@dvmkit/sdk 0.1.2-rc.7 → 0.1.3-rc.7

package/dist/{chunk-P4RUVDU7.js → chunk-H2MEFVH6.js}

@@ -1,125 +1,10 @@
-// src/sdk/types.ts
-function isZodSchema(value) {
-  return typeof value === "object" && value !== null && "_zod" in value && "parse" in value && "safeParse" in value;
-}
-var RAIL_REFUNDABLE = {
-  cashu: false,
-  x402: false,
-  tempo: false
-};
-var DEFAULT_CREDIT_MIN = "$0.10";
-var DEFAULT_CREDIT_MAX = "$5.00";
-var DEFAULT_CREDIT_TTL_SECONDS = 30 * 24 * 60 * 60;
-
-// src/lib/cast-auth/canonical-json.ts
-function canonicalize(value) {
-  return JSON.stringify(sortDeep(value));
-}
-function canonicaliseForSigning(value) {
-  return new TextEncoder().encode(canonicalize(value));
-}
-function sortDeep(value) {
-  if (value === null) return null;
-  if (typeof value === "string" || typeof value === "boolean") return value;
-  if (typeof value === "number") {
-    if (!Number.isFinite(value)) {
-      throw new TypeError(`canonicalize: non-finite number is not JSON-serialisable`);
-    }
-    return value;
-  }
-  if (Array.isArray(value)) return value.map(sortDeep);
-  if (typeof value === "object") {
-    const sorted = {};
-    for (const key of Object.keys(value).sort()) {
-      const v = value[key];
-      if (v === void 0) continue;
-      sorted[key] = sortDeep(v);
-    }
-    return sorted;
-  }
-  throw new TypeError(`canonicalize: unsupported value of type ${typeof value}`);
-}
-
-// src/lib/cast-auth/verify.ts
-import { schnorr } from "@noble/curves/secp256k1.js";
-function verifyCanonicalSignedRequest(payload, signatureHex, pubkeyHex) {
-  if (!/^[0-9a-f]{64}$/i.test(pubkeyHex) || !/^[0-9a-f]{128}$/i.test(signatureHex)) {
-    return false;
-  }
-  const data = canonicaliseForSigning(payload);
-  const signature = hexToBytes(signatureHex);
-  const pubkey = hexToBytes(pubkeyHex);
-  try {
-    return schnorr.verify(signature, data, pubkey);
-  } catch {
-    return false;
-  }
-}
-function hexToBytes(hex) {
-  const out = new Uint8Array(hex.length / 2);
-  for (let i = 0; i < out.length; i++) {
-    out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
-  }
-  return out;
-}
-
-// src/lib/signed-request-statement.ts
-var SIGNED_REQUEST_AUTH_ID = "secp256k1-schnorr-v2";
-var SIGNED_REQUEST_STATEMENT_VERSION = 2;
-var TEST_DOMAIN_SENTINEL = "__dvmkit_test_domain__";
-function normalizeSignedRequestDomain(domain) {
-  return {
-    audience: {
-      dvm_id: domain.audience.dvm_id,
-      builder_pubkey: domain.audience.builder_pubkey.trim().toLowerCase()
-    },
-    method: domain.method.trim().toUpperCase(),
-    path: canonicalRequestPath(domain.path),
-    capability: domain.capability
-  };
-}
-function signedRequestStatementHeader(domain) {
-  const normalized = normalizeSignedRequestDomain(domain);
-  return {
-    v: SIGNED_REQUEST_STATEMENT_VERSION,
-    protocol: "dvmkit",
-    protocol_version: 1,
-    auth: SIGNED_REQUEST_AUTH_ID,
-    audience: normalized.audience,
-    method: normalized.method,
-    path: normalized.path,
-    capability: normalized.capability
-  };
-}
-function canonicalSignedRequestStatement(header, input) {
-  return canonicaliseForSigning({
-    ...header,
-    input
-  });
-}
