@dvmkit/sdk 0.1.0-rc.3 → 0.1.0-rc.5

package/dist/internal/index.d.ts

@@ -1,16 +1,16 @@
-import { L as LightningBackend, a as LightningPayment, b as LightningWalletInfo, C as CreatedInvoice, I as InvoiceStatus, A as AccumulatorPool, c as LockPubkey, d as AccumulatorQuerier, e as ConsumedCredentialStore } from '../credit-menu-DONAtGVf.js';
-export { f as AppEnv, g as AttestationPayload, B as BuilderIdentityKeypair, h as CheckMintHealthOptions, i as CreditFundingReport, F as FiatDenomination, j as FiatDenominationFailure, k as FundOnlyRequest, l as IncomingPaymentOpts, J as JobCancelledError, M as MintHealthCheckResult, m as MintHealthTracker, P as PAYMENT_PROOF_KEYS, n as PaymentErrorCode, o as PaymentErrorDetail, p as PaymentInfo, R as ReporterBannerOpts, q as ResolvedFx, r as RevenueBootCheckOpts, S as SDKServerOpts, s as ServerJob, t as ShortPayForfeit, T as TempoChannelReport, u as TempoObserverHealth, v as TempoSessionChannelMismatchError, U as UpfrontPaymentOpts, V as VerifiedIncomingPayment, w as VerifyIncomingSnapshot, X as X402BatchChannelObservation, x as X402FacilitatorHealth, y as X402SettlementEvidenceOutcome, z as X402SettlementRepair, D as X402SettlementRepairRefusal, E as X402SettlementRepaired, G as X402WedgedSettlement, H as X402WedgedSettlementPage, K as X402_BATCH_SETTLEMENT_MAINNET_NETWORK, N as abortJob, O as applyPaymentInfoToJob, Q as assertRevenueReporterReady, W as buildAttestation, Y as buildPaymentErrorResponse, Z as canSwap, _ as checkMintHealth, $ as clearAccumulatorForDvm, a0 as createDVMServer, a1 as creditDepositPayload, a2 as derivedFundCreditId, a3 as devModeSkipsPaymentVerification, a4 as fromJobRecord, a5 as fundedMicroFor, a6 as generateIdentity, a7 as hasPaymentProof, a8 as hashCapabilities, a9 as hashLockKey, aa as implicitCreditId, ab as initWalletAccumulatorTable, ac as insertAccumulatorRows, ad as isDerivedCreditId, ae as isTerminal, af as isYieldMessage, ag as issueUpfrontChallenges, ah as loadIdentitySecret, ai as lockPubkeyStoreToLockPubkey, aj as msatsToFiatMicro, ak as paymentErrorBody, al as pinAskFiat, am as priceFiatMicro, an as processIncomingPayment, ao as providerMessage, ap as repairX402ExactSettlementEffect, aq as resolveFxSnapshot, ar as resolvePriceFiat, as as revenueReporterBannerState, at as signAttestation, au as toCreditTerms, av as toJobRecord, ai as toLockPubkey, aw as unknownRouteNotFound, ax as verifyAttestation, ay as verifyIncomingPayment, az as verifyTempoSessionManagementCredential, aA as verifyUpfrontPayment, aB as writeIdentity, aC as x402RequiredUsdcMicro, aD as x402SettledShare } from '../credit-menu-DONAtGVf.js';
+import { L as LightningBackend, a as LightningPayment, b as LightningWalletInfo, C as CreatedInvoice, I as InvoiceStatus, A as AccumulatorPool, c as LockPubkey, d as AccumulatorQuerier, e as ConsumedCredentialStore } from '../credit-menu-ClA1JyYW.js';
+export { f as AppEnv, g as AttestationPayload, B as BuilderIdentityKeypair, h as CheckMintHealthOptions, i as CreditFundingReport, F as FiatDenomination, j as FiatDenominationFailure, k as FundOnlyRequest, l as IncomingPaymentOpts, J as JobCancelledError, M as MintHealthCheckResult, m as MintHealthTracker, P as PAYMENT_PROOF_KEYS, n as PaymentErrorCode, o as PaymentErrorDetail, p as PaymentInfo, R as ReporterBannerOpts, q as ResolvedFx, r as RevenueBootCheckOpts, S as SDKServerOpts, s as ServerJob, t as ShortPayForfeit, T as TempoChannelReport, u as TempoObserverHealth, v as TempoSessionChannelMismatchError, U as UpfrontPaymentOpts, V as VerifiedIncomingPayment, w as VerifyIncomingSnapshot, X as X402BatchChannelObservation, x as X402FacilitatorHealth, y as X402SettlementEvidenceOutcome, z as X402SettlementRepair, D as X402SettlementRepairRefusal, E as X402SettlementRepaired, G as X402WedgedSettlement, H as X402WedgedSettlementPage, K as X402_BATCH_SETTLEMENT_MAINNET_NETWORK, N as abortJob, O as applyPaymentInfoToJob, Q as assertRevenueReporterReady, W as buildAttestation, Y as buildPaymentErrorResponse, Z as canSwap, _ as checkMintHealth, $ as clearAccumulatorForDvm, a0 as createDVMServer, a1 as creditDepositPayload, a2 as derivedFundCreditId, a3 as devModeSkipsPaymentVerification, a4 as fromJobRecord, a5 as fundedMicroFor, a6 as generateIdentity, a7 as hasPaymentProof, a8 as hashCapabilities, a9 as hashLockKey, aa as implicitCreditId, ab as initWalletAccumulatorTable, ac as insertAccumulatorRows, ad as isDerivedCreditId, ae as isTerminal, af as isYieldMessage, ag as issueUpfrontChallenges, ah as loadIdentitySecret, ai as lockPubkeyStoreToLockPubkey, aj as msatsToFiatMicro, ak as paymentErrorBody, al as pinAskFiat, am as priceFiatMicro, an as processIncomingPayment, ao as providerMessage, ap as repairX402ExactSettlementEffect, aq as resolveFxSnapshot, ar as resolvePriceFiat, as as revenueReporterBannerState, at as signAttestation, au as toCreditTerms, av as toJobRecord, ai as toLockPubkey, aw as unknownRouteNotFound, ax as verifyAttestation, ay as verifyIncomingPayment, az as verifyTempoSessionManagementCredential, aA as verifyUpfrontPayment, aB as writeIdentity, aC as x402RequiredUsdcMicro, aD as x402SettledShare } from '../credit-menu-ClA1JyYW.js';
 import { ProofLike, MeltQuoteBolt11Response, Proof, Wallet, SerializedDLEQ, MintQuoteBolt11Response, MintPreview, OutputDataLike } from '@cashu/cashu-ts';
-import { X as JsonValue, B as SignedRequestDomain, M as SignedRequestStatementHeader, Y as FundingReceipt, _ as JobReceipt$1, z as SignedRequestAudience, $ as PaymentRequired, a0 as X402Version, a1 as MppxCredential, a2 as Message, a3 as MessageType, a4 as MppxChallenge, a5 as X402_BATCH_SETTLEMENT_SCHEME, a6 as X402_EXACT_SCHEME, C as Currency, a7 as X402Wallet, a8 as X402Config, a9 as X402ExactVersionSupport, aa as X402Receipt, L as Logger$1, ab as TransactionalPayoutHook, ac as CashuMeltCompleted, K as KVStore } from '../job-store-m2pYmvbr.js';
