@dvmkit/sdk 0.1.0-rc.4 → 0.1.0-rc.6

package/dist/{chunk-2K6UXDAN.js → chunk-KSQEFVFJ.js}

@@ -1,14 +1,50 @@
 import {
-  CONFIG_AUDIT_FILE,
-  CONFIG_BACKUP_FILE,
-  CONFIG_FILE,
-  CONFIG_PINNED_FILE,
+  IMPLICIT_CREDIT_TTL_MS
+} from "./chunk-5URG56JJ.js";
+import {
   CREDITS_FILE,
   DvmError,
   ensureConfigDir
-} from "./chunk-F2L6KIMD.js";
+} from "./chunk-MKI6OVW4.js";
+
+// src/lib/output.ts
+import { writeSync } from "fs";
+var _traceId = null;
+function setOutputTraceId(id) {
+  _traceId = id;
+}
+function getOutputTraceId() {
+  return _traceId;
+}
+function json(data) {
+  const out = _traceId !== null && typeof data === "object" && data !== null && !Array.isArray(data) && !("trace_id" in data) ? { trace_id: _traceId, ...data } : data;
+  writeAllSync(1, JSON.stringify(out) + "\n");
+}
+function info(msg) {
+  writeAllSync(2, msg + "\n");
+}
+function raw(msg) {
+  writeAllSync(1, msg + "\n");
+}
+function progress(event) {
+  writeAllSync(2, JSON.stringify(event) + "\n");
+}
+function writeAllSync(fd, text) {
+  const buf = Buffer.from(text, "utf8");
+  let offset = 0;
+  while (offset < buf.length) {
+    try {
+      offset += writeSync(fd, buf, offset, buf.length - offset);
+    } catch (err) {
+      const code = err.code;
+      if (code === "EAGAIN" || code === "EINTR") continue;
+      throw err;
+    }
+  }
+}
 
 // src/lib/payment-rails/types.ts
+var RAIL_FLAGS = ["cashu", "tempo", "x402"];
 var ADVERTISED_AMOUNT_TOLERANCE_BPS = 1000n;
 function maxAdvertisedMicro(localMicro) {
   return localMicro * (10000n + ADVERTISED_AMOUNT_TOLERANCE_BPS) / 10000n;
@@ -19,9 +55,9 @@ function withinAdvertisedTolerance(advertisedMicro, localMicro) {
 
 // src/lib/transport/types.ts
 var SUPPORTED_PROTOCOL_VERSION = 1;
-function parseCreditTerms(raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
-  const credit = raw;
+function parseCreditTerms(raw2) {
+  if (!raw2 || typeof raw2 !== "object" || Array.isArray(raw2)) return void 0;
+  const credit = raw2;
   if (typeof credit.min_micro !== "number" || typeof credit.max_micro !== "number" || typeof credit.ttl_ms !== "number" || typeof credit.currency !== "string" || !Array.isArray(credit.funding) || !credit.funding.every((method) => typeof method === "string") || credit.lightning_min_micro !== void 0 && typeof credit.lightning_min_micro !== "number")
     return void 0;
   const tempo = credit.tempo === void 0 ? void 0 : parseCreditTempoTerms(credit.tempo);
@@ -41,10 +77,10 @@ function parseCreditTerms(raw) {
     }
   };
 }
-function parseCreditMenu(raw) {
-  const terms = parseCreditTerms(raw);
+function parseCreditMenu(raw2) {
+  const terms = parseCreditTerms(raw2);
   if (!terms) return void 0;
-  const credit = raw;
+  const credit = raw2;
   return {
     ...terms,
     ...typeof credit.credit_id === "string" && { credit_id: credit.credit_id },
@@ -55,9 +91,9 @@ function parseCreditMenu(raw) {
     ...typeof credit.expiry_ms === "number" && { expiry_ms: credit.expiry_ms }
   };
 }
-function parseCreditTempoTerms(raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
-  const block = raw;
+function parseCreditTempoTerms(raw2) {
+  if (!raw2 || typeof raw2 !== "object" || Array.isArray(raw2)) return void 0;
+  const block = raw2;
   if (!Array.isArray(block.methods) || !block.methods.every(isCreditTempoMethod)) return void 0;
   if (block.withheld !== void 0 && (!Array.isArray(block.withheld) || !block.withheld.every(isCreditTempoWithheldMethod)))
     return void 0;
@@ -75,15 +111,15 @@ function parseCreditTempoTerms(raw) {
     }
   };
 }
-function isCreditTempoMethod(raw) {
-  return !!raw && typeof raw === "object" && typeof raw.method === "string" && (raw.intent === "charge" || raw.intent === "session");
+function isCreditTempoMethod(raw2) {
+  return !!raw2 && typeof raw2 === "object" && typeof raw2.method === "string" && (raw2.intent === "charge" || raw2.intent === "session");
 }
-function isCreditTempoWithheldMethod(raw) {
-  return isCreditTempoMethod(raw) && typeof raw.reason === "string";
+function isCreditTempoWithheldMethod(raw2) {
+  return isCreditTempoMethod(raw2) && typeof raw2.reason === "string";
 }
-function parseCreditX402Terms(raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
-  const schemes = raw.schemes;
+function parseCreditX402Terms(raw2) {
+  if (!raw2 || typeof raw2 !== "object" || Array.isArray(raw2)) return void 0;
+  const schemes = raw2.schemes;
   if (!Array.isArray(schemes) || !schemes.every(
     (entry) => !!entry && typeof entry === "object" && typeof entry.scheme === "string" && typeof entry.network === "string"
   ))
@@ -96,663 +132,10 @@ function parseCreditX402Terms(raw) {
   };
 }
 
-// src/lib/output.ts
-import { writeSync } from "fs";
-function info(msg) {
-  writeAllSync(2, msg + "\n");
-}
-function progress(event) {
-  writeAllSync(2, JSON.stringify(event) + "\n");
-}
-function writeAllSync(fd, text) {
-  const buf = Buffer.from(text, "utf8");
-  let offset = 0;
-  while (offset < buf.length) {
-    try {
-      offset += writeSync(fd, buf, offset, buf.length - offset);
-    } catch (err) {
-      const code = err.code;
-      if (code === "EAGAIN" || code === "EINTR") continue;
-      throw err;
-    }
-  }
-}
-
-// src/lib/evm-private-key.ts
-import { secp256k1 } from "@noble/curves/secp256k1.js";
-import { hexToBytes } from "@noble/hashes/utils.js";
-var EVM_PRIVATE_KEY_RE = /^0x[0-9a-fA-F]{64}$/;
-function isValidEvmPrivateKey(value) {
-  return EVM_PRIVATE_KEY_RE.test(value) && secp256k1.utils.isValidSecretKey(hexToBytes(value.slice(2)));
-}
-
-// src/lib/config-mutation.ts
-import {
-  appendFileSync,
-  chmodSync,
-  existsSync,
-  readFileSync,
-  renameSync,
-  statSync,
-  unlinkSync,
-  writeFileSync
-} from "fs";
-var PROTECTED_CONFIG_FIELDS = ["nwcUri", "defaultIdentity", "tempo", "x402"];
-var ProtectedFieldAuthorization = class {
-  /** Targets this authorization covers. A field also covers its own leaves. */
-  targets;
-  /** Prefer {@link authorizeProtectedRemoval}; this exists for it to call. */
-  constructor(targets) {
-    this.targets = [...targets];
-  }
-  /**
-   * True when `target` is one this authorization names. Naming a field covers
-   * the leaves under it; naming a leaf covers only that leaf, so a command
-   * entitled to clear `tempo.apiKey` still cannot take the whole `tempo` block.
