@dvmkit/sdk 0.1.0-rc.1 → 0.1.0-rc.2

package/dist/{revenue-reporter-M35KP6V7.js → revenue-reporter-GB4WKLDC.js}

@@ -8,7 +8,9 @@ var ENDPOINTS = {
   revenue: "/_internal/job-revenue",
   deposit: "/_internal/credit-deposit",
   release: "/_internal/credit-draw-release",
-  drain: "/_internal/credit-drain"
+  drain: "/_internal/credit-drain",
+  payout: "/_internal/payout",
+  expiry_release: "/_internal/credit-expiry-release"
 };
 var RevenueReporter = class _RevenueReporter {
   // 24h of failed retries
@@ -83,6 +85,79 @@ var RevenueReporter = class _RevenueReporter {
   async enqueueCreditDrain(tx, payload) {
     await this.insertPending(tx, "drain", payload);
   }
+  /**
+   * Join a payout to the transaction that commits the movement it reports
+   * (internal-review) — the batch close, the accumulator mark, the drain booking.
+   * No network I/O, only the durable queue row through `tx`, the discipline
+   * {@link enqueueCreditDrain} set and for the same reason: the money has
+   * already moved on a rail this ledger does not own, so the platform row is
+   * the only record the builder's dashboard has of it, and a row lost between
+   * the fact and the queue would understate "paid out" forever. Without `tx`
+   * the row is queued on the pool, for callers with no fact of their own to
+   * commit. Idempotent on `(dvmId, payoutId)` platform-side, so the retry
+   * loop redelivers freely.
+   */
+  async enqueuePayout(payload, tx) {
+    await this.insertPending(tx ?? this.db, "payout", payload);
+  }
+  /**
+   * Report one landed payout on its own and try to deliver it at once — the
+   * live Tempo settlement, which has no dvmkit transaction to join. Durable
+   * like {@link report}.
+   */
+  async reportPayout(payload) {
+    return this.enqueue("payout", payload, payload.payoutId);
+  }
+  /**
+   * Report one rail's pending-pool snapshot (internal-review). Best-effort and
+   * fire-and-forget, deliberately unlike {@link reportPayout}: a snapshot is
+   * replaced by the next tick, so queueing a stale one behind an outage would
+   * only deliver figures the platform already has newer ones for.
+   */
+  async reportPayoutPending(payload) {
+    const url = `${this.platformUrl}/_internal/payout-pending`;
+    try {
+      const res = await fetch(url, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${this.platformToken}`
+        },
+        body: JSON.stringify(payload),
+        signal: AbortSignal.timeout(1e4)
+      });
+      if (!res.ok) {
+        console.warn(
+          JSON.stringify({
+            level: "payout_pending_report_failed",
+            rail: payload.rail,
+            status: res.status
+          })
+        );
+      }
+    } catch (err) {
+      console.warn(
+        JSON.stringify({
+          level: "payout_pending_report_failed",
+          rail: payload.rail,
+          error: err instanceof Error ? err.message : String(err)
+        })
+      );
+    }
+  }
+  /**
+   * Join a credit-expiry release — or the revival that reverses one — to the
+   * transaction that made it true (internal-review).
+   *
+   * Same discipline as {@link enqueueCreditDrain}: no network I/O, only the
+   * durable queue row written through `tx`. A release whose row was lost after
+   * the sweep committed would understate committed value forever; a lost
+   * reversal would overstate it, which is the worse direction — the builder
+   * would see money as theirs that a revived credit can still buy work with.
+   */
+  async enqueueCreditExpiryRelease(tx, payload) {
+    await this.insertPending(tx, "expiry_release", payload);
+  }
   /**
    * Report a reaper-force-failed paid job to the platform (internal-review) so the
    * operator receives an ambient notice that a DVM died or wedged mid-job.
