@engramx/idl 0.16.0-rc.1

package/dist/market.idl.d.ts

@@ -0,0 +1,1354 @@
+import type { Principal } from '@icp-sdk/core/principal';
+import type { ActorMethod } from '@icp-sdk/core/agent';
+import type { IDL } from '@icp-sdk/core/candid';
+
+export interface AccessGrant {
+  expiresAt: bigint;
+  contentRef: ContentRef;
+  hmac: Uint8Array | number[];
+  grantId: string;
+  grantee: Principal;
+  receiptId: string;
+  issuedAt: bigint;
+}
+export interface AdminRoles {
+  roles: Array<RoleGrant>;
+}
+export interface AuditEntry {
+  id: bigint;
+  entryHash: Uint8Array | number[];
+  callerRole: Role;
+  operation: string;
+  details: string;
+  caller: Principal;
+  success: boolean;
+  timestampNs: bigint;
+}
+export interface AuditHead {
+  headHash: Uint8Array | number[];
+  size: bigint;
+}
+export interface CertifiedAuditHead {
+  total: bigint;
+  certificate: [] | [Uint8Array | number[]];
+  headHash: Uint8Array | number[];
+  size: bigint;
+  witness: [] | [Uint8Array | number[]];
+}
+export interface ContentDelivery {
+  settlementTxHash: [] | [string];
+  grant: AccessGrant;
+  delivery: DeliveryMethod;
+}
+export interface ContentEntry {
+  id: string;
+  createdAt: bigint;
+  mimeType: string;
+  totalSize: bigint;
+  chunkCount: bigint;
+}
+export interface ContentRef {
+  id: string;
+  metadata: [] | [Array<[string, string]>];
+  mimeType: [] | [string];
+  sizeBytes: [] | [bigint];
+}
+export type ContentResponse =
+  { Delivered: ContentDelivery } | { PaymentRequired: Array<PaymentRequirement> };
+export type DeliveryMethod =
+  | { httpUrl: string }
+  | { inline: Uint8Array | number[] }
+  | { canisterQuery: { method: string; chunkCount: bigint } }
+  | { assetCanister: { path: string; canisterId: Principal } };
+export interface Eip3009Authorization {
+  r: Uint8Array | number[];
+  s: Uint8Array | number[];
+  v: number;
+  to: string;
+  value: bigint;
+  from: string;
+  validAfter: bigint;
+  nonce: Uint8Array | number[];
+  validBefore: bigint;
+}
+export type EndpointStatus = { Enabled: null } | { Disabled: null } | { Deleted: null };
+export type Error =
+  | { Invalid: string }
+  | { NotFound: string }
+  | { Refused: string }
+  | { Other: string }
+  | { Unavailable: string }
+  | { Conflict: string };
+export interface GenesisNote {
+  predecessorSize: [] | [bigint];
+  predecessorHeadHash: [] | [Uint8Array | number[]];
+  note: string;
+  version: string;
+  genesisAtNs: bigint;
+}
+export interface HttpRequest {
+  url: string;
+  method: string;
+  body: Uint8Array | number[];
+  headers: Array<[string, string]>;
+}
+export interface HttpResponse {
+  body: Uint8Array | number[];
+  headers: Array<[string, string]>;
+  upgrade: [] | [boolean];
+  status_code: number;
+}
+export interface Job {
+  id: string;
+  completedAtNs: [] | [bigint];
+  expiresAtNs: bigint;
+  status: JobStatus;
+  result: [] | [Uint8Array | number[]];
+  paymentReceiptId: string;
+  deliveryCallback: [] | [string];
+  parkedTx: [] | [ParkedTx];
+  operator: [] | [Principal];
+  createdAtNs: bigint;
+  actualCost: [] | [bigint];
+  buyer: string;
+  serviceId: string;
+  proof: [] | [Uint8Array | number[]];
+  amount: bigint;
+  params: Uint8Array | number[];
+}
+export interface JobCounts {
+  total: bigint;
+  active: bigint;
+  expired: bigint;
+  settled: bigint;
+  refunded: bigint;
+  settling: bigint;
+  parked: bigint;
+}
+export type JobStatus =
+  | { Disputed: null }
+  | { Refunded: null }
+  | { Computing: null }
+  | { other: string }
+  | { Settling: null }
+  | { Submitted: null }
+  | { Assigned: null }
+  | { Verified: null }
+  | { Expired: null }
+  | { Settled: null }
+  | { Pending: null };
+export interface Page {
+  total: bigint;
+  withheld: bigint;
+  items: Array<ServiceDefinition>;
+}
+export interface Page_1 {
+  total: bigint;
+  withheld: bigint;
+  items: Array<PendingWithdrawal>;
+}
+export interface Page_2 {
+  total: bigint;
+  withheld: bigint;
+  items: Array<Job>;
+}
+export interface Page_3 {
+  total: bigint;
+  withheld: bigint;
+  items: Array<X402Endpoint>;
+}
+export interface Page_4 {
+  total: bigint;
+  withheld: bigint;
+  items: Array<PurchaseRecord>;
+}
+export interface Page_5 {
+  total: bigint;
+  withheld: bigint;
+  items: Array<AuditEntry>;
+}
+export interface Page_6 {
+  total: bigint;
+  withheld: bigint;
+  items: Array<ContentEntry>;
+}
+export interface Page_7 {
+  total: bigint;
+  withheld: bigint;
+  items: Array<Principal>;
+}
+export type ParkedLeg = { UptoRemainder: null } | { Refund: null } | { Settle: null };
+export interface ParkedTx {
+  leg: ParkedLeg;
+  token: string;
+  parkedAt: bigint;
+  txHash: string;
+  chainId: bigint;
+}
+export type Payer = { Evm: string } | { Icp: Principal };
+export interface PaymentQuote {
+  amountE6: bigint;
+  requirements: Array<QuotedRequirement>;
+}
+export interface PaymentRequirement {
+  token: string;
+  tokenVersion: [] | [string];
+  scheme: string;
+  recipient: string;
+  network: string;
+  nonce: Uint8Array | number[];
+  tokenName: [] | [string];
+  expiry: bigint;
+  amount: bigint;
+}
+export interface PaymentSignature {
+  signature: Uint8Array | number[];
+  asset: [] | [string];
+  publicKey: [] | [Uint8Array | number[]];
+  scheme: string;
+  network: string;
+  sender: string;
+  nonce: Uint8Array | number[];
+  authorization: [] | [Eip3009Authorization];
+}
+export interface PendingWithdrawal {
+  id: bigint;
+  parkedAtNs: bigint;
+  createdAtTimeNs: bigint;
+  seller: Principal;
+  amountE6s: bigint;
+  reason: string;
+}
+export type PricingScheme = { Exact: bigint } | { Upto: bigint } | { Session: null };
+export interface PurchaseRecord {
+  id: string;
+  endpointId: string;
+  network: string;
+  txHash: [] | [string];
+  receiptId: string;
+  buyer: Payer;
+  amount: bigint;
+  timestampNs: bigint;
+}
+export interface QuotedRequirement {
+  token: string;
+  tokenVersion: [] | [string];
+  scheme: string;
+  recipient: string;
+  network: string;
+  expiryNs: bigint;
+  tokenName: [] | [string];
+  amount: bigint;
+}
+export type Result = { Ok: bigint } | { Err: Error };
+export type Result_1 = { Ok: null } | { Err: Error };
+export type Result_10 = { Ok: SellerStatus } | { Err: Error };
+export type Result_11 = { Ok: RevenueSummary } | { Err: Error };
+export type Result_12 = { Ok: JobStatus } | { Err: Error };
+export type Result_13 = { Ok: Uint8Array | number[] } | { Err: Error };
+export type Result_14 = { Ok: Job } | { Err: Error };
+export type Result_15 = { Ok: [] | [string] } | { Err: Error };
+export type Result_16 = { Ok: ContentResponse } | { Err: Error };
+export type Result_17 = { Ok: ServiceRequestResponse } | { Err: Error };
+export type Result_18 = { Ok: X402Endpoint } | { Err: Error };
+export type Result_2 = { Ok: string } | { Err: Error };
+export type Result_3 = { Ok: PaymentQuote } | { Err: Error };
+export type Result_4 = { Ok: SessionState } | { Err: Error };
+export type Result_5 = { Ok: Page_1 } | { Err: Error };
+export type Result_6 = { Ok: Page_2 } | { Err: Error };
+export type Result_7 = { Ok: Page_4 } | { Err: Error };
+export type Result_8 = { Ok: Page_5 } | { Err: Error };
+export type Result_9 = { Ok: Page_7 } | { Err: Error };
+export interface RevenueSummary {
+  serviceJobsSettled: bigint;
+  owedToYou: bigint;
+  endpointBreakdown: Array<{
+    revenue: bigint;
+    endpointId: string;
+    name: string;
+    purchases: bigint;
+  }>;
+  contentRevenue: bigint;
+  serviceRevenue: bigint;
+  contentPurchases: bigint;
+  unresolvedWithdrawals: bigint;
+}
+export type Role =
+  | { Anonymous: null }
+  | { Viewer: null }
+  | { Engram: null }
+  | { Root: null }
+  | { Buyer: null }
+  | { WasmAdmin: null }
+  | { Guardian: null }
+  | { Seller: null }
+  | { Admin: null }
+  | { Agent: null }
+  | { Other: null }
+  | { Owner: null };
+export interface RoleGrant {
+  role: { Root: null } | { WasmAdmin: null } | { Admin: null } | { Other: string };
+  holder: Principal;
+}
+export interface SellerStatus {
+  expiresAtNs: bigint;
+  verifiedAtNs: bigint;
+  bytesStored: bigint;
+  engramId: Principal;
+  byteQuota: bigint;
+}
