@dvmkit/sdk 0.6.0-rc.1 → 0.7.0-rc.1

package/dist/internal/caller.d.ts

@@ -1,16 +1,16 @@
-import { L as LightningTransactionListOptions, a as LightningTransactionSnapshot, b as LightningBackend, c as LightningPayment, d as LightningWalletInfo, C as CreatedInvoice, I as InvoiceStatus, M as MintAmountBounds, e as MintHealthCheckResult } from '../lightning-backend-40fIzz1W.js';
-export { A as AttestationPayload, B as BuilderIdentityKeypair, f as CheckMintHealthOptions, g as LockPubkey, h as amountBoundsVerdict, i as assertNutSupport, j as buildAttestation, k as canSwap, l as checkMintHealth, m as generateIdentity, n as hashCapabilities, o as loadIdentitySecret, s as signAttestation, t as toLockPubkey, v as verifyAttestation, w as writeIdentity } from '../lightning-backend-40fIzz1W.js';
-import { ProofLike, MeltQuoteBolt11Response, Proof, Wallet, SerializedDLEQ, MintQuoteBolt11Response, MintQuoteState, MintPreview, OutputDataLike, CounterSource, CounterRange } from '@cashu/cashu-ts';
+import { L as LightningTransactionListOptions, a as LightningTransactionSnapshot, b as LightningBackend, c as LightningPayment, d as LightningWalletInfo, C as CreatedInvoice, I as InvoiceStatus, M as MintAmountBounds, e as MintHealthCheckResult } from '../lightning-backend-Bw-qtAbt.js';
+export { A as AttestationPayload, B as BuilderIdentityKeypair, f as CheckMintHealthOptions, g as LockPubkey, h as amountBoundsVerdict, i as assertNutSupport, j as buildAttestation, k as canSwap, l as checkMintHealth, m as generateIdentity, n as hashCapabilities, o as loadIdentitySecret, p as meltAmountBounds, s as signAttestation, t as toLockPubkey, v as verifyAttestation, w as writeIdentity } from '../lightning-backend-Bw-qtAbt.js';
+import { ProofLike, MeltQuoteBolt11Response, Proof, Wallet, SerializedDLEQ, MintQuoteBolt11Response, MintQuoteState, MintPreview, OutputData, OutputDataLike, CounterSource, CounterRange } from '@cashu/cashu-ts';
 export { g as getWallet } from '../wallet-Dwjs5n_M.js';
-import { W as JsonValue, z as SignedRequestDomain, H as SignedRequestStatementHeader, X as FundingReceipt, Y as JobReceipt$1, y as SignedRequestAudience, _ as PaymentRequired, $ as X402Version, a0 as MppxCredential, a1 as Message, a2 as MessageType, a3 as MppxChallenge, a4 as X402_BATCH_SETTLEMENT_SCHEME, a5 as X402_EXACT_SCHEME, a6 as DrainReceipt, a7 as ReceiptCredit, C as Currency, a8 as X402Wallet, L as Logger$1, K as KVStore, a9 as ResourceInfo } from '../step-cache-CPdH1hei.js';
-export { aa as BuildPaymentRequirementsOpts, ab as CapabilityDescriptor, ac as CashuMode, ad as CompleteContent, ae as DrainReceiptEvent, af as ExactEvmPayload, ag as ExactEvmPayloadAuthorization, ah as FundingMethod, ai as MessageFrom, aj as PaymentPayload, ak as PaymentPayloadV1, al as PaymentPayloadV2, am as PaymentRequestContent, an as PaymentRequiredV2, ao as PaymentRequirements, ap as PaymentRequirementsV1, aq as PaymentRequirementsV2, ar as PromptContent, as as RAIL_REFUNDABLE, at as ReceiptOutcome, au as ReceiptPayment, av as SettleResponse, aw as StepCache, ax as StepRecord, ay as TextContent, az as UnsignedDrainReceipt, aA as UnsignedFundingReceipt, aB as UnsignedJobReceipt, aC as VerifyResponse, aD as WorkingContent, aE as X402Config, aF as X402ResponseBody, aG as X402SelfRelayRpcFailureReason, aH as X402_DEFAULT_NETWORK, aI as X402_V1_VERSION, aJ as X402_VERSION, aK as buildPaymentRequiredV2, aL as buildPaymentRequirements, aM as caip2ToX402Network, aN as canonicalRequestPath, aO as canonicaliseForSigning, aP as canonicalize, aQ as chainIdFromCaip2, aR as computeResultHash, aS as decodePayment, aT as decodePaymentRequiredHeader, aU as encodePayment, aV as encodePaymentRequiredHeader, aW as encodeSettleResponseHeader, aX as exactEvmAuthorization, aY as isArtifactMessage, aZ as isCancelMessage, a_ as isCompleteMessage, a$ as isDrainReceipt, b0 as isFundingReceipt, b1 as isPaymentRequestMessage, b2 as isPromptMessage, b3 as isSignedJobReceipt, b4 as isTextMessage, b5 as isWorkingMessage, b6 as paymentRequiredV2FromV1, b7 as signDrainReceipt, b8 as signFundingReceipt, b9 as signReceipt, ba as usdcContractByCaip2, bb as usdcContractFor, bc as usdcDomainNameFor, bd as usdcDomainVersionFor, be as verifyDrainReceipt, bf as verifyFundingReceipt, bg as verifyReceipt, bh as x402NetworkToCaip2 } from '../step-cache-CPdH1hei.js';
+import { W as JsonValue, z as SignedRequestDomain, H as SignedRequestStatementHeader, X as X402_BATCH_SETTLEMENT_SCHEME, Y as X402_EXACT_SCHEME, _ as FundingReceipt, $ as JobReceipt$1, y as SignedRequestAudience, a0 as PaymentRequired, a1 as X402Version, a2 as MppxCredential, a3 as Message, a4 as MessageType, a5 as MppxChallenge, a6 as DrainReceipt, a7 as ReceiptCredit, C as Currency, a8 as X402Wallet, L as Logger$1, K as KVStore, a9 as PaymentRequirementsV1, aa as PaymentRequirementsV2, ab as ResourceInfo } from '../step-cache-2MkvenJn.js';
+export { ac as BuildPaymentRequirementsOpts, ad as CapabilityDescriptor, ae as CashuMode, af as CompleteContent, ag as DrainReceiptEvent, ah as ExactEvmPayload, ai as ExactEvmPayloadAuthorization, aj as FundingMethod, ak as MessageFrom, al as PaymentPayload, am as PaymentPayloadV1, an as PaymentPayloadV2, ao as PaymentRequestContent, ap as PaymentRequiredV2, aq as PaymentRequirements, ar as PromptContent, as as RAIL_REFUNDABLE, at as ReceiptOutcome, au as ReceiptPayment, av as SettleResponse, aw as StepCache, ax as StepRecord, ay as TextContent, az as UnsignedDrainReceipt, aA as UnsignedFundingReceipt, aB as UnsignedJobReceipt, aC as VerifyResponse, aD as WorkingContent, aE as X402Config, aF as X402ResponseBody, aG as X402SelfRelayRpcFailureReason, aH as X402_DEFAULT_NETWORK, aI as X402_V1_VERSION, aJ as X402_VERSION, aK as buildPaymentRequiredV2, aL as buildPaymentRequirements, aM as caip2ToX402Network, aN as canonicalRequestPath, aO as canonicaliseForSigning, aP as canonicalize, aQ as chainIdFromCaip2, aR as computeResultHash, aS as decodePayment, aT as decodePaymentRequiredHeader, aU as encodePayment, aV as encodePaymentRequiredHeader, aW as encodeSettleResponseHeader, aX as exactEvmAuthorization, aY as isArtifactMessage, aZ as isCancelMessage, a_ as isCompleteMessage, a$ as isDrainReceipt, b0 as isFundingReceipt, b1 as isPaymentRequestMessage, b2 as isPromptMessage, b3 as isSignedJobReceipt, b4 as isTextMessage, b5 as isWorkingMessage, b6 as paymentRequiredV2FromV1, b7 as signDrainReceipt, b8 as signFundingReceipt, b9 as signReceipt, ba as usdcContractByCaip2, bb as usdcContractFor, bc as usdcDomainNameFor, bd as usdcDomainVersionFor, be as verifyDrainReceipt, bf as verifyFundingReceipt, bg as verifyReceipt, bh as x402NetworkToCaip2 } from '../step-cache-2MkvenJn.js';
 import { SimplePool } from 'nostr-tools/pool';
 import { Session } from 'mppx/tempo';
 import { Pool } from 'pg';
 import { PaymentRequired as PaymentRequired$1 } from '@x402/core/types';
 import { ClientChannelStorage, BatchSettlementClientContext, BatchSettlementEvmScheme } from '@x402/evm/batch-settlement/client';
-export { e as FX_CACHE_TTL_MS, g as FX_RETRY_COUNT, w as warmFxSnapshot } from '../fx-BgDmyTdd.js';
-export { c as InvalidUsdPriceError, p as parseUsdPrice } from '../usd-AWlrwlM5.js';
+export { e as FX_CACHE_TTL_MS, g as FX_RETRY_COUNT, w as warmFxSnapshot } from '../fx-zMWFzfrU.js';
+export { c as InvalidUsdPriceError, p as parseUsdPrice } from '../usd-DI3d3gTK.js';
 import 'hono';
 import 'mppx';
 import '@x402/core/server';
@@ -103,15 +103,16 @@ interface BudgetSpendBreakdown {
     /** USD moved into DVM prepaid credits. */
     creditFundingsUsd: number;
 }
-/** Load the persisted ledger. Returns an empty ledger if the file is missing or corrupt. */
-declare function loadLedger(): BudgetLedger;
-/**
- * Persist the ledger using a temp-file-and-rename so a crash mid-write cannot
- * leave a partial JSON on disk (which would silently reset configured caps).
- * Confirmed spending is retained indefinitely; budget checks apply their own
- * window cutoffs. The optional clock is retained for existing callers.
- */
-declare function saveLedger(ledger: BudgetLedger, _now?: Date): void;
+type BudgetCheckResult = {
+    ok: true;
+} | {
+    ok: false;
+    window: BudgetWindow;
+    spentUsd: number;
+    limitUsd: number;
+    resetsAt: number;
+    breakdown: BudgetSpendBreakdown;
+};
 interface RecordSpendOptions {
     msats: number;
     principalMsats?: number;
@@ -130,6 +131,28 @@ interface RecordSpendOptions {
     labelSource?: "provider";
     now?: Date;
 }
+/**
+ * Check whether a planned spend would exceed any configured cap.
+ * Returns the first window violated; if multiple windows would be exceeded,
+ * the daily window is reported first, then weekly, then monthly.
+ */
+declare function checkBudgetForLedger(ledger: BudgetLedger, opts: {
+    plannedMsats: number;
+    btcRate: number;
+    now?: Date;
+}): BudgetCheckResult;
+/** Normalise an entry's kind — legacy entries were all job spends. */
+declare function entryKind(entry: BudgetLedgerEntry): BudgetSpendKind;
+/** UTC-anchored start of the current window containing `now`. */
+declare function windowStart(window: BudgetWindow, now: Date): Date;
+/** UTC-anchored end (exclusive) of the current window containing `now`. */
+declare function windowEnd(window: BudgetWindow, now: Date): Date;
+declare function spendEntry(opts: RecordSpendOptions): BudgetLedgerEntry;
+declare function capFor(caps: BudgetCaps, window: BudgetWindow): number | undefined;
+declare function breakdownSince(entries: BudgetLedgerEntry[], sinceMs: number): BudgetSpendBreakdown;
+
+declare function loadLedger(): BudgetLedger;
+declare function saveLedger(ledger: BudgetLedger, _now?: Date): void;
 declare function recordSpend(opts: RecordSpendOptions): void;
 /**
  * Enforce the global budget caps before a planned spend.
@@ -160,10 +183,6 @@ declare function statusSnapshot(now?: Date): {
         breakdown: BudgetSpendBreakdown;
     }[];
 };
-/** Normalise an entry's kind — legacy entries were all job spends. */
-declare function entryKind(entry: BudgetLedgerEntry): BudgetSpendKind;
-/** UTC-anchored start of the current window containing `now`. */
-declare function windowStart(window: BudgetWindow, now: Date): Date;
 
 /** Stable response code for unavailable database-backed admin signer state. */
 declare const ADMIN_STATE_UNAVAILABLE = "admin_state_unavailable";
@@ -537,6 +556,108 @@ interface ConfigBackupInfo {
  */
 declare function describeConfigBackup(slot?: ConfigSnapshotSlot): ConfigBackupInfo | null;
 
+/** Which x402 funding flavour a top-up at this DVM would take. */
+type X402CreditFlavour = typeof X402_BATCH_SETTLEMENT_SCHEME | typeof X402_EXACT_SCHEME;
+/**
+ * Rails accepted by caller funding selection and pin validation. Each rail's orchestration still
+ * owns its availability and payment protocol.
+ */
+declare const CREDIT_FUND_RAILS: readonly ["cashu", "lightning", "x402", "tempo"];
+type CreditFundRail = (typeof CREDIT_FUND_RAILS)[number];
+/**
+ * Lightning invoices fund credit but do not provide a reclaim credential; reclaim uses the other
+ * supported payout rails.
+ */
+declare const CREDIT_DRAIN_RAILS: readonly ["cashu", "x402", "tempo"];
+type CreditDrainRail = (typeof CREDIT_DRAIN_RAILS)[number];
+declare function isCreditFundRail(value: unknown): value is CreditFundRail;
+/**
+ * The two rails that hold value in a stablecoin, and the only ones where the
+ * caller has an instrument to choose. Ecash and Lightning fund a
+ * credit by paying once; neither has a reusable form, so a funding mode narrows
+ * the eligible set to these two rather than reordering the whole list.
+ */
+declare const STABLECOIN_FUND_RAILS: readonly ["x402", "tempo"];
+declare function isStablecoinFundRail(rail: CreditFundRail): boolean;
+/**
+ * How a stablecoin credit funding is paid for — the customer-level choice
+ * underneath a rail.
+ *
+ * Both modes fund **prepaid credit**; they are not "pay one job" versus "buy
+ * credit". What differs is the instrument: a `one-shot` funding is a single
+ * payment that settles and is done, while a `reusable` one puts up channel
+ * collateral that later top-ups draw against. The rail-native names —
+ * `charge` / `session` on Tempo, `exact` / `batch-settlement` on x402 — are the
+ * wire spelling of the same two choices and stay subordinate to them.
+ */
+declare const CREDIT_FUNDING_MODES: readonly ["one-shot", "reusable"];
+/** One-shot payment or reusable channel collateral, for a stablecoin funding. */
+type CreditFundingMode = (typeof CREDIT_FUNDING_MODES)[number];
+declare function isCreditFundingMode(value: unknown): value is CreditFundingMode;
+declare function fundingModeForTempoIntent(intent: "charge" | "session"): CreditFundingMode;
+declare function fundingModeForX402Flavour(flavour: X402CreditFlavour): CreditFundingMode;
+/**
+ * The `fund.amount_micro` a fund-and-draw must sign for a token of
+ * `fundMsats`, mirroring the server's `fundedMicroFor` exactly:
+ * pro-rata at the quote-pinned ratio `priceMicroServer ↔ requiredMsats`,
+ * with the exact-payment case returning the fiat price with zero drift.
+ * Both inputs must be **server-authored**, and since the behavior was introduced both are exact
+ * integers on the same 402: `required_msats` and `price_micro`, resolved
+ * against one fx snapshot. A client-fx-derived figure — or one reconstructed by
+ * multiplying a rendered decimal price by a million — is refused with
+ * `funding_commitment_mismatch` after the spend has already committed. Taking
+ * the fiat half from a separate `/v1/quote` hop is the weaker fallback for
+ * providers that state no `price_micro`: that hop re-prices, so its figure and
+ * the 402's `required_msats` are two independent resolutions of one ratio.
+ *
+ * Cashu-shaped, which is all v1 funds on: x402 takes the same ratio against
+ * the 402's advertised `maxAmountRequired` in µUSDC rather than through
+ * millisatoshis, so a caller-side x402 fund needs its
+ * own derivation rather than this one.
+ */
+declare function fundWireAmountMicro(priceMicroServer: number, fundMsats: number, requiredMsats: number): number;
+/**
+ * What a `funding_commitment_mismatch` refusal says about the provider's own
+ * valuation of the artifact attached.
+ *
+ * The three cases are not interchangeable to a caller holding proofs that are
+ * already P2PK-locked to the provider: only `absent` means no re-sign can ever
+ * land, and only that case is safe to give up on.
+ */
+type FundValuation = 
+/** A usable figure. A corrected re-sign carries exactly this. */
+{
+    kind: "figure";
+    micro: number;
+}
+/** The provider stated a valuation, but not one that can be signed (zero, negative, fractional, out of range). */
+ | {
+    kind: "malformed";
+}
+/** No valuation stated at all: the commitment-hash branch, which re-signing can never fix. */
+ | {
+    kind: "absent";
+};
+/**
+ * Read the provider's valuation off a `funding_commitment_mismatch` body — the
+ * figure a corrected re-sign must carry. Prefers the structured
+ * `expected_micro` field; falls back to the figure the message states ("… at
+ * the quoted price (130769)") for providers that predate it, including when the
+ * structured field is present but unusable.
+ *
+ * A provider that stated *something* is on the amount branch even when what it
+ * stated is garbage, so that case returns `malformed` rather than `absent`. The
+ * two must not collapse: a caller that treats "the provider emitted a bad field"
+ * as "uncorrectable" drops the entry and burns proofs it could have held.
+ *
+ * Shared by both recovery legs: the in-flight retry in `request.ts` and the
+ * crash-resume sweep in `wallet-agent/recovery-submissions.ts`.
+ */
+declare function readFundValuation(fields: {
+    expectedMicro?: unknown;
+    message?: string;
+}): FundValuation;
+
 /**
  * Multi-rail abstraction for the agent wallet. Each `Rail` is a
  * concrete payment path the CLI knows how to execute end-to-end against a
@@ -559,6 +680,10 @@ type Rail = "cashu_p2pk" | "tempo" | "x402";
  */
 type RailFlag = "cashu" | "tempo" | "x402";
 declare const RAIL_FLAGS: readonly RailFlag[];
+/** The largest advertised figure {@link withinAdvertisedTolerance} accepts against `localMicro`. */
+declare function maxAdvertisedMicro(localMicro: bigint): bigint;
+/** True when the DVM's advertised amount is close enough to the caller's own to sign. */
+declare function withinAdvertisedTolerance(advertisedMicro: bigint, localMicro: bigint): boolean;
 
 interface Config {
     nwcUri?: string;
@@ -1247,6 +1372,35 @@ declare function floatBudgetJson(float: Pick<Float, "statedBudget">, walletRepor
  */
 declare function toFloatError(err: unknown): DvmError;
 
