@dvmkit/sdk 0.2.0-rc.9 → 0.3.0-rc.10

package/dist/{credit-menu-D4Gcdgc4.d.ts → credit-menu-0-UtJ3hh.d.ts}

@@ -1,16 +1,15 @@
-import { ah as FundingMethod, o as PaymentMethod, bM as CreditLedgerLike, a1 as Message, X as FundingReceipt, bO as CreditSnapshot, Y as JobReceipt, S as SDKJobContext, aw as StepCache, u as ResponseContent, P as PaymentContent, a2 as MessageType, bj as X402Receipt, aE as X402Config, bi as X402ExactVersionSupport, cT as X402SettlementIntent, aq as PaymentRequirementsV2, c1 as CreditLedgerQuerier, cU as X402SettlementCursor, bQ as X402SettlementStatus, cV as X402SettlementWriteOff, bN as X402RefundSettlementGate, cW as X402FacilitatorAuth, cX as X402BatchSettlementConfig, cz as PostgresX402ChannelStorage, cY as X402PayoutObserver, br as MppxServer, ab as CashuMode, cZ as CreditDepositEnqueue, c_ as X402SettlementReconciliationReason, ao as PaymentRequirements, a0 as MppxCredential, bm as CreditDepositPayload, bP as DrawResult, cn as CreditLedgerError, a6 as ReceiptCredit, ae as DrainReceiptEvent, ad as DrainReceipt, K as KVStore, y as SignedRequestAudience, c$ as CreditDrawReleaseEnqueue, cx as JobCostReportPayload, cy as JobTerminalReportPayload, cB as RevenueSkippedNoRailPayload, Z as ZodLike, a as DVMDescriptor, bV as CreditInvoiceRecord, bW as InvoiceSettlement, ch as ClientCompatibilityGate, cf as ClientCompatibility, bu as PayoutReporter, R as ResolvedCreditConfig, g as CreditView } from './step-cache-CXg7ziML.js';
+import { ah as FundingMethod, o as PaymentMethod, bM as CreditLedgerLike, a1 as Message, X as FundingReceipt, bO as CreditSnapshot, Y as JobReceipt, S as SDKJobContext, aw as StepCache, u as ResponseContent, P as PaymentContent, a2 as MessageType, bj as X402Receipt, aE as X402Config, bi as X402ExactVersionSupport, cT as X402SettlementIntent, aq as PaymentRequirementsV2, c1 as CreditLedgerQuerier, cU as X402SettlementCursor, bQ as X402SettlementStatus, cV as X402SettlementWriteOff, bN as X402RefundSettlementGate, cW as X402FacilitatorAuth, cX as X402BatchSettlementConfig, cz as PostgresX402ChannelStorage, cY as X402PayoutObserver, br as MppxServer, ab as CashuMode, cZ as CreditDepositEnqueue, c_ as X402SettlementReconciliationReason, ao as PaymentRequirements, a0 as MppxCredential, bm as CreditDepositPayload, bP as DrawResult, cn as CreditLedgerError, a6 as ReceiptCredit, ae as DrainReceiptEvent, ad as DrainReceipt, K as KVStore, y as SignedRequestAudience, c$ as CreditDrawReleaseEnqueue, cx as JobCostReportPayload, cy as JobTerminalReportPayload, cB as RevenueSkippedNoRailPayload, Z as ZodLike, a as DVMDescriptor, bV as CreditInvoiceRecord, bW as InvoiceSettlement, ch as ClientCompatibilityGate, cf as ClientCompatibility, bu as PayoutReporter, R as ResolvedCreditConfig, g as CreditView } from './step-cache-v2yhyhSZ.js';
 import { ProofLike, SerializedDLEQ, Proof } from '@cashu/cashu-ts';
 import { Hono, Context } from 'hono';
 import { Pool } from 'pg';
-import { b as FxRateSnapshot, F as FxFetcher } from './fx-B0SLBe5x.js';
-import { g as LockPubkey, f as CheckMintHealthOptions, b as LightningBackend, A as AttestationPayload } from './lightning-backend-CQBnQgsT.js';
-import { T as TopUpCapUnenforcedReason, A as AppendOutgoingOptions, J as JobRecord, b as JobStore } from './job-store-B2uZvga4.js';
+import { b as FxRateSnapshot, F as FxFetcher } from './fx-DhyT1Cjh.js';
+import { g as LockPubkey, f as CheckMintHealthOptions, b as LightningBackend, A as AttestationPayload } from './lightning-backend-BhsyrBLa.js';
+import { T as TopUpCapUnenforcedReason, A as AppendOutgoingOptions, J as JobRecord, b as JobStore } from './job-store-D3CcZp_g.js';
 import { Challenge } from 'mppx';
 import { SettleResponse, SupportedResponse } from '@x402/core/types';
 import { Channel, AutoSettlementConfig } from '@x402/evm/batch-settlement/server';
 import { FacilitatorClient } from '@x402/core/server';
 
-/** A row in the per-DVM `wallet_accumulator` table. */
 interface WalletAccumulatorRow {
     id: string;
     dvmId: string;
@@ -36,11 +35,8 @@ interface WalletAccumulatorRow {
      * rows created before the column existed.
      */
     meltQuoteId: string | null;
-    /**
-     * NUT-11 locktime captured at accept time (ms since epoch). Null when the
-     * accepted proof has no `locktime` tag. Drives oldest-first
-     * ordering and the future `wallet_accumulator_batch_expiring_soon` monitor.
-     */
+    /** NUT-11 locktime at acceptance, in epoch ms; null without a tag.
+     * Drives oldest-first ordering and expiring-soon monitoring. */
     tExpire: number | null;
 }
 /**
@@ -174,7 +170,6 @@ interface DisposableCashuCommit {
     commit(requestId: string, proofs: Proof[], account: (ledger: CreditLedgerLike) => Promise<void>): Promise<void>;
 }
 
-/** How often the sweep runs, and how long after boot its first pass fires. */
 interface CreditExpirySweepOpts {
     /** Sweep period. Defaults to {@link DEFAULT_SWEEP_INTERVAL_MS}; `0` disables the timer. */
     intervalMs?: number;
@@ -183,21 +178,56 @@ interface CreditExpirySweepOpts {
      * disables the boot pass, leaving only the interval.
      */
     bootDelayMs?: number;
-    /** Credits released per pass. Passed straight to the ledger. */
     limit?: number;
 }
 
-/** Promise resolver for a pending client prompt response. */
+interface HostingControlConfig {
+    /** Dedicated management key. Use at least 32 random bytes; never reuse a caller or builder key. */
+    secret: string;
+    /** Deployment scope shared by the platform and this DVM, independent of its caller origin. */
+    scope: string;
+}
+interface HostingControlCommand {
+    /** Version two is required for resume; version one remains valid for drain and status. */
+    version?: 2;
+    action: "drain" | "resume" | "status";
+    scope: string;
+    dvmId: string;
+    timestampMs: number;
+    nonce: string;
+    generation?: number;
+    deadlineMs?: number;
+    leaseExpiresAtMs?: number;
+}
+/** Ordered JSON arrays are the versioned wire signing contract. */
+declare function signHostingControl(secret: string, command: HostingControlCommand): string;
+interface HostingControlStatus {
+    state: "accepting" | "draining";
+    generation: number;
+    deadlineMs: number | null;
+    leaseExpiresAtMs: number | null;
+    activeJobIds: string[];
+    unownedActiveJobIds: string[];
+    pendingAdmissionCount: number;
+    pendingAdmissions: {
+        admissionId: string;
+        workId: string;
+    }[];
+    unresolvedAdmissionCount: number;
+    unresolvedAdmissions: {
+        admissionId: string;
+        jobId: string;
+    }[];
+}
+
 interface PromptResolver {
     resolve: (value: ResponseContent) => void;
     reject: (reason: Error) => void;
 }
-/** Promise resolver for a pending client payment. */
 interface PaymentResolver {
     resolve: (value: PaymentContent) => void;
     reject: (reason: Error) => void;
 }
-/** In-memory representation of a running job. */
 interface ServerJob {
     id: string;
     tags: string[];
@@ -262,17 +292,13 @@ interface ServerJob {
     /** Chain transaction returned to callers recovering x402 or Tempo acceptance. */
     paymentTransactionHash?: string;
     /**
-     * Rail-native amount accumulated across all successful credits on this
-     * job (sats for mpp, USDC microunits for x402). The single
-     * `revenue_events` row written at completion uses this as `gross_native`,
-     * so multi-credit jobs sum the per-credit native amounts.
-     * The upfront credit initializes this value; mid-job credits accumulate same-rail
-     * and reset on a cross-rail switch (see `processIncomingPayment`).
+     * Rail-native atomic units accumulated across same-rail credits: Tempo and
+     * x402 use stablecoin micro-units. A rail switch resets this amount; Cashu
+     * revenue is derived from paidMsats instead.
      */
     nativeAmount?: number;
     /** Native asset tag paired with `nativeAmount`. */
     nativeAsset?: "sats" | "usdc" | "usdc.e" | "usd-cents";
-    /** Cashu flow discriminator written into `revenue_events.metadata.cashu_flow`. */
     cashuFlow?: "p2pk_accumulator";
     /**
      * What this job cost the **builder** to serve, in 1e-6 of
@@ -316,8 +342,8 @@ interface ServerJob {
      * nonce issued by `requestPayment` and stamped onto the outbound x402
      * envelope; the caller signs `TransferWithAuthorization` against this exact
      * `bytes32`. Verification rejects an incoming `x402_payment` whose decoded
-     * authorization nonce differs, blocking a cross-job replay before the
-     * facilitator settles. Cleared on successful credit.
+     * authorization nonce differs before crediting the job. Cleared on
+     * successful credit.
      */
     pendingX402Nonce?: string;
     /**
@@ -415,9 +441,8 @@ interface ServerJob {
     /** Unix ms timestamp of last activity (message, yield, terminal). */
     lastActivityAt: number;
 }
-/** Extract the persistent fields from a ServerJob into a JobRecord. */
 declare function toJobRecord(job: ServerJob): JobRecord;
-/** Reconstitute a ServerJob from a persisted JobRecord with fresh runtime fields. */
+/** Restored snapshots receive fresh process-local listeners, cancellation and prompt state. */
 declare function fromJobRecord(record: JobRecord): ServerJob;
 /**
  * Signal cancellation to a running handler. Idempotent — aborting an
@@ -433,40 +458,14 @@ declare function abortJob(job: ServerJob, reason: string): void;
 declare class JobCancelledError extends Error {
     constructor(message?: string);
 }
-/** Append a provider-sent message to the job and notify SSE listeners. */
 declare function providerMessage(job: ServerJob, type: MessageType, content: Record<string, unknown> | object): void;
 declare function isTerminal(status: ServerJob["status"]): boolean;
-/** Check if a message is a yield point (ends the provider's turn). */
 declare function isYieldMessage(msg: Message): boolean;
 