@@ -325,7 +400,7 @@ var RevenueReporter = class _RevenueReporter {
         [Date.now()]
       );
       for (const row of rows) {
-        const label = row.payload.jobId ?? row.payload.creditId ?? row.id;
+        const label = row.payload.jobId ?? row.payload.creditId ?? row.payload.payoutId ?? row.id;
         try {
           await this.attemptDelivery(row.id, row.payload, row.kind, label);
         } catch {

package/dist/server/index.d.ts

@@ -1,8 +1,8 @@
-import { X as CashuMode, R as ResolvedCreditConfig, Y as FundingMethod, _ as CreditLedgerLike, $ as CreditSnapshot, g as CreditView, a0 as CreditInvoiceRecord, a1 as CreditDepositEnqueue, a2 as InvoiceSettlement, Z as ZodLike, a as DVMDescriptor, K as KVStore, o as JobStore, a3 as MppxServer, a4 as X402Config, p as PaymentMethod, a5 as ClientCompatibilityGate, a6 as Message, a7 as FundingReceipt, a8 as TopUpCapUnenforcedReason, a9 as JobReceipt, aa as AppendOutgoingOptions, S as SDKJobContext, ab as StepCache, v as ResponseContent, P as PaymentContent, ac as X402Receipt, ad as X402ExactVersionSupport, ae as X402SettlementIntent, af as X402FacilitatorAuth, ag as X402BatchSettlementConfig, ah as PostgresX402ChannelStorage, ai as PaymentRequirementsV2, aj as CreditLedgerQuerier, ak as X402SettlementCursor, al as X402SettlementStatus, am as X402SettlementWriteOff, an as X402RefundSettlementGate, ao as MppxCredential, J as JobRecord, ap as ReceiptCredit, aq as DrainReceiptEvent, ar as DrainReceipt, z as SignedRequestAudience, as as CreditDrawReleaseEnqueue, at as CreditDepositPayload, au as RevenueSkippedNoRailPayload, av as MessageType, aw as ClientCompatibility, ax as CreditDrainEnqueue, ay as DVMAuthScheme, B as SignedRequestDomain, az as DrawResult, aA as X402UnresolvedRefund, aB as GrownDrawResult, aC as DrawResolution, aD as FundingRecord, aE as BlockedInvoiceCursor, aF as InvoiceReconciliation, aG as InvoiceWriteOff, aH as DrawRecord, aI as StalePendingDrawCursor, aJ as TempoCreditLossEvidence, aK as TempoCreditLoss, aL as X402CreditLossEvidence, aM as X402CreditLoss, aN as DrainMethod, aO as DrainRequestResult, aP as BitcoinDepositLiability, aQ as FundingLot, aR as CreditDrainRecord, aS as ChannelDrainCursor, aT as DrainWriteOff, aU as DrainReleaseResult, aV as DrainFulfilment, aW as DrainTransitionResult, aX as StreamableJobStore, aY as ReceiptIssuingStore, aZ as RequestIdClaim, a_ as RequestIdClaimResult, a$ as OutgoingMessage, b0 as PaymentCreditDelta, b1 as VerifyAndCreditResult, b2 as JobCounters, G as SignedRequestReplayStore } from '../job-store-C5n6bhap.js';
-export { b3 as CLIENT_COMPATIBILITY_HEADERS, d as CanonicalEnvelope, b4 as ClientCompatibilityEnv, b5 as ClientCompatibilityRequirement, b6 as ClientSemVer, e as CreateSignedRequestVerifierOpts, b7 as CreditFundingBasis, b8 as CreditInvoiceStatus, b9 as CreditLedger, ba as CreditLedgerError, bb as CreditLedgerErrorCode, bc as CreditLedgerErrorDetails, bd as CreditLedgerPool, be as CreditStatus, bf as DRAIN_DELIVERY_RESERVE_SATS, bg as DVM_PROTOCOL_VERSION, bh as DrainConflictReason, bi as DrawRailValue, bj as DrawStatus, n as JobStatus, bk as ReplayStoreBackend, bl as RevenueSkippedNoRailReason, x as SIGNED_REQUEST_AUTH_ID, y as SIGNED_REQUEST_STATEMENT_VERSION, bm as Secp256k1AuthOpts, E as SignedRequestError, F as SignedRequestFailure, H as SignedRequestSignOpts, M as SignedRequestStatementHeader, N as SignedRequestVerifier, bn as X402ChannelStorageOpts, bo as X402RelayLockHolder, bp as X402RelaySubmissionLock, bq as X402RelaySubmissionLockError, br as allocateDrawValue, bs as clientCompatibilityAttributes, bt as clientCompatibilityMiddleware, bu as clientUpgradeRequired, O as createSignedRequestVerifier, bv as isStreamableJobStore, bw as parseClientCapabilities, bx as parseClientCompatibility, by as parseDvmClient, bz as parseProtocolVersion, bA as requireClientCompatibility, bB as secp256k1Auth, bC as signedRequestInput, V as signedRequestStatementHeader } from '../job-store-C5n6bhap.js';
+import { X as CashuMode, R as ResolvedCreditConfig, Y as FundingMethod, _ as CreditLedgerLike, $ as CreditSnapshot, g as CreditView, a0 as CreditInvoiceRecord, a1 as CreditDepositEnqueue, a2 as InvoiceSettlement, Z as ZodLike, a as DVMDescriptor, K as KVStore, o as JobStore, a3 as MppxServer, a4 as X402Config, p as PaymentMethod, a5 as ClientCompatibilityGate, a6 as Message, a7 as FundingReceipt, a8 as TopUpCapUnenforcedReason, a9 as JobReceipt, aa as AppendOutgoingOptions, S as SDKJobContext, ab as StepCache, v as ResponseContent, P as PaymentContent, ac as X402Receipt, ad as X402ExactVersionSupport, ae as X402SettlementIntent, af as X402FacilitatorAuth, ag as X402BatchSettlementConfig, ah as PostgresX402ChannelStorage, ai as PaymentRequirementsV2, aj as CreditLedgerQuerier, ak as X402SettlementCursor, al as X402SettlementStatus, am as