@dvmkit/sdk 0.1.2-rc.7 → 0.1.4-rc.7

package/dist/internal/server.d.ts

@@ -0,0 +1,404 @@
+import { FacilitatorConfig } from '@x402/core/server';
+import { aj as PaymentPayload, ap as PaymentRequirementsV1, aq as PaymentRequirementsV2, aE as X402Config, av as SettleResponse, aC as VerifyResponse, bi as X402ExactVersionSupport, bj as X402Receipt, bk as TransactionalPayoutHook, bl as CashuMeltCompleted } from '../step-cache-BLPZNizw.js';
+export { bm as CreditDepositPayload, bn as CreditDrainPayload, bo as FundingLot, bp as LotDebit, bq as LotDepletion, br as MppxServer, bs as NON_CHANNEL_BITCOIN_RAILS, bt as NonChannelBitcoinRail, bu as PayoutReporter, bv as PostgresTempoSessionStore, bw as RevenueReporter, bx as SIGNED_ENVELOPE_FIELDS, by as SIGNED_ENVELOPE_TYPES, bz as X402TrackedChannel, bA as _testing, bB as createDefaultReplayStore, bC as depleteLots, bD as fifoOrder, bE as inKindDrawMsats, bF as isInKindDepletion, bG as isNonChannelBitcoinRail, bH as lotOwedSats, bI as netOwedSats, bJ as wrapMppx } from '../step-cache-BLPZNizw.js';
+import { Hono } from 'hono';
+import { Env, BlankSchema } from 'hono/types';
+import { Pool } from 'pg';
+export { Pool } from 'pg';
+import { g as getWallet } from '../wallet-CJC8lwxx.js';
+import { A as AccumulatorPool, a as AccumulatorQuerier, C as ConsumedCredentialStore } from '../credit-menu-C1ezIFlJ.js';
+export { b as AppEnv, c as CreditFundingReport, F as FiatDenomination, d as FiatDenominationFailure, e as FundOnlyRequest, I as IncomingPaymentOpts, J as JobCancelledError, M as MintHealthTracker, P as PAYMENT_PROOF_KEYS, f as PaymentErrorCode, g as PaymentErrorDetail, h as PaymentInfo, R as ReporterBannerOpts, i as ResolvedFx, j as RevenueBootCheckOpts, S as SDKServerOpts, k as ServerJob, l as ShortPayForfeit, T as TempoChannelReport, m as TempoObserverHealth, n as TempoSessionChannelMismatchError, U as UpfrontPaymentOpts, V as VerifiedIncomingPayment, o as VerifyIncomingSnapshot, X as X402BatchChannelObservation, p as X402FacilitatorHealth, q as X402SettlementEvidenceOutcome, r as X402SettlementRepair, s as X402SettlementRepairRefusal, t as X402SettlementRepaired, u as X402WedgedSettlement, v as X402WedgedSettlementPage, w as X402_BATCH_SETTLEMENT_MAINNET_NETWORK, x as abortJob, y as applyPaymentInfoToJob, z as assertRevenueReporterReady, B as buildPaymentErrorResponse, D as clearAccumulatorForDvm, E as createDVMServer, G as creditDepositPayload, H as derivedFundCreditId, K as devModeSkipsPaymentVerification, L as fromJobRecord, N as fundedMicroFor, O as hasPaymentProof, Q as hashLockKey, W as implicitCreditId, Y as initWalletAccumulatorTable, Z as insertAccumulatorRows, _ as isDerivedCreditId, $ as isTerminal, a0 as isYieldMessage, a1 as issueUpfrontChallenges, a2 as msatsToFiatMicro, a3 as paymentErrorBody, a4 as pinAskFiat, a5 as priceFiatMicro, a6 as processIncomingPayment, a7 as providerMessage, a8 as repairX402ExactSettlementEffect, a9 as resolveFxSnapshot, aa as resolvePriceFiat, ab as revenueReporterBannerState, ac as toCreditTerms, ad as toJobRecord, ae as unknownRouteNotFound, af as verifyIncomingPayment, ag as verifyTempoSessionManagementCredential, ah as verifyUpfrontPayment, ai as x402RequiredUsdcMicro, aj as x402SettledShare } from '../credit-menu-C1ezIFlJ.js';
+import { g as LockPubkey } from '../lightning-backend-Ci1nogk_.js';
+export { t as lockPubkeyStoreToLockPubkey } from '../lightning-backend-Ci1nogk_.js';
+export { O as OutgoingMessage, S as StaleJobReapable, i as isStaleJobReapable } from '../job-store-DHnW4Cg_.js';
+import { Store } from 'mppx';
+import { z } from 'zod';