-export { ad as BuildPaymentRequirementsOpts, ae as CapabilityDescriptor, af as CashuMode, ag as CreditDepositPayload, ah as DrainReceipt, ai as DrainReceiptEvent, aj as ExactEvmPayload, ak as ExactEvmPayloadAuthorization, al as FundingLot, am as FundingMethod, an as LotDebit, ao as LotDepletion, ap as MppxServer, aq as NON_CHANNEL_BITCOIN_RAILS, ar as NonChannelBitcoinRail, as as OutgoingMessage, at as PaymentPayload, au as PaymentPayloadV1, av as PaymentPayloadV2, aw as PaymentRequiredV2, ax as PaymentRequirements, ay as PaymentRequirementsV1, az as PaymentRequirementsV2, aA as PayoutReporter, aB as PostgresTempoSessionStore, aC as RAIL_REFUNDABLE, aD as ReceiptCredit, aE as ReceiptOutcome, aF as ReceiptPayment, aG as ResourceInfo, aH as RevenueReporter, aI as SIGNED_ENVELOPE_FIELDS, aJ as SIGNED_ENVELOPE_TYPES, aK as SettleResponse, aL as StaleJobReapable, aM as StepCache, aN as StepRecord, aO as UnsignedDrainReceipt, aP as UnsignedFundingReceipt, aQ as UnsignedJobReceipt, aR as VerifyResponse, aS as X402ResponseBody, aT as X402SelfRelayRpcFailureReason, aU as X402TrackedChannel, aV as X402_DEFAULT_NETWORK, aW as X402_V1_VERSION, aX as X402_VERSION, aY as _testing, aZ as buildPaymentRequiredV2, a_ as buildPaymentRequirements, a$ as caip2ToX402Network, b0 as canonicaliseForSigning, b1 as canonicalize, b2 as chainIdFromCaip2, b3 as computeResultHash, b4 as createDefaultReplayStore, b5 as decodePayment, b6 as decodePaymentRequiredHeader, b7 as depleteLots, b8 as encodePayment, b9 as encodePaymentRequiredHeader, ba as encodeSettleResponseHeader, bb as exactEvmAuthorization, bc as fifoOrder, bd as inKindDrawMsats, be as isArtifactMessage, bf as isDrainReceipt, bg as isFundingReceipt, bh as isInKindDepletion, bi as isNonChannelBitcoinRail, bj as isPaymentRequestMessage, bk as isSignedJobReceipt, bl as isStaleJobReapable, bm as lotOwedSats, bn as netOwedSats, bo as paymentRequiredV2FromV1, bp as settleWithFacilitator, bq as signDrainReceipt, br as signFundingReceipt, bs as signReceipt, bt as usdcContractByCaip2, bu as usdcContractFor, bv as usdcDomainNameFor, bw as usdcDomainVersionFor, bx as verifyDrainReceipt, by as verifyFundingReceipt, bz as verifyReceipt, bA as verifyWithFacilitator, bB as wrapMppx, bC as x402NetworkToCaip2 } from '../job-store-m2pYmvbr.js';
+import { X as JsonValue, B as SignedRequestDomain, M as SignedRequestStatementHeader, Y as FundingReceipt, _ as JobReceipt$1, z as SignedRequestAudience, $ as PaymentRequired, a0 as X402Version, a1 as MppxCredential, a2 as Message, a3 as MessageType, a4 as MppxChallenge, a5 as X402_BATCH_SETTLEMENT_SCHEME, a6 as X402_EXACT_SCHEME, C as Currency, a7 as X402Wallet, a8 as X402Config, a9 as X402ExactVersionSupport, aa as X402Receipt, L as Logger$1, ab as TransactionalPayoutHook, ac as CashuMeltCompleted, K as KVStore } from '../job-store-DxFqDPYq.js';
+export { ad as BuildPaymentRequirementsOpts, ae as CapabilityDescriptor, af as CashuMode, ag as CreditDepositPayload, ah as DrainReceipt, ai as DrainReceiptEvent, aj as ExactEvmPayload, ak as ExactEvmPayloadAuthorization, al as FundingLot, am as FundingMethod, an as LotDebit, ao as LotDepletion, ap as MppxServer, aq as NON_CHANNEL_BITCOIN_RAILS, ar as NonChannelBitcoinRail, as as OutgoingMessage, at as PaymentPayload, au as PaymentPayloadV1, av as PaymentPayloadV2, aw as PaymentRequiredV2, ax as PaymentRequirements, ay as PaymentRequirementsV1, az as PaymentRequirementsV2, aA as PayoutReporter, aB as PostgresTempoSessionStore, aC as RAIL_REFUNDABLE, aD as ReceiptCredit, aE as ReceiptOutcome, aF as ReceiptPayment, aG as ResourceInfo, aH as RevenueReporter, aI as SIGNED_ENVELOPE_FIELDS, aJ as SIGNED_ENVELOPE_TYPES, aK as SettleResponse, aL as StaleJobReapable, aM as StepCache, aN as StepRecord, aO as UnsignedDrainReceipt, aP as UnsignedFundingReceipt, aQ as UnsignedJobReceipt, aR as VerifyResponse, aS as X402ResponseBody, aT as X402SelfRelayRpcFailureReason, aU as X402TrackedChannel, aV as X402_DEFAULT_NETWORK, aW as X402_V1_VERSION, aX as X402_VERSION, aY as _testing, aZ as buildPaymentRequiredV2, a_ as buildPaymentRequirements, a$ as caip2ToX402Network, b0 as canonicaliseForSigning, b1 as canonicalize, b2 as chainIdFromCaip2, b3 as computeResultHash, b4 as createDefaultReplayStore, b5 as decodePayment, b6 as decodePaymentRequiredHeader, b7 as depleteLots, b8 as encodePayment, b9 as encodePaymentRequiredHeader, ba as encodeSettleResponseHeader, bb as exactEvmAuthorization, bc as fifoOrder, bd as inKindDrawMsats, be as isArtifactMessage, bf as isDrainReceipt, bg as isFundingReceipt, bh as isInKindDepletion, bi as isNonChannelBitcoinRail, bj as isPaymentRequestMessage, bk as isPromptMessage, bl as isSignedJobReceipt, bm as isStaleJobReapable, bn as lotOwedSats, bo as netOwedSats, bp as paymentRequiredV2FromV1, bq as settleWithFacilitator, br as signDrainReceipt, bs as signFundingReceipt, bt as signReceipt, bu as usdcContractByCaip2, bv as usdcContractFor, bw as usdcDomainNameFor, bx as usdcDomainVersionFor, by as verifyDrainReceipt, bz as verifyFundingReceipt, bA as verifyReceipt, bB as verifyWithFacilitator, bC as wrapMppx, bD as x402NetworkToCaip2 } from '../job-store-DxFqDPYq.js';
 import { SimplePool } from 'nostr-tools/pool';
 import { Session } from 'mppx/tempo';
 import { Pool } from 'pg';
 export { Pool } from 'pg';
 import { PaymentRequired as PaymentRequired$1 } from '@x402/core/types';
 import { ClientChannelStorage, BatchSettlementClientContext, BatchSettlementEvmScheme } from '@x402/evm/batch-settlement/client';
-export { e as FX_CACHE_TTL_MS, g as FX_RETRY_COUNT, w as warmFxSnapshot } from '../fx-Bq4cvn16.js';
-export { c as InvalidUsdPriceError, p as parseUsdPrice } from '../usd-DjVAPMlf.js';
+export { e as FX_CACHE_TTL_MS, g as FX_RETRY_COUNT, w as warmFxSnapshot } from '../fx-ptKVFOwq.js';
+export { c as InvalidUsdPriceError, p as parseUsdPrice } from '../usd-Cha_j80I.js';
 import { Hono } from 'hono';
 import { Env, BlankSchema } from 'hono/types';
 import { Store } from 'mppx';
@@ -103,7 +103,46 @@ interface BudgetLedger {
 }
 /** Load the persisted ledger. Returns an empty ledger if the file is missing or corrupt. */
 declare function loadLedger(): BudgetLedger;
+interface RecordSpendOptions {
+    msats: number;
+    principalMsats?: number;
+    routingFeeMsats?: number | null;
+    walletDebitMsats?: number | null;
+    btcRate: number;
+    /** Outflow kind. Defaults to `job`. */
+    kind?: BudgetSpendKind;
+    jobId: string;
+    providerEndpoint: string;
+    /** Optional short context label — see {@link BudgetLedgerEntry.label}. */
+    label?: string;
+    /** Set to `"provider"` when {@link label} is provider-supplied free text. */
+    labelSource?: "provider";
+    now?: Date;
+}
+/** Append a confirmed spend to the ledger. */
+declare function recordSpend(opts: RecordSpendOptions): void;
+/**
+ * Enforce the global budget caps before a planned spend.
