@dvmkit/sdk 0.1.1-rc.7 → 0.1.3-rc.7

package/dist/chunk-2K7E3N2D.js

@@ -0,0 +1,1709 @@
+import {
+  costAnchor,
+  formatUsd,
+  msatsToUsd
+} from "./chunk-5URG56JJ.js";
+import {
+  AGENT_MNEMONIC_FILE,
+  BUILDER_CONFIG_DIR,
+  BUILDER_FILE,
+  BUILDER_KEY_FILE,
+  DvmError,
+  WALLET_FILE,
+  ensureConfigDir
+} from "./chunk-MKI6OVW4.js";
+import {
+  canonicaliseForSigning
+} from "./chunk-KXZUCCEY.js";
+import {
+  callerLoggers
+} from "./chunk-66HGCPBU.js";
+
+// src/lib/cashu/lock-pubkey.ts
+function toLockPubkey(raw) {
+  return raw.trim().toLowerCase();
+}
+
+// src/lib/x402/types.ts
+function isX402SettlementReconciliationReason(value) {
+  return value === "settlement_not_on_chain" || value === "chain_unreachable" || value === "settlement_unbookmarked" || value === "facilitator_channel_state_unavailable";
+}
+
+// src/lib/secret-backup.ts
+import { existsSync, readFileSync, writeFileSync } from "fs";
+function backupSecretFile(file, nextContent) {
+  const content = existsSync(file) ? readFileSync(file) : null;
+  if (content === null) return null;
+  if (content.toString("utf-8").trim() === nextContent?.trim()) return null;
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  for (let n = 0; n < 100; n++) {
+    const backup = n === 0 ? `${file}.${stamp}.bak` : `${file}.${stamp}-${String(n)}.bak`;
+    try {
+      writeFileSync(backup, content, { mode: 384, flag: "wx" });
+      return backup;
+    } catch (err) {
+      if (err.code !== "EEXIST") throw err;
+    }
+  }
+  throw new Error(`Could not create a backup of ${file}: 100 candidate paths already exist.`);
+}
+
+// src/lib/wallet-agent/agent-mnemonic-file.ts
+import {
+  chmodSync,
+  existsSync as existsSync2,
+  readFileSync as readFileSync2,
+  renameSync,
+  unlinkSync,
+  writeFileSync as writeFileSync2
+} from "fs";
+function readAgentMnemonic() {
+  if (!existsSync2(AGENT_MNEMONIC_FILE)) return null;
+  const raw = readFileSync2(AGENT_MNEMONIC_FILE, "utf-8");
+  return raw.trim().toLowerCase().split(/\s+/).join(" ");
+}
+function assertAgentMnemonicReplaceable(opts = {}) {
+  if (existsSync2(AGENT_MNEMONIC_FILE) && !opts.force) {
+    throw new DvmError(
+      "agent_mnemonic_exists",
+      `An agent wallet recovery mnemonic already exists at ${AGENT_MNEMONIC_FILE}.`,
+      "Re-run with --force to replace it. WARNING: funds locked to keys derived from the current words become unrecoverable without a backup. The replaced mnemonic is copied to a timestamped .bak sibling."
+    );
+  }
+}
+function writeAgentMnemonic(mnemonic, opts = {}) {
+  const normalised = mnemonic.trim().toLowerCase().split(/\s+/).join(" ");
+  assertAgentMnemonicReplaceable(opts);
+  ensureConfigDir();
+  const backupFile = backupSecretFile(AGENT_MNEMONIC_FILE, normalised);
+  const tmp = `${AGENT_MNEMONIC_FILE}.tmp`;
+  writeFileSync2(tmp, normalised + "\n", { mode: 384 });
+  try {
+    renameSync(tmp, AGENT_MNEMONIC_FILE);
+  } catch (err) {
+    try {
+      unlinkSync(tmp);
+    } catch {
+    }
+    throw err;
+  }
+  try {
+    chmodSync(AGENT_MNEMONIC_FILE, 384);
+  } catch {
+  }
+  return { backupFile };
+}
+function deleteAgentMnemonic() {
+  if (!existsSync2(AGENT_MNEMONIC_FILE)) return { backupFile: null };
+  const backupFile = backupSecretFile(AGENT_MNEMONIC_FILE);
+  unlinkSync(AGENT_MNEMONIC_FILE);
+  return { backupFile };
+}
+
+// src/lib/wallet-agent/mnemonic.ts
+import { createHash } from "crypto";
+import { HDKey } from "@scure/bip32";
+import {
+  generateMnemonic,
+  mnemonicToEntropy,
+  mnemonicToSeedSync,
+  validateMnemonic
+} from "@scure/bip39";
+import { wordlist } from "@scure/bip39/wordlists/english.js";
+var MNEMONIC_PURPOSE_INDEX = 1789;
+var AGENT_MASTER_ROLE_INDEX = 1;
+var MNEMONIC_STRENGTH_BITS = 128;
+function agentMasterKeypairPath() {
+  return `m/${MNEMONIC_PURPOSE_INDEX}'/${AGENT_MASTER_ROLE_INDEX}'`;
+}
+function generateAgentMnemonic() {
+  return generateMnemonic(wordlist, MNEMONIC_STRENGTH_BITS);
+}
+function deriveAgentMasterKeypair(mnemonic) {
+  const seed = mnemonicToSeedSync(mnemonic);
+  const hd = HDKey.fromMasterSeed(seed);
+  const child = hd.derive(agentMasterKeypairPath());
+  if (!child.privateKey || !child.publicKey) {
+    throw new Error("Failed to derive agent master keypair from mnemonic");
+  }
+  return {
+    privkey: Buffer.from(child.privateKey).toString("hex"),
+    pubkey: Buffer.from(child.publicKey).toString("hex")
+  };
+}
+function validateAgentMnemonic(mnemonic) {
+  const words = mnemonic.trim().toLowerCase().split(/\s+/);
+  if (words.length !== 12) {
+    return { ok: false, reason: "wrong_length", wordCount: words.length };
+  }
+  for (let i = 0; i < words.length; i++) {
+    if (!wordlist.includes(words[i])) {
+      return { ok: false, reason: "unknown_word", badWordIndex: i + 1, badWord: words[i] };
+    }
+  }
+  if (!validateMnemonic(words.join(" "), wordlist)) {
+    return { ok: false, reason: "checksum" };
+  }
+  return { ok: true };
+}
+function looksLikeMnemonic(input) {
+  return /\s/.test(input.trim());
+}
+function mnemonicFingerprint(mnemonic) {
+  const normalised = mnemonic.trim().toLowerCase().split(/\s+/).join(" ");
+  const entropy = mnemonicToEntropy(normalised, wordlist);
+  return createHash("sha256").update(entropy).digest("hex");
+}
+
+// src/lib/wallet-agent/store.ts
+import { existsSync as existsSync3, readFileSync as readFileSync3, renameSync as renameSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync3 } from "fs";
+import lockfile from "proper-lockfile";
+var LOCK_FILE = `${WALLET_FILE}.lock`;
+var DEFAULT_LOCK_STALE_MS = 3e4;
+var DEFAULT_LOCK_RETRIES = 30;
+var DEFAULT_LOCK_RETRY_INTERVAL_MS = 1e3;
+var WALLET_VERSION = 8;
+var RECENT_SPENDS_CAP = 10;
+var DEFAULT_AGENT_MINT_URL = "https://mint.coinos.io";
+function loadAgentWallet() {
+  if (!existsSync3(WALLET_FILE)) return null;
+  const raw = readFileSync3(WALLET_FILE, "utf-8");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new DvmError(
+      "wallet_corrupt",
+      `Wallet file at ${WALLET_FILE} is not valid JSON.`,
+      `Restore a backup or delete the file. Underlying error: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (typeof parsed !== "object" || parsed === null || !("version" in parsed)) {
+    throw new DvmError(
+      "wallet_corrupt",
+      `Wallet file at ${WALLET_FILE} is missing a version field.`,
+      "Restore a backup or run: dvm wallet init --force"
+    );
+  }
+  const version = parsed.version;
+  if (version === 1) {
+    return migrateV7ToV8(
+      migrateV6ToV7(migrateV5ToV6(migrateV4ToV5(migrateV1ToV4(parsed))))
+    );
+  }
+  if (version === 2) {
+    return migrateV7ToV8(
+      migrateV6ToV7(
+        migrateV5ToV6(
+          migrateV4ToV5(migrateV3ToV4(migrateV2ToV3(parsed)))
+        )
+      )
+    );
+  }
+  if (version === 3) {
+    return migrateV7ToV8(
+      migrateV6ToV7(migrateV5ToV6(migrateV4ToV5(migrateV3ToV4(parsed))))
+    );
+  }
+  if (version === 4) {
+    return migrateV7ToV8(
+      migrateV6ToV7(migrateV5ToV6(migrateV4ToV5(parsed)))
+    );
+  }
+  if (version === 5) {
+    return migrateV7ToV8(migrateV6ToV7(migrateV5ToV6(parsed)));
+  }
+  if (version === 6) {
+    return migrateV7ToV8(migrateV6ToV7(parsed));
+  }
+  if (version === 7) {
+    return migrateV7ToV8(parsed);
+  }
+  if (version !== WALLET_VERSION) {
+    throw new DvmError(
+      "wallet_unknown_version",
+      `Unknown wallet version ${String(version)} (this CLI understands version ${String(WALLET_VERSION)}).`,
+      "Upgrade dvm CLI: a newer version wrote this wallet."
