@plasius/economy 0.3.2 → 0.5.0

package/dist/index.d.cts

@@ -26,7 +26,12 @@ type EconomyContractVersion = typeof ECONOMY_CONTRACT_VERSION;
 type AccountId = string;
 type AllocationId = string;
 type HouseholdId = string;
+type LearningEntitlementId = string;
+type LearningModuleVersionId = string;
 type LotId = string;
+type ModuleAllowanceId = string;
+type ModuleSpendHoldId = string;
+type ModuleSpendQuoteId = string;
 type PostingId = string;
 type ProviderEventId = string;
 type TransactionId = string;
@@ -379,88 +384,6 @@ interface ReclaimGameplayAllocationInputV1 {
 /** Reclaims unused whole Tokens without changing spent history. */
 declare function reclaimGameplayAllocation(allocation: GameplayAllocationV1, input: ReclaimGameplayAllocationInputV1): GameplayAllocationV1;
 
-declare const PRE_UTILITY_BACKER_COHORT: "pre_utility_backer_v1";
-interface EarlyBackerWindowV1 {
-    readonly publicTokensLaunchAt: IsoTimestamp;
-    readonly firstPublicSpendLiveAt?: IsoTimestamp;
-}
-/** Paid-lot facts required to recalculate retained early-backer basis. */
-interface PaidLotRetentionV1 {
-    readonly schemaVersion: EconomyContractVersion;
-    readonly lotId: LotId;
-    readonly payerAccountId: AccountId;
-    readonly receivingHouseholdId: HouseholdId;
-    readonly purchaseId: string;
-    readonly catalogVersion: string;
-    readonly purchasedAt: IsoTimestamp;
-    readonly settledAt: IsoTimestamp;
-    readonly creditedAt: IsoTimestamp;
-    readonly retainedAmount: TokenSubunitString;
-}
-interface EarlyBackerEvaluationV1 {
-    readonly schemaVersion: EconomyContractVersion;
-    readonly cohortKey: typeof PRE_UTILITY_BACKER_COHORT;
-    readonly status: "not-qualified" | "provisional";
-    readonly payerAccountId: AccountId;
-    readonly receivingHouseholdId: HouseholdId;
-    readonly netRetainedAmount: TokenSubunitString;
-    readonly contributingLotIds: readonly LotId[];
-    readonly evaluatedAt: IsoTimestamp;
-}
-declare const EARLY_BACKER_SETTLEMENT_POLICY_V2: "settlement-window-v2";
-/**
- * Additive evaluation result using settlement as the sole qualification event.
- * Purchase and credit times remain provenance/order facts.
- */
-interface EarlyBackerEvaluationV2 {
-    readonly schemaVersion: EconomyContractVersion;
-    readonly policyVersion: typeof EARLY_BACKER_SETTLEMENT_POLICY_V2;
-    readonly qualificationEvent: "settled-at";
-    readonly cohortKey: typeof PRE_UTILITY_BACKER_COHORT;
-    readonly status: "not-qualified" | "provisional";
-    readonly payerAccountId: AccountId;
-    readonly receivingHouseholdId: HouseholdId;
-    readonly netRetainedAmount: TokenSubunitString;
-    readonly contributingLotIds: readonly LotId[];
-    readonly evaluatedAt: IsoTimestamp;
-}
-/**
- * Recalculates provisional cohort basis from retained paid lots. It promises no
- * future reward and deliberately has no permanent entitled state.
- */
-declare function evaluateEarlyBacker(payerAccountId: AccountId, receivingHouseholdId: HouseholdId, paidLots: readonly PaidLotRetentionV1[], window: EarlyBackerWindowV1, evaluatedAt: IsoTimestamp): EarlyBackerEvaluationV1;
-/**
- * Evaluates the approved settlement-window policy. The caller owns environment
- * and rollout classification: `publicTokensLaunchAt` and
- * `firstPublicSpendLiveAt` must be derived from the entire public cohort, so
- * staff, test, and closed-beta availability cannot open or close this window.
- * The caller must also exclude non-production/test lots before evaluation.
- */
-declare function evaluateEarlyBackerBySettlementV2(payerAccountId: AccountId, receivingHouseholdId: HouseholdId, paidLots: readonly PaidLotRetentionV1[], window: EarlyBackerWindowV1, evaluatedAt: IsoTimestamp): EarlyBackerEvaluationV2;
-
-/** Stable machine-readable failures exposed by the economy domain. */
-type EconomyErrorCode = "INVALID_AMOUNT" | "AMOUNT_OUT_OF_RANGE" | "AMOUNT_NOT_WHOLE_TOKEN" | "INVALID_CONTRACT" | "UNBALANCED_TRANSACTION" | "DUPLICATE_IDENTIFIER" | "DUPLICATE_TRANSACTION" | "INSUFFICIENT_BALANCE" | "INSUFFICIENT_ELIGIBLE_LOTS" | "SOURCE_LOT_RESTRICTED" | "REVERSAL_ALREADY_EXISTS" | "NEGATIVE_PROJECTION" | "INVALID_TIME_WINDOW";
-interface EconomyErrorEnvelopeV1 {
-    readonly schemaVersion: "1";
-    readonly error: {
-        readonly code: EconomyErrorCode;
-        readonly message: string;
-        readonly requestId?: string;
-    };
-}
-/**
- * Domain error with a stable code and deliberately non-sensitive message.
- * Provider evidence, identities, and payment details must not be included.
- */
-declare class EconomyError extends Error {
-    readonly code: EconomyErrorCode;
-    constructor(code: EconomyErrorCode, message: string);
-}
-/** Throws a stable economy error when a domain assertion fails. */
-declare function economyAssert(condition: unknown, code: EconomyErrorCode, message: string): asserts condition;
-/** Creates a bounded, non-sensitive error contract for an HTTP adapter. */
-declare function toEconomyErrorEnvelope(error: EconomyError, requestId?: string): EconomyErrorEnvelopeV1;
-
 type JournalChainId = string;
 /** Locked head of one canonical transaction hash chain. */
 interface JournalChainHeadV1 {
@@ -475,6 +398,18 @@ interface JournalChainHeadV1 {
 type ChainedEconomicJournalTransactionV1 = EconomicJournalTransactionV1 & {
     readonly canonicalHash: string;
 };
+type JournalChainVerificationFailureCodeV1 = "duplicate-transaction" | "invalid-transaction" | "previous-hash-mismatch" | "canonical-hash-mismatch" | "end-head-mismatch";
+/** Deterministic result of verifying one ordered canonical-chain segment. */
+interface JournalChainVerificationResultV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly valid: boolean;
+    readonly checkedTransactions: number;
+    readonly observedHead: JournalChainHeadV1;
+    readonly failureCode?: JournalChainVerificationFailureCodeV1;
+    readonly firstInvalidTransactionId?: TransactionId;
+}
+/** Approved infrastructure adapter that hashes exact canonical UTF-8 bytes. */
+type CanonicalPayloadHashFunctionV1 = (payload: string) => string;
 /** Validates an empty or populated journal-chain head. */
 declare function assertJournalChainHead(head: JournalChainHeadV1): void;
 /**
@@ -483,107 +418,162 @@ declare function assertJournalChainHead(head: JournalChainHeadV1): void;
  * version inside the same serializable transaction that appends the journal.
  */
 declare function advanceJournalChainHead(head: JournalChainHeadV1, transaction: ChainedEconomicJournalTransactionV1): JournalChainHeadV1;
+/**
+ * Recomputes an ordered journal segment without implementing cryptography.
+ *
+ * The caller supplies an approved SHA-256 adapter. Malformed transactions are
+ * reported as integrity failures, while an invalid hash-adapter result is a
+ * contract error and fails closed.
+ */
+declare function verifyJournalChainSegment(startHead: JournalChainHeadV1, transactions: readonly ChainedEconomicJournalTransactionV1[], expectedEndHead: JournalChainHeadV1, hashCanonicalPayload: CanonicalPayloadHashFunctionV1): JournalChainVerificationResultV1;
 
-type AdjustmentStatus = "draft" | "pending-approval" | "approved" | "rejected" | "executed" | "expired";
-/** Dual-control request; the resulting change is always a ledger transaction. */
-interface AdjustmentRequestV1 {
+/** Application ceiling below Cosmos DB's 100-operation transactional limit. */
+declare const ECONOMY_AUTHORITY_MAX_BATCH_OPERATIONS = 80;
+/** Commit-manifest create plus authority-head conditional replacement. */
+declare const ECONOMY_AUTHORITY_COMMIT_OVERHEAD_OPERATIONS = 2;
+/** Maximum referenced record writes within one 80-operation authority batch. */
+declare const ECONOMY_AUTHORITY_MAX_RECORD_REFERENCES: number;
+/** Application ceiling below Cosmos DB's 2 MiB transactional-batch limit. */
+declare const ECONOMY_AUTHORITY_MAX_BATCH_BYTES = 1572864;
+/** Validates adapter-measured transactional operation and byte counts. */
+declare function assertEconomyAuthorityBatchLimits(operationCount: number, serializedBytes: number): void;
+type EconomyAuthorityStateV1 = "open" | "acquisition-closed" | "closed" | "rebuilding";
+type EconomyAuthorityCommitKindV1 = "genesis" | "first-party-command" | "provider-acceptance" | "provider-result" | "integrity-verification" | "state-transition" | "writer-fence-transition" | "reconstruction";
+type EconomyAuthorityRecordKindV1 = "command-envelope" | "provider-evidence-manifest" | "provider-evidence" | "operational-handle-binding" | "workflow-event" | "accepted-receipt" | "result-receipt" | "journal-transaction" | "source-lot" | "source-lot-movement" | "gameplay-allocation" | "balance-projection" | "lifetime-projection" | "idempotency-result" | "outbox-event" | "work-item" | "dead-letter" | "integrity-receipt" | "integrity-anchor";
+type EconomyAuthorityWriteKindV1 = "create" | "conditional-replace";
+/**
+ * Canonical reference to one record created or conditionally replaced by an
+ * authority commit. Conditional replacements bind the previous content and a
+ * hash of the adapter's optimistic-concurrency token; unconditional replacement
+ * has no representation.
+ */
+interface EconomyAuthorityRecordReferenceV1 {
     readonly schemaVersion: EconomyContractVersion;
-    readonly adjustmentId: string;
-    readonly walletId: WalletId;
-    readonly amount: TokenSubunitString;
-    readonly reason: string;
-    readonly ticketReference: string;
-    readonly status: AdjustmentStatus;
-    readonly initiatedByAccountId: AccountId;
-    readonly initiatedAt: IsoTimestamp;
-    readonly approvedByAccountId?: AccountId;
-    readonly approvedAt?: IsoTimestamp;
-    readonly resultingTransactionId?: TransactionId;
+    readonly recordKind: EconomyAuthorityRecordKindV1;
+    readonly recordId: string;
+    readonly writeKind: EconomyAuthorityWriteKindV1;
+    readonly contentHash: string;
+    readonly previousContentHash?: string;
+    readonly expectedConcurrencyTokenHash?: string;
 }
-/** Proves that production adjustment approval was performed by another actor. */
-declare function assertDistinctAdjustmentApproval(request: AdjustmentRequestV1): void;
-
-type PaidLotLifecycleStatusV1 = "clear" | "partially-reversed" | "disputed" | "fully-reversed" | "chargeback-lost";
-type PaidLotLifecycleEventTypeV1 = "refund" | "dispute-hold" | "dispute-won" | "dispute-lost" | "chargeback" | "reversal";
-/** Paid-purchase facts not already carried by the source lot. */
-interface PaidLotPurchaseProvenanceV1 {
+/**
+ * Immutable, hash-linked record of one authoritative atomic boundary.
+ *
+ * First-party commands carry acceptance and terminal effects in one manifest.
+ * Provider commands use a provider-acceptance manifest followed by a
+ * provider-result manifest after external reconciliation.
+ */
+interface EconomyAuthorityCommitManifestV1 {
     readonly schemaVersion: EconomyContractVersion;
-    readonly purchaseId: string;
-    readonly catalogVersion: string;
-    readonly purchasedAt: IsoTimestamp;
+    readonly commitId: string;
+    readonly authorityId: string;
+    readonly sequence: string;
+    readonly commitKind: EconomyAuthorityCommitKindV1;
+    readonly previousCommitHash?: string;
+    readonly commandId?: string;
+    readonly correlationId?: string;
+    readonly authorityStateBefore: EconomyAuthorityStateV1;
+    readonly authorityStateAfter: EconomyAuthorityStateV1;
+    readonly stateReasonCode?: string;
+    readonly recoveryVerificationReceiptId?: string;
+    readonly recoveryVerificationReceiptHash?: string;
+    readonly dualApprovalEvidenceHash?: string;
+    readonly writerRegion: string;
+    readonly writerFencingToken: string;
+    readonly recordReferences: readonly EconomyAuthorityRecordReferenceV1[];
+    readonly committedAt: IsoTimestamp;
 }
-/** Provider-neutral refund/dispute evidence for a paid source lot. */
-interface PaidLotLifecycleEventV1 {
+/** Compare-and-swap projection for the singleton authority head. */
+interface EconomyAuthorityHeadV1 {
     readonly schemaVersion: EconomyContractVersion;
-    readonly eventId: string;
-    readonly lotId: LotId;
-    readonly eventType: PaidLotLifecycleEventTypeV1;
-    readonly amount: TokenSubunitString;
-    readonly occurredAt: IsoTimestamp;
+    readonly authorityId: string;
+    readonly version: string;
+    readonly state: EconomyAuthorityStateV1;
+    readonly lastCommitId?: string;
+    readonly lastCommitHash?: string;
+    readonly writerRegion: string;
+    readonly writerFencingToken: string;
+    readonly updatedAt: IsoTimestamp;
 }
-interface PaidLotLifecycleReceiptV1 {
+/** Manifest plus the canonical hash calculated by an approved adapter. */
+interface HashedEconomyAuthorityCommitManifestV1 {
     readonly schemaVersion: EconomyContractVersion;
-    readonly event: PaidLotLifecycleEventV1;
+    readonly manifest: EconomyAuthorityCommitManifestV1;
+    readonly canonicalHash: string;
+}
+type EconomyIntegrityVerificationStatusV1 = "valid" | "invalid";
+type EconomyIntegrityFailureCodeV1 = "authority-head-mismatch" | "commit-hash-mismatch" | "commit-link-mismatch" | "record-hash-mismatch" | "journal-head-mismatch" | "projection-mismatch";
+/** Immutable, privacy-safe evidence of one bounded integrity verification. */
+interface EconomyIntegrityVerificationReceiptV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly verificationId: string;
+    readonly authorityId: string;
+    readonly status: EconomyIntegrityVerificationStatusV1;
+    readonly checkedThroughSequence: string;
+    readonly checkedCommits: string;
+    readonly checkedRecords: string;
+    readonly expectedAuthorityHeadHash: string;
+    readonly observedAuthorityHeadHash: string;
+    readonly expectedJournalHeadHash?: string;
+    readonly observedJournalHeadHash?: string;
+    readonly expectedProjectionSetHash?: string;
+    readonly observedProjectionSetHash?: string;
+    readonly anchorManifestHash?: string;
+    readonly failureCode?: EconomyIntegrityFailureCodeV1;
+    readonly firstInvalidCommitId?: string;
+    readonly firstInvalidRecordId?: string;
+    readonly verifiedAt: IsoTimestamp;
 }
 /**
- * Retained paid-lot projection. Immutable purchase/original facts plus every
- * receipt are sufficient to rebuild all derived amounts in occurrence order.