-   */
-  covers(target) {
-    if (this.targets.includes(target)) return true;
-    const field = target.split(".")[0];
-    return target !== field && this.targets.includes(field);
-  }
-};
-function authorizeProtectedRemoval(...targets) {
-  return new ProtectedFieldAuthorization(targets);
-}
-function applyConfigPatch(base, patch) {
-  if (!isPlainObject(patch))
-    throw patchShapeError("A change must be an object with `set` and/or `unset`.");
-  if (patch.set !== void 0 && !isPlainObject(patch.set)) {
-    throw patchShapeError("A change's `set` must be an object of fields to write.");
-  }
-  if (patch.unset !== void 0 && !Array.isArray(patch.unset)) {
-    throw patchShapeError("A change's `unset` must be an array of field names.");
-  }
-  const set = patch.set ?? {};
-  const unset = patch.unset ?? [];
-  for (const [field, value] of Object.entries(set)) {
-    if (value !== void 0) continue;
-    throw new DvmError(
-      "config_patch_invalid",
-      `Config field '${field}' was declared with no value.`,
-      "Give the field a value, or name it in the change's `unset` list to remove it. An undefined value is how a field gets dropped without anyone deciding to drop it."
-    );
-  }
-  for (const field of unset) {
-    if (typeof field !== "string" || field.length === 0) {
-      throw patchShapeError("Every entry in a change's `unset` must be a field name.");
-    }
-    if (!Object.hasOwn(set, field)) continue;
-    throw new DvmError(
-      "config_patch_invalid",
-      `Config field '${field}' is both written and removed by the same change.`,
-      "Declare each field once: in `set` with its new value, or in `unset` to remove it."
-    );
-  }
-  const merged = { ...base, ...set };
-  const removing = new Set(unset);
-  return Object.fromEntries(
-    Object.entries(merged).filter(([field]) => !removing.has(field))
-  );
-}
-function deepFreezeConfig(config) {
-  freezeDeep(config);
-  return config;
-}
-function protectedRemovals(before, after) {
-  const previous = before;
-  const next = after;
-  const removed = [];
-  for (const field of PROTECTED_CONFIG_FIELDS) {
-    const held = previous[field];
-    if (!isPresentValue(held)) continue;
-    const kept = next[field];
-    if (!isPresentValue(kept)) {
-      removed.push(field);
-      continue;
-    }
-    const spec = PROTECTED_FIELDS[field];
-    if (spec.credentialLeaves.length === 0) continue;
-    if (!isPlainObject(held)) continue;
-    if (!isPlainObject(kept)) {
-      removed.push(field);
-      continue;
-    }
-    for (const leaf of spec.credentialLeaves) {
-      if (!isPresentValue(held[leaf]) || isPresentValue(kept[leaf])) continue;
-      removed.push(`${field}.${leaf}`);
-    }
-  }
-  return removed;
-}
-function supersededProtectedSecrets(before, after) {
-  const previous = before;
-  const next = after;
-  const superseded = [];
-  for (const field of PROTECTED_CONFIG_FIELDS) {
-    const spec = PROTECTED_FIELDS[field];
-    if (!spec.secret) continue;
-    const held = previous[field];
-    const kept = next[field];
-    if (spec.credentialLeaves.length === 0) {
-      if (isPresentValue(held) && isPresentValue(kept) && held !== kept) superseded.push(field);
-      continue;
-    }
-    if (!isPlainObject(held) || !isPlainObject(kept)) continue;
-    for (const leaf of spec.credentialLeaves) {
-      const was = held[leaf];
-      const now = kept[leaf];
-      if (!isPresentValue(was) || !isPresentValue(now) || was === now) continue;
-      superseded.push(`${field}.${leaf}`);
-    }
-  }
-  return superseded;
-}
-function changedConfigPaths(before, after) {
-  const found = /* @__PURE__ */ new Set();
-  collectChangedPaths(
-    before,
-    after,
-    CONFIG_PATH_SHAPE,
-    "",
-    found
-  );
-  return [...found].sort();
-}
-function assertValidConfig(config, fields) {
-  if (!isPlainObject(config)) {
-    throw new DvmError(
-      "config_invalid",
-      "The caller configuration is not a JSON object.",
-      `Expected an object at ${CONFIG_FILE}.${rollbackSuffix()}`
-    );
-  }
-  const record = config;
-  const scope = fields ? new Set(fields) : null;
-  for (const [field, kind] of Object.entries(CONFIG_FIELD_TYPES)) {
-    if (scope && !scope.has(field)) continue;
-    const value = record[field];
-    if (value === void 0) continue;
-    if (!matchesKind(value, kind)) throw invalidFieldError(field, kind);
-  }
-  for (const [path, kind] of Object.entries(CONFIG_LEAF_TYPES)) {
-    const [field, leaf] = path.split(".");
-    if (scope && !scope.has(field)) continue;
-    const owner = record[field];
-    if (!isPlainObject(owner)) continue;
-    const value = owner[leaf];
-    if (value === void 0 || !matchesKind(value, kind)) throw invalidFieldError(path, kind);
-  }
-}
-function readRawConfig() {
-  if (!existsSync(CONFIG_FILE)) return null;
-  try {
-    return JSON.parse(readFileSync(CONFIG_FILE, "utf-8"));
-  } catch {
-    throw new DvmError(
-      "config_corrupt",
-      "Config file is corrupt.",
-      // Not "delete it": those bytes are the only copy on this machine of the
-      // NWC connection string and both private keys, however badly they parse.
