@dvmkit/sdk 0.5.0-rc.1 → 0.7.0-rc.1

package/dist/internal/caller.js

@@ -8,6 +8,7 @@ import {
   assertTempoSessionVoucherWithinAsk,
   assertTempoWalletIdle,
   clearPendingTempoChargeFunding,
+  createTempoChannelStore,
   createTempoCloseCredential,
   createTempoCreditSession,
   createTempoSessionPaymentFetch,
@@ -22,6 +23,7 @@ import {
   loadIdentities,
   loadResumableTempoChargeFunding,
   loadTempoChannelAssociation,
+  loadTempoChannelAssociationByKey,
   loadTempoChannelController,
   loadTempoChannelEntry,
   nwcRejectionDisplay,
@@ -35,12 +37,15 @@ import {
   reconcileTempoChannelOnChain,
   recordPendingTempoChargeFunding,
   resolveSigningIdentity,
+  retireTempoChannel,
+  retireTempoChannelScope,
   rpcEndpointLine,
   rpcEndpointSuffix,
   saveIdentities,
   shellQuoteArg,
   tempoChannelControlledBy,
   tempoChargeCredentialSettleable,
+  tempoDescriptorController,
   tempoKeyImportRoutes,
   tempoSessionAssociationByKey,
   tempoSessionChallenge,
@@ -55,7 +60,7 @@ import {
   withIdentitiesLock,
   withTempoChannelLock,
   withholdsTempoCreditSession
-} from "../chunk-UOCZXO2Z.js";
+} from "../chunk-JEVLNAO3.js";
 import {
   TEMPO_CHAIN_ID,
   TEMPO_MODERATO_CHAIN_ID,
@@ -71,13 +76,14 @@ import {
   tempoTokenReference,
   tempoWrongAssetHint,
   tryResolveTempoAsset
-} from "../chunk-GFY5FRX3.js";
+} from "../chunk-SZVXOQ75.js";
 import {
   DvmX402ChannelStorage,
   X402_EXACT_AUTHORIZATION_TTL_SECONDS,
   X402_PENDING_STALE_MS,
   X402_REFUSAL_TRANSACTION_DISCOVERY_WINDOW_MS,
   acknowledgeX402ChannelOwner,
+  assertNoRivalX402Voucher,
   clearPendingX402ExactFunding,
   clearPendingX402Funding,
   connectedX402Payer,
@@ -121,8 +127,9 @@ import {
   x402PendingRetired,
   x402PendingStale,
   x402PendingUnsettled,
+  x402VoucherPendingState,
   x402WrongAssetHint
-} from "../chunk-LE74UEV7.js";
+} from "../chunk-EZXAJ6EI.js";
 import {
   RAIL_FLAGS,
   SUPPORTED_PROTOCOL_VERSION,
@@ -164,7 +171,7 @@ import {
   recordRefusedDrawBalance,
   settleDrainEvidence,
   withinAdvertisedTolerance
-} from "../chunk-B2IROPQF.js";
+} from "../chunk-O2OTZ5GP.js";
 import {
   CREDIT_POSTURES,
   FEEDBACK_POSTURES,
@@ -181,11 +188,13 @@ import {
   previewConfigRollback,
   retireConfigBackup,
   rollbackConfig,
-  updateConfig
-} from "../chunk-MZRJR2CW.js";
+  tempoAccountFromConfig,
+  updateConfig,
+  x402WalletFromConfig
+} from "../chunk-WBOKPC37.js";
 import {
   CAPABILITY_NAME_RE
-} from "../chunk-TZ2WKCDD.js";
+} from "../chunk-HCLVYZUZ.js";
 import {
   DbTransport,
   NwcBackend,
@@ -210,7 +219,7 @@ import {
   sha256hex,
   validateX402Env,
   withNwcPool
-} from "../chunk-FI4CST2D.js";
+} from "../chunk-FWGWLPXF.js";
 import {
   MemoryKVStore
 } from "../chunk-SDK6KDJN.js";
@@ -256,6 +265,7 @@ import {
   isX402SettlementReconciliationReason,
   loadAgentWallet,
   loadIdentitySecret,
+  loadWalletConfiguredMints,
   looksLikeMnemonic,
   meltAmountBounds,
   mnemonicFingerprint,
@@ -280,31 +290,7 @@ import {
   withWalletLock,
   writeAgentMnemonic,
   writeIdentity
-} from "../chunk-TUA7PYH7.js";
-import {
-  X402_BATCH_SETTLEMENT_SCHEME,
-  X402_DEFAULT_FACILITATOR,
-  X402_DEFAULT_NETWORK,
-  X402_EXACT_SCHEME,
-  X402_V1_VERSION,
-  X402_VERSION,
-  buildPaymentRequiredV2,
-  buildPaymentRequirements,
-  caip2ToX402Network,
-  chainIdFromCaip2,
-  decodePayment,
-  decodePaymentRequiredHeader,
-  encodePayment,
-  encodePaymentRequiredHeader,
-  encodeSettleResponseHeader,
-  exactEvmAuthorization,
-  paymentRequiredV2FromV1,
-  usdcContractByCaip2,
-  usdcContractFor,
-  usdcDomainNameFor,
-  usdcDomainVersionFor,
-  x402NetworkToCaip2
-} from "../chunk-IWQHUSMO.js";
+} from "../chunk-KMED3H3A.js";
 import {
   COINGECKO_SIMPLE_PRICE_URL,
   assertValidBudget,
@@ -324,7 +310,9 @@ import {
   isDrainReceipt,
   isFundingReceipt,
   isSignedJobReceipt,
+  microToSats,
   monetaryJson,
+  msatsToMicro,
   msatsToUsd,
   msatsToUsdCents,
   msatsToUsdc,
@@ -337,7 +325,7 @@ import {
   verifyDrainReceipt,
   verifyFundingReceipt,
   verifyReceipt
-} from "../chunk-PAIM66YA.js";
+} from "../chunk-NFMOPYBA.js";
 import {
   AGENT_MNEMONIC_FILE,
   BTC_RATE_FILE,
@@ -359,13 +347,35 @@ import {
   REQUEST_INTENTS_DIR,
   TEMPO_CHANNELS_FILE,
   WALLET_FILE,
+  X402_BATCH_SETTLEMENT_SCHEME,
   X402_CHANNELS_FILE,
+  X402_DEFAULT_FACILITATOR,
+  X402_DEFAULT_NETWORK,
+  X402_EXACT_SCHEME,
+  X402_V1_VERSION,
+  X402_VERSION,
+  buildPaymentRequiredV2,
+  buildPaymentRequirements,
+  caip2ToX402Network,
+  chainIdFromCaip2,
+  decodePayment,
+  decodePaymentRequiredHeader,
+  encodePayment,
+  encodePaymentRequiredHeader,
+  encodeSettleResponseHeader,
   ensureConfigDir,
   ensureConfigSubdir,
+  exactEvmAuthorization,
+  paymentRequiredV2FromV1,
   repairConfigDirMode,
   resolveRpcHttpTransportOptions,
-  resolveRpcOverride
-} from "../chunk-CZULM42S.js";
+  resolveRpcOverride,
+  usdcContractByCaip2,
+  usdcContractFor,
+  usdcDomainNameFor,
+  usdcDomainVersionFor,
+  x402NetworkToCaip2
+} from "../chunk-CXCQLOOK.js";
 import {
   RAIL_REFUNDABLE,
   SIGNED_REQUEST_AUTH_ID,
@@ -373,14 +383,13 @@ import {
   canonicalSignedRequestStatement,
   signedRequestStatementHeader,
   testOnlySignedRequestDomain
-} from "../chunk-A4YFWZ7R.js";
+} from "../chunk-RCM3P2HE.js";
 import {
   canonicaliseForSigning,
   canonicalize,
   verifyCanonicalSignedRequest
 } from "../chunk-OFVV37XC.js";
 import {
-  StepCache,
   createNoopLogger,
   createStdoutLogger,
   currentContext,
@@ -390,12 +399,15 @@ import {
   randomTraceId,
   setEmitter,
   withTraceContext
-} from "../chunk-6DOGTAHA.js";
+} from "../chunk-QR2EF2NI.js";
 import "../chunk-66HGCPBU.js";
 import {
   redactUrl,
   redactUrlsInText
 } from "../chunk-FUJ36YDV.js";
+import {
+  StepCache
+} from "../chunk-BQJIFRAZ.js";
 import {
   FX_CACHE_TTL_MS,
   FX_RETRY_COUNT,
@@ -410,20 +422,18 @@ import {
   withInitRetry
 } from "../chunk-P6QON7ER.js";
 import {
+  DvmError,
   X402_NETWORKS,
   assertSupportedX402Network,
+  isAbortError,
+  providerProseSources,
+  transportErrorCode,
   x402NetworkByCaip2,
   x402NetworkBySlug,
   x402NetworkLabel,
   x402NetworkListForCopy,
   x402SupportedNetworksHint
-} from "../chunk-RLTSCKRI.js";
-import {
-  DvmError,
-  isAbortError,
-  providerProseSources,
-  transportErrorCode
-} from "../chunk-LIRAHP7B.js";
+} from "../chunk-BPYMEMQX.js";
 import {
   DIAGNOSTIC_CATALOGUE_VERSION,
   bindDiagnosticCapabilityAuthority,
@@ -435,40 +445,9 @@ import {
   projectSpanRow
 } from "../chunk-ETXDTUJO.js";
 
-// src/lib/budget-ledger.ts
-import { existsSync, readFileSync, renameSync, writeFileSync } from "fs";
-function loadLedger() {
-  if (!existsSync(BUDGET_FILE)) return { caps: {}, entries: [] };
-  try {
-    const data = JSON.parse(readFileSync(BUDGET_FILE, "utf-8"));
-    return { caps: data.caps ?? {}, entries: data.entries ?? [] };
-  } catch {
-    return { caps: {}, entries: [] };
-  }
-}
-function saveLedger(ledger, _now = /* @__PURE__ */ new Date()) {
-  ensureConfigDir();
-  const tmp = `${BUDGET_FILE}.tmp`;
-  writeFileSync(tmp, JSON.stringify(ledger, null, 2) + "\n");
-  renameSync(tmp, BUDGET_FILE);
-}
-function recordSpend(opts) {
-  appendSpend(loadLedger(), opts);
-}
-function recordSpendOnce(opts) {
-  const ledger = loadLedger();
-  const kind = opts.kind ?? "job";
-  if (ledger.entries.some(
-    (entry) => entryKind(entry) === kind && entry.jobId === opts.jobId && entry.providerEndpoint === opts.providerEndpoint
-  )) {
-    return false;
-  }
-  appendSpend(ledger, opts);
-  return true;
-}
-function checkBudget(opts) {
+// src/lib/budget-core.ts
+function checkBudgetForLedger(ledger, opts) {
   const now = opts.now ?? /* @__PURE__ */ new Date();
-  const ledger = loadLedger();
   const plannedUsd = msatsToUsd(opts.plannedMsats, opts.btcRate);
   const windows = ["daily", "weekly", "monthly"];
   for (const window of windows) {
@@ -489,62 +468,6 @@ function checkBudget(opts) {
   }
   return { ok: true };
 }
-async function enforceGlobalBudget(opts) {
-  const ledger = loadLedger();
-  const hasCaps = ledger.caps.dailyUsd !== void 0 || ledger.caps.weeklyUsd !== void 0 || ledger.caps.monthlyUsd !== void 0;
-  if (!hasCaps) {
-    if (opts.btcRate !== void 0 && opts.btcRate > 0) return opts.btcRate;
-    try {
-      return (await resolveBtcUsdRate("payment")).rate;
-    } catch {
-      return 0;
-    }
-  }
-  const rate = opts.btcRate && opts.btcRate > 0 ? opts.btcRate : (await resolveBtcUsdRate("payment")).rate;
-  const check = checkBudget({ plannedMsats: opts.plannedMsats, btcRate: rate });
-  if (!check.ok) {
-    const windowName = check.window.charAt(0).toUpperCase() + check.window.slice(1);
-    const suffix = check.window === "daily" ? "day" : check.window === "weekly" ? "week" : "month";
-    const suggestedCap = Math.max(1, Math.ceil(check.limitUsd * 2));
-    throw new DvmError(
-      "budget_exceeded",
-      `${windowName} budget would be exceeded by this payment.`,
-      `${windowName} budget exhausted. The window resets at ${new Date(check.resetsAt).toISOString()}. Ask the user if they'd like to raise the cap (e.g. 'dvm budget set --${check.window} "$${suggestedCap}"' \u2014 substitute any USD amount).`,
-      {
-        window: check.window,
-        spent: {
-          display: `$${formatUsd(check.spentUsd)}`,
-          // the cap counts both what the agent paid DVMs and what it
-          // moved out of the Lightning float, so name the split rather than
-          // leaving the user to wonder why the number is higher than their jobs.
