@dvmkit/sdk 0.1.3-rc.7 → 0.1.4-rc.7

package/dist/{chunk-LLXV32HA.js → chunk-SSSZUVWM.js}

@@ -125,6 +125,7 @@ var ListenChannel = class {
 
 // src/sdk/server/postgres-job-store.ts
 var JOB_MESSAGES_CHANNEL = "job_messages";
+var JOB_DVM_ID = /* @__PURE__ */ Symbol("jobDvmId");
 var PostgresJobStore = class {
   pool;
   listenChannel = null;
@@ -177,6 +178,18 @@ var PostgresJobStore = class {
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS native_amount DOUBLE PRECISION;
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS native_asset TEXT;
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS cashu_flow TEXT;
+      -- internal-review: what the job cost the BUILDER to serve, declared by the
+      -- handler through ctx.cost(). NULL is "unreported", deliberately
+      -- distinguishable from a declared zero.
+      ALTER TABLE jobs ADD COLUMN IF NOT EXISTS cost_amount_micro BIGINT;
+      ALTER TABLE jobs ADD COLUMN IF NOT EXISTS cost_currency TEXT;
+      ALTER TABLE jobs ADD COLUMN IF NOT EXISTS cost_revision BIGINT;
+      -- Cost-only reports are queued after the terminal row lands. Keep the
+      -- owning DVM and the last durably-enqueued revision on that row so a
+      -- restarted (or sibling) process can close that crash window without
+      -- replaying another mount's jobs.
+      ALTER TABLE jobs ADD COLUMN IF NOT EXISTS dvm_id TEXT;
+      ALTER TABLE jobs ADD COLUMN IF NOT EXISTS cost_reported_revision BIGINT;
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS required_msats BIGINT;
       -- next_seq is intentionally absent from isolate_jobs (platform/db.ts).
       -- It powers StreamableJobStore cross-machine seq allocation; isolate
@@ -245,6 +258,10 @@ var PostgresJobStore = class {
       CREATE INDEX IF NOT EXISTS idx_jobs_retention
         ON jobs (last_activity_at, id)
         WHERE redacted_at IS NULL AND status IN ('completed', 'failed', 'cancelled');
+      CREATE INDEX IF NOT EXISTS idx_jobs_pending_cost_report
+        ON jobs (dvm_id, id)
+        WHERE cost_revision IS NOT NULL
+          AND status IN ('completed', 'failed', 'cancelled');
       -- internal-review: the idempotent-replay lookup. payment_tx_hash carries the
       -- caller's X-Cashu-Request-Id on the accumulator path, so a retried paid
       -- submit finds the job its payment already created.
@@ -413,18 +430,32 @@ var PostgresJobStore = class {
     held.client.release();
   }
   async save(record) {
+    await this.saveRecord(record, record[JOB_DVM_ID]);
+  }
+  /** Persist a job while retaining its mount identity for cost-report recovery. */
+  async saveForDvm(record, dvmId) {
+    const scoped = record;
+    scoped[JOB_DVM_ID] = dvmId;
+    try {
+      await this.save(scoped);
+    } finally {
+      delete scoped[JOB_DVM_ID];
+    }
+  }
+  async saveRecord(record, dvmId) {
     const { rowCount } = await this.pool.query(
       `INSERT INTO jobs (
         id, tags, capability, input, params, requester_id, status, summary,
         messages, seq, paid_msats, payment_mint, payment_rail,
         payment_tx_hash, payment_transaction_hash, native_amount, native_asset, cashu_flow,
+        cost_amount_micro, cost_currency, cost_revision,
         received_proofs, pending_payment_msats, pending_mpp_challenge_ids,
         pending_x402_nonce, pending_x402_amount_usdc_micro, required_msats, step_cache, state, created_at,
         last_activity_at, next_seq, requester_token_hash, requester_token,
         request_fingerprint, requester_pubkey, request_id, credit_id, draw_id,
         pending_payment_fiat_micro, pending_payment_fiat_currency, auth_request_path,
-        funding_receipt, funding_credit
-      ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24,$25,$26,$27,$28,$29,$30,$31,$32,$33,$34,$35,$36,$37,$38,$39,$40,$41)
+        funding_receipt, funding_credit, dvm_id
+      ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24,$25,$26,$27,$28,$29,$30,$31,$32,$33,$34,$35,$36,$37,$38,$39,$40,$41,$42,$43,$44,$45)
       ON CONFLICT (id) DO UPDATE SET
         status = EXCLUDED.status,
         summary = EXCLUDED.summary,
@@ -440,6 +471,29 @@ var PostgresJobStore = class {
         native_amount = EXCLUDED.native_amount,
         native_asset = EXCLUDED.native_asset,
         cashu_flow = EXCLUDED.cashu_flow,
