@unicitylabs/sphere-sdk 0.14.0-dev.5 → 0.14.0-dev.7

package/dist/modules/payments-v2/index.d.cts

@@ -547,6 +547,25 @@ interface PaymentsRequestsApi {
     decline(id: string): Promise<void>;
     dismissProcessed(): void;
 }
+/**
+ * A pending-transfers row, derived ON READ from the §6 stores (intent backstop
+ * + delivery journal + shortfalls) — never a cached mirror. kind 'shortfall' =
+ * a completed partial (#690) whose `amount` is the remainder still owed;
+ * legs.certified counts journaled legs (certified, delivery still owed).
+ */
+interface PendingTransfer {
+    transferId: string;
+    kind: 'open' | 'shortfall';
+    recipient: string;
+    coinId: string;
+    amount: string;
+    legs: {
+        certified: number;
+        total: number;
+    };
+    deliveryPending: boolean;
+    createdAt: number;
+}
 interface PaymentsV2 {
     assets(coinId?: string): Promise<Asset[]>;
     tokens(filter?: {
@@ -561,6 +580,8 @@ interface PaymentsV2 {
     receive(): Promise<{
         transfers: IncomingTransfer[];
     }>;
+    pendingTransfers(): Promise<PendingTransfer[]>;
+    resumeNow(): Promise<void>;
     readonly requests: PaymentsRequestsApi;
 }
 interface PaymentsV2Events {
@@ -572,7 +593,8 @@ interface PaymentsV2Events {
         detail?: string;
     };
     'inventory:updated': Record<string, never>;
-    'history:updated': Record<string, never>;
+    /** The just-recorded entry, client-shaped (the same mapping history() serves). */
+    'history:updated': HistoryEntry;
     'payment_request:incoming': PaymentRequestView;
     'payment_request:updated': {
         id: string;
@@ -645,6 +667,14 @@ interface DeliveryPort {
     deliver(recipientPubkey: string, blob: Uint8Array, options: DeliverOptions): Promise<DeliveryReceipt>;
     deliverBatch?(recipientPubkey: string, blobs: Uint8Array[], options: DeliverOptions): Promise<DeliveryReceipt[]>;
     incoming(sinceCursor?: string): AsyncIterable<IncomingDelivery>;
+    /**
+     * The syncEpoch of the most recent incoming() page — updated per page, null
+     * before the first. §5.7 restore self-detection: the mailbox page is the
+     * honest epoch source, so Receive voids its (cursor, epoch) continuity on a
+     * mismatch even when the wake socket missed a server restore. (Pinned by the
+     * S7 contract suite; wallet-api#119's S7 text carries the same sentence.)
+     */
+    incomingEpoch(): string | null;
     ack(deliveryId: string, disposition: 'claimed' | 'rejected', reason?: 'invalid' | 'not-owned' | 'storage-rejected' | 'other'): Promise<void>;
     onWake?(cb: () => void): () => void;
 }
@@ -739,6 +769,8 @@ declare const STORE_KEYS: {
     readonly settlingLinks: "settling";
     readonly streamCursor: (s: StreamName) => string;
     readonly epochLatch: "epoch-latch";
+    readonly suspectedSpent: "suspected-spent";
+    readonly knownSpends: "known-spends";
 };
 
 type RequestWireStatus = 'open' | 'paid' | 'declined' | 'expired';
@@ -826,6 +858,7 @@ declare class Requests implements PaymentsRequestsApi {
     private now;
     private ensureJournalLoaded;
     private mutateJournal;
+    /** Idempotent for a same-transferId re-write: committed only ratchets up, createdAt kept. */
     private writeLink;
     private clearLink;
     drainIncoming(): Promise<void>;
@@ -845,6 +878,18 @@ declare class Requests implements PaymentsRequestsApi {
     }>;
     pay(id: string): Promise<TransferResult>;
     private payInner;
+    /**
+     * THE settlement invariant (#441 + the failed-respond P1): a settling link is
+     * removed ONLY by (a) a CONFIRMED paid respond — a 2xx, or the 409
+     * already-resolved absorb — or (b) a proven clean pre-commit failure
+     * (revertPayable). Nothing else removes one: not a network error, not a 5xx,
+     * not a reload. Every path that binds a request to a transfer outcome funnels
+     * through here — pay()'s clean success (respond now), pay()'s
+     * possibly-committed throw (respond deferred), and reconcile's deferred arms
+     * — so a failed respond always leaves the link + 'settling' and the next
+     * reconcile pass (the committed-link override) retries the respond.