+import '@x402/evm/batch-settlement/server';
+import 'viem';
+import '@x402/core/types';
+import '@cashu/cashu-ts';
+import '../fx-C6dl2LVI.js';
+
+/** POST a verify request to the configured facilitator. */
+declare function verifyWithFacilitator(payload: PaymentPayload, requirements: PaymentRequirementsV1 | PaymentRequirementsV2, config?: Pick<X402Config, "facilitator" | "facilitatorAuth">, createAuthHeaders?: FacilitatorConfig["createAuthHeaders"] | undefined): Promise<VerifyResponse>;
+/** POST a settlement request to the configured facilitator. */
+declare function settleWithFacilitator(payload: PaymentPayload, requirements: PaymentRequirementsV1 | PaymentRequirementsV2, config?: Pick<X402Config, "facilitator" | "facilitatorAuth">, createAuthHeaders?: FacilitatorConfig["createAuthHeaders"] | undefined): Promise<SettleResponse>;
+
+/**
+ * Verify an x402 `X-PAYMENT` header per the x402 spec (internal-review).
+ *
+ * Flow:
+ *  1. Decode the base64 `PaymentPayload`
+ *  2. Rebuild the `PaymentRequirements` the server advertised on the 402 — the
+ *     facilitator deep-equals these against the payload's authorization, so a
+ *     credential bought against any other set fails verification.
+ *  3. Call the facilitator's `/verify`
+ *  4. On valid, call the facilitator's `/settle` to broadcast the EIP-3009
+ *     `transferWithAuthorization`. The on-chain tx hash flows through to the
+ *     receipt and into `X-PAYMENT-RESPONSE` for the client.
+ *
+ * A positive `btcUsdRate` converts the settled USDC back to msats. Zero means
+ * the requirement was already stated exactly in USD and no rate was needed;
+ * in that case `amountMsats` degrades to zero while `amountUsdcMicro` remains
+ * authoritative. Upfront accounting values that native amount against the
+ * advertised requirement, so it never books the degraded field.
+ */
+declare function verifyX402Payment(paymentHeader: string, config: X402Config, requiredUsdcMicro: bigint, resource: string, btcUsdRate: number, exactVersions?: X402ExactVersionSupport): Promise<X402Receipt>;
+
+/**
+ * Snapshot of a DVM's published lock-pubkey state at a point in time. `current`
+ * is what the SDK advertises as `cashu.lock_pubkeys[0]`; `retired` are the
+ * pubkeys that have been rotated out but still fall inside the rotation grace
+ * window (`cashu.lock_pubkey_grace_seconds`). Both halves are needed by the
+ * receive path (accept proofs locked to any entry) and the admin auth verifier
+ * (accept signatures from any entry during grace).
+ */
+interface LockPubkeyState {
+    current: LockPubkey;
+    retired: {
+        pubkey: LockPubkey;
+        retiredAtMs: number;
+    }[];
+}
+/**
+ * Lazy accessor for the DVM's lock-pubkey state. Threaded through the SDK
+ * server so call sites (info handler, accept flow, admin auth) read the fresh
+ * state on every invocation — rotation propagation has to be visible without
+ * a process restart.
+ */
+type LockPubkeyStateLoader = () => Promise<LockPubkeyState>;
+/**
+ * Subset of pg.Pool used by the lock-pubkey store. Sharing `AccumulatorPool`
+ * keeps the SDK's "pass me a Postgres pool" surface uniform across stores.
+ */
+type LockPubkeyPool = AccumulatorPool;
+/**
+ * Create the `dvm_lock_pubkeys` table if absent. Each row is one entry in a
+ * DVM's lock-pubkey lifecycle: `retired_at_ms IS NULL` is the current pubkey,
+ * any non-null value is a retired pubkey that the rotation walker can still
+ * derive privkeys for. One current row per `dvm_id` is enforced via a partial
+ * unique index — keeps `rotateLockPubkey` honest under concurrent calls.