-          jobs: `$${formatUsd(check.breakdown.jobsUsd)}`,
-          float_fundings: `$${formatUsd(check.breakdown.floatFundingsUsd)}`,
-          credit_fundings: `$${formatUsd(check.breakdown.creditFundingsUsd)}`
-        },
-        limit: { display: `$${formatUsd(check.limitUsd)}/${suffix}` },
-        resets_at: new Date(check.resetsAt).toISOString()
-      }
-    );
-  }
-  return rate;
-}
-function statusSnapshot(now = /* @__PURE__ */ new Date()) {
-  const ledger = loadLedger();
-  const windows = ["daily", "weekly", "monthly"];
-  return {
-    caps: ledger.caps,
-    windows: windows.map((window) => {
-      const breakdown = breakdownSince(ledger.entries, windowStart(window, now).getTime());
-      return {
-        window,
-        spentUsd: breakdown.totalUsd,
-        limitUsd: capFor(ledger.caps, window),
-        resetsAt: windowEnd(window, now).getTime(),
-        breakdown
-      };
-    })
-  };
-}
 function entryKind(entry) {
   return entry.kind ?? "job";
 }
@@ -569,7 +492,7 @@ function windowEnd(window, now) {
   }
   return new Date(Date.UTC(start.getUTCFullYear(), start.getUTCMonth() + 1, 1));
 }
-function appendSpend(ledger, opts) {
+function spendEntry(opts) {
   const usd = msatsToUsd(opts.msats, opts.btcRate);
   const entry = {
     timestamp: (opts.now ?? /* @__PURE__ */ new Date()).getTime(),
@@ -589,8 +512,7 @@ function appendSpend(ledger, opts) {
   if (opts.walletDebitMsats !== void 0) entry.walletDebitMsats = opts.walletDebitMsats;
   if (opts.label !== void 0) entry.label = opts.label;
   if (opts.labelSource !== void 0) entry.labelSource = opts.labelSource;
-  ledger.entries.push(entry);
-  saveLedger(ledger);
+  return entry;
 }
 function capFor(caps, window) {
   if (window === "daily") return caps.dailyUsd;
@@ -615,6 +537,110 @@ function breakdownSince(entries, sinceMs) {
   return out;
 }
 
+// src/lib/budget-store.ts
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";
+import { dirname } from "path";
+function loadBudgetLedger(file) {
+  if (!existsSync(file)) return { caps: {}, entries: [] };
+  try {
+    const data = JSON.parse(readFileSync(file, "utf-8"));
+    return { caps: data.caps ?? {}, entries: data.entries ?? [] };
+  } catch {
+    return { caps: {}, entries: [] };
+  }
+}
+function saveBudgetLedger(file, ledger) {
+  mkdirSync(dirname(file), { recursive: true, mode: 448 });
+  const tmp = `${file}.tmp`;
+  writeFileSync(tmp, JSON.stringify(ledger, null, 2) + "\n");
+  renameSync(tmp, file);
+}
+function appendBudgetSpend(file, opts, once = false) {
+  const ledger = loadBudgetLedger(file);
+  const kind = opts.kind ?? "job";
+  if (once && ledger.entries.some(
+    (entry) => entryKind(entry) === kind && entry.jobId === opts.jobId && entry.providerEndpoint === opts.providerEndpoint
+  )) {
+    return false;
+  }
+  ledger.entries.push(spendEntry(opts));
+  saveBudgetLedger(file, ledger);
+  return true;
+}
+
+// src/lib/budget-ledger.ts
+function loadLedger() {
+  return loadBudgetLedger(BUDGET_FILE);
+}
+function saveLedger(ledger, _now = /* @__PURE__ */ new Date()) {
+  saveBudgetLedger(BUDGET_FILE, ledger);
+}
+function recordSpend(opts) {
+  appendBudgetSpend(BUDGET_FILE, opts);
+}
+function recordSpendOnce(opts) {
+  return appendBudgetSpend(BUDGET_FILE, opts, true);
+}
+function checkBudget(opts) {
+  return checkBudgetForLedger(loadLedger(), opts);
+}
+async function enforceGlobalBudget(opts) {
+  const ledger = loadLedger();
+  const hasCaps = ledger.caps.dailyUsd !== void 0 || ledger.caps.weeklyUsd !== void 0 || ledger.caps.monthlyUsd !== void 0;
+  if (!hasCaps) {
+    if (opts.btcRate !== void 0 && opts.btcRate > 0) return opts.btcRate;
+    try {
+      return (await resolveBtcUsdRate("payment")).rate;
+    } catch {
+      return 0;
+    }
+  }
+  const rate = opts.btcRate && opts.btcRate > 0 ? opts.btcRate : (await resolveBtcUsdRate("payment")).rate;
+  const check = checkBudget({ plannedMsats: opts.plannedMsats, btcRate: rate });
+  if (!check.ok) {
+    const windowName = check.window.charAt(0).toUpperCase() + check.window.slice(1);
+    const suffix = check.window === "daily" ? "day" : check.window === "weekly" ? "week" : "month";
+    const suggestedCap = Math.max(1, Math.ceil(check.limitUsd * 2));
+    throw new DvmError(
+      "budget_exceeded",
+      `${windowName} budget would be exceeded by this payment.`,
+      `${windowName} budget exhausted. The window resets at ${new Date(check.resetsAt).toISOString()}. Ask the user if they'd like to raise the cap (e.g. 'dvm budget set --${check.window} "$${suggestedCap}"' \u2014 substitute any USD amount).`,
+      {
+        window: check.window,
+        spent: {
+          display: `$${formatUsd(check.spentUsd)}`,
+          // the cap counts both what the agent paid DVMs and what it
+          // moved out of the Lightning float, so name the split rather than
+          // leaving the user to wonder why the number is higher than their jobs.
+          jobs: `$${formatUsd(check.breakdown.jobsUsd)}`,
+          float_fundings: `$${formatUsd(check.breakdown.floatFundingsUsd)}`,
+          credit_fundings: `$${formatUsd(check.breakdown.creditFundingsUsd)}`
+        },
+        limit: { display: `$${formatUsd(check.limitUsd)}/${suffix}` },
+        resets_at: new Date(check.resetsAt).toISOString()
+      }
+    );
+  }
+  return rate;
+}
+function statusSnapshot(now = /* @__PURE__ */ new Date()) {
+  const ledger = loadLedger();
+  const windows = ["daily", "weekly", "monthly"];
+  return {
+    caps: ledger.caps,
+    windows: windows.map((window) => {
+      const breakdown = breakdownSince(ledger.entries, windowStart(window, now).getTime());
+      return {
+        window,
+        spentUsd: breakdown.totalUsd,
+        limitUsd: capFor(ledger.caps, window),
+        resetsAt: windowEnd(window, now).getTime(),
+        breakdown
+      };
+    })
+  };
+}
+
 // src/lib/cashu/builder-subkey.ts
 import { createHash } from "crypto";
 import { HDKey } from "@scure/bip32";
@@ -779,7 +805,7 @@ function randomNonce() {
 }
 
 // src/lib/credit-fund.ts
-import { createHash as createHash4, randomUUID as randomUUID3 } from "crypto";
+import { createHash as createHash4, randomUUID as randomUUID2 } from "crypto";
 import { Challenge, Credential } from "mppx";
 import { privateKeyToAccount as privateKeyToAccount2 } from "viem/accounts";
 
@@ -3298,716 +3324,293 @@ function deriveAgentRefundSubkeyPubkey(mnemonic, canonicalDvmId) {
   return deriveAgentRefundSubkey(mnemonic, canonicalDvmId).pubkey;
 }
 
-// src/lib/credit-policy.ts
-import { randomUUID } from "crypto";
-
-// src/lib/x402/menu.ts
-function offersX402CreditFunding(menu, network) {
-  return matchesNetwork(x402CreditFundingNetworks(menu), network);
-}
-function offersX402CreditChannel(menu, network) {
-  return matchesNetwork(x402CreditChannelNetworks(menu), network);
+// src/lib/credit-funding-contracts.ts
+var CREDIT_FUND_RAILS = ["cashu", "lightning", "x402", "tempo"];
+var CREDIT_DRAIN_RAILS = ["cashu", "x402", "tempo"];
+function isCreditFundRail(value) {
+  return typeof value === "string" && CREDIT_FUND_RAILS.includes(value);
 }
-function x402CreditFlavour(menu, network) {
-  if (offersX402CreditChannel(menu, network)) return X402_BATCH_SETTLEMENT_SCHEME;
-  if (matchesNetwork(x402CreditExactNetworks(menu), network)) return X402_EXACT_SCHEME;
-  return void 0;
+var STABLECOIN_FUND_RAILS = ["x402", "tempo"];
+function isStablecoinFundRail(rail) {
+  return STABLECOIN_FUND_RAILS.includes(rail);
 }
-function offersX402CreditFlavour(menu, network, flavour) {
-  return matchesNetwork(
-    flavour === X402_BATCH_SETTLEMENT_SCHEME ? x402CreditChannelNetworks(menu) : x402CreditExactNetworks(menu),
-    network
-  );
+var CREDIT_FUNDING_MODES = ["one-shot", "reusable"];
+function isCreditFundingMode(value) {
+  return typeof value === "string" && CREDIT_FUNDING_MODES.includes(value);
 }
-function x402InstrumentForFlavour(flavour) {
-  return flavour === X402_BATCH_SETTLEMENT_SCHEME ? "x402_channel" : "x402_exact";
+function fundingModeForTempoIntent(intent) {
+  return intent === "session" ? "reusable" : "one-shot";
 }
-function x402FlavourForInstrument(instrument) {
-  if (instrument === "x402_channel") return X402_BATCH_SETTLEMENT_SCHEME;
-  if (instrument === "x402_exact") return X402_EXACT_SCHEME;
-  return void 0;
+function fundingModeForX402Flavour(flavour) {
+  return flavour === X402_BATCH_SETTLEMENT_SCHEME ? "reusable" : "one-shot";
 }
-function x402CreditChannelNetworks(menu) {
-  return schemeNetworks(menu, X402_BATCH_SETTLEMENT_SCHEME);
+function fundWireAmountMicro(priceMicroServer, fundMsats, requiredMsats) {
+  if (fundMsats === requiredMsats) return priceMicroServer;
+  return Math.round(priceMicroServer * fundMsats / requiredMsats);
 }
-function x402CreditExactNetworks(menu) {
-  return schemeNetworks(menu, X402_EXACT_SCHEME);
+function readFundValuation(fields) {
+  const structured = usableMicro(fields.expectedMicro);
+  if (structured !== void 0) return { kind: "figure", micro: structured };
+  const match = /quoted price \((\d+)\)/.exec(fields.message ?? "");
+  const stated = match ? usableMicro(Number(match[1])) : void 0;
+  if (stated !== void 0) return { kind: "figure", micro: stated };
+  const providerStatedSomething = fields.expectedMicro !== void 0 || match !== null;
+  return providerStatedSomething ? { kind: "malformed" } : { kind: "absent" };
 }
-function x402CreditFundingNetworks(menu) {
-  return [.../* @__PURE__ */ new Set([...x402CreditChannelNetworks(menu), ...x402CreditExactNetworks(menu)])];
+function usableMicro(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : void 0;
 }
-function schemeNetworks(menu, scheme) {
-  return (menu?.x402?.schemes ?? []).filter((entry) => entry.scheme === scheme).map((entry) => entry.network);
+
+// src/lib/router-feedback-claim.ts
+import { createHmac, timingSafeEqual } from "crypto";
+var ROUTER_FEEDBACK_CLAIM_HEADER = "x-dvmkit-router-feedback-claim";
+var ROUTER_FEEDBACK_CLAIM_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
+function normalizeFeedbackEndpointHost(endpointOrHost) {
+  try {
+    const url = new URL(
+      endpointOrHost.includes("://") ? endpointOrHost : `https://${endpointOrHost}`
+    );
+    return url.host === "" ? null : url.host.toLowerCase();
+  } catch {
+    return null;
+  }
 }
-function matchesNetwork(networks, network) {
-  return networks.some((candidate) => network === void 0 || candidate === network);
+function issueRouterFeedbackClaim(secret, attribution, now = Date.now()) {
+  const body = {
+    v: 2,
+    dvm_id: attribution.dvmId,
+    job_id: attribution.jobId,
+    endpoint_host: attribution.endpointHost,
+    exp: now + ROUTER_FEEDBACK_CLAIM_TTL_MS
+  };
+  const encoded = Buffer.from(JSON.stringify(body), "utf8").toString("base64url");
+  const signature = createHmac("sha256", secret).update(encoded).digest("base64url");
+  return `${encoded}.${signature}`;
+}
+function verifyRouterFeedbackClaim(secret, token, now = Date.now()) {
+  const dot = token.indexOf(".");
+  if (dot <= 0 || dot === token.length - 1) return null;
+  const encoded = token.slice(0, dot);
+  const presentedSignature = token.slice(dot + 1);
+  const expectedSignature = createHmac("sha256", secret).update(encoded).digest("base64url");
+  if (!safeEqual(expectedSignature, presentedSignature)) return null;
+  let body;
+  try {
+    body = JSON.parse(
+      Buffer.from(encoded, "base64url").toString("utf8")
+    );
+  } catch {
+    return null;
+  }
+  if (body.v !== 2 || typeof body.dvm_id !== "string" || body.dvm_id.length === 0 || typeof body.job_id !== "string" || body.job_id.length === 0 || typeof body.endpoint_host !== "string" || body.endpoint_host.length === 0 || typeof body.exp !== "number" || !Number.isFinite(body.exp) || body.exp <= now) {
+    return null;
+  }
+  return {
+    dvmId: body.dvm_id,
+    jobId: body.job_id,
+    endpointHost: body.endpoint_host,
+    expiresAt: body.exp
+  };
+}
+function safeEqual(expected, presented) {
+  const expectedBuffer = Buffer.from(expected);
+  const presentedBuffer = Buffer.from(presented);
+  return expectedBuffer.length === presentedBuffer.length && timingSafeEqual(expectedBuffer, presentedBuffer);
 }
 
-// src/lib/credit-policy.ts
-var TIER0_CAP_MICRO = 5e5;
-var TIER1_CAP_MICRO = 2e6;
-var TIER1_MIN_RECEIPTS = 3;
-var TIER2_MIN_RECEIPTS = 15;
-var TIER2_MIN_SPAN_MS = 7 * 24 * 60 * 60 * 1e3;
-var OPEN_TARGET_JOBS = 20;
-var CASHU_REFILL_TARGET_JOBS = 40;
-var TOPUP_THRESHOLD_FRACTION = 0.25;
-var DEFAULT_CREDIT_POSTURE = "suggest";
-var POCKET_TARGET_MICRO = 5e6;
-function trustTierFor(args) {
-  const ladder = trustLadderFor(args);
-  return { tier: ladder.tier, capMicro: ladder.capMicro ?? args.menu.max_micro };
+// src/lib/wallet-agent/spend.ts
+import {
+  getEncodedToken,
+  MintOperationError
+} from "@cashu/cashu-ts";
+import { randomUUID } from "crypto";
+
+// src/lib/wallet-agent/select.ts
+function selectProofsForSpend(args) {
+  if (args.amountSats <= 0) {
+    return {
+      error: {
+        code: "insufficient_balance",
+        message: `amountSats must be positive; got ${args.amountSats}.`,
+        hint: "Pass a positive sat amount."
+      }
+    };
+  }
+  if (args.mintAllowlist.length === 0) {
+    return { error: noAcceptedMintsError() };
+  }
+  const reserveSats = args.swapReserveSats ?? (() => 0);
+  let largestEligibleBalance = 0;
+  for (const mint of args.mintAllowlist) {
+    const candidates = eligibleProofsAt(args.proofs, mint);
+    const balance = candidates.reduce((sum, p) => sum + p.amount, 0);
+    largestEligibleBalance = Math.max(largestEligibleBalance, balance);
+    if (balance < args.amountSats) continue;
+    const selected = [];
+    let total = 0;
+    for (const p of candidates) {
+      selected.push(p);
+      total += p.amount;
+      const required = args.amountSats + reserveSats(selected);
+      if (total >= required) {
+        return { selected, mint, totalSats: total };
+      }
+    }
+  }
+  return { error: noCoverError(largestEligibleBalance, args.amountSats) };
 }
-function trustLadderFor(args) {
-  const successes = completedReceiptsFor(
-    args.receipts,
-    args.endpoint,
-    args.signingPubkey,
-    args.identity
-  );
-  const tier0Cap = args.tier0CapMicro ?? TIER0_CAP_MICRO;
-  const tier1Cap = args.tier1CapMicro ?? TIER1_CAP_MICRO;
-  const builderMax = args.menu?.max_micro;
-  const issued = successes.map((r) => r.receipt.issued_at * 1e3);
-  const spanMs = issued.length > 1 ? Math.max(...issued) - Math.min(...issued) : 0;
-  const count = successes.length;
-  if (count >= TIER2_MIN_RECEIPTS && spanMs >= TIER2_MIN_SPAN_MS) {
+function coveringMintsForSpend(args) {
+  if (args.amountSats <= 0) {
     return {
-      tier: 2,
-      ...builderMax !== void 0 ? { capMicro: builderMax } : {},
-      receipts: count,
-      spanMs
+      error: {
+        code: "insufficient_balance",
+        message: `amountSats must be positive; got ${args.amountSats}.`,
+        hint: "Pass a positive sat amount."
