@dvmkit/sdk 0.1.3-rc.7 → 0.1.5-rc.7

package/dist/{chunk-5GFED3GJ.js → chunk-NPIW5VR5.js}

@@ -313,6 +313,10 @@ var TEMPO_SETTLEMENT_LEASE_OWNER_FIELD = "settlementLeaseOwner";
 var TEMPO_SETTLEMENT_LEASE_MS = 3e5;
 var TEMPO_SETTLEMENT_IN_FLIGHT = "settlement already in flight";
 var TEMPO_USDC_MAINNET = "0x20C000000000000000000000b9537d11c60E8b50";
+var TEMPO_MAINNET_CHAIN_ID = 4217;
+var TEMPO_MODERATO_CHAIN_ID = 42431;
+var TEMPO_PATH_USD_MODERATO = "0x20c0000000000000000000000000000000000000";
+var TEMPO_MODERATO_RPC = "https://rpc.moderato.tempo.xyz";
 var HEX_ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;
 function challengeMeta(challenge) {
   if (challenge.opaque) {
@@ -417,15 +421,21 @@ function buildMppMethods(opts, env) {
         `DVMKIT_TEMPO_RECIPIENT must be a 0x-prefixed 40-char hex address; got '${opts.tempoRecipient}'.`
       );
     }
-    const tempoCurrency = env.DVMKIT_TEMPO_CURRENCY ?? TEMPO_USDC_MAINNET;
+    const { chainId, currency: tempoCurrency } = resolveTempoNetwork(env);
     if (!HEX_ADDRESS_RE.test(tempoCurrency)) {
       throw new Error(
         `DVMKIT_TEMPO_CURRENCY must be a 0x-prefixed 40-char hex address; got '${tempoCurrency}'.`
       );
     }
+    if (opts.tempoSession?.chainId !== void 0 && opts.tempoSession.chainId !== chainId) {
+      throw new Error(
+        `Tempo session chain ${opts.tempoSession.chainId} does not match the configured Tempo chain ${chainId}.`
+      );
+    }
     tempoConfiguration = {
       recipient: opts.tempoRecipient,
       paymentToken: tempoCurrency,
+      chainId,
       ...opts.tempoSession && {
         operator: opts.tempoSession.account.address,
         feeToken: tempoCurrency
@@ -435,6 +445,7 @@ function buildMppMethods(opts, env) {
       tempo.charge({
         recipient: opts.tempoRecipient,
         currency: tempoCurrency,
+        chainId,
         decimals: 6,
         // Without this mppx installs `Store.memory()`, so the consumed-hash
         // guard is per-process and a credential replayed onto a sibling machine
@@ -462,9 +473,7 @@ function buildMppMethods(opts, env) {
           // dvmkit's watcher owns scheduled settlement because it gates on
           // terminal ledger consumption. mppx's in-request scheduler settles
           // the full accepted voucher and can capture caller-owned balance.
-          ...opts.tempoSession.chainId !== void 0 && {
-            chainId: opts.tempoSession.chainId
-          },
+          chainId: opts.tempoSession.chainId ?? chainId,
           ...opts.tempoSession.getClient && { getClient: opts.tempoSession.getClient },
           ...opts.tempoSession.onSessionSettlement && {
             onSessionSettlement: opts.tempoSession.onSessionSettlement
@@ -476,6 +485,24 @@ function buildMppMethods(opts, env) {
   if (methods.length === 0 || !tempoConfiguration) return void 0;
   return { methods, tempoConfiguration };
 }
+function resolveTempoNetwork(env) {
+  const testnet = env.DVMKIT_TEMPO_TESTNET === "1" || env.DVMKIT_TEMPO_TESTNET === "true";
+  const rawChainId = env.DVMKIT_TEMPO_CHAIN_ID?.trim();
+  const chainId = rawChainId ? Number(rawChainId) : testnet ? TEMPO_MODERATO_CHAIN_ID : TEMPO_MAINNET_CHAIN_ID;
+  if (!Number.isSafeInteger(chainId) || chainId <= 0) {
+    throw new Error(
+      `DVMKIT_TEMPO_CHAIN_ID must be a positive safe integer; got '${env.DVMKIT_TEMPO_CHAIN_ID}'.`
+    );
+  }
+  const currency = env.DVMKIT_TEMPO_CURRENCY ?? (chainId === TEMPO_MODERATO_CHAIN_ID ? TEMPO_PATH_USD_MODERATO : TEMPO_USDC_MAINNET);
+  const normalizedCurrency = currency.toLowerCase();
+  if (chainId === TEMPO_MODERATO_CHAIN_ID && normalizedCurrency === TEMPO_USDC_MAINNET.toLowerCase()) {
+    throw new Error(
+      `DVMKIT_TEMPO_CURRENCY ${currency} is incompatible with DVMKIT_TEMPO_CHAIN_ID ${chainId}.`
+    );
+  }
+  return { chainId, currency, testnet };
+}
 function isHmacMismatch(err) {
   if (!(err instanceof MppxErrors.InvalidChallengeError)) return false;
   return typeof err.message === "string" && err.message.includes(MPPX_HMAC_MISMATCH_REASON);
@@ -491,14 +518,16 @@ function decorateRapidRotation(original, rapidRotationAtMs) {
 }
 function wrapMppx(mppx) {
   const dispatcher = mppx.challenge;
+  const server = mppx;
   const issueChallenge = (method, intent, o) => {
     const handler = dispatcher[method][intent];
     if (!handler) {
       throw new Error(`Mppx: no challenge handler registered for ${method}/${intent}`);
     }
-    return handler(o);
+    const chainId = method === "tempo" ? server.tempoConfiguration?.chainId : void 0;
+    return handler(chainId === void 0 ? o : { chainId, ...o });
   };
-  return Object.assign(mppx, { issueChallenge });
+  return Object.assign(server, { issueChallenge });
 }
 var DEFAULT_TEMPO_SESSION_CHAIN_OPS = {
   getChannelStatesBatch: TempoSession.Precompile.Chain.getChannelStatesBatch,
@@ -945,9 +974,14 @@ export {
   TEMPO_SETTLEMENT_LEASE_MS,
   TEMPO_SETTLEMENT_IN_FLIGHT,
   TEMPO_USDC_MAINNET,
+  TEMPO_MAINNET_CHAIN_ID,
+  TEMPO_MODERATO_CHAIN_ID,
+  TEMPO_PATH_USD_MODERATO,
+  TEMPO_MODERATO_RPC,
   challengeMeta,
   createMppFromOpts,
   createDualKeyMppxFromOpts,
+  resolveTempoNetwork,
   wrapMppx,
   parseMppMethodsAllowlist,
   advertisedMethods,

package/dist/{chunk-LLXV32HA.js → chunk-SSSZUVWM.js}

@@ -125,6 +125,7 @@ var ListenChannel = class {
 
 // src/sdk/server/postgres-job-store.ts
 var JOB_MESSAGES_CHANNEL = "job_messages";
+var JOB_DVM_ID = /* @__PURE__ */ Symbol("jobDvmId");
 var PostgresJobStore = class {
   pool;
   listenChannel = null;
@@ -177,6 +178,18 @@ var PostgresJobStore = class {
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS native_amount DOUBLE PRECISION;
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS native_asset TEXT;
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS cashu_flow TEXT;
+      -- internal-review: what the job cost the BUILDER to serve, declared by the
+      -- handler through ctx.cost(). NULL is "unreported", deliberately
+      -- distinguishable from a declared zero.