+ */
+declare function initLockPubkeyTable(db: LockPubkeyPool): Promise<void>;
+/**
+ * Idempotent first-boot seed. Inserts `pubkey` as the current row for `dvmId`
+ * only when no current row exists. Reseeding with a different pubkey is a
+ * no-op — once the DB has state, `rotateLockPubkey` is the only sanctioned
+ * mutator, so a stale `DVMKIT_CASHU_LOCK_PUBKEY` env on a redeploy can't
+ * silently reset the DVM's view of "what's current".
+ *
+ * Also backfills any distinct `lock_pubkey` values found in
+ * `wallet_accumulator` for this DVM that aren't yet in `dvm_lock_pubkeys`,
+ * inserting them as retired rows with `retired_at_ms = 0` — the
+ * "long-retired-still-meltable" sentinel. This handles pre-internal-review batches
+ * that would otherwise trip the monitor's `orphan_lock_pubkey` alarm every
+ * tick. Sentinel-0 rows are exempt from grace-window filtering and
+ * `pruneRetired` so they stay visible until the operator melts the legacy
+ * batches and the receive path keeps accepting in-flight tokens locked to
+ * them.
+ *
+ * Two simultaneous cold boots can both pass the `WHERE NOT EXISTS` guard, and
+ * the loser then takes a 23505 on `dvm_lock_pubkeys_current_uidx` — the shape
+ * internal-review fixed for `mpp_secret_state`, reached here through the same
+ * first-boot window. Closed the same way, with `ON CONFLICT DO NOTHING` on
+ * that partial index: the boot lock (internal-review) serializes the cross-machine
+ * half, but two callers on one pool share its acquisition (a fire-and-forget
+ * hydrate overlapping boot's), so the guard has to hold without it.
+ */
+declare function seedLockPubkeyState(db: LockPubkeyPool, dvmId: string, pubkey: string, now?: number): Promise<void>;
+/**
+ * Read the active lock-pubkey state for a DVM. Retired rows older than the
+ * grace window are filtered out; aged-out rows linger physically until
+ * `pruneRetired` deletes them on a monitor tick. Sentinel-0 rows (the
+ * `retired_at_ms = 0` legacy backfill from `seedLockPubkeyState`) are always
+ * included regardless of grace. Throws when no current row exists — the SDK's
+ * accept/info/admin paths must not run before `seedLockPubkeyState` has been
+ * called.
+ */
+declare function loadLockPubkeyState(db: AccumulatorQuerier, dvmId: string, graceMs: number, now?: number): Promise<LockPubkeyState>;
+/**
+ * Atomically demote the current pubkey to retired (stamping `retired_at_ms`)
+ * and insert `newPubkey` as the new current row. Wrapped in a transaction so
+ * the partial unique index never has two current rows visible mid-rotation.
+ * Returns the post-rotation state filtered by the supplied grace window.
+ */
+declare function rotateLockPubkey(db: LockPubkeyPool, dvmId: string, newPubkey: string, graceMs: number, now?: number): Promise<LockPubkeyState>;
+/**
+ * Delete retired rows whose `retired_at_ms` is older than `now - graceMs`.
+ * Called from the monitor tick so aged-out entries don't accumulate.
+ * `wallet_accumulator` rows pointing at those pubkeys remain meltable (the
+ * builder can still derive the privkey from the mnemonic + rotation_index) —
+ * pruning only affects what the DVM advertises and accepts.
+ *
+ * Sentinel-0 rows (the legacy backfill from `seedLockPubkeyState`) are
+ * exempted from pruning — they exist precisely so the monitor keeps treating
+ * legacy `wallet_accumulator` batches as retired-still-meltable rather than
+ * orphan.
+ */
+declare function pruneRetired(db: AccumulatorQuerier, dvmId: string, graceMs: number, now?: number): Promise<number>;
+/**
+ * Default rotation grace window — 24h, per §4.5 of the cashu-integration
+ * design note. Operators tune via `BUILDER_LOCK_PUBKEY_GRACE_SECONDS`.
+ */
+declare const DEFAULT_LOCK_PUBKEY_GRACE_SECONDS = 86400;
+/**
+ * Lift a single pubkey + grace-filtered retired list into the flat array the
+ * accept path checks against. Convenience for call sites that don't care
+ * about the retired-row structure.