+/**
+ * The trust anchor a receipt chains to — `/v1/info#builder`, verbatim.
+ * Snapshotted alongside each stored receipt so verification stays offline and
+ * an exported bundle is self-verifying by a third party.
+ */
+interface ReceiptTrustAnchor {
+    /** Builder identity x-only pubkey (64 hex). */
+    pubkey: string;
+    /** Deploy-time attestation payload, as served. */
+    attestation: Record<string, unknown>;
+    /** BIP-340 signature over the attestation, under {@link pubkey}. */
+    signature: string;
+}
+/**
+ * What one live `/v1/info` read learned about an endpoint's trust anchor.
+ *
+ * The two ways to come back without an anchor are different facts and must not
+ * collapse into one: a DVM that answered and published no `builder` block has
+ * told us it has none, while a DVM we could not reach has told us nothing. A
+ * caller holding a previously pinned anchor needs them apart before it decides
+ * whether to drop it.
+ */
+interface TrustAnchorRead {
+    /** `true` when `/v1/info` answered — so an absent {@link anchor} is the DVM's own word. */
+    reachable: boolean;
+    /** The anchor as served. Absent when the DVM publishes none, or when unreachable. */
+    anchor?: ReceiptTrustAnchor;
+}
+
 /**
  * Receipt provenance requires a valid signature, an immutable DVM ID matching
  * the builder attestation, a signing key named by that attestation, and a
@@ -1268,19 +1422,7 @@ declare function toFloatError(err: unknown): DvmError;
  */
 type ReceiptVerification = "verified" | "verified_unattested" | "invalid" | "absent";
 type ReceiptInvalidReason = "job_id_mismatch" | "drain_id_mismatch" | "credit_id_mismatch" | "fund_id_mismatch" | "funding_amount_mismatch" | "funding_balance_mismatch" | "funding_ledger_seq_mismatch" | "caller_pubkey_mismatch" | "signature_invalid" | "attestation_invalid" | "dvm_identity_mismatch" | "receipt_key_mismatch" | "result_hash_mismatch";
-/**
- * The trust anchor a receipt chains to — `/v1/info#builder`, verbatim.
- * Snapshotted alongside each stored receipt so verification stays offline and
- * an exported bundle is self-verifying by a third party.
- */
-interface ReceiptTrustAnchor {
-    /** Builder identity x-only pubkey (64 hex). */
-    pubkey: string;
-    /** Deploy-time attestation payload, as served. */
-    attestation: Record<string, unknown>;
-    /** BIP-340 signature over the attestation, under {@link pubkey}. */
-    signature: string;
-}
+
 /**
  * The pair two hostnames must present identically before caller state may be
  * pooled across them.
@@ -2295,6 +2437,7 @@ interface DescribeOptions {
 
 type ChannelStore = ReturnType<typeof Session.Client.createJsonChannelStore>;
 type ChannelEntry = NonNullable<Awaited<ReturnType<ChannelStore["get"]>>>;
+type TempoChannelDescriptor = ChannelEntry["descriptor"];
 /** A durable link from a local Tempo channel to one DVM prepaid credit. */
 interface TempoChannelAssociation {
     /** Normalised DVM origin. */
@@ -2320,6 +2463,12 @@ interface TempoChannelAssociation {
     /** Epoch ms of the latest channel-store update. */
     updatedAt: number;
 }
+interface TempoChannelStoreContext {
+    callerPubkey: string;
+    endpoint?: string;
+    creditId?: string;
+    operator?: string;
+}
 /**
  * A one-shot Tempo `charge` retained until its funding response is
  * acknowledged.
@@ -2385,6 +2534,14 @@ interface PendingTempoChargeFunding {
      */
     credentialValidBefore?: number;
 }
+/**
+ * How long an unanswered charge holds its credit before the journal gives up on
+ * it. A backstop rather than the usual exit: every definite answer from the DVM
+ * funded, refused, bound elsewhere — clears the entry outright, so the only
+ * way to reach this line is a DVM that stayed unreachable for a day, during
+ * which no rail could have funded that credit anyway.
+ */
+declare const TEMPO_CHARGE_PENDING_STALE_MS: number;
 /**
  * Serialize channel voucher and lifecycle transitions across CLI processes.
  * TIP-1034 credentials advance cumulative authority from durable state, so
@@ -2392,8 +2549,11 @@ interface PendingTempoChargeFunding {
  * around individual storage calls.
  */
 declare function withTempoChannelLock<T>(operation: () => Promise<T>): Promise<T>;
+/** Create mppx's JSON channel store over the caller's durable state file. */
+declare function createTempoChannelStore(context: TempoChannelStoreContext): ChannelStore;
 declare function listTempoChannelAssociations(): TempoChannelAssociation[];
 declare function loadTempoChannelAssociation(endpoint: string, callerPubkey: string, creditId: string): TempoChannelAssociation | undefined;
+declare function loadTempoChannelAssociationByKey(callerPubkey: string, operator: string, channelKey: string): TempoChannelAssociation | undefined;
 declare function loadTempoChannelEntry(association: TempoChannelAssociation): Promise<ChannelEntry | undefined>;
 /**
  * The wallets a recorded channel's descriptor authorizes over its collateral.
@@ -2417,17 +2577,55 @@ interface TempoChannelController {
  * what {@link tempoChannelControlledBy} calls a stranger's channel.
  */
 declare function loadTempoChannelController(association: TempoChannelAssociation): Promise<TempoChannelController | undefined>;
+/**
+ * Who a channel descriptor names, in the form {@link tempoChannelControlledBy}
+ * compares, or `undefined` when it names no payer at all.
+ *
+ * A descriptor without a payer is as unattributable as a missing one, and gets
+ * the same answer: nothing is claimed about whose channel it is. The signer is
+ * normalised the way `operator` is on the way in — an absent one is unset — and
+ * the delegation itself is mppx's own rule, so a change to what "unset" means
+ * cannot quietly widen what counts as a stranger's channel.
+ */
+declare function tempoDescriptorController(descriptor: TempoChannelDescriptor): TempoChannelController | undefined;
 /**
  * Either payer or delegated signer controls the channel. Unknown ownership is
  * treated as controlled; with a known controller, an absent address does not match.
  */
 declare function tempoChannelControlledBy(controller: TempoChannelController | undefined, address: string | undefined): boolean;
+/** Forget a settled/closed channel and its credit association. */
+declare function retireTempoChannel(association: TempoChannelAssociation): Promise<void>;
+/** Forget a terminal channel, every credit associated with it, and its shared entry. */
+declare function retireTempoChannelScope(association: TempoChannelAssociation): Promise<void>;
+/**
+ * Whether the journalled credential can still settle, which decides only
+ * whether a resume re-presents it or signs a fresh one under the same fund id.
+ * Never a safety gate: a stale credential presented anyway is refused by the
+ * rail, and an entry whose deadline could not be read is treated as spent.
+ */
+declare function tempoChargeCredentialSettleable(pending: PendingTempoChargeFunding, now?: number): boolean;
+/** Persist a verbatim charge credential before it is submitted, replacing this credit's last. */
+declare function recordPendingTempoChargeFunding(pending: PendingTempoChargeFunding): void;
+/** The charge funding this credit can still resume, if any. */
+declare function loadResumableTempoChargeFunding(args: {
+    endpoint: string;
+    callerPubkey: string;
+    creditId: string;
+    now?: number;
+}): PendingTempoChargeFunding | undefined;
 /** Every charge funding a sweep could still resume, optionally scoped to one DVM identity. */
 declare function listResumableTempoChargeFundings(filter?: {
     endpoint?: string;
     callerPubkey?: string;
     now?: number;
 }): PendingTempoChargeFunding[];
+/**
+ * Forget one charge funding, because the DVM answered for it or it went stale.
+ * Matched on the fund id as well as the credit key, so a sweep clearing a
+ * lapsed entry cannot drop a fresher one a sibling process journalled in the
+ * meantime.
+ */
+declare function clearPendingTempoChargeFunding(pending: PendingTempoChargeFunding): void;
 
 /** Dependency-free display names for the token selected by a stablecoin rail. */
 interface RailAsset {
@@ -2610,10 +2808,169 @@ declare function generateTempoKey(opts?: {
 declare function getTempoUsdcBalance(account: TempoAccount): Promise<TempoBalance>;
 declare function deriveTempoAddress(privateKey: `0x${string}`): Promise<`0x${string}`>;
 
+declare function offersTempoCreditSession(menu: CreditMenu | undefined): boolean;
+declare function offersTempoCreditCharge(menu: CreditMenu | undefined): boolean;
+/**
+ * True when a credit menu names `tempo/session` under `withheld` — the DVM is
+ * configured for reusable sessions and is pausing them.
+ *
+ * Distinct from "absent", and the distinction is what a caller acts on. The
+ * pause covers *new* channels only, so a caller already holding an open channel
+ * on this credit may still top it up: the DVM issues that credit a session
+ * challenge, and a one-shot charge is refused against a channel-bound credit
+ * anyway. Absent means the DVM never offered sessions at all, where attempting
+ * one buys nothing.
+ */
+declare function withholdsTempoCreditSession(menu: CreditMenu | undefined): boolean;
 declare function offersTempoCreditFunding(menu: CreditMenu | undefined): boolean;
 type TempoSessionClientResolver = NonNullable<NonNullable<Parameters<typeof Session.Client.session>[0]>["getClient"]>;
 type TempoSessionMethod = ReturnType<typeof Session.Client.session>;
 type TempoSessionChallenge = Parameters<TempoSessionMethod["createCredential"]>[0]["challenge"];
+/** Fetch shape used by mppx's challenge-aware Tempo session wrapper. */
+type TempoSessionPaymentFetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+/** Caller-side scope that keeps mppx's reusable key local to one DVM operator. */
+interface TempoSessionChannelScope {
+    channelKey: string;
+    operator: string;
+}
+declare function createTempoCreditSession(args: {
+    account: TempoAccount;
+    endpoint: string;
+    callerPubkey: string;
+    creditId: string;
+    maxDepositMicro: number;
+    topUpAmountMicro: number;
+    operator?: string;
+    getClient?: TempoSessionClientResolver;
+}): ReturnType<typeof Session.Client.session>;
+/** Wrap a credit POST bridge so mppx runs its automatic open/top-up hooks. */
+declare function createTempoSessionPaymentFetch(method: TempoSessionMethod, fetch: typeof globalThis.fetch): TempoSessionPaymentFetch;
+/** Resolve mppx's payment key together with the DVM operator that may reuse it. */
+declare function tempoSessionChallengeChannelScope(challenge: TempoSessionChallenge | undefined): TempoSessionChannelScope | undefined;
+/** Resolve the operator-local payment scope carried by a saved session credential. */
+declare function tempoSessionCredentialChannelScope(credential: string): TempoSessionChannelScope | undefined;
+/** Find the existing channel a Tempo session challenge or credential will actually reuse. */
+declare function tempoSessionAssociationByKey(args: {
+    endpoint: string;
+    callerPubkey: string;
+    channelScope: TempoSessionChannelScope | undefined;
+    creditId: string;
+}): TempoChannelAssociation | undefined;
+/**
+ * What the reusable channel this funding will use has already authorized,
+ * in USD micro-units — the cumulative every ceiling on this leg is rebased over.
+ *
+ * A provisional entry (`opened: false`, written before an open is broadcast)
+ * reads as zero, because nothing on it has been authorized yet.
+ */
+declare function tempoSessionPriorCumulativeMicro(args: {
+    endpoint: string;
+    callerPubkey: string;
+    creditId: string;
+    association?: TempoChannelAssociation;
+}): number;
+/** Rebase one funding allowance over a reusable channel's cumulative authorization. */
+declare function tempoSessionCumulativeCapMicro(args: {
+    endpoint: string;
+    callerPubkey: string;
+    creditId: string;
+    allowanceMicro: number;
+    amountMicro: number;
+    association?: TempoChannelAssociation;
+}): number;
+/**
+ * Refuse to broadcast a session credential that would push the credit's
+ * channel deposit above the cap the caller authorized.
+ *
+ * mppx applies that cap before it signs, on every automatic path — its open
+ * clamps the DVM's `suggestedDeposit` to it and refuses a challenge amount
+ * over it, and its top-up refills only the headroom left under it. This is the
+ * belt: dvmkit has no hook between mppx's plan and its signature, so the check
+ * lands on the figure the finished credential commits, which is also the only
+ * figure that can be read rather than trusted. Pre-broadcast is still binding
+ * for a deposit — this bridge is the sole conduit to the DVM and the chain, so
+ * a signed transaction that is never sent locks nothing. The voucher
+ * cumulative rides in a signature rather than a transaction, so it is guarded on
+ * both sides of the signing instead: {@link assertTempoSessionChallengeWithinAsk}
+ * before and {@link assertTempoSessionVoucherWithinAsk} after.
+ */
+declare function assertTempoSessionDepositWithinCap(args: {
+    credential: string;
+    endpoint: string;
+    callerPubkey: string;
+    creditId: string;
+    capMicro: number;
+    channelScope?: TempoSessionChannelScope;
+}): void;
+/**
+ * Refuse a session challenge that asks for materially more than the funding it
+ * is paying for — before mppx signs anything.
+ *
+ * The deposit ceiling above bounds the collateral a channel locks; this bounds
+ * the money the DVM can actually capture out of it. They are different numbers
+ * on purpose: the caller's per-channel allowance is deliberately sized above one
+ * funding so auto-top-up has headroom, and mppx spends that one figure as both
+ * its deposit ceiling and its voucher ceiling — so a challenge naming several
+ * times the ask signs cleanly under it.
+ *
+ * The basis is the funding ask, and the figure measured against it is the
+ * challenge amount, because that amount is always the *delta*: on an open it
+ * becomes the whole cumulative, on a reused channel mppx adds it to a cumulative
+ * the caller already authorized. The tolerance is the shared stablecoin one —
+ * both sides convert dollars from their own BTC/USD rate, so a small
+ * disagreement is legitimate and a large one is a different price.
+ *
+ * Pre-signature is not pre-collateral: a session can re-challenge after mppx has
+ * already opened a channel or had a management top-up accepted, so the refusal
+ * copy claims only that no voucher was signed, and names the recovery path for
+ * collateral this funding may already have locked.
+ */
+declare function assertTempoSessionChallengeWithinAsk(args: {
+    challenges: readonly MppxChallenge[];
+    basisMicro: number;
+}): void;
+/**
+ * The cumulative capture authority a session credential hands the DVM, in USD
+ * micro-units. `undefined` when the credential authorizes none — a management
+ * top-up moves collateral without naming a cumulative, and a replayed journal
+ * entry or hand-rolled header is not an mppx credential at all.
+ */
+declare function tempoSessionCredentialCumulativeMicro(credential: string): number | undefined;
+/**
+ * Refuse to broadcast a signed voucher that authorizes materially more capture
+ * than the funding it pays for.
+ *
+ * The belt behind {@link assertTempoSessionChallengeWithinAsk}: that one bounds
+ * a single challenge, and mppx retries a 402 up to five times, so a DVM that
+ * keeps re-challenging at the honest amount would otherwise walk the cumulative
+ * up one ask at a time until it hit the whole per-channel allowance. This bounds
+ * the total for the funding regardless of how many times mppx signs, and it
+ * reads the figure off the credential rather than trusting the challenge that
+ * produced it. Pre-broadcast is binding here for the same reason it is for the
+ * deposit — this bridge is the sole conduit to the DVM, and a voucher that never
+ * leaves the process authorizes nothing.
+ *
+ * `authorizedMicro` is the delta over the cumulative already authorized when
+ * this funding began, so a reused channel is measured on what this funding adds
+ * rather than on everything the channel has ever agreed to pay.
+ *
+ * Collateral is a separate question from capture authority: the open or the
+ * management top-up earlier in this same funding may already have moved some,
+ * so the copy claims only what it knows about the voucher and names the verb
+ * that gets the collateral back.
+ */
+declare function assertTempoSessionVoucherWithinAsk(args: {
+    authorizedMicro: number;
+    basisMicro: number;
+}): void;
+/** Persist an open credential before broadcast so a lost response remains recoverable. */
+declare function persistTempoOpenCredential(args: {
+    credential: string;
+    endpoint: string;
+    callerPubkey: string;
+    creditId: string;
+    opened: boolean;
+}): Promise<boolean>;
 /** Read the first Tempo session challenge retained on a `/v1/credit` error. */
 declare function tempoSessionChallenge(err: unknown): TempoSessionChallenge | undefined;
 /**
@@ -2782,8 +3139,6 @@ declare function reconcileTempoChannelOnChain(args: {
  * loop asks without pulling the signing stack in behind it.
  */
 
-/** Which x402 funding flavour a top-up at this DVM would take. */
-type X402CreditFlavour = typeof X402_BATCH_SETTLEMENT_SCHEME | typeof X402_EXACT_SCHEME;
 /**
  * The same two flavours in the server's words.
  *
@@ -2808,6 +3163,31 @@ type X402CreditInstrument = "x402_exact" | "x402_channel";
  * planner's gate can stay scheme-level, the funding loop's is network-exact.
  */
 declare function offersX402CreditFunding(menu: CreditMenu | undefined, network?: string): boolean;
+/**
+ * True when a menu offers a reusable x402 channel this caller could actually
+ * open — the x402 twin of `offersTempoCreditSession`.
+ *
+ * Narrower than {@link offersX402CreditFunding} on purpose: an exact-only DVM
+ * is fundable but opens nothing to amortize across top-ups, and only the
+ * channel question can distinguish "reconnect on their chain" from "this DVM
+ * opens no channel at all" in the forced-rail hint.
+ */
+declare function offersX402CreditChannel(menu: CreditMenu | undefined, network?: string): boolean;
+/**
+ * Which flavour to attempt on this wallet's chain, or `undefined` when neither
+ * is offered there. The channel wins wherever both are advertised: a deposit
+ * amortizes across every later top-up, where an exact authorization costs a
+ * round trip and a signature each time.
+ */
+declare function x402CreditFlavour(menu: CreditMenu | undefined, network: string): X402CreditFlavour | undefined;
+/**
+ * True when a menu offers one *named* flavour on this wallet's chain — the
+ * question a credit already bound to that flavour has to ask, where
+ * {@link x402CreditFlavour}'s preference is beside the point.
+ */
+declare function offersX402CreditFlavour(menu: CreditMenu | undefined, network: string, flavour: X402CreditFlavour): boolean;
+/** The binding a funding over this flavour leaves on the credit. */
+declare function x402InstrumentForFlavour(flavour: X402CreditFlavour): X402CreditInstrument;
 /**
  * The flavour a recorded binding pins, or `undefined` for anything that isn't
  * one of x402's two. A cross-rail refusal names its own instrument
@@ -2823,6 +3203,13 @@ declare function x402FlavourForInstrument(instrument: string | undefined): X402C
 declare function x402CreditChannelNetworks(menu: CreditMenu | undefined): string[];
 /** Chains this menu takes a per-call `exact` credit top-up on. */
 declare function x402CreditExactNetworks(menu: CreditMenu | undefined): string[];
+/**
+ * Every chain this menu takes an x402 top-up on, either flavour, deduplicated.
+ * The set a "your wallet is on the wrong chain" hint has to name — pinning to
+ * the channel networks alone would tell an exact-only DVM's caller to reconnect
+ * to nowhere.
+ */
+declare function x402CreditFundingNetworks(menu: CreditMenu | undefined): string[];
 
 /**
  * Funds prepaid credit over Cashu, Lightning, x402 or Tempo. Before payment, an unavailable rail
@@ -2835,47 +3222,9 @@ declare function x402CreditExactNetworks(menu: CreditMenu | undefined): string[]
  */
 
 /**
- * Rails accepted by caller funding selection and pin validation. Each rail's orchestration still
- * owns its availability and payment protocol.
- */
-declare const CREDIT_FUND_RAILS: readonly ["cashu", "lightning", "x402", "tempo"];
-type CreditFundRail = (typeof CREDIT_FUND_RAILS)[number];
-/**
- * Lightning invoices fund credit but do not provide a reclaim credential; reclaim uses the other
- * supported payout rails.
- */
-declare const CREDIT_DRAIN_RAILS: readonly ["cashu", "x402", "tempo"];
-type CreditDrainRail = (typeof CREDIT_DRAIN_RAILS)[number];
-declare function isCreditFundRail(value: unknown): value is CreditFundRail;
-/**
- * The two rails that hold value in a stablecoin, and the only ones where the
- * caller has an instrument to choose. Ecash and Lightning fund a
- * credit by paying once; neither has a reusable form, so a funding mode narrows
- * the eligible set to these two rather than reordering the whole list.
- */
-declare const STABLECOIN_FUND_RAILS: readonly ["x402", "tempo"];
-declare function isStablecoinFundRail(rail: CreditFundRail): boolean;
-/**
- * How a stablecoin credit funding is paid for — the customer-level choice
- * underneath a rail.
- *
- * Both modes fund **prepaid credit**; they are not "pay one job" versus "buy
- * credit". What differs is the instrument: a `one-shot` funding is a single
- * payment that settles and is done, while a `reusable` one puts up channel
- * collateral that later top-ups draw against. The rail-native names —
- * `charge` / `session` on Tempo, `exact` / `batch-settlement` on x402 — are the
- * wire spelling of the same two choices and stay subordinate to them.
- */
-declare const CREDIT_FUNDING_MODES: readonly ["one-shot", "reusable"];
-/** One-shot payment or reusable channel collateral, for a stablecoin funding. */
-type CreditFundingMode = (typeof CREDIT_FUNDING_MODES)[number];
-declare function isCreditFundingMode(value: unknown): value is CreditFundingMode;
-declare function fundingModeForTempoIntent(intent: "charge" | "session"): CreditFundingMode;
-declare function fundingModeForX402Flavour(flavour: X402CreditFlavour): CreditFundingMode;
-/**
- * Where a forced rail came from. Kept apart because they are not
- * the same claim: the first three are the caller's preference, the fourth is
- * the DVM's ledger refusing to blend two rails' native value.
+ * Where a forced rail came from. Kept apart because they are not
+ * the same claim: the first three are the caller's preference, the fourth is
+ * the DVM's ledger refusing to blend two rails' native value.
  */
 type CreditRailSource = 
 /** `--rail` on this invocation. */
@@ -3212,488 +3561,115 @@ interface CompletedCreditHistoryPage {
 }
 