X402SettlementWriteOff, an as X402RefundSettlementGate, ao as MppxCredential, J as JobRecord, ap as ReceiptCredit, aq as DrainReceiptEvent, ar as DrainReceipt, z as SignedRequestAudience, as as CreditDrawReleaseEnqueue, at as CreditDepositPayload, au as RevenueSkippedNoRailPayload, av as MessageType, aw as ClientCompatibility, ax as CreditDrainEnqueue, ay as DVMAuthScheme, B as SignedRequestDomain, az as DrawResult, aA as X402UnresolvedRefund, aB as GrownDrawResult, aC as DrawResolution, aD as FundingRecord, aE as BlockedInvoiceCursor, aF as InvoiceReconciliation, aG as InvoiceWriteOff, aH as DrawRecord, aI as StalePendingDrawCursor, aJ as TempoCreditLossEvidence, aK as TempoCreditLoss, aL as X402CreditLossEvidence, aM as X402CreditLoss, aN as DrainMethod, aO as DrainRequestResult, aP as BitcoinDepositLiability, aQ as FundingLot, aR as CreditDrainRecord, aS as ChannelDrainCursor, aT as DrainWriteOff, aU as DrainReleaseResult, aV as DrainFulfilment, aW as DrainTransitionResult, aX as StreamableJobStore, aY as ReceiptIssuingStore, aZ as RequestIdClaim, a_ as RequestIdClaimResult, a$ as OutgoingMessage, b0 as PaymentCreditDelta, b1 as VerifyAndCreditResult, b2 as JobCounters, G as SignedRequestReplayStore } from '../job-store-6gR4pZRP.js';
+export { b3 as CLIENT_COMPATIBILITY_HEADERS, d as CanonicalEnvelope, b4 as ClientCompatibilityEnv, b5 as ClientCompatibilityRequirement, b6 as ClientSemVer, e as CreateSignedRequestVerifierOpts, b7 as CreditFundingBasis, b8 as CreditInvoiceStatus, b9 as CreditLedger, ba as CreditLedgerError, bb as CreditLedgerErrorCode, bc as CreditLedgerErrorDetails, bd as CreditLedgerPool, be as CreditStatus, bf as DRAIN_DELIVERY_RESERVE_SATS, bg as DVM_PROTOCOL_VERSION, bh as DrainConflictReason, bi as DrawRailValue, bj as DrawStatus, n as JobStatus, bk as ReplayStoreBackend, bl as RevenueSkippedNoRailReason, x as SIGNED_REQUEST_AUTH_ID, y as SIGNED_REQUEST_STATEMENT_VERSION, bm as Secp256k1AuthOpts, E as SignedRequestError, F as SignedRequestFailure, H as SignedRequestSignOpts, M as SignedRequestStatementHeader, N as SignedRequestVerifier, bn as X402ChannelStorageOpts, bo as X402RelayLockHolder, bp as X402RelaySubmissionLock, bq as X402RelaySubmissionLockError, br as allocateDrawValue, bs as clientCompatibilityAttributes, bt as clientCompatibilityMiddleware, bu as clientUpgradeRequired, O as createSignedRequestVerifier, bv as isStreamableJobStore, bw as parseClientCapabilities, bx as parseClientCompatibility, by as parseDvmClient, bz as parseProtocolVersion, bA as requireClientCompatibility, bB as secp256k1Auth, bC as signedRequestInput, V as signedRequestStatementHeader } from '../job-store-6gR4pZRP.js';
 import { Pool } from 'pg';
-import { F as FxFetcher } from '../ssrf-BdHsrrIb.js';
-export { P as PinnedFetch, S as SSRFError, e as SSRFGuardOpts, f as SSRFReason, g as SSRFResolver, h as assertSafeUrl, j as createPinnedFetch } from '../ssrf-BdHsrrIb.js';
+import { F as FxFetcher } from '../ssrf-DZi-xJyn.js';
+export { P as PinnedFetch, S as SSRFError, e as SSRFGuardOpts, f as SSRFReason, g as SSRFResolver, h as assertSafeUrl, j as createPinnedFetch } from '../ssrf-DZi-xJyn.js';
 import { Hono, Context } from 'hono';
 import { z } from 'zod';
 import { ProofLike } from '@cashu/cashu-ts';
@@ -11,6 +11,56 @@ import { Channel, AutoSettlementConfig } from '@x402/evm/batch-settlement/server
 import 'mppx';
 import '@x402/core/server';
 
+/** The channel view the tracker sums claims over. */
+interface X402TrackedChannel {
+    channelId: string;
+    chargedCumulativeAmount: string;
+    totalClaimed: string;
+}
+/** A refund settlement wedged between chain and ledger (internal-review), for the wedge list. */
+interface X402WedgedRefund {
+    settlementId: string;
+    /** Epoch ms the settlement was first prepared. */
+    createdAt: number;
+    native?: number;
+}
+/** What the batch-settlement server hands the tracker once it knows its scope. */
+interface X402PayoutContext {
+    /** `${network}|${payTo}|${token}` — the scope the settle-pending marker is keyed on. */
+    scope: string;
+    payTo: string;
+    network: string;
+    storage: {
+        list(): Promise<X402TrackedChannel[]>;
+    };
+    /** The scheduler's settle cadence — what a wedge's `nextRetry` is derived from. */
+    settleIntervalMs: number;
+    listWedgedRefunds?: () => Promise<X402WedgedRefund[]>;
+}
+/** The two manager verbs the tracker wraps. */
+interface X402TrackedManager {
+    claim(...args: never[]): Promise<{
+        vouchers: number;
+        transaction: string;
+    }[]>;
+    settle(): Promise<{
+        transaction: string;
+    }>;
+}
+/**
+ * The batch-settlement server's view of the reporter: attach once with the
+ * scope, then route every claim and settle through the tracked manager so
+ * the open batch is kept and the settle emits the payout.
