@dvmkit/dvmctl 0.3.2-rc.1 → 0.3.4-rc.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dvmkit/dvmctl",
-  "version": "0.3.2-rc.1",
+  "version": "0.3.4-rc.1",
   "description": "Builder CLI for creating, testing, and deploying Digital Vending Machines",
   "license": "Apache-2.0",
   "repository": {
@@ -29,14 +29,16 @@
     "node": ">=22"
   },
   "scripts": {
-    "build": "tsup --metafile && node scripts/check-bundled-notices.mjs",
+    "build": "node scripts/check-source-boundary.mjs && node scripts/check-bundled-skills.mjs && tsup --metafile && node scripts/check-bundled-notices.mjs",
     "lint": "eslint . --max-warnings 0",
     "typecheck": "tsc --noEmit",
-    "test": "node --test test/*.test.mjs",
-    "verify": "npm run build && npm run lint && npm run typecheck && npm test"
+    "test": "npm run test:source && npm run test:package",
+    "verify": "npm run build && npm run lint && npm run typecheck && npm test",
+    "test:source": "vitest run",
+    "test:package": "node --test test/*.test.mjs"
   },
   "dependencies": {
-    "@dvmkit/sdk": "0.1.5-rc.9"
+    "@dvmkit/sdk": "0.2.1-rc.9"
   },
   "optionalDependencies": {
     "pg": "8.20.0",
@@ -61,6 +63,7 @@
     "@eslint/js": "^10.0.1",
     "eslint": "^10.0.2",
     "globals": "^17.7.0",
-    "typescript-eslint": "^8.56.1"
+    "typescript-eslint": "^8.56.1",
+    "vitest": "5.0.2"
   }
 }

package/skills/build-dvm/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: build-dvm
 description: Build a first DVM with dvmkit. Use when asked to turn an idea into a paid HTTPS capability, scaffold or hand-write a DVM, implement a `configureDVM` handler, run it locally, verify Cashu, x402, or Tempo test payments, or prepare it for deployment. Do not use for changing the dvmkit platform, SDK internals, or a caller wallet unrelated to testing a DVM.
-compatibility: Node.js 22+, npm, the invited `@dvmkit/dvmctl` release, `@dvmkit/sdk@0.1.5-rc.9`, and `@dvmkit/dvm-cli@0.3.0`. Docker is needed only when this skill starts its local Cashu FakeWallet mint or performs a container build.
+compatibility: Node.js 22+, npm, the invited `@dvmkit/dvmctl` release, `@dvmkit/sdk@0.2.1-rc.9`, and `@dvmkit/dvm-cli@0.3.0`. Docker is needed only when this skill starts its local Cashu FakeWallet mint or performs a container build.
 allowed-tools: Bash Read Write Edit Glob Grep
 ---
 