 /**
- * The terminal-outcome fields a job carries once it is over — the summary, the
- * artifact metadata, and (on a failure) the provider's message. Read off a
- * transport receipt / status response, persisted on the local job record
- * and rendered into the JSON payload by `buildCompletionHintFields`.
- */
-interface JobCompletion {
-    /** Human-readable one-liner. Not the payload when artifacts are present. */
-    summary?: string;
-    /** Provider's status message (typically on a failed job). */
-    message?: string;
-    /** True when the provider emitted artifact messages. */
-    hasArtifacts?: boolean;
-    /** Count of artifact messages (present when `hasArtifacts` is true). */
-    artifactCount?: number;
-    /** Where the payload sits: the `summary` string, or in artifact messages. */
-    payloadIn?: "summary" | "messages";
-}
-/**
- * Build the snake_case JSON fields (`has_artifacts`, `artifact_count`,
- * `payload_in`, `next_step_hint`) from a transport receipt or status response.
- * Returns an object meant to be spread into the parent JSON payload — agents
- * relaying a completed-job response need these to know the summary string is
- * a one-liner, not the payload, when the real output sits in artifact messages
- */
-declare function buildCompletionHintFields(jobId: string, input: JobCompletion): Record<string, unknown>;
-/** `--no-stream` replays from seq 0: the stored cursor may already be past the artifacts. */
-declare function nextStepHint(jobId: string, payloadIn: "summary" | "messages" | undefined, artifactCount: number | undefined): string | undefined;
-/**
- * Pick the terminal-outcome fields off a receipt or status response, dropping
- * the ones the provider didn't send. What lands here is what `dvm status`
- * replays from the local record on every later read, so it must be
- * exactly the set the wire read would have rendered — no defaults, no guesses.
- */
-declare function completionSnapshot(src: JobCompletion): JobCompletion;
-/**
- * Derive the terminal snapshot from a streamed message log, for the paths that
- * learn a job is over from the stream rather than a status response. Mirrors
- * the SDK's own derivation (`statusCompletionFields`, `src/sdk/server/app.ts`):
- * `payload_in` is `"messages"` iff any `artifact` message was emitted. Requires
- * the full log (from seq 0) — a partial batch would undercount the artifacts.
- */
-declare function completionFromMessages(messages: Message[]): JobCompletion;
-
-/**
- * Free text supplied by a provider. Agents should treat fields wrapped in this
- * shape with appropriate skepticism — they are subject to prompt injection,
- * social engineering, or simply contain unverified claims about the job.
+ * Per-DVM prepaid-credit working record (`~/.dvm/credits.json`).
  *
- * Wrapping is the structural marker; the JSON shape `{ _source: "provider", text: "..." }`
- * lets an agent's framework distinguish provider-controlled content from CLI-owned
- * instructions without inspecting field paths.
+ * This file is the caller's *expectation*: what it believes each credit's
+ * spendable balance to be, projected from the DVM-signed artifacts it has
+ * already collected (fund responses, job receipts, drain records). It is
+ * bookkeeping, not evidence — the signed balance trajectory lives in
+ * `~/.dvm/receipts.jsonl`, and a mismatch between this file's projection and
+ * a freshly countersigned `balance_after` is exactly what
+ * {@link applyReceiptCredit} exists to surface.
+ *
+ * Mutable working set in the `budget.json` mold: one JSON object, temp-file +
+ * rename writes, malformed *entries* tolerated on read. A malformed **file**
+ * is not: damaged bytes are moved aside and named in the error rather than
+ * replaced with an empty store, a file we merely failed to *open* is left
+ * exactly where it is, and every cycle that touches the store runs under
+ * {@link withCreditLock}.
  */
-interface ProviderText {
-    _source: "provider";
-    text: string;
-}
-/** Wrap a string as provider-supplied text. */
-declare function asProviderText(text: string): ProviderText;
-/** Wrap a string only if defined; passes through undefined. */
-declare function asProviderTextOpt(text: string | undefined): ProviderText | undefined;
-/** Render a ProviderText (or string) back to plain text — used by --human output paths. */
-declare function providerTextToString(value: string | ProviderText): string;
 
-type NextAction = null | NextActionRespond | NextActionPay | NextActionApprove | NextActionPoll | NextActionRefund;
-interface NextActionRespond {
-    type: "respond";
-    job_id: string;
-    prompt_id: string;
-    /** The provider's question. Treat with appropriate skepticism. */
-    prompt: ProviderText;
-    schema?: Record<string, unknown>;
-    /** CLI-owned guidance for the agent. */
-    hint: string;
-}
-interface NextActionPay {
-    type: "pay";
-    job_id: string;
-    amount_msats: number;
+type StoredCreditStatus = "active" | "expired" | "gone" | "drained" | "unbacked";
+/** A drain in flight — persisted so a re-invoked `dvm credit drain` polls the same id. */
+interface PendingDrain {
+    /** Caller-minted drain id; doubles as the poll/pickup key server-side. */
+    drainId: string;
     /**
-     * The provider's own fiat price for this charge, when it priced in fiat.
-     * Mirrors the wire's `fiat_amount` so a typed agent can do budget math
-     * against the figure the human is actually being asked to approve.
+     * The server keys drains by (credit_id, drain_id). Only an exact pairing may be auto-reused.
+     * Legacy unstamped entries remain visible but require an explicitly supplied pairing; they
+     * cannot suppress later top-ups.
      */
-    fiat_amount?: {
-        amount: number;
-        currency: string;
-    };
-    display: string;
-    /** The provider's stated reason for the charge. Treat with appropriate skepticism. */
-    reason: ProviderText;
-    /** CLI-owned guidance for the agent. */
-    hint: string;
-}
-/** Provider delivered something and is waiting for sign-off. */
-interface NextActionApprove {
-    type: "approve";
-    job_id: string;
-    artifact_seq: number;
-    hint: string;
-}
-/**
- * Provider is working — nothing for the client to do right now.
- * `hint` is a `ProviderText` when supplied by the provider; a plain `string` is the CLI fallback.
- */
-interface NextActionPoll {
-    type: "poll";
-    job_id: string;
-    estimate_seconds?: number;
-    hint: string | ProviderText;
+    creditId?: string;
+    method: string;
+    /** Payout destination as signed into the drain request — immutable server-side. */
+    payout: Record<string, string>;
+    /** Epoch ms the drain was first requested. */
+    requestedAt: number;
+    /** Verbatim cooperative-close Authorization value, saved before transmission. */
+    mppCredential?: string;
 }
 /**
- * Provider sent an inbound Cashu payment (refund/change). The CLI auto-claims
- * the proofs; this surfaces the outcome to the agent. `claimed: false` means the
- * claim could not complete (e.g. mint down) and `cashu_token` carries the raw
- * token for manual recovery.
+ * A durable credit funding in flight.
+ *
+ * Kept outside {@link StoredCredit}: an opening funding must be durable before
+ * its invoice request, when no server-confirmed credit exists yet.
  */
-interface NextActionRefund {
-    type: "refund";
-    job_id: string;
-    amount_msats: number;
-    display: string;
-    reason: "refund" | "change";
-    /** Whether the proofs were auto-claimed into the local wallet. */
-    claimed: boolean;
-    /** Raw Cashu token — present only when the auto-claim failed, for manual recovery. */
-    cashu_token?: string;
-    /** CLI-owned guidance for the agent. */
-    hint: string;
+interface PendingFunding {
+    /** Normalised endpoint origin the funding was requested from. */
+    endpoint: string;
+    /** x-only pubkey of the signing identity that owns the funding. */
+    callerPubkey: string;
+    /** Caller-minted credit id the invoice is bound to. */
+    creditId: string;
+    /** Caller-minted idempotency key the invoice is bound to. */
+    fundId: string;
+    /** Requested funding amount, in the credit currency's micro-units. */
+    amountMicro: number;
+    /** Funding rail whose money-moving credential must be replayed verbatim. */
+    rail: "lightning" | "tempo";
+    /** Refill target to retain when the funding becomes a stored credit. */
+    targetMicro: number;
+    /** Additional deposit authorization allowed for this durable MPP funding. */
+    maxDepositMicro?: number;
+    /** Funding-menu snapshot to retain when the funding becomes a stored credit. */
+    menu?: CreditMenu;
+    /** Epoch ms the funding intent was first persisted. */
+    requestedAt: number;
+    /** Bolt11 returned by the DVM, once one has been issued. */
+    bolt11?: string;
+    /** Payment hash returned alongside {@link PendingFunding.bolt11}. */
+    paymentHash?: string;
+    /** Invoice amount, in millisatoshis. */
+    amountMsats?: number;
+    /** Absolute invoice expiry, epoch ms. */
+    expiresAtMs?: number;
+    /** Paid invoice principal, in millisatoshis. Present only after money moved. */
+    principalMsats?: number;
+    /** Wallet-reported routing fee. Null means the wallet omitted it. */
+    routingFeeMsats?: number | null;
+    /** Total wallet fee from an exact debit. Null means the total is unprovable. */
+    totalWalletFeeMsats?: number | null;
+    /** Wallet fee not itemized as routing. Null means the split is unprovable. */
+    unitemizedWalletFeeMsats?: number | null;
+    /** Exact wallet debit. Null means wallet evidence could not prove it. */
+    walletDebitMsats?: number | null;
+    /** How the caller wallet reached settlement. */
+    paymentOutcome?: "paid" | "reconciled" | "republished";
+    /** Serialized MPP Authorization credential, persisted before its network send. */
+    mppCredential?: string;
+    /**
+     * What this funding's Tempo session voucher actually authorizes the DVM to
+     * capture, in micro-units — the cumulative it signed, net of whatever the
+     * channel had already authorized when the funding began. Journalled beside
+     * {@link PendingFunding.mppCredential} so a resume books the authorization
+     * rather than the ask.
+     */
+    authorizedMicro?: number;
+    /**
+     * Budget-ledger valuation fixed before an MPP channel credential is created.
+     * The debit itself is not journalled: it is this rate applied to
+     * {@link PendingFunding.authorizedMicro}, so a resume books the figure the
+     * credential authorized rather than one fixed before it existed.
+     */
+    budgetBtcRate?: number;
 }
-/** A job status that means the job is over — nothing left for the caller to do. */
-type TerminalJobStatus = "completed" | "failed" | "cancelled";
 /**
- * True when a job status means the job is over and there is nothing left for
- * the caller to do (`next_action: null`). Every other status — including one
- * this CLI doesn't recognise — is non-terminal: mapping an unknown status to
- * `null` would tell an agent a live job is done.
- */
-declare function isTerminalJobStatus(status: string): status is TerminalJobStatus;
-/**
- * CLI-owned fallback poll action, for job-status snapshots that carry no
- * message log to derive a richer action from.
- */
-declare function pollNextAction(jobId: string, hint?: string): NextActionPoll;
-/**
- * Derive the next action from a batch of messages.
- * Scans from the end for the last yield-type message and returns the
- * appropriate action. Returns null if the job is done (complete/cancel)
- * or no yield message is found.
- */
-declare function computeNextAction(jobId: string, messages: Message[]): NextAction;
-
-interface JobRecord {
-    id: string;
-    endpoint: string;
-    /** Canonical DVM name. Optional for older job records. */
-    dvmId?: string;
-    /** Router-issued claim authorizing DVM attribution for feedback on this job. */
-    feedbackClaim?: string;
-    /** Capability dispatched against this DVM. Optional for older job records. */
-    capability?: string;
-    /** Caller-generated public request id used to recover this exact job. */
-    requestId?: string;
-    status: "submitted" | "processing" | "completed" | "failed" | "timeout" | "cancelled" | "awaiting-input";
-    /** Unix timestamp (ms) when submitted */
-    submittedAt: number;
-    /** Unix timestamp (ms) when completed/failed */
-    completedAt?: number;
-    /**
-     * the terminal outcome (summary + artifact metadata + failure
-     * message), snapshotted the moment the CLI learns the job is over. `dvm status`
-     * replays it instead of re-reading the provider, so a finished job answers
-     * with the same field set on every call — and still answers with the provider
-     * down. Written by `markJobTerminal` in lockstep with a terminal `status`;
-     * absent only on records written before this landed.
-     */
-    completion?: JobCompletion;
-    /** Cost in millisatoshis */
-    costMsats?: number;
-    /** Rail the upfront spend settled on. `credit` — drawn from a prepaid credit. */
-    paymentMethod?: "cashu" | "x402" | "tempo" | "credit";
-    /** Validated Tempo settlement transaction associated with the request. */
-    transactionHash?: string;
-    /**
-     * Caller-pinned Cashu spend mint. When set, every spend leg for
-     * this job (upfront, mid-job `payment-request`, `dvm pay`) draws only from
-     * this mint — no fallback to another allowlisted mint.
-     */
-    pinnedMint?: string;
-    /** Request was submitted through the fail-closed direct-Cashu mode. */
-    strictPerCall?: true;
-    /** Job-wide Cashu swap-fee ceiling in sats, including later recovery swaps. */
-    maxCashuFeeSats?: number;
-    /** Whether Cashu change has been processed (prevents double-processing on repeated polls) */
-    changeProcessed?: boolean;
-    /**
-     * Sequence numbers of inbound `payment` messages (refund/change) whose Cashu
-     * proofs have already been claimed into the local wallet. Per-`seq` (unlike
-     * the coarse `changeProcessed`) because a job may carry several such messages,
-     * and prevents double-claim on replay/re-poll.
-     */
-    claimedPaymentSeqs?: number[];
-    /** Last seen message sequence number for cursor-based polling */
-    messageCursor?: number;
-    /** Running total of payments sent (millisatoshis) */
-    totalPaidMsats?: number;
-    /** Number of payments honoured for this job (auto + manual). */
-    paymentsHonoured?: number;
-    /** Index of received artifact deliverables. */
-    artifacts?: ArtifactRef[];
-    /** Spending policy for this job's conversation. */
-    policy?: {
-        maxTotalMsats: number;
-        autoPayBelowMsats: number;
-        maxIncrementMsats: number;
-        maxPayments: number;
-    };
-    /**
-     * opaque per-job token issued by the DVM at create-time when the
-     * caller resolved to anonymous (the default for free DVMs). Persisted on
-     * the local job record and sent as `X-Job-Token` on every subsequent
-     * `status`/`messages`/`message`/`pay`/`cancel` request. Absent for
-     * authenticated callers (bearer / signed-request).
-     */
-    jobToken?: string;
-    /**
-     * platform `trace_id` captured from the submit response's
-     * `traceparent` header. Persisted locally so `dvm feedback --job <id>` can
-     * derive it without re-querying the platform. Absent on legacy job records
-     * created before this field landed.
-     */
-    traceId?: string;
-    /**
-     * the DVM-signed receipt for this job, snapshotted the moment the
-     * CLI first saw it. Lets `dvm status` replay `receipt_verified` from the
-     * local record with the provider down, alongside `completion`. The durable
-     * copy lives in `~/.dvm/receipts.jsonl` — this one dies with the job record.
-     */
-    receipt?: JobReceipt$1;
-    /** Receipt value was offered but failed the transport's structural guard. */
-    receiptParseError?: ReceiptParseError;
-    /**
-     * whether `/v1/info` advertised `receipts` at submit time. Gates
-     * the one follow-up read the streamed arc spends to collect a receipt, so a
-     * DVM that doesn't issue them costs nothing.
-     */
-    receiptsSupported?: boolean;
-    /**
-     * `/v1/info#builder` as the endpoint served it at submit time —
-     * the anchor a receipt's attestation chain terminates at. Persisted so
-     * verification stays offline; `dvm receipts verify --endpoint` is the opt-in
-     * to re-fetch a possibly-rotated one.
-     */
-    builderAnchor?: ReceiptTrustAnchor;
-}
-interface ArtifactRef {
-    seq: number;
-    name?: string;
-    mimeType?: string;
-}
-declare function saveJob(job: JobRecord): void;
-/** Merge a partial update into an existing job record. No-op if job not found. */
-declare function updateJob(id: string, update: Partial<Omit<JobRecord, "id">>): void;
-/** Persist status and completion together for offline replay. Empty completion is allowed.
- * Repeated terminal updates preserve the original completedAt. Missing jobs are unchanged. */
-declare function markJobTerminal(id: string, status: TerminalJobStatus, completion: JobCompletion, extra?: Partial<Omit<JobRecord, "id" | "status" | "completedAt" | "completion">>): void;
-declare function loadJob(id: string): JobRecord | null;
-/** Load all job records. Returns [] on missing/corrupt file. */
-declare function loadAllJobs(): JobRecord[];
-/** Add a payment to a job's running total and increment its honoured-payment count. No-op if job not found. */
-declare function addPayment(jobId: string, amountMsats: number): void;
-declare function refFromJob(job: JobRecord): ProviderRef;
-
-/**
- * Receipt failures are warnings about evidence, not failures of the paid job.
- * Persistence errors are logged without changing the job's outcome.
- */
-
-/** Verify and persist a funding receipt; callers may anchor state only on a sound verdict. */
-declare function captureFundingReceipt(args: {
-    receipt?: FundingReceipt;
-    parseError?: ReceiptParseError;
-    endpoint: string;
-    builder?: ReceiptTrustAnchor;
-    expectedCreditId: string;
-    expectedFundId: string;
-    expectedFundedMicro?: number;
-    expectedBalanceAfterMicro?: number;
-    expectedLedgerSeq?: number;
-    expectedCallerPubkey: string;
-}): ReceiptVerification | "unparseable" | "absent";
-type ReceiptCaptureStatus = ReceiptVerification | "unparseable";
-interface ReceiptCapture {
-    /** The verdict. `"absent"` when none was offered; `"unparseable"` for an invalid shape. */
-    status: ReceiptCaptureStatus;
-    receipt?: JobReceipt$1;
-    /** Per-link detail, present whenever {@link receipt} is. */
-    checks?: ReceiptVerifyResult["checks"];
-    /** Machine slug for an `invalid` or `unparseable` verdict. */
-    reason?: ReceiptVerifyResult["reason"] | ReceiptParseError;
-    /** Pre-rendered line an intermediary agent can relay verbatim. */
-    display: string;
-}
-declare function captureTransportReceipt(jobId: string, response: Pick<JobStatus, "receipt" | "receiptParseError">): ReceiptCapture;
-/**
- * `receipt_verified` is always present. Non-absent captures include display
- * text even when unparseable; raw receipt/checks require a parsed receipt.
- * Emit only on terminal responses: absent during a running job means not yet
- * issued, rather than unsupported receipts.
- */
-declare function receiptJsonFields(capture: ReceiptCapture): Record<string, unknown>;
-declare function renderReceiptHuman(capture: ReceiptCapture): void;
-/**
- * Snapshot `/v1/info`'s receipt trust anchor onto a job record at `saveJob`
- * time, so verification later stays offline and pins the anchor that was live
- * when the job ran rather than whatever the DVM advertises by then.
- */
-declare function receiptTrustFields(provider: ProviderInfo): Pick<JobRecord, "receiptsSupported" | "builderAnchor">;
-/**
- * What one live `/v1/info` read learned about an endpoint's trust anchor.
- *
- * The two ways to come back without an anchor are different facts and must not
- * collapse into one: a DVM that answered and published no `builder` block has
- * told us it has none, while a DVM we could not reach has told us nothing. A
- * caller holding a previously pinned anchor needs them apart before it decides
- * whether to drop it.
- */
-interface TrustAnchorRead {
-    /** `true` when `/v1/info` answered — so an absent {@link anchor} is the DVM's own word. */
-    reachable: boolean;
-    /** The anchor as served. Absent when the DVM publishes none, or when unreachable. */
-    anchor?: ReceiptTrustAnchor;
-}
-/**
- * Drain receipts lack a job's pinned anchor, so read it from the known endpoint.
- * Unreachable reads return reachable=false; a successful read may still have no
- * anchor. A present anchor is passed through for cryptographic verification,
- * where a forged attestation is invalid rather than unattested.
- */
-declare function fetchTrustAnchor(transport: Transport, ref: ProviderRef): Promise<TrustAnchorRead>;
-/**
- * Collect a receipt missing from a locally-known job.
- *
- * The streamed request arc learns a job is over from the log, while
- * `dvm status` can replay a terminal snapshot written by another command.
- * Neither path has necessarily seen the receipt, which only rides on a job read.
- *
- * Costs one small GET, and only against a DVM that told us at submit time it
- * issues receipts; everything else returns immediately. Best-effort throughout
- * a failure here means no receipt this time, not a failed request.
- */
-declare function fetchMissingJobReceipt(jobId: string, transport: Transport, ref: ProviderRef): Promise<{
-    receipt?: JobReceipt$1;
-    receiptParseError?: ReceiptParseError;
-}>;
-/**
- * Fill in a job record's missing trust anchor from a live `/v1/info` read.
- *
- * `dvm status` can be the first command to see a receipt — for a job submitted
- * down a paid arc, or one that predates this feature — and a stored receipt
- * with no anchor verifies as `verified_unattested` when the DVM may well have
- * an attestation to offer. One describe call settles it. Best-effort: an
- * unreachable provider leaves the record as it was.
- */
-declare function backfillTrustAnchor(jobId: string, transport: Transport, ref: ProviderRef): Promise<ReceiptTrustAnchor | undefined>;
-/**
- * Re-verify a receipt already on the job record — the `dvm status` local-replay
- * path. Deliberately re-runs the chain instead of caching a verdict, so a
- * tampered `jobs.json` answers `invalid` rather than replaying the verdict the
- * untampered bytes once earned.
- */
-declare function replayStoredReceipt(job: JobRecord): ReceiptCapture;
-
-/**
- * Per-DVM prepaid-credit working record (`~/.dvm/credits.json`).
- *
- * This file is the caller's *expectation*: what it believes each credit's
- * spendable balance to be, projected from the DVM-signed artifacts it has
- * already collected (fund responses, job receipts, drain records). It is
- * bookkeeping, not evidence — the signed balance trajectory lives in
- * `~/.dvm/receipts.jsonl`, and a mismatch between this file's projection and
- * a freshly countersigned `balance_after` is exactly what
- * {@link applyReceiptCredit} exists to surface.
- *
- * Mutable working set in the `budget.json` mold: one JSON object, temp-file +
- * rename writes, malformed *entries* tolerated on read. A malformed **file**
- * is not: damaged bytes are moved aside and named in the error rather than
- * replaced with an empty store, a file we merely failed to *open* is left
- * exactly where it is, and every cycle that touches the store runs under
- * {@link withCreditLock}.
- */
-
-type StoredCreditStatus = "active" | "expired" | "gone" | "drained" | "unbacked";
-/** A drain in flight — persisted so a re-invoked `dvm credit drain` polls the same id. */
-interface PendingDrain {
-    /** Caller-minted drain id; doubles as the poll/pickup key server-side. */
-    drainId: string;
-    /**
-     * The server keys drains by (credit_id, drain_id). Only an exact pairing may be auto-reused.
-     * Legacy unstamped entries remain visible but require an explicitly supplied pairing; they
-     * cannot suppress later top-ups.
-     */
-    creditId?: string;
-    method: string;
-    /** Payout destination as signed into the drain request — immutable server-side. */
-    payout: Record<string, string>;
-    /** Epoch ms the drain was first requested. */
-    requestedAt: number;
-    /** Verbatim cooperative-close Authorization value, saved before transmission. */
-    mppCredential?: string;
-}
-/**
- * A durable credit funding in flight.
- *
- * Kept outside {@link StoredCredit}: an opening funding must be durable before
- * its invoice request, when no server-confirmed credit exists yet.
- */
-interface PendingFunding {
-    /** Normalised endpoint origin the funding was requested from. */
-    endpoint: string;
-    /** x-only pubkey of the signing identity that owns the funding. */
-    callerPubkey: string;
-    /** Caller-minted credit id the invoice is bound to. */
-    creditId: string;
-    /** Caller-minted idempotency key the invoice is bound to. */
-    fundId: string;
-    /** Requested funding amount, in the credit currency's micro-units. */
-    amountMicro: number;
-    /** Funding rail whose money-moving credential must be replayed verbatim. */
-    rail: "lightning" | "tempo";
-    /** Refill target to retain when the funding becomes a stored credit. */
-    targetMicro: number;
-    /** Additional deposit authorization allowed for this durable MPP funding. */
-    maxDepositMicro?: number;
-    /** Funding-menu snapshot to retain when the funding becomes a stored credit. */
-    menu?: CreditMenu;
-    /** Epoch ms the funding intent was first persisted. */
-    requestedAt: number;
-    /** Bolt11 returned by the DVM, once one has been issued. */
-    bolt11?: string;
-    /** Payment hash returned alongside {@link PendingFunding.bolt11}. */
-    paymentHash?: string;
-    /** Invoice amount, in millisatoshis. */
-    amountMsats?: number;
-    /** Absolute invoice expiry, epoch ms. */
-    expiresAtMs?: number;
-    /** Paid invoice principal, in millisatoshis. Present only after money moved. */
-    principalMsats?: number;
-    /** Wallet-reported routing fee. Null means the wallet omitted it. */
-    routingFeeMsats?: number | null;
-    /** Total wallet fee from an exact debit. Null means the total is unprovable. */
-    totalWalletFeeMsats?: number | null;
-    /** Wallet fee not itemized as routing. Null means the split is unprovable. */
-    unitemizedWalletFeeMsats?: number | null;
-    /** Exact wallet debit. Null means wallet evidence could not prove it. */
-    walletDebitMsats?: number | null;
-    /** How the caller wallet reached settlement. */
-    paymentOutcome?: "paid" | "reconciled" | "republished";
-    /** Serialized MPP Authorization credential, persisted before its network send. */
-    mppCredential?: string;
-    /**
-     * What this funding's Tempo session voucher actually authorizes the DVM to
-     * capture, in micro-units — the cumulative it signed, net of whatever the
-     * channel had already authorized when the funding began. Journalled beside
-     * {@link PendingFunding.mppCredential} so a resume books the authorization
-     * rather than the ask.
-     */
-    authorizedMicro?: number;
-    /**
-     * Budget-ledger valuation fixed before an MPP channel credential is created.
-     * The debit itself is not journalled: it is this rate applied to
-     * {@link PendingFunding.authorizedMicro}, so a resume books the figure the
-     * credential authorized rather than one fixed before it existed.
-     */
-    budgetBtcRate?: number;
-}
-/**
- * One drain's DVM-signed reclaim evidence, with the trust anchor it chains to.
- *
- * Held per drain rather than per credit: a credit can be re-funded and drained
- * again, and each drain's receipts must be judged against the identity the DVM
- * published at *that* reclaim — one anchor cannot honestly grade two drains
- * that straddle a key rotation.
+ * One drain's DVM-signed reclaim evidence, with the trust anchor it chains to.
+ *
+ * Held per drain rather than per credit: a credit can be re-funded and drained
+ * again, and each drain's receipts must be judged against the identity the DVM
+ * published at *that* reclaim — one anchor cannot honestly grade two drains
+ * that straddle a key rotation.
  */
 interface StoredDrainEvidence {
     drainId: string;
@@ -4061,6 +4037,19 @@ declare function listPendingFundings(args?: {
 }): PendingFunding[];
 /** Load the oldest pending funding matching an endpoint, identity, and optional credit. */
 declare function loadPendingFunding(endpoint: string, callerPubkey: string, creditId?: string): PendingFunding | undefined;
+/**
+ * Persist a funding intent or enrich the same intent with its issued invoice.
+ *
+ * The upsert key is `(callerPubkey, creditId, fundId)` — `fundId` is
+ * caller-minted per intent — matched against any row reachable from this
+ * endpoint. A row keeps the origin it was raised at even when the enrichment
+ * arrives through a sibling hostname: the invoice belongs to the host process
+ * that issued it, and rewriting that would point a resume at a host which
+ * never saw the intent.
+ */
+declare function recordPendingFunding(funding: PendingFunding): void;
+/** Clear one resolved or expired pending funding. */
+declare function clearPendingFunding(endpoint: string, callerPubkey: string, creditId: string, fundId: string): void;
 /**
  * Record the server's answer to a fund op (or the fund leg of a
  * fund-and-draw). Always the **server's** figures — `funded_micro` can differ
@@ -4194,6 +4183,29 @@ declare function markCredit(endpoint: string, callerPubkey: string, status: Stor
     ifCreditId?: string;
     identity?: AttestedDvmIdentity;
 }): void;
+/** What the caller last heard about a credit's place within the x402 rail. */
+interface StoredCreditX402Binding {
+    /** The instrument every later top-up has to arrive on. */
+    instrument?: X402CreditInstrument;
+    /** The chain its settlement channel lives on, channel-bound only. */
+    channelNetwork?: string;
+}
+/**
+ * The x402 binding this DVM's tracked credit carries, when the record names
+ * that same credit.
+ *
+ * Credit-scoped rather than record-scoped: the store holds one record per DVM
+ * identity, so a `--credit-id` naming something else is a different credit with
+ * its own binding and the pin does not carry across — the rule `pinnedRail`
+ * applies to the rail, in the caller CLI, which lives in its own repository.
+ * `gone` and `drained` records are excluded for the same reason they can't be
+ * refilled at all.
+ *
+ * Both halves come back together because both answer one question — how to
+ * route this credit's next top-up, and what to say when it can't be routed at
+ * all — and reading them apart would take two loads of the same record.
+ */
+declare function loadCreditX402Binding(endpoint: string, callerPubkey: string, creditId: string, identity?: AttestedDvmIdentity): StoredCreditX402Binding;
 /**
  * Adopt the x402 binding a refusal named onto the tracked credit.
  *
@@ -4305,6 +4317,17 @@ declare function settleDrainEvidence(args: {
     now?: number;
 }): void;
 