+    );
+  }
+  return parsed;
+}
+function saveAgentWallet(wallet) {
+  ensureConfigDir();
+  const tmp = `${WALLET_FILE}.tmp`;
+  const data = JSON.stringify(wallet, null, 2) + "\n";
+  writeFileSync3(tmp, data, { mode: 384 });
+  try {
+    renameSync2(tmp, WALLET_FILE);
+  } catch (err) {
+    try {
+      unlinkSync2(tmp);
+    } catch {
+    }
+    throw err;
+  }
+}
+function walletExists() {
+  return existsSync3(WALLET_FILE);
+}
+async function withWalletLock(fn, opts = {}) {
+  ensureConfigDir();
+  const stale = opts.stale ?? DEFAULT_LOCK_STALE_MS;
+  const retries = opts.retries ?? DEFAULT_LOCK_RETRIES;
+  const interval = opts.retryIntervalMs ?? DEFAULT_LOCK_RETRY_INTERVAL_MS;
+  let release;
+  try {
+    release = await lockfile.lock(WALLET_FILE, {
+      lockfilePath: LOCK_FILE,
+      stale,
+      realpath: false,
+      retries: { retries, factor: 1, minTimeout: interval, maxTimeout: interval }
+    });
+  } catch (err) {
+    throw new DvmError(
+      "wallet_locked",
+      `Could not acquire the agent wallet lock at ${LOCK_FILE} within the retry budget.`,
+      `Another dvm CLI may be writing to ${WALLET_FILE}. Wait a moment and retry. If no other dvm CLI is running, remove ${LOCK_FILE} and try again.`,
+      { lock_file: LOCK_FILE, underlying: err instanceof Error ? err.message : String(err) }
+    );
+  }
+  try {
+    return await fn();
+  } finally {
+    try {
+      await release();
+    } catch {
+    }
+  }
+}
+function effectiveMints(wallet) {
+  return wallet.mints.length > 0 ? wallet.mints : [DEFAULT_AGENT_MINT_URL];
+}
+function effectiveFundingMint(mints) {
+  return mints.length > 0 ? { url: mints[0], source: "configured" } : { url: DEFAULT_AGENT_MINT_URL, source: "fallback" };
+}
+function migrateV1ToV4(parsed) {
+  const proofs = Array.isArray(parsed.proofs) ? parsed.proofs : [];
+  const pending = Array.isArray(parsed.pending_mints) ? parsed.pending_mints : [];
+  if (proofs.length > 0 || pending.length > 0) {
+    throw new DvmError(
+      "wallet_unknown_version",
+      `Cannot migrate v1 wallet at ${WALLET_FILE}: contains ${proofs.length} proofs and ${pending.length} pending mints under the legacy schema.`,
+      "v1 wallets predate the fund flow and are expected to be empty. If this wallet was somehow populated, restore a backup or run: dvm wallet init --force"
+    );
+  }
+  return {
+    version: 4,
+    lock_privkey: String(parsed.recovery_privkey ?? parsed.lock_privkey),
+    lock_pubkey: String(parsed.recovery_pubkey ?? parsed.lock_pubkey),
+    mints: Array.isArray(parsed.mints) ? parsed.mints : [],
+    proofs: [],
+    pending_mints: [],
+    recent_spends: [],
+    created_at: typeof parsed.created_at === "string" ? parsed.created_at : (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function migrateV2ToV3(parsed) {
+  return {
+    ...parsed,
+    version: 3,
+    recent_spends: []
+  };
+}
+function migrateV3ToV4(parsed) {
+  return {
+    version: 4,
+    lock_privkey: String(parsed.recovery_privkey ?? parsed.lock_privkey),
+    lock_pubkey: String(parsed.recovery_pubkey ?? parsed.lock_pubkey),
+    mints: Array.isArray(parsed.mints) ? parsed.mints : [],
+    proofs: Array.isArray(parsed.proofs) ? parsed.proofs : [],
+    pending_mints: Array.isArray(parsed.pending_mints) ? parsed.pending_mints : [],
+    recent_spends: Array.isArray(parsed.recent_spends) ? parsed.recent_spends : [],
+    created_at: typeof parsed.created_at === "string" ? parsed.created_at : (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function migrateV4ToV5(parsed) {
+  return {
+    version: 5,
+    lock_privkey: String(parsed.lock_privkey),
+    lock_pubkey: String(parsed.lock_pubkey),
+    mints: Array.isArray(parsed.mints) ? parsed.mints : [],
+    proofs: Array.isArray(parsed.proofs) ? parsed.proofs : [],
+    pending_mints: Array.isArray(parsed.pending_mints) ? parsed.pending_mints : [],
+    pending_submissions: Array.isArray(parsed.pending_submissions) ? parsed.pending_submissions : [],
+    recent_spends: Array.isArray(parsed.recent_spends) ? parsed.recent_spends : [],
+    created_at: typeof parsed.created_at === "string" ? parsed.created_at : (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function migrateV5ToV6(parsed) {
+  return {
+    version: 6,
+    lock_privkey: String(parsed.lock_privkey),
+    lock_pubkey: String(parsed.lock_pubkey),
+    mnemonic_fingerprint: typeof parsed.mnemonic_fingerprint === "string" ? parsed.mnemonic_fingerprint : null,
+    mints: Array.isArray(parsed.mints) ? parsed.mints : [],
+    proofs: Array.isArray(parsed.proofs) ? parsed.proofs : [],
+    nut13_counters: isCounterMap(parsed.nut13_counters) ? parsed.nut13_counters : {},
+    pending_mints: Array.isArray(parsed.pending_mints) ? parsed.pending_mints : [],
+    pending_submissions: Array.isArray(parsed.pending_submissions) ? parsed.pending_submissions : [],
+    recent_spends: Array.isArray(parsed.recent_spends) ? parsed.recent_spends : [],
+    created_at: typeof parsed.created_at === "string" ? parsed.created_at : (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function migrateV6ToV7(parsed) {
+  return {
+    version: 7,
+    lock_privkey: String(parsed.lock_privkey),
+    lock_pubkey: String(parsed.lock_pubkey),
+    mnemonic_fingerprint: typeof parsed.mnemonic_fingerprint === "string" ? parsed.mnemonic_fingerprint : null,
+    mints: Array.isArray(parsed.mints) ? parsed.mints : [],
+    proofs: Array.isArray(parsed.proofs) ? parsed.proofs : [],
+    nut13_counters: isCounterMap(parsed.nut13_counters) ? parsed.nut13_counters : {},
+    pending_mints: Array.isArray(parsed.pending_mints) ? parsed.pending_mints : [],
+    pending_submissions: Array.isArray(parsed.pending_submissions) ? parsed.pending_submissions : [],
+    recent_spends: Array.isArray(parsed.recent_spends) ? parsed.recent_spends : [],
+    created_at: typeof parsed.created_at === "string" ? parsed.created_at : (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function migrateV7ToV8(parsed) {
+  return {
+    version: WALLET_VERSION,
+    lock_privkey: String(parsed.lock_privkey),
+    lock_pubkey: String(parsed.lock_pubkey),
+    mnemonic_fingerprint: typeof parsed.mnemonic_fingerprint === "string" ? parsed.mnemonic_fingerprint : null,
+    mints: Array.isArray(parsed.mints) ? parsed.mints : [],
+    proofs: Array.isArray(parsed.proofs) ? parsed.proofs : [],
+    nut13_counters: isCounterMap(parsed.nut13_counters) ? parsed.nut13_counters : {},
+    pending_mints: Array.isArray(parsed.pending_mints) ? parsed.pending_mints : [],
+    pending_melts: Array.isArray(parsed.pending_melts) ? parsed.pending_melts : [],
+    pending_submissions: Array.isArray(parsed.pending_submissions) ? parsed.pending_submissions : [],
+    recent_spends: Array.isArray(parsed.recent_spends) ? parsed.recent_spends : [],
+    created_at: typeof parsed.created_at === "string" ? parsed.created_at : (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function isCounterMap(value) {
+  if (typeof value !== "object" || value === null) return false;
+  for (const inner of Object.values(value)) {
+    if (typeof inner !== "object" || inner === null) return false;
+    for (const n of Object.values(inner)) {
+      if (typeof n !== "number" || !Number.isFinite(n)) return false;
+    }
+  }
+  return true;
+}
+
+// src/lib/wallet-agent/nut13-counters.ts
+var PersistentCounterSource = class {
+  constructor(mintUrl) {
+    this.mintUrl = mintUrl;
+  }
+  mintUrl;
+  /**
+   * Reserve `n` counters for `keysetId`. Returns `{ start, count: n }`
+   * and bumps the persisted `next` to `start + n` under the wallet lock.
+   *
+   * Per cashu-ts contract, `n === 0` MUST NOT mutate state and is a
+   * pure peek — we honour that by returning `{ start, count: 0 }`
+   * without acquiring the lock.
