@dvmkit/sdk 0.3.4-rc.10 → 0.4.0-rc.1

package/dist/{step-cache-v2yhyhSZ.d.ts → step-cache-Bi43A0JN.d.ts}

@@ -2,9 +2,9 @@ import { MiddlewareHandler, Context, Hono } from 'hono';
 import { Challenge, Credential, Store, Method, Receipt } from 'mppx';
 import { FacilitatorClient } from '@x402/core/server';
 import { AuthorizerSigner, ChannelStorage, AutoSettlementConfig, Channel, ChannelUpdateResult } from '@x402/evm/batch-settlement/server';
-import { Account, Client, Hex } from 'viem';
 import { Pool, PoolClient } from 'pg';
 import { PaymentPayload as PaymentPayload$1, PaymentRequirements as PaymentRequirements$1, SettleResponse as SettleResponse$1 } from '@x402/core/types';
+import { Account, Client, Hex } from 'viem';
 import { z } from 'zod';
 
 /**
@@ -111,7 +111,7 @@ interface X402FacilitatorAuth {
  * Provider-side x402 configuration — where to receive stablecoin payments,
  * how the dvmkit DVM should advertise the rail on its 402 response.
  */
-interface X402Config {
+interface X402Config$1 {
     payTo: string;
     /** CAIP-2 chain id (`eip155:8453` for Base). */
     network: string;
@@ -320,7 +320,7 @@ interface PaymentRequiredV2 {
 type PaymentRequired = X402ResponseBody | PaymentRequiredV2;
 /** Inputs for `buildPaymentRequirements`. */
 interface BuildPaymentRequirementsOpts {
-    x402Config: X402Config;
+    x402Config: X402Config$1;
     requiredUsdcMicro: bigint;
     resource: string;
     description?: string;
@@ -699,1719 +699,1899 @@ declare function clientCompatibilityMiddleware(): MiddlewareHandler<ClientCompat
 declare const requireClientCompatibility: ClientCompatibilityGate;
 declare function clientUpgradeRequired(c: Context, compatibility: ClientCompatibility, requirement: ClientCompatibilityRequirement): Response;
 
-type JsonValue = string | number | boolean | null | JsonValue[] | {
-    [key: string]: JsonValue;
-};
-/**
- * Object keys sort recursively in UTF-16 code-unit order; arrays preserve order.
- * Undefined object properties are omitted. Unsupported scalars, including
- * non-finite numbers, throw TypeError. Callers strip unsigned fields themselves.
- */
-declare function canonicalize(value: JsonValue): string;
+interface HostedIntent {
+    admissionId?: string;
+    jobId?: string;
+    creditId?: string;
+    fundId?: string;
+    callerPubkey?: string;
+    fundingCommitment?: string;
+    paymentSeq?: number;
+    paymentArtifactHash?: string;
+    challengeId?: string;
+    invoicePaymentHash?: string;
+    invoiceRepairPaymentHash?: string;
+    amountMicro?: number;
+}
+interface HostedFundingReservation {
+    admissionId: string;
+    creditId: string;
+    fundId: string;
+    callerPubkey: string;
+    commitment: string;
+    paymentArtifactHash: string;
+}
+type Querier = Pick<PoolClient, "query">;
+/** The control row is the common transaction lock for hosted obligation creation and closure. */
+declare class HostingCleanupFence {
+    private readonly pool;
+    readonly dvmId: string;
+    readonly scope: string;
+    constructor(pool: Pool, dvmId: string, scope: string);
+    assertNewIntent(tx: Querier, intent?: HostedIntent): Promise<void>;
+    withNewIntent<T>(intent: HostedIntent | undefined, operation: (tx: PoolClient) => Promise<T>): Promise<T>;
+    assertFundingReservation(tx: Querier, reservation: HostedFundingReservation): Promise<void>;
+    fundingAdmission(tx: Querier, creditId: string, fundId: string, callerPubkey: string): Promise<string>;
+    withNewIntentOn<T>(db: Pool, intent: HostedIntent | undefined, operation: (tx: PoolClient) => Promise<T>): Promise<T>;
+}
+
+/** Query surface shared by the pool and an open Postgres transaction. */
+type X402ChannelQuerier = Pick<Pool, "query">;
 /**
- * UTF-8 encoding of the canonical JSON form.
+ * Durable phase of an irreversible x402 facilitator settlement.
+ *
+ * `written_off` is the operator's terminal: a settlement whose
+ * ledger leg cannot be completed, reviewed and closed so it leaves the repair
+ * queue without pretending it booked. It is deliberately reversible — a later
+ * reconcile still accepts it, because it moved nothing.
  */
-declare function canonicaliseForSigning(value: JsonValue): Uint8Array;
-
-type ReceiptOutcome = "completed" | "failed" | "cancelled";
-interface ReceiptPayment {
-    /** Total credited millisats. `0` on free jobs — they still get receipts. */
-    msats: number;
+type X402SettlementStatus = "prepared" | "submitting" | "settled" | "complete" | "written_off";
+/** Recovery record binding one chain settlement to one credit-ledger effect. */
+interface X402SettlementIntent {
+    settlementId: string;
+    channelId: string;
+    operation: "fund" | "refund";
+    effectId: string;
+    paymentId: string;
+    payload: PaymentPayload$1;
+    requirements: PaymentRequirements$1;
+    channelBefore: Channel;
     /**
-     * Rail of the most recent successful credit; `null` when nothing was paid.
-     * `lightning` appears on a draw against a credit the caller funded by
-     * invoice — it is a funding rail, never an attached-proof one.
+     * The channel as it stood when the settlement was handed to the facilitator —
+     * after the refund's mandatory on-chain refresh, which {@link channelBefore}
+     * precedes.
+     *
+     * The facilitator sizes a cooperative refund from *live* state
+     * (`balance − chargedCumulativeAmount`) and signs it against the *live*
+     * `refundNonce`, so this is the snapshot chain evidence has to be derived
+     * from. `channelBefore` is a pre-verify mirror kept for the voucher restore,
+     * and whenever it was stale a refund that settled read as one that never
+     * happened. Absent on rows an older build wrote, and on any row that never
+     * reached `submitting`.
      */
-    rail: "cashu" | "x402" | "tempo" | "lightning" | null;
-    /** Rail-native upfront amount (sats / USDC microunits), `null` when absent. */
-    native_amount: number | null;
-    native_asset: string | null;
-    /** Settlement reference: EVM tx hash (x402), mppx challenge id, or the Cashu request id. */
-    tx_hash: string | null;
-    /** Cashu mint the proofs were drawn on, `null` off the Cashu rail. */
-    mint: string | null;
+    channelAtSubmission?: Channel;
+    submissionBlock?: string;
+    pendingId?: string;
+    status: X402SettlementStatus;
+    response?: SettleResponse$1;
+    /** Epoch ms the row was first prepared. */
+    createdAt: number;
+    /** Epoch ms of the last status write — what the repair queue ages against. */
+    updatedAt: number;
+    /** Operator's reason, recorded by {@link PostgresX402ChannelStorage.writeOffSettlement}. */
+    writeOffNote?: string;
+    /** Epoch ms an operator reconciled or wrote this settlement off. */
+    resolvedAt?: number;
 }
+/** The caller-supplied half of a settlement row — everything the store does not stamp itself. */
+type X402SettlementIdentity = Omit<X402SettlementIntent, "status" | "response" | "createdAt" | "updatedAt" | "writeOffNote" | "resolvedAt" | "channelAtSubmission">;
 /**
- * Credit-draw countersignature block. Present on every job whose payment funded
- * or drew the credit
- * ledger — including implicit N=1 per-job payments, which fund and draw a
- * single-use credit in the same request. A caller holding a DVM-signed
- * balance trajectory plus its own caller-signed draw intents can prove
- * misbehaviour from artifacts both sides already possess; that only works
- * because the countersignature rides the receipt.
+ * Keyset position in the repair queue's `(created_at, settlement_id)` ordering.
  *
- * Absence is signature-compatible: `canonicalize` omits absent keys, so a
- * ledger-less (or free) job's receipt signs identically to a legacy
- * receipt.
+ * `createdAt` is Postgres's own rendering of the `TIMESTAMPTZ`, carried as text
+ * and handed straight back as one — never a `Date`. `created_at` has microsecond
+ * resolution and `Date` has millisecond, so a cursor that round-tripped through
+ * epoch ms would land *before* the row it was taken from and re-serve it on
+ * every page, which at `limit: 1` never advances at all.
  */
-interface ReceiptCredit {
-    credit_id: string;
-    /** This draw's identifier — matches the caller-signed draw intent. */
-    draw_id: string;
-    /** Amount drawn, in the credit's denomination. */
-    amount: number;
-    balance_after: number;
-    /** Per-credit monotonic draw counter. */
-    ledger_seq: number;
+interface X402SettlementCursor {
+    createdAt: string;
+    settlementId: string;
+}
+/** One page of the repair queue, plus the position to resume from. */
+interface X402SettlementPage {
+    settlements: X402SettlementIntent[];
+    /** Absent when this page was not full — there is nothing behind it. */
+    nextAfter?: X402SettlementCursor;
 }
 /**
- * A DVM-signed proof of what a job did and what it cost.
+ * Fleet-wide serialisation of the self-relay's chain submissions.
  *
- * Signed once at the terminal transition by the per-DVM receipt key, whose
- * authority chains to the builder identity key through the deploy-time
- * attestation (`/v1/info#builder`, `attestation.receipt_pubkey`). Served
- * identically on the synchronous `POST /v1/job` 200, on `GET /v1/job/:id`,
- * and on every later re-read — the bytes are persisted, not recomputed.
+ * Narrow on purpose, and implemented by {@link PostgresX402ChannelStorage}: the
+ * relay asks for one thing — exclusive use of its gas EOA for the length of one
+ * submission — and must not acquire the ability to touch a channel or a
+ * settlement row. Handing it this instead of the host `Pool` is what keeps the
+ * acquire off the pool the channel transaction is already holding a client from.
  */
-interface JobReceipt {
-    v: 1;
-    job_id: string;
-    /** Immutable DVM identity bound into the builder attestation. */
-    dvm_id: string;
-    /** DVM slug, as bound in the builder attestation. */
-    dvm: string;
-    capability: string;
-    outcome: ReceiptOutcome;
-    /** Signed Unix millisecond lifecycle times; absent on legacy receipts. */
-    timing?: {
-        accepted_at_ms: number;
-        terminal_at_ms: number;
-        caller_wait_ms: number;
-    };
-    /** SDK-derived attribution on failure/cancellation; absent on completion and legacy receipts. */
-    ended_by?: "caller" | "provider";
-    /** Terminal reason on `failed`/`cancelled` (e.g. `worker_died_mid_job`); `null` on success. */
-    reason: string | null;
-    /** Per-DVM monotonic terminal counter. Gaps expose receipt suppression. */
-    seq: number;
-    /** Unix seconds at which the receipt was signed. */
-    issued_at: number;
-    /** Caller's x-only pubkey when signed-request auth was used; `null` otherwise. */
-    requester_pubkey: string | null;
-    paid: ReceiptPayment;
+interface X402RelaySubmissionLock {
+    withRelaySubmissionLock<T>(key: string, operation: () => Promise<T>): Promise<T>;
+}
+interface X402ChannelStorageOpts {
+    /** Original hosted chain identity, persisted only on a channel's first write. */
+    hostedNetwork?: string;
     /**
-     * {@link computeResultHash} over the delivered result; `null` when nothing
-     * was delivered. The summary is part of the hash only on `completed` — see
-     * {@link computeResultHash}.
+     * Override the relay submission lock's wait ceiling, in milliseconds.
+     *
+     * A test seam: the production ceiling is tens of seconds, which no test can
+     * wait out, and the refusal path is exactly what needs pinning.
      */
-    result_hash: string | null;
-    /** x-only secp256k1 pubkey that signed this receipt (64 hex chars). */
-    receipt_pubkey: string;
-    /** BIP-340 Schnorr signature over the canonical receipt minus `signature` (128 hex chars). */
-    signature: string;
+    relaySubmissionLockTimeoutMs?: number;
     /**
-     * Credit-draw countersignature — present when the job's payment
-     * funded/drew the credit ledger. See {@link ReceiptCredit}. `balance_after`
-     * reflects the terminal resolution: the recorded draw trajectory on a
-     * settled (completed) job, the restored available balance on a released
-     * (failed/cancelled) one.
+     * Retire ledger credit when a fresh chain observation proves its channel
+     * has no unclaimed backing. Runs under the channel transaction so the
+     * channel-first, credit-second lock order stays fleet-wide.
      */
-    credit?: ReceiptCredit;
+    terminalizeUnbackedCredit?: (evidence: {
+        channelId: string;
+        channelBalanceNative: bigint;
+        totalClaimedNative: bigint;
+        observedAt: number;
+    }, tx: X402ChannelQuerier) => Promise<unknown>;
+}
+/** Best-effort identification of the backend holding the relay submission lock. */
+interface X402RelayLockHolder {
+    pid: number;
+    applicationName?: string;
+    clientAddr?: string;
+    state?: string;
+    /** Seconds since the holder's current statement started. */
+    heldSeconds?: number;
 }
-type UnsignedJobReceipt = Omit<JobReceipt, "signature">;
-type DrainReceiptEvent = "requested" | "parked" | "picked_up" | "sent" | "released";
 /**
- * A DVM-signed proof of one reclaim event. One receipt per
- * lifecycle transition — `requested` (the balance debited into the drain
- * liability), `parked` (Cashu notes locked to the caller's refund key,
- * parked for pickup), `picked_up` (the caller collected them), `sent` (a
- * Lightning/x402/mpp send-back settled).
+ * The fleet-wide relay submission lock was still held when the wait ceiling expired.
  *
- * The evidence pairing: the caller holds the drain *request* it signed (the
- * `/v1/credit` envelope), the DVM countersigns each state the drain reaches.
- * A `requested` receipt with no later `parked`/`sent` is a signed IOU whose
- * refusal is provable from artifacts both sides already hold — reclaim is
- * enforced by reputation with cryptographic evidence, not new crypto.
+ * Typed, and `retryable`, because it is an availability outcome rather than a
+ * fault in the payment: a fleet-mate whose RPC is retrying holds the lock, and
+ * the same request works once it lets go. It refuses rather than proceeding —
+ * two machines submitting from one EOA collide on the nonce — and it refuses
+ * rather than blocking, which is the defect: the old acquire had no
+ * `lock_timeout`, so a wedged holder pinned a host-pool client and a channel
+ * advisory lock for as long as it took.
+ */
+declare class X402RelaySubmissionLockError extends Error {
+    readonly lockKey: string;
+    readonly timeoutMs: number;
+    readonly holder?: X402RelayLockHolder | undefined;
+    readonly code = "x402_relay_submission_lock_timeout";
+    readonly retryable = true;
+    constructor(lockKey: string, timeoutMs: number, holder?: X402RelayLockHolder | undefined);
+}
+/** Outcome of {@link PostgresX402ChannelStorage.writeOffSettlement} — `written` is the transition bit. */
+interface X402SettlementWriteOff {
+    intent: X402SettlementIntent;
+    written: boolean;
+}
+/** The refund standing between a channel and the credit it backs. */
+interface X402UnresolvedRefund {
+    settlementId: string;
+    /** `${creditId}:${drainId}` — the drain this settlement belongs to. */
+    effectId: string;
+    status: X402SettlementStatus;
+}
+/**
+ * The credit ledger's read into durable x402 settlement state.
  *
- * Signed by the same per-DVM receipt key as {@link JobReceipt}, over the
- * same canonicalisation, so one attestation chain covers both.
+ * Narrow on purpose: the ledger asks one question — is this channel's refund
+ * still unresolved — and must not acquire the ability to move a settlement.
+ * Implemented by {@link PostgresX402ChannelStorage.pendingRefundSettlement}.
  */
-interface DrainReceipt {
-    v: 1;
-    /** Discriminator separating this from a `JobReceipt` in mixed stores. */
-    kind: "credit_drain";
-    credit_id: string;
-    /** This drain's identifier — matches the caller-signed drain request. */
-    drain_id: string;
-    event: DrainReceiptEvent;
-    /** Payout rail: `cashu` | `x402` | `tempo`. */
-    method: string;
-    /** Amount reclaimed, micro-units of the credit's currency. */
-    amount_micro: number;
-    /**
-     * Credit balance left after the drain debit, in micro-units. It includes
-     * pending job holds at request time and is fixed across this drain's event receipts.
-     */
-    balance_after_micro: number;
-    /** Per-credit monotonic sequence the drain consumed, shared with draws. */
-    ledger_seq: number;
-    /** Unix seconds at which this receipt was signed. */
-    issued_at: number;
-    /** The credit owner's x-only pubkey — who the money is owed to. */
-    caller_pubkey: string;
-    /** Immutable DVM identity bound into the builder attestation. */
-    dvm_id: string;
-    /** DVM slug, as bound in the builder attestation. */
-    dvm: string;
-    /** x-only secp256k1 pubkey that signed this receipt (64 hex chars). */
-    receipt_pubkey: string;
-    /** BIP-340 Schnorr signature over the canonical receipt minus `signature`. */
-    signature: string;
-}
-type UnsignedDrainReceipt = Omit<DrainReceipt, "signature">;
-/**
- * A DVM-signed proof that one payment funded a prepaid credit.
- * The balance and sequence are the values fixed when the funding committed;
- * retries return this original artifact even when the credit moved later.
- */
-interface FundingReceipt {
-    v: 1;
-    /** Discriminator separating funding evidence from job and drain receipts. */
-    kind: "credit_funding";
-    credit_id: string;
-    /** Caller fund id, or the attached rail payment id for fund-and-draw. */
-    fund_id: string;
-    /** Amount credited, in micro-units of the credit currency. */
-    funded_micro: number;
-    /** Available balance immediately after this funding operation committed. */
-    balance_after_micro: number;
-    /** Per-credit high-water sequence at that same point. */
-    ledger_seq: number;
-    /** Unix seconds at which the funding artifact was first issued. */
-    issued_at: number;
-    /** The credit owner's x-only request-signing pubkey. */
-    caller_pubkey: string;
-    /** Immutable DVM identity bound into the builder attestation. */
-    dvm_id: string;
-    /** DVM slug, as bound in the builder attestation. */
-    dvm: string;
-    receipt_pubkey: string;
-    /** BIP-340 Schnorr signature over the canonical receipt minus `signature`. */
-    signature: string;
-}
-type UnsignedFundingReceipt = Omit<FundingReceipt, "signature">;
-/**
- * Hash the delivered result so a receipt binds to *what* was returned, not
- * just that something was.
- *
- * `sha256(canonicalize({ summary, artifact_hashes }))`, where each artifact
- * hash is `sha256(canonicalize(artifactContent))` in emission order (`[]`
- * when the job emitted none). Hashing the artifact *content object* rather
- * than trusting `content.sha256` — which is optional and which `ctx.artifact`
- * never fills in — keeps the hash recomputable by any consumer from exactly
- * the messages it received.
- *
- * **Pass `summary` only for a `completed` job.** On `failed`/`cancelled` the
- * SDK's durable terminal writes the terminal *reason* into the job's summary
- * column, so a verifier recomputing a non-completed receipt must pass
- * `undefined` here and read the reason off `receipt.reason` instead. The
- * issuer does the same (`resultHashFor` in `sdk/server/receipt-issuer.ts`).
- */
-declare function computeResultHash(summary: string | undefined, artifactContents: JsonValue[]): string;
-declare function signReceipt(unsigned: UnsignedJobReceipt, secretHex: string): JobReceipt;
-/**
- * Verify a receipt's self-consistency: the BIP-340 signature over the
- * canonical payload (minus `signature`) under the receipt's own
- * `receipt_pubkey`. Returns `false` rather than throwing on malformed input.
- *
- * This is only the inner link. A consumer that wants provenance must also
- * check `receipt_pubkey` against `/v1/info#builder`'s attested
- * `receipt_pubkey` and verify that attestation under the builder pubkey
- * (`verifyAttestation` in `builder-identity.ts`).
- */
-declare function verifyReceipt(receipt: JobReceipt): boolean;
-/**
- * Structural guard on a receipt that arrived from outside this process — off a
- * `/v1/job` response, or back out of the hand-editable `~/.dvm/receipts.jsonl`.
- *
- * Checks only that the load-bearing fields are the right *kind* of thing; it
- * deliberately does not judge the receipt. A well-formed receipt whose
- * signature doesn't hold is `invalid` and the caller must see it said so. A
- * body missing one of these fields is a different animal: consumers dereference
- * them unconditionally (`receiptDisplay`'s `paid.msats`, the attestation link's
- * `receipt_pubkey`), so an unguarded one throws `TypeError` and surfaces as an
- * `internal` exit — and it could never have verified anyway, since the
- * signature covers the whole canonical body. Refusing it costs no proof.
- *
- * One guard for both directions on purpose: what can't come in over the wire
- * must not be able to come back out of the file.
- *
- * Release coupling: adding or requiring a field here changes both the SDK's
- * emitted wire shape and the caller CLI's accepted shape. Name the first-party
- * fleet redeploy as a prerequisite in the release note before publishing the
- * stricter caller; see `public compatibility guide`.
- */
-declare function isSignedJobReceipt(value: unknown): value is JobReceipt;
-/** Sign an unsigned drain receipt — same canonicalisation as {@link signReceipt}. */
-declare function signDrainReceipt(unsigned: UnsignedDrainReceipt, secretHex: string): DrainReceipt;
-/** Sign an unsigned funding receipt using the common receipt canonicalisation. */
-declare function signFundingReceipt(unsigned: UnsignedFundingReceipt, secretHex: string): FundingReceipt;
-declare function isFundingReceipt(value: unknown): value is FundingReceipt;
-declare function verifyFundingReceipt(receipt: FundingReceipt): boolean;
-/**
- * Structural guard on a drain receipt from outside this process — off a
- * `/v1/credit` drain response, or back out of `~/.dvm/credits.json`.
- *
- * Same contract and same reasoning as {@link isSignedJobReceipt}: both homes
- * type these `unknown[]` because neither the wire nor a hand-editable file is
- * evidence of shape, and the chain walk dereferences `receipt_pubkey`
- * unconditionally. A body missing one of these fields could never have carried
- * a valid signature anyway, so refusing it costs no proof.
- * Required-field changes follow the fleet-before-caller release note linked
- * from {@link isSignedJobReceipt}.
- */
-declare function isDrainReceipt(value: unknown): value is DrainReceipt;
-/**
- * Verify a drain receipt's self-consistency, mirroring {@link verifyReceipt}
- * the same provenance caveat applies: check `receipt_pubkey` against the
- * DVM's attested `receipt_pubkey` for the outer link.
- */
-declare function verifyDrainReceipt(receipt: DrainReceipt): boolean;
-
-/**
- * Cashu and Lightning credits owe unused sats back at each deposit's funding
- * rate. Keep the sats/micro basis per funding lot: a pooled ratio loses the
- * basis of top-ups made at different rates. Settled draws and reclaims share
- * these lots so their total equals the sats funded.
- */
-/**
- * The rails whose credits carry a Bitcoin deposit this ledger owes back in
- * kind — Cashu and Lightning funding, both of which leave sats in the
- * provider's own custody.
- *
- * Declared as its own list rather than derived by subtracting the stablecoin
- * rails: a channel-backed credit is in-kind *structurally* (the escrow retains
- * the unused value), so it needs no lots at all, and a rail added to
- * {@link FundingMethod} must be a decision here rather than a default.