+      }
     };
   }
-  const toTier2 = {
-    tier: 2,
-    ...builderMax !== void 0 ? { capMicro: builderMax } : {},
-    receiptsNeeded: Math.max(TIER2_MIN_RECEIPTS - count, 0),
-    spanMs: TIER2_MIN_SPAN_MS
-  };
-  if (count >= TIER1_MIN_RECEIPTS) {
-    return { tier: 1, capMicro: tier1Cap, receipts: count, spanMs, next: toTier2 };
+  if (args.mintAllowlist.length === 0) {
+    return { error: noAcceptedMintsError() };
+  }
+  const mints = [];
+  let largestEligibleBalance = 0;
+  for (const mint of args.mintAllowlist) {
+    const balance = eligibleProofsAt(args.proofs, mint).reduce((sum, p) => sum + p.amount, 0);
+    largestEligibleBalance = Math.max(largestEligibleBalance, balance);
+    if (balance >= args.amountSats && !mints.includes(mint)) mints.push(mint);
   }
+  if (mints.length === 0) {
+    return { error: noCoverError(largestEligibleBalance, args.amountSats) };
+  }
+  return { mints };
+}
+function eligibleProofsAt(proofs, mint) {
+  return proofs.filter((p) => p.mint === mint && p.status === "valid" && p.reserved_for === void 0).slice().sort((a, b) => b.amount - a.amount);
+}
+function noAcceptedMintsError() {
   return {
-    tier: 0,
-    capMicro: tier0Cap,
-    receipts: count,
-    spanMs,
-    next: { tier: 1, capMicro: tier1Cap, receiptsNeeded: TIER1_MIN_RECEIPTS - count }
+    code: "no_eligible_mint",
+    message: "DVM advertises no Cashu mints for the agent-wallet path.",
+    hint: "Use a different DVM, or fall back to the legacy --auto-pay flow."
   };
 }
-function effectiveCreditPosture(config, endpoint, identity) {
-  const postures = perDvmEntriesFor(config, endpoint, identity).map(([, per2]) => per2.posture).filter(isCreditPosture);
-  const per = postures.reduce(
-    (strictest, posture) => strictest === void 0 || POSTURE_STRICTNESS[posture] > POSTURE_STRICTNESS[strictest] ? posture : strictest,
-    void 0
-  );
-  if (per !== void 0) return { posture: per, source: "per_dvm" };
-  const global = config?.posture;
-  if (isCreditPosture(global)) return { posture: global, source: "global" };
-  return { posture: DEFAULT_CREDIT_POSTURE, source: "default" };
-}
-function effectiveFundingRail(config, endpoint, identity) {
-  let conflict;
-  if (endpoint !== void 0) {
-    const pinned = perDvmEntriesFor(config, endpoint, identity).flatMap(
-      ([origin, per]) => isCreditFundRail(per.fundingRail) ? [[origin, per.fundingRail]] : []
-    );
-    const rails = [...new Set(pinned.map(([, rail]) => rail))];
-    if (rails.length > 1) conflict = { rails, endpoints: pinned.map(([origin]) => origin) };
-    else if (rails.length === 1) return { rail: rails[0], source: "per_dvm" };
+function noCoverError(largestEligibleBalance, amountSats) {
+  if (largestEligibleBalance === 0) {
+    return {
+      code: "no_eligible_mint",
+      message: "Agent wallet has no proofs at any of the DVM's accepted mints.",
+      hint: "Fund the wallet at one of the DVM's accepted mints with: dvm wallet fund <amount>"
+    };
   }
-  const global = config?.fundingRail;
-  if (isCreditFundRail(global))
-    return { rail: global, source: "global", ...conflict ? { conflict } : {} };
-  return { source: "default", ...conflict ? { conflict } : {} };
+  return {
+    code: "insufficient_balance",
+    message: `Agent wallet has ${largestEligibleBalance} sats at the DVM's mints; need ${amountSats} plus the per-call mint swap fee.`,
+    hint: "Top the wallet up with: dvm wallet fund <amount>"
+  };
 }
-function automaticCreditBoundRail(stored) {
-  if (stored?.status !== "active" || stored.reconciliationPending) return void 0;
-  return isCreditFundRail(stored.rail) ? stored.rail : void 0;
+
+// src/lib/wallet-agent/submission-binding.ts
+import { createHash as createHash2 } from "crypto";
+function cashuSubmissionBindingFingerprint(binding) {
+  return createHash2("sha256").update(canonicaliseForSigning(binding)).digest("hex");
 }
-function trustOverrideCapMicro(args) {
-  const raw2 = args.builderPubkey ? lookupOverride(args.config?.trustOverrides, args.builderPubkey) : void 0;
-  if (!raw2) return void 0;
-  if (raw2.trim().toLowerCase() === "builder-max") {
-    return args.menu?.max_micro ?? Number.POSITIVE_INFINITY;
+function cashuSubmissionBindingFromContext(context) {
+  if (context.strict_per_call !== true || context.route === "credit" || typeof context.dvm_id !== "string" || context.dvm_id.length === 0 || typeof context.capability !== "string" || context.capability.length === 0 || typeof context.pinned_mint !== "string" || context.pinned_mint.length === 0 || !context.policy) {
+    return null;
   }
-  return parseCapMicro(raw2);
-}
-function tierCapOverrides(config) {
-  const out = {};
-  const tier0 = parseCapMicro(config?.tier0Cap);
-  const tier1 = parseCapMicro(config?.tier1Cap);
-  if (tier0 !== void 0) out.tier0CapMicro = tier0;
-  if (tier1 !== void 0) out.tier1CapMicro = tier1;
-  return out;
-}
-function sizeCreditMicro(args) {
-  const target = (args.targetJobs ?? OPEN_TARGET_JOBS) * args.priceMicro;
-  let size = Math.max(args.menu.min_micro, Math.min(target, args.capMicro));
-  const residualCeiling = args.menu.max_micro + args.priceMicro;
-  size = Math.min(size, residualCeiling);
-  return Math.max(size, args.menu.min_micro);
-}
-function refillTargetMicro(args) {
-  const target = (args.targetJobs ?? CASHU_REFILL_TARGET_JOBS) * args.priceMicro;
-  return Math.max(args.menu.min_micro, Math.min(target, args.capMicro, args.menu.max_micro));
+  return {
+    dvmId: context.dvm_id,
+    capability: context.capability,
+    requestBody: context.submit_body,
+    mint: context.pinned_mint,
+    signer: context.signing_pubkey ?? null,
+    policy: context.policy
+  };
 }
-function planCreditForQuote(args) {
-  const none = { mode: "none" };
-  const menu = args.menu;
-  if (!menu || !args.signingPubkey) return none;
-  const posture = effectiveCreditPosture(args.config, args.endpoint, args.identity).posture;
-  if (posture === "off") return none;
-  if (menu.currency.toLowerCase() !== "usd") return none;
-  const canCashu = menu.funding.includes("cashu");
-  const canFloat = menu.funding.includes("lightning") && args.floatConnected === true;
-  const canX402 = menu.funding.includes("x402") && args.x402Connected === true && offersX402CreditFunding(menu, args.x402Network);
-  const canMpp = menu.funding.includes("tempo") && args.tempoConnected === true && offersTempoCreditFunding(menu);
-  if (!canCashu && !canFloat && !canX402 && !canMpp) return none;
-  if (!Number.isFinite(args.priceMsats) || args.priceMsats <= 0) return none;
-  const stored = args.stored;
-  if (stored?.reconciliationPending) return none;
-  const refilling = stored?.status === "active" && stored.currency === menu.currency;
-  const rateUnavailable = !Number.isFinite(args.btcRate) || args.btcRate <= 0;
-  if (!refilling) {
-    const completed = completedReceiptsFor(
-      args.receipts,
-      args.endpoint,
-      args.signingPubkey,
-      args.identity
-    );
-    if (completed.length === 0) return none;
-    const identity = args.identity;
-    if (rateUnavailable && identity && !completed.some((entry) => {
-      const attested = attestedDvmIdentity(entry.builder);
-      return attested?.dvmId === identity.dvmId && attested.builderPubkey === identity.builderPubkey;
-    })) {
-      return none;
-    }
-  }
-  if (rateUnavailable) {
-    return posture === "auto" ? {
-      mode: "none",
-      fundingSkipped: {
-        reason: "btc_rate_unavailable",
-        operation: refilling ? "refill" : "open"
+
+// src/lib/wallet-agent/submission-context.ts
+import { createHash as createHash3 } from "crypto";
+function bindCashuTokenToSubmissionContext(context, cashuToken) {
+  if (!context) return void 0;
+  const commitment = createHash3("sha256").update(cashuToken).digest("hex");
+  if (context.route === "credit") {
+    const fund2 = context.credit_body?.fund;
+    if (!fund2) return context;
+    return {
+      ...context,
+      credit_body: {
+        ...context.credit_body,
+        fund: { ...fund2, commitment }
       }
-    } : none;
+    };
   }
-  const priceMicro = msatsToMicro(args.priceMsats, args.btcRate);
-  if (priceMicro <= 0) return none;
-  const tier = trustTierFor({
-    receipts: args.receipts,
-    endpoint: args.endpoint,
-    signingPubkey: args.signingPubkey,
-    ...args.identity ? { identity: args.identity } : {},
-    menu,
-    ...tierCapOverrides(args.config)
-  });
-  const targetJobs = targetJobsFor(args.config, args.endpoint, args.identity);
-  const pin = effectiveFundingRail(args.config, args.endpoint, args.identity);
-  const eligible = [
-    ...canCashu ? ["cashu"] : [],
-    ...canFloat ? ["lightning"] : [],
-    ...canX402 ? ["x402"] : [],
-    ...canMpp ? ["tempo"] : []
-  ];
-  const routeFor = (fundMicro2, boundRail2) => {
-    const forced = boundRail2 ?? pin.rail;
-    const pick = pickCreditFundRail({
-      rails: eligible,
-      amountMicro: fundMicro2,
-      menu,
-      ...args.x402Network ? { x402Network: args.x402Network } : {},
-      ...forced ? { forced } : {}
-    });
-    const head = forced ?? pick.order[0];
-    return { route: head === "cashu" ? "cashu" : "deferred", reason: pick.reason };
-  };
-  const pinned = pin.rail && pin.source !== "default" ? { rail: pin.rail, source: pin.source } : void 0;
-  const defer = (reason, creditId, fundMicro2, targetMicro2, maxDepositMicro, forced = pinned) => ({
-    mode: "none",
-    deferred: {
-      reason,
-      creditId,
-      fundMicro: fundMicro2,
-      targetMicro: targetMicro2,
-      maxDepositMicro,
-      currency: menu.currency,
-      menu,
-      ...forced ? { pinnedRail: forced.rail, pinnedRailSource: forced.source } : {}
-    }
-  });
-  if (refilling) {
-    const targetMicro2 = refillTargetMicro({
-      menu,
-      priceMicro,
-      capMicro: tier.capMicro,
-      ...targetJobs !== void 0 ? { targetJobs } : {}
-    });
-    const boundRail2 = isCreditFundRail(stored.rail) ? stored.rail : void 0;
-    const forcedRefill = boundRail2 ? { rail: boundRail2, source: "credit_bound" } : pinned;
-    const railFloorMicro = forcedRefill?.rail === "lightning" && menu.lightning_min_micro !== void 0 ? Math.max(menu.min_micro, menu.lightning_min_micro) : menu.min_micro;
-    const fundMicro2 = Math.min(
-      Math.max(railFloorMicro, targetMicro2 - Math.max(stored.remainingMicro, 0) + priceMicro),
-      menu.max_micro
-    );
-    if (posture === "suggest") {
-      return {
-        mode: "none",
-        suppressed: { reason: "refill", fundMicro: fundMicro2, targetMicro: targetMicro2, currency: menu.currency }
-      };
-    }
-    const refillRoute = routeFor(fundMicro2, boundRail2);
-    if (refillRoute.route === "deferred") {
-      return defer("refill", stored.creditId, fundMicro2, targetMicro2, fundMicro2, forcedRefill);
+  const data = context.submit_body.data;
+  const fund = data?.fund;
+  if (!data || !fund) return context;
+  return {
+    ...context,
+    submit_body: {
+      ...context.submit_body,
+      data: { ...data, fund: { ...fund, commitment } }
     }
-    if (!canCashu) return none;
+  };
+}
+
+// src/lib/wallet-agent/spend.ts
+async function prepareAgentSpend(args) {
+  if (args.maxCashuPrincipalSats !== void 0 && (!Number.isSafeInteger(args.maxCashuPrincipalSats) || args.maxCashuPrincipalSats < 0)) {
     return {
-      mode: "topup",
-      creditId: stored.creditId,
-      drawId: randomUUID(),
-      ...fundAmounts(fundMicro2, args.btcRate),
-      currency: menu.currency,
-      targetMicro: targetMicro2,
-      railReason: refillRoute.reason
+      error: {
+        code: "invalid_max_cashu_principal",
+        message: "The Cashu principal limit must be an exact non-negative integer number of sats.",
+        hint: "Pass --max-cashu-principal-sats with a value such as 20 or 100."
+      }
     };
   }
-  const fundMicro = sizeCreditMicro({
-    menu,
-    priceMicro,
-    capMicro: tier.capMicro,
-    ...targetJobs !== void 0 ? { targetJobs: Math.min(targetJobs, OPEN_TARGET_JOBS) } : {}
-  });
-  const targetMicro = refillTargetMicro({
-    menu,
-    priceMicro,
-    capMicro: tier.capMicro,
-    ...targetJobs !== void 0 ? { targetJobs } : {}
-  });
-  if (posture === "suggest") {
+  if (args.maxCashuPrincipalSats !== void 0 && args.amountSats > args.maxCashuPrincipalSats) {
+    return principalCapFailure(args.amountSats, args.maxCashuPrincipalSats);
+  }
+  if (args.maxCashuFeeSats !== void 0 && (!Number.isSafeInteger(args.maxCashuFeeSats) || args.maxCashuFeeSats < 0)) {
     return {
-      mode: "none",
-      suppressed: { reason: "open", fundMicro, targetMicro, currency: menu.currency }
+      error: {
+        code: "invalid_max_cashu_fee",
+        message: "The Cashu fee limit must be an exact non-negative integer number of sats.",
+        hint: "Pass --max-cashu-fee-sats with a value such as 1 or 2."