+      ALTER TABLE jobs ADD COLUMN IF NOT EXISTS cost_amount_micro BIGINT;
+      ALTER TABLE jobs ADD COLUMN IF NOT EXISTS cost_currency TEXT;
+      ALTER TABLE jobs ADD COLUMN IF NOT EXISTS cost_revision BIGINT;
+      -- Cost-only reports are queued after the terminal row lands. Keep the
+      -- owning DVM and the last durably-enqueued revision on that row so a
+      -- restarted (or sibling) process can close that crash window without
+      -- replaying another mount's jobs.
+      ALTER TABLE jobs ADD COLUMN IF NOT EXISTS dvm_id TEXT;
+      ALTER TABLE jobs ADD COLUMN IF NOT EXISTS cost_reported_revision BIGINT;
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS required_msats BIGINT;
       -- next_seq is intentionally absent from isolate_jobs (platform/db.ts).
       -- It powers StreamableJobStore cross-machine seq allocation; isolate
@@ -245,6 +258,10 @@ var PostgresJobStore = class {
       CREATE INDEX IF NOT EXISTS idx_jobs_retention
         ON jobs (last_activity_at, id)
         WHERE redacted_at IS NULL AND status IN ('completed', 'failed', 'cancelled');
+      CREATE INDEX IF NOT EXISTS idx_jobs_pending_cost_report
+        ON jobs (dvm_id, id)
+        WHERE cost_revision IS NOT NULL
+          AND status IN ('completed', 'failed', 'cancelled');
       -- internal-review: the idempotent-replay lookup. payment_tx_hash carries the
       -- caller's X-Cashu-Request-Id on the accumulator path, so a retried paid
       -- submit finds the job its payment already created.
@@ -413,18 +430,32 @@ var PostgresJobStore = class {
     held.client.release();
   }
   async save(record) {
+    await this.saveRecord(record, record[JOB_DVM_ID]);
+  }
+  /** Persist a job while retaining its mount identity for cost-report recovery. */
+  async saveForDvm(record, dvmId) {
+    const scoped = record;
+    scoped[JOB_DVM_ID] = dvmId;
+    try {
+      await this.save(scoped);
+    } finally {
+      delete scoped[JOB_DVM_ID];
+    }
+  }
+  async saveRecord(record, dvmId) {
     const { rowCount } = await this.pool.query(
       `INSERT INTO jobs (
         id, tags, capability, input, params, requester_id, status, summary,
         messages, seq, paid_msats, payment_mint, payment_rail,
         payment_tx_hash, payment_transaction_hash, native_amount, native_asset, cashu_flow,
+        cost_amount_micro, cost_currency, cost_revision,
         received_proofs, pending_payment_msats, pending_mpp_challenge_ids,
         pending_x402_nonce, pending_x402_amount_usdc_micro, required_msats, step_cache, state, created_at,
         last_activity_at, next_seq, requester_token_hash, requester_token,
         request_fingerprint, requester_pubkey, request_id, credit_id, draw_id,
         pending_payment_fiat_micro, pending_payment_fiat_currency, auth_request_path,
-        funding_receipt, funding_credit
-      ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24,$25,$26,$27,$28,$29,$30,$31,$32,$33,$34,$35,$36,$37,$38,$39,$40,$41)
+        funding_receipt, funding_credit, dvm_id
+      ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24,$25,$26,$27,$28,$29,$30,$31,$32,$33,$34,$35,$36,$37,$38,$39,$40,$41,$42,$43,$44,$45)
       ON CONFLICT (id) DO UPDATE SET
         status = EXCLUDED.status,
         summary = EXCLUDED.summary,
@@ -440,6 +471,29 @@ var PostgresJobStore = class {
         native_amount = EXCLUDED.native_amount,
         native_asset = EXCLUDED.native_asset,
         cashu_flow = EXCLUDED.cashu_flow,
+        -- Cost declarations are revisioned because a terminal snapshot can be
+        -- re-saved by a different machine. Never let a stale persisted prefix
+        -- replace the handler owner's later cumulative declaration; a higher
+        -- revision with NULL amount/currency is an intentional invalidation.