+ * Canonical hourly Merkle-root manifest. Signing and storage are deliberately
+ * infrastructure responsibilities; this contract contains no private key,
+ * signature, storage URI, or administrator-proof claim.
  */
-interface PaidLotLifecycleV1 {
+interface EconomyIntegrityAnchorManifestV1 {
     readonly schemaVersion: EconomyContractVersion;
-    readonly lotId: LotId;
-    readonly payerAccountId: AccountId;
-    readonly receivingHouseholdId: HouseholdId;
-    readonly purchaseId: string;
-    readonly catalogVersion: string;
-    readonly purchasedAt: IsoTimestamp;
-    readonly settledAt: IsoTimestamp;
-    readonly creditedAt: IsoTimestamp;
-    readonly originalAmount: TokenSubunitString;
-    readonly retainedAmount: TokenSubunitString;
-    readonly heldAmount: TokenSubunitString;
-    readonly reversedAmount: TokenSubunitString;
-    readonly refundedAmount: TokenSubunitString;
-    readonly chargebackAmount: TokenSubunitString;
-    readonly oneTimeReversalAmount: TokenSubunitString;
-    readonly status: PaidLotLifecycleStatusV1;
-    readonly version: number;
-    readonly receipts: readonly PaidLotLifecycleReceiptV1[];
-    readonly effectiveEventIds: readonly string[];
-}
-/** Exact signed projection deltas produced when one receipt is appended. */
-interface PaidLotLifecycleArithmeticV1 {
-    readonly retainedDelta: TokenSubunitString;
-    readonly heldDelta: TokenSubunitString;
-    readonly reversedDelta: TokenSubunitString;
-    readonly refundedDelta: TokenSubunitString;
-    readonly chargebackDelta: TokenSubunitString;
-    readonly oneTimeReversalDelta: TokenSubunitString;
-}
-interface PaidLotLifecycleMutationResultV1 {
-    readonly lifecycle: PaidLotLifecycleV1;
-    /** False only for an exact event-ID replay already recorded. */
-    readonly applied: boolean;
-    readonly stateChanged: boolean;
-    readonly arithmetic: PaidLotLifecycleArithmeticV1;
-}
-/** Validates the paid purchase facts paired with a source lot. */
-declare function assertPaidLotPurchaseProvenance(provenance: PaidLotPurchaseProvenanceV1): void;
-/** Validates one provider-neutral paid-lot lifecycle event. */
-declare function assertPaidLotLifecycleEvent(event: PaidLotLifecycleEventV1): void;
-/** Validates and deterministically rebuilds retained paid-lot arithmetic. */
-declare function assertPaidLotLifecycle(lifecycle: PaidLotLifecycleV1): void;
-/** Creates the retained projection for one newly credited paid source lot. */
-declare function createPaidLotLifecycle(lot: SourceLotV1, provenance: PaidLotPurchaseProvenanceV1): PaidLotLifecycleV1;
+    readonly anchorId: string;
+    readonly authorityId: string;
+    readonly firstCommitSequence: string;
+    readonly lastCommitSequence: string;
+    readonly leafCount: string;
+    readonly merkleRootHash: string;
+    readonly authorityHeadHash: string;
+    readonly producedAt: IsoTimestamp;
+}
+/** Validates one create-only or optimistic conditional-replace reference. */
+declare function assertEconomyAuthorityRecordReference(reference: EconomyAuthorityRecordReferenceV1): void;
+/** Validates one immutable authority commit manifest. */
+declare function assertEconomyAuthorityCommitManifest(manifest: EconomyAuthorityCommitManifestV1): void;
+/** Validates an empty or populated singleton authority head. */
+declare function assertEconomyAuthorityHead(head: EconomyAuthorityHeadV1): void;
 /**
- * Appends one event then rebuilds every receipt in authoritative occurrence
- * order. Exact retries succeed before stale-version validation.
+ * Proves that a canonical manifest advances the locked singleton authority
+ * head by exactly one sequence and returns the compare-and-swap replacement.
  */
-declare function applyPaidLotLifecycleEvent(lifecycle: PaidLotLifecycleV1, event: PaidLotLifecycleEventV1, expectedVersion: number): PaidLotLifecycleMutationResultV1;
-/** Reduces unordered/retried lifecycle evidence in canonical event order. */
-declare function reducePaidLotLifecycleEvents(initial: PaidLotLifecycleV1, events: readonly PaidLotLifecycleEventV1[]): PaidLotLifecycleV1;
-/** Creates the exact retained-basis input used by early-backer evaluators. */
-declare function createEarlyBackerRetentionFromPaidLot(lifecycle: PaidLotLifecycleV1): PaidLotRetentionV1;
+declare function advanceEconomyAuthorityHead(head: EconomyAuthorityHeadV1, manifest: EconomyAuthorityCommitManifestV1, manifestCanonicalHash: string): EconomyAuthorityHeadV1;
+/** Validates one append-only result from a bounded integrity check. */
+declare function assertEconomyIntegrityVerificationReceipt(receipt: EconomyIntegrityVerificationReceiptV1): void;
+/** Validates one canonical hourly Merkle-root manifest. */
+declare function assertEconomyIntegrityAnchorManifest(manifest: EconomyIntegrityAnchorManifestV1): void;
+/** Produces deterministic UTF-8 JSON for a singleton authority head. */
+declare function canonicalEconomyAuthorityHeadPayload(head: EconomyAuthorityHeadV1): string;
+/** Produces deterministic UTF-8 JSON for an authority commit manifest. */
+declare function canonicalEconomyAuthorityCommitManifestPayload(manifest: EconomyAuthorityCommitManifestV1): string;
+/** Produces deterministic UTF-8 JSON for an integrity-verification receipt. */
+declare function canonicalEconomyIntegrityVerificationReceiptPayload(receipt: EconomyIntegrityVerificationReceiptV1): string;
+/** Produces deterministic UTF-8 JSON for an hourly integrity anchor. */
+declare function canonicalEconomyIntegrityAnchorManifestPayload(manifest: EconomyIntegrityAnchorManifestV1): string;
+/**
+ * Proves that a reopening manifest binds a successful verification receipt.
+ * The consuming service remains responsible for its maximum allowed age.
+ */
+declare function assertEconomyAuthorityRecoveryEvidence(manifest: EconomyAuthorityCommitManifestV1, receipt: EconomyIntegrityVerificationReceiptV1, hashCanonicalPayload: CanonicalPayloadHashFunctionV1): void;
+/**
+ * Returns a copy in the canonical record-reference order expected by manifests.
+ * Construction helpers may use this before validation; canonicalization itself
+ * never silently reorders a malformed manifest.
+ */
+declare function sortEconomyAuthorityRecordReferences(references: readonly EconomyAuthorityRecordReferenceV1[]): readonly EconomyAuthorityRecordReferenceV1[];
 
 type WalletKind = "household-treasury" | "personal" | "gameplay-allocation" | "hold" | "purchase-clearing" | "provider-clearing" | "system";
 type WalletStatus = "active" | "restricted" | "closed";
@@ -753,115 +743,808 @@ interface EconomyOutboxEventV1 {
     readonly payloadHash: string;
     readonly occurredAt: IsoTimestamp;
 }
-interface PersistedIdempotencyResultV1 {
-    readonly transactionId: TransactionId;
-    readonly responseHash: string;
-    readonly recordedAt: IsoTimestamp;
+interface PersistedIdempotencyResultV1 {
+    readonly transactionId: TransactionId;
+    readonly responseHash: string;
+    readonly recordedAt: IsoTimestamp;
+}
+/** Exact actor/subject/operation namespace for a caller-owned idempotency key. */
+interface EconomyIdempotencyScopeV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly idempotencyKey: string;
+    readonly commandType: EconomyCommandType;
+    readonly actorAccountId: AccountId;
+    readonly subjectAccountId: AccountId;
+}
+/** V2 replay evidence bound to one accepted command and exact scope. */
+interface ScopedPersistedIdempotencyResultV1 extends PersistedIdempotencyResultV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly commandId: string;
+}
+/** Validates replay evidence before it is returned across a command boundary. */
+declare function assertScopedPersistedIdempotencyResult(result: ScopedPersistedIdempotencyResultV1): void;
+/** Validates the namespace that prevents cross-principal replay collisions. */
+declare function assertEconomyIdempotencyScope(scope: EconomyIdempotencyScopeV1): void;
+/** Validates minimized accepted-command evidence before durable append. */
+declare function assertEconomyCommandEnvelope(envelope: EconomyCommandEnvelopeV1): void;
+/** Validates one immutable command-workflow state event. */
+declare function assertEconomyCommandWorkflowEvent(event: EconomyCommandWorkflowEventV1): void;
+/** Operations available only inside one serializable database transaction. */
+interface EconomyUnitOfWork {
+    getWalletForUpdate(walletId: WalletId): Promise<WalletV1 | null>;
+    listSpendableLotsForUpdate(walletId: WalletId): Promise<readonly SourceLotV1[]>;
+    findLotForUpdate(lotId: LotId): Promise<SourceLotV1 | null>;
+    findIdempotencyResult(idempotencyKey: string): Promise<PersistedIdempotencyResultV1 | null>;
+    appendTransaction(transaction: LedgerTransactionV1): Promise<void>;
+    appendSourceLot(lot: SourceLotV1): Promise<void>;
+    updateSourceLotProjection(lotId: LotId, remainingAmount: TokenSubunitString, heldAmount: TokenSubunitString, reversedAmount: TokenSubunitString): Promise<void>;
+    saveBalanceProjection(projection: BalanceProjection, transactionId: TransactionId): Promise<void>;
+    saveIdempotencyResult(idempotencyKey: string, result: PersistedIdempotencyResultV1): Promise<void>;
+    appendOutboxEvent(event: EconomyOutboxEventV1): Promise<void>;
+}
+/** Adapter boundary for serializable, ACID economy mutations. */
+interface EconomyPersistencePort {
+    runSerializable<T>(operation: (unitOfWork: EconomyUnitOfWork) => Promise<T>): Promise<T>;
+    getWallet(walletId: WalletId): Promise<WalletV1 | null>;
+    getBalanceProjection(walletId: WalletId): Promise<BalanceProjectionSnapshotV1 | null>;
+    getTransaction(transactionId: TransactionId): Promise<LedgerTransactionV1 | null>;
+    rebuildProjection(): Promise<BalanceProjection>;
+}
+/**
+ * V2 mutation surface. Unlike `EconomyUnitOfWork`, it has no absolute balance
+ * overwrite: journal, source-lot movement, allocation state, balance/lifetime
+ * deltas, idempotency, chain head, and outbox are committed atomically.
+ */
+interface EconomyUnitOfWorkV2 {
+    getWalletForOwnerForUpdate(walletId: WalletId, owner: WalletOwnerReferenceV1): Promise<WalletV1 | null>;
+    listSpendableLotsForUpdate(walletId: WalletId): Promise<readonly VersionedSourceLotV1[]>;
+    findLotForUpdate(lotId: LotId): Promise<VersionedSourceLotV1 | null>;
+    getGameplayAllocationForUpdate(allocationId: AllocationId, householdId: HouseholdId, childAccountId: AccountId): Promise<GameplayAllocationV1 | null>;
+    findIdempotencyResult(scope: EconomyIdempotencyScopeV1): Promise<ScopedPersistedIdempotencyResultV1 | null>;
+    /** Locks and rejects any stale/non-active regional writer lease. */
+    lockActiveWriterFence(acceptedRegion: string, writerFencingToken: string): Promise<void>;
+    lockJournalChainHead(chainId: string): Promise<JournalChainHeadV1>;
+    appendCommandEnvelope(envelope: EconomyCommandEnvelopeV1): Promise<void>;
+    appendCommandWorkflowEvent(event: EconomyCommandWorkflowEventV1): Promise<void>;
+    appendTransaction(transaction: ChainedEconomicJournalTransactionV1): Promise<void>;
+    /** Appends `createInitialSourceLotSnapshot()` output; later changes are movements. */
+    appendSourceLot(snapshot: VersionedSourceLotV1): Promise<void>;
+    /** Appends movement evidence and applies its lot CAS as one operation. */
+    applySourceLotMovement(movement: SourceLotMovementV1): Promise<void>;
+    appendGameplayAllocation(allocation: GameplayAllocationV1): Promise<void>;
+    /**
+     * Compares `expectedVersion`, requires `allocation.version` to be exactly the
+     * next value, and never overwrites a stale row.
+     */
+    saveGameplayAllocation(allocation: GameplayAllocationV1, expectedVersion: number): Promise<void>;
+    /**
+     * Atomically adds deltas, verifies them against the appended postings and
+     * account bindings, and records transaction-scoped application keys.
+     */
+    applyWalletBalanceDeltas(transactionId: TransactionId, deltas: readonly WalletBalanceDeltaV1[]): Promise<void>;
+    /**
+     * Atomically increments monotonic lifetime counters after verifying the
+     * deltas against the appended transaction's deterministic classification.
+     */
+    applyWalletLifetimeDeltas(transactionId: TransactionId, deltas: readonly WalletLifetimeDeltaV1[]): Promise<void>;
+    saveIdempotencyResult(scope: EconomyIdempotencyScopeV1, result: ScopedPersistedIdempotencyResultV1): Promise<void>;
+    appendOutboxEvent(event: EconomyOutboxEventV1): Promise<void>;
+    /** Compare-and-swaps the full locked head, including its canonical hash. */
+    advanceJournalChainHead(expected: JournalChainHeadV1, next: JournalChainHeadV1): Promise<void>;
+}
+/**
+ * Additive authoritative persistence boundary for new consumers. V1 remains
+ * exported for compatibility but must not be adapted by delegating its
+ * absolute `saveBalanceProjection` operation to this interface.
+ */
+interface EconomyPersistencePortV2 {
+    runSerializable<T>(operation: (unitOfWork: EconomyUnitOfWorkV2) => Promise<T>): Promise<T>;
+    getWallet(walletId: WalletId): Promise<WalletV1 | null>;
+    listWalletsByOwner(owner: WalletOwnerReferenceV1): Promise<readonly WalletV1[]>;
+    getGameplayAllocation(allocationId: AllocationId, householdId: HouseholdId, childAccountId: AccountId): Promise<GameplayAllocationV1 | null>;
+    getCommandEnvelope(commandId: string): Promise<EconomyCommandEnvelopeV1 | null>;
+    getTransaction(transactionId: TransactionId): Promise<ChainedEconomicJournalTransactionV1 | null>;
+    rebuildWalletBalanceProjections(): Promise<readonly WalletBalanceProjectionV1[]>;
+}
+/**
+ * V3 journal transaction whose legacy canonical `idempotencyKey` slot carries
+ * the HMAC digest, never the raw HTTP Idempotency-Key. The wire field remains
+ * unchanged so published transaction canonical bytes stay compatible.