+      }
     };
   }
-  const openRoute = routeFor(fundMicro);
-  if (openRoute.route === "deferred") {
-    return defer("open", randomUUID(), fundMicro, targetMicro, fundMicro);
+  const strict = args.mode === "strict_per_call";
+  let submitContext = args.submitContext;
+  if (strict) {
+    const strictError = strictSpendInputError(args);
+    if (strictError) return strictError;
+    if (!submitContext)
+      return strictSpendFailure("The strict Cashu request has no recovery context.");
+    const binding = cashuSubmissionBindingFromContext(submitContext);
+    if (!binding)
+      return strictSpendFailure("The strict Cashu request has no complete recovery binding.");
+    const bindingFingerprint = cashuSubmissionBindingFingerprint(binding);
+    if (submitContext.binding_fingerprint !== bindingFingerprint)
+      return strictSpendFailure(
+        "The strict Cashu request binding does not match its request body."
+      );
+    submitContext = { ...submitContext, binding_fingerprint: bindingFingerprint };
   }
-  if (!canCashu) return none;
-  return {
-    mode: "open",
-    creditId: randomUUID(),
-    drawId: randomUUID(),
-    ...fundAmounts(fundMicro, args.btcRate),
-    currency: menu.currency,
-    targetMicro,
-    railReason: openRoute.reason
-  };
-}
-function planProbeDraw(args) {
-  const now = args.now ?? Date.now();
-  const implicit = [...args.implicit ?? []].filter(
-    (credit) => credit.status === "active" && credit.remainingMicro > 0 && credit.expiryMs > now
-  ).sort((a, b) => a.expiryMs - b.expiryMs).at(0);
-  if (implicit) {
-    if (effectiveCreditPosture(args.config, implicit.endpoint, args.identity).posture === "off") {
+  const now = args.now ?? (() => Date.now());
+  const uuid = args.uuid ?? (() => randomUUID());
+  const timeoutSec = args.inFlightTimeoutSec ?? inFlightTimeoutSeconds();
+  const getWalletForMint = args.getWalletForMint ?? getWallet;
+  const refundClause = resolveRefundClause(args.cashuP2pk, args.locktimeSeconds, now(), {
+    readMnemonic: args.readMnemonic
+  });
+  const lock1 = await withWalletLock(() => {
+    const initial = loadAgentWallet();
+    if (!initial) {
       return {
-        mode: "none",
-        drawSkipped: {
-          reason: "posture_off",
-          creditId: implicit.creditId,
-          remainingMicro: implicit.remainingMicro
-        }
-      };
-    }
-    return {
-      mode: "draw",
-      creditId: implicit.creditId,
-      drawId: randomUUID(),
-      source: "implicit"
-    };
-  }
-  const stored = args.stored;
-  if (!stored) return { mode: "none" };
-  const skip = (reason, extra) => ({
-    mode: "none",
-    drawSkipped: {
-      reason,
-      creditId: stored.creditId,
-      remainingMicro: stored.remainingMicro,
-      ...extra
-    }
-  });
-  if (effectiveCreditPosture(args.config, stored.endpoint, args.identity).posture === "off") {
-    return skip("posture_off");
-  }
-  if (stored.status !== "active") return skip("not_active");
-  if (stored.reconciliationPending) return skip("reconciliation_pending");
-  if (stored.remainingMicro <= 0 && !stored.provisional) return skip("exhausted");
-  if (stored.expiryMs > 0 && stored.expiryMs <= now) return skip("expired");
-  if (stored.lastPriceMicro !== void 0 && args.btcRate > 0) {
-    const ceilingMicro = msatsToMicro(args.drawCeilingMsats, args.btcRate);
-    if (ceilingMicro > 0 && stored.lastPriceMicro > ceilingMicro) {
-      return skip("price_above_ceiling", {
-        ceilingMicro,
-        lastPriceMicro: stored.lastPriceMicro,
-        ceilingSource: args.drawCeilingSource
-      });
-    }
-  }
-  return { mode: "draw", creditId: stored.creditId, drawId: randomUUID(), source: "prepaid" };
-}
-function needsTopup(balanceMicro, targetMicro) {
-  return targetMicro > 0 && balanceMicro < targetMicro * TOPUP_THRESHOLD_FRACTION;
-}
-function pocketTargetMicro(config) {
-  return parseCapMicro(config?.pocketTarget) ?? POCKET_TARGET_MICRO;
-}
-function needsPocketRefill(balanceMicro, targetMicro) {
-  return needsTopup(balanceMicro, targetMicro);
-}
-function fundWireAmountMicro(priceMicroServer, fundMsats, requiredMsats) {
-  if (fundMsats === requiredMsats) return priceMicroServer;
-  return Math.round(priceMicroServer * fundMsats / requiredMsats);
-}
-function readFundValuation(fields) {
-  const structured = usableMicro(fields.expectedMicro);
-  if (structured !== void 0) return { kind: "figure", micro: structured };
-  const match = /quoted price \((\d+)\)/.exec(fields.message ?? "");
-  const stated = match ? usableMicro(Number(match[1])) : void 0;
-  if (stated !== void 0) return { kind: "figure", micro: stated };
-  const providerStatedSomething = fields.expectedMicro !== void 0 || match !== null;
-  return providerStatedSomething ? { kind: "malformed" } : { kind: "absent" };
-}
-function msatsToMicro(msats, btcRate) {
-  return Math.round(msatsToUsd(msats, btcRate) * 1e6);
-}
-function microToSats(micro, btcRate) {
-  return Math.ceil(usdToMsats(micro / 1e6, btcRate) / 1e3);
-}
-function perDvmEntriesFor(config, endpoint, identity) {
-  const perDvm = config?.perDvm;
-  if (!perDvm) return [];
-  const key = normalizeCreditEndpoint(endpoint);
-  return Object.entries(perDvm).filter(
-    ([origin, per]) => normalizeCreditEndpoint(origin) === key || identity !== void 0 && per.dvmId === identity.dvmId && per.builderPubkey?.trim().toLowerCase() === identity.builderPubkey
-  );
-}
-var POSTURE_STRICTNESS = { auto: 0, suggest: 1, off: 2 };
-function usableMicro(value) {
-  return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : void 0;
-}
-function fundAmounts(fundMicro, btcRate) {
-  const fundSats = microToSats(fundMicro, btcRate);
-  return { fundMicro, fundSats, fundMsats: fundSats * 1e3 };
-}
-function completedReceiptsFor(receipts, endpoint, signingPubkey, identity) {
-  const key = normalizeCreditEndpoint(endpoint);
-  const requester = signingPubkey?.trim().toLowerCase();
-  if (!requester) return [];
-  const mine = (entry) => entry.receipt.requester_pubkey?.trim().toLowerCase() === requester && entry.receipt.outcome === "completed";
-  const here = [];
-  let anchor = identity;
-  for (const entry of receipts) {
-    if (normalizeCreditEndpoint(entry.endpoint) !== key || !mine(entry)) continue;
-    const verdict = verifyJobReceipt({ receipt: entry.receipt, builder: entry.builder });
-    if (verdict.status !== "verified" && verdict.status !== "verified_unattested") continue;
-    if (identity !== void 0) {
-      const attested = verdict.checks.attestation === "ok" ? attestedDvmIdentity(entry.builder) : void 0;
-      if (attested?.dvmId !== identity.dvmId || attested.builderPubkey !== identity.builderPubkey) {
-        continue;
-      }
-    }
-    here.push(entry);
-    if (anchor === void 0 && verdict.checks.attestation === "ok") {
-      anchor = attestedDvmIdentity(entry.builder);
-    }
-  }
-  if (!anchor) return here;
-  const elsewhere = receipts.filter((entry) => {
-    if (normalizeCreditEndpoint(entry.endpoint) === key || !mine(entry)) return false;
-    if (entry.receipt.dvm_id !== anchor.dvmId) return false;
-    const verdict = verifyJobReceipt({ receipt: entry.receipt, builder: entry.builder });
-    if (verdict.checks.attestation !== "ok") return false;
-    const attested = attestedDvmIdentity(entry.builder);
-    return attested?.dvmId === anchor.dvmId && attested.builderPubkey === anchor.builderPubkey;
-  });
-  return [...here, ...elsewhere];
-}
-function targetJobsFor(config, endpoint, identity) {
-  const targets = perDvmEntriesFor(config, endpoint, identity).map(([, per]) => per.targetJobs).filter((jobs) => typeof jobs === "number" && Number.isFinite(jobs));
-  if (targets.length > 0) return Math.min(...targets);
-  return config?.targetJobs;
-}
-function lookupOverride(overrides, builderPubkey) {
-  if (!overrides) return void 0;
-  const key = builderPubkey.trim().toLowerCase();
-  for (const [pubkey, cap] of Object.entries(overrides)) {
-    if (pubkey.trim().toLowerCase() === key) return cap;
-  }
-  return void 0;
-}
-function parseCapMicro(cap) {
-  if (!cap) return void 0;
-  const match = /^\$?(\d+(?:\.\d{1,6})?)$/.exec(cap.trim());
-  if (!match) return void 0;
-  const micro = Math.round(Number(match[1]) * 1e6);
-  return micro > 0 ? micro : void 0;
-}
-
-// src/lib/router-feedback-claim.ts
-import { createHmac, timingSafeEqual } from "crypto";
-var ROUTER_FEEDBACK_CLAIM_HEADER = "x-dvmkit-router-feedback-claim";
-var ROUTER_FEEDBACK_CLAIM_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
-function normalizeFeedbackEndpointHost(endpointOrHost) {
-  try {
-    const url = new URL(
-      endpointOrHost.includes("://") ? endpointOrHost : `https://${endpointOrHost}`
-    );
-    return url.host === "" ? null : url.host.toLowerCase();
-  } catch {
-    return null;
-  }
-}
-function issueRouterFeedbackClaim(secret, attribution, now = Date.now()) {
-  const body = {
-    v: 2,
-    dvm_id: attribution.dvmId,
-    job_id: attribution.jobId,
-    endpoint_host: attribution.endpointHost,
-    exp: now + ROUTER_FEEDBACK_CLAIM_TTL_MS
-  };
-  const encoded = Buffer.from(JSON.stringify(body), "utf8").toString("base64url");
-  const signature = createHmac("sha256", secret).update(encoded).digest("base64url");
-  return `${encoded}.${signature}`;
-}
-function verifyRouterFeedbackClaim(secret, token, now = Date.now()) {
-  const dot = token.indexOf(".");
-  if (dot <= 0 || dot === token.length - 1) return null;
-  const encoded = token.slice(0, dot);
-  const presentedSignature = token.slice(dot + 1);
-  const expectedSignature = createHmac("sha256", secret).update(encoded).digest("base64url");
-  if (!safeEqual(expectedSignature, presentedSignature)) return null;
-  let body;
-  try {
-    body = JSON.parse(
-      Buffer.from(encoded, "base64url").toString("utf8")
-    );
-  } catch {
-    return null;
-  }
-  if (body.v !== 2 || typeof body.dvm_id !== "string" || body.dvm_id.length === 0 || typeof body.job_id !== "string" || body.job_id.length === 0 || typeof body.endpoint_host !== "string" || body.endpoint_host.length === 0 || typeof body.exp !== "number" || !Number.isFinite(body.exp) || body.exp <= now) {
-    return null;
-  }
-  return {
-    dvmId: body.dvm_id,
-    jobId: body.job_id,
-    endpointHost: body.endpoint_host,
-    expiresAt: body.exp
-  };
-}
-function safeEqual(expected, presented) {
-  const expectedBuffer = Buffer.from(expected);
-  const presentedBuffer = Buffer.from(presented);
-  return expectedBuffer.length === presentedBuffer.length && timingSafeEqual(expectedBuffer, presentedBuffer);
-}
-
-// src/lib/wallet-agent/spend.ts
-import {
-  getEncodedToken,
-  MintOperationError
-} from "@cashu/cashu-ts";
-import { randomUUID as randomUUID2 } from "crypto";
-
-// src/lib/wallet-agent/select.ts
-function selectProofsForSpend(args) {
-  if (args.amountSats <= 0) {
-    return {
-      error: {
-        code: "insufficient_balance",
-        message: `amountSats must be positive; got ${args.amountSats}.`,
-        hint: "Pass a positive sat amount."
-      }
-    };
-  }
-  if (args.mintAllowlist.length === 0) {
-    return { error: noAcceptedMintsError() };
-  }
-  const reserveSats = args.swapReserveSats ?? (() => 0);
-  let largestEligibleBalance = 0;
-  for (const mint of args.mintAllowlist) {
-    const candidates = eligibleProofsAt(args.proofs, mint);
-    const balance = candidates.reduce((sum, p) => sum + p.amount, 0);
-    largestEligibleBalance = Math.max(largestEligibleBalance, balance);
-    if (balance < args.amountSats) continue;
-    const selected = [];
-    let total = 0;
-    for (const p of candidates) {
-      selected.push(p);
-      total += p.amount;
-      const required = args.amountSats + reserveSats(selected);
-      if (total >= required) {
-        return { selected, mint, totalSats: total };
-      }
-    }
-  }
-  return { error: noCoverError(largestEligibleBalance, args.amountSats) };
-}
-function coveringMintsForSpend(args) {
-  if (args.amountSats <= 0) {
-    return {
-      error: {
-        code: "insufficient_balance",
-        message: `amountSats must be positive; got ${args.amountSats}.`,
-        hint: "Pass a positive sat amount."
-      }
-    };
-  }
-  if (args.mintAllowlist.length === 0) {
-    return { error: noAcceptedMintsError() };
-  }
-  const mints = [];
-  let largestEligibleBalance = 0;
-  for (const mint of args.mintAllowlist) {
-    const balance = eligibleProofsAt(args.proofs, mint).reduce((sum, p) => sum + p.amount, 0);
-    largestEligibleBalance = Math.max(largestEligibleBalance, balance);
-    if (balance >= args.amountSats && !mints.includes(mint)) mints.push(mint);
-  }
-  if (mints.length === 0) {
-    return { error: noCoverError(largestEligibleBalance, args.amountSats) };
-  }
-  return { mints };
-}
-function eligibleProofsAt(proofs, mint) {
-  return proofs.filter((p) => p.mint === mint && p.status === "valid" && p.reserved_for === void 0).slice().sort((a, b) => b.amount - a.amount);
-}
-function noAcceptedMintsError() {
-  return {
-    code: "no_eligible_mint",
-    message: "DVM advertises no Cashu mints for the agent-wallet path.",
-    hint: "Use a different DVM, or fall back to the legacy --auto-pay flow."