+ */
+interface X402PayoutObserver {
+    attach(ctx: X402PayoutContext): void;
+    trackManager<M extends X402TrackedManager>(manager: M): M;
+    /** A settle that landed outside the tracked manager — the manual claim-and-settle's own retry loop. */
+    recordSettle(transaction: string): Promise<void>;
+    /** A settle attempt that failed outside the tracked manager. One call per attempt a builder would count as one. */
+    recordSettleFailure(error: unknown): Promise<void>;
+}
+
 declare const lockPubkeyBrand: unique symbol;
 /**
  * NUT-11 P2PK lock pubkey, lowercase-by-construction. Hex-encoded compressed
@@ -1972,6 +2022,16 @@ interface CreateX402BatchSettlementServerOpts {
     settlementEvidenceReader?: X402SettlementEvidenceReader;
     /** Authoritative channel-view override for deterministic tests. */
     channelStateReader?: (channelId: string) => Promise<X402BatchChannelObservation>;
+    /**
+     * The payout tracker (internal-review). Attached with this server's settle scope
+     * and routed every claim and settle, so the batch that lands at `pay_to` is
+     * reported with the value claimed into it, and the pending snapshot can say
+     * what is still on the channels and whether the settle is wedged.
+     *
+     * @internal Wired by `createDVMServer` from the platform reporter; not a
+     * builder surface, and not part of the extractable SDK contract (internal-review).
+     */
+    payout?: X402PayoutObserver;
 }
 /**
  * Initialize upstream's scheme and channel manager against dvmkit storage.

package/dist/server/index.js

@@ -1,15 +1,15 @@
+import {
+  PostgresReplayStore
+} from "../chunk-L4OYF4DQ.js";
 import {
   MemoryCreditLedger
-} from "../chunk-NTK5DJ6R.js";
+} from "../chunk-OJ5WFIB2.js";
 import {
   PostgresJobStore
 } from "../chunk-6JZIX5WW.js";
 import {
   PostgresKVStore
 } from "../chunk-FROTD5XQ.js";
-import {
-  PostgresReplayStore
-} from "../chunk-L4OYF4DQ.js";
 import {
   RAIL_REFUNDABLE,
   SIGNED_ENVELOPE_FIELDS,
@@ -82,7 +82,7 @@ import {
   isNonChannelBitcoinRail,
   netOwedSats,
   x402SettlementPending
-} from "../chunk-RPXHKMYE.js";
+} from "../chunk-365P52XQ.js";
 import {
   applyRetryToPool,
   withPostgresRecoveryContext
@@ -3176,11 +3176,20 @@ async function createX402BatchSettlementServer(opts) {
     read: () => postgres.isSettlePending(settleScope),
     write: (pending) => postgres.setSettlePending(settleScope, pending)
   } : void 0;
+  opts.payout?.attach({
+    scope: settleScope,
+    payTo: opts.payTo,
+    network: opts.network,
+    storage,
+    settleIntervalMs: (settlementConfig.settleIntervalSecs ?? X402_BATCH_AUTO_SETTLEMENT.settleIntervalSecs ?? 300) * 1e3,
+    ...postgres ? { listWedgedRefunds: () => listWedgedRefunds(postgres) } : {}
+  });
+  const tracked = opts.payout ? opts.payout.trackManager(manager) : manager;
   let scheduler;
   if (opts.config.autoSettlement !== false) {
     if (postgres && marker) {
       scheduler = createX402FleetSettlementScheduler({
-        manager,
+        manager: tracked,
         storage,
         config: settlementConfig,
         withLock: (operation) => postgres.withFleetSettlementLock(operation),
@@ -3521,7 +3530,7 @@ async function createX402BatchSettlementServer(opts) {
       if ("withdrawalPending" in result) {
         try {
           const claim = async () => {
-            const results = await manager.claim({
+            const results = await tracked.claim({
               maxClaimsPerBatch: 100,
               selectClaimChannels: (channels, context) => claimCeiling(
