@dvmkit/sdk 0.21.1 → 0.22.0

package/dist/{chunk-MUMZPUYD.js → chunk-JINZMDNK.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-XRLKGCAW.js";
 import {
   x402EarnedCeiling
-} from "./chunk-KRX7VNBG.js";
+} from "./chunk-DY5QIHJA.js";
 import {
   createX402FacilitatorAuthHeaders,
   createX402FacilitatorClient,
@@ -14,18 +14,19 @@ import {
   verifyWithFacilitator,
   withPaymentDiagnostics,
   withPaymentStage
-} from "./chunk-C65P6MGZ.js";
+} from "./chunk-3DGIRHP2.js";
 import {
   MemoryCreditLedger
-} from "./chunk-DJRTYBEE.js";
+} from "./chunk-HVZIITWW.js";
 import {
   PostgresJobStore
-} from "./chunk-QCZXKUS2.js";
+} from "./chunk-SQOVLAJ2.js";
 import {
   CASHU_MIN_LOCKTIME_SECONDS,
   DEFAULT_CASHU_LOCK_WINDOW_SECONDS,
   SIGNED_ENVELOPE_FIELDS,
   SignedRequestError,
+  carriesSignedEnvelope,
   humanizeZodError,
   humanizeZodIssues,
   shortestCashuLockWindowSeconds,
@@ -33,7 +34,7 @@ import {
   signedRequestInput,
   unsignedCashuLockWindowSeconds,
   zodIssuesOf
-} from "./chunk-A6AOE63A.js";
+} from "./chunk-DLRPKEAM.js";
 import {
   MemoryJobStore,
   UNCAPPABLE_ASK_TOTAL,
@@ -42,7 +43,7 @@ import {
   isJobRetentionStore,
   isReceiptIssuingStore,
   isStreamableJobStore
-} from "./chunk-6RJAE332.js";
+} from "./chunk-5NMHZIIU.js";
 import {
   ContentHoldError,
   JobCancelledError,
@@ -83,7 +84,7 @@ import {
   receiptPubkeyFromSecret,
   toLockPubkey,
   verifyChallenge
-} from "./chunk-7RWE6ELV.js";
+} from "./chunk-EQIP6TFD.js";
 import {
   X402_BATCH_SETTLEMENT_SCHEME,
   X402_DEFAULT_FACILITATOR,
@@ -102,7 +103,7 @@ import {
   resolveRpcOverride,
   usdcToMsats,
   x402NetworkToCaip2
-} from "./chunk-NUDHO4HV.js";
+} from "./chunk-LABJSMSJ.js";
 import {
   RAIL_REFUNDABLE,
   canonicalRequestPath,
@@ -110,7 +111,7 @@ import {
 } from "./chunk-SXL44PL5.js";
 import {
   createConsoleLogger
-} from "./chunk-QTKGFG3I.js";
+} from "./chunk-JMTLK2SZ.js";
 import {
   StepCache
 } from "./chunk-BQJIFRAZ.js";
@@ -127,8 +128,9 @@ import {
   roundUsd,
   satsToFiat,
   validateCurrency
-} from "./chunk-72A4PHLD.js";
+} from "./chunk-UVRBD5GR.js";
 import {
+  CARD_EXPIRY_DRAIN_PREFIX,
   CreditLedger,
   CreditLedgerError,
   DRAIN_METHODS,
@@ -138,12 +140,14 @@ import {
   X402_RESOLVED_SETTLEMENT_STATUSES,
   X402_SPEND_BLOCKING_SETTLEMENT_STATUSES,
   X402_WEDGED_SETTLEMENT_STATUSES,
+  cardExpiryDrainId,
+  isCardFundedRail,
   isDrainMethod,
   isFundingRail,
   isNonChannelBitcoinRail,
   netOwedSats,
   x402SettlementPending
-} from "./chunk-I5MXADJS.js";
+} from "./chunk-SEIMPHIP.js";
 import {
   parseStoreValue
 } from "./chunk-YG7G4DPZ.js";
@@ -162,7 +166,7 @@ import {
 import {
   isTransportError,
   withPostgresRecoveryContext
-} from "./chunk-INYFUPXV.js";
+} from "./chunk-L35WYOH2.js";
 import {
   DvmError,
   x402NetworkByCaip2
@@ -180,17 +184,17 @@ import {
   installHostedTempoCloseGuard,
   isTempoInsufficientFundsError,
   resolveTempoNetwork
-} from "./chunk-MWDUGMN2.js";
+} from "./chunk-LCNRFKP7.js";
 import {
   loggers,
   pinDimension,
   withSpan,
   withTraceContext
-} from "./chunk-LY2JYSJS.js";
+} from "./chunk-ZH5CLGO6.js";
 import {
   createDiagnosticCapabilityAuthority,
   diagnosticConsole
-} from "./chunk-ALTE7I6C.js";
+} from "./chunk-2WWVI32F.js";
 
 // src/sdk/server/lock-pubkey-store.ts
 async function initLockPubkeyTable(db) {
@@ -903,6 +907,7 @@ function stablecoinCreditInstrumentAllowed(allowOneShotStablecoin, instrument) {
 }
 
 // src/sdk/server/credit-menu.ts
+var STRIPE_CREDIT_MIN_MICRO = 5e5;
 function creditMenuConfigured(args) {
   if (args.runtime === "isolate") return false;
   if (!args.config) return false;
@@ -951,6 +956,9 @@ async function buildCreditMenu(args) {
   const funding = args.funding.filter((rail) => {
     if (rail === "tempo") return tempoMethods.length > 0;
     if (rail === "x402") return x402Schemes.length > 0;
+    if (rail === "stripe") {
+      return args.stripeNetworkId !== void 0 && currency === "usd" && bounds.maxMicro >= STRIPE_CREDIT_MIN_MICRO;
+    }
     if (isNonChannelBitcoinRail(rail)) return args.hasAcceptedMint === true;
     return true;
   });
@@ -970,7 +978,14 @@ async function buildCreditMenu(args) {
     // a builder who overrides `paymentMethods` can drop x402 from `funding`
     // while the rail stays wired, and terms for a rail the menu doesn't offer
     // are the same misadvertisement in the other direction.
-    ...funding.includes("x402") && x402Schemes.length > 0 && { x402: { schemes: x402Schemes } }
+    ...funding.includes("x402") && x402Schemes.length > 0 && { x402: { schemes: x402Schemes } },
+    ...funding.includes("stripe") && args.stripeNetworkId !== void 0 && {
+      stripe: {
+        network_id: args.stripeNetworkId,
+        min_micro: Math.max(bounds.minMicro, STRIPE_CREDIT_MIN_MICRO),
+        currency: "usd"
+      }
+    }
   };
   if (funding.includes("lightning") && args.lightningFundingMinSats !== void 0) {
     try {
@@ -1050,7 +1065,8 @@ function toCreditTerms(menu) {
     },
     ...menu.lightning_min_micro !== void 0 && {
       lightning_min_micro: menu.lightning_min_micro
-    }
+    },
+    ...menu.stripe && { stripe: { ...menu.stripe } }
   };
 }
 var LIGHTNING_FLOOR_FX_MARGIN = 1.15;
@@ -4256,7 +4272,7 @@ function upfrontPaymentFromDraw(draw) {
       amount_micro: draw.amountMicro,
       currency: value.creditCurrency
     },
-    ...rail === "cashu" || rail === "x402" || rail === "tempo" || rail === "lightning" ? { rail } : {},
+    ...rail !== null && isFundingRail(rail) ? { rail } : {},
     ...value.drawNative !== null && value.nativeAsset !== null && {
       native_amount: value.drawNative,
       native_asset: value.nativeAsset
@@ -4331,8 +4347,10 @@ function decimalsFor(methodName) {
   switch (methodName) {
     case "tempo":
       return 6;
+    case "stripe":
+      return 2;
     default:
-      throw new Error(`mpp-units: unknown method '${methodName}' (expected 'tempo')`);
+      throw new Error(`mpp-units: unknown method '${methodName}' (expected 'tempo' or 'stripe')`);
   }
 }
 function msatsToMethodAmount(msats, methodName, btcUsd) {
@@ -4363,8 +4381,10 @@ function methodNativeAsset(methodName) {
   switch (methodName) {
     case "tempo":
       return "usdc";
+    case "stripe":
+      return "usd-cents";
     default:
-      throw new Error(`mpp-units: unknown method '${methodName}' (expected 'tempo')`);
+      throw new Error(`mpp-units: unknown method '${methodName}' (expected 'tempo' or 'stripe')`);
   }
 }
 function methodNativeAmountFromDecimal(amountStr, methodName) {
@@ -4824,6 +4844,235 @@ async function verifyUpfrontPayment(opts) {
   }
   return result;
 }
+async function verifyCardFunding(opts) {
+  return withPaymentDiagnostics(() => verifyCardFundingInScope(opts));
+}
+async function verifyCardFundingInScope(opts) {
+  const rail = opts.stripeCredit;
+  const { fundOnly, amountMicro } = opts;
+  const resourcePath = opts.resourcePath ?? "/v1/credit";
+  if (!rail || !opts.creditLedger) {
+    return creditRefusal("payment_invalid", "This DVM does not accept card funding.", {
+      status: 409,
+      hint: "Fund the credit over one of the rails listed in credit.funding on /v1/info."
+    });
+  }
+  if (amountMicro % 1e4 !== 0) {
+    return creditRefusal(
+      "payment_invalid",
+      `A card top-up must be a whole number of cents; ${amountMicro} micro-USD is not.`,
+      { status: 400, hint: "Round fund.amount_micro to a multiple of 10000 (one cent) and sign again." }
+    );
+  }
+  const challenge = async () => [
+    await rail.issueChallenge({
+      amountMicro,
+      resourcePath,
+      expires: new Date(Date.now() + UPFRONT_CHALLENGE_TTL_MS).toISOString()
+    })
+  ];
+  const credential = typeof opts.mppCredential === "string" ? opts.mppCredential : void 0;
+  if (!credential) {
+    return {
+      paidMsats: 0,
+      receivedProofs: [],
+      error: {
+        body: {
+          error: "payment_required",
+          amount_micro: amountMicro,
+          currency: "usd",
+          display: "This top-up needs a card payment approved in Link.",
+          hint: 'Build an MPP credential for the attached method="stripe" challenge from the shared payment token (spt_\u2026) your human approved, set fund.commitment to its SHA-256, and resend this fund request, freshly signed, with the credential in the Authorization header.'
+        },
+        status: 402,
+        mppChallenges: await challenge()
+      }
+    };
+  }
+  if (fundingCommitment(credential) !== fundOnly.commitment) {
+    logCreditRejected("fund_commitment_mismatch", fundOnly.creditId);
+    return creditRefusal(
+      "funding_commitment_mismatch",
+      "fund.commitment does not match the SHA-256 of the attached funding artifact."
+    );
+  }
+  const refusal = crossRailRefusal(await opts.creditLedger.get(fundOnly.creditId), {
+    creditId: fundOnly.creditId,
+    binding: { rail: "stripe" }
+  });
+  if (refusal) return refusal;
+  const charged = await withPaymentStage(
+    "verifier_broadcast",
+    () => rail.charge(credential, { amountMicro, resourcePath })
+  );
+  if (!charged.ok) {
+    logCreditRejected(`stripe_${charged.reason}`, fundOnly.creditId, cardLogFields(charged));
+    return cardChargeRefusal(charged, await challenge());
+  }
+  const ledgerCtx = {
+    ledger: opts.creditLedger,
+    processedPayments: opts.processedPayments,
+    enqueueCreditDeposit: opts.enqueueCreditDeposit,
+    priceFiat: { currency: "usd", amountMicro },
+    // A card charge is valued in cents, never through a sats quote.