-  };
-}
-function noCoverError(largestEligibleBalance, amountSats) {
-  if (largestEligibleBalance === 0) {
-    return {
-      code: "no_eligible_mint",
-      message: "Agent wallet has no proofs at any of the DVM's accepted mints.",
-      hint: "Fund the wallet at one of the DVM's accepted mints with: dvm wallet fund <amount>"
-    };
-  }
-  return {
-    code: "insufficient_balance",
-    message: `Agent wallet has ${largestEligibleBalance} sats at the DVM's mints; need ${amountSats} plus the per-call mint swap fee.`,
-    hint: "Top the wallet up with: dvm wallet fund <amount>"
-  };
-}
-
-// src/lib/wallet-agent/submission-binding.ts
-import { createHash as createHash2 } from "crypto";
-function cashuSubmissionBindingFingerprint(binding) {
-  return createHash2("sha256").update(canonicaliseForSigning(binding)).digest("hex");
-}
-function cashuSubmissionBindingFromContext(context) {
-  if (context.strict_per_call !== true || context.route === "credit" || typeof context.dvm_id !== "string" || context.dvm_id.length === 0 || typeof context.capability !== "string" || context.capability.length === 0 || typeof context.pinned_mint !== "string" || context.pinned_mint.length === 0 || !context.policy) {
-    return null;
-  }
-  return {
-    dvmId: context.dvm_id,
-    capability: context.capability,
-    requestBody: context.submit_body,
-    mint: context.pinned_mint,
-    signer: context.signing_pubkey ?? null,
-    policy: context.policy
-  };
-}
-
-// src/lib/wallet-agent/submission-context.ts
-import { createHash as createHash3 } from "crypto";
-function bindCashuTokenToSubmissionContext(context, cashuToken) {
-  if (!context) return void 0;
-  const commitment = createHash3("sha256").update(cashuToken).digest("hex");
-  if (context.route === "credit") {
-    const fund2 = context.credit_body?.fund;
-    if (!fund2) return context;
-    return {
-      ...context,
-      credit_body: {
-        ...context.credit_body,
-        fund: { ...fund2, commitment }
-      }
-    };
-  }
-  const data = context.submit_body.data;
-  const fund = data?.fund;
-  if (!data || !fund) return context;
-  return {
-    ...context,
-    submit_body: {
-      ...context.submit_body,
-      data: { ...data, fund: { ...fund, commitment } }
-    }
-  };
-}
-
-// src/lib/wallet-agent/spend.ts
-async function prepareAgentSpend(args) {
-  if (args.maxCashuPrincipalSats !== void 0 && (!Number.isSafeInteger(args.maxCashuPrincipalSats) || args.maxCashuPrincipalSats < 0)) {
-    return {
-      error: {
-        code: "invalid_max_cashu_principal",
-        message: "The Cashu principal limit must be an exact non-negative integer number of sats.",
-        hint: "Pass --max-cashu-principal-sats with a value such as 20 or 100."
-      }
-    };
-  }
-  if (args.maxCashuPrincipalSats !== void 0 && args.amountSats > args.maxCashuPrincipalSats) {
-    return principalCapFailure(args.amountSats, args.maxCashuPrincipalSats);
-  }
-  if (args.maxCashuFeeSats !== void 0 && (!Number.isSafeInteger(args.maxCashuFeeSats) || args.maxCashuFeeSats < 0)) {
-    return {
-      error: {
-        code: "invalid_max_cashu_fee",
-        message: "The Cashu fee limit must be an exact non-negative integer number of sats.",
-        hint: "Pass --max-cashu-fee-sats with a value such as 1 or 2."
-      }
-    };
-  }
-  const strict = args.mode === "strict_per_call";
-  let submitContext = args.submitContext;
-  if (strict) {
-    const strictError = strictSpendInputError(args);
-    if (strictError) return strictError;
-    if (!submitContext)
-      return strictSpendFailure("The strict Cashu request has no recovery context.");
-    const binding = cashuSubmissionBindingFromContext(submitContext);
-    if (!binding)
-      return strictSpendFailure("The strict Cashu request has no complete recovery binding.");
-    const bindingFingerprint = cashuSubmissionBindingFingerprint(binding);
-    if (submitContext.binding_fingerprint !== bindingFingerprint)
-      return strictSpendFailure(
-        "The strict Cashu request binding does not match its request body."
-      );
-    submitContext = { ...submitContext, binding_fingerprint: bindingFingerprint };
-  }
-  const now = args.now ?? (() => Date.now());
-  const uuid = args.uuid ?? (() => randomUUID2());
-  const timeoutSec = args.inFlightTimeoutSec ?? inFlightTimeoutSeconds();
-  const getWalletForMint = args.getWalletForMint ?? getWallet;
-  const refundClause = resolveRefundClause(args.cashuP2pk, args.locktimeSeconds, now(), {
-    readMnemonic: args.readMnemonic
-  });
-  const lock1 = await withWalletLock(() => {
-    const initial = loadAgentWallet();
-    if (!initial) {
-      return {
-        error: {
-          code: "no_agent_wallet",
-          message: "No agent wallet found at ~/.dvm/wallet.json.",
-          hint: "Run: dvm wallet init"
+        error: {
+          code: "no_agent_wallet",
+          message: "No agent wallet found at ~/.dvm/wallet.json.",
+          hint: "Run: dvm wallet init"
         }
       };
     }
@@ -5966,13 +5569,16 @@ async function createX402BatchPayment(args) {
   };
 }
 function x402VoucherPendingRefusal(blocking, data = {}) {
+  return formatX402VoucherPendingRefusal(x402VoucherPendingState(blocking), data);
+}
+function formatX402VoucherPendingRefusal(blocking, data = {}) {
   const base = {
     credit_id: blocking.creditId,
     fund_id: blocking.fundId,
     channel_id: blocking.channelId,
     ...data
   };
-  if (!x402PendingRetired(blocking)) {
+  if (!blocking.retired) {
     return new DvmError(
       "x402_voucher_pending",
       `A signed x402 voucher for credit ${blocking.creditId} is still waiting for its acknowledgement, so this channel cannot sign another.`,
@@ -5980,8 +5586,8 @@ function x402VoucherPendingRefusal(blocking, data = {}) {
       base
     );
   }
-  const until = new Date(x402PendingBlockExpiresAt(blocking)).toISOString();
-  const signedDeadline = x402PendingDepositExpiresAt(blocking) !== void 0;
+  const until = new Date(blocking.blockedUntil).toISOString();
+  const signedDeadline = blocking.depositExpiresAt !== void 0;
   return new DvmError(
     "x402_voucher_pending",
     signedDeadline ? `The deposit this channel signed for credit ${blocking.creditId} was refused by the DVM but can still be submitted, so the channel cannot sign a second one yet.` : `The funding this channel signed for credit ${blocking.creditId} was refused by the DVM, and it names no deadline after which it stops being submittable, so the channel cannot sign a second one yet.`,
@@ -6383,12 +5989,15 @@ function x402RefundError(err, chain) {
   );
 }
 function assertNoRivalVoucher(channelId, creditId) {
-  const blocking = listPendingX402FundingsForChannel(channelId).filter(
-    (entry) => x402PendingUnsettled(entry)
-  );
-  const rival = blocking.find((entry) => entry.creditId !== creditId && !x402PendingRetired(entry)) ?? blocking.find((entry) => entry.creditId !== creditId || x402PendingRetired(entry));
-  if (!rival) return;
-  throw x402VoucherPendingRefusal(rival, { channel_id: channelId });
+  const pending = listPendingX402FundingsForChannel(channelId);
+  try {
+    assertNoRivalX402Voucher(channelId, creditId, pending);
+  } catch (state) {
+    if (typeof state !== "object" || state === null || !("code" in state) || state.code !== "x402_voucher_pending" || !("creditId" in state) || typeof state.creditId !== "string" || !("fundId" in state) || typeof state.fundId !== "string" || !("channelId" in state) || typeof state.channelId !== "string" || !("endpoint" in state) || typeof state.endpoint !== "string" || !("retired" in state) || typeof state.retired !== "boolean" || !("blockedUntil" in state) || typeof state.blockedUntil !== "number") {
+      throw state;
+    }
+    throw formatX402VoucherPendingRefusal(state);
+  }
 }
 function selectBatchRequirement(required, network, recorded) {
   const accepted = required.accepts.find(
@@ -6424,26 +6033,49 @@ function normalizeEndpoint(endpoint) {
   }
 }
 
-// src/lib/credit-fund.ts
-var CREDIT_FUND_RAILS = ["cashu", "lightning", "x402", "tempo"];
-var CREDIT_DRAIN_RAILS = ["cashu", "x402", "tempo"];
-function isCreditFundRail(value) {
-  return typeof value === "string" && CREDIT_FUND_RAILS.includes(value);
+// src/lib/x402/menu.ts
+function offersX402CreditFunding(menu, network) {
+  return matchesNetwork(x402CreditFundingNetworks(menu), network);
 }
-var STABLECOIN_FUND_RAILS = ["x402", "tempo"];
-function isStablecoinFundRail(rail) {
-  return STABLECOIN_FUND_RAILS.includes(rail);
+function offersX402CreditChannel(menu, network) {
+  return matchesNetwork(x402CreditChannelNetworks(menu), network);
 }
-var CREDIT_FUNDING_MODES = ["one-shot", "reusable"];
-function isCreditFundingMode(value) {
-  return typeof value === "string" && CREDIT_FUNDING_MODES.includes(value);
+function x402CreditFlavour(menu, network) {
+  if (offersX402CreditChannel(menu, network)) return X402_BATCH_SETTLEMENT_SCHEME;
+  if (matchesNetwork(x402CreditExactNetworks(menu), network)) return X402_EXACT_SCHEME;
+  return void 0;
 }
-function fundingModeForTempoIntent(intent) {
-  return intent === "session" ? "reusable" : "one-shot";
+function offersX402CreditFlavour(menu, network, flavour) {
+  return matchesNetwork(
+    flavour === X402_BATCH_SETTLEMENT_SCHEME ? x402CreditChannelNetworks(menu) : x402CreditExactNetworks(menu),
+    network
+  );
 }
-function fundingModeForX402Flavour(flavour) {
-  return flavour === X402_BATCH_SETTLEMENT_SCHEME ? "reusable" : "one-shot";
+function x402InstrumentForFlavour(flavour) {
+  return flavour === X402_BATCH_SETTLEMENT_SCHEME ? "x402_channel" : "x402_exact";
+}
+function x402FlavourForInstrument(instrument) {
+  if (instrument === "x402_channel") return X402_BATCH_SETTLEMENT_SCHEME;
+  if (instrument === "x402_exact") return X402_EXACT_SCHEME;
+  return void 0;
+}
+function x402CreditChannelNetworks(menu) {
+  return schemeNetworks(menu, X402_BATCH_SETTLEMENT_SCHEME);
+}
+function x402CreditExactNetworks(menu) {
+  return schemeNetworks(menu, X402_EXACT_SCHEME);
+}
+function x402CreditFundingNetworks(menu) {
+  return [.../* @__PURE__ */ new Set([...x402CreditChannelNetworks(menu), ...x402CreditExactNetworks(menu)])];
+}
+function schemeNetworks(menu, scheme) {
+  return (menu?.x402?.schemes ?? []).filter((entry) => entry.scheme === scheme).map((entry) => entry.network);
+}
+function matchesNetwork(networks, network) {
+  return networks.some((candidate) => network === void 0 || candidate === network);
 }
+
+// src/lib/credit-fund.ts
 var CREDIT_POST_TIMEOUT_MS = 15e3;
 var CREDIT_PERMANENT_REFUSALS = /* @__PURE__ */ new Set([
   "credit_over_max",
@@ -6503,7 +6135,7 @@ async function runCreditFunding(args) {
     }
     clearPending(pending);
   }
-  const fundId = args.fundId ?? randomUUID3();
+  const fundId = args.fundId ?? randomUUID2();
   const base = { creditId: args.creditId, fundId };
   const eligible = args.fundingMode ? availableRails(args).filter(isStablecoinFundRail) : availableRails(args);
   const x402Network = loadX402Wallet()?.network;
@@ -7627,7 +7259,7 @@ async function fundOverCashu(args, fundId) {
       display: "The bitcoin exchange rate couldn't be read, so the funding amount can't be sized."
     };
   }
-  const fundSats = microToSats2(args.amountMicro, rate);
+  const fundSats = microToSats(args.amountMicro, rate);
   if (args.maxCashuPrincipalSats !== void 0 && fundSats > args.maxCashuPrincipalSats) {
     return cashuFundingCapRefusal(base, {
       code: "cashu_principal_cap_exceeded",
@@ -7837,7 +7469,7 @@ async function fundOverMppCharge(args, fundId, resumed, locked = false) {
         display: "The bitcoin exchange rate couldn't be read, so the funding can't be checked against the global budget."
       };
     }
-    const plannedMsats = microToSats2(args.amountMicro, rate) * 1e3;
+    const plannedMsats = microToSats(args.amountMicro, rate) * 1e3;
     try {
       await enforceGlobalBudget({ plannedMsats, btcRate: rate });
     } catch (err) {
@@ -8082,7 +7714,7 @@ async function fundOverMpp(args, fundId, resumed, locked = false) {
         display: "The bitcoin exchange rate couldn't be read, so the funding can't be checked against the global budget."
       };
     }
-    const plannedMsats = microToSats2(args.amountMicro, rate) * 1e3;
+    const plannedMsats = microToSats(args.amountMicro, rate) * 1e3;
     let budgetBtcRate;
     try {
       budgetBtcRate = await enforceGlobalBudget({ plannedMsats, btcRate: rate });
@@ -8301,7 +7933,7 @@ async function fundOverMpp(args, fundId, resumed, locked = false) {
   const bookedMicro = current.authorizedMicro ?? current.amountMicro;
   if (current.budgetBtcRate) {
     recordSpendOnce({
-      msats: microToSats2(bookedMicro, current.budgetBtcRate) * 1e3,
+      msats: microToSats(bookedMicro, current.budgetBtcRate) * 1e3,
       btcRate: current.budgetBtcRate,
       kind: "credit_fund",
       jobId: `fund:${current.creditId}:${fundId}`,
@@ -8442,7 +8074,7 @@ async function fundOverLightning(args, fundId, resumed) {
       };
     }
     try {
-      await assertFloatBudget(microToSats2(args.amountMicro, rate) * 1e3);
+      await assertFloatBudget(microToSats(args.amountMicro, rate) * 1e3);
     } catch (err) {
       return budgetRefusal(base, err);
     }
@@ -8873,184 +8505,575 @@ function clearPending(pending) {
 function shouldClearPending(err) {
   return isPermanentRefusal(err) || err instanceof DvmError && err.code === "lightning_unavailable";
 }
-function expiredFunding(base) {
-  const error = new DvmError(
-    "lightning_invoice_expired",
-    "The original Lightning funding invoice expired before it was confirmed.",
-    "Re-run the funding to start a new intent with a new funding id."
+function expiredFunding(base) {
+  const error = new DvmError(
+    "lightning_invoice_expired",
+    "The original Lightning funding invoice expired before it was confirmed.",
+    "Re-run the funding to start a new intent with a new funding id."