                 channels.filter(
@@ -3567,13 +3576,19 @@ async function createX402BatchSettlementServer(opts) {
     } : {},
     async claimAndSettle() {
       const operation = async () => {
-        const claims = await manager.claim({
+        const claims = await tracked.claim({
           maxClaimsPerBatch: 100,
           selectClaimChannels: claimCeiling
         });
         if (claims.length > 0) await marker?.write(true);
         if (claims.length === 0 && !await marker?.read()) return;
-        await settleOutstandingClaims(manager);
+        try {
+          const settled = await settleOutstandingClaims(manager);
+          await opts.payout?.recordSettle(settled.transaction);
+        } catch (error) {
+          await opts.payout?.recordSettleFailure(error);
+          throw error;
+        }
         await marker?.write(false);
       };
       if (postgres) await postgres.withFleetSettlementLock(operation, true);
@@ -3588,12 +3603,27 @@ async function createX402BatchSettlementServer(opts) {
     }
   };
 }
+async function listWedgedRefunds(postgres) {
+  const page = await postgres.listSettlements({
+    statuses: X402_WEDGED_SETTLEMENT_STATUSES,
+    updatedBeforeMs: Date.now() - WEDGED_REFUND_MIN_AGE_MS,
+    limit: 50
+  });
+  return page.settlements.filter((intent) => intent.operation === "refund").map((intent) => {
+    const amount = intent.response?.amount;
+    return {
+      settlementId: intent.settlementId,
+      createdAt: intent.createdAt,
+      ...typeof amount === "string" && /^\d{1,15}$/.test(amount) ? { native: Number(amount) } : {}
+    };
+  });
+}
+var WEDGED_REFUND_MIN_AGE_MS = 5 * 6e4;
 async function settleOutstandingClaims(manager) {
   const retryDelaysMs = [250, 500, 1e3, 2e3];
   for (let attempt = 0; ; attempt++) {
     try {
-      await manager.settle();
-      return;
+      return await manager.settle();
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       if (!message.includes("invalid_batch_settlement_evm_nothing_to_settle") || attempt >= retryDelaysMs.length) {
@@ -9732,8 +9762,29 @@ async function handleMarkMelted(c, opts) {
       );
     }
   }
-  await recordMeltAudit(opts.db, rowIds, { meltQuoteId, paymentPreimage });
-  await markRowsMelted(opts.db, rowIds);
+  const client = await opts.db.connect();
+  try {
+    await client.query("BEGIN");
+    await recordMeltAudit(client, rowIds, { meltQuoteId, paymentPreimage });
+    await markRowsMelted(client, rowIds);
+    if (opts.onMelted) {
+      await opts.onMelted.enqueue(
+        {
+          rows: rows.map((r) => ({ id: r.id, mintUrl: r.mintUrl, proofAmount: r.proofAmount })),
+          meltQuoteId,
+          paymentPreimage
+        },
+        client
+      );
+    }
+    await client.query("COMMIT");
+  } catch (err) {
+    await client.query("ROLLBACK").catch(() => void 0);
+    throw err;
+  } finally {
+    client.release();
+  }
+  opts.onMelted?.committed();
   return c.json({ melted: rowIds.length });
 }
 async function handleRestartFailed(c, opts) {
@@ -10877,7 +10928,11 @@ async function handleReconcileInvoice(c, opts) {
             amountMicro: invoice.amountMicro,
             creditCurrency: invoice.currency,
             fundedAt: settledAtMs ?? invoice.settledAt ?? nowMs,
-            expiryMs
+            expiryMs,
+            // The settlements table types this deposit `repair` off the
+            // flag (internal-review): the sats landed at payment time and the
+            // deposit is the one row they get.