+ * - If any cap is set, resolves the BTC/USD rate, runs the check, and throws `DvmError("budget_exceeded")` on overflow.
+ * - If no cap is set, attempts a best-effort rate resolution for ledger recording (tolerates failure).
+ *
+ * A rate-provider outage degrades to the last-known cached rate on both branches
+ * (internal-review) — a stale rate still enforces caps roughly right, where a hard failure
+ * blocked every spend on the branch every default install takes. With caps set and
+ * *no* rate at all, `resolveBtcUsdRate` throws `DvmError("rate_unavailable")` and the
+ * spend is blocked: an unpriceable spend can't be cap-checked, and recording it as $0
+ * would corrupt future cap enforcement.
+ *
+ * Returns the resolved BTC/USD rate to thread into the post-payment `recordSpend` call so the
+ * pre-check and the debit use a single rate.
+ */
+declare function enforceGlobalBudget(opts: {
+    plannedMsats: number;
+    btcRate?: number;
+}): Promise<number>;
 
+/** Stable response code for unavailable database-backed admin signer state. */
+declare const ADMIN_STATE_UNAVAILABLE = "admin_state_unavailable";
 /**
  * Build the canonical 32-byte challenge that an `Authorization: P2PK …`
  * admin header is signed over. Bind `method || path || dvm_id` so a `GET`
@@ -118,6 +157,35 @@ declare function buildAdminChallenge(args: {
     nonceHex: string;
     unixSeconds: number | string;
 }): Uint8Array;
+/** Parsed components of an `Authorization: P2PK <nonce>.<unix>.<sig>` header. */
+interface AdminAuthHeader {
+    /** Full header value, ready to drop into `Authorization`. */
+    header: string;
+    /** 16-byte hex nonce — exposed so callers/tests can introspect it. */
+    nonceHex: string;
+    /** Request timestamp in unix seconds — exposed for the same reason. */
+    unixSeconds: number;
+}
+/**
+ * Build a signed `Authorization: P2PK <nonce>.<unix>.<sig>` header for a
+ * dvmkit admin request. The CLI calls this once per request; the
+ * `nonceHex` + `unixSeconds` are returned so tests can replay them through
+ * `buildAdminChallenge` to verify the signed payload.
+ *
+ * The privkey must be the per-DVM lock privkey derived via
+ * `deriveBuilderLockKeypair` — the same key the DVM advertises on
+ * `/v1/info.cashu.lock_pubkeys[0]`.
+ */
+declare function buildAdminAuthHeader(args: {
+    method: string;
+    path: string;
+    dvmId: string;
+    privkeyHex: string;
+    /** Test seam — defaults to `Date.now`. */
+    now?: () => number;
+    /** Test seam — defaults to `crypto.randomBytes(16)`. */
+    randomNonce?: () => Uint8Array;
+}): AdminAuthHeader;
 
 /**
  * Derived per-DVM builder lock keypair. Both halves are hex; the privkey is 32
@@ -380,6 +448,8 @@ declare class DvmError extends Error {
 }
 /** Identify provider-authored prose present on one or more remote error objects. */
 declare function providerProseSources(...sources: (Partial<Record<DvmErrorProseField, unknown>> | undefined)[]): DvmErrorProseSources | undefined;
+/** Detect fetch AbortError / TimeoutError — the two names browsers and Node use for signal-aborted requests. */
+declare function isAbortError(err: unknown): boolean;
 /** Return the first safe Node/undici transport code found on an error or its causes. */
 declare function transportErrorCode(err: unknown): string | undefined;
 
@@ -2744,6 +2814,84 @@ interface DvmLocated {
      */
     attestedBuilderPubkey?: string;
 }
+/**
+ * The unretired drain requested against one specific credit, if any.
+ *
+ * Strict on the stamp: an entry belonging to another credit — or to no credit
+ * we can name (written before the stamp existed) — is not this credit's drain,
+ * and re-posting its id here would open a fresh drain server-side rather than
+ * poll the one that is owed (internal-review).
+ */
+declare function pendingDrainFor(record: StoredCredit | undefined, creditId: string): PendingDrain | undefined;
+/**
+ * Load the record for one credit, or undefined when none is tracked.
+ *
+ * Locked despite reading like a lookup: learning a new `dvmId` or hostname
+ * alias rewrites the file (internal-review), and so does the legacy-duplicate
+ * collapse inside {@link loadStore}.
+ */
+declare function loadCredit(endpoint: string, callerPubkey: string, identity?: AttestedDvmIdentity): StoredCredit | undefined;
+/**
+ * Ensure a record exists for a credit whose fund leg was just accepted on
+ * `/v1/job` (fund-and-draw, internal-review). The exact credited amount is the
+ * server's call (pro-rata at its fx), so the record is marked
+ * {@link StoredCredit.provisional} until the countersigned receipt or a
+ * fund/balance response adopts the real figures.
+ */
+declare function ensureProvisionalCredit(args: {
+    endpoint: string;
+    identity?: AttestedDvmIdentity;
+    callerPubkey: string;
+    creditId: string;
+    currency: string;
+    targetMicro: number;
+    menu?: CreditMenu;
+    now?: number;
+}): void;
+/**
+ * Adopt the x402 binding a refusal named onto the tracked credit.
+ *
+ * The heal half of the pin: the local record is a copy of a server-side fact,
+ * so the server's own word replaces it rather than the other way round, and one
+ * refusal is enough — the next refill routes over the named instrument instead
+ * of signing into the same answer again.