+        cost_amount_micro = CASE
+          WHEN EXCLUDED.cost_revision IS NOT NULL
+            AND (jobs.cost_revision IS NULL OR EXCLUDED.cost_revision >= jobs.cost_revision)
+          THEN EXCLUDED.cost_amount_micro
+          ELSE jobs.cost_amount_micro
+        END,
+        cost_currency = CASE
+          WHEN EXCLUDED.cost_revision IS NOT NULL
+            AND (jobs.cost_revision IS NULL OR EXCLUDED.cost_revision >= jobs.cost_revision)
+          THEN EXCLUDED.cost_currency
+          ELSE jobs.cost_currency
+        END,
+        cost_revision = CASE
+          WHEN EXCLUDED.cost_revision IS NOT NULL
+            AND (jobs.cost_revision IS NULL OR EXCLUDED.cost_revision >= jobs.cost_revision)
+          THEN EXCLUDED.cost_revision
+          ELSE jobs.cost_revision
+        END,
+        dvm_id = COALESCE(jobs.dvm_id, EXCLUDED.dvm_id),
         received_proofs = EXCLUDED.received_proofs,
         pending_mpp_challenge_ids = EXCLUDED.pending_mpp_challenge_ids,
         pending_x402_nonce = EXCLUDED.pending_x402_nonce,
@@ -478,6 +532,9 @@ var PostgresJobStore = class {
         record.nativeAmount ?? null,
         record.nativeAsset ?? null,
         record.cashuFlow ?? null,
+        record.costAmountMicro ?? null,
+        record.costCurrency ?? null,
+        record.costRevision ?? null,
         JSON.stringify(record.receivedProofs),
         record.pendingPaymentMsats ?? null,
         record.pendingMppChallengeIds ? JSON.stringify(record.pendingMppChallengeIds) : null,
@@ -513,7 +570,8 @@ var PostgresJobStore = class {
         // whose live gate accepted this proof.
         record.authRequestPath ?? null,
         record.fundingReceipt ? JSON.stringify(record.fundingReceipt) : null,
-        record.fundingCredit ? JSON.stringify(record.fundingCredit) : null
+        record.fundingCredit ? JSON.stringify(record.fundingCredit) : null,
+        dvmId ?? null
       ]
     );
     if (rowCount === 0) {
@@ -530,6 +588,38 @@ var PostgresJobStore = class {
       await this.pool.query("DELETE FROM job_messages WHERE job_id = $1", [record.id]).catch(() => void 0);
     }
   }
+  /**
+   * Read terminal zero-revenue jobs whose latest declared-cost revision has
+   * not yet reached the durable reporter outbox.
+   */
+  async listUnreportedTerminalCosts(args) {
+    const { rows } = await this.pool.query(
+      `SELECT *
+       FROM jobs
+       WHERE dvm_id = $1
+         AND cost_revision IS NOT NULL
+         AND (cost_reported_revision IS NULL OR cost_reported_revision < cost_revision)
+         AND (
+           status IN ('failed', 'cancelled')
+           OR (status = 'completed' AND paid_msats = 0)
+         )
+         AND ($2::text IS NULL OR id > $2)
+       ORDER BY id
+       LIMIT $3`,
+      [args.dvmId, args.afterJobId ?? null, args.limit]
+    );
+    return rows.map(rowToRecord);
+  }
+  /** Mark one revision only after its report has reached durable enqueue. */
+  async markTerminalCostReported(jobId, costRevision) {
+    const { rowCount } = await this.pool.query(
+      `UPDATE jobs
+       SET cost_reported_revision = GREATEST(COALESCE(cost_reported_revision, -1), $2)
+       WHERE id = $1 AND cost_revision = $2`,
+      [jobId, costRevision]
+    );
+    return rowCount === 1;
+  }
   async delete(id) {
     await this.pool.query("DELETE FROM jobs WHERE id = $1", [id]);
     await this.pool.query("DELETE FROM job_messages WHERE job_id = $1", [id]).catch(() => void 0);
@@ -1203,6 +1293,9 @@ function rowToRecord(row) {
     nativeAmount: row.native_amount,
     nativeAsset: row.native_asset,
     cashuFlow: row.cashu_flow,
+    costAmountMicro: row.cost_amount_micro == null ? void 0 : Number(row.cost_amount_micro),
+    costCurrency: row.cost_currency ?? void 0,
+    costRevision: row.cost_revision == null ? void 0 : Number(row.cost_revision),
     creditId: row.credit_id ?? void 0,
     drawId: row.draw_id ?? void 0,
     fundingReceipt: row.funding_receipt ?? void 0,

package/dist/{chunk-7AKBC4PW.js → chunk-TQWGQCNV.js}

@@ -2,7 +2,7 @@ import {
   connectedTempoAccount,
   tempoBalanceCheckHint,
   tempoTokenReference
-} from "./chunk-ANFX5HEG.js";
+} from "./chunk-2UUXIIOC.js";
 import {
   fundingReachableAt,
   listCredits,

package/dist/{chunk-4B56DEEV.js → chunk-U6M3ATSG.js}

@@ -1,7 +1,7 @@
 import {
   StepCache,
   loggers
-} from "./chunk-YDIYXGYL.js";
+} from "./chunk-E4EVGPDX.js";
 import {
   redactUrl
 } from "./chunk-FUJ36YDV.js";
@@ -33,6 +33,9 @@ function toJobRecord(job) {
     nativeAmount: job.nativeAmount,
     nativeAsset: job.nativeAsset,
     cashuFlow: job.cashuFlow,
+    costAmountMicro: job.costAmountMicro,
+    costCurrency: job.costCurrency,
+    costRevision: job.costRevision,
     creditId: job.creditId,
     drawId: job.drawId,
     fundingReceipt: job.fundingReceipt,
@@ -76,6 +79,9 @@ function fromJobRecord(record) {
     nativeAmount: record.nativeAmount,
     nativeAsset: record.nativeAsset,
     cashuFlow: record.cashuFlow,
+    costAmountMicro: record.costAmountMicro,
+    costCurrency: record.costCurrency,
+    costRevision: record.costRevision,
     creditId: record.creditId,
     drawId: record.drawId,
     fundingReceipt: record.fundingReceipt,

package/dist/{credit-menu-C7zAJElJ.d.ts → credit-menu-B-e3vZGo.d.ts}

@@ -1,10 +1,10 @@