+   */
+  async reserve(keysetId, n) {
+    if (n === 0) {
+      const wallet = loadAgentWallet();
+      const current = wallet?.nut13_counters[this.mintUrl]?.[keysetId] ?? 0;
+      return { start: current, count: 0 };
+    }
+    return withWalletLock(() => {
+      const wallet = this.loadOrThrow();
+      const current = wallet.nut13_counters[this.mintUrl]?.[keysetId] ?? 0;
+      saveAgentWallet(this.withCounter(wallet, keysetId, current + n));
+      return { start: current, count: n };
+    });
+  }
+  /**
+   * Monotonic bump: ensure the persisted `next` for `keysetId` is at
+   * least `minNext`. No-op if the wallet is already ahead. Used by
+   * cashu-ts when the mint reports `outputs_already_signed` — the
+   * losing wallet rolls forward past the colliding counter.
+   */
+  async advanceToAtLeast(keysetId, minNext) {
+    await withWalletLock(() => {
+      const wallet = this.loadOrThrow();
+      const current = wallet.nut13_counters[this.mintUrl]?.[keysetId] ?? 0;
+      if (current >= minNext) return;
+      saveAgentWallet(this.withCounter(wallet, keysetId, minNext));
+    });
+  }
+  /**
+   * Snapshot the per-keyset `next` map for this mint. Useful for
+   * `dvm wallet show` and test assertions; cashu-ts itself does not
+   * depend on `snapshot` being implemented.
+   */
+  snapshot() {
+    const wallet = loadAgentWallet();
+    const counters = wallet?.nut13_counters[this.mintUrl] ?? {};
+    const out = {};
+    for (const [keyset, next] of Object.entries(counters)) {
+      if (typeof next === "number") out[keyset] = next;
+    }
+    return Promise.resolve(out);
+  }
+  /**
+   * Hard-set the persisted `next` for `keysetId`. Used by
+   * `dvm wallet restore` to re-anchor counters after walking
+   * `batchRestore` per keyset. cashu-ts also exposes this on
+   * `wallet.counters.setNext`.
+   */
+  async setNext(keysetId, next) {
+    await withWalletLock(() => {
+      const wallet = this.loadOrThrow();
+      saveAgentWallet(this.withCounter(wallet, keysetId, next));
+    });
+  }
+  loadOrThrow() {
+    const wallet = loadAgentWallet();
+    if (!wallet) {
+      throw new DvmError(
+        "wallet_missing",
+        "NUT-13 counter persistence requires an agent wallet at ~/.dvm/wallet.json.",
+        "Run `dvm wallet init` or `dvm wallet recover --file <path>` (or pipe the mnemonic via stdin) first."
+      );
+    }
+    return wallet;
+  }
+  withCounter(wallet, keysetId, next) {
+    return {
+      ...wallet,
+      nut13_counters: {
+        ...wallet.nut13_counters,
+        [this.mintUrl]: {
+          ...wallet.nut13_counters[this.mintUrl] ?? {},
+          [keysetId]: next
+        }
+      }
+    };
+  }
+};
+
+// src/lib/cashu/health.ts
+var DEFAULT_REQUIRED_NUTS = [4, 5, 7, 9, 10, 11, 20];
+async function checkMintHealth(mintUrl, opts) {
+  const timeoutMs = opts?.timeoutMs ?? 5e3;
+  const retries = opts?.retries ?? 3;
+  const backoff = opts?.backoffMs ?? [200, 500, 1e3];
+  const fetchImpl = opts?.fetchImpl ?? fetch;
+  const url = mintUrl.replace(/\/+$/, "") + "/v1/info";
+  let lastError;
+  let lastLatency = 0;
+  for (let attempt = 0; attempt < retries; attempt++) {
+    if (attempt > 0) {
+      const delay = backoff[Math.min(attempt - 1, backoff.length - 1)];
+      await sleep(delay);
+    }
+    const startedAt = Date.now();
+    try {
+      const res = await fetchImpl(url, { signal: AbortSignal.timeout(timeoutMs) });
+      lastLatency = Date.now() - startedAt;
+      if (!res.ok) {
+        lastError = { code: "http_error", message: `HTTP ${res.status}` };
+        continue;
+      }
+      let info;
+      try {
+        info = await res.json();
+      } catch (err) {
+        lastError = {
+          code: "parse_error",
+          message: err instanceof Error ? err.message : String(err)
+        };
+        continue;
+      }
+      return parseInfo(mintUrl, info, lastLatency);
+    } catch (err) {
+      lastLatency = Date.now() - startedAt;
+      lastError = classifyFetchError(err);
+    }
+  }
+  return {
+    mintUrl,
+    ok: false,
+    latencyMs: lastLatency,
+    error: lastError ?? { code: "network", message: "no attempts recorded" }
+  };
+}
+function parseInfo(mintUrl, info, latencyMs) {
+  if (!isRecord(info)) {
+    return {
+      mintUrl,
+      ok: false,
+      latencyMs,
+      error: { code: "parse_error", message: "/v1/info response is not an object" }
+    };
+  }
+  const pubkey = typeof info.pubkey === "string" ? info.pubkey : void 0;
+  const version = typeof info.version === "string" ? info.version : void 0;
+  if (!pubkey || !version) {
+    const missing = [];
+    if (!pubkey) missing.push("pubkey");
+    if (!version) missing.push("version");
+    return {
+      mintUrl,
+      ok: false,
+      latencyMs,
+      pubkey,
+      version,
+      error: {
+        code: "missing_fields",
+        message: `NUT-06 missing required fields: ${missing.join(", ")}`
+      }
+    };
+  }
+  const nutsRaw = isRecord(info.nuts) ? info.nuts : {};
+  const supportedNuts = Object.keys(nutsRaw).sort(byNutKey);
+  const missingRequiredNuts = DEFAULT_REQUIRED_NUTS.map(String).filter((n) => !(n in nutsRaw));
+  const bolt11SatMintSupported = hasBolt11Sat(nutsRaw["4"]);
+  const bolt11SatMeltSupported = hasBolt11Sat(nutsRaw["5"]);
+  return {
+    mintUrl,
+    ok: true,
+    latencyMs,
+    pubkey,
+    version,
+    supportedNuts,
+    missingRequiredNuts,
+    bolt11SatMintSupported,
+    bolt11SatMeltSupported,
+    mintingEnabled: canMintBolt11Sat(nutsRaw),
+    meltingEnabled: canMeltBolt11Sat(nutsRaw),
+    swapEnabled: canSwap(nutsRaw),
+    mintAmountBounds: mintAmountBounds(nutsRaw),
+    meltAmountBounds: meltAmountBounds(nutsRaw),
+    nutCompliant: evaluateNutSupport(nutsRaw).ok,
+    nutsRaw
+  };
+}
+function canMintBolt11Sat(nuts) {
+  return isMethodEnabled(nuts["4"]);
+}
+function canMeltBolt11Sat(nuts) {
+  return isMethodEnabled(nuts["5"]);
+}
+function canSwap(nuts) {
+  const node = nuts["3"];
+  if (!isRecord(node)) return true;
+  if (node.disabled === true) return false;
+  return node.supported !== false;
+}
+function isMethodEnabled(node) {
+  if (!hasBolt11Sat(node)) return false;
+  return node.disabled !== true;
+}
+function mintAmountBounds(nuts) {
+  return boundsOf(nuts["4"]);
+}
+function meltAmountBounds(nuts) {
+  return boundsOf(nuts["5"]);
+}
+function amountBoundsVerdict(sats, bounds) {
+  if (!bounds) return "ok";
+  if (bounds.minSats !== null && sats < bounds.minSats) return "below_min";
+  if (bounds.maxSats !== null && sats > bounds.maxSats) return "above_max";
+  return "ok";
+}
+function boundsOf(node) {
+  const method = findBolt11Sat(node);
+  return {
+    minSats: method ? toBoundSats(method.min_amount) : null,
+    maxSats: method ? toBoundSats(method.max_amount) : null
+  };
+}
+function toBoundSats(value) {
+  if (typeof value === "bigint") {
+    return value >= 0n && value <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(value) : null;
+  }
+  const n = typeof value === "number" ? value : typeof value === "string" && value.trim() !== "" ? Number(value) : NaN;
+  if (!Number.isFinite(n) || n < 0) return null;
+  return Math.floor(n);
+}
+function evaluateNutSupport(nuts, requiredNuts = DEFAULT_REQUIRED_NUTS) {
+  const missingNuts = requiredNuts.filter((n) => {
+    const entry = nuts[String(n)];
+    if (entry === void 0 || entry === null) return true;
+    return typeof entry === "object" && entry.supported === false;
+  });
+  const missingBolt11 = [];
+  if (!hasBolt11Sat(nuts["4"])) missingBolt11.push("mint");
+  if (!hasBolt11Sat(nuts["5"])) missingBolt11.push("melt");
+  return {
+    ok: missingNuts.length === 0 && missingBolt11.length === 0,
+    missingNuts: missingNuts.length > 0 ? [...missingNuts] : void 0,
+    missingBolt11: missingBolt11.length > 0 ? missingBolt11 : void 0
+  };
+}
+function assertNutSupport(mintUrl, nuts, requiredNuts = DEFAULT_REQUIRED_NUTS) {
+  const verdict = evaluateNutSupport(nuts, requiredNuts);
+  if (verdict.missingNuts && verdict.missingNuts.length > 0) {
+    throw new DvmError(
+      "cashu_nut_support_missing",
+      `Mint ${mintUrl} does not support required NUTs: ${verdict.missingNuts.join(", ")}. Required: ${requiredNuts.join(", ")}.`,
+      "Choose a mint that supports all required NUT capabilities for P2PK-locked Cashu payments."
