@dvmkit/sdk 0.1.2-rc.7 → 0.1.4-rc.7

package/dist/lightning-backend-Ci1nogk_.d.ts

@@ -0,0 +1,367 @@
+import { W as JsonValue } from './step-cache-BLPZNizw.js';
+
+declare const lockPubkeyBrand: unique symbol;
+/**
+ * NUT-11 P2PK lock pubkey, lowercase-by-construction. Hex-encoded compressed
+ * secp256k1 pubkey (66 chars starting with `02` / `03`), normalised via
+ * `toLockPubkey`. The brand exists so any in-memory site that compares
+ * lock-pubkeys against each other — receive matching, monitor orphan/retired
+ * lookups, melt-pending keypair maps — gets a compile-time guarantee that
+ * both sides have been normalised. Raw strings off the wire or out of the DB
+ * must pass through `toLockPubkey` before they're treated as one.
+ */
+type LockPubkey = string & {
+    readonly [lockPubkeyBrand]: never;
+};
+/**
+ * Brand a raw lock-pubkey string. Trims surrounding whitespace and lowercases
+ * the hex so equality is structural. Idempotent on values that are already
+ * lowercase. Does not validate the curve point — assertions about hex shape
+ * live at the wire-validation layer (e.g. the `/admin/cashu/rotate-lock-pubkey`
+ * regex in `admin-cashu.ts`).
+ */
+declare function toLockPubkey(raw: string): LockPubkey;
+
+/**
+ * Canonical deploy-time attestation payload (internal-review). One signature serves
+ * both auth-on-deploy and the `/v1/info#builder` attestation — the bytes the
+ * builder signs are the canonical JSON of this object. Making a field required
+ * also requires the coordinated fleet-before-caller release note in
+ * `public compatibility guide`.
+ */
+interface AttestationPayload {
+    /** Immutable platform or self-hosted DVM identifier this attestation applies to. */
+    dvm_id: string;
+    /** DVM slug the attestation applies to (must match the deploy request's slug). */
+    slug: string;
+    /** sha256(`canonicaliseForSigning(capabilities)`) hex. Binds the attestation
+     *  to the capability shape declared at deploy time. */
+    capabilities_hash: string;
+    /** Builder identity x-only secp256k1 pubkey, hex (32 bytes / 64 chars). */
+    builder_pubkey: string;
+    /**
+     * Per-DVM receipt-signing x-only pubkey, hex (internal-review). Binds the key the
+     * deployed DVM signs job receipts with to the cold builder identity: the
+     * builder signs this payload, so a receipt verifying under
+     * `receipt_pubkey` inherits the builder's authority.
+     *
+     * Optional: attestations signed before receipts shipped omit it and still
+     * verify byte-for-byte (canonical JSON drops absent keys), and deploy paths
+     * that can't provision the matching secret leave it unset rather than
+     * attesting a key the running process doesn't hold.
+     */
+    receipt_pubkey?: string;
+    /** Unix seconds at which the attestation was signed. */
+    deployed_at: number;
+}
+/** Result of {@link generateIdentity}: hex pubkey + hex secret. */
+interface BuilderIdentityKeypair {
+    /** secp256k1 BIP-340 x-only pubkey, 32 bytes hex (64 chars). */
+    pubkey: string;
+    /** secp256k1 secret, 32 bytes hex (64 chars). */
+    secret: string;
+}
+/** Generate a fresh BIP-340 Schnorr keypair for builder identity. */
+declare function generateIdentity(): BuilderIdentityKeypair;
+/**
+ * Read the builder identity secret from `~/.dvmkit/builder.key`. Returns
+ * `null` when absent so callers can surface an `identity_required` error.
+ *
+ * `writeIdentity` persists the key `0o600`, but a destination mode survives
+ * `cp`/`scp`/git-checkout intact only by luck — those can land it `0o644`,
+ * leaving the signing key world-readable on a multi-user box. On POSIX we
+ * detect loose group/other bits, warn, and best-effort re-tighten to `0o600`
+ * (same self-heal posture as `writeIdentity`) rather than throw — a hard
+ * failure would brick a CLI whose key got widened in transit.
+ */
+declare function loadIdentitySecret(): string | null;
+/**
+ * Persist a builder identity keypair: pubkey into `~/.dvmkit/builder.json`
+ * (top-level), secret into `~/.dvmkit/builder.key` (mode 0600 on POSIX).
+ * Atomic tmp+rename on the secret file so a crash mid-write never leaves a
+ * truncated key on disk — a torn write here is unrecoverable; the operator
+ * loses the ability to re-sign attestations for every DVM under this key.
+ *
+ * Refuses to overwrite when an identity already exists unless `force` is
+ * passed; the force path warns that any DVMs deployed under the old key
+ * need to be re-deployed to refresh their attestations.
