@engramx/idl 0.16.0-rc.2 → 0.16.0-rc.21

package/dist/market.idl.d.ts

@@ -79,6 +79,10 @@ export type Error =
   | { Other: string }
   | { Unavailable: string }
   | { Conflict: string };
+export interface EscrowRecovery {
+  blockIndex: bigint;
+  amount: TokenAmount;
+}
 export interface GenesisNote {
   predecessorSize: [] | [bigint];
   predecessorHeadHash: [] | [Uint8Array | number[]];
@@ -240,25 +244,34 @@ export interface QuotedRequirement {
   tokenName: [] | [string];
   amount: bigint;
 }
+export interface RecordPage {
+  ringFloor: bigint;
+  total: bigint;
+  sealed: Array<SealedEntry>;
+  items: Array<AuditEntry>;
+  hashFirstFrom: bigint;
+}
 export type Result = { Ok: bigint } | { Err: Error };
 export type Result_1 = { Ok: null } | { Err: Error };
-export type Result_10 = { Ok: SellerStatus } | { Err: Error };
-export type Result_11 = { Ok: RevenueSummary } | { Err: Error };
-export type Result_12 = { Ok: JobStatus } | { Err: Error };
-export type Result_13 = { Ok: Uint8Array | number[] } | { Err: Error };
-export type Result_14 = { Ok: Job } | { Err: Error };
-export type Result_15 = { Ok: [] | [string] } | { Err: Error };
-export type Result_16 = { Ok: ContentResponse } | { Err: Error };
-export type Result_17 = { Ok: ServiceRequestResponse } | { Err: Error };
-export type Result_18 = { Ok: X402Endpoint } | { Err: Error };
+export type Result_10 = { Ok: Page_7 } | { Err: Error };
+export type Result_11 = { Ok: RecordPage } | { Err: Error };
+export type Result_12 = { Ok: SellerStatus } | { Err: Error };
+export type Result_13 = { Ok: RevenueSummary } | { Err: Error };
+export type Result_14 = { Ok: JobStatus } | { Err: Error };
+export type Result_15 = { Ok: Uint8Array | number[] } | { Err: Error };
+export type Result_16 = { Ok: Job } | { Err: Error };
+export type Result_17 = { Ok: [] | [string] } | { Err: Error };
+export type Result_18 = { Ok: ContentResponse } | { Err: Error };
+export type Result_19 = { Ok: ServiceRequestResponse } | { Err: Error };
 export type Result_2 = { Ok: string } | { Err: Error };
-export type Result_3 = { Ok: PaymentQuote } | { Err: Error };
-export type Result_4 = { Ok: SessionState } | { Err: Error };
-export type Result_5 = { Ok: Page_1 } | { Err: Error };
-export type Result_6 = { Ok: Page_2 } | { Err: Error };
-export type Result_7 = { Ok: Page_4 } | { Err: Error };
-export type Result_8 = { Ok: Page_5 } | { Err: Error };
-export type Result_9 = { Ok: Page_7 } | { Err: Error };
+export type Result_20 = { Ok: X402Endpoint } | { Err: Error };
+export type Result_3 = { Ok: EscrowRecovery } | { Err: Error };
+export type Result_4 = { Ok: PaymentQuote } | { Err: Error };
+export type Result_5 = { Ok: SessionState } | { Err: Error };
+export type Result_6 = { Ok: Page_1 } | { Err: Error };
+export type Result_7 = { Ok: Page_2 } | { Err: Error };
+export type Result_8 = { Ok: Page_4 } | { Err: Error };
+export type Result_9 = { Ok: Page_5 } | { Err: Error };
 export interface RevenueSummary {
   serviceJobsSettled: bigint;
   owedToYou: bigint;
@@ -290,6 +303,11 @@ export interface RoleGrant {
   role: { Root: null } | { WasmAdmin: null } | { Admin: null } | { Other: string };
   holder: Principal;
 }
+export interface SealedEntry {
+  id: bigint;
+  entryHash: Uint8Array | number[];
+  digest: Uint8Array | number[];
+}
 export interface SellerStatus {
   expiresAtNs: bigint;
   verifiedAtNs: bigint;
@@ -324,6 +342,7 @@ export interface SessionCounts {
   total: bigint;
   expired: bigint;
   open: bigint;
+  refundOwed: [] | [bigint];
   closing: bigint;
 }
 export interface SessionIntent {
@@ -438,6 +457,9 @@ export interface _SERVICE {
    * / is RATIFIED as the 0.16.0 contract (the owner's ruling of 2026-10-02, the pre-cut
    * / recommendation); giving the library one arm per kind of refusal is post-cut dependency work,
    * / not a change made mid-cut.