-function signedRequestHeaderMatchesDomain(header, domain) {
-  if (!header || typeof header !== "object" || Array.isArray(header)) return false;
-  const actual = header;
-  const expected = signedRequestStatementHeader(domain);
-  const audience = actual.audience;
-  if (process.env.NODE_ENV === "test" && actual.method === TEST_DOMAIN_SENTINEL.toUpperCase() && actual.path === `/${TEST_DOMAIN_SENTINEL}` && actual.capability === TEST_DOMAIN_SENTINEL && audience?.dvm_id === TEST_DOMAIN_SENTINEL) {
-    return true;
-  }
-  return actual.v === expected.v && actual.protocol === expected.protocol && actual.protocol_version === expected.protocol_version && actual.auth === expected.auth && actual.method === expected.method && actual.path === expected.path && actual.capability === expected.capability && !!audience && typeof audience === "object" && audience.dvm_id === expected.audience.dvm_id && audience.builder_pubkey === expected.audience.builder_pubkey;
-}
-function testOnlySignedRequestDomain() {
-  if (process.env.NODE_ENV !== "test") return void 0;
-  return {
-    audience: { dvm_id: TEST_DOMAIN_SENTINEL, builder_pubkey: "00".repeat(32) },
-    method: TEST_DOMAIN_SENTINEL,
-    path: TEST_DOMAIN_SENTINEL,
-    capability: TEST_DOMAIN_SENTINEL
-  };
-}
-function canonicalRequestPath(pathOrUrl) {
-  const parsed = new URL(pathOrUrl, "https://signed-request.invalid");
-  return parsed.pathname.startsWith("/") ? parsed.pathname : `/${parsed.pathname}`;
-}
+import {
+  canonicalSignedRequestStatement,
+  isZodSchema,
+  signedRequestHeaderMatchesDomain,
+  signedRequestStatementHeader,
+  testOnlySignedRequestDomain
+} from "./chunk-KXZUCCEY.js";
 
 // src/sdk/server/zod-error.ts
 function humanizeZodError(err, opts) {
@@ -207,7 +92,7 @@ function pickHint(issues, schemaUrl) {
 }
 
 // src/sdk/server/signed-request.ts
-import { schnorr as schnorr2 } from "@noble/curves/secp256k1.js";
+import { schnorr } from "@noble/curves/secp256k1.js";
 var SIGNED_ENVELOPE_TYPES = {
   pubkey: "string",
   signature: "string",
@@ -317,7 +202,7 @@ function createSignedRequestVerifier(schema, opts = {}) {
     }
   }
   function signRequest(privkey, body, signOpts, domain) {
-    const pubkey = bytesToHex(schnorr2.getPublicKey(privkey));
+    const pubkey = bytesToHex(schnorr.getPublicKey(privkey));
     const timestamp = signOpts?.timestamp ?? now();
     const nonce = signOpts?.nonce ?? randomNonce();
     const unsigned = {
@@ -328,7 +213,7 @@ function createSignedRequestVerifier(schema, opts = {}) {
     };
     const authStatement = signedRequestStatementHeader(requiredDomain(domain));
     const signature = bytesToHex(
-      schnorr2.sign(canonicalBytes({ ...unsigned, auth_statement: authStatement }, domain), privkey)
+      schnorr.sign(canonicalBytes({ ...unsigned, auth_statement: authStatement }, domain), privkey)
     );
     return { ...unsigned, auth_statement: authStatement, signature };
   }
@@ -370,12 +255,12 @@ function statementHeader(input) {
 }
 function verifyBytes(bytes, signatureHex, pubkeyHex) {
   try {
-    return schnorr2.verify(hexToBytes2(signatureHex), bytes, hexToBytes2(pubkeyHex));
+    return schnorr.verify(hexToBytes(signatureHex), bytes, hexToBytes(pubkeyHex));
   } catch {