+ */
+declare function writeIdentity(keypair: BuilderIdentityKeypair, opts?: {
+    force?: boolean;
+}): void;
+/**
+ * Compute the canonical `capabilities_hash` (sha256-hex of canonical JSON)
+ * for the supplied capabilities block. Shared between the CLI signer and any
+ * future verifier so both compute identical bytes.
+ */
+declare function hashCapabilities(capabilities: JsonValue): string;
+/**
+ * Assemble the deploy-time attestation payload (internal-review). `deployedAt`
+ * defaults to the current Unix second; tests can pin it for reproducibility.
+ */
+declare function buildAttestation(args: {
+    dvmId: string;
+    slug: string;
+    capabilities: JsonValue;
+    builderPubkey: string;
+    /** Receipt-signing pubkey to attest (internal-review). Omitted when the deploy path
+     *  can't provision the matching `DVMKIT_RECEIPT_KEY`. */
+    receiptPubkey?: string;
+    deployedAt?: number;
+}): AttestationPayload;
+/**
+ * Sign an attestation payload with the builder identity secret. Returns the
+ * 64-byte Schnorr signature as hex. The canonical bytes are produced via the
+ * same `canonicaliseForSigning` the verifier uses — both sides hash identical
+ * input regardless of object key order.
+ */
+declare function signAttestation(payload: AttestationPayload, secretHex: string): string;
+/**
+ * Verify a deploy-time attestation. Returns `true` iff the signature is a
+ * valid BIP-340 Schnorr signature of `canonicaliseForSigning(payload)` under
+ * `pubkeyHex`. Independent of the platform binding — callers (the deploy
+ * route, `/v1/info` clients) cross-check the pubkey against their trust root.
+ */
+declare function verifyAttestation(payload: AttestationPayload, signatureHex: string, pubkeyHex: string): boolean;
+
+/**
+ * Per-method amount limits a mint advertises on its NUT-4 / NUT-5 bolt11/sat
+ * entry (internal-review). Both values are in the method's own unit — `sat` here,
+ * never msats.
+ *
+ * `null` means the mint advertised nothing in that direction, which reads as
+ * unbounded. A mint saying nothing is not a mint saying zero, so silence never
+ * narrows what we'll attempt — same defensive posture as the absent-`disabled`
+ * rule in {@link canMintBolt11Sat}.
+ */
+interface MintAmountBounds {
+    /** Smallest amount the mint will quote, or `null` when unadvertised. */
+    minSats: number | null;
+    /** Largest amount the mint will quote, or `null` when unadvertised. */
+    maxSats: number | null;
+}
+/** Error categories returned when a mint health probe fails. */
+type HealthErrorCode = "timeout" | "http_error" | "network" | "parse_error" | "missing_fields";
+/** Outcome of a single health probe against one mint. */
+interface MintHealthCheckResult {
+    /** Mint URL exactly as passed in (not normalised). */
+    mintUrl: string;
+    /** True iff `/v1/info` returned 200, parsed as JSON, and had `pubkey` + `version`. */
+    ok: boolean;
+    /** Wall-clock duration of the successful (or final failed) attempt in ms. */
+    latencyMs: number;
+    /** NUT-06 mint pubkey when present. */
+    pubkey?: string;
+    /** NUT-06 mint version string (e.g. "Nutshell/0.20.0") when present. */
+    version?: string;
+    /** Sorted list of NUT keys the mint declares support for. */
+    supportedNuts?: string[];
+    /** Subset of `DEFAULT_REQUIRED_NUTS` the mint does not declare. Empty array when fully supported. */
+    missingRequiredNuts?: string[];
+    /** True when the mint advertises NUT-04 with method `bolt11` and unit `sat`. */
+    bolt11SatMintSupported?: boolean;
+    /** True when the mint advertises NUT-05 with method `bolt11` and unit `sat`. */
+    bolt11SatMeltSupported?: boolean;
+    /**
+     * True when the mint can currently *issue* — NUT-04 advertises bolt11/sat and
+     * is not switched off (`disabled: true`). Distinct from
+     * {@link bolt11SatMintSupported}, which only asks whether the method exists:
+     * a mint in melt-only recovery keeps advertising the method and turns the
+     * flag on. Consulted when picking a funding default (internal-review).
+     */
+    mintingEnabled?: boolean;
+    /** Same question for NUT-05 (melt) — whether the mint can currently pay out. */
+    meltingEnabled?: boolean;
+    /**
+     * True when the mint can currently serve `/v1/swap` — see {@link canSwap} for
+     * why an unadvertised NUT-3 reads as `true`. This is what a per-call spend
+     * needs, so a `false` here is the reason a spend routes around this mint
+     * (internal-review).