- */
-declare const NON_CHANNEL_BITCOIN_RAILS: readonly ["cashu", "lightning"];
-type NonChannelBitcoinRail = (typeof NON_CHANNEL_BITCOIN_RAILS)[number];
-declare function isNonChannelBitcoinRail(rail: string | null | undefined): rail is NonChannelBitcoinRail;
-/**
- * One funding event's deposit: the sats that arrived and the credit micro they
- * bought, with however much of that micro is still unspent.
- *
- * `remainingMicro` is depleted FIFO by settled draws and by reclaims, so the
- * sum of a credit's lots tracks `credits.balance_micro` exactly — with one
- * deliberate exception: an expiry release zeroes the balance and
- * leaves the lots standing, because a revival restores that balance and its
- * in-kind basis has to still be there. A released credit is excluded from the
- * sweep floor by `BITCOIN_CREDIT_PREDICATE`'s own `balance_micro > 0`, so the
- * over-coverage is never counted as sats the builder owes back.
- */
-interface FundingLot {
-    lotId: string;
-    creditId: string;
-    rail: NonChannelBitcoinRail;
-    /** Sats this funding delivered. `0` on a credit funded before a rail basis was recorded. */
-    satsFunded: number;
-    /** Credit micro this funding bought — the lot's denominator, never depleted. */
-    creditedMicro: number;
-    remainingMicro: number;
-    /** Rail settlement reference, provenance only. */
-    fundingRef: string | null;
-    createdAt: number;
-}
-interface LotDebit {
-    lotId: string;
-    micro: number;
-    /** Decrease in this lot's floored sats obligation after taking the micro debit. */
-    sats: number;
-}
-interface LotDepletion {
-    debits: LotDebit[];
-    satsOwed: number;
-    /** Micro the lots could not cover. Non-zero means the credit's lots are short. */
-    uncoveredMicro: number;
-    /** Of the micro taken, how much came out of a lot carrying a real sats basis. */
-    backedMicro: number;
+interface X402RefundSettlementGate {
+    pendingRefundSettlement(channelId: string, statuses: X402SettlementStatus[]): Promise<X402UnresolvedRefund | undefined>;
 }
 /**
- * Deplete lots in FIFO order, supplied by fifoOrder. Price each debit as
- * lotSats(before) - lotSats(after), not the independently floored slice: small
- * draws then telescope to the full deposit instead of losing up to one sat
- * per draw. Fractional remaining sats stay with the provider.
- */
-declare function depleteLots(lots: FundingLot[], amountMicro: number): LotDepletion;
-/**
- * What a settling draw's fiat debit was worth in kind, in millisatoshis
- * `null` where the lots cannot price it.
- *
- * This is the single sats authority for a non-channel Bitcoin credit. The
- * settle already depletes the lots the draw consumed, so the figure costs no
- * extra read: it is `depletion.satsOwed` in the ledger's own msat unit, and
- * stamping it on `credit_draws.draw_msats` is what makes
- * `Σ settled draw sats + reclaim sats == Σ sats funded` close per credit.
- *
- * `null` follows {@link isInKindDepletion} exactly, so a settle and a reclaim
- * fall back together: lots short of the balance, or covering lots with no sats
- * basis, keep the pooled pro-rata figure rather than blending a lot rate with
- * a blended one. Mixed coverage counts as unpriceable for the same reason it
- * does on the reclaim.
- */
-declare function inKindDrawMsats(depletion: LotDepletion, amountMicro: number): number | null;
-/**
- * What these lots owe in kind if every remaining micro were reclaimed now —
- * the deposit-liability figure, and the floor the hub must never be swept
- * below.
- */
-declare function lotOwedSats(lots: FundingLot[]): number;
-/**
- * Refund delivery uses a fixed eight-sat reserve so owed_sats cannot shrink
- * after it is promised. Extra delivery cost is absorbed by the provider;
- * unused reserve stays with the provider, like fractional-sat dust.
- */
-declare const DRAIN_DELIVERY_RESERVE_SATS = 8;
-/**
- * The figure a reclaim publishes: its in-kind gross less
- * {@link DRAIN_DELIVERY_RESERVE_SATS}, floored at zero.
+ * Postgres implementation of x402's server-side {@link ChannelStorage}.
  *
- * Zero is a refusal rather than a payout — a balance worth no more than what
- * it costs to send is `drain_below_dust`, since parking a zero-value token
- * would hold the servicer's queue open forever.
- */
-declare function netOwedSats(grossSats: number): number;
-/**
- * The order lots deplete in: oldest first, `lotId` breaking a tie.
+ * `updateChannel` takes an advisory transaction lock before it reads the row,
+ * so the read/callback/write sequence is atomic even for a first deposit whose
+ * row does not exist yet. {@link withChannelTransaction} exposes the same
+ * transaction to the credit ledger: the fixed lock order is channel first,
+ * credit second, and no credit-ledger path calls back into this store.
  *
- * A tiebreak is not decoration — lot ids are surrogates rather than a
- * per-credit sequence (`fund` takes no credit lock, so two concurrent
- * fundings cannot cooperate on a counter), and two fundings can land on the
- * same millisecond. Without it the FIFO order is whatever the planner
- * returned, and a reclaim's figure would depend on it.
- */
-declare function fifoOrder(left: FundingLot, right: FundingLot): number;
-/**
- * Missing lot coverage or a zero legacy sats basis requires pooled pricing.
- * Mixed backed/unbacked lots also fall back: combining lot and live rates
- * would claim a value neither basis supports.
- */
-declare function isInKindDepletion(depletion: LotDepletion, amountMicro: number): boolean;
-
-/** The rails a payout lands on. Lightning never pays out: credits fund straight into the receive wallet. */
-type PayoutRail = "cashu" | "x402" | "tempo";
-/**
- * Transfers aggregate payments: a Cashu melt, x402 batch to pay_to, or Tempo recipient
- * settlement/close.
- */
-type PayoutKind = "melt" | "batch" | "close" | "settle";
-type PayoutRepairKind = "x402_settlement_reconciled" | "lightning_invoice_reconciled" | "tempo_close_reconciled";
-/**
- * One landed movement into builder custody. Platform retries deduplicate by (dvmId,
- * payoutId); repaired redelivery upgrades that movement rather than adding another.
+ * Two pools, and the split is load-bearing. The settlement markers
+ * must write *outside* the ledger transaction, which means a second connection
+ * taken while the transaction's client is still checked out — on the shared
+ * host pool that is a self-deadlock the moment concurrent deposits reach its
+ * `max`, with no error and no timeout because every waiter is also a holder.
+ * They therefore run on a small dedicated pool that acquires nothing itself,
+ * so nothing can ever queue behind them. The rule this rests on: a client held
+ * from one pool may only ever be used to acquire from a pool that is terminal.
+ * {@link withFleetSettlementLock} and {@link withRelaySubmissionLock} are the
+ * other two nesting sites and are bounded a different way — see their docs.
  */
-interface PayoutReportPayload {
+declare class PostgresX402ChannelStorage implements ChannelStorage {
+    private readonly pool;
+    private hostingCleanupFence?;
+    useHostingCleanupFence(fence: HostingCleanupFence): void;
+    assertHostingFundingReservation(reservation: HostedFundingReservation | undefined): Promise<void>;
+    private readonly transaction;
+    private readonly hostedFunding;
+    private readonly refundBase;
+    private settlementPool?;
+    private fleetLock;
+    private fleetLockQueueDepth;
+    private readonly relayLockTimeoutMs;
+    private readonly terminalizeUnbackedCredit?;
+    private readonly hostedNetwork?;
+    constructor(pool: Pool, opts?: X402ChannelStorageOpts);
+    init(): Promise<void>;
+    /**
+     * Read the fleet's durable "claimed funds are awaiting transfer" marker.
+     *
+     * Upstream keeps this in process memory, which a multi-machine fleet cannot
+     * share: the machine that won a claim tick is rarely the one that wins the
+     * next settle tick. An unset scope reads false, so a receiver that has never
+     * claimed never submits a settlement.
+     *
+     * Both accessors run on the settlement pool: every caller reads or writes the
+     * marker while {@link withFleetSettlementLock} holds a host-pool client, which
+     * is the nesting the split exists to keep off a non-terminal pool.
+     */
+    isSettlePending(scope: string): Promise<boolean>;
+    /** Record whether a claim's funds still need a `settle(receiver, token)` transfer. */
+    setSettlePending(scope: string, pending: boolean): Promise<void>;
+    /**
+     * Look up the durable settlement state for one credit-ledger effect.
+     *
+     * On the dedicated settlement pool like every other marker, and for a sharper
+     * reason than they had: this and {@link prepareSettlement} now run *inside*
+     * the channel transaction, which holds a host-pool client for its
+     * whole duration. Taking a second client from that same pool is the
+     * self-deadlock fixed — at pool max every client is a holder and a
+     * waiter — and moving these calls under the transaction is exactly what would
+     * reintroduce it.
+     */
+    getSettlement(operation: "fund" | "refund", effectId: string): Promise<X402SettlementIntent | undefined>;
     /**
-     * Platform record ID; must match the bearer token’s DVM.
+     * The refund on this channel that is neither finished nor abandoned, if there
+     * is one — the credit ledger's spend gate.
+     *
+     * `statuses` is the caller's, because the two gates disagree by design: a
+     * draw is blocked by {@link X402_SPEND_BLOCKING_SETTLEMENT_STATUSES}, a fresh
+     * drain only by {@link X402_WEDGED_SETTLEMENT_STATUSES}.
+     *
+     * On the dedicated settlement pool, and that is what makes the gate callable
+     * at all: a draw routinely runs inside an open channel transaction holding a
+     * host-pool client, and taking a second one from that pool is the
+     * self-deadlock. The oldest blocking row wins, so a channel that somehow
+     * accumulated two names the one an operator should reach for first.
+     *
+     * Projects three columns rather than decoding a whole {@link
+     * X402SettlementIntent}: the decoder refuses a legacy row that carries
+     * no reconciliation snapshot, and a gate that throws on one would take every
+     * draw on that channel down with it — when the row is exactly the kind that
+     * ought to block them.
      */
-    dvmId: string;
-    /** Required. The DVM's own id for the movement — `cashu:melt:<quote>`, `x402:batch:<uuid>`, `tempo:<tx>`. */
-    payoutId: string;
-    rail: PayoutRail;
-    kind: PayoutKind;
+    pendingRefundSettlement(channelId: string, statuses: X402SettlementStatus[]): Promise<X402UnresolvedRefund | undefined>;
     /**
-     * Positive rail-native atomic units: sats or USDC micro.
+     * Read one settlement by its own identifier — the handle an operator holds
+     * Same dedicated pool as {@link getSettlement}, for the same
+     * reason: the repair reads this while a channel transaction may be open.
      */
-    nativeAmount: number;
-    nativeAsset: "sats" | "usdc";
-    /** Where it landed; `null` for a melt, whose Lightning destination the platform never records. */
-    recipient: string | null;
+    getSettlementById(settlementId: string): Promise<X402SettlementIntent | undefined>;
+    /** Lazily move a legacy settlement row onto its authorization/effect-scoped replay key. */
+    normalizeLegacyPaymentId(settlementId: string, operation: "fund" | "refund", legacyPaymentId: string, paymentId: string): Promise<X402SettlementIntent>;
     /**
-     * Descriptive mechanism references, never an arithmetic basis.
+     * The operator's repair queue: settlements stuck between "chain paid" and
+     * "ledger booked", oldest write first.
+     *
+     * Keyset-paginated on `(created_at, settlement_id)` for the reason the
+     * blocked-invoice queue is: a wedged row never self-clears, so a fixed first
+     * page of rows the operator has declined to act on would starve everything
+     * behind it on every run, forever.
+     *
+     * The keyset is on `created_at`, which never moves, while `updatedBeforeMs`
+     * filters on `updated_at`, which does — so a row an operator touches mid-walk
+     * can leave the queue but can never jump the cursor and be skipped. The cursor
+     * itself is Postgres's text rendering of that timestamp, handed back verbatim;
+     * see {@link X402SettlementCursor} for why a `Date` cannot carry it.
+     *
+     * `updatedBeforeMs` is the staleness floor. A healthy settlement passes
+     * through `submitting` and `settled` inside one request, so anything younger
+     * than the floor is in flight rather than wedged and must not be offered as
+     * repairable work.
      */
-    refs: Record<string, unknown>;
-    /** Required. When the money landed (epoch ms). */
-    landedAt: number;
-    repaired?: boolean;
-    /** Required iff `repaired`. */
-    repairKind?: PayoutRepairKind;
-}
-interface PayoutWedge {
-    id: string;
+    listSettlements(args: {
+        statuses: X402SettlementStatus[];
+        updatedBeforeMs: number;
+        limit: number;
+        after?: X402SettlementCursor;
+    }): Promise<X402SettlementPage>;
     /**
-     * `settle`: an x402 batch whose transfer keeps failing (auto-retried).
-     * `refund`: an x402 cooperative refund wedged between chain and ledger —
-     * caller money, not in the pool. `close`: a Tempo close wedged the same way.
-     * `melt`: cashu rows whose builder-side melt failed.
+     * Close a wedged settlement without booking anything.
+     *
+     * A single-statement CAS on the wedged statuses, on the settlement pool —
+     * there is no ledger effect to be atomic with, which is the whole point:
+     * the write-off records that an operator reviewed this settlement and is not
+     * completing it, and no dvmkit table moves. Idempotent, and the first note
+     * wins; `written` is the transition bit the caller logs on, so the one place
+     * the amount is ever recorded gets exactly one entry.
+     *
+     * Reversible by construction: a later reconcile calls
+     * {@link recordSettlementResponse}, whose `status <> 'complete'` CAS lifts a
+     * written-off row back to `settled`.
      */
-    kind: "settle" | "refund" | "close" | "melt";
-    /** Epoch ms the wedge was first observed. */
-    since: number;
-    /** Retry count where the retry is automatic, else null. */
-    attempts: number | null;
-    /** Epoch ms of the next automatic retry, else null. */
-    nextRetry: number | null;
-    lastError: string | null;
-    /** Rail-native amount held up, when known. */
-    native?: number;
-}
-interface PayoutPool {
-    id: string;
-    native: number;
-    label?: string;
-}
-/**
- * A replaceable snapshot of one rail’s pending builder funds. Best-effort delivery uses no
- * durable queue; a later tick supersedes a lost report.
- */
-interface PayoutPendingPayload {
-    dvmId: string;
-    rail: PayoutRail;
-    /** Everything on this rail still moving toward the builder, in atomic units. */
-    poolNative: number;
-    nativeAsset: "sats" | "usdc";
-    items: number;
-    pools: PayoutPool[];
-    wedged: PayoutWedge[];
-    /** This DVM's clock when the snapshot was taken (epoch ms). */
-    snapshotAt: number;
-}
-interface PayoutTransport {
+    writeOffSettlement(settlementId: string, note: string | undefined, nowMs: number): Promise<X402SettlementWriteOff | undefined>;
+    /** Persist the reconciliation identity, refreshing a prepared retry's transient reservation. */
+    prepareSettlement(intent: X402SettlementIdentity, hostingFunding?: HostedFundingReservation): Promise<X402SettlementIntent>;
     /**
-     * Queue a payout through the caller's open transaction, so the row and the
-     * fact it reports commit or roll back together; without `tx` it is queued on
-     * its own. Durable once committed — the retry loop delivers it, or
-     * {@link PayoutTransport.drainPending} when a caller wants it now.
+     * Mark that the next operation is the ambiguous external-call boundary.
+     *
+     * `channelAtSubmission` is the live channel the facilitator is about to size
+     * and sign the settlement against — bookmarked here, with the
+     * block height, because these two are the only description of that instant
+     * that survives the call.
      */
-    enqueuePayout(payload: PayoutReportPayload, tx?: RevenueReporterQuerier): Promise<void>;
-    /** Queue a payout on its own and try to deliver it at once. */
-    reportPayout(payload: PayoutReportPayload): Promise<void>;
-    /** Best-effort: one POST, replaced by the next snapshot. */
-    reportPayoutPending(payload: PayoutPendingPayload): Promise<void>;
-    /** Deliver what is queued now rather than on the next retry tick. */
-    drainPending?(): Promise<void>;
-}
-/**
- * enqueue joins the money transaction and must throw on failure so its fact rolls back.
- * committed runs after commit, when delivery and snapshots can safely read the new state.
- */
-interface TransactionalPayoutHook<E> {
-    enqueue(event: E, tx: RevenueReporterQuerier): Promise<void>;
-    committed(): void;
+    markSettlementSubmitting(settlementId: string, submissionBlock: string, channelAtSubmission?: Channel): Promise<void>;
+    /** Return an explicitly failed facilitator submission to the safe retry phase. */
+    markSettlementRetryable(settlementId: string): Promise<void>;
+    /**
+     * Record a successful facilitator response independently of the enclosing
+     * ledger transaction.
+     *
+     * The write-off columns are cleared, not carried: this CAS is what lifts a
+     * `written_off` row back to `settled` (which is what makes the write-off
+     * reversible), and a row that is no longer written off must not still be
+     * carrying the note and resolution timestamp of a decision that has been
+     * reversed. On the live path the columns are already `NULL` and this is a
+     * no-op.
+     */
+    recordSettlementResponse(settlementId: string, response: SettleResponse$1): Promise<void>;
+    /**
+     * Mark the external settlement and ledger effect complete in the active transaction.
+     *
+     * `resolvedAtMs` is set only by the operator repair, so an audit
+     * read can tell a settlement that completed on its own from one a human had
+     * to finish.
+     */
+    completeSettlement(settlementId: string, resolvedAtMs?: number): Promise<void>;
+    get(channelId: string): Promise<Channel | undefined>;
+    /** List all channel snapshots in stable channel-id order. */
+    list(): Promise<Channel[]>;
+    /** Atomic backend-level read/modify/write for one channel. */
+    updateChannel(channelId: string, update: (current: Channel | undefined) => Channel | undefined): Promise<ChannelUpdateResult>;
+    /**
+     * Run channel state and its ledger effect under the channel lock.
+     *
+     * Upstream's voucher-only settle updates `chargedCumulativeAmount` through
+     * `updateChannel`. Keeping that update and `commitMarkedFunding` in this one
+     * transaction means a ledger refusal rolls the voucher state back. External
+     * deposit/refund responses are recorded separately before this transaction
+     * commits, leaving a durable reconciliation row if COMMIT fails.
+     */
+    /**
+     * Sanction one cooperative-refund base for the updates inside `operation`.
+     *
+     * The store cannot derive the base — it comes from the credit ledger — so
+     * this is how the settlement layer says "this exact decrease is the one the
+     * payer's verified refund voucher authorises". Outside this scope a decrease
+     * of `chargedCumulativeAmount` is refused flat, which is what keeps the
+     * arbitrary-decrease guard meaningful.
+     */
+    withSanctionedRefundBase<T>(base: string, operation: () => Promise<T>): Promise<T>;
+    withChannelTransaction<T>(channelId: string, operation: (tx: PoolClient) => Promise<T>, hostingFunding?: HostedFundingReservation): Promise<T>;
+    /** Durable effect bookkeeping reached while a caller already holds a host-pool client. */
+    withSettlementTransaction<T>(operation: (tx: PoolClient) => Promise<T>): Promise<T>;
+    /**
+     * Run one fleet-wide settlement operation, optionally waiting for the current owner.
+     *
+     * The lock is session-scoped, so its client stays checked out for the whole
+     * operation — and `operation()` (upstream's claim/settle) re-enters the pool
+     * through {@link updateChannel}. Two bounds keep that from wedging the pool
+     * local callers are serialized in-process, so this holds at most
+     * one client per process no matter how many requests arrive, and a waiting
+     * acquire carries a `lock_timeout` so a wedged fleet-mate can't pin that
+     * client — and the caller's request — indefinitely. A timeout reports the
+     * lock as not acquired, which is what every caller already handles.
+     *
+     * The queue depth is reserved synchronously, before the promise chain can
+     * yield. That makes the non-waiting form a true local try-lock even while the
+     * first caller is still acquiring its connection: an overlapping request
+     * returns `false` instead of queuing behind the facilitator operation.
+     */
+    withFleetSettlementLock(operation: () => Promise<unknown>, wait?: boolean): Promise<boolean>;
+    /**
+     * Hold the fleet-wide self-relay submission lock for one chain submission.
+     *
+     * The session lock keeps one per-DVM gas EOA to one in-flight submission
+     * across the whole fleet — two machines submitting at once collide on the
+     * nonce. It is reached from `resource.settlePayment` inside
+     * {@link withChannelTransaction} and from upstream's claim/settle inside
+     * {@link withFleetSettlementLock}, so on both paths a host-pool client is
+     * already checked out: it therefore acquires from the terminal settlement
+     * pool, which is the rule in this class's doc, and never from the host pool
+     * the caller is holding.
+     *
+     * The wait is bounded by `lock_timeout` and a timeout **refuses** rather than
+     * proceeding unlocked, which is where this differs from
+     * {@link withFleetSettlementLock}: a fleet lock nobody got means the claim is
+     * someone else's turn, while a submission lock nobody got means the caller
+     * must not submit at all. The refusal is typed and retryable, and names the
+     * holder when Postgres will tell us who it is.
+     *
+     * The relay's own in-process tail serialises callers before they reach here,
+     * so one process pins at most one settlement-pool client no matter how many
+     * deposits arrive.