+   * / ⟨2026-10-07, beside the count above⟩ Twelve: the admin's `retrySellerPayment` (the owner's
+   * / decision of that day) passes the library's settle refusal through as `#Conflict` too — state
+   * / behind this canister's own gate, like the other six.
    * /
    * / It also refuses while TRADE IS FROZEN, and that one is a true `#Conflict` — the refusal says
    * / so explicitly ("Not a permission problem and not a missing job"), and `isTradeFrozen()` is the
@@ -475,7 +497,7 @@ export interface _SERVICE {
    * / Born disabled deliberately: a listing that went live at creation would be sellable before its
    * / price was set, and `price` starts at 0 with `suggestedPrice` as the fallback.
    */
-  createEndpoint: ActorMethod<[string, string, string, bigint], Result_18>;
+  createEndpoint: ActorMethod<[string, string, string, bigint], Result_20>;
   /**
    * / Submit a paid service request. Returns a job id, or the price.
    * /
@@ -491,7 +513,7 @@ export interface _SERVICE {
    * /
    * / What DOES gate here is the market's freeze, and the service's own existence and pricing mode.
    */
-  createJob: ActorMethod<[string, Uint8Array | number[], [] | [PaymentSignature]], Result_17>;
+  createJob: ActorMethod<[string, Uint8Array | number[], [] | [PaymentSignature]], Result_19>;
   /**
    * / Delete content.
    * /
@@ -600,7 +622,7 @@ export interface _SERVICE {
    * / before the nonce lock or any ledger call, and the refusal reaches the buyer as #Refused with
    * / ic402's text naming both principals. Pay as the principal that approved the allowance.
    */
-  getContent: ActorMethod<[string, [] | [PaymentSignature]], Result_16>;
+  getContent: ActorMethod<[string, [] | [PaymentSignature]], Result_18>;
   /**
    * / ⟨0.16.0⟩ THE `getChunk` FIX, and it is the sharpest single case in the corpus.
    * /
@@ -627,7 +649,7 @@ export interface _SERVICE {
    * / check was out of scope by construction rather than by ruling. L11 adds payment gates to that
    * / list; this method is why.
    */
-  getContentChunk: ActorMethod<[AccessGrant, bigint], Result_13>;
+  getContentChunk: ActorMethod<[AccessGrant, bigint], Result_15>;
   /**
    * / A seller's payout address — THEIRS, or the admin's to read.
    * /
@@ -635,7 +657,7 @@ export interface _SERVICE {
    * / caller can read, and `#Ok(null)` genuinely means "this seller has set no payout address" —
    * / distinguishable from "you may not ask", which is the whole point of the envelope.
    */
-  getEvmSellerPayout: ActorMethod<[Principal], Result_15>;
+  getEvmSellerPayout: ActorMethod<[Principal], Result_17>;
   /**
    * / PUBLIC: what this canister's chains continue, or that they continue nothing. A fresh chain
    * / beside a published predecessor head is auditable; a fresh chain with no statement is
@@ -652,7 +674,7 @@ export interface _SERVICE {
    * / from it — the marketplace UI printed "Job not found (or not yet visible)" at a caller who was
    * / merely unauthorized. Job existence is not the secret: `getJobCounts()` is ungated.
    */
-  getJob: ActorMethod<[string], Result_14>;
+  getJob: ActorMethod<[string], Result_16>;
   /**
    * / PUBLIC: aggregate counts that identify nobody — and already public on the engram, which is
    * / what made `listJobs`' existence-leak justification false.
@@ -669,7 +691,7 @@ export interface _SERVICE {
    * / Three outcomes, three answers now. And `Payer` (above) removes the root cause rather than
    * / only labelling it.
    */
-  getJobResult: ActorMethod<[string], Result_13>;
+  getJobResult: ActorMethod<[string], Result_15>;
   /**
    * / Terminal money settlement — the seller gets paid. Honours the freeze exactly like every
    * / other settle path; a settlement that ignored the freeze would make the freeze a suggestion.
@@ -686,7 +708,7 @@ export interface _SERVICE {
    * / The engram returned `?EngramJobStatus`, conflating "no such job" with a null-ish answer. Here
    * / a missing job is `#NotFound`, which is a fact rather than an absence a caller has to interpret.