+  );
+  return {
+    ...base,
+    status: "refused",
+    error,
+    display: "The original Lightning invoice expired before it was funded. It was cleared and will not be polled again.",
+    hint: error.hint
+  };
+}
+function lightningOffer(err) {
+  if (!isSettlementPending(err)) return void 0;
+  const offer = err.data?.lightning;
+  return offer;
+}
+function isSettlementPending(err) {
+  return err instanceof DvmError && err.code === "lightning_settlement_pending" && isRecord(err.data?.lightning);
+}
+function isPermanentRefusal(err) {
+  if (!(err instanceof DvmError)) return false;
+  if (err.data?.retryable === false) return true;
+  return CREDIT_PERMANENT_REFUSALS.has(err.code) || boundRail(err) !== void 0;
+}
+function boundRail(err) {
+  if (!(err instanceof DvmError)) return void 0;
+  const rail = err.data?.credit_rail;
+  return isCreditFundRail(rail) ? rail : void 0;
+}
+function boundInstrument(err) {
+  if (!(err instanceof DvmError)) return void 0;
+  return typeof err.data?.credit_instrument === "string" ? err.data.credit_instrument : void 0;
+}
+function boundChannelId(err) {
+  if (!(err instanceof DvmError)) return void 0;
+  return typeof err.data?.credit_channel_id === "string" ? err.data.credit_channel_id : void 0;
+}
+function boundCreditId(err) {
+  if (!(err instanceof DvmError)) return void 0;
+  return typeof err.data?.bound_credit_id === "string" ? err.data.bound_credit_id : void 0;
+}
+function isBindingRefusal(err) {
+  return boundInstrument(err) !== void 0 || boundRail(err) !== void 0;
+}
+function lightningRefusal(base, err) {
+  const mapped = err instanceof DvmError ? err : void 0;
+  const required = boundRail(err);
+  if (required) {
+    return {
+      ...base,
+      status: "unavailable",
+      requiredRail: required,
+      error: mapped,
+      display: `This credit was opened over ${required}, so a Lightning top-up can't be added to it.`
+    };
+  }
+  if (mapped?.code === "below_rail_minimum") {
+    const minMicro = typeof mapped.data?.min_micro === "number" ? mapped.data.min_micro : void 0;
+    return {
+      ...base,
+      status: "unavailable",
+      error: mapped,
+      display: typeof mapped.data?.display === "string" ? mapped.data.display : "This amount is below the minimum this DVM can receive over Lightning, so no invoice was issued.",
+      hint: "Refill the agent's ecash pocket with 'dvm wallet fund' and retry \u2014 ecash funds any amount here." + (minMicro !== void 0 ? ` Or fund at least $${formatUsd(minMicro / 1e6)} to use Lightning.` : "")
+    };
+  }
+  if (mapped?.code === "lightning_unavailable") {
+    return {
+      ...base,
+      status: "unavailable",
+      error: mapped,
+      display: typeof mapped.data?.display === "string" ? mapped.data.display : "This DVM can't issue a Lightning invoice right now.",
+      hint: mapped.hint
+    };
+  }
+  return {
+    ...base,
+    status: "refused",
+    error: mapped,
+    // The DVM's own `display` when it wrote one; otherwise its message, so the
+    // composed prose is never thinner than the error it was built from —
+    // callers relay `display`, not `error.message`.
+    display: typeof mapped?.data?.display === "string" ? mapped.data.display : `The credit funding was refused${mapped ? ` (${mapped.code}). ${mapped.message}` : "."}`,
+    hint: mapped?.hint
+  };
+}
+function budgetRefusal(base, err) {
+  const mapped = err instanceof DvmError ? err : void 0;
+  const display = typeof mapped?.data?.display === "string" ? mapped.data.display : mapped?.message ?? "";
+  return {
+    ...base,
+    status: "refused",
+    error: mapped,
+    display: `${display} Nothing was charged, and any prepaid balance already at this DVM keeps working.`.trim(),
+    hint: mapped?.hint
+  };
+}
+function forcedRailHint(args, rail) {
+  const release = releaseForcedRailHint(args);
+  const advertised = args.menu?.funding;
+  if (advertised && !advertised.includes(rail)) {
+    return `This DVM advertises credit funding over ${advertised.join(", ") || "no rail at all"}, not ${rail}. ${release.text}`;
+  }
+  if (rail === "lightning") {
+    const connect = `No Lightning wallet is connected here, so there is nothing to pay an invoice with. Connect one with 'dvm wallet connect', piping the connection string in`;
+    return release.instruction ? `${connect}, or ${lowerFirst(release.text)}` : `${connect}. ${release.text}`;
+  }
+  if (rail === "x402") {
+    const wallet = loadX402Wallet();
+    if (!wallet) {
+      return `No x402 wallet is connected here, so there is nothing to sign a funding payment with. Run 'dvm wallet x402-connect' to create one, or add --key-file <path> to import a key you already hold. ${release.text}`;
+    }
+    const networks = x402CreditFundingNetworks(args.menu);
+    if (networks.length > 0) {
+      return `This DVM takes x402 credit funding on ${networks.map(x402NetworkLabel).join(", ")}, and the connected wallet is pinned to ${x402NetworkLabel(wallet.network)}. Re-pin it without handling its key: 'dvm wallet x402-network ${networks[0]}'. ${release.text}`;
+    }
+    if (args.menu) {
+      return `This DVM's funding menu names no x402 scheme, so there is no requirement to sign a payment against. ${release.text}`;
+    }
+    return `This DVM's funding menu hasn't been read here, so no x402 scheme is known to sign a payment against. ${release.text}`;
+  }
+  if (rail === "tempo") {
+    if (!hasConnectedTempoWallet(args)) {
+      const connect = `No Tempo wallet is connected here, so there is nothing to sign a funding payment with. Connect one with 'dvm wallet tempo-connect'`;
+      return release.instruction ? `${connect}, or ${lowerFirst(release.text)}` : `${connect}. ${release.text}`;
+    }
+    if (args.menu) {
+      return `This DVM advertises Tempo credit funding, but its funding menu names no supported Tempo charge or session intent, so this caller has no payment to build. ${release.text}`;
+    }
+    return `This DVM's funding menu hasn't been read here, so no Tempo charge or session intent is known to build a payment against. ${release.text}`;
+  }
+  if (!args.providerInfo) {
+    return `This DVM's '/v1/info' hasn't been read here, so no Cashu offer is known to attach a proof to. ${release.text}`;
+  }
+  return `This DVM publishes no Cashu offer for a proof to be locked to, so ecash can't fund it. ${release.text}`;
+}
+function releaseForcedRailHint(args) {
+  switch (args.railSource) {
+    case "per_dvm":
+      return {
+        text: `Run 'dvm credit rail --clear --dvm ${args.ref.endpoint}' to let the global pin or amount rule decide.`,
+        instruction: true
+      };
+    case "global":
+      return {
+        text: "Run 'dvm credit rail --clear' to let the amount rule decide.",
+        instruction: true
+      };
+    case "credit_bound":
+      return {
+        text: "This credit is bound to that rail by the DVM, so it can only be topped up over it \u2014 drain it and open a new credit to change rails.",
+        instruction: false
+      };
+    default:
+      return { text: "Drop --rail to let the CLI pick.", instruction: true };
+  }
+}
+function lowerFirst(value) {
+  return value.charAt(0).toLowerCase() + value.slice(1);
+}
+function unavailableDisplay(args, rail) {
+  const what = rail === "lightning" ? "over Lightning" : rail === "cashu" ? "with ecash" : rail === "x402" ? "over x402" : "";
+  return `No way to fund a prepaid credit at ${args.ref.endpoint}${what ? ` ${what}` : ""} right now.`;
+}
+function sha256Hex(value) {
+  return createHash4("sha256").update(value, "utf8").digest("hex");
+}
+function isRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/lib/credit-policy.ts
+import { randomUUID as randomUUID3 } from "crypto";
+var TIER0_CAP_MICRO = 5e5;
+var TIER1_CAP_MICRO = 2e6;
+var TIER1_MIN_RECEIPTS = 3;
+var TIER2_MIN_RECEIPTS = 15;
+var TIER2_MIN_SPAN_MS = 7 * 24 * 60 * 60 * 1e3;
+var OPEN_TARGET_JOBS = 20;
+var CASHU_REFILL_TARGET_JOBS = 40;
+var TOPUP_THRESHOLD_FRACTION = 0.25;
+var DEFAULT_CREDIT_POSTURE = "suggest";
+var POCKET_TARGET_MICRO = 5e6;
+function trustTierFor(args) {
+  const ladder = trustLadderFor(args);
+  return { tier: ladder.tier, capMicro: ladder.capMicro ?? args.menu.max_micro };
+}
+function trustLadderFor(args) {
+  const successes = completedReceiptsFor(
+    args.receipts,
+    args.endpoint,
+    args.signingPubkey,
+    args.identity
   );
+  const tier0Cap = args.tier0CapMicro ?? TIER0_CAP_MICRO;
+  const tier1Cap = args.tier1CapMicro ?? TIER1_CAP_MICRO;
+  const builderMax = args.menu?.max_micro;
+  const issued = successes.map((r) => r.receipt.issued_at * 1e3);
+  const spanMs = issued.length > 1 ? Math.max(...issued) - Math.min(...issued) : 0;
+  const count = successes.length;
+  if (count >= TIER2_MIN_RECEIPTS && spanMs >= TIER2_MIN_SPAN_MS) {
+    return {
+      tier: 2,
+      ...builderMax !== void 0 ? { capMicro: builderMax } : {},
+      receipts: count,
+      spanMs
+    };
+  }
+  const toTier2 = {
+    tier: 2,
+    ...builderMax !== void 0 ? { capMicro: builderMax } : {},
+    receiptsNeeded: Math.max(TIER2_MIN_RECEIPTS - count, 0),
+    spanMs: TIER2_MIN_SPAN_MS
+  };
+  if (count >= TIER1_MIN_RECEIPTS) {
+    return { tier: 1, capMicro: tier1Cap, receipts: count, spanMs, next: toTier2 };
+  }
   return {
-    ...base,
-    status: "refused",
-    error,
-    display: "The original Lightning invoice expired before it was funded. It was cleared and will not be polled again.",
-    hint: error.hint
+    tier: 0,
+    capMicro: tier0Cap,
+    receipts: count,
+    spanMs,
+    next: { tier: 1, capMicro: tier1Cap, receiptsNeeded: TIER1_MIN_RECEIPTS - count }
   };
 }
-function lightningOffer(err) {
-  if (!isSettlementPending(err)) return void 0;
-  const offer = err.data?.lightning;
-  return offer;
-}
-function isSettlementPending(err) {
-  return err instanceof DvmError && err.code === "lightning_settlement_pending" && isRecord(err.data?.lightning);
+function effectiveCreditPosture(config, endpoint, identity) {
+  const postures = perDvmEntriesFor(config, endpoint, identity).map(([, per2]) => per2.posture).filter(isCreditPosture);
+  const per = postures.reduce(
+    (strictest, posture) => strictest === void 0 || POSTURE_STRICTNESS[posture] > POSTURE_STRICTNESS[strictest] ? posture : strictest,
+    void 0
+  );
+  if (per !== void 0) return { posture: per, source: "per_dvm" };
+  const global = config?.posture;
+  if (isCreditPosture(global)) return { posture: global, source: "global" };
+  return { posture: DEFAULT_CREDIT_POSTURE, source: "default" };
 }
-function isPermanentRefusal(err) {
-  if (!(err instanceof DvmError)) return false;
-  if (err.data?.retryable === false) return true;
-  return CREDIT_PERMANENT_REFUSALS.has(err.code) || boundRail(err) !== void 0;
+function effectiveFundingRail(config, endpoint, identity) {
+  let conflict;
+  if (endpoint !== void 0) {
+    const pinned = perDvmEntriesFor(config, endpoint, identity).flatMap(
+      ([origin, per]) => isCreditFundRail(per.fundingRail) ? [[origin, per.fundingRail]] : []
+    );
+    const rails = [...new Set(pinned.map(([, rail]) => rail))];
+    if (rails.length > 1) conflict = { rails, endpoints: pinned.map(([origin]) => origin) };
+    else if (rails.length === 1) return { rail: rails[0], source: "per_dvm" };
+  }
+  const global = config?.fundingRail;
+  if (isCreditFundRail(global))
+    return { rail: global, source: "global", ...conflict ? { conflict } : {} };
+  return { source: "default", ...conflict ? { conflict } : {} };
 }
-function boundRail(err) {
-  if (!(err instanceof DvmError)) return void 0;
-  const rail = err.data?.credit_rail;
-  return isCreditFundRail(rail) ? rail : void 0;
+function automaticCreditBoundRail(stored) {
+  if (stored?.status !== "active" || stored.reconciliationPending) return void 0;
+  return isCreditFundRail(stored.rail) ? stored.rail : void 0;
 }
-function boundInstrument(err) {
-  if (!(err instanceof DvmError)) return void 0;
-  return typeof err.data?.credit_instrument === "string" ? err.data.credit_instrument : void 0;
+function trustOverrideCapMicro(args) {
+  const raw2 = args.builderPubkey ? lookupOverride(args.config?.trustOverrides, args.builderPubkey) : void 0;
+  if (!raw2) return void 0;
+  if (raw2.trim().toLowerCase() === "builder-max") {
+    return args.menu?.max_micro ?? Number.POSITIVE_INFINITY;
+  }
+  return parseCapMicro(raw2);
 }
-function boundChannelId(err) {
-  if (!(err instanceof DvmError)) return void 0;
-  return typeof err.data?.credit_channel_id === "string" ? err.data.credit_channel_id : void 0;
+function tierCapOverrides(config) {
+  const out = {};
+  const tier0 = parseCapMicro(config?.tier0Cap);
+  const tier1 = parseCapMicro(config?.tier1Cap);
+  if (tier0 !== void 0) out.tier0CapMicro = tier0;
+  if (tier1 !== void 0) out.tier1CapMicro = tier1;
+  return out;
 }
-function boundCreditId(err) {
-  if (!(err instanceof DvmError)) return void 0;
-  return typeof err.data?.bound_credit_id === "string" ? err.data.bound_credit_id : void 0;
+function sizeCreditMicro(args) {
+  const target = (args.targetJobs ?? OPEN_TARGET_JOBS) * args.priceMicro;
+  let size = Math.max(args.menu.min_micro, Math.min(target, args.capMicro));
