@dvmkit/sdk 0.10.0 → 0.11.0-rc.1

package/dist/{chunk-QNKK7SPY.js → chunk-AIQGF52I.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-XRLKGCAW.js";
 import {
   x402EarnedCeiling
-} from "./chunk-FFXXGCVG.js";
+} from "./chunk-ITRSITFP.js";
 import {
   createX402FacilitatorAuthHeaders,
   createX402FacilitatorClient,
@@ -14,16 +14,13 @@ import {
   verifyWithFacilitator,
   withPaymentDiagnostics,
   withPaymentStage
-} from "./chunk-VTHYQCDB.js";
+} from "./chunk-E7ZBCT5U.js";
 import {
   MemoryCreditLedger
-} from "./chunk-YOSZIWC3.js";
+} from "./chunk-55DVLBCD.js";
 import {
   PostgresJobStore
-} from "./chunk-Y6DO5WSO.js";
-import {
-  parseStoreValue
-} from "./chunk-YG7G4DPZ.js";
+} from "./chunk-HQPQ4PFI.js";
 import {
   SIGNED_ENVELOPE_FIELDS,
   SignedRequestError,
@@ -31,7 +28,7 @@ import {
   humanizeZodIssues,
   signedRequestInput,
   zodIssuesOf
-} from "./chunk-2XQLL6N6.js";
+} from "./chunk-WFCVS6QB.js";
 import {
   MemoryJobStore,
   UNCAPPABLE_ASK_TOTAL,
@@ -40,7 +37,7 @@ import {
   isJobRetentionStore,
   isReceiptIssuingStore,
   isStreamableJobStore
-} from "./chunk-KFCEXCZM.js";
+} from "./chunk-KJZVTWMX.js";
 import {
   ContentHoldError,
   JobCancelledError,
@@ -66,7 +63,6 @@ import {
   attestedDvmIdentity,
   buildAdminChallenge,
   checkMintHealth,
-  computeResultHash,
   createMonotonicClock,
   formatStaleness,
   getWallet,
@@ -75,12 +71,9 @@ import {
   isX402SettlementReconciliationReason,
   parseTraceparent,
   receiptPubkeyFromSecret,
-  signDrainReceipt,
-  signFundingReceipt,
-  signReceipt,
   toLockPubkey,
   verifyChallenge
-} from "./chunk-VUGEEMLT.js";
+} from "./chunk-RPUFWIT4.js";
 import {
   X402_BATCH_SETTLEMENT_SCHEME,
   X402_DEFAULT_FACILITATOR,
@@ -103,12 +96,11 @@ import {
 import {
   RAIL_REFUNDABLE,
   canonicalRequestPath,
-  canonicalize,
   isZodSchema
-} from "./chunk-UKD3R2KU.js";
+} from "./chunk-HW2UCOOC.js";
 import {
   createConsoleLogger
-} from "./chunk-3R7NQA3Z.js";
+} from "./chunk-7KQLPVV7.js";
 import {
   StepCache
 } from "./chunk-BQJIFRAZ.js";
@@ -125,7 +117,7 @@ import {
   roundUsd,
   satsToFiat,
   validateCurrency
-} from "./chunk-W3VGCNG6.js";
+} from "./chunk-LDKV4UHI.js";
 import {
   CreditLedger,
   CreditLedgerError,
@@ -141,17 +133,29 @@ import {
   isNonChannelBitcoinRail,
   netOwedSats,
   x402SettlementPending
-} from "./chunk-STJBBVNL.js";
+} from "./chunk-K2ZNIQZP.js";
+import {
+  parseStoreValue
+} from "./chunk-YG7G4DPZ.js";
 import {
   withSdkInitLock
 } from "./chunk-COYKJRMM.js";
+import {
+  computeResultHash,
+  signDrainReceipt,
+  signFundingReceipt,
+  signReceipt
+} from "./chunk-5H7P3ORL.js";
 import {
   withPostgresRecoveryContext
-} from "./chunk-MMGSYMIC.js";
+} from "./chunk-EP7OVWI5.js";
 import {
   DvmError,
   x402NetworkByCaip2
 } from "./chunk-BPYMEMQX.js";
+import {
+  canonicalize
+} from "./chunk-H3GGFEE5.js";
 import {
   TEMPO_MODERATO_CHAIN_ID,
   TEMPO_MODERATO_RPC,
@@ -162,17 +166,17 @@ import {
   installHostedTempoCloseGuard,
   isTempoInsufficientFundsError,
   resolveTempoNetwork
-} from "./chunk-MU3IE434.js";
+} from "./chunk-JLT2YIBS.js";
 import {
   loggers,
   pinDimension,
   withSpan,
   withTraceContext
-} from "./chunk-M3T5JYDJ.js";
+} from "./chunk-HNXMWHLU.js";
 import {
   createDiagnosticCapabilityAuthority,
   diagnosticConsole
-} from "./chunk-QGNXYVBO.js";
+} from "./chunk-Z4FOPROB.js";
 
 // src/sdk/server/lock-pubkey-store.ts
 async function initLockPubkeyTable(db) {
@@ -3884,7 +3888,7 @@ async function verifyUpfrontPaymentInScope(opts) {
           x402Requirements
         });
       }
-      const { verifyX402Payment } = await import("./x402-EN5LSOVM.js");
+      const { verifyX402Payment } = await import("./x402-RUJ4LUKF.js");
       const receipt = await withPaymentStage("verifier_broadcast", () => verifyX402Payment(
         x402Payment,
         x402Config,
@@ -4908,7 +4912,7 @@ async function verifyIncomingPaymentInScope(body, opts, snapshot) {