+        -- Cost declarations are revisioned because a terminal snapshot can be
+        -- re-saved by a different machine. Never let a stale persisted prefix
+        -- replace the handler owner's later cumulative declaration; a higher
+        -- revision with NULL amount/currency is an intentional invalidation.
+        cost_amount_micro = CASE
+          WHEN EXCLUDED.cost_revision IS NOT NULL
+            AND (jobs.cost_revision IS NULL OR EXCLUDED.cost_revision >= jobs.cost_revision)
+          THEN EXCLUDED.cost_amount_micro
+          ELSE jobs.cost_amount_micro
+        END,
+        cost_currency = CASE
+          WHEN EXCLUDED.cost_revision IS NOT NULL
+            AND (jobs.cost_revision IS NULL OR EXCLUDED.cost_revision >= jobs.cost_revision)
+          THEN EXCLUDED.cost_currency
+          ELSE jobs.cost_currency
+        END,
+        cost_revision = CASE
+          WHEN EXCLUDED.cost_revision IS NOT NULL
+            AND (jobs.cost_revision IS NULL OR EXCLUDED.cost_revision >= jobs.cost_revision)
+          THEN EXCLUDED.cost_revision
+          ELSE jobs.cost_revision
+        END,
+        dvm_id = COALESCE(jobs.dvm_id, EXCLUDED.dvm_id),
         received_proofs = EXCLUDED.received_proofs,
         pending_mpp_challenge_ids = EXCLUDED.pending_mpp_challenge_ids,
         pending_x402_nonce = EXCLUDED.pending_x402_nonce,
@@ -478,6 +532,9 @@ var PostgresJobStore = class {
         record.nativeAmount ?? null,
         record.nativeAsset ?? null,
         record.cashuFlow ?? null,
+        record.costAmountMicro ?? null,
+        record.costCurrency ?? null,
+        record.costRevision ?? null,
         JSON.stringify(record.receivedProofs),
         record.pendingPaymentMsats ?? null,
         record.pendingMppChallengeIds ? JSON.stringify(record.pendingMppChallengeIds) : null,
@@ -513,7 +570,8 @@ var PostgresJobStore = class {
         // whose live gate accepted this proof.
         record.authRequestPath ?? null,
         record.fundingReceipt ? JSON.stringify(record.fundingReceipt) : null,
-        record.fundingCredit ? JSON.stringify(record.fundingCredit) : null
+        record.fundingCredit ? JSON.stringify(record.fundingCredit) : null,
+        dvmId ?? null
       ]
     );
     if (rowCount === 0) {
@@ -530,6 +588,38 @@ var PostgresJobStore = class {
       await this.pool.query("DELETE FROM job_messages WHERE job_id = $1", [record.id]).catch(() => void 0);
     }
   }
+  /**
+   * Read terminal zero-revenue jobs whose latest declared-cost revision has
+   * not yet reached the durable reporter outbox.
+   */
+  async listUnreportedTerminalCosts(args) {
+    const { rows } = await this.pool.query(
+      `SELECT *
+       FROM jobs
+       WHERE dvm_id = $1
+         AND cost_revision IS NOT NULL
+         AND (cost_reported_revision IS NULL OR cost_reported_revision < cost_revision)
+         AND (
+           status IN ('failed', 'cancelled')
+           OR (status = 'completed' AND paid_msats = 0)
+         )
+         AND ($2::text IS NULL OR id > $2)
+       ORDER BY id
+       LIMIT $3`,
+      [args.dvmId, args.afterJobId ?? null, args.limit]
+    );
+    return rows.map(rowToRecord);
+  }
+  /** Mark one revision only after its report has reached durable enqueue. */
+  async markTerminalCostReported(jobId, costRevision) {
+    const { rowCount } = await this.pool.query(
+      `UPDATE jobs
+       SET cost_reported_revision = GREATEST(COALESCE(cost_reported_revision, -1), $2)
+       WHERE id = $1 AND cost_revision = $2`,
+      [jobId, costRevision]
+    );
+    return rowCount === 1;
+  }
   async delete(id) {
     await this.pool.query("DELETE FROM jobs WHERE id = $1", [id]);
     await this.pool.query("DELETE FROM job_messages WHERE job_id = $1", [id]).catch(() => void 0);
@@ -1203,6 +1293,9 @@ function rowToRecord(row) {
     nativeAmount: row.native_amount,
     nativeAsset: row.native_asset,
     cashuFlow: row.cashu_flow,
+    costAmountMicro: row.cost_amount_micro == null ? void 0 : Number(row.cost_amount_micro),
+    costCurrency: row.cost_currency ?? void 0,
+    costRevision: row.cost_revision == null ? void 0 : Number(row.cost_revision),
     creditId: row.credit_id ?? void 0,
     drawId: row.draw_id ?? void 0,
     fundingReceipt: row.funding_receipt ?? void 0,

