@dvmkit/sdk 0.10.1 → 0.12.0-rc.1

package/dist/{chunk-SYBFMHXQ.js → chunk-S7PIFHE4.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-XRLKGCAW.js";
 import {
   x402EarnedCeiling
-} from "./chunk-FFXXGCVG.js";
+} from "./chunk-ITRSITFP.js";
 import {
   createX402FacilitatorAuthHeaders,
   createX402FacilitatorClient,
@@ -14,16 +14,13 @@ import {
   verifyWithFacilitator,
   withPaymentDiagnostics,
   withPaymentStage
-} from "./chunk-VTHYQCDB.js";
+} from "./chunk-E7ZBCT5U.js";
 import {
   MemoryCreditLedger
-} from "./chunk-YOSZIWC3.js";
+} from "./chunk-POYUX2NN.js";
 import {
   PostgresJobStore
-} from "./chunk-2OGBZPPJ.js";
-import {
-  parseStoreValue
-} from "./chunk-YG7G4DPZ.js";
+} from "./chunk-TWKQFIOW.js";
 import {
   SIGNED_ENVELOPE_FIELDS,
   SignedRequestError,
@@ -31,7 +28,7 @@ import {
   humanizeZodIssues,
   signedRequestInput,
   zodIssuesOf
-} from "./chunk-2XQLL6N6.js";
+} from "./chunk-WFCVS6QB.js";
 import {
   MemoryJobStore,
   UNCAPPABLE_ASK_TOTAL,
@@ -40,7 +37,7 @@ import {
   isJobRetentionStore,
   isReceiptIssuingStore,
   isStreamableJobStore
-} from "./chunk-KFCEXCZM.js";
+} from "./chunk-KJZVTWMX.js";
 import {
   ContentHoldError,
   JobCancelledError,
@@ -66,7 +63,6 @@ import {
   attestedDvmIdentity,
   buildAdminChallenge,
   checkMintHealth,
-  computeResultHash,
   createMonotonicClock,
   formatStaleness,
   getWallet,
@@ -75,12 +71,9 @@ import {
   isX402SettlementReconciliationReason,
   parseTraceparent,
   receiptPubkeyFromSecret,
-  signDrainReceipt,
-  signFundingReceipt,
-  signReceipt,
   toLockPubkey,
   verifyChallenge
-} from "./chunk-VUGEEMLT.js";
+} from "./chunk-RPUFWIT4.js";
 import {
   X402_BATCH_SETTLEMENT_SCHEME,
   X402_DEFAULT_FACILITATOR,
@@ -103,12 +96,11 @@ import {
 import {
   RAIL_REFUNDABLE,
   canonicalRequestPath,
-  canonicalize,
   isZodSchema
-} from "./chunk-UKD3R2KU.js";
+} from "./chunk-HW2UCOOC.js";
 import {
   createConsoleLogger
-} from "./chunk-3R7NQA3Z.js";
+} from "./chunk-7KQLPVV7.js";
 import {
   StepCache
 } from "./chunk-BQJIFRAZ.js";
@@ -125,7 +117,7 @@ import {
   roundUsd,
   satsToFiat,
   validateCurrency
-} from "./chunk-W3VGCNG6.js";
+} from "./chunk-LDKV4UHI.js";
 import {
   CreditLedger,
   CreditLedgerError,
@@ -141,17 +133,29 @@ import {
   isNonChannelBitcoinRail,
   netOwedSats,
   x402SettlementPending
-} from "./chunk-STJBBVNL.js";
+} from "./chunk-2VGMZ7VF.js";
+import {
+  parseStoreValue
+} from "./chunk-YG7G4DPZ.js";
 import {
   withSdkInitLock
 } from "./chunk-COYKJRMM.js";
+import {
+  computeResultHash,
+  signDrainReceipt,
+  signFundingReceipt,
+  signReceipt
+} from "./chunk-5H7P3ORL.js";
 import {
   withPostgresRecoveryContext
-} from "./chunk-MMGSYMIC.js";
+} from "./chunk-EP7OVWI5.js";
 import {
   DvmError,
   x402NetworkByCaip2
 } from "./chunk-BPYMEMQX.js";
+import {
+  canonicalize
+} from "./chunk-H3GGFEE5.js";
 import {
   TEMPO_MODERATO_CHAIN_ID,
   TEMPO_MODERATO_RPC,
@@ -162,17 +166,17 @@ import {
   installHostedTempoCloseGuard,
   isTempoInsufficientFundsError,
   resolveTempoNetwork
-} from "./chunk-MU3IE434.js";
+} from "./chunk-JLT2YIBS.js";
 import {
   loggers,
   pinDimension,
   withSpan,
   withTraceContext
-} from "./chunk-M3T5JYDJ.js";
+} from "./chunk-HNXMWHLU.js";
 import {
   createDiagnosticCapabilityAuthority,
   diagnosticConsole
-} from "./chunk-QGNXYVBO.js";
+} from "./chunk-Z4FOPROB.js";
 
 // src/sdk/server/lock-pubkey-store.ts
 async function initLockPubkeyTable(db) {
@@ -991,6 +995,7 @@ function attachCreditMenu(body, menu) {
 }
 function toCreditTerms(menu) {
   return {
+    ...menu.balance_payment && { balance_payment: true },
     min_micro: menu.min_micro,
     max_micro: menu.max_micro,
     ttl_ms: menu.ttl_ms,