           snapshot
         });
       }
-      const { verifyX402Payment } = await import("./x402-EN5LSOVM.js");
+      const { verifyX402Payment } = await import("./x402-RUJ4LUKF.js");
       const receipt = await withPaymentStage("verifier_broadcast", () => verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -5339,7 +5343,7 @@ async function processIncomingPaymentInScope(job, body, opts) {
     try {
       const requiredMsats = job.pendingPaymentMsats ?? 0;
       const requiredUsdcMicro = job.pendingX402AmountUsdcMicro !== void 0 ? BigInt(job.pendingX402AmountUsdcMicro) : BigInt(msatsToUsdc(requiredMsats, rate));
-      const { verifyX402Payment } = await import("./x402-EN5LSOVM.js");
+      const { verifyX402Payment } = await import("./x402-RUJ4LUKF.js");
       const receipt = await withPaymentStage("verifier_broadcast", () => verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -6943,13 +6947,37 @@ async function fundingReceiptFor(ledger, issuer, funding) {
 
 // src/sdk/server/tempo-drain-leg.ts
 async function completeTempoChannelDrain(args) {
-  const settlementEvidence = refundFloorEvidence({
-    rail: "tempo",
-    refundedNative: args.refundedNative,
-    debitedNative: args.debitedNative,
-    creditId: args.creditId,
-    drainId: args.drainId
-  });
+  if (!args.tx && args.refundedNative !== void 0 && /^\d{1,78}$/.test(String(args.refundedNative))) {
+    try {
+      if (args.finalization?.outcome === "payer_exit" || args.finalization?.outcome === "payer_exit_unbacked") {
+        if (BigInt(args.refundedNative) > 0n) await args.deps.ledger.recordTempoDrainPayment?.({ creditId: args.creditId, drainId: args.drainId });
+      } else {
+        await args.deps.ledger.recordTempoDrainRefund?.({ creditId: args.creditId, drainId: args.drainId, refundedNative: args.refundedNative });
+      }
+    } catch (error) {
+      loggers.tempo.warn("tempo_drain_refund_evidence_write_failed", {});
+      throw error;
+    }
+  }
+  let settlementEvidence;
+  try {
+    settlementEvidence = refundFloorEvidence({
+      rail: "tempo",
+      refundedNative: args.refundedNative,
+      debitedNative: args.debitedNative,
+      creditId: args.creditId,
+      drainId: args.drainId
+    });
+  } catch (error) {
+    if (error instanceof DrainRefundFloorError && !args.tx) {
+      try {
+        await args.deps.ledger.recordTempoDrainHold?.({ creditId: args.creditId, drainId: args.drainId, reason: "refund_short" });
+      } catch {
+        loggers.tempo.warn("tempo_drain_hold_reason_write_failed", {});
+      }
+    }
+    throw error;
+  }
   return commitTerminalDrain(
     args.deps.drainReport,
     async (innerTx) => {
@@ -7690,6 +7718,11 @@ async function recoverTempoDrain(deps, mpp, record, channelId) {
     }
     if (!result) return null;
     if (!/^0x[0-9a-fA-F]{64}$/.test(result)) {
+      try {
+        await deps.ledger.recordTempoDrainHold?.({ creditId: record.creditId, drainId: record.drainId, reason: "close_evidence_missing" });
+      } catch {
+        loggers.tempo.warn("tempo_drain_hold_reason_write_failed", { amount_micro: record.amountMicro });
+      }
       loggers.tempo.warn("tempo_session_drain_refund_unproven", {
         channel_id: channelId,
         credit_id: record.creditId,
@@ -10130,6 +10163,7 @@ var HostedSettlementReportObligations = class {
          FROM sdk_hosted_settlement_report_obligations target
          WHERE target.dvm_id=$1 AND target.scope=$2 AND target.rail='tempo' AND target.operation='close'
            AND target.state IN ('unmatched','no_report')
+           AND ($7::text IS NULL OR target.channel_id=$7)
        )
        SELECT * FROM candidates
        WHERE ($6::boolean OR (state='unmatched' AND (retryable OR write_off_allowed)))
@@ -10141,7 +10175,8 @@ var HostedSettlementReportObligations = class {
         args.limit,
         args.after?.createdAtMs ?? null,
         args.after?.obligationId ?? null,
-        args.all ?? false