+ *
+ * A heal that actually moves the instrument drops the recorded chain with it
+ * (internal-review), unless the caller also supplies the chain resolved from the
+ * refusal's channel id. Supplying that verified chain also fills or corrects a
+ * channel instrument that was already recorded — the instrument being equal
+ * must not make the newly learned half of its binding a no-op (internal-review).
+ */
+declare function recordCreditX402Instrument(endpoint: string, callerPubkey: string, creditId: string, instrument: X402CreditInstrument, identity?: AttestedDvmIdentity, 
+/** Channel chain learned from the channel store, when the refusal names one. */
+channelNetwork?: string): void;
+/**
+ * Persist a drain request so a re-invoked drain polls the same id.
+ *
+ * Keyed on the drain's whole `(drainId, creditId)` identity: re-recording the
+ * same drain refreshes it, and anything else is appended. Deliberately not
+ * keyed on the credit alone — an entry may be the only local pointer to a
+ * parked payout, and replacing drain A with drain B because they share a
+ * credit would drop exactly the evidence this store exists to keep.
+ *
+ * Callers own the shape readers lean on. {@link pendingDrainFor} takes the
+ * first entry stamped for a credit, so `dvm credit drain` refuses a
+ * `--drain-id` that would leave a credit holding two; a second entry can then
+ * only arrive by hand-editing, and the older one is what polls.
+ */
+declare function recordPendingDrain(endpoint: string, callerPubkey: string, drain: PendingDrain, identity?: AttestedDvmIdentity): void;
+/**
+ * Retire one drain, once it is fulfilled (or once the server has said it never
+ * existed).
+ *
+ * Matched on the drain's own `(drainId, creditId)` identity rather than on the
+ * record's current credit: reclaiming a drain stranded on a previous credit
+ * must retire exactly that entry and leave the tracked credit's own drain — and
+ * its projection — untouched. Matching the id alone would also work for every
+ * entry this CLI writes, but an unstamped legacy entry can only be named this
+ * way, and it needs a retirement path too.
+ */
+declare function clearPendingDrain(endpoint: string, callerPubkey: string, drain: Pick<PendingDrain, "drainId" | "creditId">, identity?: AttestedDvmIdentity): void;
 
 /**
  * Durable, append-only store for the DVM-signed receipts this caller has
@@ -3151,6 +3299,11 @@ interface CoinGeckoSpot {
     usdc_usd: number;
     as_of: string;
 }
+/** Bitcoin-only spot snapshot. Counterpart to {@link CoinGeckoSpot}. */
+interface CoinGeckoBtcSpot {
+    btc_usd: number;
+    as_of: string;
+}
 /**
  * One raw call to CoinGecko's `simple/price` endpoint for **both** BTC and
  * USDC. No cache, no retry — callers wrap with their own. Use
@@ -3158,6 +3311,12 @@ interface CoinGeckoSpot {
  * variant throws if upstream returns a degraded `usd-coin.usd`.
  */
 declare function fetchCoinGeckoSpot(opts?: CoinGeckoFetchOptions): Promise<CoinGeckoSpot>;
+/**
+ * One raw call to CoinGecko's `simple/price` endpoint for **BTC only**. No
+ * cache, no retry. Hits the bitcoin-only URL by default — narrower upstream
+ * surface, and a malformed `usd-coin.usd` cannot break this caller.
+ */
+declare function fetchCoinGeckoBtcUsd(opts?: CoinGeckoFetchOptions): Promise<CoinGeckoBtcSpot>;
 
 /** Parsed components of a Lightning address (user@domain). */
 interface LnAddressParts {
@@ -5286,6 +5445,8 @@ declare function currentContext(service?: string): TraceContext;
  */
 declare function pinDimension(key: string, value: unknown): void;
 
+/** Postgres NOTIFY channel fired after each successful span batch INSERT. */
+declare const SPANS_INSERTED_CHANNEL = "spans_inserted";
 /**
  * Buffered span writer. Collects SpanRow objects in memory and flushes them
  * to a transport (direct DB or HTTP POST) on a timer or threshold.
@@ -5328,6 +5489,18 @@ declare class SpanWriter {
      */
     private truncateForSize;
 }
+/**
+ * Build and execute a multi-row INSERT into observability.spans.
+ * Accepts either typed SpanRow[] or loosely-typed Record<string, unknown>[]
+ * (the HTTP ingestion endpoint validates fields before calling this).
+ */
+declare function insertSpanBatch(pool: Pool, rows: readonly Record<string, unknown>[] | readonly SpanRow[]): Promise<void>;
+/** Direct Postgres INSERT transport for platform-api and router. */
+declare class DbTransport implements SpanTransport {
+    private pool;
+    constructor(pool: Pool);
+    send(rows: SpanRow[]): Promise<void>;
+}
 
 /** Process-wide singleton loggers object, set by initLoggers(). */
 declare let loggers: Record<DatasetName, Logger>;
@@ -5742,4 +5915,60 @@ declare class MemoryKVStore implements KVStore {
  */
 declare function backupSecretFile(file: string, nextContent?: string): string | null;
 
-export { AccumulatorPool, type AgentProof, type AgentWallet, type AmountLabelOptions, type AttestedDvmIdentity, type BuilderLockKeypair, CAPABILITY_NAME_RE, COINGECKO_SIMPLE_PRICE_URL, CREDIT_DRAIN_RAILS, CREDIT_FUNDING_MODES, CREDIT_FUND_RAILS, type CachedBtcRate, type CancelOptions, type CoinGeckoSpot, CreatedInvoice, type CreditDrainRail, type CreditFundOutcome, type CreditFundRail, type CreditFundStatus, type CreditFundingMode, type CreditMenu, type CreditOpResult, type CreditRailPick, type CreditRailReason, type CreditRailSource, type CreditTerms, type CreditWire, DEFAULT_LOCK_PUBKEY_GRACE_SECONDS, type DeliveredResult, type DescribeOptions, type DrainReceiptChecks, type DrainReceiptVerifyResult, type DrainWire, DvmError, DvmX402ChannelStorage, type FundCreditArgs, FundingReceipt, type FundingReceiptChecks, type FundingReceiptVerifyResult, InvoiceStatus, type JobEnvelope, type JobPolicy, JobReceipt$1 as JobReceipt, type JobStatus, JsonValue, LightningBackend, type LightningFundingOffer, LightningPayment, type LnAddressParts, LockPubkey, type LockPubkeyPool, type LockPubkeyState, type LockPubkeyStateLoader, LockPubkey as LockPubkeyStoreLockPubkey, type MeltQuoteInfo, MemoryKVStore, Message, type