    */
-  getJobStatus: ActorMethod<[string], Result_12>;
+  getJobStatus: ActorMethod<[string], Result_14>;
   /**
    * / PUBLIC: the market's spend limits, with the caller rosters REDACTED.
    * /
@@ -713,7 +735,7 @@ export interface _SERVICE {
    * / "you have sold nothing" — and returning it to a caller who simply has no identity is the
    * / fabricated-empty defect wearing a number instead of a list.
    */
-  getRevenueSummary: ActorMethod<[], Result_11>;
+  getRevenueSummary: ActorMethod<[], Result_13>;
   /**
    * / PUBLIC: what a buyer can learn about a seller, and the whole of it.
    * /
@@ -726,7 +748,7 @@ export interface _SERVICE {
    * / `verified` is about ownership at a moment in time and nothing else. It is not an endorsement,
    * / and the field name is the strongest claim it makes.
    */
-  getSellerStatus: ActorMethod<[Principal], Result_10>;
+  getSellerStatus: ActorMethod<[Principal], Result_12>;
   /**
    * / PUBLIC: aggregate session counts. Identifies nobody, and the same reasoning as getJobCounts —
    * / which is also what made `listJobs`' old "no existence leak" defence false.
@@ -813,13 +835,19 @@ export interface _SERVICE {
   /**
    * / `total` is the head counter, not the row count: this is a bounded ring, so a page that
    * / reported only what it returned would make a trimmed log look complete.
+   * /
+   * / ⟨2026-10-15, the owner's ruling 6B of 2026-10-14⟩ The reply is the shared `Wire.RecordPage`, so
+   * / one checker reads every chain. A viewer sees every entry, so `sealed` is always empty here;
+   * / `ringFloor` says where the ring starts and `hashFirstFrom` where this record switched to the
+   * / hash-first rule. The gate is unchanged (hash-only rows for strangers were ruled for the
+   * / engram's record).
    */
-  listAuditEntries: ActorMethod<[bigint, bigint], Result_8>;
+  listAuditEntries: ActorMethod<[bigint, bigint], Result_11>;
   /**
    * / Admin AND the enrolled viewers themselves — L8's roster rule. A viewer who cannot see the
    * / roster cannot tell whether their own enrolment survived a rotation.
    */
-  listAuditViewers: ActorMethod<[], Result_9>;
+  listAuditViewers: ActorMethod<[], Result_10>;
   /**
    * / PUBLIC: the catalogue is the storefront. A shop that refuses to say what it sells to
    * / anyone who has not already bought is not a shop.
@@ -830,7 +858,7 @@ export interface _SERVICE {
    * / the fabricated-empty class was born, and a refusal that leaves no trace cannot be counted,
    * / alerted on, or disproved.
    */
-  listDenialEntries: ActorMethod<[bigint, bigint], Result_8>;
+  listDenialEntries: ActorMethod<[bigint, bigint], Result_9>;
   /**
    * / Purchase history for one endpoint: its creator sees every row, a buyer sees their own.
    * /
@@ -845,7 +873,7 @@ export interface _SERVICE {
    * / few sales. `withheld` now counts them, so "no purchases here" and "not yours to see" are
    * / different answers — without naming whose they were.
    */
-  listEndpointPurchases: ActorMethod<[string, bigint, bigint], Result_7>;
+  listEndpointPurchases: ActorMethod<[string, bigint, bigint], Result_8>;
   /**
    * / PUBLIC: the shelves, like the catalogue. `#Deleted` listings are excluded from an
    * / unfiltered read and COUNTED in `withheld` — a shop with three deleted listings and a shop with
@@ -875,7 +903,7 @@ export interface _SERVICE {
    * / Now: `#Refused` when the caller may not ask, `#NotFound` when the service does not exist —
    * / two facts that were one empty list.
    */
-  listJobs: ActorMethod<[string, [] | [JobStatus], bigint, bigint], Result_6>;
+  listJobs: ActorMethod<[string, [] | [JobStatus], bigint, bigint], Result_7>;
   /**
    * / The parked withdrawals belonging to this caller, so an unresolved payout is discoverable
    * / rather than something a seller has to already know the id of.
@@ -892,7 +920,7 @@ export interface _SERVICE {
    * / non-owner's view withholds other buyers' rows. Stated because a reader comparing the two
    * / should know the zero is a fact about this surface, not an unimplemented field.