-      `Run 'dvm config rollback' to restore a stored copy, or move ${CONFIG_FILE} aside yourself and run 'dvm init'.${rollbackSuffix()}`
-    );
-  }
-}
-function writeConfigFile(config) {
-  writeJsonAtomic(CONFIG_FILE, config);
-}
-var CONFIG_SNAPSHOT_SLOTS = ["backup", "pinned"];
-function configSnapshotPath(slot) {
-  return slot === "pinned" ? CONFIG_PINNED_FILE : CONFIG_BACKUP_FILE;
-}
-function describeConfigBackup(slot = "backup") {
-  const path = configSnapshotPath(slot);
-  try {
-    if (!existsSync(path)) return null;
-    const stat = statSync(path);
-    const posix = process.platform !== "win32";
-    const mode = stat.mode & 511;
-    return {
-      path,
-      slot,
-      bytes: stat.size,
-      modifiedAt: stat.mtime.toISOString(),
-      modeOctal: posix ? toOctal(mode) : null,
-      ownerOnly: !posix || (mode & 63) === 0
-    };
-  } catch {
-    return null;
-  }
-}
-function readConfigBackup(slot = "backup") {
-  const path = configSnapshotPath(slot);
-  if (!existsSync(path)) return null;
-  try {
-    const parsed = JSON.parse(readFileSync(path, "utf-8"));
-    return isPlainObject(parsed) ? parsed : null;
-  } catch {
-    return null;
-  }
-}
-function retainConfigBackup(slot = "backup") {
-  if (!existsSync(CONFIG_FILE)) return false;
-  ensureConfigDir();
-  const path = configSnapshotPath(slot);
-  const tmp = `${path}.tmp`;
-  writeFileSync(tmp, readFileSync(CONFIG_FILE), { mode: 384 });
-  chmodSync(tmp, 384);
-  commitTmp(tmp, path);
-  return true;
-}
-function writeConfigBackup(config, slot = "backup") {
-  writeJsonAtomic(configSnapshotPath(slot), config);
-}
-function removeConfigBackup(slot = "backup") {
-  const path = configSnapshotPath(slot);
-  if (!existsSync(path)) return false;
-  unlinkSync(path);
-  return true;
-}
-function protectedTargetValue(config, target) {
-  const [field, named] = target.split(".");
-  const held = config[field];
-  const leaves = PROTECTED_FIELDS[field].credentialLeaves;
-  const leaf = named ?? (leaves.length > 0 ? leaves[0] : void 0);
-  if (leaf === void 0) return held;
-  return isPlainObject(held) ? held[leaf] : void 0;
-}
-function protectedValuesMatch(target, left, right) {
-  const normalized = comparableProtectedValue(target, left);
-  return normalized !== void 0 && normalized === comparableProtectedValue(target, right);
-}
-function isSecretProtectedTarget(target) {
-  return PROTECTED_FIELDS[target.split(".")[0]].secret;
-}
-function withoutProtectedTargets(config, targets) {
-  const dropping = /* @__PURE__ */ new Set();
-  for (const target of targets) {
-    const field = target.split(".")[0];
-    dropping.add(field);
-    for (const alias of PROTECTED_FIELDS[field].aliases) dropping.add(alias);
-  }
-  return Object.fromEntries(
-    Object.entries(config).filter(([field]) => !dropping.has(field))
-  );
-}
-function appendConfigAudit(record) {
-  try {
-    ensureConfigDir();
-    appendFileSync(CONFIG_AUDIT_FILE, JSON.stringify(record) + "\n", { mode: 384 });
-    chmodSync(CONFIG_AUDIT_FILE, 384);
-  } catch {
-  }
-}
-function protectedRemovalError(targets, reason) {
-  const named = targets.join(", ");
-  const one = targets.length === 1;
-  return new DvmError(
-    "config_protected_field",
-    `The '${reason}' change would remove ${named} from the local configuration.`,
-    `Nothing was written. ${named} ${one ? "is a credential or identity pointer" : "are credentials or identity pointers"} nothing else on this machine records, so only a command that names ${one ? "it" : "them"} explicitly may remove ${one ? "it" : "them"} \u2014 'dvm wallet disconnect', 'dvm wallet tempo-disconnect' and 'dvm wallet x402-disconnect' are those commands.`,
-    { fields: targets }
-  );
-}
-var PROTECTED_FIELDS = {
-  nwcUri: { aliases: [], credentialLeaves: [], secret: true, hexCredential: false },
-  // A pointer at a key, not a key: worth protecting from removal, and never
-  // worth stripping out of a stored copy — that is recovery lost for nothing.
-  defaultIdentity: { aliases: [], credentialLeaves: [], secret: false, hexCredential: false },
-  // `mpp` is the pre-internal-review name; a caller who has not run a mutating command
-  // since the rename still has their private key under it.
-  tempo: { aliases: ["mpp"], credentialLeaves: ["apiKey"], secret: true, hexCredential: true },
-  x402: { aliases: [], credentialLeaves: ["privateKey"], secret: true, hexCredential: true }
-};
-var CONFIG_PATH_SHAPE = {
-  float: { statedBudget: {}, connectedAt: {}, alias: {}, methods: {} },
-  x402: { privateKey: {}, network: {} },
-  tempo: { method: {}, accountId: {}, apiKey: {} },
-  credit: {
-    targetJobs: {},
-    posture: {},
-    tier0Cap: {},
-    tier1Cap: {},
-    pocketTarget: {},
-    fundingRail: {},
-    perDvm: { "*": { targetJobs: {}, posture: {}, fundingRail: {}, dvmId: {}, builderPubkey: {} } },
-    trustOverrides: { "*": {} }
-  },
-  feedback: { posture: {} }
-};
-var CONFIG_FIELD_TYPES = {
-  nwcUri: "string",
-  float: "object",
-  defaultBudget: "string",
-  autoPayThreshold: "string",
-  defaultMaxPayments: "number",
-  cashuMints: "string[]",
-  x402: "object",
-  tempo: "object",
-  defaultRail: "string",
-  defaultIdentity: "string",
-  credit: "object",
-  feedback: "object"
-};
-var CONFIG_LEAF_TYPES = {
-  "float.connectedAt": "string",
-  "x402.privateKey": "string",
-  "tempo.method": "string"
-};
-function collectChangedPaths(before, after, shape, prefix, found) {
-  for (const key of /* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)])) {
-    const held = before[key];
-    const kept = after[key];
-    if (deepEqual(held, kept)) continue;
-    const known = shape !== void 0 && Object.hasOwn(shape, key);
-    const wildcard = !known && shape !== void 0 && Object.hasOwn(shape, "*");
-    const child = known ? shape[key] : wildcard ? shape["*"] : void 0;
-    const path = prefix ? `${prefix}.${wildcard ? "*" : key}` : key;
-    const descendable = child !== void 0 && Object.keys(child).length > 0 && (held === void 0 || isPlainObject(held)) && (kept === void 0 || isPlainObject(kept));
-    if (descendable) {
-      collectChangedPaths(
-        isPlainObject(held) ? held : {},
-        isPlainObject(kept) ? kept : {},
-        child,
-        path,
-        found
-      );
-    } else {
-      found.add(path);
-    }
-  }
-}
-function invalidFieldError(path, kind) {
-  return new DvmError(
-    "config_invalid",
-    `Config field '${path}' must be ${describeKind(kind)}.`,
-    `Nothing was written. Correct the field in ${CONFIG_FILE}, or run 'dvm doctor' for the full picture.${rollbackSuffix()}`
-  );
-}
-function describeKind(kind) {
-  switch (kind) {
-    case "string":
-      return "a string";
-    case "number":
-      return "a number";
-    case "object":
-      return "an object";
-    case "string[]":
-      return "an array of strings";
-  }
-}
-function matchesKind(value, kind) {
-  switch (kind) {
-    case "string":
-      return typeof value === "string";
-    case "number":
-      return typeof value === "number" && Number.isFinite(value);
-    case "object":
-      return isPlainObject(value);
-    case "string[]":
-      return Array.isArray(value) && value.every((item) => typeof item === "string");
-  }
-}
-function rollbackSuffix() {
-  const stored = describeConfigBackup() ?? describeConfigBackup("pinned");
-  return stored === null ? "" : ` A stored copy of the previous configuration is at ${stored.path}.`;
-}
-function writeJsonAtomic(path, value) {
-  ensureConfigDir();
-  const tmp = `${path}.tmp`;
-  writeFileSync(tmp, JSON.stringify(value, null, 2) + "\n", { mode: 384 });
-  chmodSync(tmp, 384);
-  commitTmp(tmp, path);
-}
-function commitTmp(tmp, path) {
-  try {
-    renameSync(tmp, path);
-  } catch (err) {
-    try {
-      unlinkSync(tmp);
-    } catch {
-    }
-    throw err;
-  }
-}
-function deepEqual(a, b) {
-  if (a === b) return true;
-  if (Array.isArray(a) || Array.isArray(b)) {
-    if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
-    return a.every((item, index) => deepEqual(item, b[index]));
-  }
-  if (!isPlainObject(a) || !isPlainObject(b)) return false;
-  for (const key of /* @__PURE__ */ new Set([...Object.keys(a), ...Object.keys(b)])) {
-    if (!deepEqual(a[key], b[key])) return false;
-  }
-  return true;
-}
-function isPresentValue(value) {
-  if (value === void 0 || value === null) return false;
-  return typeof value !== "string" || value.trim().length > 0;
-}
-function comparableProtectedValue(target, value) {
-  if (typeof value !== "string") return void 0;
-  const trimmed = value.trim();
-  if (trimmed.length === 0) return void 0;
-  const field = target.split(".")[0];
-  return PROTECTED_FIELDS[field].hexCredential ? trimmed.toLowerCase() : trimmed;
-}
-function patchShapeError(message) {
-  return new DvmError(
-    "config_patch_invalid",
-    message,
-    "A change declares `set` (fields to write) and `unset` (field names to remove). Anything else cannot be applied, and nothing was written."