+     */
+    swapEnabled?: boolean;
+    /**
+     * Amount limits the mint advertises for issuing (NUT-04 bolt11/sat), in sats
+     * (internal-review). Consulted when picking a funding default and when refusing an
+     * amount locally, so a fund outside the range never opens a Lightning quote.
+     */
+    mintAmountBounds?: MintAmountBounds;
+    /** The NUT-05 twin — limits on a single payout, which `dvm wallet cash-out` sizes against. */
+    meltAmountBounds?: MintAmountBounds;
+    /**
+     * True when the mint passes the full {@link assertNutSupport} gate — every
+     * required NUT present (not `supported: false`) and bolt11/sat on NUT-4 +
+     * NUT-5. The runtime `MintHealthTracker` treats a mint as healthy only when
+     * this is true, reproducing the boot-time NUT gate post-`listen` (internal-review).
+     */
+    nutCompliant?: boolean;
+    /** Raw `nuts` object from the `/v1/info` response. Used by `assertNutSupport`. */
+    nutsRaw?: Record<string, unknown>;
+    /** Populated when `ok` is false. */
+    error?: {
+        code: HealthErrorCode;
+        message: string;
+    };
+}
+/** Tunables for `checkMintHealth`. */
+interface CheckMintHealthOptions {
+    /** Per-attempt timeout in ms. Default: 5000. */
+    timeoutMs?: number;
+    /** Total attempts including the first. Default: 3. */
+    retries?: number;
+    /** Inter-attempt backoff schedule in ms. Default: [200, 500, 1000]. */
+    backoffMs?: number[];
+    /** Injected `fetch` for tests. Default: global fetch. */
+    fetchImpl?: typeof fetch;
+}
+/**
+ * Probe a Cashu mint's `/v1/info` endpoint with timeout + retries, and
+ * report whether it serves the NUT-04 + NUT-05 capabilities first-party DVMs
+ * depend on. Never throws — failures are returned as `{ ok: false, error }`.
+ */
+declare function checkMintHealth(mintUrl: string, opts?: CheckMintHealthOptions): Promise<MintHealthCheckResult>;
+/**
+ * Whether the mint can currently serve `/v1/swap` — the operation every
+ * per-call Cashu payment depends on (internal-review).
+ *
+ * **An absent NUT-3 means yes.** Swap is a baseline mint operation and healthy
+ * mints do not enumerate it — neither coinos nor lnvoltz advertises a `"3"` key
+ * (see `public design rationale`).
+ * Reading silence as "incapable" would rule out every working mint.
+ *
+ * A mint that has *switched swaps off* does say so: a mint in melt-only
+ * recovery publishes a `"3"` entry flagged `disabled` / `supported: false`
+ * alongside its live NUT-5. Both spellings are honoured because this is the
+ * only signal distinguishing "can't swap" from "swap failed for some other
+ * reason", and it costs nothing to accept either.
+ *
+ * Never a boot-time gate — like {@link canMintBolt11Sat}, this informs mint
+ * *selection* only, so a mint that can still melt stays loadable for cash-out.
+ */
+declare function canSwap(nuts: Record<string, unknown>): boolean;
+/** Whether `sats` falls inside a mint's advertised limits, and which end it broke. */
+type AmountBoundsVerdict = "ok" | "below_min" | "above_max";
+/**
+ * Judge one amount against one direction's limits. The single predicate both
+ * `dvm wallet fund` (mint selection, pre-quote refusal) and
+ * `dvm wallet cash-out` (per-leg sizing) ask, so the two commands can't drift
+ * on what "out of range" means.
+ */
+declare function amountBoundsVerdict(sats: number, bounds?: MintAmountBounds): AmountBoundsVerdict;
+/**
+ * Assert that a mint's NUT-06 `nuts` object advertises all required capabilities.
+ * Two-phase check:
+ *   1. Dict-level — each NUT in `requiredNuts` must be present and not have
+ *      `supported: false`. Throws naming the missing NUT numbers and mint URL.
+ *   2. Method-level — NUT-4 and NUT-5 must each advertise a `bolt11`/`sat`
+ *      entry in their `methods` array (covers NUT-23). Throws naming the
+ *      missing method.