+ */
+type AuditedChainedEconomicJournalTransactionV1 = Omit<ChainedEconomicJournalTransactionV1, "idempotencyKey"> & {
+    readonly idempotencyKey: EconomyHmacSha256DigestV1;
+};
+/**
+ * Additive audit-capable mutation surface.
+ *
+ * First-party commands append acceptance, economic result, projections,
+ * idempotency result, outbox, authority manifest, and authority-head CAS in one
+ * serializable unit. Provider workflows use one unit for verified durable
+ * acceptance and a second unit for the reconciled economic result.
+ */
+type EconomyUnitOfWorkV3 = Omit<EconomyUnitOfWorkV2, "appendCommandEnvelope" | "findIdempotencyResult" | "saveIdempotencyResult" | "appendTransaction"> & {
+    findAuditedIdempotencyResult(scope: EconomyAuditedIdempotencyScopeV1): Promise<EconomyAuditedIdempotencyResultV1 | null>;
+    lockAuthorityHead(authorityId: string): Promise<EconomyAuthorityHeadV1>;
+    appendCommandEnvelope(envelope: AuditedEconomyCommandEnvelopeV1): Promise<void>;
+    appendProviderEvidenceManifest(manifest: EconomyProviderEvidenceManifestV1): Promise<void>;
+    appendProviderEvidence(evidence: EconomyProviderEvidenceHashV1): Promise<void>;
+    appendEncryptedOperationalHandleBinding(binding: EconomyEncryptedOperationalHandleBindingV1): Promise<void>;
+    appendAcceptedCommandReceipt(receipt: EconomyAcceptedCommandReceiptV1): Promise<void>;
+    appendCommandResultReceipt(receipt: EconomyCommandResultReceiptV1): Promise<void>;
+    appendTransaction(transaction: AuditedChainedEconomicJournalTransactionV1): Promise<void>;
+    saveAuditedIdempotencyResult(scope: EconomyAuditedIdempotencyScopeV1, result: EconomyAuditedIdempotencyResultV1): Promise<void>;
+    appendAuthorityCommitManifest(manifest: EconomyAuthorityCommitManifestV1): Promise<void>;
+    advanceAuthorityHead(expected: EconomyAuthorityHeadV1, next: EconomyAuthorityHeadV1): Promise<void>;
+    appendIntegrityVerificationReceipt(receipt: EconomyIntegrityVerificationReceiptV1): Promise<void>;
+    appendIntegrityAnchorManifest(manifest: EconomyIntegrityAnchorManifestV1): Promise<void>;
+};
+/**
+ * V3 preserves every V2 economic primitive while making the audit records
+ * mandatory capabilities of an authoritative adapter. V1 and V2 remain
+ * exported unchanged for existing consumers.
+ */
+type EconomyPersistencePortV3 = Omit<EconomyPersistencePortV2, "runSerializable" | "getCommandEnvelope" | "getTransaction"> & {
+    runSerializable<T>(operation: (unitOfWork: EconomyUnitOfWorkV3) => Promise<T>): Promise<T>;
+    getCommandEnvelope(commandId: string): Promise<AuditedEconomyCommandEnvelopeV1 | null>;
+    getTransaction(transactionId: TransactionId): Promise<AuditedChainedEconomicJournalTransactionV1 | null>;
+    getAcceptedCommandReceipt(commandId: string): Promise<EconomyAcceptedCommandReceiptV1 | null>;
+    getCommandResultReceipt(commandId: string): Promise<EconomyCommandResultReceiptV1 | null>;
+    listProviderEvidence(commandId: string): Promise<readonly EconomyProviderEvidenceHashV1[]>;
+    getProviderEvidenceManifest(commandId: string): Promise<EconomyProviderEvidenceManifestV1 | null>;
+    listEncryptedOperationalHandleBindings(commandId: string): Promise<readonly EconomyEncryptedOperationalHandleBindingV1[]>;
+    getAuthorityHead(authorityId: string): Promise<EconomyAuthorityHeadV1 | null>;
+    getAuthorityCommitManifest(commitId: string): Promise<EconomyAuthorityCommitManifestV1 | null>;
+    getIntegrityVerificationReceipt(verificationId: string): Promise<EconomyIntegrityVerificationReceiptV1 | null>;
+    getIntegrityAnchorManifest(anchorId: string): Promise<EconomyIntegrityAnchorManifestV1 | null>;
+};
+interface EconomyClockPort {
+    now(): IsoTimestamp;
+}
+interface EconomyIdPort {
+    nextId(namespace: string): string;
+}
+
+type EconomyCommandSourceV1 = "browser" | "shopify" | "ayet" | "bitlabs" | "operator" | "system";
+type EconomyCommandProcessingModeV1 = "initial" | "replay";
+type EconomyPrincipalTypeV1 = "account" | "delegated-child" | "service" | "operator";
+type EconomyCausationKindV1 = "provider-event" | "economy-command" | "ledger-transaction" | "workflow-event" | "authority-commit";
+/** One privacy-safe edge in an economy audit correlation graph. */
+interface EconomyCausationReferenceV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly kind: EconomyCausationKindV1;
+    readonly causationId: string;
+}
+type EconomyHmacFingerprintDomainV1 = "economy.idempotency-key.v1" | "economy.provider-event-key.v1" | "economy.provider-object-key.v1" | "economy.provider-payload.v1" | "economy.provider-reconciliation.v1";
+type EconomyHmacSha256DigestV1 = `hmac-sha256:${string}`;
+/**
+ * A versioned, domain-separated HMAC fingerprint produced by an approved
+ * infrastructure adapter. It is a correlation token, not reversible evidence.
+ */
+interface EconomyHmacFingerprintV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly fingerprintVersion: "1";
+    readonly algorithm: "hmac-sha256";
+    readonly domain: EconomyHmacFingerprintDomainV1;
+    readonly keyVersion: string;
+    readonly digest: EconomyHmacSha256DigestV1;
+}
+/**
+ * Hashes of sanitized authorization-decision manifests. The manifests must
+ * contain no raw tokens, capability payloads, session IDs, or personal data.
+ */
+interface EconomyAuthorizationEvidenceV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly capabilityEvidenceHash: string;
+    readonly featureFlagEvidenceHash: string;
+    readonly assuranceEvidenceHash: string;
+    readonly authenticatedAt: IsoTimestamp;
+    readonly authorizedAt: IsoTimestamp;
+}
+/**
+ * Privacy-minimized command facts for the authoritative V3 boundary.
+ *
+ * This is deliberately standalone rather than extending
+ * `EconomyCommandEnvelopeV1`: the published legacy envelope contains a raw
+ * caller idempotency key, which must never enter new audit storage.
+ */
+interface AuditedEconomyCommandEnvelopeV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly commandId: string;
+    readonly commandType: EconomyCommandType;
+    readonly commandSource: EconomyCommandSourceV1;
+    readonly idempotencyFingerprint: EconomyHmacFingerprintV1;
+    readonly actorAccountId: AccountId;
+    readonly subjectAccountId: AccountId;
+    readonly principalType: EconomyPrincipalTypeV1;
+    readonly relationshipId?: string;
+    readonly authorizationVersion?: number;
+    readonly authorizationEvidence: EconomyAuthorizationEvidenceV1;
+    readonly routeId: string;
+    readonly buildId: string;
+    readonly correlationId: string;
+    readonly causation?: EconomyCausationReferenceV1;
+    /**
+     * SHA-256 of the canonical, already-sanitized semantic command payload.
+     * Provider callback bytes use an HMAC fingerprint instead.
+     */
+    readonly payloadHash: string;
+    readonly providerEvidenceManifestHash?: string;
+    readonly acceptedAt: IsoTimestamp;
+    readonly acceptedRegion: string;
+    readonly writerFencingToken: string;
+}
+type EconomyAcquisitionProviderV1 = "shopify" | "ayet" | "bitlabs";
+/**
+ * Privacy-minimized verified provider evidence. Every value derived from a raw
+ * provider identifier or callback body is represented by a domain-separated
+ * HMAC fingerprint. Signatures and payment data have no storage field.
+ */
+interface EconomyProviderEvidenceHashV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    /** Opaque internal identifier; never the provider's event identifier. */
+    readonly providerEventId: ProviderEventId;
+    readonly commandId: string;
+    readonly provider: EconomyAcquisitionProviderV1;
+    readonly providerObjectKeyFingerprint?: EconomyHmacFingerprintV1;
+    readonly providerEventKeyFingerprint: EconomyHmacFingerprintV1;
+    readonly eventType: string;
+    readonly payloadFingerprint: EconomyHmacFingerprintV1;
+    readonly reconciliationEvidenceFingerprint?: EconomyHmacFingerprintV1;
+    readonly signatureScheme: string;
+    readonly signatureVerifiedAt: IsoTimestamp;
+    readonly providerOccurredAt?: IsoTimestamp;
+    readonly receivedAt: IsoTimestamp;
+    readonly operationalHandleBindingId?: string;
+}
+type EconomyOperationalHandlePurposeV1 = "reconciliation" | "refund" | "dispute";
+/**
+ * Ledger-side binding for a provider handle encrypted and retained by the
+ * consuming site. The ciphertext, nonce, authentication tag, and key URI are
+ * not package fields; only hashes and non-secret cryptographic metadata bind
+ * the external sealed record.
+ */
+interface EconomyEncryptedOperationalHandleBindingV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly handleBindingId: string;
+    readonly commandId: string;
+    readonly provider: EconomyAcquisitionProviderV1;
+    readonly purpose: EconomyOperationalHandlePurposeV1;
+    readonly cipherSuite: "AES-256-GCM";
+    readonly keyVersion: string;
+    readonly ciphertextContentHash: string;
+    readonly encryptionContextHash: string;
+    readonly createdAt: IsoTimestamp;
+}
+/** One canonical content reference inside a sanitized evidence manifest. */
+interface EconomyEvidenceRecordReferenceV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly recordId: string;
+    readonly contentHash: string;
+}
+/**
+ * Sanitized manifest bound by an audited provider command. Its referenced
+ * records contain HMAC fingerprints, never raw provider material.
+ */
+interface EconomyProviderEvidenceManifestV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly evidenceManifestId: string;
+    readonly commandId: string;
+    readonly provider: EconomyAcquisitionProviderV1;
+    readonly evidenceReferences: readonly EconomyEvidenceRecordReferenceV1[];
+    readonly operationalHandleReferences: readonly EconomyEvidenceRecordReferenceV1[];
+    readonly createdAt: IsoTimestamp;
+}
+/** Privacy-safe acknowledgement returned after durable command acceptance. */
+interface EconomyAcceptedCommandReceiptV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly receiptId: string;
+    readonly commandId: string;
+    readonly correlationId: string;
+    readonly commandEnvelopeHash: string;
+    readonly acceptedAt: IsoTimestamp;
+}
+type EconomyCommandResultOutcomeV1 = "completed" | "failed" | "no-op";
+/**
+ * Immutable terminal receipt. A completed result binds one journal
+ * transaction, a failed result binds one safe failure code, and a no-op binds
+ * one safe reason proving that no economic transaction was required.
+ */
+interface EconomyCommandResultReceiptV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly receiptId: string;
+    readonly commandId: string;
+    readonly correlationId: string;
+    readonly acceptedReceiptId: string;
+    readonly commandEnvelopeHash: string;
+    readonly outcome: EconomyCommandResultOutcomeV1;
+    readonly resultHash: string;
+    readonly transactionId?: TransactionId;
+    readonly transactionCanonicalHash?: string;
+    readonly failureCode?: string;
+    readonly noOpCode?: string;
+    readonly recordedAt: IsoTimestamp;
+}
+/** Raw-key-free actor/subject namespace used by authoritative V3 replay. */
+interface EconomyAuditedIdempotencyScopeV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly idempotencyFingerprint: EconomyHmacFingerprintV1;
+    readonly commandType: EconomyCommandType;
+    readonly actorAccountId: AccountId;
+    readonly subjectAccountId: AccountId;
+    readonly principalType: EconomyPrincipalTypeV1;
+    readonly relationshipId?: string;
+    readonly authorizationVersion?: number;
+}
+type EconomyAuditedIdempotencyStateV1 = "accepted" | EconomyCommandResultOutcomeV1;
+/**
+ * Persisted V3 replay result. The adapter returns this record for an exact
+ * canonical scope match; a fingerprint collision with different canonical
+ * command bytes is a security conflict, never a replay.
+ */
+interface EconomyAuditedIdempotencyResultV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly commandId: string;
+    readonly commandEnvelopeHash: string;
+    readonly acceptedReceiptId: string;
+    readonly resultReceiptId?: string;
+    readonly state: EconomyAuditedIdempotencyStateV1;
+    readonly responseHash: string;
+    readonly recordedAt: IsoTimestamp;
+}
+type EconomyCommandProcessingDispositionV1 = {
+    readonly mode: "initial";
+} | {
+    readonly mode: "replay";
+    readonly result: EconomyAuditedIdempotencyResultV1;
+};
+/** Validates a domain-separated HMAC fingerprint and its expected domain. */
+declare function assertEconomyHmacFingerprint(fingerprint: EconomyHmacFingerprintV1, expectedDomain?: EconomyHmacFingerprintDomainV1): void;
+/** Validates hashes of a sanitized, server-derived authorization decision. */
+declare function assertEconomyAuthorizationEvidence(evidence: EconomyAuthorizationEvidenceV1): void;
+/** Validates a fingerprint-only, server-derived authoritative command. */
+declare function assertAuditedEconomyCommandEnvelope(envelope: AuditedEconomyCommandEnvelopeV1): void;
+/** Validates privacy-minimized provider evidence before immutable append. */
+declare function assertEconomyProviderEvidenceHash(evidence: EconomyProviderEvidenceHashV1): void;
+/** Validates a ledger binding for site-owned encrypted provider state. */
+declare function assertEconomyEncryptedOperationalHandleBinding(binding: EconomyEncryptedOperationalHandleBindingV1): void;
+/** Validates a canonical sanitized provider-evidence manifest. */
+declare function assertEconomyProviderEvidenceManifest(manifest: EconomyProviderEvidenceManifestV1): void;
+/** Validates a client-safe durable-acceptance receipt. */
+declare function assertEconomyAcceptedCommandReceipt(receipt: EconomyAcceptedCommandReceiptV1): void;
+/** Validates the exclusive completed, failed, and no-op result shapes. */
+declare function assertEconomyCommandResultReceipt(receipt: EconomyCommandResultReceiptV1): void;
+/** Validates the raw-key-free idempotency namespace used by V3. */
+declare function assertEconomyAuditedIdempotencyScope(scope: EconomyAuditedIdempotencyScopeV1): void;
+/** Validates an exact accepted or terminal V3 replay result. */
+declare function assertEconomyAuditedIdempotencyResult(result: EconomyAuditedIdempotencyResultV1): void;
+/**
+ * Produces deterministic UTF-8 JSON for an audited-command hash adapter.