+import { ah as FundingMethod, o as PaymentMethod, bM as CreditLedgerLike, a1 as Message, X as FundingReceipt, bO as CreditSnapshot, Y as JobReceipt, S as SDKJobContext, aw as StepCache, u as ResponseContent, P as PaymentContent, a2 as MessageType, bj as X402Receipt, aE as X402Config, bi as X402ExactVersionSupport, cS as X402SettlementIntent, aq as PaymentRequirementsV2, c1 as CreditLedgerQuerier, cT as X402SettlementCursor, bQ as X402SettlementStatus, cU as X402SettlementWriteOff, bN as X402RefundSettlementGate, cV as X402FacilitatorAuth, cW as X402BatchSettlementConfig, cy as PostgresX402ChannelStorage, cX as X402PayoutObserver, br as MppxServer, ab as CashuMode, cY as CreditDepositEnqueue, cZ as X402SettlementReconciliationReason, ao as PaymentRequirements, a0 as MppxCredential, bm as CreditDepositPayload, bP as DrawResult, cn as CreditLedgerError, a6 as ReceiptCredit, ae as DrainReceiptEvent, ad as DrainReceipt, K as KVStore, y as SignedRequestAudience, c_ as CreditDrawReleaseEnqueue, cx as JobCostReportPayload, cA as RevenueSkippedNoRailPayload, Z as ZodLike, a as DVMDescriptor, bV as CreditInvoiceRecord, bW as InvoiceSettlement, ch as ClientCompatibilityGate, cf as ClientCompatibility, bu as PayoutReporter, R as ResolvedCreditConfig, g as CreditView } from './step-cache-CwM_Q8rK.js';
+import { ProofLike, SerializedDLEQ, Proof } from '@cashu/cashu-ts';
 import { Hono, Context } from 'hono';
 import { Pool } from 'pg';
-import { a0 as Message, ag as FundingMethod, W as FundingReceipt, bN as CreditSnapshot, X as JobReceipt, S as SDKJobContext, av as StepCache, u as ResponseContent, P as PaymentContent, a1 as MessageType, bi as X402Receipt, aD as X402Config, bh as X402ExactVersionSupport, cQ as X402SettlementIntent, ap as PaymentRequirementsV2, c0 as CreditLedgerQuerier, cR as X402SettlementCursor, bP as X402SettlementStatus, cS as X402SettlementWriteOff, bM as X402RefundSettlementGate, cT as X402FacilitatorAuth, cU as X402BatchSettlementConfig, cw as PostgresX402ChannelStorage, cV as X402PayoutObserver, bq as MppxServer, aa as CashuMode, bL as CreditLedgerLike, cW as CreditDepositEnqueue, cX as X402SettlementReconciliationReason, an as PaymentRequirements, $ as MppxCredential, o as PaymentMethod, bl as CreditDepositPayload, bO as DrawResult, cm as CreditLedgerError, a5 as ReceiptCredit, ad as DrainReceiptEvent, ac as DrainReceipt, K as KVStore, y as SignedRequestAudience, cY as CreditDrawReleaseEnqueue, cy as RevenueSkippedNoRailPayload, Z as ZodLike, a as DVMDescriptor, bU as CreditInvoiceRecord, bV as InvoiceSettlement, cg as ClientCompatibilityGate, ce as ClientCompatibility, bt as PayoutReporter, R as ResolvedCreditConfig, g as CreditView } from './step-cache-3cT4Shk0.js';
-import { b as FxRateSnapshot, F as FxFetcher } from './fx-BF_SG2i0.js';
-import { g as LockPubkey, f as CheckMintHealthOptions, b as LightningBackend, A as AttestationPayload } from './lightning-backend-C04nH94l.js';
-import { T as TopUpCapUnenforcedReason, A as AppendOutgoingOptions, J as JobRecord, b as JobStore } from './job-store-Bn23V3QU.js';
-import { ProofLike, SerializedDLEQ } from '@cashu/cashu-ts';
+import { b as FxRateSnapshot, F as FxFetcher } from './fx-CGRJE8rm.js';
+import { g as LockPubkey, f as CheckMintHealthOptions, b as LightningBackend, A as AttestationPayload } from './lightning-backend-KvQM0YHi.js';
+import { T as TopUpCapUnenforcedReason, A as AppendOutgoingOptions, J as JobRecord, b as JobStore } from './job-store-Cnlv9pOx.js';
 import { Challenge } from 'mppx';
 import { SettleResponse, SupportedResponse } from '@x402/core/types';
 import { Channel, AutoSettlementConfig } from '@x402/evm/batch-settlement/server';
@@ -149,6 +149,32 @@ declare class MemoryConsumedCredentialStore implements ConsumedCredentialStore {
     mark(realm: string, challengeId: string, ttlSeconds: number): Promise<void>;
 }
 
+/** Effective boot-time payment configuration for one mounted DVM. Health may change later. */
+interface PaymentMode {
+    mount: string;
+    verification: "required" | "skipped";
+    storage: "durable" | "disposable";
+    rails: Record<PaymentMethod, {
+        status: "verifying" | "unavailable" | "absent";
+        testFunds: boolean | null;
+    }>;
+}
+/** A completed job's settled customer charge, never the builder's reported cost. */
+interface PaidJobCompletion {
+    jobId: string;
+    rail: FundingMethod;
+    /** Checked integer micro-units in the credit's declared currency. */
+    amountMicro: number;
+    currency: string;
+    /** True only for a recognized test mint/network; null when configuration cannot establish this. */
+    testFunds: boolean | null;
+}
+
+/** Typed transaction boundary; proof ownership and accounting commit together. */
+interface DisposableCashuCommit {
+    commit(requestId: string, proofs: Proof[], account: (ledger: CreditLedgerLike) => Promise<void>): Promise<void>;
+}
+
 /** How often the sweep runs, and how long after boot its first pass fires. */
 interface CreditExpirySweepOpts {
     /** Sweep period. Defaults to {@link DEFAULT_SWEEP_INTERVAL_MS}; `0` disables the timer. */
@@ -239,6 +265,25 @@ interface ServerJob {
     nativeAsset?: "sats" | "usdc" | "usdc.e" | "usd-cents";
     /** Cashu flow discriminator written into `revenue_events.metadata.cashu_flow` (internal-review). */
     cashuFlow?: "p2pk_accumulator";
+    /**
+     * What this job cost the **builder** to serve, in 1e-6 of
+     * {@link ServerJob.costCurrency} — the running total the handler declared
+     * through `ctx.cost()` (internal-review). Absent until a handler declares
+     * something; absent is "unreported", which is not the same fact as a
+     * declared zero and is reported differently.