    */
-  listMyPendingWithdrawals: ActorMethod<[bigint, bigint], Result_5>;
+  listMyPendingWithdrawals: ActorMethod<[bigint, bigint], Result_6>;
   /**
    * / ⟨0.16.0⟩ `listAllServices` FOLDS in as `includeDisabled`.
    * /
@@ -945,7 +973,7 @@ export interface _SERVICE {
    * / not the bare `consumeVoucher`: the signed fallback is off on this canister, so the bare call
    * / refuses every voucher, and only the session key calling as itself may spend a session.
    */
-  openSession: ActorMethod<[SessionConfig, PaymentSignature], Result_4>;
+  openSession: ActorMethod<[SessionConfig, PaymentSignature], Result_5>;
   /**
    * / RENAMED from `requestSession` (census tier-3 #21): it is a pure dry run — a quote for a session
    * / the caller has not opened and is not committed to. `request` read as an action with an effect.
@@ -1011,7 +1039,7 @@ export interface _SERVICE {
    * / on-chain nonce, so `settle` ALWAYS requires the server one. A conformant EVM x402 client
    * / sends no server nonce at all and is unaffected.
    */
-  quotePayment: ActorMethod<[bigint], Result_3>;
+  quotePayment: ActorMethod<[bigint], Result_4>;
   /**
    * / Admin recovery: re-drive a job stuck mid-settlement — a broadcast EVM transfer whose outcome
    * / this canister never learned. Reads the chain and finishes what the settle started.
@@ -1097,8 +1125,16 @@ export interface _SERVICE {
    * / refused or rejected: that close already ends the session `closed`, with the remainder still in
    * / its escrow, so it needs no force. Recover it within 24 hours of that close, asking at most the
    * / escrow's ledger balance less one fee.
+   * /
+   * / ⟨2026-10-07, the owner's decision of that day⟩ WHAT IT ANSWERS: what came back. `amount` is what
+   * / was transferred to the session's payer, in the token named (the amount asked, capped at the
+   * / session's unconsumed deposit; the transfer's fee comes out of the escrow on top), and
+   * / `blockIndex` is that ledger's block of the transfer. Until this date it answered a bare `nat`
+   * / that was the block index alone, which read as the amount. If the session's record is removed
+   * / before the amount can be read back — a session closed in the same moment as the recovery and
+   * / cleaned up during its transfer — it answers `#Other` naming the block, never a guessed amount.
    */
-  recoverEscrow: ActorMethod<[string, TokenAmount], Result>;
+  recoverEscrow: ActorMethod<[string, TokenAmount], Result_3>;
   /**
    * / Register as a seller by naming the engram you own.
    * /
@@ -1207,6 +1243,38 @@ export interface _SERVICE {
    * / dependency work.
    */
   resolveJob: ActorMethod<[string, JobStatus], Result_1>;
+  /**
+   * / Admin recovery: retry the payment to the seller of a job left `#Verified` by a failed payment.
+   * / NOTHING ELSE. It never refunds the buyer, and it refuses every job that does not read
+   * / `#Verified`, with nothing moved.
+   * /
+   * / ⟨2026-10-07, the owner's decision of that day⟩ A job whose work passed verification and whose
+   * / payment to the seller then failed rests in `#Verified`, and only `resolveDispute` moves it — the
+   * / service's SELLER's, by the ruling of 2026-08-17, which stands unchanged. A seller who never acts
+   * / left it there, with no way for anyone else to move it. This is the admin's way: unstick, not
+   * / decide. The job's outcome was decided by its verification; the payment goes where that sent it,
+   * / and the admin names neither a recipient nor an amount. Refunding the buyer, and anything about a
+   * / job not yet verified (`#Submitted`, `#Disputed`), stay the seller's.
+   * /
+   * / It runs the library's own settle, the one a buyer's confirmation runs: the job reads `#Settling`
+   * / while it pays (so two retries cannot both pay), ends `#Settled`, and a payment the ledger refuses
+   * / leaves it `#Verified` to retry again. For a job priced "up to" an amount, that settle also returns
+   * / to the buyer what the seller did not claim, as every settle does. Past the admin check, the
+   * / freeze and the cycles floor (each of which refuses before anything is read), every outcome is a
+   * / chained record entry naming the admin.