+    requiredMsats: 0,
+    callerId: opts.callerPubkey ?? opts.requesterId ?? "anonymous",
+    hostingAdmissionId: opts.hostingAdmissionId,
+    hostingPaymentArtifactHash: opts.hostingPaymentArtifactHash,
+    dvmId: opts.dvmId ?? "",
+    fundOnly,
+    drawBasis: false,
+    ttlMs: opts.creditTtlMs ?? IMPLICIT_CREDIT_TTL_MS
+  };
+  const cents = amountMicro / 1e4;
+  let credited;
+  try {
+    credited = await commitMarkedFunding(ledgerCtx, {
+      rail: "stripe",
+      paymentId: charged.paymentIntentId,
+      paidMsats: 0,
+      fundedMicro: amountMicro,
+      nativeAmount: cents,
+      nativeAsset: "usd-cents"
+    });
+  } catch (err) {
+    const mapped = mapLedgerCommitError(err, void 0, true);
+    if (mapped) {
+      logCredentialRejected("stripe", "upfront", err);
+      return mapped.error?.body.error === "replay_rejected" ? cardReplayRefusal(mapped) : mapped;
+    }
+    logCreditRejected("stripe_booking_failed", fundOnly.creditId, {
+      payment_intent: charged.paymentIntentId
+    });
+    return {
+      paidMsats: 0,
+      receivedProofs: [],
+      error: {
+        body: paymentErrorBody("payment_invalid", {
+          message: "The card was charged but the credit could not be recorded.",
+          display: "Your card was charged, but the credit wasn't recorded yet. Sending the same request again will record it without charging again.",
+          hint: "Resend this exact fund request with the same credential and fund_id (re-sign it if the signature has expired). Do not build a new credential: that would be a second charge.",
+          retryable: true,
+          extra: { rail: "stripe", reason: "booking_failed" }
+        }),
+        status: 503
+      }
+    };
+  }
+  return withDrawBasis(
+    {
+      paidMsats: 0,
+      paymentRail: "stripe",
+      receivedProofs: [],
+      paymentTxHash: charged.paymentIntentId,
+      nativeAmount: cents,
+      nativeAsset: "usd-cents"
+    },
+    ledgerCtx,
+    credited
+  );
+}
+function cardLogFields(outcome) {
+  return {
+    message: outcome.message,
+    ...outcome.stripeError?.type && { stripe_error_type: outcome.stripeError.type },
+    ...outcome.stripeError?.code && { stripe_error_code: outcome.stripeError.code },
+    ...outcome.stripeError?.declineCode && { decline_code: outcome.stripeError.declineCode },
+    ...outcome.paymentIntentId && { payment_intent: outcome.paymentIntentId }
+  };
+}
+function cardChargeRefusal(outcome, challenges) {
+  const newApproval = "Ask your human to approve a new top-up in Link for at least this amount, then build a credential from the new shared payment token for the challenge attached to this response, and resend the fund request, freshly signed.";
+  const copy = {
+    invalid_credential: {
+      status: 402,
+      display: "The card payment couldn't be verified, so nothing was charged.",
+      hint: "Build a new credential for the challenge attached to this response, from a shared payment token that hasn't been charged, and resend the fund request, freshly signed.",
+      retryable: false,
+      challenges
+    },
+    declined: {
+      status: 402,
+      display: "The card was declined, so nothing was charged and no credit was added.",
+      hint: `${newApproval} A different card is more likely to work.`,
+      retryable: false,
+      challenges
+    },
+    requires_action: {
+      status: 402,
+      display: "The card needs an extra verification step that can't be completed here, so no credit was added.",
+      hint: "Ask your human to approve a new top-up in Link with a card that doesn't require an extra authentication step, then fund again with the new shared payment token.",
+      retryable: false,
+      challenges
+    },
+    token_unusable: {
+      status: 402,
+      display: "The card approval can't be used for this top-up (it was already used, is for a smaller amount, or has lapsed), so nothing was charged.",
+      hint: `If you already sent this shared payment token in an earlier fund request that got no answer, resend that same request (same credential and fund_id) first: it may have been charged, and the resend records it without charging again. Only if no earlier request used this token: ${newApproval.charAt(0).toLowerCase()}${newApproval.slice(1)} An approval can be charged only once, up to the amount it was approved for.`,
+      retryable: false,
+      challenges
+    },
+    // Charged, but not as this top-up: never booked, and a resend would not change it.
+    mismatch: {
+      status: 502,
+      display: "The card processor reported a charge that doesn't match this top-up, so no credit was added.",
+      hint: "Don't retry with this approval. Tell your human the top-up failed and give the provider the payment_intent reference so they can check the charge.",
+      retryable: false,
+      challenges: []
+    },
+    // Nothing reached Stripe and the approval is unused, so the same credential still works.
+    unavailable: {
+      status: 503,
+      display: "The service couldn't record the payment attempt, so this request did not charge the card and no credit was added.",
+      hint: "Resend this exact fund request with the same credential and fund_id (re-sign it if the signature has expired), within five minutes of the original request. This request charged nothing. If an earlier request with this credential got no answer, it may have charged the card; resending records that charge instead of charging again. If resends keep failing, stop and tell your human.",
+      retryable: true,
+      challenges: []
+    },
+    // No fresh challenge: a new challenge would mean a second PaymentIntent.
+    indeterminate: {
+      status: 503,
+      display: "The card processor didn't confirm the payment. The card may or may not have been charged; no credit was added yet.",
+      hint: "Resend this exact fund request with the same credential and fund_id (re-sign it if the signature has expired), within five minutes of the original request. If the earlier attempt was charged and its answer was lost, the resend records that charge instead of charging again. Do not build a new credential from the same approval. If resends keep failing, stop and tell your human; the provider can trace any charge from its records.",
+      retryable: true,
+      challenges: []
+    }
+  }[outcome.reason];
+  return {
+    paidMsats: 0,
+    receivedProofs: [],
+    error: {
+      body: paymentErrorBody("payment_invalid", {
+        message: `Card funding refused (${outcome.reason}): ${outcome.message}.`,
+        display: copy.display,
+        hint: copy.hint,
+        retryable: copy.retryable,
+        extra: {
+          rail: "stripe",
+          reason: outcome.reason,
+          ...outcome.stripeError?.code && { stripe_error_code: outcome.stripeError.code },
+          ...outcome.stripeError?.declineCode && { decline_code: outcome.stripeError.declineCode },
+          ...outcome.reason === "mismatch" && outcome.paymentIntentId && { payment_intent: outcome.paymentIntentId }
+        }
+      }),
+      status: copy.status,
+      ...copy.challenges.length > 0 && { mppChallenges: copy.challenges }
+    }
+  };
+}
+function cardReplayRefusal(mapped) {
+  if (!mapped.error) return mapped;
+  return {
+    ...mapped,
+    error: {
+      ...mapped.error,
+      body: {
+        ...mapped.error.body,
+        display: "This card payment was already used to add credit, so it wasn't charged or added again.",
+        hint: "Don't resend this credential. To add more credit, ask your human to approve a new top-up in Link and fund with the new shared payment token under a new fund_id."
+      }
+    }
+  };
+}
 async function verifyUpfrontPaymentInScope(opts) {
   const {
     cashuToken,
@@ -5180,7 +5429,7 @@ async function verifyUpfrontPaymentInScope(opts) {
           x402Requirements
         });
       }
-      const { verifyX402Payment } = await import("./x402-XLFD43RF.js");
+      const { verifyX402Payment } = await import("./x402-MFBRORHG.js");
       const receipt = await withPaymentStage("verifier_broadcast", () => verifyX402Payment(
         x402Payment,
         x402Config,
@@ -5872,6 +6121,11 @@ var PAYMENT_ERROR_COPY = {
     hint: "Do not retry, top up, or drain this credit. Pay per call or open a separate prepaid balance.",
     retryable: false
   },
+  credit_closed: {
+    display: "This card-funded balance is closed: either its expired balance was refunded to the card, or a dispute on the card payment froze it. It can't pay for jobs, take a top-up, or be drained.",
+    hint: "Do not retry with this credit_id. Pay per call, or open a new prepaid balance by funding without a credit_id.",
+    retryable: false
+  },
   credit_not_found: {
     display: "No prepaid balance exists at this service under the referenced credit. Nothing was charged.",
     hint: 'Check the credit_id, or open one at POST /v1/credit (op "fund") before drawing on it.',
@@ -6236,7 +6490,7 @@ async function verifyIncomingPaymentInScope(body, opts, snapshot) {
           snapshot
         });
       }
-      const { verifyX402Payment } = await import("./x402-XLFD43RF.js");
+      const { verifyX402Payment } = await import("./x402-MFBRORHG.js");
       const receipt = await withPaymentStage("verifier_broadcast", () => verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -6688,7 +6942,7 @@ async function processIncomingPaymentInScope(job, body, opts) {
     try {
       const requiredMsats = job.pendingPaymentMsats ?? 0;
       const requiredUsdcMicro = job.pendingX402AmountUsdcMicro !== void 0 ? BigInt(job.pendingX402AmountUsdcMicro) : BigInt(msatsToUsdc(requiredMsats, rate));
-      const { verifyX402Payment } = await import("./x402-XLFD43RF.js");
+      const { verifyX402Payment } = await import("./x402-MFBRORHG.js");
       const receipt = await withPaymentStage("verifier_broadcast", () => verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -7974,7 +8228,7 @@ function mapLedgerCommitError(err, x402Requirements, paymentCommitted = false) {
   return void 0;
 }
 function creditLedgerErrorResult(err, x402Requirements, funding, paymentCommitted = false) {
-  const code = err.code === "insufficient_credit" || err.code === "credit_expired" || err.code === "credit_unbacked" || err.code === "credit_not_found" || err.code === "tempo_channel_closing" || err.code === "settlement_pending" || err.code === "draw_conflict" ? err.code : "payment_invalid";
+  const code = err.code === "insufficient_credit" || err.code === "credit_expired" || err.code === "credit_unbacked" || err.code === "credit_closed" || err.code === "credit_not_found" || err.code === "tempo_channel_closing" || err.code === "settlement_pending" || err.code === "draw_conflict" ? err.code : "payment_invalid";
   if (code === "payment_invalid") logCreditRejected(err.code, void 0);
   const extra = {};
   if (err.details.availableMicro !== void 0) {
@@ -8296,6 +8550,8 @@ function authErrorBody(err, opts = {}) {
   const subReason = err.sub_reason === "schema_invalid" ? "signature_invalid" : err.sub_reason;
   const display = (() => {
     switch (subReason) {
+      case "signature_required":
+        return "This capability requires a signed request";
       case "signature_invalid":
         return "Request signature didn't match the supplied pubkey";
       case "timestamp_drift":
@@ -8310,7 +8566,7 @@ function authErrorBody(err, opts = {}) {
     error: "auth_error",
     sub_reason: subReason,
     display,
-    hint: "Regenerate the request with the current timestamp + a fresh nonce; sign with secp256k1+BIP-340 Schnorr over the canonical JSON form of the input."
+    hint: subReason === "signature_required" ? "Run `npx @dvmkit/dvm-cli init`, then use `dvm request` to sign and send the request, or implement secp256k1+BIP-340 Schnorr signing with the domain-bound envelope described at https://dvmkit.com/docs/protocol." : "Regenerate the request with the current timestamp + a fresh nonce; sign with secp256k1+BIP-340 Schnorr over the canonical JSON form of the input."