package/dist/{chunk-4B56DEEV.js → chunk-U6M3ATSG.js}

@@ -1,7 +1,7 @@
 import {
   StepCache,
   loggers
-} from "./chunk-YDIYXGYL.js";
+} from "./chunk-E4EVGPDX.js";
 import {
   redactUrl
 } from "./chunk-FUJ36YDV.js";
@@ -33,6 +33,9 @@ function toJobRecord(job) {
     nativeAmount: job.nativeAmount,
     nativeAsset: job.nativeAsset,
     cashuFlow: job.cashuFlow,
+    costAmountMicro: job.costAmountMicro,
+    costCurrency: job.costCurrency,
+    costRevision: job.costRevision,
     creditId: job.creditId,
     drawId: job.drawId,
     fundingReceipt: job.fundingReceipt,
@@ -76,6 +79,9 @@ function fromJobRecord(record) {
     nativeAmount: record.nativeAmount,
     nativeAsset: record.nativeAsset,
     cashuFlow: record.cashuFlow,
+    costAmountMicro: record.costAmountMicro,
+    costCurrency: record.costCurrency,
+    costRevision: record.costRevision,
     creditId: record.creditId,
     drawId: record.drawId,
     fundingReceipt: record.fundingReceipt,

package/dist/{chunk-2K7E3N2D.js → chunk-VRQDX5P4.js}

@@ -162,7 +162,7 @@ var LOCK_FILE = `${WALLET_FILE}.lock`;
 var DEFAULT_LOCK_STALE_MS = 3e4;
 var DEFAULT_LOCK_RETRIES = 30;
 var DEFAULT_LOCK_RETRY_INTERVAL_MS = 1e3;
-var WALLET_VERSION = 8;
+var WALLET_VERSION = 9;
 var RECENT_SPENDS_CAP = 10;
 var DEFAULT_AGENT_MINT_URL = "https://mint.coinos.io";
 function loadAgentWallet() {
@@ -187,37 +187,54 @@ function loadAgentWallet() {
   }
   const version = parsed.version;
   if (version === 1) {
-    return migrateV7ToV8(
-      migrateV6ToV7(migrateV5ToV6(migrateV4ToV5(migrateV1ToV4(parsed))))
+    return migrateV8ToV9(
+      migrateV7ToV8(
+        migrateV6ToV7(
+          migrateV5ToV6(migrateV4ToV5(migrateV1ToV4(parsed)))
+        )
+      )
     );
   }
   if (version === 2) {
-    return migrateV7ToV8(
-      migrateV6ToV7(
-        migrateV5ToV6(
-          migrateV4ToV5(migrateV3ToV4(migrateV2ToV3(parsed)))
+    return migrateV8ToV9(
+      migrateV7ToV8(
+        migrateV6ToV7(
+          migrateV5ToV6(
+            migrateV4ToV5(migrateV3ToV4(migrateV2ToV3(parsed)))
+          )
         )
       )
     );
   }
   if (version === 3) {
-    return migrateV7ToV8(
-      migrateV6ToV7(migrateV5ToV6(migrateV4ToV5(migrateV3ToV4(parsed))))
+    return migrateV8ToV9(
+      migrateV7ToV8(
+        migrateV6ToV7(
+          migrateV5ToV6(migrateV4ToV5(migrateV3ToV4(parsed)))
+        )
+      )
     );
   }
   if (version === 4) {
-    return migrateV7ToV8(
-      migrateV6ToV7(migrateV5ToV6(migrateV4ToV5(parsed)))
+    return migrateV8ToV9(
+      migrateV7ToV8(
+        migrateV6ToV7(migrateV5ToV6(migrateV4ToV5(parsed)))
+      )
     );
   }
   if (version === 5) {
-    return migrateV7ToV8(migrateV6ToV7(migrateV5ToV6(parsed)));
+    return migrateV8ToV9(
+      migrateV7ToV8(migrateV6ToV7(migrateV5ToV6(parsed)))
+    );
   }
   if (version === 6) {
-    return migrateV7ToV8(migrateV6ToV7(parsed));
+    return migrateV8ToV9(migrateV7ToV8(migrateV6ToV7(parsed)));
   }
   if (version === 7) {
-    return migrateV7ToV8(parsed);
+    return migrateV8ToV9(migrateV7ToV8(parsed));
+  }
+  if (version === 8) {
+    return migrateV8ToV9(parsed);
   }
   if (version !== WALLET_VERSION) {
     throw new DvmError(
@@ -366,6 +383,22 @@ function migrateV6ToV7(parsed) {
   };
 }
 function migrateV7ToV8(parsed) {
+  return {
+    version: 8,
+    lock_privkey: String(parsed.lock_privkey),
+    lock_pubkey: String(parsed.lock_pubkey),
+    mnemonic_fingerprint: typeof parsed.mnemonic_fingerprint === "string" ? parsed.mnemonic_fingerprint : null,
+    mints: Array.isArray(parsed.mints) ? parsed.mints : [],
+    proofs: Array.isArray(parsed.proofs) ? parsed.proofs : [],
+    nut13_counters: isCounterMap(parsed.nut13_counters) ? parsed.nut13_counters : {},
+    pending_mints: Array.isArray(parsed.pending_mints) ? parsed.pending_mints : [],
+    pending_melts: Array.isArray(parsed.pending_melts) ? parsed.pending_melts : [],
+    pending_submissions: Array.isArray(parsed.pending_submissions) ? parsed.pending_submissions : [],
+    recent_spends: Array.isArray(parsed.recent_spends) ? parsed.recent_spends : [],
+    created_at: typeof parsed.created_at === "string" ? parsed.created_at : (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function migrateV8ToV9(parsed) {
   return {
     version: WALLET_VERSION,
     lock_privkey: String(parsed.lock_privkey),