+   * /
+   * / A NEW METHOD, NOT A WIDER `resolveJob`, ON PURPOSE. `resolveJob` is the one place the admin line
+   * / bends — a STATE assertion, moving no money, for a job stuck in `#Settling`. Widening it to move
+   * / money on a `#Verified` job would give one argument (`#Settled`) two meanings depending on a state
+   * / the admin read a moment earlier: if the job moved to `#Settling` in between (a settle in flight),
+   * / "pay the seller" would become "declare the seller paid". One method per meaning keeps the
+   * / deciding one narrow and named.
+   * /
+   * / `#Conflict` covers the state refusals: a job that does not read `#Verified`, and the library's
+   * / own (a job that moved on before the retry ran, or a payment that failed). `#NotFound` is a job id
+   * / this market does not have.
+   */
+  retrySellerPayment: ActorMethod<[string], Result_1>;
   setAdmin: ActorMethod<[Principal], Result_1>;
   /**
    * / Override the policy for ONE payer — the market's per-buyer risk control.

package/dist/market.idl.js

@@ -28,7 +28,7 @@ export const idlFactory = ({ IDL }) => {
     suggestedPrice: IDL.Nat,
     enabledAtNs: IDL.Opt(IDL.Int),
   });
-  const Result_18 = IDL.Variant({ Ok: X402Endpoint, Err: Error });
+  const Result_20 = IDL.Variant({ Ok: X402Endpoint, Err: Error });
   const Eip3009Authorization = IDL.Record({
     r: IDL.Vec(IDL.Nat8),
     s: IDL.Vec(IDL.Nat8),
@@ -65,7 +65,7 @@ export const idlFactory = ({ IDL }) => {
     Accepted: IDL.Record({ jobId: IDL.Text }),
     PaymentRequired: IDL.Vec(PaymentRequirement),
   });
-  const Result_17 = IDL.Variant({
+  const Result_19 = IDL.Variant({
     Ok: ServiceRequestResponse,
     Err: Error,
   });
@@ -126,9 +126,9 @@ export const idlFactory = ({ IDL }) => {
     Delivered: ContentDelivery,
     PaymentRequired: IDL.Vec(PaymentRequirement),
   });
-  const Result_16 = IDL.Variant({ Ok: ContentResponse, Err: Error });
-  const Result_13 = IDL.Variant({ Ok: IDL.Vec(IDL.Nat8), Err: Error });
-  const Result_15 = IDL.Variant({ Ok: IDL.Opt(IDL.Text), Err: Error });
+  const Result_18 = IDL.Variant({ Ok: ContentResponse, Err: Error });
+  const Result_15 = IDL.Variant({ Ok: IDL.Vec(IDL.Nat8), Err: Error });
+  const Result_17 = IDL.Variant({ Ok: IDL.Opt(IDL.Text), Err: Error });
   const GenesisNote = IDL.Record({
     predecessorSize: IDL.Opt(IDL.Nat),
     predecessorHeadHash: IDL.Opt(IDL.Vec(IDL.Nat8)),
@@ -179,7 +179,7 @@ export const idlFactory = ({ IDL }) => {
     amount: IDL.Nat,
     params: IDL.Vec(IDL.Nat8),
   });
-  const Result_14 = IDL.Variant({ Ok: Job, Err: Error });
+  const Result_16 = IDL.Variant({ Ok: Job, Err: Error });
   const JobCounts = IDL.Record({
     total: IDL.Nat,
     active: IDL.Nat,
@@ -189,7 +189,7 @@ export const idlFactory = ({ IDL }) => {
     settling: IDL.Nat,
     parked: IDL.Nat,
   });
-  const Result_12 = IDL.Variant({ Ok: JobStatus, Err: Error });
+  const Result_14 = IDL.Variant({ Ok: JobStatus, Err: Error });
   const SpendingPolicy = IDL.Record({
     maxSessionDeposit: IDL.Opt(IDL.Nat),
     blockedCallers: IDL.Opt(IDL.Vec(IDL.Principal)),
@@ -217,7 +217,7 @@ export const idlFactory = ({ IDL }) => {
     contentPurchases: IDL.Nat,
     unresolvedWithdrawals: IDL.Nat,
