@dvmkit/sdk 0.1.3-rc.7 → 0.1.5-rc.7

package/dist/{chunk-3ZHMQCYP.js → chunk-NJFOV36R.js}

@@ -10,7 +10,7 @@ import {
 } from "./chunk-BQ2NMWKE.js";
 import {
   MemoryCreditLedger
-} from "./chunk-DBCLBYHP.js";
+} from "./chunk-KVEHHC7W.js";
 import {
   SIGNED_ENVELOPE_FIELDS,
   SignedRequestError,
@@ -35,7 +35,7 @@ import {
   localMessage,
   providerMessage,
   toJobRecord
-} from "./chunk-4B56DEEV.js";
+} from "./chunk-U6M3ATSG.js";
 import {
   ADMIN_AUTH_CLOCK_SKEW_SECONDS,
   ADMIN_AUTH_NONCE_TTL_SECONDS,
@@ -49,6 +49,7 @@ import {
   createMonotonicClock,
   getWallet,
   isPublicRequestId,
+  isTestMintUrl,
   isX402SettlementReconciliationReason,
   normaliseMintUrl,
   parseTraceparent,
@@ -59,7 +60,7 @@ import {
   toLockPubkey,
   verifyCashuToken,
   verifyChallenge
-} from "./chunk-2K7E3N2D.js";
+} from "./chunk-KXCKFIJI.js";
 import {
   X402_BATCH_SETTLEMENT_SCHEME,
   X402_DEFAULT_FACILITATOR,
@@ -99,7 +100,7 @@ import {
   pinDimension,
   withSpan,
   withTraceContext
-} from "./chunk-YDIYXGYL.js";
+} from "./chunk-E4EVGPDX.js";
 import {
   FxRateUnavailableError,
   InvalidCurrencyError,
@@ -140,7 +141,7 @@ import {
   advertisedMethods,
   challengeMeta,
   isTempoInsufficientFundsError
-} from "./chunk-5GFED3GJ.js";
+} from "./chunk-NPIW5VR5.js";
 
 // src/sdk/server/lock-pubkey-store.ts
 async function initLockPubkeyTable(db) {
@@ -3074,7 +3075,8 @@ import {
   Amount as Amount2,
   CheckStateEnum,
   getP2PKExpectedWitnessPubkeys,
-  getTagInt
+  getTagInt,
+  verifyDleqIfPresent
 } from "@cashu/cashu-ts";
 function valueCashuFunding(wallet, proofs) {
   let grossSats = Amount2.zero();
@@ -3091,6 +3093,9 @@ function valueCashuFunding(wallet, proofs) {
   };
 }
 async function acceptAccumulatorPayment(opts) {
+  if (opts.disposable && !opts.mints.every(isTestMintUrl)) {
+    throw new Error("Disposable Cashu accepts only known test or loopback mints.");
+  }
   if (!opts.requestId) {
     return {
       kind: "rejected",
@@ -3115,6 +3120,16 @@ async function acceptAccumulatorPayment(opts) {
     const walletProvider = opts.walletProvider ?? getWallet;
     const wallet = await walletProvider(mintUrl);
     proofs = wallet.decodeToken(opts.cashuToken).proofs;
+    if (meta.unit !== "sat" || proofs.length === 0) {
+      throw new Error("Cashu payment requires nonempty sat proofs.");
+    }
+    for (const proof of proofs) {
+      if (!proof.dleq || !verifyDleqIfPresent(proof, wallet.getKeyset(proof.id))) {
+        throw new Error(
+          "Cashu payment requires valid mint-provided NUT-12 DLEQ evidence for every proof. Request a fresh token from a compatible mint."
+        );
+      }
+    }
     valuation = valueCashuFunding(wallet, proofs);
   } catch (err) {
     return {
@@ -3149,6 +3164,9 @@ async function acceptAccumulatorPayment(opts) {
       };
     }
     const allowedNormalised = allowed.map(toLockPubkey);
+    if (opts.disposable && (allowedNormalised.length !== 1 || (getTagInt(p.secret, "n_sigs") ?? 1) !== 1)) {
+      return { kind: "rejected", code: "not_p2pk_locked", message: "Disposable Cashu requires an exclusive single-signature P2PK lock." };
+    }
     const match = accepted.find((pk) => allowedNormalised.includes(pk));
     if (!match) {
       return {
@@ -3185,6 +3203,9 @@ async function acceptAccumulatorPayment(opts) {
         message: "One or more proofs are pending at the mint \u2014 retry shortly."
       };
     }
+    if (states.some((state) => state.state !== CheckStateEnum.UNSPENT)) {
+      return { kind: "rejected", code: "mint_unreachable", message: "Mint returned an unknown proof state." };
+    }
   } catch (err) {
     return {
       kind: "rejected",
@@ -3202,7 +3223,13 @@ async function acceptAccumulatorPayment(opts) {
     tExpireMsByIndex
   };
   try {
-    if (opts.withCommitTx) {
+    if (opts.disposable) {
+      const account = opts.withDisposableLedger;
+      if (!account) throw new Error("Disposable Cashu requires atomic credit accounting.");
+      await opts.disposable.commit(opts.requestId, proofs, (ledger) => account(ledger, acceptedValue));
+    } else if (!opts.db) {
+      throw new Error("Cashu accumulator requires a storage backend.");
+    } else if (opts.withCommitTx) {
       const withCommitTx = opts.withCommitTx;
       const client = await opts.db.connect();
       try {
@@ -3254,7 +3281,7 @@ function parseNut11LocktimeMs(secret) {
 var UPFRONT_CHALLENGE_TTL_MS = 5 * 60 * 1e3;
 var CONSUMED_CREDENTIAL_TTL_MS = 2 * UPFRONT_CHALLENGE_TTL_MS;
 function devModeSkipsPaymentVerification(opts) {
-  return Boolean(opts.devMode) && !opts.mints;
+  return Boolean(opts.devMode) && !opts.mints && !opts.x402 && !opts.mpp && !opts.paymentMethods?.some((method) => method === "cashu" || method === "x402" || method === "tempo");
 }
 var PAYMENT_PROOF_KEYS = ["cashu_token", "x402_payment", "tempo_credential"];
 function hasPaymentProof(content) {
@@ -3457,7 +3484,7 @@ async function verifyUpfrontPayment(opts) {
         }
       };
     }
-    if (opts.cashuMode === "p2pk-accumulator" && opts.accumulatorDb && opts.dvmId && opts.lockPubkeys && opts.lockPubkeys.length > 0) {
+    if (opts.cashuMode === "p2pk-accumulator" && (opts.accumulatorDb || opts.disposableCashu) && opts.dvmId && opts.lockPubkeys && opts.lockPubkeys.length > 0) {
       return verifyAccumulatorReceipt(opts, mints, requiredMsats, ledgerCtx);
     }
     return {
@@ -3605,7 +3632,7 @@ async function verifyUpfrontPayment(opts) {
           x402Requirements
         });
       }
-      const { verifyX402Payment } = await import("./x402-T2C5MX3T.js");
+      const { verifyX402Payment } = await import("./x402-5H27DCBE.js");
       const receipt = await verifyX402Payment(
         x402Payment,
         x402Config,
@@ -4454,7 +4481,7 @@ function buildPaymentErrorResponse(body, challenges, x402Requirements, status, x
 async function verifyIncomingPayment(body, opts, snapshot) {
   if (body.type !== "payment") return {};
   if (body.content.cashu_token) {
-    if (opts.cashuMode === "p2pk-accumulator" && opts.accumulatorDb && opts.dvmId && opts.lockPubkeys && opts.lockPubkeys.length > 0) {
+    if (opts.cashuMode === "p2pk-accumulator" && (opts.accumulatorDb || opts.disposableCashu) && opts.dvmId && opts.lockPubkeys && opts.lockPubkeys.length > 0) {
       const mints = opts.mints ?? [];
       if (mints.length === 0) {
         return {
@@ -4472,6 +4499,7 @@ async function verifyIncomingPayment(body, opts, snapshot) {
         {
           cashuToken: body.content.cashu_token,
           accumulatorDb: opts.accumulatorDb,
+          disposableCashu: opts.disposableCashu,
           dvmId: opts.dvmId,
           lockPubkeys: opts.lockPubkeys,
           requestId,
@@ -4533,7 +4561,7 @@ async function verifyIncomingPayment(body, opts, snapshot) {
           snapshot
         });
       }
-      const { verifyX402Payment } = await import("./x402-T2C5MX3T.js");
+      const { verifyX402Payment } = await import("./x402-5H27DCBE.js");
       const receipt = await verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -4897,7 +4925,7 @@ function applyPaymentInfoToJob(job, info) {
 async function processIncomingPayment(job, body, opts) {
   if (body.type !== "payment") return null;
   if (body.content.cashu_token) {
-    if (opts.cashuMode === "p2pk-accumulator" && opts.accumulatorDb && opts.dvmId && opts.lockPubkeys && opts.lockPubkeys.length > 0) {
+    if (opts.cashuMode === "p2pk-accumulator" && (opts.accumulatorDb || opts.disposableCashu) && opts.dvmId && opts.lockPubkeys && opts.lockPubkeys.length > 0) {
       const mints = opts.mints ?? [];
       if (mints.length === 0) {
         return {
@@ -4912,6 +4940,7 @@ async function processIncomingPayment(job, body, opts) {
         {
           cashuToken: body.content.cashu_token,
           accumulatorDb: opts.accumulatorDb,