+     */
+    private settle;
     /** 'paid' respond leg: 409 = already resolved = idempotent success; other errors defer. */
     private respondPaid;
     decline(id: string): Promise<void>;
@@ -852,7 +897,9 @@ declare class Requests implements PaymentsRequestsApi {
     reconcile(outcomes: ResumeOutcomes): Promise<void>;
     private doReconcile;
     private reconcileUnaccounted;
+    /** Deferred paid: the ONE settlement path again — a failed respond keeps the link. */
     private resolvePaid;
+    /** Removal cause (b): a PROVEN clean outcome (pre-commit failure / server-aborted). */
     private revertPayable;
 }
 
@@ -899,6 +946,8 @@ interface PriceReader {
     getPrices(tokenNames: string[]): Promise<Map<string, PriceQuote>>;
 }
 
+declare const ATTENTION_RESEED_REJECTED = "intent:reseed-rejected";
+
 /**
  * F13 makes `mint(params, { transferId, opIndex })` idempotent-recoverable — a
  * same-seed re-CALL recovers the existing certification via the E.2 probe
@@ -919,6 +968,28 @@ interface FacadeSession {
     start(): Promise<void>;
     stop(): Promise<void>;
     subscribeStream(stream: 'inventory' | 'mailbox' | 'payment_requests', handler: () => void): () => void;
+    /** §5.1: the latched server syncEpoch ('' before first server contact). */
+    currentEpoch(): string;
+    /**
+     * §5.1 restore hook — REQUIRED so an unwired restore protocol is a COMPILE
+     * ERROR: handlers run and are AWAITED on a syncEpoch change BEFORE any
+     * stream nudge resumes. The facade registers handleEpochChange here.
+     */
+    subscribeEpochChange(handler: (epoch: string) => Promise<void>): () => void;
+    /**
+     * Optional connection-status feed (same wiring pattern as the streams; the
+     * emission point is the session's existing `connection:status` transition).
+     * The facade's heartbeat resets its backoff on a 'connected' recovery.
+     */
+    subscribeStatus?(handler: (status: 'connected' | 'degraded' | 'offline') => void): () => void;
+}
+/**
+ * §5.1/§6 restore surface of the checkpoint store: re-POST the slot's cached
+ * encrypt-once ciphertext byte-identical after a server restore (insert-once,
+ * first-write-wins server-side). Returns false when no ciphertext is cached.
+ */
+interface CheckpointReseeder {
+    reseedCheckpoint(transferId: string, opIndex: number): Promise<boolean>;
 }
 interface IntentWireLike {
     transferId: string;
@@ -937,7 +1008,8 @@ interface PaymentsFacadeDeps {
     client: FacadeClient;
     storagePort: StoragePort;
     deliveryPort: DeliveryPort;
-    checkpointStore: SplitCheckpointStore;
+    /** Reseeder REQUIRED: the restore protocol re-POSTs cached ciphertexts (§5.1). */
+    checkpointStore: SplitCheckpointStore & CheckpointReseeder;
     /** Initial engine source; setEngine() swaps what FUTURE operations snapshot. */
     engineRef: () => ITokenEngine;
     kv: ScopedKV;
@@ -953,7 +1025,8 @@ interface PaymentsFacadeDeps {
     ownPubkey: string;
     ownNametag?: () => string | undefined;
     requestMemo: RequestMemoCodec;
-    syncEpoch?: () => string;
+    /** REQUIRED (§5.1): reads the session's current epoch — never a default. */
+    syncEpoch: () => string;
     now?: () => number;
     newId?: () => string;
     workBudget?: number;
@@ -975,11 +1048,20 @@ declare class PaymentsFacade implements PaymentsV2 {
     private readonly receiveLoop;
     private readonly heldStates;
     private readonly ownPubkeyBytes;
+    private readonly restoreDeps;
     readonly requests: Requests;
     private currentEngine;
     private readonly pendingOps;