+ */
+declare function activePubkeySet(state: LockPubkeyState): LockPubkey[];
+
+/** Options for `installAdminCashuRoutes`. */
+interface InstallAdminCashuRoutesOpts {
+    /** Pool against the SDK's accumulator DB. */
+    db: Pool;
+    /** Identifier of this DVM — bound into every signed admin challenge. */
+    dvmId: string;
+    /**
+     * Live lock-pubkey state loader. Auth accepts a signature from the current
+     * pubkey or any retired pubkey still within the rotation grace window
+     * (internal-review). The `/admin/cashu/rotate-lock-pubkey` route narrows that to
+     * current-only.
+     */
+    getLockPubkeyState: LockPubkeyStateLoader;
+    /** Rotation grace window in seconds — threaded into `rotateLockPubkey`. */
+    graceSeconds: number;
+    /** Replay-protection store keyed by nonce. */
+    nonceStore: ConsumedCredentialStore;
+    /**
+     * Runs inside the transaction that marks the rows melted (internal-review): the
+     * proofs are SPENT and the Lightning payment reached the builder, so the
+     * melt is a landed payout, and its report commits with the mark or not at
+     * all. `enqueue` throwing rolls the mark back and fails the call — the CLI's
+     * recovery re-posts `mark-melted` on its next run, where a melt marked with
+     * no row would understate paid-out forever. `committed` runs after.
+     */
+    onMelted?: TransactionalPayoutHook<CashuMeltCompleted>;
+    /** Override for cashu-ts wallet construction (tests). */
+    walletProvider?: typeof getWallet;
+    /** Override for the current time (tests). Returns ms since epoch. */
+    now?: () => number;
+}
+/**
+ * Register the four admin endpoints on the supplied Hono app. Idempotent at
+ * the call site — `app.ts` only invokes this when accumulator config is
+ * complete (`cashuMode === "p2pk-accumulator"`, `db`, `dvmId`, `lockPubkey`).
+ */
+declare function installAdminCashuRoutes<E extends Env = Env, S extends BlankSchema = BlankSchema>(app: Hono<E, S>, opts: InstallAdminCashuRoutesOpts): void;
+/**
+ * Convenience constructor for the in-memory nonce store — exported so callers
+ * outside `app.ts` (tests, custom wiring) can mint a store with the same caps
+ * the SDK uses by default.
+ */
+declare function createAdminCashuNonceStore(): ConsumedCredentialStore;
+
+/**
+ * The `fx_rate_unavailable` payment-error detail, shaped like every other flat
+ * payment error (internal-review): a flat machine `error` code plus `message` and the
+ * `display`/`hint`/`retryable` fields an agent relays verbatim and branches
+ * retries on — the shape the `paymentErrorBody` builder enforces for the sibling
+ * 503s (`mint_health_pending`, `cashu_mint_sick`) and the 402 family alike. This
+ * one is built by hand rather than through the builder because its copy already
+ * lives on `FxRateUnavailableError`, shared with the quote path's nested
+ * envelope. 503 rather than 402 — the caller's payment isn't the problem, our
+ * pricing is.
+ */
+declare function rateUnavailablePaymentError(): {
+    body: Record<string, unknown>;
+    status: number;
+};
+
+/**
+ * Create a fetch wrapper that emits `dvm.fetch` spans via `loggers.isolate`.
+ *
+ * Attributes include the redacted URL, HTTP method, and (post-response)
+ * status code. When observability is disabled, `loggers.isolate` is the no-op
+ * logger — `span()` calls `fn()` directly with zero overhead.
+ *
+ * `signal` (internal-review) is the job's cancellation signal. When supplied, every
+ * request made through this fetch aborts on job cancel — that is what stops
+ * provider spend mid-job. It is *merged* with any caller-supplied
+ * `init.signal` rather than replacing it, so a per-request timeout (scrapfly,
+ * cast's ranged GET, …) keeps working and either signal can abort the call.
+ */
+declare function createInstrumentedFetch(signal?: AbortSignal): typeof globalThis.fetch;
+
+/**
+ * The subset of Hono's request object these helpers need. Structural rather
+ * than `HonoRequest` so both runtimes' `Context` generics pass without either
+ * side importing the other's env type.