MessagePollOptions, MessageType, MppxCredential, NwcBackend, type NwcConnection, NwcError, type NwcRequestOptions, type NwcTransaction, type OutboundMessage, type PayInvoiceOutcome, type PayInvoiceReconcilingOptions, type PayInvoiceResult, type PayOutcome, type Payment, PaymentRequired, type PendingX402ExactFunding, type PendingX402Funding, PostgresTempoChargeStore, type ProviderInfo, type ProviderRef, type ProviderText, type Quote, RECENT_SPENDS_CAP, ROUTER_FEEDBACK_CLAIM_HEADER, ROUTER_FEEDBACK_CLAIM_TTL_MS, type RailFlag, type ReceiptChecks, type ReceiptInvalidReason, type ReceiptKeypair, type ReceiptParseError, type ReceiptTrustAnchor, type ReceiptVerification, type ReceiptVerifyResult, STABLECOIN_FUND_RAILS, SUPPORTED_PROTOCOL_VERSION, type SelectError, type SendMessageOptions, type SpanRow, type SpanTransport, type StatusOptions, type StoredX402ChannelConfig, type StoredX402ChannelMetadata, type StreamOptions, type StreamResult, type SubmitOptions, TEMPO_CHAIN_ID, TEMPO_CLOSE_DB_RECOVERY_BUDGET_MS, TEMPO_CLOSE_REQUESTED_TOPIC, type Transport, type JobReceipt as TransportJobReceipt, type V1InfoCapability, type V1InfoResponse, type VerifyJobReceiptArgs, type WalletInfo, type X402Balance, type X402BatchPayment, type X402ChannelReconciliation, X402Config, type X402ConnectedWallet, X402EnvValidationError, type X402Network, type X402RefundArgs, type X402RefundOutcome, type X402RepinnedWallet, type X402UnobservedBalanceProvenance, X402Version, X402_BATCH_CHANNEL_ABI, X402_BATCH_SETTLEMENT_KEY, X402_BATCH_SETTLEMENT_SCHEME, X402_DEFAULT_FACILITATOR, X402_EXACT_AUTHORIZATION_TTL_SECONDS, X402_EXACT_SCHEME, X402_NETWORKS, X402_PENDING_STALE_MS, X402_RECEIVER_AUTHORIZER_KEY, X402_REFUSAL_TRANSACTION_DISCOVERY_WINDOW_MS, X402_RPC_URL_KEY, X402_SELF_RELAY_KEY, acknowledgeReplayedX402Payment, acknowledgeX402ChannelOwner, activePubkeySet, applyRetryToPool, asProviderText, assertSupportedX402Network, assertValidBudget, assertX402RequirementDescribesChannel, attestedDvmIdentity, authenticatedBuilderPubkey, availableRails, backupSecretFile, buildAdminChallenge, buildTempoCredential, builderLockPath, canReplaceExpiredX402Deposit, cashuSubmissionBindingFingerprint, checkMeltQuoteState, checkReceiptAttestation, clearPendingX402ExactFunding, clearPendingX402Funding, computeSmartDenominations, connectedX402Payer, costAnchor, createAdminCashuNonceStore, createInstrumentedFetch, createMonotonicClock, createNoopLogger, createStdoutLogger, createX402BatchPayment, currentContext, deriveBuilderLockKeypair, deriveBuilderLockPubkey, deriveReceiptKeypair, deriveReceiptSecret, drainReceiptsDisplay, drainReceiptsHint, ensureAddress, epochMsToIso, fetchBtcUsdRate, fetchCoinGeckoSpot, fetchLnurlPayInvoice, fetchMeltQuote, findX402Channel, formatAmount, formatAmountBestEffort, formatPaymentAmount, formatSats, formatStaleness, formatUsd, formatUsdcMicrounits, fundCredit, fundingModeForTempoIntent, fundingModeForX402Flavour, generateEphemeralReceiptKey, generateX402PrivateKey, getBalance, getInfo, getInputFeesForProofs, getLastKnownBtcRate, getWallet, getX402Balance, hashedCanonicalDvmId, humanizeZodError, initLockPubkeyTable, initLoggers, installAdminCashuRoutes, isCreditFundRail, isCreditFundingMode, isStablecoinFundRail, issueRouterFeedbackClaim, jobCredentialGate, listPendingX402Fundings, listPendingX402FundingsForChannel, listResumableX402ExactFundings, listResumableX402Fundings, listTempoChannelAssociations, listX402Channels, loadAgentWallet, loadConfiguredMints, loadLedger, loadLockPubkeyState, loadResumableX402ExactFunding, loadResumableX402Funding, loadTempoChannelEntry, loadX402Wallet, loggers, lookupInvoice, makeInvoice, maxKeysetDenomination, missingDleqRecoveryDiagnostic, monetaryJson, msatsToUsd, msatsToUsdCents, msatsToUsdc, normalizeFeedbackEndpointHost, nwcDedupWindowMs, nwcTimeoutMs, offersX402CreditFunding, parseBudget, parseCreditMenu, parseCreditTerms, parseLnAddress, parseNwcUri, payInvoiceReconciling, pickCreditFundRail, pinDimension, planCreditForQuote, pollPendingCreditFundings, preferLightningFirst, prepareP2PKMint, processX402BatchCorrection, processX402BatchResponse, processX402BatchResponseForWallet, providerProseSources, providerTextToString, pruneRetired, randomTraceId, rateUnavailablePaymentError, receiptDisplay, receiptFailureDetail, receiptHint, receiptIssuedAtIso, receiptPubkeyFromSecret, reconcileRefusedX402Deposits, recordPendingX402ExactFunding, recordPendingX402Funding, recordX402ChannelMetadata, refundX402BatchChannel, removeX402Wallet, repinX402WalletNetwork, resolveLnurlPayMetadataUrl, resolveRpcHttpTransportOptions, resolveRpcOverride, restoreProofsFromOutputs, retirePendingX402Funding, rotateLockPubkey, saveAgentWallet, saveX402Wallet, seedLockPubkeyState, selectProofsForSpend, serializeOutputData, setEmitter, signDvmRequestData, signRequestData, signedRequestDomain, swapFeeForProofs, swapSendReserve, tempoCredentialAmountMicro, transportErrorCode, usdToMsats, usdcToMsats, validateLnAddress, validateX402Env, verifyCanonicalSignedRequest, verifyDrainReceiptChain, verifyFundingReceiptChain, verifyJobReceipt, verifyRouterFeedbackClaim, verifyX402Payment, weakestReceiptVerdict, withInitRetry, withNwcPool, withTraceContext, withWalletLock, withX402ChannelLock, x402ChannelBalanceUnreconciledAt, x402ExactFundingDead, x402NetworkByCaip2, x402NetworkBySlug, x402NetworkLabel, x402NetworkListForCopy, x402PendingBlockExpiresAt, x402PendingDepositExpiresAt, x402PendingFundingJson, x402PendingRetired, x402PendingStale, x402PendingUnsettled, x402RequiredFromError, x402SupportedNetworksHint, x402VoucherPendingRefusal };
+/**
+ * The caller-facing rail vocabulary: one noun per rail, in three registers.
+ *
+ * `fundingRailLabel` is the table. `paymentRailLabel` and `probeRailLabel` are
+ * registers of it rather than parallel copies, so a caller crossing between
+ * `dvm wallet`, `dvm doctor`, `dvm quote`, `dvm pay` and `dvm credit` is told
+ * about one thing per rail rather than three (internal-review).