+            repaired: true
           }
         }
       } : {},
@@ -11228,8 +11283,10 @@ async function handleReconcileTempo(c, opts) {
   if (record.status === "sent") return tempoReconciledBody(c, record, channelId, true);
   const evidence = await classifyTempoCloseEvidence(rail.rail, channelId);
   if (evidence.chain !== "found") return tempoEvidenceRefusal(c, evidence);
+  const client = await opts.db.connect();
   let booked;
   try {
+    await client.query("BEGIN");
     booked = await completeTempoChannelDrain({
       deps: {
         ledger: opts.ledger,
@@ -11245,14 +11302,30 @@ async function handleReconcileTempo(c, opts) {
       refundedNative: evidence.refundedToPayer,
       debitedNative: record.drainedNative,
       reference: evidence.transaction,
-      repaired: true
+      repaired: true,
+      tx: client
     });
+    if (opts.onTempoDrainReconciled && !booked.replayed) {
+      await opts.onTempoDrainReconciled.enqueue(
+        {
+          channelId,
+          txHash: evidence.transaction,
+          settledToPayee: evidence.settledToPayee
+        },
+        client
+      );
+    }
+    await client.query("COMMIT");
   } catch (err) {
+    await client.query("ROLLBACK").catch(() => void 0);
     if (err instanceof CreditLedgerError) {
       return c.json({ error: err.code, message: err.message }, ledgerRefusalStatus(err.code));
     }
     throw err;
+  } finally {
+    client.release();
   }
+  if (!booked.replayed) opts.onTempoDrainReconciled?.committed();
   if (opts.receiptIssuer && !booked.replayed) {
     const receipt = opts.receiptIssuer.issueDrain({
       creditId: booked.drain.creditId,
@@ -11922,6 +11995,58 @@ function parseSerializedDleq(raw) {
   return { e: dleq.e, s: dleq.s, ...dleq.r !== void 0 ? { r: dleq.r } : {} };
 }
 
+// src/sdk/server/credit-expiry-sweep.ts
+function startCreditExpirySweep(ledger, opts = {}) {
+  const sweepExpiredCredits = ledger.sweepExpiredCredits?.bind(ledger);
+  if (!sweepExpiredCredits) return void 0;
+  const intervalMs = opts.intervalMs ?? DEFAULT_SWEEP_INTERVAL_MS;
+  const bootDelayMs = opts.bootDelayMs ?? DEFAULT_BOOT_DELAY_MS;
+  let stopped = false;
+  const runOnce = () => sweepExpiredCredits({ limit: opts.limit });
+  const pass = () => {
+    if (stopped) return;
+    void runOnce().then(({ released }) => {
+      if (released.length === 0) return;
+      console.log(
+        JSON.stringify({
+          level: "credit_expiry_released",
+          count: released.length,
+          credits: released.map((r) => r.creditId)
+        })
+      );
+    }).catch((err) => {
+      console.error(
+        JSON.stringify({
+          level: "credit_expiry_sweep_failed",
+          error: err instanceof Error ? err.message : String(err)
+        })
+      );
+    });
+  };
+  let bootTimer;
+  if (bootDelayMs > 0) {
+    bootTimer = setTimeout(pass, bootDelayMs);
+    bootTimer.unref();
+  }
+  let intervalTimer;
+  if (intervalMs > 0) {
+    intervalTimer = setInterval(pass, intervalMs);
+    intervalTimer.unref();
+  }
+  return {
+    stop() {
+      stopped = true;
+      if (bootTimer) clearTimeout(bootTimer);
+      if (intervalTimer) clearInterval(intervalTimer);
+      bootTimer = void 0;
+      intervalTimer = void 0;
+    },
+    runOnce
+  };
+}
+var DEFAULT_SWEEP_INTERVAL_MS = 60 * 60 * 1e3;
+var DEFAULT_BOOT_DELAY_MS = 3e4;
+
 // src/sdk/server/dev-page.ts
 function devPageHtml(dvmName) {
   const escaped = dvmName.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
@@ -12863,7 +12988,7 @@ function jobCredentialGate(opts) {
         // a human verbatim, so the conditional advice lives in `hint`, which
         // is what the agent acts on.
         display: "Couldn't retrieve your result \u2014 the request was missing its job credential.",
-        hint: `Send the job_token from the POST /v1/job response as the X-Job-Token header${alternative}. The token is minted once, at submit, and the DVM cannot reissue it \u2014 a job submitted from another machine, or by a caller that never stored it, can't be read here. If your caller never sends X-Job-Token at all, upgrade: npm i -g @dvmkit/cli@0.1.0.`
+        hint: `Send the job_token from the POST /v1/job response as the X-Job-Token header${alternative}. The token is minted once, at submit, and the DVM cannot reissue it \u2014 a job submitted from another machine, or by a caller that never stored it, can't be read here. If your caller never sends X-Job-Token at all, upgrade: npm i -g @dvmkit/dvm-cli@0.1.4.`
       };
     }
   };
@@ -17116,12 +17241,24 @@ async function createDVMServer(descriptor, opts) {
   const platformUrl = opts.platformUrl ?? envMaybe.DVMKIT_PLATFORM_URL;
   const dvmId = opts.dvmId;
   let revenueReporter;
+  let payoutReporter;
   if (!opts.onJobCompleted && platformToken && platformUrl && dvmId && opts.db) {
-    const { RevenueReporter } = await import("../revenue-reporter-M35KP6V7.js");
+    const { RevenueReporter } = await import("../revenue-reporter-GB4WKLDC.js");
     const reporter = new RevenueReporter(opts.db, platformUrl, platformToken);
     await reporter.init();
     reporter.startRetryLoop();
     revenueReporter = reporter;
+    const { MemoryX402BatchStore, PayoutReporter } = await import("../payout-reporter-4TNWRS5F.js");
+    payoutReporter = new PayoutReporter({
+      dvmId,
+      db: opts.db,
+      transport: reporter,
+      // The same condition the admin routes and the accumulator monitor mount on.