+          disposableCashu: opts.disposableCashu,
           dvmId: opts.dvmId,
           lockPubkeys: opts.lockPubkeys,
           requestId,
@@ -4946,7 +4975,7 @@ async function processIncomingPayment(job, body, opts) {
     try {
       const requiredMsats = job.pendingPaymentMsats ?? 0;
       const requiredUsdcMicro = job.pendingX402AmountUsdcMicro !== void 0 ? BigInt(job.pendingX402AmountUsdcMicro) : BigInt(msatsToUsdc(requiredMsats, rate));
-      const { verifyX402Payment } = await import("./x402-T2C5MX3T.js");
+      const { verifyX402Payment } = await import("./x402-5H27DCBE.js");
       const receipt = await verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -5066,7 +5095,7 @@ function creditPendingPayment(job) {
 }
 async function verifyAccumulatorReceipt(opts, mints, requiredMsats, ledgerCtx) {
   const { cashuToken, accumulatorDb, dvmId, lockPubkeys, mintHealthTracker } = opts;
-  if (!cashuToken || !accumulatorDb || !dvmId || !lockPubkeys || lockPubkeys.length === 0) {
+  if (!cashuToken || !accumulatorDb && !opts.disposableCashu || !dvmId || !lockPubkeys || lockPubkeys.length === 0) {
     return {
       paidMsats: 0,
       receivedProofs: [],
@@ -5145,6 +5174,17 @@ async function verifyAccumulatorReceipt(opts, mints, requiredMsats, ledgerCtx) {
       requestId: opts.requestId,
       mints,
       db: accumulatorDb,
+      disposable: opts.disposableCashu,
+      withDisposableLedger: ledgerCtx && requestId ? async (ledger, accepted) => {
+        credited = await fundAndDraw({ ...ledgerCtx, ledger }, {
+          rail: "cashu",
+          paymentId: requestId,
+          paidMsats: accepted.paidMsats,
+          grossPaidMsats: accepted.grossMsats,
+          cashuInputFeeMsats: accepted.inputFeeMsats,
+          mint: tokenMint
+        });
+      } : void 0,
       dvmId,
       lockPubkeys,
       beforeCommit,
@@ -6360,8 +6400,8 @@ function authErrorBody(err, opts = {}) {
     hint: "Regenerate the request with the current timestamp + a fresh nonce; sign with secp256k1+BIP-340 Schnorr over the canonical JSON form of the input."
   };
 }
-function infoSchemaUrl(requestUrl) {
-  return `${new URL(requestUrl).origin}/v1/info`;
+function infoSchemaUrl(requestUrl, publicOrigin) {
+  return `${publicOrigin ?? new URL(requestUrl).origin}/v1/info`;
 }
 function callerInputIssues(issues) {
   if (!issues) return [];
@@ -9118,6 +9158,7 @@ function isRecord2(value) {
 import { randomBytes as randomBytes4 } from "crypto";
 
 // src/sdk/server/context.ts
+import { AsyncLocalStorage } from "async_hooks";
 import { randomBytes as randomBytes3 } from "crypto";
 
 // src/sdk/server/instrumented-kv.ts
@@ -9160,6 +9201,7 @@ function instrumentKVStore(inner) {
 }
 
 // src/sdk/server/context.ts
+var stepCostScope = new AsyncLocalStorage();
 function buildContext(job, opts) {
   const log = createConsoleLogger(job.id);
   const instrumentedStore = instrumentKVStore(opts.store);
@@ -9180,6 +9222,45 @@ function buildContext(job, opts) {
   let creditedToHandlerMsats = 0;
   let creditedToHandlerMicro = 0;
   let poolBasis = false;
+  let declaredCostAmount = 0;
+  let declaredCostCurrency;
+  let declaredCostRevision = 0;
+  let costPoisoned = false;
+  const stepCostOwner = {};
+  const declareCost = (declared) => {
+    if (terminated("cost")) return;
+    const currency = validateCurrency(declared.currency);
+    const total = declaredCostAmount + declared.amount;
+    const micro = Math.round(total * 1e6);
+    if (!Number.isFinite(declared.amount) || declared.amount < 0 || !Number.isSafeInteger(micro)) {
+      throw new RangeError(
+        `ctx.cost amounts must each be a finite, non-negative number of currency units, and must total no more than ${Math.floor(Number.MAX_SAFE_INTEGER / 1e6)}; got ${String(declared.amount)}`
+      );
+    }
+    declaredCostRevision += 1;
+    job.costRevision = declaredCostRevision;
+    const replayable = { amount: declared.amount, currency };
+    const scope = stepCostScope.getStore();
+    if (scope?.owner === stepCostOwner) {
+      for (const frame of scope.frames) frame.push(replayable);
+    }
+    if (declaredCostCurrency !== void 0 && declaredCostCurrency !== currency) {
+      costPoisoned = true;
+      log.error("ctx.cost() currency switched mid-job \u2014 this job reports no cost", {
+        declared: currency,
+        pinned: declaredCostCurrency
+      });
+    }
+    declaredCostCurrency ??= currency;
+    if (costPoisoned) {
+      job.costAmountMicro = void 0;
+      job.costCurrency = void 0;
+      return;
+    }
+    declaredCostAmount = total;
+    job.costAmountMicro = micro;
+    job.costCurrency = currency;
+  };
   return {
     jobId: job.id,
     tags: job.tags,
@@ -9572,10 +9653,21 @@ function buildContext(job, opts) {
       providerMessage(job, "cancel", { reason: error });
       runTerminal();
     },
+    cost: declareCost,
     step: async (id, fn) => {
-      if (job.stepCache.has(id)) return job.stepCache.get(id);
-      const result = await fn();
-      job.stepCache.set(id, result);
+      if (job.stepCache.has(id)) {
+        const record = job.stepCache.getRecord(id);
+        for (const declared of record.costs ?? []) declareCost(declared);
+        return record.value;
+      }
+      const costs = [];
+      const scope = stepCostScope.getStore();
+      const parentFrames = scope?.owner === stepCostOwner ? scope.frames : [];
+      const result = await stepCostScope.run(
+        { owner: stepCostOwner, frames: [...parentFrames, costs] },
+        fn
+      );
+      job.stepCache.set(id, result, costs);
       return result;
     },
     state: job.state,
@@ -9941,6 +10033,9 @@ async function reapExpiredKeysetRows(opts, db) {
 // src/sdk/server/job-manager.ts
 var STALE_JOB_WATCHDOG_HEADROOM_MS = 9e4;
 var DEFAULT_PROCESSING_WATCHDOG_MS = 5 * 6e4;
+var TERMINAL_COST_RECOVERY_BATCH = 100;
+var TERMINAL_COST_RECOVERY_MAX_PAGES = 10;
+var TERMINAL_COST_RECOVERY_INTERVAL_MS = 3e4;
 var DEFAULT_HEARTBEAT_INTERVAL_MS = 3e4;
 var DEFAULT_REACTIVATION_CLAIM_GRACE_MS = 150;
 var REACTIVATION_CLAIM_POLL_MS = 25;
@@ -9959,7 +10054,12 @@ var ORPHAN_SWEEP_CLAIMS = /* @__PURE__ */ new WeakSet();
 var ATTACH_RAILS = ["cashu", "x402", "tempo"];
 var CREDIT_INBOUND_ATTEMPTS = 3;
 var CREDIT_INBOUND_BACKOFF_MS = 50;
+var TERMINAL_COST_HANDOFF_RETRY_INITIAL_MS = 100;
+var TERMINAL_COST_HANDOFF_RETRY_MAX_MS = 3e4;
 var CREDIT_INBOUND_READ_ATTEMPTS = 2;
+function isTerminalCostRecoveryStore(store) {
+  return "saveForDvm" in store && "listUnreportedTerminalCosts" in store && "markTerminalCostReported" in store;
+}
 var JobManager = class {
   descriptor;
   opts;
@@ -9967,6 +10067,8 @@ var JobManager = class {
   jobStore;
   idleTimers = /* @__PURE__ */ new Map();
   cleanupTimers = /* @__PURE__ */ new Map();
+  /** Cost revisions held only by a terminal handler owner until its durable merge succeeds. */
+  terminalCostHandoffRetryTimers = /* @__PURE__ */ new Map();
   /** Per-job NOTIFY unsubscribe handles for the durable-status watch (internal-review). */
   statusWatchers = /* @__PURE__ */ new Map();
   /** Job ids whose durable-status re-read is in flight — coalesces notify storms (internal-review). */
@@ -9990,6 +10092,7 @@ var JobManager = class {
   staleSweepTimer;
   heartbeatTimer;
   orphanDrawSweepTimer;
+  terminalCostRecoveryTimer;
   jobRetentionSweepTimer;
   jobRetentionBootTimer;
   /** This manager holds {@link ORPHAN_SWEEP_CLAIMS} for its ledger. */
@@ -10007,6 +10110,8 @@ var JobManager = class {
   monotonicNowMs = createMonotonicClock();
   sweepInFlight = false;
   orphanSweepInFlight = false;
+  terminalCostRecoveryInFlight = false;
+  terminalCostRecoveryResumeAfter;
   jobRetentionSweepInFlight = false;
   heartbeatInFlight = false;
   /**
@@ -10132,6 +10237,19 @@ var JobManager = class {
