@engramx/idl 0.16.0-rc.2 → 0.16.0-rc.21

package/dist/market.did

@@ -81,6 +81,7 @@ type SessionCounts =
    closing: nat;
    expired: nat;
    open: nat;
+   refundOwed: opt nat;
    total: nat;
  };
 type SessionConfig = 
@@ -127,6 +128,12 @@ type SellerStatus =
    expiresAtNs: int;
    verifiedAtNs: int;
  };
+type SealedEntry = 
+ record {
+   digest: blob;
+   entryHash: blob;
+   id: nat;
+ };
 type RoleGrant = 
  record {
    holder: principal;
@@ -171,87 +178,97 @@ type RevenueSummary =
 type Result_9 = 
  variant {
    Err: Error;
-   Ok: Page_7;
+   Ok: Page_5;
  };
 type Result_8 = 
  variant {
    Err: Error;
-   Ok: Page_5;
+   Ok: Page_4;
  };
 type Result_7 = 
  variant {
    Err: Error;
-   Ok: Page_4;
+   Ok: Page_2;
  };
 type Result_6 = 
  variant {
    Err: Error;
-   Ok: Page_2;
+   Ok: Page_1;
  };
 type Result_5 = 
  variant {
    Err: Error;
-   Ok: Page_1;
+   Ok: SessionState;
  };
 type Result_4 = 
  variant {
    Err: Error;
-   Ok: SessionState;
+   Ok: PaymentQuote;
  };
 type Result_3 = 
  variant {
    Err: Error;
-   Ok: PaymentQuote;
+   Ok: EscrowRecovery;
+ };
+type Result_20 = 
+ variant {
+   Err: Error;
+   Ok: X402Endpoint;
  };
 type Result_2 = 
  variant {
    Err: Error;
    Ok: text;
  };
+type Result_19 = 
+ variant {
+   Err: Error;
+   Ok: ServiceRequestResponse;
+ };
 type Result_18 = 
  variant {
    Err: Error;
-   Ok: X402Endpoint;
+   Ok: ContentResponse;
  };
 type Result_17 = 
  variant {
    Err: Error;
-   Ok: ServiceRequestResponse;
+   Ok: opt text;
  };
 type Result_16 = 
  variant {
    Err: Error;
-   Ok: ContentResponse;
+   Ok: Job;
  };
 type Result_15 = 
  variant {
    Err: Error;
-   Ok: opt text;
+   Ok: blob;
  };
 type Result_14 = 
  variant {
    Err: Error;
-   Ok: Job;
+   Ok: JobStatus;
  };
 type Result_13 = 
  variant {
    Err: Error;
-   Ok: blob;
+   Ok: RevenueSummary;
  };
 type Result_12 = 
  variant {
    Err: Error;
-   Ok: JobStatus;
+   Ok: SellerStatus;
  };
 type Result_11 = 
  variant {
    Err: Error;
-   Ok: RevenueSummary;
+   Ok: RecordPage;
  };
 type Result_10 = 
  variant {
    Err: Error;
-   Ok: SellerStatus;
+   Ok: Page_7;
  };
 type Result_1 = 
  variant {
@@ -263,6 +280,14 @@ type Result =
    Err: Error;
    Ok: nat;
  };
+type RecordPage = 
+ record {
+   hashFirstFrom: nat;
+   items: vec AuditEntry;
+   ringFloor: nat;
+   sealed: vec SealedEntry;
+   total: nat;
+ };
 type QuotedRequirement = 
  record {
    amount: nat;
@@ -466,6 +491,11 @@ type GenesisNote =
    predecessorSize: opt nat;
    version: text;
  };
+type EscrowRecovery = 
+ record {
+   amount: TokenAmount;
+   blockIndex: nat;
+ };
 type Error = 
  variant {
    Conflict: text;
@@ -616,6 +646,9 @@ service : {
   /// is RATIFIED as the 0.16.0 contract (the owner's ruling of 2026-10-02, the pre-cut
   /// recommendation); giving the library one arm per kind of refusal is post-cut dependency work,
   /// not a change made mid-cut.
+  /// ⟨2026-10-07, beside the count above⟩ Twelve: the admin's `retrySellerPayment` (the owner's
+  /// decision of that day) passes the library's settle refusal through as `#Conflict` too — state
+  /// behind this canister's own gate, like the other six.
   /// 
   /// It also refuses while TRADE IS FROZEN, and that one is a true `#Conflict` — the refusal says
   /// so explicitly ("Not a permission problem and not a missing job"), and `isTradeFrozen()` is the
@@ -649,7 +682,7 @@ service : {
   /// Born disabled deliberately: a listing that went live at creation would be sellable before its
   /// price was set, and `price` starts at 0 with `suggestedPrice` as the fallback.
   createEndpoint: (name: text, description: text, contentId: text,
-   suggestedPriceE6: nat) -> (Result_18);
+   suggestedPriceE6: nat) -> (Result_20);
   /// Submit a paid service request. Returns a job id, or the price.