package/dist/{credit-menu-C7zAJElJ.d.ts → credit-menu-C1ezIFlJ.d.ts}

@@ -1,9 +1,9 @@
 import { Hono, Context } from 'hono';
 import { Pool } from 'pg';
-import { a0 as Message, ag as FundingMethod, W as FundingReceipt, bN as CreditSnapshot, X as JobReceipt, S as SDKJobContext, av as StepCache, u as ResponseContent, P as PaymentContent, a1 as MessageType, bi as X402Receipt, aD as X402Config, bh as X402ExactVersionSupport, cQ as X402SettlementIntent, ap as PaymentRequirementsV2, c0 as CreditLedgerQuerier, cR as X402SettlementCursor, bP as X402SettlementStatus, cS as X402SettlementWriteOff, bM as X402RefundSettlementGate, cT as X402FacilitatorAuth, cU as X402BatchSettlementConfig, cw as PostgresX402ChannelStorage, cV as X402PayoutObserver, bq as MppxServer, aa as CashuMode, bL as CreditLedgerLike, cW as CreditDepositEnqueue, cX as X402SettlementReconciliationReason, an as PaymentRequirements, $ as MppxCredential, o as PaymentMethod, bl as CreditDepositPayload, bO as DrawResult, cm as CreditLedgerError, a5 as ReceiptCredit, ad as DrainReceiptEvent, ac as DrainReceipt, K as KVStore, y as SignedRequestAudience, cY as CreditDrawReleaseEnqueue, cy as RevenueSkippedNoRailPayload, Z as ZodLike, a as DVMDescriptor, bU as CreditInvoiceRecord, bV as InvoiceSettlement, cg as ClientCompatibilityGate, ce as ClientCompatibility, bt as PayoutReporter, R as ResolvedCreditConfig, g as CreditView } from './step-cache-3cT4Shk0.js';
-import { b as FxRateSnapshot, F as FxFetcher } from './fx-BF_SG2i0.js';
-import { g as LockPubkey, f as CheckMintHealthOptions, b as LightningBackend, A as AttestationPayload } from './lightning-backend-C04nH94l.js';
-import { T as TopUpCapUnenforcedReason, A as AppendOutgoingOptions, J as JobRecord, b as JobStore } from './job-store-Bn23V3QU.js';
+import { a1 as Message, ah as FundingMethod, X as FundingReceipt, bO as CreditSnapshot, Y as JobReceipt, S as SDKJobContext, aw as StepCache, u as ResponseContent, P as PaymentContent, a2 as MessageType, bj as X402Receipt, aE as X402Config, bi as X402ExactVersionSupport, cS as X402SettlementIntent, aq as PaymentRequirementsV2, c1 as CreditLedgerQuerier, cT as X402SettlementCursor, bQ as X402SettlementStatus, cU as X402SettlementWriteOff, bN as X402RefundSettlementGate, cV as X402FacilitatorAuth, cW as X402BatchSettlementConfig, cy as PostgresX402ChannelStorage, cX as X402PayoutObserver, br as MppxServer, ab as CashuMode, bM as CreditLedgerLike, cY as CreditDepositEnqueue, cZ as X402SettlementReconciliationReason, ao as PaymentRequirements, a0 as MppxCredential, o as PaymentMethod, bm as CreditDepositPayload, bP as DrawResult, cn as CreditLedgerError, a6 as ReceiptCredit, ae as DrainReceiptEvent, ad as DrainReceipt, K as KVStore, y as SignedRequestAudience, c_ as CreditDrawReleaseEnqueue, cx as JobCostReportPayload, cA as RevenueSkippedNoRailPayload, Z as ZodLike, a as DVMDescriptor, bV as CreditInvoiceRecord, bW as InvoiceSettlement, ch as ClientCompatibilityGate, cf as ClientCompatibility, bu as PayoutReporter, R as ResolvedCreditConfig, g as CreditView } from './step-cache-BLPZNizw.js';
+import { b as FxRateSnapshot, F as FxFetcher } from './fx-C6dl2LVI.js';
+import { g as LockPubkey, f as CheckMintHealthOptions, b as LightningBackend, A as AttestationPayload } from './lightning-backend-Ci1nogk_.js';
+import { T as TopUpCapUnenforcedReason, A as AppendOutgoingOptions, J as JobRecord, b as JobStore } from './job-store-DHnW4Cg_.js';
 import { ProofLike, SerializedDLEQ } from '@cashu/cashu-ts';
 import { Challenge } from 'mppx';
 import { SettleResponse, SupportedResponse } from '@x402/core/types';
@@ -239,6 +239,25 @@ interface ServerJob {
     nativeAsset?: "sats" | "usdc" | "usdc.e" | "usd-cents";
     /** Cashu flow discriminator written into `revenue_events.metadata.cashu_flow` (internal-review). */
     cashuFlow?: "p2pk_accumulator";
+    /**
+     * What this job cost the **builder** to serve, in 1e-6 of
+     * {@link ServerJob.costCurrency} — the running total the handler declared
+     * through `ctx.cost()` (internal-review). Absent until a handler declares
+     * something; absent is "unreported", which is not the same fact as a
+     * declared zero and is reported differently.
+     *
+     * Persisted on the row rather than held in the context because the report
+     * has to survive a crash between the job finishing and the report landing:
+     * the terminal funnel writes this row before it books, and Postgres cost
+     * reconciliation retries any revision whose durable-enqueue marker still
+     * lags. Never netted against `paidMsats` or the draw — the builder's cost
+     * and the caller's payment are two questions.
+     */
+    costAmountMicro?: number;
+    /** Currency {@link ServerJob.costAmountMicro} is 1e-6 of (lowercase ISO-4217). */
+    costCurrency?: string;
+    /** Number of `ctx.cost()` declarations incorporated into the current cost state. */
+    costRevision?: number;
     /** Credit the upfront payment funded/drew (internal-review). See `JobRecord.creditId`. */
     creditId?: string;
     /** The draw placed for this job on `creditId` (internal-review). */
@@ -2702,6 +2721,8 @@ interface JobManagerOpts {
     onJobCompleted?: (info: {
         dvmId: string;
         jobId: string;