   };
 }
 function infoSchemaUrl(requestUrl, publicOrigin) {
@@ -8482,6 +8738,401 @@ async function drawFundingReceiptFor(ledger, issuer, funding, currency) {
   return isDrawFundingReceipt(saved) ? saved : void 0;
 }
 
+// src/sdk/server/stripe-drain-leg.ts
+import { createHash as createHash7 } from "crypto";
+
+// src/sdk/server/stripe-refund-api.ts
+var StripeApiError = class extends Error {
+  status;
+  type;
+  code;
+  constructor(status, codes) {
+    super(status === 0 ? "Stripe could not be reached" : `Stripe answered HTTP ${status}`);
+    this.name = "StripeApiError";
+    this.status = status;
+    if (codes.type) this.type = codes.type;
+    if (codes.code) this.code = codes.code;
+  }
+  /** Stripe looked at the request and refused it; repeating it unchanged will not help. */
+  get rejected() {
+    return this.status >= 400 && this.status < 500 && this.status !== 409 && this.status !== 429;
+  }
+};
+function createStripeRefundApi(opts) {
+  const apiBase = opts.apiBase ?? "https://api.stripe.com";
+  const fetchImpl = opts.fetch ?? fetch;
+  const auth = `Basic ${Buffer.from(`${opts.secretKey}:`).toString("base64")}`;
+  const call = async (method, path, args = {}) => {
+    const url = `${apiBase}${path}${args.query ? `?${args.query.toString()}` : ""}`;
+    let response;
+    try {
+      response = await fetchImpl(url, {
+        method,
+        headers: {
+          Authorization: auth,
+          ...args.form && { "Content-Type": "application/x-www-form-urlencoded" },
+          ...args.idempotencyKey && { "Idempotency-Key": args.idempotencyKey }
+        },
+        ...args.form && { body: args.form }
+      });
+    } catch {
+      throw new StripeApiError(0, {});
+    }
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok) {
+      const error = body.error ?? {};
+      throw new StripeApiError(response.status, {
+        type: enumField(error.type),
+        code: enumField(error.code)
+      });
+    }
+    return body;
+  };
+  return {
+    async retrieveCharge(paymentIntentId) {
+      const query = new URLSearchParams([["expand[]", "latest_charge.balance_transaction"]]);
+      const pi = await call("GET", `/v1/payment_intents/${encodeURIComponent(paymentIntentId)}`, {
+        query
+      });
+      const charge = isRecord2(pi.latest_charge) ? pi.latest_charge : void 0;
+      const txn = charge && isRecord2(charge.balance_transaction) ? charge.balance_transaction : void 0;
+      return {
+        paymentIntentId,
+        status: stringOr(pi.status, "unknown"),
+        amount: integerOr(pi.amount, 0),
+        currency: stringOr(pi.currency, ""),
+        amountRefunded: integerOr(charge?.amount_refunded, 0),
+        disputed: charge?.disputed === true,
+        fee: txn && Number.isSafeInteger(txn.fee) && Number.isSafeInteger(txn.amount) && txn.amount > 0 ? { fee: txn.fee, settledAmount: txn.amount } : null
+      };
+    },
+    async listRefunds(paymentIntentId) {
+      const query = new URLSearchParams({ payment_intent: paymentIntentId, limit: "100" });
+      const page = await call("GET", "/v1/refunds", { query });
+      return arrayOf(page.data).map(refundFrom);
+    },
+    async createRefund(args) {
+      const form = new URLSearchParams({
+        payment_intent: args.paymentIntentId,
+        amount: String(args.amount)
+      });
+      for (const [key, value] of Object.entries(args.metadata)) form.set(`metadata[${key}]`, value);
+      return refundFrom(
+        await call("POST", "/v1/refunds", { form, idempotencyKey: args.idempotencyKey })
+      );
+    },
+    async retrieveRefund(refundId) {
+      return refundFrom(await call("GET", `/v1/refunds/${encodeURIComponent(refundId)}`));
+    },
+    async listDisputes(args) {
+      const query = new URLSearchParams({ "created[gte]": String(args.createdGte), limit: "100" });
+      if (args.startingAfter) query.set("starting_after", args.startingAfter);
+      const page = await call("GET", "/v1/disputes", { query });
+      return {
+        disputes: arrayOf(page.data).map((d) => ({
+          id: stringOr(d.id, ""),
+          paymentIntentId: typeof d.payment_intent === "string" ? d.payment_intent : null,
+          status: stringOr(d.status, "unknown"),
+          created: integerOr(d.created, 0)
+        })),
+        hasMore: page.has_more === true
+      };
+    },
+    async listDisputesForPaymentIntent(paymentIntentId) {
+      const query = new URLSearchParams({ payment_intent: paymentIntentId, limit: "100" });
+      const page = await call("GET", "/v1/disputes", { query });
+      return {
+        disputes: arrayOf(page.data).map((d) => ({
+          id: stringOr(d.id, ""),
+          paymentIntentId: typeof d.payment_intent === "string" ? d.payment_intent : null,
+          status: stringOr(d.status, "unknown"),
+          created: integerOr(d.created, 0)
+        })),
+        hasMore: page.has_more === true
+      };
+    },
+    async searchPaymentIntentsByMetadata(key, value) {
+      if (!/^[A-Za-z0-9_-]+$/.test(key) || !/^[A-Za-z0-9_-]+$/.test(value)) return [];
+      const query = new URLSearchParams({ query: `metadata['${key}']:'${value}'`, limit: "20" });
+      const page = await call("GET", "/v1/payment_intents/search", { query });
+      return arrayOf(page.data).map((pi) => ({
+        id: stringOr(pi.id, ""),
+        status: stringOr(pi.status, "unknown"),
+        amount: integerOr(pi.amount, 0),
+        currency: stringOr(pi.currency, ""),
+        created: integerOr(pi.created, 0)
+      }));
+    }
+  };
+}
+function refundFrom(body) {
+  const metadata = {};
+  if (isRecord2(body.metadata)) {
+    for (const [key, value] of Object.entries(body.metadata)) {
+      if (typeof value === "string") metadata[key] = value;
+    }
+  }
+  return {
+    id: stringOr(body.id, ""),
+    status: stringOr(body.status, "unknown"),
+    amount: integerOr(body.amount, 0),
+    paymentIntentId: typeof body.payment_intent === "string" ? body.payment_intent : null,
+    metadata
+  };
+}
+function enumField(value) {
+  return typeof value === "string" && /^[a-z0-9_]{1,64}$/.test(value) ? value : void 0;
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function arrayOf(value) {
+  return Array.isArray(value) ? value.filter(isRecord2) : [];
+}
+function stringOr(value, fallback) {
+  return typeof value === "string" ? value : fallback;
+}
+function integerOr(value, fallback) {
+  return Number.isSafeInteger(value) ? value : fallback;
+}
+
+// src/sdk/server/stripe-drain-leg.ts
+var MICRO_PER_CENT = 1e4;
+async function runStripeDrain(deps, drain) {
+  if (drain.method !== "stripe" || drain.status !== "pending") {
+    return { drain, completed: false };
+  }
+  const save = deps.ledger.saveCardRefund?.bind(deps.ledger);
+  if (!save) throw new Error("this credit ledger cannot record card refunds");
+  let plan = drain.cardRefund ?? null;
+  if (!plan) {
+    try {
+      const fresh = await planCardRefund(deps, drain);
+      plan = await save({
+        creditId: drain.creditId,
+        drainId: drain.drainId,
+        plan: fresh,
+        onlyIfUnset: true
+      });
+    } catch (err) {
+      logPending(drain, { stage: "plan", error_code: failureCode(err) });
+      return { drain, completed: false };
+    }
+    if (!plan) return { drain: await reread(deps, drain), completed: false };
+  }
+  plan = structuredClone(plan);
+  for (const entry of plan.entries) {
+    if (entry.amountCents <= 0 || entry.status === "succeeded") continue;
+    const status = await advanceRefund(deps.stripe, drain, entry);
+    if (status !== "succeeded") {
+      logPending(drain, {
+        stage: "refund",
+        payment_intent: entry.paymentIntentId,
+        refund_status: entry.status,
+        error_code: entry.lastError ?? void 0
+      });
+    }
+  }
+  const stored = await save({ creditId: drain.creditId, drainId: drain.drainId, plan });
+  if (stored) plan = stored;
+  if (!refundsFinished(plan)) {
+    return { drain: { ...await reread(deps, drain), cardRefund: plan }, completed: false };
+  }
+  const result = await commitTerminalDrain(
+    deps.drainReport,
+    (tx) => deps.ledger.markDrainSent({
+      creditId: drain.creditId,
+      drainId: drain.drainId,
+      sentRef: cardRefundSentRef(plan),
+      tx
+    })
+  );
+  let record = result.drain;
+  if (!result.replayed && deps.receiptIssuer) {
+    const receipt = deps.receiptIssuer.issueDrain({
+      creditId: record.creditId,
+      drainId: record.drainId,
+      event: "sent",
+      method: record.method,
+      amountMicro: record.amountMicro,
+      balanceAfterMicro: record.balanceAfterMicro,
+      ledgerSeq: record.ledgerSeq,
+      callerPubkey: record.callerPubkey
+    });
+    await deps.ledger.appendDrainReceipt({
+      creditId: record.creditId,
+      drainId: record.drainId,
+      receipt
+    });
+    record = { ...record, receipts: [...record.receipts, receipt] };
+  }
+  return { drain: record, completed: !result.replayed };
+}
+function proportionalFeeShare(grossCents, fee) {
+  const share = Math.floor(
+    (2 * grossCents * fee.fee + fee.settledAmount) / (2 * fee.settledAmount)
+  );
+  return Math.min(grossCents, Math.max(0, share));
+}
+function cardRefundSummary(plan) {
+  return {
+    grossCents: plan.grossCents,
+    refundedCents: sum(plan.entries.map((entry) => entry.amountCents)),
+    feeShareCents: sum(plan.entries.map((entry) => entry.feeShareCents)),
+    subCentMicro: plan.subCentMicro,
+    refundIds: plan.entries.flatMap((entry) => entry.refundId ? [entry.refundId] : [])
+  };
+}
+function usdFromCents(cents) {
+  return `$${(cents / 100).toFixed(2)}`;
+}
+async function planCardRefund(deps, drain) {
+  const lots = (await deps.ledger.listFundingLots(drain.creditId)).filter(