     private unsubscribers;
     private started;
+    private readonly heartbeat;
+    private readonly converger;
+    /** Resume single-flight (§7): ticks, start() and resumeNow() coalesce onto ONE pass. */
+    private readonly resumeFlight;
+    /** §5.1/§7: restore + convergence passes SERIALIZE here. */
+    private readonly passChain;
+    /** §7 ownership: ids with an in-process machine attempt — the pass never adopts one. */
+    private readonly activeMoneyOps;
     constructor(deps: PaymentsFacadeDeps);
     start(): Promise<void>;
     /** §7 same-address restart gate: resolves only after in-flight ops settle. */
@@ -994,26 +1076,36 @@ declare class PaymentsFacade implements PaymentsV2 {
         before?: string;
         limit?: number;
     }): Promise<HistoryPage>;
+    /** §4 pending-transfers UI surface — derived on read, never cached (convergence.ts). */
+    pendingTransfers(): Promise<PendingTransfer[]>;
     send(request: SendRequest): Promise<TransferResult>;
     receive(): Promise<{
         transfers: IncomingTransfer[];
     }>;
     mint(coinId: string, amount: bigint): Promise<MintResult>;
+    resumeNow(): Promise<void>;
+    /** §5.1 restore — awaited by the session latch BEFORE streams resume; never coalesced onto a pre-restore pass. */
+    handleEpochChange(_newEpoch: string): Promise<void>;
+    /** One single-flighted pass + its reschedule: concurrent callers coalesce. */
+    private runConvergencePass;
+    private convergeBody;
+    private nowMs;
+    /** The ONE place a send() outcome is shaped: success emits in finishSend, a
+     *  CLEAN rejection emits `transfer:updated{status:'failed'}` here (§4). */
+    private sendOutcome;
+    /** Only a CLEAN failure (nothing certified, classifyError 'other') is 'failed'.
+     *  Keep-open/partial/conflict outcomes are pending/converging — labelling them
+     *  'failed' invites a dApp re-send, i.e. a double-pay (#631/#676). */
+    private emitCleanFailure;
     private sendWithPolicy;
     /** §5.6 cross-network deposit trap: refused BEFORE any reserve/certification. */
     private requireSameNetworkRecipient;
     private runAttempt;
-    /**
-     * Partial outcome (#677/#690): the shortfall is already durable (written by
-     * the machine BEFORE complete). Accumulate the settled set, then re-plan ONLY
-     * the remainder under a NEW transferId — never the full amount.
-     */
+    /** Partial (#677/#690): shortfall already durable (machine wrote it BEFORE
+     *  complete); accumulate settled, re-plan ONLY the remainder, NEW transferId. */
     private consumePartial;
-    /**
-     * One attempt's failure disposition: possibly-committed → rethrow UNWRAPPED;
-     * backstop still 'open' (committed>0) → converge via the same machine's
-     * resumeIntent; clean conflict with a demoted source → bounded full re-plan.
-     */
+    /** Failure disposition: possibly-committed → rethrow UNWRAPPED; backstop
+     *  'open' → converge via resumeIntent; clean demoted conflict → full re-plan. */
     private disposeFailedAttempt;
     /** #677/#690: ≥1 leg committed — the SAME machine, resumed in-process, converges it. */
     private convergePartial;
@@ -1033,28 +1125,28 @@ declare class PaymentsFacade implements PaymentsV2 {
     private refreshThenRelease;
     private accumulate;
     private finishSend;
-    /**
-     * With nothing delivered the error passes UNWRAPPED (identity + cause kept);
-     * after ≥1 delivered leg EVERY failure surfaces as PartialSendConflictError
-     * over the accumulated settled set — never bare, never a full-amount retry.