+     *
+     * Persisted on the row rather than held in the context because the report
+     * has to survive a crash between the job finishing and the report landing:
+     * the terminal funnel writes this row before it books, and Postgres cost
+     * reconciliation retries any revision whose durable-enqueue marker still
+     * lags. Never netted against `paidMsats` or the draw — the builder's cost
+     * and the caller's payment are two questions.
+     */
+    costAmountMicro?: number;
+    /** Currency {@link ServerJob.costAmountMicro} is 1e-6 of (lowercase ISO-4217). */
+    costCurrency?: string;
+    /** Number of `ctx.cost()` declarations incorporated into the current cost state. */
+    costRevision?: number;
     /** Credit the upfront payment funded/drew (internal-review). See `JobRecord.creditId`. */
     creditId?: string;
     /** The draw placed for this job on `creditId` (internal-review). */
@@ -1870,6 +1915,7 @@ interface UpfrontPaymentOpts {
     cashuMode?: CashuMode;
     /** Per-DVM Postgres pool — required for the `p2pk-accumulator` path. */
     accumulatorDb?: AccumulatorPool;
+    disposableCashu?: DisposableCashuCommit;
     /** DVM identifier — required for the `p2pk-accumulator` path. */
     dvmId?: string;
     /**
@@ -2068,21 +2114,18 @@ type PaymentResult = PaymentInfo & {
 /**
  * Whether a dev-mode server skips payment verification outright (internal-review).
  *
- * One rule, both accept paths: a dev server with **no mints configured**
- * auto-credits, so a builder can drive a priced handler with no wallet and no
- * mint; a dev server wired to a mint verifies for real — upfront at `/v1/job`
- * and mid-job at `POST /v1/job/:id/messages` alike. The two drifted once (the
- * mid-job branch skipped unconditionally), and the asymmetry made the internal-review
- * top-up leg — every rail branch of `verifyIncomingPayment`, plus `fund` +
- * `growDraw` — unreachable at L2: the caller's sats left the wallet and the
- * server credited the job without receiving them. Both call sites read this
- * predicate so they cannot drift again.
+ * Both upfront and mid-job acceptance require verification whenever any Cashu,
+ * x402, or Tempo rail is configured. An unusable configured rail fails closed;
+ * it never silently becomes synthetic development payment.
  *
  * Truthiness on the array reference is deliberate: `mints: []` does not skip.
  */
 declare function devModeSkipsPaymentVerification(opts: {
     devMode?: boolean;
     mints?: string[];
+    x402?: X402Config;
+    mpp?: MppxServer;
+    paymentMethods?: PaymentMethod[];
 }): boolean;
 /**
  * The keys a `payment` message carries money on, in the order
@@ -2249,6 +2292,7 @@ interface IncomingPaymentOpts {
     cashuMode?: CashuMode;
     /** Per-DVM Postgres pool — required for the `p2pk-accumulator` path. */
     accumulatorDb?: AccumulatorPool;
+    disposableCashu?: DisposableCashuCommit;
     /** DVM identifier — required for the `p2pk-accumulator` path. */
     dvmId?: string;
     /** Active NUT-11 P2PK lock pubkeys (current + retired-in-grace). */
@@ -2632,6 +2676,8 @@ interface JobManagerOpts {
     cashuMode?: CashuMode;
     /** Builder's NUT-11 P2PK lock pubkey (internal-review). Required for accumulator mode. */
     lockPubkey?: string;
+    /** Test-only atomic Cashu backend, supplied by the development host. */
+    disposableCashu?: DisposableCashuCommit;
     /** Postgres pool for wallet accumulator persistence. */
     db?: Pool;
     /**
@@ -2699,9 +2745,13 @@ interface JobManagerOpts {
      * use this to report revenue to the platform via `RevenueReporter`. Mirrors
      * the isolate path's `IsolateJobManager.opts.onJobCompleted`.
      */
+    onPaidJobCompleted?: (event: PaidJobCompletion) => void | Promise<void>;
+    paymentMode?: PaymentMode;
     onJobCompleted?: (info: {
         dvmId: string;
         jobId: string;
+        /** Dispatched capability. Omitted only for legacy persisted jobs that predate dispatch. */
+        capability?: string;
         paidMsats: number;
         paymentMint?: string;
         rail: string;
@@ -2709,6 +2759,10 @@ interface JobManagerOpts {
         nativeAmount?: number;
         nativeAsset?: string;
         cashuFlow?: string;
+        cost?: {
+            amountMicro: number;
+            currency: string;
+        };
         creditId?: string;
         drawId?: string;
         drawAmountMicro?: number;
@@ -2717,6 +2771,13 @@ interface JobManagerOpts {
         fundingRef?: string;
         kind?: string;
     }) => void | Promise<void>;
+    /**
+     * Callback fired when a terminal job declared a builder cost but emitted no
+     * revenue report (internal-review). Container-runtime DVMs use the reporter's
+     * durable `job-cost` outbox path. The receiver de-duplicates by DVM + job,
+     * independently of the rail-keyed revenue ledger.