-  );
-}
-function freezeDeep(value) {
-  if (typeof value !== "object" || value === null || Object.isFrozen(value)) return;
-  Object.freeze(value);
-  for (const nested of Object.values(value)) freezeDeep(nested);
-}
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function toOctal(mode) {
-  return "0" + mode.toString(8).padStart(3, "0");
-}
-
-// src/lib/identity.ts
-import lockfile from "proper-lockfile";
-var CREDIT_POSTURES = ["suggest", "auto", "off"];
-function isCreditPosture(value) {
-  return typeof value === "string" && CREDIT_POSTURES.includes(value);
-}
-function migrateCreditConfig(config) {
-  const credit = config.credit;
-  if (!credit) return config;
-  const migrateLayer = (layer) => {
-    const railed = migrateFundingRail(layer);
-    if (!("disabled" in railed)) return railed;
-    const { disabled, ...rest } = railed;
-    const migrated = { ...rest };
-    if (migrated.posture === void 0 && disabled === true) migrated.posture = "off";
-    return migrated;
-  };
-  const perDvm = credit.perDvm;
-  return {
-    ...config,
-    credit: {
-      ...migrateLayer(credit),
-      ...perDvm ? {
-        perDvm: Object.fromEntries(
-          Object.entries(perDvm).map(([endpoint, per]) => [endpoint, migrateLayer(per)])
-        )
-      } : {}
-    }
-  };
-}
-function migrateFundingRail(layer) {
-  const loose = layer;
-  if (loose.fundingRail !== "mpp") return layer;
-  return { ...layer, fundingRail: "tempo" };
-}
-function migrateTempoWalletKey(config) {
-  const loose = config;
-  if (!loose.mpp || loose.tempo) return config;
-  const { mpp, ...rest } = loose;
-  return { ...rest, tempo: mpp };
-}
-function migrateConfig(config) {
-  return migrateCreditConfig(migrateTempoWalletKey(config));
-}
-function loadConfig() {
-  const raw = readRawConfig();
-  return raw === null ? null : migrateConfig(raw);
-}
-async function updateConfig(update) {
-  return withConfigLock(async () => {
-    const raw = readRawConfig();
-    const snapshot = raw === null ? {} : structuredClone(raw);
-    const base = raw === null ? null : migrateConfig(structuredClone(raw));
-    const handed = raw === null ? null : deepFreezeConfig(migrateConfig(structuredClone(raw)));
-    const next = applyConfigPatch(base ?? {}, await runPatch(update, handed));
-    const changed = changedConfigPaths(snapshot, next);
-    if (changed.length === 0) {
-      return {
-        config: base ?? {},
-        previous: base,
-        changed: [],
-        written: false,
-        backup: describeConfigBackup()
-      };
-    }
-    const removals = protectedRemovals(base ?? {}, next);
-    const unauthorized = removals.filter((target) => update.authorize?.covers(target) !== true);
-    if (unauthorized.length > 0) throw protectedRemovalError(unauthorized, update.reason);
-    assertValidConfig(
-      next,
-      changed.map((path) => path.split(".")[0])
-    );
-    const superseded = supersededProtectedSecrets(base ?? {}, next);
-    const stripped = [
-      .../* @__PURE__ */ new Set([...removals, ...superseded, ...update.sanitizeBackup ?? []])
-    ].filter(isSecretProtectedTarget);
-    const sweeping = update.sweepSlots ?? CONFIG_SNAPSHOT_SLOTS;
-    const swept = [];
-    if (raw !== null) {
-      if (stripped.length > 0) {
-        writeConfigBackup(withoutProtectedTargets(raw, stripped));
-        swept.push("backup");
-      } else {
-        retainConfigBackup();
-      }
-    }
-    if (stripped.length > 0 && sweeping.includes("pinned")) {
-      if (sweepPinnedSnapshot(stripped, base ?? {}, update.reason)) swept.push("pinned");
-    }
-    const backup = describeConfigBackup();
-    writeConfigFile(next);
-    appendConfigAudit({
-      ts: (/* @__PURE__ */ new Date()).toISOString(),
-      event: "update",
-      reason: update.reason,
-      fields: changed,
-      ...removals.length > 0 ? { removed: removals } : {},
-      ...superseded.length > 0 ? { superseded } : {},
-      ...swept.length > 0 ? { sweptSlots: swept } : {},
-      backup: backup !== null,
-      pid: process.pid
-    });
-    return { config: next, previous: base, changed, written: true, backup };
-  });
-}
-async function withConfigLock(fn) {
-  ensureConfigDir();
-  let release;
-  try {
-    release = await lockfile.lock(CONFIG_FILE, {
-      lockfilePath: `${CONFIG_FILE}.lock`,
-      realpath: false,
-      stale: 3e4,
-      retries: { retries: 10, factor: 1, minTimeout: 100, maxTimeout: 100 }
-    });
-  } catch {
-    throw new DvmError(
-      "config_locked",
-      "Another dvm process is updating the local configuration.",
-      "Wait a moment and retry."
-    );
-  }
-  try {
-    return await fn();
-  } finally {
-    await release().catch(() => void 0);
-  }
-}
-async function runPatch(update, current) {
-  try {
-    return await update.patch(current);
-  } catch (err) {
-    if (err instanceof TypeError && /read only|not extensible|frozen|cannot delete property|cannot add property/i.test(
-      err.message
-    )) {
-      throw new DvmError(
-        "config_patch_invalid",
-        `The '${update.reason}' change tried to modify the configuration it was handed.`,
-        "Nothing was written. A change declares what it wants through its `set` and `unset` lists; editing the current config in place bypasses the protected-field gate, so the object is frozen."