+    (lot) => isCardFundedRail(lot.rail) && lot.fundingRef?.startsWith("pi_")
+  );
+  const grossCents = Math.floor(drain.amountMicro / MICRO_PER_CENT);
+  const entries = [];
+  let left = grossCents;
+  for (const lot of lots) {
+    if (left === 0) break;
+    const charge = await deps.stripe.retrieveCharge(lot.fundingRef);
+    assertRefundable(charge);
+    const gross = Math.min(left, charge.amount - charge.amountRefunded);
+    if (gross <= 0) continue;
+    const feeShare = proportionalFeeShare(gross, charge.fee);
+    entries.push({
+      lotId: lot.lotId,
+      paymentIntentId: charge.paymentIntentId,
+      grossCents: gross,
+      feeShareCents: feeShare,
+      amountCents: gross - feeShare,
+      attempt: 1,
+      refundId: null,
+      status: "planned",
+      lastError: null
+    });
+    left -= gross;
+  }
+  if (left > 0) throw new CardRefundPlanError("charges_exhausted");
+  return { grossCents, subCentMicro: drain.amountMicro - grossCents * MICRO_PER_CENT, entries };
+}
+var CardRefundPlanError = class extends Error {
+  constructor(code) {
+    super(`card refund cannot be planned: ${code}`);
+    this.code = code;
+    this.name = "CardRefundPlanError";
+  }
+  code;
+};
+function assertRefundable(charge) {
+  if (charge.status !== "succeeded" || charge.currency !== "usd") {
+    throw new CardRefundPlanError("charge_not_refundable");
+  }
+  if (!charge.fee) throw new CardRefundPlanError("fee_not_settled");
+}
+async function advanceRefund(stripe, drain, entry) {
+  await advanceRefundOnce(stripe, drain, entry);
+  return entry.status;
+}
+async function advanceRefundOnce(stripe, drain, entry) {
+  const tag = refundDrainTag(drain);
+  try {
+    if (entry.refundId && isOpenStatus(entry.status)) {
+      const refund2 = await stripe.retrieveRefund(entry.refundId);
+      setStatus(entry, refund2.status);
+      return;
+    }
+    const existing = (await stripe.listRefunds(entry.paymentIntentId)).find(
+      (refund2) => refund2.metadata.dvmkit_drain === tag && refund2.metadata.dvmkit_lot === entry.lotId && refund2.status !== "failed" && refund2.status !== "canceled"
+    );
+    if (existing) {
+      entry.refundId = existing.id;
+      setStatus(entry, existing.status);
+      return;
+    }
+    if (entry.status === "rejected" || entry.status === "failed" || entry.status === "canceled") {
+      entry.attempt += 1;
+    }
+    const refund = await stripe.createRefund({
+      paymentIntentId: entry.paymentIntentId,
+      amount: entry.amountCents,
+      idempotencyKey: refundIdempotencyKey(drain, entry),
+      metadata: { dvmkit_drain: tag, dvmkit_lot: entry.lotId, dvmkit_attempt: String(entry.attempt) }
+    });
+    entry.refundId = refund.id;
+    setStatus(entry, refund.status);
+  } catch (err) {
+    if (err instanceof StripeApiError && err.rejected) entry.status = "rejected";
+    entry.lastError = failureCode(err);
+  }
+}
+function setStatus(entry, status) {
+  switch (status) {
+    case "succeeded":
+    case "pending":
+    case "requires_action":
+    case "failed":
+    case "canceled":
+      entry.status = status;
+      entry.lastError = status === "failed" || status === "canceled" ? status : null;
+      return;
+    default:
+      entry.status = "pending";
+  }
+}
+function isOpenStatus(status) {
+  return status === "pending" || status === "requires_action" || status === "planned";
+}
+function refundsFinished(plan) {
+  return plan.entries.every((entry) => entry.amountCents <= 0 || entry.status === "succeeded");
+}
+function refundIdempotencyKey(drain, entry) {
+  const digest = createHash7("sha256").update([drain.creditId, drain.drainId, entry.lotId, String(entry.attempt)].join("\0")).digest("hex");
+  return `dvmkit-card-refund-${digest}`;
+}
+function cardRefundSentRef(plan) {
+  const summary = cardRefundSummary(plan);
+  return {
+    refund_ids: summary.refundIds,
+    refunded_cents: summary.refundedCents,
+    fee_share_cents: summary.feeShareCents,
+    sub_cent_micro: summary.subCentMicro,
+    refunds: plan.entries.map((entry) => ({
+      payment_intent: entry.paymentIntentId,
+      refund_id: entry.refundId,
+      gross_cents: entry.grossCents,
+      fee_share_cents: entry.feeShareCents,
+      amount_cents: entry.amountCents
+    }))
+  };
+}
+async function reread(deps, drain) {
+  return await deps.ledger.getDrain({ creditId: drain.creditId, drainId: drain.drainId }) ?? drain;
+}
+function failureCode(err) {
+  if (err instanceof CardRefundPlanError) return err.code;
+  if (err instanceof StripeApiError) {
+    return err.code ?? err.type ?? (err.status === 0 ? "stripe_unreachable" : `http_${err.status}`);
+  }
+  return "internal_error";
+}
+function refundDrainTag(drain) {
+  const tag = `${drain.creditId}:${drain.drainId}`;
+  if (tag.length <= 200) return tag;
+  return `sha256:${createHash7("sha256").update(tag).digest("hex")}`;
+}
+function logPending(drain, fields) {
+  diagnosticConsole.warn({
+    event: "card_refund_pending",
+    credit_id: drain.creditId,
+    drain_id: drain.drainId,
+    ...fields
+  });
+}
+function sum(values) {
+  return values.reduce((total, value) => total + value, 0);
+}
+
 // src/sdk/server/tempo-drain-leg.ts
 async function completeTempoChannelDrain(args) {
   if (!args.tx && args.refundedNative !== void 0 && /^\d{1,78}$/.test(String(args.refundedNative))) {
@@ -8627,9 +9278,10 @@ var CREDIT_REQUEST_SCHEMA = z.object({
     /**
      * Lightning names an invoice request; MPP names the charge/session
      * intent before a credential exists, so a bound credit can refuse the
-     * wrong instrument before issuing or broadcasting anything.
+     * wrong instrument before issuing or broadcasting anything. Stripe names
+     * a card top-up: its MPP `method="stripe"` challenge is issued only here.
      */
-    method: z.enum(["lightning", "tempo"]).optional(),
+    method: z.enum(["lightning", "tempo", "stripe"]).optional(),
     /** Required with `method: "tempo"`; invalid on every other funding rail. */
     intent: z.enum(["charge", "session"]).optional()
   }).optional(),
@@ -8858,6 +9510,9 @@ async function handleDrain(c, deps, args) {
       if (isHttpResponse(completed)) return completed;
       existing = completed;
     }
+    if (existing.method === "stripe" && existing.status === "pending" && deps.stripeCredit) {
+      existing = (await runStripeDrain(stripeLegDeps(deps, deps.stripeCredit), existing)).drain;
+    }
     return respondDrain(c, deps, { record: await deliverIfParked(deps, existing), credit });
   }
   if (credit.tempoChannelId && drain.method !== "tempo") {
@@ -8883,8 +9538,17 @@ async function handleDrain(c, deps, args) {
   }
   const rejected = await burnNonce(c, deps, args.envelope);
   if (rejected) return rejected;
+  if (isCardFundedRail(credit.rail) && drain.method !== "stripe") {
+    return c.json(cardCreditNotDrainable(credit), 409);
+  }
+  if (drain.method === "stripe" && !isCardFundedRail(credit.rail)) {
+    return c.json(cardRefundOfNonCardCredit(credit), 409);
+  }
   const target = validateDrainTarget(drain);
   if ("error" in target) return c.json(target.error, 400);
+  if (target.method === "stripe") {
+    return handleCardRefundDrain(c, deps, { creditId, drainId: drain.drain_id, callerPubkey: args.callerPubkey });
+  }
   const railMismatch = railMismatchRefusal(credit, target.method);
   if (railMismatch) return c.json(railMismatch, 400);
   const tempoChargeDrain = target.method === "tempo" && !credit.tempoChannelId;
@@ -9641,13 +10305,14 @@ async function respondDrain(c, deps, args) {
     ...drainCopy(args.record)
   });
 }
+var MAX_CARD_REFUND_DRAIN_ID = 128;
 function validateDrainTarget(drain) {
   const refuse = (message, hint) => ({
     error: { error: "invalid_request", message, hint }
   });
   const missingFields = () => refuse(
     "A new drain requires drain.method and drain.payout.",
-    'Send drain: { drain_id, method: "cashu" | "x402" | "tempo", payout: { \u2026 } }. Only a poll of an existing drain_id may omit them.'
+    'Send drain: { drain_id, method: "cashu" | "x402" | "tempo", payout: { \u2026 } }, or { drain_id, method: "stripe" } for card-funded credit. Only a poll of an existing drain_id may omit them.'
   );
   const method = drain.method;
   if (!method) return missingFields();
@@ -9655,10 +10320,33 @@ function validateDrainTarget(drain) {
     return {
       error: paymentErrorBody("drain_method_unsupported", {
         message: `"${method}" is not a payout rail this service reclaims over.`,
-        extra: { supported_methods: [...DRAIN_METHODS], drain_registered: false }
+        // Payout rails only: a card refund is not one, and card credit is pointed at it by its own refusal.
+        extra: { supported_methods: DRAIN_METHODS.filter((m) => m !== "stripe"), drain_registered: false }
       })
     };
   }
+  if (method === "stripe") {
+    const named = Object.values(drain.payout ?? {}).some((value) => value !== void 0 && value !== "");
+    if (named) {
+      return refuse(
+        "stripe drains carry no payout destination: the refund goes back to the card that paid for the credit.",
+        'Send drain: { drain_id, method: "stripe" } with no payout.'
+      );
+    }
+    if (drain.drain_id.length > MAX_CARD_REFUND_DRAIN_ID) {
+      return refuse(
+        `stripe drain ids are at most ${MAX_CARD_REFUND_DRAIN_ID} characters.`,
+        "Choose a shorter drain_id, such as a UUID."
+      );
+    }
+    if (drain.drain_id.startsWith(CARD_EXPIRY_DRAIN_PREFIX)) {
+      return refuse(
+        `drain ids starting "${CARD_EXPIRY_DRAIN_PREFIX}" are reserved for the refund this service makes when a card balance expires.`,
+        "Choose a drain_id that does not start with that prefix, such as a UUID."