+ *
+ * **Rail-choice menus are the one caller-facing surface that deliberately does
+ * not read from here.** `dvm wallet setup`'s onramp titles and the NWC float
+ * row beside them — both in the caller CLI, which lives in its own repository —
+ * lead with the protocol name — `Cashu — Bitcoin / Lightning`, not
+ * `ecash — Bitcoin / Lightning` — because at the moment of choosing, the
+ * protocol name *is* the information: it's what identifies the row to someone
+ * who already holds that money, and it's the literal `--rail` value they type
+ * next. internal-review wrote that
+ * carve-out into the payment-language rule — a caller meets protocol terms
+ * "only when choosing a rail, troubleshooting, or managing custody and exits"
+ * — and internal-review settled that the onramp titles fall under it.
+ *
+ * Those titles carry the plain language in their second half, after the dash:
+ * `<protocol name> — <what the money is>`. Everything downstream of the choice
+ * — a balance, a quote, a credit row, a diagnosis — glosses from this file.
+ * `__tests__/rail-naming-contract.ts` holds both registers as literals, so
+ * neither can drift into the other silently.
+ */
+
+/**
+ * Human wording for every funding rail, exhaustive over the rail registry, so
+ * adding a rail to `CREDIT_FUND_RAILS` is a compile error here by design.
+ *
+ * Rail keys are wire and config identifiers: `cashu`, `cashu_p2pk` and `tempo`
+ * are protocol and locking-scheme names rather than things a human recognizes
+ * owning. Prose that a human reads gets the gloss; the raw key stays in the
+ * machine fields beside it.
+ *
+ * This is the single table every caller-facing surface reads (internal-review). The
+ * twins below are registers of it, not parallel copies — `dvm wallet`,
+ * `dvm doctor`, `dvm quote`, `dvm pay` and `dvm credit` all land on one noun
+ * per rail, so a caller crossing between commands isn't told about three
+ * different things.
+ */
+declare function fundingRailLabel(rail: CreditFundRail): string;
+
+/** Quote one argument for safe copy/paste into a POSIX shell command. */
+declare function shellQuoteArg(value: string): string;
+
+/**
+ * Verify a BIP-340 Schnorr signature against a 32-byte challenge and a
+ * compressed (33-byte, `02`/`03` prefix) or x-only (32-byte) public key.
+ * Compressed inputs have their parity byte dropped — BIP-340 keys are
+ * x-only — and the y-coordinate is recomputed inside cashu-ts when
+ * needed.
+ */
+declare function verifyChallenge(pubkeyHex: string, challenge: Uint8Array, sigHex: string): boolean;
+
+export { ADMIN_STATE_UNAVAILABLE, AccumulatorPool, type AgentProof, type AgentWallet, type AmountLabelOptions, type AttestedDvmIdentity, type BuilderLockKeypair, CAPABILITY_NAME_RE, COINGECKO_SIMPLE_PRICE_URL, CREDIT_DRAIN_RAILS, CREDIT_FUNDING_MODES, CREDIT_FUND_RAILS, type CachedBtcRate, type CancelOptions, type CoinGeckoBtcSpot, type CoinGeckoSpot, CreatedInvoice, type CreditDrainRail, type CreditFundOutcome, type CreditFundRail, type CreditFundStatus, type CreditFundingMode, type CreditMenu, type CreditOpResult, type CreditRailPick, type CreditRailReason, type CreditRailSource, type CreditTerms, type CreditWire, DEFAULT_LOCK_PUBKEY_GRACE_SECONDS, DbTransport, type DeliveredResult, type DescribeOptions, type DrainReceiptChecks, type DrainReceiptVerifyResult, type DrainWire, type DrawCeilingSource, type DrawSkip, DvmError, DvmX402ChannelStorage, type FundCreditArgs, FundingReceipt, type FundingReceiptChecks, type FundingReceiptVerifyResult, InvoiceStatus, type JobEnvelope, type JobPolicy, JobReceipt$1 as JobReceipt, type JobStatus, JsonValue, LightningBackend, type LightningFundingOffer, LightningPayment, LightningWalletInfo, type LnAddressParts, LockPubkey, type LockPubkeyPool, type LockPubkeyState, type LockPubkeyStateLoader, LockPubkey as LockPubkeyStoreLockPubkey, type MeltQuoteInfo, MemoryKVStore, Message, type MessagePollOptions, MessageType, MppxChallenge, MppxCredential, NwcBackend, type NwcConnection, NwcError, type NwcRequestOptions, type NwcTransaction, type OutboundMessage, type PayInvoiceOutcome, type PayInvoiceReconcilingOptions, type PayInvoiceResult, type PayOutcome, type Payment, PaymentRequired, type PendingX402ExactFunding, type PendingX402Funding, type PersistedOutputData, PostgresTempoChargeStore, type ProviderInfo, type ProviderRef, type ProviderText, type Quote, RECENT_SPENDS_CAP, ROUTER_FEEDBACK_CLAIM_HEADER, ROUTER_FEEDBACK_CLAIM_TTL_MS, type RailFlag, type ReceiptChecks, type ReceiptInvalidReason, type ReceiptKeypair, type ReceiptParseError, type ReceiptTrustAnchor, type ReceiptVerification, type ReceiptVerifyResult, SPANS_INSERTED_CHANNEL, STABLECOIN_FUND_RAILS, SUPPORTED_PROTOCOL_VERSION, type SelectError, type SendMessageOptions, type SpanRow, type SpanTransport, SpanWriter, type StatusOptions, type StoredCredit, type StoredX402ChannelConfig, type StoredX402ChannelMetadata, type StreamOptions, type StreamResult, type SubmitOptions, type SuppressedPurchase, TEMPO_CHAIN_ID, TEMPO_CLOSE_DB_RECOVERY_BUDGET_MS, TEMPO_CLOSE_REQUESTED_TOPIC, type Transport, type JobReceipt as TransportJobReceipt, type V1InfoCapability, type V1InfoResponse, type VerifyJobReceiptArgs, type WalletInfo, type X402Balance, type X402BatchPayment, type X402ChannelReconciliation, X402Config, type X402ConnectedWallet, type X402CreditFlavour, type X402CreditInstrument, X402EnvValidationError, type X402Network, type X402RefundArgs, type X402RefundOutcome, type X402RepinnedWallet, type