-/**
- * Per-DVM runtime mint-health tracker. Alongside the platform's
- * durable mint-health cron, probes every configured
- * mint on a timer, tracks consecutive failures, and flips a mint to `sick`
- * once the threshold is crossed. The SDK uses the resulting view to:
- *
- * 1. Filter `/v1/info`'s advertised `mints` to currently-healthy ones.
- * 2. Reject new accumulator receives at sick mints before they touch the
- * DB (`cashu_mint_sick` 503 from `verifyAccumulatorReceipt`).
- *
- * Since this tracker is the sole owner of mint health: boot no longer
- * runs a fail-fast check before binding the port. To preserve what boot used
- * to guarantee it (a) treats a mint as healthy only when it's reachable AND
- * NUT-compliant (reproducing `assertNutSupport` via `nutCompliant`), and (b)
- * exposes `initialProbeComplete()` so the paid path holds calls at
- * `mint_health_pending` until the first probe validates ≥1 mint.
- *
- * Existing accumulator entries are not touched — they're P2PK-locked to the
- * original mint and stay put until `dvmctl melt-pending` drains them. The
- * accumulator monitor's `wallet_accumulator_batch_expiring_soon` already
- * pages the builder when a stuck batch nears `t_expire`.
- *
- * In-memory only — no DB persistence. The platform cron keeps the durable
- * record + email path; the SDK only needs fresh in-process state
- * to make routing decisions.
- */
+/** In-process mint health gates advertising and new receives. Paid calls wait for
+ * the first probe; NUT incompatibility fails immediately, transient failures
+ * use a consecutive threshold. Existing accumulator proofs remain at their mint. */
 
-/** Per-mint runtime view exposed by `snapshot()`. */
 interface MintHealthSnapshot {
     /** Last-observed wall-clock latency of the probe in ms. */
     latencyMs?: number;
@@ -486,9 +485,7 @@ interface MintHealthSnapshot {
      * never resolves without a config/mint change.
      */
     nutIncompatible?: boolean;
-    /** Mint version reported by the last successful probe. */
     version?: string;
-    /** Error category from the most recent failed probe. */
     errorCode?: string;
 }
 interface MintHealthTrackerOptions {
@@ -508,22 +505,9 @@ interface MintHealthTrackerOptions {
     consecutiveFailuresToSick?: number;
     fetchImpl?: typeof fetch;
     now?: () => number;
-    /**
-     * Per-probe timeout / retry / backoff, forwarded to {@link checkMintHealth}.
-     * Defaults to that function's own defaults — 3 attempts with `[200, 500]`
-     * backoff, which is what a real tick should do.
-     *
-     * Tests that drive several failing ticks set `backoffMs: [0]`: a failing
-     * probe otherwise costs 700ms of real `setTimeout`, and four of them put a
-     * unit test within a loaded CI runner's reach of the 5s default timeout.
-     * `fetchImpl` is set on the tracker, not here.
-     */
+    /** Forwarded to checkMintHealth; fetchImpl is supplied on the tracker. */
     probe?: Omit<CheckMintHealthOptions, "fetchImpl">;
 }
-/**
- * Runtime mint-health tracker. Owns its own timer; `start()` runs an initial
- * probe immediately so the first received call doesn't see a stale snapshot.
- */
 declare class MintHealthTracker {
     private readonly mints;
     private readonly tickIntervalMs;
@@ -569,60 +553,31 @@ declare class MintHealthTracker {
      * where a merely-flapping mint is still published.
      */
     isNutIncompatible(mintUrl: string): boolean;
-    /** Plain-object snapshot keyed by mint URL — for tests + observability. */
     snapshot(): Record<string, MintHealthSnapshot>;
     private applyResult;
-    /**
-     * One-shot structured summary emitted after the first probe tick. Replaces
-     * the boot check's per-mint `cashu_mint_startup_health` lines and surfaces an
-     * all-mints-unhealthy warning — the operator alert that the Fly restart-loop
-     * used to be before boot stopped refusing to start.
-     */
+    /** One boot summary, including an all-unhealthy warning. */
     private logBootHealth;
 }
 
 /**
- * Credit fields carried inside the signed request body.
- *
- * An explicit draw references the credit INSIDE the secp256k1/Schnorr-signed
- * `body.data` — no new caller crypto. Wire field names (snake_case, matching
- * the rest of the wire surface):
- *
- * - `credit_id` — the credit to draw against.
- * - `draw_id` — client-generated draw id; the ledger's idempotency key.
- * - `fund` — optional `{ amount_micro, commitment }` funding commitment:
- * present iff a funding artifact (X-Cashu / X-PAYMENT / mpp credential)
- * rides the same request. `commitment` is the SHA-256 hex over the raw
- * artifact bytes, binding the header-borne proof — which sits OUTSIDE the
- * signed body — to the credit its sender intended (the funding-commitment rule).
+ * Credit fields belong to the raw signed body. The funding commitment hashes the header
+ * artifact, binding money outside that body to its intended credit.
  *
- * These are envelope-level fields, not capability input: **the SDK** removes
- * them before any builder-owned schema parses ({@link stripCreditEnvelope} in
- * `JobManager.parseInput` and on the quote path; {@link
- * creditEnvelopeIgnoreFields} feeding the auth verifier's own schema check), so
- * handlers never see them and a top-level `.strict()` capability schema is
- * fine. Relying on Zod's default strip mode instead was the trap:
- * `.strict()` rejects unknown keys, so an explicit draw 400'd at parse before
- * the envelope was ever extracted.
- *
- * The strip never touches the canonical signing bytes. Every auth call site
- * verifies the raw wire body (`signedRequestInput`), so the credit
- * fields are in the verified bytes because they were never taken out of them —
- * the strip is only ever applied to what a schema is about to parse.
+ * Schema projection strips undeclared protocol keys before builder input parsing, without
+ * changing canonical signing bytes. Signature verification must use the original wire body; a
+ * parsed projection may omit credit fields.
  */
 interface CreditEnvelope {
     creditId: string;
     drawId: string;
     fund?: CreditFundCommitment;
 }
-/** The signed funding commitment for a fund-and-draw request. */
 interface CreditFundCommitment {
     /** Funding amount in 1e-6 units of the credit's currency. */
     amountMicro: number;
     /** SHA-256 hex over the raw funding artifact bytes. */
     commitment: string;
 }
-/** Wire keys reserved for the credit envelope inside `body.data`. */
 declare const CREDIT_ENVELOPE_KEYS: readonly ["credit_id", "draw_id", "fund"];
 /**
  * Thrown by {@link extractCreditEnvelope} on a structurally invalid credit
@@ -640,28 +595,16 @@ declare class CreditEnvelopeError extends Error {
  */
 declare function extractCreditEnvelope(data: unknown): CreditEnvelope | undefined;
 /**
- * The reserved keys `schema` does not itself declare — the ones the SDK is
- * free to remove before handing it an input.
- *
- * A capability schema declares none of them, so all three are removable. The
- * one exception this exists for is `/v1/credit`'s own `CREDIT_REQUEST_SCHEMA`,
- * where `credit_id` and `fund` are real fields on a different wire shape and
- * removing them would empty the request. It is not an escape hatch for a
- * capability: the three names stay reserved on `body.data`, and declaring one
- * doesn't win a builder their own value — `app.ts` runs
- * {@link extractCreditEnvelope} over the raw body on every submit, so a
- * capability that declares `fund` answers `invalid_credit_fields` instead.
+ * Return protocol keys not declared by the schema. Schema-declared keys remain available,
+ * including /v1/credit’s differently shaped credit_id and fund fields. Submit separately
+ * extracts and validates the credit envelope from raw body.data; declaring a key does not
+ * bypass that validation.
  */
 declare function creditEnvelopeIgnoreFields(schema: unknown): readonly string[];
 /**
- * Remove the reserved credit keys from `data` before `schema` parses it, so a
- * strict schema doesn't reject the protocol's own envelope. Keys
- * `schema` declares are left alone — see {@link creditEnvelopeIgnoreFields}.
- *
- * Returns `data` unchanged when it isn't a plain object or carries none of the
- * removable keys, so the ordinary no-credit request allocates nothing. Never
- * use the result to derive canonical signing bytes: those cover the wire form,
- * credit fields included (`signedRequestInput`).
+ * Remove undeclared credit keys before schema parsing. Preserve nonobject/array inputs and
+ * objects with no removable keys. Never derive signing bytes from this projection; signatures
+ * cover the raw wire body.
  */
 declare function stripCreditEnvelope(schema: unknown, data: unknown): unknown;
 
@@ -904,18 +847,8 @@ declare function derivedFundCreditId(callerPubkey: string, fundId: string): stri
 declare function drawSettlementRef(dvmId: string, creditId: string, drawId: string): string;
 
