@dvmkit/sdk 0.1.4-rc.7 → 0.1.5-rc.8

package/README.md

@@ -40,7 +40,7 @@ import dvm from "./handler.mjs";
 await serve(dvm, { devMode: true });
 ```
 
-Submit a local request. `devMode` makes Postgres optional and skips payment verification when no Cashu mint is configured:
+Submit a local request. `devMode` makes Postgres optional and skips payment verification only when no Cashu, x402, or Tempo rail is configured:
 
 ```sh
 curl -sS http://localhost:8080/v1/job \
@@ -76,6 +76,14 @@ Run that file with `node --test handler.test.mjs`. The repository carries the co
 
 The generated [API reference](./docs/API.md) lists every declaration under these three entries. Deep imports from `dist/` are unsupported.
 
+## Verified payments in development
+
+`serve()` returns a `paymentModes` snapshot describing whether each configured rail is verifying, unavailable, or absent. A priced development server skips verification only when it has no configured payment rail. Configuring an unusable rail fails closed instead of turning the request into a synthetic development payment.
+
+Cashu development without Postgres is limited to known test or loopback mints. It uses a fresh lock identity and process-local accounting on every boot, so proofs, balances, and jobs do not survive restart. Production Cashu remains PostgreSQL-backed. Both paths require valid mint-provided NUT-12 DLEQ evidence on every proof before accepting its value; older tokens without that evidence must be replaced with fresh tokens from a compatible mint.
+
+Builders can pass `onPaidJobCompleted` to observe settled customer charges after successful completion. The event contains `jobId`, verified rail, checked integer `amountMicro`, the credit currency, and whether configuration identifies test funds. Reconciliation can repeat an event, so consumers deduplicate by `jobId`. Free jobs, synthetic development payments, failed jobs, and released draws do not emit.
+
 ## Production next steps
 
 - Use Postgres through `DATABASE_URL`; production boot refuses an in-memory job store unless you deliberately supply another durable implementation.
@@ -88,7 +96,7 @@ The public [SDK guide](https://dvmkit.com/docs/sdk) covers signed requests, cust
 
 ## Repository development
 
-Use the Node.js release in `.nvmrc` (Node 22). Install with `npm ci`, then run the same gate CI runs with `npm run verify`: the toolchain check, lint, build, typecheck (including the release scripts under `checkJs`), unit and database tests, the public API surface and package-shape checks, a consumer install, a public-safety scan, the release contract, and a clean-install smoke.
+Use the Node.js release in `.nvmrc` (Node 22). Install with `npm ci`, then run the same gate CI runs with `npm run verify`. The gate checks repository metadata in the checkout, copies only tracked and unignored source into an isolated directory, installs its locked dependencies, and runs lint, build, typecheck (including the release scripts under `checkJs`), unit and database tests, API, package, consumer, packed-artifact safety, and release checks there. The clean source tree owns the complete build and test pass, so verification never depends on the checkout's `node_modules` or pre-existing `dist` and does not repeat the full suite; after every check passes, its verified `dist` replaces the checkout's build output for release packaging.
 
 `DATABASE_URL` is optional locally. Without it the database suite is skipped rather than passed, and `verify` says so in its summary, because a skipped suite verified nothing and must not be reported as green. Point `DATABASE_URL` at a scratch Postgres to run it, and pass `npm run verify -- --require-database` to make a missing one a failure, which is what CI does.
 