+declare function msatsToUsd(msats: number, rate: number): number;
+declare function usdToMsats(usd: number, rate: number): number;
+declare function msatsToUsdCents(msats: number, btcPriceUsd: number): number;
+/** Convert millisatoshis to USDC amount (6-decimal micro-units). USDC ≈ USD. */
+declare function msatsToUsdc(msats: number, btcUsdRate: number): number;
+/** Convert USDC amount (human-readable, e.g. 1.50) to millisatoshis. */
+declare function usdcToMsats(usdc: number, btcUsdRate: number): number;
+declare function msatsToMicro(msats: number, btcRate: number): number;
+/** Convert a micro-unit USD amount into whole sats (ceil) at the given rate. */
+declare function microToSats(micro: number, btcRate: number): number;
+
 /**
  * Append-only receipt collection, separate from the rewrite-in-place job working
  * set. Each exported line carries its collection-time endpoint and trust anchor
@@ -4333,6 +4356,27 @@ interface StoredReceipt {
     /** Epoch ms at which this receipt was collected and first verified. */
     verified_at: number;
 }
+interface StoredFundingReceipt {
+    receipt: FundingReceipt;
+    endpoint: string;
+    builder?: ReceiptTrustAnchor;
+    verification: ReceiptVerification;
+    verified_at: number;
+}
+/**
+ * Append a receipt to the collection. No-op when a receipt for the same
+ * `job_id` is already stored — a job's receipt is issued once and its bytes
+ * are stable, so the second sighting (a `dvm status` re-read, a replayed
+ * submit) carries nothing new.
+ *
+ * Deduped on `job_id`, never on the signature: BIP-340 mixes auxiliary
+ * randomness, so signing the same payload twice yields different bytes. What
+ * makes a receipt's bytes stable is the SDK persisting them write-once, not
+ * the signer being deterministic.
+ */
+declare function appendReceipt(entry: StoredReceipt): void;
+/** Append one funding artifact, deduped by its `(credit_id, fund_id)` identity. */
+declare function appendFundingReceipt(entry: StoredFundingReceipt): void;
 /** Load every stored receipt, oldest first. Returns [] when the file is absent. */
 declare function loadReceipts(): StoredReceipt[];
 declare function loadReceipt(jobId: string): StoredReceipt | null;
@@ -4706,78 +4750,7 @@ declare function pocketTargetMicro(config?: CreditConfig): number;
  * at the same healthy moments.
  */
 declare function needsPocketRefill(balanceMicro: number, targetMicro: number): boolean;
-/**
- * The `fund.amount_micro` a fund-and-draw must sign for a token of
- * `fundMsats`, mirroring the server's `fundedMicroFor` exactly:
- * pro-rata at the quote-pinned ratio `priceMicroServer ↔ requiredMsats`,
- * with the exact-payment case returning the fiat price with zero drift.
- * Both inputs must be **server-authored**, and since the behavior was introduced both are exact
- * integers on the same 402: `required_msats` and `price_micro`, resolved
- * against one fx snapshot. A client-fx-derived figure — or one reconstructed by
- * multiplying a rendered decimal price by a million — is refused with
- * `funding_commitment_mismatch` after the spend has already committed. Taking
- * the fiat half from a separate `/v1/quote` hop is the weaker fallback for
- * providers that state no `price_micro`: that hop re-prices, so its figure and
- * the 402's `required_msats` are two independent resolutions of one ratio.
- *
- * Cashu-shaped, which is all v1 funds on: x402 takes the same ratio against
- * the 402's advertised `maxAmountRequired` in µUSDC rather than through
- * millisatoshis, so a caller-side x402 fund needs its
- * own derivation rather than this one.
- */
-declare function fundWireAmountMicro(priceMicroServer: number, fundMsats: number, requiredMsats: number): number;
-/**
- * What a `funding_commitment_mismatch` refusal says about the provider's own
- * valuation of the artifact attached.
- *
- * The three cases are not interchangeable to a caller holding proofs that are
- * already P2PK-locked to the provider: only `absent` means no re-sign can ever
- * land, and only that case is safe to give up on.
- */
-type FundValuation = 
-/** A usable figure. A corrected re-sign carries exactly this. */
-{
-    kind: "figure";
-    micro: number;
-}
-/** The provider stated a valuation, but not one that can be signed (zero, negative, fractional, out of range). */
- | {
-    kind: "malformed";
-}
-/** No valuation stated at all: the commitment-hash branch, which re-signing can never fix. */
- | {
-    kind: "absent";
-};
-/**
- * Read the provider's valuation off a `funding_commitment_mismatch` body — the
- * figure a corrected re-sign must carry. Prefers the structured
- * `expected_micro` field; falls back to the figure the message states ("… at
- * the quoted price (130769)") for providers that predate it, including when the
- * structured field is present but unusable.
- *
- * A provider that stated *something* is on the amount branch even when what it
- * stated is garbage, so that case returns `malformed` rather than `absent`. The
- * two must not collapse: a caller that treats "the provider emitted a bad field"
- * as "uncorrectable" drops the entry and burns proofs it could have held.
- *
- * Shared by both recovery legs: the in-flight retry in `request.ts` and the
- * crash-resume sweep in `wallet-agent/recovery-submissions.ts`.
- */
-declare function readFundValuation(fields: {
-    expectedMicro?: unknown;
-    message?: string;
-}): FundValuation;
-declare function msatsToMicro(msats: number, btcRate: number): number;
-/** Convert a micro-unit USD amount into whole sats (ceil) at the given rate. */
-declare function microToSats(micro: number, btcRate: number): number;
 
-declare function msatsToUsd(msats: number, rate: number): number;
-declare function usdToMsats(usd: number, rate: number): number;
-declare function msatsToUsdCents(msats: number, btcPriceUsd: number): number;
-/** Convert millisatoshis to USDC amount (6-decimal micro-units). USDC ≈ USD. */
-declare function msatsToUsdc(msats: number, btcUsdRate: number): number;
-/** Convert USDC amount (human-readable, e.g. 1.50) to millisatoshis. */
-declare function usdcToMsats(usdc: number, btcUsdRate: number): number;
 /**
  * Whether an amount label carries its {@link costAnchor} clause. On by default:
  * an anchor is what lets an agent explain a price to a human who has never seen
@@ -5011,6 +4984,13 @@ declare function buildTempoCredential(args: BuildTempoCredentialArgs): Promise<M
  * booking the ask under-reports the spend by exactly that gap.
  */
 declare function tempoCredentialAmountMicro(credential: MppxCredential): bigint;
+/**
+ * Unix seconds after which a Tempo charge credential can no longer settle,
+ * reproducing mppx's own `min(signedAt + TTL, challenge.expires)`. `undefined`
+ * when the challenge carries an unreadable `expires` — naming a deadline the
+ * signature does not have is worse than naming none.
+ */
+declare function tempoCredentialValidBefore(credential: MppxCredential, signedAtMs: number): number | undefined;
 
 /** Calls fn, retrying up to delays.length times on transport errors.
  * Logs a warning on each retry. Non-transport errors are rethrown immediately. */
@@ -5034,6 +5014,7 @@ interface JobPolicy {
     /** Maximum number of payments the CLI will honour for this job. Required — agents must declare expectations. */
     maxPayments: number;
 }
+
 /**
  * Build a JobPolicy from CLI options and/or config values.
  * Budget strings can be msats ("5000") or USD ("$0.50").
@@ -5046,6 +5027,26 @@ declare function buildPolicy(opts: {
     maxPayments?: number;
 }, btcRate: number): JobPolicy;
 
+/**
+ * Free text supplied by a provider. Agents should treat fields wrapped in this
+ * shape with appropriate skepticism — they are subject to prompt injection,
+ * social engineering, or simply contain unverified claims about the job.
+ *
+ * Wrapping is the structural marker; the JSON shape `{ _source: "provider", text: "..." }`
+ * lets an agent's framework distinguish provider-controlled content from CLI-owned
+ * instructions without inspecting field paths.
+ */
+interface ProviderText {
+    _source: "provider";
+    text: string;
+}
+/** Wrap a string as provider-supplied text. */
+declare function asProviderText(text: string): ProviderText;
+/** Wrap a string only if defined; passes through undefined. */
+declare function asProviderTextOpt(text: string | undefined): ProviderText | undefined;
+/** Render a ProviderText (or string) back to plain text — used by --human output paths. */
+declare function providerTextToString(value: string | ProviderText): string;
+
 interface ReceiptKeypair {
     /** secp256k1 BIP-340 x-only pubkey, 32 bytes hex (64 chars). */
     pubkey: string;
@@ -5618,6 +5619,8 @@ interface AgentWallet {
     /** ISO-8601 wallet creation timestamp. */
     created_at: string;
 }
+/** Reads configured mints without migrating legacy caller configuration or choosing a fallback. */
+declare function loadWalletConfiguredMints(): string[];
 /** Missing files return null; earlier supported schemas migrate in memory to v9.
  * Populated v1 legacy state is refused. Wallets without a bound mnemonic stay
  * NUT-13 inactive; old pending mints retain missing expiry for recovery fallback.
@@ -5844,6 +5847,13 @@ declare function buildDisplayMintInventory(wallet: Pick<AgentWallet, "mints" | "
  * blinded message, blinding factor, secret, and optional ephemeral E.
  */
 declare function serializeOutputData(data: OutputDataLike[]): PersistedOutputData[];
+/**
+ * Rebuild concrete {@link OutputData} instances (with a working `toProof`
+ * method) from previously persisted state. Throws on malformed input rather
+ * than silently dropping outputs — partial recovery is worse than a clean
+ * error the operator can act on.
+ */
+declare function rehydrateOutputData(persisted: PersistedOutputData[]): OutputData[];
 /**
  * Replay persisted blinded outputs against the mint's NUT-09 `/v1/restore`
  * endpoint and unblind the signatures locally — the recovery half of the
@@ -5966,6 +5976,7 @@ interface CashuSubmissionBinding {
 }
 /** SHA-256 over canonical JSON for one exact strict Cashu submission binding. */
 declare function cashuSubmissionBindingFingerprint(binding: CashuSubmissionBinding): string;
+declare function cashuSubmissionBindingFromContext(context: PendingSubmissionContext): CashuSubmissionBinding | null;
 
 /**
  * The payer's two timed-exit calls, their exact-result events, and the three
@@ -6120,28 +6131,6 @@ declare const X402_BATCH_CHANNEL_ABI: readonly [{
     }];
 }];
 