+        args.all ?? false,
+        args.channelId ?? null
       ]
     );
     return result.rows.map((row) => ({
@@ -12725,22 +12760,17 @@ function buildContext(job, opts) {
         };
         const doResolve = async (pc) => {
           if (resolved) return;
+          if (job.pendingPayment?.resolve === doResolve) {
+            job.status = job.pendingPrompts.size > 0 ? "awaiting-input" : "processing";
+            const persist = opts.onPaymentResume ?? opts.onYield;
+            if (job.status === "awaiting-input" && persist) await persist();
+            if (resolved) return;
+            job.pendingPayment = null;
+          }
           resolved = true;
           cleanup();
           creditedToHandlerMsats += amountMsats;
           creditedToHandlerMicro += pendingFiat?.amountMicro ?? 0;
-          if (job.pendingPayment?.resolve === doResolve) {
-            job.pendingPayment = null;
-            job.status = job.pendingPrompts.size > 0 ? "awaiting-input" : "processing";
-            if (job.status === "awaiting-input" && opts.onYield) {
-              try {
-                await opts.onYield();
-              } catch (err) {
-                reject(err);
-                return;
-              }
-            }
-          }
           resolve(pc);
         };
         const doReject = (err) => {
@@ -13266,6 +13296,9 @@ var JobManager = class {
   // A prompt response and a payment NOTIFY must not mistake each other for a
   // different machine's successful claim.
   inputResumeTails = /* @__PURE__ */ new WeakMap();
+  // A failed partial-wait snapshot leaves our durable claim in processing.
+  // Retain its continuation so a later input can finish it without a new claim.
+  claimedPaymentResumes = /* @__PURE__ */ new WeakMap();
   sessionId = randomBytes4(3).toString("hex");
   nextJobId = 1;
   accumulatorMonitor;
@@ -13672,7 +13705,10 @@ var JobManager = class {
   }
   async queueInputResume(job, resume) {
     const previous = this.inputResumeTails.get(job) ?? Promise.resolve();
-    const next = previous.catch(() => void 0).then(resume);
+    const next = previous.catch(() => void 0).then(async () => {
+      await this.claimedPaymentResumes.get(job)?.();
+      return resume();
+    });
     this.inputResumeTails.set(job, next);
     try {
       return await next;
@@ -13684,6 +13720,19 @@ var JobManager = class {
     await job.messageAppenderTail;
     return isStreamableJobStore(this.jobStore) ? this.jobStore.claimForProcessing(job.id) : true;
   }
+  async resumeClaimedPayment(job, resume) {
+    const retry = async () => {
+      try {
+        if (!isTerminal(job.status) && !await this.adoptDurableTerminal(job)) await resume();
+        this.claimedPaymentResumes.delete(job);
+      } catch (error) {
+        if (!(error instanceof JobSnapshotPersistenceError)) this.claimedPaymentResumes.delete(job);
+        throw error;
+      }
+    };
+    this.claimedPaymentResumes.set(job, retry);
+    await retry();
+  }
   async dispatchMessageNow(job, type, content) {
     const ctx = job.sdkCtx;
     const cap = this.getCapability(job.capability);
@@ -13712,10 +13761,13 @@ var JobManager = class {
           return;
         }
         if (job.pendingPayment !== pp || isTerminal(job.status)) return;
-        job.pendingPayment = null;
-        job.status = job.pendingPrompts.size > 0 ? "awaiting-input" : "processing";
-        if (job.status === "awaiting-input") await this.persistJob(job);
-        await pp.resolve(pc);
+        await this.resumeClaimedPayment(job, async () => {
+          job.status = job.pendingPrompts.size > 0 ? "awaiting-input" : "processing";
+          if (job.status === "awaiting-input") await retryJobSnapshot(() => this.persistJob(job));
+          if (job.pendingPayment !== pp || isTerminal(job.status)) return;
+          job.pendingPayment = null;
+          await pp.resolve(pc);
+        });
       } else if (cap?.onPayment && ctx) {