+     */
+    withRelaySubmissionLock<T>(key: string, operation: () => Promise<T>): Promise<T>;
+    /** Release the dedicated settlement pool; the host-owned pool is left alone. */
+    close(): Promise<void>;
+    private settlementWriter;
+    private settlementPoolRef;
+    private runUnderFleetLock;
+    private updateInTransaction;
 }
-interface CashuMeltCompleted {
-    rows: {
-        id: string;
-        mintUrl: string;
-        proofAmount: number;
-    }[];
-    meltQuoteId: string;
-    paymentPreimage: string;
+
+type Query = Pick<Pool | PoolClient, "query">;
+type Rail = "x402" | "tempo";
+type Operation = "claim" | "refund" | "settle" | "close";
+type State = "reserved" | "observed" | "report_queued" | "delivered" | "no_report";
+interface ObligationRow {
+    id: string;
+    source_key: string;
+    dvm_id: string;
+    scope: string;
+    instance_id: string;
+    boot_epoch: string;
+    rail: Rail;
+    operation: Operation;
+    network: string;
+    contract: string;
+    channel_id: string;
+    original: Record<string, unknown>;
+    state: State;
+    tx_hash: string | null;
+    block_number: string | null;
+    block_hash: string | null;
+    delta_native: string | null;
+    payout_id: string | null;
+    report_id: string | null;
+    report_payload: Record<string, unknown> | null;
+}
+interface HostedEffectReservation {
+    id: string;
+    replayed: boolean;
 }
-interface TempoSessionSettled {
+interface HostedObservedEffect {
+    id: string;
     txHash: string;
-    channelId: string;
-    trigger: "settle" | "close" | "scheduled";
-    /** Cumulative amount settled to the payee on this channel, atomic units. */
-    amount: bigint;
-    /** Newly settled to the payee by this transaction, atomic units. */
-    delta: bigint;
+    blockNumber: string;
+    blockHash: string;
+    deltaNative: string;
 }
-interface TempoCloseReconciled {
+interface HostedRecoverableEffect {
+    id: string;
+    rail: Rail;
+    operation: Operation;
     channelId: string;
     txHash: string;
-    /** Captured by the payee — this DVM — per the receipt, atomic units as a decimal string. */
-    settledToPayee: string;
+    batchId?: string;
+    reportId: string | null;
+    blockHash: string | null;
+    deltaNative: string | null;
 }
-interface X402TrackedChannel {
-    channelId: string;
-    chargedCumulativeAmount: string;
-    totalClaimed: string;
-}
-interface X402WedgedRefund {
-    settlementId: string;
-    /** Epoch ms the settlement was first prepared. */
-    createdAt: number;
-    native?: number;
+interface X402Config {
+    network: string;
+    rpcUrl?: string;
+    receiver: string;
+    token: string;
 }
-interface X402PayoutContext {
-    /** `${network}|${payTo}|${token}` — the scope the settle-pending marker is keyed on. */
-    scope: string;
-    payTo: string;
+interface TempoConfig {
     network: string;
-    storage: {
-        list(): Promise<X402TrackedChannel[]>;
-    };
-    /** The scheduler's settle cadence — what a wedge's `nextRetry` is derived from. */
-    settleIntervalMs: number;
-    listWedgedRefunds?: () => Promise<X402WedgedRefund[]>;
+    rpcUrl?: string;
+    escrow: string;
+    payee: string;
+    token: string;
 }
-interface X402TrackedManager {
-    claim(...args: never[]): Promise<{
-        vouchers: number;
-        transaction: string;
-    }[]>;
-    settle(): Promise<{
-        transaction: string;
-    }>;
+/** Private, server-installed record of economic effects whose report may outlive the rail call. */
+declare class HostedSettlementReportObligations {
+    private readonly pool;
+    private readonly dvmId;
+    private readonly scope;
+    private x402?;
+    private tempo?;
+    private x402SettlementStore?;
+    constructor(pool: Pool, dvmId: string, scope: string);
+    configureX402(config: X402Config): void;
+    attachX402SettlementStore(store: PostgresX402ChannelStorage): void;
+    private x402Transaction;
+    configureTempo(config: TempoConfig): void;
+    init(): Promise<void>;
+    reserveX402(channelId: string, operation: "claim" | "refund", expected: {
+        charged?: string;
+        signature?: string;
+        refundNonce?: string;
+        refundAmount?: string;
+        voucherSignature?: string;
+        signedMax?: string;
+        authorizationPayload: Record<string, unknown>;
+        authorizationRequirements: {
+            scheme: string;
+            network: string;
+            asset: string;
+            payTo: string;
+            amount: string;
+        };
+    }): Promise<HostedEffectReservation | null>;
+    reserveTempo(channelId: string, operation: "settle" | "close", drainId?: string): Promise<HostedEffectReservation>;
+    findPendingTempo(channelId: string, operation: "settle" | "close"): Promise<ObligationRow | undefined>;
+    submittedIds(rail: Rail, operation: Operation, txHash: string, batchId?: string): Promise<string[]>;
+    refundClaimDelta(txHash: string, channelId: string): Promise<bigint>;
+    assertReservedTempoClose(id: string, channelId: string): Promise<void>;
+    originalTempoCloseSettled(id: string, channelId: string, txHash: string): Promise<bigint>;
+    settlementId(batchId: string, txHash: string): Promise<string>;
+    reserveOpenX402Settlement(): Promise<HostedEffectReservation>;
+    private ensureOpenX402Batch;
+    recordSubmitted(id: string, txHash: string): Promise<void>;
+    recoveryCandidates(): Promise<HostedRecoverableEffect[]>;
+    recoverOriginalX402Refunds(): Promise<Array<{
+        id: string;
+        error: unknown;
+    }>>;
+    reconcileX402Batches(): Promise<Array<{
+        id: string;
+        error: unknown;
+    }>>;
+    queueReport(ids: string[], payoutId: string, reportId: string, payload: Record<string, unknown>, tx: Query): Promise<void>;
+    hasOriginalReport(ids: string[], payoutId: string, payload: Record<string, unknown>, tx: Query): Promise<boolean>;
+    assertReportReady(reportId: string, payload: Record<string, unknown>, query?: Query): Promise<void>;
+    acknowledgeDelivered(reportId: string, tx: Query, requireLinked?: boolean): Promise<void>;
+    observeCanonical(id: string): Promise<HostedObservedEffect>;
+    private lockRow;
+    unresolvedCount(query?: Query): Promise<number>;
+    hasCompleteHistory(query?: Query): Promise<boolean>;
+    private lockIdentity;
+    private insert;
 }
+
+type JsonValue = string | number | boolean | null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
 /**
- * The batch-settlement server's view of the reporter: attach once with the
- * scope, then route every claim and settle through the tracked manager so
- * the open batch is kept and the settle emits the payout.
+ * Object keys sort recursively in UTF-16 code-unit order; arrays preserve order.
+ * Undefined object properties are omitted. Unsupported scalars, including
+ * non-finite numbers, throw TypeError. Callers strip unsigned fields themselves.
  */
-interface X402PayoutObserver {
-    attach(ctx: X402PayoutContext): void;
-    trackManager<M extends X402TrackedManager>(manager: M): M;
-    /** A settle that landed outside the tracked manager — the manual claim-and-settle's own retry loop. */
-    recordSettle(transaction: string): Promise<void>;
-    /** A settle attempt that failed outside the tracked manager. One call per attempt a builder would count as one. */
-    recordSettleFailure(error: unknown): Promise<void>;
-}
-interface TempoPayoutReader {
-    recipient?: string;
-    /** CAIP-2 network for the refs, when known. */
-    network?: string;
-    listActive?: (limit: number, cursor?: {
-        updatedAt: number;
-        key: string;
-    }) => Promise<{
-        key: string;
-        state: Record<string, unknown>;
-        updatedAt: number;
-    }[]>;
-    listChannelDrains?: (args: {
-        limit: number;
-        after?: ChannelDrainCursor;
-        createdBeforeMs: number;
-        rail: "tempo";
-    }) => Promise<CreditDrainRecord[]>;
-}
+declare function canonicalize(value: JsonValue): string;
 /**
- * Claims accumulated since the last settle. The batch is durable across machines: claims and
- * eventual settlement can run on different hosts under the fleet lock.
+ * UTF-8 encoding of the canonical JSON form.
  */
-interface X402OpenBatch {
-    scope: string;
-    batchId: string;
-    claimedNative: bigint;
-    voucherCount: number;
-    claims: number;
-    openedAt: number;
-    attempts: number;
-    firstFailedAt: number | null;
-    lastError: string | null;
-    nextRetryAt: number | null;
-}
-interface X402BatchStore {
-    get(scope: string): Promise<X402OpenBatch | undefined>;
-    put(batch: X402OpenBatch): Promise<void>;
-    delete(scope: string): Promise<void>;
+declare function canonicaliseForSigning(value: JsonValue): Uint8Array;
+
+type ReceiptOutcome = "completed" | "failed" | "cancelled";
+interface ReceiptPayment {
+    /** Total credited millisats. `0` on free jobs — they still get receipts. */
+    msats: number;
     /**
-     * Atomically delete the matching batch and enqueue its payout. Failed enqueue preserves the
-     * batch for retry; false means the scope no longer holds batchId and nothing was queued.
+     * Rail of the most recent successful credit; `null` when nothing was paid.
+     * `lightning` appears on a draw against a credit the caller funded by
+     * invoice — it is a funding rail, never an attached-proof one.
      */
-    settle(scope: string, batchId: string, enqueue: (tx?: RevenueReporterQuerier) => Promise<void>): Promise<boolean>;
+    rail: "cashu" | "x402" | "tempo" | "lightning" | null;
+    /** Rail-native upfront amount (sats / USDC microunits), `null` when absent. */
+    native_amount: number | null;
+    native_asset: string | null;
+    /** Settlement reference: EVM tx hash (x402), mppx challenge id, or the Cashu request id. */
+    tx_hash: string | null;
+    /** Cashu mint the proofs were drawn on, `null` off the Cashu rail. */
+    mint: string | null;
 }
-interface PayoutReporterOpts {
-    dvmId: string;
-    transport: PayoutTransport;
-    /**
-     * Postgres holds durable x402 batches and supplies Cashu snapshots. Without it, the default
-     * batch store is memory and Cashu snapshots are omitted.
-     */
-    db?: Pool;
-    /**
-     * Only accumulator hosts create wallet_accumulator; enabling this on another host makes
-     * each snapshot query fail.
-     */
-    cashu?: boolean;
-    /** Override the batch store (tests); defaults to Postgres on `db`, memory without. */
-    batchStore?: X402BatchStore;
-    /** Snapshot cadence, ms. Default 5 minutes. */
-    snapshotIntervalMs?: number;
-    now?: () => number;
+/**
+ * Credit-draw countersignature block. Present on every job whose payment funded
+ * or drew the credit
+ * ledger — including implicit N=1 per-job payments, which fund and draw a
+ * single-use credit in the same request. A caller holding a DVM-signed
+ * balance trajectory plus its own caller-signed draw intents can prove
+ * misbehaviour from artifacts both sides already possess; that only works
+ * because the countersignature rides the receipt.
+ *
+ * Absence is signature-compatible: `canonicalize` omits absent keys, so a
+ * ledger-less (or free) job's receipt signs identically to a legacy
+ * receipt.
+ */
+interface ReceiptCredit {
+    credit_id: string;
+    /** This draw's identifier — matches the caller-signed draw intent. */
+    draw_id: string;
+    /** Amount drawn, in the credit's denomination. */
+    amount: number;
+    balance_after: number;
+    /** Per-credit monotonic draw counter. */
+    ledger_seq: number;
 }
 /**
- * Cashu melts and repaired Tempo closes enqueue inside their caller’s transaction and
- * propagate failures. x402 reporting and pending snapshots instead log failures; failed x402
- * enqueue preserves the open batch for retry.
+ * A DVM-signed proof of what a job did and what it cost.
+ *
+ * Signed once at the terminal transition by the per-DVM receipt key, whose
+ * authority chains to the builder identity key through the deploy-time
+ * attestation (`/v1/info#builder`, `attestation.receipt_pubkey`). Served
+ * identically on the synchronous `POST /v1/job` 200, on `GET /v1/job/:id`,
+ * and on every later re-read — the bytes are persisted, not recomputed.
  */
-declare class PayoutReporter implements PayoutTransport {
-    private readonly dvmId;
-    private readonly transport;
-    private readonly db?;
-    private readonly cashu;
-    private readonly batches;
-    private readonly ownsBatchStore;
-    private readonly intervalMs;
-    private readonly now;
-    private lastX402SnapshotAt;
-    private x402?;
-    private tempo?;
-    private timer;
-    private warmup;
-    constructor(opts: PayoutReporterOpts);
-    init(): Promise<void>;
-    /**
-     * Start the snapshot loop. Unref'd, so it never keeps a scale-to-zero
-     * machine awake; a first snapshot runs shortly after boot so a fresh process
-     * reports without waiting a whole interval.
-     */
-    start(): void;
-    stop(): void;
-    enqueuePayout(payload: PayoutReportPayload, tx?: RevenueReporterQuerier): Promise<void>;
-    reportPayout(payload: PayoutReportPayload): Promise<void>;
-    reportPayoutPending(payload: PayoutPendingPayload): Promise<void>;
-    /** Deliver what is queued now; a transport without the seam waits for its retry loop. */
-    flush(): Promise<void>;
-    meltHook(): TransactionalPayoutHook<CashuMeltCompleted>;
-    /**
-     * Report melted face value per mint, not the Lightning amount received after fees. Hash the
-     * payment preimage; do not publish it. With tx, propagate enqueue failures and defer
-     * delivery until commit. Without tx, enqueue independently and start delivery.
-     */
-    cashuMelted(event: CashuMeltCompleted, tx?: RevenueReporterQuerier): Promise<void>;
-    attachTempo(reader: TempoPayoutReader): void;
-    /**
-     * A Tempo channel settled or closed on chain. `delta` is what this
-     * transaction newly paid the recipient; a transaction that paid nothing new
-     * (a close of a fully settled channel) is no payout.
-     */
-    tempoSettled(event: TempoSessionSettled): Promise<void>;
-    tempoRepairHook(): TransactionalPayoutHook<TempoCloseReconciled>;
-    /**
-     * Report the receipt’s payee total under the live close’s transaction ID, flagged repaired.
-     * The platform upgrades a live row if one exists. Join tx and propagate enqueue failures;
-     * this does not report the caller refund.
-     */
-    tempoCloseReconciled(event: TempoCloseReconciled, tx?: RevenueReporterQuerier): Promise<void>;
-    x402Observer(): X402PayoutObserver;
-    /**
-     * Read claim deltas from storage because upstream returns voucher counts. Under the fleet
-     * lock, before/after reads are consistent. A deleted channel contributes its pre-claim
-     * unclaimed value, including refund claim-then-delete.
-     */
-    private trackX402Manager;
-    private recordX402Claim;
-    private recordX402Settle;
-    private recordX402SettleFailure;
-    /** Every rail this reporter can read, each on its own failure boundary. */
-    snapshot(): Promise<void>;
+interface JobReceipt {
+    v: 1;
+    job_id: string;
+    /** Immutable DVM identity bound into the builder attestation. */
+    dvm_id: string;
+    /** DVM slug, as bound in the builder attestation. */
+    dvm: string;
+    capability: string;
+    outcome: ReceiptOutcome;
+    /** Signed Unix millisecond lifecycle times; absent on legacy receipts. */
+    timing?: {
+        accepted_at_ms: number;
+        terminal_at_ms: number;
+        caller_wait_ms: number;
+    };
+    /** SDK-derived attribution on failure/cancellation; absent on completion and legacy receipts. */
+    ended_by?: "caller" | "provider";
+    /** Terminal reason on `failed`/`cancelled` (e.g. `worker_died_mid_job`); `null` on success. */
+    reason: string | null;
+    /** Per-DVM monotonic terminal counter. Gaps expose receipt suppression. */
+    seq: number;
+    /** Unix seconds at which the receipt was signed. */
+    issued_at: number;
+    /** Caller's x-only pubkey when signed-request auth was used; `null` otherwise. */
+    requester_pubkey: string | null;
+    paid: ReceiptPayment;
     /**
-     * Cashu: every unmelted proof in the accumulator, per mint. Rows whose
-     * builder-side melt failed are still in the pool (they are still at the
-     * mint) and listed as wedged until `restart-failed` clears them.
+     * {@link computeResultHash} over the delivered result; `null` when nothing
+     * was delivered. The summary is part of the hash only on `completed` — see
+     * {@link computeResultHash}.
      */
-    snapshotCashu(): Promise<void>;
+    result_hash: string | null;
+    /** x-only secp256k1 pubkey that signed this receipt (64 hex chars). */
+    receipt_pubkey: string;
+    /** BIP-340 Schnorr signature over the canonical receipt minus `signature` (128 hex chars). */
+    signature: string;
     /**
-     * x402: the open batch (claimed, not yet transferred) plus every channel's
-     * unclaimed voucher value; wedged when the settle keeps failing, and the
-     * refund settlements stuck between chain and ledger beside it.
+     * Credit-draw countersignature — present when the job's payment
+     * funded/drew the credit ledger. See {@link ReceiptCredit}. `balance_after`
+     * reflects the terminal resolution: the recorded draw trajectory on a
+     * settled (completed) job, the restored available balance on a released
+     * (failed/cancelled) one.
      */
-    snapshotX402(): Promise<void>;
+    credit?: ReceiptCredit;
+}
+type UnsignedJobReceipt = Omit<JobReceipt, "signature">;
+type DrainReceiptEvent = "requested" | "parked" | "picked_up" | "sent" | "released";
+/**
+ * A DVM-signed proof of one reclaim event. One receipt per
+ * lifecycle transition — `requested` (the balance debited into the drain
+ * liability), `parked` (Cashu notes locked to the caller's refund key,
+ * parked for pickup), `picked_up` (the caller collected them), `sent` (a
+ * Lightning/x402/mpp send-back settled).
+ *
+ * The evidence pairing: the caller holds the drain *request* it signed (the
+ * `/v1/credit` envelope), the DVM countersigns each state the drain reaches.
+ * A `requested` receipt with no later `parked`/`sent` is a signed IOU whose
+ * refusal is provable from artifacts both sides already hold — reclaim is
+ * enforced by reputation with cryptographic evidence, not new crypto.
+ *
+ * Signed by the same per-DVM receipt key as {@link JobReceipt}, over the
+ * same canonicalisation, so one attestation chain covers both.
+ */
+interface DrainReceipt {
+    v: 1;
+    /** Discriminator separating this from a `JobReceipt` in mixed stores. */
+    kind: "credit_drain";
+    credit_id: string;
+    /** This drain's identifier — matches the caller-signed drain request. */
+    drain_id: string;
+    event: DrainReceiptEvent;
+    /** Payout rail: `cashu` | `x402` | `tempo`. */
+    method: string;
+    /** Amount reclaimed, micro-units of the credit's currency. */
+    amount_micro: number;
     /**
-     * Tempo: each active channel's spent-but-unsettled balance — earned, not
-     * yet paid to the recipient — and the cooperative closes wedged between
-     * chain and ledger, aged past the same floor the repair queue
-     * uses so an in-flight close is not reported as stuck.
+     * Credit balance left after the drain debit, in micro-units. It includes
+     * pending job holds at request time and is fixed across this drain's event receipts.
      */
-    snapshotTempo(): Promise<void>;
+    balance_after_micro: number;
+    /** Per-credit monotonic sequence the drain consumed, shared with draws. */
+    ledger_seq: number;
+    /** Unix seconds at which this receipt was signed. */
+    issued_at: number;
+    /** The credit owner's x-only pubkey — who the money is owed to. */
+    caller_pubkey: string;
+    /** Immutable DVM identity bound into the builder attestation. */
+    dvm_id: string;
+    /** DVM slug, as bound in the builder attestation. */
+    dvm: string;
+    /** x-only secp256k1 pubkey that signed this receipt (64 hex chars). */
+    receipt_pubkey: string;
+    /** BIP-340 Schnorr signature over the canonical receipt minus `signature`. */
+    signature: string;
+}
+type UnsignedDrainReceipt = Omit<DrainReceipt, "signature">;
+/**
+ * A DVM-signed proof that one payment funded a prepaid credit.
+ * The balance and sequence are the values fixed when the funding committed;
+ * retries return this original artifact even when the credit moved later.
+ */
+interface FundingReceipt {
+    v: 1;
+    /** Discriminator separating funding evidence from job and drain receipts. */
+    kind: "credit_funding";
+    credit_id: string;
+    /** Caller fund id, or the attached rail payment id for fund-and-draw. */
+    fund_id: string;
+    /** Amount credited, in micro-units of the credit currency. */
+    funded_micro: number;
+    /** Available balance immediately after this funding operation committed. */
+    balance_after_micro: number;
+    /** Per-credit high-water sequence at that same point. */
+    ledger_seq: number;
+    /** Unix seconds at which the funding artifact was first issued. */
+    issued_at: number;
+    /** The credit owner's x-only request-signing pubkey. */
+    caller_pubkey: string;
+    /** Immutable DVM identity bound into the builder attestation. */
+    dvm_id: string;
+    /** DVM slug, as bound in the builder attestation. */
+    dvm: string;
+    receipt_pubkey: string;
+    /** BIP-340 Schnorr signature over the canonical receipt minus `signature`. */
+    signature: string;
+}
+type UnsignedFundingReceipt = Omit<FundingReceipt, "signature">;
+/**
+ * Hash the delivered result so a receipt binds to *what* was returned, not
+ * just that something was.
+ *
+ * `sha256(canonicalize({ summary, artifact_hashes }))`, where each artifact
+ * hash is `sha256(canonicalize(artifactContent))` in emission order (`[]`
+ * when the job emitted none). Hashing the artifact *content object* rather
+ * than trusting `content.sha256` — which is optional and which `ctx.artifact`
+ * never fills in — keeps the hash recomputable by any consumer from exactly
+ * the messages it received.
+ *
+ * **Pass `summary` only for a `completed` job.** On `failed`/`cancelled` the
+ * SDK's durable terminal writes the terminal *reason* into the job's summary
+ * column, so a verifier recomputing a non-completed receipt must pass
+ * `undefined` here and read the reason off `receipt.reason` instead. The
+ * issuer does the same (`resultHashFor` in `sdk/server/receipt-issuer.ts`).
+ */
+declare function computeResultHash(summary: string | undefined, artifactContents: JsonValue[]): string;
+declare function signReceipt(unsigned: UnsignedJobReceipt, secretHex: string): JobReceipt;
+/**
+ * Verify a receipt's self-consistency: the BIP-340 signature over the
+ * canonical payload (minus `signature`) under the receipt's own
+ * `receipt_pubkey`. Returns `false` rather than throwing on malformed input.
+ *
+ * This is only the inner link. A consumer that wants provenance must also
+ * check `receipt_pubkey` against `/v1/info#builder`'s attested
+ * `receipt_pubkey` and verify that attestation under the builder pubkey
+ * (`verifyAttestation` in `builder-identity.ts`).
+ */
+declare function verifyReceipt(receipt: JobReceipt): boolean;
+/**
+ * Structural guard on a receipt that arrived from outside this process — off a
+ * `/v1/job` response, or back out of the hand-editable `~/.dvm/receipts.jsonl`.
+ *
+ * Checks only that the load-bearing fields are the right *kind* of thing; it
+ * deliberately does not judge the receipt. A well-formed receipt whose
+ * signature doesn't hold is `invalid` and the caller must see it said so. A
+ * body missing one of these fields is a different animal: consumers dereference
+ * them unconditionally (`receiptDisplay`'s `paid.msats`, the attestation link's
+ * `receipt_pubkey`), so an unguarded one throws `TypeError` and surfaces as an
+ * `internal` exit — and it could never have verified anyway, since the
+ * signature covers the whole canonical body. Refusing it costs no proof.
+ *
+ * One guard for both directions on purpose: what can't come in over the wire
+ * must not be able to come back out of the file.
+ *
+ * Release coupling: adding or requiring a field here changes both the SDK's
+ * emitted wire shape and the caller CLI's accepted shape. Name the first-party
+ * fleet redeploy as a prerequisite in the release note before publishing the
+ * stricter caller; see `public compatibility guide`.
+ */
+declare function isSignedJobReceipt(value: unknown): value is JobReceipt;
+/** Sign an unsigned drain receipt — same canonicalisation as {@link signReceipt}. */
+declare function signDrainReceipt(unsigned: UnsignedDrainReceipt, secretHex: string): DrainReceipt;
+/** Sign an unsigned funding receipt using the common receipt canonicalisation. */
+declare function signFundingReceipt(unsigned: UnsignedFundingReceipt, secretHex: string): FundingReceipt;
+declare function isFundingReceipt(value: unknown): value is FundingReceipt;
+declare function verifyFundingReceipt(receipt: FundingReceipt): boolean;
+/**
+ * Structural guard on a drain receipt from outside this process — off a
+ * `/v1/credit` drain response, or back out of `~/.dvm/credits.json`.
+ *
+ * Same contract and same reasoning as {@link isSignedJobReceipt}: both homes
+ * type these `unknown[]` because neither the wire nor a hand-editable file is
+ * evidence of shape, and the chain walk dereferences `receipt_pubkey`
+ * unconditionally. A body missing one of these fields could never have carried
+ * a valid signature anyway, so refusing it costs no proof.