-/** Immutable channel configuration needed by the unilateral withdrawal verbs. */
-interface StoredX402ChannelConfig {
-    payer: `0x${string}`;
-    payerAuthorizer: `0x${string}`;
-    receiver: `0x${string}`;
-    receiverAuthorizer: `0x${string}`;
-    token: `0x${string}`;
-    withdrawDelay: number;
-    salt: `0x${string}`;
-}
-/** Caller metadata that connects an upstream channel record to one DVM credit. */
-interface StoredX402ChannelMetadata {
-    channelId: `0x${string}`;
-    endpoint: string;
-    callerPubkey: string;
-    creditId: string;
-    network: string;
-    config: StoredX402ChannelConfig;
-    updatedAt: number;
-}
-/** Provenance for an upstream balance write that did not read the contract. */
-type X402UnobservedBalanceProvenance = "unreconciled" | "unchanged";
 /** Exact signed request retained until a funding response is acknowledged. */
 interface PendingX402Funding {
     endpoint: string;
@@ -6174,8 +6163,8 @@ interface PendingX402Funding {
      * ERC-3009 deposit authorization, dead at `authorizationValidBefore`, and the
      * cumulative claim voucher, which `claim()` accepts with no expiry field and
      * no dependency on the deposit having landed. So a refusal releases the
-     * deposit-shaped gates on that timestamp and raises the exit's guaranteed
-     * figure never — only `wallet x402-clear-pending --force` does that.
+     * deposit-shaped gates on that timestamp, but never releases the claim
+     * voucher reservation. Explicit journal deletion is a separate operation.
      */
     refusedAt?: number;
     /**
@@ -6185,6 +6174,81 @@ interface PendingX402Funding {
      */
     supersededAt?: number;
 }
+/**
+ * Age at which an active unacknowledged voucher is reported as abandoned and
+ * may be retired without force. Age alone does not revoke its signed authority.
+ * Retired deposits have a separate authorization-expiry gate.
+ */
+declare const X402_PENDING_STALE_MS: number;
+/** Whether an entry has gone long enough unacknowledged to read as abandoned. */
+declare function x402PendingStale(pending: PendingX402Funding, now?: number): boolean;
+/** Whether this funding has a final answer or a newer alias-split replacement. */
+declare function x402PendingRetired(pending: PendingX402Funding): boolean;
+/**
+ * When a refused entry's deposit authorization stops being submittable, and
+ * with it every gate that exists to stop a second deposit being minted.
+ *
+ * Entries with no readable `authorizationValidBefore` — written before the
+ * field existed, or carrying a voucher-only payload — get the conservative
+ * answer rather than an immediate release: the stale threshold, the same
+ * "long enough to read as abandoned" line the CLI already draws.
+ */
+declare function x402PendingBlockExpiresAt(pending: PendingX402Funding): number;
+/** Signed deposit deadline in epoch milliseconds; absent for unreadable/legacy authority. */
+declare function x402PendingDepositExpiresAt(pending: PendingX402Funding): number | undefined;
+/**
+ * Whether an entry still carries the deposit-shaped hazard: a signed ERC-3009
+ * authorization that could yet be submitted, which is what the rival-voucher
+ * gate and the key-loss refusals exist to protect against. True for anything
+ * still awaiting acknowledgement — nothing releases on age — and for
+ * a refused entry only until its authorization dies.
+ *
+ * Never the predicate for the timed exit's guaranteed figure, which accounts
+ * for the claim voucher and has no timestamp to release on.
+ */
+declare function x402PendingUnsettled(pending: PendingX402Funding, now?: number): boolean;
+/** Refusal facts in epoch milliseconds, without caller recovery guidance. */
+interface X402VoucherPendingState {
+    code: "x402_voucher_pending";
+    creditId: string;
+    fundId: string;
+    channelId: string;
+    endpoint: string;
+    retired: boolean;
+    blockedUntil: number;
+    depositExpiresAt?: number;
+}
+declare function x402VoucherPendingState(blocking: PendingX402Funding): X402VoucherPendingState;
+/**
+ * Reject a second independently spendable deposit across credit/endpoint scopes.
+ * Same-credit live entries permit verbatim replay; retirement alone never revokes
+ * an authorization. Supply the existing channel-scoped journal. The thrown
+ * value is facts, for caller adapters to render.
+ */
+declare function assertNoRivalX402Voucher(channelId: `0x${string}`, creditId: string, pending: PendingX402Funding[], now?: number): void;
+
+/** Immutable channel configuration needed by the unilateral withdrawal verbs. */
+interface StoredX402ChannelConfig {
+    payer: `0x${string}`;
+    payerAuthorizer: `0x${string}`;
+    receiver: `0x${string}`;
+    receiverAuthorizer: `0x${string}`;
+    token: `0x${string}`;
+    withdrawDelay: number;
+    salt: `0x${string}`;
+}
+/** Caller metadata that connects an upstream channel record to one DVM credit. */
+interface StoredX402ChannelMetadata {
+    channelId: `0x${string}`;
+    endpoint: string;
+    callerPubkey: string;
+    creditId: string;
+    network: string;
+    config: StoredX402ChannelConfig;
+    updatedAt: number;
+}
+/** Provenance for an upstream balance write that did not read the contract. */
+type X402UnobservedBalanceProvenance = "unreconciled" | "unchanged";
 /**
  * An `exact`-scheme authorization retained until its funding response is
  * acknowledged.
@@ -6270,48 +6334,6 @@ declare function listResumableX402ExactFundings(filter?: {
  * a sibling process journalled in the meantime.
  */
 declare function clearPendingX402ExactFunding(pending: PendingX402ExactFunding): void;
-/**
- * Age at which an active unacknowledged voucher is reported as abandoned and
- * may be retired without force. Age alone does not revoke its signed authority.
- * Retired deposits have a separate authorization-expiry gate.
- */
-declare const X402_PENDING_STALE_MS: number;
-/** Whether an entry has gone long enough unacknowledged to read as abandoned. */
-declare function x402PendingStale(pending: PendingX402Funding, now?: number): boolean;
-/** Whether this funding has a final answer or a newer alias-split replacement. */
-declare function x402PendingRetired(pending: PendingX402Funding): boolean;
-/**
- * When a refused entry's deposit authorization stops being submittable, and
- * with it every gate that exists to stop a second deposit being minted.
- *
- * Entries with no readable `authorizationValidBefore` — written before the
- * field existed, or carrying a voucher-only payload — get the conservative
- * answer rather than an immediate release: the stale threshold, the same
- * "long enough to read as abandoned" line the CLI already draws.
- */
-declare function x402PendingBlockExpiresAt(pending: PendingX402Funding): number;
-/**
- * The deadline the caller actually signed, or `undefined` when this entry never
- * carried one — a voucher-only payload authorizes no ERC-3009 transfer at all,
- * and an entry written before journalled no expiry for the one it did.
- *
- * The block timestamp is the same either way, so this exists for the prose:
- * telling an agent "the deposit you signed can be submitted until X" when X is
- * a fallback this code invented is a claim about a signature that was never
- * made, and the agent relays it to a human verbatim.
- */
-declare function x402PendingDepositExpiresAt(pending: PendingX402Funding): number | undefined;
-/**
- * Whether an entry still carries the deposit-shaped hazard: a signed ERC-3009
- * authorization that could yet be submitted, which is what the rival-voucher
- * gate and the key-loss refusals exist to protect against. True for anything
- * still awaiting acknowledgement — nothing releases on age — and for
- * a refused entry only until its authorization dies.
- *
- * Never the predicate for the timed exit's guaranteed figure, which accounts
- * for the claim voucher and has no timestamp to release on.
- */
-declare function x402PendingUnsettled(pending: PendingX402Funding, now?: number): boolean;
 /**
  * One journal entry in the shape every CLI surface puts on the wire. Shared, so
  * an agent reading a drain, a timed exit and `x402-clear-pending` sees the same
@@ -6538,17 +6560,7 @@ declare function createX402BatchPayment(args: {
     /** Deposit policy in token micro-units, raised to upstream's required minimum. */
     depositMicro: number;
 }): Promise<X402BatchPayment>;
-/**
- * The one refusal that says "this channel already owes a signature". Shared by
- * the authoritative gate below and by `credit-fund`'s cheap local pre-check, so
- * an agent reading either gets the same two facts: which funding stands in the
- * way, and what makes it go away.
- *
- * A funding the DVM refused outright is the second flavour, and it needs its
- * own words: retrying it is impossible, so the way out is the clock. The hint
- * names the moment its deposit authorization stops being submittable, which is
- * when this block lifts on its own.
- */
+/** Compatibility adapter retaining caller commands until consumer migration. */
 declare function x402VoucherPendingRefusal(blocking: PendingX402Funding, data?: Record<string, unknown>): DvmError;
 /** Advance durable cumulative state from a successful PAYMENT-RESPONSE. */
 declare function processX402BatchResponse(scheme: BatchSettlementEvmScheme, paymentResponse: string | undefined): Promise<void>;
@@ -7441,179 +7453,432 @@ interface StaleRateNotice {
     display: string;
 }
 /**
- * Resolve BTC/USD, using the last cached rate when the provider is unreachable.
- * A stale rate still permits cap enforcement; no rate blocks the spend with
- * rate_unavailable rather than silently bypassing the cap. Stale fallback warns
- * once per process on stderr. Display-only callers use tryResolveBtcUsdRate.
+ * Resolve BTC/USD, using the last cached rate when the provider is unreachable.
+ * A stale rate still permits cap enforcement; no rate blocks the spend with
+ * rate_unavailable rather than silently bypassing the cap. Stale fallback warns
+ * once per process on stderr. Display-only callers use tryResolveBtcUsdRate.
+ */
+declare function resolveBtcUsdRate(purpose: BtcRatePurpose): Promise<ResolvedBtcRate>;
+/**
+ * Best-effort rate for a figure that is *displayed* but never spent — a price
+ * label, a wallet balance line. Returns null rather than throwing: a caller
+ * should not lose a payment, or be blocked from connecting a wallet, because a
+ * price API was down when we went to render a dollar sign.
+ */
+declare function tryResolveBtcUsdRate(): Promise<ResolvedBtcRate | null>;
+/** Freshness notice for a resolved rate. Undefined when the rate came back live. */
+declare function staleRateNotice(resolved: ResolvedBtcRate | null): StaleRateNotice | undefined;
+
+/** Get balance per mint as a Map of mintUrl → msats. */
+declare function getBalanceByMint(): Map<string, number>;
+
+type SigningIdentitySource = {
+    kind: "flag";
+    name: string;
+} | {
+    kind: "env";
+} | {
+    kind: "default";
+    name: string;
+} | {
+    kind: "sole";
+    name: string;
+}
+/** Matched by pubkey — the resume path re-signing as whoever paid. */
+ | {
+    kind: "pubkey";
+    name: string;
+};
+interface ResolvedSigningIdentity {
+    /** 32-byte secp256k1 secret, lowercase hex. */
+    privkey: string;
+    /** 32-byte BIP-340 x-only pubkey, lowercase hex. */
+    pubkey: string;
+    source: SigningIdentitySource;
+}
+interface ResolveSigningIdentityOpts {
+    as?: string;
+    config?: Config | null;
+}
+/**
+ * Resolve which caller signing identity `dvm request` / `dvm quote` should
+ * use to sign a descriptor-auth submission. Resolution chain (first match
+ * wins):
+ *
+ * 1. `--as <name>` flag → look up named identity.
+ * 2. `DVM_IDENTITY_KEY=<hex>` env → use as anonymous key (no name lookup).
+ * 3. `config.defaultIdentity` → look up named identity.
+ * 4. Identities file has exactly one entry → use it.
+ * 5. Else → throw `auth_required` listing available identities.
+ */
+declare function resolveSigningIdentity(opts: ResolveSigningIdentityOpts): ResolvedSigningIdentity;
+/**
+ * Look an identity up by its pubkey rather than by name.
+ *
+ * The pending-submission resume has to re-sign the original call as the caller
+ * who paid for it — signing as anyone else would file the job under the wrong
+ * pubkey. It therefore can't go through {@link resolveSigningIdentity}, whose
+ * answer depends on flags, env, and config that may have changed since. Returns
+ * `null` when the key is no longer configured, which makes the submission
+ * unresumable rather than mis-signed.
+ */
+declare function findSigningIdentityByPubkey(pubkey: string): ResolvedSigningIdentity | null;
+
+declare const IDENTITIES_VERSION: 1;
+/** One stored caller signing identity. The `name` is the file's record key. */
+interface CliIdentityEntry {
+    /** 32-byte secp256k1 secret key, lowercase hex (64 chars). Never sent to any server. */
+    privkey: string;
+    /** 32-byte BIP-340 x-only public key, lowercase hex (64 chars). */
+    pubkey: string;
+    /** Epoch millis when the entry was generated or imported. */
+    createdAt: number;
+}
+/**
+ * Persistent on-disk shape of `~/.dvm/identities.json` (mode 0600). Stores the
+ * caller signing identities `dvm request` / `dvm quote` use to auto-sign
+ * descriptor-auth submissions.
+ */
+interface IdentitiesFile {
+    version: typeof IDENTITIES_VERSION;
+    identities: Record<string, CliIdentityEntry>;
+}
+/** Whether `~/.dvm/identities.json` exists. Cheap presence check; does not parse. */
+declare function identitiesFileExists(): boolean;
+declare function loadIdentities(): IdentitiesFile | null;
+/**
+ * Atomically write the identities file with mode 0600. POSIX guarantees rename atomicity within a filesystem,
+ * so a crash mid-write leaves either the previous file or the new one.
+ *
+ * Callers performing a read-modify-write cycle must hold {@link withIdentitiesLock}
+ * across the cycle so two concurrent `dvm identity …` invocations cannot
+ * clobber each other's writes.
+ */
+declare function saveIdentities(file: IdentitiesFile): void;
+/** Lock acquisition budget; retry and stale-lock values are in milliseconds. */
+interface WithIdentitiesLockOptions {
+    /** Stale-lock threshold in ms. A lock whose mtime is older than this is reclaimed. Default 30_000. */
+    stale?: number;
+    /** Number of acquisition retries before failing. Default 30. */
+    retries?: number;
+    /** Milliseconds between retries. Default 1_000. */
+    retryIntervalMs?: number;
+}
+/**
+ * Run `fn` while holding an OS-level exclusive lock on the identities file,
+ * so concurrent `dvm identity …` invocations serialise their
+ * read-modify-write cycles instead of clobbering each other. The lock file
+ * lives at `~/.dvm/identities.json.lock` and is reclaimed automatically if a
+ * previous holder died without releasing.
+ *
+ * Throws `DvmError("identities_locked", …)` when the lock can't be acquired
+ * within the retry budget (~30s by default).
+ */
+declare function withIdentitiesLock<T>(fn: () => Promise<T> | T, opts?: WithIdentitiesLockOptions): Promise<T>;
+/**
+ * Generate a fresh secp256k1 keypair as a {@link CliIdentityEntry}. The
+ * private key is 32 cryptographically-random bytes; the public key is the
+ * BIP-340 x-only form — same convention as the SDK's
+ * `createSignedRequestVerifier.signRequest`.
+ */
+declare function generateIdentity(now?: number): CliIdentityEntry;
+/**
+ * Validate a 64-char lowercase hex private key and derive the matching
+ * BIP-340 x-only pubkey. Throws `DvmError("invalid_privkey", ...)` on a
+ * malformed input. Used by `dvm identity import` and the
+ * `DVM_IDENTITY_KEY` env override resolver.
+ */
+declare function deriveIdentityFromPrivkey(privkeyHex: string, now?: number): CliIdentityEntry;
+
+/**
+ * The terminal-outcome fields a job carries once it is over — the summary, the
+ * artifact metadata, and (on a failure) the provider's message. Read off a
+ * transport receipt / status response, persisted on the local job record
+ * and rendered into the JSON payload by `buildCompletionHintFields`.
+ */
+interface JobCompletion {
+    /** Human-readable one-liner. Not the payload when artifacts are present. */
+    summary?: string;
+    /** Provider's status message (typically on a failed job). */
+    message?: string;
+    /** True when the provider emitted artifact messages. */
+    hasArtifacts?: boolean;
+    /** Count of artifact messages (present when `hasArtifacts` is true). */
+    artifactCount?: number;
+    /** Where the payload sits: the `summary` string, or in artifact messages. */
+    payloadIn?: "summary" | "messages";
+}
+/**
+ * Build the snake_case JSON fields (`has_artifacts`, `artifact_count`,
+ * `payload_in`, `next_step_hint`) from a transport receipt or status response.
+ * Returns an object meant to be spread into the parent JSON payload — agents
+ * relaying a completed-job response need these to know the summary string is
+ * a one-liner, not the payload, when the real output sits in artifact messages
+ */
+declare function buildCompletionHintFields(jobId: string, input: JobCompletion): Record<string, unknown>;
+/** `--no-stream` replays from seq 0: the stored cursor may already be past the artifacts. */
+declare function nextStepHint(jobId: string, payloadIn: "summary" | "messages" | undefined, artifactCount: number | undefined): string | undefined;
+/**
+ * Pick the terminal-outcome fields off a receipt or status response, dropping
+ * the ones the provider didn't send. What lands here is what `dvm status`
+ * replays from the local record on every later read, so it must be
+ * exactly the set the wire read would have rendered — no defaults, no guesses.
+ */
+declare function completionSnapshot(src: JobCompletion): JobCompletion;
+/**
+ * Derive the terminal snapshot from a streamed message log, for the paths that
+ * learn a job is over from the stream rather than a status response. Mirrors
+ * the SDK's own derivation (`statusCompletionFields`, `src/sdk/server/app.ts`):
+ * `payload_in` is `"messages"` iff any `artifact` message was emitted. Requires
+ * the full log (from seq 0) — a partial batch would undercount the artifacts.
+ */
+declare function completionFromMessages(messages: Message[]): JobCompletion;
+
+/** Outcome of a {@link repairConfigDirMode} pass. Never throws; failures land in `error`. */
+interface ConfigDirModeResult {
+    path: string;
+    /** Whether the directory exists. False also when the stat itself failed (see `error`). */
+    exists: boolean;
+    /** Mode after the pass, e.g. `"0700"`. Null when absent, unreadable, or off-POSIX. */
+    modeOctal: string | null;
+    /** Mode found before the pass, when {@link repaired} is true. */
+    previousModeOctal?: string;
+    /** True when this call tightened a group/other-accessible directory to 0700. */
+    repaired: boolean;
+    /** True on Windows, where POSIX modes are meaningless and the pass is a no-op. */
+    skippedNonPosix: boolean;
+    /** Underlying message when the stat or chmod failed. */
+    error?: string;
+}
+/** Create the caller-state directory owner-only; existing modes are unchanged. */
+declare function ensureConfigDir(): void;
+/**
+ * Create a caller-state subdirectory owner-only. Recursive mkdir may also create
+ * CONFIG_DIR, so every creation path must carry the same owner-only mode.
  */
-declare function resolveBtcUsdRate(purpose: BtcRatePurpose): Promise<ResolvedBtcRate>;
+declare function ensureConfigSubdir(path: string): void;
 /**
- * Best-effort rate for a figure that is *displayed* but never spent — a price
- * label, a wallet balance line. Returns null rather than throwing: a caller
- * should not lose a payment, or be blocked from connecting a wallet, because a
- * price API was down when we went to render a dollar sign.
+ * Tighten an existing `CONFIG_DIR` to 0700 when it is group- or
+ * other-accessible. Does not create the directory — an absent one is reported,
+ * not conjured, so read-mostly callers (`dvm doctor`) stay honest.
+ *
+ * Only *loosening* is corrected: a directory an operator deliberately set
+ * stricter than 0700 (e.g. 0500) is left alone, so a shared-service setup is
+ * not fought with on every run. No-op on Windows.
  */
-declare function tryResolveBtcUsdRate(): Promise<ResolvedBtcRate | null>;
-/** Freshness notice for a resolved rate. Undefined when the rate came back live. */
-declare function staleRateNotice(resolved: ResolvedBtcRate | null): StaleRateNotice | undefined;
+declare function repairConfigDirMode(): ConfigDirModeResult;
 
-/** Get balance per mint as a Map of mintUrl → msats. */
-declare function getBalanceByMint(): Map<string, number>;
+/** Return whether a value is a 0x-prefixed 32-byte secp256k1 secret scalar. */
+declare function isValidEvmPrivateKey(value: string): value is `0x${string}`;
 
