@dvmkit/sdk 0.1.2-rc.7 → 0.1.3-rc.7

package/dist/{chunk-N4VTG3KH.js → chunk-3ZHMQCYP.js}

@@ -1,3 +1,65 @@
+import {
+  MemoryProcessedPaymentStore,
+  ProcessedPaymentReplayError
+} from "./chunk-DMNLFNTW.js";
+import {
+  createX402FacilitatorAuthHeaders,
+  createX402FacilitatorClient,
+  settleWithFacilitator,
+  verifyWithFacilitator
+} from "./chunk-BQ2NMWKE.js";
+import {
+  MemoryCreditLedger
+} from "./chunk-DBCLBYHP.js";
+import {
+  SIGNED_ENVELOPE_FIELDS,
+  SignedRequestError,
+  humanizeZodError,
+  humanizeZodIssues,
+  signedRequestInput,
+  zodIssuesOf
+} from "./chunk-H2MEFVH6.js";
+import {
+  JobCancelledError,
+  MemoryJobStore,
+  UNCAPPABLE_ASK_TOTAL,
+  abortJob,
+  accumulateAskedTopUp,
+  createInstrumentedFetch,
+  fromJobRecord,
+  isJobRetentionStore,
+  isReceiptIssuingStore,
+  isStreamableJobStore,
+  isTerminal,
+  isYieldMessage,
+  localMessage,
+  providerMessage,
+  toJobRecord
+} from "./chunk-4B56DEEV.js";
+import {
+  ADMIN_AUTH_CLOCK_SKEW_SECONDS,
+  ADMIN_AUTH_NONCE_TTL_SECONDS,
+  ADMIN_STATE_UNAVAILABLE,
+  TEMPO_SESSION_UPDATED_REASON,
+  X402_BATCH_CHANNEL_ABI,
+  attestedDvmIdentity,
+  buildAdminChallenge,
+  checkMintHealth,
+  computeResultHash,
+  createMonotonicClock,
+  getWallet,
+  isPublicRequestId,
+  isX402SettlementReconciliationReason,
+  normaliseMintUrl,
+  parseTraceparent,
+  receiptPubkeyFromSecret,
+  signDrainReceipt,
+  signFundingReceipt,
+  signReceipt,
+  toLockPubkey,
+  verifyCashuToken,
+  verifyChallenge
+} from "./chunk-2K7E3N2D.js";
 import {
   X402_BATCH_SETTLEMENT_SCHEME,
   X402_DEFAULT_FACILITATOR,
@@ -6,78 +68,38 @@ import {
   X402_VERSION,
   buildPaymentRequiredV2,
   buildPaymentRequirements,
-  createX402FacilitatorAuthHeaders,
-  createX402FacilitatorClient,
   decodePayment,
   encodePaymentRequiredHeader,
   encodeSettleResponseHeader,
   exactEvmAuthorization,
   paymentRequiredV2FromV1,
-  settleWithFacilitator,
-  verifyWithFacilitator,
   x402NetworkByCaip2,
   x402NetworkToCaip2
-} from "./chunk-JGGI65I3.js";
+} from "./chunk-Z4BNLUZF.js";
 import {
   IMPLICIT_CREDIT_TTL_MS,
-  costAnchor,
   formatStaleness,
-  formatUsd,
   msatsToUsd,
   msatsToUsdc,
   usdcToMsats
 } from "./chunk-5URG56JJ.js";
 import {
-  AGENT_MNEMONIC_FILE,
-  BUILDER_CONFIG_DIR,
-  BUILDER_FILE,
-  BUILDER_KEY_FILE,
-  DvmError,
-  WALLET_FILE,
-  ensureConfigDir,
   resolveRpcOverride
 } from "./chunk-MKI6OVW4.js";
-import {
-  MemoryCreditLedger
-} from "./chunk-EXHBXA4U.js";
 import {
   RAIL_REFUNDABLE,
-  SIGNED_ENVELOPE_FIELDS,
-  SignedRequestError,
   canonicalRequestPath,
-  canonicaliseForSigning,
   canonicalize,
-  humanizeZodError,
-  humanizeZodIssues,
-  isZodSchema,
-  signedRequestInput,
-  zodIssuesOf
-} from "./chunk-P4RUVDU7.js";
+  isZodSchema
+} from "./chunk-KXZUCCEY.js";
 import {
-  JobCancelledError,
-  MemoryJobStore,
   StepCache,
-  UNCAPPABLE_ASK_TOTAL,
-  abortJob,
-  accumulateAskedTopUp,
   createConsoleLogger,
-  createInstrumentedFetch,
-  fromJobRecord,
-  isReceiptIssuingStore,
-  isStreamableJobStore,
-  isTerminal,
-  isYieldMessage,
-  localMessage,
   loggers,
   pinDimension,
-  providerMessage,
-  toJobRecord,
   withSpan,
   withTraceContext
-} from "./chunk-TKA6ZP4M.js";
-import {
-  callerLoggers
-} from "./chunk-66HGCPBU.js";
+} from "./chunk-YDIYXGYL.js";
 import {
   FxRateUnavailableError,
   InvalidCurrencyError,
@@ -107,7 +129,10 @@ import {
   isNonChannelBitcoinRail,
   netOwedSats,
   x402SettlementPending
-} from "./chunk-LWUR4CGG.js";
+} from "./chunk-MLRCSJYX.js";
+import {
+  withSdkInitLock
+} from "./chunk-S3XAHZQY.js";
 import {
   withPostgresRecoveryContext
 } from "./chunk-C3MTFLC6.js";
@@ -116,18 +141,6 @@ import {
   challengeMeta,
   isTempoInsufficientFundsError
 } from "./chunk-5GFED3GJ.js";
-import {
-  MemoryProcessedPaymentStore,
-  ProcessedPaymentReplayError
-} from "./chunk-DMNLFNTW.js";
-import {
-  withSdkInitLock
-} from "./chunk-S3XAHZQY.js";
-
-// src/lib/cashu/lock-pubkey.ts
-function toLockPubkey(raw) {
-  return raw.trim().toLowerCase();
-}
 
 // src/sdk/server/lock-pubkey-store.ts
 async function initLockPubkeyTable(db) {
@@ -849,12 +862,12 @@ async function buildCreditMenu(args) {
       method.intent === "session" ? "tempo_session" : "tempo_charge"
     )
   );
-  const x402Schemes = (args.x402Schemes ?? []).filter(
+  const x402Schemes = args.currency === "usd" ? (args.x402Schemes ?? []).filter(
     (scheme) => stablecoinCreditInstrumentAllowed(
       args.config.allowOneShotStablecoin,
       scheme.scheme === "batch-settlement" ? "x402_batch_settlement" : "x402_exact"
     )
-  );
+  ) : [];
   const funding = args.funding.filter((rail) => {
     if (rail === "tempo") return tempoMethods.length > 0;
     if (rail === "x402") return x402Schemes.length > 0;
@@ -999,11 +1012,6 @@ function warnOnce(event, message) {
   console.warn(JSON.stringify({ level: "warn", event, message }));
 }
 
-// src/lib/x402/types.ts
-function isX402SettlementReconciliationReason(value) {
-  return value === "settlement_not_on_chain" || value === "chain_unreachable" || value === "settlement_unbookmarked" || value === "facilitator_channel_state_unavailable";
-}
-
 // src/sdk/server/funding.ts
 import { createHash as createHash2 } from "crypto";
 function resolvePriceFiat(args) {
@@ -1092,9 +1100,11 @@ function fundedMicroFor(priceFiat, paidMsats, requiredMsats) {
   if (paidMsats === requiredMsats) return priceFiat.amountMicro;
   return Math.round(priceFiat.amountMicro * paidMsats / requiredMsats);
 }
-function x402RequiredUsdcMicro(priceFiat, requiredMsats, btcUsdRate) {
-  if (priceFiat?.currency === "usd") return priceFiat.amountMicro;
-  return msatsToUsdc(requiredMsats, btcUsdRate);
+function x402RequiredUsdcMicro(priceFiat) {
+  if (priceFiat.currency !== "usd") {
+    throw new Error(`x402 is not offered for ${priceFiat.currency}-priced DVMs`);
+  }
+  return priceFiat.amountMicro;
 }
 function x402SettledShare(quoted, requiredUsdcMicro, settledUsdcMicro) {
   if (requiredUsdcMicro <= 0 || settledUsdcMicro === requiredUsdcMicro) return quoted;
@@ -1229,889 +1239,67 @@ function rateUnavailable() {
   );
 }
 
-// src/lib/secret-backup.ts
-import { existsSync, readFileSync, writeFileSync } from "fs";
-function backupSecretFile(file, nextContent) {
-  const content = existsSync(file) ? readFileSync(file) : null;
-  if (content === null) return null;
-  if (content.toString("utf-8").trim() === nextContent?.trim()) return null;
-  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  for (let n = 0; n < 100; n++) {
-    const backup = n === 0 ? `${file}.${stamp}.bak` : `${file}.${stamp}-${String(n)}.bak`;
-    try {
-      writeFileSync(backup, content, { mode: 384, flag: "wx" });
-      return backup;
-    } catch (err) {
-      if (err.code !== "EEXIST") throw err;
-    }
-  }
-  throw new Error(`Could not create a backup of ${file}: 100 candidate paths already exist.`);
-}
-
-// src/lib/wallet-agent/agent-mnemonic-file.ts
-import {
-  chmodSync,
-  existsSync as existsSync2,
-  readFileSync as readFileSync2,
-  renameSync,
-  unlinkSync,
-  writeFileSync as writeFileSync2
-} from "fs";
-function readAgentMnemonic() {
-  if (!existsSync2(AGENT_MNEMONIC_FILE)) return null;
-  const raw = readFileSync2(AGENT_MNEMONIC_FILE, "utf-8");
-  return raw.trim().toLowerCase().split(/\s+/).join(" ");
-}
-function assertAgentMnemonicReplaceable(opts = {}) {
-  if (existsSync2(AGENT_MNEMONIC_FILE) && !opts.force) {
-    throw new DvmError(
-      "agent_mnemonic_exists",
-      `An agent wallet recovery mnemonic already exists at ${AGENT_MNEMONIC_FILE}.`,
-      "Re-run with --force to replace it. WARNING: funds locked to keys derived from the current words become unrecoverable without a backup. The replaced mnemonic is copied to a timestamped .bak sibling."
-    );
-  }
-}
-function writeAgentMnemonic(mnemonic, opts = {}) {
-  const normalised = mnemonic.trim().toLowerCase().split(/\s+/).join(" ");
-  assertAgentMnemonicReplaceable(opts);
-  ensureConfigDir();
-  const backupFile = backupSecretFile(AGENT_MNEMONIC_FILE, normalised);
-  const tmp = `${AGENT_MNEMONIC_FILE}.tmp`;
-  writeFileSync2(tmp, normalised + "\n", { mode: 384 });
-  try {
-    renameSync(tmp, AGENT_MNEMONIC_FILE);
-  } catch (err) {
-    try {
-      unlinkSync(tmp);
-    } catch {
-    }
-    throw err;
-  }
-  try {
-    chmodSync(AGENT_MNEMONIC_FILE, 384);
-  } catch {
-  }
-  return { backupFile };
-}
-function deleteAgentMnemonic() {
-  if (!existsSync2(AGENT_MNEMONIC_FILE)) return { backupFile: null };
-  const backupFile = backupSecretFile(AGENT_MNEMONIC_FILE);
-  unlinkSync(AGENT_MNEMONIC_FILE);
-  return { backupFile };
-}
-
-// src/lib/wallet-agent/mnemonic.ts
+// src/sdk/server/x402-batch-settlement.ts
 import { createHash as createHash3 } from "crypto";
-import { HDKey } from "@scure/bip32";
+import { isDeepStrictEqual } from "util";
+import { x402ResourceServer } from "@x402/core/server";
 import {
-  generateMnemonic,
-  mnemonicToEntropy,
-  mnemonicToSeedSync,
-  validateMnemonic
-} from "@scure/bip39";
-import { wordlist } from "@scure/bip39/wordlists/english.js";
-var MNEMONIC_PURPOSE_INDEX = 1789;
-var AGENT_MASTER_ROLE_INDEX = 1;
-var MNEMONIC_STRENGTH_BITS = 128;
-function agentMasterKeypairPath() {
-  return `m/${MNEMONIC_PURPOSE_INDEX}'/${AGENT_MASTER_ROLE_INDEX}'`;
-}
-function generateAgentMnemonic() {
-  return generateMnemonic(wordlist, MNEMONIC_STRENGTH_BITS);
-}
-function deriveAgentMasterKeypair(mnemonic) {
-  const seed = mnemonicToSeedSync(mnemonic);
-  const hd = HDKey.fromMasterSeed(seed);
-  const child = hd.derive(agentMasterKeypairPath());
-  if (!child.privateKey || !child.publicKey) {
-    throw new Error("Failed to derive agent master keypair from mnemonic");
-  }
-  return {
-    privkey: Buffer.from(child.privateKey).toString("hex"),
-    pubkey: Buffer.from(child.publicKey).toString("hex")
-  };
-}
-function validateAgentMnemonic(mnemonic) {
-  const words = mnemonic.trim().toLowerCase().split(/\s+/);
-  if (words.length !== 12) {
-    return { ok: false, reason: "wrong_length", wordCount: words.length };
-  }
-  for (let i = 0; i < words.length; i++) {
-    if (!wordlist.includes(words[i])) {
-      return { ok: false, reason: "unknown_word", badWordIndex: i + 1, badWord: words[i] };
-    }
-  }
-  if (!validateMnemonic(words.join(" "), wordlist)) {
-    return { ok: false, reason: "checksum" };
-  }
-  return { ok: true };
-}
-function looksLikeMnemonic(input) {
-  return /\s/.test(input.trim());
-}
-function mnemonicFingerprint(mnemonic) {
-  const normalised = mnemonic.trim().toLowerCase().split(/\s+/).join(" ");
-  const entropy = mnemonicToEntropy(normalised, wordlist);
-  return createHash3("sha256").update(entropy).digest("hex");
-}
+  BATCH_SETTLEMENT_ADDRESS as BATCH_SETTLEMENT_ADDRESS2,
+  isBatchSettlementDepositPayload as isBatchSettlementDepositPayload2,
+  isBatchSettlementRefundPayload as isBatchSettlementRefundPayload2,
+  isBatchSettlementVoucherPayload
+} from "@x402/evm";
+import {
+  BatchSettlementEvmScheme as BatchSettlementEvmScheme2,
+  InMemoryChannelStorage
+} from "@x402/evm/batch-settlement/server";
+import { createPublicClient as createPublicClient3, http as http3 } from "viem";
+import { privateKeyToAccount as privateKeyToAccount2 } from "viem/accounts";
 