     return false;
   }
 }
-function hexToBytes2(hex) {
+function hexToBytes(hex) {
   const out = new Uint8Array(hex.length / 2);
   for (let i = 0; i < out.length; i++) out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
   return out;
@@ -427,20 +312,6 @@ function createDefaultReplayStore() {
 var SATURATION_WARN_INTERVAL_SECONDS = 60;
 
 export {
-  isZodSchema,
-  RAIL_REFUNDABLE,
-  DEFAULT_CREDIT_MIN,
-  DEFAULT_CREDIT_MAX,
-  DEFAULT_CREDIT_TTL_SECONDS,
-  canonicalize,
-  canonicaliseForSigning,
-  verifyCanonicalSignedRequest,
-  SIGNED_REQUEST_AUTH_ID,
-  SIGNED_REQUEST_STATEMENT_VERSION,
-  signedRequestStatementHeader,
-  canonicalSignedRequestStatement,
-  testOnlySignedRequestDomain,
-  canonicalRequestPath,
   humanizeZodError,
   humanizeZodIssues,
   zodIssuesOf,

package/dist/chunk-KXZUCCEY.js

@@ -0,0 +1,142 @@
+// src/sdk/types.ts
+function isZodSchema(value) {
+  return typeof value === "object" && value !== null && "_zod" in value && "parse" in value && "safeParse" in value;
+}
+var RAIL_REFUNDABLE = {
+  cashu: false,
+  x402: false,
+  tempo: false
+};
+var DEFAULT_CREDIT_MIN = "$0.10";
+var DEFAULT_CREDIT_MAX = "$5.00";
+var DEFAULT_CREDIT_TTL_SECONDS = 30 * 24 * 60 * 60;
+var DEFAULT_JOB_RETENTION_DAYS = 90;
+
+// src/lib/cast-auth/canonical-json.ts
+function canonicalize(value) {
+  return JSON.stringify(sortDeep(value));
+}
+function canonicaliseForSigning(value) {
+  return new TextEncoder().encode(canonicalize(value));
+}
+function sortDeep(value) {
+  if (value === null) return null;
+  if (typeof value === "string" || typeof value === "boolean") return value;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new TypeError(`canonicalize: non-finite number is not JSON-serialisable`);
+    }
+    return value;
+  }
+  if (Array.isArray(value)) return value.map(sortDeep);
+  if (typeof value === "object") {
+    const sorted = {};
+    for (const key of Object.keys(value).sort()) {
+      const v = value[key];
+      if (v === void 0) continue;
+      sorted[key] = sortDeep(v);
+    }
+    return sorted;
+  }
+  throw new TypeError(`canonicalize: unsupported value of type ${typeof value}`);
+}
+
+// src/lib/cast-auth/verify.ts
+import { schnorr } from "@noble/curves/secp256k1.js";
+function verifyCanonicalSignedRequest(payload, signatureHex, pubkeyHex) {
+  if (!/^[0-9a-f]{64}$/i.test(pubkeyHex) || !/^[0-9a-f]{128}$/i.test(signatureHex)) {
+    return false;
+  }
+  const data = canonicaliseForSigning(payload);
+  const signature = hexToBytes(signatureHex);
+  const pubkey = hexToBytes(pubkeyHex);
+  try {
+    return schnorr.verify(signature, data, pubkey);
+  } catch {
+    return false;
+  }
+}
+function hexToBytes(hex) {
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) {
+    out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return out;
+}
+
+// src/lib/signed-request-statement.ts
+var SIGNED_REQUEST_AUTH_ID = "secp256k1-schnorr-v2";
+var SIGNED_REQUEST_STATEMENT_VERSION = 2;
+var TEST_DOMAIN_SENTINEL = "__dvmkit_test_domain__";
+function normalizeSignedRequestDomain(domain) {
+  return {
+    audience: {
+      dvm_id: domain.audience.dvm_id,
+      builder_pubkey: domain.audience.builder_pubkey.trim().toLowerCase()