@@ -64,7 +64,7 @@ Scaffold when it helps; a hand-written Node 22 project with `@dvmkit/sdk` is equ
 For a hand-written project, pin the admitted SDK exactly:
 
 ```bash
-npm install --save-exact @dvmkit/sdk@0.1.5-rc.9
+npm install --save-exact @dvmkit/sdk@0.2.1-rc.9
 ```
 
 ```bash

package/skills/build-dvm/references/local-cashu-test.md

@@ -84,18 +84,45 @@ dvm request --endpoint "$dvm_endpoint" --data "$DVM_INPUT" --rail cashu --mint "
   --max-increment "$DVM_PAYMENT_CAP" --max-payments 1 </dev/null >"$test_root/paid.json"
 dvm wallet show >"$test_root/after.json"
 job_id="$(node -p 'require(process.argv[1]).jobId' "$test_root/paid.json")"
-dvm receipts verify "$job_id" >"$test_root/verified.json"
-node - "$test_root/unpaid.json" "$test_root/before.json" "$test_root/after.json" "$test_root/paid.json" "$test_root/verified.json" <<'NODE'
-const [challengePath, beforePath, afterPath, paidPath, verifiedPath] = process.argv.slice(2);
-const challenge=require(challengePath), before=require(beforePath), after=require(afterPath), paid=require(paidPath), verified=require(verifiedPath);
+result_dir="$PWD/.dvmkit-test-results/$job_id"
+mkdir -p -m 700 "$result_dir"
+cp "$test_root/unpaid.json" "$test_root/before.json" "$test_root/after.json" "$test_root/paid.json" "$result_dir/"
+dvm messages "$job_id" --no-stream >/dev/null
+TMPDIR="$result_dir" dvm messages "$job_id" --no-stream --human | tee "$result_dir/artifacts.txt"
+retained_config="$result_dir/caller"
+node - "$DVM_CONFIG_DIR" "$retained_config" "$result_dir/messages.json" "$job_id" <<'NODE'
+const { mkdirSync, readFileSync, writeFileSync } = require("node:fs");
+const { join } = require("node:path");
+const [source, destination, resultPath, jobId] = process.argv.slice(2);
+const job = JSON.parse(readFileSync(join(source, "jobs.json"), "utf8")).find(item => item.id === jobId);
+if (!job) throw Error(`caller state did not retain ${jobId}`);
+const receipts = readFileSync(join(source, "receipts.jsonl"), "utf8").trim().split("\n").filter(Boolean).filter(line => JSON.parse(line).receipt?.job_id === jobId);
+if (receipts.length !== 1) throw Error(`expected one receipt for ${jobId}, found ${receipts.length}`);
+const messages = readFileSync(join(source, "messages", `${jobId}.jsonl`), "utf8").trim().split("\n").filter(Boolean).map(line => JSON.parse(line));
+const retainedMessages = messages.filter(message => ["text", "artifact", "complete", "cancel"].includes(message.type));
+if (!retainedMessages.some(message => message.type === "complete" || message.type === "cancel")) throw Error("caller state did not retain a terminal message");
+const retainedJob = { id: job.id, endpoint: job.endpoint, status: job.status, submittedAt: job.submittedAt, completedAt: job.completedAt, completion: job.completion, paymentsHonoured: job.paymentsHonoured, policy: job.policy };
+mkdirSync(join(destination, "messages"), { recursive: true, mode: 0o700 });
+writeFileSync(join(destination, "jobs.json"), `${JSON.stringify([retainedJob])}\n`, { mode: 0o600 });
+writeFileSync(join(destination, "receipts.jsonl"), `${receipts[0]}\n`, { mode: 0o600 });
+writeFileSync(join(destination, "messages", `${jobId}.jsonl`), `${retainedMessages.map(message => JSON.stringify(message)).join("\n")}\n`, { mode: 0o600 });
+writeFileSync(resultPath, `${JSON.stringify({ jobId, messages: retainedMessages })}\n`, { mode: 0o600 });
+NODE
+DVM_CONFIG_DIR="$retained_config" dvm receipts verify "$job_id" >"$result_dir/verified.json"
+node - "$result_dir/unpaid.json" "$result_dir/before.json" "$result_dir/after.json" "$result_dir/paid.json" "$result_dir/messages.json" "$result_dir/verified.json" <<'NODE'
+const [challengePath, beforePath, afterPath, paidPath, messagesPath, verifiedPath] = process.argv.slice(2);
+const challenge=require(challengePath), before=require(beforePath), after=require(afterPath), paid=require(paidPath), messages=require(messagesPath), verified=require(verifiedPath);
 const validReceiptStatuses = new Set(["verified", "verified_unattested"]);
 const expectedSats=challenge.required_msats/1000;
 if (before.total_sats-after.total_sats !== expectedSats) throw Error(`Cashu debit was ${before.total_sats-after.total_sats}, quote was ${expectedSats} sats`);
 if (!paid.jobId || paid.next_action !== null || !validReceiptStatuses.has(paid.receipt_verified)) throw Error("paid result is not terminal with a valid receipt signature");
 if (paid.receipt?.outcome !== "completed" || paid.receipt?.paid?.rail !== "cashu" || paid.receipt.paid.msats !== challenge.required_msats) throw Error("receipt is not bound to the 402 quote");
-if (verified.job_id !== paid.jobId || !validReceiptStatuses.has(verified.receipt_verified)) throw Error("stored receipt signature did not verify");
+if (!messages.messages?.some(message => message.type === "complete")) throw Error("paid messages did not complete");
+if ((paid.has_artifacts || paid.artifact_count > 0) && !messages.messages?.some(message => message.type === "artifact")) throw Error("paid result advertised an artifact that was not retrieved");
+if (verified.job_id !== paid.jobId || !validReceiptStatuses.has(verified.receipt_verified) || verified.receipt_checks?.result_hash !== "ok") throw Error("stored receipt and paid result hash did not verify");
 NODE
-cat "$test_root/paid.json"
+cat "$result_dir/paid.json"
+printf '\nPaid result and artifact evidence retained in %s\n' "$result_dir"
 ```
 