   });
-  const Result_11 = IDL.Variant({ Ok: RevenueSummary, Err: Error });
+  const Result_13 = IDL.Variant({ Ok: RevenueSummary, Err: Error });
   const SellerStatus = IDL.Record({
     expiresAtNs: IDL.Int,
     verifiedAtNs: IDL.Int,
@@ -225,12 +225,13 @@ export const idlFactory = ({ IDL }) => {
     engramId: IDL.Principal,
     byteQuota: IDL.Nat,
   });
-  const Result_10 = IDL.Variant({ Ok: SellerStatus, Err: Error });
+  const Result_12 = IDL.Variant({ Ok: SellerStatus, Err: Error });
   const SessionCounts = IDL.Record({
     closed: IDL.Nat,
     total: IDL.Nat,
     expired: IDL.Nat,
     open: IDL.Nat,
+    refundOwed: IDL.Opt(IDL.Nat),
     closing: IDL.Nat,
   });
   const HttpRequest = IDL.Record({
@@ -245,6 +246,11 @@ export const idlFactory = ({ IDL }) => {
     upgrade: IDL.Opt(IDL.Bool),
     status_code: IDL.Nat16,
   });
+  const SealedEntry = IDL.Record({
+    id: IDL.Nat,
+    entryHash: IDL.Vec(IDL.Nat8),
+    digest: IDL.Vec(IDL.Nat8),
+  });
   const Role = IDL.Variant({
     Anonymous: IDL.Null,
     Viewer: IDL.Null,
@@ -269,18 +275,20 @@ export const idlFactory = ({ IDL }) => {
     success: IDL.Bool,
     timestampNs: IDL.Int,
   });
-  const Page_5 = IDL.Record({
+  const RecordPage = IDL.Record({
+    ringFloor: IDL.Nat,
     total: IDL.Nat,
-    withheld: IDL.Nat,
+    sealed: IDL.Vec(SealedEntry),
     items: IDL.Vec(AuditEntry),
+    hashFirstFrom: IDL.Nat,
   });
-  const Result_8 = IDL.Variant({ Ok: Page_5, Err: Error });
+  const Result_11 = IDL.Variant({ Ok: RecordPage, Err: Error });
   const Page_7 = IDL.Record({
     total: IDL.Nat,
     withheld: IDL.Nat,
     items: IDL.Vec(IDL.Principal),
   });
-  const Result_9 = IDL.Variant({ Ok: Page_7, Err: Error });
+  const Result_10 = IDL.Variant({ Ok: Page_7, Err: Error });
   const ContentEntry = IDL.Record({
     id: IDL.Text,
     createdAt: IDL.Int,
@@ -293,6 +301,12 @@ export const idlFactory = ({ IDL }) => {
     withheld: IDL.Nat,
     items: IDL.Vec(ContentEntry),
   });
+  const Page_5 = IDL.Record({
+    total: IDL.Nat,
+    withheld: IDL.Nat,
+    items: IDL.Vec(AuditEntry),
+  });
+  const Result_9 = IDL.Variant({ Ok: Page_5, Err: Error });
   const Payer = IDL.Variant({ Evm: IDL.Text, Icp: IDL.Principal });
   const PurchaseRecord = IDL.Record({
     id: IDL.Text,
@@ -309,7 +323,7 @@ export const idlFactory = ({ IDL }) => {
     withheld: IDL.Nat,
     items: IDL.Vec(PurchaseRecord),
   });
-  const Result_7 = IDL.Variant({ Ok: Page_4, Err: Error });
+  const Result_8 = IDL.Variant({ Ok: Page_4, Err: Error });
   const Page_3 = IDL.Record({
     total: IDL.Nat,
     withheld: IDL.Nat,
@@ -320,7 +334,7 @@ export const idlFactory = ({ IDL }) => {
     withheld: IDL.Nat,
     items: IDL.Vec(Job),
   });
-  const Result_6 = IDL.Variant({ Ok: Page_2, Err: Error });
+  const Result_7 = IDL.Variant({ Ok: Page_2, Err: Error });
   const PendingWithdrawal = IDL.Record({
     id: IDL.Nat,
     parkedAtNs: IDL.Int,
@@ -334,7 +348,7 @@ export const idlFactory = ({ IDL }) => {
     withheld: IDL.Nat,
     items: IDL.Vec(PendingWithdrawal),
   });
-  const Result_5 = IDL.Variant({ Ok: Page_1, Err: Error });
+  const Result_6 = IDL.Variant({ Ok: Page_1, Err: Error });