+    },
+    method: domain.method.trim().toUpperCase(),
+    path: canonicalRequestPath(domain.path),
+    capability: domain.capability
+  };
+}
+function signedRequestStatementHeader(domain) {
+  const normalized = normalizeSignedRequestDomain(domain);
+  return {
+    v: SIGNED_REQUEST_STATEMENT_VERSION,
+    protocol: "dvmkit",
+    protocol_version: 1,
+    auth: SIGNED_REQUEST_AUTH_ID,
+    audience: normalized.audience,
+    method: normalized.method,
+    path: normalized.path,
+    capability: normalized.capability
+  };
+}
+function canonicalSignedRequestStatement(header, input) {
+  return canonicaliseForSigning({
+    ...header,
+    input
+  });
+}
+function signedRequestHeaderMatchesDomain(header, domain) {
+  if (!header || typeof header !== "object" || Array.isArray(header)) return false;
+  const actual = header;
+  const expected = signedRequestStatementHeader(domain);
+  const audience = actual.audience;
+  if (process.env.NODE_ENV === "test" && actual.method === TEST_DOMAIN_SENTINEL.toUpperCase() && actual.path === `/${TEST_DOMAIN_SENTINEL}` && actual.capability === TEST_DOMAIN_SENTINEL && audience?.dvm_id === TEST_DOMAIN_SENTINEL) {
+    return true;
+  }
+  return actual.v === expected.v && actual.protocol === expected.protocol && actual.protocol_version === expected.protocol_version && actual.auth === expected.auth && actual.method === expected.method && actual.path === expected.path && actual.capability === expected.capability && !!audience && typeof audience === "object" && audience.dvm_id === expected.audience.dvm_id && audience.builder_pubkey === expected.audience.builder_pubkey;
+}
+function testOnlySignedRequestDomain() {
+  if (process.env.NODE_ENV !== "test") return void 0;
+  return {
+    audience: { dvm_id: TEST_DOMAIN_SENTINEL, builder_pubkey: "00".repeat(32) },
+    method: TEST_DOMAIN_SENTINEL,
+    path: TEST_DOMAIN_SENTINEL,
+    capability: TEST_DOMAIN_SENTINEL
+  };
+}
+function canonicalRequestPath(pathOrUrl) {
+  const parsed = new URL(pathOrUrl, "https://signed-request.invalid");
+  return parsed.pathname.startsWith("/") ? parsed.pathname : `/${parsed.pathname}`;
+}
+
+export {
+  isZodSchema,
+  RAIL_REFUNDABLE,
+  DEFAULT_CREDIT_MIN,
+  DEFAULT_CREDIT_MAX,
+  DEFAULT_CREDIT_TTL_SECONDS,
+  DEFAULT_JOB_RETENTION_DAYS,
+  canonicalize,
+  canonicaliseForSigning,
+  verifyCanonicalSignedRequest,
+  SIGNED_REQUEST_AUTH_ID,
+  SIGNED_REQUEST_STATEMENT_VERSION,
+  signedRequestStatementHeader,
+  canonicalSignedRequestStatement,
+  signedRequestHeaderMatchesDomain,
+  testOnlySignedRequestDomain,
+  canonicalRequestPath
+};

package/dist/{chunk-6JZIX5WW.js → chunk-LLXV32HA.js}

@@ -202,6 +202,7 @@ var PostgresJobStore = class {
       -- receipt or re-allocate a sequence number.
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS receipt JSONB;
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS receipt_seq BIGINT;
+      ALTER TABLE jobs ADD COLUMN IF NOT EXISTS redacted_at BIGINT;
       -- internal-review: credit-ledger linkage. Written at submission alongside the
       -- payment fields; the terminal funnel settles/releases the draw and the
       -- receipt countersigns the ReceiptCredit block from it.