+ */
+interface JobCredentialRequest {
+    header(name: string): string | undefined;
+}
+/**
+ * internal-review: the credential gate on a runtime's `/v1/job/:id/*` routes — the
+ * "did this request present anything?" predicate and the 401 body that answers
+ * when it didn't, built together so the copy can never describe a credential
+ * the predicate doesn't accept.
+ */
+interface JobCredentialGate {
+    /** Did this request present *any* credential this runtime accepts? */
+    presents(req: JobCredentialRequest): boolean;
+    /** The flat 401 body for a request that presented none. */
+    body(): Record<string, unknown>;
+}
+/**
+ * internal-review: build the credential gate for one runtime.
+ *
+ * `acceptsBearer` is what separates them. The isolate tier derives
+ * `requesterId` from `Authorization: Bearer`, so a Bearer token really is a
+ * job credential there. The SDK server does not — its auth middleware pins
+ * `requesterId` to `anonymous`/`dev-anonymous`, so every SDK job is gated on
+ * the internal-review `X-Job-Token` and a Bearer header proves nothing. Counting it
+ * anyway would send a stale client that happens to send one back to the
+ * opaque 404 this exists to eliminate.
+ *
+ * A request carrying no accepted credential can be refused before the job is
+ * ever looked up, which is what makes {@link JobCredentialGate.body} safe to
+ * be specific about — the 404-not-403 choice on a *failed* ownership check is
+ * deliberate (internal-review: a wrong credential must never confirm a job id exists),
+ * and that property is untouched here because this body is returned before any
+ * store lookup, identical whether or not the job exists.
+ *
+ * Shared by `src/sdk/server/app.ts` and the isolate routes so the two runtimes
+ * answer identically by construction rather than by comment.
+ */
+declare function jobCredentialGate(opts: {
+    acceptsBearer: boolean;
+}): JobCredentialGate;
+
+/** Options for `PostgresTempoChargeStore`. */
+interface PostgresTempoChargeStoreOpts {
+    /** Table name. Defaults to `"mpp_tempo_charge_replays"`. Must match `/^[a-zA-Z_][a-zA-Z0-9_]*$/`. */
+    tableName?: string;
+    /**
+     * How long a row survives its last write, in milliseconds. Defaults to one
+     * hour — see the class doc for why that is both generous and safe.
+     */
+    retentionMs?: number;
+    /**
+     * Probability (per write) of firing a fire-and-forget GC sweep that deletes
+     * expired rows. Defaults to 0.01 — every ~100 writes runs one DELETE. Set to
+     * 0 to disable GC entirely (rely on an external sweeper).
+     */
+    gcSampleRate?: number;
+    /** Clock source (ms). Defaults to `Date.now`. Test seam for deterministic TTL. */
+    now?: () => number;
+}
+/**
+ * Postgres implementation of the atomic store mppx's `tempo.charge` uses for
+ * replay protection (internal-review).
+ *
+ * mppx refuses a charge credential whose transaction hash it has already taken
+ * (`markHashUsed`), and refuses a zero-dollar proof credential whose challenge
+ * id it has already taken — but only against the store it is handed. Omitting
+ * one leaves it on `Store.memory()`: per-process, lost on restart, invisible to
+ * sibling machines. A replayed credential then reaches a broadcast the chain
+ * rejects instead of the cheap `Transaction hash has already been used`.
+ *
+ * {@link PostgresTempoSessionStore} cannot serve this keyspace — its `update`
+ * asserts a monotonic *channel-state object*, and a replay marker is the number
+ * `Date.now()`. Values here are deliberately opaque JSON: mppx writes a number
+ * for a replay marker and a `SponsorBudget.State` object for the fee-sponsor
+ * budget, which shares this store unprefixed so aggregate in-flight fee
+ * exposure is sponsor-wide rather than per-process.
+ *
+ * **Retention is ours — mppx has no TTL at any layer of `Store`.** Every row
+ * carries an `expires_at` refreshed on each write, swept by a sampled in-line
+ * DELETE. The window is uniform rather than per-keyspace because it is safe for
+ * both kinds of row: a replay marker guards a credential whose transaction is
+ * settleable for about twenty-five seconds and whose challenge expires in
+ * minutes, and a sponsor-budget reservation is bounded by that same expiring
+ * nonce (plus a thirty-second lease while it is `prepared`), so an hour-idle
+ * budget row holds only reservations `SponsorBudget.reconcile` would release on
+ * sight. Sweeping such a row is equivalent to reconciling it, and the next
+ * reservation recreates it. Keeping the rule uniform is what lets this store
+ * stay ignorant of mppx's key naming across version bumps.