@@ -3884,7 +3889,7 @@ async function verifyUpfrontPaymentInScope(opts) {
           x402Requirements
         });
       }
-      const { verifyX402Payment } = await import("./x402-EN5LSOVM.js");
+      const { verifyX402Payment } = await import("./x402-RUJ4LUKF.js");
       const receipt = await withPaymentStage("verifier_broadcast", () => verifyX402Payment(
         x402Payment,
         x402Config,
@@ -4908,7 +4913,7 @@ async function verifyIncomingPaymentInScope(body, opts, snapshot) {
           snapshot
         });
       }
-      const { verifyX402Payment } = await import("./x402-EN5LSOVM.js");
+      const { verifyX402Payment } = await import("./x402-RUJ4LUKF.js");
       const receipt = await withPaymentStage("verifier_broadcast", () => verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -5339,7 +5344,7 @@ async function processIncomingPaymentInScope(job, body, opts) {
     try {
       const requiredMsats = job.pendingPaymentMsats ?? 0;
       const requiredUsdcMicro = job.pendingX402AmountUsdcMicro !== void 0 ? BigInt(job.pendingX402AmountUsdcMicro) : BigInt(msatsToUsdc(requiredMsats, rate));
-      const { verifyX402Payment } = await import("./x402-EN5LSOVM.js");
+      const { verifyX402Payment } = await import("./x402-RUJ4LUKF.js");
       const receipt = await withPaymentStage("verifier_broadcast", () => verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -6943,13 +6948,37 @@ async function fundingReceiptFor(ledger, issuer, funding) {
 
 // src/sdk/server/tempo-drain-leg.ts
 async function completeTempoChannelDrain(args) {
-  const settlementEvidence = refundFloorEvidence({
-    rail: "tempo",
-    refundedNative: args.refundedNative,
-    debitedNative: args.debitedNative,
-    creditId: args.creditId,
-    drainId: args.drainId
-  });
+  if (!args.tx && args.refundedNative !== void 0 && /^\d{1,78}$/.test(String(args.refundedNative))) {
+    try {
+      if (args.finalization?.outcome === "payer_exit" || args.finalization?.outcome === "payer_exit_unbacked") {
+        if (BigInt(args.refundedNative) > 0n) await args.deps.ledger.recordTempoDrainPayment?.({ creditId: args.creditId, drainId: args.drainId });
+      } else {
+        await args.deps.ledger.recordTempoDrainRefund?.({ creditId: args.creditId, drainId: args.drainId, refundedNative: args.refundedNative });
+      }
+    } catch (error) {
+      loggers.tempo.warn("tempo_drain_refund_evidence_write_failed", {});
+      throw error;
+    }
+  }
+  let settlementEvidence;
+  try {
+    settlementEvidence = refundFloorEvidence({
+      rail: "tempo",
+      refundedNative: args.refundedNative,
+      debitedNative: args.debitedNative,
+      creditId: args.creditId,
+      drainId: args.drainId
+    });
+  } catch (error) {
+    if (error instanceof DrainRefundFloorError && !args.tx) {
+      try {
+        await args.deps.ledger.recordTempoDrainHold?.({ creditId: args.creditId, drainId: args.drainId, reason: "refund_short" });
+      } catch {
+        loggers.tempo.warn("tempo_drain_hold_reason_write_failed", {});
+      }
+    }
+    throw error;
+  }
   return commitTerminalDrain(
     args.deps.drainReport,
     async (innerTx) => {
@@ -7690,6 +7719,11 @@ async function recoverTempoDrain(deps, mpp, record, channelId) {
     }
     if (!result) return null;
     if (!/^0x[0-9a-fA-F]{64}$/.test(result)) {
+      try {
+        await deps.ledger.recordTempoDrainHold?.({ creditId: record.creditId, drainId: record.drainId, reason: "close_evidence_missing" });
+      } catch {
+        loggers.tempo.warn("tempo_drain_hold_reason_write_failed", { amount_micro: record.amountMicro });
+      }
       loggers.tempo.warn("tempo_session_drain_refund_unproven", {
         channel_id: channelId,