         }
       }
     }
+    if (opts.dvmId && opts.onJobCost && isTerminalCostRecoveryStore(this.jobStore)) {
+      this.terminalCostRecoveryTimer = setInterval(() => {
+        void this.recoverTerminalCosts().catch((err) => {
+          console.error(
+            JSON.stringify({
+              level: "terminal_cost_recovery_failed",
+              error: err instanceof Error ? err.message : String(err)
+            })
+          );
+        });
+      }, TERMINAL_COST_RECOVERY_INTERVAL_MS);
+      this.terminalCostRecoveryTimer.unref();
+    }
   }
   /** Active in-memory jobs. */
   get activeJobs() {
@@ -10431,7 +10549,11 @@ var JobManager = class {
         record.seq = Math.max(record.seq, highSeq);
       }
     }
-    await this.jobStore.save(record);
+    if (this.opts.dvmId && isTerminalCostRecoveryStore(this.jobStore)) {
+      await this.jobStore.saveForDvm(record, this.opts.dvmId);
+    } else {
+      await this.jobStore.save(record);
+    }
   }
   /**
    * Cross-machine terminal guard (internal-review). `buildContext`'s guard reads the
@@ -10472,6 +10594,7 @@ var JobManager = class {
     job.pendingPrompts.clear();
     job.pendingPayment = null;
     abortJob(job, reason);
+    const terminalCostPersisted = durable.status === "completed" ? true : await this.tryPersistAdoptedTerminalCost(job, 1);
     if (durable.status !== "completed") {
       localMessage(job, "provider", "cancel", { reason });
     }
@@ -10486,8 +10609,78 @@ var JobManager = class {
     this.clearIdleTimer(job.id);
     void this.issueReceiptForStoredJob(job.id);
     this.scheduleCleanup(job);
+    if (durable.status !== "completed" && terminalCostPersisted) {
+      await this.reportJobCost(job);
+    }
     return true;
   }
+  /**
+   * Persist an adopted terminal cost, retaining the in-memory revision for a
+   * later retry when the durable store is transiently unavailable.
+   */
+  async tryPersistAdoptedTerminalCost(job, attempt) {
+    try {
+      await this.persistAdoptedTerminalCost(job);
+      return true;
+    } catch (err) {
+      this.scheduleTerminalCostHandoffRetry(job, attempt, err);
+      return false;
+    }
+  }
+  /** Retry outside the status watcher, which correctly stops once the job is terminal. */
+  scheduleTerminalCostHandoffRetry(job, attempt, err) {
+    if (this.terminalCostHandoffRetryTimers.has(job.id)) return;
+    const delayMs = Math.min(
+      TERMINAL_COST_HANDOFF_RETRY_INITIAL_MS * 2 ** Math.min(attempt - 1, 8),
+      TERMINAL_COST_HANDOFF_RETRY_MAX_MS
+    );
+    console.error(
+      JSON.stringify({
+        level: "terminal_cost_handoff_retry_scheduled",
+        jobId: job.id,
+        attempt,
+        delayMs,
+        error: err instanceof Error ? err.message : String(err)
+      })
+    );
+    const timer = setTimeout(() => {
+      this.terminalCostHandoffRetryTimers.delete(job.id);
+      void this.retryTerminalCostHandoff(job, attempt + 1);
+    }, delayMs);
+    timer.unref();
+    this.terminalCostHandoffRetryTimers.set(job.id, timer);
+  }
+  async retryTerminalCostHandoff(job, attempt) {
+    if (!await this.tryPersistAdoptedTerminalCost(job, attempt)) return;
+    await this.reportJobCost(job);
+  }
+  /** Durably merge a terminal handler owner's latest cost before reporting it. */
+  async persistAdoptedTerminalCost(job) {
+    const dvmId = this.opts.dvmId;
+    const localRevision = job.costRevision;
+    if (localRevision === void 0 || !dvmId || !isTerminalCostRecoveryStore(this.jobStore)) {
+      return;
+    }
+    const durable = await this.jobStore.get(job.id);
+    if (!durable || durable.status !== job.status) {
+      throw new Error(`Terminal cost merge lost durable job ${job.id}`);
+    }
+    if ((durable.costRevision ?? -1) > localRevision) {
+      job.costAmountMicro = durable.costAmountMicro;
+      job.costCurrency = durable.costCurrency;
+      job.costRevision = durable.costRevision;
+      return;
+    }
+    await this.jobStore.saveForDvm(
+      {
+        ...durable,
+        costAmountMicro: job.costAmountMicro,
+        costCurrency: job.costCurrency,
+        costRevision: localRevision
+      },
+      dvmId
+    );
+  }
   /**
    * Watch the durable status of a locally-active job (internal-review).
    *
@@ -10763,7 +10956,7 @@ var JobManager = class {
         );
         if (claimed) {
           swept++;
-          await this.issueReceiptForStoredJob(record.id);
+          await this.finalizeStoredTerminal(record.id);
           console.warn(
             JSON.stringify({
               level: awaiting ? "stale_job_cancelled" : "stale_job_failed",
@@ -11543,6 +11736,7 @@ var JobManager = class {
         resourcePath: `/v1/job/${job.id}/messages`,
         cashuMode: this.opts.cashuMode,
         accumulatorDb: this.opts.cashuMode === "p2pk-accumulator" ? this.opts.db : void 0,
+        disposableCashu: this.opts.disposableCashu,
         dvmId: this.opts.dvmId,
         lockPubkeys: extra?.lockPubkeys,
         mintHealthTracker: extra?.mintHealthTracker,
@@ -11981,8 +12175,25 @@ var JobManager = class {
    * `context.ts`). The gap is visible to callers — the `seq` series skips a
    * number — which is precisely the completeness signal receipts exist for.
    */
+  async observePaidCompletion(record) {
+    const callback = this.opts.onPaidJobCompleted;
+    if (!callback || record.status !== "completed" || !record.paymentRail || !record.creditId || !record.drawId || !this.opts.creditLedger) return;
+    const draw = await this.opts.creditLedger.getDraw({ creditId: record.creditId, drawId: record.drawId }).catch(() => void 0);
+    const rail = draw?.railValue.rail;
+    const currency = draw?.railValue.creditCurrency;
+    if (draw?.status !== "settled" || draw.amountMicro <= 0 || !currency || !rail || !isFundingRail(rail)) return;
+    const testFunds = rail === "lightning" ? null : this.opts.paymentMode?.rails[rail].testFunds ?? null;
+    try {
+      await callback({ jobId: record.id, rail, amountMicro: draw.amountMicro, currency, testFunds });
+    } catch (error) {
+      console.error(`[${record.id}] Paid completion observer failed:`, error);
+    }
+  }
   async issueReceipt(record) {
-    if (record.receipt) return record.receipt;
+    if (record.receipt) {
+      await this.observePaidCompletion(record);
+      return record.receipt;
+    }
     if (!isReceiptableStatus(record.status)) return void 0;
     let credit;
     try {
@@ -12002,13 +12213,18 @@ var JobManager = class {
       return void 0;
     }
     const issuer = this.opts.receiptIssuer;
-    if (!issuer) return void 0;
+    if (!issuer) {
+      await this.observePaidCompletion(record);
+      return void 0;
+    }
     if (!isReceiptIssuingStore(this.jobStore)) return void 0;
     const store = this.jobStore;
     try {
       const seq = await store.claimReceiptSeq(record.id);
       const receipt = issuer.issue(record, seq, void 0, credit);
-      return await store.saveReceipt(record.id, receipt) ?? receipt;
+      const saved = await store.saveReceipt(record.id, receipt) ?? receipt;
+      await this.observePaidCompletion(record);
+      return saved;
     } catch (err) {
       console.error(
         JSON.stringify({
@@ -12135,6 +12351,7 @@ var JobManager = class {
   async finalizeTerminal(job) {
     await this.attachReceipt(job);
     await this.persistJob(job).catch(() => void 0);
+    await this.reportJobCost(job);
   }
   /**
    * Issue a receipt for a job this process doesn't hold in `activeJobs` — a
@@ -12151,13 +12368,117 @@ var JobManager = class {
     if (active && receipt) active.receipt = receipt;
     return receipt;
   }
+  /**
+   * Finish accounting for a terminal written directly to the store — the
+   * stale reaper and a cancel handled on a different machine (internal-review).