@@ -241,6 +242,9 @@ var PostgresJobStore = class {
       $migration$;
       UPDATE jobs SET next_seq = seq + 1 WHERE next_seq <= seq;
       CREATE INDEX IF NOT EXISTS idx_jobs_status ON jobs (status);
+      CREATE INDEX IF NOT EXISTS idx_jobs_retention
+        ON jobs (last_activity_at, id)
+        WHERE redacted_at IS NULL AND status IN ('completed', 'failed', 'cancelled');
       -- internal-review: the idempotent-replay lookup. payment_tx_hash carries the
       -- caller's X-Cashu-Request-Id on the accumulator path, so a retried paid
       -- submit finds the job its payment already created.
@@ -452,8 +456,9 @@ var PostgresJobStore = class {
       -- idempotent re-persist of the same outcome); a different status is
       -- rejected wholesale, so the row can't end up as a Frankenstein of a
       -- cancelled status and a completed snapshot.
-      WHERE jobs.status NOT IN ('completed', 'failed', 'cancelled')
-         OR jobs.status = EXCLUDED.status`,
+      WHERE jobs.redacted_at IS NULL
+        AND (jobs.status NOT IN ('completed', 'failed', 'cancelled')
+          OR jobs.status = EXCLUDED.status)`,
       [
         record.id,
         JSON.stringify(record.tags),
@@ -529,6 +534,73 @@ var PostgresJobStore = class {
     await this.pool.query("DELETE FROM jobs WHERE id = $1", [id]);
     await this.pool.query("DELETE FROM job_messages WHERE job_id = $1", [id]).catch(() => void 0);
   }
+  async listJobsForRetention(args) {
+    const after = args.after;
+    const capabilityClause = args.capabilities === null ? "" : "AND capability = ANY($5::text[])";
+    const params = [
+      args.lastActivityBeforeMs,
+      args.limit,
+      after?.lastActivityAt ?? null,
+      after?.id ?? null
+    ];
+    if (args.capabilities !== null) params.push(args.capabilities);
+    const { rows } = await this.pool.query(
+      `SELECT * FROM jobs
+        WHERE redacted_at IS NULL
+          AND status IN ('completed', 'failed', 'cancelled')
+          AND last_activity_at < $1
+          AND ($3::bigint IS NULL OR (last_activity_at, id) > ($3::bigint, $4::text))
+          ${capabilityClause}
+        ORDER BY last_activity_at, id
+        LIMIT $2`,
+      params
+    );
+    return rows.map((row) => rowToRecord(row));
+  }
+  async redactJob(args) {
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      const { rowCount } = await client.query(
+        `UPDATE jobs SET
+         input = '',
+         params = '{}'::jsonb,
+         summary = NULL,
+         messages = '[]'::jsonb,
+         received_proofs = '[]'::jsonb,
+         pending_payment_msats = NULL,
+         pending_mpp_challenge_ids = NULL,
+         pending_x402_nonce = NULL,
+         pending_x402_amount_usdc_micro = NULL,
+         pending_payment_fiat_micro = NULL,
+         pending_payment_fiat_currency = NULL,
+         step_cache = '[]'::jsonb,
+         state = '{}'::jsonb,
+         requester_token = NULL,
+         request_fingerprint = NULL,
+         auth_request_path = NULL,
+         redacted_at = $3
+       WHERE id = $1
+         AND last_activity_at = $2
+         AND redacted_at IS NULL
+         AND status IN ('completed', 'failed', 'cancelled')`,
+        [args.jobId, args.expectedLastActivityAt, args.redactedAt]
+      );
+      if (rowCount === 1) {