 /**
- * Durable marker for a rail payment that already funded the credit ledger
- * (the funding-commitment rule). The x402 and mpp rails have no dvmkit-side
- * commit point of their own — the money moves at the facilitator / the payer's
- * mpp server — so the marker row, inserted in the SAME transaction as
- * `CreditLedger.fund` + `draw`, is what makes a crash-replayed credential
- * unable to fund twice: the second attempt collides on the primary key and
- * surfaces as {@link ProcessedPaymentReplayError}, which the verifier routes
- * into the recovery gates instead of a second fund.
- *
- * The Cashu rail does not use this store — its accumulator insert is already
- * the durable commit point, and its replay key (the `X-Cashu-Request-Id`
- * regime) must stay exactly as-is (dual-idempotency rule, the signed credit contract).
+ * x402/Tempo marker, funding and draw commit in one transaction so a retry
+ * cannot fund twice. Cashu retains its separate accumulator replay regime.
  */
 interface ProcessedPaymentStore {
     /**
@@ -941,11 +874,8 @@ interface ProcessedPaymentStore {
         paymentId: string;
     }): Promise<ProcessedPaymentRecord | undefined>;
     /**
-     * Run `fn` inside one transaction (Postgres: BEGIN → fn → COMMIT, rollback
-     * on throw). The verifier funds and draws the ledger inside `fn`, passing
-     * the handle through to `record` / `CreditLedger.fund` / `draw` so all
-     * three commit atomically. The memory implementation invokes `fn` with no
-     * handle — its operations are synchronous-atomic in-process.
+     * Postgres supplies a transaction for marker, fund and draw; failure rolls it
+     * back. Memory invokes fn without a transactional handle or rollback.
      */
     withTx<T>(fn: (tx?: ProcessedPaymentQuerier) => Promise<T>): Promise<T>;
 }
@@ -1024,7 +954,6 @@ declare class MemoryProcessedPaymentStore implements ProcessedPaymentStore {
  */
 type AccumulatorRejectionCode = "missing_request_id" | "missing_lock_pubkey" | "not_p2pk_locked" | "wrong_lock_pubkey" | "proof_not_unspent" | "proof_pending" | "replay_rejected" | "mint_unreachable" | "invalid_token";
 
-/** Durable state of one exact x402 authorization. */
 type X402ExactSettlementStatus = "prepared" | "submitting" | "settled" | "local_committed" | "ambiguous" | "rejected" | "complete";
 /** Serializable local economic effect that follows an exact settlement. */
 interface X402ExactSettlementEffect {
@@ -1073,7 +1002,6 @@ interface X402ExactAuthorizationFacts {
     nonce: string;
     fingerprint: string;
 }
-/** One durable exact-x402 settlement intent. */
 interface X402ExactSettlementIntent extends X402ExactAuthorizationFacts {
     id: string;
     dvmId: string;
@@ -1128,11 +1056,9 @@ interface X402ExactSettlementStore {
     }): Promise<X402ExactSettlementIntent[]>;
     attempts(dvmId: string, intentId: string): Promise<X402ExactSettlementAttempt[]>;
 }
-/** Postgres-backed exact settlement intent store. */
 declare class PostgresX402ExactSettlementStore implements X402ExactSettlementStore {
     private readonly pool;
     constructor(pool: Pick<Pool, "query" | "connect">);
-    /** Create the exact settlement tables. */
     init(): Promise<void>;
     prepare(intent: Omit<X402ExactSettlementIntent, "status" | "createdAt" | "updatedAt" | "resolvedAt">): Promise<X402ExactSettlementIntent>;
     get(dvmId: string, intentId: string): Promise<X402ExactSettlementIntent | undefined>;
@@ -1241,7 +1167,6 @@ type X402ExactAcceptance<T> = {
     intentId: string;
     reason: string;
 };
-/** Dependencies for the durable exact x402 settlement coordinator. */
 interface X402ExactSettlementServerOpts {
     store: X402ExactSettlementStore;
     evidence?: X402ExactSettlementEvidenceReader;
@@ -1264,13 +1189,11 @@ declare class X402ExactSettlementServer {
         effect?: X402ExactSettlementEffect;
         commit: (receipt: X402Receipt, tx?: ProcessedPaymentQuerier, effect?: X402ExactSettlementEffect) => Promise<T>;
     }): Promise<X402ExactAcceptance<T>>;
-    /** Read the operator queue. */
     list(args: {
         dvmId: string;
         limit: number;
         includeResolved?: boolean;
     }): Promise<X402ExactSettlementIntent[]>;
-    /** Read durable attempt evidence for one intent. */
     attempts(dvmId: string, intentId: string): Promise<X402ExactSettlementAttempt[]>;
     /** Reconcile and finish one intent from chain evidence. */
     reconcile(dvmId: string, intentId: string): Promise<{
@@ -1614,7 +1537,6 @@ interface CreateX402BatchSettlementServerOpts {
  */
 declare function createX402BatchSettlementServer(opts: CreateX402BatchSettlementServerOpts): Promise<X402BatchSettlementServer>;
 