+ * The legacy transaction canonical payload remains a separate stable format.
+ */
+declare function canonicalAuditedEconomyCommandEnvelopePayload(envelope: AuditedEconomyCommandEnvelopeV1): string;
+/** Produces deterministic UTF-8 JSON for privacy-minimized provider evidence. */
+declare function canonicalEconomyProviderEvidenceHashPayload(evidence: EconomyProviderEvidenceHashV1): string;
+/** Produces deterministic UTF-8 JSON for an encrypted-handle binding. */
+declare function canonicalEconomyEncryptedOperationalHandleBindingPayload(binding: EconomyEncryptedOperationalHandleBindingV1): string;
+/** Produces deterministic UTF-8 JSON for a sanitized evidence manifest. */
+declare function canonicalEconomyProviderEvidenceManifestPayload(manifest: EconomyProviderEvidenceManifestV1): string;
+/** Produces deterministic UTF-8 JSON for a privacy-safe accepted receipt. */
+declare function canonicalEconomyAcceptedCommandReceiptPayload(receipt: EconomyAcceptedCommandReceiptV1): string;
+/** Produces deterministic UTF-8 JSON for a terminal command receipt. */
+declare function canonicalEconomyCommandResultReceiptPayload(receipt: EconomyCommandResultReceiptV1): string;
+/**
+ * Rejects a replay candidate unless every canonical accepted-command byte
+ * matches. Processing mode is intentionally external to the envelope, so the
+ * original command source remains unchanged on replay.
+ */
+declare function assertExactAuditedEconomyCommandReplay(existing: AuditedEconomyCommandEnvelopeV1, candidate: AuditedEconomyCommandEnvelopeV1): void;
+
+/** Complete bounded record graph for one accepted authoritative command. */
+interface EconomyAuditGraphV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly commandEnvelope: AuditedEconomyCommandEnvelopeV1;
+    readonly commandEnvelopeHash: string;
+    readonly providerEvidenceManifest?: EconomyProviderEvidenceManifestV1;
+    readonly providerEvidence: readonly EconomyProviderEvidenceHashV1[];
+    readonly operationalHandleBindings: readonly EconomyEncryptedOperationalHandleBindingV1[];
+    readonly acceptedReceipt: EconomyAcceptedCommandReceiptV1;
+    readonly resultReceipt?: EconomyCommandResultReceiptV1;
+    readonly transaction?: EconomicJournalTransactionV1 & {
+        readonly canonicalHash: string;
+    };
+    readonly startAuthorityHead: EconomyAuthorityHeadV1;
+    readonly commits: readonly HashedEconomyAuthorityCommitManifestV1[];
+    readonly expectedAuthorityHead: EconomyAuthorityHeadV1;
+}
+/**
+ * Validates every actor/subject, evidence, receipt, transaction, record, and
+ * authority-chain edge for one bounded command graph.
+ *
+ * The callback must hash exact canonical UTF-8 bytes using approved SHA-256.
+ * Raw provider data and idempotency keys are neither accepted nor reconstructed.
+ */
+declare function assertEconomyAuditGraph(graph: EconomyAuditGraphV1, hash: CanonicalPayloadHashFunctionV1): void;
+
+declare const PRE_UTILITY_BACKER_COHORT: "pre_utility_backer_v1";
+interface EarlyBackerWindowV1 {
+    readonly publicTokensLaunchAt: IsoTimestamp;
+    readonly firstPublicSpendLiveAt?: IsoTimestamp;
+}
+/** Paid-lot facts required to recalculate retained early-backer basis. */
+interface PaidLotRetentionV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly lotId: LotId;
+    readonly payerAccountId: AccountId;
+    readonly receivingHouseholdId: HouseholdId;
+    readonly purchaseId: string;
+    readonly catalogVersion: string;
+    readonly purchasedAt: IsoTimestamp;
+    readonly settledAt: IsoTimestamp;
+    readonly creditedAt: IsoTimestamp;
+    readonly retainedAmount: TokenSubunitString;
+}
+interface EarlyBackerEvaluationV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly cohortKey: typeof PRE_UTILITY_BACKER_COHORT;
+    readonly status: "not-qualified" | "provisional";
+    readonly payerAccountId: AccountId;
+    readonly receivingHouseholdId: HouseholdId;
+    readonly netRetainedAmount: TokenSubunitString;
+    readonly contributingLotIds: readonly LotId[];
+    readonly evaluatedAt: IsoTimestamp;
+}
+declare const EARLY_BACKER_SETTLEMENT_POLICY_V2: "settlement-window-v2";
+/**
+ * Additive evaluation result using settlement as the sole qualification event.
+ * Purchase and credit times remain provenance/order facts.
+ */
+interface EarlyBackerEvaluationV2 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly policyVersion: typeof EARLY_BACKER_SETTLEMENT_POLICY_V2;
+    readonly qualificationEvent: "settled-at";
+    readonly cohortKey: typeof PRE_UTILITY_BACKER_COHORT;
+    readonly status: "not-qualified" | "provisional";
+    readonly payerAccountId: AccountId;
+    readonly receivingHouseholdId: HouseholdId;
+    readonly netRetainedAmount: TokenSubunitString;
+    readonly contributingLotIds: readonly LotId[];
+    readonly evaluatedAt: IsoTimestamp;
+}
+/**
+ * Recalculates provisional cohort basis from retained paid lots. It promises no
+ * future reward and deliberately has no permanent entitled state.
+ */
+declare function evaluateEarlyBacker(payerAccountId: AccountId, receivingHouseholdId: HouseholdId, paidLots: readonly PaidLotRetentionV1[], window: EarlyBackerWindowV1, evaluatedAt: IsoTimestamp): EarlyBackerEvaluationV1;
+/**
+ * Evaluates the approved settlement-window policy. The caller owns environment
+ * and rollout classification: `publicTokensLaunchAt` and
+ * `firstPublicSpendLiveAt` must be derived from the entire public cohort, so
+ * staff, test, and closed-beta availability cannot open or close this window.
+ * The caller must also exclude non-production/test lots before evaluation.
+ */
+declare function evaluateEarlyBackerBySettlementV2(payerAccountId: AccountId, receivingHouseholdId: HouseholdId, paidLots: readonly PaidLotRetentionV1[], window: EarlyBackerWindowV1, evaluatedAt: IsoTimestamp): EarlyBackerEvaluationV2;
+
+/** Stable machine-readable failures exposed by the economy domain. */
+type EconomyErrorCode = "INVALID_AMOUNT" | "AMOUNT_OUT_OF_RANGE" | "AMOUNT_NOT_WHOLE_TOKEN" | "INVALID_CONTRACT" | "UNBALANCED_TRANSACTION" | "DUPLICATE_IDENTIFIER" | "DUPLICATE_TRANSACTION" | "INSUFFICIENT_BALANCE" | "INSUFFICIENT_ELIGIBLE_LOTS" | "SOURCE_LOT_RESTRICTED" | "REVERSAL_ALREADY_EXISTS" | "NEGATIVE_PROJECTION" | "INVALID_TIME_WINDOW";
+interface EconomyErrorEnvelopeV1 {
+    readonly schemaVersion: "1";
+    readonly error: {
+        readonly code: EconomyErrorCode;
+        readonly message: string;
+        readonly requestId?: string;
+    };
+}
+/**
+ * Domain error with a stable code and deliberately non-sensitive message.
+ * Provider evidence, identities, and payment details must not be included.
+ */
+declare class EconomyError extends Error {
+    readonly code: EconomyErrorCode;
+    constructor(code: EconomyErrorCode, message: string);
+}
+/** Throws a stable economy error when a domain assertion fails. */
+declare function economyAssert(condition: unknown, code: EconomyErrorCode, message: string): asserts condition;
+/** Creates a bounded, non-sensitive error contract for an HTTP adapter. */
+declare function toEconomyErrorEnvelope(error: EconomyError, requestId?: string): EconomyErrorEnvelopeV1;
+
+declare const MODULE_ALLOWANCE_PURPOSE: "junior-coder-module-entitlement";
+type ModuleAllowanceStatusV1 = "active" | "closed";
+/** Guardian-funded value that can only purchase modules for one child. */
+interface ModuleAllowanceV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly purpose: typeof MODULE_ALLOWANCE_PURPOSE;
+    readonly allowanceId: ModuleAllowanceId;
+    readonly householdId: HouseholdId;
+    readonly hostWalletId: WalletId;
+    readonly allowanceWalletId: WalletId;
+    readonly childAccountId: AccountId;
+    readonly status: ModuleAllowanceStatusV1;
+    readonly allocatedAmount: TokenSubunitString;
+    readonly availableAmount: TokenSubunitString;
+    readonly heldAmount: TokenSubunitString;
+    readonly spentAmount: TokenSubunitString;
+    readonly reclaimedAmount: TokenSubunitString;
+    readonly fundingSlices: readonly SourceLotSliceV1[];
+    readonly reclaimedSlices: readonly SourceLotSliceV1[];
+    readonly version: number;
+    readonly createdAt: IsoTimestamp;
+    readonly updatedAt: IsoTimestamp;
+}
+interface CreateModuleAllowanceInputV1 {
+    readonly allowanceId: ModuleAllowanceId;
+    readonly householdId: HouseholdId;
+    readonly hostWalletId: WalletId;
+    readonly allowanceWalletId: WalletId;
+    readonly childAccountId: AccountId;
+    readonly amount: TokenSubunitString;
+    readonly fundingSlices: readonly SourceLotSliceV1[];
+    readonly occurredAt: IsoTimestamp;
+}
+interface FundModuleAllowanceInputV1 {
+    readonly amount: TokenSubunitString;
+    readonly fundingSlices: readonly SourceLotSliceV1[];
+    readonly expectedVersion: number;
+    readonly occurredAt: IsoTimestamp;
+}
+interface ReclaimModuleAllowanceInputV1 {
+    readonly amount: TokenSubunitString;
+    readonly sourceSlices: readonly SourceLotSliceV1[];
+    readonly expectedVersion: number;
+    readonly occurredAt: IsoTimestamp;
+}
+interface CloseModuleAllowanceInputV1 {
+    readonly expectedVersion: number;
+    readonly occurredAt: IsoTimestamp;
+}
+/** Immutable Guardian-approved module price and requirements evidence. */
+interface ModuleSpendQuoteV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly quoteId: ModuleSpendQuoteId;
+    readonly allowanceId: ModuleAllowanceId;
+    readonly householdId: HouseholdId;
+    readonly guardianAccountId: AccountId;
+    readonly childAccountId: AccountId;
+    readonly moduleVersionId: LearningModuleVersionId;
+    readonly catalogVersion: string;
+    readonly amount: TokenSubunitString;
+    readonly requirementsManifestVersion: string;
+    readonly requirementsManifestHash: string;
+    readonly requirementsAcknowledgedAt: IsoTimestamp;
+    readonly issuedAt: IsoTimestamp;
+    readonly expiresAt: IsoTimestamp;
+}
+type CreateModuleSpendQuoteInputV1 = Omit<ModuleSpendQuoteV1, "schemaVersion">;
+type ModuleSpendHoldStatusV1 = "held" | "settled" | "released";
+/** Versioned projection for one quote-bound allowance hold. */
+interface ModuleSpendHoldV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly holdId: ModuleSpendHoldId;
+    readonly quoteId: ModuleSpendQuoteId;
+    readonly allowanceId: ModuleAllowanceId;
+    readonly householdId: HouseholdId;
+    readonly guardianAccountId: AccountId;
+    readonly childAccountId: AccountId;
+    readonly moduleVersionId: LearningModuleVersionId;
+    readonly amount: TokenSubunitString;
+    readonly requirementsManifestVersion: string;
+    readonly requirementsManifestHash: string;
+    readonly sourceSlices: readonly SourceLotSliceV1[];
+    readonly status: ModuleSpendHoldStatusV1;
+    readonly holdIdempotencyKey: string;
+    readonly settlementIdempotencyKey?: string;
+    readonly releaseIdempotencyKey?: string;
+    readonly entitlementId?: LearningEntitlementId;
+    readonly settlementTransactionId?: TransactionId;
+    readonly releaseTransactionId?: TransactionId;
+    readonly version: number;
+    readonly createdAt: IsoTimestamp;
+    readonly expiresAt: IsoTimestamp;
+    readonly updatedAt: IsoTimestamp;
+}
+interface CreateModuleSpendHoldInputV1 {
+    readonly holdId: ModuleSpendHoldId;
+    readonly idempotencyKey: string;
+    readonly sourceSlices: readonly SourceLotSliceV1[];
+    readonly expectedAllowanceVersion: number;
+    readonly occurredAt: IsoTimestamp;
+}
+interface SettleModuleSpendHoldInputV1 {
+    readonly entitlementId: LearningEntitlementId;
+    readonly settlementTransactionId: TransactionId;
+    readonly idempotencyKey: string;
+    readonly expectedAllowanceVersion: number;
+    readonly expectedHoldVersion: number;
+    readonly occurredAt: IsoTimestamp;
 }
-/** Exact actor/subject/operation namespace for a caller-owned idempotency key. */
-interface EconomyIdempotencyScopeV1 {
-    readonly schemaVersion: EconomyContractVersion;
+interface ReleaseModuleSpendHoldInputV1 {
+    readonly releaseTransactionId: TransactionId;
     readonly idempotencyKey: string;
-    readonly commandType: EconomyCommandType;
-    readonly actorAccountId: AccountId;
-    readonly subjectAccountId: AccountId;
+    readonly expectedAllowanceVersion: number;
+    readonly expectedHoldVersion: number;
+    readonly occurredAt: IsoTimestamp;
 }
-/** V2 replay evidence bound to one accepted command and exact scope. */
-interface ScopedPersistedIdempotencyResultV1 extends PersistedIdempotencyResultV1 {
+interface ModuleSpendTransitionResultV1 {
+    readonly allowance: ModuleAllowanceV1;
+    readonly hold: ModuleSpendHoldV1;
+}
+/** Durable economic receipt for an activated learning entitlement. */
+interface ModulePurchaseReceiptV1 {
     readonly schemaVersion: EconomyContractVersion;
-    readonly commandId: string;
+    readonly receiptId: string;
+    readonly quoteId: ModuleSpendQuoteId;
+    readonly holdId: ModuleSpendHoldId;
+    readonly allowanceId: ModuleAllowanceId;
+    readonly householdId: HouseholdId;
+    readonly guardianAccountId: AccountId;
+    readonly childAccountId: AccountId;
+    readonly moduleVersionId: LearningModuleVersionId;
+    readonly entitlementId: LearningEntitlementId;
+    readonly amount: TokenSubunitString;
+    readonly requirementsManifestVersion: string;
+    readonly requirementsManifestHash: string;
+    readonly settlementTransactionId: TransactionId;
+    readonly issuedAt: IsoTimestamp;
+}
+interface CreateModulePurchaseReceiptInputV1 {
+    readonly receiptId: string;
+    readonly issuedAt: IsoTimestamp;
+}
+type ModulePurchaseFinancialStateV1 = "missing" | "held" | "settled" | "released";
+type ModulePurchaseEntitlementStateV1 = "missing" | "pending" | "active" | "cancelled";
+/** Privacy-minimized observation used by an authoritative reconciler. */
+interface ModulePurchaseReconciliationObservationV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly quoteId: ModuleSpendQuoteId;
+    readonly holdId: ModuleSpendHoldId;
+    readonly childAccountId: AccountId;
+    readonly moduleVersionId: LearningModuleVersionId;
+    readonly financialState: ModulePurchaseFinancialStateV1;
+    readonly entitlementState: ModulePurchaseEntitlementStateV1;