+        await client.query("DELETE FROM job_messages WHERE job_id = $1", [args.jobId]);
+      }
+      await client.query("COMMIT");
+      return rowCount === 1;
+    } catch (err) {
+      try {
+        await client.query("ROLLBACK");
+      } catch {
+      }
+      throw err;
+    } finally {
+      client.release();
+    }
+  }
   async claimReceiptSeq(jobId) {
     const client = await this.pool.connect();
     try {
@@ -577,7 +649,9 @@ var PostgresJobStore = class {
     try {
       await client.query("BEGIN");
       const { rows } = await client.query(
-        "UPDATE jobs SET next_seq = next_seq + 1, last_activity_at = $2 WHERE id = $1 RETURNING (next_seq - 1) AS seq",
+        `UPDATE jobs SET next_seq = next_seq + 1, last_activity_at = $2
+           WHERE id = $1 AND redacted_at IS NULL
+           RETURNING (next_seq - 1) AS seq`,
         [jobId, Date.now()]
       );
       if (rows.length === 0) {
@@ -667,7 +741,9 @@ var PostgresJobStore = class {
     try {
       await client.query("BEGIN");
       const { rows } = await client.query(
-        "UPDATE jobs SET next_seq = next_seq + 1, last_activity_at = $2 WHERE id = $1 RETURNING (next_seq - 1) AS seq",
+        `UPDATE jobs SET next_seq = next_seq + 1, last_activity_at = $2
+           WHERE id = $1 AND redacted_at IS NULL
+           RETURNING (next_seq - 1) AS seq`,
         [jobId, Date.now()]
       );
       if (rows.length === 0) {
@@ -1146,7 +1222,8 @@ function rowToRecord(row) {
     stepCache: row.step_cache,
     state: row.state,
     createdAt: Number(row.created_at),
-    lastActivityAt: Number(row.last_activity_at)
+    lastActivityAt: Number(row.last_activity_at),
+    redactedAt: row.redacted_at == null ? void 0 : Number(row.redacted_at)
   };
 }
 

package/dist/{chunk-LWUR4CGG.js → chunk-MLRCSJYX.js}

@@ -1,9 +1,9 @@
-import {
-  applyRetryToPool
-} from "./chunk-C3MTFLC6.js";
 import {
   withSdkInitLock
 } from "./chunk-S3XAHZQY.js";
+import {
+  applyRetryToPool
+} from "./chunk-C3MTFLC6.js";
 
 // src/sdk/server/credit-ledger.ts
 import { randomUUID } from "crypto";
@@ -2736,6 +2736,14 @@ var CreditLedger = class {
     );
     return rows.length === 1 ? drawRecordFromRow(rows[0], rows[0]) : void 0;
   }
+  /** Read every draw linked to a job, including already-resolved rows. */
+  async listDrawsByJobId(jobId) {
+    const { rows } = await this.pool.query(
+      `${DRAW_WITH_BASIS_SELECT} WHERE d.job_id = $1 ORDER BY d.created_at, d.credit_id, d.ledger_seq`,
+      [jobId]
+    );
+    return rows.map((row) => drawRecordFromRow(row, row));
+  }
   /**
    * All pending holds on a credit, in `ledger_seq` order (no lock). Read
    * surface for the internal-review sweeper wiring — a worker that dies mid-job

package/dist/{chunk-2ABMGUDS.js → chunk-NFRM5QYP.js}

@@ -12,6 +12,25 @@ var ENDPOINTS = {
   payout: "/_internal/payout",
   expiry_release: "/_internal/credit-expiry-release"
 };
+var PENDING_DVM_REPORTS_TABLE = "pending_dvm_reports";
+var LEGACY_PENDING_REPORTS_TABLE = "pending_revenue_reports";
+var SDK_REPORT_TABLE_BASE_COLUMNS = [
+  "id",
+  "payload",
+  "retry_count",
+  "next_retry_at",
+  "stale",
+  "created_at"
+];
+var PLATFORM_REPORT_TABLE_COLUMNS = [
+  "id",
+  "payload",
+  "source",
+  "retry_count",
+  "next_retry_at",
+  "last_error",