package/dist/{chunk-ANFX5HEG.js → chunk-2UUXIIOC.js}

@@ -2,7 +2,7 @@ import {
   isValidEvmPrivateKey,
   loadConfig,
   updateConfig
-} from "./chunk-TSWKITGR.js";
+} from "./chunk-CGKZDODG.js";
 import {
   DvmError,
   resolveRpcHttpTransportOptions,
@@ -16,8 +16,24 @@ import {
 // src/lib/payment-rails/tempo-wallet.ts
 var TEMPO_USDC_MAINNET = "0x20C000000000000000000000b9537d11c60E8b50";
 var TEMPO_CHAIN_ID = 4217;
-function resolveTempoAsset(env = process.env) {
-  const address = env.DVM_TEMPO_CURRENCY ?? TEMPO_USDC_MAINNET;
+var TEMPO_MODERATO_CHAIN_ID = 42431;
+var TEMPO_PATH_USD_MODERATO = "0x20c0000000000000000000000000000000000000";
+var TEMPO_MODERATO_RPC = "https://rpc.moderato.tempo.xyz";
+function resolveTempoNetwork(network = "mainnet") {
+  return network === "moderato" ? {
+    network,
+    chainId: TEMPO_MODERATO_CHAIN_ID,
+    rpcUrl: TEMPO_MODERATO_RPC,
+    defaultToken: TEMPO_PATH_USD_MODERATO
+  } : {
+    network,
+    chainId: TEMPO_CHAIN_ID,
+    rpcUrl: "https://rpc.tempo.xyz",
+    defaultToken: TEMPO_USDC_MAINNET
+  };
+}
+function resolveTempoAsset(env = process.env, network = "mainnet") {
+  const address = env.DVM_TEMPO_CURRENCY ?? resolveTempoNetwork(network).defaultToken;
   if (!HEX_ADDRESS_RE.test(address)) {
     throw new DvmError(
       "tempo_config_invalid",
@@ -58,7 +74,9 @@ function tempoWrongAssetHint(asset) {
   return `This rail settles only in ${asset.label} (${asset.address}) on Tempo. Another Tempo dollar \u2014 USDT0 or any other stablecoin \u2014 is a different contract and will never show up here, however much of it your wallet says you hold. If you funded with the wrong one, swap it to ${asset.label} on Tempo (an on-chain swap, fees are sub-cent) or send ${asset.label} to this address.`;
 }
 function tempoTokenSymbol(address) {
-  return address.toLowerCase() === TEMPO_USDC_MAINNET.toLowerCase() ? "USDC.e" : null;
+  if (address.toLowerCase() === TEMPO_USDC_MAINNET.toLowerCase()) return "USDC.e";
+  if (address.toLowerCase() === TEMPO_PATH_USD_MODERATO.toLowerCase()) return "pathUSD";
+  return null;
 }
 var HEX_ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;
 async function connectedTempoAccount() {
@@ -83,7 +101,7 @@ async function generateTempoKey(opts = {}) {
     );
   }
   if (existing && opts.force) {
-    const { assertTempoWalletIdle } = await import("./tempo-lifecycle-SQL3KLEZ.js");
+    const { assertTempoWalletIdle } = await import("./tempo-lifecycle-DFIXQ54Q.js");
     await assertTempoWalletIdle("replace");
   }
   const { privateKeyToAccount, generatePrivateKey } = await import("viem/accounts");
@@ -91,22 +109,30 @@ async function generateTempoKey(opts = {}) {
   const account = privateKeyToAccount(privateKey);
   const generated = {
     privateKey,
-    address: account.address.toLowerCase()
+    address: account.address.toLowerCase(),
+    network: opts.network ?? "mainnet"
   };
   await opts.beforePersist?.(generated);
   await updateConfig({
     reason: "tempo_wallet_generate",
-    patch: () => ({ set: { tempo: { method: "tempo", apiKey: privateKey } } })
+    patch: () => ({
+      set: {
+        tempo: { method: "tempo", apiKey: privateKey, network: generated.network }
+      }
+    })
   });
   return generated;
 }
 async function getTempoUsdcBalance(account) {
-  const tokenAddress = resolveTempoAsset().address;
+  const accountNetwork = account.network ?? "mainnet";
+  const network = resolveTempoNetwork(accountNetwork);
+  const tokenAddress = resolveTempoAsset(process.env, accountNetwork).address;
   const { createPublicClient, http, erc20Abi } = await import("viem");
-  const { tempo } = await import("viem/chains");
+  const { tempo, tempoModerato } = await import("viem/chains");
+  const chain = accountNetwork === "moderato" ? tempoModerato : tempo;
   const { url: rpcUrl, source: rpcSource } = resolveRpcOverride(
     process.env.DVM_TEMPO_RPC_URL,
-    tempo.rpcUrls.default.http[0]
+    network.rpcUrl
   );
   try {
     const transportOptions = resolveRpcHttpTransportOptions(
@@ -114,7 +140,7 @@ async function getTempoUsdcBalance(account) {
       process.env.DVM_TEMPO_RPC_HEADERS_JSON
     );
     const client = createPublicClient({
-      chain: tempo,
+      chain,
       transport: transportOptions ? http(rpcUrl, transportOptions) : http(rpcUrl)
     });
     const raw = await client.readContract({
@@ -128,7 +154,7 @@ async function getTempoUsdcBalance(account) {
       rawBaseUnits: raw,
       usdc: Number(raw) / 1e6,
       tokenAddress,
-      chainId: TEMPO_CHAIN_ID,
+      chainId: network.chainId,
       // internal-review: redacted here rather than at a display surface, so the clear
       // endpoint never leaves this function on the success path either.
       rpcUrlRedacted: redactUrl(rpcUrl),
@@ -160,7 +186,7 @@ async function tempoAccountFromConfig(config) {
   if (!apiKey || !isValidEvmPrivateKey(apiKey)) return null;
   const privateKey = apiKey;
   const address = await deriveTempoAddress(privateKey);
-  return { privateKey, address };
+  return { privateKey, address, network: config.tempo.network ?? "mainnet" };
 }
 function invalidTempoPrivateKey() {
   return new DvmError(
@@ -173,6 +199,10 @@ function invalidTempoPrivateKey() {
 export {
   TEMPO_USDC_MAINNET,
   TEMPO_CHAIN_ID,
+  TEMPO_MODERATO_CHAIN_ID,
+  TEMPO_PATH_USD_MODERATO,
+  TEMPO_MODERATO_RPC,
+  resolveTempoNetwork,
   resolveTempoAsset,
   tempoTokenLabel,
   tempoTokenReference,