   /// 
   /// ⟨0.16.0⟩ TWO GATES FROM THE ENGRAM DO NOT TRAVEL, and both for the same reason: they were the
@@ -664,7 +697,7 @@ service : {
   /// 
   /// What DOES gate here is the market's freeze, and the service's own existence and pricing mode.
   createJob: (serviceId: text, params: blob, paymentSig:
-   opt PaymentSignature) -> (Result_17);
+   opt PaymentSignature) -> (Result_19);
   /// Delete content.
   /// 
   /// ⚠ THE QUOTA IS NOT REFUNDED, and this is the honest part of the design rather than a
@@ -753,7 +786,7 @@ service : {
   /// before the nonce lock or any ledger call, and the refusal reaches the buyer as #Refused with
   /// ic402's text naming both principals. Pay as the principal that approved the allowance.
   getContent: (contentId: text, paymentSig: opt PaymentSignature) ->
-   (Result_16);
+   (Result_18);
   /// ⟨0.16.0⟩ THE `getChunk` FIX, and it is the sharpest single case in the corpus.
   /// 
   /// The engram's version was:
@@ -778,13 +811,13 @@ service : {
   /// list they scan holds authorization helpers only — so a refusal fabricated behind a payment
   /// check was out of scope by construction rather than by ruling. L11 adds payment gates to that
   /// list; this method is why.
-  getContentChunk: (grant: AccessGrant, index: nat) -> (Result_13) query;
+  getContentChunk: (grant: AccessGrant, index: nat) -> (Result_15) query;
   /// A seller's payout address — THEIRS, or the admin's to read.
   /// 
   /// The engram made this owner-only and TRAPPED at everyone else. Here the answer is a refusal a
   /// caller can read, and `#Ok(null)` genuinely means "this seller has set no payout address" —
   /// distinguishable from "you may not ask", which is the whole point of the envelope.
-  getEvmSellerPayout: (seller: principal) -> (Result_15) query;
+  getEvmSellerPayout: (seller: principal) -> (Result_17) query;
   /// PUBLIC: what this canister's chains continue, or that they continue nothing. A fresh chain
   /// beside a published predecessor head is auditable; a fresh chain with no statement is
   /// indistinguishable from a wipe.
@@ -797,7 +830,7 @@ service : {
   /// collapsed "unknown jobId" and "not authorized", and the product rendered the wrong conclusion
   /// from it — the marketplace UI printed "Job not found (or not yet visible)" at a caller who was
   /// merely unauthorized. Job existence is not the secret: `getJobCounts()` is ungated.
-  getJob: (jobId: text) -> (Result_14) query;
+  getJob: (jobId: text) -> (Result_16) query;
   /// PUBLIC: aggregate counts that identify nobody — and already public on the engram, which is
   /// what made `listJobs`' existence-leak justification false.
   getJobCounts: () -> (JobCounts) query;
@@ -810,7 +843,7 @@ service : {
   /// 
   /// Three outcomes, three answers now. And `Payer` (above) removes the root cause rather than
   /// only labelling it.
-  getJobResult: (jobId: text) -> (Result_13) query;
+  getJobResult: (jobId: text) -> (Result_15) query;
   /// Terminal money settlement — the seller gets paid. Honours the freeze exactly like every
   /// other settle path; a settlement that ignored the freeze would make the freeze a suggestion.
   /// PUBLIC: a job's state, and nothing else about it.
@@ -825,7 +858,7 @@ service : {
   /// 
   /// The engram returned `?EngramJobStatus`, conflating "no such job" with a null-ish answer. Here
   /// a missing job is `#NotFound`, which is a fact rather than an absence a caller has to interpret.
-  getJobStatus: (jobId: text) -> (Result_12) query;
+  getJobStatus: (jobId: text) -> (Result_14) query;
   /// PUBLIC: the market's spend limits, with the caller rosters REDACTED.
   /// 
   /// The limits themselves are already public — they are advertised inside every 402 challenge, so
@@ -848,7 +881,7 @@ service : {
   /// Anonymous is refused rather than answered with zeroes. A zero here is a real business fact —
   /// "you have sold nothing" — and returning it to a caller who simply has no identity is the
   /// fabricated-empty defect wearing a number instead of a list.
-  getRevenueSummary: () -> (Result_11) query;
+  getRevenueSummary: () -> (Result_13) query;
   /// PUBLIC: what a buyer can learn about a seller, and the whole of it.
   /// 
   /// The ENGRAM ID is the point of this read. This market runs no reputation system and issues no
@@ -859,7 +892,7 @@ service : {
   /// 
   /// `verified` is about ownership at a moment in time and nothing else. It is not an endorsement,
   /// and the field name is the strongest claim it makes.