-// src/lib/wallet-agent/store.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3, renameSync as renameSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync3 } from "fs";
-import lockfile from "proper-lockfile";
-var LOCK_FILE = `${WALLET_FILE}.lock`;
-var DEFAULT_LOCK_STALE_MS = 3e4;
-var DEFAULT_LOCK_RETRIES = 30;
-var DEFAULT_LOCK_RETRY_INTERVAL_MS = 1e3;
-var WALLET_VERSION = 8;
-var RECENT_SPENDS_CAP = 10;
-var DEFAULT_AGENT_MINT_URL = "https://mint.coinos.io";
-function loadAgentWallet() {
-  if (!existsSync3(WALLET_FILE)) return null;
-  const raw = readFileSync3(WALLET_FILE, "utf-8");
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (err) {
-    throw new DvmError(
-      "wallet_corrupt",
-      `Wallet file at ${WALLET_FILE} is not valid JSON.`,
-      `Restore a backup or delete the file. Underlying error: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-  if (typeof parsed !== "object" || parsed === null || !("version" in parsed)) {
-    throw new DvmError(
-      "wallet_corrupt",
-      `Wallet file at ${WALLET_FILE} is missing a version field.`,
-      "Restore a backup or run: dvm wallet init --force"
-    );
-  }
-  const version = parsed.version;
-  if (version === 1) {
-    return migrateV7ToV8(
-      migrateV6ToV7(migrateV5ToV6(migrateV4ToV5(migrateV1ToV4(parsed))))
-    );
-  }
-  if (version === 2) {
-    return migrateV7ToV8(
-      migrateV6ToV7(
-        migrateV5ToV6(
-          migrateV4ToV5(migrateV3ToV4(migrateV2ToV3(parsed)))
-        )
-      )
-    );
-  }
-  if (version === 3) {
-    return migrateV7ToV8(
-      migrateV6ToV7(migrateV5ToV6(migrateV4ToV5(migrateV3ToV4(parsed))))
-    );
-  }
-  if (version === 4) {
-    return migrateV7ToV8(
-      migrateV6ToV7(migrateV5ToV6(migrateV4ToV5(parsed)))
-    );
-  }
-  if (version === 5) {
-    return migrateV7ToV8(migrateV6ToV7(migrateV5ToV6(parsed)));
-  }
-  if (version === 6) {
-    return migrateV7ToV8(migrateV6ToV7(parsed));
-  }
-  if (version === 7) {
-    return migrateV7ToV8(parsed);
-  }
-  if (version !== WALLET_VERSION) {
-    throw new DvmError(
-      "wallet_unknown_version",
-      `Unknown wallet version ${String(version)} (this CLI understands version ${String(WALLET_VERSION)}).`,
-      "Upgrade dvm CLI: a newer version wrote this wallet."
-    );
-  }
-  return parsed;
-}
-function saveAgentWallet(wallet) {
-  ensureConfigDir();
-  const tmp = `${WALLET_FILE}.tmp`;
-  const data = JSON.stringify(wallet, null, 2) + "\n";
-  writeFileSync3(tmp, data, { mode: 384 });
-  try {
-    renameSync2(tmp, WALLET_FILE);
-  } catch (err) {
-    try {
-      unlinkSync2(tmp);
-    } catch {
-    }
-    throw err;
+// src/sdk/server/x402-self-relay.ts
+import { x402Facilitator } from "@x402/core/facilitator";
+import { BatchSettlementEvmScheme } from "@x402/evm/batch-settlement/facilitator";
+import { createPublicClient, createWalletClient, http } from "viem";
+import { privateKeyToAccount } from "viem/accounts";
+import { base } from "viem/chains";
+var X402_SELF_RELAY_DEFAULT_LOW_BALANCE_WEI = 1000000000000000n;
+var X402_SELF_RELAY_BALANCE_INTERVAL_MS = 5 * 60 * 1e3;
+function createX402SelfRelay(opts) {
+  if (!opts.config.rpcUrl.trim()) throw new Error("x402 self-relay requires an explicit RPC URL");
+  if (opts.config.lowBalanceWei !== void 0 && opts.config.lowBalanceWei <= 0n) {
+    throw new Error("x402 self-relay lowBalanceWei must be positive");
   }
-}
-function walletExists() {
-  return existsSync3(WALLET_FILE);
-}
-async function withWalletLock(fn, opts = {}) {
-  ensureConfigDir();
-  const stale = opts.stale ?? DEFAULT_LOCK_STALE_MS;
-  const retries = opts.retries ?? DEFAULT_LOCK_RETRIES;
-  const interval = opts.retryIntervalMs ?? DEFAULT_LOCK_RETRY_INTERVAL_MS;
-  let release;
-  try {
-    release = await lockfile.lock(WALLET_FILE, {
-      lockfilePath: LOCK_FILE,
-      stale,
-      realpath: false,
-      retries: { retries, factor: 1, minTimeout: interval, maxTimeout: interval }
-    });
-  } catch (err) {
-    throw new DvmError(
-      "wallet_locked",
-      `Could not acquire the agent wallet lock at ${LOCK_FILE} within the retry budget.`,
-      `Another dvm CLI may be writing to ${WALLET_FILE}. Wait a moment and retry. If no other dvm CLI is running, remove ${LOCK_FILE} and try again.`,
-      { lock_file: LOCK_FILE, underlying: err instanceof Error ? err.message : String(err) }
-    );
+  if (opts.config.balanceCheckIntervalMs !== void 0 && (!Number.isFinite(opts.config.balanceCheckIntervalMs) || opts.config.balanceCheckIntervalMs <= 0)) {
+    throw new Error("x402 self-relay balanceCheckIntervalMs must be positive");
   }
-  try {
-    return await fn();
-  } finally {
+  const chain = relayChain(opts.network);
+  const account = privateKeyToAccount(opts.config.privateKey);
+  const transport = http(opts.config.rpcUrl);
+  const publicClient = createPublicClient({ chain, transport });
+  const walletClient = createWalletClient({ account, chain, transport });
+  const observeRpcFailure = async (operation) => {
     try {
-      await release();
-    } catch {
+      return await operation();
+    } catch (error) {
+      const reason = classifyX402SelfRelayRpcFailure(error);
+      if (reason) await reportRpcFailure(opts.config, account.address, opts.network, reason);
+      throw error;
     }
-  }
-}
-function effectiveMints(wallet) {
-  return wallet.mints.length > 0 ? wallet.mints : [DEFAULT_AGENT_MINT_URL];
-}
-function effectiveFundingMint(mints) {
-  return mints.length > 0 ? { url: mints[0], source: "configured" } : { url: DEFAULT_AGENT_MINT_URL, source: "fallback" };
-}
-function migrateV1ToV4(parsed) {
-  const proofs = Array.isArray(parsed.proofs) ? parsed.proofs : [];
-  const pending = Array.isArray(parsed.pending_mints) ? parsed.pending_mints : [];
-  if (proofs.length > 0 || pending.length > 0) {
-    throw new DvmError(
-      "wallet_unknown_version",
-      `Cannot migrate v1 wallet at ${WALLET_FILE}: contains ${proofs.length} proofs and ${pending.length} pending mints under the legacy schema.`,
-      "v1 wallets predate the fund flow and are expected to be empty. If this wallet was somehow populated, restore a backup or run: dvm wallet init --force"
-    );
-  }
-  return {
-    version: 4,
-    lock_privkey: String(parsed.recovery_privkey ?? parsed.lock_privkey),
-    lock_pubkey: String(parsed.recovery_pubkey ?? parsed.lock_pubkey),
-    mints: Array.isArray(parsed.mints) ? parsed.mints : [],
-    proofs: [],
-    pending_mints: [],
-    recent_spends: [],
-    created_at: typeof parsed.created_at === "string" ? parsed.created_at : (/* @__PURE__ */ new Date()).toISOString()
-  };
-}
-function migrateV2ToV3(parsed) {
-  return {
-    ...parsed,
-    version: 3,
-    recent_spends: []
-  };
-}
-function migrateV3ToV4(parsed) {
-  return {
-    version: 4,
-    lock_privkey: String(parsed.recovery_privkey ?? parsed.lock_privkey),
-    lock_pubkey: String(parsed.recovery_pubkey ?? parsed.lock_pubkey),
-    mints: Array.isArray(parsed.mints) ? parsed.mints : [],
-    proofs: Array.isArray(parsed.proofs) ? parsed.proofs : [],
-    pending_mints: Array.isArray(parsed.pending_mints) ? parsed.pending_mints : [],
-    recent_spends: Array.isArray(parsed.recent_spends) ? parsed.recent_spends : [],
-    created_at: typeof parsed.created_at === "string" ? parsed.created_at : (/* @__PURE__ */ new Date()).toISOString()
-  };
-}
-function migrateV4ToV5(parsed) {
-  return {
-    version: 5,
-    lock_privkey: String(parsed.lock_privkey),
-    lock_pubkey: String(parsed.lock_pubkey),
-    mints: Array.isArray(parsed.mints) ? parsed.mints : [],
-    proofs: Array.isArray(parsed.proofs) ? parsed.proofs : [],
-    pending_mints: Array.isArray(parsed.pending_mints) ? parsed.pending_mints : [],
-    pending_submissions: Array.isArray(parsed.pending_submissions) ? parsed.pending_submissions : [],
-    recent_spends: Array.isArray(parsed.recent_spends) ? parsed.recent_spends : [],
-    created_at: typeof parsed.created_at === "string" ? parsed.created_at : (/* @__PURE__ */ new Date()).toISOString()
-  };
-}
-function migrateV5ToV6(parsed) {
-  return {
-    version: 6,
-    lock_privkey: String(parsed.lock_privkey),
-    lock_pubkey: String(parsed.lock_pubkey),
-    mnemonic_fingerprint: typeof parsed.mnemonic_fingerprint === "string" ? parsed.mnemonic_fingerprint : null,
-    mints: Array.isArray(parsed.mints) ? parsed.mints : [],
-    proofs: Array.isArray(parsed.proofs) ? parsed.proofs : [],
-    nut13_counters: isCounterMap(parsed.nut13_counters) ? parsed.nut13_counters : {},
-    pending_mints: Array.isArray(parsed.pending_mints) ? parsed.pending_mints : [],
-    pending_submissions: Array.isArray(parsed.pending_submissions) ? parsed.pending_submissions : [],
-    recent_spends: Array.isArray(parsed.recent_spends) ? parsed.recent_spends : [],
-    created_at: typeof parsed.created_at === "string" ? parsed.created_at : (/* @__PURE__ */ new Date()).toISOString()
-  };
-}
-function migrateV6ToV7(parsed) {
-  return {
-    version: 7,
-    lock_privkey: String(parsed.lock_privkey),
-    lock_pubkey: String(parsed.lock_pubkey),
-    mnemonic_fingerprint: typeof parsed.mnemonic_fingerprint === "string" ? parsed.mnemonic_fingerprint : null,
-    mints: Array.isArray(parsed.mints) ? parsed.mints : [],
-    proofs: Array.isArray(parsed.proofs) ? parsed.proofs : [],
-    nut13_counters: isCounterMap(parsed.nut13_counters) ? parsed.nut13_counters : {},
-    pending_mints: Array.isArray(parsed.pending_mints) ? parsed.pending_mints : [],
-    pending_submissions: Array.isArray(parsed.pending_submissions) ? parsed.pending_submissions : [],
-    recent_spends: Array.isArray(parsed.recent_spends) ? parsed.recent_spends : [],
-    created_at: typeof parsed.created_at === "string" ? parsed.created_at : (/* @__PURE__ */ new Date()).toISOString()
-  };
-}
-function migrateV7ToV8(parsed) {
-  return {
-    version: WALLET_VERSION,
-    lock_privkey: String(parsed.lock_privkey),
-    lock_pubkey: String(parsed.lock_pubkey),
-    mnemonic_fingerprint: typeof parsed.mnemonic_fingerprint === "string" ? parsed.mnemonic_fingerprint : null,
-    mints: Array.isArray(parsed.mints) ? parsed.mints : [],
-    proofs: Array.isArray(parsed.proofs) ? parsed.proofs : [],
-    nut13_counters: isCounterMap(parsed.nut13_counters) ? parsed.nut13_counters : {},
-    pending_mints: Array.isArray(parsed.pending_mints) ? parsed.pending_mints : [],
-    pending_melts: Array.isArray(parsed.pending_melts) ? parsed.pending_melts : [],
-    pending_submissions: Array.isArray(parsed.pending_submissions) ? parsed.pending_submissions : [],
-    recent_spends: Array.isArray(parsed.recent_spends) ? parsed.recent_spends : [],
-    created_at: typeof parsed.created_at === "string" ? parsed.created_at : (/* @__PURE__ */ new Date()).toISOString()
   };
-}
-function isCounterMap(value) {
-  if (typeof value !== "object" || value === null) return false;
-  for (const inner of Object.values(value)) {
-    if (typeof inner !== "object" || inner === null) return false;
-    for (const n of Object.values(inner)) {
-      if (typeof n !== "number" || !Number.isFinite(n)) return false;
-    }
-  }
-  return true;
-}
-
-// src/lib/wallet-agent/nut13-counters.ts
-var PersistentCounterSource = class {
-  constructor(mintUrl) {
-    this.mintUrl = mintUrl;
-  }
-  mintUrl;
-  /**
-   * Reserve `n` counters for `keysetId`. Returns `{ start, count: n }`
-   * and bumps the persisted `next` to `start + n` under the wallet lock.
-   *
-   * Per cashu-ts contract, `n === 0` MUST NOT mutate state and is a
-   * pure peek — we honour that by returning `{ start, count: 0 }`
-   * without acquiring the lock.
-   */
-  async reserve(keysetId, n) {
-    if (n === 0) {
-      const wallet = loadAgentWallet();
-      const current = wallet?.nut13_counters[this.mintUrl]?.[keysetId] ?? 0;
-      return { start: current, count: 0 };
-    }
-    return withWalletLock(() => {
-      const wallet = this.loadOrThrow();
-      const current = wallet.nut13_counters[this.mintUrl]?.[keysetId] ?? 0;
-      saveAgentWallet(this.withCounter(wallet, keysetId, current + n));
-      return { start: current, count: n };
-    });
-  }
-  /**
-   * Monotonic bump: ensure the persisted `next` for `keysetId` is at
-   * least `minNext`. No-op if the wallet is already ahead. Used by
-   * cashu-ts when the mint reports `outputs_already_signed` — the
-   * losing wallet rolls forward past the colliding counter.
-   */
-  async advanceToAtLeast(keysetId, minNext) {
-    await withWalletLock(() => {
-      const wallet = this.loadOrThrow();
-      const current = wallet.nut13_counters[this.mintUrl]?.[keysetId] ?? 0;
-      if (current >= minNext) return;
-      saveAgentWallet(this.withCounter(wallet, keysetId, minNext));
-    });
-  }
-  /**
-   * Snapshot the per-keyset `next` map for this mint. Useful for
-   * `dvm wallet show` and test assertions; cashu-ts itself does not
-   * depend on `snapshot` being implemented.
-   */
-  snapshot() {
-    const wallet = loadAgentWallet();
-    const counters = wallet?.nut13_counters[this.mintUrl] ?? {};
-    const out = {};
-    for (const [keyset, next] of Object.entries(counters)) {
-      if (typeof next === "number") out[keyset] = next;
-    }
-    return Promise.resolve(out);
-  }
-  /**
-   * Hard-set the persisted `next` for `keysetId`. Used by
-   * `dvm wallet restore` to re-anchor counters after walking
-   * `batchRestore` per keyset. cashu-ts also exposes this on
-   * `wallet.counters.setNext`.
-   */
-  async setNext(keysetId, next) {
-    await withWalletLock(() => {
-      const wallet = this.loadOrThrow();
-      saveAgentWallet(this.withCounter(wallet, keysetId, next));
-    });
-  }
-  loadOrThrow() {
-    const wallet = loadAgentWallet();
-    if (!wallet) {
-      throw new DvmError(
-        "wallet_missing",
-        "NUT-13 counter persistence requires an agent wallet at ~/.dvm/wallet.json.",
-        "Run `dvm wallet init` or `dvm wallet recover --file <path>` (or pipe the mnemonic via stdin) first."
-      );
-    }
-    return wallet;
-  }
-  withCounter(wallet, keysetId, next) {
-    return {
-      ...wallet,
-      nut13_counters: {
-        ...wallet.nut13_counters,
-        [this.mintUrl]: {
-          ...wallet.nut13_counters[this.mintUrl] ?? {},
-          [keysetId]: next
-        }
-      }
-    };
-  }
-};
-
-// src/lib/cashu/health.ts
-var DEFAULT_REQUIRED_NUTS = [4, 5, 7, 9, 10, 11, 20];
-async function checkMintHealth(mintUrl, opts) {
-  const timeoutMs = opts?.timeoutMs ?? 5e3;
-  const retries = opts?.retries ?? 3;
-  const backoff = opts?.backoffMs ?? [200, 500, 1e3];
-  const fetchImpl = opts?.fetchImpl ?? fetch;
-  const url = mintUrl.replace(/\/+$/, "") + "/v1/info";
-  let lastError;
-  let lastLatency = 0;
-  for (let attempt = 0; attempt < retries; attempt++) {
-    if (attempt > 0) {
-      const delay = backoff[Math.min(attempt - 1, backoff.length - 1)];
-      await sleep(delay);
-    }
-    const startedAt = Date.now();
-    try {
-      const res = await fetchImpl(url, { signal: AbortSignal.timeout(timeoutMs) });
-      lastLatency = Date.now() - startedAt;
-      if (!res.ok) {
-        lastError = { code: "http_error", message: `HTTP ${res.status}` };
-        continue;
-      }
-      let info;
-      try {
-        info = await res.json();
-      } catch (err) {
-        lastError = {
-          code: "parse_error",
-          message: err instanceof Error ? err.message : String(err)
-        };
-        continue;
-      }
-      return parseInfo(mintUrl, info, lastLatency);
-    } catch (err) {
-      lastLatency = Date.now() - startedAt;
-      lastError = classifyFetchError(err);
-    }
-  }
-  return {
-    mintUrl,
-    ok: false,
-    latencyMs: lastLatency,
-    error: lastError ?? { code: "network", message: "no attempts recorded" }
-  };
-}
-function parseInfo(mintUrl, info, latencyMs) {
-  if (!isRecord(info)) {
-    return {
-      mintUrl,
-      ok: false,
-      latencyMs,
-      error: { code: "parse_error", message: "/v1/info response is not an object" }
-    };
-  }
-  const pubkey = typeof info.pubkey === "string" ? info.pubkey : void 0;
-  const version = typeof info.version === "string" ? info.version : void 0;
-  if (!pubkey || !version) {
-    const missing = [];
-    if (!pubkey) missing.push("pubkey");
-    if (!version) missing.push("version");
-    return {
-      mintUrl,
-      ok: false,
-      latencyMs,
-      pubkey,
-      version,
-      error: {
-        code: "missing_fields",
-        message: `NUT-06 missing required fields: ${missing.join(", ")}`
-      }
-    };
-  }
-  const nutsRaw = isRecord(info.nuts) ? info.nuts : {};
-  const supportedNuts = Object.keys(nutsRaw).sort(byNutKey);
-  const missingRequiredNuts = DEFAULT_REQUIRED_NUTS.map(String).filter((n) => !(n in nutsRaw));
-  const bolt11SatMintSupported = hasBolt11Sat(nutsRaw["4"]);
-  const bolt11SatMeltSupported = hasBolt11Sat(nutsRaw["5"]);
-  return {
-    mintUrl,
-    ok: true,
-    latencyMs,
-    pubkey,
-    version,
-    supportedNuts,
-    missingRequiredNuts,
-    bolt11SatMintSupported,
-    bolt11SatMeltSupported,
-    mintingEnabled: canMintBolt11Sat(nutsRaw),
-    meltingEnabled: canMeltBolt11Sat(nutsRaw),
-    swapEnabled: canSwap(nutsRaw),
-    mintAmountBounds: mintAmountBounds(nutsRaw),
-    meltAmountBounds: meltAmountBounds(nutsRaw),
-    nutCompliant: evaluateNutSupport(nutsRaw).ok,
-    nutsRaw
-  };
-}
-function canMintBolt11Sat(nuts) {
-  return isMethodEnabled(nuts["4"]);
-}
-function canMeltBolt11Sat(nuts) {
-  return isMethodEnabled(nuts["5"]);
-}
-function canSwap(nuts) {
-  const node = nuts["3"];
-  if (!isRecord(node)) return true;
-  if (node.disabled === true) return false;
-  return node.supported !== false;
-}
-function isMethodEnabled(node) {
-  if (!hasBolt11Sat(node)) return false;
-  return node.disabled !== true;
-}
-function mintAmountBounds(nuts) {
-  return boundsOf(nuts["4"]);
-}
-function meltAmountBounds(nuts) {
-  return boundsOf(nuts["5"]);
-}
-function amountBoundsVerdict(sats, bounds) {
-  if (!bounds) return "ok";
-  if (bounds.minSats !== null && sats < bounds.minSats) return "below_min";
-  if (bounds.maxSats !== null && sats > bounds.maxSats) return "above_max";
-  return "ok";
-}
-function boundsOf(node) {
-  const method = findBolt11Sat(node);
-  return {
-    minSats: method ? toBoundSats(method.min_amount) : null,
-    maxSats: method ? toBoundSats(method.max_amount) : null
-  };
-}
-function toBoundSats(value) {
-  if (typeof value === "bigint") {
-    return value >= 0n && value <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(value) : null;
-  }
-  const n = typeof value === "number" ? value : typeof value === "string" && value.trim() !== "" ? Number(value) : NaN;
-  if (!Number.isFinite(n) || n < 0) return null;
-  return Math.floor(n);
-}
-function evaluateNutSupport(nuts, requiredNuts = DEFAULT_REQUIRED_NUTS) {
-  const missingNuts = requiredNuts.filter((n) => {
-    const entry = nuts[String(n)];
-    if (entry === void 0 || entry === null) return true;
-    return typeof entry === "object" && entry.supported === false;
-  });
-  const missingBolt11 = [];
-  if (!hasBolt11Sat(nuts["4"])) missingBolt11.push("mint");
-  if (!hasBolt11Sat(nuts["5"])) missingBolt11.push("melt");
-  return {
-    ok: missingNuts.length === 0 && missingBolt11.length === 0,
-    missingNuts: missingNuts.length > 0 ? [...missingNuts] : void 0,
-    missingBolt11: missingBolt11.length > 0 ? missingBolt11 : void 0
-  };
-}
-function assertNutSupport(mintUrl, nuts, requiredNuts = DEFAULT_REQUIRED_NUTS) {
-  const verdict = evaluateNutSupport(nuts, requiredNuts);
-  if (verdict.missingNuts && verdict.missingNuts.length > 0) {
-    throw new DvmError(
-      "cashu_nut_support_missing",
-      `Mint ${mintUrl} does not support required NUTs: ${verdict.missingNuts.join(", ")}. Required: ${requiredNuts.join(", ")}.`,
-      "Choose a mint that supports all required NUT capabilities for P2PK-locked Cashu payments."
-    );
-  }
-  if (verdict.missingBolt11?.includes("mint")) {
-    throw new DvmError(
-      "cashu_nut_support_missing",
-      `Mint ${mintUrl} does not advertise bolt11/sat method on NUT-4 (mint quotes).`,
-      "Choose a mint that advertises bolt11/sat on NUT-4 mint quotes."
-    );
-  }
-  if (verdict.missingBolt11?.includes("melt")) {
-    throw new DvmError(
-      "cashu_nut_support_missing",
-      `Mint ${mintUrl} does not advertise bolt11/sat method on NUT-5 (melt quotes).`,
-      "Choose a mint that advertises bolt11/sat on NUT-5 melt quotes."
-    );
-  }
-}
-function hasBolt11Sat(node) {
-  return findBolt11Sat(node) !== void 0;
-}
-function findBolt11Sat(node) {
-  if (!isRecord(node)) return void 0;
-  const methods = node.methods;
-  if (!Array.isArray(methods)) return void 0;
-  return methods.find((m) => isRecord(m) && m.method === "bolt11" && m.unit === "sat");
-}
-function classifyFetchError(err) {
-  const message = err instanceof Error ? err.message : String(err);
-  if (err instanceof Error) {
-    if (err.name === "TimeoutError" || err.name === "AbortError") {
-      return { code: "timeout", message };
-    }
-  }
-  return { code: "network", message };
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function byNutKey(a, b) {
-  const an = Number(a);
-  const bn = Number(b);
-  if (Number.isFinite(an) && Number.isFinite(bn)) return an - bn;
-  return a.localeCompare(b);
-}
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
-// src/lib/cashu/wallet.ts
-import { Wallet } from "@cashu/cashu-ts";
-import { mnemonicToSeedSync as mnemonicToSeedSync2 } from "@scure/bip39";
-var walletCache = /* @__PURE__ */ new Map();
-var keysetResidueRegistry = /* @__PURE__ */ new Map();
-var NUT13_MODULUS = BigInt(2 ** 31 - 1);
-function assertNoKeysetCollision(keysets, mintUrl) {
-  for (const keyset of keysets) {
-    let residue;
-    try {
-      residue = BigInt("0x" + keyset.id) % NUT13_MODULUS;
-    } catch {
-      throw new DvmError(
-        "cashu_keyset_collision",
-        `Mint ${mintUrl} has keyset ID "${keyset.id}" that is not valid hex. Cannot verify NUT-13 collision safety.`,
-        "Contact the mint operator to ensure the mint returns standard keyset IDs."
-      );
-    }
-    const existing = keysetResidueRegistry.get(residue);
-    if (existing && existing.keysetId !== keyset.id) {
-      throw new DvmError(
-        "cashu_keyset_collision",
-        `Keyset collision detected: mint ${mintUrl} keyset ${keyset.id} and mint ${existing.mintUrl} keyset ${existing.keysetId} share the same 31-bit NUT-13 residue. Cannot safely derive deterministic secrets.`,
-        "Contact the affected mint operators to rotate their keyset IDs."
-      );
-    }
-    keysetResidueRegistry.set(residue, { keysetId: keyset.id, mintUrl });
-  }
-}
-async function getWallet(mintUrl) {
-  const cached = walletCache.get(mintUrl);
-  if (cached) return cached;
-  return callerLoggers.cashu.span("cashu.get_wallet", { mint_url: mintUrl }, async () => {
-    let nut13 = loadNut13Config(mintUrl);
-    let wallet = await buildAndLoadWallet(mintUrl, nut13);
-    if (nut13) {
-      if (wallet.getKeyset().id.startsWith("00")) {
-        nut13 = null;
-        wallet = await buildAndLoadWallet(mintUrl, null);
-      }
-    }
-    assertNutSupport(mintUrl, wallet.getMintInfo().cache.nuts);
-    if (nut13) {
-      const restoreKeysets = wallet.keyChain.getKeysets().filter((keyset) => keyset.unit === wallet.unit && !keyset.id.startsWith("00"));
-      assertNoKeysetCollision(restoreKeysets, mintUrl);
-    }
-    walletCache.set(mintUrl, wallet);
-    return wallet;
-  });
-}
-async function buildAndLoadWallet(mintUrl, nut13) {
-  const wallet = nut13 ? new Wallet(mintUrl, nut13) : new Wallet(mintUrl);
-  try {
-    await wallet.loadMint();
-  } catch {
-    throw new DvmError(
-      "cashu_mint_unreachable",
-      `Cannot connect to mint: ${mintUrl}`,
-      "The mint is not responding. Try again later."
-    );
-  }
-  return wallet;
-}
-function loadNut13Config(mintUrl) {
-  const wallet = loadAgentWallet();
-  if (!wallet?.mnemonic_fingerprint) return null;
-  const mnemonic = readAgentMnemonic();
-  if (!mnemonic) return null;
-  const actual = mnemonicFingerprint(mnemonic);
-  if (actual !== wallet.mnemonic_fingerprint) {
-    throw new DvmError(
-      "wallet_mnemonic_mismatch",
-      "The mnemonic at ~/.dvm/wallet.mnemonic does not match the fingerprint recorded on ~/.dvm/wallet.json.",
-      "Either restore the matching mnemonic file from a backup, or run `dvm wallet restore --force --file <path>` (or pipe the mnemonic via stdin) with the wallet's actual mnemonic to rebuild from scratch."
-    );
-  }
-  return {
-    bip39seed: mnemonicToSeedSync2(mnemonic),
-    counterSource: new PersistentCounterSource(mintUrl)
-  };
-}
-
-// src/lib/x402/batch-abi.ts
-var X402_CHANNEL_CONFIG_COMPONENTS = [
-  { name: "payer", type: "address" },
-  { name: "payerAuthorizer", type: "address" },
-  { name: "receiver", type: "address" },
-  { name: "receiverAuthorizer", type: "address" },
-  { name: "token", type: "address" },
-  { name: "withdrawDelay", type: "uint40" },
-  { name: "salt", type: "bytes32" }
-];
-var X402_BATCH_CHANNEL_ABI = [
-  {
-    type: "function",
-    name: "initiateWithdraw",
-    inputs: [
-      { name: "config", type: "tuple", components: X402_CHANNEL_CONFIG_COMPONENTS },
-      { name: "amount", type: "uint128" }
-    ],
-    outputs: [],
-    stateMutability: "nonpayable"
-  },
-  {
-    type: "function",
-    name: "finalizeWithdraw",
-    inputs: [{ name: "config", type: "tuple", components: X402_CHANNEL_CONFIG_COMPONENTS }],
-    outputs: [],
-    stateMutability: "nonpayable"
-  },
-  {
-    type: "function",
-    name: "channels",
-    inputs: [{ name: "channelId", type: "bytes32" }],
-    outputs: [
-      { name: "balance", type: "uint128" },
-      { name: "totalClaimed", type: "uint128" }
-    ],
-    stateMutability: "view"
-  },
-  {
-    type: "function",
-    name: "pendingWithdrawals",
-    inputs: [{ name: "channelId", type: "bytes32" }],
-    outputs: [
-      { name: "amount", type: "uint128" },
-      { name: "initiatedAt", type: "uint40" }
-    ],
-    stateMutability: "view"
-  },
-  {
-    type: "function",
-    name: "refundNonce",
-    inputs: [{ name: "channelId", type: "bytes32" }],
-    outputs: [{ name: "", type: "uint256" }],
-    stateMutability: "view"
-  },
-  {
-    type: "event",
-    name: "WithdrawInitiated",
-    inputs: [
-      { name: "channelId", type: "bytes32", indexed: true },
-      { name: "amount", type: "uint128", indexed: false },
-      { name: "finalizeAfter", type: "uint40", indexed: false }
-    ]
-  },
-  {
-    type: "event",
-    name: "WithdrawFinalized",
-    inputs: [
-      { name: "channelId", type: "bytes32", indexed: true },
-      { name: "sender", type: "address", indexed: true },
-      { name: "amount", type: "uint128", indexed: false }
-    ]
-  }
-];
-
-// src/sdk/server/x402-batch-settlement.ts
-import { createHash as createHash4 } from "crypto";
-import { isDeepStrictEqual } from "util";
-import { x402ResourceServer } from "@x402/core/server";
-import {
-  BATCH_SETTLEMENT_ADDRESS as BATCH_SETTLEMENT_ADDRESS2,
-  isBatchSettlementDepositPayload as isBatchSettlementDepositPayload2,
-  isBatchSettlementRefundPayload as isBatchSettlementRefundPayload2,
-  isBatchSettlementVoucherPayload
-} from "@x402/evm";
-import {
-  BatchSettlementEvmScheme as BatchSettlementEvmScheme2,
-  InMemoryChannelStorage
-} from "@x402/evm/batch-settlement/server";
-import { createPublicClient as createPublicClient3, http as http3 } from "viem";
-import { privateKeyToAccount as privateKeyToAccount2 } from "viem/accounts";
-
-// src/sdk/server/x402-self-relay.ts
-import { x402Facilitator } from "@x402/core/facilitator";
-import { BatchSettlementEvmScheme } from "@x402/evm/batch-settlement/facilitator";
-import { createPublicClient, createWalletClient, http } from "viem";
-import { privateKeyToAccount } from "viem/accounts";
-import { base } from "viem/chains";
-var X402_SELF_RELAY_DEFAULT_LOW_BALANCE_WEI = 1000000000000000n;
-var X402_SELF_RELAY_BALANCE_INTERVAL_MS = 5 * 60 * 1e3;
-function createX402SelfRelay(opts) {
-  if (!opts.config.rpcUrl.trim()) throw new Error("x402 self-relay requires an explicit RPC URL");
-  if (opts.config.lowBalanceWei !== void 0 && opts.config.lowBalanceWei <= 0n) {
-    throw new Error("x402 self-relay lowBalanceWei must be positive");
-  }
-  if (opts.config.balanceCheckIntervalMs !== void 0 && (!Number.isFinite(opts.config.balanceCheckIntervalMs) || opts.config.balanceCheckIntervalMs <= 0)) {
-    throw new Error("x402 self-relay balanceCheckIntervalMs must be positive");
-  }
-  const chain = relayChain(opts.network);
-  const account = privateKeyToAccount(opts.config.privateKey);
-  const transport = http(opts.config.rpcUrl);
-  const publicClient = createPublicClient({ chain, transport });
-  const walletClient = createWalletClient({ account, chain, transport });
-  const observeRpcFailure = async (operation) => {
-    try {
-      return await operation();
-    } catch (error) {
-      const reason = classifyX402SelfRelayRpcFailure(error);
-      if (reason) await reportRpcFailure(opts.config, account.address, opts.network, reason);
-      throw error;
-    }
-  };
-  const signer = createX402SelfRelaySigner({
-    network: opts.network,
-    ...opts.submissionLock ? { submissionLock: opts.submissionLock } : {},
-    backend: {
-      address: account.address,
-      readContract: (args) => observeRpcFailure(() => publicClient.readContract(args)),
-      verifyTypedData: (args) => observeRpcFailure(() => publicClient.verifyTypedData(args)),
-      writeContract: (args) => observeRpcFailure(() => walletClient.writeContract(args)),
-      sendTransaction: (args) => observeRpcFailure(() => walletClient.sendTransaction(args)),
-      waitForTransactionReceipt: async (args) => {
-        const receipt = await observeRpcFailure(() => publicClient.waitForTransactionReceipt(args));
-        return { status: receipt.status, logs: receipt.logs };
-      },
-      getCode: (args) => observeRpcFailure(() => publicClient.getCode(args))
+  const signer = createX402SelfRelaySigner({
+    network: opts.network,
+    ...opts.submissionLock ? { submissionLock: opts.submissionLock } : {},
+    backend: {
+      address: account.address,
+      readContract: (args) => observeRpcFailure(() => publicClient.readContract(args)),
+      verifyTypedData: (args) => observeRpcFailure(() => publicClient.verifyTypedData(args)),
+      writeContract: (args) => observeRpcFailure(() => walletClient.writeContract(args)),
+      sendTransaction: (args) => observeRpcFailure(() => walletClient.sendTransaction(args)),
+      waitForTransactionReceipt: async (args) => {
+        const receipt = await observeRpcFailure(() => publicClient.waitForTransactionReceipt(args));
+        return { status: receipt.status, logs: receipt.logs };
+      },
+      getCode: (args) => observeRpcFailure(() => publicClient.getCode(args))
     }
   });
   const local = new x402Facilitator().register(
@@ -3678,7 +2866,7 @@ async function applyRecoveredChannelSettlement(storage, payload, requirements, s
   if (!isBatchSettlementDepositPayload2(raw) && !isBatchSettlementRefundPayload2(raw)) {
     throw new Error("x402 recovery supports only irreversible deposit/refund settlements");
   }
-  const channelState = isRecord2(settlement.extra?.channelState) ? settlement.extra.channelState : {};
+  const channelState = isRecord(settlement.extra?.channelState) ? settlement.extra.channelState : {};
   const result = await storage.updateChannel(raw.voucher.channelId, (current) => {
     const currentMatchesOriginalAuthority = current?.chargedCumulativeAmount === channelBefore.chargedCumulativeAmount && current.signedMaxClaimable === channelBefore.signedMaxClaimable && current.signature === channelBefore.signature && isDeepStrictEqual(current.channelConfig, channelBefore.channelConfig);
     const intentCreatedMissingChannel = current === void 0 && isBatchSettlementDepositPayload2(raw);
@@ -3728,12 +2916,12 @@ async function applyRecoveredChannelSettlement(storage, payload, requirements, s
   }
 }
 function settlementIdentity(operation, effectId) {
-  return createHash4("sha256").update(operation).update("\0").update(effectId).digest("hex");
+  return createHash3("sha256").update(operation).update("\0").update(effectId).digest("hex");
 }
 function depositAuthorizationPaymentId(payload) {
-  const deposit = isRecord2(payload.deposit) ? payload.deposit : void 0;
-  const wrapper = isRecord2(deposit?.authorization) ? deposit.authorization : void 0;
-  const authorization = isRecord2(wrapper?.erc3009Authorization) ? wrapper.erc3009Authorization : void 0;
+  const deposit = isRecord(payload.deposit) ? payload.deposit : void 0;
+  const wrapper = isRecord(deposit?.authorization) ? deposit.authorization : void 0;
+  const authorization = isRecord(wrapper?.erc3009Authorization) ? wrapper.erc3009Authorization : void 0;
   const salt = authorization?.salt;
   const voucher = batchVoucher(payload);
   if (typeof salt !== "string" || !/^0x[0-9a-f]{64}$/i.test(salt)) {
@@ -3786,10 +2974,10 @@ function withCachedSupportedResponse(facilitator, supportedResponse) {
 }
 function decodeBatchPayment(header) {
   const parsed = JSON.parse(Buffer.from(header, "base64").toString("utf8"));
-  if (!isRecord2(parsed) || parsed.x402Version !== 2 || !isRecord2(parsed.accepted)) {
+  if (!isRecord(parsed) || parsed.x402Version !== 2 || !isRecord(parsed.accepted)) {
     throw new Error("invalid batch-settlement payment envelope");
   }
-  if (parsed.accepted.scheme !== X402_BATCH_SETTLEMENT_SCHEME || typeof parsed.accepted.network !== "string" || !isRecord2(parsed.payload)) {
+  if (parsed.accepted.scheme !== X402_BATCH_SETTLEMENT_SCHEME || typeof parsed.accepted.network !== "string" || !isRecord(parsed.payload)) {
     throw new Error("invalid batch-settlement payment envelope");
   }
   if (!isBatchSettlementDepositPayload2(parsed.payload) && !isBatchSettlementVoucherPayload(parsed.payload) && !isBatchSettlementRefundPayload2(parsed.payload)) {
@@ -3839,7 +3027,7 @@ async function restoreRevokedVoucher(storage, channelId, pendingId, before) {
     };
   });
 }
-function isRecord2(value) {
+function isRecord(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 
@@ -3847,46 +3035,6 @@ function isRecord2(value) {
 import { randomBytes, randomUUID as randomUUID2 } from "crypto";
 import { Challenge } from "mppx";
 