package/dist/{chunk-C6JHBLMW.js → chunk-BIP6G74V.js}

@@ -10,7 +10,7 @@ import {
   isValidEvmPrivateKey,
   loadConfig,
   updateConfig
-} from "./chunk-TSWKITGR.js";
+} from "./chunk-CGKZDODG.js";
 import {
   X402_DEFAULT_NETWORK,
   X402_V1_VERSION,

package/dist/{chunk-EDDYHZ6W.js → chunk-CEOAHV2I.js}

@@ -2,34 +2,6 @@ import {
   callerLoggers
 } from "./chunk-66HGCPBU.js";
 
-// src/lib/mints.ts
-var RECOMMENDED_MINTS = [
-  {
-    name: "Coinos",
-    description: "Primary Cashu mint accepted by dvmkit DVMs",
-    url: "https://mint.coinos.io"
-  },
-  {
-    name: "Voltz Mint",
-    description: "Fallback Cashu mint accepted by dvmkit DVMs",
-    url: "https://mint.lnvoltz.com"
-  }
-];
-function isTestMintUrl(url) {
-  let host;
-  try {
-    host = new URL(url).hostname.toLowerCase();
-  } catch {
-    return false;
-  }
-  if (host.startsWith("[") && host.endsWith("]")) host = host.slice(1, -1);
-  if (LOOPBACK_HOSTS.has(host)) return true;
-  if (host.endsWith(".localhost")) return true;
-  return TEST_MINT_HOSTS.has(host);
-}
-var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "0.0.0.0", "::1"]);
-var TEST_MINT_HOSTS = /* @__PURE__ */ new Set(["testnut.cashu.space"]);
-
 // src/lib/x402/env.ts
 import { isAddress } from "viem";
 import { privateKeyToAccount } from "viem/accounts";
@@ -981,8 +953,6 @@ var NwcBackend = class {
 };
 
 export {
-  RECOMMENDED_MINTS,
-  isTestMintUrl,
   X402_SELF_RELAY_KEY,
   X402_RECEIVER_AUTHORIZER_KEY,
   X402_BATCH_SETTLEMENT_KEY,