+        /** Dispatched capability. Omitted only for legacy persisted jobs that predate dispatch. */
+        capability?: string;
         paidMsats: number;
         paymentMint?: string;
         rail: string;
@@ -2709,6 +2730,10 @@ interface JobManagerOpts {
         nativeAmount?: number;
         nativeAsset?: string;
         cashuFlow?: string;
+        cost?: {
+            amountMicro: number;
+            currency: string;
+        };
         creditId?: string;
         drawId?: string;
         drawAmountMicro?: number;
@@ -2717,6 +2742,13 @@ interface JobManagerOpts {
         fundingRef?: string;
         kind?: string;
     }) => void | Promise<void>;
+    /**
+     * Callback fired when a terminal job declared a builder cost but emitted no
+     * revenue report (internal-review). Container-runtime DVMs use the reporter's
+     * durable `job-cost` outbox path. The receiver de-duplicates by DVM + job,
+     * independently of the rail-keyed revenue ledger.
+     */
+    onJobCost?: (info: JobCostReportPayload) => void | Promise<void>;
     /**
      * Callback fired when the stale-job reaper force-fails a *paid* job — its
      * pending credit draw is released rather than settled, because only a
@@ -2895,6 +2927,8 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     private readonly jobStore;
     private readonly idleTimers;
     private readonly cleanupTimers;
+    /** Cost revisions held only by a terminal handler owner until its durable merge succeeds. */
+    private readonly terminalCostHandoffRetryTimers;
     /** Per-job NOTIFY unsubscribe handles for the durable-status watch (internal-review). */
     private readonly statusWatchers;
     /** Job ids whose durable-status re-read is in flight — coalesces notify storms (internal-review). */
@@ -2918,6 +2952,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     private staleSweepTimer?;
     private heartbeatTimer?;
     private orphanDrawSweepTimer?;
+    private terminalCostRecoveryTimer?;
     private jobRetentionSweepTimer?;
     private jobRetentionBootTimer?;
     /** This manager holds {@link ORPHAN_SWEEP_CLAIMS} for its ledger. */
@@ -2935,6 +2970,8 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     private readonly monotonicNowMs;
     private sweepInFlight;
     private orphanSweepInFlight;
+    private terminalCostRecoveryInFlight;
+    private terminalCostRecoveryResumeAfter?;
     private jobRetentionSweepInFlight;
     private heartbeatInFlight;
     /**
@@ -3086,6 +3123,16 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * stores' terminal-sticky `save`, which keeps the row itself correct).
      */
     private adoptDurableTerminal;
+    /**
+     * Persist an adopted terminal cost, retaining the in-memory revision for a
+     * later retry when the durable store is transiently unavailable.
+     */
+    private tryPersistAdoptedTerminalCost;
+    /** Retry outside the status watcher, which correctly stops once the job is terminal. */
+    private scheduleTerminalCostHandoffRetry;
+    private retryTerminalCostHandoff;
+    /** Durably merge a terminal handler owner's latest cost before reporting it. */
+    private persistAdoptedTerminalCost;
     /**
      * Watch the durable status of a locally-active job (internal-review).
      *
@@ -3645,8 +3692,27 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * from whatever the caller happened to have in hand.
      */
     issueReceiptForStoredJob(jobId: string): Promise<JobReceipt | undefined>;
+    /**
+     * Finish accounting for a terminal written directly to the store — the
+     * stale reaper and a cancel handled on a different machine (internal-review).
+     */
+    finalizeStoredTerminal(jobId: string): Promise<JobReceipt | undefined>;
     /** Handle job reaching terminal state (completed, failed, cancelled). */
     private handleJobTerminal;
+    /**
+     * Re-enqueue terminal cost-only rows left between the job commit and outbox
+     * insert. The marker advances only after `onJobCost` resolves, which for the
+     * SDK reporter means the local durable insert has committed; a crash after
+     * that insert but before the marker can duplicate a payload, but the
+     * revisioned platform contract makes that replay harmless.
+     */
+    recoverTerminalCosts(): Promise<{
+        examined: number;
+        queued: number;
+        complete: boolean;
+    }>;
+    /** Report the latest declared-cost state only when no revenue event carried it. */
+    private reportJobCost;
     /**
      * Report a completed paid job's revenue (internal-review, re-keyed by internal-review).
      * Fire-and-forget — the `RevenueReporter` owns persistence and retry.
@@ -4435,6 +4501,12 @@ interface SDKServerOpts {
      * tests and advanced integrations only.
      */
     onJobCompleted?: JobManagerOpts["onJobCompleted"];
+    /**
+     * Advanced override for a declared cost on a terminal job that emitted no
+     * revenue report (internal-review). Auto-wired to the reporter's durable
+     * job-cost path; intended for tests and advanced integrations only.
+     */
+    onJobCost?: JobManagerOpts["onJobCost"];
     /**
      * Advanced override: callback fired when the stale-job reaper force-fails a
      * *paid* job (internal-review). Auto-wired to the `RevenueReporter`'s paid-job-death