+ */
+declare function assertNutSupport(mintUrl: string, nuts: Record<string, unknown>, requiredNuts?: readonly number[]): void;
+
+/** A Lightning invoice created by the backend. */
+interface CreatedInvoice {
+    /** BOLT11 payment request string. */
+    bolt11: string;
+    /** Payment hash (hex) — primary key for looking up settlement. */
+    paymentHash: string;
+    /** Amount in millisatoshis. */
+    amountMsats: number;
+    /** Unix milliseconds when the invoice expires. */
+    expiresAt: number;
+}
+/** Result of looking up an invoice's settlement status. */
+interface InvoiceStatus {
+    /** True once the invoice has been paid and preimage is known. */
+    settled: boolean;
+    /** Preimage (hex) — present only after settlement. */
+    preimage?: string;
+    /** Unix milliseconds when the invoice settled (if settled). */
+    settledAt?: number;
+    /** Unix milliseconds when the invoice expires. */
+    expiresAt?: number;
+}
+/** How a payment reached a settled state — see `payInvoiceReconciling`. */
+type LightningPayOutcome = "paid" | "reconciled" | "republished";
+/** Settled payment plus the audit trail of how it got there. */
+interface LightningPayment {
+    /** Payment preimage (hex) — proof the invoice was paid. */
+    preimage: string;
+    /** Routing fee reported by the wallet, in millisatoshis. Absent means unknown. */
+    feesPaidMsats?: number;
+    /** Whether the wallet answered directly, or the outcome had to be reconciled. */
+    outcome: LightningPayOutcome;
+}
+/** Bounds for a read-only wallet transaction snapshot. */
+interface LightningTransactionListOptions {
+    /** Include transactions created at or after this Unix timestamp (seconds). */
+    from?: number;
+    /** Maximum number of transactions the wallet may return. */
+    limit?: number;
+}
+/**
+ * Credential-safe transaction evidence used to account for a wallet debit.
+ *
+ * Invoice, payment hash and preimage are deliberately replaced by digests or
+ * omitted. `fingerprint` identifies the complete reduced row; `invoiceHash`
+ * lets a caller bind an outgoing row to the invoice it just paid.
+ */
+interface LightningTransactionSnapshot {
+    fingerprint: string;
+    invoiceHash?: string;
+    type: "incoming" | "outgoing";
+    amountMsats: number;
+    /** Wallet-reported routing fee. Absent when the wallet omitted it. */
+    feesPaidMsats?: number;
+    createdAt: number;
+    settledAt?: number;
+}
+/** What a backend can tell us about the wallet behind it. */
+interface LightningWalletInfo {
+    /** Human-readable wallet name (e.g. "Alby Hub"). */
+    alias?: string;
+    /** Operations the wallet supports (e.g. `pay_invoice`, `lookup_invoice`). */
+    methods: string[];
+    /**
+     * Budget fields the wallet volunteered, if any.
+     *
+     * No rail behind this interface is required to expose a connection's
+     * spending cap, and NWC — today's only implementation — has no method that
+     * returns one. Present it when a wallet offers it, never infer it.
+     */
+    walletReportedBudget?: Record<string, unknown>;
+}
+/** Abstraction over Lightning wallet backends (NWC, future). */
+interface LightningBackend {
+    /**
+     * Pay a bolt11 invoice exactly once. Returns the preimage on success.
+     *
+     * Implementations must never re-send a payment on an unknown outcome without
+     * first reconciling against the wallet — the rails behind this interface have
+     * no idempotency key, so a blind retry is a second payment.
+     *
+     * `amountMsats` is passed when known (callers always have it from the
+     * provider's payment-request). Backends that don't need it may ignore the
+     * param.
+     */
+    payInvoice(bolt11: string, amountMsats?: number): Promise<LightningPayment>;
+    /** Get wallet balance in millisatoshis. */
+    getBalance(): Promise<number>;
+    /** Get wallet info (name, supported methods, any volunteered budget fields). */
+    getInfo(): Promise<LightningWalletInfo>;
+    /** Create a new incoming invoice for the given amount and description. */
+    createInvoice(params: {
+        amountMsats: number;
+        description?: string;
+        expirySeconds?: number;
+    }): Promise<CreatedInvoice>;
+    /** Look up an invoice's settlement status by payment hash. */
+    lookupInvoice(paymentHash: string): Promise<InvoiceStatus>;
+    /**
+     * Return a bounded, credential-safe transaction snapshot when supported.
+     * Optional so existing backends remain source-compatible; without it an
+     * exact total wallet debit cannot be attributed.