-      );
-    }
-    throw err;
-  }
-}
-function sweepPinnedSnapshot(targets, departing, reason) {
-  if (describeConfigBackup("pinned") === null) return false;
-  const pinned = readConfigBackup("pinned");
-  if (pinned === null) {
-    return retireSlot(`${reason}:unreadable_pin`, "pinned");
-  }
-  const migrated = migrateConfig(structuredClone(pinned));
-  const matching = targets.filter(
-    (target) => protectedValuesMatch(
-      target,
-      protectedTargetValue(departing, target),
-      protectedTargetValue(migrated, target)
-    )
-  );
-  if (matching.length === 0) return false;
-  const sanitized = withoutProtectedTargets(pinned, matching);
-  const changed = changedConfigPaths(pinned, sanitized);
-  if (changed.length === 0) return false;
-  writeConfigBackup(sanitized, "pinned");
-  appendConfigAudit({
-    ts: (/* @__PURE__ */ new Date()).toISOString(),
-    event: "backup_sanitized",
-    reason,
-    fields: changed,
-    removed: matching,
-    slot: "pinned",
-    backup: describeConfigBackup() !== null,
-    pid: process.pid
-  });
-  return true;
-}
-function retireSlot(reason, slot) {
-  if (!removeConfigBackup(slot)) return false;
-  appendConfigAudit({
-    ts: (/* @__PURE__ */ new Date()).toISOString(),
-    event: "backup_retired",
-    reason,
-    fields: [],
-    slot,
-    backup: describeConfigBackup() !== null,
-    pid: process.pid
-  });
-  return true;
-}
-
 // src/lib/credit-store.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, renameSync as renameSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "fs";
 import { dirname } from "path";
-import lockfile2 from "proper-lockfile";
+import lockfile from "proper-lockfile";
 function withCreditLock(fn, opts = {}) {
   if (lockDepth > 0) {
     lockDepth += 1;
@@ -834,6 +217,12 @@ function fundingReachableAt(funding, endpoint, credits) {
   const origins = dvmLocationOrigins(record);
   return origins.includes(at) && origins.includes(named);
 }
+function pendingDrainFor(record, creditId) {
+  return record?.pendingDrains?.find((d) => d.creditId === creditId);
+}
+function pendingDrainById(record, drainId) {
+  return record?.pendingDrains?.find((d) => d.drainId === drainId);
+}
 function loadCredit(endpoint, callerPubkey, identity) {
   return withCreditLock(() => {
     const key = normalizeCreditEndpoint(endpoint);
@@ -847,9 +236,124 @@ function loadCredit(endpoint, callerPubkey, identity) {
     return record;
   });
 }
+function clearCreditSelection(endpoint, callerPubkey, creditId, identity) {
+  return withCreditLock(() => {
+    const key = normalizeCreditEndpoint(endpoint);
+    const store = loadStore();
+    const record = findDvmLocated(store.credits, {
+      endpoint: key,
+      ...identity ? { identity } : {},
+      where: (candidate) => candidate.callerPubkey === callerPubkey && candidate.creditId === creditId
+    });
+    if (!record) {
+      throw new DvmError(
+        "credit_not_found",
+        `Credit ${creditId} is not the selected local credit at ${key}.`
+      );
+    }
+    attachDvmLocation(record, key, identity);
+    record.selectionCleared = true;
+    record.updatedAt = Date.now();
+    saveStore(store);
+    return structuredClone(record);
+  });
+}
 function listCredits() {
   return withCreditLock(() => [...loadStore().credits].sort((a, b) => b.updatedAt - a.updatedAt));
 }
+function listImplicitCredits(now = Date.now()) {
+  return withCreditLock(() => {
+    const store = loadStore();
+    const aged = ageImplicitCredits(store.implicitCredits, now);
+    const capped = capLostImplicitCredits(store.implicitCredits);
+    if (aged || capped.changed) {
+      store.implicitCredits = capped.credits;
+      saveStore(store);
+    }
+    return [...store.implicitCredits].sort(compareImplicitCredits);
+  });
+}
+function loadImplicitCredits(endpoint, callerPubkey, identity, now = Date.now()) {
+  return withCreditLock(() => {
+    const store = loadStore();
+    const key = normalizeCreditEndpoint(endpoint);
+    let changed = ageImplicitCredits(store.implicitCredits, now);
+    const matches = store.implicitCredits.filter(
+      (record) => Boolean(
+        findDvmLocated([record], {
+          endpoint: key,
+          ...identity ? { identity } : {},
+          where: (candidate) => candidate.callerPubkey === callerPubkey
+        })
+      )
+    );
+    for (const record of matches) {
+      changed = attachDvmLocation(record, key, identity) || changed;
+    }
+    const capped = capLostImplicitCredits(store.implicitCredits);
+    if (changed || capped.changed) {
+      store.implicitCredits = capped.credits;
+      saveStore(store);
+    }
+    return matches.filter((record) => store.implicitCredits.includes(record)).sort(compareImplicitCredits);
+  });
+}
+function markImplicitCreditLost(args) {
+  return withCreditLock(() => {
+    const store = loadStore();
+    const key = normalizeCreditEndpoint(args.endpoint);
+    const record = findDvmLocated(store.implicitCredits, {
+      endpoint: key,
+      ...args.identity ? { identity: args.identity } : {},
+      where: (candidate) => candidate.callerPubkey === args.callerPubkey && candidate.creditId === args.creditId
+    });
+    if (!record) return void 0;
+    attachDvmLocation(record, key, args.identity);
+    record.status = "lost";
+    record.lossReason = args.reason;
+    record.updatedAt = args.now ?? Date.now();
+    const capped = capLostImplicitCredits(store.implicitCredits);
+    store.implicitCredits = capped.credits;
+    saveStore(store);
+    return store.implicitCredits.includes(record) ? record : void 0;
+  });
+}
+function listFundingMenuSnapshots() {
+  return withCreditLock(
+    () => [...loadStore().fundingMenuSnapshots].sort((a, b) => b.observedAt - a.observedAt)
+  );
+}
+function recordFundingMenuSnapshot(args) {
+  const menu = parseCreditMenu(args.menu);
+  if (!menu) return;
+  withCreditLock(() => {
+    const store = loadStore();
+    const key = normalizeCreditEndpoint(args.endpoint);
+    const previous = findDvmLocated(store.fundingMenuSnapshots, {
+      endpoint: key,
+      ...args.identity ? { identity: args.identity } : {},
+      where: (entry) => entry.callerPubkey === args.callerPubkey
+    });
+    const index = previous ? store.fundingMenuSnapshots.indexOf(previous) : -1;
+    const builderPubkey = args.builderPubkey ?? previous?.builderPubkey;
+    const snapshot = {
+      // The row keeps the origin it was opened at and learns the new spelling
+      // as an alias, so a caller who alternates hostnames still reads one menu.