   const ServiceType = IDL.Variant({ Sync: IDL.Null, Async: IDL.Null });
   const PricingScheme = IDL.Variant({
     Exact: IDL.Nat,
@@ -397,7 +411,7 @@ export const idlFactory = ({ IDL }) => {
     remaining: IDL.Nat,
     payer: Payer,
   });
-  const Result_4 = IDL.Variant({ Ok: SessionState, Err: Error });
+  const Result_5 = IDL.Variant({ Ok: SessionState, Err: Error });
   const SessionIntent = IDL.Record({
     token: IDL.Text,
     costPerCall: IDL.Opt(IDL.Nat),
@@ -422,7 +436,7 @@ export const idlFactory = ({ IDL }) => {
     amountE6: IDL.Nat,
     requirements: IDL.Vec(QuotedRequirement),
   });
-  const Result_3 = IDL.Variant({ Ok: PaymentQuote, Err: Error });
+  const Result_4 = IDL.Variant({ Ok: PaymentQuote, Err: Error });
   const Result_2 = IDL.Variant({ Ok: IDL.Text, Err: Error });
   const Result = IDL.Variant({ Ok: IDL.Nat, Err: Error });
   const TokenAmount = IDL.Variant({
@@ -430,13 +444,18 @@ export const idlFactory = ({ IDL }) => {
     Ckusdc: IDL.Nat,
     Ckusdt: IDL.Nat,
   });
+  const EscrowRecovery = IDL.Record({
+    blockIndex: IDL.Nat,
+    amount: TokenAmount,
+  });
+  const Result_3 = IDL.Variant({ Ok: EscrowRecovery, Err: Error });
   return IDL.Service({
     addAuditViewer: IDL.Func([IDL.Principal], [Result_1], []),
     anchorNow: IDL.Func([], [Result_1], []),
     claimJob: IDL.Func([IDL.Text], [Result_1], []),
     confirmJob: IDL.Func([IDL.Text, IDL.Opt(IDL.Vec(IDL.Nat8))], [Result_1], []),
-    createEndpoint: IDL.Func([IDL.Text, IDL.Text, IDL.Text, IDL.Nat], [Result_18], []),
-    createJob: IDL.Func([IDL.Text, IDL.Vec(IDL.Nat8), IDL.Opt(PaymentSignature)], [Result_17], []),
+    createEndpoint: IDL.Func([IDL.Text, IDL.Text, IDL.Text, IDL.Nat], [Result_20], []),
+    createJob: IDL.Func([IDL.Text, IDL.Vec(IDL.Nat8), IDL.Opt(PaymentSignature)], [Result_19], []),
     deleteContent: IDL.Func([IDL.Text], [Result_1], []),
     deleteEndpoint: IDL.Func([IDL.Text], [Result_1], []),
     disputeJob: IDL.Func([IDL.Text, IDL.Text, IDL.Opt(IDL.Vec(IDL.Nat8))], [Result_1], []),
@@ -447,17 +466,17 @@ export const idlFactory = ({ IDL }) => {
     getAuditHead: IDL.Func([], [AuditHead], ['query']),
     getBuyerActionMessage: IDL.Func([IDL.Text, IDL.Text], [IDL.Text], ['query']),
     getCertifiedAuditHead: IDL.Func([], [CertifiedAuditHead], ['query']),
-    getContent: IDL.Func([IDL.Text, IDL.Opt(PaymentSignature)], [Result_16], []),
-    getContentChunk: IDL.Func([AccessGrant, IDL.Nat], [Result_13], ['query']),
-    getEvmSellerPayout: IDL.Func([IDL.Principal], [Result_15], ['query']),
+    getContent: IDL.Func([IDL.Text, IDL.Opt(PaymentSignature)], [Result_18], []),
+    getContentChunk: IDL.Func([AccessGrant, IDL.Nat], [Result_15], ['query']),
+    getEvmSellerPayout: IDL.Func([IDL.Principal], [Result_17], ['query']),
     getGenesisNote: IDL.Func([], [GenesisNote], ['query']),
-    getJob: IDL.Func([IDL.Text], [Result_14], ['query']),
+    getJob: IDL.Func([IDL.Text], [Result_16], ['query']),
     getJobCounts: IDL.Func([], [JobCounts], ['query']),
-    getJobResult: IDL.Func([IDL.Text], [Result_13], ['query']),
-    getJobStatus: IDL.Func([IDL.Text], [Result_12], ['query']),
+    getJobResult: IDL.Func([IDL.Text], [Result_15], ['query']),
+    getJobStatus: IDL.Func([IDL.Text], [Result_14], ['query']),