-  getSellerStatus: (seller: principal) -> (Result_10) query;
+  getSellerStatus: (seller: principal) -> (Result_12) query;
   /// PUBLIC: aggregate session counts. Identifies nobody, and the same reasoning as getJobCounts —
   /// which is also what made `listJobs`' old "no existence leak" defence false.
   getSessionCounts: () -> (SessionCounts) query;
@@ -938,17 +971,23 @@ service : {
   isTradeFrozen: () -> (bool) query;
   /// `total` is the head counter, not the row count: this is a bounded ring, so a page that
   /// reported only what it returned would make a trimmed log look complete.
-  listAuditEntries: (start: nat, limit: nat) -> (Result_8) query;
+  /// 
+  /// ⟨2026-10-15, the owner's ruling 6B of 2026-10-14⟩ The reply is the shared `Wire.RecordPage`, so
+  /// one checker reads every chain. A viewer sees every entry, so `sealed` is always empty here;
+  /// `ringFloor` says where the ring starts and `hashFirstFrom` where this record switched to the
+  /// hash-first rule. The gate is unchanged (hash-only rows for strangers were ruled for the
+  /// engram's record).
+  listAuditEntries: (start: nat, limit: nat) -> (Result_11) query;
   /// Admin AND the enrolled viewers themselves — L8's roster rule. A viewer who cannot see the
   /// roster cannot tell whether their own enrolment survived a rotation.
-  listAuditViewers: () -> (Result_9) query;
+  listAuditViewers: () -> (Result_10) query;
   /// PUBLIC: the catalogue is the storefront. A shop that refuses to say what it sells to
   /// anyone who has not already bought is not a shop.
   listContent: (start: nat, limit: nat) -> (Page_6) query;
   /// L11 names this canister's reason for having a denial log at all: the commerce surface is where
   /// the fabricated-empty class was born, and a refusal that leaves no trace cannot be counted,
   /// alerted on, or disproved.
-  listDenialEntries: (start: nat, limit: nat) -> (Result_8) query;
+  listDenialEntries: (start: nat, limit: nat) -> (Result_9) query;
   /// Purchase history for one endpoint: its creator sees every row, a buyer sees their own.
   /// 
   /// ⟨0.16.0⟩ Two defects close here at once, and they are the same defect wearing two hats.
@@ -962,7 +1001,7 @@ service : {
   /// few sales. `withheld` now counts them, so "no purchases here" and "not yours to see" are
   /// different answers — without naming whose they were.
   listEndpointPurchases: (endpointId: text, start: nat, limit: nat) ->
-   (Result_7) query;
+   (Result_8) query;
   /// PUBLIC: the shelves, like the catalogue. `#Deleted` listings are excluded from an
   /// unfiltered read and COUNTED in `withheld` — a shop with three deleted listings and a shop with
   /// none look different, which is the honest answer, without publishing what was withdrawn.
@@ -990,7 +1029,7 @@ service : {
   /// Now: `#Refused` when the caller may not ask, `#NotFound` when the service does not exist —
   /// two facts that were one empty list.
   listJobs: (serviceId: text, statusFilter: opt JobStatus, start: nat, limit:
-   nat) -> (Result_6) query;
+   nat) -> (Result_7) query;
   /// The parked withdrawals belonging to this caller, so an unresolved payout is discoverable
   /// rather than something a seller has to already know the id of.
   /// 
@@ -1005,7 +1044,7 @@ service : {
   /// not see, so nothing is ever hidden from them — unlike `listEndpointPurchases`, where a
   /// non-owner's view withholds other buyers' rows. Stated because a reader comparing the two
   /// should know the zero is a fact about this surface, not an unimplemented field.
-  listMyPendingWithdrawals: (start: nat, limit: nat) -> (Result_5) query;
+  listMyPendingWithdrawals: (start: nat, limit: nat) -> (Result_6) query;
   /// ⟨0.16.0⟩ `listAllServices` FOLDS in as `includeDisabled`.
   /// 
   /// The engram had two methods because the visibility rule differed: everyone saw enabled
@@ -1055,7 +1094,7 @@ service : {
   /// ⟨2026-09-30, ic402 2.17.0⟩ That future spend path calls `gate.consumeVoucherFrom(msg.caller, …)`,
   /// not the bare `consumeVoucher`: the signed fallback is off on this canister, so the bare call
   /// refuses every voucher, and only the session key calling as itself may spend a session.
-  openSession: (config: SessionConfig, sig: PaymentSignature) -> (Result_4);
+  openSession: (config: SessionConfig, sig: PaymentSignature) -> (Result_5);
   /// RENAMED from `requestSession` (census tier-3 #21): it is a pure dry run — a quote for a session
   /// the caller has not opened and is not committed to. `request` read as an action with an effect.