-// src/lib/cashu/verify.ts
-import { getTokenMetadata } from "@cashu/cashu-ts";
-function verifyCashuToken(token, acceptedMints) {
-  let mint, unit, totalMsats;
-  try {
-    const meta = getTokenMetadata(token);
-    mint = meta.mint;
-    unit = meta.unit;
-    totalMsats = meta.amount.toNumber() * 1e3;
-  } catch {
-    throw new DvmError(
-      "cashu_invalid_token",
-      "The Cashu token could not be decoded.",
-      "Ensure the token is a valid cashuA... or cashuB... string."
-    );
-  }
-  const normalised = acceptedMints.map(normaliseMintUrl);
-  if (!normalised.includes(normaliseMintUrl(mint))) {
-    throw new DvmError(
-      "cashu_mint_not_accepted",
-      `Mint ${mint} is not accepted by this provider.`,
-      `Accepted mints: ${acceptedMints.join(", ")}`
-    );
-  }
-  return { mint, totalMsats, unit };
-}
-function normaliseMintUrl(url) {
-  try {
-    const u = new URL(url);
-    u.hostname = u.hostname.toLowerCase();
-    u.pathname = u.pathname.replace(/\/+/g, "/").replace(/\/+$/, "") || "/";
-    return u.toString().replace(/\/$/, "");
-  } catch {
-    return url.toLowerCase().replace(/\/+$/, "");
-  }
-}
-
-// src/lib/payment-rails/tempo-wire.ts
-var TEMPO_SESSION_UPDATED_REASON = "Tempo session updated; attach the next voucher to fund this credit.";
-
 // src/sdk/server/mpp-units.ts
 function decimalsFor(methodName) {
   switch (methodName) {
@@ -4158,21 +3306,19 @@ async function verifyUpfrontPayment(opts) {
   } = opts;
   const sessionOffered = opts.tempoSessionOffered ?? true;
   const sessionUnavailable = tempoSessionUnavailableCopy(opts.tempoSessionUnavailableReason);
+  const x402PriceFiat = opts.priceFiat?.currency === "usd" ? opts.priceFiat : void 0;
+  if (x402Payment && x402Config && requiredMsats && !x402PriceFiat) {
+    return x402NotOfferedResult(opts.priceFiat?.currency);
+  }
   const sessionIssuable = sessionOffered || await targetCreditHoldsTempoChannel(opts);
   const x402ExactVersions = opts.x402ExactVersions ?? { v1: true, v2: true };
-  const x402Advertised = Boolean(x402Config) && (x402Config?.dualServe ?? true) && (x402ExactVersions.v1 || x402ExactVersions.v2);
-  const needsRate = Boolean(requiredMsats) && (Boolean(mpp) || x402Advertised || Boolean(x402Payment && x402Config));
+  const x402Advertised = Boolean(x402Config) && Boolean(x402PriceFiat) && (x402Config?.dualServe ?? true) && (x402ExactVersions.v1 || x402ExactVersions.v2);
+  const needsRate = Boolean(requiredMsats) && Boolean(mpp);
   const rate = needsRate ? await resolveRateOrNull(opts.fxFetcher) : null;
   const rateOutage = needsRate && rate === null;
-  const x402Requirements = x402Config && x402Advertised && requiredMsats && rate !== null && (!opts.fundOnly || stablecoinCreditInstrumentAllowed(opts.fundOnly.allowOneShotStablecoin, "x402_exact")) ? buildX402Requirements(
-    x402Config,
-    requiredMsats,
-    x402Resource ?? "/v1/job",
-    rate,
-    opts.priceFiat
-  ) : void 0;
-  const x402BatchRequirements = opts.fundOnly && opts.x402BatchSettlement && x402Advertised && requiredMsats && rate !== null ? await opts.x402BatchSettlement.buildRequirements(
-    String(x402RequiredUsdcMicro(opts.priceFiat, requiredMsats, rate))
+  const x402Requirements = x402Config && x402Advertised && x402PriceFiat && requiredMsats && (!opts.fundOnly || stablecoinCreditInstrumentAllowed(opts.fundOnly.allowOneShotStablecoin, "x402_exact")) ? buildX402Requirements(x402Config, x402Resource ?? "/v1/job", x402PriceFiat) : void 0;
+  const x402BatchRequirements = opts.fundOnly && opts.x402BatchSettlement && x402Advertised && x402PriceFiat && requiredMsats ? await opts.x402BatchSettlement.buildRequirements(
+    String(x402RequiredUsdcMicro(x402PriceFiat))
   ) : void 0;
   const ledgerCtx = resolveLedgerContext(opts);
   const creditEnv = opts.creditEnvelope;
@@ -4328,17 +3474,18 @@ async function verifyUpfrontPayment(opts) {
     };
   }
   if (x402Payment && x402Config && requiredMsats && paymentScheme(x402Payment) === X402_BATCH_SETTLEMENT_SCHEME) {
+    if (!x402PriceFiat) return x402NotOfferedResult(opts.priceFiat?.currency);
     if (!opts.fundOnly || !opts.x402BatchSettlement) {
       return creditRefusal(
         "payment_invalid",
         "Reusable x402 channels are accepted only by POST /v1/credit."
       );
     }
-    if (rate === null) return rateUnavailableResult();
+    if (rateOutage) return rateUnavailableResult();
     if (!ledgerCtx?.fundOnly?.creditId) {
       throw new Error("x402 batch settlement requires a named credit funding effect");
     }
-    const requiredUsdcMicro = x402RequiredUsdcMicro(opts.priceFiat, requiredMsats, rate);
+    const requiredUsdcMicro = x402RequiredUsdcMicro(x402PriceFiat);
     try {
       const accepted = await opts.x402BatchSettlement.accept({
         paymentHeader: x402Payment,
@@ -4414,12 +3561,13 @@ async function verifyUpfrontPayment(opts) {
     }
   }
   if (x402Payment && x402Config && requiredMsats) {
+    if (!x402PriceFiat) return x402NotOfferedResult(opts.priceFiat?.currency);
     if (opts.fundOnly && !stablecoinCreditInstrumentAllowed(opts.fundOnly.allowOneShotStablecoin, "x402_exact")) {
       return oneShotCreditRefusal("x402 exact");
     }
-    if (rate === null) return rateUnavailableResult();
+    if (rateOutage) return rateUnavailableResult();
     try {
-      const requiredUsdcMicro = BigInt(x402RequiredUsdcMicro(opts.priceFiat, requiredMsats, rate));
+      const requiredUsdcMicro = BigInt(x402RequiredUsdcMicro(x402PriceFiat));
       if (creditEnv?.fund && ledgerCtx) {
         const predicted = predictX402FundedMicro(
           x402Payment,
@@ -4449,7 +3597,7 @@ async function verifyUpfrontPayment(opts) {
           config: x402Config,
           requiredUsdcMicro,
           resource: x402Resource ?? "/v1/job",
-          btcUsdRate: rate,
+          btcUsdRate: rate ?? 0,
           exactVersions: x402ExactVersions,
           dvmId: opts.dvmId ?? "",
           requiredMsats,
@@ -4457,13 +3605,13 @@ async function verifyUpfrontPayment(opts) {
           x402Requirements
         });
       }
-      const { verifyX402Payment } = await import("./x402-FTG2GRAQ.js");
+      const { verifyX402Payment } = await import("./x402-T2C5MX3T.js");
       const receipt = await verifyX402Payment(
         x402Payment,
         x402Config,
         requiredUsdcMicro,
         x402Resource ?? "/v1/job",
-        rate,
+        rate ?? 0,
         x402ExactVersions
       );
       if (receipt.verified) {
@@ -4962,6 +4110,11 @@ var PAYMENT_ERROR_COPY = {
     hint: "Request a fresh quote and pay again \u2014 the previous payment can't be reused.",
     retryable: false
   },
+  x402_not_offered: {
+    display: "This service does not offer x402 payment for prices in its configured currency. Nothing was charged.",
+    hint: "Use one of the payment methods advertised by this service and submit the request again.",
+    retryable: false
+  },
   x402_settlement_ambiguous: {
     display: "The stablecoin payment may have settled, but the service has not finished recording what it bought. Do not pay again.",
     hint: "Retry the identical request with the same signed payment. If it remains pending, give settlement_intent_id to the service operator; do not request a fresh quote or sign another authorization.",
@@ -5359,6 +4512,9 @@ async function verifyIncomingPayment(body, opts, snapshot) {
     };
   }
   if (body.content.x402_payment && opts.x402Config) {
+    if ((opts.pricingCurrency ?? "usd") !== "usd") {
+      return { error: x402NotOfferedPaymentError(opts.pricingCurrency) };
+    }
     const rate = await resolveRateOrNull(opts.fxFetcher);
     if (rate === null) return { error: rateUnavailablePaymentError() };
     try {
@@ -5377,7 +4533,7 @@ async function verifyIncomingPayment(body, opts, snapshot) {
           snapshot
         });
       }
-      const { verifyX402Payment } = await import("./x402-FTG2GRAQ.js");
+      const { verifyX402Payment } = await import("./x402-T2C5MX3T.js");
       const receipt = await verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -5782,12 +4938,15 @@ async function processIncomingPayment(job, body, opts) {
       status: 402
     };
   } else if (body.content.x402_payment && opts.x402Config) {
+    if ((opts.pricingCurrency ?? "usd") !== "usd") {
+      return x402NotOfferedPaymentError(opts.pricingCurrency);
+    }
     const rate = await resolveRateOrNull(opts.fxFetcher);
     if (rate === null) return rateUnavailablePaymentError();
     try {
       const requiredMsats = job.pendingPaymentMsats ?? 0;
       const requiredUsdcMicro = job.pendingX402AmountUsdcMicro !== void 0 ? BigInt(job.pendingX402AmountUsdcMicro) : BigInt(msatsToUsdc(requiredMsats, rate));
-      const { verifyX402Payment } = await import("./x402-FTG2GRAQ.js");
+      const { verifyX402Payment } = await import("./x402-T2C5MX3T.js");
       const receipt = await verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -6090,8 +5249,8 @@ async function verifyAccumulatorReceipt(opts, mints, requiredMsats, ledgerCtx) {
     credited
   );
 }
-function buildX402Requirements(config, requiredMsats, resource, btcUsdRate, priceFiat) {
-  const requiredUsdcMicro = BigInt(x402RequiredUsdcMicro(priceFiat, requiredMsats, btcUsdRate));
+function buildX402Requirements(config, resource, priceFiat) {
+  const requiredUsdcMicro = BigInt(x402RequiredUsdcMicro(priceFiat));
   return [
     buildPaymentRequirements({
       x402Config: config,
@@ -6403,11 +5562,15 @@ async function fundAndDraw(ctx, funding, tx) {
   if (createsDepositLiability && enqueue && (!tx || !ctx.dvmId)) {
     throw new Error("deposit outbox enqueue requires the rail's open transaction and a DVM id");
   }
-  const commitDeposit = async (result) => {
+  const commitDeposit = async (result, credit) => {
+    const report = {
+      ...deposit,
+      callerPubkey: credit.callerPubkey
+    };
     if (createsDepositLiability && enqueue && tx) {
-      await enqueue(tx, creditDepositPayload(ctx.dvmId, deposit));
+      await enqueue(tx, creditDepositPayload(ctx.dvmId, report));
     }
-    return result;
+    return { ...result, deposit: report };
   };
   if (ctx.fundOnly) {
     const { creditId: creditId2 } = ctx.fundOnly;
@@ -6435,11 +5598,11 @@ async function fundAndDraw(ctx, funding, tx) {
       ledgerSeq: credit.lastLedgerSeq,
       tx
     });
-    return commitDeposit({ creditId: creditId2, deposit });
+    return commitDeposit({ creditId: creditId2 }, credit);
   }
   if (ctx.topUp) {
     const { creditId: creditId2, drawId: drawId2 } = ctx.topUp;
-    await ctx.ledger.fund({
+    const credit = await ctx.ledger.fund({
       creditId: creditId2,
       callerPubkey: ctx.callerId,
       currency: ctx.priceFiat.currency,
@@ -6449,9 +5612,9 @@ async function fundAndDraw(ctx, funding, tx) {
       tx
     });
     if (ctx.askSatisfied) {
-      return commitDeposit({ creditId: creditId2, deposit, unappliedMicro: fundedMicro });
+      return commitDeposit({ creditId: creditId2, unappliedMicro: fundedMicro }, credit);
     }
-    if (shortMidJob) return commitDeposit({ creditId: creditId2, deposit });
+    if (shortMidJob) return commitDeposit({ creditId: creditId2 }, credit);
     const grown = await ctx.ledger.growDraw({
       creditId: creditId2,
       drawId: drawId2,
@@ -6472,15 +5635,17 @@ async function fundAndDraw(ctx, funding, tx) {
       tx
     });
     if (grown.addedAmountMicro <= 0) {
-      return commitDeposit({ creditId: creditId2, deposit, unappliedMicro: grown.cappedMicro });
+      return commitDeposit({ creditId: creditId2, unappliedMicro: grown.cappedMicro }, credit);
     }
-    return commitDeposit({
-      creditId: creditId2,
-      draw: grown,
-      added: { amountMicro: grown.addedAmountMicro, ...grown.addedRailValue },
-      ...grown.cappedMicro > 0 && { unappliedMicro: grown.cappedMicro },
-      deposit
-    });
+    return commitDeposit(
+      {
+        creditId: creditId2,
+        draw: grown,
+        added: { amountMicro: grown.addedAmountMicro, ...grown.addedRailValue },
+        ...grown.cappedMicro > 0 && { unappliedMicro: grown.cappedMicro }
+      },
+      credit
+    );
   }
   const creditId = deposit.creditId;
   const drawId = env?.drawId ?? funding.paymentId;
@@ -6503,7 +5668,7 @@ async function fundAndDraw(ctx, funding, tx) {
     basis,
     tx
   });
-  if (shortMidJob) return commitDeposit({ creditId, deposit });
+  if (shortMidJob) return commitDeposit({ creditId }, fundedCredit);
   let draw;
   try {
     draw = await ctx.ledger.draw({
@@ -6523,7 +5688,10 @@ async function fundAndDraw(ctx, funding, tx) {
         ledgerSeq: fundedCredit.lastLedgerSeq,
         tx
       });
-      return commitDeposit({ creditId, drawRefusal: err, deposit, fundingCredit: fundedCredit });
+      return commitDeposit(
+        { creditId, drawRefusal: err, fundingCredit: fundedCredit },
+        fundedCredit
+      );
     }
     throw err;
   }
@@ -6538,17 +5706,20 @@ async function fundAndDraw(ctx, funding, tx) {
       tx
     });
   }
-  return commitDeposit({
-    creditId,
-    draw,
-    deposit,
-    ...env ? { fundingCredit: fundedCredit } : {}
-  });
+  return commitDeposit(
+    {
+      creditId,
+      draw,
+      ...env ? { fundingCredit: fundedCredit } : {}
+    },
+    fundedCredit
+  );
 }
 function creditDepositPayload(dvmId, funding) {
   return {
     dvmId,
     creditId: funding.creditId,
+    callerPubkey: funding.callerPubkey,
     fundingId: funding.fundingId,
     rail: funding.rail,
     paidMsats: funding.paidMsats,
@@ -7119,6 +6290,21 @@ async function resolveRateOrNull(fetcher) {
 function rateUnavailableResult() {
   return { paidMsats: 0, receivedProofs: [], error: rateUnavailablePaymentError() };
 }
+function x402NotOfferedPaymentError(currency) {
+  return {
+    body: paymentErrorBody("x402_not_offered", {
+      message: `x402 is offered only by USD-priced DVMs; this DVM prices in ${currency ?? "an unknown currency"}.`
+    }),
+    status: 402
+  };
+}
+function x402NotOfferedResult(currency) {
+  return {
+    paidMsats: 0,
+    receivedProofs: [],
+    error: x402NotOfferedPaymentError(currency)
+  };
+}
 function logCredentialRejected(rail, phase, err) {
   console.warn(
     JSON.stringify({
@@ -7261,6 +6447,7 @@ function drainReport(dvmId, drain) {
   return {
     dvmId,
     creditId: drain.creditId,
+    callerPubkey: drain.callerPubkey,
     drainId: drain.drainId,
     method: drain.method,
     amountMicro: drain.amountMicro,
@@ -9105,1238 +8292,106 @@ function x402SettlementPendingRefusal(args) {
       ...args.settlementId ? { settlement_id: args.settlementId } : {},
       ...args.settlementStatus ? { settlement_status: args.settlementStatus } : {},
       ...admitted ? { settlement_drain_id: admitted } : {}
-    }
-  });
-}
-function drainLedgerErrorResponse(error, creditId, drainId) {
-  if (error.code === "nothing_to_drain") {
-    return jsonPaymentError("nothing_to_drain", 409, {
-      message: `credit ${creditId} has no available balance to drain.`,
-      extra: {
-        balance_micro: error.details.balanceMicro ?? 0,
-        remaining_micro: Math.max(0, error.details.availableMicro ?? 0)
-      }
-    });
-  }
-  if (error.code === "drain_below_dust") {
-    return jsonPaymentError("drain_below_dust", 409, {
-      message: error.message,
-      extra: {
-        balance_micro: error.details.balanceMicro ?? 0,
-        remaining_micro: Math.max(0, error.details.availableMicro ?? 0),
-        owed_sats: 0
-      }
-    });
-  }
-  if (error.code === "drain_conflict") {
-    const copy = error.details.drainConflict ? DRAIN_CONFLICT_COPY[error.details.drainConflict] : void 0;
-    return jsonPaymentError("drain_conflict", 409, {
-      message: error.message,
-      display: copy?.display,
-      hint: copy?.hint({ creditId, drainId }),
-      // An unclassified conflict keeps the duplicate-payout copy's own
-      // `retryable`, and the id it was never told anything about.
-      retryable: copy?.retryable,
-      extra: { drain_registered: copy?.drainRegistered ?? false }
-    });
-  }
-  if (error.code === "settlement_pending") {
-    return x402SettlementPendingRefusal({
-      door: "drain",
-      message: error.message,
-      drainId,
-      ...error.details.settlementId ? { settlementId: error.details.settlementId } : {},
-      ...error.details.settlementStatus ? { settlementStatus: error.details.settlementStatus } : {},
-      ...error.details.blockingDrainId ? { blockingDrainId: error.details.blockingDrainId } : {}
-    });
-  }
-  if (error.code === "caller_mismatch" || error.code === "credit_not_found") {
-    return jsonPaymentError("credit_not_found", 404, {
-      message: `No credit ${creditId} for this caller.`
-    });
-  }
-  return jsonPaymentError(mapLedgerCode(error), 402, { message: error.message });
-}
-function isHttpResponse(value) {
-  return value instanceof Response || typeof value === "object" && "headers" in value && typeof value.status === "number";
-}
-function mapLedgerCode(err) {
-  switch (err.code) {
-    case "insufficient_credit":
-    case "credit_expired":
-    case "credit_unbacked":
-    case "credit_not_found":
-    case "tempo_channel_closing":
-    case "settlement_pending":
-    case "nothing_to_drain":
-    case "drain_below_dust":
-    case "drain_not_found":
-    case "drain_conflict":
-      return err.code;
-    default:
-      return "payment_invalid";
-  }
-}
-function creditBody(credit, reconciliationPending = false) {
-  return {
-    status: credit.status,
-    credit_id: credit.creditId,
-    currency: credit.currency,
-    balance_micro: credit.balanceMicro,
-    remaining_micro: credit.availableMicro,
-    expiry_ms: credit.expiryMs,
-    expired: credit.expired,
-    // Reclaimable via op "drain" (internal-review) — true whenever spendable-or-
-    // expired value remains. Expiry ends spending, never ownership.
-    drainable: credit.status === "active" && credit.availableMicro > 0,
-    ...reconciliationPending && { reconciliation_pending: true },
-    ledger_seq: credit.lastLedgerSeq
-  };
-}
-function spendable(credit, currency) {
-  return !credit.expired && credit.status === "active" && credit.currency === currency;
-}
-function pickPrimary(credits, currency) {
-  let best;
-  for (const credit of credits) {
-    if (!spendable(credit, currency) || credit.availableMicro <= 0) continue;
-    if (!best || credit.availableMicro > best.availableMicro || credit.availableMicro === best.availableMicro && credit.createdAt > best.createdAt) {
-      best = credit;
-    }
-  }
-  return best;
-}
-
-// src/lib/mints.ts
-var RECOMMENDED_MINTS = [
-  {
-    name: "Testnut",
-    description: "Cashu test mint \u2014 use for testing only, not real funds",
-    url: "https://testnut.cashu.space"
-  },
-  {
-    name: "Voltz Mint",
-    description: "Production Cashu mint by the Voltz Wallet team",
-    url: "https://mint.lnvoltz.com"
-  }
-];
-function isTestMintUrl(url) {
-  let host;
-  try {
-    host = new URL(url).hostname.toLowerCase();
-  } catch {
-    return false;
-  }
-  if (host.startsWith("[") && host.endsWith("]")) host = host.slice(1, -1);
-  if (LOOPBACK_HOSTS.has(host)) return true;
-  if (host.endsWith(".localhost")) return true;
-  return TEST_MINT_HOSTS.has(host);
-}
-var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "0.0.0.0", "::1"]);
-var TEST_MINT_HOSTS = /* @__PURE__ */ new Set(["testnut.cashu.space"]);
-
-// src/lib/receipt-key.ts
-import { schnorr, secp256k1 } from "@noble/curves/secp256k1.js";
-import { hkdf } from "@noble/hashes/hkdf.js";
-import { sha256 } from "@noble/hashes/sha2.js";
-import { bytesToHex, hexToBytes } from "@noble/hashes/utils.js";
-var RECEIPT_KDF_SALT = "dvmkit/receipt/v1";
-function deriveReceiptSecret(builderSecretHex, dvmId) {
-  const ikm = hexToBytes(builderSecretHex);
-  const salt = new TextEncoder().encode(RECEIPT_KDF_SALT);
-  for (let counter = 0; counter < 256; counter++) {
-    const info = new TextEncoder().encode(
-      counter === 0 ? `${RECEIPT_KDF_SALT}/${dvmId}` : `${RECEIPT_KDF_SALT}/${dvmId}#${String(counter)}`
-    );
-    const candidate = hkdf(sha256, ikm, salt, info, 32);
-    if (secp256k1.utils.isValidSecretKey(candidate)) return bytesToHex(candidate);
-  }
-  throw new Error(`deriveReceiptSecret: no valid secp256k1 scalar for DVM ID "${dvmId}"`);
-}
-function receiptPubkeyFromSecret(secretHex) {
-  return bytesToHex(schnorr.getPublicKey(hexToBytes(secretHex)));
-}
-function deriveReceiptKeypair(builderSecretHex, dvmId) {
-  const secret = deriveReceiptSecret(builderSecretHex, dvmId);
-  return { secret, pubkey: receiptPubkeyFromSecret(secret) };
-}
-function generateEphemeralReceiptKey() {
-  const { secretKey, publicKey } = schnorr.keygen();
-  return { secret: bytesToHex(secretKey), pubkey: bytesToHex(publicKey) };
-}
-
-// src/lib/x402/env.ts
-import { isAddress } from "viem";
-import { privateKeyToAccount as privateKeyToAccount3 } from "viem/accounts";
-var X402_SELF_RELAY_KEY = "DVMKIT_X402_SELF_RELAY_KEY";
-var X402_RECEIVER_AUTHORIZER_KEY = "DVMKIT_X402_RECEIVER_AUTHORIZER_KEY";
-var X402_BATCH_SETTLEMENT_KEY = "DVMKIT_X402_BATCH_SETTLEMENT";
-var X402_RPC_URL_KEY = "DVMKIT_X402_RPC_URL";
-var PRIVATE_KEY_RE = /^0x[0-9a-fA-F]{64}$/;
-var X402EnvValidationError = class extends Error {
-  constructor(code, variable, message, expectedAddress) {
-    super(message);
-    this.code = code;
-    this.variable = variable;
-    this.expectedAddress = expectedAddress;
-    this.name = "X402EnvValidationError";
-  }
-  code;
-  variable;
-  expectedAddress;
-};
-function validateX402Env(env, opts = {}) {
-  const relayKey = env[X402_SELF_RELAY_KEY];
-  const authorizerKey = env[X402_RECEIVER_AUTHORIZER_KEY];
-  const hasRelayKey = relayKey !== void 0;
-  const hasAuthorizerKey = authorizerKey !== void 0;
-  const relay = hasRelayKey ? derive(X402_SELF_RELAY_KEY, relayKey) : void 0;
-  const authorizer = hasAuthorizerKey ? derive(X402_RECEIVER_AUTHORIZER_KEY, authorizerKey) : void 0;
-  const completeWrite = opts.requireCompleteBundle === true && (hasRelayKey || hasAuthorizerKey);
-  if (hasRelayKey || completeWrite) {
-    if (env[X402_BATCH_SETTLEMENT_KEY] !== "true") {
-      fail(
-        "x402_bundle_incomplete",
-        hasRelayKey ? X402_SELF_RELAY_KEY : X402_RECEIVER_AUTHORIZER_KEY,
-        `Changing either x402 private key requires ${X402_BATCH_SETTLEMENT_KEY}=true in the same write.`
-      );
-    }
-    if (!env[X402_RPC_URL_KEY]?.trim()) {
-      fail(
-        "x402_bundle_incomplete",
-        hasRelayKey ? X402_SELF_RELAY_KEY : X402_RECEIVER_AUTHORIZER_KEY,
-        `Changing either x402 private key requires an explicit ${X402_RPC_URL_KEY} in the same write.`
-      );
-    }
-    if (!hasAuthorizerKey || completeWrite && !hasRelayKey) {
-      if (!completeWrite && !hasAuthorizerKey) {
-        fail(
-          "x402_bundle_incomplete",
-          X402_RECEIVER_AUTHORIZER_KEY,
-          `${X402_SELF_RELAY_KEY} requires ${X402_RECEIVER_AUTHORIZER_KEY}.`
-        );
-      }
-      fail(
-        "x402_bundle_incomplete",
-        hasRelayKey ? X402_RECEIVER_AUTHORIZER_KEY : X402_SELF_RELAY_KEY,
-        `Changing either x402 private key requires both ${X402_SELF_RELAY_KEY} and ${X402_RECEIVER_AUTHORIZER_KEY} in the same write.`
-      );
-    }
-  }
-  if (hasRelayKey && relayKey.toLowerCase() === authorizerKey?.toLowerCase()) {
-    fail(
-      "x402_key_reuse",
-      X402_SELF_RELAY_KEY,
-      `${X402_SELF_RELAY_KEY} and ${X402_RECEIVER_AUTHORIZER_KEY} must use different private keys.`
-    );
-  }
-  assertExpectation(X402_SELF_RELAY_KEY, relay, opts.expectedRelay);
-  assertExpectation(X402_RECEIVER_AUTHORIZER_KEY, authorizer, opts.expectedAuthorizer);
-  return { ...relay ? { relay } : {}, ...authorizer ? { authorizer } : {} };
-}
-function derive(variable, key) {
-  if (!PRIVATE_KEY_RE.test(key)) {
-    fail(
-      "invalid_x402_private_key",
-      variable,
-      `${variable} must be a 0x-prefixed 32-byte hex secp256k1 private key.`
-    );
-  }
-  try {
-    return privateKeyToAccount3(key).address;
-  } catch {
-    fail(
-      "invalid_x402_private_key",
-      variable,
-      `${variable} must be a valid secp256k1 private key.`
-    );
-  }
-}
-function assertExpectation(variable, actual, expected) {
-  if (expected === void 0) return;
-  if (!isAddress(expected, { strict: false })) {
-    fail(
-      "invalid_x402_expected_address",
-      variable,
-      `Expected address for ${variable} must be a 0x-prefixed 20-byte EVM address.`
-    );
-  }
-  if (actual?.toLowerCase() !== expected.toLowerCase()) {
-    fail(
-      "x402_address_mismatch",
-      variable,
-      `${variable} derives to a different public address than expected ${expected}.`,
-      expected
-    );
-  }
-}
-function fail(code, variable, message, expectedAddress) {
-  throw new X402EnvValidationError(code, variable, message, expectedAddress);
-}
-
-// src/observability/span-writer.ts
-var noop = () => {
-};
-var SPANS_INSERTED_CHANNEL = "spans_inserted";
-var MAX_BUFFERED_SPANS = 1e4;
-var MAX_ROW_JSONB_BYTES = 64 * 1024;
-var MAX_STRING_VALUE_BYTES = 4 * 1024;
-var FLUSH_THRESHOLD = 1e3;
-var MAX_BACKOFF_EXPONENT = 6;
-var SpanWriter = class {
-  constructor(transport, flushIntervalMs = 1e4) {
-    this.transport = transport;
-    this.flushIntervalMs = flushIntervalMs;
-  }
-  transport;
-  flushIntervalMs;
-  buffer = [];
-  flushTimer = null;
-  flushing = false;
-  dropCount = 0;
-  truncatedSpanCount = 0;
-  consecutiveFailures = 0;
-  backoffTimer = null;
-  /** Enqueue a span row. Non-blocking — truncates oversize JSONB and appends to buffer. */
-  enqueue(row) {
-    const originalBytes = JSON.stringify({
-      attributes: row.attributes,
-      dimensions: row.dimensions
-    }).length;
-    if (originalBytes > MAX_ROW_JSONB_BYTES) {
-      row = this.truncateForSize(row, originalBytes);
-    }
-    if (this.buffer.length >= MAX_BUFFERED_SPANS) {
-      this.dropCount++;
-      if (this.dropCount === 1 || this.dropCount % 1e3 === 0) {
-        console.error(
-          JSON.stringify({
-            event: "span_buffer_drop",
-            reason: "buffer_full",
-            total_dropped: this.dropCount,
-            buffer_size: this.buffer.length
-          })
-        );
-      }
-      return;
-    }
-    this.buffer.push(row);
-    if (this.buffer.length >= FLUSH_THRESHOLD && !this.flushing) {
-      void this.flush().catch(noop);
-    }
-  }
-  /** Start periodic flush to the transport. */
-  startFlush() {
-    this.flushTimer = setInterval(() => {
-      void this.flush().catch(noop);
-    }, this.flushIntervalMs);
-  }
-  /** Stop periodic flush. */
-  stopFlush() {
-    if (this.flushTimer) {
-      clearInterval(this.flushTimer);
-      this.flushTimer = null;
-    }
-    if (this.backoffTimer) {
-      clearTimeout(this.backoffTimer);
-      this.backoffTimer = null;
-    }
-  }
-  /** Flush buffered spans. Single-flight: concurrent calls exit early. */
-  async flush() {
-    if (this.flushing) return;
-    if (this.buffer.length === 0) return;
-    this.flushing = true;
-    const batch = this.buffer;
-    this.buffer = [];
-    try {
-      await this.transport.send(batch);
-      this.consecutiveFailures = 0;
-    } catch (err) {
-      this.consecutiveFailures++;
-      console.error(
-        JSON.stringify({
-          event: "span_flush_failed",
-          error: err instanceof Error ? err.message : String(err),
-          batch_size: batch.length,
-          consecutive_failures: this.consecutiveFailures
-        })
-      );
-      const room = MAX_BUFFERED_SPANS - this.buffer.length;
-      if (room > 0) {
-        this.buffer.unshift(...batch.slice(0, room));
-      }
-      if (this.consecutiveFailures > 1) {
-        const exponent = Math.min(this.consecutiveFailures - 1, MAX_BACKOFF_EXPONENT);
-        const backoffMs = this.flushIntervalMs * Math.pow(2, exponent);
-        this.stopFlush();
-        this.backoffTimer = setTimeout(() => {
-          this.backoffTimer = null;
-          this.startFlush();
-        }, backoffMs);
-      }
-    } finally {
-      this.flushing = false;
-    }
-  }
-  /** Flush remaining spans on shutdown. */
-  async shutdown() {
-    this.stopFlush();
-    await this.flush();
-  }
-  /** Number of spans dropped due to buffer overflow. */
-  getDropCount() {
-    return this.dropCount;
-  }
-  /** Number of spans truncated due to oversized JSONB payload. */
-  getTruncatedSpanCount() {
-    return this.truncatedSpanCount;
-  }
-  /** Current buffer size. */
-  getBufferSize() {
-    return this.buffer.length;
-  }
-  /** Consecutive flush failures; resets to 0 on the next successful flush. */
-  getConsecutiveFailures() {
-    return this.consecutiveFailures;
-  }
-  /**
-   * Two-pass truncation: cap individual string values, then fall back to
-   * wholesale attribute replacement if the blob is still over the limit.
-   */
-  truncateForSize(row, originalBytes) {
-    const truncatedAttrs = {};
-    for (const [key, value] of Object.entries(row.attributes)) {
-      if (typeof value === "string" && value.length > MAX_STRING_VALUE_BYTES) {
-        const omitted = value.length - MAX_STRING_VALUE_BYTES;
-        truncatedAttrs[key] = `${value.slice(0, MAX_STRING_VALUE_BYTES)}\u2026 [truncated, ${omitted} chars omitted]`;
-      } else {
-        truncatedAttrs[key] = value;
-      }
-    }
-    const afterStringPass = JSON.stringify({
-      attributes: truncatedAttrs,
-      dimensions: row.dimensions
-    }).length;
-    let mode;
-    if (afterStringPass <= MAX_ROW_JSONB_BYTES) {
-      row = { ...row, attributes: truncatedAttrs };
-      mode = "string_pass";
-    } else {
-      const dimSize = JSON.stringify(row.dimensions).length;
-      if (dimSize > MAX_ROW_JSONB_BYTES) {
-        console.error(
-          JSON.stringify({
-            event: "span_dimension_oversized",
-            name: row.name,
-            dataset: row.dataset,
-            dimension_bytes: dimSize
-          })
-        );
-      }
-      row = {
-        ...row,
-        attributes: {
-          _truncated: true,
-          original_bytes: originalBytes,
-          original_keys: Object.keys(row.attributes).sort()
-        }
-      };
-      mode = "wholesale_fallback";
-    }
-    this.truncatedSpanCount++;
-    if (this.truncatedSpanCount === 1 || this.truncatedSpanCount % 100 === 0) {
-      console.error(
-        JSON.stringify({
-          event: "span_truncated",
-          name: row.name,
-          dataset: row.dataset,
-          original_bytes: originalBytes,
-          after_string_pass_bytes: afterStringPass,
-          mode,
-          total_truncated: this.truncatedSpanCount
-        })
-      );
-    }
-    return row;
-  }
-};
-var SPAN_COLUMNS = [
-  "span_id",
-  "trace_id",
-  "parent_span_id",
-  "dataset",
-  "name",
-  "level",
-  "status",
-  "started_at_ms",
-  "ended_at_ms",
-  "service",
-  "service_version",
-  "host",
-  "pid",
-  "dimensions",
-  "attributes",
-  "error_message",
-  "error_stack",
-  "sample_rate"
-];
-async function insertSpanBatch(pool, rows) {
-  if (rows.length === 0) return;
-  const values = [];
-  const placeholders = [];
-  let idx = 1;
-  for (const row of rows) {
-    const rowPlaceholders = [];
-    for (const col of SPAN_COLUMNS) {
-      let val = row[col] ?? null;
-      if (col === "sample_rate" && val == null) {
-        val = 1;
-      }
-      if (col === "dimensions" || col === "attributes") {
-        rowPlaceholders.push(`$${idx}::jsonb`);
-        values.push(typeof val === "string" ? val : JSON.stringify(val ?? {}));
-      } else {
-        rowPlaceholders.push(`$${idx}`);
-        values.push(val);
-      }
-      idx++;
-    }
-    placeholders.push(`(${rowPlaceholders.join(", ")})`);
-  }
-  await pool.query(
-    `INSERT INTO observability.spans (${SPAN_COLUMNS.join(", ")})
-     VALUES ${placeholders.join(",\n")}
-     ON CONFLICT (dataset, span_id) DO NOTHING`,
-    values
-  );
-  try {
-    await pool.query(`SELECT pg_notify('${SPANS_INSERTED_CHANNEL}', '')`);
-  } catch {
-  }
-}
-var DbTransport = class {
-  constructor(pool) {
-    this.pool = pool;
-  }
-  pool;
-  async send(rows) {
-    await insertSpanBatch(this.pool, rows);
-  }
-};
-var HttpTransport = class {
-  constructor(platformUrl, serviceToken) {
-    this.platformUrl = platformUrl;
-    this.serviceToken = serviceToken;
-  }
-  platformUrl;
-  serviceToken;
-  async send(rows) {
-    if (rows.length === 0) return;
-    const resp = await fetch(`${this.platformUrl.replace(/\/$/, "")}/_internal/spans`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: `Bearer ${this.serviceToken}`
-      },
-      body: JSON.stringify({ spans: rows })