package/dist/{fx-BF_SG2i0.d.ts → fx-C6dl2LVI.d.ts}

@@ -1,4 +1,4 @@
-import { C as Currency } from './step-cache-3cT4Shk0.js';
+import { C as Currency } from './step-cache-BLPZNizw.js';
 
 /**
  * Quote-time fx snapshot. Embedded in scribe's `lockedQuote` for within-job

package/dist/index.d.ts

@@ -1,8 +1,8 @@
-import { C as Currency, Z as ZodLike, D as DVMConfig, a as DVMDescriptor } from './step-cache-3cT4Shk0.js';
-export { A as ApprovalContent, b as ArtifactContent, c as CancelContent, d as CanonicalEnvelope, e as CreateSignedRequestVerifierOpts, f as CreditConfig, g as CreditView, h as DEFAULT_CREDIT_MAX, i as DEFAULT_CREDIT_MIN, j as DEFAULT_CREDIT_TTL_SECONDS, k as DEFAULT_JOB_RETENTION_DAYS, l as DVMRouteContext, I as IncomingMessage, m as InputType, n as InvalidCurrencyError, K as KVStore, L as Logger, P as PaymentContent, o as PaymentMethod, p as PriceValue, q as ProgressContent, r as PromptOpts, Q as QuoteConfig, s as QuoteContext, t as QuoteResult, R as ResolvedCreditConfig, u as ResponseContent, S as SDKJobContext, v as SDKPaymentRequestOpts, w as SIGNED_REQUEST_AUTH_ID, x as SIGNED_REQUEST_STATEMENT_VERSION, y as SignedRequestAudience, z as SignedRequestDomain, B as SignedRequestError, E as SignedRequestFailure, F as SignedRequestReplayStore, G as SignedRequestSignOpts, H as SignedRequestStatementHeader, J as SignedRequestVerifier, U as UnsupportedCurrencyError, M as createSignedRequestVerifier, N as isZodSchema, O as signedRequestStatementHeader, T as validateCurrency } from './step-cache-3cT4Shk0.js';
-export { C as CreateFxFetcherOpts, D as DEFAULT_FX_CURRENCIES, a as DEFAULT_FX_RATE_SOURCE, F as FxFetcher, b as FxRateSnapshot, c as FxRateUnavailableError, P as PlatformFxSource, d as createFxFetcher, f as fxRateFor, r as resolveFxSourceFromEnv } from './fx-BF_SG2i0.js';
-export { I as InvalidFxRateError, f as fiatToSatsCeil, a as formatFiat, b as formatUsd, r as roundUsd, s as satsToFiat } from './usd-BnuXoFl5.js';
-export { J as JobRecord, a as JobStatus, b as JobStore } from './job-store-Bn23V3QU.js';
+import { C as Currency, Z as ZodLike, D as DVMConfig, a as DVMDescriptor } from './step-cache-BLPZNizw.js';
+export { A as ApprovalContent, b as ArtifactContent, c as CancelContent, d as CanonicalEnvelope, e as CreateSignedRequestVerifierOpts, f as CreditConfig, g as CreditView, h as DEFAULT_CREDIT_MAX, i as DEFAULT_CREDIT_MIN, j as DEFAULT_CREDIT_TTL_SECONDS, k as DEFAULT_JOB_RETENTION_DAYS, l as DVMRouteContext, I as IncomingMessage, m as InputType, n as InvalidCurrencyError, J as JobCost, K as KVStore, L as Logger, P as PaymentContent, o as PaymentMethod, p as PriceValue, q as ProgressContent, r as PromptOpts, Q as QuoteConfig, s as QuoteContext, t as QuoteResult, R as ResolvedCreditConfig, u as ResponseContent, S as SDKJobContext, v as SDKPaymentRequestOpts, w as SIGNED_REQUEST_AUTH_ID, x as SIGNED_REQUEST_STATEMENT_VERSION, y as SignedRequestAudience, z as SignedRequestDomain, B as SignedRequestError, E as SignedRequestFailure, F as SignedRequestReplayStore, G as SignedRequestSignOpts, H as SignedRequestStatementHeader, M as SignedRequestVerifier, U as UnsupportedCurrencyError, N as createSignedRequestVerifier, O as isZodSchema, T as signedRequestStatementHeader, V as validateCurrency } from './step-cache-BLPZNizw.js';
+export { C as CreateFxFetcherOpts, D as DEFAULT_FX_CURRENCIES, a as DEFAULT_FX_RATE_SOURCE, F as FxFetcher, b as FxRateSnapshot, c as FxRateUnavailableError, P as PlatformFxSource, d as createFxFetcher, f as fxRateFor, r as resolveFxSourceFromEnv } from './fx-C6dl2LVI.js';
+export { I as InvalidFxRateError, f as fiatToSatsCeil, a as formatFiat, b as formatUsd, r as roundUsd, s as satsToFiat } from './usd-BgOfZlk6.js';
+export { J as JobRecord, a as JobStatus, b as JobStore } from './job-store-DHnW4Cg_.js';
 export { P as PinnedFetch, S as SSRFError, a as SSRFGuardOpts, b as SSRFReason, c as SSRFResolver, d as assertSafeUrl, e as createPinnedFetch } from './ssrf-DbFkpDv0.js';
 export { z } from 'zod';
 import 'hono';