+export interface ServiceDefinition {
+  id: string;
+  serviceType: ServiceType;
+  name: string;
+  createdAt: bigint;
+  description: string;
+  pricing: PricingScheme;
+  enabled: boolean;
+  operatorId: Principal;
+  delivery: ServiceDeliveryMethod;
+  timeout: bigint;
+  verification: VerificationMethod;
+}
+export type ServiceDeliveryMethod = { Both: null } | { Poll: null } | { Callback: null };
+export type ServiceRequestResponse =
+  { Accepted: { jobId: string } } | { PaymentRequired: Array<PaymentRequirement> };
+export type ServiceType = { Sync: null } | { Async: null };
+export interface SessionConfig {
+  autoClose: boolean;
+  idleTimeout: [] | [bigint];
+  maxDeposit: bigint;
+}
+export interface SessionCounts {
+  closed: bigint;
+  total: bigint;
+  expired: bigint;
+  open: bigint;
+  closing: bigint;
+}
+export interface SessionIntent {
+  token: string;
+  costPerCall: [] | [bigint];
+  minDeposit: [] | [bigint];
+  recipient: string;
+  network: string;
+  description: [] | [string];
+  expiryNs: bigint;
+  suggestedDeposit: bigint;
+}
+export interface SessionState {
+  id: string;
+  status: SessionStatus;
+  deposited: bigint;
+  openedAtNs: bigint;
+  lastActivityAtNs: bigint;
+  consumed: bigint;
+  voucherCount: bigint;
+  remaining: bigint;
+  payer: Payer;
+}
+export type SessionStatus =
+  { closed: null } | { expired: null } | { other: string } | { open: null } | { closing: null };
+export interface SpendingPolicy {
+  maxSessionDeposit: [] | [bigint];
+  blockedCallers: [] | [Array<Principal>];
+  maxPerDay: [] | [bigint];
+  maxSessionDuration: [] | [bigint];
+  sessionIdleTimeout: [] | [bigint];
+  rateLimitPerMinute: [] | [bigint];
+  maxPerTransaction: [] | [bigint];
+  allowedCallers: [] | [Array<Principal>];
+  maxConcurrentSessions: [] | [bigint];
+}
+export type TokenAmount = { Icp: bigint } | { Ckusdc: bigint } | { Ckusdt: bigint };
+export type VerificationMethod =
+  | {
+      BuyerConfirm: { disputeWindowSeconds: bigint };
+    }
+  | {
+      ZkGroth16: {
+        bindResult: boolean;
+        verifierCanister: Principal;
+        verificationKey: Uint8Array | number[];
+      };
+    }
+  | { AutoSettle: null }
+  | { HashMatch: null };
+export interface X402Endpoint {
+  id: string;
+  status: EndpointStatus;
+  contentId: [] | [string];
+  enabledBy: [] | [Principal];
+  name: string;
+  createdBy: Principal;
+  createdAtNs: bigint;
+  description: string;
+  totalPurchases: bigint;
+  totalRevenue: bigint;
+  price: bigint;
+  suggestedPrice: bigint;
+  enabledAtNs: [] | [bigint];
+}
+export interface _SERVICE {
+  addAuditViewer: ActorMethod<[Principal], Result_1>;
+  /**
+   * / Push this canister's chain head into the registry's anchor ring — the same thing every engram
+   * / does with its memory head, and the cashier with its treasury head.
+   * /
+   * / L12's argument applies to escrow with full force: a self-attested commerce ledger sitting
+   * / beside witnessed ones is the asymmetry an auditor finds first. Every chain in this system is
+   * / witnessed by a party that does not control it, or the phrase means nothing.
+   * /
+   * / Best-effort and isolated: a registry that is slow or down must never take the market with it.
+   * / The FAILURE IS RECORDED rather than swallowed — an anchor push that silently stopped would
+   * / leave the chain looking witnessed while it was not, which is worse than a visibly missing one.
+   * /
+   * / ⟨RENAMED 2026-10-02 from `sysAnchorNow`, with `setRegistryId` and for the same reason: its
+   * / caller is the market's admin, a person, so it does not belong to the canister-to-canister
+   * / tier the `sys` prefix names.⟩
+   */
+  anchorNow: ActorMethod<[], Result_1>;
+  /**
+   * / A seller takes on a pending job. The CALLER must be the seller of the service the job was
+   * / created against — claiming is not open, and there is no assignment step: whoever registered
+   * / the service claims its work.
+   * /
+   * / ⚠ EVERY FAILURE ARRIVES AS `#Conflict`, INCLUDING ONES THAT ARE NOT CONFLICTS. The refusals
+   * / come from the vendored ic402 service registry as plain strings, so the arm is already lost
+   * / when this method sees them. `#Conflict` here therefore covers FOUR distinct situations:
+   * /   · the job does not exist        ⟶ properly `#NotFound`
+   * /   · the service does not exist    ⟶ properly `#NotFound`
+   * /   · the job is not pending        ⟶ properly `#Conflict`
+   * /   · **you are not the seller**  ⟶ properly `#Refused`
+   * /
+   * / **Read the MESSAGE, not the arm, on this method only.** That is the opposite of what L1 asks
+   * / everywhere else, and it is stated here rather than left to be discovered: a caller branching
+   * / on the arm will retry a call that can never succeed for it. Recovering the distinction needs
+   * / the LIBRARY to carry arms — matching its prose here would reintroduce exactly the
+   * / message-branching L1 abolished, and would break silently on an ic402 bump. ⟨Recorded with
+   * / three costed options in the project's backlog, 2026-08-21. This is the market's whole ic402
+   * / seam, not one method: 6 call sites collapse a module error into `#Conflict`.⟩
+   * / ⟨2026-10-02 — counted again, and ruled.⟩ ELEVEN sites on this market collapse an ic402 text
+   * / into `#Conflict`, not 6: `setServiceEnabled`, `claimJob`, `submitJobResult`, `confirmJob`,
+   * / `disputeJob`, `resolveDispute`, `reconcileSession`, `forceResolveSession`, `recoverEscrow`,
+   * / `reconcileJob`, `resolveJob` — each now carries its own audited caveat. Four can carry a
+   * / refusal of the caller's standing — `claimJob`, `confirmJob`, `disputeJob` and `submitJobResult`;
+   * / `setServiceEnabled`, the fourth noted on 2026-08-21, is now gated by this canister before the
+   * / library is called; the other six are state behind this canister's own gate. Read-the-message
+   * / is RATIFIED as the 0.16.0 contract (the owner's ruling of 2026-10-02, the pre-cut
+   * / recommendation); giving the library one arm per kind of refusal is post-cut dependency work,
+   * / not a change made mid-cut.
+   * /
+   * / It also refuses while TRADE IS FROZEN, and that one is a true `#Conflict` — the refusal says
+   * / so explicitly ("Not a permission problem and not a missing job"), and `isTradeFrozen()` is the
+   * / ungated read that confirms it.
+   */
+  claimJob: ActorMethod<[string], Result_1>;
+  /**
+   * / ⟨0.16.0, L2.6⟩ `confirmJob` ABSORBS `confirmJobEvm`. One buyer action, two ways to prove you
+   * / are the buyer.
+   * /
+   * / The pair existed because authorization arrives differently on the two rails, not because the
+   * / ACT differs: both release escrow to the seller. An ICP-rail buyer proves identity by calling
+   * / as their principal; an EVM-rail buyer has no principal here at all, so they prove it with a
+   * / secp256k1 signature over `getBuyerActionMessage`, which ic402 ecRecovers and compares to the job's
+   * / stored 0x buyer. `evmProof = null` means "authorize me as the caller".
+   * /
+   * / THE HARDENING IS ON THE SIGNATURE BRANCH ONLY, and deliberately so. That branch is
+   * / ANONYMOUS and does real work — an ecRecover plus, on success, an on-chain settle — so it is
+   * / griefable by anyone: it keeps the cycles floor (protect the canister's balance from drain) and
+   * / the per-caller rate limit. Applying the same rate limit to the principal branch would throttle
+   * / identified buyers to defend against a threat that branch does not have.
+   * /
+   * / ⚠ `#Conflict` HERE ALSO COVERS "NOT THE BUYER", which is a refusal and not a conflict. The
+   * / underlying ic402 registry returns plain strings, so the arm is gone before this method sees
+   * / it: `Job not found` (properly `#NotFound`), `Job not in submitted status` (properly
+   * / `#Conflict`) and **`Not the buyer`** (properly `#Refused`) all arrive as `#Conflict`. On THIS
+   * / method read the MESSAGE rather than the arm — it is terminal money settlement, so a caller
+   * / who reads `#Conflict` as "retry later" will retry a release that can never happen for them.