 The observed hosted-mint acceptance for a `$0.01` call quoted `12000` msats and debited `12` test sats. That is evidence from that rate snapshot, not a constant for future runs.

package/skills/build-dvm/references/local-tempo-test.md

@@ -56,17 +56,34 @@ dvm request --endpoint "$dvm_endpoint" --data "$DVM_INPUT" --rail tempo \
   --budget "$DVM_PAYMENT_CAP" --auto-pay-below "$DVM_PAYMENT_CAP" \
   --max-increment "$DVM_PAYMENT_CAP" --max-payments 1 </dev/null >"$test_root/paid.json"
 job_id="$(node -p 'require(process.argv[1]).jobId' "$test_root/paid.json")"
-dvm receipts verify "$job_id" >"$test_root/verified.json"
-node - "$test_root/unpaid.json" "$test_root/paid.json" "$test_root/verified.json" <<'NODE'
-const [challengePath,paidPath,verifiedPath]=process.argv.slice(2);const challenge=require(challengePath),paid=require(paidPath),verified=require(verifiedPath);
+result_dir="$PWD/.dvmkit-test-results/$job_id"
+mkdir -p -m 700 "$result_dir"
+cp "$test_root/unpaid.json" "$test_root/paid.json" "$result_dir/"
+dvm messages "$job_id" --no-stream >/dev/null
+TMPDIR="$result_dir" dvm messages "$job_id" --no-stream --human | tee "$result_dir/artifacts.txt"
+retained_config="$result_dir/caller"
+node - "$DVM_CONFIG_DIR" "$retained_config" "$result_dir/messages.json" "$job_id" <<'NODE'
+const { mkdirSync, readFileSync, writeFileSync }=require("node:fs");const { join }=require("node:path");const [source,destination,resultPath,jobId]=process.argv.slice(2);
+const job=JSON.parse(readFileSync(join(source,"jobs.json"),"utf8")).find(item=>item.id===jobId);if(!job)throw Error(`caller state did not retain ${jobId}`);
+const receipts=readFileSync(join(source,"receipts.jsonl"),"utf8").trim().split("\n").filter(Boolean).filter(line=>JSON.parse(line).receipt?.job_id===jobId);if(receipts.length!==1)throw Error(`expected one receipt for ${jobId}, found ${receipts.length}`);
+const messages=readFileSync(join(source,"messages",`${jobId}.jsonl`),"utf8").trim().split("\n").filter(Boolean).map(line=>JSON.parse(line));const retainedMessages=messages.filter(message=>["text","artifact","complete","cancel"].includes(message.type));if(!retainedMessages.some(message=>message.type==="complete"||message.type==="cancel"))throw Error("caller state did not retain a terminal message");
+const retainedJob={id:job.id,endpoint:job.endpoint,status:job.status,submittedAt:job.submittedAt,completedAt:job.completedAt,completion:job.completion,paymentsHonoured:job.paymentsHonoured,policy:job.policy};mkdirSync(join(destination,"messages"),{recursive:true,mode:0o700});
+writeFileSync(join(destination,"jobs.json"),`${JSON.stringify([retainedJob])}\n`,{mode:0o600});writeFileSync(join(destination,"receipts.jsonl"),`${receipts[0]}\n`,{mode:0o600});writeFileSync(join(destination,"messages",`${jobId}.jsonl`),`${retainedMessages.map(message=>JSON.stringify(message)).join("\n")}\n`,{mode:0o600});writeFileSync(resultPath,`${JSON.stringify({jobId,messages:retainedMessages})}\n`,{mode:0o600});
+NODE
+DVM_CONFIG_DIR="$retained_config" dvm receipts verify "$job_id" >"$result_dir/verified.json"
+node - "$result_dir/unpaid.json" "$result_dir/paid.json" "$result_dir/messages.json" "$result_dir/verified.json" <<'NODE'
+const [challengePath,paidPath,messagesPath,verifiedPath]=process.argv.slice(2);const challenge=require(challengePath),paid=require(paidPath),messages=require(messagesPath),verified=require(verifiedPath);
 const validReceiptStatuses=new Set(["verified","verified_unattested"]);