+ *
+ * `expires_at` is a GC marker only: reads do not filter on it, so protection
+ * lapses when a row is swept and never before.
+ */
+declare class PostgresTempoChargeStore implements Store.AtomicStore {
+    private readonly pool;
+    private readonly tableName;
+    private readonly retentionMs;
+    private readonly gcSampleRate;
+    private readonly now;
+    constructor(pool: Pool, opts?: PostgresTempoChargeStoreOpts);
+    /** Run the CREATE TABLE migration. Idempotent — safe to call repeatedly. */
+    init(): Promise<void>;
+    /** Read one stored value, or `null` when absent — mppx's miss sentinel. */
+    get(key: string): Promise<unknown>;
+    /** Replace one stored value. */
+    put(key: string, value: unknown): Promise<void>;
+    /** Delete one stored value — mppx's compensating release on a failed broadcast. */
+    delete(key: string): Promise<void>;
+    /**
+     * Atomic read-modify-write, linearized across every machine sharing the pool.
+     *
+     * The advisory lock is taken before the row lock because a key's *first*
+     * write is the one that matters here: `FOR UPDATE` locks nothing when no row
+     * exists, so two machines marking one hash for the first time would both read
+     * `null` and both believe they won.
+     *
+     * Replay keys are unique per credential, so they never contend. The contended
+     * key is the fee-sponsor budget — one per `(chain, sponsor)`, read-modified
+     * several times per sponsored charge — and serializing it across machines is
+     * the point of sharing the store at all. The critical section is a SELECT and
+     * an upsert, so a queue of waiters clears in tens of milliseconds; a pooled
+     * connection is held for exactly that long and never across a chain call.
+     */
+    update<result>(key: string, fn: (current: unknown) => Store.Change<unknown, result>): Promise<result>;
+    /** The boot DDL itself — always runs under {@link withSdkInitLock} (internal-review). */
+    private createTables;
+    private maybeSweep;
+}
+
+/**
+ * `topics[0]` of a `CloseRequested` log.
+ *
+ * Hard-coded rather than derived, because this module is imported by every
+ * DVM server while `viem` is an *optional* peer dependency — computing the
+ * selector at import time would make an EVM library mandatory for a DVM that
+ * takes no on-chain payments at all. `tempo-close-event.test.ts` pins the
+ * constant against viem's own `toEventSelector`, so it cannot drift.
+ */
+declare const TEMPO_CLOSE_REQUESTED_TOPIC = "0xf5a36fc00a96cbb9cf1f8f59299165e1d8ffffe94396d82904b4da524d16bbce";
+/**
+ * Maximum wall-clock budget for replacing stale Postgres sockets during one
+ * close delivery. The platform wake request allows 30 seconds; retaining a
+ * fifteen-second margin leaves receipt verification and the settlement submission
+ * room to finish instead of letting database recovery consume the whole wake.
+ */
+declare const TEMPO_CLOSE_DB_RECOVERY_BUDGET_MS = 15000;
+
+/** Humanised `{ message, hint }` derived from a ZodError for the `invalid_input`/`invalid_quote_data` envelope. */
+interface HumanizedZodError {
+    message: string;
+    hint: string;
+}
+/**
+ * Render a `ZodError` into the structured `{ message, hint }` fields used by
+ * `/v1/job` and `/v1/quote` error envelopes.
+ *
+ * `message` is a single human-readable line (path: reason; …) that an agent
+ * can relay to its caller, capped at {@link MAX_REPORTED_CLAUSES} clauses with
+ * the remainder counted rather than printed. `hint` is the most actionable fix
+ * derived from the issues — oversized string → chunking guidance, empty
+ * required string → "provide non-empty text", everything else → a pointer at
+ * `/v1/info`. The hint is picked over **every** issue, not just the clauses
+ * that fit: a chunking hint is the one output that tells a caller what to
+ * actually do, and losing it because the oversized field sorted fourth is the
+ * same class of unhelpful answer this whole path exists to avoid.