+    );
+  }
+  if (verdict.missingBolt11?.includes("mint")) {
+    throw new DvmError(
+      "cashu_nut_support_missing",
+      `Mint ${mintUrl} does not advertise bolt11/sat method on NUT-4 (mint quotes).`,
+      "Choose a mint that advertises bolt11/sat on NUT-4 mint quotes."
+    );
+  }
+  if (verdict.missingBolt11?.includes("melt")) {
+    throw new DvmError(
+      "cashu_nut_support_missing",
+      `Mint ${mintUrl} does not advertise bolt11/sat method on NUT-5 (melt quotes).`,
+      "Choose a mint that advertises bolt11/sat on NUT-5 melt quotes."
+    );
+  }
+}
+function hasBolt11Sat(node) {
+  return findBolt11Sat(node) !== void 0;
+}
+function findBolt11Sat(node) {
+  if (!isRecord(node)) return void 0;
+  const methods = node.methods;
+  if (!Array.isArray(methods)) return void 0;
+  return methods.find((m) => isRecord(m) && m.method === "bolt11" && m.unit === "sat");
+}
+function classifyFetchError(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  if (err instanceof Error) {
+    if (err.name === "TimeoutError" || err.name === "AbortError") {
+      return { code: "timeout", message };
+    }
+  }
+  return { code: "network", message };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function byNutKey(a, b) {
+  const an = Number(a);
+  const bn = Number(b);
+  if (Number.isFinite(an) && Number.isFinite(bn)) return an - bn;
+  return a.localeCompare(b);
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/lib/cashu/wallet.ts
+import { Wallet } from "@cashu/cashu-ts";
+import { mnemonicToSeedSync as mnemonicToSeedSync2 } from "@scure/bip39";
+var walletCache = /* @__PURE__ */ new Map();
+var keysetResidueRegistry = /* @__PURE__ */ new Map();
+var NUT13_MODULUS = BigInt(2 ** 31 - 1);
+function assertNoKeysetCollision(keysets, mintUrl) {
+  for (const keyset of keysets) {
+    let residue;
+    try {
+      residue = BigInt("0x" + keyset.id) % NUT13_MODULUS;
+    } catch {
+      throw new DvmError(
+        "cashu_keyset_collision",
+        `Mint ${mintUrl} has keyset ID "${keyset.id}" that is not valid hex. Cannot verify NUT-13 collision safety.`,
+        "Contact the mint operator to ensure the mint returns standard keyset IDs."
+      );
+    }
+    const existing = keysetResidueRegistry.get(residue);
+    if (existing && existing.keysetId !== keyset.id) {
+      throw new DvmError(
+        "cashu_keyset_collision",
+        `Keyset collision detected: mint ${mintUrl} keyset ${keyset.id} and mint ${existing.mintUrl} keyset ${existing.keysetId} share the same 31-bit NUT-13 residue. Cannot safely derive deterministic secrets.`,
+        "Contact the affected mint operators to rotate their keyset IDs."
+      );
+    }
+    keysetResidueRegistry.set(residue, { keysetId: keyset.id, mintUrl });
+  }
+}
+async function getWallet(mintUrl) {
+  const cached = walletCache.get(mintUrl);
+  if (cached) return cached;
+  return callerLoggers.cashu.span("cashu.get_wallet", { mint_url: mintUrl }, async () => {
+    let nut13 = loadNut13Config(mintUrl);
+    let wallet = await buildAndLoadWallet(mintUrl, nut13);
+    if (nut13) {
+      if (wallet.getKeyset().id.startsWith("00")) {
+        nut13 = null;
+        wallet = await buildAndLoadWallet(mintUrl, null);
+      }
+    }
+    assertNutSupport(mintUrl, wallet.getMintInfo().cache.nuts);
+    if (nut13) {
+      const restoreKeysets = wallet.keyChain.getKeysets().filter((keyset) => keyset.unit === wallet.unit && !keyset.id.startsWith("00"));
+      assertNoKeysetCollision(restoreKeysets, mintUrl);
+    }
+    walletCache.set(mintUrl, wallet);
+    return wallet;
+  });
+}
+async function buildAndLoadWallet(mintUrl, nut13) {
+  const wallet = nut13 ? new Wallet(mintUrl, nut13) : new Wallet(mintUrl);
+  try {
+    await wallet.loadMint();
+  } catch {
+    throw new DvmError(
+      "cashu_mint_unreachable",
+      `Cannot connect to mint: ${mintUrl}`,
+      "The mint is not responding. Try again later."
+    );
+  }
+  return wallet;
+}
+function loadNut13Config(mintUrl) {
+  const wallet = loadAgentWallet();
+  if (!wallet?.mnemonic_fingerprint) return null;
+  const mnemonic = readAgentMnemonic();
+  if (!mnemonic) return null;
+  const actual = mnemonicFingerprint(mnemonic);
+  if (actual !== wallet.mnemonic_fingerprint) {
+    throw new DvmError(
+      "wallet_mnemonic_mismatch",
+      "The mnemonic at ~/.dvm/wallet.mnemonic does not match the fingerprint recorded on ~/.dvm/wallet.json.",
+      "Either restore the matching mnemonic file from a backup, or run `dvm wallet restore --force --file <path>` (or pipe the mnemonic via stdin) with the wallet's actual mnemonic to rebuild from scratch."
+    );
+  }
+  return {
+    bip39seed: mnemonicToSeedSync2(mnemonic),
+    counterSource: new PersistentCounterSource(mintUrl)
+  };
+}
+
+// src/lib/x402/batch-abi.ts
+var X402_CHANNEL_CONFIG_COMPONENTS = [
+  { name: "payer", type: "address" },
+  { name: "payerAuthorizer", type: "address" },
+  { name: "receiver", type: "address" },
+  { name: "receiverAuthorizer", type: "address" },
+  { name: "token", type: "address" },
+  { name: "withdrawDelay", type: "uint40" },
+  { name: "salt", type: "bytes32" }
+];
+var X402_BATCH_CHANNEL_ABI = [
+  {
+    type: "function",
+    name: "initiateWithdraw",
+    inputs: [
+      { name: "config", type: "tuple", components: X402_CHANNEL_CONFIG_COMPONENTS },
+      { name: "amount", type: "uint128" }
+    ],
+    outputs: [],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "finalizeWithdraw",
+    inputs: [{ name: "config", type: "tuple", components: X402_CHANNEL_CONFIG_COMPONENTS }],
+    outputs: [],
+    stateMutability: "nonpayable"
+  },
+  {
+    type: "function",
+    name: "channels",
+    inputs: [{ name: "channelId", type: "bytes32" }],
+    outputs: [
+      { name: "balance", type: "uint128" },
+      { name: "totalClaimed", type: "uint128" }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "pendingWithdrawals",
+    inputs: [{ name: "channelId", type: "bytes32" }],
+    outputs: [
+      { name: "amount", type: "uint128" },
+      { name: "initiatedAt", type: "uint40" }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "refundNonce",
+    inputs: [{ name: "channelId", type: "bytes32" }],
+    outputs: [{ name: "", type: "uint256" }],
+    stateMutability: "view"
+  },
+  {
+    type: "event",
+    name: "WithdrawInitiated",
+    inputs: [
+      { name: "channelId", type: "bytes32", indexed: true },
+      { name: "amount", type: "uint128", indexed: false },
+      { name: "finalizeAfter", type: "uint40", indexed: false }
+    ]
+  },
+  {
+    type: "event",
+    name: "WithdrawFinalized",
+    inputs: [
+      { name: "channelId", type: "bytes32", indexed: true },
+      { name: "sender", type: "address", indexed: true },
+      { name: "amount", type: "uint128", indexed: false }
+    ]
+  }
+];
+
+// src/lib/receipt-key.ts
+import { schnorr, secp256k1 } from "@noble/curves/secp256k1.js";
+import { hkdf } from "@noble/hashes/hkdf.js";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { bytesToHex, hexToBytes } from "@noble/hashes/utils.js";
+var RECEIPT_KDF_SALT = "dvmkit/receipt/v1";
+function deriveReceiptSecret(builderSecretHex, dvmId) {
+  const ikm = hexToBytes(builderSecretHex);
+  const salt = new TextEncoder().encode(RECEIPT_KDF_SALT);
+  for (let counter = 0; counter < 256; counter++) {
+    const info = new TextEncoder().encode(
+      counter === 0 ? `${RECEIPT_KDF_SALT}/${dvmId}` : `${RECEIPT_KDF_SALT}/${dvmId}#${String(counter)}`
+    );
+    const candidate = hkdf(sha256, ikm, salt, info, 32);
+    if (secp256k1.utils.isValidSecretKey(candidate)) return bytesToHex(candidate);
+  }
+  throw new Error(`deriveReceiptSecret: no valid secp256k1 scalar for DVM ID "${dvmId}"`);
+}
+function receiptPubkeyFromSecret(secretHex) {
+  return bytesToHex(schnorr.getPublicKey(hexToBytes(secretHex)));
+}
+function deriveReceiptKeypair(builderSecretHex, dvmId) {
+  const secret = deriveReceiptSecret(builderSecretHex, dvmId);
+  return { secret, pubkey: receiptPubkeyFromSecret(secret) };
+}
+function generateEphemeralReceiptKey() {
+  const { secretKey, publicKey } = schnorr.keygen();
+  return { secret: bytesToHex(secretKey), pubkey: bytesToHex(publicKey) };
+}
+
+// src/lib/builder-identity.ts
+import {
+  chmodSync as chmodSync3,
+  existsSync as existsSync5,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync5,
+  renameSync as renameSync4,
+  statSync,
+  unlinkSync as unlinkSync4,