-    });
-    if (!resp.ok) {
-      const text = await resp.text().catch(() => "");
-      throw new Error(`Span ingestion failed: ${resp.status} ${text}`);
-    }
-  }
-};
-
-// src/lib/builder-identity.ts
-import {
-  chmodSync as chmodSync3,
-  existsSync as existsSync5,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync5,
-  renameSync as renameSync4,
-  statSync,
-  unlinkSync as unlinkSync4,
-  writeFileSync as writeFileSync5
-} from "fs";
-import { schnorr as schnorr2 } from "@noble/curves/secp256k1.js";
-import { sha256 as sha2562 } from "@noble/hashes/sha2.js";
-
-// src/lib/builder-store.ts
-import {
-  chmodSync as chmodSync2,
-  existsSync as existsSync4,
-  mkdirSync,
-  readFileSync as readFileSync4,
-  renameSync as renameSync3,
-  unlinkSync as unlinkSync3,
-  writeFileSync as writeFileSync4
-} from "fs";
-var CURRENT_VERSION = 2;
-function loadBuilderStore() {
-  if (!existsSync4(BUILDER_FILE)) {
-    return { version: CURRENT_VERSION, dvms: {} };
-  }
-  const raw = readFileSync4(BUILDER_FILE, "utf-8");
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (err) {
-    throw new Error(
-      `${BUILDER_FILE} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`,
-      { cause: err }
-    );
-  }
-  if (typeof parsed !== "object" || parsed === null) {
-    throw new Error(`${BUILDER_FILE} is not a JSON object`);
-  }
-  const values = parsed;
-  const version = values.version;
-  if (version === 1) {
-    return migrateV1Store(parsed);
-  }
-  if (version !== CURRENT_VERSION) {
-    throw new Error(
-      `${BUILDER_FILE} has unknown version ${String(version)} (expected ${CURRENT_VERSION})`
-    );
-  }
-  if (typeof values.dvms !== "object" || values.dvms === null) {
-    throw new Error(`${BUILDER_FILE} is missing the dvms object`);
-  }
-  return {
-    version: CURRENT_VERSION,
-    ...typeof values.identity_pubkey === "string" ? { identity_pubkey: values.identity_pubkey } : {},
-    dvms: values.dvms
-  };
-}
-function loadIdentityPubkey() {
-  return loadBuilderStore().identity_pubkey ?? null;
-}
-function setIdentityPubkey(pubkey) {
-  mkdirSync(BUILDER_CONFIG_DIR, { recursive: true, mode: 448 });
-  const store = loadBuilderStore();
-  store.identity_pubkey = pubkey;
-  writeBuilderStore(store);
-}
-function writeBuilderStore(store) {
-  const content = JSON.stringify(store, null, 2) + "\n";
-  backupSecretFile(BUILDER_FILE, content);
-  const tmp = `${BUILDER_FILE}.tmp`;
-  try {
-    writeFileSync4(tmp, content, { mode: 384 });
-    renameSync3(tmp, BUILDER_FILE);
-  } catch (err) {
-    try {
-      unlinkSync3(tmp);
-    } catch {
-    }
-    throw err;
-  }
-  try {
-    chmodSync2(BUILDER_FILE, 384);
-  } catch {
-  }
-}
-function migrateV1Store(parsed) {
-  if (typeof parsed.dvms !== "object" || parsed.dvms === null) {
-    throw new Error(`${BUILDER_FILE} is missing the dvms object`);
-  }
-  const dvms = {};
-  for (const [handle, rawEntry] of Object.entries(parsed.dvms)) {
-    if (typeof rawEntry !== "object" || rawEntry === null) {
-      throw new Error(`${BUILDER_FILE} has an invalid DVM entry for ${handle}`);
-    }
-    const entry = rawEntry;
-    const dvmId = entry.canonical_dvm_id;
-    if (typeof dvmId !== "string") {
-      throw new Error(`${BUILDER_FILE} has no canonical_dvm_id for ${handle}`);
-    }
-    if (Object.prototype.hasOwnProperty.call(dvms, dvmId)) {
-      throw new Error(`${BUILDER_FILE} has multiple entries for canonical_dvm_id ${dvmId}`);
-    }
-    dvms[dvmId] = { ...entry, handle };
-  }
-  return {
-    version: CURRENT_VERSION,
-    ...typeof parsed.identity_pubkey === "string" ? { identity_pubkey: parsed.identity_pubkey } : {},
-    dvms
-  };
-}
-
-// src/lib/builder-identity.ts
-function generateIdentity() {
-  const { secretKey, publicKey } = schnorr2.keygen();
-  return { pubkey: bytesToHex2(publicKey), secret: bytesToHex2(secretKey) };
-}
-function loadIdentitySecret() {
-  if (!existsSync5(BUILDER_KEY_FILE)) return null;
-  warnAndTightenLooseKeyMode();
-  const raw = readFileSync5(BUILDER_KEY_FILE, "utf-8").trim();
-  if (!/^[0-9a-f]{64}$/.test(raw)) {
-    throw new DvmError(
-      "identity_secret_malformed",
-      `${BUILDER_KEY_FILE} is not a 32-byte hex secret.`,
-      "Delete the file and re-run `dvmctl identity create` (this rotates the key \u2014 existing DVM attestations need re-deploy)."
-    );
-  }
-  return raw;
-}
-function writeIdentity(keypair, opts = {}) {
-  const existing = loadIdentityPubkey();
-  if (existing && !opts.force) {
-    throw new DvmError(
-      "identity_exists",
-      "A builder identity already exists.",
-      "Pass --force to overwrite. Any DVMs deployed under the old key will need to be re-deployed to refresh their /v1/info attestation."
-    );
-  }
-  mkdirSync2(BUILDER_CONFIG_DIR, { recursive: true, mode: 448 });
-  const tmp = `${BUILDER_KEY_FILE}.tmp`;
-  writeFileSync5(tmp, keypair.secret + "\n", { mode: 384 });
-  try {
-    renameSync4(tmp, BUILDER_KEY_FILE);
-  } catch (err) {
-    try {
-      unlinkSync4(tmp);
-    } catch {
-    }
-    throw err;
-  }
-  try {
-    chmodSync3(BUILDER_KEY_FILE, 384);
-  } catch {
-  }
-  setIdentityPubkey(keypair.pubkey);
-}
-function hashCapabilities(capabilities) {
-  return bytesToHex2(sha2562(canonicaliseForSigning(capabilities)));
-}
-function buildAttestation(args) {
-  return {
-    dvm_id: args.dvmId,
-    slug: args.slug,
-    capabilities_hash: hashCapabilities(args.capabilities),
-    builder_pubkey: args.builderPubkey,
-    ...args.receiptPubkey ? { receipt_pubkey: args.receiptPubkey } : {},
-    deployed_at: args.deployedAt ?? Math.floor(Date.now() / 1e3)
-  };
-}
-function signAttestation(payload, secretHex) {
-  const secretBytes = hexToBytes2(secretHex);
-  const canonicalBytes = canonicaliseForSigning(payload);
-  return bytesToHex2(schnorr2.sign(canonicalBytes, secretBytes));
-}
-function verifyAttestation(payload, signatureHex, pubkeyHex) {
-  try {
-    const canonicalBytes = canonicaliseForSigning(payload);
-    return schnorr2.verify(hexToBytes2(signatureHex), canonicalBytes, hexToBytes2(pubkeyHex));
-  } catch {
-    return false;
-  }
-}
-function warnAndTightenLooseKeyMode() {
-  if (process.platform === "win32") return;
-  try {
-    const mode = statSync(BUILDER_KEY_FILE).mode & 511;
-    if ((mode & 63) === 0) return;
-    console.warn(
-      JSON.stringify({
-        level: "warn",
-        event: "builder_identity_key_loose_mode",
-        message: `${BUILDER_KEY_FILE} is group/other-readable (mode ${mode.toString(8).padStart(3, "0")}). The builder signing key should be owner-only \u2014 re-tightening to 0600. A cp/scp/git checkout can widen the mode; verify nobody else read it in the meantime.`,
-        path: BUILDER_KEY_FILE,
-        mode: mode.toString(8).padStart(3, "0")
-      })
-    );
-    chmodSync3(BUILDER_KEY_FILE, 384);
-  } catch {
-  }
-}
-function bytesToHex2(bytes) {
-  let s = "";
-  for (const b of bytes) s += b.toString(16).padStart(2, "0");
-  return s;
-}
-function hexToBytes2(hex) {
-  if (hex.length % 2 !== 0) {
-    throw new Error(`hex string has odd length: ${String(hex.length)}`);
-  }
-  const out = new Uint8Array(hex.length / 2);
-  for (let i = 0; i < out.length; i++) {
-    out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
-  }
-  return out;
-}
-
-// src/lib/receipt.ts
-import { schnorr as schnorr3 } from "@noble/curves/secp256k1.js";
-import { sha256 as sha2563 } from "@noble/hashes/sha2.js";
-import { bytesToHex as bytesToHex3, hexToBytes as hexToBytes3 } from "@noble/hashes/utils.js";
-function computeResultHash(summary, artifactContents) {
-  const artifactHashes = artifactContents.map(
-    (content) => bytesToHex3(sha2563(canonicaliseForSigning(content)))
-  );
-  return bytesToHex3(
-    sha2563(
-      canonicaliseForSigning({
-        summary: summary ?? null,
-        artifact_hashes: artifactHashes
-      })
-    )
-  );
-}
-function signReceipt(unsigned, secretHex) {
-  const bytes = canonicaliseForSigning(unsigned);
-  const signature = bytesToHex3(schnorr3.sign(bytes, hexToBytes3(secretHex)));
-  return { ...unsigned, signature };
-}
-function verifyReceipt(receipt) {
-  try {
-    const { signature, ...unsigned } = receipt;
-    const bytes = canonicaliseForSigning(unsigned);
-    return schnorr3.verify(hexToBytes3(signature), bytes, hexToBytes3(receipt.receipt_pubkey));
-  } catch {
-    return false;
-  }
-}
-function isSignedJobReceipt(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-  const r = value;
-  const paid = r.paid;
-  return r.v === 1 && typeof r.job_id === "string" && typeof r.dvm_id === "string" && typeof r.dvm === "string" && typeof r.capability === "string" && (r.outcome === "completed" || r.outcome === "failed" || r.outcome === "cancelled") && typeof r.seq === "number" && typeof r.issued_at === "number" && typeof r.receipt_pubkey === "string" && typeof r.signature === "string" && !!paid && typeof paid === "object" && !Array.isArray(paid) && typeof paid.msats === "number";
-}
-function signDrainReceipt(unsigned, secretHex) {
-  const bytes = canonicaliseForSigning(unsigned);
-  const signature = bytesToHex3(schnorr3.sign(bytes, hexToBytes3(secretHex)));
-  return { ...unsigned, signature };
-}
-function signFundingReceipt(unsigned, secretHex) {
-  const bytes = canonicaliseForSigning(unsigned);
-  const signature = bytesToHex3(schnorr3.sign(bytes, hexToBytes3(secretHex)));
-  return { ...unsigned, signature };
-}
-function isFundingReceipt(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-  const r = value;
-  return r.v === 1 && r.kind === "credit_funding" && typeof r.credit_id === "string" && typeof r.fund_id === "string" && typeof r.funded_micro === "number" && typeof r.balance_after_micro === "number" && typeof r.ledger_seq === "number" && typeof r.issued_at === "number" && typeof r.caller_pubkey === "string" && typeof r.dvm_id === "string" && typeof r.dvm === "string" && typeof r.receipt_pubkey === "string" && typeof r.signature === "string";
-}
-function verifyFundingReceipt(receipt) {
-  try {
-    const { signature, ...unsigned } = receipt;
-    const bytes = canonicaliseForSigning(unsigned);
-    return schnorr3.verify(hexToBytes3(signature), bytes, hexToBytes3(receipt.receipt_pubkey));
-  } catch {
-    return false;
-  }
-}
-function isDrainReceipt(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-  const r = value;
-  return r.v === 1 && r.kind === "credit_drain" && typeof r.credit_id === "string" && typeof r.drain_id === "string" && (r.event === "requested" || r.event === "parked" || r.event === "picked_up" || r.event === "sent" || r.event === "released") && typeof r.method === "string" && typeof r.amount_micro === "number" && typeof r.issued_at === "number" && typeof r.caller_pubkey === "string" && typeof r.dvm_id === "string" && typeof r.dvm === "string" && typeof r.receipt_pubkey === "string" && typeof r.signature === "string";
-}
-function verifyDrainReceipt(receipt) {
-  try {
-    const { signature, ...unsigned } = receipt;
-    const bytes = canonicaliseForSigning(unsigned);
-    return schnorr3.verify(hexToBytes3(signature), bytes, hexToBytes3(receipt.receipt_pubkey));
-  } catch {
-    return false;
-  }
-}
-
-// src/lib/receipt-verify.ts
-function attestedDvmIdentity(builder) {
-  const builderPubkey = authenticatedBuilderPubkey(builder);
-  if (!builderPubkey) return void 0;
-  const dvmId = builder.attestation.dvm_id;
-  if (typeof dvmId !== "string" || dvmId.length === 0) return void 0;
-  return { dvmId, builderPubkey };
-}
-function authenticatedBuilderPubkey(builder) {
-  if (!isTrustAnchor(builder)) return void 0;
-  const pubkey = builder.pubkey.trim().toLowerCase();
-  const attestedPubkey = builder.attestation.builder_pubkey;
-  if (!/^[0-9a-f]{64}$/.test(pubkey) || typeof attestedPubkey !== "string" || attestedPubkey.trim().toLowerCase() !== pubkey) {
-    return void 0;
-  }
-  const payload = builder.attestation;
-  return verifyAttestation(payload, builder.signature, pubkey) ? pubkey : void 0;
-}
-function verifyJobReceipt(args) {
-  const { receipt, builder, expectedJobId, delivered } = args;
-  const checks = {
-    job_id: checkJobId(receipt, expectedJobId),
-    signature: verifyReceipt(receipt),
-    attestation: "absent",
-    result_hash: "unchecked"
-  };
-  if (checks.job_id === "mismatch") {
-    return { status: "invalid", checks, reason: "job_id_mismatch" };
-  }
-  if (!checks.signature) {
-    return { status: "invalid", checks, reason: "signature_invalid" };
-  }
-  checks.attestation = checkReceiptAttestation(receipt, builder);
-  if (checks.attestation === "invalid") {
-    return { status: "invalid", checks, reason: "attestation_invalid" };
-  }
-  if (checks.attestation === "identity_mismatch") {
-    return { status: "invalid", checks, reason: "dvm_identity_mismatch" };
-  }
-  if (checks.attestation === "key_mismatch") {
-    return { status: "invalid", checks, reason: "receipt_key_mismatch" };
-  }
-  checks.result_hash = checkResultHash(receipt, delivered);
-  if (checks.result_hash === "mismatch") {
-    return { status: "invalid", checks, reason: "result_hash_mismatch" };
-  }
-  return {
-    status: checks.attestation === "ok" ? "verified" : "verified_unattested",
-    checks
-  };
-}
-function checkReceiptAttestation(receipt, builder) {
-  if (!isTrustAnchor(builder)) return "absent";
-  const payload = builder.attestation;
-  if (!authenticatedBuilderPubkey(builder)) return "invalid";
-  if (typeof payload.dvm_id !== "string" || payload.dvm_id !== receipt.dvm_id) {
-    return "identity_mismatch";
-  }
-  const attested = builder.attestation.receipt_pubkey;
-  if (typeof attested !== "string" || attested.length === 0) return "absent";
-  return attested.toLowerCase() === receipt.receipt_pubkey.toLowerCase() ? "ok" : "key_mismatch";
-}
-function verifyDrainReceiptChain(args) {
-  const { receipt, builder, expectedDrainId, expectedCreditId } = args;
-  const named = isDrainReceipt(receipt) ? receipt : void 0;
-  const checks = {
-    drain_id: checkDrainField(named?.drain_id, expectedDrainId),
-    credit_id: checkDrainField(named?.credit_id, expectedCreditId),
-    signature: named !== void 0 && verifyDrainReceipt(named),
-    attestation: "absent"
-  };
-  if (checks.drain_id === "mismatch") {
-    return { status: "invalid", checks, reason: "drain_id_mismatch" };
-  }
-  if (checks.credit_id === "mismatch") {
-    return { status: "invalid", checks, reason: "credit_id_mismatch" };
-  }
-  if (named === void 0 || !checks.signature) {
-    return { status: "invalid", checks, reason: "signature_invalid" };
-  }
-  checks.attestation = checkReceiptAttestation(named, builder);
-  if (checks.attestation === "invalid") {
-    return { status: "invalid", checks, reason: "attestation_invalid" };
-  }
-  if (checks.attestation === "identity_mismatch") {
-    return { status: "invalid", checks, reason: "dvm_identity_mismatch" };
-  }
-  if (checks.attestation === "key_mismatch") {
-    return { status: "invalid", checks, reason: "receipt_key_mismatch" };
-  }
-  return {
-    status: checks.attestation === "ok" ? "verified" : "verified_unattested",
-    checks
-  };
-}
-function verifyFundingReceiptChain(args) {
-  const named = isFundingReceipt(args.receipt) ? args.receipt : void 0;
-  const check = (actual, expected) => expected === void 0 ? "unchecked" : actual === expected ? "ok" : "mismatch";
-  const checks = {
-    credit_id: check(named?.credit_id, args.expectedCreditId),
-    fund_id: check(named?.fund_id, args.expectedFundId),
-    funded_micro: check(named?.funded_micro, args.expectedFundedMicro),
-    balance_after_micro: check(named?.balance_after_micro, args.expectedBalanceAfterMicro),
-    ledger_seq: check(named?.ledger_seq, args.expectedLedgerSeq),
-    caller_pubkey: check(named?.caller_pubkey, args.expectedCallerPubkey),
-    signature: named !== void 0 && verifyFundingReceipt(named),
-    attestation: "absent"
-  };
-  const mismatch = [
-    ["credit_id", "credit_id_mismatch"],
-    ["fund_id", "fund_id_mismatch"],
-    ["funded_micro", "funding_amount_mismatch"],
-    ["balance_after_micro", "funding_balance_mismatch"],
-    ["ledger_seq", "funding_ledger_seq_mismatch"],
-    ["caller_pubkey", "caller_pubkey_mismatch"]
-  ];
-  for (const [field, reason] of mismatch) {
-    if (checks[field] === "mismatch") return { status: "invalid", checks, reason, receipt: named };
-  }
-  if (!named || !checks.signature) {
-    return { status: "invalid", checks, reason: "signature_invalid", receipt: named };
-  }
-  checks.attestation = checkReceiptAttestation(named, args.builder);
-  if (checks.attestation === "invalid") {
-    return { status: "invalid", checks, reason: "attestation_invalid", receipt: named };
+    }
+  });
+}
+function drainLedgerErrorResponse(error, creditId, drainId) {
+  if (error.code === "nothing_to_drain") {
+    return jsonPaymentError("nothing_to_drain", 409, {
+      message: `credit ${creditId} has no available balance to drain.`,
+      extra: {
+        balance_micro: error.details.balanceMicro ?? 0,
+        remaining_micro: Math.max(0, error.details.availableMicro ?? 0)
+      }
+    });
   }
-  if (checks.attestation === "identity_mismatch") {
-    return { status: "invalid", checks, reason: "dvm_identity_mismatch", receipt: named };
+  if (error.code === "drain_below_dust") {
+    return jsonPaymentError("drain_below_dust", 409, {
+      message: error.message,
+      extra: {
+        balance_micro: error.details.balanceMicro ?? 0,
+        remaining_micro: Math.max(0, error.details.availableMicro ?? 0),
+        owed_sats: 0
+      }
+    });
   }
-  if (checks.attestation === "key_mismatch") {
-    return { status: "invalid", checks, reason: "receipt_key_mismatch", receipt: named };
+  if (error.code === "drain_conflict") {
+    const copy = error.details.drainConflict ? DRAIN_CONFLICT_COPY[error.details.drainConflict] : void 0;
+    return jsonPaymentError("drain_conflict", 409, {
+      message: error.message,
+      display: copy?.display,
+      hint: copy?.hint({ creditId, drainId }),
+      // An unclassified conflict keeps the duplicate-payout copy's own
+      // `retryable`, and the id it was never told anything about.
+      retryable: copy?.retryable,
+      extra: { drain_registered: copy?.drainRegistered ?? false }
+    });
   }
-  return {
-    status: checks.attestation === "ok" ? "verified" : "verified_unattested",
-    checks,
-    receipt: named
-  };
-}
-function weakestReceiptVerdict(statuses) {
-  if (statuses.length === 0) return "absent";
-  if (statuses.includes("invalid")) return "invalid";
-  if (statuses.includes("absent")) return "absent";
-  if (statuses.includes("verified_unattested")) return "verified_unattested";
-  return "verified";
-}
-function drainReceiptsDisplay(status, sound, total) {
-  const tally = `${String(sound)} of ${String(total)}`;
-  switch (status) {
-    case "verified":
-      return `Verified reclaim receipts (${tally}): signed by the key this DVM's builder identity attests.`;
-    case "verified_unattested":
-      return `Reclaim receipts, signed but unattested (${tally}): the signature holds, but this DVM publishes no builder identity to vouch for the signing key.`;
-    case "invalid":
-      return `UNVERIFIED reclaim receipts: only ${tally} hold up \u2014 the refund is still owed, but this evidence is not sound.`;
-    case "absent":
-      return "No reclaim receipts: this DVM returned no signed evidence of the drain.";
-  }
-}
-function drainReceiptsHint(status) {
-  switch (status) {
-    case "verified":
-      return "The refund evidence chains to this DVM's published builder identity, and is stored locally with that identity pinned beside it \u2014 so an unhonoured refund stays provable against the builder, not against an anonymous key.";
-    case "verified_unattested":
-      return "The receipts are signed, but nothing vouches for the signing key \u2014 expected for a locally-run or development DVM, not for a deployed one. Stored either way; the refund is owed regardless.";
-    case "invalid":
-      return "The refund is unaffected \u2014 this is a problem with the proof, not the money. Keep this output, and treat the reclaim as unattested when deciding how much to leave on deposit at this DVM.";
-    case "absent":
-      return "This DVM countersigned nothing, so the only artifact behind this reclaim is the drain request the caller signed. Weaker evidence than a countersigned drain, and worth weighing before funding here again.";
-  }
-}
-function receiptDisplay(receipt, status, rate = 0) {
-  const what = `${receipt.dvm}/${receipt.capability} (DVM ID ${receipt.dvm_id})`;
-  const when = receiptIssuedAtIso(receipt)?.slice(0, 10);
-  return `${VERDICT_PREFIX[status]}: paid ${formatPaid(receipt.paid.msats, rate)} for ${what}, ${receipt.outcome}${when ? ` ${when}` : ""}.`;
-}
-function receiptIssuedAtIso(receipt) {
-  const seconds = receipt.issued_at;
-  return typeof seconds === "number" ? epochMsToIso(seconds * 1e3) : null;
-}
-function epochMsToIso(ms) {
-  if (typeof ms !== "number" || !Number.isFinite(ms) || Math.abs(ms) > MAX_TIMESTAMP_MS) {
-    return null;
+  if (error.code === "settlement_pending") {
+    return x402SettlementPendingRefusal({
+      door: "drain",
+      message: error.message,
+      drainId,
+      ...error.details.settlementId ? { settlementId: error.details.settlementId } : {},
+      ...error.details.settlementStatus ? { settlementStatus: error.details.settlementStatus } : {},
+      ...error.details.blockingDrainId ? { blockingDrainId: error.details.blockingDrainId } : {}
+    });
   }
-  return new Date(ms).toISOString();
-}
-function receiptHint(status, jobId) {
-  const verifyCmd = jobId ? `'dvm receipts verify ${jobId}'` : "'dvm receipts verify <job-id>'";
-  switch (status) {
-    case "verified":
-      return `Proof of purchase is stored locally. Re-check it any time with ${verifyCmd}, or hand over the raw bundle with 'dvm receipts export'.`;
-    case "verified_unattested":
-      return `The receipt's signature is valid, but this DVM publishes no builder identity to vouch for the signing key \u2014 expected for a locally-run or development DVM, not for a deployed one. Stored either way; inspect it with ${verifyCmd}.`;
-    case "invalid":
-      return `The job itself is unaffected \u2014 this is a problem with the proof, not the result. Run ${verifyCmd} to see which check failed before relying on this receipt as evidence.`;
-    case "absent":
-      return "This DVM does not issue signed receipts, so there is no proof of purchase to store. Nothing went wrong.";
-  }
-}
-function receiptFailureDetail(reason) {
-  switch (reason) {
-    case "job_id_mismatch":
-      return "The receipt names a different job than the one it was collected for \u2014 it is not proof of this job, whoever signed it.";
-    case "drain_id_mismatch":
-      return "The receipt names a different reclaim than the one it is filed under \u2014 it is not evidence of this drain, whoever signed it.";
-    case "credit_id_mismatch":
-      return "The receipt names a different credit than the one this reclaim was against \u2014 it is not evidence of this refund, whoever signed it.";
-    case "fund_id_mismatch":
-      return "The receipt names a different funding operation than the caller submitted.";
-    case "funding_amount_mismatch":
-      return "The signed funded amount differs from the provider's funding response.";
-    case "funding_balance_mismatch":
-      return "The signed post-funding balance differs from the provider's fresh balance response.";
-    case "funding_ledger_seq_mismatch":
-      return "The signed funding sequence differs from the provider's fresh balance response.";
-    case "caller_pubkey_mismatch":
-      return "The funding receipt names a different caller than the key that submitted the funding.";
-    case "signature_invalid":
-      return "The receipt's signature does not verify under the key it names \u2014 the bytes were altered, or it was never signed by that key.";
-    case "attestation_invalid":
-      return "The DVM's published builder attestation does not verify under its own builder pubkey.";
-    case "dvm_identity_mismatch":
-      return "The receipt names a different immutable DVM ID than the builder attestation, so it is not evidence for this provider.";
-    case "receipt_key_mismatch":
-      return "The receipt was signed by a different key than the one the DVM's builder attested.";
-    case "result_hash_mismatch":
-      return "The receipt attests a different result than the one delivered.";
-  }
-}
-var MAX_TIMESTAMP_MS = 864e13;
-function checkJobId(receipt, expectedJobId) {
-  if (expectedJobId === void 0) return "unchecked";
-  return receipt.job_id === expectedJobId ? "ok" : "mismatch";
-}
-function checkDrainField(actual, expected) {
-  if (expected === void 0 || actual === void 0) return "unchecked";
-  return actual === expected ? "ok" : "mismatch";
-}
-var VERDICT_PREFIX = {
-  verified: "Verified receipt",
-  verified_unattested: "Receipt (signed, unattested)",
-  invalid: "UNVERIFIED receipt",
-  absent: "No receipt"
-};
-function checkResultHash(receipt, delivered) {
-  if (!delivered) return "unchecked";
-  if (receipt.result_hash === null) return "unchecked";
-  const summary = receipt.outcome === "completed" ? delivered.summary : void 0;
-  let recomputed;
-  try {
-    recomputed = computeResultHash(summary, delivered.artifactContents);
-  } catch {
-    return "unchecked";
+  if (error.code === "caller_mismatch" || error.code === "credit_not_found") {
+    return jsonPaymentError("credit_not_found", 404, {
+      message: `No credit ${creditId} for this caller.`
+    });
   }
-  return recomputed === receipt.result_hash ? "ok" : "mismatch";
-}
-function isTrustAnchor(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-  const anchor = value;
-  return typeof anchor.pubkey === "string" && typeof anchor.signature === "string" && !!anchor.attestation && typeof anchor.attestation === "object" && !Array.isArray(anchor.attestation);
-}
-function formatPaid(msats, rate) {
-  if (msats === 0) return "nothing (free job)";
-  const sats = msats % 1e3 === 0 ? msats / 1e3 : Math.round(msats / 1e3 * 100) / 100;
-  const satsLabel = `${sats.toLocaleString("en-US")} sats`;
-  if (rate <= 0) return satsLabel;
-  const usd = msatsToUsd(msats, rate);
-  return `~$${formatUsd(usd)} (${satsLabel}, ${costAnchor(usd)})`;
-}
-
-// src/lib/request-id.ts
-var MAX_REQUEST_ID_LENGTH = 128;
-var REQUEST_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/;
-function isPublicRequestId(value) {
-  return typeof value === "string" && value.length > 0 && value.length <= MAX_REQUEST_ID_LENGTH && REQUEST_ID_PATTERN.test(value);
+  return jsonPaymentError(mapLedgerCode(error), 402, { message: error.message });
 }
-
-// src/lib/traceparent.ts
-var TRACEPARENT_RE = /^00-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/;
-var ALL_ZERO_TRACE = "00000000000000000000000000000000";
-var ALL_ZERO_SPAN = "0000000000000000";
-function parseTraceparent(header) {
-  if (!header) return null;
-  const match = TRACEPARENT_RE.exec(header.trim());
-  if (!match) return null;
-  const [, traceId, parentSpanId, flagsHex] = match;
-  if (traceId === ALL_ZERO_TRACE || parentSpanId === ALL_ZERO_SPAN) return null;
-  return { traceId, parentSpanId, flags: parseInt(flagsHex, 16) };
+function isHttpResponse(value) {
+  return value instanceof Response || typeof value === "object" && "headers" in value && typeof value.status === "number";
 }
-
-// src/lib/wallet-agent/keypair.ts
-import { secp256k1 as secp256k12 } from "@noble/curves/secp256k1.js";
-var PRIVKEY_HEX_RE = /^[0-9a-f]{64}$/i;
-function derivePubkeyFromPrivkey(privkey) {
-  if (!PRIVKEY_HEX_RE.test(privkey)) {
-    throw new DvmError(
-      "invalid_privkey",
-      "Privkey must be 64 hex characters (32 bytes).",
-      "Provide a valid secp256k1 private key as a 64-char hex string."
-    );
-  }
-  const bytes = hexToBytes4(privkey);
-  if (!secp256k12.utils.isValidSecretKey(bytes)) {
-    throw new DvmError(
-      "invalid_privkey",
-      "Privkey is not a valid secp256k1 scalar (zero or out of curve order).",
-      "Generate a fresh key with: dvm wallet init"
-    );
+function mapLedgerCode(err) {
+  switch (err.code) {
+    case "insufficient_credit":
+    case "credit_expired":
+    case "credit_unbacked":
+    case "credit_not_found":
+    case "tempo_channel_closing":
+    case "settlement_pending":
+    case "nothing_to_drain":
+    case "drain_below_dust":
+    case "drain_not_found":
+    case "drain_conflict":
+      return err.code;
+    default:
+      return "payment_invalid";
   }
-  const pub = secp256k12.getPublicKey(bytes);
-  return bytesToHex4(pub);
 }
-function bytesToHex4(bytes) {
-  return Buffer.from(bytes).toString("hex");
+function creditBody(credit, reconciliationPending = false) {
+  return {
+    status: credit.status,
+    credit_id: credit.creditId,
+    currency: credit.currency,
+    balance_micro: credit.balanceMicro,
+    remaining_micro: credit.availableMicro,
+    expiry_ms: credit.expiryMs,
+    expired: credit.expired,
+    // Reclaimable via op "drain" (internal-review) — true whenever spendable-or-
+    // expired value remains. Expiry ends spending, never ownership.
+    drainable: credit.status === "active" && credit.availableMicro > 0,
+    ...reconciliationPending && { reconciliation_pending: true },
+    ledger_seq: credit.lastLedgerSeq
+  };
 }
-function hexToBytes4(hex) {
-  return Uint8Array.from(Buffer.from(hex, "hex"));
+function spendable(credit, currency) {
+  return !credit.expired && credit.status === "active" && credit.currency === currency;
 }
-
-// src/lib/wallet-agent/sign.ts
-import { schnorr as schnorr4 } from "@noble/curves/secp256k1.js";
-var PUBKEY_COMPRESSED_HEX_RE = /^0[23][0-9a-f]{64}$/i;
-var PUBKEY_XONLY_HEX_RE = /^[0-9a-f]{64}$/i;
-var SIG_HEX_RE = /^[0-9a-f]{128}$/i;
-function signChallenge(privkeyHex, challenge) {
-  if (!PRIVKEY_HEX_RE.test(privkeyHex)) {
-    throw new DvmError(
-      "invalid_privkey",
-      "Privkey must be 64 hex characters (32 bytes).",
-      "Provide a valid secp256k1 private key as a 64-char hex string."
-    );
-  }
-  if (challenge.length !== 32) {
-    throw new DvmError(
-      "invalid_challenge",
-      `Challenge must be exactly 32 bytes; got ${challenge.length}.`,
-      "Pass the SHA-256 digest output (32 bytes)."
-    );
-  }
-  const sig = schnorr4.sign(challenge, hexToBytes5(privkeyHex));
-  return bytesToHex5(sig);
-}
-function verifyChallenge(pubkeyHex, challenge, sigHex) {
-  if (!SIG_HEX_RE.test(sigHex)) return false;
-  if (challenge.length !== 32) return false;
-  let xonly;
-  if (PUBKEY_COMPRESSED_HEX_RE.test(pubkeyHex)) {
-    xonly = hexToBytes5(pubkeyHex.slice(2));
-  } else if (PUBKEY_XONLY_HEX_RE.test(pubkeyHex)) {
-    xonly = hexToBytes5(pubkeyHex);
-  } else {
-    return false;
-  }
-  try {
-    return schnorr4.verify(hexToBytes5(sigHex), challenge, xonly);
-  } catch {
-    return false;
+function pickPrimary(credits, currency) {
+  let best;
+  for (const credit of credits) {
+    if (!spendable(credit, currency) || credit.availableMicro <= 0) continue;
+    if (!best || credit.availableMicro > best.availableMicro || credit.availableMicro === best.availableMicro && credit.createdAt > best.createdAt) {
+      best = credit;
+    }
   }
-}
-function hexToBytes5(hex) {
-  return Uint8Array.from(Buffer.from(hex, "hex"));
-}
-function bytesToHex5(bytes) {
-  return Buffer.from(bytes).toString("hex");
-}
-
-// src/lib/cashu/admin-auth.ts
-import { randomBytes as randomBytes3 } from "crypto";
-import { sha256 as sha2564 } from "@noble/hashes/sha2.js";
-var ADMIN_AUTH_NONCE_TTL_SECONDS = 300;
-var ADMIN_AUTH_CLOCK_SKEW_SECONDS = 30;
-var ADMIN_STATE_UNAVAILABLE = "admin_state_unavailable";
-function buildAdminChallenge(args) {
-  const msg = `dvmkit-admin:${args.method}:${args.path}:${args.dvmId}:${args.nonceHex}:${args.unixSeconds}`;
-  return sha2564(new TextEncoder().encode(msg));
-}
-function buildAdminAuthHeader(args) {
-  const nowMs = args.now ? args.now() : Date.now();
-  const unixSeconds = Math.floor(nowMs / 1e3);
-  const nonceBytes = args.randomNonce ? args.randomNonce() : Uint8Array.from(randomBytes3(16));
-  const nonceHex = Buffer.from(nonceBytes).toString("hex");
-  const challenge = buildAdminChallenge({
-    method: args.method,
-    path: args.path,
-    dvmId: args.dvmId,
-    nonceHex,
-    unixSeconds
-  });
-  const sigHex = signChallenge(args.privkeyHex, challenge);
-  return {
-    header: `P2PK ${nonceHex}.${unixSeconds}.${sigHex}`,
-    nonceHex,
-    unixSeconds
-  };
+  return best;
 }
 