         credit_id: record.creditId,
@@ -10130,6 +10164,7 @@ var HostedSettlementReportObligations = class {
          FROM sdk_hosted_settlement_report_obligations target
          WHERE target.dvm_id=$1 AND target.scope=$2 AND target.rail='tempo' AND target.operation='close'
            AND target.state IN ('unmatched','no_report')
+           AND ($7::text IS NULL OR target.channel_id=$7)
        )
        SELECT * FROM candidates
        WHERE ($6::boolean OR (state='unmatched' AND (retryable OR write_off_allowed)))
@@ -10141,7 +10176,8 @@ var HostedSettlementReportObligations = class {
         args.limit,
         args.after?.createdAtMs ?? null,
         args.after?.obligationId ?? null,
-        args.all ?? false
+        args.all ?? false,
+        args.channelId ?? null
       ]
     );
     return result.rows.map((row) => ({
@@ -12605,6 +12641,7 @@ function buildContext(job, opts) {
       const paymentRequestContent = {
         amount_msats: amountMsats,
         reason,
+        ...pendingFiat && { credit: { amount_micro: pendingFiat.amountMicro, currency: pendingFiat.currency } },
         ...fiatAmount && { fiat_amount: fiatAmount },
         ...payOpts?.mints && { mints: payOpts.mints },
         ...payOpts?.minLocktimeSeconds && { min_locktime_seconds: payOpts.minLocktimeSeconds },
@@ -12683,8 +12720,16 @@ function buildContext(job, opts) {
         if (job.replayPaymentIndex < payments.length) {
           const payment = payments[job.replayPaymentIndex];
           job.replayPaymentIndex++;
-          if (job.reactivationPaymentApplied !== true) {
-            throw new Error("[internal_error] payment replay reached without credit");
+          const balance = payment.content.credit;
+          const accepted = balance ? await opts.acceptedBalancePayment?.(payment.seq, pendingFiat?.amountMicro, pendingFiat?.currency) : job.reactivationPaymentApplied === true;
+          if (!accepted) throw new Error("[internal_error] payment replay reached without credit");
+          if (balance) {
+            job.pendingPaymentMsats = void 0;
+            job.pendingPaymentFiatMicro = void 0;
+            job.pendingPaymentFiatCurrency = void 0;
+            job.pendingMppChallengeIds = void 0;
+            job.pendingX402Nonce = void 0;
+            job.pendingX402AmountUsdcMicro = void 0;
           }
           job.status = "processing";
           creditedToHandlerMsats += amountMsats;
@@ -12753,7 +12798,7 @@ function buildContext(job, opts) {
             try {
               const counters = await getCounters();
               if (!counters || resolved) return;
-              const satisfied = poolBasis ? counters.paidMsats - paidMsatsAtYield >= amountMsats : counters.paidMsats - creditedToHandlerMsats >= amountMsats;
+              const satisfied = counters.balancePaymentSatisfied === true || (poolBasis ? counters.paidMsats - paidMsatsAtYield >= amountMsats : counters.paidMsats - creditedToHandlerMsats >= amountMsats);
               if (satisfied) {
                 const resume = async () => {
                   job.paidMsats = counters.paidMsats;
@@ -13257,6 +13302,9 @@ var JobManager = class {
   statusChecksInFlight = /* @__PURE__ */ new Set();
   /** Job ids that were notified mid-re-read and must be re-checked. */
   statusChecksQueued = /* @__PURE__ */ new Set();
+  // Bind live resolvers and recovery scaffolds to the store-allocated ask identity.
+  paymentAskSeqs = /* @__PURE__ */ new WeakMap();
+  reactivationAskSeqs = /* @__PURE__ */ new WeakMap();
   // Every local input resume holds this queue through its durable wait update.
   // A prompt response and a payment NOTIFY must not mistake each other for a
   // different machine's successful claim.