+   * / Same seam as `claimJob`; three costed fixes in the project's backlog ⟨2026-08-21⟩.
+   */
+  confirmJob: ActorMethod<[string, [] | [Uint8Array | number[]]], Result_1>;
+  /**
+   * / Create a content endpoint — a shelf in the storefront. Born DISABLED.
+   * /
+   * / Born disabled deliberately: a listing that went live at creation would be sellable before its
+   * / price was set, and `price` starts at 0 with `suggestedPrice` as the fallback.
+   */
+  createEndpoint: ActorMethod<[string, string, string, bigint], Result_18>;
+  /**
+   * / Submit a paid service request. Returns a job id, or the price.
+   * /
+   * / ⟨0.16.0⟩ TWO GATES FROM THE ENGRAM DO NOT TRAVEL, and both for the same reason: they were the
+   * / engram protecting ITS OWNER'S money, which is custody, and custody stayed.
+   * /
+   * /   · `requireAgentOrOwner` — the engram only let its own agents spend its funds. Here the
+   * /     caller is a BUYER paying with their own signature; gating that to a roster would mean a
+   * /     marketplace only its own staff could buy from.
+   * /   · `approvalId` / `#approvalPending` — an approval is the buyer's own spend policy, checked on
+   * /     their engram before they call. Two arms and a parameter disappear because the
+   * /     responsibility moved, not because a check was dropped.
+   * /
+   * / What DOES gate here is the market's freeze, and the service's own existence and pricing mode.
+   */
+  createJob: ActorMethod<[string, Uint8Array | number[], [] | [PaymentSignature]], Result_17>;
+  /**
+   * / Delete content.
+   * /
+   * / ⚠ THE QUOTA IS NOT REFUNDED, and this is the honest part of the design rather than a
+   * / meanness. The memory is not returned to the subnet when the entry goes — enhanced orthogonal
+   * / persistence never shrinks — so crediting the bytes back would let one seller cycle uploads
+   * / forever against a ceiling that only ever rose in reality. The quota tracks bytes CLAIMED, not
+   * / bytes currently held, because claimed is the number that costs money.
+   */
+  deleteContent: ActorMethod<[string], Result_1>;
+  /**
+   * / Delete an endpoint. Terminal — the record stays as #Deleted so purchase history keeps
+   * / resolving, and the id is never reused.
+   */
+  deleteEndpoint: ActorMethod<[string], Result_1>;
+  /**
+   * / ⟨0.16.0, L2.6⟩ `disputeJob` ABSORBS `disputeJobEvm`, exactly as confirmJob does, and for the
+   * / same reason: one act, two proofs of buyership.
+   * /
+   * / NOT FREEZE-GATED, and that asymmetry with confirmJob is deliberate. Recording a dispute moves
+   * / no money — it marks the job #Disputed, and any refund happens later through resolveDispute or
+   * / a timeout. A buyer must be able to say "this is wrong" DURING an emergency freeze; a freeze
+   * / that silenced complaints would protect the market from its own buyers.
+   * /
+   * / ⚠ `#Conflict` HERE ALSO COVERS "NOT THE BUYER" — same ic402 seam as `confirmJob` and
+   * / `claimJob`: `Job not found`, `Job not in submitted status` and **`Not the buyer`** all arrive
+   * / as `#Conflict` because the library hands back strings. Read the MESSAGE, not the arm.
+   * / ⟨2026-08-21; the project's backlog carries the three fixes and why none is a one-liner.⟩
+   * /
+   * / ⚠ AND NOTE WHERE THE DISPUTE GOES: `resolveDispute` is answered by the SERVICE'S OWN SELLER
+   * / — the party being disputed. This market has no admin arbitration and no appeal, deliberately
+   * / and on the record. Filing a dispute is not an escalation to a neutral party.
+   */
+  disputeJob: ActorMethod<[string, string, [] | [Uint8Array | number[]]], Result_1>;
+  /**
+   * / Closing refunds the unconsumed deposit to the payer, so it is NOT freeze-gated — the same
+   * / reasoning as disputeJob and forceCloseSession. A halt stops money moving toward sellers; it
+   * / must not strand a buyer's own escrow.
+   */
+  endSession: ActorMethod<[string], Result_1>;
+  /**
+   * / Admin recovery: force a stuck session closed and return the unconsumed deposit to its payer.
+   * /
+   * / Documented in RECOVERY-RUNBOOK as an owner procedure; on a shared canister the equivalent
+   * / authority is the market admin, because the session's own parties are precisely who cannot
+   * / unstick it. No discretion: the refund destination is the payer recorded on the session.
+   */
+  forceCloseSession: ActorMethod<[string], Result_1>;
+  /**
+   * / Admin recovery: mark a stuck session resolved. STATE ONLY — no funds move.
+   * /
+   * / Kept distinct from forceCloseSession, which refunds, because the two are different admissions.
+   * / This one says "the accounting is already right and the record is wrong"; that one says "return
+   * / what is left". Merging them would let a state repair silently move money.
+   * /
+   * / NOT freeze-gated, and the asymmetry is the point: a freeze halts SETTLEMENT, and this settles
+   * / nothing. An admin must be able to repair a record during the halt that made the record wrong.
+   * /
+   * / ⟨2026-10-02, the payment library's refusal channel — audited at this site⟩ `#Conflict` here
+   * / carries ic402's text, and ic402 answers with one text channel for every refusal. AUDITED:
+   * / this method's own gate (`requireAdmin`) decides authorization before the library is called, and every
+   * / text the library returns here is a STATE refusal (session missing, or not stuck in #closing) — including "not found", which
+   * / arrives as `#Conflict` rather than `#NotFound`. Read the MESSAGE for which. This is the 0.16.0
+   * / contract as ratified on 2026-10-02; giving the library one arm per kind of refusal is post-cut
+   * / dependency work.
+   */
+  forceResolveSession: ActorMethod<[string], Result_1>;
+  /**
+   * / PUBLIC: accountability requires knowing who holds power. This is the shape every canister
+   * / in the system serves, so one reader covers all of them.
+   */
+  getAdminRoles: ActorMethod<[], AdminRoles>;
+  /**
+   * / PUBLIC: a head exists to be compared. A head nobody can read witnesses nothing.
+   */
+  getAuditHead: ActorMethod<[], AuditHead>;
+  /**
+   * / The exact message an EVM buyer signs (keccak256 of it) to confirm or dispute a job.
+   * /
+   * / PUBLIC: it must be, since the caller who needs it is by definition unauthenticated here.
+   * / It binds action + job + THIS canister, so a signature cannot be replayed across actions, across
+   * / jobs, or onto another market.
+   */
+  getBuyerActionMessage: ActorMethod<[string, string], string>;
+  /**
+   * / PUBLIC: the subnet-certified head, so a client verifies against the NNS root rather than
+   * / trusting this replica. `witness` is null until this canister grows a certified tree — an
+   * / honest absence, distinct from an empty proof.
+   */
+  getCertifiedAuditHead: ActorMethod<[], CertifiedAuditHead>;
+  /**
+   * / Paid content read. `#PaymentRequired` comes back inside `#Ok` — see Types.ContentResponse for
+   * / why a price is an answer rather than an error.
+   * /
+   * / The `approvalId` parameter is gone, as it is on openSession: an approval is the BUYER's own
+   * / custody policy, checked on their engram before they call here.
+   * /
+   * / ⟨L7⟩ UPDATE, NOT QUERY: the paid path awaits `gate.settle(sig, ?amount)`, an inter-canister
+   * / settlement. A query cannot await it, and splitting the free and paid halves into two methods
+   * / would put the price and the content behind different names for one buyer act.
+   * /
+   * / ⟨2026-09-30, ic402 2.17.0⟩ It now awaits `gate.settleFrom(msg.caller, sig, ?amount)`. On the
+   * / ICP rail a signature's `sender` is only a claim — the payer's ICRC-2 allowance is the whole
+   * / authentication — so `settle` would spend the allowance of whoever the signature named and
+   * / deliver the content to the caller. `settleFrom` refuses unless the caller IS the named sender,
+   * / before the nonce lock or any ledger call, and the refusal reaches the buyer as #Refused with
+   * / ic402's text naming both principals. Pay as the principal that approved the allowance.
+   */
+  getContent: ActorMethod<[string, [] | [PaymentSignature]], Result_16>;
+  /**
+   * / ⟨0.16.0⟩ THE `getChunk` FIX, and it is the sharpest single case in the corpus.
+   * /
+   * / The engram's version was:
+   * /
+   * /     switch (gate.verifyGrant(msg.caller, grant)) {
+   * /       case (#ok) { contentStore.getChunk(grant.contentRef.id, index) };
+   * /       case (_) { null };
+   * /     };
+   * /
+   * / `AccessGrantResult` has FOUR arms — `#ok`, `#expired`, `#invalidGrant`, `#revoked` — each
+   * / carrying its own explanatory text. All three failures were collapsed into `null`, which is
+   * / ALSO what the content store returns for "that chunk index does not exist". So a buyer whose
+   * / grant had expired, a buyer whose grant was revoked, and a buyer asking for a chunk past the end
+   * / of a file received byte-identical answers. The information existed — the sibling `verifyGrant`
+   * / returned the full result — and was discarded one line later.