+  const residualCeiling = args.menu.max_micro + args.priceMicro;
+  size = Math.min(size, residualCeiling);
+  return Math.max(size, args.menu.min_micro);
 }
-function isBindingRefusal(err) {
-  return boundInstrument(err) !== void 0 || boundRail(err) !== void 0;
+function refillTargetMicro(args) {
+  const target = (args.targetJobs ?? CASHU_REFILL_TARGET_JOBS) * args.priceMicro;
+  return Math.max(args.menu.min_micro, Math.min(target, args.capMicro, args.menu.max_micro));
 }
-function lightningRefusal(base, err) {
-  const mapped = err instanceof DvmError ? err : void 0;
-  const required = boundRail(err);
-  if (required) {
-    return {
-      ...base,
-      status: "unavailable",
-      requiredRail: required,
-      error: mapped,
-      display: `This credit was opened over ${required}, so a Lightning top-up can't be added to it.`
-    };
+function planCreditForQuote(args) {
+  const none = { mode: "none" };
+  const menu = args.menu;
+  if (!menu || !args.signingPubkey) return none;
+  const posture = effectiveCreditPosture(args.config, args.endpoint, args.identity).posture;
+  if (posture === "off") return none;
+  if (menu.currency.toLowerCase() !== "usd") return none;
+  const canCashu = menu.funding.includes("cashu");
+  const canFloat = menu.funding.includes("lightning") && args.floatConnected === true;
+  const canX402 = menu.funding.includes("x402") && args.x402Connected === true && offersX402CreditFunding(menu, args.x402Network);
+  const canMpp = menu.funding.includes("tempo") && args.tempoConnected === true && offersTempoCreditFunding(menu);
+  if (!canCashu && !canFloat && !canX402 && !canMpp) return none;
+  if (!Number.isFinite(args.priceMsats) || args.priceMsats <= 0) return none;
+  const stored = args.stored;
+  if (stored?.reconciliationPending) return none;
+  const refilling = stored?.status === "active" && stored.currency === menu.currency;
+  const rateUnavailable = !Number.isFinite(args.btcRate) || args.btcRate <= 0;
+  if (!refilling) {
+    const completed = completedReceiptsFor(
+      args.receipts,
+      args.endpoint,
+      args.signingPubkey,
+      args.identity
+    );
+    if (completed.length === 0) return none;
+    const identity = args.identity;
+    if (rateUnavailable && identity && !completed.some((entry) => {
+      const attested = attestedDvmIdentity(entry.builder);
+      return attested?.dvmId === identity.dvmId && attested.builderPubkey === identity.builderPubkey;
+    })) {
+      return none;
+    }
   }
-  if (mapped?.code === "below_rail_minimum") {
-    const minMicro = typeof mapped.data?.min_micro === "number" ? mapped.data.min_micro : void 0;
+  if (rateUnavailable) {
+    return posture === "auto" ? {
+      mode: "none",
+      fundingSkipped: {
+        reason: "btc_rate_unavailable",
+        operation: refilling ? "refill" : "open"
+      }
+    } : none;
+  }
+  const priceMicro = msatsToMicro(args.priceMsats, args.btcRate);
+  if (priceMicro <= 0) return none;
+  const tier = trustTierFor({
+    receipts: args.receipts,
+    endpoint: args.endpoint,
+    signingPubkey: args.signingPubkey,
+    ...args.identity ? { identity: args.identity } : {},
+    menu,
+    ...tierCapOverrides(args.config)
+  });
+  const targetJobs = targetJobsFor(args.config, args.endpoint, args.identity);
+  const pin = effectiveFundingRail(args.config, args.endpoint, args.identity);
+  const eligible = [
+    ...canCashu ? ["cashu"] : [],
+    ...canFloat ? ["lightning"] : [],
+    ...canX402 ? ["x402"] : [],
+    ...canMpp ? ["tempo"] : []
+  ];
+  const routeFor = (fundMicro2, boundRail2) => {
+    const forced = boundRail2 ?? pin.rail;
+    const pick = pickCreditFundRail({
+      rails: eligible,
+      amountMicro: fundMicro2,
+      menu,
+      ...args.x402Network ? { x402Network: args.x402Network } : {},
+      ...forced ? { forced } : {}
+    });
+    const head = forced ?? pick.order[0];
+    return { route: head === "cashu" ? "cashu" : "deferred", reason: pick.reason };
+  };
+  const pinned = pin.rail && pin.source !== "default" ? { rail: pin.rail, source: pin.source } : void 0;
+  const defer = (reason, creditId, fundMicro2, targetMicro2, maxDepositMicro, forced = pinned) => ({
+    mode: "none",
+    deferred: {
+      reason,
+      creditId,
+      fundMicro: fundMicro2,
+      targetMicro: targetMicro2,
+      maxDepositMicro,
+      currency: menu.currency,
+      menu,
+      ...forced ? { pinnedRail: forced.rail, pinnedRailSource: forced.source } : {}
+    }
+  });
+  if (refilling) {
+    const targetMicro2 = refillTargetMicro({
+      menu,
+      priceMicro,
+      capMicro: tier.capMicro,
+      ...targetJobs !== void 0 ? { targetJobs } : {}
+    });
+    const boundRail2 = isCreditFundRail(stored.rail) ? stored.rail : void 0;
+    const forcedRefill = boundRail2 ? { rail: boundRail2, source: "credit_bound" } : pinned;
+    const railFloorMicro = forcedRefill?.rail === "lightning" && menu.lightning_min_micro !== void 0 ? Math.max(menu.min_micro, menu.lightning_min_micro) : menu.min_micro;
+    const fundMicro2 = Math.min(
+      Math.max(railFloorMicro, targetMicro2 - Math.max(stored.remainingMicro, 0) + priceMicro),
+      menu.max_micro
+    );
+    if (posture === "suggest") {
+      return {
+        mode: "none",
+        suppressed: { reason: "refill", fundMicro: fundMicro2, targetMicro: targetMicro2, currency: menu.currency }
+      };
+    }
+    const refillRoute = routeFor(fundMicro2, boundRail2);
+    if (refillRoute.route === "deferred") {
+      return defer("refill", stored.creditId, fundMicro2, targetMicro2, fundMicro2, forcedRefill);
+    }
+    if (!canCashu) return none;
     return {
-      ...base,
-      status: "unavailable",
-      error: mapped,
-      display: typeof mapped.data?.display === "string" ? mapped.data.display : "This amount is below the minimum this DVM can receive over Lightning, so no invoice was issued.",
-      hint: "Refill the agent's ecash pocket with 'dvm wallet fund' and retry \u2014 ecash funds any amount here." + (minMicro !== void 0 ? ` Or fund at least $${formatUsd(minMicro / 1e6)} to use Lightning.` : "")
+      mode: "topup",
+      creditId: stored.creditId,
+      drawId: randomUUID3(),
+      ...fundAmounts(fundMicro2, args.btcRate),
+      currency: menu.currency,
+      targetMicro: targetMicro2,
+      railReason: refillRoute.reason
     };
   }
-  if (mapped?.code === "lightning_unavailable") {
+  const fundMicro = sizeCreditMicro({
+    menu,
+    priceMicro,
+    capMicro: tier.capMicro,
+    ...targetJobs !== void 0 ? { targetJobs: Math.min(targetJobs, OPEN_TARGET_JOBS) } : {}
+  });
+  const targetMicro = refillTargetMicro({
+    menu,
+    priceMicro,
+    capMicro: tier.capMicro,
+    ...targetJobs !== void 0 ? { targetJobs } : {}
+  });
+  if (posture === "suggest") {
     return {
-      ...base,
-      status: "unavailable",
-      error: mapped,
-      display: typeof mapped.data?.display === "string" ? mapped.data.display : "This DVM can't issue a Lightning invoice right now.",
-      hint: mapped.hint
+      mode: "none",
+      suppressed: { reason: "open", fundMicro, targetMicro, currency: menu.currency }
     };
   }
+  const openRoute = routeFor(fundMicro);
+  if (openRoute.route === "deferred") {
+    return defer("open", randomUUID3(), fundMicro, targetMicro, fundMicro);
+  }
+  if (!canCashu) return none;
   return {
-    ...base,
-    status: "refused",
-    error: mapped,
-    // The DVM's own `display` when it wrote one; otherwise its message, so the
-    // composed prose is never thinner than the error it was built from —
-    // callers relay `display`, not `error.message`.
-    display: typeof mapped?.data?.display === "string" ? mapped.data.display : `The credit funding was refused${mapped ? ` (${mapped.code}). ${mapped.message}` : "."}`,
-    hint: mapped?.hint
-  };
-}
-function budgetRefusal(base, err) {
-  const mapped = err instanceof DvmError ? err : void 0;
-  const display = typeof mapped?.data?.display === "string" ? mapped.data.display : mapped?.message ?? "";
-  return {
-    ...base,
-    status: "refused",
-    error: mapped,
-    display: `${display} Nothing was charged, and any prepaid balance already at this DVM keeps working.`.trim(),
-    hint: mapped?.hint
+    mode: "open",
+    creditId: randomUUID3(),
+    drawId: randomUUID3(),
+    ...fundAmounts(fundMicro, args.btcRate),
+    currency: menu.currency,
+    targetMicro,
+    railReason: openRoute.reason
   };
 }
-function forcedRailHint(args, rail) {
-  const release = releaseForcedRailHint(args);
-  const advertised = args.menu?.funding;
-  if (advertised && !advertised.includes(rail)) {
-    return `This DVM advertises credit funding over ${advertised.join(", ") || "no rail at all"}, not ${rail}. ${release.text}`;
-  }
-  if (rail === "lightning") {
-    const connect = `No Lightning wallet is connected here, so there is nothing to pay an invoice with. Connect one with 'dvm wallet connect', piping the connection string in`;
-    return release.instruction ? `${connect}, or ${lowerFirst(release.text)}` : `${connect}. ${release.text}`;
-  }
-  if (rail === "x402") {
-    const wallet = loadX402Wallet();
-    if (!wallet) {
-      return `No x402 wallet is connected here, so there is nothing to sign a funding payment with. Run 'dvm wallet x402-connect' to create one, or add --key-file <path> to import a key you already hold. ${release.text}`;
-    }
-    const networks = x402CreditFundingNetworks(args.menu);
-    if (networks.length > 0) {
-      return `This DVM takes x402 credit funding on ${networks.map(x402NetworkLabel).join(", ")}, and the connected wallet is pinned to ${x402NetworkLabel(wallet.network)}. Re-pin it without handling its key: 'dvm wallet x402-network ${networks[0]}'. ${release.text}`;
-    }
-    if (args.menu) {
-      return `This DVM's funding menu names no x402 scheme, so there is no requirement to sign a payment against. ${release.text}`;
+function planProbeDraw(args) {
+  const now = args.now ?? Date.now();
+  const implicit = [...args.implicit ?? []].filter(
+    (credit) => credit.status === "active" && credit.remainingMicro > 0 && credit.expiryMs > now
+  ).sort((a, b) => a.expiryMs - b.expiryMs).at(0);
+  if (implicit) {
+    if (effectiveCreditPosture(args.config, implicit.endpoint, args.identity).posture === "off") {
+      return {
+        mode: "none",
+        drawSkipped: {
+          reason: "posture_off",
+          creditId: implicit.creditId,
+          remainingMicro: implicit.remainingMicro
+        }
+      };
     }
-    return `This DVM's funding menu hasn't been read here, so no x402 scheme is known to sign a payment against. ${release.text}`;
+    return {
+      mode: "draw",
+      creditId: implicit.creditId,
+      drawId: randomUUID3(),
+      source: "implicit"
+    };
   }
-  if (rail === "tempo") {
-    if (!hasConnectedTempoWallet(args)) {
-      const connect = `No Tempo wallet is connected here, so there is nothing to sign a funding payment with. Connect one with 'dvm wallet tempo-connect'`;
-      return release.instruction ? `${connect}, or ${lowerFirst(release.text)}` : `${connect}. ${release.text}`;
-    }
-    if (args.menu) {
-      return `This DVM advertises Tempo credit funding, but its funding menu names no supported Tempo charge or session intent, so this caller has no payment to build. ${release.text}`;
+  const stored = args.stored;
+  if (!stored) return { mode: "none" };
+  const skip = (reason, extra) => ({
+    mode: "none",
+    drawSkipped: {
+      reason,
+      creditId: stored.creditId,
+      remainingMicro: stored.remainingMicro,
+      ...extra
     }
-    return `This DVM's funding menu hasn't been read here, so no Tempo charge or session intent is known to build a payment against. ${release.text}`;
+  });
+  if (effectiveCreditPosture(args.config, stored.endpoint, args.identity).posture === "off") {
+    return skip("posture_off");
   }
-  if (!args.providerInfo) {
-    return `This DVM's '/v1/info' hasn't been read here, so no Cashu offer is known to attach a proof to. ${release.text}`;
+  if (stored.status !== "active") return skip("not_active");
+  if (stored.reconciliationPending) return skip("reconciliation_pending");
+  if (stored.remainingMicro <= 0 && !stored.provisional) return skip("exhausted");
+  if (stored.expiryMs > 0 && stored.expiryMs <= now) return skip("expired");
+  if (stored.lastPriceMicro !== void 0 && args.btcRate > 0) {
+    const ceilingMicro = msatsToMicro(args.drawCeilingMsats, args.btcRate);
+    if (ceilingMicro > 0 && stored.lastPriceMicro > ceilingMicro) {
+      return skip("price_above_ceiling", {
+        ceilingMicro,
+        lastPriceMicro: stored.lastPriceMicro,
+        ceilingSource: args.drawCeilingSource
+      });
+    }
   }
-  return `This DVM publishes no Cashu offer for a proof to be locked to, so ecash can't fund it. ${release.text}`;
+  return { mode: "draw", creditId: stored.creditId, drawId: randomUUID3(), source: "prepaid" };
 }
-function releaseForcedRailHint(args) {
-  switch (args.railSource) {
-    case "per_dvm":
-      return {
-        text: `Run 'dvm credit rail --clear --dvm ${args.ref.endpoint}' to let the global pin or amount rule decide.`,
-        instruction: true