+      endpoint: previous?.endpoint ?? key,
+      ...previous?.endpointAliases ? { endpointAliases: [...previous.endpointAliases] } : {},
+      ...previous?.dvmId ? { dvmId: previous.dvmId } : {},
+      ...previous?.attestedBuilderPubkey ? { attestedBuilderPubkey: previous.attestedBuilderPubkey } : {},
+      callerPubkey: args.callerPubkey,
+      menu,
+      observedAt: args.now ?? Date.now(),
+      ...builderPubkey ? { builderPubkey } : {}
+    };
+    attachDvmLocation(snapshot, key, args.identity);
+    if (index === -1) store.fundingMenuSnapshots.push(snapshot);
+    else store.fundingMenuSnapshots[index] = snapshot;
+    saveStore(store);
+  });
+}
 function listPendingFundings(args = {}) {
   const endpoint = args.endpoint ? normalizeCreditEndpoint(args.endpoint) : void 0;
   return withCreditLock(() => {
@@ -945,6 +449,231 @@ function recordFundResponse(args) {
     return record;
   });
 }
+function recordBalanceResponse(args) {
+  const now = args.now ?? Date.now();
+  return withCreditLock(() => {
+    const existing = loadCredit(args.endpoint, args.callerPubkey, args.identity);
+    const prepaidCredits = args.credits.filter((credit) => !credit.credit_id.startsWith("imp:"));
+    const selectedPrimary = args.primary && !args.primary.credit_id.startsWith("imp:") ? args.primary : void 0;
+    const primary = selectedPrimary ?? prepaidCredits.find((credit) => credit.credit_id === existing?.creditId);
+    if (!primary) {
+      if (existing) {
+        mutateCredit(
+          {
+            endpoint: args.endpoint,
+            callerPubkey: args.callerPubkey,
+            ...args.identity ? { identity: args.identity } : {}
+          },
+          (record2) => {
+            record2.siblingCredits = [];
+            return void 0;
+          }
+        );
+      }
+      return existing;
+    }
+    const record = recordFundResponse({
+      endpoint: args.endpoint,
+      ...args.identity ? { identity: args.identity } : {},
+      callerPubkey: args.callerPubkey,
+      credit: primary,
+      targetMicro: args.targetMicro ?? existing?.targetMicro ?? primary.remaining_micro,
+      ...args.menu ? { menu: args.menu } : {},
+      ...args.builderPubkey ? { builderPubkey: args.builderPubkey } : {},
+      ...args.selectPrimary ? { select: true } : {},
+      ...args.sequenced === false ? { sequenced: false } : {},
+      now
+    });
+    mutateCredit(
+      {
+        endpoint: args.endpoint,
+        callerPubkey: args.callerPubkey,
+        ...args.identity ? { identity: args.identity } : {}
+      },
+      (current) => {
+        current.siblingCredits = prepaidCredits.filter((credit) => credit.credit_id !== current.creditId).map((credit) => siblingFromWire(credit, now));
+        return void 0;
+      }
+    );
+    return loadCredit(args.endpoint, args.callerPubkey, args.identity) ?? record;
+  });
+}
+function applyReceiptCredit(args) {
+  const now = args.now ?? Date.now();
+  return withCreditLock(() => {
+    const store = loadStore();
+    const key = normalizeCreditEndpoint(args.endpoint);
+    const record = findDvmLocated(store.credits, {
+      endpoint: key,
+      ...args.identity ? { identity: args.identity } : {},
+      where: (c) => c.callerPubkey === args.callerPubkey && c.creditId === args.credit.credit_id
+    });
+    if (!record) return {};
+    attachDvmLocation(record, key, args.identity);
+    let mismatch;
+    const sequential = args.credit.ledger_seq === record.ledgerSeq + 1;
+    if (sequential && args.outcome === "completed" && record.status === "active" && !record.provisional && !record.unsequencedBalance) {
+      const expected = record.remainingMicro - args.credit.amount;
+      if (args.credit.balance_after !== expected) {
+        mismatch = {
+          atMs: now,
+          expectedMicro: expected,
+          reportedMicro: args.credit.balance_after,
+          drawId: args.credit.draw_id,
+          ledgerSeq: args.credit.ledger_seq,
+          ...record.lastReceiptJobId ? { priorJobId: record.lastReceiptJobId } : {},
+          jobId: args.jobId
+        };
+        record.discrepancy = mismatch;
+      }
+    }
+    if (args.credit.ledger_seq >= record.ledgerSeq) {
+      record.remainingMicro = args.credit.balance_after;
+      record.ledgerSeq = args.credit.ledger_seq;
+      delete record.unsequencedBalance;
+    }
+    delete record.provisional;
+    if (args.outcome === "completed") record.lastPriceMicro = args.credit.amount;
+    if (!mismatch && record.discrepancy && args.credit.ledger_seq > record.discrepancy.ledgerSeq) {
+      delete record.discrepancy;
+    }
+    record.lastReceiptJobId = args.jobId;
+    record.updatedAt = now;
+    saveStore(store);
+    return { credit: record, ...mismatch ? { mismatch } : {} };
+  });
+}
+function applyImplicitReceiptCredit(args) {
+  if (!args.credit.credit_id.startsWith("imp:")) return {};
+  const now = args.now ?? Date.now();
+  return withCreditLock(() => {
+    const store = loadStore();
+    const key = normalizeCreditEndpoint(args.endpoint);
+    let record = findDvmLocated(store.implicitCredits, {
+      endpoint: key,
+      ...args.identity ? { identity: args.identity } : {},
+      where: (candidate) => candidate.callerPubkey === args.callerPubkey && candidate.creditId === args.credit.credit_id
+    });
+    if (!record && (args.outcome === "completed" || args.credit.balance_after <= 0)) return {};
+    if (!record) {
+      record = {
+        endpoint: key,
+        ...identityFields(args.identity),
+        callerPubkey: args.callerPubkey,
+        creditId: args.credit.credit_id,
+        currency: args.currency,
+        remainingMicro: args.credit.balance_after,
+        ledgerSeq: args.credit.ledger_seq,
+        expiryMs: args.issuedAtMs + IMPLICIT_CREDIT_TTL_MS,
+        status: args.issuedAtMs + IMPLICIT_CREDIT_TTL_MS <= now ? "lost" : "active",
+        releasedByJobId: args.jobId,
+        releasedAt: args.issuedAtMs,
+        updatedAt: now,
+        lastReceiptJobId: args.jobId
+      };
+      store.implicitCredits.push(record);
+      const capped2 = capLostImplicitCredits(store.implicitCredits);
+      store.implicitCredits = capped2.credits;
+      saveStore(store);
+      return store.implicitCredits.includes(record) ? { credit: record } : {};
+    }
+    attachDvmLocation(record, key, args.identity);
+    let mismatch;
+    const sequential = args.credit.ledger_seq === record.ledgerSeq + 1;
+    if (sequential && args.outcome === "completed" && record.status === "active") {
+      const expected = record.remainingMicro - args.credit.amount;
+      if (args.credit.balance_after !== expected) {
+        mismatch = {
+          atMs: now,
+          expectedMicro: expected,
+          reportedMicro: args.credit.balance_after,
+          drawId: args.credit.draw_id,
+          ledgerSeq: args.credit.ledger_seq,
+          ...record.lastReceiptJobId ? { priorJobId: record.lastReceiptJobId } : {},
+          jobId: args.jobId
+        };
+        record.discrepancy = mismatch;
+      }
+    }
+    if (args.credit.ledger_seq >= record.ledgerSeq) {
+      record.remainingMicro = args.credit.balance_after;
+      record.ledgerSeq = args.credit.ledger_seq;
+    }
+    if (!mismatch && record.discrepancy && args.credit.ledger_seq > record.discrepancy.ledgerSeq) {
+      delete record.discrepancy;
+    }
+    record.currency = args.currency;
+    record.lastReceiptJobId = args.jobId;
+    record.updatedAt = now;
+    if (record.remainingMicro <= 0) {