+   * /
+   * / Worse than uninformative: a buyer who PAID and whose grant expired sees "no such chunk" and
+   * / concludes the content is gone, not that their access lapsed. On a paid rail that is a refund
+   * / request and a support ticket generated by a type.
+   * /
+   * / The honesty gates could not see it. `gate.verifyGrant` is a PAYMENT gate, and the gate-call
+   * / list they scan holds authorization helpers only — so a refusal fabricated behind a payment
+   * / check was out of scope by construction rather than by ruling. L11 adds payment gates to that
+   * / list; this method is why.
+   */
+  getContentChunk: ActorMethod<[AccessGrant, bigint], Result_13>;
+  /**
+   * / A seller's payout address — THEIRS, or the admin's to read.
+   * /
+   * / The engram made this owner-only and TRAPPED at everyone else. Here the answer is a refusal a
+   * / caller can read, and `#Ok(null)` genuinely means "this seller has set no payout address" —
+   * / distinguishable from "you may not ask", which is the whole point of the envelope.
+   */
+  getEvmSellerPayout: ActorMethod<[Principal], Result_15>;
+  /**
+   * / PUBLIC: what this canister's chains continue, or that they continue nothing. A fresh chain
+   * / beside a published predecessor head is auditable; a fresh chain with no statement is
+   * / indistinguishable from a wipe.
+   */
+  getGenesisNote: ActorMethod<[], GenesisNote>;
+  /**
+   * / ⟨0.16.0, L1⟩ The engram TRAPPED here. Trapping was the right fix at the time — it stopped the
+   * / refusal masquerading as a not-found — but it hands the caller no structured reason and cannot
+   * / be told from a genuine fault. Under L1 the refusal is a value.
+   * /
+   * / The comment the engram carried is worth keeping because it names what went wrong: `null`
+   * / collapsed "unknown jobId" and "not authorized", and the product rendered the wrong conclusion
+   * / from it — the marketplace UI printed "Job not found (or not yet visible)" at a caller who was
+   * / merely unauthorized. Job existence is not the secret: `getJobCounts()` is ungated.
+   */
+  getJob: ActorMethod<[string], Result_14>;
+  /**
+   * / PUBLIC: aggregate counts that identify nobody — and already public on the engram, which is
+   * / what made `listJobs`' existence-leak justification false.
+   */
+  getJobCounts: ActorMethod<[], JobCounts>;
+  /**
+   * / The sharpest of the family, and the one in a money path — the engram's own comment said so.
+   * /
+   * / `null` there collapsed THREE meanings: unknown jobId, not authorized, and NO RESULT SUBMITTED
+   * / YET. So a refusal presented as a claim about the WORK. Combined with the `buyer : Text` defect,
+   * / an EVM-rail buyer was refused permanently, polled, read `null` as "the seller delivered
+   * / nothing", and escalated to dispute — a fabricated refusal manufacturing a commercial conflict.
+   * /
+   * / Three outcomes, three answers now. And `Payer` (above) removes the root cause rather than
+   * / only labelling it.
+   */
+  getJobResult: ActorMethod<[string], Result_13>;
+  /**
+   * / Terminal money settlement — the seller gets paid. Honours the freeze exactly like every
+   * / other settle path; a settlement that ignored the freeze would make the freeze a suggestion.
+   * / PUBLIC: a job's state, and nothing else about it.
+   * /
+   * / ⟨0.16.0⟩ THE UNGATED TWIN OF `getJob`, AND IT MUST STAY UNGATED. `getJob` is allowed to refuse
+   * / precisely because this exists: an EVM-rail buyer has NO PRINCIPAL on this canister, so a
+   * / principal-gated read can never authorize them, and without a public status read they would
+   * / have no way to see the state of a job they paid for. `getJob`'s refusal names this method for
+   * / exactly that reason.
+   * /
+   * / Job existence is not the secret being kept — the payload is. Status and nothing more.
+   * /
+   * / The engram returned `?EngramJobStatus`, conflating "no such job" with a null-ish answer. Here
+   * / a missing job is `#NotFound`, which is a fact rather than an absence a caller has to interpret.
+   */
+  getJobStatus: ActorMethod<[string], Result_12>;
+  /**
+   * / PUBLIC: the market's spend limits, with the caller rosters REDACTED.
+   * /
+   * / The limits themselves are already public — they are advertised inside every 402 challenge, so
+   * / withholding them here would hide nothing while making the market unquotable. `allowedCallers`
+   * / and `blockedCallers` are different in kind: an access-control roster, and a world-readable
+   * / blocklist tells everyone who has been blocked. Redacted to `null`, which reads as "not
+   * / disclosed" rather than as "empty" — an empty roster and a withheld one are different facts.
+   * /
+   * / Reads the GLOBAL policy. The engram called `getPolicy(self)`, i.e. the effective policy for
+   * / the canister acting as its own payer — which silently returns a self-override if one exists,
+   * / so the published limits could differ from the ones actually applied to buyers.
+   */
+  getPaymentPolicy: ActorMethod<[], SpendingPolicy>;
+  /**
+   * / and nothing is aggregated across sellers.
+   * /
+   * / THE FIGURES ARE COMPUTED, NOT READ FROM THE CANISTER-WIDE COUNTERS. `payments`' scalars are
+   * / every seller's money added together; handing them to one seller would overstate their revenue
+   * / by the entire market. Service revenue is derived per seller from settled jobs on services they
+   * / operate.
+   * /
+   * / Anonymous is refused rather than answered with zeroes. A zero here is a real business fact —
+   * / "you have sold nothing" — and returning it to a caller who simply has no identity is the
+   * / fabricated-empty defect wearing a number instead of a list.
+   */
+  getRevenueSummary: ActorMethod<[], Result_11>;
+  /**
+   * / PUBLIC: what a buyer can learn about a seller, and the whole of it.
+   * /
+   * / The ENGRAM ID is the point of this read. This market runs no reputation system and issues no
+   * / badges, so the honest trust signal is not a verdict we invent — it is a pointer to the record
+   * / the seller already keeps. A buyer who wants to know whether this seller is a verified human,
+   * / what their audit chain says, or how long they have existed asks THAT engram directly, and gets
+   * / an answer this market cannot shade.
+   * /
+   * / `verified` is about ownership at a moment in time and nothing else. It is not an endorsement,
+   * / and the field name is the strongest claim it makes.
+   */
+  getSellerStatus: ActorMethod<[Principal], Result_10>;
+  /**
+   * / PUBLIC: aggregate session counts. Identifies nobody, and the same reasoning as getJobCounts —
+   * / which is also what made `listJobs`' old "no existence leak" defence false.
+   */
+  getSessionCounts: ActorMethod<[], SessionCounts>;
+  http_request: ActorMethod<[HttpRequest], HttpResponse>;
+  /**
+   * / ⟨2026-09-30, ic402 2.17.0⟩ THE TWO PAID ROUTES HERE STAY ON `gate.settle`, AND THAT IS WHY NO
+   * / FLOW MAY LEAVE A STANDING ALLOWANCE TO THIS MARKET. An HTTP request arrives with no caller to
+   * / check (the gateway calls anonymously), so `settleFrom` cannot apply and ic402 says to keep
+   * / `settle` on HTTP paths. Such a settle is authenticated only by the payer's ICRC-2 allowance:
+   * / anyone who names a principal holding an unspent allowance to this canister can spend it here.
+   * / The defence is on the paying side — approve exactly the price plus one ledger fee, expiring
+   * / within minutes, immediately before paying (the SDK's `MarketClient` does). WHAT WOULD MAKE
+   * / THIS WRONG: an HTTP route that could authenticate its payer, or a flow of ours that approves
+   * / more than one payment's worth or without an expiry.
+   * /
+   * / ⟨CORRECTED 2026-09-30 — the owner's answer "1 B"⟩ The paragraph above is history. No web route
+   * / settles an ICP-rail payment any more, so none spends an allowance and none can be used against
+   * / a standing one. The one `gate.settle` left is on /service/, reached only with an EVM (`eip155:`)
+   * / payment carrying the buyer's own EIP-3009 authorization — a signature that names the payment and
+   * / travels privately in the request. An ICP-rail (ckUSDC) payment offered there is refused before
+   * / any settle and pointed at the Candid `createJob`; /content/ sells nothing over the web
+   * / (`contentNotSoldOverHttp`). ckUSDC is taken only by the Candid calls, which check their caller.
+   * / WHAT WOULD MAKE THIS WRONG: a web route that settles a payment whose network is not `eip155:`.
+   */
+  http_request_update: ActorMethod<[HttpRequest], HttpResponse>;
+  /**
+   * / PUBLIC: a wallet calls this BEFORE its user has any standing here — that is the whole point of
+   * / the call — so gating it would make the message unreadable at exactly the moment it is needed,
+   * / and a signature given without it is a signature given blind.
+   * /
+   * / ICRC-21 consent messages for this market's own state-changing methods.