+      cashu: opts.cashuMode === "p2pk-accumulator" && !!opts.lockPubkey,
+      ...typeof opts.db.connect === "function" ? {} : { batchStore: new MemoryX402BatchStore() }
+    });
+    await payoutReporter.init();
+    payoutReporter.start();
   }
   assertRevenueReporterReady({
     failFast: opts.failFast ?? false,
@@ -17164,6 +17301,13 @@ async function createDVMServer(descriptor, opts) {
   });
   opts.tempoSettlementReadiness?.start();
   const creditLedger = opts.creditLedger ?? new MemoryCreditLedger();
+  if (revenueReporter && dvmId) {
+    creditLedger.useCreditExpiryReleaseOutbox?.({
+      dvmId,
+      enqueue: revenueReporter.enqueueCreditExpiryRelease.bind(revenueReporter)
+    });
+  }
+  const creditExpirySweep = startCreditExpirySweep(creditLedger, opts.creditExpirySweep);
   const processedPayments = opts.processedPayments ?? new MemoryProcessedPaymentStore();
   const bootX402Support = opts.x402 ? opts.x402FacilitatorHealth?.support() ?? configuredX402FacilitatorSupport(opts.x402) : void 0;
   const x402Config = opts.x402;
@@ -17214,7 +17358,8 @@ async function createDVMServer(descriptor, opts) {
     db: opts.db,
     allowInMemory: opts.devMode,
     earnedNative: (channelId) => creditLedger.earnedNativeForX402Channel(channelId),
-    supportedResponse: selfRelayEnabled ? void 0 : opts.x402FacilitatorHealth?.supportedResponse?.()
+    supportedResponse: selfRelayEnabled ? void 0 : opts.x402FacilitatorHealth?.supportedResponse?.(),
+    payout: payoutReporter?.x402Observer()
   }) : void 0;
   const x402BatchSettlement = x402BatchSettlementFactory && (bootX402Support?.batchSettlement || selfRelayEnabled) ? await x402BatchSettlementFactory() : void 0;
   const x402ExactStore = x402Config && opts.db && typeof opts.db.connect === "function" ? new PostgresX402ExactSettlementStore(opts.db) : void 0;
@@ -17251,21 +17396,25 @@ async function createDVMServer(descriptor, opts) {
     enqueueCreditDrawRelease,
     x402BatchSettlement,
     x402BatchSettlementFactory,
-    x402ExactSettlement
+    x402ExactSettlement,
+    payoutReporter
   });
   return {
     app: server.app,
     authAudience: server.authAudience,
     shutdown() {
       const settlementStopped = server.shutdown();
+      payoutReporter?.stop();
       revenueReporter?.stop();
+      creditExpirySweep?.stop();
       unsubscribeTempoSettlementReadiness?.();
       if (x402ChannelStorage) {
         void settlementStopped.then(() => x402ChannelStorage.close()).catch(() => void 0);
       }
     },
     jobManager: server.jobManager,
-    revenueReporterActive: !!revenueReporter
+    revenueReporterActive: !!revenueReporter,
+    payoutReporter
   };
 }
 function unknownRouteNotFound(c) {
@@ -17540,12 +17689,16 @@ var DVMServer = class {
     if (this.opts.cashuMode === "p2pk-accumulator" && this.opts.db && this.opts.dvmId && this.opts.lockPubkey) {
       const db = this.opts.db;
       const dvmId = this.opts.dvmId;
+      const payoutReporter = this.opts.payoutReporter;
       installAdminCashuRoutes(this.app, {
         db,
         dvmId,
         getLockPubkeyState: () => this.loadActiveLockPubkeyState(db, dvmId),
         graceSeconds: this.graceSeconds(),
-        nonceStore: this.adminCashuNonceStore
+        nonceStore: this.adminCashuNonceStore,
+        // internal-review: a completed melt is a landed payout, queued in the
+        // transaction that marks it.
+        ...payoutReporter ? { onMelted: payoutReporter.meltHook() } : {}
       });
       installAdminCreditRoutes(this.app, {
         db,
@@ -17575,7 +17728,10 @@ var DVMServer = class {
         // Health-filtered, and read per request rather than captured: the
         // servicer picking a mint to buy a refund at wants the list that
         // excludes a mint currently failing its probe (internal-review).
-        mints: () => this.advertisedMints()
+        mints: () => this.advertisedMints(),
+        // internal-review: a repaired Tempo close is a landed payout the agent
+        // finished, queued in the transaction that books the drain.