-     */
+    /** Nothing delivered → UNWRAPPED; after ≥1 delivered leg every failure surfaces as PartialSendConflictError over the settled set. */
     private partialize;
     /** #441: possibly-committed errors must carry the transferId for the settling journal. */
     private stampTransferId;
     private softAbort;
     private mintInner;
+    private mintUnderJournal;
     private finalizeMint;
+    /** @returns how many journal entries were RESOLVED (cleared) — heartbeat progress. */
     private replayMints;
     private replayMint;
     private mintParams;
     private tokenInServerInventory;
     private engine;
     private newId;
-    private runResume;
     private seedHeldStates;
     private toUiToken;
     private track;
     private trackTail;
 }
 
-export { ATTENTION_MINT_UNRESOLVED, type ApplyDeltaResult, type DeliverOptions, type DeliveryJournalEntry, type DeliveryPort, type DeliveryReceipt, type DeterministicMintCapable, type FacadeClient, type FacadeSession, type HistoryEntry, type HistoryPage, type IncomingDelivery, type IntentBackstopEntry, type IntentPayload, type InventoryAsset, type InventoryItem, type InventoryPage, MAX_RESELECT, type MintJournalEntry, type MintResult, type OpOutcome, type OutcomeClass, type PaymentRequestStatus, type PaymentRequestView, PaymentsFacade, type PaymentsFacadeDeps, type PaymentsRequestsApi, type PaymentsV2, type PaymentsV2Events, type PlannedOp, type RecipientInfo, STORE_KEYS, type ScopedKV, type SendRequest, type SettlingLink, type ShortfallEntry, type StoragePort, type StreamCursor, type StreamName, createScopedKV, supportsDeterministicMint };
+declare const HEARTBEAT_SEED_MS = 5000;
+declare const HEARTBEAT_CAP_MS = 120000;
+
+export { ATTENTION_MINT_UNRESOLVED, ATTENTION_RESEED_REJECTED, type ApplyDeltaResult, type CheckpointReseeder, type DeliverOptions, type DeliveryJournalEntry, type DeliveryPort, type DeliveryReceipt, type DeterministicMintCapable, type FacadeClient, type FacadeSession, HEARTBEAT_CAP_MS, HEARTBEAT_SEED_MS, type HistoryEntry, type HistoryPage, type IncomingDelivery, type IntentBackstopEntry, type IntentPayload, type InventoryAsset, type InventoryItem, type InventoryPage, MAX_RESELECT, type MintJournalEntry, type MintResult, type OpOutcome, type OutcomeClass, type PaymentRequestStatus, type PaymentRequestView, PaymentsFacade, type PaymentsFacadeDeps, type PaymentsRequestsApi, type PaymentsV2, type PaymentsV2Events, type PendingTransfer, type PlannedOp, type RecipientInfo, STORE_KEYS, type ScopedKV, type SendRequest, type SettlingLink, type ShortfallEntry, type StoragePort, type StreamCursor, type StreamName, createScopedKV, supportsDeterministicMint };

package/dist/modules/payments-v2/index.d.ts

@@ -547,6 +547,25 @@ interface PaymentsRequestsApi {
     decline(id: string): Promise<void>;
     dismissProcessed(): void;
 }
+/**
+ * A pending-transfers row, derived ON READ from the §6 stores (intent backstop
+ * + delivery journal + shortfalls) — never a cached mirror. kind 'shortfall' =
+ * a completed partial (#690) whose `amount` is the remainder still owed;
+ * legs.certified counts journaled legs (certified, delivery still owed).
+ */
+interface PendingTransfer {
+    transferId: string;
+    kind: 'open' | 'shortfall';
+    recipient: string;
+    coinId: string;
+    amount: string;
+    legs: {
+        certified: number;
+        total: number;
+    };
+    deliveryPending: boolean;
+    createdAt: number;
+}
 interface PaymentsV2 {
     assets(coinId?: string): Promise<Asset[]>;
     tokens(filter?: {
@@ -561,6 +580,8 @@ interface PaymentsV2 {
     receive(): Promise<{
         transfers: IncomingTransfer[];
     }>;
+    pendingTransfers(): Promise<PendingTransfer[]>;
+    resumeNow(): Promise<void>;
     readonly requests: PaymentsRequestsApi;
 }
 interface PaymentsV2Events {
@@ -572,7 +593,8 @@ interface PaymentsV2Events {
         detail?: string;
     };
     'inventory:updated': Record<string, never>;
-    'history:updated': Record<string, never>;
+    /** The just-recorded entry, client-shaped (the same mapping history() serves). */
+    'history:updated': HistoryEntry;
     'payment_request:incoming': PaymentRequestView;
     'payment_request:updated': {
         id: string;
@@ -645,6 +667,14 @@ interface DeliveryPort {
     deliver(recipientPubkey: string, blob: Uint8Array, options: DeliverOptions): Promise<DeliveryReceipt>;
     deliverBatch?(recipientPubkey: string, blobs: Uint8Array[], options: DeliverOptions): Promise<DeliveryReceipt[]>;
     incoming(sinceCursor?: string): AsyncIterable<IncomingDelivery>;
+    /**
+     * The syncEpoch of the most recent incoming() page — updated per page, null
+     * before the first. §5.7 restore self-detection: the mailbox page is the
+     * honest epoch source, so Receive voids its (cursor, epoch) continuity on a
+     * mismatch even when the wake socket missed a server restore. (Pinned by the
+     * S7 contract suite; wallet-api#119's S7 text carries the same sentence.)