+   * /
+   * / Every canister a signer is asked to sign FOR needs this, or the wallet cannot render what it
+   * / is approving. Two shape facts, both learned from live signer failures and both load-bearing:
+   * /
+   * /   · `user_preferences : {}` accepts ANY record. The spec nests language at
+   * /     user_preferences.metadata.language, and declaring the flat `{ language }` TRAPPED every
+   * /     real signer's request ("did not find field language in record"; OISY, 2026-07-25).
+   * /     `record {}` is a supertype of every record, so it decodes any signer's preferences without
+   * /     trapping and is a widening — therefore compatible — interface.
+   * /   · The reply REQUIRES `metadata` beside `consent_message`. Omitting it made OISY fail to
+   * /     decode the reply ("Cannot find required field metadata", 2026-07-26). language is "en"
+   * /     because the messages ARE English; the field states what they are, not what was asked for.
+   * /
+   * / The fallback says the method name rather than inventing a description. A wallet showing an
+   * / approving-sounding sentence for a method this canister does not recognise is the signing-time
+   * / version of a fabricated answer.
+   */
+  icrc21_canister_call_consent_message: ActorMethod<
+    [
+      {
+        arg: Uint8Array | number[];
+        method: string;
+        user_preferences: {};
+      },
+    ],
+    | {
+        Ok: {
+          metadata: {
+            utc_offset_minutes: [] | [number];
+            language: string;
+          };
+          consent_message: { GenericDisplayMessage: string };
+        };
+      }
+    | { Err: { description: string; error_code: bigint } }
+  >;
+  /**
+   * / PUBLIC: whether this market is trading at all. A buyer whose job creation refuses needs to be
+   * / able to tell "the market is halted" from "my request was wrong", and only this canister can
+   * / say which. Withholding it would turn an announced halt into an unexplained failure, which is
+   * / the fabricate-on-refusal shape read from the other side.
+   * /
+   * / The market's own freeze — trade halted for everyone here, by this canister's admin.
+   * /
+   * / DELIBERATELY NOT the engram's freeze, which stops one owner's engram signing at its guardian's
+   * / word. The two were a single field for as long as they shared a struct, and a guardian who
+   * / froze their own engram could not tell they had not also frozen a marketplace. Separate facts,
+   * / separate authorities, separate switches.
+   */
+  isTradeFrozen: ActorMethod<[], boolean>;
+  /**
+   * / `total` is the head counter, not the row count: this is a bounded ring, so a page that
+   * / reported only what it returned would make a trimmed log look complete.
+   */
+  listAuditEntries: ActorMethod<[bigint, bigint], Result_8>;
+  /**
+   * / Admin AND the enrolled viewers themselves — L8's roster rule. A viewer who cannot see the
+   * / roster cannot tell whether their own enrolment survived a rotation.
+   */
+  listAuditViewers: ActorMethod<[], Result_9>;
+  /**
+   * / PUBLIC: the catalogue is the storefront. A shop that refuses to say what it sells to
+   * / anyone who has not already bought is not a shop.
+   */
+  listContent: ActorMethod<[bigint, bigint], Page_6>;
+  /**
+   * / L11 names this canister's reason for having a denial log at all: the commerce surface is where
+   * / the fabricated-empty class was born, and a refusal that leaves no trace cannot be counted,
+   * / alerted on, or disproved.
+   */
+  listDenialEntries: ActorMethod<[bigint, bigint], Result_8>;
+  /**
+   * / Purchase history for one endpoint: its creator sees every row, a buyer sees their own.
+   * /
+   * / ⟨0.16.0⟩ Two defects close here at once, and they are the same defect wearing two hats.
+   * /
+   * / The engram matched a buyer with `buyer == Principal.toText(msg.caller)` — string equality
+   * / against a field that holds a principal on one rail and a `0x` address on the other. So an
+   * / EVM-rail buyer could not see their OWN purchases, ever. `Payer` makes that an arm match.
+   * /
+   * / And the filtered rows were dropped SILENTLY: a buyer reading someone else's endpoint got a
+   * / short list with nothing saying rows had been removed, indistinguishable from an endpoint with
+   * / few sales. `withheld` now counts them, so "no purchases here" and "not yours to see" are
+   * / different answers — without naming whose they were.
+   */
+  listEndpointPurchases: ActorMethod<[string, bigint, bigint], Result_7>;
+  /**
+   * / PUBLIC: the shelves, like the catalogue. `#Deleted` listings are excluded from an
+   * / unfiltered read and COUNTED in `withheld` — a shop with three deleted listings and a shop with
+   * / none look different, which is the honest answer, without publishing what was withdrawn.
+   */
+  listEndpoints: ActorMethod<[[] | [EndpointStatus], bigint, bigint], Page_3>;
+  /**
+   * / ⟨0.16.0⟩ THE `listJobs` FIX — the second of the two fabricated empties L11 names.
+   * /
+   * / The engram's version ended its authorization check with `if (not (isOwner or
+   * / isServiceOperator)) { return [] }`, and its own `.did` comment declared the behaviour on the
+   * / wire: "Fails closed to [] for an unknown service or an unauthorized caller (no existence
+   * / leak)." So a refused caller and a service with genuinely no jobs were the same answer, and it
+   * / was documented as a feature.
+   * /
+   * / THE EXISTENCE-LEAK JUSTIFICATION DOES NOT HOLD, checked at the site rather than argued: the
+   * / sibling `getJobCounts()` is an UNGATED public query over the same registry, so the number of jobs
+   * / is already world-readable. Nothing was being protected — the empty list hid the refusal from
+   * / the person refused, and hid it from every honesty gate too.
+   * /
+   * / It could not be caught mechanically either, and that is the more interesting half. The gates
+   * / scan for a known set of authorization helpers; this method's check is two LOCAL BOOLEANS
+   * / (`isOwner`, `isServiceOperator`), so the analyzer matched nothing and reported no finding. Its
+   * / siblings `getJob` and `getJobResult` had already been converted to traps for exactly this
+   * / defect; this one survived because it was written differently, not because it was ruled safe.
+   * /
+   * / Now: `#Refused` when the caller may not ask, `#NotFound` when the service does not exist —
+   * / two facts that were one empty list.
+   */
+  listJobs: ActorMethod<[string, [] | [JobStatus], bigint, bigint], Result_6>;
+  /**
+   * / The parked withdrawals belonging to this caller, so an unresolved payout is discoverable
+   * / rather than something a seller has to already know the id of.
+   * /
+   * / PAGED, and NOT taken as a bounded exemption, though the temptation was real: a seller parks a
+   * / withdrawal only when a ledger call rejects, and each withdrawal zeroes their balance — so the
+   * / list is 0 or 1 in every ordinary history. It is not STRUCTURALLY bounded, which is the test
+   * / the page-shape rule actually applies: a run of ledger outages across a run of sales
+   * / accumulates rows with nothing to stop it. A bare array that silently truncated would be
+   * / indistinguishable from "you have no other unresolved payouts", and this is money.
+   * /
+   * / `withheld` is always 0 here. The filter is by owner and a caller cannot own a row they may
+   * / not see, so nothing is ever hidden from them — unlike `listEndpointPurchases`, where a
+   * / non-owner's view withholds other buyers' rows. Stated because a reader comparing the two
+   * / should know the zero is a fact about this surface, not an unimplemented field.
+   */
+  listMyPendingWithdrawals: ActorMethod<[bigint, bigint], Result_5>;
+  /**
+   * / ⟨0.16.0⟩ `listAllServices` FOLDS in as `includeDisabled`.
+   * /
+   * / The engram had two methods because the visibility rule differed: everyone saw enabled
+   * / services; the owner and active sellers also saw disabled drafts. On a shared market that
+   * / rule becomes per-seller — you see every enabled service, plus YOUR OWN disabled drafts — which
+   * / is one query with a flag rather than two methods with divergent gates.
+   * /
+   * / `withheld` counts other sellers' drafts that the flag asked for and the caller may not see. A
+   * / seller can tell "no drafts" from "not yours to see" without learning whose they are.
+   */
+  listServices: ActorMethod<[boolean, bigint, bigint], Page>;
+  /**
+   * / ⟨0.16.0⟩ THE APPROVAL PARAMETER IS GONE, and its absence is the split working.
+   * /
+   * / The engram's openSession took an `approvalId` and could answer `#approvalPending` — because
+   * / there, opening a session was THE ENGRAM SPENDING ITS OWNER'S MONEY, so the owner's approval
+   * / queue gated it.
+   * /
+   * / Here the caller is a BUYER. If that buyer is an engram, its owner's approval was checked on
+   * / the engram before it ever called this canister — approvals stayed with custody, and so did the
+   * / signing they gate. The market receives a payment signature that someone already authorised;
+   * / asking it to also adjudicate whose approval backs that signature would put one owner's custody
+   * / policy on a canister shared with everyone else's.
+   * /
+   * / So a whole return arm disappears rather than moving. That is what a correct seam looks like:
+   * / the market got simpler because the responsibility went where it belonged, not because anything
+   * / was dropped.