+ * Required-field changes follow the fleet-before-caller release note linked
+ * from {@link isSignedJobReceipt}.
+ */
+declare function isDrainReceipt(value: unknown): value is DrainReceipt;
+/**
+ * Verify a drain receipt's self-consistency, mirroring {@link verifyReceipt}
+ * the same provenance caveat applies: check `receipt_pubkey` against the
+ * DVM's attested `receipt_pubkey` for the outer link.
+ */
+declare function verifyDrainReceipt(receipt: DrainReceipt): boolean;
+
+/**
+ * Cashu and Lightning credits owe unused sats back at each deposit's funding
+ * rate. Keep the sats/micro basis per funding lot: a pooled ratio loses the
+ * basis of top-ups made at different rates. Settled draws and reclaims share
+ * these lots so their total equals the sats funded.
+ */
+/**
+ * The rails whose credits carry a Bitcoin deposit this ledger owes back in
+ * kind — Cashu and Lightning funding, both of which leave sats in the
+ * provider's own custody.
+ *
+ * Declared as its own list rather than derived by subtracting the stablecoin
+ * rails: a channel-backed credit is in-kind *structurally* (the escrow retains
+ * the unused value), so it needs no lots at all, and a rail added to
+ * {@link FundingMethod} must be a decision here rather than a default.
+ */
+declare const NON_CHANNEL_BITCOIN_RAILS: readonly ["cashu", "lightning"];
+type NonChannelBitcoinRail = (typeof NON_CHANNEL_BITCOIN_RAILS)[number];
+declare function isNonChannelBitcoinRail(rail: string | null | undefined): rail is NonChannelBitcoinRail;
+/**
+ * One funding event's deposit: the sats that arrived and the credit micro they
+ * bought, with however much of that micro is still unspent.
+ *
+ * `remainingMicro` is depleted FIFO by settled draws and by reclaims, so the
+ * sum of a credit's lots tracks `credits.balance_micro` exactly — with one
+ * deliberate exception: an expiry release zeroes the balance and
+ * leaves the lots standing, because a revival restores that balance and its
+ * in-kind basis has to still be there. A released credit is excluded from the
+ * sweep floor by `BITCOIN_CREDIT_PREDICATE`'s own `balance_micro > 0`, so the
+ * over-coverage is never counted as sats the builder owes back.
+ */
+interface FundingLot {
+    lotId: string;
+    creditId: string;
+    rail: NonChannelBitcoinRail;
+    /** Sats this funding delivered. `0` on a credit funded before a rail basis was recorded. */
+    satsFunded: number;
+    /** Credit micro this funding bought — the lot's denominator, never depleted. */
+    creditedMicro: number;
+    remainingMicro: number;
+    /** Rail settlement reference, provenance only. */
+    fundingRef: string | null;
+    createdAt: number;
+}
+interface LotDebit {
+    lotId: string;
+    micro: number;
+    /** Decrease in this lot's floored sats obligation after taking the micro debit. */
+    sats: number;
+}
+interface LotDepletion {
+    debits: LotDebit[];
+    satsOwed: number;
+    /** Micro the lots could not cover. Non-zero means the credit's lots are short. */
+    uncoveredMicro: number;
+    /** Of the micro taken, how much came out of a lot carrying a real sats basis. */
+    backedMicro: number;
 }
-
 /**
- * JSON wire shape POSTed to the platform's `/_internal/job-revenue` endpoint
- * and stored in `pending_dvm_reports.payload` for durable retry.
+ * Deplete lots in FIFO order, supplied by fifoOrder. Price each debit as
+ * lotSats(before) - lotSats(after), not the independently floored slice: small
+ * draws then telescope to the full deposit instead of losing up to one sat
+ * per draw. Fractional remaining sats stay with the provider.
  */
-interface RevenueReportPayload {
-    /** Platform DVM record ID (`dvms.id`). Identifies which DVM earned the revenue. */
-    dvmId: string;
-    /** Job identifier used by the platform to de-duplicate revenue rows and link to the job record. */
-    jobId: string;
-    /**
-     * Capability selected by dispatch for this job. Omitted for
-     * reports from older SDKs and legacy persisted jobs that predate capability
-     * dispatch; absence must not be rewritten as a capability name.
-     */
-    capability?: string;
-    /** Total amount paid by the caller in millisatoshis, across all credits that satisfied the job. */
-    paidMsats: number;
-    /** Cashu mint URL from which the payment tokens were issued. Set only for the `cashu` rail; omitted for all other rails. */
-    paymentMint?: string;
-    /**
-     * Payment rail identifier (`"cashu"`, `"tempo"`, `"x402"`, `"stripe"`).
-     * Mirrors `PaymentMethod` on the platform; carried as a plain string over the wire
-     * so the SDK has no platform-type dependency.
-     */
-    rail: string;
-    /**
-     * Settlement reference for the credit: EVM tx hash for `x402`, credential
-     * challenge ID for `tempo`, `X-Cashu-Request-Id` UUID for `cashu`. Required by the
-     * platform revenue ledger for `tempo`/`x402` rails (recordJobRevenue throws without it);
-     * nullable for `cashu`.
-     */
-    paymentTxHash?: string;
-    /**
-     * Rail-native payment amount in atomic units: USDC microunits for `tempo` and
-     * `x402`, USD cents for `stripe`. Omitted for `cashu` (platform derives
-     * `paidMsats / 1000`). Must be set together with `nativeAsset`.
-     */
-    nativeAmount?: number;
-    /**
-     * Asset tag paired with `nativeAmount`: `"sats"`, `"usdc"`, `"usdc.e"`, or
-     * `"usd-cents"`. Both fields must be present for the platform to write a non-cashu
-     * revenue row.
-     */
-    nativeAsset?: string;
-    /**
-     * Cashu flow discriminator. Set to `"p2pk_accumulator"` when the cashu
-     * accumulator path satisfied the job; omitted for legacy cashu. Written into
-     * `revenue_events.metadata.cashu_flow` by the platform so ops can split per-call cashu
-     * rows by source.
-     */
-    cashuFlow?: string;
-    /**
-     * What the job cost the **builder** to serve, as declared by the
-     * handler through `ctx.cost()` — the other half of the
-     * margin the dashboard states. `amountMicro` is 1e-6 of `currency`, which
-     * is the currency the builder incurred the cost in and need not be the
-     * credit's.
-     *
-     * Never netted against `paidMsats` or `drawAmountMicro`: what the caller
-     * paid and what serving them cost are two questions, so they are two fields.
-     *
-     * **Absent means unreported, not zero.** A handler that declares nothing
-     * sends no `cost` key at all, and the platform shows the margin as unknown
-     * rather than as 100%. A handler that declares `{ amount: 0 }` is making the
-     * opposite, positive claim and sends `amountMicro: 0`.
-     *
-     * Additive on the wire: a platform build that does not read this key keeps
-     * accepting the report unchanged.
-     */
-    cost?: {
-        amountMicro: number;
-        currency: string;
-    };
-    /**
-     * Credit this job's payment drew against. Present on
-     * every job a ledger-backed payment satisfied; its presence is what tells
-     * the platform the row is a **draw-keyed** revenue event rather than a
-     * pre-credits per-call one.
-     */
-    creditId?: string;
-    /** The draw this job settled — one draw, one revenue row. */
-    drawId?: string;
-    /** The draw's fiat amount, 1e-6 of `creditCurrency`. The exact liability offset. */
-    drawAmountMicro?: number;
-    /** Currency the credit is denominated in (lowercase ISO, e.g. `usd`). */
-    creditCurrency?: string;
-    /**
-     * Settlement instant (epoch ms) — draws are revenue *when they
-     * settle*, so this dates the row. Omitted for pre-credits rows, which the
-     * platform dates at record time as before.
-     */
-    settledAt?: number;
-    /** The funding's own rail reference, for reconciling a draw back to its deposit. */
-    fundingRef?: string;
-    /**
-     * Revenue class when this row is not ordinary service revenue.
-     * `short_pay_forfeit` marks money kept from an underpayment that bought no
-     * job so analytics can exclude it.
-     */
-    kind?: string;
-}
-/** Privacy-preserving terminal evidence; contains no caller or payment references. */
-interface JobTerminalReportPayload {
-    dvmId: string;
-    jobId: string;
-    capability: string;
-    outcome: "completed" | "failed" | "cancelled";
-    endedBy: "caller" | "provider" | null;
-    paid: boolean;
-    acceptedAtMs: number;
-    terminalAtMs: number;
-    callerWaitMs: number;
-    receiptSeq: number | null;
-}
+declare function depleteLots(lots: FundingLot[], amountMicro: number): LotDepletion;
 /**
- * JSON wire shape POSTed to the platform's `/_internal/job-cost` endpoint
- * when a terminal job incurred a declared builder cost but produced no
- * revenue report.
+ * What a settling draw's fiat debit was worth in kind, in millisatoshis
+ * `null` where the lots cannot price it.
  *
- * Unlike {@link RevenueReportPayload}, this event has no payment rail or
- * revenue amount: a failed, cancelled, or free job is not a sale. The
- * platform upserts it by `(dvmId, jobId)`, independently of the revenue
- * ledger's rail-keyed constraint. It replaces the stored value only when
- * `costRevision` is higher; equal revisions must be byte-identical. That rule
- * makes a persisted prefix and a later in-memory total converge regardless of
- * delivery order.
+ * This is the single sats authority for a non-channel Bitcoin credit. The
+ * settle already depletes the lots the draw consumed, so the figure costs no
+ * extra read: it is `depletion.satsOwed` in the ledger's own msat unit, and
+ * stamping it on `credit_draws.draw_msats` is what makes
+ * `Σ settled draw sats + reclaim sats == Σ sats funded` close per credit.
+ *
+ * `null` follows {@link isInKindDepletion} exactly, so a settle and a reclaim
+ * fall back together: lots short of the balance, or covering lots with no sats
+ * basis, keep the pooled pro-rata figure rather than blending a lot rate with
+ * a blended one. Mixed coverage counts as unpriceable for the same reason it
+ * does on the reclaim.
  */
-interface JobCostReportPayload {
-    /** Platform DVM record ID (`dvms.id`); bound to the authenticating token. */
-    dvmId: string;
-    /** Job identifier and the report's platform-side idempotency key. */
-    jobId: string;
-    /** Capability selected by dispatch; absent only on legacy persisted jobs. */
-    capability?: string;
-    /** Terminal outcome that explains why this event carries no revenue. */
-    outcome: "completed" | "failed" | "cancelled";
-    /**
-     * Number of declarations incorporated into `cost`; the
-     * platform keeps the payload with the highest revision for this job.
-     */
-    costRevision: number;
-    /**
-     * The builder's cumulative declared cost, in millionths of its currency.
-     * `null` at a higher revision invalidates an earlier prefix when the handler
-     * switched currencies and the final total is therefore unreportable.
-     */
-    cost: {
-        amountMicro: number;
-        currency: string;
-    } | null;
-}
+declare function inKindDrawMsats(depletion: LotDepletion, amountMicro: number): number | null;
 /**
- * JSON wire shape POSTed to the platform's `/_internal/credit-deposit`
- * endpoint. A funding event is a **deposit** — a liability until
- * drawn — reported separately and never summed into revenue (the deposit-accounting rule).
+ * What these lots owe in kind if every remaining micro were reclaimed now —
+ * the deposit-liability figure, and the floor the hub must never be swept
+ * below.
+ */
+declare function lotOwedSats(lots: FundingLot[]): number;
+/**
+ * Refund delivery uses a fixed eight-sat reserve so owed_sats cannot shrink
+ * after it is promised. Extra delivery cost is absorbed by the provider;
+ * unused reserve stays with the provider, like fractional-sat dust.
+ */
+declare const DRAIN_DELIVERY_RESERVE_SATS = 8;
+/**
+ * The figure a reclaim publishes: its in-kind gross less
+ * {@link DRAIN_DELIVERY_RESERVE_SATS}, floored at zero.
  *
- * Idempotent on `(dvmId, creditId, fundingId)`, so the shared retry loop can
- * redeliver freely.
+ * Zero is a refusal rather than a payout — a balance worth no more than what
+ * it costs to send is `drain_below_dust`, since parking a zero-value token
+ * would hold the servicer's queue open forever.
  */
-interface CreditDepositPayload {
-    /** Platform DVM record ID (`dvms.id`); must match the bearer token's DVM. */
-    dvmId: string;
-    creditId: string;
-    /** Canonical owner of the funded credit. */
-    callerPubkey: string;
-    /** The rail's settlement reference — the deposit's idempotency key. */
-    fundingId: string;
-    /** Payment rail (`"cashu"`, `"tempo"`, `"x402"`). */
-    rail: string;
-    /** Rail value received, in millisatoshis. */
-    paidMsats: number;
-    /** Cashu only. Full received proof face before its receiver input fee. */
-    grossPaidMsats?: number;
-    /** Cashu only. Standalone NUT-02 fee reserved by the received proofs. */
-    cashuInputFeeMsats?: number;
-    /** Rail-native atomic units; omitted for cashu (derived from `paidMsats`). */
-    nativeAmount?: number;
-    /** Asset tag paired with `nativeAmount`. */
-    nativeAsset?: string;
-    /** Cashu mint URL the funding proofs were issued from. */
-    paymentMint?: string;
-    /** Fiat micro credited to the ledger — the liability this deposit creates. */
-    amountMicro: number;
-    /** Currency `amountMicro` is 1e-6 of. */
-    creditCurrency: string;
-    /** When the funding committed (epoch ms). */
-    fundedAt: number;
-    /** Current credit expiry after this funding committed (epoch ms). */
-    expiryMs: number;
-    /**
-     * Tempo session funding only: the TIP-1034 channel this deposit
-     * arrived on, registered so the platform's close observer can route a
-     * `CloseRequested` event back to the DVM that owns the channel.
-     *
-     * Rides the deposit report rather than a side channel on purpose — accepting
-     * the voucher and booking the registration then share the one durable commit
-     * boundary, so a registered channel can never be a channel whose funding
-     * rolled back, and the existing retry drain delivers it after a crash. The
-     * registration is therefore asynchronous relative to the close: an event can
-     * legitimately arrive first, which is what the platform's payee fallback is
-     * for.
+declare function netOwedSats(grossSats: number): number;
+/**
+ * The order lots deplete in: oldest first, `lotId` breaking a tie.
+ *
+ * A tiebreak is not decoration — lot ids are surrogates rather than a
+ * per-credit sequence (`fund` takes no credit lock, so two concurrent
+ * fundings cannot cooperate on a counter), and two fundings can land on the
+ * same millisecond. Without it the FIFO order is whatever the planner
+ * returned, and a reclaim's figure would depend on it.
+ */
+declare function fifoOrder(left: FundingLot, right: FundingLot): number;
+/**
+ * Missing lot coverage or a zero legacy sats basis requires pooled pricing.
+ * Mixed backed/unbacked lots also fall back: combining lot and live rates
+ * would claim a value neither basis supports.
+ */
+declare function isInKindDepletion(depletion: LotDepletion, amountMicro: number): boolean;
+
+/** The rails a payout lands on. Lightning never pays out: credits fund straight into the receive wallet. */
+type PayoutRail = "cashu" | "x402" | "tempo";
+/**
+ * Transfers aggregate payments: a Cashu melt, x402 batch to pay_to, or Tempo recipient
+ * settlement/close.
+ */
+type PayoutKind = "melt" | "batch" | "close" | "settle";
+type PayoutRepairKind = "x402_settlement_reconciled" | "lightning_invoice_reconciled" | "tempo_close_reconciled";
+/**
+ * One landed movement into builder custody. Platform retries deduplicate by (dvmId,
+ * payoutId); repaired redelivery upgrades that movement rather than adding another.
+ */
+interface PayoutReportPayload {
+    /**
+     * Platform record ID; must match the bearer token’s DVM.
      */
-    tempoChannel?: {
-        chainId: number;
-        /** 32-byte channel id, `0x`-prefixed and lowercased. */
-        channelId: string;
-        /** TIP-1034 escrow the channel was opened against. */
-        escrow: string;
-        /** The DVM's on-chain recipient — the fallback routing key. */
-        payee?: string;
-    };
+    dvmId: string;
+    /** Required. The DVM's own id for the movement — `cashu:melt:<quote>`, `x402:batch:<uuid>`, `tempo:<tx>`. */
+    payoutId: string;
+    rail: PayoutRail;
+    kind: PayoutKind;
     /**
-     * Tempo session funding only: which channel this deposit's voucher
-     * was accepted on, emitted **whenever the funding was session-based** —
-     * independently of whether {@link CreditDepositPayload.tempoChannel} could be
-     * read. That independence is the entire point: `rail: "tempo"` covers both
-     * `tempo/session` and the `tempo/charge` one-shot, and a charge legitimately
-     * carries no channel at all, so without this the platform cannot tell a
-     * routine charge deposit from a session whose chain binding was lost — the
-     * shape, where the close observer silently never watches the escrow.
-     *
-     * Carries only the channel id, not the chain binding: a DVM that could read
-     * the binding sends `tempoChannel` too, and one that could not still names
-     * the channel an operator has to go and look at.
+     * Positive rail-native atomic units: sats or USDC micro.
      */
-    tempoSession?: {
-        /** 32-byte channel id, `0x`-prefixed and lowercased. */
-        channelId: string;
-    };
+    nativeAmount: number;
+    nativeAsset: "sats" | "usdc";
+    /** Where it landed; `null` for a melt, whose Lightning destination the platform never records. */
+    recipient: string | null;
     /**
-     * Set by the blocked-invoice repair: this deposit is a paid
-     * Lightning invoice the builder's agent reconciled onto a credit. The money
-     * landed in the receive wallet at payment time and this deposit is the one
-     * row it gets, so the settlements table types it `repair` off this flag
-     * rather than off a second row.
+     * Descriptive mechanism references, never an arithmetic basis.
      */
+    refs: Record<string, unknown>;
+    /** Required. When the money landed (epoch ms). */
+    landedAt: number;
     repaired?: boolean;
+    /** Required iff `repaired`. */
+    repairKind?: PayoutRepairKind;
 }
-/**
- * JSON wire shape POSTed to the platform's `/_internal/credit-draw-release`
- * endpoint. A released hold leaves the credit balance intact, but
- * marks that slice of the outstanding liability as failure churn rather than
- * untouched prefunding.
- *
- * Idempotent on `(dvmId, creditId, drawId)`, so the reporter queue can
- * redeliver freely.
- */
-interface CreditDrawReleasePayload {
-    /** Platform DVM record ID (`dvms.id`); must match the bearer token's DVM. */
-    dvmId: string;
-    creditId: string;
-    /** Released draw; the platform idempotency key with DVM and credit. */
-    drawId: string;
-    /** Fiat micro restored to availability. */
-    amountMicro: number;
-    /** Currency `amountMicro` is 1e-6 of. */
-    creditCurrency: string;
-    /** Per-credit gap-free sequence assigned when the draw was placed. */
-    ledgerSeq: number;
-    /** When the hold reached `released` (epoch ms). */
-    releasedAt: number;
+interface PayoutWedge {
+    id: string;
+    /**
+     * `settle`: an x402 batch whose transfer keeps failing (auto-retried).
+     * `refund`: an x402 cooperative refund wedged between chain and ledger —
+     * caller money, not in the pool. `close`: a Tempo close wedged the same way.
+     * `melt`: cashu rows whose builder-side melt failed.
+     */
+    kind: "settle" | "refund" | "close" | "melt";
+    /** Epoch ms the wedge was first observed. */
+    since: number;
+    /** Retry count where the retry is automatic, else null. */
+    attempts: number | null;
+    /** Epoch ms of the next automatic retry, else null. */
+    nextRetry: number | null;
+    lastError: string | null;
+    /** Rail-native amount held up, when known. */
+    native?: number;
+}
+interface PayoutPool {
+    id: string;
+    native: number;
+    label?: string;
 }
-type CreditDrainRepairKind = "x402_settlement_reconciled" | "tempo_close_reconciled";
 /**
- * Terminal picked_up/sent drains report reclaimed fiat micro-units, reducing
- * outstanding liability rather than adding revenue. Requested or parked drains
- * have not paid the caller. Idempotency key: (dvmId, creditId, drainId).
+ * A replaceable snapshot of one rail’s pending builder funds. Best-effort delivery uses no
+ * durable queue; a later tick supersedes a lost report.
  */
-interface CreditDrainPayload {
-    /** Platform DVM record ID (`dvms.id`); must match the bearer token's DVM. */
+interface PayoutPendingPayload {
     dvmId: string;
-    creditId: string;
-    /** Canonical owner of the reclaimed credit. */
-    callerPubkey: string;
-    /** The drain's own idempotency key. */
-    drainId: string;
-    /** Payout rail (`"cashu"`, `"x402"`, `"tempo"`). */
-    method: string;
-    /** Fiat micro reclaimed — the liability this drain extinguishes. */
-    amountMicro: number;
-    /** Currency `amountMicro` is 1e-6 of. */
-    creditCurrency: string;
-    /** Terminal state: `"picked_up"` for cashu, `"sent"` for other rails. */
-    status: string;
-    /** When the money left (epoch ms). */
-    drainedAt: number;
-    /** Per-credit gap-free ledger sequence, for reconciling against the DVM's ledger. */
-    ledgerSeq?: number;
-    /** Set when an operator repair verb completed this reclaim. */
-    repaired?: boolean;
-    /** Required iff `repaired`; identifies the repair path that completed the reclaim. */
-    repairKind?: CreditDrainRepairKind;
+    rail: PayoutRail;
+    /** Everything on this rail still moving toward the builder, in atomic units. */
+    poolNative: number;
+    nativeAsset: "sats" | "usdc";
+    items: number;
+    pools: PayoutPool[];
+    wedged: PayoutWedge[];
+    /** This DVM's clock when the snapshot was taken (epoch ms). */
+    snapshotAt: number;
 }
-/**
- * Open Postgres transaction handle accepted by the reporter-owned outbox
- * enqueue. The payment rail owns BEGIN/COMMIT; the reporter owns its table.
- */
-interface RevenueReporterQuerier {
-    query: Pool["query"];
+interface PayoutTransport {
+    /**
+     * Queue a payout through the caller's open transaction, so the row and the
+     * fact it reports commit or roll back together; without `tx` it is queued on
+     * its own. Durable once committed — the retry loop delivers it, or
+     * {@link PayoutTransport.drainPending} when a caller wants it now.
+     */
+    enqueuePayout(payload: PayoutReportPayload, tx?: RevenueReporterQuerier): Promise<void>;
+    enqueueHostedPayout?(payload: PayoutReportPayload, obligationIds: string[], tx?: RevenueReporterQuerier): Promise<void>;
+    /** Queue a payout on its own and try to deliver it at once. */
+    reportPayout(payload: PayoutReportPayload): Promise<void>;
+    /** Best-effort: one POST, replaced by the next snapshot. */
+    reportPayoutPending(payload: PayoutPendingPayload): Promise<void>;
+    /** Deliver what is queued now rather than on the next retry tick. */
+    drainPending?(): Promise<void>;
 }
 /**
- * Transactional deposit-outbox seam threaded through each rail commit.
- *
- * Implemented by {@link RevenueReporter.enqueueDeposit}; callers must await it
- * before committing the rail receive and ledger funding.