         await cap.onPayment(ctx, pc);
       }
@@ -13768,10 +13820,14 @@ var JobManager = class {
         record.seq = Math.max(record.seq, highSeq);
       }
     }
-    if (this.opts.dvmId && isTerminalCostRecoveryStore(this.jobStore)) {
-      await this.jobStore.saveForDvm(record, this.opts.dvmId);
-    } else {
-      await this.jobStore.save(record);
+    try {
+      if (this.opts.dvmId && isTerminalCostRecoveryStore(this.jobStore)) {
+        await this.jobStore.saveForDvm(record, this.opts.dvmId);
+      } else {
+        await this.jobStore.save(record);
+      }
+    } catch (error) {
+      throw new JobSnapshotPersistenceError(error);
     }
     const saved = await this.jobStore.get(job.id);
     if (saved) {
@@ -15311,6 +15367,7 @@ var JobManager = class {
       fxFetcher: this.opts.fxFetcher,
       onTerminal: () => this.handleJobTerminal(job),
       onYield: () => this.persistJob(job),
+      onPaymentResume: () => retryJobSnapshot(() => this.persistJob(job)),
       subscribeNotifications: isStreamableJobStore(jobStore) ? (cb) => jobStore.subscribeNotifications(job.id, cb) : void 0,
       getCounters: isStreamableJobStore(jobStore) ? () => jobStore.getCounters(job.id) : void 0,
       drawPool: this.opts.creditLedger ? () => this.resolveDrawPool(job) : void 0,
@@ -15321,7 +15378,9 @@ var JobManager = class {
           if (!pending || job.pendingPayment !== pending || isTerminal(job.status)) return false;
           if (!await this.claimLocalInput(job)) return false;
           if (job.pendingPayment !== pending || isTerminal(job.status)) return false;
-          await resume?.();
+          await this.resumeClaimedPayment(job, async () => {
+            await resume?.();
+          });
           return true;
         });
       } : void 0,
@@ -16082,6 +16141,23 @@ function resolvePricingMax(raw) {
   if (raw === void 0) return void 0;
   return { amount: roundUsd(parseUsdPrice(raw, "price")), currency: "usd" };
 }
+var JobSnapshotPersistenceError = class extends Error {
+  constructor(cause) {
+    super("Job snapshot could not be persisted", { cause });
+    this.name = "JobSnapshotPersistenceError";
+  }
+};
+async function retryJobSnapshot(persist) {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      await persist();
+      return;
+    } catch (error) {
+      if (!(error instanceof JobSnapshotPersistenceError) || attempt >= 2) throw error;
+      await new Promise((resolve) => setTimeout(resolve, 50 * (attempt + 1)));
+    }
+  }
+}
 
 // src/sdk/server/mint-health-tracker.ts
 var DEFAULT_TICK_INTERVAL_MS2 = 5 * 60 * 1e3;
@@ -17129,6 +17205,8 @@ function shortSha(sha) {
 }
 
 // src/sdk/server/admin-credit.ts
+import { sha256 } from "@noble/hashes/sha2.js";
+import { bytesToHex } from "@noble/hashes/utils.js";
 import {
   Amount as Amount3,
   CheckStateEnum as CheckStateEnum3,
@@ -17136,6 +17214,7 @@ import {
   getTokenMetadata as getTokenMetadata2
 } from "@cashu/cashu-ts";
 function installAdminCreditRoutes(app, opts) {
+  app.post("/admin/credit/refund-draw", (c) => handleRefundDraw(c, opts));
   app.get("/admin/credit/pending-drains", (c) => handlePendingDrains(c, opts));
   app.get("/admin/credit/bitcoin-liability", (c) => handleBitcoinLiability(c, opts));
   app.post("/admin/credit/park-drain", (c) => handleParkDrain(c, opts));
@@ -17156,9 +17235,68 @@ function installAdminCreditRoutes(app, opts) {
   app.post("/admin/credit/write-off-tempo-close-report", (c) => handleTempoCloseReportAction(c, opts, "write-off"));
   app.get("/admin/credit/tempo-drains", (c) => handleTempoDrains(c, opts));
   app.get("/admin/credit/tempo-losses", (c) => handleTempoLosses(c, opts));
+  app.post("/admin/credit/book-tempo-drain", (c) => handleTempoDrainDecision(c, opts, "book_refunded"));
+  app.post("/admin/credit/release-tempo-drain", (c) => handleTempoDrainDecision(c, opts, "release"));
   app.post("/admin/credit/reconcile-tempo-drain", (c) => handleReconcileTempo(c, opts));