+     */
+    listTransactions?(options: LightningTransactionListOptions): Promise<LightningTransactionSnapshot[]>;
+}
+
+export { type AttestationPayload as A, type BuilderIdentityKeypair as B, type CreatedInvoice as C, type InvoiceStatus as I, type LightningTransactionListOptions as L, type MintAmountBounds as M, type LightningTransactionSnapshot as a, type LightningBackend as b, type LightningPayment as c, type LightningWalletInfo as d, type MintHealthCheckResult as e, type CheckMintHealthOptions as f, type LockPubkey as g, amountBoundsVerdict as h, assertNutSupport as i, buildAttestation as j, canSwap as k, checkMintHealth as l, generateIdentity as m, hashCapabilities as n, loadIdentitySecret as o, signAttestation as s, toLockPubkey as t, verifyAttestation as v, writeIdentity as w };

package/dist/{memory-credit-ledger-XJ5VQEVP.js → memory-credit-ledger-OP24Z2KO.js}

@@ -1,9 +1,9 @@
 import {
   MemoryCreditLedger
-} from "./chunk-EXHBXA4U.js";
-import "./chunk-LWUR4CGG.js";
-import "./chunk-C3MTFLC6.js";
+} from "./chunk-DBCLBYHP.js";
+import "./chunk-MLRCSJYX.js";
 import "./chunk-S3XAHZQY.js";
+import "./chunk-C3MTFLC6.js";
 export {
   MemoryCreditLedger
 };

package/dist/{postgres-job-store-J5F4GUWU.js → postgres-job-store-3RAXMNSY.js}

@@ -1,6 +1,6 @@
 import {
   PostgresJobStore
-} from "./chunk-6JZIX5WW.js";
+} from "./chunk-SSSZUVWM.js";
 import "./chunk-S3XAHZQY.js";
 export {
   PostgresJobStore

package/dist/{revenue-reporter-JIKUPXOK.js → revenue-reporter-ASZ7SHHH.js}

@@ -1,6 +1,6 @@
 import {
   RevenueReporter
-} from "./chunk-2ABMGUDS.js";
+} from "./chunk-EVBK675R.js";
 import "./chunk-S3XAHZQY.js";
 export {
   RevenueReporter

package/dist/server/index.d.ts

@@ -1,23 +1,26 @@
-import { ah as CashuMode, bP as CreditDrainEnqueue, R as ResolvedCreditConfig, bQ as DVMAuthScheme, B as SignedRequestDomain, bR as CreditLedgerLike, bS as X402RefundSettlementGate, bT as CreditSnapshot, bU as DrawResult, bV as X402SettlementStatus, bW as X402UnresolvedRefund, bX as GrownDrawResult, bY as DrawResolution, bZ as FundingRecord, Y as FundingReceipt, b_ as CreditInvoiceRecord, b$ as InvoiceSettlement, c0 as BlockedInvoiceCursor, c1 as InvoiceReconciliation, c2 as InvoiceWriteOff, c3 as DrawRecord, c4 as StalePendingDrawCursor, c5 as TempoCreditLossEvidence, c6 as CreditLedgerQuerier, c7 as TempoCreditLoss, c8 as X402CreditLossEvidence, c9 as X402CreditLoss, ca as DrainMethod, cb as DrainRequestResult, cc as BitcoinDepositLiability, ao as FundingLot, cd as CreditDrainRecord, ce as ChannelDrainCursor, cf as DrainWriteOff, cg as DrainReleaseResult, ch as DrainFulfilment, ci as DrainTransitionResult, cj as StreamableJobStore, ck as ReceiptIssuingStore, J as JobRecord, cl as RequestIdClaim, cm as RequestIdClaimResult, _ as JobReceipt, aw as OutgoingMessage, cn as AppendOutgoingOptions, co as PaymentCreditDelta, cp as VerifyAndCreditResult, cq as JobCounters, a2 as Message, K as KVStore, G as SignedRequestReplayStore, Z as ZodLike, a as DVMDescriptor } from '../job-store-C53VQ5uu.js';
-export { cr as CLIENT_COMPATIBILITY_HEADERS, d as CanonicalEnvelope, cs as ClientCompatibility, ct as ClientCompatibilityEnv, cu as ClientCompatibilityGate, cv as ClientCompatibilityRequirement, cw as ClientSemVer, e as CreateSignedRequestVerifierOpts, cx as CreditFundingBasis, cy as CreditInvoiceStatus, cz as CreditLedger, cA as CreditLedgerError, cB as CreditLedgerErrorCode, cC as CreditLedgerErrorDetails, cD as CreditLedgerPool, cE as CreditStatus, cF as DRAIN_DELIVERY_RESERVE_SATS, cG as DVM_PROTOCOL_VERSION, cH as DrainConflictReason, cI as DrawRailValue, cJ as DrawStatus, n as JobStatus, o as JobStore, cK as PostgresX402ChannelStorage, cL as ReplayStoreBackend, cM as RevenueSkippedNoRailPayload, cN as RevenueSkippedNoRailReason, x as SIGNED_REQUEST_AUTH_ID, y as SIGNED_REQUEST_STATEMENT_VERSION, cO as Secp256k1AuthOpts, z as SignedRequestAudience, E as SignedRequestError, F as SignedRequestFailure, H as SignedRequestSignOpts, M