 // src/sdk/server/admin-cashu.ts
@@ -10670,7 +8725,7 @@ async function handleRotateLockPubkey(c, opts) {
 }
 
 // src/sdk/server/x402-exact-settlement.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 var X402ExactSettlementServer = class {
   constructor(opts) {
     this.opts = opts;
@@ -10998,7 +9053,7 @@ function settlementMayHaveMoved(response) {
   return reason.includes("authorization_already_used") || reason.includes("authorization already used") || /facilitator_status_5\d\d/.test(reason);
 }
 function hash(parts) {
-  return createHash5("sha256").update(JSON.stringify(parts)).digest("hex");
+  return createHash4("sha256").update(JSON.stringify(parts)).digest("hex");
 }
 function safeError(err) {
   if (err instanceof Error) return err.name;
@@ -11022,31 +9077,16 @@ function jobCredentialGate(opts) {
         // (2026-06-29, paid jobs whose results were unretrievable behind an
         // opaque 404) is only one of two ways to get here — a current client
         // reading a job whose local state has no token gets the same refusal,
-        // and "upgrade" would be a dead end for them. `display` is relayed to
-        // a human verbatim, so the conditional advice lives in `hint`, which
+        // and an upgrade alone would be a dead end for them. `display` is relayed
+        // to a human verbatim, so the conditional advice lives in `hint`, which
         // is what the agent acts on.
         display: "Couldn't retrieve your result \u2014 the request was missing its job credential.",
-        hint: `Send the job_token from the POST /v1/job response as the X-Job-Token header${alternative}. The token is minted once, at submit, and the DVM cannot reissue it \u2014 a job submitted from another machine, or by a caller that never stored it, can't be read here. If your caller never sends X-Job-Token at all, upgrade: npm i -g @dvmkit/dvm-cli@0.1.4.`
+        hint: `Send the job_token from the POST /v1/job response as the X-Job-Token header${alternative}. The token is minted once, at submit, and the DVM cannot reissue it \u2014 a job submitted from another machine, or by a caller that never stored it, can't be read here. If your caller never sends X-Job-Token at all, upgrade: npm i -g @dvmkit/dvm-cli@0.2.0, then retry the same command with --endpoint <url> --job-token <hex> (or set DVM_JOB_ENDPOINT and DVM_JOB_TOKEN).`
       };
     }
   };
 }
 