@@ -13683,7 +13731,59 @@ var JobManager = class {
   }
   async claimLocalInput(job) {
     await job.messageAppenderTail;
-    return isStreamableJobStore(this.jobStore) ? this.jobStore.claimForProcessing(job.id) : true;
+    const askSeq = job.pendingPayment ? this.paymentAskSeqs.get(job.pendingPayment) : void 0;
+    if (job.pendingPayment && this.opts.db && this.jobStore instanceof PostgresJobStore && askSeq === void 0) return false;
+    return this.claimInputForAsk(job.id, askSeq);
+  }
+  async claimInputForAsk(jobId, askSeq) {
+    if (!isStreamableJobStore(this.jobStore)) return true;
+    if (askSeq === void 0 || !this.opts.db || !(this.jobStore instanceof PostgresJobStore)) return this.jobStore.claimForProcessing(jobId);
+    const tx = await this.opts.db.connect();
+    try {
+      await tx.query("BEGIN");
+      const { rows: [record] } = await tx.query("SELECT status FROM jobs WHERE id=$1 FOR UPDATE", [jobId]);
+      const { rows: [ask] } = await tx.query(
+        `SELECT MAX(seq) AS seq FROM job_messages WHERE job_id=$1 AND status='verified'
+         AND data->>'from'='provider' AND data->>'type'='payment-request'`,
+        [jobId]
+      );
+      if (record?.status !== "awaiting-input" || Number(ask?.seq) !== askSeq) {
+        await tx.query("ROLLBACK");
+        return false;
+      }
+      await tx.query(
+        `UPDATE jobs SET status='processing', last_activity_at=$2,
+         caller_wait_ms=caller_wait_ms+GREATEST(0,$2-COALESCE(awaiting_input_at_ms,last_activity_at)),
+         awaiting_input_at_ms=NULL WHERE id=$1`,
+        [jobId, Date.now()]
+      );
+      await tx.query("COMMIT");
+      return true;
+    } catch (error) {
+      await tx.query("ROLLBACK").catch(() => void 0);
+      throw error;
+    } finally {
+      tx.release();
+    }
+  }
+  async adoptPaymentMetadata(job, pending) {
+    const record = await this.jobStore.get(job.id);
+    if (!record || job.pendingPayment !== pending || isTerminal(job.status) || isTerminal(record.status)) return false;
+    job.paidMsats = record.paidMsats;
+    job.pendingPaymentMsats = record.pendingPaymentMsats;
+    job.creditId = record.creditId;
+    job.drawId = record.drawId;
+    job.paymentRail = record.paymentRail;
+    job.paymentMint = record.paymentMint;
+    job.paymentTxHash = record.paymentTxHash;
+    job.nativeAmount = record.nativeAmount;
+    job.nativeAsset = record.nativeAsset;
+    job.pendingPaymentFiatMicro = record.pendingPaymentFiatMicro;
+    job.pendingPaymentFiatCurrency = record.pendingPaymentFiatCurrency;
+    job.pendingMppChallengeIds = record.pendingMppChallengeIds;
+    job.pendingX402Nonce = record.pendingX402Nonce;
+    job.pendingX402AmountUsdcMicro = record.pendingX402AmountUsdcMicro;
+    return true;
   }
   async resumeClaimedPayment(job, resume) {
     const retry = async () => {
@@ -14048,8 +14148,9 @@ var JobManager = class {
     const jobId = job.id;
     job.messageAppender = (msg, opts) => {
       const prev = job.messageAppenderTail ?? Promise.resolve();
-      const next = prev.then(
-        () => store.appendOutgoing(
+      const next = prev.then(() => {
+        const pending = job.pendingPayment;
+        return store.appendOutgoing(
           jobId,
           {
             from: msg.from,
@@ -14058,7 +14159,11 @@ var JobManager = class {
             content: msg.content
           },
           opts
-        ).catch((_err) => {
+        ).then((stored) => {
+          if (msg.type === "payment-request" && pending && job.pendingPayment === pending) {
+            this.paymentAskSeqs.set(pending, stored);
+          }
+        }).catch((_err) => {
           diagnosticConsole.error(
             {
               level: "job_message_append_failed",
@@ -14072,8 +14177,8 @@ var JobManager = class {
               error: void 0