as SignedRequestStatementHeader, N as SignedRequestVerifier, cP as X402ChannelStorageOpts, cQ as X402RelayLockHolder, cR as X402RelaySubmissionLock, cS as X402RelaySubmissionLockError, cT as allocateDrawValue, cU as clientCompatibilityAttributes, cV as clientCompatibilityMiddleware, cW as clientUpgradeRequired, O as createSignedRequestVerifier, cX as isStreamableJobStore, cY as parseClientCapabilities, cZ as parseClientCompatibility, c_ as parseDvmClient, c$ as parseProtocolVersion, d0 as requireClientCompatibility, d1 as secp256k1Auth, d2 as signedRequestInput, V as signedRequestStatementHeader } from '../job-store-C53VQ5uu.js';
+import { ab as CashuMode, bK as CreditDrainEnqueue, R as ResolvedCreditConfig, bL as DVMAuthScheme, z as SignedRequestDomain, bM as CreditLedgerLike, bN as X402RefundSettlementGate, bO as CreditSnapshot, bP as DrawResult, bQ as X402SettlementStatus, bR as X402UnresolvedRefund, bS as GrownDrawResult, bT as DrawResolution, bU as FundingRecord, X as FundingReceipt, bV as CreditInvoiceRecord, bW as InvoiceSettlement, bX as BlockedInvoiceCursor, bY as InvoiceReconciliation, bZ as InvoiceWriteOff, b_ as DrawRecord, b$ as StalePendingDrawCursor, c0 as TempoCreditLossEvidence, c1 as CreditLedgerQuerier, c2 as TempoCreditLoss, c3 as X402CreditLossEvidence, c4 as X402CreditLoss, c5 as DrainMethod, c6 as DrainRequestResult, c7 as BitcoinDepositLiability, bo as FundingLot, c8 as CreditDrainRecord, c9 as ChannelDrainCursor, ca as DrainWriteOff, cb as DrainReleaseResult, cc as DrainFulfilment, cd as DrainTransitionResult, Y as JobReceipt, a1 as Message, K as KVStore, F as SignedRequestReplayStore, Z as ZodLike, a as DVMDescriptor } from '../step-cache-BLPZNizw.js';
+export { ce as CLIENT_COMPATIBILITY_HEADERS, d as CanonicalEnvelope, cf as ClientCompatibility, cg as ClientCompatibilityEnv, ch as ClientCompatibilityGate, ci as ClientCompatibilityRequirement, cj as ClientSemVer, e as CreateSignedRequestVerifierOpts, ck as CreditFundingBasis, cl as CreditInvoiceStatus, cm as CreditLedger, cn as CreditLedgerError, co as CreditLedgerErrorCode, cp as CreditLedgerErrorDetails, cq as CreditLedgerPool, cr as CreditStatus, cs as DRAIN_DELIVERY_RESERVE_SATS, ct as DVM_PROTOCOL_VERSION, cu as DrainConflictReason, cv as DrawRailValue, cw as DrawStatus, cx as JobCostReportPayload, cy as PostgresX402ChannelStorage, cz as ReplayStoreBackend, cA as RevenueSkippedNoRailPayload, cB as RevenueSkippedNoRailReason, w as SIGNED_REQUEST_AUTH_ID, x as SIGNED_REQUEST_STATEMENT_VERSION, cC as Secp256k1AuthOpts, y as SignedRequestAudience, B as SignedRequestError, E as SignedRequestFailure, G as SignedRequestSignOpts, H as SignedRequestStatementHeader, M as SignedRequestVerifier, cD as X402ChannelStorageOpts, cE as X402RelayLockHolder, cF as X402RelaySubmissionLock, cG as X402RelaySubmissionLockError, cH as allocateDrawValue, cI as clientCompatibilityAttributes, cJ as clientCompatibilityMiddleware, cK as clientUpgradeRequired, N as createSignedRequestVerifier, cL as parseClientCapabilities, cM as parseClientCompatibility, cN as parseDvmClient, cO as parseProtocolVersion, cP as requireClientCompatibility, cQ as secp256k1Auth, cR as signedRequestInput, T as signedRequestStatementHeader } from '../step-cache-BLPZNizw.js';
 import { Pool } from 'pg';
-import { aJ as CreditMenu, i as AppEnv, U as UpfrontPaymentOpts, s as PaymentInfo, aK as ReceiptIssuer, aL as LightningReceive, aM as TempoSettlementReadiness, aN as DVMHostOpts } from '../credit-menu-BM4qCD5U.js';