-/** Payment state from upfront token verification. */
 interface PaymentInfo {
     /**
      * Rail value this payment contributes to the job, in millisatoshis.
@@ -1647,12 +1569,10 @@ interface PaymentInfo {
     /** Chain transaction returned to a caller recovering this accepted request. */
     paymentTransactionHash?: string;
     /**
-     * Rail-native payment amount in atomic units. Sats for mpp,
-     * USDC microunits for x402. Cashu leaves it unset — the existing
-     * `paidMsats / 1000` derivation in the platform callback covers it.
+     * Stablecoin micro-units for Tempo and x402. Cashu leaves this unset; its revenue is derived
+     * from paidMsats.
      */
     nativeAmount?: number;
-    /** Native asset tag matching `revenue_events.native_asset`. */
     nativeAsset?: "sats" | "usdc" | "usdc.e" | "usd-cents";
     /**
      * Discriminator written into `revenue_events.metadata.cashu_flow` so ops
@@ -1801,7 +1721,6 @@ interface UpfrontPaymentOpts {
      * no per-process replay protection beyond mppx's own expiry check.
      */
     consumedCredentialStore?: ConsumedCredentialStore;
-    /** Cashu receive mode. Routes the receive path. */
     cashuMode?: CashuMode;
     /** Per-DVM Postgres pool — required for the `p2pk-accumulator` path. */
     accumulatorDb?: AccumulatorPool;
@@ -1834,12 +1753,9 @@ interface UpfrontPaymentOpts {
      */
     fxFetcher?: FxFetcher;
     /**
-     * Credit ledger every payment funds and draws through (the credit lifecycle contract):
-     * an attached rail payment is an implicit N=1 funding — `fund` the paid
-     * amount + `draw` it, atomically with the rail commit. When absent (or
-     * when the price can't be fiat-denominated), the payment is accepted with
-     * legacy semantics and a structured warning — money is never refused
-     * because the ledger is unavailable.
+     * Attached payments fund and draw an implicit per-job credit atomically with
+     * rail accounting. Omitting the ledger uses the legacy ledgerless path;
+     * a configured ledger requires a fiat-denominated price before acceptance.
      */
     creditLedger?: CreditLedgerLike;
     /**
@@ -1917,7 +1833,6 @@ interface FundOnlyRequest {
      */
     commitment: string;
 }
-/** Structured payment validation error detail carried through `PaymentValidationError`. */
 interface PaymentErrorDetail {
     body: Record<string, unknown>;
     status: number;
@@ -2065,7 +1980,6 @@ declare function hasPaymentProof(content: Record<string, unknown>): boolean;
  * surfaces always keep charge.
  */
 declare function issueUpfrontChallenges(mpp: MppxServer, requiredMsats: number, resourcePath: string, btcUsdRate: number, sessionIssuable?: boolean, allowOneShotStablecoin?: unknown, priceFiat?: PriceFiat): Promise<Challenge.Challenge[]>;
-/** Verify an upfront payment on job submission (Cashu, x402, or MPP). */
 declare function verifyUpfrontPayment(opts: UpfrontPaymentOpts): Promise<PaymentResult>;
 /**
  * A management credential signed for a channel other than the one required
@@ -2117,25 +2031,9 @@ declare function verifyTempoSessionManagementCredential(args: {
  */
 type PaymentErrorCode = "payment_invalid" | "x402_not_offered" | "x402_settlement_ambiguous" | "cashu_unavailable" | "cashu_not_p2pk_locked" | "mint_health_pending" | "cashu_mint_sick" | "payment_insufficient" | "payment_unapplied" | "insufficient_credit" | "credit_expired" | "credit_unbacked" | "credit_not_found" | "tempo_channel_closing" | "settlement_pending" | "draw_conflict" | "funding_commitment_mismatch" | "credit_not_supported" | "one_shot_credit_not_supported" | "credit_below_min" | "below_rail_minimum" | "credit_over_max" | "credit_id_unavailable" | "nothing_to_drain" | "drain_below_dust" | "drain_not_found" | "drain_conflict" | "drain_method_unsupported" | "tempo_channel_exit_required" | "x402_settlement_submission_failed" | X402SettlementReconciliationReason | "lightning_settlement_pending" | "lightning_invoice_expired" | "lightning_unavailable" | AccumulatorRejectionCode;
 /**
- * Build a flat payment-error body carrying the four agent-facing fields every
- * payment error must have: the machine `code`, the operator-facing
- * `message`, and the `display`/`hint`/`retryable` copy an agent relays to a
- * human and branches retries on. `display`, `hint`, and `retryable` default from
- * {@link PAYMENT_ERROR_COPY} keyed on `code`; `message` is the per-site operator
- * log line. The prose fields can be overridden for dynamic cases (e.g.
- * `cashu_mint_sick` naming the currently-healthy mints, or a retained deposit
- * distinguishing "not spent" from "not paid"). `extra` carries a code's ad-hoc
- * fields (`mints`, `required_msats`, `received_msats`) and is merged last so
- * those are preserved.
- *
- * `retryable` overrides on the same terms, and for the same reason: a code that
- * covers more than one refusal can be terminal for one of them and clear on its
- * own for another — `drain_conflict` is both. Override it only
- * alongside the `hint`, since the two are one answer: a hint that says retry
- * under `retryable: false` is the disagreement this exists to prevent.
- *
- * Upstream of {@link buildPaymentErrorResponse}, which serializes the body onto
- * a `Response` — this shapes it.
+ * Per-code display, hint and retryability may be overridden for a particular
+ * refusal. Keep the hint and retry decision consistent. Extra fields merge
+ * last, so callers can supply code-specific amounts and alternatives.
  */
 declare function paymentErrorBody(code: PaymentErrorCode, opts: {
     message: string;
@@ -2216,14 +2114,9 @@ interface IncomingPaymentOpts {
     creditTtlMs?: number;
 }
 /**
- * Pure verification of an incoming mid-job payment. Runs the
- * rail-specific verify path and returns the credit shape; does not mutate
- * the job. The caller (`JobManager.processPayment`) applies the result
- * inside Tx C so verify+credit land atomically.
- *
- * `snapshot` carries the read-only job state the verification path needs
- * (`pendingPaymentMsats` for amount checks, the MPP/x402 per-job bindings,
- * `paymentRail` for the same-rail accumulator check).
+ * Job state read by incoming-payment verification; the job itself is not mutated. Rail
+ * acceptance and ledger funding can still occur before the caller applies the returned credit in
+ * Tx C.
  */
 interface VerifyIncomingSnapshot {
     pendingPaymentMsats?: number;
@@ -2326,16 +2219,8 @@ declare function verifyIncomingPayment(body: {
  */
 declare function applyPaymentInfoToJob(job: ServerJob, info: VerifiedIncomingPayment): void;
 /**
- * Process an incoming payment message. Returns an error body on failure.
- *
- * **The isolate-runtime path, and deliberately ledger-less** (the isolate-runtime rule). Its
- * only caller is `platform/isolate-job-manager.ts`; isolate DVMs have no
- * Postgres of their own, so they run implicit N=1 with today's semantics
- * preserved and never advertise credit. The credits-carrying mid-job path is
- * {@link verifyIncomingPayment} + `JobManager.processPayment` (Tx C), where
- * wired `fund` + `growDraw`. Wiring a ledger here would need a
- * platform-side ledger leg with its own funding-atomicity and receipt-key
- * story — the trust-surface expansion exists to decide.
+ * Legacy ledgerless payment path. Mutates the job on acceptance; durable credit hosts use
+ * verifyIncomingPayment and apply its result in Tx C.
  */
 declare function processIncomingPayment(job: ServerJob, body: {
     type: MessageType;
@@ -2414,14 +2299,8 @@ interface ReceiptIssuerOpts {
     dvmId: string;
 }
 /**
- * Signs job receipts for one DVM.
- *
- * Constructed only when a receipt key is wired, so the presence of an issuer
- * *is* the "this DVM emits receipts" signal that `/v1/info` advertises. Pure:
- * it holds the key and the slug and turns a terminal `JobRecord` plus an
- * allocated sequence number into signed bytes — sequence allocation and
- * persistence belong to the store, which is what makes issuance idempotent
- * across machines.
+ * An issuer indicates receipt support. Sequence allocation and write-once
+ * persistence belong to the store; signing alone does not provide idempotency.
  */
 declare class ReceiptIssuer {
     /** x-only pubkey this issuer signs under; the attested `receipt_pubkey`. */
@@ -2431,20 +2310,10 @@ declare class ReceiptIssuer {
     private readonly dvmId;
     constructor(opts: ReceiptIssuerOpts);
     /**
-     * Build and sign the receipt for a terminal job. `seq` comes from
-     * `JobStore.claimReceiptSeq`; `issuedAt` is epoch seconds and defaults to now.
-     *
-     * Free jobs get receipts too, with `paid.msats: 0` — they still consume a
-     * sequence number and still attest an outcome. Whether feedback is
-     * paid-only is the feedback layer's call, not this one's.
-     *
-     * Timing and attribution come from the committed terminal row, not signing
-     * time or handler input. Legacy rows without those durable inputs omit the
-     * optional blocks rather than inventing historical evidence.
-     *
-     * `credit` is the resolved draw block — present on every job
-     * whose payment funded/drew the ledger, absent otherwise. Signature-
-     * compatible either way: `canonicalize` omits absent keys.
+     * seq is store-allocated; issuedAt is epoch seconds. Free jobs also consume a
+     * sequence and attest their outcome. Timing/attribution comes from the committed
+     * terminal row; legacy rows omit unknown historical fields. credit is present
+     * only for a resolved ledger draw.
      */
     issue(record: JobRecord, seq: number, issuedAt?: number, credit?: ReceiptCredit): JobReceipt;
     /**
@@ -2544,9 +2413,9 @@ interface JobManagerOpts {
     env: Record<string, string>;
     store: KVStore;
     mints?: string[];
-    /** Persistent backing store for job records. Default: in-memory. */
+    /** Durable in production; defaults to memory only in development/test mode. */
     jobStore?: JobStore;
-    /** When true, payment messages auto-credit without verification. */
+    /** Skips payment only when no payment rail is configured. Wired rails still verify. */
     devMode?: boolean;
     /** Payment methods this DVM accepts. Default: derived by the server from configured rails. */
     paymentMethods?: PaymentMethod[];
@@ -2555,9 +2424,7 @@ interface JobManagerOpts {
     x402ExactSettlement?: X402ExactSettlementServer;
     /** Live facilitator capabilities for version-specific mid-job payment handling. */
     x402FacilitatorHealth?: X402FacilitatorHealthLike;
-    /** MPP multi-rail payment handle (built via `createMppFromOpts`). */
     mpp?: MppxServer;
-    /** Cashu receive mode. */
     cashuMode?: CashuMode;
     /** Builder's NUT-11 P2PK lock pubkey. Required for accumulator mode. */
     lockPubkey?: string;
@@ -2693,16 +2560,10 @@ interface JobManagerOpts {
      */
     onRevenueSkippedNoRail?: (info: RevenueSkippedNoRailPayload) => void | Promise<void>;
     /**
-     * Stale-job sweep threshold in ms. Jobs in a non-terminal status
-     * (`processing` / `working` / `awaiting-input`) whose `lastActivityAt` is
-     * older than this are force-cancelled with reason `stale_no_terminal_status`,
-     * so callers always reach a terminal status instead of polling forever after
-     * a worker crash, OOM, or silent `messageAppender` failure. Default:
-     * `2 × descriptor.idleTimeout + STALE_JOB_WATCHDOG_HEADROOM_MS`, which keeps
-     * the default beyond scrape's `JOB_TIMEOUT_MS`.
-     * Builders whose per-handler wall-clock bound exceeds 90s must override
-     * this — otherwise the watchdog fires on a legitimate in-flight handler.
-     * Set to `0` to disable (test seam).
+     * Awaiting-input age in milliseconds before cancellation. Defaults to
+     * twice descriptor.idleTimeout (seconds), converted to milliseconds, plus
+     * STALE_JOB_WATCHDOG_HEADROOM_MS. Set to 0 to disable this arm; processing
+     * jobs use processingWatchdogMs.
      */
     staleJobTimeoutMs?: number;
     /**
@@ -2907,9 +2768,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * never promise something `issueReceipt` silently declines to do.
      */
     get receiptsEnabled(): boolean;
-    /** True when the named capability exists on this descriptor. */
     hasCapability(name: string): boolean;
-    /** Names of every capability this descriptor exposes — used for error envelopes. */
     capabilityNames(): string[];
     /**
      * Resolve a capability's static `price` to msats.
@@ -3101,9 +2960,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * `artifact`'s NOTIFY silently drops the artifact.
      */
     private wireMessageAppender;
-    /** Start (or restart) the idle timer for a job. */
     startIdleTimer(job: ServerJob): void;
-    /** Clear the idle timer for a job. */
     clearIdleTimer(id: string): void;
     /** Cancel a job due to idle timeout. Exposed for the reactivation path's idle-expiry guard. */
     cancelJobIdle(job: ServerJob): Promise<void>;
@@ -3609,7 +3466,6 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     private reportTerminalJob;
     private terminalReportRecoveryCursor?;
     private recoverTerminalReports;
-    /** Handle job reaching terminal state (completed, failed, cancelled). */
     private handleJobTerminal;
     /**
      * Re-enqueue terminal cost-only rows left between the job commit and outbox
@@ -3671,19 +3527,16 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     private bookRevenue;
     /** Schedule job removal from activeJobs after a delay so clients can still poll final status. */
     scheduleCleanup(job: ServerJob): void;
-    /** Clear all timers. Called on server shutdown to allow clean exit. */
     shutdown(): void;
 }
 
 /** Cached liveness signal for a platform-hosted DVM's Lightning receive rail. */
 interface LightningRailHealth {
-    /** Whether the receive rail may be advertised at this instant. */
     available(): boolean;
     /** Prime the cached signal at boot when the source supports it. */
     refresh?(): Promise<void>;
 }
 