-// src/lib/monotonic-clock.ts
-function createMonotonicClock() {
-  let anchorWallMs = Date.now();
-  let anchorMonoMs = performance.now();
-  return () => {
-    const wallMs = Date.now();
-    const monoMs = performance.now();
-    const projectedMs = anchorWallMs + (monoMs - anchorMonoMs);
-    const nowMs = wallMs >= projectedMs ? wallMs : projectedMs;
-    anchorWallMs = nowMs;
-    anchorMonoMs = monoMs;
-    return Math.floor(nowMs);
-  };
-}
-
 // src/sdk/server/request-envelope.ts
 var REQUEST_ID_FIELD = "request_id";
 var AUTH_STATEMENT_FIELD = "auth_statement";
@@ -11055,7 +9095,7 @@ function protocolEnvelopeIgnoreFields(schema) {
 }
 function stripProtocolEnvelope(schema, data) {
   const withoutCredit = stripCreditEnvelope(schema, data);
-  if (!isRecord3(withoutCredit)) return withoutCredit;
+  if (!isRecord2(withoutCredit)) return withoutCredit;
   const {
     [REQUEST_ID_FIELD]: _requestId,
     [AUTH_STATEMENT_FIELD]: _authStatement,
@@ -11064,26 +9104,26 @@ function stripProtocolEnvelope(schema, data) {
   return builderInput;
 }
 function requestIdFromEnvelope(data) {
-  if (!isRecord3(data) || !(REQUEST_ID_FIELD in data)) return void 0;
+  if (!isRecord2(data) || !(REQUEST_ID_FIELD in data)) return void 0;
   return isPublicRequestId(data[REQUEST_ID_FIELD]) ? data[REQUEST_ID_FIELD] : void 0;
 }
 function hasInvalidRequestId(data) {
-  return isRecord3(data) && REQUEST_ID_FIELD in data && !isPublicRequestId(data[REQUEST_ID_FIELD]);
+  return isRecord2(data) && REQUEST_ID_FIELD in data && !isPublicRequestId(data[REQUEST_ID_FIELD]);
 }
-function isRecord3(value) {
+function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
 // src/sdk/server/job-manager.ts
-import { randomBytes as randomBytes5 } from "crypto";
+import { randomBytes as randomBytes4 } from "crypto";
 
 // src/sdk/server/context.ts
-import { randomBytes as randomBytes4 } from "crypto";
+import { randomBytes as randomBytes3 } from "crypto";
 
 // src/sdk/server/instrumented-kv.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 function hashKey(key) {
-  return createHash6("sha256").update(key).digest("hex").slice(0, 16);
+  return createHash5("sha256").update(key).digest("hex").slice(0, 16);
 }
 function instrumentKVStore(inner) {
   return {
@@ -11322,19 +9362,21 @@ function buildContext(job, opts) {
       let x402Nonce;
       let x402AmountUsdcMicro;
       const hasExplicitX402 = Boolean(payOpts?.x402);
-      if (payOpts?.x402) {
-        paymentRequestContent.x402 = payOpts.x402;
-      } else if (opts.paymentMethods?.includes("x402") && opts.x402 && (opts.x402FacilitatorHealth?.support().available ?? true)) {
-        paymentRequestContent.x402 = {
-          pay_to: opts.x402.payTo,
-          network: opts.x402.network,
-          asset: opts.x402.asset ?? "USDC",
-          ...opts.x402.facilitator && { facilitator: opts.x402.facilitator }
-        };
+      if ((opts.pricingCurrency ?? "usd") === "usd") {
+        if (payOpts?.x402) {
+          paymentRequestContent.x402 = payOpts.x402;
+        } else if (opts.paymentMethods?.includes("x402") && opts.x402 && (opts.x402FacilitatorHealth?.support().available ?? true)) {
+          paymentRequestContent.x402 = {
+            pay_to: opts.x402.payTo,
+            network: opts.x402.network,
+            asset: opts.x402.asset ?? "USDC",
+            ...opts.x402.facilitator && { facilitator: opts.x402.facilitator }
+          };
+        }
       }
       if (paymentRequestContent.x402) {
         paymentRate = (await resolveServerBtcUsdRate(opts.fxFetcher)).rate;
-        x402Nonce = `0x${randomBytes4(32).toString("hex")}`;
+        x402Nonce = `0x${randomBytes3(32).toString("hex")}`;
         x402AmountUsdcMicro = msatsToUsdc(amountMsats, paymentRate).toString();
         const x402Request = paymentRequestContent.x402;
         const challengeConfig = {
@@ -11905,6 +9947,11 @@ var REACTIVATION_CLAIM_POLL_MS = 25;
 var DEFAULT_ORPHAN_DRAW_AGE_MS = 15 * 6e4;
 var DEFAULT_TERMINAL_DRAW_RECONCILE_AGE_MS = 30 * 6e4;
 var DEFAULT_ORPHAN_DRAW_SWEEP_INTERVAL_MS = 5 * 6e4;
+var DEFAULT_JOB_RETENTION_SWEEP_INTERVAL_MS = 24 * 60 * 6e4;
+var DEFAULT_JOB_RETENTION_BOOT_DELAY_MS = 3e4;
+var JOB_RETENTION_SWEEP_BATCH = 50;
+var JOB_RETENTION_SWEEP_MAX_PAGES = 20;
+var DAY_MS = 24 * 60 * 6e4;
 var ORPHAN_DRAW_SWEEP_BATCH = 50;
 var ORPHAN_DRAW_SWEEP_MAX_PAGES = 20;
 var ANY_DRAW_AGE_CUTOFF_MS = Number.MAX_SAFE_INTEGER;
@@ -11926,7 +9973,7 @@ var JobManager = class {
   statusChecksInFlight = /* @__PURE__ */ new Set();
   /** Job ids that were notified mid-re-read and must be re-checked (internal-review). */
   statusChecksQueued = /* @__PURE__ */ new Set();
-  sessionId = randomBytes5(3).toString("hex");
+  sessionId = randomBytes4(3).toString("hex");
   nextJobId = 1;
   accumulatorMonitor;
   staleJobTimeoutMs;
@@ -11943,10 +9990,13 @@ var JobManager = class {
   staleSweepTimer;
   heartbeatTimer;
   orphanDrawSweepTimer;
+  jobRetentionSweepTimer;
+  jobRetentionBootTimer;
   /** This manager holds {@link ORPHAN_SWEEP_CLAIMS} for its ledger. */
   orphanSweepClaimed = false;
   /** Where a page-capped tick left off; cleared once a tick reaches the end. */
   orphanSweepResumeFrom;
+  jobRetentionResumeFrom;
   /**
    * A `Date.now()` reading that cannot regress within this manager's lifetime
    * (internal-review). Anchored at construction, so a manager already running when
@@ -11957,6 +10007,7 @@ var JobManager = class {
   monotonicNowMs = createMonotonicClock();
   sweepInFlight = false;
   orphanSweepInFlight = false;
+  jobRetentionSweepInFlight = false;
   heartbeatInFlight = false;
   /**
    * The denomination of every credit this DVM opens (internal-review). Resolved once,
@@ -12055,6 +10106,32 @@ var JobManager = class {
       }, orphanIntervalMs);
       this.orphanDrawSweepTimer.unref();
     }
+    if (descriptor.jobRetentionDays > 0) {
+      if (!isJobRetentionStore(this.jobStore)) {
+        console.warn(
+          JSON.stringify({
+            level: "warn",
+            event: "job_retention_store_unsupported",
+            dvm: descriptor.name,
+            retentionDays: descriptor.jobRetentionDays
+          })
+        );
+      } else {
+        const pass = () => {
+          void this.sweepJobRetention().catch(() => void 0);
+        };
+        const bootDelayMs = opts.jobRetentionSweepBootDelayMs ?? DEFAULT_JOB_RETENTION_BOOT_DELAY_MS;
+        if (bootDelayMs > 0) {
+          this.jobRetentionBootTimer = setTimeout(pass, bootDelayMs);
+          this.jobRetentionBootTimer.unref();
+        }
+        const intervalMs = opts.jobRetentionSweepIntervalMs ?? DEFAULT_JOB_RETENTION_SWEEP_INTERVAL_MS;
+        if (intervalMs > 0) {
+          this.jobRetentionSweepTimer = setInterval(pass, intervalMs);
+          this.jobRetentionSweepTimer.unref();
+        }
+      }
+    }
   }
   /** Active in-memory jobs. */
   get activeJobs() {
@@ -12755,47 +10832,212 @@ var JobManager = class {
       this.sweepInFlight = false;
     }
   }
-  /**
-   * How far one watchdog arm may lean on {@link monotonicNowMs} past the wall
-   * clock to cover a backwards step (internal-review). The compensation is capped,
-   * not free: a claimed row must still have been silent for
-   * `windowMs - cap`, and unlike the orphan sweep, claiming eagerly here
-   * force-fails a job that may well be alive.
-   *
-   * **Half the window** is the floor that governs a wide window — five missed
-   * heartbeats on the processing defaults. On the `awaiting-input` arm it also
-   * preserves a real invariant: with the derived
-   * `2 x idleTimeout + headroom`, half is `idleTimeout + 45s`, so the sweeper
-   * still cannot fire before the in-process idle timer would have. (A builder
-   * who overrides `staleJobTimeoutMs` below `2 x idleTimeout` has already
-   * opted out of that, guard or no guard.)
-   *
-   * **Two heartbeat intervals** is the floor that governs a window configured
-   * close to the beat cadence — `processingWatchdog: 40` against the 30s
-   * default beat, where half the window is less than one beat and a worker
-   * heartbeating exactly on schedule would be reaped the moment the host's
-   * clock stepped. That pair is marginal already; the guard must not make it
-   * deterministic. The cap collapses to zero there, which is today's
-   * behaviour: late, never wrong. The `awaiting-input` arm takes no such term
-   * — nothing heartbeats it by design, and its refresh is an inbound caller
-   * message on no cadence at all.
-   *
-   * **Why a magnitude and not a predicate.** The tempting sharper rule is to
-   * compensate per row, fully, for any stamp that reads ahead of our wall —
-   * one our own post-step heartbeat could not have written. It is unsafe: a
-   * future-stamped row is equally what a live job heartbeated by a peer whose
-   * clock runs fast looks like, and from the stamp alone the two are
-   * indistinguishable. The same reasoning bounds the cap from the other side —
-   * while our clock is stepped, the guard force-fails the live jobs of any
-   * peer slower than `windowMs - cap`, which is 2.5 minutes of tolerated
-   * disagreement on the defaults, far outside anything NTP-managed hosts show.
-   */
-  staleSweepCompensationCapMs(windowMs, heartbeated) {
-    if (windowMs <= 0) return 0;
-    const halfWindow = Math.floor(windowMs / 2);
-    if (!heartbeated || this.heartbeatIntervalMs <= 0) return halfWindow;
-    return Math.max(0, Math.min(halfWindow, windowMs - 2 * this.heartbeatIntervalMs));
-  }
+  /**
+   * How far one watchdog arm may lean on {@link monotonicNowMs} past the wall
+   * clock to cover a backwards step (internal-review). The compensation is capped,
+   * not free: a claimed row must still have been silent for
+   * `windowMs - cap`, and unlike the orphan sweep, claiming eagerly here
+   * force-fails a job that may well be alive.
+   *
+   * **Half the window** is the floor that governs a wide window — five missed
+   * heartbeats on the processing defaults. On the `awaiting-input` arm it also
+   * preserves a real invariant: with the derived
+   * `2 x idleTimeout + headroom`, half is `idleTimeout + 45s`, so the sweeper
+   * still cannot fire before the in-process idle timer would have. (A builder
+   * who overrides `staleJobTimeoutMs` below `2 x idleTimeout` has already
+   * opted out of that, guard or no guard.)
+   *
+   * **Two heartbeat intervals** is the floor that governs a window configured
+   * close to the beat cadence — `processingWatchdog: 40` against the 30s
+   * default beat, where half the window is less than one beat and a worker
+   * heartbeating exactly on schedule would be reaped the moment the host's
+   * clock stepped. That pair is marginal already; the guard must not make it
+   * deterministic. The cap collapses to zero there, which is today's
+   * behaviour: late, never wrong. The `awaiting-input` arm takes no such term
+   * — nothing heartbeats it by design, and its refresh is an inbound caller
+   * message on no cadence at all.
+   *
+   * **Why a magnitude and not a predicate.** The tempting sharper rule is to
+   * compensate per row, fully, for any stamp that reads ahead of our wall —
+   * one our own post-step heartbeat could not have written. It is unsafe: a
+   * future-stamped row is equally what a live job heartbeated by a peer whose
+   * clock runs fast looks like, and from the stamp alone the two are
+   * indistinguishable. The same reasoning bounds the cap from the other side —
+   * while our clock is stepped, the guard force-fails the live jobs of any
+   * peer slower than `windowMs - cap`, which is 2.5 minutes of tolerated
+   * disagreement on the defaults, far outside anything NTP-managed hosts show.
+   */
+  staleSweepCompensationCapMs(windowMs, heartbeated) {
+    if (windowMs <= 0) return 0;
+    const halfWindow = Math.floor(windowMs / 2);
+    if (!heartbeated || this.heartbeatIntervalMs <= 0) return halfWindow;
+    return Math.max(0, Math.min(halfWindow, windowMs - 2 * this.heartbeatIntervalMs));
+  }
+  // ── Terminal job content retention ───────────────────────────────────
+  /**
+   * Redact terminal job content beyond this DVM's configured window.
+   *
+   * The scan advances over every candidate, including rows that fail draw
+   * resolution, so one money-path fault cannot starve everything behind it.
+   * Any failed row remains unredacted and the next tick restarts from the head;
+   * a page-capped clean pass instead retains its cursor and resumes at the
+   * tail. Failure and recovery callbacks are awaited but never allowed to
+   * change the sweep result.
+   */
+  async sweepJobRetention() {
+    const idle = { examined: 0, redacted: 0, complete: false };
+    if (this.descriptor.jobRetentionDays <= 0 || !isJobRetentionStore(this.jobStore)) return idle;
+    if (this.jobRetentionSweepInFlight) return idle;
+    this.jobRetentionSweepInFlight = true;
+    let examined = 0;
+    let redacted = 0;
+    let complete = false;
+    let cursor = this.jobRetentionResumeFrom;
+    const failures = [];
+    const now = Date.now();
+    const lastActivityBeforeMs = now - this.descriptor.jobRetentionDays * DAY_MS;
+    try {
+      for (let page = 0; page < JOB_RETENTION_SWEEP_MAX_PAGES; page++) {
+        const candidates = await this.jobStore.listJobsForRetention({
+          lastActivityBeforeMs,
+          limit: JOB_RETENTION_SWEEP_BATCH,
+          capabilities: this.capabilityNames(),
+          after: cursor
+        });
+        for (const record of candidates) {
+          examined++;
+          cursor = { lastActivityAt: record.lastActivityAt, id: record.id };
+          try {
+            await this.prepareJobForRedaction(record, now);
+            const changed = await this.jobStore.redactJob({
+              jobId: record.id,
+              expectedLastActivityAt: record.lastActivityAt,
+              redactedAt: now
+            });
+            if (changed) redacted++;
+          } catch (err) {
+            const failure = err instanceof Error ? err : new Error(String(err));
+            failures.push(failure);
+            console.error(
+              JSON.stringify({
+                level: "error",
+                event: "job_retention_candidate_failed",
+                jobId: record.id,
+                error: failure.message
+              })
+            );
+          }
+        }
+        if (candidates.length < JOB_RETENTION_SWEEP_BATCH) {
+          complete = true;
+          break;
+        }
+      }
+      if (failures.length > 0) {
+        this.jobRetentionResumeFrom = void 0;
+        throw new AggregateError(failures, `${failures.length} job retention candidate(s) failed`);
+      }
+      this.jobRetentionResumeFrom = complete ? void 0 : cursor;
+      console.log(
+        JSON.stringify({
+          level: "info",
+          event: "job_retention_swept",
+          retentionDays: this.descriptor.jobRetentionDays,
+          cutoffMs: lastActivityBeforeMs,
+          examined,
+          redacted,
+          complete
+        })
+      );
+      if (complete) {
+        await this.notifyJobRetentionRecovered({ examined, redacted });
+      }
+      return { examined, redacted, complete };
+    } catch (err) {
+      this.jobRetentionResumeFrom = void 0;
+      const error = err instanceof Error ? err.message : String(err);
+      console.error(
+        JSON.stringify({
+          level: "error",
+          event: "job_retention_sweep_failed",
+          retentionDays: this.descriptor.jobRetentionDays,
+          examined,
+          redacted,
+          error
+        })
+      );
+      await this.notifyJobRetentionFailed(error);
+      throw err;
+    } finally {
+      this.jobRetentionSweepInFlight = false;
+    }
+  }
+  /** Resolve every hold and persist any configured receipt before content disappears. */
+  async prepareJobForRedaction(record, nowMs) {
+    const ledger = this.opts.creditLedger;
+    if (!ledger) {
+      if (record.creditId || record.drawId) {
+        throw new Error("job carries a credit draw but no ledger is configured");
+      }
+    } else {
+      const draws = await ledger.listDrawsByJobId(record.id);
+      for (const draw of draws) {
+        if (draw.status !== "pending") continue;
+        await this.reconcileTerminalDraw(ledger, draw, record, nowMs);
+      }
+      const stillPending = (await ledger.listDrawsByJobId(record.id)).filter(
+        (draw) => draw.status === "pending"
+      );
+      if (stillPending.length > 0) {
+        throw new Error(
+          `job still has ${stillPending.length} pending credit draw(s): ${stillPending.map((draw) => draw.drawId).join(", ")}`
+        );
+      }
+    }
+    if (!record.receipt && this.opts.receiptIssuer && isReceiptIssuingStore(this.jobStore) && !await this.issueReceipt(record)) {
+      throw new Error("signed receipt could not be persisted");
+    }
+  }
+  async notifyJobRetentionFailed(error) {
+    const callback = this.opts.onJobRetentionSweepFailed;
+    if (!callback) return;
+    try {
+      await callback({
+        dvmId: this.opts.dvmId ?? "",
+        dvmName: this.descriptor.name,
+        retentionDays: this.descriptor.jobRetentionDays,
+        error
+      });
+    } catch (callbackError) {
+      console.error(
+        JSON.stringify({
+          level: "error",
+          event: "job_retention_alert_failed",
+          error: callbackError instanceof Error ? callbackError.message : String(callbackError)
+        })
+      );
+    }
+  }
+  async notifyJobRetentionRecovered(result) {
+    const callback = this.opts.onJobRetentionSweepRecovered;
+    if (!callback) return;
+    try {
+      await callback({
+        dvmId: this.opts.dvmId ?? "",
+        dvmName: this.descriptor.name,
+        retentionDays: this.descriptor.jobRetentionDays,
+        ...result
+      });
+    } catch (callbackError) {
+      console.error(
+        JSON.stringify({
+          level: "error",
+          event: "job_retention_recovery_alert_failed",
+          error: callbackError instanceof Error ? callbackError.message : String(callbackError)
+        })
+      );
+    }
+  }
   // ── Orphan-draw sweeper (internal-review) + terminal reconciler (internal-review) ──
   /**
    * Resolve `pending` credit draws the terminal funnel can no longer reach.
@@ -13294,6 +11536,7 @@ var JobManager = class {
       {
         mints: this.opts.mints,
         x402Config: this.opts.x402,
+        pricingCurrency: this.pricingCurrency,
         x402ExactSettlement: this.opts.x402ExactSettlement,
         x402ExactVersions: this.opts.x402FacilitatorHealth?.support().exact,
         mpp: this.opts.mpp,
@@ -14105,6 +12348,14 @@ var JobManager = class {
       clearInterval(this.orphanDrawSweepTimer);
       this.orphanDrawSweepTimer = void 0;
     }
+    if (this.jobRetentionBootTimer) {
+      clearTimeout(this.jobRetentionBootTimer);
+      this.jobRetentionBootTimer = void 0;
+    }
+    if (this.jobRetentionSweepTimer) {
+      clearInterval(this.jobRetentionSweepTimer);
+      this.jobRetentionSweepTimer = void 0;
+    }
     if (this.orphanSweepClaimed && this.opts.creditLedger) {
       ORPHAN_SWEEP_CLAIMS.delete(this.opts.creditLedger);
       this.orphanSweepClaimed = false;
@@ -15224,7 +13475,7 @@ function withWallClockDeadline(promise, timeoutMs) {
 }
 