+      store.implicitCredits = store.implicitCredits.filter((candidate) => candidate !== record);
+      saveStore(store);
+      return { ...mismatch ? { mismatch } : {}, pruned: true };
+    }
+    if (record.expiryMs <= now) record.status = "lost";
+    const capped = capLostImplicitCredits(store.implicitCredits);
+    store.implicitCredits = capped.credits;
+    saveStore(store);
+    return {
+      ...store.implicitCredits.includes(record) ? { credit: record } : {},
+      ...mismatch ? { mismatch } : {}
+    };
+  });
+}
+function ensureProvisionalCredit(args) {
+  const now = args.now ?? Date.now();
+  withCreditLock(() => {
+    const store = loadStore();
+    const key = normalizeCreditEndpoint(args.endpoint);
+    let record = findDvmLocated(store.credits, {
+      endpoint: key,
+      ...args.identity ? { identity: args.identity } : {},
+      where: (c) => c.callerPubkey === args.callerPubkey
+    });
+    if (!record) {
+      record = {
+        endpoint: key,
+        ...identityFields(args.identity),
+        callerPubkey: args.callerPubkey,
+        creditId: args.creditId,
+        currency: args.currency,
+        balanceMicro: 0,
+        remainingMicro: 0,
+        ledgerSeq: 0,
+        expiryMs: 0,
+        targetMicro: args.targetMicro,
+        status: "active",
+        openedAt: now,
+        updatedAt: now
+      };
+      store.credits.push(record);
+    }
+    attachDvmLocation(record, key, args.identity);
+    adoptCreditId(record, args.creditId);
+    record.currency = args.currency;
+    record.targetMicro = args.targetMicro;
+    record.status = "active";
+    record.provisional = true;
+    record.updatedAt = now;
+    if (args.menu) record.menu = args.menu;
+    saveStore(store);
+  });
+}
+function markCredit(endpoint, callerPubkey, status, opts = {}) {
+  mutateCredit(
+    { endpoint, callerPubkey, ...opts.identity ? { identity: opts.identity } : {} },
+    (record) => {
+      if (opts.ifCreditId !== void 0 && record.creditId !== opts.ifCreditId) return "skip";
+      record.status = status;
+      if (status !== "active") {
+        delete record.refillUnavailableRail;
+        delete record.refillDrainNoticed;
+      }
+      if (status === "drained") record.remainingMicro = 0;
+      return void 0;
+    }
+  );
+}
 function loadCreditX402Binding(endpoint, callerPubkey, creditId, identity) {
   const record = loadCredit(endpoint, callerPubkey, identity);
   if (record?.creditId !== creditId) return {};
@@ -970,6 +699,127 @@ function recordCreditX402Instrument(endpoint, callerPubkey, creditId, instrument
     return void 0;
   });
 }
+function recordRefusedDrawBalance(args) {
+  const remaining = safeMicro(args.remainingMicro);
+  if (remaining === void 0) return;
+  const balance = safeMicro(args.balanceMicro);
+  mutateCredit(mutationAt(args.endpoint, args.callerPubkey, args.identity), (record) => {
+    if (record.creditId !== args.creditId) return "skip";
+    const unchanged = record.remainingMicro === remaining && (balance === void 0 || record.balanceMicro === balance) && record.unsequencedBalance === true && !record.provisional;
+    if (unchanged) return "skip";
+    record.remainingMicro = remaining;
+    if (balance !== void 0) record.balanceMicro = balance;
+    record.unsequencedBalance = true;
+    delete record.provisional;
+    return void 0;
+  });
+}
+function markRefillRailUnavailable(endpoint, callerPubkey, creditId, rail, identity) {
+  let firstObservation = false;
+  mutateCredit(mutationAt(endpoint, callerPubkey, identity), (record) => {
+    if (record.creditId !== creditId) return "skip";
+    if (record.refillUnavailableRail === rail) return "skip";
+    record.refillUnavailableRail = rail;
+    firstObservation = true;
+    return void 0;
+  });
+  return firstObservation;
+}
+function markRefillDrainNoticed(endpoint, callerPubkey, creditId, drainId, identity) {
+  let firstObservation = false;
+  mutateCredit(mutationAt(endpoint, callerPubkey, identity), (record) => {
+    if (record.creditId !== creditId) return "skip";
+    if (record.refillDrainNoticed === drainId) return "skip";
+    record.refillDrainNoticed = drainId;
+    firstObservation = true;
+    return void 0;
+  });
+  return firstObservation;
+}
+function clearRefillRailUnavailable(endpoint, callerPubkey, creditId, identity) {
+  mutateCredit(mutationAt(endpoint, callerPubkey, identity), (record) => {
+    if (record.creditId !== creditId) return "skip";
+    if (record.refillUnavailableRail === void 0) return "skip";
+    delete record.refillUnavailableRail;
+    return void 0;
+  });
+}
+function forgetCredit(endpoint, callerPubkey, identity) {
+  withCreditLock(() => {
+    const store = loadStore();
+    const key = normalizeCreditEndpoint(endpoint);
+    const record = findDvmLocated(store.credits, {
+      endpoint: key,
+      ...identity ? { identity } : {},
+      where: (c) => c.callerPubkey === callerPubkey
+    });
+    if (!record) return;
+    saveStore({ ...store, credits: store.credits.filter((c) => c !== record) });
+  });
+}
+function recordPendingDrain(endpoint, callerPubkey, drain, identity) {
+  mutateCredit(mutationAt(endpoint, callerPubkey, identity), (record) => {
+    const drains = record.pendingDrains ?? [];
+    const index = drains.findIndex(
+      (d) => d.drainId === drain.drainId && d.creditId === drain.creditId
+    );
+    if (index === -1) drains.push(drain);
+    else drains[index] = drain;
+    record.pendingDrains = capPendingDrains(drains, record.creditId);
+    return void 0;
+  });
+}
+function clearPendingDrain(endpoint, callerPubkey, drain, identity) {
+  mutateCredit(mutationAt(endpoint, callerPubkey, identity), (record) => {
+    const before = record.pendingDrains ?? [];
+    const remaining = before.filter(
+      (d) => !(d.drainId === drain.drainId && d.creditId === drain.creditId)
+    );
+    if (remaining.length === before.length) return "skip";
+    if (remaining.length === 0) delete record.pendingDrains;
+    else record.pendingDrains = remaining;
+    return void 0;
+  });
+}
+function recordDrainReceipts(args) {
+  const {
+    endpoint,
+    identity,
+    callerPubkey,
+    drainId,
+    creditId,
+    receipts,
+    read,
+    now = Date.now()
+  } = args;
+  if (receipts.length === 0) return;
+  mutateCredit(mutationAt(endpoint, callerPubkey, identity), (record) => {
+    const evidence = record.drainEvidence ??= [];
+    let bundle = evidence.find((e) => e.drainId === drainId);
+    if (!bundle) {
+      bundle = { drainId, creditId, receipts: [], collectedAt: now };
+      evidence.push(bundle);
+    }
+    bundle.creditId = creditId;
+    bundle.receipts = receipts;
+    bundle.collectedAt = now;
+    if (read.anchor) bundle.anchor = read.anchor;
+    else if (read.reachable) delete bundle.anchor;
+    record.drainEvidence = capDrainEvidence(evidence, endpoint);
+    return void 0;
+  });
+}
+function settleDrainEvidence(args) {
+  const { endpoint, identity, callerPubkey, drainId, now = Date.now() } = args;
+  mutateCredit(mutationAt(endpoint, callerPubkey, identity), (record) => {
+    const evidence = record.drainEvidence ?? [];
+    const bundle = evidence.find((e) => e.drainId === drainId);
+    if (!bundle || bundle.settledAt !== void 0) return "skip";
+    bundle.settledAt = now;
+    record.drainEvidence = capDrainEvidence(evidence, endpoint);
+    return void 0;
+  });
+}
 function identityFields(identity) {
   if (!identity) return {};
   return { dvmId: identity.dvmId, attestedBuilderPubkey: identity.builderPubkey };