-/** Builder-facing wiring for the Lightning receive leg. */
 interface LightningReceiveConfig {
     /**
      * Receive-only NWC connection URI (`DVMKIT_NWC_RECEIVE_URI`). Validated at
@@ -3722,25 +3575,14 @@ declare const DEFAULT_INVOICE_TTL_SECONDS = 900;
  */
 declare const MIN_INVOICE_TTL_SECONDS = 600;
 /**
- * The builder-side Lightning receive leg for funding prepaid credit.
+ * Prepaid Lightning funding over a receive-safe NWC connection. URI construction validates
+ * the advertised method allowlist, refusing spending or unknown authority; the injected
+ * backend seam bypasses that probe. Receive-safe methods include invoice, read and
+ * hold-invoice operations.
  *
- * Issues a bolt11 over a **receive-only** NWC connection while the DVM is
- * awake serving the 402, and credits the ledger when a later request observes
- * settlement. Two properties are load-bearing:
- *
- * - **It never holds a send credential.** `pay_invoice` on this connection is
- * refused at construction, so a compromised DVM can mint invoices and
- * nothing else. The drain/refund sender is a separate, budgeted
- * connection by rule.
- * - **Crediting is pull-based — there is no settlement watcher.** The caller's
- * next request drives `lookup_invoice`, which is what makes this work on a
- * suspend-to-zero fleet: a machine that is asleep has nothing to miss.
- * Wallet downtime at that moment delays crediting; it never loses money,
- * because the invoice→credit binding is a durable row.
- *
- * Reachability is **cached**, never probed per request: the funding menu is
- * assembled on every quote and every 402, so a live NIP-47 round trip there
- * would put a nostr relay in the latency path of every priced call.
+ * Crediting is pull-based: later requests observe settlement against the durable invoice
+ * binding, so sleeping hosts need no watcher. Reachability is cached and refreshed in the
+ * background for funding menus.
  */
 declare class LightningReceive {
     private readonly source;
@@ -3753,36 +3595,21 @@ declare class LightningReceive {
     private constructor();
     private readonly railHealth;
     /**
-     * Validate the configured connection and build the receive leg, or return
-     * `undefined` when this DVM didn't configure one.
-     *
-     * **Throws on a credential that is wrong, degrades on one that is merely
-     * unreachable.** A wallet outage at boot must not stop a DVM whose other
-     * rails are fine — the menu simply omits `lightning` until a later probe
-     * succeeds. A connection that can spend, or one that can't state what it can
-     * do, is a different thing entirely: it is a standing money risk that no
-     * amount of retrying fixes, so it fails the boot loudly with the fix in the
-     * message.
+     * Return undefined when unconfigured. Permission/URI failures refuse construction with a
+     * corrective message; wallet transport failure constructs an unavailable receive leg so
+     * other rails can still boot. Recovery must validate method scope before advertising
+     * Lightning.
      */
     static create(config: LightningReceiveConfig): Promise<LightningReceive | undefined>;
     /**
-     * Whether `lightning` belongs on the funding menu right now.
-     *
-     * Reads the cached observation and never blocks; a stale one kicks off a
-     * background refresh and answers with what we last knew. Advertising a rail
-     * whose wallet is down would hand the caller an option that 402s on use —
-     * the §4 posture is to drop it and let the sale survive on the others.
+     * Answer from cached wallet and optional rail-health observations without blocking. A stale
+     * wallet observation starts a background refresh.
      */
     available(): boolean;
     /**
-     * Issue (or re-issue) the bolt11 funding `(creditId, fundId)`.
-     *
-     * The invoice is minted **for** the credit and amount named in the caller's
-     * signed body — that binding is the condition-3 commitment on this
-     * rail, and it is why no artifact hash rides the request: there is no
-     * caller-supplied artifact to hash. A re-poll returns the stored row rather
-     * than minting again; a second bolt11 for one `fund_id` would leave two
-     * payable invoices against a funding that can only be credited once.
+     * Return the stored invoice on retry: two payable bolt11s for one fund ID could charge
+     * twice while only one credits. Caller and amount are bound to the recorded credit/funding
+     * pair, without a caller-supplied artifact hash.
      */
     issue(ledger: CreditLedgerLike, args: {
         creditId: string;
@@ -3794,24 +3621,9 @@ declare class LightningReceive {
         description?: string;
     }): Promise<CreditInvoiceRecord>;
     /**
-     * Ask the wallet whether one payment hash is paid, and when.
-     *
-     * The operator's reconcile verb runs this before it credits anything. A
-     * `blocked` row implies payment — {@link applyOne} returns above the block
-     * classification when the lookup says unpaid — but that is *this fleet's
-     * belief, recorded possibly weeks ago*, and the verb it gates mints balance
-     * against it. One round trip turns the belief into a fact and recovers the
-     * true settlement instant for `settled_at`, which a blocked row never got to
-     * write.
-     *
-     * Unlike {@link settlePending} this **throws**: there is no request whose
-     * latency it protects, and crediting on an unverifiable wallet is exactly
-     * what it exists to prevent. `NOT_FOUND` is the one exception, and it is not
-     * an outage — it is the wallet saying it has never seen this hash, the same
-     * reading {@link applyOne} and the caller-side reconcile in `src/lib/nwc.ts`
-     * take. It comes back as `known: false` because the operator's repair for it
-     * ("you are pointed at a different wallet than the one that minted this")
-     * is not the repair for an unpaid invoice, and certainly not for a retry.
+     * Re-observe the wallet payment before an operator credits a blocked invoice and recover
+     * its settlement instant. Unlike settlePending, lookup failures throw. NOT_FOUND returns
+     * known:false, distinguishing the wrong wallet/unknown hash from an unpaid known invoice.
      */
     lookupSettlement(paymentHash: string): Promise<{
         settled: boolean;
@@ -3819,23 +3631,12 @@ declare class LightningReceive {
         known: boolean;
     }>;
     /**
-     * Consult the wallet about this caller's outstanding invoices and credit the
-     * ones that settled — the pull half of pull-based crediting.
-     *
-     * The pending rows are read locally first, so the common case (nothing
-     * outstanding) costs one indexed SELECT and no network at all. Bounded to
-     * {@link MAX_SETTLE_CHECKS} invoices on a short deadline, and **never throws
-     * into the request**: a wallet failure here means the caller's balance is
-     * merely not updated yet, which the ordinary `insufficient_credit` path
-     * already states honestly.
+     * Read pending invoices locally, then check at most MAX_SETTLE_CHECKS on bounded wallet
+     * deadlines. Log failures without throwing into the request.
      *
-     * **Each invoice gets its own failure boundary.** The sweep window is a few
-     * rows wide, so a row that fails on its own terms — a `fund_id` the caller
-     * reused on another rail, a credit someone else opened first — must not take
-     * the rest of the pass down with it: the next invoice in the window may be
-     * the paid one, and it would never be looked up. Only a transport failure
-     * ends the pass early, because there the wallet itself is gone and the
-     * remaining lookups would just spend the caller's latency confirming it.
+     * An invoice-specific failure must not suppress payable siblings; wallet transport failure
+     * ends the pass. Deterministic refusals retire that row as blocked for operator repair,
+     * while transient failures remain pending.
      */
     settlePending(ledger: CreditLedgerLike, args: {
         callerPubkey: string;
@@ -3845,49 +3646,21 @@ declare class LightningReceive {
         enqueueCreditDeposit?: CreditDepositEnqueue;
         nowMs?: number;
     }): Promise<InvoiceSettlement[]>;
-    /**
-     * One invoice's settlement check. Returns the applied settlement, or
-     * `undefined` when nothing changed (still unpaid, or retired unpaid).
-     *
-     * Throws whatever the wallet or the ledger threw — classifying that is
-     * {@link retireOrLog}'s job, so this stays one invoice's happy path.
-     */
     private applyOne;
     /**
-     * Decide what one invoice's failure means, and retire the invoice when the
-     * answer is "this can never succeed".
-     *
-     * The split that matters is permanent-versus-transient, because it decides
-     * whether the row keeps a slot in the sweep window. A transient failure — the
-     * database blinked, the wallet answered oddly — leaves it `pending` and the
-     * caller's next request retries it. A **permanent** one means the ledger will
-     * refuse this invoice identically forever, so leaving it pending costs a
-     * `lookup_invoice` on every subsequent request and, at
-     * {@link MAX_SETTLE_CHECKS} of them, fills the window so a genuinely payable
-     * invoice behind them is never even looked up. Those get `blocked`, which
-     * drops them out of the sweep and hands the operator the payment hash.
+     * Retire a deterministic uncreditable payment as blocked so it no longer occupies the
+     * bounded sweep window. Transient failures stay pending for a later request; report the
+     * payment hash for operator repair.
      */
     private retireOrLog;
     /**
-     * The reason this invoice can never be credited, or `undefined` if the
-     * failure was transient.
-     *
-     * Every code here is decided by state a retry cannot move — a row the ledger
-     * has already committed (a `credit_fundings` entry at this
-     * `(credit_id, fund_id)`, or a `credits` row whose owner, denomination or
-     * rail disagrees with the invoice), or the basis this module rebuilds
-     * identically from the invoice row on every pass. None of them is a race.
-     *
-     * `funding_replayed` is the one that needs a second read to classify.
-     * Usually it *is* benign — a concurrent check won the race and the money is
-     * credited either way — but the key is `(credit_id, fund_id)` and `fund_id`
-     * is **caller-chosen**: reuse it on cashu or x402 after this bolt11 was
-     * minted and the row that collided is a different payment entirely, so the
-     * sats this invoice received have nowhere to land.
+     * Classify funding_replayed by reading the existing funding’s rail. A Lightning row can
+     * represent a concurrent applied check; another rail at this caller-chosen key is a
+     * different payment, leaving the invoice’s sats uncredited. A failed diagnostic read
+     * remains transient, never a guessed permanent refusal.
      */
     private blockingReason;
     private withBackend;
-    /** Record activity without letting it promote an unvalidated connection. */
     private noteOperationOk;
     private notePermissionsOk;
     private notePermissionRefused;
@@ -3910,7 +3683,7 @@ interface OwnerDisplay {
     avatarUrl?: string | null;
     type: "builder" | "org";
 }
-/** Optional builder identity surfaced on `/v1/info` (forward-compatible stub). */
+/** Builder identity advertised on /v1/info. */
 interface BuilderIdentity {
     id?: string;
     name?: string;
@@ -3935,7 +3708,6 @@ interface PlatformReporterOpts {
     /** Platform internal URL. Defaults to `DVMKIT_PLATFORM_URL` env. */
     url?: string;
 }
-/** Running host handle returned by serve(). */
 interface DVMServeResult {
     url: string;
     close: () => Promise<void>;
@@ -3943,6 +3715,8 @@ interface DVMServeResult {
     paymentModes: PaymentMode[];
 }
 interface DVMHostOpts {
+    /** Dedicated hosting-management authority for each mounted DVM. Requires durable Postgres. */
+    hostingControl?: HostingControlConfig;
     /**
      * Postgres connection string. Defaults to `DATABASE_URL` env.
      * Required at runtime. Boot fails when missing unless `jobStore`
@@ -3957,7 +3731,6 @@ interface DVMHostOpts {
      * to ambient process variables.
      */
     env?: Record<string, string>;
-    /** Builder identity for `/v1/info` (forward-compatible). */
     builder?: BuilderIdentity;
     /** Owner display identity for `/v1/info#owner`. Falls back to env vars. */
     owner?: OwnerDisplay;
@@ -3985,7 +3758,6 @@ interface DVMHostOpts {
     pool?: Pool;
     /** Cashu mints accepted. Defaults to env `DVMKIT_CASHU_MINTS`. */
     mints?: string[];
-    /** Cashu receive mode override. */
     cashuMode?: CashuMode;
     /** MPP handle override. Defaults to env-resolved via `createMppFromOpts`. */
     mpp?: MppxServer;
@@ -4008,9 +3780,7 @@ interface DVMHostOpts {
     onPaidJobCompleted?: (event: PaidJobCompletion) => void | Promise<void>;
     /** When true, payment is skipped only when no payment rail is configured. */
     devMode?: boolean;
-    /** Consumed-credential store override (test seam). */
     consumedCredentialStore?: ConsumedCredentialStore;
-    /** Mint-health tracker override (test seam). */
     mintHealthTracker?: MintHealthTracker;
     /** Operator-alert boundary for failed terminal-job retention passes. */
     onJobRetentionSweepFailed?: JobManagerOpts["onJobRetentionSweepFailed"];
@@ -4023,12 +3793,10 @@ interface DVMHostOpts {
      */
     wrapRouteClientCompatibility?: (sdkGate: ClientCompatibilityGate) => ClientCompatibilityGate;
 }
-/** Per-mount options. Currently only `prefix` is supported. */
 interface MountOpts {
     /** Path prefix for this DVM's protocol routes (e.g. `/delete-feed`). */
     prefix?: string;
 }
-/** Live DVM host. Single wiring locus for the SDK. */
 interface DVMHost {
     /**
      * Underlying Hono app for custom non-protocol routes that belong to the
@@ -4057,7 +3825,6 @@ interface DVMHost {
      * a single mount with no prefix attaches at root.
      */
     mount<S, I extends ZodLike | undefined>(descriptor: DVMDescriptor<S, I>, opts?: MountOpts): void;
-    /** Start listening. Returns the live server handle. */
     serve(opts?: {
         port?: number;
     }): Promise<DVMServeResult>;
@@ -4101,22 +3868,10 @@ interface TempoObserverHealth {
     /** Prime the cached signal at boot. */
     refresh?(): Promise<void>;
     /**
-     * Register a mount's `tempo/session` **capability** so the poll can carry it
-     * back to the platform.
-     *
-     * The platform's `dvms.tempo_session_advertised_at` — the only filter on the
-     * close observer's payee-fallback rung 2 — was written once per container
-     * deploy and never refreshed, so a builder flipping sessions on with
-     * `dvmctl env --set` stayed invisible to the fallback indefinitely. That is a
-     * `no_route` on the first close of that DVM's first channel, which is exactly
-     * the race the rung exists to cover.
-     *
-     * The reader must answer from **configuration**, never from
-     * {@link TempoObserverHealth.available} — a fail-closed gate blip must not
-     * de-stamp the DVM, which is the failure through a new door.
-     *
-     * Returns a disposer the mount calls on shutdown, so a torn-down capability
-     * stops voting in the OR below.
+     * Report the OR of mounted session capabilities to keep the platform's
+     * observer watch signal current. Readers must use configuration, not current
+     * availability: an observer outage must not erase the capability it watches.
+     * The returned disposer removes a mount's contribution on shutdown.
      */
     declareSessionCapability?(read: () => boolean): () => void;
 }
@@ -4164,7 +3919,6 @@ interface TempoSettlementReadinessStateStore {
     clearFailureIfRefilled(version: string, balanceMicro: bigint, lowBalanceMicro: bigint): Promise<boolean>;
     clearFailureAfterSuccessfulTransaction(version: string): Promise<boolean>;
 }
-/** Construction inputs for {@link TempoSettlementReadiness}. */
 interface TempoSettlementReadinessOptions {
     address: `0x${string}`;
     network: string;
@@ -4211,7 +3965,6 @@ declare class TempoSettlementReadiness {
     start(): void;
     /** Stop the cadence without affecting any in-flight reading. */
     stop(): void;
-    /** Read and report the configured fee-token balance now. */
     checkBalance(opts?: {
         successfulTransaction?: boolean;
         recoveryVersion?: string;
@@ -4234,24 +3987,11 @@ declare class TempoSettlementReadiness {
     private notify;
 }
 