+     */
+    onJobCost?: (info: JobCostReportPayload) => void | Promise<void>;
     /**
      * Callback fired when the stale-job reaper force-fails a *paid* job — its
      * pending credit draw is released rather than settled, because only a
@@ -2895,6 +2956,8 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     private readonly jobStore;
     private readonly idleTimers;
     private readonly cleanupTimers;
+    /** Cost revisions held only by a terminal handler owner until its durable merge succeeds. */
+    private readonly terminalCostHandoffRetryTimers;
     /** Per-job NOTIFY unsubscribe handles for the durable-status watch (internal-review). */
     private readonly statusWatchers;
     /** Job ids whose durable-status re-read is in flight — coalesces notify storms (internal-review). */
@@ -2918,6 +2981,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     private staleSweepTimer?;
     private heartbeatTimer?;
     private orphanDrawSweepTimer?;
+    private terminalCostRecoveryTimer?;
     private jobRetentionSweepTimer?;
     private jobRetentionBootTimer?;
     /** This manager holds {@link ORPHAN_SWEEP_CLAIMS} for its ledger. */
@@ -2935,6 +2999,8 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     private readonly monotonicNowMs;
     private sweepInFlight;
     private orphanSweepInFlight;
+    private terminalCostRecoveryInFlight;
+    private terminalCostRecoveryResumeAfter?;
     private jobRetentionSweepInFlight;
     private heartbeatInFlight;
     /**
@@ -3086,6 +3152,16 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * stores' terminal-sticky `save`, which keeps the row itself correct).
      */
     private adoptDurableTerminal;
+    /**
+     * Persist an adopted terminal cost, retaining the in-memory revision for a
+     * later retry when the durable store is transiently unavailable.
+     */
+    private tryPersistAdoptedTerminalCost;
+    /** Retry outside the status watcher, which correctly stops once the job is terminal. */
+    private scheduleTerminalCostHandoffRetry;
+    private retryTerminalCostHandoff;
+    /** Durably merge a terminal handler owner's latest cost before reporting it. */
+    private persistAdoptedTerminalCost;
     /**
      * Watch the durable status of a locally-active job (internal-review).
      *
@@ -3582,6 +3658,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * `context.ts`). The gap is visible to callers — the `seq` series skips a
      * number — which is precisely the completeness signal receipts exist for.
      */
+    private observePaidCompletion;
     issueReceipt(record: JobRecord): Promise<JobReceipt | undefined>;
     /** Build the common settle/release args, adding the hosted release outbox when wired. */
     private drawResolutionArgs;
@@ -3645,8 +3722,27 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * from whatever the caller happened to have in hand.
      */
     issueReceiptForStoredJob(jobId: string): Promise<JobReceipt | undefined>;
+    /**
+     * Finish accounting for a terminal written directly to the store — the
+     * stale reaper and a cancel handled on a different machine (internal-review).
+     */
+    finalizeStoredTerminal(jobId: string): Promise<JobReceipt | undefined>;
     /** Handle job reaching terminal state (completed, failed, cancelled). */
     private handleJobTerminal;
+    /**
+     * Re-enqueue terminal cost-only rows left between the job commit and outbox
+     * insert. The marker advances only after `onJobCost` resolves, which for the
+     * SDK reporter means the local durable insert has committed; a crash after
+     * that insert but before the marker can duplicate a payload, but the
+     * revisioned platform contract makes that replay harmless.
+     */
+    recoverTerminalCosts(): Promise<{
+        examined: number;
+        queued: number;
+        complete: boolean;
+    }>;
+    /** Report the latest declared-cost state only when no revenue event carried it. */
+    private reportJobCost;
     /**
      * Report a completed paid job's revenue (internal-review, re-keyed by internal-review).
      * Fire-and-forget — the `RevenueReporter` owns persistence and retry.
@@ -3958,6 +4054,13 @@ interface PlatformReporterOpts {
     /** Platform internal URL. Defaults to `DVMKIT_PLATFORM_URL` env. */
     url?: string;
 }
+/** Running host handle returned by serve(). */
+interface DVMServeResult {
+    url: string;
+    close: () => Promise<void>;
+    /** Boot snapshot for each mount; configured but unusable rails remain payment-required. */
+    paymentModes: PaymentMode[];
+}
 /** Options for {@link createDVMHost}. */
 interface DVMHostOpts {
     /**
@@ -4014,7 +4117,12 @@ interface DVMHostOpts {
      * production must always come through the URI.
      */
     lightningReceive?: LightningReceiveConfig;
-    /** When true, payment is skipped if no mints are configured (dev/test). */
+    /** Observe verified completed charges after settlement and receipt issuance, when enabled.
+     * May repeat after reconciliation/reload: deduplicate by jobId. Exceptions are logged and
+     * cannot undo a completed job. Free, synthetic development, failed and released draws do not emit.
+     */
+    onPaidJobCompleted?: (event: PaidJobCompletion) => void | Promise<void>;
+    /** When true, payment is skipped only when no payment rail is configured. */
     devMode?: boolean;
     /** Consumed-credential store override (test seam). */
     consumedCredentialStore?: ConsumedCredentialStore;
@@ -4068,10 +4176,7 @@ interface DVMHost {
     /** Start listening. Returns the live server handle. */
     serve(opts?: {
         port?: number;
-    }): Promise<{
-        url: string;
-        close: () => Promise<void>;
-    }>;
+    }): Promise<DVMServeResult>;
     /** Graceful shutdown. Runs descriptor `onShutdown` hooks in reverse mount order. */
     shutdown(): Promise<void>;
 }
@@ -4375,6 +4480,8 @@ interface SDKServerOpts {
      * directly.
      */
     lockPubkey?: string;
+    /** Test-only atomic Cashu backend, supplied by the development host. */
+    disposableCashu?: DisposableCashuCommit;
     /**
      * Rotation grace window (seconds) — retired pubkeys remain advertised on
      * `cashu.lock_pubkeys` and accepted by the receive path until they age out.
@@ -4434,7 +4541,15 @@ interface SDKServerOpts {
      * caller assumes full responsibility for revenue tracking. Intended for
      * tests and advanced integrations only.