             }
           );
-        })
-      );
+        });
+      });
       job.messageAppenderTail = next;
     };
   }
@@ -14804,10 +14909,13 @@ var JobManager = class {
   async claimAwaitingInputForReactivation(jobId) {
     if (!isStreamableJobStore(this.jobStore)) return true;
     const store = this.jobStore;
+    const scaffold = this._activeJobs.get(jobId);
+    const askSeq = scaffold ? this.reactivationAskSeqs.get(scaffold) : void 0;
     const deadline = this.monotonicNowMs() + this.reactivationClaimGraceMs;
     for (; ; ) {
       if (this.monotonicNowMs() >= deadline) {
-        return store.claimForProcessing(jobId);
+        if (scaffold && this._activeJobs.get(jobId) !== scaffold) return false;
+        return this.claimInputForAsk(jobId, askSeq);
       }
       const record = await store.get(jobId);
       if (record?.status !== "awaiting-input") return false;
@@ -14917,6 +15025,8 @@ var JobManager = class {
       }
     }
     const job = fromJobRecord(record);
+    const ask = record.messages.findLast((message) => message.from === "provider" && message.type === "payment-request");
+    if (ask) this.reactivationAskSeqs.set(job, ask.seq);
     this._activeJobs.set(job.id, job);
     this.wireMessageAppender(job);
     this.watchDurableStatus(job);
@@ -15334,7 +15444,23 @@ var JobManager = class {
       onYield: () => this.persistJob(job),
       onPaymentResume: () => retryJobSnapshot(() => this.persistJob(job)),
       subscribeNotifications: isStreamableJobStore(jobStore) ? (cb) => jobStore.subscribeNotifications(job.id, cb) : void 0,
-      getCounters: isStreamableJobStore(jobStore) ? () => jobStore.getCounters(job.id) : void 0,
+      acceptedBalancePayment: this.opts.db && jobStore instanceof PostgresJobStore ? async (seq, amountMicro, currency) => {
+        const { rowCount } = await this.opts.db.query(
+          `SELECT 1 FROM credit_balance_payments p
+               JOIN job_messages m ON m.job_id=p.job_id AND m.seq=(p.response->>'seq')::bigint AND m.status='verified'
+               JOIN job_messages a ON a.job_id=p.job_id AND a.seq=p.request_seq AND a.status='verified'
+               WHERE p.job_id=$1 AND m.seq=$2 AND a.data->>'type'='payment-request'
+                 AND (m.data->'content'->'credit'->>'request_seq')::bigint=p.request_seq
+                 AND a.data->'content'->'credit'->>'amount_micro'=$3
+                 AND a.data->'content'->'credit'->>'currency'=$4`,
+          [job.id, seq, amountMicro === void 0 ? null : String(amountMicro), currency ?? null]
+        );
+        return rowCount === 1;
+      } : void 0,
+      getCounters: isStreamableJobStore(jobStore) ? async () => {
+        await job.messageAppenderTail;
+        return jobStore.getCounters(job.id);
+      } : void 0,
       drawPool: this.opts.creditLedger ? () => this.resolveDrawPool(job) : void 0,
       pricingCurrency: this.pricingCurrency,
       claimForProcessing: isStreamableJobStore(jobStore) ? (resume) => {
@@ -15343,10 +15469,13 @@ var JobManager = class {
           if (!pending || job.pendingPayment !== pending || isTerminal(job.status)) return false;
           if (!await this.claimLocalInput(job)) return false;
           if (job.pendingPayment !== pending || isTerminal(job.status)) return false;
+          let resumed = false;
           await this.resumeClaimedPayment(job, async () => {
+            if (!await this.adoptPaymentMetadata(job, pending)) return;
             await resume?.();
+            resumed = true;
           });
-          return true;
+          return resumed;
         });
       } : void 0,
       onSuperseded: () => {
@@ -15379,6 +15508,12 @@ var JobManager = class {
    * fall back on is a slice of the credit's rail value at a ratio pinned
    * whenever that credit was funded, so it cannot safely fund a new ask.