+  "created_at"
+];
 var RevenueReporter = class _RevenueReporter {
   // 24h of failed retries
   constructor(db, platformUrl, platformToken) {
@@ -27,14 +46,14 @@ var RevenueReporter = class _RevenueReporter {
   static MAX_BACKOFF_MS = 3e5;
   // 5 min
   static ABANDON_AFTER_MS = 24 * 60 * 60 * 1e3;
-  /** Create the pending-reports table (idempotent). */
+  /** Create the pending-reports table and migrate the legacy SDK outbox (idempotent). */
   async init() {
     await withSdkInitLock(this.db, () => this.createTables());
   }
   /** The boot DDL itself — always runs under {@link withSdkInitLock} (internal-review). */
   async createTables() {
     await this.db.query(`
-      CREATE TABLE IF NOT EXISTS pending_revenue_reports (
+      CREATE TABLE IF NOT EXISTS ${PENDING_DVM_REPORTS_TABLE} (
         id            TEXT PRIMARY KEY,
         payload       JSONB NOT NULL,
         retry_count   INTEGER NOT NULL DEFAULT 0,
@@ -45,12 +64,66 @@ var RevenueReporter = class _RevenueReporter {
         kind          TEXT NOT NULL DEFAULT 'revenue'
       )
     `);
+    await this.assertSdkTableShape(PENDING_DVM_REPORTS_TABLE);
     await this.db.query(
-      "ALTER TABLE pending_revenue_reports ADD COLUMN IF NOT EXISTS stale_reason TEXT"
+      `ALTER TABLE ${PENDING_DVM_REPORTS_TABLE} ADD COLUMN IF NOT EXISTS stale_reason TEXT`
     );
     await this.db.query(
-      "ALTER TABLE pending_revenue_reports ADD COLUMN IF NOT EXISTS kind TEXT NOT NULL DEFAULT 'revenue'"
+      `ALTER TABLE ${PENDING_DVM_REPORTS_TABLE} ADD COLUMN IF NOT EXISTS kind TEXT NOT NULL DEFAULT 'revenue'`
     );
+    await this.migrateLegacySdkOutbox();
+  }
+  /** Copy rows from the old SDK-owned table without touching the platform's table of that name. */
+  async migrateLegacySdkOutbox() {
+    const columns = await this.tableColumns(LEGACY_PENDING_REPORTS_TABLE);
+    if (columns.size === 0) return;
+    if (PLATFORM_REPORT_TABLE_COLUMNS.every((column) => columns.has(column))) {
+      return;
+    }
+    this.assertSdkColumns(LEGACY_PENDING_REPORTS_TABLE, columns);
+    await this.db.query(
+      `ALTER TABLE ${LEGACY_PENDING_REPORTS_TABLE} ADD COLUMN IF NOT EXISTS stale_reason TEXT`
+    );
+    await this.db.query(
+      `ALTER TABLE ${LEGACY_PENDING_REPORTS_TABLE} ADD COLUMN IF NOT EXISTS kind TEXT NOT NULL DEFAULT 'revenue'`
+    );
+    await this.db.query(`
+      WITH copied AS (
+        INSERT INTO ${PENDING_DVM_REPORTS_TABLE}
+        (id, payload, retry_count, next_retry_at, stale, stale_reason, created_at, kind)
+        SELECT id, payload, retry_count, next_retry_at, stale, stale_reason, created_at, kind
+        FROM ${LEGACY_PENDING_REPORTS_TABLE}
+        ON CONFLICT (id) DO NOTHING
+        RETURNING id
+      )
+
+      DELETE FROM ${LEGACY_PENDING_REPORTS_TABLE} AS legacy
+      WHERE EXISTS (SELECT 1 FROM copied WHERE copied.id = legacy.id)
+         OR EXISTS (
+           SELECT 1 FROM ${PENDING_DVM_REPORTS_TABLE} AS migrated
+           WHERE migrated.id = legacy.id
+         )
+    `);
+  }
+  /** Refuse a pre-existing relation whose columns cannot safely serve as the SDK outbox. */
+  async assertSdkTableShape(tableName) {
+    this.assertSdkColumns(tableName, await this.tableColumns(tableName));
+  }
+  assertSdkColumns(tableName, columns) {