      */
+    onPaidJobCompleted?: (event: PaidJobCompletion) => void | Promise<void>;
+    paymentMode?: PaymentMode;
     onJobCompleted?: JobManagerOpts["onJobCompleted"];
+    /**
+     * Advanced override for a declared cost on a terminal job that emitted no
+     * revenue report (internal-review). Auto-wired to the reporter's durable
+     * job-cost path; intended for tests and advanced integrations only.
+     */
+    onJobCost?: JobManagerOpts["onJobCost"];
     /**
      * Advanced override: callback fired when the stale-job reaper force-fails a
      * *paid* job (internal-review). Auto-wired to the `RevenueReporter`'s paid-job-death
@@ -4536,7 +4651,7 @@ interface SDKServerOpts {
 declare function createDVMServer<State, InputSchema extends ZodLike | undefined>(descriptor: DVMDescriptor<State, InputSchema>, opts: SDKServerOpts): Promise<{
     app: Hono<AppEnv>;
     authAudience?: SignedRequestAudience;
-    shutdown: () => void;
+    shutdown: () => Promise<void>;
     jobManager: JobManager<State, InputSchema>;
     revenueReporterActive: boolean;
     /** The payout reporter (internal-review), for the host to attach its Tempo readers to. */
@@ -4808,4 +4923,4 @@ declare function attachCreditMenu(body: Record<string, unknown>, menu: CreditMen
  */
 declare function toCreditTerms(menu: CreditMenu): CreditTerms;
 
-export { isTerminal as $, type AccumulatorPool as A, buildPaymentErrorResponse as B, type ConsumedCredentialStore as C, clearAccumulatorForDvm as D, createDVMServer as E, type FiatDenomination as F, creditDepositPayload as G, derivedFundCreditId as H, type IncomingPaymentOpts as I, JobCancelledError as J, devModeSkipsPaymentVerification as K, fromJobRecord as L, MintHealthTracker as M, fundedMicroFor as N, hasPaymentProof as O, PAYMENT_PROOF_KEYS as P, hashLockKey as Q, type ReporterBannerOpts as R, type SDKServerOpts as S, type TempoChannelReport as T, type UpfrontPaymentOpts as U, type VerifiedIncomingPayment as V, implicitCreditId as W, type X402BatchChannelObservation as X, initWalletAccumulatorTable as Y, insertAccumulatorRows as Z, isDerivedCreditId as _, type AccumulatorQuerier as a, X402ExactSettlementEvidenceMissingError as a$, isYieldMessage as a0, issueUpfrontChallenges as a1, msatsToFiatMicro as a2, paymentErrorBody as a3, pinAskFiat as a4, priceFiatMicro as a5, processIncomingPayment as a6, providerMessage as a7, repairX402ExactSettlementEffect as a8, resolveFxSnapshot as a9, type JobManagerOpts as aA, type LightningReceiveConfig as aB, MIN_INVOICE_TTL_SECONDS as aC, MemoryConsumedCredentialStore as aD, type MemoryConsumedCredentialStoreOpts as aE, MemoryProcessedPaymentStore as aF, MemoryX402ExactSettlementStore as aG, type MountOpts as aH, type OwnerDisplay as aI, type PlatformReporterOpts as aJ, PostgresProcessedPaymentStore as aK, PostgresX402ExactSettlementStore as aL, type PriceFiat as aM, type ProcessedPaymentQuerier as aN, type ProcessedPaymentRail as aO, type ProcessedPaymentRecord as aP, ProcessedPaymentReplayError as aQ, type ProcessedPaymentStore as aR, type X402BatchAcceptance as aS, type X402BatchFunding as aT, type X402BatchRefusal as aU, type X402BatchSettlementServer as aV, type X402ExactAcceptance as aW, X402ExactIntentConflictError as aX, type X402ExactSettlementAttempt as aY, type X402ExactSettlementChainEvidence as aZ, type X402ExactSettlementEffect as a_, resolvePriceFiat as aa, revenueReporterBannerState as ab, toCreditTerms as ac, toJobRecord as ad, unknownRouteNotFound as ae, verifyIncomingPayment as af, verifyTempoSessionManagementCredential as ag, verifyUpfrontPayment as ah, x402RequiredUsdcMicro as ai, x402SettledShare as aj, type CreditMenu as ak, ReceiptIssuer as al, LightningReceive as am, TempoSettlementReadiness as an, type DVMHostOpts as ao, type BuildCreditMenuArgs as ap, type BuilderIdentity as aq, CREDIT_ENVELOPE_KEYS as ar, type CreateX402BatchSettlementServerOpts as as, type CreditEnvelope as at, CreditEnvelopeError as au, type CreditFundCommitment as av, type CreditTerms as aw, DEFAULT_INVOICE_TTL_SECONDS as ax, type DVMHost as ay, JobManager as az, type AppEnv as b, type X402ExactSettlementEvidenceReader as b0, type X402ExactSettlementIntent as b1, X402ExactSettlementNotReadyError as b2, X402ExactSettlementServer as b3, type X402ExactSettlementServerOpts as b4, type X402ExactSettlementStatus as b5, type X402ExactSettlementStore as b6, type X402SettlementChainEvidence as b7, type X402SettlementEvidenceReader as b8, X402SettlementSubmissionError as b9, X402_BATCH_AUTO_SETTLEMENT as ba, X402_BATCH_MIN_WITHDRAW_DELAY_SECONDS as bb, X402_BATCH_SETTLEMENT_NETWORK as bc, attachCreditMenu as bd, buildCreditMenu as be, createDVMHost as bf, createX402BatchSettlementServer as bg, creditEnvelopeIgnoreFields as bh, drawSettlementRef as bi, extractCreditEnvelope as bj, fundingCommitment as bk, selectPrimaryCredit as bl, stripCreditEnvelope as bm, toCreditView as bn, type CreditFundingReport as c, type FiatDenominationFailure as d, type FundOnlyRequest as e, type PaymentErrorCode as f, type PaymentErrorDetail as g, type PaymentInfo as h, type ResolvedFx as i, type RevenueBootCheckOpts as j, type ServerJob as k, type ShortPayForfeit as l, type TempoObserverHealth as m, TempoSessionChannelMismatchError as n, type VerifyIncomingSnapshot as o, X402FacilitatorHealth as p, type X402SettlementEvidenceOutcome as q, type X402SettlementRepair as r, type X402SettlementRepairRefusal as s, type X402SettlementRepaired as t, type X402WedgedSettlement as u, type X402WedgedSettlementPage as v, X402_BATCH_SETTLEMENT_MAINNET_NETWORK as w, abortJob as x, applyPaymentInfoToJob as y, assertRevenueReporterReady as z };