X402UnobservedBalanceProvenance, X402Version, X402_BATCH_CHANNEL_ABI, X402_BATCH_SETTLEMENT_KEY, X402_BATCH_SETTLEMENT_SCHEME, X402_DEFAULT_FACILITATOR, X402_EXACT_AUTHORIZATION_TTL_SECONDS, X402_EXACT_SCHEME, X402_NETWORKS, X402_PENDING_STALE_MS, X402_RECEIVER_AUTHORIZER_KEY, X402_REFUSAL_TRANSACTION_DISCOVERY_WINDOW_MS, X402_RPC_URL_KEY, X402_SELF_RELAY_KEY, acknowledgeReplayedX402Payment, acknowledgeX402ChannelOwner, activePubkeySet, applyRetryToPool, asProviderText, assertSupportedX402Network, assertValidBudget, assertX402RequirementDescribesChannel, attestedDvmIdentity, authenticatedBuilderPubkey, availableRails, backupSecretFile, buildAdminAuthHeader, buildAdminChallenge, buildTempoCredential, builderLockPath, canReplaceExpiredX402Deposit, cashuSubmissionBindingFingerprint, checkMeltQuoteState, checkReceiptAttestation, clearPendingDrain, clearPendingX402ExactFunding, clearPendingX402Funding, computeSmartDenominations, connectedX402Payer, costAnchor, createAdminCashuNonceStore, createInstrumentedFetch, createMonotonicClock, createNoopLogger, createStdoutLogger, createX402BatchPayment, currentContext, deriveBuilderLockKeypair, deriveBuilderLockPubkey, deriveReceiptKeypair, deriveReceiptSecret, drainReceiptsDisplay, drainReceiptsHint, enforceGlobalBudget, ensureAddress, ensureProvisionalCredit, epochMsToIso, fetchBtcUsdRate, fetchCoinGeckoBtcUsd, fetchCoinGeckoSpot, fetchLnurlPayInvoice, fetchMeltQuote, findX402Channel, formatAmount, formatAmountBestEffort, formatPaymentAmount, formatSats, formatStaleness, formatUsd, formatUsdcMicrounits, fundCredit, fundingModeForTempoIntent, fundingModeForX402Flavour, fundingRailLabel, generateEphemeralReceiptKey, generateX402PrivateKey, getBalance, getInfo, getInputFeesForProofs, getLastKnownBtcRate, getWallet, getX402Balance, hashedCanonicalDvmId, humanizeZodError, initLockPubkeyTable, initLoggers, insertSpanBatch, installAdminCashuRoutes, isAbortError, isCreditFundRail, isCreditFundingMode, isStablecoinFundRail, issueRouterFeedbackClaim, jobCredentialGate, listPendingX402Fundings, listPendingX402FundingsForChannel, listResumableX402ExactFundings, listResumableX402Fundings, listTempoChannelAssociations, listX402Channels, loadAgentWallet, loadConfiguredMints, loadCredit, loadLedger, loadLockPubkeyState, loadResumableX402ExactFunding, loadResumableX402Funding, loadTempoChannelEntry, loadX402Wallet, loggers, lookupInvoice, makeInvoice, maxKeysetDenomination, missingDleqRecoveryDiagnostic, monetaryJson, msatsToUsd, msatsToUsdCents, msatsToUsdc, normalizeFeedbackEndpointHost, nwcDedupWindowMs, nwcTimeoutMs, offersX402CreditFunding, parseBudget, parseCreditMenu, parseCreditTerms, parseLnAddress, parseNwcUri, payInvoiceReconciling, pendingDrainFor, pickCreditFundRail, pinDimension, planCreditForQuote, pollPendingCreditFundings, preferLightningFirst, prepareP2PKMint, processX402BatchCorrection, processX402BatchResponse, processX402BatchResponseForWallet, providerProseSources, providerTextToString, pruneRetired, randomTraceId, rateUnavailablePaymentError, receiptDisplay, receiptFailureDetail, receiptHint, receiptIssuedAtIso, receiptPubkeyFromSecret, reconcileRefusedX402Deposits, recordCreditX402Instrument, recordPendingDrain, recordPendingX402ExactFunding, recordPendingX402Funding, recordSpend, recordX402ChannelMetadata, refundX402BatchChannel, removeX402Wallet, repinX402WalletNetwork, resolveLnurlPayMetadataUrl, resolveRpcHttpTransportOptions, resolveRpcOverride, restoreProofsFromOutputs, retirePendingX402Funding, rotateLockPubkey, saveAgentWallet, saveX402Wallet, seedLockPubkeyState, selectProofsForSpend, serializeOutputData, setEmitter, shellQuoteArg, signDvmRequestData, signRequestData, signedRequestDomain, swapFeeForProofs, swapSendReserve, tempoCredentialAmountMicro, transportErrorCode, usdToMsats, usdcToMsats, validateLnAddress, validateX402Env, verifyCanonicalSignedRequest, verifyChallenge, verifyDrainReceiptChain, verifyFundingReceiptChain, verifyJobReceipt, verifyRouterFeedbackClaim, verifyX402Payment, weakestReceiptVerdict, withInitRetry, withNwcPool, withTraceContext, withWalletLock, withX402ChannelLock, x402ChannelBalanceUnreconciledAt, x402ExactFundingDead, x402NetworkByCaip2, x402NetworkBySlug, x402NetworkLabel, x402NetworkListForCopy, x402PendingBlockExpiresAt, x402PendingDepositExpiresAt, x402PendingFundingJson, x402PendingRetired, x402PendingStale, x402PendingUnsettled, x402RequiredFromError, x402SupportedNetworksHint, x402VoucherPendingRefusal };

package/dist/internal/index.js

@@ -8,6 +8,7 @@ import {
   connectedTempoAccount,
   createTempoCreditSession,
   createTempoSessionPaymentFetch,
+  fundingRailLabel,
   listResumableTempoChargeFundings,
   listTempoChannelAssociations,
   loadResumableTempoChargeFunding,
@@ -18,6 +19,7 @@ import {
   offersTempoCreditSession,
   persistTempoOpenCredential,
   recordPendingTempoChargeFunding,
+  shellQuoteArg,
   tempoChargeCredentialSettleable,
   tempoSessionAssociationByKey,
   tempoSessionChallenge,
@@ -28,7 +30,7 @@ import {
   tempoSessionPriorCumulativeMicro,
   withTempoChannelLock,
   withholdsTempoCreditSession
-} from "../chunk-YD3TZNXV.js";
+} from "../chunk-ZMZTZFRC.js";
 import {
   DvmX402ChannelStorage,
   X402_EXACT_AUTHORIZATION_TTL_SECONDS,
@@ -71,28 +73,33 @@ import {
   x402PendingRetired,
   x402PendingStale,
   x402PendingUnsettled
-} from "../chunk-RHP3BRTH.js";
+} from "../chunk-AB3L6B52.js";
 import {
   SUPPORTED_PROTOCOL_VERSION,
+  clearPendingDrain,
   clearPendingFunding,
+  ensureProvisionalCredit,
   info,
   isCreditPosture,
   isValidEvmPrivateKey,
   listPendingFundings,
   loadConfig,
+  loadCredit,
   loadCreditX402Binding,
   loadPendingFunding,
   maxAdvertisedMicro,
   normalizeCreditEndpoint,
   parseCreditMenu,
   parseCreditTerms,
+  pendingDrainFor,