 // src/sdk/server/app.ts
-import { createHash as createHash8, randomBytes as randomBytes6, randomUUID as randomUUID4 } from "crypto";
+import { createHash as createHash7, randomBytes as randomBytes5, randomUUID as randomUUID4 } from "crypto";
 import { Hono } from "hono";
 import { getCookie } from "hono/cookie";
 import { cors } from "hono/cors";
@@ -15246,7 +13497,7 @@ import {
   Amount as Amount3,
   CheckStateEnum as CheckStateEnum3,
   getP2PKExpectedWitnessPubkeys as getP2PKExpectedWitnessPubkeys2,
-  getTokenMetadata as getTokenMetadata2
+  getTokenMetadata
 } from "@cashu/cashu-ts";
 function installAdminCreditRoutes(app, opts) {
   app.get("/admin/credit/pending-drains", (c) => handlePendingDrains(c, opts));
@@ -15522,6 +13773,15 @@ async function handleBitcoinLiability(c, opts) {
 async function handleParkDrain(c, opts) {
   const auth = await requireAuth(c, opts);
   if ("response" in auth) return auth.response;
+  if (!opts.accumulatorWired) {
+    return c.json(
+      {
+        error: "accumulator_not_wired",
+        message: "Cashu accumulator persistence is not configured on this DVM."
+      },
+      503
+    );
+  }
   let body;
   try {
     body = await c.req.json();
@@ -15609,7 +13869,7 @@ async function handleParkDrain(c, opts) {
   }
   let parsed;
   try {
-    const meta = getTokenMetadata2(token);
+    const meta = getTokenMetadata(token);
     parsed = {
       mint: meta.mint,
       faceSats: Amount3.from(meta.amount).toNumber(),
@@ -15956,6 +14216,7 @@ async function handleReconcileInvoice(c, opts) {
           payload: {
             dvmId: opts.dvmId,
             creditId: targetCreditId,
+            callerPubkey: invoice.callerPubkey,
             // The payment hash keys the deposit, as it does on the ordinary
             // settlement path — so a redelivered report collides rather
             // than double-counts.
@@ -18005,7 +16266,7 @@ initSchemaForm();
 }
 
 // src/sdk/server/request-fingerprint.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 function requestFingerprint(req, opts) {
   const canonical = canonicalize({
     capability: req.capability,
@@ -18013,7 +16274,7 @@ function requestFingerprint(req, opts) {
     params: req.params ?? {},
     data: opts.stripAuthEnvelope ? stripEnvelope(req.data) : req.data
   });
-  return createHash7("sha256").update(canonical).digest("hex");
+  return createHash6("sha256").update(canonical).digest("hex");
 }
 var ENVELOPE_KEYS = /* @__PURE__ */ new Set(["pubkey", "signature", "timestamp", "nonce", "auth_statement"]);
 function stripEnvelope(data) {
@@ -18062,7 +16323,7 @@ async function createDVMServer(descriptor, opts) {
   let revenueReporter;
   let payoutReporter;
   if (!opts.onJobCompleted && platformToken && platformUrl && dvmId && opts.db) {
-    const { RevenueReporter } = await import("./revenue-reporter-JIKUPXOK.js");
+    const { RevenueReporter } = await import("./revenue-reporter-XXSU5KVB.js");
     const reporter = new RevenueReporter(opts.db, platformUrl, platformToken);
     await reporter.init();
     reporter.startRetryLoop();
@@ -18345,7 +16606,9 @@ var DVMServer = class {
       // needs-approval — reachable only from a rung that raises a real mid-job
       // ask, which nothing above L1 did. Facilitator availability is still
       // re-checked per ask in `context.ts`, so a static list is safe here.
-      paymentMethods: opts.paymentMethods ?? this.defaultPaymentMethods(),
+      paymentMethods: (opts.paymentMethods ?? this.defaultPaymentMethods()).filter(
+        (method) => method !== "x402" || this.x402CurrencySupported()
+      ),
       x402: opts.x402,
       x402ExactSettlement: this.x402ExactSettlement,
       x402FacilitatorHealth: opts.x402FacilitatorHealth,
@@ -18370,6 +16633,8 @@ var DVMServer = class {
       onJobCompleted: opts.onJobCompleted,
       onPaidJobDeath: opts.onPaidJobDeath,
       onRevenueSkippedNoRail: opts.onRevenueSkippedNoRail,
+      onJobRetentionSweepFailed: opts.onJobRetentionSweepFailed,
+      onJobRetentionSweepRecovered: opts.onJobRetentionSweepRecovered,
       reactivationClaimGraceMs: opts.reactivationClaimGraceMs
     });
     this.app = new Hono();
@@ -18505,20 +16770,23 @@ var DVMServer = class {
     this.app.post("/v1/job/:id/messages", (c) => this.handlePostMessage(c));
     this.app.delete("/v1/job/:id", (c) => this.handleDeleteJob(c));
     this.app.post("/v1/credit", (c) => this.handleCredit(c));
-    if (this.opts.cashuMode === "p2pk-accumulator" && this.opts.db && this.opts.dvmId && this.opts.lockPubkey) {
+    if (this.opts.db && this.opts.dvmId && this.opts.lockPubkey) {
       const db = this.opts.db;
       const dvmId = this.opts.dvmId;
       const payoutReporter = this.opts.payoutReporter;
-      installAdminCashuRoutes(this.app, {
-        db,
-        dvmId,
-        getLockPubkeyState: () => this.loadActiveLockPubkeyState(db, dvmId),
-        graceSeconds: this.graceSeconds(),
-        nonceStore: this.adminCashuNonceStore,
-        // internal-review: a completed melt is a landed payout, queued in the
-        // transaction that marks it.
-        ...payoutReporter ? { onMelted: payoutReporter.meltHook() } : {}
-      });
+      const accumulatorWired = this.opts.cashuMode === "p2pk-accumulator";
+      if (accumulatorWired) {
+        installAdminCashuRoutes(this.app, {
+          db,
+          dvmId,
+          getLockPubkeyState: () => this.loadActiveLockPubkeyState(db, dvmId),
+          graceSeconds: this.graceSeconds(),
+          nonceStore: this.adminCashuNonceStore,
+          // internal-review: a completed melt is a landed payout, queued in the
+          // transaction that marks it.
+          ...payoutReporter ? { onMelted: payoutReporter.meltHook() } : {}
+        });
+      }
       installAdminCreditRoutes(this.app, {
         db,
         dvmId,
@@ -18526,6 +16794,7 @@ var DVMServer = class {
         fxFetcher: this.fxFetcher,
         getLockPubkeyState: () => this.loadActiveLockPubkeyState(db, dvmId),
         nonceStore: this.adminCashuNonceStore,
+        accumulatorWired,
         receiptIssuer: this.receiptIssuer,
         creditTtlMs: () => this.creditTtlMs(),
         creditCurrency: () => this.creditCurrency(),
@@ -18843,7 +17112,7 @@ var DVMServer = class {
       const dvmId = this.opts.dvmId ?? `dev:${this.descriptor.name}`;
       return {
         dvm_id: dvmId,
-        builder_pubkey: createHash8("sha256").update(`dvmkit-dev:${dvmId}`).digest("hex")
+        builder_pubkey: createHash7("sha256").update(`dvmkit-dev:${dvmId}`).digest("hex")
       };
     }
     throw new AuthAudienceError();
@@ -18899,7 +17168,7 @@ var DVMServer = class {
       const accumulatorReady = this.opts.cashuMode === "p2pk-accumulator" && !!this.opts.lockPubkey && !!this.opts.db;
       if (accumulatorReady) methods.push("cashu");
     }
-    if (this.opts.x402) methods.push("x402");
+    if (this.opts.x402 && this.x402CurrencySupported()) methods.push("x402");
     if (this.opts.mpp) methods.push("tempo");
     return methods;
   }
@@ -18909,6 +17178,10 @@ var DVMServer = class {
     if (!this.opts.x402.batchSettlement?.selfRelay) return support;
     return { ...support, batchSettlement: true };
   }
+  /** Whether this DVM can state its price exactly in x402's USDC unit. */
+  x402CurrencySupported() {
+    return this.pricingCurrency === "usd";
+  }
   /**
    * Settleable rails for this DVM, honouring an explicit `opts.paymentMethods`
    * override and otherwise deriving from wired rails. Single source of truth so
@@ -18916,9 +17189,12 @@ var DVMServer = class {
    */
   resolvePaymentMethods() {
     const configured = this.opts.paymentMethods ?? this.defaultPaymentMethods();
-    if (!this.opts.x402) return configured;
-    const x402Available = this.x402Support()?.available ?? false;
-    return configured.filter((method) => method !== "x402" || x402Available);
+    const currencyFiltered = configured.filter(
+      (method) => method !== "x402" || this.x402CurrencySupported()
+    );
+    if (!this.opts.x402) return currencyFiltered;
+    const x402Available = this.x402CurrencySupported() && (this.x402Support()?.available ?? false);
+    return currencyFiltered.filter((method) => method !== "x402" || x402Available);
   }
   /**
    * Rails a **credit top-up** may arrive on — the funding menu's list
@@ -18936,7 +17212,9 @@ var DVMServer = class {
     const methods = this.resolvePaymentMethods().filter(
       (method) => method !== "tempo" || creditMpp
     );
-    if (this.x402BatchAvailable() && !methods.includes("x402")) methods.push("x402");
+    if (this.x402CurrencySupported() && this.x402BatchAvailable() && !methods.includes("x402")) {
+      methods.push("x402");
+    }
     if (this.opts.lightningReceive?.available()) methods.push("lightning");
     return methods;
   }
@@ -18984,7 +17262,7 @@ var DVMServer = class {
   creditX402Schemes() {
     const x402 = this.opts.x402;
     const support = this.x402Support();
-    if (!x402 || !support) return [];
+    if (!this.x402CurrencySupported() || !x402 || !support) return [];
     return [
       ...support.available ? [{ scheme: X402_EXACT_SCHEME, network: x402.network }] : [],
       ...this.x402BatchAvailable() ? [{ scheme: X402_BATCH_SETTLEMENT_SCHEME, network: x402.network }] : []
@@ -19026,6 +17304,7 @@ var DVMServer = class {
       if (replayed || !funding || !credit) continue;
       this.reportCreditDeposit({
         creditId: invoice.creditId,
+        callerPubkey: credit.callerPubkey,
         // The payment hash is Lightning's own settlement reference, so it is
         // what keys the deposit — a redelivered report collides rather than
         // double-counts.
@@ -19078,7 +17357,7 @@ var DVMServer = class {
     }
     const x402Support = this.x402Support();
     const x402BatchSettlement = await this.resolveX402BatchSettlement();
-    const x402Payment = x402Support?.exact.v2 || x402Support?.batchSettlement ? c.req.header("PAYMENT-SIGNATURE") : void 0;
+    const x402Payment = this.x402CurrencySupported() ? x402Support?.exact.v2 || x402Support?.batchSettlement ? c.req.header("PAYMENT-SIGNATURE") : void 0 : c.req.header("PAYMENT-SIGNATURE") ?? c.req.header("X-PAYMENT");
     return {
       cashuToken: c.req.header("X-Cashu"),
       mints: this.opts.mints,
@@ -19261,7 +17540,7 @@ var DVMServer = class {
     if (this.opts.mints) info.mints = this.advertisedMints();
     info.capabilities = this.renderCapabilities();
     info.payment = { methods: this.resolvePaymentMethods() };
-    if (this.opts.x402 && this.x402Support()?.available) {
+    if (this.x402CurrencySupported() && this.opts.x402 && this.x402Support()?.available) {
       info.x402 = {
         pay_to: this.opts.x402.payTo,
         network: this.opts.x402.network,
@@ -19894,7 +18173,7 @@ var DVMServer = class {
         requesterId: c.get("requesterId"),
         requestFingerprint: fingerprint,
         jobId: this.jobManager.allocateJobId(),
-        claimToken: randomBytes6(32).toString("hex")
+        claimToken: randomBytes5(32).toString("hex")
       };
       publicRequestClaimResult = resumeOnly ? await recoveryStore.resumeRequestId(publicRequestClaim) : await recoveryStore.claimRequestId(publicRequestClaim);
       if (!publicRequestClaimResult) {
@@ -20121,8 +18400,8 @@ var DVMServer = class {
         }
       }
       const isAnonymous = requesterId === "anonymous" || requesterId === "dev-anonymous";
-      const jobToken = isAnonymous ? randomBytes6(32).toString("hex") : void 0;
-      const requesterTokenHash = jobToken ? createHash8("sha256").update(jobToken).digest("hex") : void 0;
+      const jobToken = isAnonymous ? randomBytes5(32).toString("hex") : void 0;
+      const requesterTokenHash = jobToken ? createHash7("sha256").update(jobToken).digest("hex") : void 0;
       const job = jm.createJob(
         normalisedBody,
         requesterId,
@@ -20822,7 +19101,7 @@ function isJobOwner(c, job) {
   if (job.requesterTokenHash) {
     const token = c.req.header("X-Job-Token");
     if (!token) return false;
-    const provided = createHash8("sha256").update(token).digest("hex");
+    const provided = createHash7("sha256").update(token).digest("hex");
     return timingSafeEqualHex(provided, job.requesterTokenHash);
   }
   return c.get("requesterId") === job.requesterId;
@@ -21088,567 +19367,6 @@ function validateMessageContent(type, content, devMode) {
   return null;
 }
 
