Class BankingApi

Every account the acting owner holds (the multi-account read).

The acting owner's routing payment credential (implant-first), or null.

The sync materialized balance of accountId (0 for an unknown id).

Boot seam (idempotent). The warm caches are loaded separately by AccountBalance.warm() / SupplyAggregate.warm() (awaited in AppBootstrap before this). Activation = the singleton's presence.

The corpo affiliation recorded on an account (readable via corpo).

Deposit a coin stack: coin → vault, balance credited 1:1 (custodial).

Drain money out of an account — the central-bank sink. Supply shrinks by amount; one logged drain row to the issuance sentinel. Throws if the account holds less than amount.

Ensure a venue's P&L account exists (owner = the venue's durable path), creating a primary one if absent — lazily, on first banking interaction at the venue. The bar's account the order/pnl/payroll flows resolve.

Every ledger row touching accountId on either side — the substrate read.

Float liquidity into an account — convenience over mint.

Report-lost: freeze a credential (account + balance untouched).

Issue/reissue a payment card linked 1:1 to accountId, into inventory.

Mint physical cash into into — the central-bank cash faucet (the genesis of circulating coin; supply grows). Returns the coin stack.

Mint money into an account — the central-bank faucet. Supply grows by amount; one logged mint row from the issuance sentinel to the target. Developer-gated at the verb layer; the actor is the context-derived author, never a parameter.

The sync total money supply (Σ mints − Σ drains).

The acting owner's account id at bankPath (no number typed).

Open the acting owner's account at a branch (idempotent). The first account an owner opens becomes their primary (receive-by-identity default); the bank's corpoKey affiliation is recorded on the row. The owner is the context-derived author, never a parameter. Returns the durable account id.

Pay a wage from an employer account to a worker's primary account — the P&L's labor line (wage/wages). Who is employed is authored; this is the payment only. Developer/employer-gated at the verb layer.

The ownerKey's primary account id — the receive-by-identity target.

A categorized read of an account's ledger — the bar's P&L: per-category signed net flow + a running balance that sits red by design (Law 1: a count, not a worth-assertion). A derive-on-read consumer, no backfill.

Replay the ledger for accountId into its balance — the audit seam. Byte-identical to the materialized cache (the rebuild-from-log invariant).

Rebuild the supply aggregate from a full ledger scan — the audit/repair.

The conservation audit: top-down supply vs bottom-up (Σ account balances

• Σ circulating coins). balanced is the reconciliation invariant; one of the two and only two reporting consumers (with the bar P&L).

Remit the demo sales tax on a sale from the seller's account to the placeholder treasury at the authored, inert rate — seller-collected, so it shows in the seller's P&L as a tax line; the treasury merely accumulates (no appropriation path). Returns the tax remitted (zero when the rate is absent). The bar loop calls this at point of sale.

Switch a credential's active account (the wallet verb; persists).

The uniform settlement primitive — one Charge, one method-as-parameter. Cash hands coin to the payee (off the governed ledger); credential authorizes an on-ledger debit/credit routed through the owning corpo bank (with optional remittance splits). Returns a receipt the scene reads to name what cleared.

Transfer balance → balance (conserving); only from your own account.

Withdraw cash: balance → coin, bounded by the branch till liquidity.