   /// 
@@ -1117,7 +1156,7 @@ service : {
   /// This matters most on the ckUSDC rail, which is where customer payments settle: ICP has no
   /// on-chain nonce, so `settle` ALWAYS requires the server one. A conformant EVM x402 client
   /// sends no server nonce at all and is unaffected.
-  quotePayment: (amountE6: nat) -> (Result_3) query;
+  quotePayment: (amountE6: nat) -> (Result_4) query;
   /// Admin recovery: re-drive a job stuck mid-settlement — a broadcast EVM transfer whose outcome
   /// this canister never learned. Reads the chain and finishes what the settle started.
   /// 
@@ -1196,7 +1235,15 @@ service : {
   /// refused or rejected: that close already ends the session `closed`, with the remainder still in
   /// its escrow, so it needs no force. Recover it within 24 hours of that close, asking at most the
   /// escrow's ledger balance less one fee.
-  recoverEscrow: (sessionId: text, amount: TokenAmount) -> (Result);
+  /// 
+  /// ⟨2026-10-07, the owner's decision of that day⟩ WHAT IT ANSWERS: what came back. `amount` is what
+  /// was transferred to the session's payer, in the token named (the amount asked, capped at the
+  /// session's unconsumed deposit; the transfer's fee comes out of the escrow on top), and
+  /// `blockIndex` is that ledger's block of the transfer. Until this date it answered a bare `nat`
+  /// that was the block index alone, which read as the amount. If the session's record is removed
+  /// before the amount can be read back — a session closed in the same moment as the recovery and
+  /// cleaned up during its transfer — it answers `#Other` naming the block, never a guessed amount.
+  recoverEscrow: (sessionId: text, amount: TokenAmount) -> (Result_3);
   /// Register as a seller by naming the engram you own.
   /// 
   /// The registry is asked, not trusted from the caller's word: `verifyEngramActiveOwner` confirms
@@ -1284,6 +1331,36 @@ service : {
   /// contract as ratified on 2026-10-02; giving the library one arm per kind of refusal is post-cut
   /// dependency work.
   resolveJob: (jobId: text, terminal: JobStatus) -> (Result_1);
+  /// Admin recovery: retry the payment to the seller of a job left `#Verified` by a failed payment.
+  /// NOTHING ELSE. It never refunds the buyer, and it refuses every job that does not read
+  /// `#Verified`, with nothing moved.
+  /// 
+  /// ⟨2026-10-07, the owner's decision of that day⟩ A job whose work passed verification and whose
+  /// payment to the seller then failed rests in `#Verified`, and only `resolveDispute` moves it — the
+  /// service's SELLER's, by the ruling of 2026-08-17, which stands unchanged. A seller who never acts
+  /// left it there, with no way for anyone else to move it. This is the admin's way: unstick, not
+  /// decide. The job's outcome was decided by its verification; the payment goes where that sent it,
+  /// and the admin names neither a recipient nor an amount. Refunding the buyer, and anything about a
+  /// job not yet verified (`#Submitted`, `#Disputed`), stay the seller's.
+  /// 
+  /// It runs the library's own settle, the one a buyer's confirmation runs: the job reads `#Settling`
+  /// while it pays (so two retries cannot both pay), ends `#Settled`, and a payment the ledger refuses
+  /// leaves it `#Verified` to retry again. For a job priced "up to" an amount, that settle also returns
+  /// to the buyer what the seller did not claim, as every settle does. Past the admin check, the
+  /// freeze and the cycles floor (each of which refuses before anything is read), every outcome is a
+  /// chained record entry naming the admin.
+  /// 
+  /// A NEW METHOD, NOT A WIDER `resolveJob`, ON PURPOSE. `resolveJob` is the one place the admin line
+  /// bends — a STATE assertion, moving no money, for a job stuck in `#Settling`. Widening it to move
+  /// money on a `#Verified` job would give one argument (`#Settled`) two meanings depending on a state
+  /// the admin read a moment earlier: if the job moved to `#Settling` in between (a settle in flight),
+  /// "pay the seller" would become "declare the seller paid". One method per meaning keeps the
+  /// deciding one narrow and named.
+  /// 
+  /// `#Conflict` covers the state refusals: a job that does not read `#Verified`, and the library's
+  /// own (a job that moved on before the retry ran, or a payment that failed). `#NotFound` is a job id
+  /// this market does not have.
+  retrySellerPayment: (jobId: text) -> (Result_1);
   setAdmin: (newAdmin: principal) -> (Result_1);
   /// Override the policy for ONE payer — the market's per-buyer risk control.
   setCallerPolicy: (caller: principal, policy: SpendingPolicy) -> (Result_1);