+    const matchesSdk = SDK_REPORT_TABLE_BASE_COLUMNS.every((column) => columns.has(column)) && !columns.has("source");
+    if (matchesSdk) return;
+    throw new Error(
+      `RevenueReporter.init(): table "${tableName}" is not the SDK revenue outbox shape. The SDK owns "${PENDING_DVM_REPORTS_TABLE}"; the platform owns "${LEGACY_PENDING_REPORTS_TABLE}". Refusing to boot before credit funding can reach a mismatched outbox. Found columns: ${[...columns].sort().join(", ") || "none"}.`
+    );
+  }
+  async tableColumns(tableName) {
+    const { rows } = await this.db.query(
+      `SELECT column_name
+       FROM information_schema.columns
+       WHERE table_schema = current_schema() AND table_name = $1`,
+      [tableName]
+    );
+    return new Set(rows.map((row) => row.column_name));
   }
   /** Persist a revenue report and attempt immediate delivery. */
   async report(payload) {
@@ -367,7 +440,7 @@ var RevenueReporter = class _RevenueReporter {
   async getQueueStats() {
     const { rows } = await this.db.query(
       `SELECT stale, stale_reason, COUNT(*)::int AS count
-       FROM pending_revenue_reports
+       FROM ${PENDING_DVM_REPORTS_TABLE}
        GROUP BY stale, stale_reason`
     );
     let liveRetry = 0;
@@ -394,7 +467,7 @@ var RevenueReporter = class _RevenueReporter {
   async drainPending() {
     try {
       const { rows } = await this.db.query(
-        `SELECT id, payload, retry_count, created_at, kind FROM pending_revenue_reports
+        `SELECT id, payload, retry_count, created_at, kind FROM ${PENDING_DVM_REPORTS_TABLE}
          WHERE stale = false AND next_retry_at <= $1
          ORDER BY created_at LIMIT 10`,
         [Date.now()]
@@ -428,7 +501,7 @@ var RevenueReporter = class _RevenueReporter {
             _RevenueReporter.MAX_BACKOFF_MS
           );
           await this.db.query(
-            `UPDATE pending_revenue_reports
+            `UPDATE ${PENDING_DVM_REPORTS_TABLE}
              SET retry_count = $1, next_retry_at = $2
              WHERE id = $3`,
             [retryCount, Date.now() + backoff, row.id]
@@ -449,7 +522,7 @@ var RevenueReporter = class _RevenueReporter {
   async insertPending(q, kind, payload) {
     const id = randomUUID();
     await q.query(
-      `INSERT INTO pending_revenue_reports (id, payload, created_at, kind)
+      `INSERT INTO ${PENDING_DVM_REPORTS_TABLE} (id, payload, created_at, kind)
        VALUES ($1, $2, $3, $4)`,
       [id, JSON.stringify(payload), Date.now(), kind]
     );
@@ -476,7 +549,7 @@ var RevenueReporter = class _RevenueReporter {
       throw err;
     }
     if (res.ok) {
-      await this.db.query("DELETE FROM pending_revenue_reports WHERE id = $1", [id]);
+      await this.db.query(`DELETE FROM ${PENDING_DVM_REPORTS_TABLE} WHERE id = $1`, [id]);
       console.log(`[revenue-reporter] reported ${kind} ${label}`);
       return;
     }
@@ -500,7 +573,7 @@ var RevenueReporter = class _RevenueReporter {
   /** Mark a pending row terminal (stale) with a classification reason. */
   async markStale(id, reason) {
     await this.db.query(
-      "UPDATE pending_revenue_reports SET stale = true, stale_reason = $1 WHERE id = $2",
+      `UPDATE ${PENDING_DVM_REPORTS_TABLE} SET stale = true, stale_reason = $1 WHERE id = $2`,
       [reason, id]
     );
   }