    */
+  async hasAcceptedBalancePayment(jobId) {
+    return this.jobStore instanceof PostgresJobStore && !!this.opts.db && !!(await this.opts.db.query(
+      "SELECT 1 FROM credit_balance_payments WHERE job_id=$1 LIMIT 1",
+      [jobId]
+    )).rowCount;
+  }
   async resolveDrawPool(job) {
     const ledger = this.opts.creditLedger;
     if (!ledger || !job.creditId || !job.drawId) return { basis: "rail" };
@@ -15398,8 +15533,10 @@ var JobManager = class {
       return { basis: "unpriced" };
     }
     const { rail, drawMsats, creditCurrency } = draw.railValue;
-    if (!rail || drawMsats <= 0)
-      return { basis: "rail", creditCurrency: creditCurrency ?? void 0 };
+    if (!rail || drawMsats <= 0) {
+      const acceptedBalance = await this.hasAcceptedBalancePayment(job.id);
+      if (!acceptedBalance) return { basis: "rail", creditCurrency: creditCurrency ?? void 0 };
+    }
     if (!creditCurrency) {
       this.warnDrawPool(job, "credit_currency_missing");
       return { basis: "unpriced" };
@@ -15839,7 +15976,7 @@ var JobManager = class {
     const onJobCompleted = this.opts.onJobCompleted;
     const onRevenueSkippedNoRail = this.opts.onRevenueSkippedNoRail;
     if (!onJobCompleted && !onRevenueSkippedNoRail) return false;
-    if (job.status !== "completed" || job.paidMsats <= 0) return false;
+    if (job.status !== "completed") return false;
     let credit = {};
     let creditRail;
     let drawAmountMicro;
@@ -15876,6 +16013,7 @@ var JobManager = class {
         settledAt: draw.resolvedAt ?? void 0
       };
     }
+    if (job.paidMsats <= 0 && !(drawAmountMicro !== void 0 && drawAmountMicro > 0 && typeof credit.creditCurrency === "string" && creditRail && isFundingRail(creditRail))) return false;
     if (!job.paymentRail) {
       if (job.creditId && job.drawId) {
         const creditCurrency = typeof credit.creditCurrency === "string" ? credit.creditCurrency : void 0;
@@ -17151,13 +17289,167 @@ function withWallClockDeadline(promise, timeoutMs) {
   });
 }
 
+// src/sdk/server/balance-payment.ts
+import { createHash as createHash9 } from "crypto";
+import { z as z2 } from "zod";
+var BALANCE_PAYMENT_SCHEMA = z2.object({
+  credit_id: z2.string().min(1).max(256),
+  draw_id: z2.string().min(1).max(256),
+  payment_id: z2.string().min(1).max(256),
+  request_seq: z2.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+  amount_micro: z2.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  currency: z2.string().regex(/^[a-z]{3}$/),
+  pubkey: z2.string(),
+  signature: z2.string(),
+  timestamp: z2.number(),
+  nonce: z2.string()
+});
+var BalancePaymentError = class extends Error {
+  constructor(status, body) {
+    super(String(body.error));
+    this.status = status;
+    this.body = body;
+  }
+  status;
+  body;
+};
+function conflict(error = "credit_payment_conflict") {
+  throw new BalancePaymentError(409, { error });
+}
+async function commitBalancePayment(args) {
+  args.auth.recheckSignature(BALANCE_PAYMENT_SCHEMA, args.raw, args.domain);
+  const auth = BALANCE_PAYMENT_SCHEMA.parse(args.raw);
+  const { pubkey, credit_id, draw_id, payment_id, request_seq, amount_micro, currency } = auth;
+  const fingerprint = createHash9("sha256").update(JSON.stringify([
+    args.domain,
+    args.jobId,
+    pubkey,
+    credit_id,
+    draw_id,
+    payment_id,
+    request_seq,
+    amount_micro,
+    currency
+  ])).digest("hex");
+  const tx = await args.pool.connect();
+  try {
+    await tx.query("BEGIN");
+    await tx.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [`balance-payment:${payment_id}`]);
+    const prior = await tx.query(
+      "SELECT fingerprint, response FROM credit_balance_payments WHERE payment_id=$1",
+      [payment_id]
+    );
+    if (prior.rows[0]) {
+      if (prior.rows[0].fingerprint !== fingerprint) conflict();
+      await tx.query("COMMIT");
+      return { response: prior.rows[0].response, replayed: true };
+    }
+    if (args.allowFresh === false) conflict("balance_payment_unavailable");
+    args.auth.checkAuth(BALANCE_PAYMENT_SCHEMA, args.raw, args.domain);
+    const jobs = await tx.query("SELECT * FROM jobs WHERE id=$1 FOR UPDATE", [args.jobId]);
+    const job = jobs.rows[0];
+    if (!job || job.dvm_id !== null && job.dvm_id !== args.dvmId || job.requester_pubkey !== pubkey) conflict("credit_payment_owner_mismatch");