- */
-type CreditDepositEnqueue = (tx: RevenueReporterQuerier, payload: CreditDepositPayload) => Promise<void>;
-/** Transactional draw-release outbox seam used by the credit ledger. */
-type CreditDrawReleaseEnqueue = (tx: RevenueReporterQuerier, payload: CreditDrawReleasePayload) => Promise<void>;
-/**
- * Transactional drain-outbox seam threaded through each terminal drain
- * transition.
- *
- * Implemented by {@link RevenueReporter.enqueueCreditDrain}; callers must await
- * it before committing the status CAS that moved the money.
- */
-type CreditDrainEnqueue = (tx: RevenueReporterQuerier, payload: CreditDrainPayload) => Promise<void>;
-/**
- * JSON wire shape POSTed to the platform's `/_internal/credit-expiry-release`
- * endpoint. A prepaid credit that reaches its TTL with an undrawn
- * remainder RELEASES that remainder to the builder: on cashu, Lightning and
- * x402 the funding value reached builder custody at funding time or on the
- * settlement cycle, so expiry extinguishes the caller's remaining claim.
- * Reported so committed value nets to
- * `deposited − drawn − drained − released`; without it an expired credit is
- * owed forever on paper, exactly like an unreported drain.
- *
- * Never sent for a Tempo credit. Tempo balances are channel-backed and undrawn
- * channel value returns to the *caller* at exit, so no release exists on that
- * rail — the sweep skips them and the platform refuses one outright.
- *
- * Two reports share this shape, distinguished only by `reversedAt`:
- *
- * - **The release**, written by the expiry sweep with `reversedAt` absent.
- * - **The reversal**, written when a later funding revives the credit
- * (`CreditLedger.fund` overwrites `expiry_ms`, so the recorded remainder is
- * no longer final). It repeats the whole payload rather than sending a
- * reference, because the retry loop can deliver the two out of order and the
- * platform's upsert must be able to land either one first.
- *
- * Idempotent on `(dvmId, creditId, releaseId)`, so the shared retry loop can
- * redeliver freely.
+ * enqueue joins the money transaction and must throw on failure so its fact rolls back.
+ * committed runs after commit, when delivery and snapshots can safely read the new state.
  */
-interface CreditExpiryReleasePayload {
-    /** Platform DVM record ID (`dvms.id`); must match the bearer token's DVM. */
-    dvmId: string;
-    creditId: string;
-    /** Per-expiry-episode key; the platform idempotency key with DVM and credit. */
-    releaseId: string;
-    callerPubkey: string;
-    /** Funding rail. `null` on a credit funded before the basis became mandatory. */
-    rail: string | null;
-    /** Fiat micro released — the liability this expiry extinguishes. */
-    amountMicro: number;
-    /** Currency `amountMicro` is 1e-6 of. */
-    creditCurrency: string;
-    /** When the credit's TTL ran out (epoch ms) — when the liability ended. */
-    expiryMs: number;
-    /** When the sweep observed the expiry (epoch ms). */
-    releasedAt: number;
-    /** Set only on the reversal report: when the revival funding landed (epoch ms). */
-    reversedAt?: number | null;
+interface TransactionalPayoutHook<E> {
+    enqueue(event: E, tx: RevenueReporterQuerier): Promise<void>;
+    committed(): void;
+}
+interface CashuMeltCompleted {
+    rows: {
+        id: string;
+        mintUrl: string;
+        proofAmount: number;
+    }[];
+    meltQuoteId: string;
+    paymentPreimage: string;
+}
+interface TempoSessionSettled {
+    txHash: string;
+    channelId: string;
+    trigger: "settle" | "close" | "scheduled";
+    /** Cumulative amount settled to the payee on this channel, atomic units. */
+    amount: bigint;
+    /** Newly settled to the payee by this transaction, atomic units. */
+    delta: bigint;
+}
+interface TempoCloseReconciled {
+    channelId: string;
+    txHash: string;
+    /** Captured by the payee — this DVM — per the receipt, atomic units as a decimal string. */
+    settledToPayee: string;
+}
+interface X402TrackedChannel {
+    channelId: string;
+    chargedCumulativeAmount: string;
+    totalClaimed: string;
+}
+interface X402WedgedRefund {
+    settlementId: string;
+    /** Epoch ms the settlement was first prepared. */
+    createdAt: number;
+    native?: number;
+}
+interface X402PayoutContext {
+    /** `${network}|${payTo}|${token}` — the scope the settle-pending marker is keyed on. */
+    scope: string;
+    payTo: string;
+    network: string;
+    storage: {
+        list(): Promise<X402TrackedChannel[]>;
+    };
+    /** The scheduler's settle cadence — what a wedge's `nextRetry` is derived from. */
+    settleIntervalMs: number;
+    listWedgedRefunds?: () => Promise<X402WedgedRefund[]>;
+}
+interface X402TrackedManager {
+    claim(...args: never[]): Promise<{
+        vouchers: number;
+        transaction: string;
+    }[]>;
+    settle(): Promise<{
+        transaction: string;
+    }>;
+    refund?(channelIds?: string[]): Promise<{
+        channel: string;
+        transaction: string;
+    }[]>;
 }
 /**
- * Transactional expiry-release outbox seam, threaded through the sweep's insert
- * and through the funding that reverses a release.
- *
- * Implemented by {@link RevenueReporter.enqueueCreditExpiryRelease}; callers
- * must await it before committing the write that made the release (or its
- * reversal) true, for the same reason the drain seam does — a report lost
- * between the two overstates or understates committed value forever.
- */
-type CreditExpiryReleaseEnqueue = (tx: RevenueReporterQuerier, payload: CreditExpiryReleasePayload) => Promise<void>;
-/**
- * JSON wire shape POSTed to the platform's `/_internal/paid-job-death` endpoint
- * when the stale-job reaper force-fails a *paid* job — its pending
- * credit draw is released rather than settled, so the caller's payment is back
- * on their credit balance and reclaimable by drain. The platform resolves fiat
- * + owner and sends an ambient notice via the shared alert sink. Unlike
- * {@link RevenueReportPayload} this carries no durable-retry semantics: the
- * reaper's `stale_job_failed` structured log is the durable backstop, so a lost
- * report degrades to log-only rather than blocking the sweep.
+ * The batch-settlement server's view of the reporter: attach once with the
+ * scope, then route every claim and settle through the tracked manager so
+ * the open batch is kept and the settle emits the payout.
  */
-interface PaidJobDeathPayload {
-    /** Platform DVM record ID (`dvms.id`). Bound to the authenticating token. */
-    dvmId: string;
-    jobId: string;
-    capability: string;
-    /** Amount of the released credit draw in millisatoshis. */
-    paidMsats: number;
-    /** Payment rail of the released draw (`"cashu"`, `"tempo"`, `"x402"`). */
-    rail: string;
-    /** Reaper reason: dead worker or never-terminal idle job. */
-    reason: string;
-    /** Rail-native released amount, paired with `nativeAsset`. */
-    nativeAmount?: number;
-    /** Asset tag for `nativeAmount` (`"sats"` / `"usdc"` / …). */
-    nativeAsset?: string;
-    /** Cashu mint URL the credit draw's tokens were issued from. */
-    paymentMint?: string;
+interface X402PayoutObserver {
+    attach(ctx: X402PayoutContext): void;
+    trackManager<M extends X402TrackedManager>(manager: M): M;
+    /** A settle that landed outside the tracked manager — the manual claim-and-settle's own retry loop. */
+    recordSettle(transaction: string): Promise<void>;
+    /** A settle attempt that failed outside the tracked manager. One call per attempt a builder would count as one. */
+    recordSettleFailure(error: unknown): Promise<void>;
+    /** A credit-drain refund's bundled claim, recorded after its exact pre-effect reservation. */
+    recordRefundClaim?(transaction: string, delta: bigint): Promise<void>;
+}
+interface TempoPayoutReader {
+    recipient?: string;
+    /** CAIP-2 network for the refs, when known. */
+    network?: string;
+    listActive?: (limit: number, cursor?: {
+        updatedAt: number;
+        key: string;
+    }) => Promise<{
+        key: string;
+        state: Record<string, unknown>;
+        updatedAt: number;
+    }[]>;
+    listChannelDrains?: (args: {
+        limit: number;
+        after?: ChannelDrainCursor;
+        createdBeforeMs: number;
+        rail: "tempo";
+    }) => Promise<CreditDrainRecord[]>;
 }
-type RevenueSkippedNoRailReason = "credit_rail_null" | "credit_rail_unrecognized" | "job_rail_missing" | "ledger_not_configured";
 /**
- * JSON wire shape POSTed to the platform's `/_internal/revenue-skipped-no-rail`
- * endpoint when a settled credit draw has no usable payment rail
- * for its revenue event. This is an operator notice rather than a durable
- * accounting report: the SDK's structured log remains the durable backstop,
- * and a failed alert must never block terminal handling or reconciliation.
+ * Claims accumulated since the last settle. The batch is durable across machines: claims and
+ * eventual settlement can run on different hosts under the fleet lock.
  */
-interface RevenueSkippedNoRailPayload {
-    /** Platform DVM record ID (`dvms.id`). Bound to the authenticating token. */
-    dvmId: string;
-    jobId: string;
-    creditId: string;
-    drawId: string;
-    /** Caller payment captured for the job, in millisatoshis. */
-    paidMsats: number;
-    /** Settled draw amount in 1e-6 of `creditCurrency`. */
-    drawAmountMicro?: number;
-    /** Currency the draw amount is denominated in. */
-    creditCurrency?: string;
-    /** Credit funding rail as stored on the draw, or null for legacy rows. */
-    creditRail: string | null;
-    reason: RevenueSkippedNoRailReason;
+interface X402OpenBatch {
+    scope: string;
+    batchId: string;
+    claimedNative: bigint;
+    voucherCount: number;
+    claims: number;
+    openedAt: number;
+    attempts: number;
+    firstFailedAt: number | null;
+    lastError: string | null;
+    nextRetryAt: number | null;
+    obligationIds?: string[];
 }
-/** Gas-balance observation POSTed by a platform-hosted x402 self-relay. */
-interface X402SelfRelayGasBalancePayload {
-    /** Platform DVM record ID, bound to the authenticating platform token. */
-    dvmId: string;
-    /** Dedicated relay EOA whose Base ETH balance was read. */
-    address: `0x${string}`;
-    /** CAIP-2 Base network identifier. */
-    network: string;
-    /** Current native balance as a decimal wei string. */
-    balanceWei: string;
-    /** Configured paging floor as a decimal wei string. */
-    lowBalanceWei: string;
-    /** Millisecond timestamp at which the DVM read the balance. */
-    checkedAt: number;
+interface X402BatchStore {
+    get(scope: string): Promise<X402OpenBatch | undefined>;
+    put(batch: X402OpenBatch): Promise<void>;
+    delete(scope: string): Promise<void>;
+    /**
+     * Atomically delete the matching batch and enqueue its payout. Failed enqueue preserves the
+     * batch for retry; false means the scope no longer holds batchId and nothing was queued.
+     */
+    settle(scope: string, batchId: string, enqueue: (tx?: RevenueReporterQuerier) => Promise<void>): Promise<boolean>;
 }
-/** RPC-health transition POSTed by a platform-hosted x402 self-relay. */
-type X402SelfRelayRpcHealthPayload = {
-    /** Platform DVM record ID, bound to the authenticating platform token. */
-    dvmId: string;
-    /** Dedicated relay EOA identifying the affected self-relay. */
-    address: `0x${string}`;
-    /** CAIP-2 Base network identifier. */
-    network: string;
-    /** Healthy transition clears an open RPC page. */
-    status: "healthy";
-    /** Millisecond timestamp at which the DVM observed the transition. */
-    checkedAt: number;
-} | {
-    /** Platform DVM record ID, bound to the authenticating platform token. */
-    dvmId: string;
-    /** Dedicated relay EOA identifying the affected self-relay. */
-    address: `0x${string}`;
-    /** CAIP-2 Base network identifier. */
-    network: string;
-    /** Failed transition opens or refreshes an RPC page. */
-    status: "failed";
-    /** Redacted failure class; never the provider error or endpoint URL. */
-    reason: X402SelfRelayRpcFailureReason;
-    /** Millisecond timestamp at which the DVM observed the transition. */
-    checkedAt: number;
-};
-/** Configured Tempo operator fee-token balance POSTed by a hosted DVM. */
-interface TempoSettlementBalancePayload {
+interface PayoutReporterOpts {
     dvmId: string;
-    address: `0x${string}`;
-    network: string;
-    token: `0x${string}`;
-    balanceMicro: string;
-    lowBalanceMicro: string;
-    checkedAt: number;
-    ready: boolean;
+    transport: PayoutTransport;
+    /**
+     * Postgres holds durable x402 batches and supplies Cashu snapshots. Without it, the default
+     * batch store is memory and Cashu snapshots are omitted.
+     */
+    db?: Pool;
+    /**
+     * Only accumulator hosts create wallet_accumulator; enabling this on another host makes
+     * each snapshot query fail.
+     */
+    cashu?: boolean;
+    /** Override the batch store (tests); defaults to Postgres on `db`, memory without. */
+    batchStore?: X402BatchStore;
+    hostedObligations?: HostedSettlementReportObligations;
+    /** Snapshot cadence, ms. Default 5 minutes. */
+    snapshotIntervalMs?: number;
+    now?: () => number;
 }
-/** Redacted Tempo operator fee-funding rejection POSTed by a hosted DVM. */
-interface TempoSettlementFailurePayload {
-    dvmId: string;
-    address: `0x${string}`;
-    network: string;
-    token: `0x${string}`;
-    operation: "settle" | "close";
-    errorClass: "InsufficientFundsError";
-    checkedAt: number;
-    balanceMicro?: string;
-    channelId?: string;
-    creditId?: string;
-    drainId?: string;
+/**
+ * Cashu melts and repaired Tempo closes enqueue inside their caller’s transaction and
+ * propagate failures. x402 reporting and pending snapshots instead log failures; failed x402
+ * enqueue preserves the open batch for retry.
+ */
+declare class PayoutReporter implements PayoutTransport {
+    private readonly dvmId;
+    private readonly transport;
+    private readonly db?;
+    private readonly cashu;
+    private readonly batches;
+    private readonly ownsBatchStore;
+    private readonly intervalMs;
+    private readonly now;
+    private readonly hostedObligations?;
+    private lastX402SnapshotAt;
+    private x402?;
+    private tempo?;
+    private timer;
+    private warmup;
+    constructor(opts: PayoutReporterOpts);
+    init(): Promise<void>;
+    /**
+     * Start the snapshot loop. Unref'd, so it never keeps a scale-to-zero
+     * machine awake; a first snapshot runs shortly after boot so a fresh process
+     * reports without waiting a whole interval.
+     */
+    start(): void;
+    stop(): void;
+    private reconcileHosted;
+    enqueuePayout(payload: PayoutReportPayload, tx?: RevenueReporterQuerier): Promise<void>;
+    reportPayout(payload: PayoutReportPayload): Promise<void>;
+    reportPayoutPending(payload: PayoutPendingPayload): Promise<void>;
+    /** Deliver what is queued now; a transport without the seam waits for its retry loop. */
+    flush(): Promise<void>;
+    meltHook(): TransactionalPayoutHook<CashuMeltCompleted>;
+    /**
+     * Report melted face value per mint, not the Lightning amount received after fees. Hash the
+     * payment preimage; do not publish it. With tx, propagate enqueue failures and defer
+     * delivery until commit. Without tx, enqueue independently and start delivery.
+     */
+    cashuMelted(event: CashuMeltCompleted, tx?: RevenueReporterQuerier): Promise<void>;
+    attachTempo(reader: TempoPayoutReader): void;
+    /**
+     * A Tempo channel settled or closed on chain. `delta` is what this
+     * transaction newly paid the recipient; a transaction that paid nothing new
+     * (a close of a fully settled channel) is no payout.
+     */
+    tempoSettled(event: TempoSessionSettled): Promise<void>;
+    tempoRepairHook(): TransactionalPayoutHook<TempoCloseReconciled>;
+    /**
+     * Report the receipt’s payee total under the live close’s transaction ID, flagged repaired.
+     * The platform upgrades a live row if one exists. Join tx and propagate enqueue failures;
+     * this does not report the caller refund.
+     */
+    tempoCloseReconciled(event: TempoCloseReconciled, tx?: RevenueReporterQuerier): Promise<void>;
+    x402Observer(): X402PayoutObserver;
+    /**
+     * Read claim deltas from storage because upstream returns voucher counts. Under the fleet
+     * lock, before/after reads are consistent. A deleted channel contributes its pre-claim
+     * unclaimed value, including refund claim-then-delete.
+     */
+    private trackX402Manager;
+    private recordX402Claim;
+    private recordX402Settle;
+    private recordX402SettleFailure;
+    /** Every rail this reporter can read, each on its own failure boundary. */
+    snapshot(): Promise<void>;
+    /**
+     * Cashu: every unmelted proof in the accumulator, per mint. Rows whose
+     * builder-side melt failed are still in the pool (they are still at the
+     * mint) and listed as wedged until `restart-failed` clears them.
+     */
+    snapshotCashu(): Promise<void>;
+    /**
+     * x402: the open batch (claimed, not yet transferred) plus every channel's
+     * unclaimed voucher value; wedged when the settle keeps failing, and the
+     * refund settlements stuck between chain and ledger beside it.
+     */
+    snapshotX402(): Promise<void>;
+    /**
+     * Tempo: each active channel's spent-but-unsettled balance — earned, not
+     * yet paid to the recipient — and the cooperative closes wedged between
+     * chain and ledger, aged past the same floor the repair queue
+     * uses so an in-flight close is not reported as stuck.
+     */
+    snapshotTempo(): Promise<void>;
 }
+
 /**
- * Durable revenue reporter for container-runtime DVMs.
- *
- * On job completion the SDK calls `report()`, which persists the payload to
- * a local Postgres table and attempts an immediate POST to the platform.
- * A background retry loop picks up un-acked rows with exponential backoff.
- * Gauge and health notifications are best-effort: failed delivery is logged
- * and dropped rather than queued for retry.
+ * JSON wire shape POSTed to the platform's `/_internal/job-revenue` endpoint
+ * and stored in `pending_dvm_reports.payload` for durable retry.
  */
-declare class RevenueReporter {
-    private readonly db;
-    private readonly platformUrl;
-    private readonly platformToken;
-    private retryTimer;
-    private static readonly RETRY_INTERVAL_MS;
-    private static readonly MAX_BACKOFF_MS;
-    private static readonly ABANDON_AFTER_MS;
-    constructor(db: Pool, platformUrl: string, platformToken: string);
-    /** Create the pending-reports table and migrate the legacy SDK outbox (idempotent). */
-    init(): Promise<void>;
-    private createTables;
-    private migrateLegacySdkOutbox;
-    private assertSdkTableShape;
-    private assertSdkColumns;
-    private tableColumns;
-    /** Persist a revenue report and attempt immediate delivery. */
-    report(payload: RevenueReportPayload): Promise<void>;
-    /** The permanent deduplication claim and outbox insert commit together.
-     * The claim survives successful delivery, including for custom job stores.
+interface RevenueReportPayload {
+    /** Platform DVM record ID (`dvms.id`). Identifies which DVM earned the revenue. */
+    dvmId: string;
+    /** Job identifier used by the platform to de-duplicate revenue rows and link to the job record. */
+    jobId: string;
+    /**
+     * Capability selected by dispatch for this job. Omitted for
+     * reports from older SDKs and legacy persisted jobs that predate capability
+     * dispatch; absence must not be rewritten as a capability name.
      */
-    reportTerminal(payload: JobTerminalReportPayload): Promise<void>;
-    /** Persist a zero-revenue job cost and attempt immediate delivery. */
-    reportCost(payload: JobCostReportPayload): Promise<void>;
+    capability?: string;
+    /** Total amount paid by the caller in millisatoshis, across all credits that satisfied the job. */
+    paidMsats: number;
+    /** Cashu mint URL from which the payment tokens were issued. Set only for the `cashu` rail; omitted for all other rails. */
+    paymentMint?: string;
     /**
-     * Join a credit deposit to the caller-owned rail transaction.
-     *
-     * This method performs no network I/O: it only writes the reporter-owned
-     * durable queue row through `tx`. The retry drain delivers the row after the
-     * rail transaction commits, including after a process restart.
+     * Payment rail identifier (`"cashu"`, `"tempo"`, `"x402"`, `"stripe"`).
+     * Mirrors `PaymentMethod` on the platform; carried as a plain string over the wire
+     * so the SDK has no platform-type dependency.
      */
-    enqueueDeposit(tx: RevenueReporterQuerier, payload: CreditDepositPayload): Promise<void>;
-    /** Join a released draw to the transaction that made the hold terminal. */
-    enqueueCreditDrawRelease(tx: RevenueReporterQuerier, payload: CreditDrawReleasePayload): Promise<void>;
+    rail: string;
     /**
-     * Await durable queue insertion through tx so the terminal drain and its
-     * report commit or roll back together; no network I/O here.
+     * Settlement reference for the credit: EVM tx hash for `x402`, credential
+     * challenge ID for `tempo`, `X-Cashu-Request-Id` UUID for `cashu`. Required by the
+     * platform revenue ledger for `tempo`/`x402` rails (recordJobRevenue throws without it);
+     * nullable for `cashu`.
      */
-    enqueueCreditDrain(tx: RevenueReporterQuerier, payload: CreditDrainPayload): Promise<void>;
+    paymentTxHash?: string;
     /**
-     * Join a payout to the transaction that commits the movement it reports
-     * the batch close, the accumulator mark, the drain booking.
-     * No network I/O, only the durable queue row through `tx`, the discipline
-     * {@link enqueueCreditDrain} set and for the same reason: the money has
-     * already moved on a rail this ledger does not own, so the platform row is
-     * the only record the builder's dashboard has of it, and a row lost between
-     * the fact and the queue would understate "paid out" forever. Without `tx`
-     * the row is queued on the pool, for callers with no fact of their own to
-     * commit. Idempotent on `(dvmId, payoutId)` platform-side, so the retry
-     * loop redelivers freely.
+     * Rail-native payment amount in atomic units: USDC microunits for `tempo` and
+     * `x402`, USD cents for `stripe`. Omitted for `cashu` (platform derives
+     * `paidMsats / 1000`). Must be set together with `nativeAsset`.
      */
-    enqueuePayout(payload: PayoutReportPayload, tx?: RevenueReporterQuerier): Promise<void>;
+    nativeAmount?: number;
     /**
-     * Report one landed payout on its own and try to deliver it at once — the
-     * live Tempo settlement, which has no dvmkit transaction to join. Durable
-     * like {@link report}.
+     * Asset tag paired with `nativeAmount`: `"sats"`, `"usdc"`, `"usdc.e"`, or
+     * `"usd-cents"`. Both fields must be present for the platform to write a non-cashu
+     * revenue row.
      */
-    reportPayout(payload: PayoutReportPayload): Promise<void>;
+    nativeAsset?: string;
     /**
-     * Report one rail's pending-pool snapshot. Best-effort and
-     * fire-and-forget, deliberately unlike {@link reportPayout}: a snapshot is
-     * replaced by the next tick, so queueing a stale one behind an outage would
-     * only deliver figures the platform already has newer ones for.
+     * Cashu flow discriminator. Set to `"p2pk_accumulator"` when the cashu
+     * accumulator path satisfied the job; omitted for legacy cashu. Written into
+     * `revenue_events.metadata.cashu_flow` by the platform so ops can split per-call cashu
+     * rows by source.