+   * /
+   * / ⚠ ⟨2026-09-02 — OWNER-RULED: MARKET SESSIONS ARE NOT REQUIRED FOR NOW. The interfaces stay;
+   * / this note is what makes them honest.⟩ THE SESSION LIFECYCLE HERE IS INERT: a session can be
+   * / opened, and it can be closed or refunded, but it can never be SPENT. `gate.consumeVoucher` has
+   * / **zero call sites in this canister** — the only two in the estate are on the ENGRAM, which
+   * / runs its own separate paid-memory rail with its own gateway, `sess-N` counter and escrow
+   * / subaccount. So a market session is deposit-in and full-refund-out, and a buyer who opens one
+   * / gets their money back minus two ckUSDC ledger fees, having bought nothing.
+   * /
+   * / WHY THE METHODS ARE KEPT RATHER THAN DELETED: they are a complete, reviewable lifecycle
+   * / (open / end / forceClose / forceResolve / recoverEscrow / getSessionCounts) against a real
+   * / escrow, and the ruling is "not required for now", not "never". Deleting them would mean
+   * / re-deriving the seam when session billing is wanted, and the market is WITHHELD at 0.16.0 —
+   * / in neither environment — so nothing here is reachable by a customer today regardless.
+   * /
+   * / WHAT WOULD MAKE THIS SAFE TO ENABLE: a voucher-spend path — something on this canister that
+   * / calls `gate.consumeVoucher` and delivers what the voucher paid for. Until that exists, the
+   * / two `#Session` billing refusals say session billing is UNAVAILABLE rather than pointing
+   * / buyers at `openSession`, which is what they used to do.
+   * /
+   * / ⟨2026-09-30, ic402 2.17.0⟩ That future spend path calls `gate.consumeVoucherFrom(msg.caller, …)`,
+   * / not the bare `consumeVoucher`: the signed fallback is off on this canister, so the bare call
+   * / refuses every voucher, and only the session key calling as itself may spend a session.
+   */
+  openSession: ActorMethod<[SessionConfig, PaymentSignature], Result_4>;
+  /**
+   * / RENAMED from `requestSession` (census tier-3 #21): it is a pure dry run — a quote for a session
+   * / the caller has not opened and is not committed to. `request` read as an action with an effect.
+   * /
+   * / PUBLIC: a price list nobody can read is not a price list, and this is the market's. ⟨The
+   * / sentence was already here as "Ungated:"; only the marker the L8 gate greps for was missing,
+   * / which is why this method read as undefended when it was not.⟩
+   * / ⟨CORRECTED 2026-08-24 — this said "⟨L7⟩ UPDATE, NOT QUERY" and cited a market ruling that
+   * / DEC-107 had already closed.⟩ QUERY, per the ruled quote convention: FAST READS. Both
+   * / `quotePayment` and `previewOpenSession` become queries, and L7's open-ruling exception
+   * / retires with them — so the argument written here for keeping it an update was arguing the
+   * / losing side of a decision already made, and was added the same day by not reading forward
+   * / to the ruling. `gate.offerSession` is pure — it validates the intent and returns it — so
+   * / nothing forced the update in the first place.
+   * /
+   * / ONE-REPLICA CAVEAT, stated here because the ruling requires it at both sites: a query is one
+   * / replica's word and is NOT a settleable challenge. Nothing quoted here can be redeemed. The
+   * / commitment happens in `openSession`, which IS a certified update call, and a buyer who needs
+   * / the price attested rather than quoted takes it from that reply.
+   * /
+   * / ⟨2026-10-02⟩ Answers the house `Types.SessionIntent` — ic402's intent with `expiry` spelled
+   * / `expiryNs`. `openSession` hands ic402 its own record, from `sessionIntent()` below.
+   */
+  previewOpenSession: ActorMethod<[], SessionIntent>;
+  /**
+   * / PUBLIC: what it costs to pay this market a given amount, on every rail it settles.
+   * /
+   * / ⟨0.16.0⟩ Reshaped from `getPaymentRequirements(amount) : [PaymentRequirement]`. A bare array
+   * / was a `get*` returning a list, which reads like a collection to page through; this is a QUOTE,
+   * / a single answer to a single question, and it now says so in its name and its type.
+   * /
+   * / The quote ECHOES the amount it priced. A caller comparing this to a later 402 challenge is
+   * / then comparing two stated numbers instead of assuming the one they sent came back unchanged.
+   * /
+   * / Zero is refused. ic402's requirement builder traps on a zero amount, and a quote for nothing
+   * / is not a question this canister can answer — better a legible refusal than a trap in the
+   * / caller's own callback.
+   * /
+   * / ⟨CORRECTED 2026-10-02 — the nonce is GONE from the quote; the two paragraphs below are kept as
+   * / the record of why.⟩ Each requirement is now a `QuotedRequirement`: ic402's requirement without
+   * / its `nonce` (and with `expiry` spelled `expiryNs`). The paragraphs below describe the throwaway
+   * / that was published until this date; the pre-cut review recommended dropping it over ratifying
+   * / it, and it was dropped. "Do not pay against it" is now enforced by there being nothing to pay
+   * / against.
+   * /
+   * / ⚠ THE NONCE IN EACH REQUIREMENT IS A THROWAWAY — DO NOT PAY AGAINST IT. `requireAll` mints a
+   * / server nonce with a HashMap put, and this is a QUERY, so the write is discarded on return.
+   * / The nonce is published and does not exist. Signing a payment against it settles as
+   * / `#expired("Server nonce expired, already used, or bound to a different network/token")`,
+   * / which is wrong on every clause and points a caller back here for another dead one.
+   * /
+   * / That is by design, not an oversight now excused: a quote is a PRICE LIST, not a settleable
+   * / challenge. The HTTP surface of this same canister already draws the line in the same place —
+   * / `/discovery/resources` is a catalog with a throwaway nonce, while `/content` and `/service`
+   * / return `httpUpgrade()` so the challenge is minted in an UPDATE and persists. This is the
+   * / Candid twin of `/discovery/resources`, and it was the only one of the pair not saying so.
+   * / ⟨CORRECTED 2026-09-30⟩ Only `/service` upgrades now; `/content` sells nothing over the web and
+   * / answers 410 from the query. And unlike this quote, the web catalog lists EVM requirements only.
+   * /
+   * / TO GET A PAYABLE CHALLENGE, call the resource: `getContent(contentId, null)` or
+   * / `createJob(serviceId, params, null)`. Both are updates, so the nonce they mint survives.
+   * / This matters most on the ckUSDC rail, which is where customer payments settle: ICP has no
+   * / on-chain nonce, so `settle` ALWAYS requires the server one. A conformant EVM x402 client
+   * / sends no server nonce at all and is unaffected.
+   */
+  quotePayment: ActorMethod<[bigint], Result_3>;
+  /**
+   * / Admin recovery: re-drive a job stuck mid-settlement — a broadcast EVM transfer whose outcome
+   * / this canister never learned. Reads the chain and finishes what the settle started.
+   * /
+   * / Unstick, not decide: it does not choose an outcome, it discovers one. When it cannot, it says
+   * / so and points at resolveJob, which is where a human decision belongs.
+   * /
+   * / ⟨2026-10-02, the payment library's refusal channel — audited at this site⟩ `#Conflict` here
+   * / carries ic402's text, and ic402 answers with one text channel for every refusal. AUDITED:
+   * / this method's own gate (`requireAdmin`) decides authorization before the library is called, and every
+   * / text the library returns here is a STATE refusal (job missing, no parked tx, no confirm hook wired, the chain's answer) — including "not found", which
+   * / arrives as `#Conflict` rather than `#NotFound`. Read the MESSAGE for which. This is the 0.16.0
+   * / contract as ratified on 2026-10-02; giving the library one arm per kind of refusal is post-cut
+   * / dependency work.
+   */
+  reconcileJob: ActorMethod<[string], Result_2>;
+  /**
+   * / Admin recovery for a session whose settlement was interrupted mid-flight. Same line as
+   * / forceCloseSession: it completes what was already decided, it does not decide anything.
+   * /
+   * / Freeze-gated, unlike forceClose — reconciliation can PAY a seller, and a halt must stop money
+   * / moving outward. Force-close only returns a buyer's own deposit, which a freeze must not trap
+   * / (the same reasoning that leaves disputeJob un-gated).
+   * /
+   * / ⟨2026-10-02, the payment library's refusal channel — audited at this site⟩ `#Conflict` here
+   * / carries ic402's text, and ic402 answers with one text channel for every refusal. AUDITED:
+   * / this method's own gate (`requireAdmin`) decides authorization before the library is called, and every
+   * / text the library returns here is a STATE refusal (session missing, not parked in #closing, no parked tx, no EVM deposit or sender configured, the chain's answer) — including "not found", which
+   * / arrives as `#Conflict` rather than `#NotFound`. Read the MESSAGE for which. This is the 0.16.0
+   * / contract as ratified on 2026-10-02; giving the library one arm per kind of refusal is post-cut
+   * / dependency work.
+   */
+  reconcileSession: ActorMethod<[string], Result_2>;
+  /**
+   * / Settle a parked withdrawal by asking the ledger what happened, rather than assuming.
+   * /
+   * / Re-sends the IDENTICAL transfer — same amount, same fee, same `created_at_time`. Within
+   * / ICRC-1's 24h deduplication window there are exactly two outcomes and both are conclusive:
+   * /   · `#Err(#Duplicate)` — the original DID execute. The seller has been paid; discard the
+   * /     parked record.
+   * /   · `#Ok` — the original did NOT execute, and this call has now paid it. Discard.