+    if (["completed", "failed", "cancelled"].includes(job.status)) conflict("job_not_active");
+    const asks = await tx.query(
+      `SELECT data FROM job_messages WHERE job_id=$1 AND data->>'type'='payment-request'
+       AND data->>'from'='provider' AND status='verified' ORDER BY seq DESC LIMIT 1`,
+      [args.jobId]
+    );
+    const ask = asks.rows[0]?.data;
+    if (!ask || ask.seq !== request_seq || !ask.content.credit || ask.content.credit.amount_micro !== amount_micro || ask.content.credit.currency !== currency || Number(job.pending_payment_fiat_micro) !== amount_micro || job.pending_payment_fiat_currency !== currency || Number(job.pending_payment_msats) <= 0 || job.asked_topup_micro === null || Number(job.asked_topup_micro) < amount_micro) {
+      conflict("credit_payment_ask_mismatch");
+    }
+    if ((job.credit_id !== null || job.draw_id !== null) && (job.credit_id !== credit_id || job.draw_id !== draw_id)) conflict();
+    const { rows: [credit] } = await tx.query(
+      "SELECT caller_pubkey,currency FROM credits WHERE credit_id=$1",
+      [credit_id]
+    );
+    if (!credit || credit.caller_pubkey !== pubkey) conflict("credit_payment_owner_mismatch");
+    if (credit.currency !== currency) conflict("credit_payment_currency_mismatch");
+    const seq = Number(job.next_seq);
+    const message = { seq, from: "requester", type: "payment", timestamp: Math.floor(Date.now() / 1e3), content: { credit: args.raw } };
+    await tx.query(`INSERT INTO job_messages (job_id,seq,data,status,created_at_ms)
+      VALUES ($1,$2,$3,'pending-verification',$4)`, [args.jobId, seq, JSON.stringify(message), Date.now()]);
+    if (job.credit_id === null) {
+      const existing = await tx.query("SELECT 1 FROM credit_draws WHERE credit_id=$1 AND draw_id=$2", [credit_id, draw_id]);
+      if (existing.rowCount) conflict();
+      await args.ledger.draw({
+        creditId: credit_id,
+        drawId: draw_id,
+        amountMicro: 0,
+        jobId: args.jobId,
+        hostingPaymentSeq: seq,
+        tx
+      });
+    }
+    const grown = await args.ledger.growDraw({
+      creditId: credit_id,
+      drawId: draw_id,
+      jobId: args.jobId,
+      spendExistingBalance: true,
+      hostingPaymentSeq: seq,
+      addAmountMicro: amount_micro,
+      capMicro: Number(job.asked_topup_micro),
+      tx
+    });
+    if (grown.addedAmountMicro !== amount_micro) conflict("credit_payment_ask_mismatch");
+    const basis = grown.railValue;
+    const nativeAsset = basis.nativeAsset;
+    await tx.query(
+      `UPDATE jobs SET next_seq=next_seq+1,
+      paid_msats=paid_msats+$2, pending_payment_msats=NULL,
+      pending_payment_fiat_micro=NULL, pending_payment_fiat_currency=NULL,
+      pending_mpp_challenge_ids=NULL, pending_x402_nonce=NULL, pending_x402_amount_usdc_micro=NULL,
+      credit_id=$3, draw_id=$4, payment_rail=$5, payment_mint=$6, payment_tx_hash=$7,
+      native_amount=$8, native_asset=$9, last_activity_at=$10 WHERE id=$1`,
+      [
+        args.jobId,
+        grown.addedRailValue.drawMsats,
+        credit_id,
+        draw_id,
+        basis.rail,
+        basis.mint,
+        drawSettlementRef(args.dvmId, credit_id, draw_id),
+        basis.drawNative,
+        nativeAsset,
+        Date.now()
+      ]
+    );
+    await tx.query("UPDATE job_messages SET status='verified' WHERE job_id=$1 AND seq=$2", [args.jobId, seq]);
+    const response = { seq };
+    await tx.query(
+      "INSERT INTO credit_balance_payments(payment_id,fingerprint,response,job_id,request_seq) VALUES($1,$2,$3,$4,$5)",
+      [payment_id, fingerprint, JSON.stringify(response), args.jobId, request_seq]
+    );
+    await tx.query("SELECT pg_notify('job_messages', $1)", [args.jobId]);
+    await tx.query("COMMIT");
+    return { response, replayed: false };
+  } catch (error) {
+    await tx.query("ROLLBACK").catch(() => void 0);
+    if (error instanceof CreditLedgerError && error.code === "insufficient_credit") {
+      const remaining = error.details.availableMicro ?? 0;
+      throw new BalancePaymentError(402, {
+        error: "insufficient_credit",
+        remaining_micro: remaining,
+        shortfall_micro: Math.max(0, auth.amount_micro - remaining)
+      });
+    }
+    if (error instanceof CreditLedgerError) {
+      throw new BalancePaymentError(409, { error: error.code });
+    }
+    throw error;
+  } finally {
+    tx.release();
+  }
+}
+