-/**
- * Options for the revenue reporter readiness assertion.
- *
- * The check branches on `platformUrl` presence — that's the unambiguous
- * "platform-hosted" signal. `failFast` stays on the opts as a general SDK
- * strict-mode flag but is not consulted by this assertion.
- */
 interface RevenueBootCheckOpts {
     /**
-     * General SDK strict-mode flag, sourced from `DVMKIT_FAIL_FAST` at the host
-     * boundary. Reserved for future warning-vs-fatal SDK checks; the
-     * reporter check itself ignores it, hence optional.
+     * Reporter readiness ignores this host strict-mode flag.
      */
     failFast?: boolean;
-    /**
-     * The SDK's canonical "this is a dev/test run" signal. Exempts the boot from
-     * the platform-hosted wiring requirement — see below.
-     */
     devMode?: boolean;
     platformToken: string | undefined;
     platformUrl: string | undefined;
@@ -4355,11 +4095,11 @@ interface SDKServerOpts {
     canonicalDvmId?: string;
     /** Postgres pool for builder admin state and wallet accumulator persistence. */
     db?: Pool;
+    /** Enables authenticated, durable hosting admission and bounded drain. Requires Postgres and dvmId. */
+    hostingControl?: HostingControlConfig;
     /**
-     * General SDK strict-mode flag, sourced from `DVMKIT_FAIL_FAST` at
-     * the host boundary. Reserved for future warning-vs-fatal SDK checks; the
-     * revenue-reporter boot check is gated on platform context, not on this
-     * flag.
+     * Host strict-mode flag. Reporter readiness follows hosted context regardless
+     * of this value.
      */
     failFast?: boolean;
     /** Agent-wallet: per-DVM identifier — drives the monitor advisory lock + replay key. */
@@ -4486,12 +4226,6 @@ interface SDKServerOpts {
      */
     creditExpirySweep?: CreditExpirySweepOpts;
 }
-/**
- * Builds a Hono sub-app for one DVM descriptor, wires payment verification,
- * auto-wires `RevenueReporter` when platform env + db + dvmId are present, and
- * runs the platform-hosted partial-wiring assertion — gated on
- * `DVMKIT_PLATFORM_URL` presence, independent of `DVMKIT_FAIL_FAST`.
- */
 declare function createDVMServer<State, InputSchema extends ZodLike | undefined>(descriptor: DVMDescriptor<State, InputSchema>, opts: SDKServerOpts): Promise<{
     app: Hono<AppEnv>;
     authAudience?: SignedRequestAudience;
@@ -4533,13 +4267,8 @@ interface AppEnv {
 declare function unknownRouteNotFound(c: Context): Response;
 