      */
-    reportPayoutPending(payload: PayoutPendingPayload): Promise<void>;
+    cashuFlow?: string;
     /**
-     * Await durable queue insertion through tx so expiry release or reversal and
-     * its report commit together. A missing reversal would overstate builder value.
+     * What the job cost the **builder** to serve, as declared by the
+     * handler through `ctx.cost()` — the other half of the
+     * margin the dashboard states. `amountMicro` is 1e-6 of `currency`, which
+     * is the currency the builder incurred the cost in and need not be the
+     * credit's.
+     *
+     * Never netted against `paidMsats` or `drawAmountMicro`: what the caller
+     * paid and what serving them cost are two questions, so they are two fields.
+     *
+     * **Absent means unreported, not zero.** A handler that declares nothing
+     * sends no `cost` key at all, and the platform shows the margin as unknown
+     * rather than as 100%. A handler that declares `{ amount: 0 }` is making the
+     * opposite, positive claim and sends `amountMicro: 0`.
+     *
+     * Additive on the wire: a platform build that does not read this key keeps
+     * accepting the report unchanged.
      */
-    enqueueCreditExpiryRelease(tx: RevenueReporterQuerier, payload: CreditExpiryReleasePayload): Promise<void>;
+    cost?: {
+        amountMicro: number;
+        currency: string;
+    };
     /**
-     * Report a reaper-force-failed paid job to the platform so the
-     * operator receives an ambient notice that a DVM died or wedged mid-job.
-     * Best-effort and fire-and-forget: unlike {@link report} there is no local
-     * durable queue — a non-2xx or transport failure is structured-logged
-     * (`paid_job_death_report_failed`) and dropped, since the reaper's own
-     * `stale_job_failed` log is the durable record and a failed *alert* must never
-     * wedge the sweep.
+     * Credit this job's payment drew against. Present on
+     * every job a ledger-backed payment satisfied; its presence is what tells
+     * the platform the row is a **draw-keyed** revenue event rather than a
+     * pre-credits per-call one.
      */
-    reportPaidJobDeath(payload: PaidJobDeathPayload): Promise<void>;
+    creditId?: string;
+    /** The draw this job settled — one draw, one revenue row. */
+    drawId?: string;
+    /** The draw's fiat amount, 1e-6 of `creditCurrency`. The exact liability offset. */
+    drawAmountMicro?: number;
+    /** Currency the credit is denominated in (lowercase ISO, e.g. `usd`). */
+    creditCurrency?: string;
     /**
-     * Report a settled draw whose revenue event was skipped.
-     * Best-effort and fire-and-forget: the SDK's structured
-     * `revenue_skipped_no_rail` log is the durable backstop, so a failed notice
-     * must never wedge terminal handling or the orphan-draw reconciler.
+     * Settlement instant (epoch ms) — draws are revenue *when they
+     * settle*, so this dates the row. Omitted for pre-credits rows, which the
+     * platform dates at record time as before.
      */
-    reportRevenueSkippedNoRail(payload: RevenueSkippedNoRailPayload): Promise<void>;
-    reportX402SelfRelayGasBalance(payload: X402SelfRelayGasBalancePayload): Promise<void>;
-    reportX402SelfRelayRpcHealth(payload: X402SelfRelayRpcHealthPayload): Promise<void>;
-    reportTempoSettlementBalance(payload: TempoSettlementBalancePayload): Promise<void>;
-    reportTempoSettlementFailure(payload: TempoSettlementFailurePayload): Promise<void>;
-    private postTempoSettlementReadiness;
-    startRetryLoop(): void;
-    stop(): void;
+    settledAt?: number;
+    /** The funding's own rail reference, for reconciling a draw back to its deposit. */
+    fundingRef?: string;
     /**
-     * Operator-facing queue snapshot: distinguishes the live retry queue from
-     * terminal (stale) rows and breaks the latter down by classification reason
-     * (`token_rotated`, `client_error:<status>`, `abandoned`). Lets monitoring tell
-     * transient backlog apart from permanently-failed rows.
+     * Revenue class when this row is not ordinary service revenue.
+     * `short_pay_forfeit` marks money kept from an underpayment that bought no
+     * job so analytics can exclude it.
      */
-    getQueueStats(): Promise<{
-        liveRetry: number;
-        stale: number;
-        byReason: Record<string, number>;
-    }>;
+    kind?: string;
+}
+/** Privacy-preserving terminal evidence; contains no caller or payment references. */
+interface JobTerminalReportPayload {
+    dvmId: string;
+    jobId: string;
+    capability: string;
+    outcome: "completed" | "failed" | "cancelled";
+    endedBy: "caller" | "provider" | null;
+    paid: boolean;
+    acceptedAtMs: number;
+    terminalAtMs: number;
+    callerWaitMs: number;
+    receiptSeq: number | null;
+}
+/**
+ * JSON wire shape POSTed to the platform's `/_internal/job-cost` endpoint
+ * when a terminal job incurred a declared builder cost but produced no
+ * revenue report.
+ *
+ * Unlike {@link RevenueReportPayload}, this event has no payment rail or
+ * revenue amount: a failed, cancelled, or free job is not a sale. The
+ * platform upserts it by `(dvmId, jobId)`, independently of the revenue
+ * ledger's rail-keyed constraint. It replaces the stored value only when
+ * `costRevision` is higher; equal revisions must be byte-identical. That rule
+ * makes a persisted prefix and a later in-memory total converge regardless of
+ * delivery order.
+ */
+interface JobCostReportPayload {
+    /** Platform DVM record ID (`dvms.id`); bound to the authenticating token. */
+    dvmId: string;
+    /** Job identifier and the report's platform-side idempotency key. */
+    jobId: string;
+    /** Capability selected by dispatch; absent only on legacy persisted jobs. */
+    capability?: string;
+    /** Terminal outcome that explains why this event carries no revenue. */
+    outcome: "completed" | "failed" | "cancelled";
+    /**
+     * Number of declarations incorporated into `cost`; the
+     * platform keeps the payload with the highest revision for this job.
+     */
+    costRevision: number;
     /**
-     * Deliver one bounded batch from the durable queue.
-     *
-     * Processes due, non-stale rows; failures back off up to five minutes and
-     * become terminal after 24 hours. Successful deliveries remove their rows.
+     * The builder's cumulative declared cost, in millionths of its currency.
+     * `null` at a higher revision invalidates an earlier prefix when the handler
+     * switched currencies and the final total is therefore unreportable.
      */
-    drainPending(): Promise<void>;
-    private enqueue;
-    private insertPending;
-    private attemptDelivery;
-    private markStale;
+    cost: {
+        amountMicro: number;
+        currency: string;
+    } | null;
 }
-
-/** Query surface shared by the pool and an open Postgres transaction. */
-type X402ChannelQuerier = Pick<Pool, "query">;
 /**
- * Durable phase of an irreversible x402 facilitator settlement.
+ * JSON wire shape POSTed to the platform's `/_internal/credit-deposit`
+ * endpoint. A funding event is a **deposit** — a liability until
+ * drawn — reported separately and never summed into revenue (the deposit-accounting rule).
  *
- * `written_off` is the operator's terminal: a settlement whose
- * ledger leg cannot be completed, reviewed and closed so it leaves the repair
- * queue without pretending it booked. It is deliberately reversible — a later
- * reconcile still accepts it, because it moved nothing.
+ * Idempotent on `(dvmId, creditId, fundingId)`, so the shared retry loop can
+ * redeliver freely.
  */
-type X402SettlementStatus = "prepared" | "submitting" | "settled" | "complete" | "written_off";
-/** Recovery record binding one chain settlement to one credit-ledger effect. */
-interface X402SettlementIntent {
-    settlementId: string;
-    channelId: string;
-    operation: "fund" | "refund";
-    effectId: string;
-    paymentId: string;
-    payload: PaymentPayload$1;
-    requirements: PaymentRequirements$1;
-    channelBefore: Channel;
+interface CreditDepositPayload {
+    /** Platform DVM record ID (`dvms.id`); must match the bearer token's DVM. */
+    dvmId: string;
+    creditId: string;
+    /** Canonical owner of the funded credit. */
+    callerPubkey: string;
+    /** The rail's settlement reference — the deposit's idempotency key. */
+    fundingId: string;
+    /** Payment rail (`"cashu"`, `"tempo"`, `"x402"`). */
+    rail: string;
+    /** Rail value received, in millisatoshis. */
+    paidMsats: number;
+    /** Cashu only. Full received proof face before its receiver input fee. */
+    grossPaidMsats?: number;
+    /** Cashu only. Standalone NUT-02 fee reserved by the received proofs. */
+    cashuInputFeeMsats?: number;
+    /** Rail-native atomic units; omitted for cashu (derived from `paidMsats`). */
+    nativeAmount?: number;
+    /** Asset tag paired with `nativeAmount`. */
+    nativeAsset?: string;
+    /** Cashu mint URL the funding proofs were issued from. */
+    paymentMint?: string;
+    /** Fiat micro credited to the ledger — the liability this deposit creates. */
+    amountMicro: number;
+    /** Currency `amountMicro` is 1e-6 of. */
+    creditCurrency: string;
+    /** When the funding committed (epoch ms). */
+    fundedAt: number;
+    /** Current credit expiry after this funding committed (epoch ms). */
+    expiryMs: number;
     /**
-     * The channel as it stood when the settlement was handed to the facilitator —
-     * after the refund's mandatory on-chain refresh, which {@link channelBefore}
-     * precedes.
+     * Tempo session funding only: the TIP-1034 channel this deposit
+     * arrived on, registered so the platform's close observer can route a
+     * `CloseRequested` event back to the DVM that owns the channel.
      *
-     * The facilitator sizes a cooperative refund from *live* state
-     * (`balance − chargedCumulativeAmount`) and signs it against the *live*
-     * `refundNonce`, so this is the snapshot chain evidence has to be derived
-     * from. `channelBefore` is a pre-verify mirror kept for the voucher restore,
-     * and whenever it was stale a refund that settled read as one that never
-     * happened. Absent on rows an older build wrote, and on any row that never
-     * reached `submitting`.
+     * Rides the deposit report rather than a side channel on purpose — accepting
+     * the voucher and booking the registration then share the one durable commit
+     * boundary, so a registered channel can never be a channel whose funding
+     * rolled back, and the existing retry drain delivers it after a crash. The
+     * registration is therefore asynchronous relative to the close: an event can
+     * legitimately arrive first, which is what the platform's payee fallback is
+     * for.
      */
-    channelAtSubmission?: Channel;
-    submissionBlock?: string;
-    pendingId?: string;
-    status: X402SettlementStatus;
-    response?: SettleResponse$1;
-    /** Epoch ms the row was first prepared. */
-    createdAt: number;
-    /** Epoch ms of the last status write — what the repair queue ages against. */
-    updatedAt: number;
-    /** Operator's reason, recorded by {@link PostgresX402ChannelStorage.writeOffSettlement}. */
-    writeOffNote?: string;
-    /** Epoch ms an operator reconciled or wrote this settlement off. */
-    resolvedAt?: number;
+    tempoChannel?: {
+        chainId: number;
+        /** 32-byte channel id, `0x`-prefixed and lowercased. */
+        channelId: string;
+        /** TIP-1034 escrow the channel was opened against. */
+        escrow: string;
+        /** The DVM's on-chain recipient — the fallback routing key. */
+        payee?: string;
+    };
+    /**
+     * Tempo session funding only: which channel this deposit's voucher
+     * was accepted on, emitted **whenever the funding was session-based** —
+     * independently of whether {@link CreditDepositPayload.tempoChannel} could be
+     * read. That independence is the entire point: `rail: "tempo"` covers both
+     * `tempo/session` and the `tempo/charge` one-shot, and a charge legitimately
+     * carries no channel at all, so without this the platform cannot tell a
+     * routine charge deposit from a session whose chain binding was lost — the
+     * shape, where the close observer silently never watches the escrow.
+     *
+     * Carries only the channel id, not the chain binding: a DVM that could read
+     * the binding sends `tempoChannel` too, and one that could not still names
+     * the channel an operator has to go and look at.
+     */
+    tempoSession?: {
+        /** 32-byte channel id, `0x`-prefixed and lowercased. */
+        channelId: string;
+    };
+    /**
+     * Set by the blocked-invoice repair: this deposit is a paid
+     * Lightning invoice the builder's agent reconciled onto a credit. The money
+     * landed in the receive wallet at payment time and this deposit is the one
+     * row it gets, so the settlements table types it `repair` off this flag
+     * rather than off a second row.
+     */
+    repaired?: boolean;
 }
-/** The caller-supplied half of a settlement row — everything the store does not stamp itself. */
-type X402SettlementIdentity = Omit<X402SettlementIntent, "status" | "response" | "createdAt" | "updatedAt" | "writeOffNote" | "resolvedAt" | "channelAtSubmission">;
 /**
- * Keyset position in the repair queue's `(created_at, settlement_id)` ordering.
+ * JSON wire shape POSTed to the platform's `/_internal/credit-draw-release`
+ * endpoint. A released hold leaves the credit balance intact, but
+ * marks that slice of the outstanding liability as failure churn rather than
+ * untouched prefunding.
  *
- * `createdAt` is Postgres's own rendering of the `TIMESTAMPTZ`, carried as text
- * and handed straight back as one — never a `Date`. `created_at` has microsecond
- * resolution and `Date` has millisecond, so a cursor that round-tripped through
- * epoch ms would land *before* the row it was taken from and re-serve it on
- * every page, which at `limit: 1` never advances at all.
+ * Idempotent on `(dvmId, creditId, drawId)`, so the reporter queue can
+ * redeliver freely.
  */
-interface X402SettlementCursor {
-    createdAt: string;
-    settlementId: string;
-}
-/** One page of the repair queue, plus the position to resume from. */
-interface X402SettlementPage {
-    settlements: X402SettlementIntent[];
-    /** Absent when this page was not full — there is nothing behind it. */
-    nextAfter?: X402SettlementCursor;
+interface CreditDrawReleasePayload {
+    /** Platform DVM record ID (`dvms.id`); must match the bearer token's DVM. */
+    dvmId: string;
+    creditId: string;
+    /** Released draw; the platform idempotency key with DVM and credit. */
+    drawId: string;
+    /** Fiat micro restored to availability. */
+    amountMicro: number;
+    /** Currency `amountMicro` is 1e-6 of. */
+    creditCurrency: string;
+    /** Per-credit gap-free sequence assigned when the draw was placed. */
+    ledgerSeq: number;
+    /** When the hold reached `released` (epoch ms). */
+    releasedAt: number;
 }
+type CreditDrainRepairKind = "x402_settlement_reconciled" | "tempo_close_reconciled";
 /**
- * Fleet-wide serialisation of the self-relay's chain submissions.
- *
- * Narrow on purpose, and implemented by {@link PostgresX402ChannelStorage}: the
- * relay asks for one thing — exclusive use of its gas EOA for the length of one
- * submission — and must not acquire the ability to touch a channel or a
- * settlement row. Handing it this instead of the host `Pool` is what keeps the
- * acquire off the pool the channel transaction is already holding a client from.
+ * Terminal picked_up/sent drains report reclaimed fiat micro-units, reducing
+ * outstanding liability rather than adding revenue. Requested or parked drains
+ * have not paid the caller. Idempotency key: (dvmId, creditId, drainId).
  */
-interface X402RelaySubmissionLock {
-    withRelaySubmissionLock<T>(key: string, operation: () => Promise<T>): Promise<T>;
-}
-interface X402ChannelStorageOpts {
-    /**
-     * Override the relay submission lock's wait ceiling, in milliseconds.
-     *
-     * A test seam: the production ceiling is tens of seconds, which no test can
-     * wait out, and the refusal path is exactly what needs pinning.
-     */
-    relaySubmissionLockTimeoutMs?: number;
-    /**
-     * Retire ledger credit when a fresh chain observation proves its channel
-     * has no unclaimed backing. Runs under the channel transaction so the
-     * channel-first, credit-second lock order stays fleet-wide.
-     */
-    terminalizeUnbackedCredit?: (evidence: {
-        channelId: string;
-        channelBalanceNative: bigint;
-        totalClaimedNative: bigint;
-        observedAt: number;
-    }, tx: X402ChannelQuerier) => Promise<unknown>;
+interface CreditDrainPayload {
+    /** Platform DVM record ID (`dvms.id`); must match the bearer token's DVM. */
+    dvmId: string;
+    creditId: string;
+    /** Canonical owner of the reclaimed credit. */
+    callerPubkey: string;
+    /** The drain's own idempotency key. */
+    drainId: string;
+    /** Payout rail (`"cashu"`, `"x402"`, `"tempo"`). */
+    method: string;
+    /** Fiat micro reclaimed — the liability this drain extinguishes. */
+    amountMicro: number;
+    /** Currency `amountMicro` is 1e-6 of. */
+    creditCurrency: string;
+    /** Terminal state: `"picked_up"` for cashu, `"sent"` for other rails. */
+    status: string;
+    /** When the money left (epoch ms). */
+    drainedAt: number;
+    /** Per-credit gap-free ledger sequence, for reconciling against the DVM's ledger. */
+    ledgerSeq?: number;
+    /** Set when an operator repair verb completed this reclaim. */
+    repaired?: boolean;
+    /** Required iff `repaired`; identifies the repair path that completed the reclaim. */
+    repairKind?: CreditDrainRepairKind;
 }
-/** Best-effort identification of the backend holding the relay submission lock. */
-interface X402RelayLockHolder {
-    pid: number;
-    applicationName?: string;
-    clientAddr?: string;
-    state?: string;
-    /** Seconds since the holder's current statement started. */
-    heldSeconds?: number;
+/**
+ * Open Postgres transaction handle accepted by the reporter-owned outbox
+ * enqueue. The payment rail owns BEGIN/COMMIT; the reporter owns its table.
+ */
+interface RevenueReporterQuerier {
+    query: Pool["query"];
 }
 /**
- * The fleet-wide relay submission lock was still held when the wait ceiling expired.
+ * Transactional deposit-outbox seam threaded through each rail commit.
+ *
+ * Implemented by {@link RevenueReporter.enqueueDeposit}; callers must await it
+ * before committing the rail receive and ledger funding.
+ */
+type CreditDepositEnqueue = (tx: RevenueReporterQuerier, payload: CreditDepositPayload) => Promise<void>;
+/** Transactional draw-release outbox seam used by the credit ledger. */
+type CreditDrawReleaseEnqueue = (tx: RevenueReporterQuerier, payload: CreditDrawReleasePayload) => Promise<void>;
+/**
+ * Transactional drain-outbox seam threaded through each terminal drain
+ * transition.
+ *
+ * Implemented by {@link RevenueReporter.enqueueCreditDrain}; callers must await
+ * it before committing the status CAS that moved the money.
+ */
+type CreditDrainEnqueue = (tx: RevenueReporterQuerier, payload: CreditDrainPayload) => Promise<void>;
+/**
+ * JSON wire shape POSTed to the platform's `/_internal/credit-expiry-release`
+ * endpoint. A prepaid credit that reaches its TTL with an undrawn
+ * remainder RELEASES that remainder to the builder: on cashu, Lightning and
+ * x402 the funding value reached builder custody at funding time or on the
+ * settlement cycle, so expiry extinguishes the caller's remaining claim.
+ * Reported so committed value nets to
+ * `deposited − drawn − drained − released`; without it an expired credit is
+ * owed forever on paper, exactly like an unreported drain.
  *
- * Typed, and `retryable`, because it is an availability outcome rather than a
- * fault in the payment: a fleet-mate whose RPC is retrying holds the lock, and
- * the same request works once it lets go. It refuses rather than proceeding —
- * two machines submitting from one EOA collide on the nonce — and it refuses
- * rather than blocking, which is the defect: the old acquire had no
- * `lock_timeout`, so a wedged holder pinned a host-pool client and a channel
- * advisory lock for as long as it took.
+ * Never sent for a Tempo credit. Tempo balances are channel-backed and undrawn
+ * channel value returns to the *caller* at exit, so no release exists on that
+ * rail — the sweep skips them and the platform refuses one outright.
+ *
+ * Two reports share this shape, distinguished only by `reversedAt`:
+ *
+ * - **The release**, written by the expiry sweep with `reversedAt` absent.
+ * - **The reversal**, written when a later funding revives the credit
+ * (`CreditLedger.fund` overwrites `expiry_ms`, so the recorded remainder is
+ * no longer final). It repeats the whole payload rather than sending a
+ * reference, because the retry loop can deliver the two out of order and the
+ * platform's upsert must be able to land either one first.
+ *
+ * Idempotent on `(dvmId, creditId, releaseId)`, so the shared retry loop can
+ * redeliver freely.
  */
-declare class X402RelaySubmissionLockError extends Error {
-    readonly lockKey: string;
-    readonly timeoutMs: number;
-    readonly holder?: X402RelayLockHolder | undefined;
-    readonly code = "x402_relay_submission_lock_timeout";
-    readonly retryable = true;
-    constructor(lockKey: string, timeoutMs: number, holder?: X402RelayLockHolder | undefined);
-}
-/** Outcome of {@link PostgresX402ChannelStorage.writeOffSettlement} — `written` is the transition bit. */
-interface X402SettlementWriteOff {
-    intent: X402SettlementIntent;
-    written: boolean;
-}
-/** The refund standing between a channel and the credit it backs. */
-interface X402UnresolvedRefund {
-    settlementId: string;
-    /** `${creditId}:${drainId}` — the drain this settlement belongs to. */
-    effectId: string;
-    status: X402SettlementStatus;
+interface CreditExpiryReleasePayload {
+    /** Platform DVM record ID (`dvms.id`); must match the bearer token's DVM. */
+    dvmId: string;
+    creditId: string;
+    /** Per-expiry-episode key; the platform idempotency key with DVM and credit. */
+    releaseId: string;
+    callerPubkey: string;
+    /** Funding rail. `null` on a credit funded before the basis became mandatory. */
+    rail: string | null;
+    /** Fiat micro released — the liability this expiry extinguishes. */
+    amountMicro: number;
+    /** Currency `amountMicro` is 1e-6 of. */
+    creditCurrency: string;
+    /** When the credit's TTL ran out (epoch ms) — when the liability ended. */
+    expiryMs: number;
+    /** When the sweep observed the expiry (epoch ms). */
+    releasedAt: number;
+    /** Set only on the reversal report: when the revival funding landed (epoch ms). */
+    reversedAt?: number | null;
 }
 /**
- * The credit ledger's read into durable x402 settlement state.
+ * Transactional expiry-release outbox seam, threaded through the sweep's insert
+ * and through the funding that reverses a release.
  *
- * Narrow on purpose: the ledger asks one question — is this channel's refund
- * still unresolved — and must not acquire the ability to move a settlement.
- * Implemented by {@link PostgresX402ChannelStorage.pendingRefundSettlement}.
+ * Implemented by {@link RevenueReporter.enqueueCreditExpiryRelease}; callers
+ * must await it before committing the write that made the release (or its
+ * reversal) true, for the same reason the drain seam does — a report lost
+ * between the two overstates or understates committed value forever.