+   * / Anything else leaves the record parked and retryable; it is never guessed at.
+   * /
+   * / Callable by the SELLER it belongs to. This pays only ever to the recorded seller, so a
+   * / stranger calling it could not misdirect funds — but it is still scoped, because a parked
+   * / withdrawal is the seller's business and its existence is a fact about their balance.
+   * /
+   * / The precedent is the cashier's `recoverPendingClaim`: same saga, same rail, same reason.
+   */
+  recoverContentWithdrawal: ActorMethod<[bigint], Result>;
+  /**
+   * / Admin recovery: return unconsumed escrow from a stuck or terminal session's own subaccount.
+   * / THE ONE RECOVERY METHOD THAT MOVES REAL MONEY.
+   * /
+   * / It is on the right side of "an admin may unstick, and may not decide" for one structural
+   * / reason, not by policy: THE DESTINATION IS NOT A PARAMETER. ic402 hardcodes the refund to
+   * / `session.payer`, and the admin's principal appears nowhere in the transfer. The admin supplies
+   * / the session, the token and an amount; they cannot supply a recipient. An admin can unstick a
+   * / refund and cannot redirect one, and that is enforced by the shape of the call rather than by
+   * / this comment.
+   * /
+   * / ic402 authorizes `caller == session.payer`, so the payer is read from the session and passed
+   * / through — the same pattern the engram used, and NOT the seller-impersonation defect, because
+   * / here the identity being passed is the one that RECEIVES the money rather than one being
+   * / presented as the actor. The audit row records the real admin who forced it.
+   * /
+   * / Idempotent through the ledger: the first refund drains the subaccount, so a second call fails
+   * / with insufficient funds rather than paying twice.
+   * /
+   * / ⟨2026-10-02, the payment library's refusal channel — audited at this site⟩ `#Conflict` here
+   * / carries ic402's text, and ic402 answers with one text channel for every refusal. AUDITED:
+   * / this method's own gate (`requireAdmin`; the library's own only-the-payer check cannot fire, because the payer is read from the session and passed through) decides authorization before the library is called, and every
+   * / text the library returns here is a STATE refusal (an open session, nothing left to recover, the ledger's refusal) — including "not found", which
+   * / arrives as `#Conflict` rather than `#NotFound`. Read the MESSAGE for which. This is the 0.16.0
+   * / contract as ratified on 2026-10-02; giving the library one arm per kind of refusal is post-cut
+   * / dependency work.
+   * /
+   * / ⟨2026-10-05, ic402 2.17.3 — beside the first line and the list above⟩ Escrow comes back only
+   * / from a session that reads `closed`. A session that reads `closing` or `expired` is refused, with
+   * / nothing moved — a fourth state refusal — so a "stuck" session here means one that
+   * / `forceResolveSession` has closed first; recover it within 24 hours of that force.
+   */
+  recoverEscrow: ActorMethod<[string, TokenAmount], Result>;
+  /**
+   * / Register as a seller by naming the engram you own.
+   * /
+   * / The registry is asked, not trusted from the caller's word: `verifyEngramActiveOwner` confirms
+   * / that THIS caller owns THAT engram and that it is #Active — which also means an abandoned
+   * / engram cannot back a listing, since abandonment is terminal there and this market has no
+   * / business inheriting a claim its owner walked away from.
+   * /
+   * / Re-registering is how a seller refreshes an expiring binding, and it is idempotent apart from
+   * / the timestamp. The byte count SURVIVES re-registration — otherwise the quota would reset every
+   * / thirty days, which is a quota in name only.
+   */
+  registerSeller: ActorMethod<[Principal], Result_1>;
+  /**
+   * / Register a paid service. Born DISABLED, like an endpoint and for the same reason: a listing
+   * / that went live at creation would be sellable before its seller had checked it.
+   * /
+   * / ⚠ THIS NEARLY DID NOT MAKE THE MOVE. It was deleted from the engram with the rest of the
+   * / commerce graft and was not written here until a downstream web client failed to compile
+   * / against a market that had no way to create a service at all — sellers could enable, disable
+   * / and list services, and could never make one. Recorded because the gap was invisible to every
+   * / gate: the canisters compiled, the .did was well formed, and check-client-idls only sees names
+   * / that ARE declared.
+   * /
+   * / `verificationMethod` stays a STRING with a parsed tail, exactly as the engram had it, because
+   * / #BuyerConfirm carries a window ("BuyerConfirm:3600") and a bare variant cannot. The parse is
+   * / total: an unrecognised method falls back to #AutoSettle rather than refusing, which is the
+   * / engram's behaviour preserved deliberately — a seller mistyping a verification mode should get
+   * / the safe default, not a service they cannot create.
+   */
+  registerService: ActorMethod<
+    [
+      string,
+      string,
+      ServiceType,
+      PricingScheme,
+      string,
+      [] | [string],
+      [] | [Uint8Array | number[]],
+      ServiceDeliveryMethod,
+      bigint,
+      [] | [boolean],
+    ],
+    Result_2
+  >;
+  removeAuditViewer: ActorMethod<[Principal], Result_1>;
+  /**
+   * / Remove a per-payer override so that payer reverts to — and keeps TRACKING — the global policy.
+   * /
+   * / Its pair's only other "undo" was overwriting the override with a frozen copy of the global
+   * / policy, which then stops following later global changes. That is why the two never travel
+   * / apart: without this one, every override is permanent in effect.
+   */
+  removeCallerPolicy: ActorMethod<[Principal], Result_1>;
+  /**
+   * / ⟨0.16.0⟩ RULED 2026-08-17: THE SELLER RESOLVES. Not the market admin.
+   * /
+   * / The engram's `requireOwner` was coherent there because the engram's owner IS the seller — a
+   * / dispute was between that owner and their buyer. Transcribing it here would have made the
+   * / market admin the arbiter of commercial disputes between independent parties, moving their
+   * / money: a business and probably a legal position, inherited by accident from a canister where
+   * / "owner" meant something else.
+   * /
+   * / The ruling keeps the power where it already was rather than quietly relocating it to us.
+   * /
+   * / ⚠ THE ASYMMETRY IS REAL AND IS STATED, HERE AND ON THE WIRE. The accused judges. A seller can
+   * / refuse a refund to a buyer who has already paid, and nothing on this canister overrides that:
+   * / there is no admin override, no appeal, and no reputation system yet to price the behaviour.
+   * / That is an honest description of who holds power in this market today, and a buyer is entitled
+   * / to know it BEFORE they buy — which is why it is in the refusal text a buyer actually sees, not
+   * / only in a comment they never will.
+   * /
+   * / Writing it down is also what makes it revisitable: when a reputation system or an escrow
+   * / timeout arrives, this method is where the change lands and this comment is the argument it has
+   * / to answer.
+   * /
+   * / ⟨2026-10-02, the payment library's refusal channel — audited at this site⟩ `#Conflict` here
+   * / carries ic402's text, and ic402 answers with one text channel for every refusal. AUDITED:
+   * / this method's own gate (the service's seller, checked above the library call) decides authorization before the library is called, and every
+   * / text the library returns here is a STATE refusal (job missing, not in a resolvable state, a refund parked or failed) — including "not found", which
+   * / arrives as `#Conflict` rather than `#NotFound`. Read the MESSAGE for which. This is the 0.16.0
+   * / contract as ratified on 2026-10-02; giving the library one arm per kind of refusal is post-cut
+   * / dependency work.
+   */
+  resolveDispute: ActorMethod<[string, boolean], Result_1>;
+  /**
+   * / Admin LAST RESORT: force a job to a terminal status when reconcileJob cannot determine one —
+   * / a reverted or dead transaction that the chain will never resolve either way.
+   * /
+   * / ⚠ THIS IS THE ONE PLACE THE ADMIN LINE BENDS, AND IT IS NAMED SO IT CANNOT BE USED CASUALLY.
+   * / Elsewhere on this canister an admin may unstick and may not decide; here the whole point is
+   * / that no discoverable answer exists, so someone must choose whether the seller was paid or
+   * / the buyer refunded. The narrowness is the safeguard: ic402 rejects any non-terminal target, so
+   * / the choice is between #Settled, #Refunded and #Expired and cannot be used to reopen a job or
+   * / move it sideways. Every use is a chained audit row naming the admin and the status they chose.
+   * /
+   * / `#other` fails closed. It is a placeholder for a job state this canister cannot name, and
+   * / forcing a job into a state we cannot name is not a recovery.
+   * /
+   * / ⟨2026-10-02, the payment library's refusal channel — audited at this site⟩ `#Conflict` here
+   * / carries ic402's text, and ic402 answers with one text channel for every refusal. AUDITED:
+   * / this method's own gate (`requireAdmin`) decides authorization before the library is called, and every
+   * / text the library returns here is a STATE refusal (job missing, not stuck in #Settling, a target that is not terminal) — including "not found", which
+   * / arrives as `#Conflict` rather than `#NotFound`. Read the MESSAGE for which. This is the 0.16.0
+   * / contract as ratified on 2026-10-02; giving the library one arm per kind of refusal is post-cut
+   * / dependency work.