-type SigningIdentitySource = {
-    kind: "flag";
-    name: string;
-} | {
-    kind: "env";
-} | {
-    kind: "default";
-    name: string;
-} | {
-    kind: "sole";
-    name: string;
+type NextAction = null | NextActionRespond | NextActionPay | NextActionApprove | NextActionPoll | NextActionRefund;
+interface NextActionRespond {
+    type: "respond";
+    job_id: string;
+    prompt_id: string;
+    /** The provider's question. Treat with appropriate skepticism. */
+    prompt: ProviderText;
+    schema?: Record<string, unknown>;
+    /** CLI-owned guidance for the agent. */
+    hint: string;
 }
-/** Matched by pubkey — the resume path re-signing as whoever paid. */
- | {
-    kind: "pubkey";
-    name: string;
-};
-interface ResolvedSigningIdentity {
-    /** 32-byte secp256k1 secret, lowercase hex. */
-    privkey: string;
-    /** 32-byte BIP-340 x-only pubkey, lowercase hex. */
-    pubkey: string;
-    source: SigningIdentitySource;
+interface NextActionPay {
+    type: "pay";
+    job_id: string;
+    amount_msats: number;
+    /**
+     * The provider's own fiat price for this charge, when it priced in fiat.
+     * Mirrors the wire's `fiat_amount` so a typed agent can do budget math
+     * against the figure the human is actually being asked to approve.
+     */
+    fiat_amount?: {
+        amount: number;
+        currency: string;
+    };
+    display: string;
+    /** The provider's stated reason for the charge. Treat with appropriate skepticism. */
+    reason: ProviderText;
+    /** CLI-owned guidance for the agent. */
+    hint: string;
 }
-interface ResolveSigningIdentityOpts {
-    as?: string;
-    config?: Config | null;
+/** Provider delivered something and is waiting for sign-off. */
+interface NextActionApprove {
+    type: "approve";
+    job_id: string;
+    artifact_seq: number;
+    hint: string;
 }
 /**
- * Resolve which caller signing identity `dvm request` / `dvm quote` should
- * use to sign a descriptor-auth submission. Resolution chain (first match
- * wins):
- *
- * 1. `--as <name>` flag → look up named identity.
- * 2. `DVM_IDENTITY_KEY=<hex>` env → use as anonymous key (no name lookup).
- * 3. `config.defaultIdentity` → look up named identity.
- * 4. Identities file has exactly one entry → use it.
- * 5. Else → throw `auth_required` listing available identities.
+ * Provider is working — nothing for the client to do right now.
+ * `hint` is a `ProviderText` when supplied by the provider; a plain `string` is the CLI fallback.
  */
-declare function resolveSigningIdentity(opts: ResolveSigningIdentityOpts): ResolvedSigningIdentity;
+interface NextActionPoll {
+    type: "poll";
+    job_id: string;
+    estimate_seconds?: number;
+    hint: string | ProviderText;
+}
 /**
- * Look an identity up by its pubkey rather than by name.
- *
- * The pending-submission resume has to re-sign the original call as the caller
- * who paid for it — signing as anyone else would file the job under the wrong
- * pubkey. It therefore can't go through {@link resolveSigningIdentity}, whose
- * answer depends on flags, env, and config that may have changed since. Returns
- * `null` when the key is no longer configured, which makes the submission
- * unresumable rather than mis-signed.
+ * Provider sent an inbound Cashu payment (refund/change). The CLI auto-claims
+ * the proofs; this surfaces the outcome to the agent. `claimed: false` means the
+ * claim could not complete (e.g. mint down) and `cashu_token` carries the raw
+ * token for manual recovery.
  */
-declare function findSigningIdentityByPubkey(pubkey: string): ResolvedSigningIdentity | null;
-
-declare const IDENTITIES_VERSION: 1;
-/** One stored caller signing identity. The `name` is the file's record key. */
-interface CliIdentityEntry {
-    /** 32-byte secp256k1 secret key, lowercase hex (64 chars). Never sent to any server. */
-    privkey: string;
-    /** 32-byte BIP-340 x-only public key, lowercase hex (64 chars). */
-    pubkey: string;
-    /** Epoch millis when the entry was generated or imported. */
-    createdAt: number;
+interface NextActionRefund {
+    type: "refund";
+    job_id: string;
+    amount_msats: number;
+    display: string;
+    reason: "refund" | "change";
+    /** Whether the proofs were auto-claimed into the local wallet. */
+    claimed: boolean;
+    /** Raw Cashu token — present only when the auto-claim failed, for manual recovery. */
+    cashu_token?: string;
+    /** CLI-owned guidance for the agent. */
+    hint: string;
 }
+/** A job status that means the job is over — nothing left for the caller to do. */
+type TerminalJobStatus = "completed" | "failed" | "cancelled";
 /**
- * Persistent on-disk shape of `~/.dvm/identities.json` (mode 0600). Stores the
- * caller signing identities `dvm request` / `dvm quote` use to auto-sign
- * descriptor-auth submissions.
+ * True when a job status means the job is over and there is nothing left for
+ * the caller to do (`next_action: null`). Every other status — including one
+ * this CLI doesn't recognise — is non-terminal: mapping an unknown status to
+ * `null` would tell an agent a live job is done.
  */
-interface IdentitiesFile {
-    version: typeof IDENTITIES_VERSION;
-    identities: Record<string, CliIdentityEntry>;
-}
-/** Whether `~/.dvm/identities.json` exists. Cheap presence check; does not parse. */
-declare function identitiesFileExists(): boolean;
-declare function loadIdentities(): IdentitiesFile | null;
+declare function isTerminalJobStatus(status: string): status is TerminalJobStatus;
 /**
- * Atomically write the identities file with mode 0600. POSIX guarantees rename atomicity within a filesystem,
- * so a crash mid-write leaves either the previous file or the new one.
- *
- * Callers performing a read-modify-write cycle must hold {@link withIdentitiesLock}
- * across the cycle so two concurrent `dvm identity …` invocations cannot
- * clobber each other's writes.
+ * CLI-owned fallback poll action, for job-status snapshots that carry no
+ * message log to derive a richer action from.
  */
-declare function saveIdentities(file: IdentitiesFile): void;
-/** Lock acquisition budget; retry and stale-lock values are in milliseconds. */
-interface WithIdentitiesLockOptions {
-    /** Stale-lock threshold in ms. A lock whose mtime is older than this is reclaimed. Default 30_000. */
-    stale?: number;
-    /** Number of acquisition retries before failing. Default 30. */
-    retries?: number;
-    /** Milliseconds between retries. Default 1_000. */
-    retryIntervalMs?: number;
+declare function pollNextAction(jobId: string, hint?: string): NextActionPoll;
+/**
+ * Derive the next action from a batch of messages.
+ * Scans from the end for the last yield-type message and returns the
+ * appropriate action. Returns null if the job is done (complete/cancel)
+ * or no yield message is found.
+ */
+declare function computeNextAction(jobId: string, messages: Message[]): NextAction;
+
+interface JobRecord {
+    id: string;
+    endpoint: string;
+    /** Canonical DVM name. Optional for older job records. */
+    dvmId?: string;
+    /** Router-issued claim authorizing DVM attribution for feedback on this job. */
+    feedbackClaim?: string;
+    /** Capability dispatched against this DVM. Optional for older job records. */
+    capability?: string;
+    /** Caller-generated public request id used to recover this exact job. */
+    requestId?: string;
+    status: "submitted" | "processing" | "completed" | "failed" | "timeout" | "cancelled" | "awaiting-input";
+    /** Unix timestamp (ms) when submitted */
+    submittedAt: number;
+    /** Unix timestamp (ms) when completed/failed */
+    completedAt?: number;
+    /**
+     * the terminal outcome (summary + artifact metadata + failure
+     * message), snapshotted the moment the CLI learns the job is over. `dvm status`
+     * replays it instead of re-reading the provider, so a finished job answers
+     * with the same field set on every call — and still answers with the provider
+     * down. Written by `markJobTerminal` in lockstep with a terminal `status`;
+     * absent only on records written before this landed.
+     */
+    completion?: JobCompletion;
+    /** Cost in millisatoshis */
+    costMsats?: number;
+    /** Rail the upfront spend settled on. `credit` — drawn from a prepaid credit. */
+    paymentMethod?: "cashu" | "x402" | "tempo" | "credit";
+    /** Validated Tempo settlement transaction associated with the request. */
+    transactionHash?: string;
+    /**
+     * Caller-pinned Cashu spend mint. When set, every spend leg for
+     * this job (upfront, mid-job `payment-request`, `dvm pay`) draws only from
+     * this mint — no fallback to another allowlisted mint.
+     */
+    pinnedMint?: string;
+    /** Request was submitted through the fail-closed direct-Cashu mode. */
+    strictPerCall?: true;
+    /** Job-wide Cashu swap-fee ceiling in sats, including later recovery swaps. */
+    maxCashuFeeSats?: number;
+    /** Whether Cashu change has been processed (prevents double-processing on repeated polls) */
+    changeProcessed?: boolean;
+    /**
+     * Sequence numbers of inbound `payment` messages (refund/change) whose Cashu
+     * proofs have already been claimed into the local wallet. Per-`seq` (unlike
+     * the coarse `changeProcessed`) because a job may carry several such messages,
+     * and prevents double-claim on replay/re-poll.
+     */
+    claimedPaymentSeqs?: number[];
+    /** Last seen message sequence number for cursor-based polling */
+    messageCursor?: number;
+    /** Running total of payments sent (millisatoshis) */
+    totalPaidMsats?: number;
+    /** Number of payments honoured for this job (auto + manual). */
+    paymentsHonoured?: number;
+    /** Index of received artifact deliverables. */
+    artifacts?: ArtifactRef[];
+    /** Spending policy for this job's conversation. */
+    policy?: {
+        maxTotalMsats: number;
+        autoPayBelowMsats: number;
+        maxIncrementMsats: number;
+        maxPayments: number;
+    };
+    /**
+     * opaque per-job token issued by the DVM at create-time when the
+     * caller resolved to anonymous (the default for free DVMs). Persisted on
+     * the local job record and sent as `X-Job-Token` on every subsequent
+     * `status`/`messages`/`message`/`pay`/`cancel` request. Absent for
+     * authenticated callers (bearer / signed-request).
+     */
+    jobToken?: string;
+    /**
+     * platform `trace_id` captured from the submit response's
+     * `traceparent` header. Persisted locally so `dvm feedback --job <id>` can
+     * derive it without re-querying the platform. Absent on legacy job records
+     * created before this field landed.
+     */
+    traceId?: string;
+    /**
+     * the DVM-signed receipt for this job, snapshotted the moment the
+     * CLI first saw it. Lets `dvm status` replay `receipt_verified` from the
+     * local record with the provider down, alongside `completion`. The durable
+     * copy lives in `~/.dvm/receipts.jsonl` — this one dies with the job record.
+     */
+    receipt?: JobReceipt$1;
+    /** Receipt value was offered but failed the transport's structural guard. */
+    receiptParseError?: ReceiptParseError;
+    /**
+     * whether `/v1/info` advertised `receipts` at submit time. Gates
+     * the one follow-up read the streamed arc spends to collect a receipt, so a
+     * DVM that doesn't issue them costs nothing.
+     */
+    receiptsSupported?: boolean;
+    /**
+     * `/v1/info#builder` as the endpoint served it at submit time —
+     * the anchor a receipt's attestation chain terminates at. Persisted so
+     * verification stays offline; `dvm receipts verify --endpoint` is the opt-in
+     * to re-fetch a possibly-rotated one.
+     */
+    builderAnchor?: ReceiptTrustAnchor;
 }
-/**
- * Run `fn` while holding an OS-level exclusive lock on the identities file,
- * so concurrent `dvm identity …` invocations serialise their
- * read-modify-write cycles instead of clobbering each other. The lock file
- * lives at `~/.dvm/identities.json.lock` and is reclaimed automatically if a
- * previous holder died without releasing.
- *
- * Throws `DvmError("identities_locked", …)` when the lock can't be acquired
- * within the retry budget (~30s by default).
- */
-declare function withIdentitiesLock<T>(fn: () => Promise<T> | T, opts?: WithIdentitiesLockOptions): Promise<T>;
-/**
- * Generate a fresh secp256k1 keypair as a {@link CliIdentityEntry}. The
- * private key is 32 cryptographically-random bytes; the public key is the
- * BIP-340 x-only form — same convention as the SDK's
- * `createSignedRequestVerifier.signRequest`.
- */
-declare function generateIdentity(now?: number): CliIdentityEntry;
-/**
- * Validate a 64-char lowercase hex private key and derive the matching
- * BIP-340 x-only pubkey. Throws `DvmError("invalid_privkey", ...)` on a
- * malformed input. Used by `dvm identity import` and the
- * `DVM_IDENTITY_KEY` env override resolver.
- */
-declare function deriveIdentityFromPrivkey(privkeyHex: string, now?: number): CliIdentityEntry;
-
-/** Outcome of a {@link repairConfigDirMode} pass. Never throws; failures land in `error`. */
-interface ConfigDirModeResult {
-    path: string;
-    /** Whether the directory exists. False also when the stat itself failed (see `error`). */
-    exists: boolean;
-    /** Mode after the pass, e.g. `"0700"`. Null when absent, unreadable, or off-POSIX. */
-    modeOctal: string | null;
-    /** Mode found before the pass, when {@link repaired} is true. */
-    previousModeOctal?: string;
-    /** True when this call tightened a group/other-accessible directory to 0700. */
-    repaired: boolean;
-    /** True on Windows, where POSIX modes are meaningless and the pass is a no-op. */
-    skippedNonPosix: boolean;
-    /** Underlying message when the stat or chmod failed. */
-    error?: string;
+interface ArtifactRef {
+    seq: number;
+    name?: string;
+    mimeType?: string;
 }
-/** Create the caller-state directory owner-only; existing modes are unchanged. */
-declare function ensureConfigDir(): void;
-/**
- * Create a caller-state subdirectory owner-only. Recursive mkdir may also create
- * CONFIG_DIR, so every creation path must carry the same owner-only mode.
- */
-declare function ensureConfigSubdir(path: string): void;
-/**
- * Tighten an existing `CONFIG_DIR` to 0700 when it is group- or
- * other-accessible. Does not create the directory — an absent one is reported,
- * not conjured, so read-mostly callers (`dvm doctor`) stay honest.
- *
- * Only *loosening* is corrected: a directory an operator deliberately set
- * stricter than 0700 (e.g. 0500) is left alone, so a shared-service setup is
- * not fought with on every run. No-op on Windows.
- */
-declare function repairConfigDirMode(): ConfigDirModeResult;
-
-/** Return whether a value is a 0x-prefixed 32-byte secp256k1 secret scalar. */
-declare function isValidEvmPrivateKey(value: string): value is `0x${string}`;
+declare function saveJob(job: JobRecord): void;
+/** Merge a partial update into an existing job record. No-op if job not found. */
+declare function updateJob(id: string, update: Partial<Omit<JobRecord, "id">>): void;
+/** Persist status and completion together for offline replay. Empty completion is allowed.
+ * Repeated terminal updates preserve the original completedAt. Missing jobs are unchanged. */
+declare function markJobTerminal(id: string, status: TerminalJobStatus, completion: JobCompletion, extra?: Partial<Omit<JobRecord, "id" | "status" | "completedAt" | "completion">>): void;
+declare function loadJob(id: string): JobRecord | null;
+/** Load all job records. Returns [] on missing/corrupt file. */
+declare function loadAllJobs(): JobRecord[];
+/** Add a payment to a job's running total and increment its honoured-payment count. No-op if job not found. */
+declare function addPayment(jobId: string, amountMsats: number): void;
+declare function refFromJob(job: JobRecord): ProviderRef;
 
 interface MintRecommendation {
     name: string;
@@ -7647,6 +7912,14 @@ declare function info(msg: string): void;
  * so output stays vim-pasteable and shell-redirectable.
  */
 declare function raw(msg: string): void;
+/**
+ * Write a structured progress event to stderr as one JSON line.
+ *
+ * Lets long-running JSON-mode commands (notably `dvmctl deploy`) stream
+ * progress events to streaming callers — agents-as-intermediaries can tail
+ * stderr while keeping stdout reserved for the final single-line result.
+ */
+declare function progress(event: object): void;
 
 /**
  * The safety preflight that stands between the caller's Tempo key and the
@@ -7704,6 +7977,92 @@ type TempoWalletIntent = "replace" | "disconnect";
  */
 declare function assertTempoWalletIdle(intent: TempoWalletIntent): Promise<void>;
 
+/**
+ * Receipt failures are warnings about evidence, not failures of the paid job.
+ * Persistence errors are logged without changing the job's outcome.
+ */
+
+/** Verify and persist a funding receipt; callers may anchor state only on a sound verdict. */
+declare function captureFundingReceipt(args: {
+    receipt?: FundingReceipt;
+    parseError?: ReceiptParseError;
+    endpoint: string;
+    builder?: ReceiptTrustAnchor;
+    expectedCreditId: string;
+    expectedFundId: string;
+    expectedFundedMicro?: number;
+    expectedBalanceAfterMicro?: number;
+    expectedLedgerSeq?: number;
+    expectedCallerPubkey: string;
+}): ReceiptVerification | "unparseable" | "absent";
+type ReceiptCaptureStatus = ReceiptVerification | "unparseable";
+interface ReceiptCapture {
+    /** The verdict. `"absent"` when none was offered; `"unparseable"` for an invalid shape. */
+    status: ReceiptCaptureStatus;
+    receipt?: JobReceipt$1;
+    /** Per-link detail, present whenever {@link receipt} is. */
+    checks?: ReceiptVerifyResult["checks"];
+    /** Machine slug for an `invalid` or `unparseable` verdict. */
+    reason?: ReceiptVerifyResult["reason"] | ReceiptParseError;
+    /** Pre-rendered line an intermediary agent can relay verbatim. */
+    display: string;
+}
+declare function captureTransportReceipt(jobId: string, response: Pick<JobStatus, "receipt" | "receiptParseError">): ReceiptCapture;
+/**
+ * `receipt_verified` is always present. Non-absent captures include display
+ * text even when unparseable; raw receipt/checks require a parsed receipt.
+ * Emit only on terminal responses: absent during a running job means not yet
+ * issued, rather than unsupported receipts.
+ */
+declare function receiptJsonFields(capture: ReceiptCapture): Record<string, unknown>;
+declare function renderReceiptHuman(capture: ReceiptCapture): void;
+/**
+ * Snapshot `/v1/info`'s receipt trust anchor onto a job record at `saveJob`
+ * time, so verification later stays offline and pins the anchor that was live
+ * when the job ran rather than whatever the DVM advertises by then.
+ */
+declare function receiptTrustFields(provider: ProviderInfo): Pick<JobRecord, "receiptsSupported" | "builderAnchor">;
+
+/**
+ * Drain receipts lack a job's pinned anchor, so read it from the known endpoint.
+ * Unreachable reads return reachable=false; a successful read may still have no
+ * anchor. A present anchor is passed through for cryptographic verification,
+ * where a forged attestation is invalid rather than unattested.
+ */
+declare function fetchTrustAnchor(transport: Transport, ref: ProviderRef): Promise<TrustAnchorRead>;
+/**
+ * Collect a receipt missing from a locally-known job.
+ *
+ * The streamed request arc learns a job is over from the log, while
+ * `dvm status` can replay a terminal snapshot written by another command.
+ * Neither path has necessarily seen the receipt, which only rides on a job read.
+ *
+ * Costs one small GET, and only against a DVM that told us at submit time it
+ * issues receipts; everything else returns immediately. Best-effort throughout
+ * a failure here means no receipt this time, not a failed request.
+ */
+declare function fetchMissingJobReceipt(jobId: string, transport: Transport, ref: ProviderRef): Promise<{
+    receipt?: JobReceipt$1;
+    receiptParseError?: ReceiptParseError;
+}>;
+/**
+ * Fill in a job record's missing trust anchor from a live `/v1/info` read.
+ *
+ * `dvm status` can be the first command to see a receipt — for a job submitted
+ * down a paid arc, or one that predates this feature — and a stored receipt
+ * with no anchor verifies as `verified_unattested` when the DVM may well have
+ * an attestation to offer. One describe call settles it. Best-effort: an
+ * unreachable provider leaves the record as it was.
+ */
+declare function backfillTrustAnchor(jobId: string, transport: Transport, ref: ProviderRef): Promise<ReceiptTrustAnchor | undefined>;
+/**
+ * Re-verify a receipt already on the job record — the `dvm status` local-replay
+ * path. Deliberately re-runs the chain instead of caching a verdict, so a
+ * tampered `jobs.json` answers `invalid` rather than replaying the verdict the
+ * untampered bytes once earned.
+ */
+declare function replayStoredReceipt(job: JobRecord): ReceiptCapture;
+
 /** True when a value is a URL-safe caller-generated request identifier. */
 declare function isPublicRequestId(value: unknown): value is string;
 
@@ -7748,6 +8107,18 @@ interface WriteAgentMnemonicResult {
      */
     backupFile: string | null;
 }
+/**
+ * Read the agent wallet's BIP-39 mnemonic from `~/.dvm/wallet.mnemonic`.
+ *
+ * Returns `null` when the file is absent — callers treat that as the
+ * NUT-13-inactive "degraded mode" and skip `bip39seed` on the cashu-ts
+ * `Wallet` constructor (see `getWallet` in `src/lib/cashu/wallet.ts`).
+ *
+ * The mnemonic is normalised on the way out (trimmed; words lower-cased
+ * and joined by a single space) so any callsite gets the exact form
+ * `mnemonicToSeedSync` expects.
+ */
+declare function readAgentMnemonic(): string | null;
 /**
  * Throw `agent_mnemonic_exists` if `~/.dvm/wallet.mnemonic` is present and
  * `force` wasn't passed. {@link writeAgentMnemonic} calls this itself, so the
@@ -8138,6 +8509,8 @@ interface ToAgentProofTags {
 }
 /** Convert a cashu-ts proof into the lossless agent-wallet disk shape. */
 declare function toAgentProof(proof: Proof, mintUrl: string, lockedTo: string | null, tags?: ToAgentProofTags): AgentProof;
+/** Rehydrate persisted proofs for cashu-ts without dropping NUT-12 DLEQ. */
+declare function toCashuProofs(proofs: AgentProof[]): Proof[];
 
 interface ReceiveResult {
     mintUrl: string;
@@ -8948,6 +9321,13 @@ interface X402PaymentProof {
  * have a typed error. A cached rate can price the ceiling and budget ledger.
  */
 declare function tryX402Payment(request: X402PaymentRequest, wallet: X402Wallet): Promise<X402PaymentProof | null>;
+/**
+ * Whether this build can sign the requirement — the predicate
+ * {@link tryX402Payment} narrows a v2 challenge with, exported so a caller that
+ * pre-narrows one (the credit rail chain-matches before signing) drops the same
+ * entries the signer would rather than discarding a signable sibling.
+ */
+declare function isSignableExactRequirement(requirement: PaymentRequirementsV1 | PaymentRequirementsV2): boolean;
 
 /**
  * Key replacement and disconnect require chain proof that every owned channel
@@ -9073,4 +9453,132 @@ declare function readX402ChannelOnChain(args: {
  */
 declare function x402ChannelControlledBy(channel: StoredX402ChannelMetadata, address: string | null | undefined): boolean;
 