+    readonly receiptPresent: boolean;
+    readonly observedAt: IsoTimestamp;
+}
+type ModulePurchaseReconciliationActionV1 = "none" | "resume-settlement" | "release-hold" | "activate-entitlement" | "issue-receipt" | "cancel-pending-entitlement" | "manual-review";
+interface ModulePurchaseReconciliationResultV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly action: ModulePurchaseReconciliationActionV1;
+    readonly blocking: boolean;
+    readonly consistent: boolean;
+    readonly reasonCode: string;
+}
+/** Validates exact arithmetic and source-lot provenance for an allowance. */
+declare function assertModuleAllowance(allowance: ModuleAllowanceV1): void;
+/** Creates a child-specific Module Allowance from locked source-lot slices. */
+declare function createModuleAllowance(input: CreateModuleAllowanceInputV1): ModuleAllowanceV1;
+/** Adds Guardian-selected source-lot value without replacing prior history. */
+declare function fundModuleAllowance(allowance: ModuleAllowanceV1, input: FundModuleAllowanceInputV1): ModuleAllowanceV1;
+/** Returns unused value to its source lots without changing spent history. */
+declare function reclaimModuleAllowance(allowance: ModuleAllowanceV1, input: ReclaimModuleAllowanceInputV1): ModuleAllowanceV1;
+/** Closes an empty allowance; funding later requires a new allowance. */
+declare function closeModuleAllowance(allowance: ModuleAllowanceV1, input: CloseModuleAllowanceInputV1): ModuleAllowanceV1;
+/** Validates immutable price, Guardian acknowledgement, and manifest evidence. */
+declare function assertModuleSpendQuote(quote: ModuleSpendQuoteV1): void;
+/** Creates immutable quote evidence from server-derived catalog facts. */
+declare function createModuleSpendQuote(input: CreateModuleSpendQuoteInputV1): ModuleSpendQuoteV1;
+/** Validates one quote-bound hold lifecycle projection. */
+declare function assertModuleSpendHold(hold: ModuleSpendHoldV1): void;
+/** Moves quoted value from available to held after all bindings are checked. */
+declare function createModuleSpendHold(allowance: ModuleAllowanceV1, quote: ModuleSpendQuoteV1, input: CreateModuleSpendHoldInputV1): ModuleSpendTransitionResultV1;
+/** Settles a hold only when the pending learning entitlement is identified. */
+declare function settleModuleSpendHold(allowance: ModuleAllowanceV1, hold: ModuleSpendHoldV1, input: SettleModuleSpendHoldInputV1): ModuleSpendTransitionResultV1;
+/** Releases failed or expired held value back to the same allowance. */
+declare function releaseModuleSpendHold(allowance: ModuleAllowanceV1, hold: ModuleSpendHoldV1, input: ReleaseModuleSpendHoldInputV1): ModuleSpendTransitionResultV1;
+/** Validates a durable receipt against settled economic evidence. */
+declare function assertModulePurchaseReceipt(receipt: ModulePurchaseReceiptV1): void;
+/** Creates a receipt only when quote and settled hold evidence match exactly. */
+declare function createModulePurchaseReceipt(quote: ModuleSpendQuoteV1, hold: ModuleSpendHoldV1, input: CreateModulePurchaseReceiptInputV1): ModulePurchaseReceiptV1;
+/** Validates privacy-minimized cross-service reconciliation evidence. */
+declare function assertModulePurchaseReconciliationObservation(observation: ModulePurchaseReconciliationObservationV1): void;
+/**
+ * Returns one forward-safe action. Callers must reload and lock authoritative
+ * state before carrying it out; `manual-review` never authorizes a mutation.
+ */
+declare function reconcileModulePurchase(observation: ModulePurchaseReconciliationObservationV1): ModulePurchaseReconciliationResultV1;
+
+type AdjustmentStatus = "draft" | "pending-approval" | "approved" | "rejected" | "executed" | "expired";
+/** Dual-control request; the resulting change is always a ledger transaction. */
+interface AdjustmentRequestV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly adjustmentId: string;
+    readonly walletId: WalletId;
+    readonly amount: TokenSubunitString;
+    readonly reason: string;
+    readonly ticketReference: string;
+    readonly status: AdjustmentStatus;
+    readonly initiatedByAccountId: AccountId;
+    readonly initiatedAt: IsoTimestamp;
+    readonly approvedByAccountId?: AccountId;
+    readonly approvedAt?: IsoTimestamp;
+    readonly resultingTransactionId?: TransactionId;
 }
-/** Validates replay evidence before it is returned across a command boundary. */
-declare function assertScopedPersistedIdempotencyResult(result: ScopedPersistedIdempotencyResultV1): void;
-/** Validates the namespace that prevents cross-principal replay collisions. */
-declare function assertEconomyIdempotencyScope(scope: EconomyIdempotencyScopeV1): void;
-/** Validates minimized accepted-command evidence before durable append. */
-declare function assertEconomyCommandEnvelope(envelope: EconomyCommandEnvelopeV1): void;
-/** Validates one immutable command-workflow state event. */
-declare function assertEconomyCommandWorkflowEvent(event: EconomyCommandWorkflowEventV1): void;
-/** Operations available only inside one serializable database transaction. */
-interface EconomyUnitOfWork {
-    getWalletForUpdate(walletId: WalletId): Promise<WalletV1 | null>;
-    listSpendableLotsForUpdate(walletId: WalletId): Promise<readonly SourceLotV1[]>;
-    findLotForUpdate(lotId: LotId): Promise<SourceLotV1 | null>;
-    findIdempotencyResult(idempotencyKey: string): Promise<PersistedIdempotencyResultV1 | null>;
-    appendTransaction(transaction: LedgerTransactionV1): Promise<void>;
-    appendSourceLot(lot: SourceLotV1): Promise<void>;
-    updateSourceLotProjection(lotId: LotId, remainingAmount: TokenSubunitString, heldAmount: TokenSubunitString, reversedAmount: TokenSubunitString): Promise<void>;
-    saveBalanceProjection(projection: BalanceProjection, transactionId: TransactionId): Promise<void>;
-    saveIdempotencyResult(idempotencyKey: string, result: PersistedIdempotencyResultV1): Promise<void>;
-    appendOutboxEvent(event: EconomyOutboxEventV1): Promise<void>;
+/** Proves that production adjustment approval was performed by another actor. */
+declare function assertDistinctAdjustmentApproval(request: AdjustmentRequestV1): void;
+
+type PaidLotLifecycleStatusV1 = "clear" | "partially-reversed" | "disputed" | "fully-reversed" | "chargeback-lost";
+type PaidLotLifecycleEventTypeV1 = "refund" | "dispute-hold" | "dispute-won" | "dispute-lost" | "chargeback" | "reversal";
+/** Paid-purchase facts not already carried by the source lot. */
+interface PaidLotPurchaseProvenanceV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly purchaseId: string;
+    readonly catalogVersion: string;
+    readonly purchasedAt: IsoTimestamp;
 }
-/** Adapter boundary for serializable, ACID economy mutations. */
-interface EconomyPersistencePort {
-    runSerializable<T>(operation: (unitOfWork: EconomyUnitOfWork) => Promise<T>): Promise<T>;
-    getWallet(walletId: WalletId): Promise<WalletV1 | null>;
-    getBalanceProjection(walletId: WalletId): Promise<BalanceProjectionSnapshotV1 | null>;
-    getTransaction(transactionId: TransactionId): Promise<LedgerTransactionV1 | null>;
-    rebuildProjection(): Promise<BalanceProjection>;
+/** Provider-neutral refund/dispute evidence for a paid source lot. */
+interface PaidLotLifecycleEventV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly eventId: string;
+    readonly lotId: LotId;
+    readonly eventType: PaidLotLifecycleEventTypeV1;
+    readonly amount: TokenSubunitString;
+    readonly occurredAt: IsoTimestamp;
 }
-/**
- * V2 mutation surface. Unlike `EconomyUnitOfWork`, it has no absolute balance
- * overwrite: journal, source-lot movement, allocation state, balance/lifetime
- * deltas, idempotency, chain head, and outbox are committed atomically.
- */
-interface EconomyUnitOfWorkV2 {
-    getWalletForOwnerForUpdate(walletId: WalletId, owner: WalletOwnerReferenceV1): Promise<WalletV1 | null>;
-    listSpendableLotsForUpdate(walletId: WalletId): Promise<readonly VersionedSourceLotV1[]>;
-    findLotForUpdate(lotId: LotId): Promise<VersionedSourceLotV1 | null>;
-    getGameplayAllocationForUpdate(allocationId: AllocationId, householdId: HouseholdId, childAccountId: AccountId): Promise<GameplayAllocationV1 | null>;
-    findIdempotencyResult(scope: EconomyIdempotencyScopeV1): Promise<ScopedPersistedIdempotencyResultV1 | null>;
-    /** Locks and rejects any stale/non-active regional writer lease. */
-    lockActiveWriterFence(acceptedRegion: string, writerFencingToken: string): Promise<void>;
-    lockJournalChainHead(chainId: string): Promise<JournalChainHeadV1>;
-    appendCommandEnvelope(envelope: EconomyCommandEnvelopeV1): Promise<void>;
-    appendCommandWorkflowEvent(event: EconomyCommandWorkflowEventV1): Promise<void>;
-    appendTransaction(transaction: ChainedEconomicJournalTransactionV1): Promise<void>;
-    /** Appends `createInitialSourceLotSnapshot()` output; later changes are movements. */
-    appendSourceLot(snapshot: VersionedSourceLotV1): Promise<void>;
-    /** Appends movement evidence and applies its lot CAS as one operation. */
-    applySourceLotMovement(movement: SourceLotMovementV1): Promise<void>;
-    appendGameplayAllocation(allocation: GameplayAllocationV1): Promise<void>;
-    /**
-     * Compares `expectedVersion`, requires `allocation.version` to be exactly the
-     * next value, and never overwrites a stale row.
-     */
-    saveGameplayAllocation(allocation: GameplayAllocationV1, expectedVersion: number): Promise<void>;
-    /**
-     * Atomically adds deltas, verifies them against the appended postings and
-     * account bindings, and records transaction-scoped application keys.
-     */
-    applyWalletBalanceDeltas(transactionId: TransactionId, deltas: readonly WalletBalanceDeltaV1[]): Promise<void>;
-    /**
-     * Atomically increments monotonic lifetime counters after verifying the
-     * deltas against the appended transaction's deterministic classification.
-     */
-    applyWalletLifetimeDeltas(transactionId: TransactionId, deltas: readonly WalletLifetimeDeltaV1[]): Promise<void>;
-    saveIdempotencyResult(scope: EconomyIdempotencyScopeV1, result: ScopedPersistedIdempotencyResultV1): Promise<void>;
-    appendOutboxEvent(event: EconomyOutboxEventV1): Promise<void>;
-    /** Compare-and-swaps the full locked head, including its canonical hash. */
-    advanceJournalChainHead(expected: JournalChainHeadV1, next: JournalChainHeadV1): Promise<void>;
+interface PaidLotLifecycleReceiptV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly event: PaidLotLifecycleEventV1;
 }
 /**
- * Additive authoritative persistence boundary for new consumers. V1 remains
- * exported for compatibility but must not be adapted by delegating its
- * absolute `saveBalanceProjection` operation to this interface.
+ * Retained paid-lot projection. Immutable purchase/original facts plus every
+ * receipt are sufficient to rebuild all derived amounts in occurrence order.
  */
-interface EconomyPersistencePortV2 {
-    runSerializable<T>(operation: (unitOfWork: EconomyUnitOfWorkV2) => Promise<T>): Promise<T>;
-    getWallet(walletId: WalletId): Promise<WalletV1 | null>;
-    listWalletsByOwner(owner: WalletOwnerReferenceV1): Promise<readonly WalletV1[]>;
-    getGameplayAllocation(allocationId: AllocationId, householdId: HouseholdId, childAccountId: AccountId): Promise<GameplayAllocationV1 | null>;
-    getCommandEnvelope(commandId: string): Promise<EconomyCommandEnvelopeV1 | null>;
-    getTransaction(transactionId: TransactionId): Promise<ChainedEconomicJournalTransactionV1 | null>;
-    rebuildWalletBalanceProjections(): Promise<readonly WalletBalanceProjectionV1[]>;
+interface PaidLotLifecycleV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly lotId: LotId;
+    readonly payerAccountId: AccountId;
+    readonly receivingHouseholdId: HouseholdId;
+    readonly purchaseId: string;
+    readonly catalogVersion: string;
+    readonly purchasedAt: IsoTimestamp;
+    readonly settledAt: IsoTimestamp;
+    readonly creditedAt: IsoTimestamp;
+    readonly originalAmount: TokenSubunitString;
+    readonly retainedAmount: TokenSubunitString;
+    readonly heldAmount: TokenSubunitString;
+    readonly reversedAmount: TokenSubunitString;
+    readonly refundedAmount: TokenSubunitString;
+    readonly chargebackAmount: TokenSubunitString;
+    readonly oneTimeReversalAmount: TokenSubunitString;
+    readonly status: PaidLotLifecycleStatusV1;
+    readonly version: number;
+    readonly receipts: readonly PaidLotLifecycleReceiptV1[];
+    readonly effectiveEventIds: readonly string[];
 }
-interface EconomyClockPort {
-    now(): IsoTimestamp;
+/** Exact signed projection deltas produced when one receipt is appended. */
+interface PaidLotLifecycleArithmeticV1 {
+    readonly retainedDelta: TokenSubunitString;
+    readonly heldDelta: TokenSubunitString;
+    readonly reversedDelta: TokenSubunitString;
+    readonly refundedDelta: TokenSubunitString;
+    readonly chargebackDelta: TokenSubunitString;
+    readonly oneTimeReversalDelta: TokenSubunitString;
 }
-interface EconomyIdPort {
-    nextId(namespace: string): string;
+interface PaidLotLifecycleMutationResultV1 {
+    readonly lifecycle: PaidLotLifecycleV1;
+    /** False only for an exact event-ID replay already recorded. */
+    readonly applied: boolean;
+    readonly stateChanged: boolean;
+    readonly arithmetic: PaidLotLifecycleArithmeticV1;
 }
+/** Validates the paid purchase facts paired with a source lot. */
+declare function assertPaidLotPurchaseProvenance(provenance: PaidLotPurchaseProvenanceV1): void;
+/** Validates one provider-neutral paid-lot lifecycle event. */
+declare function assertPaidLotLifecycleEvent(event: PaidLotLifecycleEventV1): void;
+/** Validates and deterministically rebuilds retained paid-lot arithmetic. */
+declare function assertPaidLotLifecycle(lifecycle: PaidLotLifecycleV1): void;
+/** Creates the retained projection for one newly credited paid source lot. */
+declare function createPaidLotLifecycle(lot: SourceLotV1, provenance: PaidLotPurchaseProvenanceV1): PaidLotLifecycleV1;
+/**
+ * Appends one event then rebuilds every receipt in authoritative occurrence
+ * order. Exact retries succeed before stale-version validation.