   app.post("/admin/credit/write-off-tempo-drain", (c) => handleWriteOffTempo(c, opts));
 }
+async function handleRefundDraw(c, opts) {
+  const auth = await requireAuth(c, opts);
+  if ("response" in auth) return auth.response;
+  const body = await c.req.json().catch(() => null);
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    return c.json({ error: "invalid_body", message: "Request body must be a JSON object." }, 400);
+  }
+  const value = body;
+  const nonempty = (item) => typeof item === "string" && item.length > 0;
+  const byJob = nonempty(value.jobId) && value.creditId === void 0 && value.drawId === void 0;
+  const byDraw = value.jobId === void 0 && nonempty(value.creditId) && nonempty(value.drawId);
+  if (!byJob && !byDraw || !nonempty(value.refundId) || value.amountMicro !== void 0 && (typeof value.amountMicro !== "number" || !Number.isSafeInteger(value.amountMicro) || value.amountMicro <= 0) || value.reason !== void 0 && (typeof value.reason !== "string" || value.reason.length > 280)) {
+    return c.json({ error: "invalid_body", message: "Provide jobId or creditId + drawId, refundId, an optional positive safe integer amountMicro, and an optional reason of at most 280 characters." }, 400);
+  }
+  if (!opts.ledger.durable || !opts.enqueueCreditDrawRefund) {
+    return c.json({ error: "credit_refund_unavailable", hint: "Configure the persistent credit store and platform refund reporter, then retry with the original refund ID." }, 503);
+  }
+  try {
+    const result = await opts.ledger.refundDraw({
+      ...byJob ? { jobId: value.jobId } : { creditId: value.creditId, drawId: value.drawId },
+      refundId: value.refundId,
+      ...value.amountMicro === void 0 ? {} : { amountMicro: value.amountMicro },
+      ...value.reason === void 0 ? {} : { reason: value.reason },
+      outbox: { dvmId: opts.dvmId, enqueue: opts.enqueueCreditDrawRefund },
+      ...opts.receiptIssuer ? { trustedReceiptPubkey: opts.receiptIssuer.pubkey } : {},
+      ...opts.now ? { nowMs: opts.now() } : {}
+    });
+    return c.json({
+      status: "refunded",
+      refund_id: result.refundId,
+      credit_id: result.creditId,
+      draw_id: result.drawId,
+      job_id: result.jobId,
+      amount_micro: result.amountMicro,
+      currency: result.currency,
+      ledger_seq: result.ledgerSeq,
+      refunded_at: result.refundedAt,
+      balance_after_micro: result.balanceAfterMicro,
+      replayed: result.replayed
+    });
+  } catch (error) {
+    if (!(error instanceof CreditLedgerError)) throw error;
+    const hints = {
+      draw_not_found: "Check the job ID or credit/draw IDs. If they are correct, this DVM may lack trusted ownership evidence; ask an operator to inspect that evidence. Retrying alone cannot establish ownership.",
+      draw_not_completed: "Wait for the job to complete. Failed or cancelled jobs release their pending hold automatically.",
+      refund_exceeds_draw: "Refund no more than the remaining unrefunded charge. Omit amountMicro to refund that remainder.",
+      credit_not_open: "The original credit is closed or expired. Ask an operator to inspect the original payment before arranging a refund.",
+      credit_refund_channel_unsupported: "This channel returns unused collateral through its normal exit. Ask an operator about refunding completed spending.",
+      credit_refund_basis_unavailable: "The original payment value cannot be proven automatically. Ask an operator to inspect independent original-payment evidence before arranging a repair. Retrying alone cannot establish that evidence.",
+      credit_refund_state_unavailable: "The original credit reopening order cannot be proven automatically. Ask an operator to inspect independent funding and drain evidence before arranging a repair. Retrying alone cannot establish that evidence.",
+      refund_conflict: "Repeat the original arguments, or deliberately choose a new refund ID for a different refund."