package/dist/internal/caller.d.ts

@@ -1,16 +1,16 @@
-import { L as LightningTransactionListOptions, a as LightningTransactionSnapshot, b as LightningBackend, c as LightningPayment, d as LightningWalletInfo, C as CreatedInvoice, I as InvoiceStatus, M as MintAmountBounds, e as MintHealthCheckResult } from '../lightning-backend-C04nH94l.js';
-export { A as AttestationPayload, B as BuilderIdentityKeypair, f as CheckMintHealthOptions, g as LockPubkey, h as amountBoundsVerdict, i as assertNutSupport, j as buildAttestation, k as canSwap, l as checkMintHealth, m as generateIdentity, n as hashCapabilities, o as loadIdentitySecret, s as signAttestation, t as toLockPubkey, v as verifyAttestation, w as writeIdentity } from '../lightning-backend-C04nH94l.js';
+import { L as LightningTransactionListOptions, a as LightningTransactionSnapshot, b as LightningBackend, c as LightningPayment, d as LightningWalletInfo, C as CreatedInvoice, I as InvoiceStatus, M as MintAmountBounds, e as MintHealthCheckResult } from '../lightning-backend-Ci1nogk_.js';
+export { A as AttestationPayload, B as BuilderIdentityKeypair, f as CheckMintHealthOptions, g as LockPubkey, h as amountBoundsVerdict, i as assertNutSupport, j as buildAttestation, k as canSwap, l as checkMintHealth, m as generateIdentity, n as hashCapabilities, o as loadIdentitySecret, s as signAttestation, t as toLockPubkey, v as verifyAttestation, w as writeIdentity } from '../lightning-backend-Ci1nogk_.js';
 import { ProofLike, MeltQuoteBolt11Response, Proof, Wallet, SerializedDLEQ, MintQuoteBolt11Response, MintQuoteState, MintPreview, OutputDataLike, CounterSource, CounterRange } from '@cashu/cashu-ts';
 export { g as getWallet } from '../wallet-CJC8lwxx.js';
-import { V as JsonValue, z as SignedRequestDomain, H as SignedRequestStatementHeader, W as FundingReceipt, X as JobReceipt$1, y as SignedRequestAudience, Y as PaymentRequired, _ as X402Version, $ as MppxCredential, a0 as Message, a1 as MessageType, a2 as MppxChallenge, a3 as X402_BATCH_SETTLEMENT_SCHEME, a4 as X402_EXACT_SCHEME, a5 as ReceiptCredit, C as Currency, a6 as X402Wallet, L as Logger$1, K as KVStore, a7 as ResourceInfo } from '../step-cache-3cT4Shk0.js';
-export { a8 as BuildPaymentRequirementsOpts, a9 as CapabilityDescriptor, aa as CashuMode, ab as CompleteContent, ac as DrainReceipt, ad as DrainReceiptEvent, ae as ExactEvmPayload, af as ExactEvmPayloadAuthorization, ag as FundingMethod, ah as MessageFrom, ai as PaymentPayload, aj as PaymentPayloadV1, ak as PaymentPayloadV2, al as PaymentRequestContent, am as PaymentRequiredV2, an as PaymentRequirements, ao as PaymentRequirementsV1, ap as PaymentRequirementsV2, aq as PromptContent, ar as RAIL_REFUNDABLE, as as ReceiptOutcome, at as ReceiptPayment, au as SettleResponse, av as StepCache, aw as StepRecord, ax as TextContent, ay as UnsignedDrainReceipt, az as UnsignedFundingReceipt, aA as UnsignedJobReceipt, aB as VerifyResponse, aC as WorkingContent, aD as X402Config, aE as X402ResponseBody, aF as X402SelfRelayRpcFailureReason, aG as X402_DEFAULT_NETWORK, aH as X402_V1_VERSION, aI as X402_VERSION, aJ as buildPaymentRequiredV2, aK as buildPaymentRequirements, aL as caip2ToX402Network, aM as canonicalRequestPath, aN as canonicaliseForSigning, aO as canonicalize, aP as chainIdFromCaip2, aQ as computeResultHash, aR as decodePayment, aS as decodePaymentRequiredHeader, aT as encodePayment, aU as encodePaymentRequiredHeader, aV as encodeSettleResponseHeader, aW as exactEvmAuthorization, aX as isArtifactMessage, aY as isCancelMessage, aZ as isCompleteMessage, a_ as isDrainReceipt, a$ as isFundingReceipt, b0 as isPaymentRequestMessage, b1 as isPromptMessage, b2 as isSignedJobReceipt, b3 as isTextMessage, b4 as isWorkingMessage, b5 as paymentRequiredV2FromV1, b6 as signDrainReceipt, b7 as signFundingReceipt, b8 as signReceipt, b9 as usdcContractByCaip2, ba as usdcContractFor, bb as usdcDomainNameFor, bc as usdcDomainVersionFor, bd as verifyDrainReceipt, be as verifyFundingReceipt, bf as verifyReceipt, bg as x402NetworkToCaip2 } from '../step-cache-3cT4Shk0.js';
+import { W as JsonValue, z as SignedRequestDomain, H as SignedRequestStatementHeader, X as FundingReceipt, Y as JobReceipt$1, y as SignedRequestAudience, _ as PaymentRequired, $ as X402Version, a0 as MppxCredential, a1 as Message, a2 as MessageType, a3 as MppxChallenge, a4 as X402_BATCH_SETTLEMENT_SCHEME, a5 as X402_EXACT_SCHEME, a6 as ReceiptCredit, C as Currency, a7 as X402Wallet, L as Logger$1, K as KVStore, a8 as ResourceInfo } from '../step-cache-BLPZNizw.js';
+export { a9 as BuildPaymentRequirementsOpts, aa as CapabilityDescriptor, ab as CashuMode, ac as CompleteContent, ad as DrainReceipt, ae as DrainReceiptEvent, af as ExactEvmPayload, ag as ExactEvmPayloadAuthorization, ah as FundingMethod, ai as MessageFrom, aj as PaymentPayload, ak as PaymentPayloadV1, al as PaymentPayloadV2, am as PaymentRequestContent, an as PaymentRequiredV2, ao as PaymentRequirements, ap as PaymentRequirementsV1, aq as PaymentRequirementsV2, ar as PromptContent, as as RAIL_REFUNDABLE, at as ReceiptOutcome, au as ReceiptPayment, av as SettleResponse, aw as StepCache, ax as StepRecord, ay as TextContent, az as UnsignedDrainReceipt, aA as UnsignedFundingReceipt, aB as UnsignedJobReceipt, aC as VerifyResponse, aD as WorkingContent, aE as X402Config, aF as X402ResponseBody, aG as X402SelfRelayRpcFailureReason, aH as X402_DEFAULT_NETWORK, aI as X402_V1_VERSION, aJ as X402_VERSION, aK as buildPaymentRequiredV2, aL as buildPaymentRequirements, aM as caip2ToX402Network, aN as canonicalRequestPath, aO as canonicaliseForSigning, aP as canonicalize, aQ as chainIdFromCaip2, aR as computeResultHash, aS as decodePayment, aT as decodePaymentRequiredHeader, aU as encodePayment, aV as encodePaymentRequiredHeader, aW as encodeSettleResponseHeader, aX as exactEvmAuthorization, aY as isArtifactMessage, aZ as isCancelMessage, a_ as isCompleteMessage, a$ as isDrainReceipt, b0 as isFundingReceipt, b1 as isPaymentRequestMessage, b2 as isPromptMessage, b3 as isSignedJobReceipt, b4 as isTextMessage, b5 as isWorkingMessage, b6 as paymentRequiredV2FromV1, b7 as signDrainReceipt, b8 as signFundingReceipt, b9 as signReceipt, ba as usdcContractByCaip2, bb as usdcContractFor, bc as usdcDomainNameFor, bd as usdcDomainVersionFor, be as verifyDrainReceipt, bf as verifyFundingReceipt, bg as verifyReceipt, bh as x402NetworkToCaip2 } from '../step-cache-BLPZNizw.js';
 import { SimplePool } from 'nostr-tools/pool';
 import { Session } from 'mppx/tempo';
 import { Pool } from 'pg';
 import { PaymentRequired as PaymentRequired$1 } from '@x402/core/types';
 import { ClientChannelStorage, BatchSettlementClientContext, BatchSettlementEvmScheme } from '@x402/evm/batch-settlement/client';
-export { e as FX_CACHE_TTL_MS, g as FX_RETRY_COUNT, w as warmFxSnapshot } from '../fx-BF_SG2i0.js';
-export { c as InvalidUsdPriceError, p as parseUsdPrice } from '../usd-BnuXoFl5.js';
+export { e as FX_CACHE_TTL_MS, g as FX_RETRY_COUNT, w as warmFxSnapshot } from '../fx-C6dl2LVI.js';
+export { c as InvalidUsdPriceError, p as parseUsdPrice } from '../usd-BgOfZlk6.js';
 import 'hono';
 import 'mppx';
 import '@x402/core/server';
@@ -5888,7 +5888,7 @@ interface SmartDenominationOptions {
 declare function computeSmartDenominations(amountSats: number, opts?: SmartDenominationOptions): number[];
 