-export { ADMIN_STATE_UNAVAILABLE, AGENT_MNEMONIC_FILE, type AgentProof, type AgentWallet, type AmountLabelOptions, type AttestedDvmIdentity, BTC_RATE_FILE, BUDGET_FILE, type BudgetCaps, type BudgetSpendKind, type BudgetWindow, type BuilderLockKeypair, CAPABILITY_NAME_RE, COINGECKO_SIMPLE_PRICE_URL, CONFIG_AUDIT_FILE, CONFIG_BACKUP_FILE, CONFIG_DIR, CONFIG_FILE, CONFIG_PINNED_FILE, CREDITS_FILE, CREDIT_DRAIN_RAILS, CREDIT_FUNDING_MODES, CREDIT_FUND_RAILS, CREDIT_POSTURES, type CachedBtcRate, type CancelOptions, type CashOutMintOutcome, type CashOutQuote, type CliIdentityEntry, type CoinGeckoBtcSpot, type CoinGeckoSpot, type CompletedCreditHistoryPage, type CompletedCreditHistoryQuery, type CompletedCreditHistoryRecord, type CompletedRefundHistoryRecord, type Config, type ConfigBackupInfo, type ConfigDirModeResult, type ConfigField, type ConfigRollbackPreview, type ConfigSnapshotSlot, CreatedInvoice, type CreditConfig, type CreditDrainRail, type CreditFundOutcome, type CreditFundRail, type CreditFundStatus, type CreditFundingMode, type CreditMenu, type CreditOpResult, type CreditPlan, type CreditPosture, type CreditRailPick, type CreditRailReason, type CreditRailSource, type CreditTerms, type CreditWire, DEFAULT_AGENT_MINT_URL, DEFAULT_CREDIT_POSTURE, DEFAULT_RESERVE_LOCKTIME_SECONDS, DIAGNOSTIC_CATALOGUE_VERSION, DbTransport, type DeferredFunding, type DeliveredResult, type DescribeOptions, type DiagnosticCapabilityAuthority, type DiagnosticIdentityAuthority, DrainReceipt, type DrainReceiptChecks, type DrainReceiptVerifyResult, type DrainWire, type DrawCeilingSource, type DrawSkip, DvmError, DvmX402ChannelStorage, type EffectiveFundingRail, type ExpiredCreditLossHistoryRecord, FAVORITES_FILE, FEEDBACK_NUDGES_FILE, FEEDBACK_POSTURES, type FeedbackPosture, type Float, type FloatPayment, type FloatProbe, type FundCreditArgs, FundingReceipt, type FundingReceiptChecks, type FundingReceiptVerifyResult, type FundingSkip, IDENTITIES_FILE, IDENTITIES_VERSION, type IdentitiesFile, InvoiceStatus, JOBS_FILE, type JobCompletion, type JobEnvelope, type JobPolicy, JobReceipt$1 as JobReceipt, type JobRecord, type JobStatus, JsonValue, LightningBackend, type LightningFundingOffer, LightningPayment, LightningTransactionListOptions, LightningTransactionSnapshot, LightningWalletInfo, type LnAddressParts, MESSAGES_DIR, type MeltQuoteInfo, type MeltSweepResult, MemoryKVStore, Message, type MessagePollOptions, MessageType, MintAmountBounds, MintHealthCheckResult, type MintSource, type MnemonicValidationResult, MppxChallenge, MppxCredential, NWC_FUNDING_FLOAT_ROLE, type NextAction, type NextActionRefund, NwcBackend, type NwcConnection, NwcError, type NwcRequestOptions, type NwcTransaction, type OutboundMessage, PAIRINGS_DIR, PRIVKEY_HEX_RE, type PayInvoiceOutcome, type PayInvoiceReconcilingOptions, type PayInvoiceResult, type PayOutcome, type Payment, type PaymentRailKey, PaymentRequired, type PendingDrain, type PendingFunding, type PendingMint, type PendingSubmission, type PendingX402ExactFunding, type PendingX402Funding, type PersistedOutputData, PersistentCounterSource, type PreparedAgentSpend, type ProtectedTarget, type ProviderInfo, type ProviderRef, type ProviderText, type Quote, RAIL_FLAGS, RECEIPTS_FILE, RECENT_SPENDS_CAP, RECOMMENDED_MINTS, RECOVERY_MNEMONIC_FILE, REQUEST_INTENTS_DIR, RESUME_MAX_AGE_MS, RESUME_MAX_ATTEMPTS, ROUTER_FEEDBACK_CLAIM_HEADER, ROUTER_FEEDBACK_CLAIM_TTL_MS, type Rail, type RailFlag, type RailProbe, type ReceiptCapture, type ReceiptChecks, ReceiptCredit, type ReceiptInvalidReason, type ReceiptKeypair, type ReceiptParseError, type ReceiptTrustAnchor, type ReceiptVerification, type ReceiptVerifyResult, type ReleaseMintOutcome, type ResolvedBtcRate, ResourceInfo, SPANS_INSERTED_CHANNEL, STABLECOIN_FUND_RAILS, SUPPORTED_PROTOCOL_VERSION, type SelectError, type SendMessageOptions, type SpanProjectionResult, type SpanRow, type SpanTransport, SpanWriter, type StaleRateNotice, type StatusOptions, type StoredCredit, type StoredFundingMenuSnapshot, type StoredImplicitCredit, type StoredReceipt, type StoredSiblingCredit, type StoredX402ChannelConfig, type StoredX402ChannelMetadata, type StreamOptions, type StreamResult, type SubmissionSweepOutcome, type SubmitOptions, type SuppressedPurchase, type SweepResult, TEMPO_CHAIN_ID, TEMPO_CHANNELS_FILE, TEMPO_EXIT_KEY_MISSING_HINT, TEMPO_MODERATO_CHAIN_ID, TEMPO_MODERATO_RPC, TEMPO_PATH_USD_MODERATO, type TempoAccount, type TempoChannelAssociation, type TempoChannelExitResult, type TempoChannelReconcileResult, type TempoNetwork, type TerminalJobStatus, type Transport, type JobReceipt as TransportJobReceipt, type TrustAnchorRead, type TrustLadder, type V1InfoCapability, type V1InfoResponse, type VerifyJobReceiptArgs, WALLET_FILE, WALLET_VERSION, type WalletInfo, type X402Asset, type X402Balance, type X402BatchPayment, type X402ChannelChainReport, type X402ChannelClient, type X402ChannelReconciliation, type X402ConnectedWallet, type X402CreditFlavour, type X402CreditInstrument, X402EnvValidationError, type X402Network, type X402PaymentProof, type X402RefundArgs, type X402RefundOutcome, type X402RepinnedWallet, type X402UnobservedBalanceProvenance, X402Version, X402Wallet, X402_BATCH_CHANNEL_ABI, X402_BATCH_SETTLEMENT_KEY, X402_BATCH_SETTLEMENT_SCHEME, X402_CHANNELS_FILE, X402_DEFAULT_FACILITATOR, X402_EXACT_AUTHORIZATION_TTL_SECONDS, X402_EXACT_SCHEME, X402_NETWORKS, X402_PENDING_STALE_MS, X402_RECEIVER_AUTHORIZER_KEY, X402_REFUSAL_TRANSACTION_DISCOVERY_WINDOW_MS, X402_RPC_URL_KEY, X402_SELF_RELAY_KEY, abandonPendingSubmission, acknowledgeReplayedX402Payment, acknowledgeX402ChannelOwner, addPayment, advanceTempoChannelExit, applyImplicitReceiptCredit, applyReceiptCredit, applyRetryToPool, asProviderText, asProviderTextOpt, assertAgentMnemonicReplaceable, assertFloatBudget, assertSupportedX402Network, assertTempoWalletIdle, assertValidBudget, assertX402ChannelPayer, assertX402RequirementDescribesChannel, assertX402WalletIdle, attestedDvmIdentity, authenticatedBuilderPubkey, authorizeProtectedRemoval, automaticCreditBoundRail, availableRails, backfillTrustAnchor, backupSecretFile, bindDiagnosticCapabilityAuthority, bindDiagnosticIdentityAuthority, buildAdminAuthHeader, buildAdminChallenge, buildCompletionHintFields, buildDisplayMintInventory, buildPolicy, buildTempoCredential, builderLockPath, canReplaceExpiredX402Deposit, captureFundingReceipt, captureTransportReceipt, cashOutFromMint, cashuSubmissionBindingFingerprint, checkMeltQuoteState, checkReceiptAttestation, clearCreditSelection, clearPendingDrain, clearPendingX402ExactFunding, clearPendingX402Funding, clearRefillRailUnavailable, generateIdentity as cliIdentityStoreGenerateIdentity, commitAgentSpend, completionFromMessages, completionSnapshot, computeNextAction, computeSmartDenominations, configSnapshotPath, connectedTempoAccount, connectedX402Payer, correctPendingFundAmount, costAnchor, coveringMintsForSpend, createDiagnosticCapabilityAuthority, createMonotonicClock, createNoopLogger, createStdoutLogger, createTempoCloseCredential, createX402BatchPayment, currentContext, deleteAgentMnemonic, deriveAgentMasterKeypair, deriveBuilderLockKeypair, deriveBuilderLockPubkey, deriveIdentityFromPrivkey, derivePubkeyFromPrivkey, deriveReceiptKeypair, deriveReceiptSecret, deriveTempoAddress, describeConfigBackup, describeMintBounds, drainReceiptsDisplay, drainReceiptsHint, dvmLocationIdentity, effectiveCreditPosture, effectiveFundingMint, effectiveFundingRail, effectiveMints, emitFloatBudgetWarning, enforceGlobalBudget, ensureAddress, ensureConfig, ensureConfigDir, ensureConfigSubdir, ensureProvisionalCredit, entryKind, epochMsToIso, extendDiagnosticIdentityAuthority, extractBuilderHandle, fetchBtcUsdRate, fetchCoinGeckoBtcUsd, fetchCoinGeckoSpot, fetchLnurlPayInvoice, fetchMeltQuote, fetchMissingJobReceipt, fetchTrustAnchor, findSigningIdentityByPubkey, findX402Channel, floatBudgetJson, floatPaymentDisplay, floatPaymentJson, forgetCredit, formatAmount, formatAmountBestEffort, formatLocktime, formatPaymentAmount, formatSats, formatStaleness, formatUsd, formatUsdcMicrounits, fundAgentWallet, fundCredit, fundWireAmountMicro, fundingModeForTempoIntent, fundingModeForX402Flavour, fundingRailLabel, generateAgentMnemonic, generateEphemeralReceiptKey, generateTempoKey, generateX402PrivateKey, getBalance, getBalanceByMint, getFundingGuidance, getInfo, getInputFeesForProofs, getLastKnownBtcRate, getOutputTraceId, getTempoUsdcBalance, getX402Balance, hashedCanonicalDvmId, identitiesFileExists, info, initLoggers, insertSpanBatch, isAbortError, isCreditFundRail, isCreditFundingMode, isCreditPosture, isFeedbackPosture, isPaymentRailKey, isPublicRequestId, isResumable, isStablecoinFundRail, isTerminalJobStatus, isValidEvmPrivateKey, issueRouterFeedbackClaim, json, listCredits, listFundingMenuSnapshots, listImplicitCredits, listPendingFundings, listPendingX402Fundings, listPendingX402FundingsForChannel, listResumableTempoChargeFundings, listResumableX402ExactFundings, listResumableX402Fundings, listTempoChannelAssociations, listTransactions, listX402Channels, loadAgentWallet, loadAllJobs, loadConfig, loadConfiguredMints, loadCredit, loadFloat, loadIdentities, loadImplicitCredits, loadJob, loadLedger, loadPendingFunding, loadReceipt, loadReceipts, loadResumableX402ExactFunding, loadResumableX402Funding, loadTempoChannelAssociation, loadTempoChannelController, loadTempoChannelEntry, loadX402Wallet, loggers, looksLikeMnemonic, lookupInvoice, makeInvoice, markCredit, markImplicitCreditLost, markJobTerminal, markRefillDrainNoticed, markRefillRailUnavailable, maxKeysetDenomination, microToSats, missingDleqRecoveryDiagnostic, mnemonicFingerprint, monetaryJson, msatsToMicro, msatsToUsd, msatsToUsdCents, msatsToUsdc, needsPocketRefill, needsTopup, nextStepHint, normalizeCreditEndpoint, normalizeFeedbackEndpointHost, nwcDedupWindowMs, nwcRejectionDisplay, nwcTimeoutMs, offersTempoCreditFunding, offersX402CreditFunding, parseBudget, parseCreditMenu, parseCreditTerms, parseLnAddress, parseLocktime, parseNwcUri, parseStatedBudget, parseTraceparent, payInvoiceReconciling, payViaFloat, paymentRailLabel, pendingDrainById, pendingDrainFor, pickCreditFundRail, pinConfigSnapshot, pinDimension, planConfigReset, planCreditForQuote, planProbeDraw, pocketTargetMicro, pollNextAction, pollPendingCreditFundings, preferLightningFirst, prepareAgentSpend, prepareP2PKMint, previewConfigRollback, printFundingGuidance, probeFloat, probeRailLabel, probeWallets, processX402BatchCorrection, processX402BatchResponse, processX402BatchResponseForWallet, projectDiagnosticFields, projectEventName, projectSpanRow, providerProseSources, providerTextToString, railLabelAtSentenceStart, randomTraceId, raw, readCompletedCreditHistory, readFundValuation, readX402ChannelOnChain, receiptDisplay, receiptFailureDetail, receiptHint, receiptIssuedAtIso, receiptJsonFields, receiptPubkeyFromSecret, receiptTrustFields, receiveToAgentWallet, reclaimAtMs, reconcileRefusedX402Deposits, reconcileTempoChannelOnChain, recordBalanceResponse, recordCreditX402Instrument, recordDrainReceipts, recordFloatSpend, recordFundResponse, recordFundingMenuSnapshot, recordPendingDrain, recordPendingX402ExactFunding, recordPendingX402Funding, recordRefusedDrawBalance, recordSpend, recordX402ChannelMetadata, recoverPendingSubmission, redactUrl, redactUrlsInText, refFromJob, refundX402BatchChannel, releaseAgentReserve, removeX402Wallet, renderReceiptHuman, repairConfigDirMode, repinX402WalletNetwork, replayStoredReceipt, reserveAgentWallet, resolveBtcUsdRate, resolveFundMint, resolveLnurlPayMetadataUrl, resolveRpcHttpTransportOptions, resolveRpcOverride, resolveSigningIdentity, resolveTempoAsset, resolveTempoNetwork, resolveX402Asset, resolveX402ChannelRpc, restoreProofsFromOutputs, retireConfigBackup, retirePendingX402Funding, rollbackConfig, rpcEndpointLine, rpcEndpointSuffix, saveAgentWallet, saveIdentities, saveJob, saveLedger, saveX402Wallet, selectProofsForSpend, serializeOutputData, setEmitter, setOutputTraceId, settleDrainEvidence, shellQuoteArg, signDvmRequestData, signRequestData, signedRequestDomain, spendableAt, staleRateNotice, statusSnapshot, swapFeeForProofs, swapSendReserve, sweepPendingMelts, sweepPendingMints, sweepPendingSubmissions, sweepStaleInFlight, tempoBalanceCheckHint, tempoChannelControlledBy, tempoCredentialAmountMicro, tempoKeyImportRoutes, tempoSessionChallenge, tempoSessionChallengeMicro, tempoTokenReference, tempoWrongAssetHint, tierCapOverrides, toAgentProof, toFloatError, transportErrorCode, trustLadderFor, trustOverrideCapMicro, tryResolveBtcUsdRate, tryResolveTempoAsset, tryX402Payment, unreachableRailDisplay, unreachableRailHint, unrecordedFloatBudgetWarning, unsignRequestData, updateConfig, updateJob, usdToMsats, usdcToMsats, validateAgentMnemonic, validateLnAddress, validateX402Env, verifyCanonicalSignedRequest, verifyChallenge, verifyDrainReceiptChain, verifyFundingReceiptChain, verifyJobReceipt, verifyRouterFeedbackClaim, walletExists, weakestReceiptVerdict, windowStart, withIdentitiesLock, withInitRetry, withNwcPool, withTempoChannelLock, withTraceContext, withWalletLock, withX402ChannelLock, writeAgentMnemonic, x402ChannelBalanceUnreconciledAt, x402ChannelControlledBy, x402ChannelReservation, x402CreditChannelNetworks, x402CreditExactNetworks, x402ExactFundingDead, x402FlavourForInstrument, x402NetworkByCaip2, x402NetworkBySlug, x402NetworkLabel, x402NetworkListForCopy, x402PendingBlockExpiresAt, x402PendingDepositExpiresAt, x402PendingFundingJson, x402PendingRetired, x402PendingStale, x402PendingUnsettled, x402RequiredFromError, x402ReservationRelease, x402SupportedNetworksHint, x402VoucherPendingRefusal, x402WrongAssetHint };
+/** Credential projection only; config persistence and replacement policy belong to its owner. */
+interface WalletCredentialConfig {
+    x402?: {
+        privateKey: string;
+        network?: string;
+    };
+    tempo?: {
+        method: string;
+        apiKey?: string;
+        network?: "mainnet" | "moderato";
+    };
+}
+interface TempoCredentialAccount {
+    address: `0x${string}`;
+    privateKey: `0x${string}`;
+    network?: "mainnet" | "moderato";
+}
+declare function x402WalletFromConfig(config: WalletCredentialConfig | null): X402Wallet | null;
+declare function tempoAccountFromConfig(config: WalletCredentialConfig | null): Promise<TempoCredentialAccount | null>;
+
+/** Load the persisted ledger. Returns an empty ledger if the file is missing or corrupt. */
+declare function loadBudgetLedger(file: string): BudgetLedger;
+/**
+ * Persist the ledger using a temp-file-and-rename so a crash mid-write cannot
+ * leave a partial JSON on disk (which would silently reset configured caps).
+ * Confirmed spending is retained indefinitely; budget checks apply their own
+ * window cutoffs.
+ */
+declare function saveBudgetLedger(file: string, ledger: BudgetLedger): void;
+/**
+ * Record one logical spend at most once across a crash/replay window.
+ *
+ * Callers must give the logical operation a stable `jobId`. Kind, job id and
+ * provider form the idempotency tuple, so unrelated payments on one job can
+ * still use the ordinary append-only path (`once = false`).
+ * The caller holds its existing payment lock across check, payment, and append;
+ * this writer does not create a separate lock domain.
+ */
+declare function appendBudgetSpend(file: string, opts: RecordSpendOptions, once?: boolean): boolean;
+
+/**
+ * Derived per-DVM agent refund keypair. Both halves are hex; the privkey is
+ * 32 bytes (64 chars), the pubkey is the 33-byte compressed secp256k1
+ * encoding (66 chars starting with `02` or `03`).
+ *
+ * The privkey must never be persisted to disk — it is regenerated on demand
+ * from the agent's mnemonic when `dvm wallet release` needs to sign refund
+ * witnesses on unshipped pre-fund proofs.
+ */
+interface AgentRefundKeypair {
+    privkey: string;
+    pubkey: string;
+}
+/**
+ * Derive the agent's per-DVM refund keypair from a BIP-39 mnemonic.
+ *
+ * The pubkey is attached as the NUT-11 `refund` tag on pre-fund proofs minted
+ * by `dvm wallet reserve --builder <handle>` **and**, since the behavior was introduced, on every
+ * per-call swap output; the privkey signs refund witnesses on the matching
+ * proofs after `t_expire` (`dvm wallet release`, and the auto-reclaim in
+ * `sweepPendingSubmissions`).
+ *
+ * Per-DVM scoping means colluding builders cannot correlate the agent's
+ * identity across DVMs from refund tags alone — each DVM sees a different
+ * agent pubkey. What does trade away, deliberately, is *within*-DVM
+ * unlinkability: one DVM now sees the same refund pubkey on every call from
+ * this agent. The operator accepted that in exchange for eliminating
+ * caller-side money loss. The mnemonic + `canonical_dvm_id` is the stable
+ * derivation root; nothing else needs to be persisted to recover the keypair.
+ */
+declare function deriveAgentRefundSubkey(mnemonic: string, canonicalDvmId: string): AgentRefundKeypair;
+declare function deriveAgentRefundSubkeyPubkey(mnemonic: string, canonicalDvmId: string): string;
+
+declare function sha256hex(input: string): string;
+
+/**
+ * Wire strings the Tempo session handshake is keyed on, shared by the SDK that
+ * writes them and the caller that reads them.
+ *
+ * Deliberately dependency-free and on the `src/lib/` side of the boundary:
+ * `src/sdk/server/` imports from `src/lib/` freely, and nothing in `src/lib/`
+ * may import back.
+ */
+/**
+ * The reason a DVM gives when it has accepted a Tempo session's on-chain
+ * management top-up and now wants the cumulative voucher that funds against it.
+ *
+ * mppx's session hook posts the management credential and expects an empty
+ * success before it will sign the voucher; dvmkit shares `/v1/credit` for both
+ * phases, so the SDK answers that step with a 402 carrying this reason plus the