  */
-interface X402RefundSettlementGate {
-    pendingRefundSettlement(channelId: string, statuses: X402SettlementStatus[]): Promise<X402UnresolvedRefund | undefined>;
+type CreditExpiryReleaseEnqueue = (tx: RevenueReporterQuerier, payload: CreditExpiryReleasePayload) => Promise<void>;
+/**
+ * JSON wire shape POSTed to the platform's `/_internal/paid-job-death` endpoint
+ * when the stale-job reaper force-fails a *paid* job — its pending
+ * credit draw is released rather than settled, so the caller's payment is back
+ * on their credit balance and reclaimable by drain. The platform resolves fiat
+ * + owner and sends an ambient notice via the shared alert sink. Unlike
+ * {@link RevenueReportPayload} this carries no durable-retry semantics: the
+ * reaper's `stale_job_failed` structured log is the durable backstop, so a lost
+ * report degrades to log-only rather than blocking the sweep.
+ */
+interface PaidJobDeathPayload {
+    /** Platform DVM record ID (`dvms.id`). Bound to the authenticating token. */
+    dvmId: string;
+    jobId: string;
+    capability: string;
+    /** Amount of the released credit draw in millisatoshis. */
+    paidMsats: number;
+    /** Payment rail of the released draw (`"cashu"`, `"tempo"`, `"x402"`). */
+    rail: string;
+    /** Reaper reason: dead worker or never-terminal idle job. */
+    reason: string;
+    /** Rail-native released amount, paired with `nativeAsset`. */
+    nativeAmount?: number;
+    /** Asset tag for `nativeAmount` (`"sats"` / `"usdc"` / …). */
+    nativeAsset?: string;
+    /** Cashu mint URL the credit draw's tokens were issued from. */
+    paymentMint?: string;
 }
+type RevenueSkippedNoRailReason = "credit_rail_null" | "credit_rail_unrecognized" | "job_rail_missing" | "ledger_not_configured";
 /**
- * Postgres implementation of x402's server-side {@link ChannelStorage}.
- *
- * `updateChannel` takes an advisory transaction lock before it reads the row,
- * so the read/callback/write sequence is atomic even for a first deposit whose
- * row does not exist yet. {@link withChannelTransaction} exposes the same
- * transaction to the credit ledger: the fixed lock order is channel first,
- * credit second, and no credit-ledger path calls back into this store.
- *
- * Two pools, and the split is load-bearing. The settlement markers
- * must write *outside* the ledger transaction, which means a second connection
- * taken while the transaction's client is still checked out — on the shared
- * host pool that is a self-deadlock the moment concurrent deposits reach its
- * `max`, with no error and no timeout because every waiter is also a holder.
- * They therefore run on a small dedicated pool that acquires nothing itself,
- * so nothing can ever queue behind them. The rule this rests on: a client held
- * from one pool may only ever be used to acquire from a pool that is terminal.
- * {@link withFleetSettlementLock} and {@link withRelaySubmissionLock} are the
- * other two nesting sites and are bounded a different way — see their docs.
+ * JSON wire shape POSTed to the platform's `/_internal/revenue-skipped-no-rail`
+ * endpoint when a settled credit draw has no usable payment rail
+ * for its revenue event. This is an operator notice rather than a durable
+ * accounting report: the SDK's structured log remains the durable backstop,
+ * and a failed alert must never block terminal handling or reconciliation.
  */
-declare class PostgresX402ChannelStorage implements ChannelStorage {
-    private readonly pool;
-    private readonly transaction;
-    private readonly refundBase;
-    private settlementPool?;
-    private fleetLock;
-    private fleetLockQueueDepth;
-    private readonly relayLockTimeoutMs;
-    private readonly terminalizeUnbackedCredit?;
-    constructor(pool: Pool, opts?: X402ChannelStorageOpts);
-    init(): Promise<void>;
-    /**
-     * Read the fleet's durable "claimed funds are awaiting transfer" marker.
-     *
-     * Upstream keeps this in process memory, which a multi-machine fleet cannot
-     * share: the machine that won a claim tick is rarely the one that wins the
-     * next settle tick. An unset scope reads false, so a receiver that has never
-     * claimed never submits a settlement.
-     *
-     * Both accessors run on the settlement pool: every caller reads or writes the
-     * marker while {@link withFleetSettlementLock} holds a host-pool client, which
-     * is the nesting the split exists to keep off a non-terminal pool.
-     */
-    isSettlePending(scope: string): Promise<boolean>;
-    /** Record whether a claim's funds still need a `settle(receiver, token)` transfer. */
-    setSettlePending(scope: string, pending: boolean): Promise<void>;
-    /**
-     * Look up the durable settlement state for one credit-ledger effect.
-     *
-     * On the dedicated settlement pool like every other marker, and for a sharper
-     * reason than they had: this and {@link prepareSettlement} now run *inside*
-     * the channel transaction, which holds a host-pool client for its
-     * whole duration. Taking a second client from that same pool is the
-     * self-deadlock fixed — at pool max every client is a holder and a
-     * waiter — and moving these calls under the transaction is exactly what would
-     * reintroduce it.
+interface RevenueSkippedNoRailPayload {
+    /** Platform DVM record ID (`dvms.id`). Bound to the authenticating token. */
+    dvmId: string;
+    jobId: string;
+    creditId: string;
+    drawId: string;
+    /** Caller payment captured for the job, in millisatoshis. */
+    paidMsats: number;
+    /** Settled draw amount in 1e-6 of `creditCurrency`. */
+    drawAmountMicro?: number;
+    /** Currency the draw amount is denominated in. */
+    creditCurrency?: string;
+    /** Credit funding rail as stored on the draw, or null for legacy rows. */
+    creditRail: string | null;
+    reason: RevenueSkippedNoRailReason;
+}
+/** Gas-balance observation POSTed by a platform-hosted x402 self-relay. */
+interface X402SelfRelayGasBalancePayload {
+    /** Platform DVM record ID, bound to the authenticating platform token. */
+    dvmId: string;
+    /** Dedicated relay EOA whose Base ETH balance was read. */
+    address: `0x${string}`;
+    /** CAIP-2 Base network identifier. */
+    network: string;
+    /** Current native balance as a decimal wei string. */
+    balanceWei: string;
+    /** Configured paging floor as a decimal wei string. */
+    lowBalanceWei: string;
+    /** Millisecond timestamp at which the DVM read the balance. */
+    checkedAt: number;
+}
+/** RPC-health transition POSTed by a platform-hosted x402 self-relay. */
+type X402SelfRelayRpcHealthPayload = {
+    /** Platform DVM record ID, bound to the authenticating platform token. */
+    dvmId: string;
+    /** Dedicated relay EOA identifying the affected self-relay. */
+    address: `0x${string}`;
+    /** CAIP-2 Base network identifier. */
+    network: string;
+    /** Healthy transition clears an open RPC page. */
+    status: "healthy";
+    /** Millisecond timestamp at which the DVM observed the transition. */
+    checkedAt: number;
+} | {
+    /** Platform DVM record ID, bound to the authenticating platform token. */
+    dvmId: string;
+    /** Dedicated relay EOA identifying the affected self-relay. */
+    address: `0x${string}`;
+    /** CAIP-2 Base network identifier. */
+    network: string;
+    /** Failed transition opens or refreshes an RPC page. */
+    status: "failed";
+    /** Redacted failure class; never the provider error or endpoint URL. */
+    reason: X402SelfRelayRpcFailureReason;
+    /** Millisecond timestamp at which the DVM observed the transition. */
+    checkedAt: number;
+};
+/** Configured Tempo operator fee-token balance POSTed by a hosted DVM. */
+interface TempoSettlementBalancePayload {
+    dvmId: string;
+    address: `0x${string}`;
+    network: string;
+    token: `0x${string}`;
+    balanceMicro: string;
+    lowBalanceMicro: string;
+    checkedAt: number;
+    ready: boolean;
+}
+/** Redacted Tempo operator fee-funding rejection POSTed by a hosted DVM. */
+interface TempoSettlementFailurePayload {
+    dvmId: string;
+    address: `0x${string}`;
+    network: string;
+    token: `0x${string}`;
+    operation: "settle" | "close";
+    errorClass: "InsufficientFundsError";
+    checkedAt: number;
+    balanceMicro?: string;
+    channelId?: string;
+    creditId?: string;
+    drainId?: string;
+}
+/**
+ * Durable revenue reporter for container-runtime DVMs.
+ *
+ * On job completion the SDK calls `report()`, which persists the payload to
+ * a local Postgres table and attempts an immediate POST to the platform.
+ * A background retry loop picks up un-acked rows with exponential backoff.
+ * Gauge and health notifications are best-effort: failed delivery is logged
+ * and dropped rather than queued for retry.
+ */
+declare class RevenueReporter {
+    private readonly db;
+    private readonly platformUrl;
+    private readonly platformToken;
+    private readonly hostedObligations?;
+    private retryTimer;
+    private static readonly RETRY_INTERVAL_MS;
+    private static readonly MAX_BACKOFF_MS;
+    private static readonly ABANDON_AFTER_MS;
+    constructor(db: Pool, platformUrl: string, platformToken: string, hostedObligations?: HostedSettlementReportObligations | undefined);
+    /** Create the pending-reports table and migrate the legacy SDK outbox (idempotent). */
+    init(): Promise<void>;
+    private createTables;
+    private migrateLegacySdkOutbox;
+    private assertSdkTableShape;
+    private assertSdkColumns;
+    private tableColumns;
+    /** Persist a revenue report and attempt immediate delivery. */
+    report(payload: RevenueReportPayload): Promise<void>;
+    /** The permanent deduplication claim and outbox insert commit together.
+     * The claim survives successful delivery, including for custom job stores.
      */
-    getSettlement(operation: "fund" | "refund", effectId: string): Promise<X402SettlementIntent | undefined>;
+    reportTerminal(payload: JobTerminalReportPayload): Promise<void>;
+    /** Persist a zero-revenue job cost and attempt immediate delivery. */
+    reportCost(payload: JobCostReportPayload): Promise<void>;
     /**
-     * The refund on this channel that is neither finished nor abandoned, if there
-     * is one — the credit ledger's spend gate.
-     *
-     * `statuses` is the caller's, because the two gates disagree by design: a
-     * draw is blocked by {@link X402_SPEND_BLOCKING_SETTLEMENT_STATUSES}, a fresh
-     * drain only by {@link X402_WEDGED_SETTLEMENT_STATUSES}.
-     *
-     * On the dedicated settlement pool, and that is what makes the gate callable
-     * at all: a draw routinely runs inside an open channel transaction holding a
-     * host-pool client, and taking a second one from that pool is the
-     * self-deadlock. The oldest blocking row wins, so a channel that somehow
-     * accumulated two names the one an operator should reach for first.
+     * Join a credit deposit to the caller-owned rail transaction.
      *
-     * Projects three columns rather than decoding a whole {@link
-     * X402SettlementIntent}: the decoder refuses a legacy row that carries
-     * no reconciliation snapshot, and a gate that throws on one would take every
-     * draw on that channel down with it — when the row is exactly the kind that
-     * ought to block them.
-     */
-    pendingRefundSettlement(channelId: string, statuses: X402SettlementStatus[]): Promise<X402UnresolvedRefund | undefined>;
-    /**
-     * Read one settlement by its own identifier — the handle an operator holds
-     * Same dedicated pool as {@link getSettlement}, for the same
-     * reason: the repair reads this while a channel transaction may be open.
+     * This method performs no network I/O: it only writes the reporter-owned
+     * durable queue row through `tx`. The retry drain delivers the row after the
+     * rail transaction commits, including after a process restart.
      */
-    getSettlementById(settlementId: string): Promise<X402SettlementIntent | undefined>;
-    /** Lazily move a legacy settlement row onto its authorization/effect-scoped replay key. */
-    normalizeLegacyPaymentId(settlementId: string, operation: "fund" | "refund", legacyPaymentId: string, paymentId: string): Promise<X402SettlementIntent>;
+    enqueueDeposit(tx: RevenueReporterQuerier, payload: CreditDepositPayload): Promise<void>;
+    /** Join a released draw to the transaction that made the hold terminal. */
+    enqueueCreditDrawRelease(tx: RevenueReporterQuerier, payload: CreditDrawReleasePayload): Promise<void>;
     /**
-     * The operator's repair queue: settlements stuck between "chain paid" and
-     * "ledger booked", oldest write first.
-     *
-     * Keyset-paginated on `(created_at, settlement_id)` for the reason the
-     * blocked-invoice queue is: a wedged row never self-clears, so a fixed first
-     * page of rows the operator has declined to act on would starve everything
-     * behind it on every run, forever.
-     *
-     * The keyset is on `created_at`, which never moves, while `updatedBeforeMs`
-     * filters on `updated_at`, which does — so a row an operator touches mid-walk
-     * can leave the queue but can never jump the cursor and be skipped. The cursor
-     * itself is Postgres's text rendering of that timestamp, handed back verbatim;
-     * see {@link X402SettlementCursor} for why a `Date` cannot carry it.
-     *
-     * `updatedBeforeMs` is the staleness floor. A healthy settlement passes
-     * through `submitting` and `settled` inside one request, so anything younger
-     * than the floor is in flight rather than wedged and must not be offered as
-     * repairable work.
+     * Await durable queue insertion through tx so the terminal drain and its
+     * report commit or roll back together; no network I/O here.
      */
-    listSettlements(args: {
-        statuses: X402SettlementStatus[];
-        updatedBeforeMs: number;
-        limit: number;
-        after?: X402SettlementCursor;
-    }): Promise<X402SettlementPage>;
+    enqueueCreditDrain(tx: RevenueReporterQuerier, payload: CreditDrainPayload): Promise<void>;
     /**
-     * Close a wedged settlement without booking anything.
-     *
-     * A single-statement CAS on the wedged statuses, on the settlement pool —
-     * there is no ledger effect to be atomic with, which is the whole point:
-     * the write-off records that an operator reviewed this settlement and is not
-     * completing it, and no dvmkit table moves. Idempotent, and the first note
-     * wins; `written` is the transition bit the caller logs on, so the one place
-     * the amount is ever recorded gets exactly one entry.
-     *
-     * Reversible by construction: a later reconcile calls
-     * {@link recordSettlementResponse}, whose `status <> 'complete'` CAS lifts a
-     * written-off row back to `settled`.
+     * Join a payout to the transaction that commits the movement it reports
+     * the batch close, the accumulator mark, the drain booking.
+     * No network I/O, only the durable queue row through `tx`, the discipline
+     * {@link enqueueCreditDrain} set and for the same reason: the money has
+     * already moved on a rail this ledger does not own, so the platform row is
+     * the only record the builder's dashboard has of it, and a row lost between
+     * the fact and the queue would understate "paid out" forever. Without `tx`
+     * the row is queued on the pool, for callers with no fact of their own to
+     * commit. Idempotent on `(dvmId, payoutId)` platform-side, so the retry
+     * loop redelivers freely.
      */
-    writeOffSettlement(settlementId: string, note: string | undefined, nowMs: number): Promise<X402SettlementWriteOff | undefined>;
-    /** Persist the reconciliation identity, refreshing a prepared retry's transient reservation. */
-    prepareSettlement(intent: X402SettlementIdentity): Promise<X402SettlementIntent>;
+    enqueuePayout(payload: PayoutReportPayload, tx?: RevenueReporterQuerier): Promise<void>;
+    enqueueHostedPayout(payload: PayoutReportPayload, obligationIds: string[], tx?: RevenueReporterQuerier): Promise<void>;
     /**
-     * Mark that the next operation is the ambiguous external-call boundary.
-     *
-     * `channelAtSubmission` is the live channel the facilitator is about to size
-     * and sign the settlement against — bookmarked here, with the
-     * block height, because these two are the only description of that instant
-     * that survives the call.
+     * Report one landed payout on its own and try to deliver it at once — the
+     * live Tempo settlement, which has no dvmkit transaction to join. Durable
+     * like {@link report}.
      */
-    markSettlementSubmitting(settlementId: string, submissionBlock: string, channelAtSubmission?: Channel): Promise<void>;
-    /** Return an explicitly failed facilitator submission to the safe retry phase. */
-    markSettlementRetryable(settlementId: string): Promise<void>;
+    reportPayout(payload: PayoutReportPayload): Promise<void>;
     /**
-     * Record a successful facilitator response independently of the enclosing
-     * ledger transaction.
-     *
-     * The write-off columns are cleared, not carried: this CAS is what lifts a
-     * `written_off` row back to `settled` (which is what makes the write-off
-     * reversible), and a row that is no longer written off must not still be
-     * carrying the note and resolution timestamp of a decision that has been
-     * reversed. On the live path the columns are already `NULL` and this is a
-     * no-op.
+     * Report one rail's pending-pool snapshot. Best-effort and
+     * fire-and-forget, deliberately unlike {@link reportPayout}: a snapshot is
+     * replaced by the next tick, so queueing a stale one behind an outage would
+     * only deliver figures the platform already has newer ones for.
      */
-    recordSettlementResponse(settlementId: string, response: SettleResponse$1): Promise<void>;
+    reportPayoutPending(payload: PayoutPendingPayload): Promise<void>;
     /**
-     * Mark the external settlement and ledger effect complete in the active transaction.
-     *
-     * `resolvedAtMs` is set only by the operator repair, so an audit
-     * read can tell a settlement that completed on its own from one a human had
-     * to finish.
+     * Await durable queue insertion through tx so expiry release or reversal and
+     * its report commit together. A missing reversal would overstate builder value.
      */
-    completeSettlement(settlementId: string, resolvedAtMs?: number): Promise<void>;
-    get(channelId: string): Promise<Channel | undefined>;
-    /** List all channel snapshots in stable channel-id order. */
-    list(): Promise<Channel[]>;
-    /** Atomic backend-level read/modify/write for one channel. */
-    updateChannel(channelId: string, update: (current: Channel | undefined) => Channel | undefined): Promise<ChannelUpdateResult>;
+    enqueueCreditExpiryRelease(tx: RevenueReporterQuerier, payload: CreditExpiryReleasePayload): Promise<void>;
     /**
-     * Run channel state and its ledger effect under the channel lock.
-     *
-     * Upstream's voucher-only settle updates `chargedCumulativeAmount` through
-     * `updateChannel`. Keeping that update and `commitMarkedFunding` in this one
-     * transaction means a ledger refusal rolls the voucher state back. External
-     * deposit/refund responses are recorded separately before this transaction
-     * commits, leaving a durable reconciliation row if COMMIT fails.
+     * Report a reaper-force-failed paid job to the platform so the
+     * operator receives an ambient notice that a DVM died or wedged mid-job.
+     * Best-effort and fire-and-forget: unlike {@link report} there is no local
+     * durable queue — a non-2xx or transport failure is structured-logged
+     * (`paid_job_death_report_failed`) and dropped, since the reaper's own
+     * `stale_job_failed` log is the durable record and a failed *alert* must never
+     * wedge the sweep.
      */
+    reportPaidJobDeath(payload: PaidJobDeathPayload): Promise<void>;
     /**
-     * Sanction one cooperative-refund base for the updates inside `operation`.
-     *
-     * The store cannot derive the base — it comes from the credit ledger — so
-     * this is how the settlement layer says "this exact decrease is the one the
-     * payer's verified refund voucher authorises". Outside this scope a decrease
-     * of `chargedCumulativeAmount` is refused flat, which is what keeps the
-     * arbitrary-decrease guard meaningful.
+     * Report a settled draw whose revenue event was skipped.
+     * Best-effort and fire-and-forget: the SDK's structured
+     * `revenue_skipped_no_rail` log is the durable backstop, so a failed notice
+     * must never wedge terminal handling or the orphan-draw reconciler.
      */
-    withSanctionedRefundBase<T>(base: string, operation: () => Promise<T>): Promise<T>;
-    withChannelTransaction<T>(channelId: string, operation: (tx: PoolClient) => Promise<T>): Promise<T>;
+    reportRevenueSkippedNoRail(payload: RevenueSkippedNoRailPayload): Promise<void>;
+    reportX402SelfRelayGasBalance(payload: X402SelfRelayGasBalancePayload): Promise<void>;
+    reportX402SelfRelayRpcHealth(payload: X402SelfRelayRpcHealthPayload): Promise<void>;
+    reportTempoSettlementBalance(payload: TempoSettlementBalancePayload): Promise<void>;
+    reportTempoSettlementFailure(payload: TempoSettlementFailurePayload): Promise<void>;
+    private postTempoSettlementReadiness;
+    startRetryLoop(): void;
+    stop(): void;
     /**
-     * Run one fleet-wide settlement operation, optionally waiting for the current owner.
-     *
-     * The lock is session-scoped, so its client stays checked out for the whole
-     * operation — and `operation()` (upstream's claim/settle) re-enters the pool
-     * through {@link updateChannel}. Two bounds keep that from wedging the pool
-     * local callers are serialized in-process, so this holds at most
-     * one client per process no matter how many requests arrive, and a waiting
-     * acquire carries a `lock_timeout` so a wedged fleet-mate can't pin that
-     * client — and the caller's request — indefinitely. A timeout reports the
-     * lock as not acquired, which is what every caller already handles.
-     *
-     * The queue depth is reserved synchronously, before the promise chain can
-     * yield. That makes the non-waiting form a true local try-lock even while the
-     * first caller is still acquiring its connection: an overlapping request
-     * returns `false` instead of queuing behind the facilitator operation.
+     * Operator-facing queue snapshot: distinguishes the live retry queue from
+     * terminal (stale) rows and breaks the latter down by classification reason
+     * (`token_rotated`, `client_error:<status>`, `abandoned`). Lets monitoring tell
+     * transient backlog apart from permanently-failed rows.
      */
-    withFleetSettlementLock(operation: () => Promise<unknown>, wait?: boolean): Promise<boolean>;
+    getQueueStats(): Promise<{
+        liveRetry: number;
+        stale: number;
+        byReason: Record<string, number>;
+    }>;
     /**
-     * Hold the fleet-wide self-relay submission lock for one chain submission.
-     *
-     * The session lock keeps one per-DVM gas EOA to one in-flight submission
-     * across the whole fleet — two machines submitting at once collide on the
-     * nonce. It is reached from `resource.settlePayment` inside
-     * {@link withChannelTransaction} and from upstream's claim/settle inside
-     * {@link withFleetSettlementLock}, so on both paths a host-pool client is
-     * already checked out: it therefore acquires from the terminal settlement
-     * pool, which is the rule in this class's doc, and never from the host pool
-     * the caller is holding.
-     *
-     * The wait is bounded by `lock_timeout` and a timeout **refuses** rather than
-     * proceeding unlocked, which is where this differs from
-     * {@link withFleetSettlementLock}: a fleet lock nobody got means the claim is
-     * someone else's turn, while a submission lock nobody got means the caller
-     * must not submit at all. The refusal is typed and retryable, and names the
-     * holder when Postgres will tell us who it is.
+     * Deliver one bounded batch from the durable queue.
      *
-     * The relay's own in-process tail serialises callers before they reach here,
-     * so one process pins at most one settlement-pool client no matter how many
-     * deposits arrive.
+     * Processes due, non-stale rows; failures back off up to five minutes and
+     * become terminal after 24 hours. Successful deliveries remove their rows.