+   */
+  async finalizeStoredTerminal(jobId) {
+    const receipt = await this.issueReceiptForStoredJob(jobId);
+    const record = await this.jobStore.get(jobId).catch(() => void 0);
+    if (record && isTerminal(record.status)) await this.reportJobCost(record);
+    return receipt;
+  }
   /** Handle job reaching terminal state (completed, failed, cancelled). */
   async handleJobTerminal(job) {
     this.clearIdleTimer(job.id);
     await this.attachReceipt(job);
-    await this.bookRevenue(job);
+    const booked = await this.bookRevenue(job);
+    if (!booked) await this.reportJobCost(job);
     this.scheduleCleanup(job);
   }
+  /**
+   * Re-enqueue terminal cost-only rows left between the job commit and outbox
+   * insert. The marker advances only after `onJobCost` resolves, which for the
+   * SDK reporter means the local durable insert has committed; a crash after
+   * that insert but before the marker can duplicate a payload, but the
+   * revisioned platform contract makes that replay harmless.
+   */
+  async recoverTerminalCosts() {
+    const store = this.jobStore;
+    const dvmId = this.opts.dvmId;
+    if (!dvmId || !this.opts.onJobCost || !isTerminalCostRecoveryStore(store)) {
+      return { examined: 0, queued: 0, complete: true };
+    }
+    if (this.terminalCostRecoveryInFlight) {
+      return { examined: 0, queued: 0, complete: false };
+    }
+    this.terminalCostRecoveryInFlight = true;
+    let examined = 0;
+    let queued = 0;
+    let cursor = this.terminalCostRecoveryResumeAfter;
+    try {
+      for (let page = 0; page < TERMINAL_COST_RECOVERY_MAX_PAGES; page++) {
+        const candidates = await store.listUnreportedTerminalCosts({
+          dvmId,
+          limit: TERMINAL_COST_RECOVERY_BATCH,
+          ...cursor ? { afterJobId: cursor } : {}
+        });
+        for (const record of candidates) {
+          examined++;
+          cursor = record.id;
+          if (await this.reportJobCost(record)) queued++;
+        }
+        if (candidates.length < TERMINAL_COST_RECOVERY_BATCH) {
+          this.terminalCostRecoveryResumeAfter = void 0;
+          if (examined > 0) {
+            console.log(
+              JSON.stringify({
+                level: "info",
+                event: "terminal_cost_recovery_complete",
+                dvmId,
+                examined,
+                queued
+              })
+            );
+          }
+          return { examined, queued, complete: true };
+        }
+      }
+      this.terminalCostRecoveryResumeAfter = cursor;
+      console.warn(
+        JSON.stringify({
+          level: "terminal_cost_recovery_truncated",
+          dvmId,
+          examined,
+          queued,
+          resumeAfterJobId: cursor
+        })
+      );
+      return { examined, queued, complete: false };
+    } finally {
+      this.terminalCostRecoveryInFlight = false;
+    }
+  }
+  /** Report the latest declared-cost state only when no revenue event carried it. */
+  async reportJobCost(job) {
+    const onJobCost = this.opts.onJobCost;
+    if (!onJobCost || job.status !== "completed" && job.status !== "failed" && job.status !== "cancelled") {
+      return false;
+    }
+    const costRevision = job.costRevision ?? (job.costAmountMicro !== void 0 && job.costCurrency !== void 0 ? 0 : void 0);
+    if (costRevision === void 0) return false;
+    const payload = {
+      dvmId: this.opts.dvmId ?? "",
+      jobId: job.id,
+      ...job.capability ? { capability: job.capability } : {},
+      outcome: job.status,
+      costRevision,
+      cost: job.costAmountMicro !== void 0 && job.costCurrency !== void 0 ? { amountMicro: job.costAmountMicro, currency: job.costCurrency } : null
+    };
+    try {
+      await onJobCost(payload);
+      if (isTerminalCostRecoveryStore(this.jobStore)) {
+        const marked = await this.jobStore.markTerminalCostReported(job.id, costRevision);
+        if (!marked) {
+          return false;
+        }
+      }
+    } catch (err) {
+      console.error(`[${job.id}] Job cost reporting failed:`, err);
+      return false;
+    }
+    return true;
+  }
   /**
    * Report a completed paid job's revenue (internal-review, re-keyed by internal-review).
    * Fire-and-forget — the `RevenueReporter` owns persistence and retry.
@@ -12296,6 +12617,9 @@ var JobManager = class {
       onJobCompleted({
         dvmId: this.opts.dvmId ?? "",
         jobId: job.id,
+        // Legacy Postgres rows surface a missing capability as `""`. Keep
+        // that absence distinct from every real capability name on the wire.
+        ...job.capability ? { capability: job.capability } : {},
         paidMsats: bookedMsats,
         paymentMint: job.paymentMint,
         rail: job.paymentRail,
@@ -12303,6 +12627,11 @@ var JobManager = class {
         nativeAmount: job.nativeAmount,
         nativeAsset: job.nativeAsset,
         cashuFlow: job.cashuFlow,
+        // Absent unless the handler declared one, and absent is a fact: the
+        // platform shows "no costs reported" rather than a zero cost and a
+        // 100% margin (internal-review). Both halves or neither — a bare amount
+        // in an unnamed currency is not a cost.
+        ...job.costAmountMicro !== void 0 && job.costCurrency !== void 0 ? { cost: { amountMicro: job.costAmountMicro, currency: job.costCurrency } } : {},
         ...credit
       })
     ).catch((err) => {
@@ -12329,6 +12658,10 @@ var JobManager = class {
       clearTimeout(timer);
       this.cleanupTimers.delete(id);
     }
+    for (const [id, timer] of this.terminalCostHandoffRetryTimers) {
+      clearTimeout(timer);
+      this.terminalCostHandoffRetryTimers.delete(id);
+    }
     for (const id of [...this.statusWatchers.keys()]) {
       this.unwatchDurableStatus(id);
     }
@@ -12348,6 +12681,10 @@ var JobManager = class {
       clearInterval(this.orphanDrawSweepTimer);
       this.orphanDrawSweepTimer = void 0;
     }
+    if (this.terminalCostRecoveryTimer) {
+      clearInterval(this.terminalCostRecoveryTimer);
+      this.terminalCostRecoveryTimer = void 0;
+    }
     if (this.jobRetentionBootTimer) {
       clearTimeout(this.jobRetentionBootTimer);
       this.jobRetentionBootTimer = void 0;
@@ -13380,7 +13717,7 @@ var X402FacilitatorHealth = class {
           facilitator: support.facilitator,
           network: support.network,
           reason: support.reason,
-          message: "x402 omitted because the configured facilitator advertises no supported exact generation on this network. Other rails are unaffected."
+          message: "Exact x402 is unavailable because the configured facilitator advertises no supported exact generation on this network. Configured batch settlement is evaluated separately; other rails are unaffected."
         })
       );
     } else if (!support.exact.v1 || !support.exact.v2 || this.config.batchSettlement && !support.batchSettlement) {
@@ -15293,6 +15630,23 @@ function parseSerializedDleq(raw) {
   return { e: dleq.e, s: dleq.s, ...dleq.r !== void 0 ? { r: dleq.r } : {} };
 }
 
+// src/sdk/server/caller-facing-url.ts
+function resolvePublicOrigin(value) {
+  if (!value) return void 0;
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "http:" && url.protocol !== "https:") return void 0;
+    return url.origin;
+  } catch {
+    return void 0;
+  }
+}
+function callerFacingRequestUrl(requestUrl, publicOrigin) {
+  if (!publicOrigin) return requestUrl;
+  const request = new URL(requestUrl);
+  return `${publicOrigin}${request.pathname}${request.search}`;
+}
+
 // src/sdk/server/credit-expiry-sweep.ts
 function startCreditExpirySweep(ledger, opts = {}) {
   const sweepExpiredCredits = ledger.sweepExpiredCredits?.bind(ledger);
@@ -16308,194 +16662,236 @@ function revenueReporterBannerState(s) {
   return s.devMode ? "(dev \u2014 not reporting)" : "misconfigured";
 }
 async function createDVMServer(descriptor, opts) {
-  if (process.env.DVMKIT_CASHU_MINTS && opts.cashuMode === void 0) {
-    console.warn(
-      JSON.stringify({
-        level: "cashu_opts_env_ignored",
-        message: "DVMKIT_CASHU_MINTS is set in env but cashuMode opt is undefined \u2014 cashu is NOT active. Pass cashuMode, lockPubkey, and db via createDVMHost to enable it."