package/dist/{chunk-TSWKITGR.js → chunk-CGKZDODG.js}

@@ -181,6 +181,13 @@ function assertValidConfig(config, fields) {
     const value = owner[leaf];
     if (value === void 0 || !matchesKind(value, kind)) throw invalidFieldError(path, kind);
   }
+  if ((!scope || scope.has("tempo")) && isPlainObject(record.tempo) && record.tempo.network !== void 0 && record.tempo.network !== "mainnet" && record.tempo.network !== "moderato") {
+    throw new DvmError(
+      "config_invalid",
+      `The caller configuration field 'tempo.network' must be 'mainnet' or 'moderato'.`,
+      `Correct tempo.network in ${CONFIG_FILE}.${rollbackSuffix()}`
+    );
+  }
 }
 function readRawConfig() {
   if (!existsSync(CONFIG_FILE)) return null;
@@ -308,7 +315,7 @@ var PROTECTED_FIELDS = {
 var CONFIG_PATH_SHAPE = {
   float: { statedBudget: {}, connectedAt: {}, alias: {}, methods: {} },
   x402: { privateKey: {}, network: {} },
-  tempo: { method: {}, accountId: {}, apiKey: {} },
+  tempo: { method: {}, accountId: {}, apiKey: {}, network: {} },
   credit: {
     targetJobs: {},
     posture: {},

package/dist/{chunk-DBCLBYHP.js → chunk-KVEHHC7W.js}

@@ -19,7 +19,7 @@ import {
 
 // src/sdk/server/memory-credit-ledger.ts
 import { randomUUID } from "crypto";
-var MemoryCreditLedger = class {
+var MemoryCreditLedger = class _MemoryCreditLedger {
   /**
    * Per-process and lost on restart, so a DVM backed by this ledger never
    * advertises the funding menu outside devMode (internal-review) — funding on one
@@ -32,6 +32,16 @@ var MemoryCreditLedger = class {
   tempoLosses = /* @__PURE__ */ new Map();
   x402Losses = /* @__PURE__ */ new Map();
   x402Settlements;
+  /** Internal disposable transaction snapshot. The caller must serialize every ledger access. */
+  forkForTransaction() {
+    const fork = new _MemoryCreditLedger();
+    for (const name of ["credits", "fundings", "invoices", "tempoLosses", "x402Losses"]) {
+      const target = fork[name];
+      for (const [key, value] of this[name]) target.set(key, structuredClone(value));
+    }
+    fork.x402Settlements = this.x402Settlements;
+    return fork;
+  }
   /** See {@link CreditLedger.useX402SettlementGate} — same contract (internal-review). */
   useX402SettlementGate(gate) {
     this.x402Settlements = gate;

package/dist/{chunk-VRQDX5P4.js → chunk-KXCKFIJI.js}

@@ -29,6 +29,34 @@ function isX402SettlementReconciliationReason(value) {
   return value === "settlement_not_on_chain" || value === "chain_unreachable" || value === "settlement_unbookmarked" || value === "facilitator_channel_state_unavailable";
 }
 
+// src/lib/mints.ts
+var RECOMMENDED_MINTS = [
+  {
+    name: "Coinos",
+    description: "Primary Cashu mint accepted by dvmkit DVMs",
+    url: "https://mint.coinos.io"
+  },
+  {
+    name: "Voltz Mint",
+    description: "Fallback Cashu mint accepted by dvmkit DVMs",
+    url: "https://mint.lnvoltz.com"
+  }
+];
+function isTestMintUrl(url) {
+  let host;
+  try {
+    host = new URL(url).hostname.toLowerCase();
+  } catch {
+    return false;
+  }
+  if (host.startsWith("[") && host.endsWith("]")) host = host.slice(1, -1);
+  if (LOOPBACK_HOSTS.has(host)) return true;
+  if (host.endsWith(".localhost")) return true;
+  return TEST_MINT_HOSTS.has(host);
+}
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "0.0.0.0", "::1"]);
+var TEST_MINT_HOSTS = /* @__PURE__ */ new Set(["testnut.cashu.space", "dvmkit-testmint.fly.dev"]);
+
 // src/lib/secret-backup.ts
 import { existsSync, readFileSync, writeFileSync } from "fs";
 function backupSecretFile(file, nextContent) {
@@ -1666,6 +1694,8 @@ export {
   verifyCashuToken,
   normaliseMintUrl,
   TEMPO_SESSION_UPDATED_REASON,
+  RECOMMENDED_MINTS,
+  isTestMintUrl,
   backupSecretFile,
   readAgentMnemonic,
   assertAgentMnemonicReplaceable,