-// src/lib/nwc.ts
-import { decrypt, encrypt } from "nostr-tools/nip04";
-import { SimplePool, useWebSocketImplementation } from "nostr-tools/pool";
-import { finalizeEvent, getPublicKey } from "nostr-tools/pure";
-import WebSocket from "ws";
-
-// src/lib/hash.ts
-import { createHash as createHash9 } from "crypto";
-function sha256hex(input) {
-  return createHash9("sha256").update(input).digest("hex");
-}
-
-// src/lib/nwc.ts
-useWebSocketImplementation(WebSocket);
-var NwcError = class extends Error {
-  constructor(code, message, method) {
-    super(message);
-    this.code = code;
-    this.method = method;
-    this.name = "NwcError";
-  }
-  code;
-  method;
-};
-function nwcTimeoutMs() {
-  return positiveSecondsEnv("DVM_NWC_TIMEOUT_SEC", 30);
-}
-function nwcDedupWindowMs() {
-  return positiveSecondsEnv("DVM_NWC_DEDUP_WINDOW_SEC", 240);
-}
-async function withNwcPool(conn, fn, timeoutMs) {
-  return withPool(void 0, conn, (pool) => fn({ pool, timeoutMs }));
-}
-function parseNwcUri(uri) {
-  if (!uri.startsWith("nostr+walletconnect://")) {
-    throw new NwcError("invalid_uri", "NWC URI must start with nostr+walletconnect://");
-  }
-  const withoutScheme = uri.slice("nostr+walletconnect://".length);
-  const [walletPubkey, queryString] = withoutScheme.split("?", 2);
-  if (!walletPubkey || !queryString) {
-    throw new NwcError("invalid_uri", "NWC URI missing pubkey or query params");
-  }
-  const params = new URLSearchParams(queryString);
-  const relays = params.getAll("relay").filter((r) => r.length > 0);
-  const secretHex = params.get("secret");
-  if (relays.length === 0) throw new NwcError("invalid_uri", "NWC URI missing relay param");
-  if (!secretHex) throw new NwcError("invalid_uri", "NWC URI missing secret param");
-  if (!/^[0-9a-fA-F]{64}$/.test(secretHex)) {
-    throw new NwcError("invalid_uri", "NWC URI secret must be 64 hex characters");
-  }
-  const secret = hexToBytes6(secretHex);
-  const clientPubkey = getPublicKey(secret);
-  return { walletPubkey, relays, secret, clientPubkey };
-}
-async function payInvoiceReconciling(conn, bolt11, opts = {}) {
-  return callerLoggers.lightning.span(
-    "lightning.pay_invoice",
-    {
-      relays: conn.relays.join(","),
-      wallet_pubkey: conn.walletPubkey,
-      bolt11_hash: sha256hex(bolt11).slice(0, 16)
-    },
-    async () => {
-      const now = opts.now ?? (() => Date.now());
-      const dedupWindowMs = opts.dedupWindowMs ?? nwcDedupWindowMs();
-      return withPool(opts.pool, conn, async (pool) => {
-        const method = "pay_invoice";
-        const event = buildRequestEvent(conn, method, { invoice: bolt11 });
-        const publishedAtMs = now();
-        const first = await attemptPayment(conn, method, event, pool, opts.timeoutMs);
-        if (first.kind === "settled") {
-          return settledOutcome(first, "paid");
-        }
-        if (first.kind === "rejected") throw first.error;
-        if (first.kind === "not_sent") {
-          throw first.error;
-        }
-        const reconciled = await reconcile(conn, bolt11, pool, opts.timeoutMs);
-        if (reconciled.kind === "settled") {
-          callerLoggers.lightning.info("lightning.pay_invoice.reconciled", { republished: false });
-          return settledOutcome(reconciled, "reconciled");
-        }
-        if (reconciled.kind === "unknown") {
-          throw new NwcError(
-            "payment_unknown",
-            "The wallet never answered and could not confirm whether the payment went through."
-          );
-        }
-        if (now() - publishedAtMs >= dedupWindowMs) {
-          throw new NwcError(
-            "payment_unknown",
-            "The wallet never answered and too much time has passed to safely retry the payment."
-          );
-        }
-        callerLoggers.lightning.info("lightning.pay_invoice.republish", { event_id: event.id });
-        const second = await attemptPayment(conn, method, event, pool, opts.timeoutMs);
-        if (second.kind === "settled") {
-          return settledOutcome(second, "republished");
-        }
-        if (second.kind === "rejected") throw second.error;
-        const final = await reconcile(conn, bolt11, pool, opts.timeoutMs);
-        if (final.kind === "settled") {
-          return settledOutcome(final, "republished");
-        }
-        throw new NwcError(
-          "payment_unknown",
-          "The wallet never answered and could not confirm whether the payment went through."
-        );
-      });
-    }
-  );
-}
-async function getBalance(conn, opts = {}) {
-  return callerLoggers.lightning.span(
-    "lightning.get_balance",
-    { relays: conn.relays.join(","), wallet_pubkey: conn.walletPubkey },
-    async () => {
-      const result = await sendNwcRequest(conn, "get_balance", {}, opts);
-      const balance = result.balance ?? 0;
-      callerLoggers.lightning.info("lightning.get_balance.result", { balance_msats: balance });
-      return balance;
-    }
-  );
-}
-async function getInfo(conn, opts = {}) {
-  return callerLoggers.lightning.span(
-    "lightning.get_info",
-    { relays: conn.relays.join(","), wallet_pubkey: conn.walletPubkey },
-    async () => {
-      const result = await sendNwcRequest(conn, "get_info", {}, opts);
-      const info = { alias: result.alias, methods: result.methods ?? [] };
-      const volunteered = extractWalletReportedBudget(result);
-      if (volunteered) info.walletReportedBudget = volunteered;
-      callerLoggers.lightning.info("lightning.get_info.result", {
-        alias: info.alias,
-        methods: info.methods,
-        wallet_reported_budget: volunteered !== void 0
-      });
-      return info;
-    }
-  );
-}
-async function makeInvoice(conn, params, opts = {}) {
-  return callerLoggers.lightning.span(
-    "lightning.make_invoice",
-    {
-      relays: conn.relays.join(","),
-      wallet_pubkey: conn.walletPubkey,
-      amount_msats: params.amountMsats
-    },
-    async () => {
-      const body = { amount: params.amountMsats };
-      if (params.description !== void 0) body.description = params.description;
-      if (params.expirySeconds !== void 0) body.expiry = params.expirySeconds;
-      const result = await sendNwcRequest(conn, "make_invoice", body, opts);
-      const tx = toTransaction(result);
-      if (!tx.invoice) {
-        throw new NwcError("missing_invoice", "Wallet did not return a BOLT11 invoice");
-      }
-      if (!tx.paymentHash) {
-        throw new NwcError("missing_payment_hash", "Wallet did not return a payment hash");
-      }
-      callerLoggers.lightning.info("lightning.make_invoice.result", {
-        payment_hash_hash: sha256hex(tx.paymentHash).slice(0, 16)
-      });
-      return tx;
-    }
-  );
-}
-async function lookupInvoice(conn, params, opts = {}) {
-  return callerLoggers.lightning.span(
-    "lightning.lookup_invoice",
-    {
-      relays: conn.relays.join(","),
-      wallet_pubkey: conn.walletPubkey,
-      payment_hash_hash: params.paymentHash ? sha256hex(params.paymentHash).slice(0, 16) : void 0
-    },
-    async () => {
-      const body = {};
-      if (params.paymentHash) body.payment_hash = params.paymentHash;
-      if (params.invoice) body.invoice = params.invoice;
-      if (!body.payment_hash && !body.invoice) {
-        throw new NwcError("bad_request", "lookupInvoice requires payment_hash or invoice");
-      }
-      const result = await sendNwcRequest(conn, "lookup_invoice", body, opts);
-      return toTransaction(result);
-    }
-  );
-}
-async function listTransactions(conn, options, opts = {}) {
-  return callerLoggers.lightning.span(
-    "lightning.list_transactions",
-    {
-      relays: conn.relays.join(","),
-      wallet_pubkey: conn.walletPubkey,
-      from: options.from,
-      limit: options.limit
-    },
-    async () => {
-      const body = {};
-      if (options.from !== void 0) body.from = options.from;
-      if (options.limit !== void 0) body.limit = options.limit;
-      const result = await sendNwcRequest(conn, "list_transactions", body, opts);
-      if (!Array.isArray(result.transactions)) {
-        throw new NwcError("invalid_response", "Wallet did not return a transaction list.");
-      }
-      const transactions = result.transactions.map(toTransactionSnapshot);
-      callerLoggers.lightning.info("lightning.list_transactions.result", {
-        transaction_count: transactions.length
-      });
-      return transactions;
-    }
-  );
-}
-var VOLUNTEERED_BUDGET_KEYS = [
-  "budget",
-  "budget_renewal",
-  "budget_msats",
-  "budget_amount",
-  "max_amount",
-  "remaining_budget",
-  "budget_remaining",
-  "renews_at"
-];
-function extractWalletReportedBudget(result) {
-  const out = {};
-  for (const key of VOLUNTEERED_BUDGET_KEYS) {
-    const value = result[key];
-    if (value !== void 0 && value !== null) out[key] = value;
-  }
-  return Object.keys(out).length > 0 ? out : void 0;
-}
-async function attemptPayment(conn, method, event, pool, timeoutMs) {
-  let result;
-  try {
-    result = await publishAndAwait(conn, method, event, pool, timeoutMs);
-  } catch (err) {
-    if (err instanceof NwcError && err.code === "relay_unreachable") {
-      return { kind: "not_sent", error: err };
-    }
-    if (err instanceof NwcError && (err.code === "timeout" || err.code === "publish_rejected")) {
-      return { kind: "unknown" };
-    }
-    if (err instanceof NwcError && err.code === "invalid_response") return { kind: "unknown" };
-    if (err instanceof NwcError) return { kind: "rejected", error: err };
-    throw err;
-  }
-  if (!result.preimage) {
-    return {
-      kind: "rejected",
-      error: new NwcError("missing_preimage", "Wallet did not return a payment preimage.")
-    };
-  }
-  const feesPaidMsats = optionalFeeMsats(result.fees_paid);
-  return {
-    kind: "settled",
-    preimage: result.preimage,
-    ...feesPaidMsats !== void 0 ? { feesPaidMsats } : {}
-  };
-}
-async function reconcile(conn, bolt11, pool, timeoutMs) {
-  try {
-    const tx = await lookupInvoice(conn, { invoice: bolt11 }, { pool, timeoutMs });
-    if (tx.invoice !== bolt11) return { kind: "unknown" };
-    if (tx.settledAt != null && tx.preimage) {
-      return {
-        kind: "settled",
-        preimage: tx.preimage,
-        ...tx.feesPaidMsats !== void 0 ? { feesPaidMsats: tx.feesPaidMsats } : {}
-      };
-    }
-    if (tx.settledAt != null) {
-      return {
-        kind: "settled",
-        preimage: "",
-        ...tx.feesPaidMsats !== void 0 ? { feesPaidMsats: tx.feesPaidMsats } : {}
-      };
-    }
-    return { kind: "unpaid" };
-  } catch (err) {
-    if (err instanceof NwcError && err.code.toUpperCase() === "NOT_FOUND") {
-      return { kind: "unpaid" };
-    }
-    return { kind: "unknown" };
-  }
-}
-async function sendNwcRequest(conn, method, params, opts) {
-  return withPool(
-    opts.pool,
-    conn,
-    (pool) => publishAndAwait(conn, method, buildRequestEvent(conn, method, params), pool, opts.timeoutMs)
-  );
-}
-function buildRequestEvent(conn, method, params) {
-  const content = JSON.stringify({ method, params });
-  const encrypted = encrypt(conn.secret, conn.walletPubkey, content);
-  return finalizeEvent(
-    {
-      kind: 23194,
-      tags: [["p", conn.walletPubkey]],
-      content: encrypted,
-      created_at: Math.floor(Date.now() / 1e3)
-    },
-    conn.secret
-  );
-}
-async function publishAndAwait(conn, method, event, pool, timeoutMs) {
-  const relays = conn.relays;
-  const budgetMs = timeoutMs ?? nwcTimeoutMs();
-  const waiter = awaitResponse(pool, relays, conn.walletPubkey, event.id, budgetMs);
-  try {
-    await publishEvent(pool, relays, event);
-  } catch (err) {
-    waiter.cancel();
-    if (err instanceof NwcError) throw err;
-    throw new NwcError(
-      "publish_rejected",
-      `No relay accepted the request (${relays.join(", ")}): ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-  const response = await waiter.promise;
-  if (response === null) {
-    throw new NwcError("timeout", `Wallet did not respond within ${Math.round(budgetMs / 1e3)}s`);
-  }
-  let decrypted;
-  try {
-    decrypted = decrypt(conn.secret, conn.walletPubkey, response);
-  } catch {
-    throw new NwcError("invalid_response", "Wallet response could not be decrypted.");
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(decrypted);
-  } catch {
-    throw new NwcError("invalid_response", "Wallet returned a malformed response.");
-  }
-  if (parsed.error) {
-    throw new NwcError(
-      parsed.error.code ?? "wallet_error",
-      parsed.error.message ?? "Wallet error",
-      method
-    );
-  }
-  return parsed.result ?? {};
-}
-function awaitResponse(pool, relays, walletPubkey, eventId, timeoutMs) {
-  let settle;
-  const promise = new Promise((resolve) => {
-    const done = (value) => {
-      clearTimeout(timer);
-      sub.close();
-      resolve(value);
-    };
-    settle = done;
-    const timer = setTimeout(() => {
-      done(null);
-    }, timeoutMs);
-    const sub = pool.subscribeMany(
-      relays,
-      {
-        kinds: [23195],
-        authors: [walletPubkey],
-        "#e": [eventId]
-      },
-      {
-        onevent(ev) {
-          done(ev.content);
-        },
-        // required by nostr-tools
-        oneose() {
-        }
-        // eslint-disable-line @typescript-eslint/no-empty-function
-      }
-    );
-  });
-  return {
-    promise,
-    cancel: () => {
-      settle?.(null);
-    }
-  };
-}
-async function withPool(external, conn, fn) {
-  if (external) return fn(external);
-  const pool = new SimplePool();
-  try {
-    return await fn(pool);
-  } finally {
-    pool.close(conn.relays);
-  }
-}
-function toTransaction(raw) {
-  const feesPaidMsats = optionalFeeMsats(raw.fees_paid);
-  return {
-    type: raw.type ?? "incoming",
-    invoice: raw.invoice,
-    description: raw.description,
-    paymentHash: raw.payment_hash ?? "",
-    preimage: raw.preimage,
-    amountMsats: raw.amount ?? 0,
-    ...feesPaidMsats !== void 0 ? { feesPaidMsats } : {},
-    createdAt: raw.created_at ?? Math.floor(Date.now() / 1e3),
-    expiresAt: raw.expires_at,
-    settledAt: raw.settled_at ?? void 0
-  };
-}
-function toTransactionSnapshot(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new NwcError("invalid_response", "Wallet returned a malformed transaction.");
-  }
-  const raw = value;
-  if (raw.type !== "incoming" && raw.type !== "outgoing") {
-    throw new NwcError("invalid_response", "Wallet returned an invalid transaction type.");
-  }
-  const amountMsats = requiredNonNegativeInteger(raw.amount, "amount");
-  const createdAt = requiredNonNegativeInteger(raw.created_at, "creation time");
-  const feesPaidMsats = optionalFeeMsats(raw.fees_paid);
-  if (raw.fees_paid != null && feesPaidMsats === void 0) {
-    throw new NwcError("invalid_response", "Wallet returned an invalid transaction fee.");
-  }
-  const settledAt = optionalNonNegativeInteger(raw.settled_at);
-  if (raw.settled_at != null && settledAt === void 0) {
-    throw new NwcError("invalid_response", "Wallet returned an invalid settlement time.");
-  }
-  const invoice = optionalPrivateString(raw.invoice, "invoice");
-  const paymentHash = optionalPrivateString(raw.payment_hash, "payment hash");
-  const reducedIdentity = {
-    type: raw.type,
-    invoice: invoice ?? null,
-    paymentHash: paymentHash ?? null,
-    amountMsats,
-    feesPaidMsats: feesPaidMsats ?? null,
-    createdAt,
-    settledAt: settledAt ?? null
-  };
-  return {
-    fingerprint: sha256hex(JSON.stringify(reducedIdentity)),
-    ...invoice ? { invoiceHash: sha256hex(invoice) } : {},
-    type: raw.type,
-    amountMsats,
-    ...feesPaidMsats !== void 0 ? { feesPaidMsats } : {},
-    createdAt,
-    ...settledAt !== void 0 ? { settledAt } : {}
-  };
-}
-function settledOutcome(payment, outcome) {
-  return {
-    preimage: payment.preimage,
-    outcome,
-    ...payment.feesPaidMsats !== void 0 ? { feesPaidMsats: payment.feesPaidMsats } : {}
-  };
-}
-function optionalFeeMsats(value) {
-  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : void 0;
-}
-function optionalNonNegativeInteger(value) {
-  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : void 0;
-}
-function requiredNonNegativeInteger(value, field) {
-  const parsed = optionalNonNegativeInteger(value);
-  if (parsed === void 0) {
-    throw new NwcError("invalid_response", `Wallet returned an invalid transaction ${field}.`);
-  }
-  return parsed;
-}
-function optionalPrivateString(value, field) {
-  if (value === void 0 || value === null) return void 0;
-  if (typeof value !== "string" || value.length === 0) {
-    throw new NwcError("invalid_response", `Wallet returned an invalid transaction ${field}.`);
-  }
-  return value;
-}
-async function publishEvent(pool, relays, event) {
-  const connections = await Promise.allSettled(relays.map((url) => pool.ensureRelay(url)));
-  const live = connections.flatMap((c) => c.status === "fulfilled" ? [c.value] : []);
-  if (live.length === 0) {
-    throw new NwcError(
-      "relay_unreachable",
-      `Could not connect to any of the wallet's relays (${relays.join(", ")}): ${describeRejections(
-        connections
-      )}`
-    );
-  }
-  try {
-    await Promise.any(live.map((relay) => relay.publish(event)));
-  } catch (err) {
-    throw new NwcError(
-      "publish_rejected",
-      `No relay accepted the request (${relays.join(", ")}): ${describeAggregate(err)}`
-    );
-  }
-}
-function describeRejections(results) {
-  const reasons = results.flatMap((r) => r.status === "rejected" ? [errorText(r.reason)] : []);
-  return reasons.length > 0 ? reasons.join("; ") : "no relays configured";
-}
-function describeAggregate(err) {
-  if (err instanceof AggregateError) {
-    return err.errors.map((e) => errorText(e)).join("; ");
-  }
-  return errorText(err);
-}
-function errorText(err) {
-  return err instanceof Error ? err.message : String(err);
-}
-function positiveSecondsEnv(name, fallbackSec) {
-  const raw = process.env[name];
-  if (!raw) return fallbackSec * 1e3;
-  const n = Number(raw);
-  if (!Number.isFinite(n) || n <= 0) return fallbackSec * 1e3;
-  return Math.floor(n) * 1e3;
-}
-function hexToBytes6(hex) {
-  const bytes = new Uint8Array(hex.length / 2);
-  for (let i = 0; i < bytes.length; i++) {
-    bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
-  }
-  return bytes;
-}
-
-// src/lib/nwc-backend.ts
-var NwcBackend = class {
-  constructor(conn, opts = {}) {
-    this.conn = conn;
-    this.opts = opts;
-  }
-  conn;
-  opts;
-  async payInvoice(bolt11, _amountMsats) {
-    return payInvoiceReconciling(this.conn, bolt11, this.opts);
-  }
-  async getBalance() {
-    return getBalance(this.conn, this.opts);
-  }
-  async getInfo() {
-    return getInfo(this.conn, this.opts);
-  }
-  async createInvoice(params) {
-    const tx = await makeInvoice(this.conn, params, this.opts);
-    const expiresAtMs = tx.expiresAt ? tx.expiresAt * 1e3 : Date.now() + (params.expirySeconds ?? 3600) * 1e3;
-    return {
-      bolt11: tx.invoice ?? "",
-      paymentHash: tx.paymentHash,
-      amountMsats: tx.amountMsats || params.amountMsats,
-      expiresAt: expiresAtMs
-    };
-  }
-  async lookupInvoice(paymentHash) {
-    const tx = await lookupInvoice(this.conn, { paymentHash }, this.opts);
-    return {
-      settled: tx.settledAt != null,
-      preimage: tx.preimage,
-      settledAt: tx.settledAt != null ? tx.settledAt * 1e3 : void 0,
-      expiresAt: tx.expiresAt != null ? tx.expiresAt * 1e3 : void 0
-    };
-  }
-  async listTransactions(options) {
-    return listTransactions(this.conn, options, this.opts);
-  }
-};
-
 // src/sdk/server/tempo-observer-health.ts
 var TEMPO_OBSERVER_HEALTH_REFRESH_TTL_MS = 60 * 1e3;
 var TEMPO_OBSERVER_HEALTH_MAX_CURSOR_AGE_MS = 2 * 60 * 1e3;
@@ -21820,7 +19538,6 @@ function createPlatformTempoObserverHealth(env) {
 }
 
 export {
-  toLockPubkey,
   initLockPubkeyTable,
   seedLockPubkeyState,
   loadLockPubkeyState,
@@ -21853,7 +19570,6 @@ export {
   toCreditView,
   attachCreditMenu,
   toCreditTerms,
-  isX402SettlementReconciliationReason,
   resolvePriceFiat,
   priceFiatMicro,
   resolveFxSnapshot,
@@ -21867,35 +19583,7 @@ export {
   isDerivedCreditId,
   derivedFundCreditId,
   drawSettlementRef,
-  TEMPO_SESSION_UPDATED_REASON,
   rateUnavailablePaymentError,
-  backupSecretFile,
-  readAgentMnemonic,
-  assertAgentMnemonicReplaceable,
-  writeAgentMnemonic,
-  deleteAgentMnemonic,
-  generateAgentMnemonic,
-  deriveAgentMasterKeypair,
-  validateAgentMnemonic,
-  looksLikeMnemonic,
-  mnemonicFingerprint,
-  WALLET_VERSION,
-  RECENT_SPENDS_CAP,
-  DEFAULT_AGENT_MINT_URL,
-  loadAgentWallet,
-  saveAgentWallet,
-  walletExists,
-  withWalletLock,
-  effectiveMints,
-  effectiveFundingMint,
-  PersistentCounterSource,
-  checkMintHealth,
-  canSwap,
-  meltAmountBounds,
-  amountBoundsVerdict,
-  assertNutSupport,
-  getWallet,
-  X402_BATCH_CHANNEL_ABI,
   X402_BATCH_SETTLEMENT_NETWORK,
   X402_BATCH_SETTLEMENT_MAINNET_NETWORK,
   X402_BATCH_MIN_WITHDRAW_DELAY_SECONDS,
@@ -21918,68 +19606,11 @@ export {
   repairX402ExactSettlementEffect,
   CREDIT_REQUEST_SCHEMA,
   handleCreditRequest,
-  RECOMMENDED_MINTS,
-  isTestMintUrl,
-  deriveReceiptSecret,
-  receiptPubkeyFromSecret,
-  deriveReceiptKeypair,
-  generateEphemeralReceiptKey,
-  X402_SELF_RELAY_KEY,
-  X402_RECEIVER_AUTHORIZER_KEY,
-  X402_BATCH_SETTLEMENT_KEY,
-  X402_RPC_URL_KEY,
-  X402EnvValidationError,
-  validateX402Env,
-  SPANS_INSERTED_CHANNEL,
-  SpanWriter,
-  insertSpanBatch,
-  DbTransport,
-  HttpTransport,
-  generateIdentity,
-  loadIdentitySecret,
-  writeIdentity,
-  hashCapabilities,
-  buildAttestation,
-  signAttestation,
-  verifyAttestation,
-  computeResultHash,
-  signReceipt,
-  verifyReceipt,
-  isSignedJobReceipt,
-  signDrainReceipt,
-  signFundingReceipt,
-  isFundingReceipt,
-  verifyFundingReceipt,
-  isDrainReceipt,
-  verifyDrainReceipt,
-  attestedDvmIdentity,
-  authenticatedBuilderPubkey,
-  verifyJobReceipt,
-  checkReceiptAttestation,
-  verifyDrainReceiptChain,
-  verifyFundingReceiptChain,
-  weakestReceiptVerdict,
-  drainReceiptsDisplay,
-  drainReceiptsHint,
-  receiptDisplay,
-  receiptIssuedAtIso,
-  epochMsToIso,
-  receiptHint,
-  receiptFailureDetail,
-  isPublicRequestId,
-  parseTraceparent,
-  PRIVKEY_HEX_RE,
-  derivePubkeyFromPrivkey,
-  verifyChallenge,
-  ADMIN_STATE_UNAVAILABLE,
-  buildAdminChallenge,
-  buildAdminAuthHeader,
   installAdminCashuRoutes,
   createAdminCashuNonceStore,
   X402ExactSettlementServer,
   X402ExactSettlementEvidenceMissingError,
   jobCredentialGate,
-  createMonotonicClock,
   REQUEST_ID_FIELD,
   protocolEnvelopeIgnoreFields,
   stripProtocolEnvelope,
@@ -21998,18 +19629,5 @@ export {
   revenueReporterBannerState,
   createDVMServer,
   unknownRouteNotFound,
-  sha256hex,
-  NwcError,
-  nwcTimeoutMs,
-  nwcDedupWindowMs,
-  withNwcPool,
-  parseNwcUri,
-  payInvoiceReconciling,
-  getBalance,
-  getInfo,
-  makeInvoice,
-  lookupInvoice,
-  listTransactions,
-  NwcBackend,
   createPlatformTempoObserverHealth
 };