+export { isTerminal as $, type AccumulatorPool as A, buildPaymentErrorResponse as B, type ConsumedCredentialStore as C, clearAccumulatorForDvm as D, createDVMServer as E, type FiatDenomination as F, creditDepositPayload as G, derivedFundCreditId as H, type IncomingPaymentOpts as I, JobCancelledError as J, devModeSkipsPaymentVerification as K, fromJobRecord as L, MintHealthTracker as M, fundedMicroFor as N, hasPaymentProof as O, PAYMENT_PROOF_KEYS as P, hashLockKey as Q, type ReporterBannerOpts as R, type SDKServerOpts as S, type TempoChannelReport as T, type UpfrontPaymentOpts as U, type VerifiedIncomingPayment as V, implicitCreditId as W, type X402BatchChannelObservation as X, initWalletAccumulatorTable as Y, insertAccumulatorRows as Z, isDerivedCreditId as _, type AccumulatorQuerier as a, type X402ExactSettlementAttempt as a$, isYieldMessage as a0, issueUpfrontChallenges as a1, msatsToFiatMicro as a2, paymentErrorBody as a3, pinAskFiat as a4, priceFiatMicro as a5, processIncomingPayment as a6, providerMessage as a7, repairX402ExactSettlementEffect as a8, resolveFxSnapshot as a9, JobManager as aA, type JobManagerOpts as aB, type LightningReceiveConfig as aC, MIN_INVOICE_TTL_SECONDS as aD, MemoryConsumedCredentialStore as aE, type MemoryConsumedCredentialStoreOpts as aF, MemoryProcessedPaymentStore as aG, MemoryX402ExactSettlementStore as aH, type MountOpts as aI, type OwnerDisplay as aJ, type PaidJobCompletion as aK, type PaymentMode as aL, type PlatformReporterOpts as aM, PostgresProcessedPaymentStore as aN, PostgresX402ExactSettlementStore as aO, type PriceFiat as aP, type ProcessedPaymentQuerier as aQ, type ProcessedPaymentRail as aR, type ProcessedPaymentRecord as aS, ProcessedPaymentReplayError as aT, type ProcessedPaymentStore as aU, type X402BatchAcceptance as aV, type X402BatchFunding as aW, type X402BatchRefusal as aX, type X402BatchSettlementServer as aY, type X402ExactAcceptance as aZ, X402ExactIntentConflictError as a_, resolvePriceFiat as aa, revenueReporterBannerState as ab, toCreditTerms as ac, toJobRecord as ad, unknownRouteNotFound as ae, verifyIncomingPayment as af, verifyTempoSessionManagementCredential as ag, verifyUpfrontPayment as ah, x402RequiredUsdcMicro as ai, x402SettledShare as aj, type CreditMenu as ak, ReceiptIssuer as al, LightningReceive as am, TempoSettlementReadiness as an, type DVMHostOpts as ao, type DVMServeResult as ap, type BuildCreditMenuArgs as aq, type BuilderIdentity as ar, CREDIT_ENVELOPE_KEYS as as, type CreateX402BatchSettlementServerOpts as at, type CreditEnvelope as au, CreditEnvelopeError as av, type CreditFundCommitment as aw, type CreditTerms as ax, DEFAULT_INVOICE_TTL_SECONDS as ay, type DVMHost as az, type AppEnv as b, type X402ExactSettlementChainEvidence as b0, type X402ExactSettlementEffect as b1, X402ExactSettlementEvidenceMissingError as b2, type X402ExactSettlementEvidenceReader as b3, type X402ExactSettlementIntent as b4, X402ExactSettlementNotReadyError as b5, X402ExactSettlementServer as b6, type X402ExactSettlementServerOpts as b7, type X402ExactSettlementStatus as b8, type X402ExactSettlementStore as b9, type X402SettlementChainEvidence as ba, type X402SettlementEvidenceReader as bb, X402SettlementSubmissionError as bc, X402_BATCH_AUTO_SETTLEMENT as bd, X402_BATCH_MIN_WITHDRAW_DELAY_SECONDS as be, X402_BATCH_SETTLEMENT_NETWORK as bf, attachCreditMenu as bg, buildCreditMenu as bh, createDVMHost as bi, createX402BatchSettlementServer as bj, creditEnvelopeIgnoreFields as bk, drawSettlementRef as bl, extractCreditEnvelope as bm, fundingCommitment as bn, selectPrimaryCredit as bo, stripCreditEnvelope as bp, toCreditView as bq, type CreditFundingReport as c, type FiatDenominationFailure as d, type FundOnlyRequest as e, type PaymentErrorCode as f, type PaymentErrorDetail as g, type PaymentInfo as h, type ResolvedFx as i, type RevenueBootCheckOpts as j, type ServerJob as k, type ShortPayForfeit as l, type TempoObserverHealth as m, TempoSessionChannelMismatchError as n, type VerifyIncomingSnapshot as o, X402FacilitatorHealth as p, type X402SettlementEvidenceOutcome as q, type X402SettlementRepair as r, type X402SettlementRepairRefusal as s, type X402SettlementRepaired as t, type X402WedgedSettlement as u, type X402WedgedSettlementPage as v, X402_BATCH_SETTLEMENT_MAINNET_NETWORK as w, abortJob as x, applyPaymentInfoToJob as y, assertRevenueReporterReady as z };