+  writeFileSync as writeFileSync5
+} from "fs";
+import { schnorr as schnorr2 } from "@noble/curves/secp256k1.js";
+import { sha256 as sha2562 } from "@noble/hashes/sha2.js";
+
+// src/lib/builder-store.ts
+import {
+  chmodSync as chmodSync2,
+  existsSync as existsSync4,
+  mkdirSync,
+  readFileSync as readFileSync4,
+  renameSync as renameSync3,
+  unlinkSync as unlinkSync3,
+  writeFileSync as writeFileSync4
+} from "fs";
+var CURRENT_VERSION = 2;
+function loadBuilderStore() {
+  if (!existsSync4(BUILDER_FILE)) {
+    return { version: CURRENT_VERSION, dvms: {} };
+  }
+  const raw = readFileSync4(BUILDER_FILE, "utf-8");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(
+      `${BUILDER_FILE} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`,
+      { cause: err }
+    );
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    throw new Error(`${BUILDER_FILE} is not a JSON object`);
+  }
+  const values = parsed;
+  const version = values.version;
+  if (version === 1) {
+    return migrateV1Store(parsed);
+  }
+  if (version !== CURRENT_VERSION) {
+    throw new Error(
+      `${BUILDER_FILE} has unknown version ${String(version)} (expected ${CURRENT_VERSION})`
+    );
+  }
+  if (typeof values.dvms !== "object" || values.dvms === null) {
+    throw new Error(`${BUILDER_FILE} is missing the dvms object`);
+  }
+  return {
+    version: CURRENT_VERSION,
+    ...typeof values.identity_pubkey === "string" ? { identity_pubkey: values.identity_pubkey } : {},
+    dvms: values.dvms
+  };
+}
+function loadIdentityPubkey() {
+  return loadBuilderStore().identity_pubkey ?? null;
+}
+function setIdentityPubkey(pubkey) {
+  mkdirSync(BUILDER_CONFIG_DIR, { recursive: true, mode: 448 });
+  const store = loadBuilderStore();
+  store.identity_pubkey = pubkey;
+  writeBuilderStore(store);
+}
+function writeBuilderStore(store) {
+  const content = JSON.stringify(store, null, 2) + "\n";
+  backupSecretFile(BUILDER_FILE, content);
+  const tmp = `${BUILDER_FILE}.tmp`;
+  try {
+    writeFileSync4(tmp, content, { mode: 384 });
+    renameSync3(tmp, BUILDER_FILE);
+  } catch (err) {
+    try {
+      unlinkSync3(tmp);
+    } catch {
+    }
+    throw err;
+  }
+  try {
+    chmodSync2(BUILDER_FILE, 384);
+  } catch {
+  }
+}
+function migrateV1Store(parsed) {
+  if (typeof parsed.dvms !== "object" || parsed.dvms === null) {
+    throw new Error(`${BUILDER_FILE} is missing the dvms object`);
+  }
+  const dvms = {};
+  for (const [handle, rawEntry] of Object.entries(parsed.dvms)) {
+    if (typeof rawEntry !== "object" || rawEntry === null) {
+      throw new Error(`${BUILDER_FILE} has an invalid DVM entry for ${handle}`);
+    }
+    const entry = rawEntry;
+    const dvmId = entry.canonical_dvm_id;
+    if (typeof dvmId !== "string") {
+      throw new Error(`${BUILDER_FILE} has no canonical_dvm_id for ${handle}`);
+    }
+    if (Object.prototype.hasOwnProperty.call(dvms, dvmId)) {
+      throw new Error(`${BUILDER_FILE} has multiple entries for canonical_dvm_id ${dvmId}`);
+    }
+    dvms[dvmId] = { ...entry, handle };
+  }
+  return {
+    version: CURRENT_VERSION,
+    ...typeof parsed.identity_pubkey === "string" ? { identity_pubkey: parsed.identity_pubkey } : {},
+    dvms
+  };
+}
+
+// src/lib/builder-identity.ts
+function generateIdentity() {
+  const { secretKey, publicKey } = schnorr2.keygen();
+  return { pubkey: bytesToHex2(publicKey), secret: bytesToHex2(secretKey) };
+}
+function loadIdentitySecret() {
+  if (!existsSync5(BUILDER_KEY_FILE)) return null;
+  warnAndTightenLooseKeyMode();
+  const raw = readFileSync5(BUILDER_KEY_FILE, "utf-8").trim();
+  if (!/^[0-9a-f]{64}$/.test(raw)) {
+    throw new DvmError(
+      "identity_secret_malformed",
+      `${BUILDER_KEY_FILE} is not a 32-byte hex secret.`,
+      "Delete the file and re-run `dvmctl identity create` (this rotates the key \u2014 existing DVM attestations need re-deploy)."
+    );
+  }
+  return raw;
+}
+function writeIdentity(keypair, opts = {}) {
+  const existing = loadIdentityPubkey();
+  if (existing && !opts.force) {
+    throw new DvmError(
+      "identity_exists",
+      "A builder identity already exists.",
+      "Pass --force to overwrite. Any DVMs deployed under the old key will need to be re-deployed to refresh their /v1/info attestation."
+    );
+  }
+  mkdirSync2(BUILDER_CONFIG_DIR, { recursive: true, mode: 448 });
+  const tmp = `${BUILDER_KEY_FILE}.tmp`;
+  writeFileSync5(tmp, keypair.secret + "\n", { mode: 384 });
+  try {
+    renameSync4(tmp, BUILDER_KEY_FILE);
+  } catch (err) {
+    try {
+      unlinkSync4(tmp);
+    } catch {
+    }
+    throw err;
+  }
+  try {
+    chmodSync3(BUILDER_KEY_FILE, 384);
+  } catch {
+  }
+  setIdentityPubkey(keypair.pubkey);
+}
+function hashCapabilities(capabilities) {
+  return bytesToHex2(sha2562(canonicaliseForSigning(capabilities)));
+}
+function buildAttestation(args) {
+  return {
+    dvm_id: args.dvmId,
+    slug: args.slug,
+    capabilities_hash: hashCapabilities(args.capabilities),
+    builder_pubkey: args.builderPubkey,
+    ...args.receiptPubkey ? { receipt_pubkey: args.receiptPubkey } : {},
+    deployed_at: args.deployedAt ?? Math.floor(Date.now() / 1e3)
+  };
+}
+function signAttestation(payload, secretHex) {
+  const secretBytes = hexToBytes2(secretHex);
+  const canonicalBytes = canonicaliseForSigning(payload);
+  return bytesToHex2(schnorr2.sign(canonicalBytes, secretBytes));
+}
+function verifyAttestation(payload, signatureHex, pubkeyHex) {
+  try {
+    const canonicalBytes = canonicaliseForSigning(payload);
+    return schnorr2.verify(hexToBytes2(signatureHex), canonicalBytes, hexToBytes2(pubkeyHex));
+  } catch {
+    return false;
+  }
+}
+function warnAndTightenLooseKeyMode() {
+  if (process.platform === "win32") return;
+  try {
+    const mode = statSync(BUILDER_KEY_FILE).mode & 511;
+    if ((mode & 63) === 0) return;
+    console.warn(
+      JSON.stringify({
+        level: "warn",
+        event: "builder_identity_key_loose_mode",
+        message: `${BUILDER_KEY_FILE} is group/other-readable (mode ${mode.toString(8).padStart(3, "0")}). The builder signing key should be owner-only \u2014 re-tightening to 0600. A cp/scp/git checkout can widen the mode; verify nobody else read it in the meantime.`,
+        path: BUILDER_KEY_FILE,
+        mode: mode.toString(8).padStart(3, "0")
+      })
+    );
+    chmodSync3(BUILDER_KEY_FILE, 384);
+  } catch {
+  }
+}
+function bytesToHex2(bytes) {
+  let s = "";
+  for (const b of bytes) s += b.toString(16).padStart(2, "0");
+  return s;
+}
+function hexToBytes2(hex) {
+  if (hex.length % 2 !== 0) {
+    throw new Error(`hex string has odd length: ${String(hex.length)}`);
+  }
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) {
+    out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return out;
+}
+
+// src/lib/receipt.ts
+import { schnorr as schnorr3 } from "@noble/curves/secp256k1.js";
+import { sha256 as sha2563 } from "@noble/hashes/sha2.js";
+import { bytesToHex as bytesToHex3, hexToBytes as hexToBytes3 } from "@noble/hashes/utils.js";
+function computeResultHash(summary, artifactContents) {
+  const artifactHashes = artifactContents.map(
+    (content) => bytesToHex3(sha2563(canonicaliseForSigning(content)))
+  );
+  return bytesToHex3(
+    sha2563(
+      canonicaliseForSigning({
+        summary: summary ?? null,
+        artifact_hashes: artifactHashes
+      })
+    )
+  );
+}
+function signReceipt(unsigned, secretHex) {
+  const bytes = canonicaliseForSigning(unsigned);
+  const signature = bytesToHex3(schnorr3.sign(bytes, hexToBytes3(secretHex)));
+  return { ...unsigned, signature };
+}
+function verifyReceipt(receipt) {
+  try {
+    const { signature, ...unsigned } = receipt;
+    const bytes = canonicaliseForSigning(unsigned);
+    return schnorr3.verify(hexToBytes3(signature), bytes, hexToBytes3(receipt.receipt_pubkey));
+  } catch {
+    return false;
+  }
+}
+function isSignedJobReceipt(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const r = value;
+  const paid = r.paid;
+  return r.v === 1 && typeof r.job_id === "string" && typeof r.dvm_id === "string" && typeof r.dvm === "string" && typeof r.capability === "string" && (r.outcome === "completed" || r.outcome === "failed" || r.outcome === "cancelled") && typeof r.seq === "number" && typeof r.issued_at === "number" && typeof r.receipt_pubkey === "string" && typeof r.signature === "string" && !!paid && typeof paid === "object" && !Array.isArray(paid) && typeof paid.msats === "number";