+      );
+    }
+    return { method: "stripe", payout: {} };
+  }
   if (!drain.payout && method !== "tempo") return missingFields();
   switch (method) {
     case "cashu": {
@@ -9687,9 +10375,70 @@ function validateDrainTarget(drain) {
     }
   }
 }
+function cardCreditNotDrainable(credit) {
+  return {
+    error: "card_credit_not_drainable",
+    message: "This credit was funded by card. Card credit is refunded to the card that paid for it, never paid out on another rail.",
+    display: credit.expired ? "This balance was paid by card and has expired, so it can only go back to that card. It will be refunded there automatically, or you can ask for the refund now." : "This balance was paid by card, so it can only go back to that card.",
+    hint: `Drain it with method "stripe" and no payout ('dvm credit drain <dvm> --method stripe'); no other method is accepted for card-funded credit. The refund goes to the card, less the refund's share of Stripe's card processing fee.`,
+    retryable: false
+  };
+}
+function cardRefundOfNonCardCredit(credit) {
+  return {
+    error: "invalid_request",
+    message: `This credit was funded over ${credit.rail ?? "another rail"}, not by card, so it cannot be refunded to a card.`,
+    hint: 'Reclaim it on the rail that funded it; method "stripe" only refunds credit that a card paid for.',
+    retryable: false,
+    ...credit.rail ? { credit_rail: credit.rail } : {}
+  };
+}
+async function handleCardRefundDrain(c, deps, args) {
+  const stripeCredit = deps.stripeCredit;
+  if (!stripeCredit) {
+    return c.json(
+      {
+        error: "card_refund_unavailable",
+        message: "This service is not configured for card refunds right now, so nothing was drained.",
+        hint: "Retry later with the same drain_id. Your balance is unchanged and stays yours.",
+        retryable: true
+      },
+      503
+    );
+  }
+  try {
+    const result = await deps.ledger.requestDrain({
+      creditId: args.creditId,
+      drainId: args.drainId,
+      callerPubkey: args.callerPubkey,
+      method: "stripe",
+      payout: {}
+    });
+    let record = result.drain;
+    if (!result.replayed && deps.receiptIssuer) {
+      record = await countersignDrain(deps, record, "requested");
+    }
+    record = (await runStripeDrain(stripeLegDeps(deps, stripeCredit), record)).drain;
+    return await respondDrain(c, deps, { record, credit: result.credit });
+  } catch (err) {
+    if (err instanceof CreditLedgerError) {
+      return drainLedgerErrorResponse(err, args.creditId, args.drainId);
+    }
+    throw err;
+  }
+}
+function stripeLegDeps(deps, stripeCredit) {
+  return {
+    ledger: deps.ledger,
+    drainReport: deps.drainReport,
+    stripe: stripeCredit.refunds,
+    ...deps.receiptIssuer && { receiptIssuer: deps.receiptIssuer }
+  };
+}
 function railMismatchRefusal(credit, method) {
   if (method !== "x402" && method !== "tempo") return void 0;
   if (!isFundingRail(credit.rail) || credit.rail === method) return void 0;
+  if (isCardFundedRail(credit.rail)) return cardCreditNotDrainable(credit);
   const target = credit.rail === "cashu" || credit.rail === "lightning" ? "--method cashu" : `--method ${credit.rail} --address 0x\u2026`;
   return {
     error: "invalid_request",
@@ -9727,10 +10476,57 @@ function drainBody(record) {
     created_at: record.createdAt,
     ...record.token !== null ? { token: record.token } : {},
     ...record.sentRef !== null ? { sent: record.sentRef } : {},
+    ...record.method === "stripe" ? cardRefundBody(record) : {},
     receipts: record.receipts
   };
 }
+function cardRefundBody(record) {
+  if (!record.cardRefund) return { refund_ids: [] };
+  const summary = cardRefundSummary(record.cardRefund);
+  return {
+    refund_ids: summary.refundIds,
+    card_refund: {
+      refunded_usd: usdFromCents(summary.refundedCents),
+      stripe_fee_share_usd: usdFromCents(summary.feeShareCents),
+      refunded_cents: summary.refundedCents,
+      stripe_fee_share_cents: summary.feeShareCents,
+      sub_cent_micro: summary.subCentMicro,
+      refunds: record.cardRefund.entries.map((entry) => ({
+        refund_id: entry.refundId,
+        amount_cents: entry.amountCents,
+        fee_share_cents: entry.feeShareCents,
+        status: entry.status
+      }))
+    }
+  };
+}
+function cardRefundCopy(record) {
+  const sent = record.status === "sent";
+  if (!record.cardRefund) {
+    return {
+      display: "The refund to your card is approved and the balance is set aside for it, but the card processor hasn't been reached yet.",
+      hint: "Poll this op with the same drain_id; each poll retries the refund. The balance stays owed to the card until it goes through."
+    };
+  }
+  const summary = cardRefundSummary(record.cardRefund);
+  const gross = usdFromCents(summary.grossCents);
+  const fee = summary.feeShareCents > 0 ? ` ${usdFromCents(summary.feeShareCents)} of the ${gross} balance was kept to cover this refund's share of Stripe's card processing fee: Stripe charged that fee when the card paid and does not return it on a refund.` : "";
+  const dust = summary.subCentMicro > 0 ? " Less than one cent of the balance could not be refunded, because cards are refunded in whole cents." : "";
+  if (sent) {
+    return {
+      display: `${usdFromCents(summary.refundedCents)} went back to the card that paid for this credit.${fee}${dust} Card refunds usually show on the statement within 5 to 10 business days.`,
+      hint: "See refund_ids for the Stripe refund references. Nothing else to do."
+    };
+  }
+  return {
+    display: `A refund of ${usdFromCents(summary.refundedCents)} to the card that paid for this credit is under way and the balance is set aside for it.${fee}${dust}`,
+    hint: "Poll this op with the same drain_id; each poll retries any refund the card processor hasn't finished, and it flips to sent once every refund has gone through. No refund is made twice."
+  };
+}
 function drainCopy(record) {
+  if (record.method === "stripe" && (record.status === "pending" || record.status === "sent")) {
+    return cardRefundCopy(record);
+  }
   switch (record.status) {
     case "pending":
       if (record.method === "cashu") {
@@ -9870,26 +10666,36 @@ async function handleFund(c, deps, args) {
     tempoIntent: fund.method === "tempo" ? fund.intent : void 0
   });
   if (sizing) return sizing;
+  if (fund.method === "stripe" && (!menu.stripe || !deps.stripeCredit)) {
+    return jsonPaymentError("payment_invalid", 409, {
+      message: "This DVM does not offer card funding for prepaid credit.",
+      display: "This service doesn't take card payments for prepaid credit. Nothing was charged.",
+      hint: "Fund the credit over one of the rails listed in credit.funding on /v1/info.",
+      extra: { alternatives: menu.funding.filter((rail) => rail !== "stripe") }
+    });
+  }
   if (fund.method === "tempo" && fund.intent === "charge" && !stablecoinCreditInstrumentAllowed(deps.creditConfig?.allowOneShotStablecoin, "tempo_charge")) {
     return jsonPaymentError("one_shot_credit_not_supported", 409, {
       message: "Tempo charge remains available for per-call payment, but this DVM accepts only reusable Tempo sessions for prepaid credit."
     });
   }
-  let requiredMsats;
-  try {
-    const fx = await deps.fxFetcher.fetch();
-    requiredMsats = fiatToSatsCeil(fund.amount_micro / 1e6, fxRateFor(fx, menu.currency)) * 1e3;
-  } catch {
-    return c.json(
-      {
-        error: "fx_rate_unavailable",
-        message: `Could not price a ${menu.currency} top-up in sats right now.`,
-        display: "The service can't work out the exchange rate right now. Nothing was charged.",
-        hint: "Retry in a few moments.",
-        retryable: true
-      },
-      503
-    );
+  let requiredMsats = 0;
+  if (fund.method !== "stripe") {
+    try {
+      const fx = await deps.fxFetcher.fetch();
+      requiredMsats = fiatToSatsCeil(fund.amount_micro / 1e6, fxRateFor(fx, menu.currency)) * 1e3;
+    } catch {
+      return c.json(
+        {
+          error: "fx_rate_unavailable",
+          message: `Could not price a ${menu.currency} top-up in sats right now.`,
+          display: "The service can't work out the exchange rate right now. Nothing was charged.",
+          hint: "Retry in a few moments.",
+          retryable: true
+        },
+        503
+      );
+    }
   }
   if (fund.method === "lightning") {
     return lightningIssue(c, deps, {
@@ -9910,7 +10716,13 @@ async function handleFund(c, deps, args) {
     const result = await loggers.isolate.span(
       "dvm.credit.fund",
       { required_msats: requiredMsats },
-      () => verifyUpfrontPayment({
+      () => fund.method === "stripe" ? verifyCardFunding({
+        ...railOpts,
+        stripeCredit: deps.stripeCredit,
+        amountMicro: fund.amount_micro,
+        callerPubkey: args.callerPubkey,
+        fundOnly: { creditId, fundId: fund.fund_id, commitment }
+      }) : verifyUpfrontPayment({
         ...railOpts,
         requiredMsats,
         priceFiat: { currency: menu.currency, amountMicro: fund.amount_micro },
@@ -10194,6 +11006,19 @@ async function checkSizing(deps, args) {
       extra: { min_micro: menu.min_micro, max_micro: menu.max_micro, currency: menu.currency }
     });
   }
+  if (args.rail === "stripe" && menu.stripe && args.amountMicro < menu.stripe.min_micro) {
+    return jsonPaymentError("below_rail_minimum", 400, {
+      message: `Top-up of ${args.amountMicro} micro-${menu.currency.toUpperCase()} is below the ${menu.stripe.min_micro} micro-${menu.currency.toUpperCase()} card minimum.`,
+      display: "Card top-ups start at $0.50. Nothing was charged.",
+      hint: `Ask for a top-up of at least ${menu.stripe.min_micro} micro-USD ($0.50) and sign the fund request again with that amount.`,
+      extra: {
+        rail: "stripe",
+        min_micro: menu.stripe.min_micro,
+        alternatives: menu.funding.filter((rail) => rail !== "stripe"),
+        currency: menu.currency
+      }
+    });
+  }
   const floorSats = deps.lightning?.receive.fundingMinSats;
   if (args.rail === "lightning" && floorSats !== void 0) {
     let fx;
@@ -10221,7 +11046,7 @@ async function checkSizing(deps, args) {
   const held = await deps.ledger.getForCaller(args.callerPubkey);
   const target = await checkTargetCredit(deps, { ...args, held });
   if (target) return target;
-  const heldMicro = held.filter((credit) => spendable(credit, menu.currency)).reduce((sum, credit) => sum + credit.availableMicro, 0);
+  const heldMicro = held.filter((credit) => spendable(credit, menu.currency)).reduce((sum2, credit) => sum2 + credit.availableMicro, 0);
   const fundableMicro = menu.max_micro - heldMicro;
   if (args.amountMicro > fundableMicro) {
     return jsonPaymentError("credit_over_max", 400, {
@@ -10244,6 +11069,17 @@ async function checkTargetCredit(deps, args) {
         message: `Credit ${args.creditId} is terminal because its Tempo backing finalized before the DVM was protected.`
       });
     }
+    if (mine.status === "refunded" || mine.status === "disputed") {
+      return jsonPaymentError("credit_closed", 409, {
+        message: mine.status === "refunded" ? `Credit ${args.creditId} is closed: its expired card balance was refunded to the card.` : `Credit ${args.creditId} is frozen: a card payment that funded it is disputed.`
+      });
+    }
+    if (isCardFundedRail(mine.rail) && mine.expiryMs <= Date.now()) {
+      return jsonPaymentError("credit_closed", 409, {
+        message: `Credit ${args.creditId} expired; its card balance is being refunded to the card.`,
+        hint: "Omit credit_id (or use a new fund_id) to open a new prepaid balance. The expired balance comes back to the card on its own."