     getPaymentPolicy: IDL.Func([], [SpendingPolicy], ['query']),
-    getRevenueSummary: IDL.Func([], [Result_11], ['query']),
-    getSellerStatus: IDL.Func([IDL.Principal], [Result_10], ['query']),
+    getRevenueSummary: IDL.Func([], [Result_13], ['query']),
+    getSellerStatus: IDL.Func([IDL.Principal], [Result_12], ['query']),
     getSessionCounts: IDL.Func([], [SessionCounts], ['query']),
     http_request: IDL.Func([HttpRequest], [HttpResponse], ['query']),
     http_request_update: IDL.Func([HttpRequest], [HttpResponse], []),
@@ -489,22 +508,22 @@ export const idlFactory = ({ IDL }) => {
       ['query'],
     ),
     isTradeFrozen: IDL.Func([], [IDL.Bool], ['query']),
-    listAuditEntries: IDL.Func([IDL.Nat, IDL.Nat], [Result_8], ['query']),
-    listAuditViewers: IDL.Func([], [Result_9], ['query']),
+    listAuditEntries: IDL.Func([IDL.Nat, IDL.Nat], [Result_11], ['query']),
+    listAuditViewers: IDL.Func([], [Result_10], ['query']),
     listContent: IDL.Func([IDL.Nat, IDL.Nat], [Page_6], ['query']),
-    listDenialEntries: IDL.Func([IDL.Nat, IDL.Nat], [Result_8], ['query']),
-    listEndpointPurchases: IDL.Func([IDL.Text, IDL.Nat, IDL.Nat], [Result_7], ['query']),
+    listDenialEntries: IDL.Func([IDL.Nat, IDL.Nat], [Result_9], ['query']),
+    listEndpointPurchases: IDL.Func([IDL.Text, IDL.Nat, IDL.Nat], [Result_8], ['query']),
     listEndpoints: IDL.Func([IDL.Opt(EndpointStatus), IDL.Nat, IDL.Nat], [Page_3], ['query']),
-    listJobs: IDL.Func([IDL.Text, IDL.Opt(JobStatus), IDL.Nat, IDL.Nat], [Result_6], ['query']),
-    listMyPendingWithdrawals: IDL.Func([IDL.Nat, IDL.Nat], [Result_5], ['query']),
+    listJobs: IDL.Func([IDL.Text, IDL.Opt(JobStatus), IDL.Nat, IDL.Nat], [Result_7], ['query']),
+    listMyPendingWithdrawals: IDL.Func([IDL.Nat, IDL.Nat], [Result_6], ['query']),
     listServices: IDL.Func([IDL.Bool, IDL.Nat, IDL.Nat], [Page], ['query']),
-    openSession: IDL.Func([SessionConfig, PaymentSignature], [Result_4], []),
+    openSession: IDL.Func([SessionConfig, PaymentSignature], [Result_5], []),
     previewOpenSession: IDL.Func([], [SessionIntent], ['query']),
-    quotePayment: IDL.Func([IDL.Nat], [Result_3], ['query']),
+    quotePayment: IDL.Func([IDL.Nat], [Result_4], ['query']),
     reconcileJob: IDL.Func([IDL.Text], [Result_2], []),
     reconcileSession: IDL.Func([IDL.Text], [Result_2], []),
     recoverContentWithdrawal: IDL.Func([IDL.Nat], [Result], []),
-    recoverEscrow: IDL.Func([IDL.Text, TokenAmount], [Result], []),
+    recoverEscrow: IDL.Func([IDL.Text, TokenAmount], [Result_3], []),
     registerSeller: IDL.Func([IDL.Principal], [Result_1], []),
     registerService: IDL.Func(
       [
@@ -526,6 +545,7 @@ export const idlFactory = ({ IDL }) => {
     removeCallerPolicy: IDL.Func([IDL.Principal], [Result_1], []),
     resolveDispute: IDL.Func([IDL.Text, IDL.Bool], [Result_1], []),
     resolveJob: IDL.Func([IDL.Text, JobStatus], [Result_1], []),
+    retrySellerPayment: IDL.Func([IDL.Text], [Result_1], []),
     setAdmin: IDL.Func([IDL.Principal], [Result_1], []),
     setCallerPolicy: IDL.Func([IDL.Principal, SpendingPolicy], [Result_1], []),
     setEndpointEnabled: IDL.Func([IDL.Text, IDL.Bool], [Result_1], []),