-export { aO as BuildCreditMenuArgs, aP as BuilderIdentity, aQ as CREDIT_ENVELOPE_KEYS, g as ConsumedCredentialStore, aR as CreateX402BatchSettlementServerOpts, aS as CreditEnvelope, aT as CreditEnvelopeError, aU as CreditFundCommitment, aV as CreditTerms, aW as DEFAULT_INVOICE_TTL_SECONDS, aX as DVMHost, aY as JobManager, aZ as JobManagerOpts, a_ as LightningReceiveConfig, a$ as MIN_INVOICE_TTL_SECONDS, b0 as MemoryConsumedCredentialStore, b1 as MemoryConsumedCredentialStoreOpts, b2 as MemoryProcessedPaymentStore, b3 as MemoryX402ExactSettlementStore, b4 as MountOpts, b5 as OwnerDisplay, b6 as PlatformReporterOpts, b7 as PostgresProcessedPaymentStore, b8 as PostgresX402ExactSettlementStore, b9 as PriceFiat, ba as ProcessedPaymentQuerier, bb as ProcessedPaymentRail, bc as ProcessedPaymentRecord, bd as ProcessedPaymentReplayError, be as ProcessedPaymentStore, bf as X402BatchAcceptance, bg as X402BatchFunding, bh as X402BatchRefusal, bi as X402BatchSettlementServer, bj as X402ExactAcceptance, bk as X402ExactIntentConflictError, bl as X402ExactSettlementAttempt, bm as X402ExactSettlementChainEvidence, bn as X402ExactSettlementEffect, bo as X402ExactSettlementEvidenceMissingError, bp as X402ExactSettlementEvidenceReader, bq as X402ExactSettlementIntent, br as X402ExactSettlementNotReadyError, bs as X402ExactSettlementServer, bt as X402ExactSettlementServerOpts, bu as X402ExactSettlementStatus, bv as X402ExactSettlementStore, bw as X402SettlementChainEvidence, bx as X402SettlementEvidenceReader, by as X402SettlementSubmissionError, bz as X402_BATCH_AUTO_SETTLEMENT, bA as X402_BATCH_MIN_WITHDRAW_DELAY_SECONDS, bB as X402_BATCH_SETTLEMENT_NETWORK, bC as attachCreditMenu, bD as buildCreditMenu, bE as createDVMHost, bF as createX402BatchSettlementServer, bG as creditEnvelopeIgnoreFields, bH as drawSettlementRef, bI as extractCreditEnvelope, bJ as fundingCommitment, bK as selectPrimaryCredit, bL as stripCreditEnvelope, bM as toCreditView } from '../credit-menu-BM4qCD5U.js';
+import { ak as CreditMenu, b as AppEnv, U as UpfrontPaymentOpts, h as PaymentInfo, al as ReceiptIssuer, am as LightningReceive, an as TempoSettlementReadiness, ao as DVMHostOpts } from '../credit-menu-C1ezIFlJ.js';
+export { ap as BuildCreditMenuArgs, aq as BuilderIdentity, ar as CREDIT_ENVELOPE_KEYS, C as ConsumedCredentialStore, as as CreateX402BatchSettlementServerOpts, at as CreditEnvelope, au as CreditEnvelopeError, av as CreditFundCommitment, aw as CreditTerms, ax as DEFAULT_INVOICE_TTL_SECONDS, ay as DVMHost, az as JobManager, aA as JobManagerOpts, aB as LightningReceiveConfig, aC as MIN_INVOICE_TTL_SECONDS, aD as MemoryConsumedCredentialStore, aE as MemoryConsumedCredentialStoreOpts, aF as MemoryProcessedPaymentStore, aG as MemoryX402ExactSettlementStore, aH as MountOpts, aI as OwnerDisplay, aJ as PlatformReporterOpts, aK as PostgresProcessedPaymentStore, aL as PostgresX402ExactSettlementStore, aM as PriceFiat, aN as ProcessedPaymentQuerier, aO as ProcessedPaymentRail, aP as ProcessedPaymentRecord, aQ as ProcessedPaymentReplayError, aR as ProcessedPaymentStore, aS as X402BatchAcceptance, aT as X402BatchFunding, aU as X402BatchRefusal, aV as X402BatchSettlementServer, aW as X402ExactAcceptance, aX as X402ExactIntentConflictError, aY as X402ExactSettlementAttempt, aZ as X402ExactSettlementChainEvidence, a_ as X402ExactSettlementEffect, a$ as X402ExactSettlementEvidenceMissingError, b0 as X402ExactSettlementEvidenceReader, b1 as X402ExactSettlementIntent, b2 as X402ExactSettlementNotReadyError, b3 as X402ExactSettlementServer, b4 as X402ExactSettlementServerOpts, b5 as X402ExactSettlementStatus, b6 as X402ExactSettlementStore, b7 as X402SettlementChainEvidence, b8 as X402SettlementEvidenceReader, b9 as X402SettlementSubmissionError, ba as X402_BATCH_AUTO_SETTLEMENT, bb as X402_BATCH_MIN_WITHDRAW_DELAY_SECONDS, bc as X402_BATCH_SETTLEMENT_NETWORK, bd as attachCreditMenu, be as buildCreditMenu, bf as createDVMHost, bg as createX402BatchSettlementServer, bh as creditEnvelopeIgnoreFields, bi as drawSettlementRef, bj as extractCreditEnvelope, bk as fundingCommitment, bl as selectPrimaryCredit, bm as stripCreditEnvelope, bn as toCreditView } from '../credit-menu-C1ezIFlJ.js';
 import { Context } from 'hono';
 import { z } from 'zod';
-import { F as FxFetcher } from '../fx-C-liI3oY.js';
+import { F as FxFetcher } from '../fx-C6dl2LVI.js';