+      });
+    }
     if (mine.currency !== args.menu.currency) {
       return jsonPaymentError("payment_invalid", 400, {
         message: `Credit ${args.creditId} is denominated in ${mine.currency}, not ${args.menu.currency}.`
@@ -10388,6 +11224,12 @@ var DRAIN_CONFLICT_COPY = {
     retryable: true,
     drainRegistered: false
   },
+  card_refund_pending: {
+    display: "A refund of this prepaid balance to your card is already in progress, so a second one was not started. Nothing changed.",
+    hint: ({ blockingDrainId }) => `Poll drain ${blockingDrainId ?? "the earlier card refund"} (the same drain request again) until it is sent; it returns the balance it covers. Start a new card refund only after that, if any balance is left.`,
+    retryable: true,
+    drainRegistered: false
+  },
   refund_floor: {
     display: "The refund reached the chain, but it paid less than the balance this service had recorded, so nothing was booked here. Your on-chain refund arrived; the difference has to be reconciled by the service operator.",
     hint: ({ creditId, drainId }) => `Report drain ${drainId} on credit ${creditId} to the service operator \u2014 only they can reconcile the difference. Retrying this drain, or requesting a new drain_id, lands here again.`,
@@ -10439,9 +11281,12 @@ function drainLedgerErrorResponse(error, creditId, drainId) {
     return jsonPaymentError("drain_conflict", 409, {
       message: error.message,
       display: copy?.display,
-      hint: copy?.hint({ creditId, drainId }),
+      hint: copy?.hint({ creditId, drainId, blockingDrainId: error.details.blockingDrainId }),
       retryable: copy?.retryable,
-      extra: { drain_registered: copy?.drainRegistered ?? false }
+      extra: {
+        drain_registered: copy?.drainRegistered ?? false,
+        ...error.details.blockingDrainId && { blocking_drain_id: error.details.blockingDrainId }
+      }
     });
   }
   if (error.code === "settlement_pending") {
@@ -10454,6 +11299,9 @@ function drainLedgerErrorResponse(error, creditId, drainId) {
       ...error.details.blockingDrainId ? { blockingDrainId: error.details.blockingDrainId } : {}
     });
   }
+  if (error.code === "credit_closed") {
+    return jsonPaymentError("credit_closed", 409, { message: error.message });
+  }
   if (error.code === "caller_mismatch" || error.code === "credit_not_found") {
     return jsonPaymentError("credit_not_found", 404, {
       message: `No credit ${creditId} for this caller.`
@@ -10469,6 +11317,7 @@ function mapLedgerCode(err) {
     case "insufficient_credit":
     case "credit_expired":
     case "credit_unbacked":
+    case "credit_closed":
     case "credit_not_found":
     case "tempo_channel_closing":
     case "settlement_pending":
@@ -10493,6 +11342,8 @@ function creditBody(credit, reconciliationPending = false) {
     // Nominal expiry does not itself reclaim ownership; a committed sweep can remove undrawn
     // value.
     drainable: credit.status === "active" && credit.availableMicro > 0,
+    // The drain an expired card balance went back to the card under; poll it like any drain.
+    ...credit.status === "refunded" && { refund_drain_id: cardExpiryDrainId(credit.expiryMs) },
     ...reconciliationPending && { reconciliation_pending: true },
     ledger_seq: credit.lastLedgerSeq
   };
@@ -10909,7 +11760,7 @@ async function handle(c, opts, action) {
 }
 
 // src/sdk/server/hosting-settlement-report-obligations.ts
-import { createHash as createHash7, randomUUID as randomUUID4 } from "crypto";
+import { createHash as createHash8, randomUUID as randomUUID4 } from "crypto";
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
 import { BATCH_SETTLEMENT_ADDRESS as BATCH_SETTLEMENT_ADDRESS3 } from "@x402/evm";
 import { computeChannelId as computeChannelId2 } from "@x402/evm/batch-settlement/client";
@@ -10982,7 +11833,7 @@ var TEMPO_CLOSED_EVENT = TempoSession.Precompile.escrowAbi.find(
   (item) => item.type === "event" && item.name === "ChannelClosed"
 );
 function hash2(value) {
-  return createHash7("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash8("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function hex(value, bytes) {
   return typeof value === "string" && new RegExp(`^0x[0-9a-fA-F]{${bytes * 2}}$`).test(value);
@@ -11800,7 +12651,7 @@ var HostedSettlementReportObligations = class {
             [this.dvmId, this.scope, batch.batch_id]
           );
           if (!sources.rows.length || sources.rows.some((row) => !row.tx_hash || !row.block_hash || row.delta_native === null)) return;
-          const claimed = sources.rows.reduce((sum, row) => sum + BigInt(row.delta_native), 0n);
+          const claimed = sources.rows.reduce((sum2, row) => sum2 + BigInt(row.delta_native), 0n);
           const hashes = new Set(sources.rows.map((row) => row.tx_hash));
           await tx.query(
             `UPDATE payout_x402_batches
@@ -11901,7 +12752,7 @@ var HostedSettlementReportObligations = class {
       const batchId = payload.payoutId.slice("x402:batch:".length);
       const settle = rows2.rows.filter((row) => row.operation === "settle" && row.rail === "x402");
       const claims = rows2.rows.filter((row) => row.operation === "claim" || row.operation === "refund");
-      if (settle.length !== 1 || !claims.length || claims.length + 1 !== rows2.rows.length || rows2.rows.some((row) => row.original.batchId !== batchId) || BigInt(settle[0].delta_native) !== BigInt(amount) || claims.reduce((sum, row) => sum + BigInt(row.delta_native), 0n) !== BigInt(amount)) {
+      if (settle.length !== 1 || !claims.length || claims.length + 1 !== rows2.rows.length || rows2.rows.some((row) => row.original.batchId !== batchId) || BigInt(settle[0].delta_native) !== BigInt(amount) || claims.reduce((sum2, row) => sum2 + BigInt(row.delta_native), 0n) !== BigInt(amount)) {
         throw new Error("Hosted x402 payout differs from its original finalized batch");
       }
     } else {
@@ -12370,7 +13221,7 @@ var HostingCleanupFence = class {
 };
 
 // src/sdk/server/hosting-channel-evidence.ts
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 import { Session as TempoSession2 } from "mppx/tempo";
 import { createPublicClient as createPublicClient5, http as http5 } from "viem";
 import { BATCH_SETTLEMENT_ADDRESS as BATCH_SETTLEMENT_ADDRESS4 } from "@x402/evm";
@@ -12421,7 +13272,7 @@ async function readHostedChannelSnapshot(query) {
   };
   const x402HistoryComplete = await history(names[6]);
   const tempoHistoryComplete = await history(names[7]);
-  const digest = createHash8("sha256").update(JSON.stringify({
+  const digest = createHash9("sha256").update(JSON.stringify({
     present: [...exists].sort(),
     x402,
     x402Tombstones,
@@ -13544,7 +14395,7 @@ function protocolEnvelopeIgnoreFields(schema) {
 }
 function stripProtocolEnvelope(schema, data) {
   const withoutCredit = stripCreditEnvelope(schema, data);
-  if (!isRecord2(withoutCredit)) return withoutCredit;
+  if (!isRecord3(withoutCredit)) return withoutCredit;
   const {
     [REQUEST_ID_FIELD]: _requestId,
     [AUTH_STATEMENT_FIELD]: _authStatement,
@@ -13553,13 +14404,13 @@ function stripProtocolEnvelope(schema, data) {
   return builderInput;
 }
 function requestIdFromEnvelope(data) {
-  if (!isRecord2(data) || !(REQUEST_ID_FIELD in data)) return void 0;
+  if (!isRecord3(data) || !(REQUEST_ID_FIELD in data)) return void 0;
   return isPublicRequestId(data[REQUEST_ID_FIELD]) ? data[REQUEST_ID_FIELD] : void 0;
 }
 function hasInvalidRequestId(data) {
-  return isRecord2(data) && REQUEST_ID_FIELD in data && !isPublicRequestId(data[REQUEST_ID_FIELD]);
+  return isRecord3(data) && REQUEST_ID_FIELD in data && !isPublicRequestId(data[REQUEST_ID_FIELD]);
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -13571,9 +14422,9 @@ import { AsyncLocalStorage } from "async_hooks";
 import { randomBytes as randomBytes3 } from "crypto";
 
 // src/sdk/server/instrumented-kv.ts
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 function hashKey(key) {
-  return createHash9("sha256").update(key).digest("hex").slice(0, 16);
+  return createHash10("sha256").update(key).digest("hex").slice(0, 16);
 }
 function instrumentKVStore(inner) {
   return {
@@ -14343,9 +15194,7 @@ function resultHashFor(record) {
 // src/sdk/server/unsigned-request.ts
 function takesUnsignedPath(auth, body) {
   if (!auth?.allowUnsignedPaid) return false;
-  const raw = signedRequestInput(body);
-  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return true;
-  return !SIGNED_ENVELOPE_FIELDS.some((field) => field in raw);
+  return !carriesSignedEnvelope(signedRequestInput(body));
 }
 function carriesCreditFields(raw) {
   if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return false;
@@ -17189,7 +18038,7 @@ var JobManager = class {
     const rail = draw?.railValue.rail;
     const currency = draw?.railValue.creditCurrency;
     if (draw?.status !== "settled" || draw.amountMicro <= 0 || !currency || !rail || !isFundingRail(rail)) return;
-    const testFunds = rail === "lightning" ? null : this.opts.paymentMode?.rails[rail].testFunds ?? null;
+    const testFunds = rail === "lightning" || rail === "stripe" ? null : this.opts.paymentMode?.rails[rail].testFunds ?? null;
     try {
       await callback({ jobId: record.id, rail, amountMicro: draw.amountMicro, currency, testFunds });
     } catch (error) {
@@ -18529,7 +19378,7 @@ function isReadUnavailable(error) {
 }
 
 // src/sdk/server/balance-payment.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 import { z as z2 } from "zod";
 var BALANCE_PAYMENT_SCHEMA = z2.object({
   credit_id: z2.string().min(1).max(256),
@@ -18559,7 +19408,7 @@ async function commitBalancePayment(args) {
   args.auth.recheckSignature(BALANCE_PAYMENT_SCHEMA, args.raw, args.domain);
   const auth = BALANCE_PAYMENT_SCHEMA.parse(args.raw);
   const { pubkey, credit_id, draw_id, payment_id, request_seq, amount_micro, currency } = auth;
-  const fingerprint = createHash10("sha256").update(JSON.stringify([
+  const fingerprint = createHash11("sha256").update(JSON.stringify([
     args.domain,
     args.jobId,
     pubkey,
@@ -18683,7 +19532,7 @@ async function commitBalancePayment(args) {
 }
 
 // src/sdk/server/app.ts
-import { createHash as createHash12, randomBytes as randomBytes5, randomUUID as randomUUID6 } from "crypto";
+import { createHash as createHash13, randomBytes as randomBytes5, randomUUID as randomUUID6 } from "crypto";
 import { Hono } from "hono";
 import { getCookie } from "hono/cookie";
 import { cors } from "hono/cors";
@@ -18963,7 +19812,7 @@ async function handlePendingDrains(c, opts) {
   const drains = pending.map((d) => {
     const automatic = d.method === "cashu";
     const amountSats = !automatic ? null : d.owedSats ?? netOwedSats(fiatToSatsCeil(d.amountMicro / 1e6, rateFor(d.currency)));
-    const settlement = automatic ? "automatic" : d.channelId === null ? "manual" : "channel";
+    const settlement = automatic ? "automatic" : d.method === "stripe" ? "card" : d.channelId === null ? "manual" : "channel";
     return {
       credit_id: d.creditId,
       drain_id: d.drainId,
@@ -18979,17 +19828,19 @@ async function handlePendingDrains(c, opts) {
       amount_native: d.drainedNative,
       settlement,
       channel_id: d.channelId,
-      created_at: d.createdAt
+      created_at: d.createdAt,
+      ...d.method === "stripe" && { card_refund: cardRefundStatus(d) }
     };
   });
   const liability = {
-    cashu_sats: drains.filter((d) => d.method === "cashu").reduce((sum, d) => sum + (d.amount_sats ?? 0), 0),
+    cashu_sats: drains.filter((d) => d.method === "cashu").reduce((sum2, d) => sum2 + (d.amount_sats ?? 0), 0),
     by_method_micro: DRAIN_METHODS.reduce((acc, method) => {
-      acc[method] = pending.filter((d) => d.method === method).reduce((sum, d) => sum + d.amountMicro, 0);
+      acc[method] = pending.filter((d) => d.method === method).reduce((sum2, d) => sum2 + d.amountMicro, 0);
       return acc;
     }, {}),
-    manual_micro: drains.filter((d) => d.settlement === "manual").reduce((sum, d) => sum + d.amount_micro, 0),
-    channel_micro: drains.filter((d) => d.settlement === "channel").reduce((sum, d) => sum + d.amount_micro, 0)
+    manual_micro: drains.filter((d) => d.settlement === "manual").reduce((sum2, d) => sum2 + d.amount_micro, 0),
+    channel_micro: drains.filter((d) => d.settlement === "channel").reduce((sum2, d) => sum2 + d.amount_micro, 0),
+    card_micro: drains.filter((d) => d.settlement === "card").reduce((sum2, d) => sum2 + d.amount_micro, 0)
   };
   return c.json({ drains, liability, mints: opts.mints?.() ?? [] });
 }
@@ -18999,7 +19850,7 @@ async function handleBitcoinLiability(c, opts) {
   const deposit = await opts.ledger.bitcoinDepositLiability();
   const pending = await opts.ledger.listPendingDrains();
   const promised = pending.filter((d) => d.method === "cashu" && d.status === "pending");
-  const drainSats = promised.reduce((sum, d) => sum + (d.owedSats ?? 0), 0);
+  const drainSats = promised.reduce((sum2, d) => sum2 + (d.owedSats ?? 0), 0);
   const drainsUnpriced = promised.filter((d) => d.owedSats === null).length;
   return c.json({
     deposit_liability_sats: deposit.depositSats,
@@ -19336,6 +20187,7 @@ async function handleMarkDrainSent(c, opts) {
       409
     );
   }
+  if (existing?.method === "stripe") return retryCardRefund(c, opts, existing);
   let record;
   let replayed;
   try {
@@ -20748,6 +21600,60 @@ function parseSerializedDleq(raw) {
   if (dleq.r !== void 0 && typeof dleq.r !== "string") return void 0;
   return { e: dleq.e, s: dleq.s, ...dleq.r !== void 0 ? { r: dleq.r } : {} };
 }
+function cardRefundStatus(drain) {
+  const plan = drain.cardRefund;
+  if (!plan) return { planned: false };
+  const summary = cardRefundSummary(plan);
+  return {
+    planned: true,
+    refunded_cents: summary.refundedCents,
+    fee_share_cents: summary.feeShareCents,
+    sub_cent_micro: summary.subCentMicro,
+    refund_ids: summary.refundIds,
+    refunds: plan.entries.map((entry) => ({
+      payment_intent: entry.paymentIntentId,
+      refund_id: entry.refundId,
+      amount_cents: entry.amountCents,
+      fee_share_cents: entry.feeShareCents,
+      attempt: entry.attempt,
+      status: entry.status,
+      last_error: entry.lastError
+    }))
+  };
+}
+async function retryCardRefund(c, opts, drain) {
+  if (drain.status === "sent") {
+    return c.json({ status: "sent", credit_id: drain.creditId, drain_id: drain.drainId, replayed: true });
+  }
+  if (!opts.stripeRefunds) {
+    return c.json(
+      {
+        error: "card_refund_unavailable",
+        message: "This DVM has no Stripe secret key configured, so it cannot refund to the card."