+ *
+ * The `ZodError.message` field is itself a JSON-stringified array of issues
+ * (per Zod's default Error contract). Using it raw — as the SDK previously
+ * did — leaks the unstructured array into the agent-facing response, which
+ * is what internal-review fixes.
+ */
+declare function humanizeZodError(err: z.ZodError, opts: {
+    schemaUrl: string;
+}): HumanizedZodError;
+
+export { AccumulatorPool, DEFAULT_LOCK_PUBKEY_GRACE_SECONDS, type LockPubkeyPool, type LockPubkeyState, type LockPubkeyStateLoader, LockPubkey as LockPubkeyStoreLockPubkey, PostgresTempoChargeStore, TEMPO_CLOSE_DB_RECOVERY_BUDGET_MS, TEMPO_CLOSE_REQUESTED_TOPIC, activePubkeySet, createAdminCashuNonceStore, createInstrumentedFetch, humanizeZodError, initLockPubkeyTable, installAdminCashuRoutes, jobCredentialGate, loadLockPubkeyState, pruneRetired, rateUnavailablePaymentError, rotateLockPubkey, seedLockPubkeyState, settleWithFacilitator, verifyWithFacilitator, verifyX402Payment };

package/dist/internal/server.js

@@ -0,0 +1,202 @@
+import {
+  PostgresTempoSessionStore
+} from "../chunk-UP2F5RRT.js";
+import {
+  verifyX402Payment
+} from "../chunk-BIFLRKMO.js";
+import {
+  RevenueReporter
+} from "../chunk-EVBK675R.js";
+import {
+  PayoutReporter
+} from "../chunk-6BQM7TOW.js";
+import {
+  PostgresTempoChargeStore
+} from "../chunk-JZWELPFH.js";
+import "../chunk-YG7G4DPZ.js";
+import {
+  DEFAULT_LOCK_PUBKEY_GRACE_SECONDS,
+  MintHealthTracker,
+  PAYMENT_PROOF_KEYS,
+  TEMPO_CLOSE_DB_RECOVERY_BUDGET_MS,
+  TEMPO_CLOSE_REQUESTED_TOPIC,
+  TempoSessionChannelMismatchError,
+  X402FacilitatorHealth,
+  X402_BATCH_SETTLEMENT_MAINNET_NETWORK,
+  activePubkeySet,
+  applyPaymentInfoToJob,
+  assertRevenueReporterReady,
+  buildPaymentErrorResponse,
+  clearAccumulatorForDvm,
+  createAdminCashuNonceStore,
+  createDVMServer,
+  creditDepositPayload,
+  derivedFundCreditId,
+  devModeSkipsPaymentVerification,
+  fundedMicroFor,
+  hasPaymentProof,
+  hashLockKey,
+  implicitCreditId,
+  initLockPubkeyTable,
+  initWalletAccumulatorTable,
+  insertAccumulatorRows,
+  installAdminCashuRoutes,
+  isDerivedCreditId,
+  issueUpfrontChallenges,
+  jobCredentialGate,
+  loadLockPubkeyState,
+  msatsToFiatMicro,
+  paymentErrorBody,
+  pinAskFiat,
+  priceFiatMicro,
+  processIncomingPayment,
+  pruneRetired,
+  rateUnavailablePaymentError,
+  repairX402ExactSettlementEffect,
+  resolveFxSnapshot,
+  resolvePriceFiat,
+  revenueReporterBannerState,
+  rotateLockPubkey,
+  seedLockPubkeyState,
+  toCreditTerms,
+  unknownRouteNotFound,
+  verifyIncomingPayment,
+  verifyTempoSessionManagementCredential,
+  verifyUpfrontPayment,
+  x402RequiredUsdcMicro,
+  x402SettledShare
+} from "../chunk-QK3VJNCK.js";
+import "../chunk-DMNLFNTW.js";
+import {
+  settleWithFacilitator,
+  verifyWithFacilitator
+} from "../chunk-BQ2NMWKE.js";
+import "../chunk-DBCLBYHP.js";
+import {
+  SIGNED_ENVELOPE_FIELDS,
+  SIGNED_ENVELOPE_TYPES,
+  createDefaultReplayStore,