+}
+function signDrainReceipt(unsigned, secretHex) {
+  const bytes = canonicaliseForSigning(unsigned);
+  const signature = bytesToHex3(schnorr3.sign(bytes, hexToBytes3(secretHex)));
+  return { ...unsigned, signature };
+}
+function signFundingReceipt(unsigned, secretHex) {
+  const bytes = canonicaliseForSigning(unsigned);
+  const signature = bytesToHex3(schnorr3.sign(bytes, hexToBytes3(secretHex)));
+  return { ...unsigned, signature };
+}
+function isFundingReceipt(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const r = value;
+  return r.v === 1 && r.kind === "credit_funding" && typeof r.credit_id === "string" && typeof r.fund_id === "string" && typeof r.funded_micro === "number" && typeof r.balance_after_micro === "number" && typeof r.ledger_seq === "number" && typeof r.issued_at === "number" && typeof r.caller_pubkey === "string" && typeof r.dvm_id === "string" && typeof r.dvm === "string" && typeof r.receipt_pubkey === "string" && typeof r.signature === "string";
+}
+function verifyFundingReceipt(receipt) {
+  try {
+    const { signature, ...unsigned } = receipt;
+    const bytes = canonicaliseForSigning(unsigned);
+    return schnorr3.verify(hexToBytes3(signature), bytes, hexToBytes3(receipt.receipt_pubkey));
+  } catch {
+    return false;
+  }
+}
+function isDrainReceipt(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const r = value;
+  return r.v === 1 && r.kind === "credit_drain" && typeof r.credit_id === "string" && typeof r.drain_id === "string" && (r.event === "requested" || r.event === "parked" || r.event === "picked_up" || r.event === "sent" || r.event === "released") && typeof r.method === "string" && typeof r.amount_micro === "number" && typeof r.issued_at === "number" && typeof r.caller_pubkey === "string" && typeof r.dvm_id === "string" && typeof r.dvm === "string" && typeof r.receipt_pubkey === "string" && typeof r.signature === "string";
+}
+function verifyDrainReceipt(receipt) {
+  try {
+    const { signature, ...unsigned } = receipt;
+    const bytes = canonicaliseForSigning(unsigned);
+    return schnorr3.verify(hexToBytes3(signature), bytes, hexToBytes3(receipt.receipt_pubkey));
+  } catch {
+    return false;
+  }
+}
+
+// src/lib/receipt-verify.ts
+function attestedDvmIdentity(builder) {
+  const builderPubkey = authenticatedBuilderPubkey(builder);
+  if (!builderPubkey) return void 0;
+  const dvmId = builder.attestation.dvm_id;
+  if (typeof dvmId !== "string" || dvmId.length === 0) return void 0;
+  return { dvmId, builderPubkey };
+}
+function authenticatedBuilderPubkey(builder) {
+  if (!isTrustAnchor(builder)) return void 0;
+  const pubkey = builder.pubkey.trim().toLowerCase();
+  const attestedPubkey = builder.attestation.builder_pubkey;
+  if (!/^[0-9a-f]{64}$/.test(pubkey) || typeof attestedPubkey !== "string" || attestedPubkey.trim().toLowerCase() !== pubkey) {
+    return void 0;
+  }
+  const payload = builder.attestation;
+  return verifyAttestation(payload, builder.signature, pubkey) ? pubkey : void 0;
+}
+function verifyJobReceipt(args) {
+  const { receipt, builder, expectedJobId, delivered } = args;
+  const checks = {
+    job_id: checkJobId(receipt, expectedJobId),
+    signature: verifyReceipt(receipt),
+    attestation: "absent",
+    result_hash: "unchecked"
+  };
+  if (checks.job_id === "mismatch") {
+    return { status: "invalid", checks, reason: "job_id_mismatch" };
+  }
+  if (!checks.signature) {
+    return { status: "invalid", checks, reason: "signature_invalid" };
+  }
+  checks.attestation = checkReceiptAttestation(receipt, builder);
+  if (checks.attestation === "invalid") {
+    return { status: "invalid", checks, reason: "attestation_invalid" };
+  }
+  if (checks.attestation === "identity_mismatch") {
+    return { status: "invalid", checks, reason: "dvm_identity_mismatch" };
+  }
+  if (checks.attestation === "key_mismatch") {
+    return { status: "invalid", checks, reason: "receipt_key_mismatch" };
+  }
+  checks.result_hash = checkResultHash(receipt, delivered);
+  if (checks.result_hash === "mismatch") {
+    return { status: "invalid", checks, reason: "result_hash_mismatch" };
+  }
+  return {
+    status: checks.attestation === "ok" ? "verified" : "verified_unattested",
+    checks
+  };
+}
+function checkReceiptAttestation(receipt, builder) {
+  if (!isTrustAnchor(builder)) return "absent";
+  const payload = builder.attestation;
+  if (!authenticatedBuilderPubkey(builder)) return "invalid";
+  if (typeof payload.dvm_id !== "string" || payload.dvm_id !== receipt.dvm_id) {
+    return "identity_mismatch";
+  }
+  const attested = builder.attestation.receipt_pubkey;
+  if (typeof attested !== "string" || attested.length === 0) return "absent";
+  return attested.toLowerCase() === receipt.receipt_pubkey.toLowerCase() ? "ok" : "key_mismatch";
+}
+function verifyDrainReceiptChain(args) {
+  const { receipt, builder, expectedDrainId, expectedCreditId } = args;
+  const named = isDrainReceipt(receipt) ? receipt : void 0;
+  const checks = {
+    drain_id: checkDrainField(named?.drain_id, expectedDrainId),
+    credit_id: checkDrainField(named?.credit_id, expectedCreditId),
+    signature: named !== void 0 && verifyDrainReceipt(named),
+    attestation: "absent"
+  };
+  if (checks.drain_id === "mismatch") {
+    return { status: "invalid", checks, reason: "drain_id_mismatch" };
+  }
+  if (checks.credit_id === "mismatch") {
+    return { status: "invalid", checks, reason: "credit_id_mismatch" };
+  }
+  if (named === void 0 || !checks.signature) {
+    return { status: "invalid", checks, reason: "signature_invalid" };
+  }
+  checks.attestation = checkReceiptAttestation(named, builder);
+  if (checks.attestation === "invalid") {
+    return { status: "invalid", checks, reason: "attestation_invalid" };
+  }
+  if (checks.attestation === "identity_mismatch") {
+    return { status: "invalid", checks, reason: "dvm_identity_mismatch" };
+  }
+  if (checks.attestation === "key_mismatch") {
+    return { status: "invalid", checks, reason: "receipt_key_mismatch" };
+  }
+  return {
+    status: checks.attestation === "ok" ? "verified" : "verified_unattested",
+    checks
+  };
+}
+function verifyFundingReceiptChain(args) {
+  const named = isFundingReceipt(args.receipt) ? args.receipt : void 0;
+  const check = (actual, expected) => expected === void 0 ? "unchecked" : actual === expected ? "ok" : "mismatch";
+  const checks = {
+    credit_id: check(named?.credit_id, args.expectedCreditId),
+    fund_id: check(named?.fund_id, args.expectedFundId),
+    funded_micro: check(named?.funded_micro, args.expectedFundedMicro),
+    balance_after_micro: check(named?.balance_after_micro, args.expectedBalanceAfterMicro),
+    ledger_seq: check(named?.ledger_seq, args.expectedLedgerSeq),
+    caller_pubkey: check(named?.caller_pubkey, args.expectedCallerPubkey),
+    signature: named !== void 0 && verifyFundingReceipt(named),
+    attestation: "absent"
+  };
+  const mismatch = [
+    ["credit_id", "credit_id_mismatch"],
+    ["fund_id", "fund_id_mismatch"],
+    ["funded_micro", "funding_amount_mismatch"],
+    ["balance_after_micro", "funding_balance_mismatch"],
+    ["ledger_seq", "funding_ledger_seq_mismatch"],
+    ["caller_pubkey", "caller_pubkey_mismatch"]
+  ];
+  for (const [field, reason] of mismatch) {
+    if (checks[field] === "mismatch") return { status: "invalid", checks, reason, receipt: named };
+  }
+  if (!named || !checks.signature) {
+    return { status: "invalid", checks, reason: "signature_invalid", receipt: named };
+  }
+  checks.attestation = checkReceiptAttestation(named, args.builder);
+  if (checks.attestation === "invalid") {
+    return { status: "invalid", checks, reason: "attestation_invalid", receipt: named };
+  }
+  if (checks.attestation === "identity_mismatch") {
+    return { status: "invalid", checks, reason: "dvm_identity_mismatch", receipt: named };
+  }
+  if (checks.attestation === "key_mismatch") {
+    return { status: "invalid", checks, reason: "receipt_key_mismatch", receipt: named };
+  }
+  return {
+    status: checks.attestation === "ok" ? "verified" : "verified_unattested",
+    checks,
+    receipt: named
+  };
+}
+function weakestReceiptVerdict(statuses) {
+  if (statuses.length === 0) return "absent";
+  if (statuses.includes("invalid")) return "invalid";
+  if (statuses.includes("absent")) return "absent";