+      },
+      503
+    );
+  }
+  const { drain: after, completed } = await runStripeDrain(
+    {
+      ledger: opts.ledger,
+      drainReport: { db: opts.db, dvmId: opts.dvmId, enqueueCreditDrain: opts.enqueueCreditDrain },
+      stripe: opts.stripeRefunds,
+      ...opts.receiptIssuer && { receiptIssuer: opts.receiptIssuer }
+    },
+    drain
+  );
+  return c.json(
+    {
+      status: after.status,
+      credit_id: after.creditId,
+      drain_id: after.drainId,
+      replayed: after.status === "sent" && !completed,
+      card_refund: cardRefundStatus(after)
+    },
+    after.status === "sent" ? 200 : 202
+  );
+}
 
 // src/sdk/server/caller-facing-url.ts
 function resolvePublicOrigin(value) {
@@ -20766,6 +21672,220 @@ function callerFacingRequestUrl(requestUrl, publicOrigin) {
   return `${publicOrigin}${request.pathname}${request.search}`;
 }
 
+// src/sdk/server/card-refund-sweep.ts
+var DISPUTE_LOOKBACK_MS = 180 * 24 * 60 * 60 * 1e3;
+var MAX_DISPUTE_PAGES = 10;
+var DISPUTE_SETTLED_FOR_MERCHANT = /* @__PURE__ */ new Set(["won", "warning_closed"]);
+var STRANDED_AFTER_MS = 30 * 60 * 1e3;
+var STRANDED_SEARCH_WINDOW_MS = 24 * 60 * 60 * 1e3;
+var STRANDED_ABANDON_AFTER_MS = 7 * 24 * 60 * 60 * 1e3;
+async function runCardRefundSweep(deps, opts = {}) {
+  const nowMs = opts.nowMs ?? Date.now();
+  const limit = opts.limit ?? 200;
+  const result = {
+    frozen: [],
+    unfrozen: [],
+    expiryRefunds: [],
+    completed: [],
+    pending: [],
+    strandedRefunds: [],
+    failedSteps: []
+  };
+  const legDeps = {
+    ledger: deps.ledger,
+    stripe: deps.stripe,
+    drainReport: deps.drainReport,
+    ...deps.receiptIssuer && { receiptIssuer: deps.receiptIssuer }
+  };
+  const step = async (name, run) => {
+    try {
+      await run();
+    } catch {
+      result.failedSteps.push(name);
+      diagnosticConsole.error({ event: "card_refund_sweep_step_failed", stage: name });
+    }
+  };
+  await step("disputes", () => applyDisputes(deps, nowMs, result));
+  const { listExpiredCardCredits, openCardExpiryRefund } = deps.ledger;
+  if (listExpiredCardCredits && openCardExpiryRefund) {
+    await step("expiry", async () => {
+      for (const creditId of await listExpiredCardCredits.call(deps.ledger, { nowMs, limit })) {
+        try {
+          const drain = await openCardExpiryRefund.call(deps.ledger, { creditId, nowMs });
+          if (drain) result.expiryRefunds.push(creditId);
+        } catch {
+          diagnosticConsole.error({ event: "card_refund_expiry_failed", credit_id: creditId });
+        }
+      }
+    });
+  }
+  await step("retry", async () => {
+    const pending = (await deps.ledger.listPendingDrains()).filter(
+      (drain) => drain.method === "stripe" && drain.status === "pending"
+    );
+    for (const drain of pending.slice(0, limit)) {
+      try {
+        const { drain: after } = await runStripeDrain(legDeps, drain);
+        (after.status === "sent" ? result.completed : result.pending).push(
+          `${drain.creditId}:${drain.drainId}`
+        );
+      } catch {
+        result.pending.push(`${drain.creditId}:${drain.drainId}`);
+      }
+    }
+  });
+  const journal = deps.journal;
+  if (journal && deps.ledger.cardFundingBooked) {
+    await step("stranded", async () => {
+      result.strandedRefunds = await refundStranded(deps, journal, nowMs, limit);
+    });
+  }
+  return result;
+}
+function startCardRefundSweep(deps, opts = {}) {
+  if (!deps.ledger.saveCardRefund) return void 0;
+  const intervalMs = opts.intervalMs ?? 60 * 60 * 1e3;
+  const bootDelayMs = opts.bootDelayMs ?? 3e4;
+  let stopped = false;
+  const runOnce = () => runCardRefundSweep(deps, { limit: opts.limit });
+  const pass = () => {
+    if (stopped) return;
+    void runOnce().then((summary) => {
+      const moved = summary.frozen.length + summary.unfrozen.length + summary.expiryRefunds.length + summary.completed.length + summary.pending.length + summary.strandedRefunds.length;
+      if (moved === 0) return;
+      diagnosticConsole.log({
+        event: "card_refund_sweep",
+        frozen: summary.frozen.length,
+        unfrozen: summary.unfrozen.length,
+        expiry_refunds: summary.expiryRefunds.length,
+        completed: summary.completed.length,
+        pending: summary.pending.length,
+        stranded_refunds: summary.strandedRefunds.length
+      });
+    }).catch(() => {
+      diagnosticConsole.error({ event: "card_refund_sweep_failed" });
+    });
+  };
+  const bootTimer = bootDelayMs > 0 ? setTimeout(pass, bootDelayMs) : void 0;
+  bootTimer?.unref();
+  const intervalTimer = intervalMs > 0 ? setInterval(pass, intervalMs) : void 0;
+  intervalTimer?.unref();
+  return {
+    stop() {
+      stopped = true;
+      if (bootTimer) clearTimeout(bootTimer);
+      if (intervalTimer) clearInterval(intervalTimer);
+    },
+    runOnce
+  };
+}
+async function applyDisputes(deps, nowMs, result) {
+  const freeze = deps.ledger.freezeCardCreditsForPaymentIntent?.bind(deps.ledger);
+  if (!freeze) return;
+  const statusesByIntent = /* @__PURE__ */ new Map();
+  const createdGte = Math.floor((nowMs - DISPUTE_LOOKBACK_MS) / 1e3);
+  let startingAfter;
+  try {
+    for (let page = 0; page < MAX_DISPUTE_PAGES; page++) {
+      const { disputes, hasMore } = await deps.stripe.listDisputes({
+        createdGte,
+        ...startingAfter && { startingAfter }
+      });
+      for (const dispute of disputes) {
+        if (!dispute.paymentIntentId) continue;
+        const statuses = statusesByIntent.get(dispute.paymentIntentId) ?? [];
+        statuses.push(dispute.status);
+        statusesByIntent.set(dispute.paymentIntentId, statuses);
+      }
+      if (!hasMore || disputes.length === 0) break;
+      startingAfter = disputes[disputes.length - 1].id;
+    }
+  } finally {
+    const blocking = new Set(
+      [...statusesByIntent].filter(([, statuses]) => !allSettledForMerchant(statuses)).map(([paymentIntentId]) => paymentIntentId)
+    );
+    for (const paymentIntentId of blocking) {
+      result.frozen.push(...await freeze(paymentIntentId));
+    }
+    for (const paymentIntentId of statusesByIntent.keys()) {
+      if (!blocking.has(paymentIntentId)) result.unfrozen.push(...await unfreezeSettled(deps, paymentIntentId));
+    }
+  }
+}
+async function unfreezeSettled(deps, paymentIntentId) {
+  const candidates = deps.ledger.disputedCardCreditsFundedBy?.bind(deps.ledger);
+  const unfreeze = deps.ledger.unfreezeCardCredit?.bind(deps.ledger);
+  if (!candidates || !unfreeze) return [];
+  const unfrozen = [];
+  for (const credit of await candidates(paymentIntentId)) {
+    let settled = true;
+    for (const fundingIntent of credit.paymentIntentIds) {
+      const { disputes, hasMore } = await deps.stripe.listDisputesForPaymentIntent(fundingIntent);
+      if (hasMore || !allSettledForMerchant(disputes.map((dispute) => dispute.status))) {
+        settled = false;
+        break;
+      }
+    }
+    if (settled && await unfreeze(credit.creditId)) unfrozen.push(credit.creditId);
+  }
+  return unfrozen;
+}
+function allSettledForMerchant(statuses) {
+  return statuses.every((status) => DISPUTE_SETTLED_FOR_MERCHANT.has(status));
+}
+async function refundStranded(deps, journal, nowMs, limit) {
+  const booked = deps.ledger.cardFundingBooked?.bind(deps.ledger);
+  if (!booked) return [];
+  const refunded = [];
+  const attempts = await journal.listUnresolved({ olderThanMs: nowMs - STRANDED_AFTER_MS, limit });
+  for (const attempt of attempts) {
+    try {
+      const intents = await deps.stripe.searchPaymentIntentsByMetadata(
+        "mpp_challenge_id",
+        attempt.challengeId
+      );
+      if (intents.length === 0) {
+        if (nowMs - attempt.createdAt > STRANDED_SEARCH_WINDOW_MS) {
+          await journal.resolve(attempt.challengeId, "not_found");
+        }
+        continue;
+      }
+      let unsettled = false;
+      let refundedHere = 0;
+      for (const intent of intents) {
+        if (intent.status !== "succeeded") {
+          if (intent.status !== "canceled" && intent.status !== "requires_payment_method") {
+            unsettled = true;
+          }
+          continue;
+        }
+        if (await booked(intent.id)) continue;
+        const charge = await deps.stripe.retrieveCharge(intent.id);
+        const owed = charge.amount - charge.amountRefunded;
+        if (owed > 0 && !charge.disputed) {
+          await deps.stripe.createRefund({
+            paymentIntentId: intent.id,
+            amount: owed,
+            idempotencyKey: `dvmkit-stranded-${intent.id}`,
+            metadata: { dvmkit_stranded: "true" }
+          });
+          refunded.push(intent.id);
+          refundedHere += 1;
+          diagnosticConsole.warn({ event: "card_charge_stranded_refunded", payment_intent: intent.id });
+        }
+      }
+      if (!unsettled) {
+        await journal.resolve(attempt.challengeId, refundedHere > 0 ? "refunded" : "settled");
+      } else if (nowMs - attempt.createdAt > STRANDED_ABANDON_AFTER_MS) {
+        diagnosticConsole.error({ event: "card_charge_unsettled", challenge_id: attempt.challengeId });