-      })
-    );
-  }
-  const envMaybe = opts.env;
-  const platformToken = opts.platformToken ?? envMaybe.DVMKIT_PLATFORM_TOKEN;
-  const platformUrl = opts.platformUrl ?? envMaybe.DVMKIT_PLATFORM_URL;
-  const dvmId = opts.dvmId;
   let revenueReporter;
   let payoutReporter;
-  if (!opts.onJobCompleted && platformToken && platformUrl && dvmId && opts.db) {
-    const { RevenueReporter } = await import("./revenue-reporter-XXSU5KVB.js");
-    const reporter = new RevenueReporter(opts.db, platformUrl, platformToken);
-    await reporter.init();
-    reporter.startRetryLoop();
-    revenueReporter = reporter;
-    const { MemoryX402BatchStore, PayoutReporter } = await import("./payout-reporter-RG6XNGPI.js");
-    payoutReporter = new PayoutReporter({
+  let unsubscribeTempoSettlementReadiness;
+  let creditExpirySweep;
+  let x402ChannelStorage;
+  let x402BatchSettlement;
+  let server;
+  let shutdownPromise;
+  const shutdown = () => shutdownPromise ??= (async () => {
+    const errors = [];
+    const capture = async (operation) => {
+      try {
+        await operation();
+      } catch (error) {
+        errors.push(error);
+      }
+    };
+    let settlementStopped;
+    if (server) {
+      try {
+        settlementStopped = server.shutdown();
+      } catch (error) {
+        errors.push(error);
+      }
+    } else if (x402BatchSettlement) {
+      try {
+        settlementStopped = x402BatchSettlement.stop();
+      } catch (error) {
+        errors.push(error);
+      }
+    }
+    await capture(() => payoutReporter?.stop());
+    await capture(() => revenueReporter?.stop());
+    await capture(() => creditExpirySweep?.stop());
+    await capture(() => unsubscribeTempoSettlementReadiness?.());
+    if (settlementStopped) await capture(() => settlementStopped);
+    if (x402ChannelStorage) {
+      await capture(() => x402ChannelStorage?.close());
+    }
+    if (errors.length === 1) throw errors[0];
+    if (errors.length > 1) {
+      throw new AggregateError(errors, `${String(errors.length)} DVM shutdown operations failed`);
+    }
+  })();
+  try {
+    if (process.env.DVMKIT_CASHU_MINTS && opts.cashuMode === void 0) {
+      console.warn(
+        JSON.stringify({
+          level: "cashu_opts_env_ignored",
+          message: "DVMKIT_CASHU_MINTS is set in env but cashuMode opt is undefined \u2014 cashu is NOT active. Pass cashuMode, lockPubkey, and db via createDVMHost to enable it."
+        })
+      );
+    }
+    const envMaybe = opts.env;
+    const platformToken = opts.platformToken ?? envMaybe.DVMKIT_PLATFORM_TOKEN;
+    const platformUrl = opts.platformUrl ?? envMaybe.DVMKIT_PLATFORM_URL;
+    const dvmId = opts.dvmId;
+    if (!opts.onJobCompleted && platformToken && platformUrl && dvmId && opts.db) {
+      const { RevenueReporter } = await import("./revenue-reporter-ASZ7SHHH.js");
+      const reporter = new RevenueReporter(opts.db, platformUrl, platformToken);
+      revenueReporter = reporter;
+      await reporter.init();
+      reporter.startRetryLoop();
+      const { MemoryX402BatchStore, PayoutReporter } = await import("./payout-reporter-RG6XNGPI.js");
+      payoutReporter = new PayoutReporter({
+        dvmId,
+        db: opts.db,
+        transport: reporter,
+        // The same condition the admin routes and the accumulator monitor mount on.
+        cashu: opts.cashuMode === "p2pk-accumulator" && !!opts.lockPubkey,
+        ...typeof opts.db.connect === "function" ? {} : { batchStore: new MemoryX402BatchStore() }
+      });
+      await payoutReporter.init();
+      payoutReporter.start();
+    }
+    assertRevenueReporterReady({
+      failFast: opts.failFast ?? false,
+      devMode: opts.devMode,
+      platformToken,
+      platformUrl,
       dvmId,
-      db: opts.db,
-      transport: reporter,
-      // The same condition the admin routes and the accumulator monitor mount on.
-      cashu: opts.cashuMode === "p2pk-accumulator" && !!opts.lockPubkey,
-      ...typeof opts.db.connect === "function" ? {} : { batchStore: new MemoryX402BatchStore() }
+      hasPgPool: !!opts.db
     });
-    await payoutReporter.init();
-    payoutReporter.start();
-  }
-  assertRevenueReporterReady({
-    failFast: opts.failFast ?? false,
-    devMode: opts.devMode,
-    platformToken,
-    platformUrl,
-    dvmId,
-    hasPgPool: !!opts.db
-  });
-  const effectiveOnJobCompleted = opts.onJobCompleted ?? (revenueReporter ? (info) => revenueReporter.report(info) : void 0);
-  const effectiveOnPaidJobDeath = opts.onPaidJobDeath ?? (revenueReporter ? (info) => revenueReporter.reportPaidJobDeath(info) : void 0);
-  const effectiveOnRevenueSkippedNoRail = opts.onRevenueSkippedNoRail ?? (revenueReporter ? (info) => revenueReporter.reportRevenueSkippedNoRail(info) : void 0);
-  const enqueueCreditDeposit = !opts.onCreditFunded && revenueReporter ? revenueReporter.enqueueDeposit.bind(revenueReporter) : void 0;
-  const enqueueCreditDrain = revenueReporter ? revenueReporter.enqueueCreditDrain.bind(revenueReporter) : void 0;
-  const enqueueCreditDrawRelease = revenueReporter ? revenueReporter.enqueueCreditDrawRelease.bind(revenueReporter) : void 0;
-  const unsubscribeTempoSettlementReadiness = opts.tempoSettlementReadiness?.subscribe({
-    onBalance: (observation) => revenueReporter && dvmId ? revenueReporter.reportTempoSettlementBalance({
-      dvmId,
-      address: observation.address,
-      network: observation.network,
-      token: observation.token,
-      balanceMicro: observation.balanceMicro.toString(),
-      lowBalanceMicro: observation.lowBalanceMicro.toString(),
-      checkedAt: observation.checkedAt,
-      ready: observation.ready
-    }) : void 0,
-    onFailure: (observation) => revenueReporter && dvmId ? revenueReporter.reportTempoSettlementFailure({
-      dvmId,
-      address: observation.address,
-      network: observation.network,
-      token: observation.token,
-      operation: observation.operation,
-      errorClass: observation.errorClass,
-      checkedAt: observation.checkedAt,
-      ...observation.balanceMicro !== void 0 ? { balanceMicro: observation.balanceMicro.toString() } : {},
-      ...observation.channelId ? { channelId: observation.channelId } : {},
-      ...observation.creditId ? { creditId: observation.creditId } : {},
-      ...observation.drainId ? { drainId: observation.drainId } : {}
-    }) : void 0
-  });
-  opts.tempoSettlementReadiness?.start();
-  const creditLedger = opts.creditLedger ?? new MemoryCreditLedger();
-  if (revenueReporter && dvmId) {
-    creditLedger.useCreditExpiryReleaseOutbox?.({
-      dvmId,
-      enqueue: revenueReporter.enqueueCreditExpiryRelease.bind(revenueReporter)
+    const activeRevenueReporter = revenueReporter;
+    const effectiveOnJobCompleted = opts.onJobCompleted ?? (activeRevenueReporter ? (info) => activeRevenueReporter.report(info) : void 0);
+    const effectiveOnJobCost = opts.onJobCost ?? (activeRevenueReporter ? (info) => activeRevenueReporter.reportCost(info) : void 0);
+    const effectiveOnPaidJobDeath = opts.onPaidJobDeath ?? (activeRevenueReporter ? (info) => activeRevenueReporter.reportPaidJobDeath(info) : void 0);
+    const effectiveOnRevenueSkippedNoRail = opts.onRevenueSkippedNoRail ?? (activeRevenueReporter ? (info) => activeRevenueReporter.reportRevenueSkippedNoRail(info) : void 0);
+    const enqueueCreditDeposit = !opts.onCreditFunded && activeRevenueReporter ? activeRevenueReporter.enqueueDeposit.bind(activeRevenueReporter) : void 0;
+    const enqueueCreditDrain = activeRevenueReporter ? activeRevenueReporter.enqueueCreditDrain.bind(activeRevenueReporter) : void 0;
+    const enqueueCreditDrawRelease = activeRevenueReporter ? activeRevenueReporter.enqueueCreditDrawRelease.bind(activeRevenueReporter) : void 0;
+    unsubscribeTempoSettlementReadiness = opts.tempoSettlementReadiness?.subscribe({