+ */
+declare function applyPaidLotLifecycleEvent(lifecycle: PaidLotLifecycleV1, event: PaidLotLifecycleEventV1, expectedVersion: number): PaidLotLifecycleMutationResultV1;
+/** Reduces unordered/retried lifecycle evidence in canonical event order. */
+declare function reducePaidLotLifecycleEvents(initial: PaidLotLifecycleV1, events: readonly PaidLotLifecycleEventV1[]): PaidLotLifecycleV1;
+/** Creates the exact retained-basis input used by early-backer evaluators. */
+declare function createEarlyBackerRetentionFromPaidLot(lifecycle: PaidLotLifecycleV1): PaidLotRetentionV1;
 
 type WalletPortfolioComponentRole = "household-treasury" | "personal" | "gameplay-allocation" | "hold";
 /** One server-authorized component of a portfolio read. */
@@ -1183,6 +1866,278 @@ declare const BASELINE_MONTHLY_SUBSCRIPTION_PLAN: TokenSubscriptionPlanV1;
 /** Validates future provider-neutral recurrence without enabling it. */
 declare function assertTokenSubscriptionPlan(plan: TokenSubscriptionPlanV1): void;
 
+declare const ECONOMY_RECOVERY_PROTOCOL_VERSION: "1";
+type EconomyRecoveryProtocolVersion = typeof ECONOMY_RECOVERY_PROTOCOL_VERSION;
+type EconomyRecoveryRecordKindV1 = "acceptance" | "committed-result";
+type EconomyRecoveryDirectionV1 = "credit" | "debit";
+type EconomyEvidenceSignatureAlgorithmV1 = "ed25519" | "ecdsa-p256-sha256" | "rsa-pss-sha256";
+/** Public, non-secret metadata selected before detached signing. */
+interface EconomyEvidenceSignatureMetadataV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly signatureVersion: "1";
+    readonly algorithm: EconomyEvidenceSignatureAlgorithmV1;
+    readonly keyId: string;
+    readonly signedAt: IsoTimestamp;
+}
+/** Public metadata plus the final detached signature value. */
+interface EconomyEvidenceSignatureV1 extends EconomyEvidenceSignatureMetadataV1 {
+    readonly value: string;
+}
+/** Deterministic signing request safe to pass to an external key adapter. */
+interface EconomyPreparedEvidenceSignatureV1 {
+    readonly contentAddressedId: string;
+    readonly canonicalPayload: string;
+}
+/**
+ * Encrypted reconstruction bytes stored outside the live authority.
+ *
+ * The plaintext must contain only the already-approved, privacy-minimized
+ * authority records. Raw provider callbacks, signatures, payment data,
+ * idempotency keys, email addresses, and exact birth data are forbidden.
+ */
+interface EconomySealedRecoveryPayloadV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly payloadVersion: "1";
+    readonly cipherSuite: "AES-256-GCM";
+    readonly encoding: "base64url";
+    readonly keyVersion: string;
+    readonly nonce: string;
+    readonly ciphertext: string;
+    readonly authenticationTag: string;
+    readonly plaintextContentHash: string;
+    readonly encryptionContextHash: string;
+}
+/** Content-addressed body written identically to every evidence region. */
+interface EconomyRecoveryAcceptanceBodyV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly recoveryVersion: EconomyRecoveryProtocolVersion;
+    readonly recordType: "economy-recovery-acceptance";
+    readonly authorityId: string;
+    readonly commandId: string;
+    readonly correlationId: string;
+    readonly idempotencyFingerprint: EconomyHmacFingerprintV1;
+    readonly commandEnvelopeHash: string;
+    readonly acceptedReceiptId: string;
+    readonly acceptedReceiptHash: string;
+    readonly sealedPayload: EconomySealedRecoveryPayloadV1;
+    readonly preparedAt: IsoTimestamp;
+    readonly acceptedAt: IsoTimestamp;
+}
+/**
+ * Provider-neutral durable acceptance. The ID is SHA-256-addressed from the
+ * canonical body and therefore remains identical in all evidence regions.
+ */
+interface EconomyRecoveryAcceptanceEnvelopeV1 extends EconomyRecoveryAcceptanceBodyV1 {
+    readonly acceptanceEnvelopeId: string;
+}
+/** Content-addressed result body written after the authority commit. */
+interface EconomyRecoveryCommittedResultBodyV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly recoveryVersion: EconomyRecoveryProtocolVersion;
+    readonly recordType: "economy-recovery-committed-result";
+    readonly authorityId: string;
+    readonly commandId: string;
+    readonly correlationId: string;
+    readonly acceptanceEnvelopeId: string;
+    readonly acceptanceEnvelopeHash: string;
+    readonly resultReceiptId: string;
+    readonly resultReceiptHash: string;
+    readonly outcome: EconomyCommandResultOutcomeV1;
+    readonly authorityCommitId: string;
+    readonly authorityCommitHash: string;
+    readonly authoritySequence: string;
+    readonly authorityHeadHashAfter: string;
+    readonly transactionId?: TransactionId;
+    readonly transactionCanonicalHash?: string;
+    readonly sealedPayload: EconomySealedRecoveryPayloadV1;
+    readonly committedAt: IsoTimestamp;
+}
+/**
+ * Immutable reconstruction result for one command. Failed and no-op commands
+ * are retained as facts but cannot carry transaction identity or value.
+ */
+interface EconomyRecoveryCommittedResultV1 extends EconomyRecoveryCommittedResultBodyV1 {
+    readonly committedResultId: string;
+}
+/** Region-specific body proving one recovery record was durably retained. */
+interface EconomyRegionalEvidenceReceiptBodyV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly recoveryVersion: EconomyRecoveryProtocolVersion;
+    readonly recordType: "economy-regional-evidence-receipt";
+    readonly journalId: string;
+    readonly region: string;
+    readonly sequence: string;
+    readonly previousReceiptHash?: string;
+    readonly authorityId: string;
+    readonly commandId: string;
+    readonly recoveryRecordKind: EconomyRecoveryRecordKindV1;
+    readonly recoveryRecordId: string;
+    readonly recoveryRecordContentHash: string;
+    readonly storedAt: IsoTimestamp;
+    readonly retentionUntil: IsoTimestamp;
+}
+/**
+ * Signed, content-addressed evidence-region acknowledgement.
+ *
+ * Its ID addresses the unsigned storage fact. Its detached signature covers
+ * that ID, the exact canonical body, and the public signature metadata.
+ */
+interface EconomyRegionalEvidenceReceiptV1 extends EconomyRegionalEvidenceReceiptBodyV1 {
+    readonly evidenceReceiptId: string;
+    readonly signature: EconomyEvidenceSignatureV1;
+}
+/** One sibling in a duplicate-last, binary SHA-256 Merkle proof. */
+interface EconomyMerkleProofStepV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly side: "left" | "right";
+    readonly hash: string;
+}
+/** Portable proof that an authority commit is covered by an hourly anchor. */
+interface EconomyMerkleInclusionProofV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly proofVersion: "1";
+    readonly algorithm: "duplicate-last-sha256-v1";
+    readonly anchorId: string;
+    readonly anchorManifestHash: string;
+    readonly leafHash: string;
+    readonly leafIndex: string;
+    readonly leafCount: string;
+    readonly siblings: readonly EconomyMerkleProofStepV1[];
+}
+/** Privacy-safe link from a customer receipt to one regional evidence fact. */
+interface EconomyPortableEvidenceReferenceV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly region: string;
+    readonly evidenceReceiptId: string;
+    readonly evidenceReceiptHash: string;
+}
+/** Content-addressed customer-facing receipt body. */
+interface EconomyPortableCustomerReceiptBodyV1 {
+    readonly schemaVersion: EconomyContractVersion;
+    readonly recoveryVersion: EconomyRecoveryProtocolVersion;
+    readonly recordType: "economy-portable-customer-receipt";
+    readonly authorityId: string;
+    readonly commandId: string;
+    readonly activityType: ActivityType;
+    readonly direction: EconomyRecoveryDirectionV1;
+    readonly tokenAmount: TokenSubunitString;
+    readonly transactionId: TransactionId;
+    readonly transactionCanonicalHash: string;
+    readonly resultReceiptId: string;
+    readonly resultReceiptHash: string;
+    readonly committedResultId: string;
+    readonly committedResultContentHash: string;
+    readonly authorityCommitId: string;
+    readonly authorityCommitHash: string;
+    readonly authoritySequence: string;
+    readonly regionalEvidence: readonly EconomyPortableEvidenceReferenceV1[];
+    readonly merkleInclusionProof?: EconomyMerkleInclusionProofV1;
+    readonly tokenTermsVersion: string;
+    readonly cashRedemptionAllowed: false;
+    readonly committedAt: IsoTimestamp;
+    readonly issuedAt: IsoTimestamp;
+}
+/**
+ * Downloadable signed receipt containing no payer, household, provider,
+ * payment, email, session, or exact-age data.
+ */
+interface EconomyPortableCustomerReceiptV1 extends EconomyPortableCustomerReceiptBodyV1 {
+    readonly portableReceiptId: string;
+    readonly signature: EconomyEvidenceSignatureV1;
+}
+/** Infrastructure-supplied signature verifier; this package owns no keys. */
+interface EconomyEvidenceSignatureVerificationInputV1 {
+    readonly algorithm: EconomyEvidenceSignatureAlgorithmV1;
+    readonly keyId: string;
+    readonly signedAt: IsoTimestamp;
+    readonly signature: string;
+    readonly canonicalPayload: string;
+}
+type EconomyEvidenceSignatureVerifierV1 = (input: EconomyEvidenceSignatureVerificationInputV1) => boolean;
+/** Validates a bounded AES-GCM envelope without implementing cryptography. */
+declare function assertEconomySealedRecoveryPayload(payload: EconomySealedRecoveryPayloadV1): void;
+/** Canonical body bytes used to derive an acceptance-envelope ID. */
+declare function canonicalEconomyRecoveryAcceptanceBodyPayload(body: EconomyRecoveryAcceptanceBodyV1): string;
+/** Creates an acceptance record whose ID addresses its exact canonical body. */
+declare function createEconomyRecoveryAcceptanceEnvelope(body: EconomyRecoveryAcceptanceBodyV1, hashCanonicalPayload: CanonicalPayloadHashFunctionV1): EconomyRecoveryAcceptanceEnvelopeV1;
+/** Validates schema, privacy shape, and the acceptance content address. */
+declare function assertEconomyRecoveryAcceptanceEnvelope(envelope: EconomyRecoveryAcceptanceEnvelopeV1, hashCanonicalPayload: CanonicalPayloadHashFunctionV1): void;
+/** Canonical complete acceptance bytes written create-only in each region. */
+declare function canonicalEconomyRecoveryAcceptanceEnvelopePayload(envelope: EconomyRecoveryAcceptanceEnvelopeV1, hashCanonicalPayload: CanonicalPayloadHashFunctionV1): string;
+/** Canonical body bytes used to derive a committed-result ID. */
+declare function canonicalEconomyRecoveryCommittedResultBodyPayload(body: EconomyRecoveryCommittedResultBodyV1): string;
+/** Creates a result record whose ID addresses its exact canonical body. */
+declare function createEconomyRecoveryCommittedResult(body: EconomyRecoveryCommittedResultBodyV1, hashCanonicalPayload: CanonicalPayloadHashFunctionV1): EconomyRecoveryCommittedResultV1;
+/** Validates schema, privacy shape, and the committed-result content address. */
+declare function assertEconomyRecoveryCommittedResult(result: EconomyRecoveryCommittedResultV1, hashCanonicalPayload: CanonicalPayloadHashFunctionV1): void;
+/** Canonical complete result bytes written create-only in each region. */
+declare function canonicalEconomyRecoveryCommittedResultPayload(result: EconomyRecoveryCommittedResultV1, hashCanonicalPayload: CanonicalPayloadHashFunctionV1): string;
+/**
+ * Proves that a committed result is the terminal recovery record for the exact
+ * accepted command. It also recomputes the acceptance record hash.
+ */
+declare function assertEconomyRecoveryResultLink(acceptance: EconomyRecoveryAcceptanceEnvelopeV1, result: EconomyRecoveryCommittedResultV1, hashCanonicalPayload: CanonicalPayloadHashFunctionV1): void;
+/** Validates a detached evidence signature without owning signing keys. */
+declare function assertEconomyEvidenceSignatureMetadata(signature: EconomyEvidenceSignatureMetadataV1): void;
+/** Validates a detached evidence signature without owning signing keys. */
+declare function assertEconomyEvidenceSignature(signature: EconomyEvidenceSignatureV1): void;
+/** Canonical body bytes used to derive a regional evidence-receipt ID. */
+declare function canonicalEconomyRegionalEvidenceReceiptBodyPayload(body: EconomyRegionalEvidenceReceiptBodyV1): string;
+/** Creates a signed region receipt after the adapter has produced a signature. */
+declare function createEconomyRegionalEvidenceReceipt(body: EconomyRegionalEvidenceReceiptBodyV1, signature: EconomyEvidenceSignatureV1, hashCanonicalPayload: CanonicalPayloadHashFunctionV1): EconomyRegionalEvidenceReceiptV1;
+/** Validates a region receipt and its content-addressed unsigned body. */
+declare function assertEconomyRegionalEvidenceReceipt(receipt: EconomyRegionalEvidenceReceiptV1, hashCanonicalPayload: CanonicalPayloadHashFunctionV1): void;
+/**
+ * Prepares the regional content address and exact bytes for an external signer.
+ * No placeholder signature value is required or returned.