package/dist/{chunk-5GFED3GJ.js → chunk-M7LHFJ5K.js}

@@ -313,6 +313,10 @@ var TEMPO_SETTLEMENT_LEASE_OWNER_FIELD = "settlementLeaseOwner";
 var TEMPO_SETTLEMENT_LEASE_MS = 3e5;
 var TEMPO_SETTLEMENT_IN_FLIGHT = "settlement already in flight";
 var TEMPO_USDC_MAINNET = "0x20C000000000000000000000b9537d11c60E8b50";
+var TEMPO_MAINNET_CHAIN_ID = 4217;
+var TEMPO_MODERATO_CHAIN_ID = 42431;
+var TEMPO_PATH_USD_MODERATO = "0x20c0000000000000000000000000000000000000";
+var TEMPO_MODERATO_RPC = "https://rpc.moderato.tempo.xyz";
 var HEX_ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;
 function challengeMeta(challenge) {
   if (challenge.opaque) {
@@ -417,15 +421,21 @@ function buildMppMethods(opts, env) {
         `DVMKIT_TEMPO_RECIPIENT must be a 0x-prefixed 40-char hex address; got '${opts.tempoRecipient}'.`
       );
     }
-    const tempoCurrency = env.DVMKIT_TEMPO_CURRENCY ?? TEMPO_USDC_MAINNET;
+    const { chainId, currency: tempoCurrency } = resolveTempoNetwork(env);
     if (!HEX_ADDRESS_RE.test(tempoCurrency)) {
       throw new Error(
         `DVMKIT_TEMPO_CURRENCY must be a 0x-prefixed 40-char hex address; got '${tempoCurrency}'.`
       );
     }
+    if (opts.tempoSession?.chainId !== void 0 && opts.tempoSession.chainId !== chainId) {
+      throw new Error(
+        `Tempo session chain ${opts.tempoSession.chainId} does not match the configured Tempo chain ${chainId}.`
+      );
+    }
     tempoConfiguration = {
       recipient: opts.tempoRecipient,
       paymentToken: tempoCurrency,
+      chainId,
       ...opts.tempoSession && {
         operator: opts.tempoSession.account.address,
         feeToken: tempoCurrency
@@ -435,6 +445,11 @@ function buildMppMethods(opts, env) {
       tempo.charge({
         recipient: opts.tempoRecipient,
         currency: tempoCurrency,
+        // mppx resolves the route's verification requirement from `testnet`.
+        // Passing `chainId` only adds a challenge default, so a Moderato
+        // challenge can otherwise be re-derived as mainnet when the credential
+        // returns and fail before payment verification.
+        testnet: chainId === TEMPO_MODERATO_CHAIN_ID,
         decimals: 6,
         // Without this mppx installs `Store.memory()`, so the consumed-hash
         // guard is per-process and a credential replayed onto a sibling machine
@@ -462,9 +477,7 @@ function buildMppMethods(opts, env) {
           // dvmkit's watcher owns scheduled settlement because it gates on
           // terminal ledger consumption. mppx's in-request scheduler settles
           // the full accepted voucher and can capture caller-owned balance.
-          ...opts.tempoSession.chainId !== void 0 && {
-            chainId: opts.tempoSession.chainId
-          },
+          chainId: opts.tempoSession.chainId ?? chainId,
           ...opts.tempoSession.getClient && { getClient: opts.tempoSession.getClient },
           ...opts.tempoSession.onSessionSettlement && {
             onSessionSettlement: opts.tempoSession.onSessionSettlement