+        ...payoutReporter ? { onTempoDrainReconciled: payoutReporter.tempoRepairHook() } : {}
       });
     }
   }
@@ -21613,6 +21769,9 @@ function createDVMHost(opts = {}) {
   let pgPool;
   let creditLedger;
   let tempoSessionStore;
+  const tempoPayoutReader = {};
+  const payoutSinks = {};
+  let tempoPayoutOwner;
   let tempoSettlementReadiness;
   let processedPayments;
   let pgStreamStore;
@@ -21764,6 +21923,7 @@ ${config.facilitatorAuth?.keyId ?? ""}`;
         ]);
         const sessionStore = new PostgresTempoSessionStore(pgPool);
         tempoSessionStore = sessionStore;
+        tempoPayoutReader.listActive = (limit, cursor) => sessionStore.listActive(limit, cursor);
         pendingInits.push(sessionStore.init());
         const operator = privateKeyToAccount5(tempoOperatorKey);
         const tempoCurrency = envMaybe.DVMKIT_TEMPO_CURRENCY ?? TEMPO_USDC_MAINNET;
@@ -21826,6 +21986,13 @@ ${config.facilitatorAuth?.keyId ?? ""}`;
                 delta: settlement.delta.toString()
               })
             );
+            await payoutSinks.tempoSettled?.({
+              txHash: settlement.txHash,
+              channelId: settlement.channelId,
+              trigger: settlement.trigger,
+              amount: settlement.amount,
+              delta: settlement.delta
+            });
           }
         };
       }
@@ -21916,7 +22083,7 @@ ${config.facilitatorAuth?.keyId ?? ""}`;
       sharedPgConsumedStore = consumedStore;
     }
     if (pgPool) {
-      const { CreditLedger: CreditLedger2 } = await import("../credit-ledger-EDMEZSA2.js");
+      const { CreditLedger: CreditLedger2 } = await import("../credit-ledger-RO4FGSHG.js");
       const pgLedger = new CreditLedger2(pgPool, tempoSessionStore);
       pendingInits.push(pgLedger.init());
       creditLedger = pgLedger;
@@ -21925,7 +22092,7 @@ ${config.facilitatorAuth?.keyId ?? ""}`;
       pendingInits.push(pgProcessed.init());
       processedPayments = pgProcessed;
     } else {
-      const { MemoryCreditLedger: MemoryCreditLedger2 } = await import("../memory-credit-ledger-7TTZDSRS.js");
+      const { MemoryCreditLedger: MemoryCreditLedger2 } = await import("../memory-credit-ledger-I2G64DDK.js");
       creditLedger = new MemoryCreditLedger2();
       const { MemoryProcessedPaymentStore: MemoryProcessedPaymentStore2 } = await import("../processed-payment-store-HAA4SFNK.js");
       processedPayments = new MemoryProcessedPaymentStore2();
@@ -21999,7 +22166,8 @@ ${config.facilitatorAuth?.keyId ?? ""}`;
       const {
         app: subApp,
         shutdown,
-        authAudience
+        authAudience,
+        payoutReporter
       } = await createDVMServer(descriptor, {
         env,
         store,
@@ -22034,6 +22202,16 @@ ${config.facilitatorAuth?.keyId ?? ""}`;
         tempoSettlementReadiness
       });
       entry.shutdown = shutdown;
+      if (payoutReporter && !tempoPayoutOwner) {
+        tempoPayoutOwner = payoutReporter;
+        const ledger = creditLedger;
+        payoutReporter.attachTempo({
+          ...tempoPayoutReader,
+          ...mppTempoRecipient ? { recipient: mppTempoRecipient } : {},
+          listChannelDrains: (args) => ledger.listChannelDrains(args)
+        });
+        payoutSinks.tempoSettled = (event) => payoutReporter.tempoSettled(event);
+      }
       if (descriptor.config.routes) {
         await descriptor.config.routes(subApp, {
           authAudience,

package/dist/{ssrf-BdHsrrIb.d.ts → ssrf-DZi-xJyn.d.ts}

@@ -1,4 +1,4 @@
-import { C as Currency } from './job-store-C5n6bhap.js';
+import { C as Currency } from './job-store-6gR4pZRP.js';
 
 /**
  * Quote-time fx snapshot. Embedded in scribe's `lockedQuote` for within-job

package/dist/testing/index.d.ts

@@ -1,4 +1,4 @@
-import { aX as StreamableJobStore, aY as ReceiptIssuingStore, J as JobRecord, aZ as RequestIdClaim, a_ as RequestIdClaimResult, a9 as JobReceipt, a$ as OutgoingMessage, aa as AppendOutgoingOptions, b0 as PaymentCreditDelta, b1 as VerifyAndCreditResult, b2 as JobCounters, a6 as Message, av as MessageType, K as KVStore, L as Logger, v as ResponseContent, P as PaymentContent, S as SDKJobContext } from '../job-store-C5n6bhap.js';
+import { aX as StreamableJobStore, aY as ReceiptIssuingStore, J as JobRecord, aZ as RequestIdClaim, a_ as RequestIdClaimResult, a9 as JobReceipt, a$ as OutgoingMessage, aa as AppendOutgoingOptions, b0 as PaymentCreditDelta, b1 as VerifyAndCreditResult, b2 as JobCounters, a6 as Message, av as MessageType, K as KVStore, L as Logger, v as ResponseContent, P as PaymentContent, S as SDKJobContext } from '../job-store-6gR4pZRP.js';
 import '@cashu/cashu-ts';
 import 'mppx';
 import 'hono';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dvmkit/sdk",
-  "version": "0.1.0-rc.1",
+  "version": "0.1.0-rc.2",
   "description": "SDK for building accountless, pay-per-use Digital Vending Machines",
   "license": "Apache-2.0",
   "repository": {