+  if (statuses.includes("verified_unattested")) return "verified_unattested";
+  return "verified";
+}
+function drainReceiptsDisplay(status, sound, total) {
+  const tally = `${String(sound)} of ${String(total)}`;
+  switch (status) {
+    case "verified":
+      return `Verified reclaim receipts (${tally}): signed by the key this DVM's builder identity attests.`;
+    case "verified_unattested":
+      return `Reclaim receipts, signed but unattested (${tally}): the signature holds, but this DVM publishes no builder identity to vouch for the signing key.`;
+    case "invalid":
+      return `UNVERIFIED reclaim receipts: only ${tally} hold up \u2014 the refund is still owed, but this evidence is not sound.`;
+    case "absent":
+      return "No reclaim receipts: this DVM returned no signed evidence of the drain.";
+  }
+}
+function drainReceiptsHint(status) {
+  switch (status) {
+    case "verified":
+      return "The refund evidence chains to this DVM's published builder identity, and is stored locally with that identity pinned beside it \u2014 so an unhonoured refund stays provable against the builder, not against an anonymous key.";
+    case "verified_unattested":
+      return "The receipts are signed, but nothing vouches for the signing key \u2014 expected for a locally-run or development DVM, not for a deployed one. Stored either way; the refund is owed regardless.";
+    case "invalid":
+      return "The refund is unaffected \u2014 this is a problem with the proof, not the money. Keep this output, and treat the reclaim as unattested when deciding how much to leave on deposit at this DVM.";
+    case "absent":
+      return "This DVM countersigned nothing, so the only artifact behind this reclaim is the drain request the caller signed. Weaker evidence than a countersigned drain, and worth weighing before funding here again.";
+  }
+}
+function receiptDisplay(receipt, status, rate = 0) {
+  const what = `${receipt.dvm}/${receipt.capability} (DVM ID ${receipt.dvm_id})`;
+  const when = receiptIssuedAtIso(receipt)?.slice(0, 10);
+  return `${VERDICT_PREFIX[status]}: paid ${formatPaid(receipt.paid.msats, rate)} for ${what}, ${receipt.outcome}${when ? ` ${when}` : ""}.`;
+}
+function receiptIssuedAtIso(receipt) {
+  const seconds = receipt.issued_at;
+  return typeof seconds === "number" ? epochMsToIso(seconds * 1e3) : null;
+}
+function epochMsToIso(ms) {
+  if (typeof ms !== "number" || !Number.isFinite(ms) || Math.abs(ms) > MAX_TIMESTAMP_MS) {
+    return null;
+  }
+  return new Date(ms).toISOString();
+}
+function receiptHint(status, jobId) {
+  const verifyCmd = jobId ? `'dvm receipts verify ${jobId}'` : "'dvm receipts verify <job-id>'";
+  switch (status) {
+    case "verified":
+      return `Proof of purchase is stored locally. Re-check it any time with ${verifyCmd}, or hand over the raw bundle with 'dvm receipts export'.`;
+    case "verified_unattested":
+      return `The receipt's signature is valid, but this DVM publishes no builder identity to vouch for the signing key \u2014 expected for a locally-run or development DVM, not for a deployed one. Stored either way; inspect it with ${verifyCmd}.`;
+    case "invalid":
+      return `The job itself is unaffected \u2014 this is a problem with the proof, not the result. Run ${verifyCmd} to see which check failed before relying on this receipt as evidence.`;
+    case "absent":
+      return "This DVM does not issue signed receipts, so there is no proof of purchase to store. Nothing went wrong.";
+  }
+}
+function receiptFailureDetail(reason) {
+  switch (reason) {
+    case "job_id_mismatch":
+      return "The receipt names a different job than the one it was collected for \u2014 it is not proof of this job, whoever signed it.";
+    case "drain_id_mismatch":
+      return "The receipt names a different reclaim than the one it is filed under \u2014 it is not evidence of this drain, whoever signed it.";
+    case "credit_id_mismatch":
+      return "The receipt names a different credit than the one this reclaim was against \u2014 it is not evidence of this refund, whoever signed it.";
+    case "fund_id_mismatch":
+      return "The receipt names a different funding operation than the caller submitted.";
+    case "funding_amount_mismatch":
+      return "The signed funded amount differs from the provider's funding response.";
+    case "funding_balance_mismatch":
+      return "The signed post-funding balance differs from the provider's fresh balance response.";
+    case "funding_ledger_seq_mismatch":
+      return "The signed funding sequence differs from the provider's fresh balance response.";
+    case "caller_pubkey_mismatch":
+      return "The funding receipt names a different caller than the key that submitted the funding.";
+    case "signature_invalid":
+      return "The receipt's signature does not verify under the key it names \u2014 the bytes were altered, or it was never signed by that key.";
+    case "attestation_invalid":
+      return "The DVM's published builder attestation does not verify under its own builder pubkey.";
+    case "dvm_identity_mismatch":
+      return "The receipt names a different immutable DVM ID than the builder attestation, so it is not evidence for this provider.";
+    case "receipt_key_mismatch":
+      return "The receipt was signed by a different key than the one the DVM's builder attested.";
+    case "result_hash_mismatch":
+      return "The receipt attests a different result than the one delivered.";
+  }
+}
+var MAX_TIMESTAMP_MS = 864e13;
+function checkJobId(receipt, expectedJobId) {
+  if (expectedJobId === void 0) return "unchecked";
+  return receipt.job_id === expectedJobId ? "ok" : "mismatch";
+}
+function checkDrainField(actual, expected) {
+  if (expected === void 0 || actual === void 0) return "unchecked";
+  return actual === expected ? "ok" : "mismatch";
+}
+var VERDICT_PREFIX = {
+  verified: "Verified receipt",
+  verified_unattested: "Receipt (signed, unattested)",
+  invalid: "UNVERIFIED receipt",
+  absent: "No receipt"
+};
+function checkResultHash(receipt, delivered) {
+  if (!delivered) return "unchecked";
+  if (receipt.result_hash === null) return "unchecked";
+  const summary = receipt.outcome === "completed" ? delivered.summary : void 0;
+  let recomputed;
+  try {
+    recomputed = computeResultHash(summary, delivered.artifactContents);
+  } catch {
+    return "unchecked";
+  }
+  return recomputed === receipt.result_hash ? "ok" : "mismatch";
+}
+function isTrustAnchor(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const anchor = value;
+  return typeof anchor.pubkey === "string" && typeof anchor.signature === "string" && !!anchor.attestation && typeof anchor.attestation === "object" && !Array.isArray(anchor.attestation);
+}
+function formatPaid(msats, rate) {
+  if (msats === 0) return "nothing (free job)";
+  const sats = msats % 1e3 === 0 ? msats / 1e3 : Math.round(msats / 1e3 * 100) / 100;
+  const satsLabel = `${sats.toLocaleString("en-US")} sats`;
+  if (rate <= 0) return satsLabel;
+  const usd = msatsToUsd(msats, rate);
+  return `~$${formatUsd(usd)} (${satsLabel}, ${costAnchor(usd)})`;
+}
+
+// src/lib/request-id.ts
+var MAX_REQUEST_ID_LENGTH = 128;
+var REQUEST_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/;
+function isPublicRequestId(value) {
+  return typeof value === "string" && value.length > 0 && value.length <= MAX_REQUEST_ID_LENGTH && REQUEST_ID_PATTERN.test(value);
+}
+
+// src/lib/traceparent.ts
+var TRACEPARENT_RE = /^00-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/;
+var ALL_ZERO_TRACE = "00000000000000000000000000000000";
+var ALL_ZERO_SPAN = "0000000000000000";
+function parseTraceparent(header) {
+  if (!header) return null;
+  const match = TRACEPARENT_RE.exec(header.trim());
+  if (!match) return null;
+  const [, traceId, parentSpanId, flagsHex] = match;
+  if (traceId === ALL_ZERO_TRACE || parentSpanId === ALL_ZERO_SPAN) return null;
+  return { traceId, parentSpanId, flags: parseInt(flagsHex, 16) };
+}
+
+// src/lib/wallet-agent/keypair.ts
+import { secp256k1 as secp256k12 } from "@noble/curves/secp256k1.js";
+var PRIVKEY_HEX_RE = /^[0-9a-f]{64}$/i;
+function derivePubkeyFromPrivkey(privkey) {
+  if (!PRIVKEY_HEX_RE.test(privkey)) {
+    throw new DvmError(
+      "invalid_privkey",
+      "Privkey must be 64 hex characters (32 bytes).",
+      "Provide a valid secp256k1 private key as a 64-char hex string."