   progress,
   recordCreditX402Instrument,
   recordFundResponse,
+  recordPendingDrain,
   recordPendingFunding,
   updateConfig,
   withinAdvertisedTolerance
-} from "../chunk-FT7IM66W.js";
+} from "../chunk-4KB3LTOS.js";
 import {
   RevenueReporter
 } from "../chunk-2ABMGUDS.js";
@@ -110,12 +117,16 @@ import {
   CAPABILITY_NAME_RE
 } from "../chunk-XYTSDAPH.js";
 import {
+  ADMIN_STATE_UNAVAILABLE,
   DEFAULT_LOCK_PUBKEY_GRACE_SECONDS,
+  DbTransport,
   MintHealthTracker,
   NwcBackend,
   NwcError,
   PAYMENT_PROOF_KEYS,
   RECENT_SPENDS_CAP,
+  SPANS_INSERTED_CHANNEL,
+  SpanWriter,
   TEMPO_CLOSE_DB_RECOVERY_BUDGET_MS,
   TEMPO_CLOSE_REQUESTED_TOPIC,
   TEMPO_SESSION_UPDATED_REASON,
@@ -134,6 +145,7 @@ import {
   attestedDvmIdentity,
   authenticatedBuilderPubkey,
   backupSecretFile,
+  buildAdminAuthHeader,
   buildAdminChallenge,
   buildAttestation,
   buildPaymentErrorResponse,
@@ -166,6 +178,7 @@ import {
   initLockPubkeyTable,
   initWalletAccumulatorTable,
   insertAccumulatorRows,
+  insertSpanBatch,
   installAdminCashuRoutes,
   isDerivedCreditId,
   isDrainReceipt,
@@ -212,6 +225,7 @@ import {
   unknownRouteNotFound,
   validateX402Env,
   verifyAttestation,
+  verifyChallenge,
   verifyDrainReceipt,
   verifyDrainReceiptChain,
   verifyFundingReceipt,
@@ -227,7 +241,7 @@ import {
   writeIdentity,
   x402RequiredUsdcMicro,
   x402SettledShare
-} from "../chunk-C2DC4FKR.js";
+} from "../chunk-ATQIII6K.js";
 import {
   X402_BATCH_SETTLEMENT_SCHEME,
   X402_DEFAULT_FACILITATOR,
@@ -260,7 +274,7 @@ import {
   x402NetworkListForCopy,
   x402NetworkToCaip2,
   x402SupportedNetworksHint
-} from "../chunk-XY5Y5REG.js";
+} from "../chunk-AAJNGQMC.js";
 import {
   BUDGET_FILE,
   COINGECKO_SIMPLE_PRICE_URL,
@@ -270,6 +284,7 @@ import {
   costAnchor,
   ensureConfigDir,
   fetchBtcUsdRate,
+  fetchCoinGeckoBtcUsd,
   fetchCoinGeckoSpot,
   formatAmount,
   formatAmountBestEffort,
@@ -279,6 +294,7 @@ import {
   formatUsd,
   formatUsdcMicrounits,
   getLastKnownBtcRate,
+  isAbortError,
   monetaryJson,
   msatsToUsd,
   msatsToUsdCents,
@@ -290,7 +306,7 @@ import {
   transportErrorCode,
   usdToMsats,
   usdcToMsats
-} from "../chunk-5SO7ZVOH.js";
+} from "../chunk-F2L6KIMD.js";
 import "../chunk-EXHBXA4U.js";
 import {
   RAIL_REFUNDABLE,
@@ -6033,6 +6049,9 @@ function sleep(ms) {
 }
 
 // src/lib/messages/types.ts
+function isPromptMessage(msg) {
+  return msg.type === "prompt";
+}
 function isArtifactMessage(msg) {
   return msg.type === "artifact";
 }
@@ -6048,12 +6067,14 @@ function providerTextToString(value) {
   return typeof value === "string" ? value : value.text;
 }
 export {
+  ADMIN_STATE_UNAVAILABLE,
   CAPABILITY_NAME_RE,
   COINGECKO_SIMPLE_PRICE_URL,
   CREDIT_DRAIN_RAILS,
   CREDIT_FUNDING_MODES,
   CREDIT_FUND_RAILS,
   DEFAULT_LOCK_PUBKEY_GRACE_SECONDS,
+  DbTransport,
   DvmError,
   DvmX402ChannelStorage,
   FX_CACHE_TTL_MS,
@@ -6076,8 +6097,10 @@ export {
   RevenueReporter,
   SIGNED_ENVELOPE_FIELDS,
   SIGNED_ENVELOPE_TYPES,
+  SPANS_INSERTED_CHANNEL,
   STABLECOIN_FUND_RAILS,
   SUPPORTED_PROTOCOL_VERSION,
+  SpanWriter,
   StepCache,
   TEMPO_CHAIN_ID,
   TEMPO_CLOSE_DB_RECOVERY_BUDGET_MS,
@@ -6117,6 +6140,7 @@ export {
   authenticatedBuilderPubkey,
   availableRails,
   backupSecretFile,
+  buildAdminAuthHeader,
   buildAdminChallenge,
   buildAttestation,
   buildPaymentErrorResponse,
@@ -6135,6 +6159,7 @@ export {
   checkMintHealth,
   checkReceiptAttestation,
   clearAccumulatorForDvm,
+  clearPendingDrain,
   clearPendingX402ExactFunding,
   clearPendingX402Funding,
   computeResultHash,
@@ -6165,10 +6190,13 @@ export {
   encodePayment,
   encodePaymentRequiredHeader,
   encodeSettleResponseHeader,
+  enforceGlobalBudget,
   ensureAddress,
+  ensureProvisionalCredit,
   epochMsToIso,
   exactEvmAuthorization,
   fetchBtcUsdRate,
+  fetchCoinGeckoBtcUsd,
   fetchCoinGeckoSpot,
   fetchLnurlPayInvoice,
   fetchMeltQuote,
@@ -6186,6 +6214,7 @@ export {
   fundedMicroFor,
   fundingModeForTempoIntent,
   fundingModeForX402Flavour,
+  fundingRailLabel,
   generateEphemeralReceiptKey,
   generateIdentity,
   generateX402PrivateKey,
@@ -6206,7 +6235,9 @@ export {
   initLoggers,
   initWalletAccumulatorTable,
   insertAccumulatorRows,
+  insertSpanBatch,
   installAdminCashuRoutes,
+  isAbortError,
   isArtifactMessage,
   isCreditFundRail,
   isCreditFundingMode,
@@ -6216,6 +6247,7 @@ export {
   isInKindDepletion,
   isNonChannelBitcoinRail,
   isPaymentRequestMessage,
+  isPromptMessage,
   isSignedJobReceipt,
   isStablecoinFundRail,
   isStaleJobReapable,
@@ -6232,6 +6264,7 @@ export {
   listX402Channels,
   loadAgentWallet,
   loadConfiguredMints,
+  loadCredit,
   loadIdentitySecret,
   loadLedger,
   loadLockPubkeyState,
@@ -6265,6 +6298,7 @@ export {
   payInvoiceReconciling,
   paymentErrorBody,
   paymentRequiredV2FromV1,
+  pendingDrainFor,
   pickCreditFundRail,
   pinAskFiat,
   pinDimension,
@@ -6289,8 +6323,11 @@ export {
   receiptIssuedAtIso,
   receiptPubkeyFromSecret,
   reconcileRefusedX402Deposits,
+  recordCreditX402Instrument,
+  recordPendingDrain,
   recordPendingX402ExactFunding,
   recordPendingX402Funding,
+  recordSpend,
   recordX402ChannelMetadata,
   refundX402BatchChannel,
   removeX402Wallet,
@@ -6312,6 +6349,7 @@ export {
   serializeOutputData,
   setEmitter,
   settleWithFacilitator,
+  shellQuoteArg,
   signAttestation,
   signDrainReceipt,
   signDvmRequestData,
@@ -6337,6 +6375,7 @@ export {
   validateX402Env,
   verifyAttestation,
   verifyCanonicalSignedRequest,
+  verifyChallenge,
   verifyDrainReceipt,
   verifyDrainReceiptChain,
   verifyFundingReceipt,