+      onBalance: (observation) => activeRevenueReporter && dvmId ? activeRevenueReporter.reportTempoSettlementBalance({
+        dvmId,
+        address: observation.address,
+        network: observation.network,
+        token: observation.token,
+        balanceMicro: observation.balanceMicro.toString(),
+        lowBalanceMicro: observation.lowBalanceMicro.toString(),
+        checkedAt: observation.checkedAt,
+        ready: observation.ready
+      }) : void 0,
+      onFailure: (observation) => activeRevenueReporter && dvmId ? activeRevenueReporter.reportTempoSettlementFailure({
+        dvmId,
+        address: observation.address,
+        network: observation.network,
+        token: observation.token,
+        operation: observation.operation,
+        errorClass: observation.errorClass,
+        checkedAt: observation.checkedAt,
+        ...observation.balanceMicro !== void 0 ? { balanceMicro: observation.balanceMicro.toString() } : {},
+        ...observation.channelId ? { channelId: observation.channelId } : {},
+        ...observation.creditId ? { creditId: observation.creditId } : {},
+        ...observation.drainId ? { drainId: observation.drainId } : {}
+      }) : void 0
     });
-  }
-  const creditExpirySweep = startCreditExpirySweep(creditLedger, opts.creditExpirySweep);
-  const processedPayments = opts.processedPayments ?? new MemoryProcessedPaymentStore();
-  const bootX402Support = opts.x402 ? opts.x402FacilitatorHealth?.support() ?? configuredX402FacilitatorSupport(opts.x402) : void 0;
-  const x402Config = opts.x402;
-  const x402BatchConfig = x402Config?.batchSettlement;
-  const selfRelayEnabled = !!x402BatchConfig?.selfRelay;
-  const effectiveX402BatchConfig = x402BatchConfig?.selfRelay ? {
-    ...x402BatchConfig,
-    selfRelay: {
-      ...x402BatchConfig.selfRelay,
-      onBalance: async (observation) => {
-        if (revenueReporter && dvmId) {
-          await revenueReporter.reportX402SelfRelayGasBalance({
-            dvmId,
-            address: observation.address,
-            network: observation.network,
-            balanceWei: observation.balanceWei.toString(),
-            lowBalanceWei: observation.lowBalanceWei.toString(),
-            checkedAt: observation.checkedAt
-          });
-        }
-        await x402BatchConfig.selfRelay?.onBalance?.(observation);
-      },
-      onRpcHealth: async (observation) => {
-        if (revenueReporter && dvmId) {
-          await revenueReporter.reportX402SelfRelayRpcHealth({
-            dvmId,
-            ...observation
-          });
-        }
-        await x402BatchConfig.selfRelay?.onRpcHealth?.(observation);
-      }
-    }
-  } : x402BatchConfig;
-  const x402ChannelStorage = opts.db && x402Config && effectiveX402BatchConfig && !effectiveX402BatchConfig.storage ? new PostgresX402ChannelStorage(opts.db, {
-    terminalizeUnbackedCredit: (evidence, tx) => creditLedger.terminalizeX402Credit(evidence, tx)
-  }) : void 0;
-  if (x402ChannelStorage) {
-    await x402ChannelStorage.init();
-    creditLedger.useX402SettlementGate?.(x402ChannelStorage);
-  }
-  const x402BatchSettlementFactory = x402Config && effectiveX402BatchConfig ? () => createX402BatchSettlementServer({
-    channelStorage: x402ChannelStorage,
-    network: x402Config.network,
-    payTo: x402Config.payTo,
-    facilitator: x402Config.facilitator,
-    ...x402Config.facilitatorAuth ? { facilitatorAuth: x402Config.facilitatorAuth } : {},
-    config: effectiveX402BatchConfig,
-    db: opts.db,
-    allowInMemory: opts.devMode,
-    earnedNative: (channelId) => creditLedger.earnedNativeForX402Channel(channelId),
-    supportedResponse: selfRelayEnabled ? void 0 : opts.x402FacilitatorHealth?.supportedResponse?.(),
-    payout: payoutReporter?.x402Observer()
-  }) : void 0;
-  const x402BatchSettlement = x402BatchSettlementFactory && (bootX402Support?.batchSettlement || selfRelayEnabled) ? await x402BatchSettlementFactory() : void 0;
-  const x402ExactStore = x402Config && opts.db && typeof opts.db.connect === "function" ? new PostgresX402ExactSettlementStore(opts.db) : void 0;
-  await x402ExactStore?.init();
-  const x402ExactEvidence = x402Config && x402ExactStore ? await createX402SettlementEvidenceReader({
-    network: x402Config.network,
-    ...x402BatchConfig?.rpcUrl ? { rpcUrl: x402BatchConfig.rpcUrl } : {}
-  }) : void 0;
-  const x402ExactSettlement = x402Config && x402ExactStore ? new X402ExactSettlementServer({
-    store: x402ExactStore,
-    evidence: x402ExactEvidence,
-    repair: async (effect, receipt, tx) => {
-      if (!receipt.txHash) throw new Error("settled exact x402 intent has no transaction");
-      await repairX402ExactSettlementEffect({
-        effect,
-        paymentId: receipt.txHash,
-        ledger: creditLedger,
-        processedPayments,
-        enqueueCreditDeposit,
-        tx
+    opts.tempoSettlementReadiness?.start();
+    const creditLedger = opts.creditLedger ?? new MemoryCreditLedger();
+    if (activeRevenueReporter && dvmId) {
+      creditLedger.useCreditExpiryReleaseOutbox?.({
+        dvmId,
+        enqueue: activeRevenueReporter.enqueueCreditExpiryRelease.bind(activeRevenueReporter)
       });
     }
-  }) : void 0;
-  const server = new DVMServer(descriptor, {
-    ...opts,
-    creditLedger,
-    processedPayments,
-    onJobCompleted: effectiveOnJobCompleted,
-    onPaidJobDeath: effectiveOnPaidJobDeath,
-    onRevenueSkippedNoRail: effectiveOnRevenueSkippedNoRail,
-    onCreditFunded: opts.onCreditFunded,
-    enqueueCreditDeposit,
-    enqueueCreditDrain,
-    enqueueCreditDrawRelease,
-    x402BatchSettlement,
-    x402BatchSettlementFactory,
-    x402ExactSettlement,
-    payoutReporter
-  });
-  return {
-    app: server.app,
-    authAudience: server.authAudience,
-    shutdown() {
-      const settlementStopped = server.shutdown();
-      payoutReporter?.stop();
-      revenueReporter?.stop();
-      creditExpirySweep?.stop();
-      unsubscribeTempoSettlementReadiness?.();
-      if (x402ChannelStorage) {
-        void settlementStopped.then(() => x402ChannelStorage.close()).catch(() => void 0);
+    creditExpirySweep = startCreditExpirySweep(creditLedger, opts.creditExpirySweep);
+    const processedPayments = opts.processedPayments ?? new MemoryProcessedPaymentStore();
+    const bootX402Support = opts.x402 ? opts.x402FacilitatorHealth?.support() ?? configuredX402FacilitatorSupport(opts.x402) : void 0;
+    const x402Config = opts.x402;
+    const x402BatchConfig = x402Config?.batchSettlement;
+    const selfRelayEnabled = !!x402BatchConfig?.selfRelay;
+    const effectiveX402BatchConfig = x402BatchConfig?.selfRelay ? {
+      ...x402BatchConfig,
+      selfRelay: {
+        ...x402BatchConfig.selfRelay,
+        onBalance: async (observation) => {
+          if (activeRevenueReporter && dvmId) {
+            await activeRevenueReporter.reportX402SelfRelayGasBalance({
+              dvmId,
+              address: observation.address,
+              network: observation.network,
+              balanceWei: observation.balanceWei.toString(),
+              lowBalanceWei: observation.lowBalanceWei.toString(),
+              checkedAt: observation.checkedAt
+            });
+          }
+          await x402BatchConfig.selfRelay?.onBalance?.(observation);
+        },
+        onRpcHealth: async (observation) => {
+          if (activeRevenueReporter && dvmId) {
+            await activeRevenueReporter.reportX402SelfRelayRpcHealth({
+              dvmId,
+              ...observation
+            });
+          }
+          await x402BatchConfig.selfRelay?.onRpcHealth?.(observation);
+        }
       }
-    },
-    jobManager: server.jobManager,
-    revenueReporterActive: !!revenueReporter,
-    payoutReporter
-  };
+    } : x402BatchConfig;