 if(!paid.jobId || paid.next_action!==null || !validReceiptStatuses.has(paid.receipt_verified)) throw Error("paid result is not terminal with a valid receipt signature");
 const receipt=paid.receipt;
 if(receipt?.outcome!=="completed" || receipt?.paid?.rail!=="tempo" || receipt.paid.msats!==challenge.required_msats) throw Error("receipt is not quote-bound Tempo");
 if(receipt.paid.native_amount!==10000 || receipt.paid.native_asset!=="usdc") throw Error("$0.01 must settle as exactly 10000 pathUSD micro-units");
-if(verified.job_id!==paid.jobId || !validReceiptStatuses.has(verified.receipt_verified)) throw Error("stored receipt signature did not verify");
+if(!messages.messages?.some(message=>message.type==="complete")) throw Error("paid messages did not complete");
+if((paid.has_artifacts || paid.artifact_count>0) && !messages.messages?.some(message=>message.type==="artifact")) throw Error("paid result advertised an artifact that was not retrieved");
+if(verified.job_id!==paid.jobId || !validReceiptStatuses.has(verified.receipt_verified) || verified.receipt_checks?.result_hash!=="ok") throw Error("stored receipt and paid result hash did not verify");
 NODE
-cat "$test_root/paid.json"
+cat "$result_dir/paid.json"
+printf '\nPaid result and artifact evidence retained in %s\n' "$result_dir"
 ```
 
 Stop if the Moderato chain check, faucet, balance, or cap fails. Do not switch to mainnet or fund a production wallet as a workaround.

package/skills/build-dvm/references/local-x402-test.md

@@ -58,17 +58,34 @@ dvm request --endpoint "$dvm_endpoint" --data "$DVM_INPUT" --rail x402 \
   --budget "$DVM_PAYMENT_CAP" --auto-pay-below "$DVM_PAYMENT_CAP" \
   --max-increment "$DVM_PAYMENT_CAP" --max-payments 1 </dev/null >"$test_root/paid.json"
 job_id="$(node -p 'require(process.argv[1]).jobId' "$test_root/paid.json")"
-dvm receipts verify "$job_id" >"$test_root/verified.json"
-node - "$test_root/unpaid.json" "$test_root/paid.json" "$test_root/verified.json" <<'NODE'
-const [challengePath,paidPath,verifiedPath]=process.argv.slice(2);const challenge=require(challengePath),paid=require(paidPath),verified=require(verifiedPath);
+result_dir="$PWD/.dvmkit-test-results/$job_id"
+mkdir -p -m 700 "$result_dir"
+cp "$test_root/unpaid.json" "$test_root/paid.json" "$result_dir/"
+dvm messages "$job_id" --no-stream >/dev/null
+TMPDIR="$result_dir" dvm messages "$job_id" --no-stream --human | tee "$result_dir/artifacts.txt"
+retained_config="$result_dir/caller"
+node - "$DVM_CONFIG_DIR" "$retained_config" "$result_dir/messages.json" "$job_id" <<'NODE'
+const { mkdirSync, readFileSync, writeFileSync }=require("node:fs");const { join }=require("node:path");const [source,destination,resultPath,jobId]=process.argv.slice(2);
+const job=JSON.parse(readFileSync(join(source,"jobs.json"),"utf8")).find(item=>item.id===jobId);if(!job)throw Error(`caller state did not retain ${jobId}`);
+const receipts=readFileSync(join(source,"receipts.jsonl"),"utf8").trim().split("\n").filter(Boolean).filter(line=>JSON.parse(line).receipt?.job_id===jobId);if(receipts.length!==1)throw Error(`expected one receipt for ${jobId}, found ${receipts.length}`);
+const messages=readFileSync(join(source,"messages",`${jobId}.jsonl`),"utf8").trim().split("\n").filter(Boolean).map(line=>JSON.parse(line));const retainedMessages=messages.filter(message=>["text","artifact","complete","cancel"].includes(message.type));if(!retainedMessages.some(message=>message.type==="complete"||message.type==="cancel"))throw Error("caller state did not retain a terminal message");