@@ -1029,21 +879,23 @@ function adoptCreditId(record, creditId) {
   delete record.discrepancy;
   delete record.lastReceiptJobId;
 }
+var MAX_PENDING_DRAINS = 8;
+var MAX_SETTLED_DRAIN_EVIDENCE = 8;
 var MAX_LOST_IMPLICIT_CREDITS = 8;
 var MAX_DATE_MS = 864e13;
 function loadStore() {
-  if (!existsSync2(CREDITS_FILE)) {
+  if (!existsSync(CREDITS_FILE)) {
     return { credits: [], implicitCredits: [], pendingFundings: [], fundingMenuSnapshots: [] };
   }
-  let raw;
+  let raw2;
   try {
-    raw = readFileSync2(CREDITS_FILE, "utf-8");
+    raw2 = readFileSync(CREDITS_FILE, "utf-8");
   } catch (cause) {
     throw unreadableStore(cause);
   }
   let data;
   try {
-    const parsed = JSON.parse(raw);
+    const parsed = JSON.parse(raw2);
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
       throw new Error("the file parsed as JSON but is not a credit-store object");
     }
@@ -1118,6 +970,18 @@ function dedupeImplicitCredits(credits) {
   const capped = capLostImplicitCredits(merged);
   return { credits: capped.credits, changed: changed || capped.changed };
 }
+function ageImplicitCredits(credits, now) {
+  let changed = false;
+  for (const credit of credits) {
+    if (credit.status === "active" && credit.expiryMs <= now) {
+      credit.status = "lost";
+      credit.lossReason = "expired";
+      credit.updatedAt = now;
+      changed = true;
+    }
+  }
+  return changed;
+}
 function capLostImplicitCredits(credits) {
   const lostByOwner = /* @__PURE__ */ new Map();
   for (const credit of credits) {
@@ -1136,6 +1000,10 @@ function capLostImplicitCredits(credits) {
   }
   return dropped.size === 0 ? { credits, changed: false } : { credits: credits.filter((credit) => !dropped.has(credit)), changed: true };
 }
+function compareImplicitCredits(a, b) {
+  if (a.status !== b.status) return a.status === "active" ? -1 : 1;
+  return a.status === "active" ? a.expiryMs - b.expiryMs : b.updatedAt - a.updatedAt;
+}
 function mergeDuplicateSnapshots(snapshots, credits) {
   const identities = originIdentityMap(credits);
   const merged = [];
@@ -1339,6 +1207,21 @@ function isFundingMenuSnapshot(value) {
   const snapshot = value;
   return typeof snapshot.endpoint === "string" && typeof snapshot.callerPubkey === "string" && typeof snapshot.observedAt === "number" && Number.isFinite(snapshot.observedAt) && Math.abs(snapshot.observedAt) <= MAX_DATE_MS && parseCreditMenu(snapshot.menu) !== void 0 && (snapshot.builderPubkey === void 0 || typeof snapshot.builderPubkey === "string");
 }
+function siblingFromWire(credit, observedAt) {
+  return {
+    creditId: credit.credit_id,
+    status: credit.status ?? "active",
+    currency: credit.currency,
+    balanceMicro: credit.balance_micro,
+    remainingMicro: credit.remaining_micro,
+    ledgerSeq: credit.ledger_seq,
+    expiryMs: credit.expiry_ms,
+    expired: credit.expired,
+    drainable: credit.drainable,
+    ...credit.reconciliation_pending ? { reconciliationPending: true } : {},
+    observedAt
+  };
+}
 function normalizeRailKey(record) {
   const loose = record;
   if (loose.rail === LEGACY_TEMPO_RAIL_KEY) loose.rail = "tempo";
@@ -1402,15 +1285,37 @@ function isEvidenceish(value) {
 function isDrainish(value) {
   return typeof value === "object" && value !== null && typeof value.drainId === "string";
 }
+function capPendingDrains(drains, creditId) {
+  if (drains.length <= MAX_PENDING_DRAINS) return drains;
+  const evictable = drains.filter((d) => d.creditId !== creditId).sort((a, b) => a.requestedAt - b.requestedAt);
+  const dropped = new Set(evictable.slice(0, drains.length - MAX_PENDING_DRAINS));
+  for (const d of dropped) {
+    info(
+      `Dropping the oldest unclaimed drain record (${d.drainId}${d.creditId ? ` on credit ${d.creditId}` : ""}) \u2014 ${String(MAX_PENDING_DRAINS)} is the most this DVM's record keeps.`
+    );
+  }
+  return drains.filter((d) => !dropped.has(d));
+}
+function capDrainEvidence(evidence, endpoint) {
+  const settled = evidence.filter((e) => e.settledAt !== void 0).sort((a, b) => (a.settledAt ?? 0) - (b.settledAt ?? 0));
+  if (settled.length <= MAX_SETTLED_DRAIN_EVIDENCE) return evidence;
+  const dropped = new Set(settled.slice(0, settled.length - MAX_SETTLED_DRAIN_EVIDENCE));
+  for (const e of dropped) {
+    info(
+      `Dropping the oldest completed reclaim's receipts (drain ${e.drainId}${e.creditId ? ` on credit ${e.creditId}` : ""}) \u2014 ${String(MAX_SETTLED_DRAIN_EVIDENCE)} is the most this DVM's record archives. Export the ones still held before they age out too: 'dvm credit receipts ${endpoint} --export'.`
+    );
+  }
+  return evidence.filter((e) => !dropped.has(e));
+}
 function saveStore(store) {
   ensureConfigDir();
   const tmp = `${CREDITS_FILE}.${String(process.pid)}.tmp`;
-  writeFileSync2(tmp, JSON.stringify(store, null, 2) + "\n", { mode: 384 });
+  writeFileSync(tmp, JSON.stringify(store, null, 2) + "\n", { mode: 384 });
   try {
-    renameSync2(tmp, CREDITS_FILE);
+    renameSync(tmp, CREDITS_FILE);
   } catch (err) {
     try {
-      unlinkSync2(tmp);
+      unlinkSync(tmp);
     } catch {
     }
     throw err;
@@ -1431,7 +1336,7 @@ function quarantineCorruptStore(cause) {
   const quarantined = `${CREDITS_FILE}.corrupt-${stamp}-${String(process.pid)}`;
   let moved = false;
   try {
-    renameSync2(CREDITS_FILE, quarantined);
+    renameSync(CREDITS_FILE, quarantined);
     moved = true;
   } catch {
   }
@@ -1448,6 +1353,9 @@ function quarantineCorruptStore(cause) {
     `The local record of your prepaid credits is damaged. It was set aside at ${kept} rather than overwritten, so any signed proof of a refund you are owed is still in that file. Your credits are held by each DVM, not by this file, so re-reading a balance will restore what the CLI shows.`
   );
 }
+function safeMicro(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : void 0;
+}
 function mutateCredit(location, mutate) {
   withCreditLock(() => {
     const store = loadStore();
@@ -1480,7 +1388,7 @@ function acquireCreditLock(opts) {
   let lastError;
   for (let attempt = 0; attempt <= retries; attempt += 1) {
     try {
-      return lockfile2.lockSync(CREDITS_FILE, {
+      return lockfile.lockSync(CREDITS_FILE, {
         lockfilePath: lockPath,
         stale,
         realpath: false
@@ -1532,26 +1440,50 @@ function sleepSync(ms) {
 }
 
 export {
+  setOutputTraceId,
+  getOutputTraceId,
+  json,
   info,
+  raw,
   progress,
+  RAIL_FLAGS,
   maxAdvertisedMicro,
   withinAdvertisedTolerance,
-  isValidEvmPrivateKey,
-  authorizeProtectedRemoval,
-  isCreditPosture,
-  loadConfig,
-  updateConfig,
   SUPPORTED_PROTOCOL_VERSION,
   parseCreditTerms,
   parseCreditMenu,
   normalizeCreditEndpoint,
+  dvmLocationIdentity,
   fundingReachableAt,
+  pendingDrainFor,
+  pendingDrainById,
+  loadCredit,
+  clearCreditSelection,
   listCredits,
+  listImplicitCredits,
+  loadImplicitCredits,
+  markImplicitCreditLost,
+  listFundingMenuSnapshots,
+  recordFundingMenuSnapshot,
   listPendingFundings,
   loadPendingFunding,
   recordPendingFunding,
   clearPendingFunding,
   recordFundResponse,
+  recordBalanceResponse,
+  applyReceiptCredit,
+  applyImplicitReceiptCredit,
+  ensureProvisionalCredit,
+  markCredit,
   loadCreditX402Binding,
-  recordCreditX402Instrument
+  recordCreditX402Instrument,
+  recordRefusedDrawBalance,
+  markRefillRailUnavailable,
+  markRefillDrainNoticed,
+  clearRefillRailUnavailable,
+  forgetCredit,
+  recordPendingDrain,
+  clearPendingDrain,
+  recordDrainReceipts,
+  settleDrainEvidence
 };