+    x402ChannelStorage = opts.db && x402Config && effectiveX402BatchConfig && !effectiveX402BatchConfig.storage ? new PostgresX402ChannelStorage(opts.db, {
+      terminalizeUnbackedCredit: (evidence, tx) => creditLedger.terminalizeX402Credit(evidence, tx)
+    }) : void 0;
+    if (x402ChannelStorage) {
+      await x402ChannelStorage.init();
+      creditLedger.useX402SettlementGate?.(x402ChannelStorage);
+    }
+    const x402BatchSettlementFactory = x402Config && effectiveX402BatchConfig ? () => createX402BatchSettlementServer({
+      channelStorage: x402ChannelStorage,
+      network: x402Config.network,
+      payTo: x402Config.payTo,
+      facilitator: x402Config.facilitator,
+      ...x402Config.facilitatorAuth ? { facilitatorAuth: x402Config.facilitatorAuth } : {},
+      config: effectiveX402BatchConfig,
+      db: opts.db,
+      allowInMemory: opts.devMode,
+      earnedNative: (channelId) => creditLedger.earnedNativeForX402Channel(channelId),
+      supportedResponse: selfRelayEnabled ? void 0 : opts.x402FacilitatorHealth?.supportedResponse?.(),
+      payout: payoutReporter?.x402Observer()
+    }) : void 0;
+    x402BatchSettlement = x402BatchSettlementFactory && (bootX402Support?.batchSettlement || selfRelayEnabled) ? await x402BatchSettlementFactory() : void 0;
+    const x402ExactStore = x402Config && opts.db && typeof opts.db.connect === "function" ? new PostgresX402ExactSettlementStore(opts.db) : void 0;
+    await x402ExactStore?.init();
+    const x402ExactEvidence = x402Config && x402ExactStore ? await createX402SettlementEvidenceReader({
+      network: x402Config.network,
+      ...x402BatchConfig?.rpcUrl ? { rpcUrl: x402BatchConfig.rpcUrl } : {}
+    }) : void 0;
+    const x402ExactSettlement = x402Config && x402ExactStore ? new X402ExactSettlementServer({
+      store: x402ExactStore,
+      evidence: x402ExactEvidence,
+      repair: async (effect, receipt, tx) => {
+        if (!receipt.txHash) throw new Error("settled exact x402 intent has no transaction");
+        await repairX402ExactSettlementEffect({
+          effect,
+          paymentId: receipt.txHash,
+          ledger: creditLedger,
+          processedPayments,
+          enqueueCreditDeposit,
+          tx
+        });
+      }
+    }) : void 0;
+    server = new DVMServer(descriptor, {
+      ...opts,
+      creditLedger,
+      processedPayments,
+      onJobCompleted: effectiveOnJobCompleted,
+      onJobCost: effectiveOnJobCost,
+      onPaidJobDeath: effectiveOnPaidJobDeath,
+      onRevenueSkippedNoRail: effectiveOnRevenueSkippedNoRail,
+      onCreditFunded: opts.onCreditFunded,
+      enqueueCreditDeposit,
+      enqueueCreditDrain,
+      enqueueCreditDrawRelease,
+      x402BatchSettlement,
+      x402BatchSettlementFactory,
+      x402ExactSettlement,
+      payoutReporter
+    });
+    await server.jobManager.recoverTerminalCosts();
+    return {
+      app: server.app,
+      authAudience: server.authAudience,
+      shutdown,
+      jobManager: server.jobManager,
+      revenueReporterActive: !!activeRevenueReporter,
+      payoutReporter
+    };
+  } catch (initializationError) {
+    await shutdown().catch(() => void 0);
+    throw initializationError;
+  }
 }
 function unknownRouteNotFound(c) {
   c.set("unknownRoute", true);
@@ -16507,6 +16903,8 @@ var DVMServer = class {
   mintHealthTracker;
   descriptor;
   opts;
+  /** Validated `DVMKIT_PUBLIC_URL` origin, or request-derived URLs when absent. */
+  publicOrigin;
   consumedCredentialStore;
   adminCashuNonceStore;
   ownsMintHealthTracker;
@@ -16550,6 +16948,7 @@ var DVMServer = class {
     this.descriptor = descriptor;
     this.pricingCurrency = descriptor.currency ?? "usd";
     this.opts = opts;
+    this.publicOrigin = resolvePublicOrigin(opts.env.DVMKIT_PUBLIC_URL);
     this.authAudience = this.resolveAuthAudience();
     this.x402BatchSettlement = opts.x402BatchSettlement;
     this.x402ExactSettlement = opts.x402ExactSettlement;
@@ -16568,7 +16967,6 @@ var DVMServer = class {
       this.ownsMintHealthTracker = false;
     } else if (opts.mints && opts.mints.length > 0) {
       this.mintHealthTracker = new MintHealthTracker({ mints: opts.mints });
-      this.mintHealthTracker.start();
       this.ownsMintHealthTracker = true;
     } else {
       this.ownsMintHealthTracker = false;
@@ -16581,12 +16979,6 @@ var DVMServer = class {
     this.creditLedger = opts.creditLedger ?? new MemoryCreditLedger();
     this.opts.mpp?.useTempoCreditLedger?.(this.creditLedger);
     this.processedPayments = opts.processedPayments ?? new MemoryProcessedPaymentStore();
-    if (this.opts.tempoObserverHealth?.declareSessionCapability) {
-      this.undeclareSessionCapability = this.opts.tempoObserverHealth.declareSessionCapability(
-        () => this.tempoSessionCapability()
-      );
-      void this.opts.tempoObserverHealth.refresh?.();
-    }
     this.jobManager = new JobManager(descriptor, {
       receiptIssuer: this.receiptIssuer,
       creditLedger: this.creditLedger,
@@ -16615,6 +17007,7 @@ var DVMServer = class {
       mpp: opts.mpp,
       cashuMode: opts.cashuMode,
       lockPubkey: opts.lockPubkey,
+      disposableCashu: opts.disposableCashu,
       db: opts.db,
       dvmId: opts.dvmId,
       authAudience: this.authAudience,
@@ -16631,6 +17024,9 @@ var DVMServer = class {
       pricingCurrency: this.pricingCurrency,
       onCreditFunded: opts.onCreditFunded,
       onJobCompleted: opts.onJobCompleted,
+      onPaidJobCompleted: opts.onPaidJobCompleted,
+      paymentMode: opts.paymentMode,
+      onJobCost: opts.onJobCost,
       onPaidJobDeath: opts.onPaidJobDeath,
       onRevenueSkippedNoRail: opts.onRevenueSkippedNoRail,
       onJobRetentionSweepFailed: opts.onJobRetentionSweepFailed,
@@ -16638,19 +17034,44 @@ var DVMServer = class {
       reactivationClaimGraceMs: opts.reactivationClaimGraceMs
     });
     this.app = new Hono();
-    this.registerRoutes();
+    try {
+      this.registerRoutes();
+      if (this.ownsMintHealthTracker) this.mintHealthTracker?.start();
+      if (this.opts.tempoObserverHealth?.declareSessionCapability) {
+        this.undeclareSessionCapability = this.opts.tempoObserverHealth.declareSessionCapability(
+          () => this.tempoSessionCapability()
+        );
+        void this.opts.tempoObserverHealth.refresh?.();
+      }
+    } catch (error) {
+      try {
+        this.jobManager.shutdown();
+      } catch {
+      }
+      try {
+        if (this.ownsMintHealthTracker) this.mintHealthTracker?.stop();
+      } catch {
+      }
+      try {
+        this.undeclareSessionCapability?.();
+      } catch {
+      }
+      this.undeclareSessionCapability = void 0;
+      throw error;
+    }
   }
   /**
    * Tear down this mount. Every leg is synchronous except the batch-settlement
    * server's own `stop()`; the returned promise settles once that has finished,
    * so a caller holding a resource behind it — the settlement pool the spend
    * gate's store owns (internal-review) — can sequence its close instead of pulling it
-   * out from under an in-flight stop. It never rejects, so ignoring it is safe.
+   * out from under an in-flight stop. A rejection remains observable so the app
+   * and host teardown layers can finish later cleanup before surfacing it.
    */
   shutdown() {
     this.jobManager.shutdown();
     const settlement = this.x402BatchSettlementInit ?? Promise.resolve(this.x402BatchSettlement);
-    const stopped = settlement.then((s) => s?.stop()).catch(() => void 0);
+    const stopped = settlement.then((s) => s?.stop());
     if (this.ownsMintHealthTracker) this.mintHealthTracker?.stop();
     this.undeclareSessionCapability?.();
     this.undeclareSessionCapability = void 0;
@@ -16847,6 +17268,7 @@ var DVMServer = class {
    * `cashu_not_p2pk_locked`).