+ */
+declare function prepareEconomyRegionalEvidenceReceiptSignature(body: EconomyRegionalEvidenceReceiptBodyV1, signature: EconomyEvidenceSignatureMetadataV1, hashCanonicalPayload: CanonicalPayloadHashFunctionV1): EconomyPreparedEvidenceSignatureV1;
+/** Exact bytes covered by a regional receipt's detached signature. */
+declare function canonicalEconomyRegionalEvidenceReceiptSigningPayload(receipt: EconomyRegionalEvidenceReceiptV1, hashCanonicalPayload: CanonicalPayloadHashFunctionV1): string;
+/** Canonical complete region-receipt bytes, including its signature. */
+declare function canonicalEconomyRegionalEvidenceReceiptPayload(receipt: EconomyRegionalEvidenceReceiptV1, hashCanonicalPayload: CanonicalPayloadHashFunctionV1): string;
+/** Verifies one region receipt through an infrastructure-supplied key adapter. */
+declare function assertEconomyRegionalEvidenceReceiptSignature(receipt: EconomyRegionalEvidenceReceiptV1, hashCanonicalPayload: CanonicalPayloadHashFunctionV1, verifySignature: EconomyEvidenceSignatureVerifierV1): void;
+/**
+ * Verifies an ordered regional hash-chain segment. Segments beginning after
+ * sequence one must supply the trusted preceding receipt hash.
+ */
+declare function assertEconomyRegionalEvidenceChain(receipts: readonly EconomyRegionalEvidenceReceiptV1[], expectedPreviousReceiptHash: string | undefined, hashCanonicalPayload: CanonicalPayloadHashFunctionV1, verifySignature: EconomyEvidenceSignatureVerifierV1): void;
+/**
+ * Proves that at least two distinct regions retained byte-identical recovery
+ * content. Region-specific receipt metadata and signatures may differ.
+ */
+declare function assertEconomyRegionalEvidenceEquality(receipts: readonly EconomyRegionalEvidenceReceiptV1[], expectedRegions: readonly string[], hashCanonicalPayload: CanonicalPayloadHashFunctionV1): void;
+/** Validates the exact portable Merkle-proof shape. */
+declare function assertEconomyMerkleInclusionProof(proof: EconomyMerkleInclusionProofV1): void;
+/**
+ * Recomputes duplicate-last Merkle inclusion against a canonical hourly anchor.
+ * The hash adapter receives only domain-separated canonical node bytes.
+ */
+declare function assertEconomyMerkleInclusion(proof: EconomyMerkleInclusionProofV1, anchor: EconomyIntegrityAnchorManifestV1, hashCanonicalPayload: CanonicalPayloadHashFunctionV1): void;
+/** Canonical body bytes used to derive a portable receipt ID. */
+declare function canonicalEconomyPortableCustomerReceiptBodyPayload(body: EconomyPortableCustomerReceiptBodyV1): string;
+/** Creates a signed portable receipt from a canonical content-addressed body. */
+declare function createEconomyPortableCustomerReceipt(body: EconomyPortableCustomerReceiptBodyV1, signature: EconomyEvidenceSignatureV1, hashCanonicalPayload: CanonicalPayloadHashFunctionV1): EconomyPortableCustomerReceiptV1;
+/** Validates schema, privacy shape, signature shape, and content address. */
+declare function assertEconomyPortableCustomerReceipt(receipt: EconomyPortableCustomerReceiptV1, hashCanonicalPayload: CanonicalPayloadHashFunctionV1): void;
+/**
+ * Prepares the portable content address and exact bytes for an external signer.
+ * No placeholder signature value is required or returned.
+ */
+declare function prepareEconomyPortableCustomerReceiptSignature(body: EconomyPortableCustomerReceiptBodyV1, signature: EconomyEvidenceSignatureMetadataV1, hashCanonicalPayload: CanonicalPayloadHashFunctionV1): EconomyPreparedEvidenceSignatureV1;
+/** Exact bytes covered by a portable receipt's detached signature. */
+declare function canonicalEconomyPortableCustomerReceiptSigningPayload(receipt: EconomyPortableCustomerReceiptV1, hashCanonicalPayload: CanonicalPayloadHashFunctionV1): string;
+/** Canonical complete portable-receipt bytes, including its signature. */
+declare function canonicalEconomyPortableCustomerReceiptPayload(receipt: EconomyPortableCustomerReceiptV1, hashCanonicalPayload: CanonicalPayloadHashFunctionV1): string;
+/** Verifies a portable receipt through an infrastructure-supplied key adapter. */
+declare function assertEconomyPortableCustomerReceiptSignature(receipt: EconomyPortableCustomerReceiptV1, hashCanonicalPayload: CanonicalPayloadHashFunctionV1, verifySignature: EconomyEvidenceSignatureVerifierV1): void;
+/**
+ * Cross-validates the complete portable proof graph without storage, identity,
+ * key-vault, or cloud-SDK dependencies.
+ */
+declare function assertEconomyPortableCustomerReceiptEvidence(receipt: EconomyPortableCustomerReceiptV1, regionalReceipts: readonly EconomyRegionalEvidenceReceiptV1[], expectedRegions: readonly string[], anchor: EconomyIntegrityAnchorManifestV1 | undefined, hashCanonicalPayload: CanonicalPayloadHashFunctionV1, verifySignature: EconomyEvidenceSignatureVerifierV1): void;
+
 type SpendRequestPurpose = "gameplay-conversion" | "non-gameplay";
 type SpendRequestStatus = "requested" | "approved" | "rejected" | "expired" | "executed" | "cancelled";
 /** Future child request; baseline adapters must reject creation while disabled. */
@@ -1204,4 +2159,4 @@ interface SpendRequestV1 {
 /** Validates future child requests while creation remains policy-disabled. */
 declare function assertSpendRequest(request: SpendRequestV1): void;
 
-export { type AccountId, type ActivityEntryV1, type ActivityStatus, type ActivityType, type AdjustmentRequestV1, type AdjustmentStatus, type AllocationId, type AllocationStatus, BASELINE_GBP_CATALOG_VERSION, BASELINE_GBP_REFERENCE_RATE, BASELINE_GBP_TOKEN_PACKS, BASELINE_MONTHLY_SUBSCRIPTION_PLAN, BASELINE_PURCHASE_LIMIT_POLICY, type BalanceProjection, type BalanceProjectionSnapshotV1, type BitLabsConversionState, type BoostGameplayAllocationInputV1, type ChainedEconomicJournalTransactionV1, type CreateGameplayAllocationInputV1, EARLY_BACKER_SETTLEMENT_POLICY_V2, ECONOMY_CONTRACT_VERSION, type EarlyBackerEvaluationV1, type EarlyBackerEvaluationV2, type EarlyBackerWindowV1, type EconomicActivityStatusV1, type EconomicJournalStatus, type EconomicJournalTransactionV1, type EconomicWalletActivityEntryV1, type EconomyClockPort, type EconomyCommandEnvelopeV1, type EconomyCommandType, type EconomyCommandWorkflowEventV1, type EconomyCommandWorkflowStateV1, type EconomyContractVersion, EconomyError, type EconomyErrorCode, type EconomyErrorEnvelopeV1, type EconomyIdPort, type EconomyIdempotencyScopeV1, type EconomyOutboxEventV1, type EconomyPersistencePort, type EconomyPersistencePortV2, type EconomyQueryPortV1, type EconomyUnitOfWork, type EconomyUnitOfWorkV2, type FxSnapshotV1, type GameplayAllocationV1, type GameplayLimitsV1, type GbpMinorUnitString, type HouseholdId, type IsoTimestamp, type JournalChainHeadV1, type JournalChainId, type LedgerPostingV1, type LedgerTransactionV1, type LotId, type LotRefundState, type LotTransferPolicy, type LotUseContextV1, type LotUseOperation, PRE_UTILITY_BACKER_COHORT, type PaidLotLifecycleArithmeticV1, type PaidLotLifecycleEventTypeV1, type PaidLotLifecycleEventV1, type PaidLotLifecycleMutationResultV1, type PaidLotLifecycleReceiptV1, type PaidLotLifecycleStatusV1, type PaidLotLifecycleV1, type PaidLotPurchaseProvenanceV1, type PaidLotRetentionV1, type PeriodicLimitWindow, type PersistedIdempotencyResultV1, type PostingId, type ProviderEventId, type PurchaseCapMutationResultV1, type PurchaseCapReservationStatusV1, type PurchaseCapReservationTransitionReceiptV1, type PurchaseCapReservationTransitionTypeV1, type PurchaseCapReservationTransitionV1, type PurchaseCapReservationV1, type PurchaseCapScopeTypeV1, type PurchaseCreditInstructionV1, type PurchaseIntentDisputeDispositionV1, type PurchaseIntentLifecycleV1, type PurchaseIntentReductionV1, type PurchaseIntentStatus, type PurchaseIntentTransitionReceiptV1, type PurchaseIntentTransitionResultV1, type PurchaseIntentTransitionTypeV1, type PurchaseIntentTransitionV1, type PurchaseIntentV1, type PurchaseLimitPolicyV1, type ReclaimGameplayAllocationInputV1, type RecurrenceInterval, type ReservePurchaseCapsCommandV1, type ReversalInputV1, type RewardActivityTransitionV1, type RewardConversionStatus, type RewardConversionV1, type RewardRateV1, type RollingPurchaseCapStateV1, type ScopedPersistedIdempotencyResultV1, type SourceLotMovementType, type SourceLotMovementV1, type SourceLotSliceV1, type SourceLotV1, type SpendRequestPurpose, type SpendRequestStatus, type SpendRequestV1, TOKEN_SUBUNITS_MAX, TOKEN_SUBUNITS_MIN, TOKEN_SUBUNITS_PER_TOKEN, type TokenPackV1, type TokenReferenceRateV1, type TokenSource, type TokenSubscriptionPlanV1, type TokenSubunitString, type TransactionId, type VersionedSourceLotV1, type WalletActivityEntryV1, type WalletActivityFilterV1, type WalletActivityPageRequestV1, type WalletActivityPageV1, type WalletActivityStatusV1, type WalletBalanceDeltaV1, type WalletBalanceProjectionV1, type WalletBalanceSummaryV1, type WalletBalanceTotalsV1, type WalletId, type WalletKind, type WalletLifetimeBucket, type WalletLifetimeDeltaV1, type WalletLifetimeSnapshotV1, type WalletLifetimeTotalsV1, type WalletOwnerReferenceV1, type WalletOwnerType, type WalletPortfolioBalanceComponentV1, type WalletPortfolioComponentRole, type WalletPortfolioComponentScopeV1, type WalletPortfolioLifetimeComponentV1, type WalletPortfolioLifetimeV1, type WalletPortfolioReadScopeV1, type WalletPortfolioSummaryV1, type WalletPostingAccountBindingV1, type WalletProjectionBucket, type WalletStatus, type WalletV1, type WorkflowActivityStatusV1, type WorkflowWalletActivityEntryV1, advanceJournalChainHead, applyPaidLotLifecycleEvent, applyPurchaseIntentTransition, applySourceLotMovement, applyTransactionToProjection, applyWalletBalanceDelta, applyWalletLifetimeDeltas, assertActivityEntry, assertBalancedTransaction, assertDeterministicWalletBalanceSummary, assertDistinctAdjustmentApproval, assertEconomicJournalTransaction, assertEconomyCommandEnvelope, assertEconomyCommandWorkflowEvent, assertEconomyIdempotencyScope, assertEconomyIdentifier, assertFlatTokenCatalog, assertFxSnapshot, assertGameplayAllocation, assertJournalChainHead, assertNonNegativeAccounts, assertOpenPurchaseIntent, assertPaidLotLifecycle, assertPaidLotLifecycleEvent, assertPaidLotPurchaseProvenance, assertPurchaseCapReservation, assertPurchaseCapReservationTransition, assertPurchaseIntentBinding, assertPurchaseIntentLifecycle, assertPurchaseIntentTransition, assertPurchaseLimitPolicy, assertReversalAvailable, assertRewardConversion, assertRewardRate, assertRollingPurchaseCapState, assertScopedPersistedIdempotencyResult, assertSourceLot, assertSourceLotMovement, assertSpendRequest, assertTokenPack, assertTokenReferenceRate, assertTokenSubscriptionPlan, assertVersionedSourceLot, assertWallet, assertWalletActivityEntry, assertWalletActivityPage, assertWalletActivityPageForPortfolio, assertWalletActivityPageRequest, assertWalletBalanceDelta, assertWalletBalanceDeltaBatch, assertWalletBalanceProjection, assertWalletBalanceSummary, assertWalletLifetimeSnapshot, assertWalletLifetimeTotals, assertWalletOwnerReference, assertWalletPortfolioLifetime, assertWalletPortfolioReadScope, assertWalletPortfolioSummary, availableSourceLotAmount, boostGameplayAllocation, calculateRollingPurchaseCapUsage, canUseSourceLot, canonicalTransactionPayload, convertRewardPayout, createEarlyBackerRetentionFromPaidLot, createGameplayAllocation, createInitialSourceLotSnapshot, createPaidLotLifecycle, createProjectionSnapshot, createPurchaseIntentLifecycle, createReversalTransaction, createRollingPurchaseCapState, createWalletBalanceSummary, createWalletPortfolioLifetime, createWalletPortfolioSummary, deriveWalletBalanceDeltas, deriveWalletLifetimeDeltas, economyAssert, evaluateEarlyBacker, evaluateEarlyBackerBySettlementV2, isWholeTokenAmount, mapBitLabsConversionState, parseGbpMinorUnits, parseIsoTimestamp, parseTokenSubunits, rebuildBalanceProjection, reclaimGameplayAllocation, reducePaidLotLifecycleEvents, reducePurchaseIntentTransitions, reserveRollingPurchaseCaps, selectSourceLots, serializeGbpMinorUnits, serializeTokenSubunits, sortStringRecord, subunitsToWholeTokens, sumTokenSubunits, toEconomyErrorEnvelope, transitionRollingPurchaseCapReservation, wholeTokensToSubunits };