+   */
+  resolveJob: ActorMethod<[string, JobStatus], Result_1>;
+  setAdmin: ActorMethod<[Principal], Result_1>;
+  /**
+   * / Override the policy for ONE payer — the market's per-buyer risk control.
+   */
+  setCallerPolicy: ActorMethod<[Principal, SpendingPolicy], Result_1>;
+  /**
+   * / ⟨0.16.0, L2.6⟩ `enableEndpoint` and `disableEndpoint` FOLD into one setter.
+   * /
+   * / They were byte-identical apart from the status they wrote and the word in their name, which is
+   * / the definition of a boolean expressed as two methods. L2.6 rules one idiom for a boolean
+   * / feature, and the fold also removes a real hazard: two methods meant two authorization checks
+   * / to keep in step, and a divergence between them would have been invisible to a reader looking at
+   * / either one alone.
+   * /
+   * / `#Deleted` stays a refusal in both directions and stays `#Conflict`, not `#Invalid`: the
+   * / request is well-formed and permitted, the endpoint is simply in a terminal state — and calling
+   * / that `#Invalid` would tell a caller to fix their request when nothing about it is wrong.
+   */
+  setEndpointEnabled: ActorMethod<[string, boolean], Result_1>;
+  /**
+   * / Set an endpoint's price. THE SELLER'S, not the admin's.
+   * /
+   * / requireEndpointOwner admits the market admin for the enable/disable pair, because a listing an
+   * / admin cannot take down is a moderation problem. PRICE IS DIFFERENT: changing what a seller
+   * / charges is trading on their behalf, and no recovery story needs it.
+   */
+  setEndpointPrice: ActorMethod<[string, bigint], Result_1>;
+  /**
+   * / A seller registers the EVM address their EVM-paid settlements are sent to.
+   * /
+   * / SELF-SCOPED: the address is keyed by `msg.caller`, so the only account a caller can change is
+   * / their own — there is no gate to get wrong, because there is nothing to gate. The engram's
+   * / `requireAgentOrOwner` here was protecting a canister-level roster that a shared market does
+   * / not have. Anonymous is refused: an anonymous payout address is an address nobody can be paid at.
+   * /
+   * / Without one, an EVM-paid job's settlement FAILS CLOSED and rolls back — the market does not
+   * / cross rails and pay an EVM seller out of the ICP pool.
+   */
+  setEvmSellerPayout: ActorMethod<[string], Result_1>;
+  /**
+   * / Set the market's global spending policy.
+   * /
+   * / The audit row records the LIMITS, not just the fact of a change, so a WIDENING is
+   * / distinguishable from a tightening after the fact. A policy raise is the quiet half of most
+   * / money incidents, and "policy changed" alone cannot tell an investigator which way.
+   */
+  setPaymentPolicy: ActorMethod<[SpendingPolicy], Result_1>;
+  /**
+   * / Whom this canister anchors to. Set by the admin at deploy; `sys` because it is protocol
+   * / configuration, not a product surface.
+   * /
+   * / ⟨RENAMED 2026-10-02 from `sysSetRegistryId` — the sys-tier retier ruled 2026-08-24, executed
+   * / under the owner's 2026-10-02 ruling to carry out the pre-cut interface decisions as
+   * / recommended.⟩ The sentence above is why it was sys-named, and the retier is why it no longer
+   * / is: the `sys` prefix names the canister-to-canister tier, whose callers are other canisters,
+   * / and this method's only caller is a PERSON — the market's admin, at deploy. Keeping it there
+   * / made "a `sys` method has no human caller" false, and so uncheckable. A plain admin setter
+   * / (`setAdmin`'s sibling) is what it always was.
+   */
+  setRegistryId: ActorMethod<[Principal], Result_1>;
+  /**
+   * / ⟨0.16.0, L2.6⟩ enableService + disableService FOLD, same as the endpoint pair.
+   * /
+   * / Deliberately NOT admin-overridable, unlike endpoints. Disabling a seller's service is a
+   * / commercial act against that seller, and an admin who needs to remove a listing should do it
+   * / through a recorded moderation path rather than by silently flipping a flag that looks like the
+   * / seller did it. Endpoints allow the admin override because a deleted endpoint is already
+   * / terminal and visible; a disabled service looks like the seller's own choice.
+   * /
+   * / ⚠ `#Conflict` HERE ALSO COVERS "NOT THE SELLER" — the same ic402 seam as `claimJob`,
+   * / `confirmJob` and `disputeJob`. `enableService`/`disableService` return `Service not found`
+   * / (properly `#NotFound`) and **`Not the seller`** (properly `#Refused`) as plain strings, so
+   * / the arm is gone before this method sees it. Read the MESSAGE, not the arm.
+   * / ⟨2026-08-21; the project's backlog carries the three costed fixes and why none is a
+   * / one-liner.⟩
+   * / ⟨CORRECTED 2026-10-02, audited at this site — the paragraph above no longer holds here.⟩
+   * / `requireServiceSeller` now runs BEFORE the library: a missing service is refused `#NotFound`
+   * / and another seller `#Refused`, by this canister, with its own sentences. The library is then
+   * / called with the caller already proven to be the seller, so its "Not the seller" and "Service
+   * / not found" texts cannot reach the `#Conflict` arm below except across a race with a deletion.
+   * / The seam is closed on this method by the gate, not by the library; the others keep their
+   * / caveats.
+   */
+  setServiceEnabled: ActorMethod<[string, boolean], Result_1>;
+  /**
+   * / A seller submits a finished job's result.
+   * /
+   * / AUTHORITY IS THE JOB'S SELLER, checked by ic402 against the claim — not "a seller of this
+   * / canister", which on a shared market would mean any seller could submit results for any other
+   * / seller's jobs. The engram's `requireAgentOrOwner` was a canister-level gate that made sense
+   * / only while one canister meant one seller.
+   * /
+   * / FREEZE-GATED because it can MOVE MONEY: the auto-settling verification modes (#AutoSettle /
+   * / #HashMatch / #ZkGroth16) pay the seller inside submitResult. Only #BuyerConfirm defers to
+   * / confirmJob. A reader who assumes "submitting a result is not a payment" is wrong for three of
+   * / the four modes.
+   * /
+   * / ⚠ `#Conflict` HERE ALSO COVERS "NOT THE ASSIGNED OPERATOR" — a refusal of the caller's
+   * / STANDING, not of the job's state. ⟨2026-10-02, audited at this site⟩ ic402's `submitResult`
+   * / checks the caller against the job's operator itself and answers with one text channel, so
+   * / "Not the assigned operator" and "Job not assigned" arrive here exactly as "Cannot submit result
+   * / in status: …" does. A caller that branches on the arm retries a submission that can never be
+   * / theirs. Read the MESSAGE, not the arm. This is the 0.16.0 contract as ratified on 2026-10-02;
+   * / giving the library one arm per kind of refusal is post-cut dependency work.
+   */
+  submitJobResult: ActorMethod<
+    [string, Uint8Array | number[], [] | [Uint8Array | number[]], [] | [bigint]],
+    Result_1
+  >;
+  /**
+   * / Upload a whole file in one call.
+   */
+  uploadContent: ActorMethod<[string, string, Uint8Array | number[]], Result_1>;
+  /**
+   * / Push one chunk of a started upload. NOT charged — uploadContentInit already reserved the
+   * / declared total, so charging again here would bill the same bytes twice.
+   */
+  uploadContentChunk: ActorMethod<[string, bigint, Uint8Array | number[]], Result_1>;
+  /**
+   * / Begin a chunked upload. The WHOLE declared size is charged here, up front.
+   * /
+   * / Charging at init rather than per chunk is the point: a per-chunk charge would let a seller
+   * / begin an upload that cannot finish, and discover it only after claiming most of the memory.
+   * / Reserving the declared total means an over-quota upload is refused before its first byte lands.
+   */
+  uploadContentInit: ActorMethod<[string, string, bigint, bigint], Result_1>;
+  /**
+   * / The buyer-facing half of the same check, kept because it answers a different question: "is my
+   * / grant still good", asked BEFORE spending a round trip on a chunk. Documented in ACCESS-CONTROL
+   * / as the buyer's pre-flight.
+   */
+  verifyGrant: ActorMethod<[AccessGrant], Result_1>;
+  /**
+   * / Withdraw everything this caller has earned from content sales, to their own principal.
+   * /
+   * / NO DESTINATION ARGUMENT, and that is the security property rather than a missing feature: the
+   * / funds go to `msg.caller` and nowhere else, so a stolen or mis-signed call cannot redirect a
+   * / seller's balance to an attacker's account. A seller who wants the money elsewhere moves it
+   * / from their own account, where they are the only signer.
+   * /
+   * / NOT GATED ON `requireSeller`. A seller binding expires and can be revoked; earnings do not.
+   * / Gating withdrawal on current seller status would strand the balance of anyone whose engram
+   * / lapsed after they sold — money owed, permanently unreachable, for a reason unrelated to the
+   * / debt. The gate is the debt itself: you may withdraw exactly what you are owed.
+   */
+  withdrawContentRevenue: ActorMethod<[], Result>;
+}
+export declare const idlFactory: IDL.InterfaceFactory;
+export declare const init: (args: { IDL: typeof IDL }) => IDL.Type[];