+     */
+    incomingEpoch(): string | null;
     ack(deliveryId: string, disposition: 'claimed' | 'rejected', reason?: 'invalid' | 'not-owned' | 'storage-rejected' | 'other'): Promise<void>;
     onWake?(cb: () => void): () => void;
 }
@@ -739,6 +769,8 @@ declare const STORE_KEYS: {
     readonly settlingLinks: "settling";
     readonly streamCursor: (s: StreamName) => string;
     readonly epochLatch: "epoch-latch";
+    readonly suspectedSpent: "suspected-spent";
+    readonly knownSpends: "known-spends";
 };
 
 type RequestWireStatus = 'open' | 'paid' | 'declined' | 'expired';
@@ -826,6 +858,7 @@ declare class Requests implements PaymentsRequestsApi {
     private now;
     private ensureJournalLoaded;
     private mutateJournal;
+    /** Idempotent for a same-transferId re-write: committed only ratchets up, createdAt kept. */
     private writeLink;
     private clearLink;
     drainIncoming(): Promise<void>;
@@ -845,6 +878,18 @@ declare class Requests implements PaymentsRequestsApi {
     }>;
     pay(id: string): Promise<TransferResult>;
     private payInner;
+    /**
+     * THE settlement invariant (#441 + the failed-respond P1): a settling link is
+     * removed ONLY by (a) a CONFIRMED paid respond — a 2xx, or the 409
+     * already-resolved absorb — or (b) a proven clean pre-commit failure
+     * (revertPayable). Nothing else removes one: not a network error, not a 5xx,
+     * not a reload. Every path that binds a request to a transfer outcome funnels
+     * through here — pay()'s clean success (respond now), pay()'s
+     * possibly-committed throw (respond deferred), and reconcile's deferred arms
+     * — so a failed respond always leaves the link + 'settling' and the next
+     * reconcile pass (the committed-link override) retries the respond.
+     */
+    private settle;
     /** 'paid' respond leg: 409 = already resolved = idempotent success; other errors defer. */
     private respondPaid;
     decline(id: string): Promise<void>;
@@ -852,7 +897,9 @@ declare class Requests implements PaymentsRequestsApi {
     reconcile(outcomes: ResumeOutcomes): Promise<void>;
     private doReconcile;
     private reconcileUnaccounted;
+    /** Deferred paid: the ONE settlement path again — a failed respond keeps the link. */
     private resolvePaid;
+    /** Removal cause (b): a PROVEN clean outcome (pre-commit failure / server-aborted). */
     private revertPayable;
 }
 
@@ -899,6 +946,8 @@ interface PriceReader {
     getPrices(tokenNames: string[]): Promise<Map<string, PriceQuote>>;
 }
 
+declare const ATTENTION_RESEED_REJECTED = "intent:reseed-rejected";
+
 /**
  * F13 makes `mint(params, { transferId, opIndex })` idempotent-recoverable — a
  * same-seed re-CALL recovers the existing certification via the E.2 probe
@@ -919,6 +968,28 @@ interface FacadeSession {
     start(): Promise<void>;
     stop(): Promise<void>;
     subscribeStream(stream: 'inventory' | 'mailbox' | 'payment_requests', handler: () => void): () => void;
+    /** §5.1: the latched server syncEpoch ('' before first server contact). */
+    currentEpoch(): string;
+    /**
+     * §5.1 restore hook — REQUIRED so an unwired restore protocol is a COMPILE
+     * ERROR: handlers run and are AWAITED on a syncEpoch change BEFORE any
+     * stream nudge resumes. The facade registers handleEpochChange here.
+     */
+    subscribeEpochChange(handler: (epoch: string) => Promise<void>): () => void;
+    /**
+     * Optional connection-status feed (same wiring pattern as the streams; the
+     * emission point is the session's existing `connection:status` transition).
+     * The facade's heartbeat resets its backoff on a 'connected' recovery.