+    };
+    const hint = hints[error.code];
+    if (!hint) throw error;
+    return c.json({ error: error.code, hint }, error.code === "draw_not_found" ? 404 : error.code === "refund_conflict" ? 409 : 422);
+  }
+}
 async function handleX402ExactSettlements(c, opts) {
   const auth = await requireAuth(c, opts);
   if ("response" in auth) return auth.response;
@@ -17277,6 +17415,9 @@ async function handleTempoLosses(c, opts) {
       currency: loss.currency,
       former_balance_micro: loss.formerBalanceMicro,
       settled_on_chain_native: loss.settledOnChainNative.toString(),
+      refunded_to_payer_native: loss.refundedToPayerNative?.toString() ?? null,
+      loss_native: loss.lossNative?.toString() ?? null,
+      loss_basis: loss.lossBasis ?? null,
       highest_voucher_native: loss.highestVoucherNative.toString(),
       consumed_service_micro: loss.consumedServiceMicro,
       consumed_native: loss.consumedNative.toString(),
@@ -18263,13 +18404,18 @@ async function handleTempoDrains(c, opts) {
     ...after ? { after } : {},
     createdBeforeMs: nowMs - minAge,
     rail: "tempo",
-    includeResolved: c.req.query("include_resolved") === "true"
+    includeResolved: c.req.query("include_resolved") === "true",
+    includeWrittenOff: true
   });
   const wantsEvidence = c.req.query("evidence") !== "false";
   const rows2 = [];
   for (const drain of drains) {
     const evidence = wantsEvidence && drain.channelId ? await classifyTempoCloseEvidence(rail.rail, drain.channelId) : void 0;
-    rows2.push(tempoDrainBody(drain, evidence));
+    const closeReports = drain.channelId && opts.hostedSettlementReports ? await opts.hostedSettlementReports.store.listTempoCloseReports({ limit: 50, all: true, channelId: drain.channelId }) : [];
+    rows2.push({
+      ...tempoDrainBody(drain, evidence),
+      close_reports: closeReports.map((row) => ({ obligation_id: row.id, status: row.status, written_off: row.writtenOff }))
+    });
   }
   const last = drains.length === limit ? drains[drains.length - 1] : void 0;
   return c.json({
@@ -18283,6 +18429,90 @@ async function handleTempoDrains(c, opts) {
     } : {}
   });
 }
+async function handleTempoDrainDecision(c, opts, decision) {
+  const auth = await requireAuth(c, opts);
+  if ("response" in auth) return auth.response;
+  const body = await c.req.json().catch(() => null);
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    return c.json({ error: "invalid_body", message: "Request body must be a JSON object." }, 400);
+  }
+  const value = body;
+  const text = (item, max) => typeof item === "string" && item.trim().length > 0 && item.trim().length <= max;
+  if (Object.keys(value).some((key) => !["credit_id", "drain_id", "reason", "evidence"].includes(key)) || typeof value.credit_id !== "string" || value.credit_id.length === 0 || typeof value.drain_id !== "string" || value.drain_id.length === 0 || !text(value.reason, 2e3) || value.evidence !== void 0 && !text(value.evidence, 4e3)) {
+    return c.json({ error: "invalid_body", message: "Provide credit_id, drain_id, a reason of 1\u20132000 characters, and optional evidence of 1\u20134000 characters." }, 400);
+  }
+  if (!opts.ledger.durable || !opts.ledger.decideTempoDrain) {
+    return c.json({ error: "tempo_drain_decision_unavailable", message: "A durable Tempo decision store is required." }, 503);
+  }
+  const args = {
+    creditId: value.credit_id,
+    drainId: value.drain_id,
+    decision,
+    reason: value.reason.trim(),
+    ...value.evidence === void 0 ? {} : { evidence: value.evidence.trim() },
+    nowMs: opts.now ? opts.now() : Date.now()
+  };
+  if (decision === "book_refunded" && opts.requireDrainReport && !opts.enqueueCreditDrain) {
+    const existing = await opts.ledger.getDrain(args);
+    if (existing && !existing.operatorDecision && (existing.status === "pending" || existing.status === "exit_required")) {
+      return c.json({ error: "tempo_drain_decision_unavailable", message: "Hosted booking requires a transactional drain reporter. Restore its configuration, then retry the original decision." }, 503);
+    }
+  }
+  const client = await opts.db.connect();
+  let result;
+  try {
+    await client.query("BEGIN");
+    let decided;
+    const transition = async () => {
+      decided = await opts.ledger.decideTempoDrain({ ...args, tx: client });
+      return decided;
+    };
+    if (decision === "book_refunded") {
+      await commitTerminalDrain({ db: opts.db, dvmId: opts.dvmId, enqueueCreditDrain: opts.enqueueCreditDrain }, transition, client);
+    } else {
+      await transition();
+    }
+    result = decided;
+    await client.query("COMMIT");
+  } catch (error) {
+    await client.query("ROLLBACK").catch(() => void 0);
+    if (error instanceof CreditLedgerError) {
+      return c.json(
+        { error: error.code, message: error.message },