 /**
- * The public prepaid-credit terms a DVM advertises before a caller identifies
- * itself. Snake_case: this is the wire shape.
- *
- * This type deliberately excludes the per-caller echo. `/v1/info` is public
- * and cacheable, so its type must make a caller credit ID or balance
- * unrepresentable rather than relying on the current handler not to ask for
- * one.
+ * Public, cacheable prepaid terms exclude caller IDs and balances. toCreditTerms explicitly
+ * whitelists this shape so later caller-specific menu fields cannot leak into /v1/info.
  */
 interface CreditTerms {
     /** Smallest funding accepted, in 1e-6 units of `currency`. */
@@ -4552,7 +4281,10 @@ interface CreditTerms {
     currency: string;
     /** Rails a top-up may be funded over. */
     funding: FundingMethod[];
-    /** MPP instruments offered or temporarily withheld for credit funding. */
+    /**
+     * Tempo methods are actionable. withheld names configured but temporarily unavailable
+     * instruments, preserving capability discovery without advertising them for funding.
+     */
     tempo?: {
         methods: {
             method: string;
@@ -4564,63 +4296,32 @@ interface CreditTerms {
             reason: string;
         }[];
     };
-    /** x402 flavours accepted for credit funding. */
+    /**
+     * Present with offered x402 funding. Reusable batch settlement is enabled by default; exact
+     * requires explicit acceptance of its manual refund obligation.
+     */
     x402?: {
         schemes: {
             scheme: string;
             network: string;
         }[];
     };
-    /** Smallest Lightning funding accepted, in 1e-6 units of `currency`. */
+    /**
+     * Configured Lightning receive floor in micro-units of currency, including the advertised
+     * FX margin. Issuance checks the raw sats floor at current rates; arbitrary drift can still
+     * make the advertised amount insufficient.
+     */
     lightning_min_micro?: number;
 }
 /**
- * The **funding menu** a DVM advertises on `/v1/quote` and in every 402;
- * this is the snake_case wire shape.
- *
- * `min_micro` / `max_micro` / `ttl_ms` are the DVM's sizing terms — `max_micro`
- * binds the **residual balance**, not a funding amount, so a job priced above
- * it still clears as fund-and-immediately-draw. `funding` is the rail list a
- * top-up may arrive on — a {@link FundingMethod}, not a `PaymentMethod`, since
- * `lightning` funds a credit without ever being an attached-proof wire method.
- * A rail whose backing wallet is unreachable drops out and the sale survives
- * on the others.
+ * Funding options and sizing in the wire denomination. max_micro limits residual balance,
+ * not a job’s price; fund-and-draw can spend a larger payment immediately. Lightning funds
+ * credit but is not an attached-proof payment method.
  *
- * The `credit_id` / `balance_micro` / `remaining_micro` / `expiry_ms` echo
- * appears only for an authenticated caller who already holds a live credit —
- * so one round trip answers "what does this cost, and what do I have left?"
- * through the signed credit endpoint.
+ * An authenticated caller’s live credit may add an echo with funded and spendable balance;
+ * pending holds are included only in the funded figure.
  */
 interface CreditMenu extends CreditTerms {
-    /**
-     * MPP instruments accepted for this credit, reusable sessions first when
-     * available.
-     *
-     * `withheld` names an instrument this DVM is configured for and is not
-     * offering at this instant, with the reason. Two audiences read
-     * it. An agent gets to relay *why* `tempo/session` vanished instead of
-     * inferring the DVM never had it. And the platform's deploy probe reads
-     * capability from `methods ∪ withheld`, so a deploy landing during an
-     * observer blip no longer stamps `tempo_session_advertised_at` NULL and
-     * drops the DVM out of the close observer's payee fallback permanently.
-     * `methods` stays the list a caller acts on — never widen it to include a
-     * withheld instrument.
-     */
-    /**
-     * Which x402 flavours a top-up may arrive on, and the chain each rides
-     * Present exactly when `funding` lists `x402`. Reusable
-     * `batch-settlement` is admitted by default; one-payment `exact` appears
-     * only when the builder explicitly accepts its manual refund obligation.
-     */
-    /**
-     * Smallest funding the `lightning` rail accepts, in 1e-6 units of
-     * `currency`. Present only when `funding` lists `lightning`. This is the
-     * deployment's sats-physical receive floor rendered into fiat
-     * with a ×{@link LIGHTNING_FLOOR_FX_MARGIN} margin absorbing rate drift
-     * between menu fetch and funding — issuance enforces the *raw* floor at
-     * request-time rates, so funding exactly this figure always clears. Rails
-     * without an entry (cashu) have no floor beyond `min_micro`.
-     */
     /** The caller's credit this echo describes. Present only with the echo. */
     credit_id?: string;
     /** Funded balance, pending holds NOT subtracted. */
@@ -4630,7 +4331,6 @@ interface CreditMenu extends CreditTerms {
     /** Absolute expiry of the echoed credit, ms since epoch. */
     expiry_ms?: number;
 }
-/** Everything {@link buildCreditMenu} needs, assembled per request. */
 interface BuildCreditMenuArgs {
     /**
      * Which runtime is answering. `"isolate"` is refused unconditionally — see
@@ -4640,13 +4340,8 @@ interface BuildCreditMenuArgs {
     /** The DVM's resolved `credit` block; `undefined` means it didn't opt in. */
     config: ResolvedCreditConfig | undefined;
     /**
-     * Currency the menu — and the credit it funds — denominates in: the DVM's
-     * declared `DVMConfig.currency`, which every call site reads off the single
-     * `DVMServer.creditCurrency()`. Deliberately *not* the currency of
-     * the response this menu rides on: a quote priced elsewhere is refused before
-     * it reaches here, so the two agree, and sourcing it from the response is
-     * what left `POST /v1/credit` — which has no response to read — funding in
-     * hardwired USD at a DVM whose jobs draw in something else.
+     * Use the DVM’s declared denomination, including /v1/credit where no quote response supplies
+     * it. Quote validation refuses a different denomination before menu construction.
      */
     currency: string;
     /** Rails this DVM settles over — the menu's funding options. */
@@ -4662,31 +4357,19 @@ interface BuildCreditMenuArgs {
         intent: "charge" | "session";
         reason: string;
     }[];
-    /**
-     * x402 flavours this DVM can actually accept a top-up on — one
-     * server read, so what the sub-block advertises is what `/v1/credit` will
-     * answer a 402 with.
-     */
     x402Schemes?: {
         scheme: string;
         network: string;
     }[];
     /**
-     * The deployment's Lightning receive floor in sats, when `lightning` is on
-     * the menu — rendered into `lightning_min_micro`. An fx failure during that
-     * rendering drops `lightning` from `funding` rather than suppressing the
-     * menu: a rail whose minimum we can't state honestly is a rail we must not
-     * advertise, but the other rails' sale survives.
+     * Configured raw receive floor in sats, rendered with an FX margin for the menu. Failure
+     * omits Lightning while allowing the rest of the menu; issuance checks the raw floor at
+     * current request-time rates.
      */
     lightningFundingMinSats?: number;
     /**
-     * Whether this DVM has at least one accepted Cashu mint configured
-     * Without one, no Bitcoin funding rail may be advertised — see
-     * the filter in {@link buildCreditMenu}.
-     *
-     * Read off the **configured** mint list, never the health-filtered
-     * advertised one: a mint blip must not make a funding rail appear and
-     * disappear between quotes.
+     * Read the configured accepted mint list, not its health-filtered advertisement. Non-channel
+     * Bitcoin refunds need a mint, but configuration alone does not establish refund solvency.
      */
     hasAcceptedMint?: boolean;
     fxFetcher: FxFetcher;
@@ -4699,50 +4382,18 @@ interface BuildCreditMenuArgs {
     callerPubkey?: string;
 }
 /**
- * Assemble the funding menu, or return `undefined` when this DVM must not
- * advertise credit. **The refusal ladder is the feature**; each rung exists
- * because advertising anyway would misadvertise:
- *
- * 1. **Isolate runtime** (the isolate-runtime rule) — checked first and unconditionally,
- * before config is even read. Isolate DVMs have no Postgres of their own;
- * their only DVM-side persistence is the last-write-wins callback KV, which
- * the durable-ledger requirement prohibits for credit state. Until isolate
- * runtimes have durable credit storage, they run implicit N=1 only and their quote never offers
- * credit so nothing is misadvertised.
- * 2. **Not opted in** — no `credit` block on `configureDVM`.
- * 3. **No descriptor auth** — a credit belongs to a verified secp256k1 pubkey.
- * Without auth the ledger's funder identity degrades to the requester id or
- * `"anonymous"` (see `resolveLedgerContext`), which would pool every
- * anonymous caller's money into one balance. Advertising a per-caller
- * balance on such a DVM would be a lie at best and a disclosure at worst.
- * 4. **Non-durable ledger outside devMode** — a `MemoryCreditLedger` is
- * per-process, so a caller funding on machine A and drawing on machine B
- * gets `credit_not_found`. Advertise only what survives the fleet.
- * 5. **Bounds not expressible in `currency`** — an fx outage, or a currency the
- * snapshot doesn't carry. Omit rather than quote a number we can't state.
- *
- * The balance echo is added only when a verified `callerPubkey` holds a live,
- * same-currency credit.
+ * Return no menu for static ineligibility or unresolvable denomination bounds. Isolates
+ * currently lack durable credit storage; anonymous balances must not be advertised.
  *
- * Rungs 1–4 live in {@link creditMenuConfigured}, which the capability refresh
- * reads too.
+ * Select the caller echo only from live, same-currency credits with spendable value.
  */
 declare function buildCreditMenu(args: BuildCreditMenuArgs): Promise<CreditMenu | undefined>;
 /**
- * The one credit a caller's quote echoes, from the several they may hold —
- * every implicit N=1 payment mints its own `imp:<rail>:<paymentId>` credit, so
- * this list grows with each paid job.
+ * Choose the largest live, active, same-currency spendable balance; newest creation breaks
+ * a tie. Released implicit payments can hold reclaimable value and are eligible too.
  *
- * Live, same-currency credits with something left in them; largest spendable
- * balance wins, newest breaks a tie. That is the credit a caller would in fact
- * draw against next. A failed job's released hold leaves a positive implicit
- * balance, which is real caller money (the credit lifecycle contract, no debit on failure) and is
- * echoed like any other.
- *
- * **Requires a verified pubkey.** Never call this with a requester id or
- * `"anonymous"`: on an auth-less DVM the ledger pools every anonymous caller
- * under one `caller_pubkey`, so echoing it would show one caller another's
- * balance.
+ * The caller supplies a verified pubkey. Anonymous/missing identity returns no credit; the
+ * ledger’s anonymous pool must not be exposed to an individual caller.
  */
 declare function selectPrimaryCredit(args: {
     ledger: CreditLedgerLike;
@@ -4750,21 +4401,16 @@ declare function selectPrimaryCredit(args: {
     currency: string;
     nowMs?: number;
 }): Promise<CreditSnapshot | undefined>;
-/** Narrow a ledger snapshot to the read-only shape a quote handler receives. */
 declare function toCreditView(snapshot: CreditSnapshot): CreditView;
 /**
- * Attach a menu to a response body when there is one. Keeps the "omit the key
- * entirely rather than emit `credit: null`" rule in one place — every consumer
- * checks presence, and the isolate tier depends on the key never appearing.
+ * Omit the credit key entirely when there is no menu; consumers use presence to determine
+ * whether credit is offered.
  */
 declare function attachCreditMenu(body: Record<string, unknown>, menu: CreditMenu | undefined): Record<string, unknown>;
 /**
- * Project a quote/402 menu onto the public, cache-safe `/v1/info` terms.
- *
- * This is an explicit whitelist rather than object rest syntax: a later
- * caller-specific field added to {@link CreditMenu} cannot cross this boundary
- * until someone deliberately adds it to {@link CreditTerms} and this copy.
+ * Explicitly whitelist public /v1/info terms. A future caller-specific menu field cannot
+ * cross this cacheable boundary merely by being added to CreditMenu.
  */
 declare function toCreditTerms(menu: CreditMenu): CreditTerms;
 