 /** Current on-disk wallet schema version. Bumping requires a migration path. */
-declare const WALLET_VERSION: 8;
+declare const WALLET_VERSION: 9;
 /** Cap on the number of recent-spends entries persisted to the wallet. */
 declare const RECENT_SPENDS_CAP = 10;
 /**
@@ -6026,6 +6026,8 @@ interface PendingMint {
     amount_sats: number;
     /** ISO-8601 timestamp of the original `createMintQuote` call. */
     requested_at: string;
+    /** Quote expiry as unix seconds, when the mint supplied one. */
+    expires_at?: number;
     /** Pre-built blinded outputs, present only between `prepareMint` and `completeMint`. */
     minting?: PendingMintMintingState;
 }
@@ -6350,27 +6352,29 @@ interface AgentWallet {
 }
 /**
  * Read `~/.dvm/wallet.json` and return the parsed wallet. Returns `null` if
- * the file does not exist. Migrates older wallets in-memory to v8:
- *   - v1 → v8: rejects populated proofs/pending_mints (the v1 shape predated
+ * the file does not exist. Migrates older wallets in-memory to v9:
+ *   - v1 → v9: rejects populated proofs/pending_mints (the v1 shape predated
  *     the fund flow and is expected to be empty); fresh recent_spends,
  *     pending_submissions, nut13_counters; `mnemonic_fingerprint: null`.
- *   - v2 → v8: preserves all v2 fields, adds empty recent_spends,
+ *   - v2 → v9: preserves all v2 fields, adds empty recent_spends,
  *     pending_submissions, nut13_counters.
- *   - v3 → v8: renames recovery_pubkey/recovery_privkey → lock_pubkey/lock_privkey;
+ *   - v3 → v9: renames recovery_pubkey/recovery_privkey → lock_pubkey/lock_privkey;
  *     adds empty pending_submissions, nut13_counters.
- *   - v4 → v8: adds empty pending_submissions (internal-review), nut13_counters
+ *   - v4 → v9: adds empty pending_submissions (internal-review), nut13_counters
  *     (internal-review).
- *   - v5 → v8: adds empty nut13_counters and a null mnemonic_fingerprint
+ *   - v5 → v9: adds empty nut13_counters and a null mnemonic_fingerprint
  *     (internal-review). A v5 wallet inherits NUT-13 inactive — `getWallet` will
  *     stay in degraded mode until the user runs `dvm wallet restore
  *     <mnemonic>` to re-attach the sibling `~/.dvm/wallet.mnemonic`.
- *   - v6 → v8: pass-through for the v7 step (internal-review). Existing proofs are
+ *   - v6 → v9: pass-through for the v7 step (internal-review). Existing proofs are
  *     free-balance, so `reserved_for` and `t_expire` remain unset;
  *     `dvm wallet reserve` populates them on new pre-fund proofs.
- *   - v7 → v8: adds empty pending_melts (internal-review). No wallet predating the
+ *   - v7 → v9: adds empty pending_melts (internal-review). No wallet predating the
  *     cash-out verb can have a melt in flight, so an empty list is exact.
+ *   - v8 → v9: preserves pending mints without `expires_at`; the recovery sweep
+ *     applies its bounded legacy fallback to those entries.
  * Throws `DvmError("wallet_unknown_version", ...)` for files written by a
- * newer CLI so we never silently corrupt a future schema by treating it as v8.
+ * newer CLI so we never silently corrupt a future schema by treating it as v9.
  */
 declare function loadAgentWallet(): AgentWallet | null;
 /**
@@ -9257,6 +9261,10 @@ interface MeltSweepOptions {
     abandonAfterMs?: number;
     /** Override `getWallet`. */
     getWalletForMint?: (mintUrl: string) => Promise<Wallet>;
+    /** Maximum time spent retrying one transient quote-status read. Default 10 seconds. */
+    quoteRetryTimeoutMs?: number;
+    /** Sleep override for quote-status retry tests. */
+    sleep?: (ms: number) => Promise<void>;
 }
 /**
  * Reconcile every entry in `wallet.pending_melts[]` against its mint and
@@ -9557,10 +9565,14 @@ interface SweepResult {
 interface SweepOptions {
     /** Override `Date.now`. */
     now?: () => number;
-    /** Override `fundTimeoutMs`. */
+    /** Override the bounded fallback for legacy entries without a quote expiry. */
     expirationMs?: number;
     /** Override `getWallet`. */
     getWalletForMint?: (mintUrl: string) => Promise<Wallet>;
+    /** Maximum time spent retrying one transient quote-status read. Default 10 seconds. */
+    quoteRetryTimeoutMs?: number;
+    /** Sleep override for quote-status retry tests. */
+    sleep?: (ms: number) => Promise<void>;
 }
 /**
  * Reconcile every entry in `wallet.pending_mints[]` against its mint and