    */
   async resolveLockPubkeysForReceive() {
+    if (this.opts.disposableCashu && this.opts.lockPubkey) return [toLockPubkey(this.opts.lockPubkey)];
     if (this.opts.cashuMode !== "p2pk-accumulator" || !this.opts.db || !this.opts.dvmId || !this.opts.lockPubkey) {
       return void 0;
     }
@@ -17165,7 +17587,7 @@ var DVMServer = class {
   defaultPaymentMethods() {
     const methods = [];
     if (this.opts.mints?.length) {
-      const accumulatorReady = this.opts.cashuMode === "p2pk-accumulator" && !!this.opts.lockPubkey && !!this.opts.db;
+      const accumulatorReady = this.opts.cashuMode === "p2pk-accumulator" && !!this.opts.lockPubkey && (!!this.opts.db || !!this.opts.disposableCashu);
       if (accumulatorReady) methods.push("cashu");
     }
     if (this.opts.x402 && this.x402CurrencySupported()) methods.push("x402");
@@ -17350,7 +17772,7 @@ var DVMServer = class {
     const authHeader = c.req.header("Authorization");
     const { Credential } = await import("mppx");
     const mppCredential = authHeader ? Credential.extractPaymentScheme(authHeader) ?? void 0 : void 0;
-    let lockPubkeys;
+    let lockPubkeys = this.opts.disposableCashu && this.opts.lockPubkey ? [toLockPubkey(this.opts.lockPubkey)] : void 0;
     if (this.opts.cashuMode === "p2pk-accumulator" && this.opts.db && this.opts.dvmId && this.opts.lockPubkey) {
       const active = await this.lockPubkeyStateForRead(this.opts.db, this.opts.dvmId);
       lockPubkeys = activePubkeySet(active);
@@ -17368,7 +17790,7 @@ var DVMServer = class {
       x402ExactSettlement: this.x402ExactSettlement,
       x402ExactVersions: x402Support?.exact,
       x402BatchSettlement,
-      x402Resource: c.req.url,
+      x402Resource: callerFacingRequestUrl(c.req.url, this.publicOrigin),
       mppCredential,
       mpp: this.opts.mpp,
       resourcePath: c.req.path,
@@ -17384,6 +17806,7 @@ var DVMServer = class {
       consumedCredentialStore: this.consumedCredentialStore,
       cashuMode: this.opts.cashuMode,
       accumulatorDb: this.opts.cashuMode === "p2pk-accumulator" ? this.opts.db : void 0,
+      disposableCashu: this.opts.disposableCashu,
       dvmId: this.opts.dvmId,
       lockPubkeys,
       requestId: c.req.header("X-Cashu-Request-Id"),
@@ -17570,6 +17993,7 @@ var DVMServer = class {
         ...this.opts.mpp.tempoConfiguration && {
           recipient: this.opts.mpp.tempoConfiguration.recipient,
           payment_token: this.opts.mpp.tempoConfiguration.paymentToken,
+          chain_id: this.opts.mpp.tempoConfiguration.chainId,
           ...this.opts.mpp.tempoConfiguration.operator && {
             operator: this.opts.mpp.tempoConfiguration.operator
           },
@@ -17698,7 +18122,8 @@ var DVMServer = class {
             500
           );
         }
-        if (err instanceof SignedRequestError) return buildAuthErrorResponse(c, err);
+        if (err instanceof SignedRequestError)
+          return buildAuthErrorResponse(c, err, this.publicOrigin);
         throw err;
       }
     }
@@ -17723,7 +18148,7 @@ var DVMServer = class {
             { onError: () => ({ "error.code": "invalid_quote_data" }) }
           );
         } catch (err) {
-          const schemaUrl = infoSchemaUrl(c.req.url);
+          const schemaUrl = infoSchemaUrl(c.req.url, this.publicOrigin);
           const { message, hint } = err instanceof z2.ZodError ? humanizeZodError(err, { schemaUrl }) : {
             message: "Quote-input validation failed",
             hint: `Inspect ${schemaUrl} for the expected input schema.`
@@ -17837,7 +18262,7 @@ var DVMServer = class {
    */
   requireCapabilityFromBody(c, capability) {
     const known = this.jobManager.capabilityNames();
-    const infoUrl = `${new URL(c.req.url).origin}/v1/info`;
+    const infoUrl = infoSchemaUrl(c.req.url, this.publicOrigin);
     if (typeof capability !== "string" || capability.length === 0) {
       return {
         error: c.json(
@@ -17878,7 +18303,7 @@ var DVMServer = class {
     try {
       return { body: await c.req.json() };
     } catch {
-      const infoUrl = `${new URL(c.req.url).origin}/v1/info`;
+      const infoUrl = infoSchemaUrl(c.req.url, this.publicOrigin);
       return {
         error: c.json(
           {
@@ -17913,7 +18338,7 @@ var DVMServer = class {
    * relayed to a human don't change with the status.
    */
   invalidInputResponse(c, err) {
-    const schemaUrl = infoSchemaUrl(c.req.url);
+    const schemaUrl = infoSchemaUrl(c.req.url, this.publicOrigin);
     const issues = zodIssuesOf(err);
     if (issues) {
       const inputIssues = callerInputIssues(issues);
@@ -18027,7 +18452,8 @@ var DVMServer = class {
           500
         );
       }
-      if (error instanceof SignedRequestError) return buildAuthErrorResponse(c, error);
+      if (error instanceof SignedRequestError)
+        return buildAuthErrorResponse(c, error, this.publicOrigin);
       throw error;
     }
     const signedRequestId = requestIdFromEnvelope(body.data);
@@ -18081,6 +18507,7 @@ var DVMServer = class {
     const capabilityResult = this.requireCapabilityFromBody(c, body.capability);
     if ("error" in capabilityResult) return capabilityResult.error;
     const capabilityName = capabilityResult.name;
+    pinDimension("capability", capabilityName);
     const cap = this.descriptor.capabilities[capabilityName];
     let parsedInput;
     let deferredInputError;
@@ -18145,7 +18572,8 @@ var DVMServer = class {
             500
           );
         }
-        if (err instanceof SignedRequestError) return buildAuthErrorResponse(c, err);
+        if (err instanceof SignedRequestError)
+          return buildAuthErrorResponse(c, err, this.publicOrigin);
         throw err;
       }
     }
@@ -18378,7 +18806,7 @@ var DVMServer = class {
         } catch (err) {
           if (err instanceof SignedRequestError && err.sub_reason === "replay_detected" && exactAdmission?.replayed) {
           } else if (err instanceof SignedRequestError) {
-            return buildAuthErrorResponse(c, err);
+            return buildAuthErrorResponse(c, err, this.publicOrigin);
           } else {
             throw err;
           }
@@ -18936,8 +19364,7 @@ var DVMServer = class {
         summary,
         lastActivityAt: Date.now()
       });
-      const baseUrl = new URL(c.req.url);
-      const infoUrl = `${baseUrl.origin}/v1/info`;
+      const infoUrl = infoSchemaUrl(c.req.url, this.publicOrigin);
       return c.json(
         {
           error: "unknown_capability",
@@ -18960,7 +19387,7 @@ var DVMServer = class {
           summary: "Persisted auth envelope failed signature re-verification on reactivation",
           lastActivityAt: Date.now()
         }).catch(() => void 0);
-        return buildAuthErrorResponse(c, err);
+        return buildAuthErrorResponse(c, err, this.publicOrigin);
       }
       if (err instanceof ReactivationAuthSchemaError) {
         return c.json(
@@ -19077,13 +19504,13 @@ var DVMServer = class {
       if (isStreamableJobStore(store)) {
         const cancelled = await store.cancelJob(id, reason ?? "Job cancelled");
         if (!cancelled) return this.jobNotActiveResponse(c);
-        await jm.issueReceiptForStoredJob(id);
+        await jm.finalizeStoredTerminal(id);
         return c.json({ status: "cancelled" });
       }
       record.status = "cancelled";
       record.lastActivityAt = Date.now();
       await jm.store.save(record);
-      await jm.issueReceiptForStoredJob(id);
+      await jm.finalizeStoredTerminal(id);
       return c.json({ status: "cancelled" });
     }
     if (!isJobOwner(c, job)) return c.json({ error: "Job not found" }, 404);
@@ -19350,8 +19777,8 @@ var PaymentValidationError = class extends Error {
   }
   detail;
 };
-function buildAuthErrorResponse(c, err) {
-  return c.json(authErrorBody(err, { schemaUrl: infoSchemaUrl(c.req.url) }), 401);
+function buildAuthErrorResponse(c, err, publicOrigin) {
+  return c.json(authErrorBody(err, { schemaUrl: infoSchemaUrl(c.req.url, publicOrigin) }), 401);
 }
 function validateMessageContent(type, content, devMode) {
   if (type === "response") {
@@ -19545,6 +19972,7 @@ export {
   pruneRetired,
   DEFAULT_LOCK_PUBKEY_GRACE_SECONDS,
   activePubkeySet,
+  AccumulatorReplayError,
   initWalletAccumulatorTable,
   insertAccumulatorRows,
   clearAccumulatorForDvm,