-export { isTerminal as $, type AccumulatorPool as A, buildPaymentErrorResponse as B, type ConsumedCredentialStore as C, clearAccumulatorForDvm as D, createDVMServer as E, type FiatDenomination as F, creditDepositPayload as G, derivedFundCreditId as H, type IncomingPaymentOpts as I, JobCancelledError as J, devModeSkipsPaymentVerification as K, fromJobRecord as L, MintHealthTracker as M, fundedMicroFor as N, hasPaymentProof as O, PAYMENT_PROOF_KEYS as P, hashLockKey as Q, type ReporterBannerOpts as R, type SDKServerOpts as S, type TempoChannelReport as T, type UpfrontPaymentOpts as U, type VerifiedIncomingPayment as V, implicitCreditId as W, type X402BatchChannelObservation as X, initWalletAccumulatorTable as Y, insertAccumulatorRows as Z, isDerivedCreditId as _, type AccumulatorQuerier as a, type X402ExactSettlementAttempt as a$, isYieldMessage as a0, issueUpfrontChallenges as a1, msatsToFiatMicro as a2, paymentErrorBody as a3, pinAskFiat as a4, priceFiatMicro as a5, processIncomingPayment as a6, providerMessage as a7, repairX402ExactSettlementEffect as a8, resolveFxSnapshot as a9, JobManager as aA, type JobManagerOpts as aB, type LightningReceiveConfig as aC, MIN_INVOICE_TTL_SECONDS as aD, MemoryConsumedCredentialStore as aE, type MemoryConsumedCredentialStoreOpts as aF, MemoryProcessedPaymentStore as aG, MemoryX402ExactSettlementStore as aH, type MountOpts as aI, type OwnerDisplay as aJ, type PaidJobCompletion as aK, type PaymentMode as aL, type PlatformReporterOpts as aM, PostgresProcessedPaymentStore as aN, PostgresX402ExactSettlementStore as aO, type PriceFiat as aP, type ProcessedPaymentQuerier as aQ, type ProcessedPaymentRail as aR, type ProcessedPaymentRecord as aS, ProcessedPaymentReplayError as aT, type ProcessedPaymentStore as aU, type X402BatchAcceptance as aV, type X402BatchFunding as aW, type X402BatchRefusal as aX, type X402BatchSettlementServer as aY, type X402ExactAcceptance as aZ, X402ExactIntentConflictError as a_, resolvePriceFiat as aa, revenueReporterBannerState as ab, toCreditTerms as ac, toJobRecord as ad, unknownRouteNotFound as ae, verifyIncomingPayment as af, verifyTempoSessionManagementCredential as ag, verifyUpfrontPayment as ah, x402RequiredUsdcMicro as ai, x402SettledShare as aj, type CreditMenu as ak, ReceiptIssuer as al, LightningReceive as am, TempoSettlementReadiness as an, type DVMHostOpts as ao, type DVMServeResult as ap, type BuildCreditMenuArgs as aq, type BuilderIdentity as ar, CREDIT_ENVELOPE_KEYS as as, type CreateX402BatchSettlementServerOpts as at, type CreditEnvelope as au, CreditEnvelopeError as av, type CreditFundCommitment as aw, type CreditTerms as ax, DEFAULT_INVOICE_TTL_SECONDS as ay, type DVMHost as az, type AppEnv as b, type X402ExactSettlementChainEvidence as b0, type X402ExactSettlementEffect as b1, X402ExactSettlementEvidenceMissingError as b2, type X402ExactSettlementEvidenceReader as b3, type X402ExactSettlementIntent as b4, X402ExactSettlementNotReadyError as b5, X402ExactSettlementServer as b6, type X402ExactSettlementServerOpts as b7, type X402ExactSettlementStatus as b8, type X402ExactSettlementStore as b9, type X402SettlementChainEvidence as ba, type X402SettlementEvidenceReader as bb, X402SettlementSubmissionError as bc, X402_BATCH_AUTO_SETTLEMENT as bd, X402_BATCH_MIN_WITHDRAW_DELAY_SECONDS as be, X402_BATCH_SETTLEMENT_NETWORK as bf, attachCreditMenu as bg, buildCreditMenu as bh, createDVMHost as bi, createX402BatchSettlementServer as bj, creditEnvelopeIgnoreFields as bk, drawSettlementRef as bl, extractCreditEnvelope as bm, fundingCommitment as bn, selectPrimaryCredit as bo, stripCreditEnvelope as bp, toCreditView as bq, type CreditFundingReport as c, type FiatDenominationFailure as d, type FundOnlyRequest as e, type PaymentErrorCode as f, type PaymentErrorDetail as g, type PaymentInfo as h, type ResolvedFx as i, type RevenueBootCheckOpts as j, type ServerJob as k, type ShortPayForfeit as l, type TempoObserverHealth as m, TempoSessionChannelMismatchError as n, type VerifyIncomingSnapshot as o, X402FacilitatorHealth as p, type X402SettlementEvidenceOutcome as q, type X402SettlementRepair as r, type X402SettlementRepairRefusal as s, type X402SettlementRepaired as t, type X402WedgedSettlement as u, type X402WedgedSettlementPage as v, X402_BATCH_SETTLEMENT_MAINNET_NETWORK as w, abortJob as x, applyPaymentInfoToJob as y, assertRevenueReporterReady as z };
+export { isTerminal as $, type AccumulatorPool as A, buildPaymentErrorResponse as B, type ConsumedCredentialStore as C, clearAccumulatorForDvm as D, createDVMServer as E, type FiatDenomination as F, creditDepositPayload as G, derivedFundCreditId as H, type IncomingPaymentOpts as I, JobCancelledError as J, devModeSkipsPaymentVerification as K, fromJobRecord as L, MintHealthTracker as M, fundedMicroFor as N, hasPaymentProof as O, PAYMENT_PROOF_KEYS as P, hashLockKey as Q, type ReporterBannerOpts as R, type SDKServerOpts as S, type TempoChannelReport as T, type UpfrontPaymentOpts as U, type VerifiedIncomingPayment as V, implicitCreditId as W, type X402BatchChannelObservation as X, initWalletAccumulatorTable as Y, insertAccumulatorRows as Z, isDerivedCreditId as _, type AccumulatorQuerier as a, type X402BatchSettlementServer as a$, isYieldMessage as a0, issueUpfrontChallenges as a1, msatsToFiatMicro as a2, paymentErrorBody as a3, pinAskFiat as a4, priceFiatMicro as a5, processIncomingPayment as a6, providerMessage as a7, repairX402ExactSettlementEffect as a8, resolveFxSnapshot as a9, type HostingControlCommand as aA, type HostingControlConfig as aB, type HostingControlStatus as aC, JobManager as aD, type JobManagerOpts as aE, type LightningReceiveConfig as aF, MIN_INVOICE_TTL_SECONDS as aG, MemoryConsumedCredentialStore as aH, type MemoryConsumedCredentialStoreOpts as aI, MemoryProcessedPaymentStore as aJ, MemoryX402ExactSettlementStore as aK, type MountOpts as aL, type OwnerDisplay as aM, type PaidJobCompletion as aN, type PaymentMode as aO, type PlatformReporterOpts as aP, PostgresProcessedPaymentStore as aQ, PostgresX402ExactSettlementStore as aR, type PriceFiat as aS, type ProcessedPaymentQuerier as aT, type ProcessedPaymentRail as aU, type ProcessedPaymentRecord as aV, ProcessedPaymentReplayError as aW, type ProcessedPaymentStore as aX, type X402BatchAcceptance as aY, type X402BatchFunding as aZ, type X402BatchRefusal as a_, resolvePriceFiat as aa, revenueReporterBannerState as ab, toCreditTerms as ac, toJobRecord as ad, unknownRouteNotFound as ae, verifyIncomingPayment as af, verifyTempoSessionManagementCredential as ag, verifyUpfrontPayment as ah, x402RequiredUsdcMicro as ai, x402SettledShare as aj, type CreditMenu as ak, ReceiptIssuer as al, LightningReceive as am, TempoSettlementReadiness as an, type DVMHostOpts as ao, type DVMServeResult as ap, type BuildCreditMenuArgs as aq, type BuilderIdentity as ar, CREDIT_ENVELOPE_KEYS as as, type CreateX402BatchSettlementServerOpts as at, type CreditEnvelope as au, CreditEnvelopeError as av, type CreditFundCommitment as aw, type CreditTerms as ax, DEFAULT_INVOICE_TTL_SECONDS as ay, type DVMHost as az, type AppEnv as b, type X402ExactAcceptance as b0, X402ExactIntentConflictError as b1, type X402ExactSettlementAttempt as b2, type X402ExactSettlementChainEvidence as b3, type X402ExactSettlementEffect as b4, X402ExactSettlementEvidenceMissingError as b5, type X402ExactSettlementEvidenceReader as b6, type X402ExactSettlementIntent as b7, X402ExactSettlementNotReadyError as b8, X402ExactSettlementServer as b9, type X402ExactSettlementServerOpts as ba, type X402ExactSettlementStatus as bb, type X402ExactSettlementStore as bc, type X402SettlementChainEvidence as bd, type X402SettlementEvidenceReader as be, X402SettlementSubmissionError as bf, X402_BATCH_AUTO_SETTLEMENT as bg, X402_BATCH_MIN_WITHDRAW_DELAY_SECONDS as bh, X402_BATCH_SETTLEMENT_NETWORK as bi, attachCreditMenu as bj, buildCreditMenu as bk, createDVMHost as bl, createX402BatchSettlementServer as bm, creditEnvelopeIgnoreFields as bn, drawSettlementRef as bo, extractCreditEnvelope as bp, fundingCommitment as bq, selectPrimaryCredit as br, signHostingControl as bs, stripCreditEnvelope as bt, toCreditView as bu, type CreditFundingReport as c, type FiatDenominationFailure as d, type FundOnlyRequest as e, type PaymentErrorCode as f, type PaymentErrorDetail as g, type PaymentInfo as h, type ResolvedFx as i, type RevenueBootCheckOpts as j, type ServerJob as k, type ShortPayForfeit as l, type TempoObserverHealth as m, TempoSessionChannelMismatchError as n, type VerifyIncomingSnapshot as o, X402FacilitatorHealth as p, type X402SettlementEvidenceOutcome as q, type X402SettlementRepair as r, type X402SettlementRepairRefusal as s, type X402SettlementRepaired as t, type X402WedgedSettlement as u, type X402WedgedSettlementPage as v, X402_BATCH_SETTLEMENT_MAINNET_NETWORK as w, abortJob as x, applyPaymentInfoToJob as y, assertRevenueReporterReady as z };