@@ -476,6 +489,29 @@ function buildMppMethods(opts, env) {
   if (methods.length === 0 || !tempoConfiguration) return void 0;
   return { methods, tempoConfiguration };
 }
+function resolveTempoNetwork(env) {
+  const testnet = env.DVMKIT_TEMPO_TESTNET === "1" || env.DVMKIT_TEMPO_TESTNET === "true";
+  const rawChainId = env.DVMKIT_TEMPO_CHAIN_ID?.trim();
+  const chainId = rawChainId ? Number(rawChainId) : testnet ? TEMPO_MODERATO_CHAIN_ID : TEMPO_MAINNET_CHAIN_ID;
+  if (!Number.isSafeInteger(chainId) || chainId <= 0) {
+    throw new Error(
+      `DVMKIT_TEMPO_CHAIN_ID must be a positive safe integer; got '${env.DVMKIT_TEMPO_CHAIN_ID}'.`
+    );
+  }
+  if (chainId !== TEMPO_MAINNET_CHAIN_ID && chainId !== TEMPO_MODERATO_CHAIN_ID) {
+    throw new Error(
+      `DVMKIT_TEMPO_CHAIN_ID must be ${TEMPO_MAINNET_CHAIN_ID} (mainnet) or ${TEMPO_MODERATO_CHAIN_ID} (Moderato); got '${chainId}'.`
+    );
+  }
+  const currency = env.DVMKIT_TEMPO_CURRENCY ?? (chainId === TEMPO_MODERATO_CHAIN_ID ? TEMPO_PATH_USD_MODERATO : TEMPO_USDC_MAINNET);
+  const normalizedCurrency = currency.toLowerCase();
+  if (chainId === TEMPO_MODERATO_CHAIN_ID && normalizedCurrency === TEMPO_USDC_MAINNET.toLowerCase()) {
+    throw new Error(
+      `DVMKIT_TEMPO_CURRENCY ${currency} is incompatible with DVMKIT_TEMPO_CHAIN_ID ${chainId}.`
+    );
+  }
+  return { chainId, currency, testnet };
+}
 function isHmacMismatch(err) {
   if (!(err instanceof MppxErrors.InvalidChallengeError)) return false;
   return typeof err.message === "string" && err.message.includes(MPPX_HMAC_MISMATCH_REASON);
@@ -491,14 +527,16 @@ function decorateRapidRotation(original, rapidRotationAtMs) {
 }
 function wrapMppx(mppx) {
   const dispatcher = mppx.challenge;
+  const server = mppx;
   const issueChallenge = (method, intent, o) => {
     const handler = dispatcher[method][intent];
     if (!handler) {
       throw new Error(`Mppx: no challenge handler registered for ${method}/${intent}`);
     }
-    return handler(o);
+    const chainId = method === "tempo" ? server.tempoConfiguration?.chainId : void 0;
+    return handler(chainId === void 0 ? o : { chainId, ...o });
   };
-  return Object.assign(mppx, { issueChallenge });
+  return Object.assign(server, { issueChallenge });
 }
 var DEFAULT_TEMPO_SESSION_CHAIN_OPS = {
   getChannelStatesBatch: TempoSession.Precompile.Chain.getChannelStatesBatch,
@@ -945,9 +983,14 @@ export {
   TEMPO_SETTLEMENT_LEASE_MS,
   TEMPO_SETTLEMENT_IN_FLIGHT,
   TEMPO_USDC_MAINNET,
+  TEMPO_MAINNET_CHAIN_ID,
+  TEMPO_MODERATO_CHAIN_ID,
+  TEMPO_PATH_USD_MODERATO,
+  TEMPO_MODERATO_RPC,
   challengeMeta,
   createMppFromOpts,
   createDualKeyMppxFromOpts,
+  resolveTempoNetwork,
   wrapMppx,
   parseMppMethodsAllowlist,
   advertisedMethods,

package/dist/{chunk-7AKBC4PW.js → chunk-TQWGQCNV.js}

@@ -2,7 +2,7 @@ import {
   connectedTempoAccount,
   tempoBalanceCheckHint,
   tempoTokenReference
-} from "./chunk-ANFX5HEG.js";
+} from "./chunk-2UUXIIOC.js";
 import {
   fundingReachableAt,
   listCredits,