+     */
+    subscribeStatus?(handler: (status: 'connected' | 'degraded' | 'offline') => void): () => void;
+}
+/**
+ * §5.1/§6 restore surface of the checkpoint store: re-POST the slot's cached
+ * encrypt-once ciphertext byte-identical after a server restore (insert-once,
+ * first-write-wins server-side). Returns false when no ciphertext is cached.
+ */
+interface CheckpointReseeder {
+    reseedCheckpoint(transferId: string, opIndex: number): Promise<boolean>;
 }
 interface IntentWireLike {
     transferId: string;
@@ -937,7 +1008,8 @@ interface PaymentsFacadeDeps {
     client: FacadeClient;
     storagePort: StoragePort;
     deliveryPort: DeliveryPort;
-    checkpointStore: SplitCheckpointStore;
+    /** Reseeder REQUIRED: the restore protocol re-POSTs cached ciphertexts (§5.1). */
+    checkpointStore: SplitCheckpointStore & CheckpointReseeder;
     /** Initial engine source; setEngine() swaps what FUTURE operations snapshot. */
     engineRef: () => ITokenEngine;
     kv: ScopedKV;
@@ -953,7 +1025,8 @@ interface PaymentsFacadeDeps {
     ownPubkey: string;
     ownNametag?: () => string | undefined;
     requestMemo: RequestMemoCodec;
-    syncEpoch?: () => string;
+    /** REQUIRED (§5.1): reads the session's current epoch — never a default. */
+    syncEpoch: () => string;
     now?: () => number;
     newId?: () => string;
     workBudget?: number;
@@ -975,11 +1048,20 @@ declare class PaymentsFacade implements PaymentsV2 {
     private readonly receiveLoop;
     private readonly heldStates;
     private readonly ownPubkeyBytes;
+    private readonly restoreDeps;
     readonly requests: Requests;
     private currentEngine;
     private readonly pendingOps;
     private unsubscribers;
     private started;
+    private readonly heartbeat;
+    private readonly converger;
+    /** Resume single-flight (§7): ticks, start() and resumeNow() coalesce onto ONE pass. */
+    private readonly resumeFlight;
+    /** §5.1/§7: restore + convergence passes SERIALIZE here. */
+    private readonly passChain;
+    /** §7 ownership: ids with an in-process machine attempt — the pass never adopts one. */
+    private readonly activeMoneyOps;
     constructor(deps: PaymentsFacadeDeps);
     start(): Promise<void>;
     /** §7 same-address restart gate: resolves only after in-flight ops settle. */
@@ -994,26 +1076,36 @@ declare class PaymentsFacade implements PaymentsV2 {
         before?: string;
         limit?: number;
     }): Promise<HistoryPage>;
+    /** §4 pending-transfers UI surface — derived on read, never cached (convergence.ts). */
+    pendingTransfers(): Promise<PendingTransfer[]>;
     send(request: SendRequest): Promise<TransferResult>;
     receive(): Promise<{
         transfers: IncomingTransfer[];
     }>;
     mint(coinId: string, amount: bigint): Promise<MintResult>;
+    resumeNow(): Promise<void>;
+    /** §5.1 restore — awaited by the session latch BEFORE streams resume; never coalesced onto a pre-restore pass. */
+    handleEpochChange(_newEpoch: string): Promise<void>;
+    /** One single-flighted pass + its reschedule: concurrent callers coalesce. */
+    private runConvergencePass;
+    private convergeBody;
+    private nowMs;
+    /** The ONE place a send() outcome is shaped: success emits in finishSend, a
+     *  CLEAN rejection emits `transfer:updated{status:'failed'}` here (§4). */
+    private sendOutcome;
+    /** Only a CLEAN failure (nothing certified, classifyError 'other') is 'failed'.
+     *  Keep-open/partial/conflict outcomes are pending/converging — labelling them
+     *  'failed' invites a dApp re-send, i.e. a double-pay (#631/#676). */
+    private emitCleanFailure;
     private sendWithPolicy;
     /** §5.6 cross-network deposit trap: refused BEFORE any reserve/certification. */
     private requireSameNetworkRecipient;
     private runAttempt;
-    /**
-     * Partial outcome (#677/#690): the shortfall is already durable (written by
-     * the machine BEFORE complete). Accumulate the settled set, then re-plan ONLY
-     * the remainder under a NEW transferId — never the full amount.