+import { c as StreamableJobStore, R as ReceiptIssuingStore, J as JobRecord, d as RequestIdClaim, e as RequestIdClaimResult, f as JobRetentionCursor, O as OutgoingMessage, A as AppendOutgoingOptions, P as PaymentCreditDelta, V as VerifyAndCreditResult, g as JobCounters } from '../job-store-DHnW4Cg_.js';
+export { a as JobStatus, b as JobStore, h as isStreamableJobStore } from '../job-store-DHnW4Cg_.js';
 export { P as PinnedFetch, S as SSRFError, a as SSRFGuardOpts, b as SSRFReason, c as SSRFResolver, d as assertSafeUrl, e as createPinnedFetch } from '../ssrf-DbFkpDv0.js';
-import '@cashu/cashu-ts';
 import 'mppx';
 import '@x402/core/server';
 import '@x402/evm/batch-settlement/server';
 import 'viem';
 import '@x402/core/types';
+import '../lightning-backend-Ci1nogk_.js';
+import '@cashu/cashu-ts';
 
 /** Lifetime of a per-call implicit credit before the ledger refuses new draws. */
 declare const IMPLICIT_CREDIT_TTL_MS: number;
 
-/** Cashu accumulator opts resolved from environment variables. */
+/** Builder-lock and Cashu accumulator opts resolved from environment variables. */
 interface ResolvedCashuOpts {
     cashuMode: CashuMode | undefined;
     lockPubkey: string | undefined;
@@ -27,10 +30,11 @@ interface ResolvedCashuOpts {
     canonicalDvmId: string | undefined;
 }
 /**
- * Resolves cashu accumulator opts from environment variables, initializing DB
- * tables when all prerequisites are met. Extracted from serve() so DVMs that
- * call createDVMServer directly (cast, scrape) can wire cashu without using
- * the serve() wrapper (internal-review).
+ * Resolves the builder-lock and Cashu accumulator opts from environment
+ * variables, initializing DB tables when their prerequisites are met.
+ * Extracted from serve() so DVMs that call createDVMServer directly (cast,
+ * scrape) can wire Cashu and the builder admin surface without using the
+ * serve() wrapper (internal-review).
  *
  * @param pool - existing Postgres pool to reuse; pass undefined when no DB is available
  * @param cashuModeHint - programmatic override for cashu mode (serve()'s opts.cashuMode)
@@ -327,6 +331,7 @@ declare class MemoryCreditLedger implements CreditLedgerLike {
         drawId: string;
     }): Promise<DrawRecord | undefined>;
     getDrawByJobId(jobId: string): Promise<DrawRecord | undefined>;
+    listDrawsByJobId(jobId: string): Promise<DrawRecord[]>;
     listPendingDraws(creditId: string): Promise<DrawRecord[]>;
     listStalePendingDraws(args: {
         createdBeforeMs: number;
@@ -445,7 +450,32 @@ declare class PostgresJobStore implements StreamableJobStore, ReceiptIssuingStor
     private acquireRequestIdClaim;
     releaseRequestIdClaim(claim: RequestIdClaim): Promise<void>;
     save(record: JobRecord): Promise<void>;
+    /** Persist a job while retaining its mount identity for cost-report recovery. */
+    saveForDvm(record: JobRecord, dvmId: string): Promise<void>;
+    private saveRecord;
+    /**
+     * Read terminal zero-revenue jobs whose latest declared-cost revision has
+     * not yet reached the durable reporter outbox.
+     */
+    listUnreportedTerminalCosts(args: {
+        dvmId: string;
+        limit: number;
+        afterJobId?: string;
+    }): Promise<JobRecord[]>;
+    /** Mark one revision only after its report has reached durable enqueue. */
+    markTerminalCostReported(jobId: string, costRevision: number): Promise<boolean>;
     delete(id: string): Promise<void>;
+    listJobsForRetention(args: {
+        lastActivityBeforeMs: number;
+        limit: number;
+        capabilities: string[] | null;
+        after?: JobRetentionCursor;
+    }): Promise<JobRecord[]>;
+    redactJob(args: {
+        jobId: string;
+        expectedLastActivityAt: number;
+        redactedAt: number;
+    }): Promise<boolean>;
     claimReceiptSeq(jobId: string): Promise<number>;
     saveReceipt(jobId: string, receipt: JobReceipt): Promise<JobReceipt | undefined>;
     appendOutgoing(jobId: string, message: OutgoingMessage, opts?: AppendOutgoingOptions): Promise<number>;