-      };
-    case "global":
-      return {
-        text: "Run 'dvm credit rail --clear' to let the amount rule decide.",
-        instruction: true
-      };
-    case "credit_bound":
-      return {
-        text: "This credit is bound to that rail by the DVM, so it can only be topped up over it \u2014 drain it and open a new credit to change rails.",
-        instruction: false
-      };
-    default:
-      return { text: "Drop --rail to let the CLI pick.", instruction: true };
-  }
+function needsTopup(balanceMicro, targetMicro) {
+  return targetMicro > 0 && balanceMicro < targetMicro * TOPUP_THRESHOLD_FRACTION;
 }
-function lowerFirst(value) {
-  return value.charAt(0).toLowerCase() + value.slice(1);
+function pocketTargetMicro(config) {
+  return parseCapMicro(config?.pocketTarget) ?? POCKET_TARGET_MICRO;
 }
-function unavailableDisplay(args, rail) {
-  const what = rail === "lightning" ? "over Lightning" : rail === "cashu" ? "with ecash" : rail === "x402" ? "over x402" : "";
-  return `No way to fund a prepaid credit at ${args.ref.endpoint}${what ? ` ${what}` : ""} right now.`;
+function needsPocketRefill(balanceMicro, targetMicro) {
+  return needsTopup(balanceMicro, targetMicro);
 }
-function microToSats2(micro, btcRate) {
-  return Math.ceil(usdToMsats(micro / 1e6, btcRate) / 1e3);
+function perDvmEntriesFor(config, endpoint, identity) {
+  const perDvm = config?.perDvm;
+  if (!perDvm) return [];
+  const key = normalizeCreditEndpoint(endpoint);
+  return Object.entries(perDvm).filter(
+    ([origin, per]) => normalizeCreditEndpoint(origin) === key || identity !== void 0 && per.dvmId === identity.dvmId && per.builderPubkey?.trim().toLowerCase() === identity.builderPubkey
+  );
 }
-function sha256Hex(value) {
-  return createHash4("sha256").update(value, "utf8").digest("hex");
+var POSTURE_STRICTNESS = { auto: 0, suggest: 1, off: 2 };
+function fundAmounts(fundMicro, btcRate) {
+  const fundSats = microToSats(fundMicro, btcRate);
+  return { fundMicro, fundSats, fundMsats: fundSats * 1e3 };
 }
-function isRecord(value) {
-  return !!value && typeof value === "object" && !Array.isArray(value);
+function completedReceiptsFor(receipts, endpoint, signingPubkey, identity) {
+  const key = normalizeCreditEndpoint(endpoint);
+  const requester = signingPubkey?.trim().toLowerCase();
+  if (!requester) return [];
+  const mine = (entry) => entry.receipt.requester_pubkey?.trim().toLowerCase() === requester && entry.receipt.outcome === "completed";
+  const here = [];
+  let anchor = identity;
+  for (const entry of receipts) {
+    if (normalizeCreditEndpoint(entry.endpoint) !== key || !mine(entry)) continue;
+    const verdict = verifyJobReceipt({ receipt: entry.receipt, builder: entry.builder });
+    if (verdict.status !== "verified" && verdict.status !== "verified_unattested") continue;
+    if (identity !== void 0) {
+      const attested = verdict.checks.attestation === "ok" ? attestedDvmIdentity(entry.builder) : void 0;
+      if (attested?.dvmId !== identity.dvmId || attested.builderPubkey !== identity.builderPubkey) {
+        continue;
+      }
+    }
+    here.push(entry);
+    if (anchor === void 0 && verdict.checks.attestation === "ok") {
+      anchor = attestedDvmIdentity(entry.builder);
+    }
+  }
+  if (!anchor) return here;
+  const elsewhere = receipts.filter((entry) => {
+    if (normalizeCreditEndpoint(entry.endpoint) === key || !mine(entry)) return false;
+    if (entry.receipt.dvm_id !== anchor.dvmId) return false;
+    const verdict = verifyJobReceipt({ receipt: entry.receipt, builder: entry.builder });
+    if (verdict.checks.attestation !== "ok") return false;
+    const attested = attestedDvmIdentity(entry.builder);
+    return attested?.dvmId === anchor.dvmId && attested.builderPubkey === anchor.builderPubkey;
+  });
+  return [...here, ...elsewhere];
 }
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+function targetJobsFor(config, endpoint, identity) {
+  const targets = perDvmEntriesFor(config, endpoint, identity).map(([, per]) => per.targetJobs).filter((jobs) => typeof jobs === "number" && Number.isFinite(jobs));
+  if (targets.length > 0) return Math.min(...targets);
+  return config?.targetJobs;
+}
+function lookupOverride(overrides, builderPubkey) {
+  if (!overrides) return void 0;
+  const key = builderPubkey.trim().toLowerCase();
+  for (const [pubkey, cap] of Object.entries(overrides)) {
+    if (pubkey.trim().toLowerCase() === key) return cap;
+  }
+  return void 0;
+}
+function parseCapMicro(cap) {
+  if (!cap) return void 0;
+  const match = /^\$?(\d+(?:\.\d{1,6})?)$/.exec(cap.trim());
+  if (!match) return void 0;
+  const micro = Math.round(Number(match[1]) * 1e6);
+  return micro > 0 ? micro : void 0;
 }
 
 // src/lib/messages/types.ts
@@ -9436,7 +9459,7 @@ async function probeX402(x402, timeoutMs) {
   let network;
   let address;
   try {
-    const { loadX402Wallet: loadX402Wallet2, getX402Balance: getX402Balance2, ensureAddress: ensureAddress2, usdcContractByCaip2: usdcContractByCaip22 } = await import("../x402-R6HPBY5D.js");
+    const { loadX402Wallet: loadX402Wallet2, getX402Balance: getX402Balance2, ensureAddress: ensureAddress2, usdcContractByCaip2: usdcContractByCaip22 } = await import("../x402-FT4S4JS4.js");
     const wallet = loadX402Wallet2();
     if (!wallet) {
       const storedKey = x402.privateKey;
@@ -9488,7 +9511,7 @@ async function probeMpp(mpp, timeoutMs) {
   if (!mpp) return null;
   if (mpp.method === "tempo") {
     try {
-      const { connectedTempoAccount: connectedTempoAccount2, getTempoUsdcBalance: getTempoUsdcBalance2, resolveTempoNetwork: resolveTempoNetwork2 } = await import("../tempo-wallet-B5XXV3YH.js");
+      const { connectedTempoAccount: connectedTempoAccount2, getTempoUsdcBalance: getTempoUsdcBalance2, resolveTempoNetwork: resolveTempoNetwork2 } = await import("../tempo-wallet-X2GGAZ6X.js");
       const account = await connectedTempoAccount2();
       if (!account) {
         return {
@@ -9633,10 +9656,12 @@ export {
   StepCache,
   TEMPO_CHAIN_ID,
   TEMPO_CHANNELS_FILE,
+  TEMPO_CHARGE_PENDING_STALE_MS,
   TEMPO_EXIT_KEY_MISSING_HINT,
   TEMPO_MODERATO_CHAIN_ID,
   TEMPO_MODERATO_RPC,
   TEMPO_PATH_USD_MODERATO,
+  TEMPO_SESSION_UPDATED_REASON,
   WALLET_FILE,
   WALLET_VERSION,
   X402EnvValidationError,
@@ -9662,6 +9687,9 @@ export {
   addPayment,
   advanceTempoChannelExit,
   amountBoundsVerdict,
+  appendBudgetSpend,
+  appendFundingReceipt,
+  appendReceipt,
   applyImplicitReceiptCredit,
   applyReceiptCredit,
   applyRetryToPool,
@@ -9669,8 +9697,12 @@ export {
   asProviderTextOpt,
   assertAgentMnemonicReplaceable,
   assertFloatBudget,
+  assertNoRivalX402Voucher,
   assertNutSupport,
   assertSupportedX402Network,
+  assertTempoSessionChallengeWithinAsk,
+  assertTempoSessionDepositWithinCap,
+  assertTempoSessionVoucherWithinAsk,
   assertTempoWalletIdle,
   assertValidBudget,
   assertX402ChannelPayer,
@@ -9683,8 +9715,10 @@ export {
   availableRails,
   backfillTrustAnchor,
   backupSecretFile,
+  bindCashuTokenToSubmissionContext,
   bindDiagnosticCapabilityAuthority,
   bindDiagnosticIdentityAuthority,
+  breakdownSince,
   buildAdminAuthHeader,
   buildAdminChallenge,
   buildAttestation,
@@ -9701,16 +9735,21 @@ export {
   canonicalRequestPath,
   canonicaliseForSigning,
   canonicalize,
+  capFor,
   captureFundingReceipt,
   captureTransportReceipt,
   cashOutFromMint,
   cashuSubmissionBindingFingerprint,
+  cashuSubmissionBindingFromContext,
   chainIdFromCaip2,
+  checkBudgetForLedger,
   checkMeltQuoteState,
   checkMintHealth,
   checkReceiptAttestation,
   clearCreditSelection,
   clearPendingDrain,
+  clearPendingFunding,
+  clearPendingTempoChargeFunding,
   clearPendingX402ExactFunding,
   clearPendingX402Funding,
   clearRefillRailUnavailable,
@@ -9728,16 +9767,22 @@ export {
   costAnchor,
   coveringMintsForSpend,
   createDiagnosticCapabilityAuthority,
+  createMintQuoteRetryState,
   createMonotonicClock,
   createNoopLogger,
   createStdoutLogger,
+  createTempoChannelStore,
   createTempoCloseCredential,
+  createTempoCreditSession,
+  createTempoSessionPaymentFetch,
   createX402BatchPayment,
   currentContext,
   decodePayment,
   decodePaymentRequiredHeader,
   deleteAgentMnemonic,
   deriveAgentMasterKeypair,
+  deriveAgentRefundSubkey,
+  deriveAgentRefundSubkeyPubkey,
   deriveBuilderLockKeypair,
   deriveBuilderLockPubkey,
   deriveIdentityFromPrivkey,
@@ -9832,6 +9877,7 @@ export {
   isPromptMessage,
   isPublicRequestId,
   isResumable,
+  isSignableExactRequirement,
   isSignedJobReceipt,
   isStablecoinFundRail,
   isTerminalJobStatus,
@@ -9854,9 +9900,11 @@ export {
   listX402Channels,
   loadAgentWallet,
   loadAllJobs,
+  loadBudgetLedger,
   loadConfig,
   loadConfiguredMints,
   loadCredit,
+  loadCreditX402Binding,
   loadFloat,
   loadIdentities,
   loadIdentitySecret,
@@ -9866,11 +9914,14 @@ export {
   loadPendingFunding,
   loadReceipt,
   loadReceipts,
+  loadResumableTempoChargeFunding,
   loadResumableX402ExactFunding,
   loadResumableX402Funding,
   loadTempoChannelAssociation,
+  loadTempoChannelAssociationByKey,
   loadTempoChannelController,
   loadTempoChannelEntry,
+  loadWalletConfiguredMints,
   loadX402Wallet,
   loggers,
   looksLikeMnemonic,
@@ -9881,7 +9932,9 @@ export {
   markJobTerminal,
   markRefillDrainNoticed,
   markRefillRailUnavailable,
+  maxAdvertisedMicro,
   maxKeysetDenomination,
+  meltAmountBounds,
   microToSats,
   missingDleqRecoveryDiagnostic,
   mnemonicFingerprint,
@@ -9898,7 +9951,11 @@ export {
   nwcDedupWindowMs,
   nwcRejectionDisplay,
   nwcTimeoutMs,
+  offersTempoCreditCharge,
   offersTempoCreditFunding,
+  offersTempoCreditSession,
+  offersX402CreditChannel,
+  offersX402CreditFlavour,
   offersX402CreditFunding,
   parseBudget,
   parseCreditMenu,
@@ -9915,6 +9972,7 @@ export {
   paymentRequiredV2FromV1,
   pendingDrainById,
   pendingDrainFor,
+  persistTempoOpenCredential,
   pickCreditFundRail,
   pinConfigSnapshot,
   pinDimension,
@@ -9935,6 +9993,7 @@ export {
   processX402BatchCorrection,
   processX402BatchResponse,
   processX402BatchResponseForWallet,
+  progress,
   projectDiagnosticFields,
   projectEventName,
   projectSpanRow,
@@ -9943,6 +10002,7 @@ export {
   railLabelAtSentenceStart,
   randomTraceId,
   raw,
+  readAgentMnemonic,
   readCompletedCreditHistory,
   readFundValuation,
   readX402ChannelOnChain,
@@ -9964,6 +10024,8 @@ export {
   recordFundResponse,
   recordFundingMenuSnapshot,
   recordPendingDrain,
+  recordPendingFunding,
+  recordPendingTempoChargeFunding,
   recordPendingX402ExactFunding,
   recordPendingX402Funding,
   recordRefusedDrawBalance,
@@ -9974,6 +10036,7 @@ export {
   redactUrlsInText,
   refFromJob,
   refundX402BatchChannel,
+  rehydrateOutputData,
   releaseAgentReserve,
   removeX402Wallet,
   renderReceiptHuman,
@@ -9994,10 +10057,14 @@ export {
   restoreProofsFromOutputs,
   retireConfigBackup,
   retirePendingX402Funding,
+  retireTempoChannel,
+  retireTempoChannelScope,
+  retryMintQuoteOperation,
   rollbackConfig,
   rpcEndpointLine,
   rpcEndpointSuffix,
   saveAgentWallet,
+  saveBudgetLedger,
   saveIdentities,
   saveJob,
   saveLedger,
@@ -10007,6 +10074,7 @@ export {
   setEmitter,
   setOutputTraceId,
   settleDrainEvidence,
+  sha256hex,
   shellQuoteArg,
   signAttestation,
   signDrainReceipt,
@@ -10015,6 +10083,7 @@ export {
   signReceipt,
   signRequestData,
   signedRequestDomain,
+  spendEntry,
   spendableAt,
   staleRateNotice,
   statusSnapshot,
@@ -10024,16 +10093,27 @@ export {
   sweepPendingMints,
   sweepPendingSubmissions,
   sweepStaleInFlight,
+  tempoAccountFromConfig,
   tempoBalanceCheckHint,
   tempoChannelControlledBy,
+  tempoChargeCredentialSettleable,
   tempoCredentialAmountMicro,
+  tempoCredentialValidBefore,
+  tempoDescriptorController,
   tempoKeyImportRoutes,
+  tempoSessionAssociationByKey,
   tempoSessionChallenge,
+  tempoSessionChallengeChannelScope,
   tempoSessionChallengeMicro,
+  tempoSessionCredentialChannelScope,
+  tempoSessionCredentialCumulativeMicro,
+  tempoSessionCumulativeCapMicro,
+  tempoSessionPriorCumulativeMicro,
   tempoTokenReference,
   tempoWrongAssetHint,
   tierCapOverrides,
   toAgentProof,
+  toCashuProofs,
   toFloatError,
   toLockPubkey,
   transportErrorCode,
@@ -10070,6 +10150,7 @@ export {
   walletExists,
   warmFxSnapshot,
   weakestReceiptVerdict,
+  windowEnd,
   windowStart,
   withIdentitiesLock,
   withInitRetry,
@@ -10078,6 +10159,8 @@ export {
   withTraceContext,
   withWalletLock,
   withX402ChannelLock,
+  withholdsTempoCreditSession,
+  withinAdvertisedTolerance,
   writeAgentMnemonic,
   writeIdentity,
   x402ChannelBalanceUnreconciledAt,
@@ -10085,8 +10168,11 @@ export {
   x402ChannelReservation,
   x402CreditChannelNetworks,
   x402CreditExactNetworks,
+  x402CreditFlavour,
+  x402CreditFundingNetworks,
   x402ExactFundingDead,
   x402FlavourForInstrument,
+  x402InstrumentForFlavour,
   x402NetworkByCaip2,
   x402NetworkBySlug,
   x402NetworkLabel,
@@ -10102,5 +10188,7 @@ export {
   x402ReservationRelease,
   x402SupportedNetworksHint,
   x402VoucherPendingRefusal,
+  x402VoucherPendingState,
+  x402WalletFromConfig,
   x402WrongAssetHint
 };