-     */
+    /** Partial (#677/#690): shortfall already durable (machine wrote it BEFORE
+     *  complete); accumulate settled, re-plan ONLY the remainder, NEW transferId. */
     private consumePartial;
-    /**
-     * One attempt's failure disposition: possibly-committed → rethrow UNWRAPPED;
-     * backstop still 'open' (committed>0) → converge via the same machine's
-     * resumeIntent; clean conflict with a demoted source → bounded full re-plan.
-     */
+    /** Failure disposition: possibly-committed → rethrow UNWRAPPED; backstop
+     *  'open' → converge via resumeIntent; clean demoted conflict → full re-plan. */
     private disposeFailedAttempt;
     /** #677/#690: ≥1 leg committed — the SAME machine, resumed in-process, converges it. */
     private convergePartial;
@@ -1033,28 +1125,28 @@ declare class PaymentsFacade implements PaymentsV2 {
     private refreshThenRelease;
     private accumulate;
     private finishSend;
-    /**
-     * With nothing delivered the error passes UNWRAPPED (identity + cause kept);
-     * after ≥1 delivered leg EVERY failure surfaces as PartialSendConflictError
-     * over the accumulated settled set — never bare, never a full-amount retry.
-     */
+    /** Nothing delivered → UNWRAPPED; after ≥1 delivered leg every failure surfaces as PartialSendConflictError over the settled set. */
     private partialize;
     /** #441: possibly-committed errors must carry the transferId for the settling journal. */
     private stampTransferId;
     private softAbort;
     private mintInner;
+    private mintUnderJournal;
     private finalizeMint;
+    /** @returns how many journal entries were RESOLVED (cleared) — heartbeat progress. */
     private replayMints;
     private replayMint;
     private mintParams;
     private tokenInServerInventory;
     private engine;
     private newId;
-    private runResume;
     private seedHeldStates;
     private toUiToken;
     private track;
     private trackTail;
 }
 
-export { ATTENTION_MINT_UNRESOLVED, type ApplyDeltaResult, type DeliverOptions, type DeliveryJournalEntry, type DeliveryPort, type DeliveryReceipt, type DeterministicMintCapable, type FacadeClient, type FacadeSession, type HistoryEntry, type HistoryPage, type IncomingDelivery, type IntentBackstopEntry, type IntentPayload, type InventoryAsset, type InventoryItem, type InventoryPage, MAX_RESELECT, type MintJournalEntry, type MintResult, type OpOutcome, type OutcomeClass, type PaymentRequestStatus, type PaymentRequestView, PaymentsFacade, type PaymentsFacadeDeps, type PaymentsRequestsApi, type PaymentsV2, type PaymentsV2Events, type PlannedOp, type RecipientInfo, STORE_KEYS, type ScopedKV, type SendRequest, type SettlingLink, type ShortfallEntry, type StoragePort, type StreamCursor, type StreamName, createScopedKV, supportsDeterministicMint };
+declare const HEARTBEAT_SEED_MS = 5000;
+declare const HEARTBEAT_CAP_MS = 120000;
+
+export { ATTENTION_MINT_UNRESOLVED, ATTENTION_RESEED_REJECTED, type ApplyDeltaResult, type CheckpointReseeder, type DeliverOptions, type DeliveryJournalEntry, type DeliveryPort, type DeliveryReceipt, type DeterministicMintCapable, type FacadeClient, type FacadeSession, HEARTBEAT_CAP_MS, HEARTBEAT_SEED_MS, type HistoryEntry, type HistoryPage, type IncomingDelivery, type IntentBackstopEntry, type IntentPayload, type InventoryAsset, type InventoryItem, type InventoryPage, MAX_RESELECT, type MintJournalEntry, type MintResult, type OpOutcome, type OutcomeClass, type PaymentRequestStatus, type PaymentRequestView, PaymentsFacade, type PaymentsFacadeDeps, type PaymentsRequestsApi, type PaymentsV2, type PaymentsV2Events, type PendingTransfer, type PlannedOp, type RecipientInfo, STORE_KEYS, type ScopedKV, type SendRequest, type SettlingLink, type ShortfallEntry, type StoragePort, type StreamCursor, type StreamName, createScopedKV, supportsDeterministicMint };