+        error.code === "drain_not_found" || error.code === "credit_not_found" ? 404 : ["drain_decision_conflict", "tempo_drain_close_pending", "tempo_drain_refund_paid", "tempo_drain_refund_unknown"].includes(error.code) ? 409 : 422
+      );
+    }
+    throw error;
+  } finally {
+    client.release();
+  }
+  if (!result.replayed) {
+    diagnosticConsole.warn({
+      dataset: "tempo",
+      event: decision === "book_refunded" ? "tempo_drain_booked_as_refunded" : "tempo_drain_released",
+      credit_id: result.drain.creditId,
+      drain_id: result.drain.drainId,
+      channel_id: result.drain.channelId,
+      drain_reference: `sha256:${bytesToHex(sha256(new TextEncoder().encode(JSON.stringify([result.drain.creditId, result.drain.drainId]))))}`,
+      amount_micro: result.drain.amountMicro,
+      amount_native: result.drain.drainedNative?.toString() ?? null,
+      currency: result.drain.currency
+    });
+  }
+  return c.json({
+    status: result.drain.status,
+    credit_id: result.drain.creditId,
+    drain_id: result.drain.drainId,
+    channel_id: result.drain.channelId,
+    amount_micro: result.drain.amountMicro,
+    amount_native: result.drain.drainedNative,
+    currency: result.drain.currency,
+    decision: result.drain.operatorDecision,
+    balance_micro: result.credit.balanceMicro,
+    spendable_micro: result.spendableMicro,
+    replayed: result.replayed
+  });
+}
 async function handleReconcileTempo(c, opts) {
   const auth = await requireAuth(c, opts);
   if ("response" in auth) return auth.response;
@@ -18296,6 +18526,12 @@ async function handleReconcileTempo(c, opts) {
   if (record.status === "sent") return tempoReconciledBody(c, record, channelId, true);
   const evidence = await classifyTempoCloseEvidence(rail.rail, channelId);
   if (evidence.chain !== "found") return tempoEvidenceRefusal(c, evidence);
+  try {
+    await opts.ledger.recordTempoDrainRefund?.({ creditId: record.creditId, drainId: record.drainId, refundedNative: evidence.refundedToPayer });
+  } catch (error) {
+    diagnosticConsole.warn({ dataset: "tempo", event: "tempo_drain_refund_evidence_write_failed", amount_micro: record.amountMicro });
+    throw error;
+  }
   const client = await opts.db.connect();
   let booked;
   try {
@@ -18784,6 +19020,10 @@ function tempoDrainBody(drain, evidence) {
     created_at: drain.createdAt,
     write_off_note: drain.writeOffNote,
     written_off_at: drain.writtenOffAt,
+    decision: drain.operatorDecision ?? null,
+    proven_refund_native: drain.provenRefundNative ?? null,
+    refund_payment_proven: drain.refundPaymentProven ?? false,
+    held_reason: drain.status === "pending" || drain.status === "exit_required" ? drain.holdReason ?? (evidence?.chain === "found" && drain.drainedNative !== null && BigInt(evidence.refundedToPayer) < BigInt(drain.drainedNative) ? "refund_short" : drain.status === "exit_required" ? "exit_required" : "refund_unproven") : null,
     ...evidence ? { chain: evidence } : {}
   };
 }
@@ -20129,7 +20369,7 @@ async function createDVMServer(descriptor, opts) {
       }
     }
     if (!opts.onJobCompleted && platformToken && platformUrl && dvmId && opts.db) {
-      const { RevenueReporter } = await import("./revenue-reporter-EV3K5L6B.js");
+      const { RevenueReporter } = await import("./revenue-reporter-HD4GMXGD.js");
       const reporter = new RevenueReporter(
         opts.db,
         platformUrl,
@@ -20139,7 +20379,7 @@ async function createDVMServer(descriptor, opts) {
       revenueReporter = reporter;
       await reporter.init();
       reporter.startRetryLoop();
-      const { MemoryX402BatchStore, PayoutReporter } = await import("./payout-reporter-HVJ6WUF3.js");
+      const { MemoryX402BatchStore, PayoutReporter } = await import("./payout-reporter-NXWQVKXW.js");
       payoutReporter = new PayoutReporter({
         dvmId,
         db: opts.db,
@@ -20167,6 +20407,7 @@ async function createDVMServer(descriptor, opts) {
     const effectiveOnRevenueSkippedNoRail = opts.onRevenueSkippedNoRail ?? (activeRevenueReporter ? (info) => activeRevenueReporter.reportRevenueSkippedNoRail(info) : void 0);
     const enqueueCreditDeposit = !opts.onCreditFunded && activeRevenueReporter ? activeRevenueReporter.enqueueDeposit.bind(activeRevenueReporter) : void 0;
     const enqueueCreditDrain = activeRevenueReporter ? activeRevenueReporter.enqueueCreditDrain.bind(activeRevenueReporter) : void 0;
+    const enqueueCreditDrawRefund = activeRevenueReporter ? activeRevenueReporter.enqueueCreditDrawRefund.bind(activeRevenueReporter) : void 0;
     const enqueueCreditDrawRelease = activeRevenueReporter ? activeRevenueReporter.enqueueCreditDrawRelease.bind(activeRevenueReporter) : void 0;
     unsubscribeTempoSettlementReadiness = opts.tempoSettlementReadiness?.subscribe({