+ * voucher challenge, and `credit-fund.ts`'s bridge translates exactly that
+ * answer into the 204 mppx is waiting for.
+ *
+ * Written once here because the coupling is otherwise a substring match across
+ * two modules with nothing linking them: a reword on the SDK side — the sort of
+ * thing payment-language pass does routinely — would stop the
+ * translation, mppx would never build the voucher, and every Tempo session
+ * top-up would wedge, caught only by the non-per-PR Tempo money loop.
+ * Same reasoning as `MPPX_HMAC_MISMATCH_REASON` in `sdk/server/mpp-setup.ts`.
+ */
+declare const TEMPO_SESSION_UPDATED_REASON = "Tempo session updated; attach the next voucher to fund this credit.";
+
+/** Backoff carried across repeated quote polls within one wait. */
+interface MintQuoteRetryState {
+    backoffMs: number;
+    lastRetryAt?: number;
+}
+/** Clock and deadline seams shared by fund/reserve waits and recovery sweeps. */
+interface MintQuoteRetryOptions {
+    /** Absolute epoch/monotonic value, in the same time domain returned by `now`. */
+    deadlineMs: number;
+    /** Quote identifier included in a structured deadline error. */
+    quoteId: string;
+    /** Mutable state when backoff must survive more than one operation call. */
+    state?: MintQuoteRetryState;
+    now?: () => number;
+    sleep?: (ms: number) => Promise<void>;
+}
+declare function createMintQuoteRetryState(): MintQuoteRetryState;
+/**
+ * Retry one mint quote-status operation until it succeeds or its caller's
+ * deadline arrives. Unknown/client failures are rethrown immediately.
+ */
+declare function retryMintQuoteOperation<T>(operation: () => Promise<T>, opts: MintQuoteRetryOptions): Promise<T>;
+
+/** Bind a token-dependent fund commitment into a serializable resume context. */
+declare function bindCashuTokenToSubmissionContext(context: PendingSubmissionContext | undefined, cashuToken: string): PendingSubmissionContext | undefined;
+
+export { ADMIN_STATE_UNAVAILABLE, AGENT_MNEMONIC_FILE, type AgentProof, type AgentRecentSpend, type AgentWallet, type AmountLabelOptions, type AttestedDvmIdentity, BTC_RATE_FILE, BUDGET_FILE, type BudgetCaps, type BudgetCheckResult, type BudgetLedger, type BudgetLedgerEntry, type BudgetSpendBreakdown, type BudgetSpendKind, type BudgetWindow, type BuilderLockKeypair, CAPABILITY_NAME_RE, COINGECKO_SIMPLE_PRICE_URL, CONFIG_AUDIT_FILE, CONFIG_BACKUP_FILE, CONFIG_DIR, CONFIG_FILE, CONFIG_PINNED_FILE, CREDITS_FILE, CREDIT_DRAIN_RAILS, CREDIT_FUNDING_MODES, CREDIT_FUND_RAILS, CREDIT_POSTURES, type CachedBtcRate, type CancelOptions, type CashOutMintOutcome, type CashOutQuote, type CliIdentityEntry, type CoinGeckoBtcSpot, type CoinGeckoSpot, type CompletedCreditHistoryPage, type CompletedCreditHistoryQuery, type CompletedCreditHistoryRecord, type CompletedRefundHistoryRecord, type Config, type ConfigBackupInfo, type ConfigDirModeResult, type ConfigField, type ConfigRollbackPreview, type ConfigSnapshotSlot, CreatedInvoice, type CreditConfig, type CreditDrainRail, type CreditFundOutcome, type CreditFundRail, type CreditFundStatus, type CreditFundingMode, type CreditMenu, type CreditOpResult, type CreditPlan, type CreditPosture, type CreditRailPick, type CreditRailReason, type CreditRailSource, type CreditTerms, type CreditWire, DEFAULT_AGENT_MINT_URL, DEFAULT_CREDIT_POSTURE, DEFAULT_RESERVE_LOCKTIME_SECONDS, DIAGNOSTIC_CATALOGUE_VERSION, DbTransport, type DeferredFunding, type DeliveredResult, type DescribeOptions, type DiagnosticCapabilityAuthority, type DiagnosticIdentityAuthority, DrainReceipt, type DrainReceiptChecks, type DrainReceiptVerifyResult, type DrainWire, type DrawCeilingSource, type DrawSkip, DvmError, DvmX402ChannelStorage, type EffectiveFundingRail, type ExpiredCreditLossHistoryRecord, FAVORITES_FILE, FEEDBACK_NUDGES_FILE, FEEDBACK_POSTURES, type FeedbackPosture, type Float, type FloatPayment, type FloatProbe, type FundCreditArgs, type FundValuation, FundingReceipt, type FundingReceiptChecks, type FundingReceiptVerifyResult, type FundingSkip, IDENTITIES_FILE, IDENTITIES_VERSION, type IdentitiesFile, InvoiceStatus, JOBS_FILE, type JobCompletion, type JobEnvelope, type JobPolicy, JobReceipt$1 as JobReceipt, type JobRecord, type JobStatus, JsonValue, LightningBackend, type LightningFundingOffer, LightningPayment, LightningTransactionListOptions, LightningTransactionSnapshot, LightningWalletInfo, type LnAddressParts, MESSAGES_DIR, type MeltQuoteInfo, type MeltSweepResult, MemoryKVStore, Message, type MessagePollOptions, MessageType, MintAmountBounds, MintHealthCheckResult, type MintSource, type MnemonicValidationResult, MppxChallenge, MppxCredential, NWC_FUNDING_FLOAT_ROLE, type NextAction, type NextActionRefund, NwcBackend, type NwcConnection, NwcError, type NwcRequestOptions, type NwcTransaction, type OutboundMessage, PAIRINGS_DIR, PRIVKEY_HEX_RE, type PayInvoiceOutcome, type PayInvoiceReconcilingOptions, type PayInvoiceResult, type PayOutcome, type Payment, type PaymentRailKey, PaymentRequired, PaymentRequirementsV1, PaymentRequirementsV2, type PendingDrain, type PendingFunding, type PendingMelt, type PendingMint, type PendingMintMintingState, type PendingSubmission, type PendingSubmissionContext, type PendingTempoChargeFunding, type PendingX402ExactFunding, type PendingX402Funding, type PersistedOutputData, PersistentCounterSource, type PreparedAgentSpend, type ProtectedTarget, type ProviderInfo, type ProviderRef, type ProviderText, type Quote, RAIL_FLAGS, RECEIPTS_FILE, RECENT_SPENDS_CAP, RECOMMENDED_MINTS, RECOVERY_MNEMONIC_FILE, REQUEST_INTENTS_DIR, RESUME_MAX_AGE_MS, RESUME_MAX_ATTEMPTS, ROUTER_FEEDBACK_CLAIM_HEADER, ROUTER_FEEDBACK_CLAIM_TTL_MS, type Rail, type RailAsset, type RailFlag, type RailProbe, type ReceiptCapture, type ReceiptChecks, ReceiptCredit, type ReceiptInvalidReason, type ReceiptKeypair, type ReceiptParseError, type ReceiptTrustAnchor, type ReceiptVerification, type ReceiptVerifyResult, type RecordSpendOptions, type ReleaseMintOutcome, type ResolvedBtcRate, ResourceInfo, type RpcSource, SPANS_INSERTED_CHANNEL, STABLECOIN_FUND_RAILS, SUPPORTED_PROTOCOL_VERSION, type SelectError, type SendMessageOptions, type SpanProjectionResult, type SpanRow, type SpanTransport, SpanWriter, type StaleRateNotice, type StatusOptions, type StoredCredit, type StoredCreditX402Binding, type StoredFundingMenuSnapshot, type StoredImplicitCredit, type StoredReceipt, type StoredSiblingCredit, type StoredX402ChannelConfig, type StoredX402ChannelMetadata, type StreamOptions, type StreamResult, type SubmissionSweepOutcome, type SubmitOptions, type SuppressedPurchase, type SwapSendReserve, type SweepResult, TEMPO_CHAIN_ID, TEMPO_CHANNELS_FILE, TEMPO_CHARGE_PENDING_STALE_MS, TEMPO_EXIT_KEY_MISSING_HINT, TEMPO_MODERATO_CHAIN_ID, TEMPO_MODERATO_RPC, TEMPO_PATH_USD_MODERATO, TEMPO_SESSION_UPDATED_REASON, type TempoAccount, type TempoChannelAssociation, type TempoChannelController, type TempoChannelDescriptor, type TempoChannelExitResult, type TempoChannelReconcileResult, type TempoChannelStoreContext, type TempoCredentialAccount, type TempoNetwork, type TempoSessionClientResolver, type TerminalJobStatus, type Transport, type JobReceipt as TransportJobReceipt, type TrustAnchorRead, type TrustLadder, type V1InfoCapability, type V1InfoResponse, type VerifyJobReceiptArgs, WALLET_FILE, WALLET_VERSION, type WalletCredentialConfig, type WalletInfo, type X402Asset, type X402Balance, type X402BatchPayment, type X402ChannelChainReport, type X402ChannelClient, type X402ChannelReconciliation, type X402ConnectedWallet, type X402CreditFlavour, type X402CreditInstrument, X402EnvValidationError, type X402Network, type X402PaymentProof, type X402RefundArgs, type X402RefundOutcome, type X402RepinnedWallet, type X402UnobservedBalanceProvenance, X402Version, type X402VoucherPendingState, X402Wallet, X402_BATCH_CHANNEL_ABI, X402_BATCH_SETTLEMENT_KEY, X402_BATCH_SETTLEMENT_SCHEME, X402_CHANNELS_FILE, X402_DEFAULT_FACILITATOR, X402_EXACT_AUTHORIZATION_TTL_SECONDS, X402_EXACT_SCHEME, X402_NETWORKS, X402_PENDING_STALE_MS, X402_RECEIVER_AUTHORIZER_KEY, X402_REFUSAL_TRANSACTION_DISCOVERY_WINDOW_MS, X402_RPC_URL_KEY, X402_SELF_RELAY_KEY, abandonPendingSubmission, acknowledgeReplayedX402Payment, acknowledgeX402ChannelOwner, addPayment, advanceTempoChannelExit, appendBudgetSpend, appendFundingReceipt, appendReceipt, applyImplicitReceiptCredit, applyReceiptCredit, applyRetryToPool, asProviderText, asProviderTextOpt, assertAgentMnemonicReplaceable, assertFloatBudget, assertNoRivalX402Voucher, assertSupportedX402Network, assertTempoSessionChallengeWithinAsk, assertTempoSessionDepositWithinCap, assertTempoSessionVoucherWithinAsk, assertTempoWalletIdle, assertValidBudget, assertX402ChannelPayer, assertX402RequirementDescribesChannel, assertX402WalletIdle, attestedDvmIdentity, authenticatedBuilderPubkey, authorizeProtectedRemoval, automaticCreditBoundRail, availableRails, backfillTrustAnchor, backupSecretFile, bindCashuTokenToSubmissionContext, bindDiagnosticCapabilityAuthority, bindDiagnosticIdentityAuthority, breakdownSince, buildAdminAuthHeader, buildAdminChallenge, buildCompletionHintFields, buildDisplayMintInventory, buildPolicy, buildTempoCredential, builderLockPath, canReplaceExpiredX402Deposit, capFor, captureFundingReceipt, captureTransportReceipt, cashOutFromMint, cashuSubmissionBindingFingerprint, cashuSubmissionBindingFromContext, checkBudgetForLedger, checkMeltQuoteState, checkReceiptAttestation, clearCreditSelection, clearPendingDrain, clearPendingFunding, clearPendingTempoChargeFunding, clearPendingX402ExactFunding, clearPendingX402Funding, clearRefillRailUnavailable, generateIdentity as cliIdentityStoreGenerateIdentity, commitAgentSpend, completionFromMessages, completionSnapshot, computeNextAction, computeSmartDenominations, configSnapshotPath, connectedTempoAccount, connectedX402Payer, correctPendingFundAmount, costAnchor, coveringMintsForSpend, createDiagnosticCapabilityAuthority, createMintQuoteRetryState, createMonotonicClock, createNoopLogger, createStdoutLogger, createTempoChannelStore, createTempoCloseCredential, createTempoCreditSession, createTempoSessionPaymentFetch, createX402BatchPayment, currentContext, deleteAgentMnemonic, deriveAgentMasterKeypair, deriveAgentRefundSubkey, deriveAgentRefundSubkeyPubkey, deriveBuilderLockKeypair, deriveBuilderLockPubkey, deriveIdentityFromPrivkey, derivePubkeyFromPrivkey, deriveReceiptKeypair, deriveReceiptSecret, deriveTempoAddress, describeConfigBackup, describeMintBounds, drainReceiptsDisplay, drainReceiptsHint, dvmLocationIdentity, effectiveCreditPosture, effectiveFundingMint, effectiveFundingRail, effectiveMints, emitFloatBudgetWarning, enforceGlobalBudget, ensureAddress, ensureConfig, ensureConfigDir, ensureConfigSubdir, ensureProvisionalCredit, entryKind, epochMsToIso, extendDiagnosticIdentityAuthority, extractBuilderHandle, fetchBtcUsdRate, fetchCoinGeckoBtcUsd, fetchCoinGeckoSpot, fetchLnurlPayInvoice, fetchMeltQuote, fetchMissingJobReceipt, fetchTrustAnchor, findSigningIdentityByPubkey, findX402Channel, floatBudgetJson, floatPaymentDisplay, floatPaymentJson, forgetCredit, formatAmount, formatAmountBestEffort, formatLocktime, formatPaymentAmount, formatSats, formatStaleness, formatUsd, formatUsdcMicrounits, fundAgentWallet, fundCredit, fundWireAmountMicro, fundingModeForTempoIntent, fundingModeForX402Flavour, fundingRailLabel, generateAgentMnemonic, generateEphemeralReceiptKey, generateTempoKey, generateX402PrivateKey, getBalance, getBalanceByMint, getFundingGuidance, getInfo, getInputFeesForProofs, getLastKnownBtcRate, getOutputTraceId, getTempoUsdcBalance, getX402Balance, hashedCanonicalDvmId, identitiesFileExists, info, initLoggers, insertSpanBatch, isAbortError, isCreditFundRail, isCreditFundingMode, isCreditPosture, isFeedbackPosture, isPaymentRailKey, isPublicRequestId, isResumable, isSignableExactRequirement, isStablecoinFundRail, isTerminalJobStatus, isValidEvmPrivateKey, issueRouterFeedbackClaim, json, listCredits, listFundingMenuSnapshots, listImplicitCredits, listPendingFundings, listPendingX402Fundings, listPendingX402FundingsForChannel, listResumableTempoChargeFundings, listResumableX402ExactFundings, listResumableX402Fundings, listTempoChannelAssociations, listTransactions, listX402Channels, loadAgentWallet, loadAllJobs, loadBudgetLedger, loadConfig, loadConfiguredMints, loadCredit, loadCreditX402Binding, loadFloat, loadIdentities, loadImplicitCredits, loadJob, loadLedger, loadPendingFunding, loadReceipt, loadReceipts, loadResumableTempoChargeFunding, loadResumableX402ExactFunding, loadResumableX402Funding, loadTempoChannelAssociation, loadTempoChannelAssociationByKey, loadTempoChannelController, loadTempoChannelEntry, loadWalletConfiguredMints, loadX402Wallet, loggers, looksLikeMnemonic, lookupInvoice, makeInvoice, markCredit, markImplicitCreditLost, markJobTerminal, markRefillDrainNoticed, markRefillRailUnavailable, maxAdvertisedMicro, maxKeysetDenomination, microToSats, missingDleqRecoveryDiagnostic, mnemonicFingerprint, monetaryJson, msatsToMicro, msatsToUsd, msatsToUsdCents, msatsToUsdc, needsPocketRefill, needsTopup, nextStepHint, normalizeCreditEndpoint, normalizeFeedbackEndpointHost, nwcDedupWindowMs, nwcRejectionDisplay, nwcTimeoutMs, offersTempoCreditCharge, offersTempoCreditFunding, offersTempoCreditSession, offersX402CreditChannel, offersX402CreditFlavour, offersX402CreditFunding, parseBudget, parseCreditMenu, parseCreditTerms, parseLnAddress, parseLocktime, parseNwcUri, parseStatedBudget, parseTraceparent, payInvoiceReconciling, payViaFloat, paymentRailLabel, pendingDrainById, pendingDrainFor, persistTempoOpenCredential, pickCreditFundRail, pinConfigSnapshot, pinDimension, planConfigReset, planCreditForQuote, planProbeDraw, pocketTargetMicro, pollNextAction, pollPendingCreditFundings, preferLightningFirst, prepareAgentSpend, prepareP2PKMint, previewConfigRollback, printFundingGuidance, probeFloat, probeRailLabel, probeWallets, processX402BatchCorrection, processX402BatchResponse, processX402BatchResponseForWallet, progress, projectDiagnosticFields, projectEventName, projectSpanRow, providerProseSources, providerTextToString, railLabelAtSentenceStart, randomTraceId, raw, readAgentMnemonic, readCompletedCreditHistory, readFundValuation, readX402ChannelOnChain, receiptDisplay, receiptFailureDetail, receiptHint, receiptIssuedAtIso, receiptJsonFields, receiptPubkeyFromSecret, receiptTrustFields, receiveToAgentWallet, reclaimAtMs, reconcileRefusedX402Deposits, reconcileTempoChannelOnChain, recordBalanceResponse, recordCreditX402Instrument, recordDrainReceipts, recordFloatSpend, recordFundResponse, recordFundingMenuSnapshot, recordPendingDrain, recordPendingFunding, recordPendingTempoChargeFunding, recordPendingX402ExactFunding, recordPendingX402Funding, recordRefusedDrawBalance, recordSpend, recordX402ChannelMetadata, recoverPendingSubmission, redactUrl, redactUrlsInText, refFromJob, refundX402BatchChannel, rehydrateOutputData, releaseAgentReserve, removeX402Wallet, renderReceiptHuman, repairConfigDirMode, repinX402WalletNetwork, replayStoredReceipt, reserveAgentWallet, resolveBtcUsdRate, resolveFundMint, resolveLnurlPayMetadataUrl, resolveRpcHttpTransportOptions, resolveRpcOverride, resolveSigningIdentity, resolveTempoAsset, resolveTempoNetwork, resolveX402Asset, resolveX402ChannelRpc, restoreProofsFromOutputs, retireConfigBackup, retirePendingX402Funding, retireTempoChannel, retireTempoChannelScope, retryMintQuoteOperation, rollbackConfig, rpcEndpointLine, rpcEndpointSuffix, saveAgentWallet, saveBudgetLedger, saveIdentities, saveJob, saveLedger, saveX402Wallet, selectProofsForSpend, serializeOutputData, setEmitter, setOutputTraceId, settleDrainEvidence, sha256hex, shellQuoteArg, signDvmRequestData, signRequestData, signedRequestDomain, spendEntry, spendableAt, staleRateNotice, statusSnapshot, swapFeeForProofs, swapSendReserve, sweepPendingMelts, sweepPendingMints, sweepPendingSubmissions, sweepStaleInFlight, tempoAccountFromConfig, tempoBalanceCheckHint, tempoChannelControlledBy, tempoChargeCredentialSettleable, tempoCredentialAmountMicro, tempoCredentialValidBefore, tempoDescriptorController, tempoKeyImportRoutes, tempoSessionAssociationByKey, tempoSessionChallenge, tempoSessionChallengeChannelScope, tempoSessionChallengeMicro, tempoSessionCredentialChannelScope, tempoSessionCredentialCumulativeMicro, tempoSessionCumulativeCapMicro, tempoSessionPriorCumulativeMicro, tempoTokenReference, tempoWrongAssetHint, tierCapOverrides, toAgentProof, toCashuProofs, toFloatError, transportErrorCode, trustLadderFor, trustOverrideCapMicro, tryResolveBtcUsdRate, tryResolveTempoAsset, tryX402Payment, unreachableRailDisplay, unreachableRailHint, unrecordedFloatBudgetWarning, unsignRequestData, updateConfig, updateJob, usdToMsats, usdcToMsats, validateAgentMnemonic, validateLnAddress, validateX402Env, verifyCanonicalSignedRequest, verifyChallenge, verifyDrainReceiptChain, verifyFundingReceiptChain, verifyJobReceipt, verifyRouterFeedbackClaim, walletExists, weakestReceiptVerdict, windowEnd, windowStart, withIdentitiesLock, withInitRetry, withNwcPool, withTempoChannelLock, withTraceContext, withWalletLock, withX402ChannelLock, withholdsTempoCreditSession, withinAdvertisedTolerance, writeAgentMnemonic, x402ChannelBalanceUnreconciledAt, x402ChannelControlledBy, x402ChannelReservation, x402CreditChannelNetworks, x402CreditExactNetworks, x402CreditFlavour, x402CreditFundingNetworks, x402ExactFundingDead, x402FlavourForInstrument, x402InstrumentForFlavour, x402NetworkByCaip2, x402NetworkBySlug, x402NetworkLabel, x402NetworkListForCopy, x402PendingBlockExpiresAt, x402PendingDepositExpiresAt, x402PendingFundingJson, x402PendingRetired, x402PendingStale, x402PendingUnsettled, x402RequiredFromError, x402ReservationRelease, x402SupportedNetworksHint, x402VoucherPendingRefusal, x402VoucherPendingState, x402WalletFromConfig, x402WrongAssetHint };