+export { type AccountId, type ActivityEntryV1, type ActivityStatus, type ActivityType, type AdjustmentRequestV1, type AdjustmentStatus, type AllocationId, type AllocationStatus, type AuditedChainedEconomicJournalTransactionV1, type AuditedEconomyCommandEnvelopeV1, BASELINE_GBP_CATALOG_VERSION, BASELINE_GBP_REFERENCE_RATE, BASELINE_GBP_TOKEN_PACKS, BASELINE_MONTHLY_SUBSCRIPTION_PLAN, BASELINE_PURCHASE_LIMIT_POLICY, type BalanceProjection, type BalanceProjectionSnapshotV1, type BitLabsConversionState, type BoostGameplayAllocationInputV1, type CanonicalPayloadHashFunctionV1, type ChainedEconomicJournalTransactionV1, type CloseModuleAllowanceInputV1, type CreateGameplayAllocationInputV1, type CreateModuleAllowanceInputV1, type CreateModulePurchaseReceiptInputV1, type CreateModuleSpendHoldInputV1, type CreateModuleSpendQuoteInputV1, EARLY_BACKER_SETTLEMENT_POLICY_V2, ECONOMY_AUTHORITY_COMMIT_OVERHEAD_OPERATIONS, ECONOMY_AUTHORITY_MAX_BATCH_BYTES, ECONOMY_AUTHORITY_MAX_BATCH_OPERATIONS, ECONOMY_AUTHORITY_MAX_RECORD_REFERENCES, ECONOMY_CONTRACT_VERSION, ECONOMY_RECOVERY_PROTOCOL_VERSION, type EarlyBackerEvaluationV1, type EarlyBackerEvaluationV2, type EarlyBackerWindowV1, type EconomicActivityStatusV1, type EconomicJournalStatus, type EconomicJournalTransactionV1, type EconomicWalletActivityEntryV1, type EconomyAcceptedCommandReceiptV1, type EconomyAcquisitionProviderV1, type EconomyAuditGraphV1, type EconomyAuditedIdempotencyResultV1, type EconomyAuditedIdempotencyScopeV1, type EconomyAuditedIdempotencyStateV1, type EconomyAuthorityCommitKindV1, type EconomyAuthorityCommitManifestV1, type EconomyAuthorityHeadV1, type EconomyAuthorityRecordKindV1, type EconomyAuthorityRecordReferenceV1, type EconomyAuthorityStateV1, type EconomyAuthorityWriteKindV1, type EconomyAuthorizationEvidenceV1, type EconomyCausationKindV1, type EconomyCausationReferenceV1, type EconomyClockPort, type EconomyCommandEnvelopeV1, type EconomyCommandProcessingDispositionV1, type EconomyCommandProcessingModeV1, type EconomyCommandResultOutcomeV1, type EconomyCommandResultReceiptV1, type EconomyCommandSourceV1, type EconomyCommandType, type EconomyCommandWorkflowEventV1, type EconomyCommandWorkflowStateV1, type EconomyContractVersion, type EconomyEncryptedOperationalHandleBindingV1, EconomyError, type EconomyErrorCode, type EconomyErrorEnvelopeV1, type EconomyEvidenceRecordReferenceV1, type EconomyEvidenceSignatureAlgorithmV1, type EconomyEvidenceSignatureMetadataV1, type EconomyEvidenceSignatureV1, type EconomyEvidenceSignatureVerificationInputV1, type EconomyEvidenceSignatureVerifierV1, type EconomyHmacFingerprintDomainV1, type EconomyHmacFingerprintV1, type EconomyHmacSha256DigestV1, type EconomyIdPort, type EconomyIdempotencyScopeV1, type EconomyIntegrityAnchorManifestV1, type EconomyIntegrityFailureCodeV1, type EconomyIntegrityVerificationReceiptV1, type EconomyIntegrityVerificationStatusV1, type EconomyMerkleInclusionProofV1, type EconomyMerkleProofStepV1, type EconomyOperationalHandlePurposeV1, type EconomyOutboxEventV1, type EconomyPersistencePort, type EconomyPersistencePortV2, type EconomyPersistencePortV3, type EconomyPortableCustomerReceiptBodyV1, type EconomyPortableCustomerReceiptV1, type EconomyPortableEvidenceReferenceV1, type EconomyPreparedEvidenceSignatureV1, type EconomyPrincipalTypeV1, type EconomyProviderEvidenceHashV1, type EconomyProviderEvidenceManifestV1, type EconomyQueryPortV1, type EconomyRecoveryAcceptanceBodyV1, type EconomyRecoveryAcceptanceEnvelopeV1, type EconomyRecoveryCommittedResultBodyV1, type EconomyRecoveryCommittedResultV1, type EconomyRecoveryDirectionV1, type EconomyRecoveryProtocolVersion, type EconomyRecoveryRecordKindV1, type EconomyRegionalEvidenceReceiptBodyV1, type EconomyRegionalEvidenceReceiptV1, type EconomySealedRecoveryPayloadV1, type EconomyUnitOfWork, type EconomyUnitOfWorkV2, type EconomyUnitOfWorkV3, type FundModuleAllowanceInputV1, type FxSnapshotV1, type GameplayAllocationV1, type GameplayLimitsV1, type GbpMinorUnitString, type HashedEconomyAuthorityCommitManifestV1, type HouseholdId, type IsoTimestamp, type JournalChainHeadV1, type JournalChainId, type JournalChainVerificationFailureCodeV1, type JournalChainVerificationResultV1, type LearningEntitlementId, type LearningModuleVersionId, type LedgerPostingV1, type LedgerTransactionV1, type LotId, type LotRefundState, type LotTransferPolicy, type LotUseContextV1, type LotUseOperation, MODULE_ALLOWANCE_PURPOSE, type ModuleAllowanceId, type ModuleAllowanceStatusV1, type ModuleAllowanceV1, type ModulePurchaseEntitlementStateV1, type ModulePurchaseFinancialStateV1, type ModulePurchaseReceiptV1, type ModulePurchaseReconciliationActionV1, type ModulePurchaseReconciliationObservationV1, type ModulePurchaseReconciliationResultV1, type ModuleSpendHoldId, type ModuleSpendHoldStatusV1, type ModuleSpendHoldV1, type ModuleSpendQuoteId, type ModuleSpendQuoteV1, type ModuleSpendTransitionResultV1, PRE_UTILITY_BACKER_COHORT, type PaidLotLifecycleArithmeticV1, type PaidLotLifecycleEventTypeV1, type PaidLotLifecycleEventV1, type PaidLotLifecycleMutationResultV1, type PaidLotLifecycleReceiptV1, type PaidLotLifecycleStatusV1, type PaidLotLifecycleV1, type PaidLotPurchaseProvenanceV1, type PaidLotRetentionV1, type PeriodicLimitWindow, type PersistedIdempotencyResultV1, type PostingId, type ProviderEventId, type PurchaseCapMutationResultV1, type PurchaseCapReservationStatusV1, type PurchaseCapReservationTransitionReceiptV1, type PurchaseCapReservationTransitionTypeV1, type PurchaseCapReservationTransitionV1, type PurchaseCapReservationV1, type PurchaseCapScopeTypeV1, type PurchaseCreditInstructionV1, type PurchaseIntentDisputeDispositionV1, type PurchaseIntentLifecycleV1, type PurchaseIntentReductionV1, type PurchaseIntentStatus, type PurchaseIntentTransitionReceiptV1, type PurchaseIntentTransitionResultV1, type PurchaseIntentTransitionTypeV1, type PurchaseIntentTransitionV1, type PurchaseIntentV1, type PurchaseLimitPolicyV1, type ReclaimGameplayAllocationInputV1, type ReclaimModuleAllowanceInputV1, type RecurrenceInterval, type ReleaseModuleSpendHoldInputV1, type ReservePurchaseCapsCommandV1, type ReversalInputV1, type RewardActivityTransitionV1, type RewardConversionStatus, type RewardConversionV1, type RewardRateV1, type RollingPurchaseCapStateV1, type ScopedPersistedIdempotencyResultV1, type SettleModuleSpendHoldInputV1, type SourceLotMovementType, type SourceLotMovementV1, type SourceLotSliceV1, type SourceLotV1, type SpendRequestPurpose, type SpendRequestStatus, type SpendRequestV1, TOKEN_SUBUNITS_MAX, TOKEN_SUBUNITS_MIN, TOKEN_SUBUNITS_PER_TOKEN, type TokenPackV1, type TokenReferenceRateV1, type TokenSource, type TokenSubscriptionPlanV1, type TokenSubunitString, type TransactionId, type VersionedSourceLotV1, type WalletActivityEntryV1, type WalletActivityFilterV1, type WalletActivityPageRequestV1, type WalletActivityPageV1, type WalletActivityStatusV1, type WalletBalanceDeltaV1, type WalletBalanceProjectionV1, type WalletBalanceSummaryV1, type WalletBalanceTotalsV1, type WalletId, type WalletKind, type WalletLifetimeBucket, type WalletLifetimeDeltaV1, type WalletLifetimeSnapshotV1, type WalletLifetimeTotalsV1, type WalletOwnerReferenceV1, type WalletOwnerType, type WalletPortfolioBalanceComponentV1, type WalletPortfolioComponentRole, type WalletPortfolioComponentScopeV1, type WalletPortfolioLifetimeComponentV1, type WalletPortfolioLifetimeV1, type WalletPortfolioReadScopeV1, type WalletPortfolioSummaryV1, type WalletPostingAccountBindingV1, type WalletProjectionBucket, type WalletStatus, type WalletV1, type WorkflowActivityStatusV1, type WorkflowWalletActivityEntryV1, advanceEconomyAuthorityHead, advanceJournalChainHead, applyPaidLotLifecycleEvent, applyPurchaseIntentTransition, applySourceLotMovement, applyTransactionToProjection, applyWalletBalanceDelta, applyWalletLifetimeDeltas, assertActivityEntry, assertAuditedEconomyCommandEnvelope, assertBalancedTransaction, assertDeterministicWalletBalanceSummary, assertDistinctAdjustmentApproval, assertEconomicJournalTransaction, assertEconomyAcceptedCommandReceipt, assertEconomyAuditGraph, assertEconomyAuditedIdempotencyResult, assertEconomyAuditedIdempotencyScope, assertEconomyAuthorityBatchLimits, assertEconomyAuthorityCommitManifest, assertEconomyAuthorityHead, assertEconomyAuthorityRecordReference, assertEconomyAuthorityRecoveryEvidence, assertEconomyAuthorizationEvidence, assertEconomyCommandEnvelope, assertEconomyCommandResultReceipt, assertEconomyCommandWorkflowEvent, assertEconomyEncryptedOperationalHandleBinding, assertEconomyEvidenceSignature, assertEconomyEvidenceSignatureMetadata, assertEconomyHmacFingerprint, assertEconomyIdempotencyScope, assertEconomyIdentifier, assertEconomyIntegrityAnchorManifest, assertEconomyIntegrityVerificationReceipt, assertEconomyMerkleInclusion, assertEconomyMerkleInclusionProof, assertEconomyPortableCustomerReceipt, assertEconomyPortableCustomerReceiptEvidence, assertEconomyPortableCustomerReceiptSignature, assertEconomyProviderEvidenceHash, assertEconomyProviderEvidenceManifest, assertEconomyRecoveryAcceptanceEnvelope, assertEconomyRecoveryCommittedResult, assertEconomyRecoveryResultLink, assertEconomyRegionalEvidenceChain, assertEconomyRegionalEvidenceEquality, assertEconomyRegionalEvidenceReceipt, assertEconomyRegionalEvidenceReceiptSignature, assertEconomySealedRecoveryPayload, assertExactAuditedEconomyCommandReplay, assertFlatTokenCatalog, assertFxSnapshot, assertGameplayAllocation, assertJournalChainHead, assertModuleAllowance, assertModulePurchaseReceipt, assertModulePurchaseReconciliationObservation, assertModuleSpendHold, assertModuleSpendQuote, assertNonNegativeAccounts, assertOpenPurchaseIntent, assertPaidLotLifecycle, assertPaidLotLifecycleEvent, assertPaidLotPurchaseProvenance, assertPurchaseCapReservation, assertPurchaseCapReservationTransition, assertPurchaseIntentBinding, assertPurchaseIntentLifecycle, assertPurchaseIntentTransition, assertPurchaseLimitPolicy, assertReversalAvailable, assertRewardConversion, assertRewardRate, assertRollingPurchaseCapState, assertScopedPersistedIdempotencyResult, assertSourceLot, assertSourceLotMovement, assertSpendRequest, assertTokenPack, assertTokenReferenceRate, assertTokenSubscriptionPlan, assertVersionedSourceLot, assertWallet, assertWalletActivityEntry, assertWalletActivityPage, assertWalletActivityPageForPortfolio, assertWalletActivityPageRequest, assertWalletBalanceDelta, assertWalletBalanceDeltaBatch, assertWalletBalanceProjection, assertWalletBalanceSummary, assertWalletLifetimeSnapshot, assertWalletLifetimeTotals, assertWalletOwnerReference, assertWalletPortfolioLifetime, assertWalletPortfolioReadScope, assertWalletPortfolioSummary, availableSourceLotAmount, boostGameplayAllocation, calculateRollingPurchaseCapUsage, canUseSourceLot, canonicalAuditedEconomyCommandEnvelopePayload, canonicalEconomyAcceptedCommandReceiptPayload, canonicalEconomyAuthorityCommitManifestPayload, canonicalEconomyAuthorityHeadPayload, canonicalEconomyCommandResultReceiptPayload, canonicalEconomyEncryptedOperationalHandleBindingPayload, canonicalEconomyIntegrityAnchorManifestPayload, canonicalEconomyIntegrityVerificationReceiptPayload, canonicalEconomyPortableCustomerReceiptBodyPayload, canonicalEconomyPortableCustomerReceiptPayload, canonicalEconomyPortableCustomerReceiptSigningPayload, canonicalEconomyProviderEvidenceHashPayload, canonicalEconomyProviderEvidenceManifestPayload, canonicalEconomyRecoveryAcceptanceBodyPayload, canonicalEconomyRecoveryAcceptanceEnvelopePayload, canonicalEconomyRecoveryCommittedResultBodyPayload, canonicalEconomyRecoveryCommittedResultPayload, canonicalEconomyRegionalEvidenceReceiptBodyPayload, canonicalEconomyRegionalEvidenceReceiptPayload, canonicalEconomyRegionalEvidenceReceiptSigningPayload, canonicalTransactionPayload, closeModuleAllowance, convertRewardPayout, createEarlyBackerRetentionFromPaidLot, createEconomyPortableCustomerReceipt, createEconomyRecoveryAcceptanceEnvelope, createEconomyRecoveryCommittedResult, createEconomyRegionalEvidenceReceipt, createGameplayAllocation, createInitialSourceLotSnapshot, createModuleAllowance, createModulePurchaseReceipt, createModuleSpendHold, createModuleSpendQuote, createPaidLotLifecycle, createProjectionSnapshot, createPurchaseIntentLifecycle, createReversalTransaction, createRollingPurchaseCapState, createWalletBalanceSummary, createWalletPortfolioLifetime, createWalletPortfolioSummary, deriveWalletBalanceDeltas, deriveWalletLifetimeDeltas, economyAssert, evaluateEarlyBacker, evaluateEarlyBackerBySettlementV2, fundModuleAllowance, isWholeTokenAmount, mapBitLabsConversionState, parseGbpMinorUnits, parseIsoTimestamp, parseTokenSubunits, prepareEconomyPortableCustomerReceiptSignature, prepareEconomyRegionalEvidenceReceiptSignature, rebuildBalanceProjection, reclaimGameplayAllocation, reclaimModuleAllowance, reconcileModulePurchase, reducePaidLotLifecycleEvents, reducePurchaseIntentTransitions, releaseModuleSpendHold, reserveRollingPurchaseCaps, selectSourceLots, serializeGbpMinorUnits, serializeTokenSubunits, settleModuleSpendHold, sortEconomyAuthorityRecordReferences, sortStringRecord, subunitsToWholeTokens, sumTokenSubunits, toEconomyErrorEnvelope, transitionRollingPurchaseCapReservation, verifyJournalChainSegment, wholeTokensToSubunits };