      */
-    withRelaySubmissionLock<T>(key: string, operation: () => Promise<T>): Promise<T>;
-    /** Release the dedicated settlement pool; the host-owned pool is left alone. */
-    close(): Promise<void>;
-    private settlementWriter;
-    private settlementPoolRef;
-    private runUnderFleetLock;
-    private updateInTransaction;
+    drainPending(): Promise<void>;
+    private enqueue;
+    private insertPending;
+    private attemptDelivery;
+    private markStale;
 }
 
 interface TempoSessionSettlementStore {
@@ -2486,6 +2666,8 @@ declare class CreditLedger {
     readonly durable = true;
     private x402Settlements?;
     private expiryReleaseOutbox?;
+    private hostingCleanupFence?;
+    private readonly invoiceSettlementClients;
     constructor(pool: CreditLedgerPool, tempoSessionStore?: TempoSessionSettlementStore | undefined);
     /**
      * Bound after construction because the settlement store shares this ledger and is
@@ -2498,6 +2680,7 @@ declare class CreditLedger {
      * wiring, ledger transitions still run.
      */
     useCreditExpiryReleaseOutbox(outbox: CreditExpiryReleaseOutbox): void;
+    useHostingCleanupFence(fence: HostingCleanupFence): void;
     init(): Promise<void>;
     private createTables;
     /**
@@ -2584,6 +2767,8 @@ declare class CreditLedger {
         drawId: string;
         amountMicro: number;
         jobId?: string;
+        hostingAdmissionId?: string;
+        hostingPaymentSeq?: number;
         /** External transaction handle — caller owns BEGIN/COMMIT (spec condition 3). */
         tx?: CreditLedgerQuerier;
         nowMs?: number;
@@ -2679,6 +2864,12 @@ declare class CreditLedger {
         amountMicro: number;
         /** Rail the money arrived on, for the deposit audit trail. */
         rail?: string;
+        hostingAdmissionId?: string;
+        hostingCallerPubkey?: string;
+        hostingJobId?: string;
+        hostingPaymentSeq?: number;
+        hostingInvoicePaymentHash?: string;
+        hostingInvoiceRepairPaymentHash?: string;
         /** External transaction handle — caller owns BEGIN/COMMIT (spec condition 3). */
         tx?: CreditLedgerQuerier;
         nowMs?: number;
@@ -3177,6 +3368,12 @@ interface CreditLedgerLike {
         amountMicro: number;
         expiryMs: number;
         basis: CreditFundingBasis;
+        hostingAdmissionId?: string;
+        hostingJobId?: string;
+        hostingFundId?: string;
+        hostingPaymentSeq?: number;
+        hostingInvoicePaymentHash?: string;
+        hostingInvoiceRepairPaymentHash?: string;
         tx?: CreditLedgerQuerier;
         nowMs?: number;
     }): Promise<CreditSnapshot>;
@@ -3185,6 +3382,8 @@ interface CreditLedgerLike {
         drawId: string;
         amountMicro: number;
         jobId?: string;
+        hostingAdmissionId?: string;
+        hostingPaymentSeq?: number;
         tx?: CreditLedgerQuerier;
         nowMs?: number;
     }): Promise<DrawResult>;
@@ -3218,6 +3417,12 @@ interface CreditLedgerLike {
         fundId: string;
         amountMicro: number;
         rail?: string;
+        hostingAdmissionId?: string;
+        hostingCallerPubkey?: string;
+        hostingJobId?: string;
+        hostingPaymentSeq?: number;
+        hostingInvoicePaymentHash?: string;
+        hostingInvoiceRepairPaymentHash?: string;
         tx?: CreditLedgerQuerier;
         nowMs?: number;
     }): Promise<FundingRecord>;
@@ -3871,6 +4076,13 @@ interface CreditFundArgs {
      * Rail value contributed by this funding; required on writes.
      */
     basis: CreditFundingBasis;
+    /** Server-verified original hosted admission, never accepted from the caller body. */
+    hostingAdmissionId?: string;
+    hostingJobId?: string;
+    hostingFundId?: string;
+    hostingPaymentSeq?: number;
+    hostingInvoicePaymentHash?: string;
+    hostingInvoiceRepairPaymentHash?: string;
     /**
      * External transaction handle; caller owns BEGIN, COMMIT and ROLLBACK.
      */
@@ -4119,6 +4331,8 @@ interface TempoSessionLifecycle {
  */
 declare class PostgresTempoSessionStore implements Store.AtomicStore {
     private readonly pool;
+    private hostingCleanupFence?;
+    useHostingCleanupFence(fence: HostingCleanupFence): void;
     private readonly acceptance;
     constructor(pool: Pool);
     init(): Promise<void>;
@@ -4132,6 +4346,7 @@ declare class PostgresTempoSessionStore implements Store.AtomicStore {
     withVoucherAcceptance<value, result>(voucher: {
         channelId: string;
         cumulativeAmount: bigint;
+        hostingFunding?: HostedFundingReservation;
     }, commit: (tx: PoolClient, voucher: TempoVoucherDelta) => Promise<result>, operation: () => Promise<value>): Promise<{
         value: value;
         result: result | undefined;
@@ -4240,6 +4455,7 @@ interface MppOpts {
      */
     tempoSession?: {
         store: Store.AtomicStore;
+        hostedObligations?: HostedSettlementReportObligations;
         account: Account;
         getClient?: (parameters: {
             chainId?: number;
@@ -4300,6 +4516,10 @@ interface MppxServer {
      * always the mutating path, so this is the only one the SDK binds.
      */
     broadcastCredential(credential: Credential.Credential | string, options?: any): Promise<Receipt.Receipt>;
+    /** Non-mutating mppx HMAC, route, expiry and method preflight. */
+    validateCredential?(credential: Credential.Credential | string, options?: any): Promise<Method.Validation>;
+    completeHostedTempoCharge?: (challengeId: string) => Promise<void>;
+    permitHostedTempoClose?: (credential: Credential.Credential | string, reservationId: string) => void;
     /**
      * Typed dispatcher over `mppx.challenge.<method>.<intent>(opts)`. Localizes
      * the cast across the open challenge dispatcher so callers don't repeat it.
@@ -5410,7 +5630,7 @@ interface DVMConfig<State = Record<string, unknown>, InputSchema extends ZodLike
     /** Payment methods this DVM accepts. Default: derived from configured rails — adds "cashu" when `mints` is set, "x402" when `x402` is set, "tempo" when `tempo` is set. */
     paymentMethods?: PaymentMethod[];
     /** x402 stablecoin payment configuration (provider-side). */
-    x402?: X402Config;
+    x402?: X402Config$1;
     /** MPP multi-rail payment handle (provider-side, built via `createMppFromOpts`). */
     mpp?: MppxServer;
     /**
@@ -5499,7 +5719,7 @@ interface DVMDescriptor<State = Record<string, unknown>, InputSchema extends Zod
     /** Payment methods this DVM accepts. */
     readonly paymentMethods?: PaymentMethod[];
     /** x402 stablecoin payment configuration. */
-    readonly x402?: X402Config;
+    readonly x402?: X402Config$1;
     /** MPP multi-rail payment handle. */
     readonly mpp?: MppxServer;
     /**
@@ -5541,4 +5761,4 @@ declare class StepCache {
     static deserialize(records: StepRecord[]): StepCache;
 }
 
-export { type X402Version as $, type ApprovalContent as A, SignedRequestError as B, type Currency as C, type DVMConfig as D, type SignedRequestFailure as E, type SignedRequestReplayStore as F, type SignedRequestSignOpts as G, type SignedRequestStatementHeader as H, type IncomingMessage as I, type JobCost as J, type KVStore as K, type Logger as L, type SignedRequestVerifier as M, createSignedRequestVerifier as N, isZodSchema as O, type PaymentContent as P, type QuoteConfig as Q, type ResolvedCreditConfig as R, type SDKJobContext as S, signedRequestStatementHeader as T, UnsupportedCurrencyError as U, validateCurrency as V, type JsonValue as W, type FundingReceipt as X, type JobReceipt as Y, type ZodLike as Z, type PaymentRequired as _, type DVMDescriptor as a, isDrainReceipt as a$, type MppxCredential as a0, type Message as a1, type MessageType as a2, type MppxChallenge as a3, X402_BATCH_SETTLEMENT_SCHEME as a4, X402_EXACT_SCHEME as a5, type ReceiptCredit as a6, type X402Wallet as a7, type ResourceInfo as a8, type BuildPaymentRequirementsOpts as a9, type UnsignedFundingReceipt as aA, type UnsignedJobReceipt as aB, type VerifyResponse as aC, type WorkingContent as aD, type X402Config as aE, type X402ResponseBody as aF, type X402SelfRelayRpcFailureReason as aG, X402_DEFAULT_NETWORK as aH, X402_V1_VERSION as aI, X402_VERSION as aJ, buildPaymentRequiredV2 as aK, buildPaymentRequirements as aL, caip2ToX402Network as aM, canonicalRequestPath as aN, canonicaliseForSigning as aO, canonicalize as aP, chainIdFromCaip2 as aQ, computeResultHash as aR, decodePayment as aS, decodePaymentRequiredHeader as aT, encodePayment as aU, encodePaymentRequiredHeader as aV, encodeSettleResponseHeader as aW, exactEvmAuthorization as aX, isArtifactMessage as aY, isCancelMessage as aZ, isCompleteMessage as a_, type CapabilityDescriptor as aa, type CashuMode as ab, type CompleteContent as ac, type DrainReceipt as ad, type DrainReceiptEvent as ae, type ExactEvmPayload as af, type ExactEvmPayloadAuthorization as ag, type FundingMethod as ah, type MessageFrom as ai, type PaymentPayload as aj, type PaymentPayloadV1 as ak, type PaymentPayloadV2 as al, type PaymentRequestContent as am, type PaymentRequiredV2 as an, type PaymentRequirements as ao, type PaymentRequirementsV1 as ap, type PaymentRequirementsV2 as aq, type PromptContent as ar, RAIL_REFUNDABLE as as, type ReceiptOutcome as at, type ReceiptPayment as au, type SettleResponse as av, StepCache as aw, type StepRecord as ax, type TextContent as ay, type UnsignedDrainReceipt as az, type ArtifactContent as b, type StalePendingDrawCursor as b$, isFundingReceipt as b0, isPaymentRequestMessage as b1, isPromptMessage as b2, isSignedJobReceipt as b3, isTextMessage as b4, isWorkingMessage as b5, paymentRequiredV2FromV1 as b6, signDrainReceipt as b7, signFundingReceipt as b8, signReceipt as b9, _testing as bA, createDefaultReplayStore as bB, depleteLots as bC, fifoOrder as bD, inKindDrawMsats as bE, isInKindDepletion as bF, isNonChannelBitcoinRail as bG, lotOwedSats as bH, netOwedSats as bI, wrapMppx as bJ, type CreditDrainEnqueue as bK, type DVMAuthScheme as bL, type CreditLedgerLike as bM, type X402RefundSettlementGate as bN, type CreditSnapshot as bO, type DrawResult as bP, type X402SettlementStatus as bQ, type X402UnresolvedRefund as bR, type GrownDrawResult as bS, type DrawResolution as bT, type FundingRecord as bU, type CreditInvoiceRecord as bV, type InvoiceSettlement as bW, type BlockedInvoiceCursor as bX, type InvoiceReconciliation as bY, type InvoiceWriteOff as bZ, type DrawRecord as b_, usdcContractByCaip2 as ba, usdcContractFor as bb, usdcDomainNameFor as bc, usdcDomainVersionFor as bd, verifyDrainReceipt as be, verifyFundingReceipt as bf, verifyReceipt as bg, x402NetworkToCaip2 as bh, type X402ExactVersionSupport as bi, type X402Receipt as bj, type TransactionalPayoutHook as bk, type CashuMeltCompleted as bl, type CreditDepositPayload as bm, type CreditDrainPayload as bn, type FundingLot as bo, type LotDebit as bp, type LotDepletion as bq, type MppxServer as br, NON_CHANNEL_BITCOIN_RAILS as bs, type NonChannelBitcoinRail as bt, PayoutReporter as bu, PostgresTempoSessionStore as bv, RevenueReporter as bw, SIGNED_ENVELOPE_FIELDS as bx, SIGNED_ENVELOPE_TYPES as by, type X402TrackedChannel as bz, type CancelContent as c, type CreditDrawReleaseEnqueue as c$, type TempoCreditLossEvidence as c0, type CreditLedgerQuerier as c1, type TempoCreditLoss as c2, type X402CreditLossEvidence as c3, type X402CreditLoss as c4, type DrainMethod as c5, type DrainRequestResult as c6, type BitcoinDepositLiability as c7, type CreditDrainRecord as c8, type ChannelDrainCursor as c9, type ReplayStoreBackend as cA, type RevenueSkippedNoRailPayload as cB, type RevenueSkippedNoRailReason as cC, type Secp256k1AuthOpts as cD, type X402ChannelStorageOpts as cE, type X402RelayLockHolder as cF, type X402RelaySubmissionLock as cG, X402RelaySubmissionLockError as cH, allocateDrawValue as cI, clientCompatibilityAttributes as cJ, clientCompatibilityMiddleware as cK, clientUpgradeRequired as cL, parseClientCapabilities as cM, parseClientCompatibility as cN, parseDvmClient as cO, parseProtocolVersion as cP, requireClientCompatibility as cQ, secp256k1Auth as cR, signedRequestInput as cS, type X402SettlementIntent as cT, type X402SettlementCursor as cU, type X402SettlementWriteOff as cV, type X402FacilitatorAuth as cW, type X402BatchSettlementConfig as cX, type X402PayoutObserver as cY, type CreditDepositEnqueue as cZ, type X402SettlementReconciliationReason as c_, type DrainWriteOff as ca, type DrainReleaseResult as cb, type DrainFulfilment as cc, type DrainTransitionResult as cd, CLIENT_COMPATIBILITY_HEADERS as ce, type ClientCompatibility as cf, type ClientCompatibilityEnv as cg, type ClientCompatibilityGate as ch, type ClientCompatibilityRequirement as ci, type ClientSemVer as cj, type CreditFundingBasis as ck, type CreditInvoiceStatus as cl, CreditLedger as cm, CreditLedgerError as cn, type CreditLedgerErrorCode as co, type CreditLedgerErrorDetails as cp, type CreditLedgerPool as cq, type CreditStatus as cr, DRAIN_DELIVERY_RESERVE_SATS as cs, DVM_PROTOCOL_VERSION as ct, type DrainConflictReason as cu, type DrawRailValue as cv, type DrawStatus as cw, type JobCostReportPayload as cx, type JobTerminalReportPayload as cy, PostgresX402ChannelStorage as cz, type CanonicalEnvelope as d, type CreateSignedRequestVerifierOpts as e, type CreditConfig as f, type CreditView as g, DEFAULT_CREDIT_MAX as h, DEFAULT_CREDIT_MIN as i, DEFAULT_CREDIT_TTL_SECONDS as j, DEFAULT_JOB_RETENTION_DAYS as k, type DVMRouteContext as l, type InputType as m, InvalidCurrencyError as n, type PaymentMethod as o, type PriceValue as p, type ProgressContent as q, type PromptOpts as r, type QuoteContext as s, type QuoteResult as t, type ResponseContent as u, type SDKPaymentRequestOpts as v, SIGNED_REQUEST_AUTH_ID as w, SIGNED_REQUEST_STATEMENT_VERSION as x, type SignedRequestAudience as y, type SignedRequestDomain as z };
+export { type X402Version as $, type ApprovalContent as A, SignedRequestError as B, type Currency as C, type DVMConfig as D, type SignedRequestFailure as E, type SignedRequestReplayStore as F, type SignedRequestSignOpts as G, type SignedRequestStatementHeader as H, type IncomingMessage as I, type JobCost as J, type KVStore as K, type Logger as L, type SignedRequestVerifier as M, createSignedRequestVerifier as N, isZodSchema as O, type PaymentContent as P, type QuoteConfig as Q, type ResolvedCreditConfig as R, type SDKJobContext as S, signedRequestStatementHeader as T, UnsupportedCurrencyError as U, validateCurrency as V, type JsonValue as W, type FundingReceipt as X, type JobReceipt as Y, type ZodLike as Z, type PaymentRequired as _, type DVMDescriptor as a, isDrainReceipt as a$, type MppxCredential as a0, type Message as a1, type MessageType as a2, type MppxChallenge as a3, X402_BATCH_SETTLEMENT_SCHEME as a4, X402_EXACT_SCHEME as a5, type ReceiptCredit as a6, type X402Wallet as a7, type ResourceInfo as a8, type BuildPaymentRequirementsOpts as a9, type UnsignedFundingReceipt as aA, type UnsignedJobReceipt as aB, type VerifyResponse as aC, type WorkingContent as aD, type X402Config$1 as aE, type X402ResponseBody as aF, type X402SelfRelayRpcFailureReason as aG, X402_DEFAULT_NETWORK as aH, X402_V1_VERSION as aI, X402_VERSION as aJ, buildPaymentRequiredV2 as aK, buildPaymentRequirements as aL, caip2ToX402Network as aM, canonicalRequestPath as aN, canonicaliseForSigning as aO, canonicalize as aP, chainIdFromCaip2 as aQ, computeResultHash as aR, decodePayment as aS, decodePaymentRequiredHeader as aT, encodePayment as aU, encodePaymentRequiredHeader as aV, encodeSettleResponseHeader as aW, exactEvmAuthorization as aX, isArtifactMessage as aY, isCancelMessage as aZ, isCompleteMessage as a_, type CapabilityDescriptor as aa, type CashuMode as ab, type CompleteContent as ac, type DrainReceipt as ad, type DrainReceiptEvent as ae, type ExactEvmPayload as af, type ExactEvmPayloadAuthorization as ag, type FundingMethod as ah, type MessageFrom as ai, type PaymentPayload as aj, type PaymentPayloadV1 as ak, type PaymentPayloadV2 as al, type PaymentRequestContent as am, type PaymentRequiredV2 as an, type PaymentRequirements as ao, type PaymentRequirementsV1 as ap, type PaymentRequirementsV2 as aq, type PromptContent as ar, RAIL_REFUNDABLE as as, type ReceiptOutcome as at, type ReceiptPayment as au, type SettleResponse as av, StepCache as aw, type StepRecord as ax, type TextContent as ay, type UnsignedDrainReceipt as az, type ArtifactContent as b, type DrawRecord as b$, isFundingReceipt as b0, isPaymentRequestMessage as b1, isPromptMessage as b2, isSignedJobReceipt as b3, isTextMessage as b4, isWorkingMessage as b5, paymentRequiredV2FromV1 as b6, signDrainReceipt as b7, signFundingReceipt as b8, signReceipt as b9, _testing as bA, createDefaultReplayStore as bB, depleteLots as bC, fifoOrder as bD, inKindDrawMsats as bE, isInKindDepletion as bF, isNonChannelBitcoinRail as bG, lotOwedSats as bH, netOwedSats as bI, wrapMppx as bJ, type CreditDrainEnqueue as bK, HostedSettlementReportObligations as bL, type DVMAuthScheme as bM, type CreditLedgerLike as bN, type X402RefundSettlementGate as bO, type CreditSnapshot as bP, type DrawResult as bQ, type X402SettlementStatus as bR, type X402UnresolvedRefund as bS, type GrownDrawResult as bT, type DrawResolution as bU, type FundingRecord as bV, type CreditInvoiceRecord as bW, type InvoiceSettlement as bX, type BlockedInvoiceCursor as bY, type InvoiceReconciliation as bZ, type InvoiceWriteOff as b_, usdcContractByCaip2 as ba, usdcContractFor as bb, usdcDomainNameFor as bc, usdcDomainVersionFor as bd, verifyDrainReceipt as be, verifyFundingReceipt as bf, verifyReceipt as bg, x402NetworkToCaip2 as bh, type X402ExactVersionSupport as bi, type X402Receipt as bj, type TransactionalPayoutHook as bk, type CashuMeltCompleted as bl, type CreditDepositPayload as bm, type CreditDrainPayload as bn, type FundingLot as bo, type LotDebit as bp, type LotDepletion as bq, type MppxServer as br, NON_CHANNEL_BITCOIN_RAILS as bs, type NonChannelBitcoinRail as bt, PayoutReporter as bu, PostgresTempoSessionStore as bv, RevenueReporter as bw, SIGNED_ENVELOPE_FIELDS as bx, SIGNED_ENVELOPE_TYPES as by, type X402TrackedChannel as bz, type CancelContent as c, type X402BatchSettlementConfig as c$, type StalePendingDrawCursor as c0, type TempoCreditLossEvidence as c1, type CreditLedgerQuerier as c2, type TempoCreditLoss as c3, type X402CreditLossEvidence as c4, type X402CreditLoss as c5, type DrainMethod as c6, type DrainRequestResult as c7, type BitcoinDepositLiability as c8, type CreditDrainRecord as c9, type JobTerminalReportPayload as cA, PostgresX402ChannelStorage as cB, type ReplayStoreBackend as cC, type RevenueSkippedNoRailPayload as cD, type RevenueSkippedNoRailReason as cE, type Secp256k1AuthOpts as cF, type X402ChannelStorageOpts as cG, type X402RelayLockHolder as cH, type X402RelaySubmissionLock as cI, X402RelaySubmissionLockError as cJ, allocateDrawValue as cK, clientCompatibilityAttributes as cL, clientCompatibilityMiddleware as cM, clientUpgradeRequired as cN, parseClientCapabilities as cO, parseClientCompatibility as cP, parseDvmClient as cQ, parseProtocolVersion as cR, requireClientCompatibility as cS, secp256k1Auth as cT, signedRequestInput as cU, type HostedIntent as cV, type X402SettlementIntent as cW, type HostedFundingReservation as cX, type X402SettlementCursor as cY, type X402SettlementWriteOff as cZ, type X402FacilitatorAuth as c_, type ChannelDrainCursor as ca, type DrainWriteOff as cb, type DrainReleaseResult as cc, type DrainFulfilment as cd, type DrainTransitionResult as ce, HostingCleanupFence as cf, CLIENT_COMPATIBILITY_HEADERS as cg, type ClientCompatibility as ch, type ClientCompatibilityEnv as ci, type ClientCompatibilityGate as cj, type ClientCompatibilityRequirement as ck, type ClientSemVer as cl, type CreditFundingBasis as cm, type CreditInvoiceStatus as cn, CreditLedger as co, CreditLedgerError as cp, type CreditLedgerErrorCode as cq, type CreditLedgerErrorDetails as cr, type CreditLedgerPool as cs, type CreditStatus as ct, DRAIN_DELIVERY_RESERVE_SATS as cu, DVM_PROTOCOL_VERSION as cv, type DrainConflictReason as cw, type DrawRailValue as cx, type DrawStatus as cy, type JobCostReportPayload as cz, type CanonicalEnvelope as d, type X402PayoutObserver as d0, type CreditDepositEnqueue as d1, type X402SettlementReconciliationReason as d2, type CreditDrawReleaseEnqueue as d3, type CreateSignedRequestVerifierOpts as e, type CreditConfig as f, type CreditView as g, DEFAULT_CREDIT_MAX as h, DEFAULT_CREDIT_MIN as i, DEFAULT_CREDIT_TTL_SECONDS as j, DEFAULT_JOB_RETENTION_DAYS as k, type DVMRouteContext as l, type InputType as m, InvalidCurrencyError as n, type PaymentMethod as o, type PriceValue as p, type ProgressContent as q, type PromptOpts as r, type QuoteContext as s, type QuoteResult as t, type ResponseContent as u, type SDKPaymentRequestOpts as v, SIGNED_REQUEST_AUTH_ID as w, SIGNED_REQUEST_STATEMENT_VERSION as x, type SignedRequestAudience as y, type SignedRequestDomain as z };