+const retainedJob={id:job.id,endpoint:job.endpoint,status:job.status,submittedAt:job.submittedAt,completedAt:job.completedAt,completion:job.completion,paymentsHonoured:job.paymentsHonoured,policy:job.policy};mkdirSync(join(destination,"messages"),{recursive:true,mode:0o700});
+writeFileSync(join(destination,"jobs.json"),`${JSON.stringify([retainedJob])}\n`,{mode:0o600});writeFileSync(join(destination,"receipts.jsonl"),`${receipts[0]}\n`,{mode:0o600});writeFileSync(join(destination,"messages",`${jobId}.jsonl`),`${retainedMessages.map(message=>JSON.stringify(message)).join("\n")}\n`,{mode:0o600});writeFileSync(resultPath,`${JSON.stringify({jobId,messages:retainedMessages})}\n`,{mode:0o600});
+NODE
+DVM_CONFIG_DIR="$retained_config" dvm receipts verify "$job_id" >"$result_dir/verified.json"
+node - "$result_dir/unpaid.json" "$result_dir/paid.json" "$result_dir/messages.json" "$result_dir/verified.json" <<'NODE'
+const [challengePath,paidPath,messagesPath,verifiedPath]=process.argv.slice(2);const challenge=require(challengePath),paid=require(paidPath),messages=require(messagesPath),verified=require(verifiedPath);
 const validReceiptStatuses=new Set(["verified","verified_unattested"]);
 if(!paid.jobId || paid.next_action!==null || !validReceiptStatuses.has(paid.receipt_verified)) throw Error("paid result is not terminal with a valid receipt signature");
 const receipt=paid.receipt;
 if(receipt?.outcome!=="completed" || receipt?.paid?.rail!=="x402" || receipt.paid.msats!==challenge.required_msats) throw Error("receipt is not quote-bound x402");
 if(receipt.paid.native_amount!==10000 || receipt.paid.native_asset!=="usdc") throw Error("$0.01 must settle as exactly 10000 micro-USDC");
-if(verified.job_id!==paid.jobId || !validReceiptStatuses.has(verified.receipt_verified)) throw Error("stored receipt signature did not verify");
+if(!messages.messages?.some(message=>message.type==="complete")) throw Error("paid messages did not complete");
+if((paid.has_artifacts || paid.artifact_count>0) && !messages.messages?.some(message=>message.type==="artifact")) throw Error("paid result advertised an artifact that was not retrieved");
+if(verified.job_id!==paid.jobId || !validReceiptStatuses.has(verified.receipt_verified) || verified.receipt_checks?.result_hash!=="ok") throw Error("stored receipt and paid result hash did not verify");
 NODE
-cat "$test_root/paid.json"
+cat "$result_dir/paid.json"
+printf '\nPaid result and artifact evidence retained in %s\n' "$result_dir"
 ```
 
 Stop on a missing balance, RPC/facilitator failure, or cap refusal. Do not replace the network, key, or cap without new approval.

package/skills/build-dvm/references/running-deployment.md

@@ -150,6 +150,8 @@ stage. VM resources go in `package.json`'s `dvmkit` field (`{ "dvmkit": { "memor
 
 ### Environment variables
 
+For cloud compute deployment automation, `dvmctl deploy --target cloud --env-stdin` accepts a piped JSON object of string environment values. They override the project `.env` for this deployment without rewriting it. Input must finish within 5 seconds and fit in 64 KiB. Send secret values through stdin; local, self-host, connect-tier, and dry-run deployments reject this flag.
+
 The SDK reads only `DVMKIT_*`-prefixed variables. Old unprefixed names (`MINTS`,
 `MPP_TEMPO_RECIPIENT`, `X402_PAY_TO`, etc.) and the legacy `DVMKIT_FIRST_PARTY` /
 `DVMKIT_ACCESS_TOKENS` / `DVMKIT_SKIP_PAYMENT` are gone — don't use them.