+  humanizeZodError
+} from "../chunk-H2MEFVH6.js";
+import {
+  JobCancelledError,
+  abortJob,
+  createInstrumentedFetch,
+  fromJobRecord,
+  isStaleJobReapable,
+  isTerminal,
+  isYieldMessage,
+  providerMessage,
+  toJobRecord
+} from "../chunk-U6M3ATSG.js";
+import {
+  toLockPubkey
+} from "../chunk-VRQDX5P4.js";
+import "../chunk-Z4BNLUZF.js";
+import "../chunk-5URG56JJ.js";
+import "../chunk-MKI6OVW4.js";
+import "../chunk-KXZUCCEY.js";
+import "../chunk-E4EVGPDX.js";
+import "../chunk-66HGCPBU.js";
+import "../chunk-FUJ36YDV.js";
+import "../chunk-27V2ILSR.js";
+import "../chunk-AT6V3SY7.js";
+import {
+  NON_CHANNEL_BITCOIN_RAILS,
+  depleteLots,
+  fifoOrder,
+  inKindDrawMsats,
+  isInKindDepletion,
+  isNonChannelBitcoinRail,
+  lotOwedSats,
+  netOwedSats
+} from "../chunk-MLRCSJYX.js";
+import "../chunk-S3XAHZQY.js";
+import "../chunk-C3MTFLC6.js";
+import {
+  _testing,
+  wrapMppx
+} from "../chunk-5GFED3GJ.js";
+export {
+  DEFAULT_LOCK_PUBKEY_GRACE_SECONDS,
+  JobCancelledError,
+  MintHealthTracker,
+  NON_CHANNEL_BITCOIN_RAILS,
+  PAYMENT_PROOF_KEYS,
+  PayoutReporter,
+  PostgresTempoChargeStore,
+  PostgresTempoSessionStore,
+  RevenueReporter,
+  SIGNED_ENVELOPE_FIELDS,
+  SIGNED_ENVELOPE_TYPES,
+  TEMPO_CLOSE_DB_RECOVERY_BUDGET_MS,
+  TEMPO_CLOSE_REQUESTED_TOPIC,
+  TempoSessionChannelMismatchError,
+  X402FacilitatorHealth,
+  X402_BATCH_SETTLEMENT_MAINNET_NETWORK,
+  _testing,
+  abortJob,
+  activePubkeySet,
+  applyPaymentInfoToJob,
+  assertRevenueReporterReady,
+  buildPaymentErrorResponse,
+  clearAccumulatorForDvm,
+  createAdminCashuNonceStore,
+  createDVMServer,
+  createDefaultReplayStore,
+  createInstrumentedFetch,
+  creditDepositPayload,
+  depleteLots,
+  derivedFundCreditId,
+  devModeSkipsPaymentVerification,
+  fifoOrder,
+  fromJobRecord,
+  fundedMicroFor,
+  hasPaymentProof,
+  hashLockKey,
+  humanizeZodError,
+  implicitCreditId,
+  inKindDrawMsats,
+  initLockPubkeyTable,
+  initWalletAccumulatorTable,
+  insertAccumulatorRows,
+  installAdminCashuRoutes,
+  isDerivedCreditId,
+  isInKindDepletion,
+  isNonChannelBitcoinRail,
+  isStaleJobReapable,
+  isTerminal,
+  isYieldMessage,
+  issueUpfrontChallenges,
+  jobCredentialGate,
+  loadLockPubkeyState,
+  toLockPubkey as lockPubkeyStoreToLockPubkey,
+  lotOwedSats,
+  msatsToFiatMicro,
+  netOwedSats,
+  paymentErrorBody,
+  pinAskFiat,
+  priceFiatMicro,
+  processIncomingPayment,
+  providerMessage,
+  pruneRetired,
+  rateUnavailablePaymentError,
+  repairX402ExactSettlementEffect,
+  resolveFxSnapshot,
+  resolvePriceFiat,
+  revenueReporterBannerState,
+  rotateLockPubkey,
+  seedLockPubkeyState,
+  settleWithFacilitator,
+  toCreditTerms,
+  toJobRecord,
+  unknownRouteNotFound,
+  verifyIncomingPayment,
+  verifyTempoSessionManagementCredential,
+  verifyUpfrontPayment,
+  verifyWithFacilitator,
+  verifyX402Payment,
+  wrapMppx,
+  x402RequiredUsdcMicro,
+  x402SettledShare
+};