       onBalance: (observation) => activeRevenueReporter && dvmId ? activeRevenueReporter.reportTempoSettlementBalance({
@@ -20322,6 +20563,7 @@ async function createDVMServer(descriptor, opts) {
     } : void 0;
     server = new DVMServer(descriptor, {
       ...opts,
+      platformUrl,
       hostingControlInstance: hostingControl,
       hostedSettlementReports,
       hostingClosureSupport,
@@ -20336,6 +20578,7 @@ async function createDVMServer(descriptor, opts) {
       enqueueCreditDeposit,
       enqueueCreditDrain,
       enqueueCreditDrawRelease,
+      enqueueCreditDrawRefund,
       x402BatchSettlement,
       x402BatchSettlementFactory,
       x402ExactSettlement,
@@ -20791,8 +21034,10 @@ var DVMServer = class {
         receiptIssuer: this.receiptIssuer,
         creditTtlMs: () => this.creditTtlMs(),
         creditCurrency: () => this.creditCurrency(),
+        enqueueCreditDrawRefund: this.opts.enqueueCreditDrawRefund,
         enqueueCreditDeposit: this.opts.enqueueCreditDeposit,
         enqueueCreditDrain: this.opts.enqueueCreditDrain,
+        requireDrainReport: !!this.opts.platformUrl,
         lightningReceive: this.opts.lightningReceive,
         // x402 repair queue rides the same surface, and resolves
         // the rail the same lazy way the verify path does — constructing the
@@ -22927,8 +23172,14 @@ var DVMServer = class {
         await jm.markInboundVerified(activeJob.id, inboundSeq2);
       }
       jm.startIdleTimer(activeJob);
-      await jm.dispatchMessage(activeJob, body2.type, body2.content);
-      await jm.persistJob(activeJob);
+      try {
+        await jm.dispatchMessage(activeJob, body2.type, body2.content);
+        await this.persistMessageSnapshot(jm, activeJob, body2.type);
+      } catch (error) {
+        const response = this.postPaymentSnapshotFailure(c, error, activeJob, body2.type, inboundSeq2, unappliedCredit2);
+        if (response) return response;
+        throw error;
+      }
       const lastMsg2 = activeJob.messages[activeJob.messages.length - 1];
       return c.json({ seq: lastMsg2.seq, ...unappliedCredit2 && { credit: unappliedCredit2 } }, 201);
     }
@@ -23011,20 +23262,48 @@ var DVMServer = class {
       return c.json({ seq: lastMsg2.seq, ...creditBlock }, 201);
     }
     jm.startIdleTimer(job);
-    if (isStreamableJobStore(jm.store)) {
-      const store = jm.store;
-      const lockResult = await store.tryReactivationLock(job.id, async () => {
+    try {
+      if (isStreamableJobStore(jm.store)) {
+        const store = jm.store;
+        const lockResult = await store.tryReactivationLock(job.id, async () => {
+          await this.runReactivation(jm, job, body, record.status);
+        });
+        if (!lockResult.acquired) {
+          this.teardownReactivationScaffold(jm, job);
+        }
+      } else {
         await this.runReactivation(jm, job, body, record.status);
-      });
-      if (!lockResult.acquired) {
-        this.teardownReactivationScaffold(jm, job);
       }
-    } else {
-      await this.runReactivation(jm, job, body, record.status);
+    } catch (error) {
+      const response = this.postPaymentSnapshotFailure(c, error, job, body.type, inboundSeq, unappliedCredit);
+      if (response) return response;
+      throw error;
     }
     const lastMsg = job.messages[job.messages.length - 1];
     return c.json({ seq: lastMsg.seq, ...creditBlock }, 201);
   }
+  async persistMessageSnapshot(jm, job, type) {
+    if (type === "payment") {
+      await retryJobSnapshot(() => jm.persistJob(job));
+    } else {
+      await jm.persistJob(job);
+    }
+  }
+  postPaymentSnapshotFailure(c, error, job, type, inboundSeq, unappliedCredit) {
+    if (!(error instanceof JobSnapshotPersistenceError) || type !== "payment" || inboundSeq === null || !isStreamableJobStore(this.jobManager.store)) return void 0;
+    diagnosticConsole.error({ level: "job_snapshot_unavailable", job_id: job.id, seq: inboundSeq });
+    return c.json({
+      error: "job_snapshot_unavailable",
+      message: "Payment was recorded but the job snapshot could not be persisted.",
+      display: "Your payment was recorded. The service could not save the latest job progress.",
+      hint: "Do not send another payment. Read the job status and messages; if the worker stopped, resume with a non-payment message.",
+      retryable: false,
+      payment_status: "recorded",
+      job_id: job.id,
+      seq: inboundSeq,
+      ...unappliedCredit && { credit: unappliedCredit }
+    }, 503);
+  }
   /**
    * Run the handler or dispatch the inbound after Tx B + Tx C have already
    * committed the credit. Status decides the behaviour: `awaiting-input`
@@ -23050,7 +23329,7 @@ var DVMServer = class {
       });
     } else {
       await jm.dispatchMessage(job, body.type, body.content);
-      await jm.persistJob(job);
+      await this.persistMessageSnapshot(jm, job, body.type);
     }
   }
   /**