+    );
+  }
+  const bytes = hexToBytes4(privkey);
+  if (!secp256k12.utils.isValidSecretKey(bytes)) {
+    throw new DvmError(
+      "invalid_privkey",
+      "Privkey is not a valid secp256k1 scalar (zero or out of curve order).",
+      "Generate a fresh key with: dvm wallet init"
+    );
+  }
+  const pub = secp256k12.getPublicKey(bytes);
+  return bytesToHex4(pub);
+}
+function bytesToHex4(bytes) {
+  return Buffer.from(bytes).toString("hex");
+}
+function hexToBytes4(hex) {
+  return Uint8Array.from(Buffer.from(hex, "hex"));
+}
+
+// src/lib/wallet-agent/sign.ts
+import { schnorr as schnorr4 } from "@noble/curves/secp256k1.js";
+var PUBKEY_COMPRESSED_HEX_RE = /^0[23][0-9a-f]{64}$/i;
+var PUBKEY_XONLY_HEX_RE = /^[0-9a-f]{64}$/i;
+var SIG_HEX_RE = /^[0-9a-f]{128}$/i;
+function signChallenge(privkeyHex, challenge) {
+  if (!PRIVKEY_HEX_RE.test(privkeyHex)) {
+    throw new DvmError(
+      "invalid_privkey",
+      "Privkey must be 64 hex characters (32 bytes).",
+      "Provide a valid secp256k1 private key as a 64-char hex string."
+    );
+  }
+  if (challenge.length !== 32) {
+    throw new DvmError(
+      "invalid_challenge",
+      `Challenge must be exactly 32 bytes; got ${challenge.length}.`,
+      "Pass the SHA-256 digest output (32 bytes)."
+    );
+  }
+  const sig = schnorr4.sign(challenge, hexToBytes5(privkeyHex));
+  return bytesToHex5(sig);
+}
+function verifyChallenge(pubkeyHex, challenge, sigHex) {
+  if (!SIG_HEX_RE.test(sigHex)) return false;
+  if (challenge.length !== 32) return false;
+  let xonly;
+  if (PUBKEY_COMPRESSED_HEX_RE.test(pubkeyHex)) {
+    xonly = hexToBytes5(pubkeyHex.slice(2));
+  } else if (PUBKEY_XONLY_HEX_RE.test(pubkeyHex)) {
+    xonly = hexToBytes5(pubkeyHex);
+  } else {
+    return false;
+  }
+  try {
+    return schnorr4.verify(hexToBytes5(sigHex), challenge, xonly);
+  } catch {
+    return false;
+  }
+}
+function hexToBytes5(hex) {
+  return Uint8Array.from(Buffer.from(hex, "hex"));
+}
+function bytesToHex5(bytes) {
+  return Buffer.from(bytes).toString("hex");
+}
+
+// src/lib/cashu/admin-auth.ts
+import { randomBytes } from "crypto";
+import { sha256 as sha2564 } from "@noble/hashes/sha2.js";
+var ADMIN_AUTH_NONCE_TTL_SECONDS = 300;
+var ADMIN_AUTH_CLOCK_SKEW_SECONDS = 30;
+var ADMIN_STATE_UNAVAILABLE = "admin_state_unavailable";
+function buildAdminChallenge(args) {
+  const msg = `dvmkit-admin:${args.method}:${args.path}:${args.dvmId}:${args.nonceHex}:${args.unixSeconds}`;
+  return sha2564(new TextEncoder().encode(msg));
+}
+function buildAdminAuthHeader(args) {
+  const nowMs = args.now ? args.now() : Date.now();
+  const unixSeconds = Math.floor(nowMs / 1e3);
+  const nonceBytes = args.randomNonce ? args.randomNonce() : Uint8Array.from(randomBytes(16));
+  const nonceHex = Buffer.from(nonceBytes).toString("hex");
+  const challenge = buildAdminChallenge({
+    method: args.method,
+    path: args.path,
+    dvmId: args.dvmId,
+    nonceHex,
+    unixSeconds
+  });
+  const sigHex = signChallenge(args.privkeyHex, challenge);
+  return {
+    header: `P2PK ${nonceHex}.${unixSeconds}.${sigHex}`,
+    nonceHex,
+    unixSeconds
+  };
+}
+
+// src/lib/monotonic-clock.ts
+function createMonotonicClock() {
+  let anchorWallMs = Date.now();
+  let anchorMonoMs = performance.now();
+  return () => {
+    const wallMs = Date.now();
+    const monoMs = performance.now();
+    const projectedMs = anchorWallMs + (monoMs - anchorMonoMs);
+    const nowMs = wallMs >= projectedMs ? wallMs : projectedMs;
+    anchorWallMs = nowMs;
+    anchorMonoMs = monoMs;
+    return Math.floor(nowMs);
+  };
+}
+
+// src/lib/cashu/verify.ts
+import { getTokenMetadata } from "@cashu/cashu-ts";
+function verifyCashuToken(token, acceptedMints) {
+  let mint, unit, totalMsats;
+  try {
+    const meta = getTokenMetadata(token);
+    mint = meta.mint;
+    unit = meta.unit;
+    totalMsats = meta.amount.toNumber() * 1e3;
+  } catch {
+    throw new DvmError(
+      "cashu_invalid_token",
+      "The Cashu token could not be decoded.",
+      "Ensure the token is a valid cashuA... or cashuB... string."
+    );
+  }
+  const normalised = acceptedMints.map(normaliseMintUrl);
+  if (!normalised.includes(normaliseMintUrl(mint))) {
+    throw new DvmError(
+      "cashu_mint_not_accepted",
+      `Mint ${mint} is not accepted by this provider.`,
+      `Accepted mints: ${acceptedMints.join(", ")}`
+    );
+  }
+  return { mint, totalMsats, unit };
+}
+function normaliseMintUrl(url) {
+  try {
+    const u = new URL(url);
+    u.hostname = u.hostname.toLowerCase();
+    u.pathname = u.pathname.replace(/\/+/g, "/").replace(/\/+$/, "") || "/";
+    return u.toString().replace(/\/$/, "");
+  } catch {
+    return url.toLowerCase().replace(/\/+$/, "");
+  }
+}
+
+// src/lib/payment-rails/tempo-wire.ts
+var TEMPO_SESSION_UPDATED_REASON = "Tempo session updated; attach the next voucher to fund this credit.";
+
+export {
+  toLockPubkey,
+  isX402SettlementReconciliationReason,
+  verifyCashuToken,
+  normaliseMintUrl,
+  TEMPO_SESSION_UPDATED_REASON,
+  backupSecretFile,
+  readAgentMnemonic,
+  assertAgentMnemonicReplaceable,
+  writeAgentMnemonic,
+  deleteAgentMnemonic,
+  generateAgentMnemonic,
+  deriveAgentMasterKeypair,
+  validateAgentMnemonic,
+  looksLikeMnemonic,
+  mnemonicFingerprint,
+  WALLET_VERSION,
+  RECENT_SPENDS_CAP,
+  DEFAULT_AGENT_MINT_URL,
+  loadAgentWallet,
+  saveAgentWallet,
+  walletExists,
+  withWalletLock,
+  effectiveMints,
+  effectiveFundingMint,
+  PersistentCounterSource,
+  checkMintHealth,
+  canSwap,
+  meltAmountBounds,
+  amountBoundsVerdict,
+  assertNutSupport,
+  getWallet,
+  X402_BATCH_CHANNEL_ABI,
+  deriveReceiptSecret,
+  receiptPubkeyFromSecret,
+  deriveReceiptKeypair,
+  generateEphemeralReceiptKey,
+  generateIdentity,
+  loadIdentitySecret,
+  writeIdentity,
+  hashCapabilities,
+  buildAttestation,
+  signAttestation,
+  verifyAttestation,
+  computeResultHash,
+  signReceipt,
+  verifyReceipt,
+  isSignedJobReceipt,
+  signDrainReceipt,
+  signFundingReceipt,
+  isFundingReceipt,
+  verifyFundingReceipt,
+  isDrainReceipt,
+  verifyDrainReceipt,
+  attestedDvmIdentity,
+  authenticatedBuilderPubkey,
+  verifyJobReceipt,
+  checkReceiptAttestation,
+  verifyDrainReceiptChain,
+  verifyFundingReceiptChain,
+  weakestReceiptVerdict,
+  drainReceiptsDisplay,
+  drainReceiptsHint,
+  receiptDisplay,
+  receiptIssuedAtIso,
+  epochMsToIso,
+  receiptHint,
+  receiptFailureDetail,
+  isPublicRequestId,
+  parseTraceparent,
+  PRIVKEY_HEX_RE,
+  derivePubkeyFromPrivkey,
+  verifyChallenge,
+  ADMIN_AUTH_NONCE_TTL_SECONDS,
+  ADMIN_AUTH_CLOCK_SKEW_SECONDS,
+  ADMIN_STATE_UNAVAILABLE,
+  buildAdminChallenge,
+  buildAdminAuthHeader,
+  createMonotonicClock
+};