+        await journal.resolve(attempt.challengeId, "unsettled");
+      }
+    } catch {
+    }
+  }
+  return refunded;
+}
+
 // src/sdk/server/credit-expiry-sweep.ts
 function startCreditExpirySweep(ledger, opts = {}) {
   const sweepExpiredCredits = ledger.sweepExpiredCredits?.bind(ledger);
@@ -21739,7 +22859,7 @@ initSchemaForm();
 }
 
 // src/sdk/server/request-fingerprint.ts
-import { createHash as createHash11 } from "crypto";
+import { createHash as createHash12 } from "crypto";
 function requestFingerprint(req, opts) {
   const canonical = canonicalize({
     capability: req.capability,
@@ -21747,7 +22867,7 @@ function requestFingerprint(req, opts) {
     params: req.params ?? {},
     data: opts.stripAuthEnvelope ? stripEnvelope(req.data) : req.data
   });
-  return createHash11("sha256").update(canonical).digest("hex");
+  return createHash12("sha256").update(canonical).digest("hex");
 }
 var ENVELOPE_KEYS = /* @__PURE__ */ new Set(["pubkey", "signature", "timestamp", "nonce", "auth_statement"]);
 function stripEnvelope(data) {
@@ -21785,6 +22905,7 @@ async function createDVMServer(descriptor, opts) {
   let payoutReporter;
   let unsubscribeTempoSettlementReadiness;
   let creditExpirySweep;
+  let cardRefundSweep;
   let x402ChannelStorage;
   let x402BatchSettlement;
   let server;
@@ -21817,6 +22938,7 @@ async function createDVMServer(descriptor, opts) {
     await capture(() => payoutReporter?.stop());
     await capture(() => revenueReporter?.stop());
     await capture(() => creditExpirySweep?.stop());
+    await capture(() => cardRefundSweep?.stop());
     await capture(() => unsubscribeTempoSettlementReadiness?.());
     if (settlementStopped) await capture(() => settlementStopped);
     if (x402ChannelStorage) {
@@ -21870,7 +22992,7 @@ async function createDVMServer(descriptor, opts) {
       }
     }
     if (!opts.onJobCompleted && platformToken && platformUrl && dvmId && opts.db) {
-      const { RevenueReporter } = await import("./revenue-reporter-6XARUEG6.js");
+      const { RevenueReporter } = await import("./revenue-reporter-FD3GDQZS.js");
       const reporter = new RevenueReporter(
         opts.db,
         platformUrl,
@@ -21880,7 +23002,7 @@ async function createDVMServer(descriptor, opts) {
       revenueReporter = reporter;
       await reporter.init();
       reporter.startRetryLoop();
-      const { MemoryX402BatchStore, PayoutReporter } = await import("./payout-reporter-5QAHCYIO.js");
+      const { MemoryX402BatchStore, PayoutReporter } = await import("./payout-reporter-KTLBNJJ7.js");
       payoutReporter = new PayoutReporter({
         dvmId,
         db: opts.db,
@@ -22086,6 +23208,18 @@ async function createDVMServer(descriptor, opts) {
       payoutReporter
     });
     await server.jobManager.recoverTerminalCosts();
+    if (opts.stripeCredit) {
+      cardRefundSweep = startCardRefundSweep(
+        {
+          ledger: creditLedger,
+          stripe: opts.stripeCredit.refunds,
+          drainReport: { db: opts.db, dvmId, enqueueCreditDrain },
+          ...server.drainReceiptIssuer && { receiptIssuer: server.drainReceiptIssuer },
+          ...opts.stripeCredit.chargeJournal && { journal: opts.stripeCredit.chargeJournal }
+        },
+        opts.creditExpirySweep
+      );
+    }
     return {
       app: server.app,
       authAudience: server.authAudience,
@@ -22136,6 +23270,10 @@ var DVMServer = class {
   tempoSweepLastAttemptMs = 0;
   receiptIssuer;
   creditLedger;
+  /** Countersigns reclaim events outside a request, such as a card refund the sweep finishes. */
+  get drainReceiptIssuer() {
+    return this.receiptIssuer;
+  }
   processedPayments;
   authAudience;
   /** Lazily constructed when a refreshed facilitator probe gains batch support. */
@@ -22581,6 +23719,7 @@ var DVMServer = class {
         // DVM wired with an in-memory session store resolves to a rail with no
         // close-intent read and the verbs answer 503.
         tempoDrainRail: () => Promise.resolve(this.opts.mpp),
+        ...this.opts.stripeCredit && { stripeRefunds: this.opts.stripeCredit.refunds },
         ...this.opts.hostedSettlementReports ? {
           hostedSettlementReports: { store: this.opts.hostedSettlementReports }
         } : {},
@@ -22822,7 +23961,7 @@ var DVMServer = class {
       const dvmId = this.opts.dvmId ?? `dev:${this.descriptor.name}`;
       return {
         dvm_id: dvmId,
-        builder_pubkey: createHash12("sha256").update(`dvmkit-dev:${dvmId}`).digest("hex")
+        builder_pubkey: createHash13("sha256").update(`dvmkit-dev:${dvmId}`).digest("hex")
       };
     }
     throw new AuthAudienceError();
@@ -22924,6 +24063,7 @@ var DVMServer = class {
       methods.push("x402");
     }
     if (this.opts.lightningReceive?.available()) methods.push("lightning");
+    if (this.opts.stripeCredit) methods.push("stripe");
     return methods;
   }
   creditMppMethods() {
@@ -23132,6 +24272,7 @@ var DVMServer = class {
       tempoWithheld: mppSplit.withheld,
       x402Schemes: this.creditX402Schemes(),
       lightningFundingMinSats: this.opts.lightningReceive?.fundingMinSats,
+      stripeNetworkId: this.opts.stripeCredit?.networkId,
       // Configured, not advertised: `advertisedMints()` is health
       // filtered, and a rail that comes and goes with a mint's uptime is worse
       // product than one that is honestly absent.
@@ -23183,7 +24324,7 @@ var DVMServer = class {
         const paymentAuthorization = ctx.req.header("Authorization");
         const mppArtifact = paymentAuthorization ? (await import("mppx")).Credential.extractPaymentScheme(paymentAuthorization) : void 0;
         const attachedPayment = ctx.req.header("X-Cashu") ?? ctx.req.header("PAYMENT-SIGNATURE") ?? ctx.req.header("X-PAYMENT") ?? mppArtifact;
-        const paymentArtifactHash = attachedPayment ? createHash12("sha256").update(attachedPayment).digest("hex") : void 0;
+        const paymentArtifactHash = attachedPayment ? createHash13("sha256").update(attachedPayment).digest("hex") : void 0;
         hostingFundingArtifactHash = paymentArtifactHash;
         if (!await control.admit(admissionId, workId, {
           creditId,
@@ -23222,7 +24363,8 @@ var DVMServer = class {
           await control.finishAdmission(admissionId, outcome);
         }
       } : void 0,
-      tempoSettlementReadiness: this.opts.tempoSettlementReadiness
+      tempoSettlementReadiness: this.opts.tempoSettlementReadiness,
+      stripeCredit: this.opts.stripeCredit
     });
   }
   /**
@@ -23770,7 +24912,7 @@ var DVMServer = class {
       if (err instanceof SignedRequestError) return err;
       throw err;
     }
-    return new SignedRequestError("signed request required", "signature_invalid");
+    return new SignedRequestError("signed request required", "signature_required");
   }
   /**
    * On authenticated DVMs, envelope-only parse failures defer to auth
@@ -24043,7 +25185,7 @@ var DVMServer = class {
     const authorization = c.req.header("Authorization");
     const mppArtifact = authorization ? (await import("mppx")).Credential.extractPaymentScheme(authorization) : void 0;
     const attachedPayment = c.req.header("X-Cashu") ?? c.req.header("PAYMENT-SIGNATURE") ?? c.req.header("X-PAYMENT") ?? mppArtifact;
-    const hostingPaymentArtifactHash = attachedPayment ? createHash12("sha256").update(attachedPayment).digest("hex") : void 0;
+    const hostingPaymentArtifactHash = attachedPayment ? createHash13("sha256").update(attachedPayment).digest("hex") : void 0;
     if (!resumeOnly && this.opts.hostingControlInstance && hostingPaymentArtifactHash) {
       const priorId = await this.opts.hostingControlInstance.acceptedJobByPaymentArtifactHash(
         hostingPaymentArtifactHash
@@ -24367,7 +25509,7 @@ var DVMServer = class {
       }
       const isAnonymous = requesterId === "anonymous" || requesterId === "dev-anonymous";
       const jobToken = isAnonymous ? randomBytes5(32).toString("hex") : void 0;
-      const requesterTokenHash = jobToken ? createHash12("sha256").update(jobToken).digest("hex") : void 0;
+      const requesterTokenHash = jobToken ? createHash13("sha256").update(jobToken).digest("hex") : void 0;
       const job = jm.createJob(
         normalisedBody,
         requesterId,
@@ -25225,7 +26367,7 @@ function isJobOwner(c, job) {
   if (job.requesterTokenHash) {
     const token = c.req.header("X-Job-Token");
     if (!token) return false;
-    const provided = createHash12("sha256").update(token).digest("hex");
+    const provided = createHash13("sha256").update(token).digest("hex");
     return timingSafeEqualHex(provided, job.requesterTokenHash);
   }
   return c.get("requesterId") === job.requesterId;
@@ -25779,11 +26921,15 @@ export {
   extractCreditEnvelope,
   creditEnvelopeIgnoreFields,
   stripCreditEnvelope,
+  STRIPE_CREDIT_MIN_MICRO,
   buildCreditMenu,
   selectPrimaryCredit,
   toCreditView,
   attachCreditMenu,
   toCreditTerms,
+  fiatMicroToMethodAmount,
+  createStripeRefundApi,
+  callerInputIssues,
   resolvePriceFiat,
   priceFiatMicro,
   resolveFxSnapshot,