 // src/sdk/server/app.ts
-import { createHash as createHash10, randomBytes as randomBytes5, randomUUID as randomUUID6 } from "crypto";
+import { createHash as createHash11, randomBytes as randomBytes5, randomUUID as randomUUID6 } from "crypto";
 import { Hono } from "hono";
 import { getCookie } from "hono/cookie";
 import { cors } from "hono/cors";
 import { streamSSE } from "hono/streaming";
-import { toJSONSchema, z as z2 } from "zod";
+import { toJSONSchema, z as z3 } from "zod";
 
 // src/lib/git-sha.ts
 var DIRTY_SUFFIX = "-dirty";
@@ -17170,6 +17462,8 @@ function shortSha(sha) {
 }
 
 // src/sdk/server/admin-credit.ts
+import { sha256 } from "@noble/hashes/sha2.js";
+import { bytesToHex } from "@noble/hashes/utils.js";
 import {
   Amount as Amount3,
   CheckStateEnum as CheckStateEnum3,
@@ -17177,6 +17471,7 @@ import {
   getTokenMetadata as getTokenMetadata2
 } from "@cashu/cashu-ts";
 function installAdminCreditRoutes(app, opts) {
+  app.post("/admin/credit/refund-draw", (c) => handleRefundDraw(c, opts));
   app.get("/admin/credit/pending-drains", (c) => handlePendingDrains(c, opts));
   app.get("/admin/credit/bitcoin-liability", (c) => handleBitcoinLiability(c, opts));
   app.post("/admin/credit/park-drain", (c) => handleParkDrain(c, opts));
@@ -17197,9 +17492,68 @@ function installAdminCreditRoutes(app, opts) {
   app.post("/admin/credit/write-off-tempo-close-report", (c) => handleTempoCloseReportAction(c, opts, "write-off"));
   app.get("/admin/credit/tempo-drains", (c) => handleTempoDrains(c, opts));
   app.get("/admin/credit/tempo-losses", (c) => handleTempoLosses(c, opts));
+  app.post("/admin/credit/book-tempo-drain", (c) => handleTempoDrainDecision(c, opts, "book_refunded"));
+  app.post("/admin/credit/release-tempo-drain", (c) => handleTempoDrainDecision(c, opts, "release"));
   app.post("/admin/credit/reconcile-tempo-drain", (c) => handleReconcileTempo(c, opts));
   app.post("/admin/credit/write-off-tempo-drain", (c) => handleWriteOffTempo(c, opts));
 }
+async function handleRefundDraw(c, opts) {
+  const auth = await requireAuth(c, opts);
+  if ("response" in auth) return auth.response;
+  const body = await c.req.json().catch(() => null);
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    return c.json({ error: "invalid_body", message: "Request body must be a JSON object." }, 400);
+  }
+  const value = body;
+  const nonempty = (item) => typeof item === "string" && item.length > 0;
+  const byJob = nonempty(value.jobId) && value.creditId === void 0 && value.drawId === void 0;
+  const byDraw = value.jobId === void 0 && nonempty(value.creditId) && nonempty(value.drawId);
+  if (!byJob && !byDraw || !nonempty(value.refundId) || value.amountMicro !== void 0 && (typeof value.amountMicro !== "number" || !Number.isSafeInteger(value.amountMicro) || value.amountMicro <= 0) || value.reason !== void 0 && (typeof value.reason !== "string" || value.reason.length > 280)) {
+    return c.json({ error: "invalid_body", message: "Provide jobId or creditId + drawId, refundId, an optional positive safe integer amountMicro, and an optional reason of at most 280 characters." }, 400);
+  }
+  if (!opts.ledger.durable || !opts.enqueueCreditDrawRefund) {
+    return c.json({ error: "credit_refund_unavailable", hint: "Configure the persistent credit store and platform refund reporter, then retry with the original refund ID." }, 503);
+  }
+  try {
+    const result = await opts.ledger.refundDraw({
+      ...byJob ? { jobId: value.jobId } : { creditId: value.creditId, drawId: value.drawId },
+      refundId: value.refundId,
+      ...value.amountMicro === void 0 ? {} : { amountMicro: value.amountMicro },
+      ...value.reason === void 0 ? {} : { reason: value.reason },
+      outbox: { dvmId: opts.dvmId, enqueue: opts.enqueueCreditDrawRefund },
+      ...opts.receiptIssuer ? { trustedReceiptPubkey: opts.receiptIssuer.pubkey } : {},
+      ...opts.now ? { nowMs: opts.now() } : {}
+    });
+    return c.json({
+      status: "refunded",
+      refund_id: result.refundId,
+      credit_id: result.creditId,
+      draw_id: result.drawId,
+      job_id: result.jobId,
+      amount_micro: result.amountMicro,
+      currency: result.currency,
+      ledger_seq: result.ledgerSeq,
+      refunded_at: result.refundedAt,
+      balance_after_micro: result.balanceAfterMicro,
+      replayed: result.replayed
+    });
+  } catch (error) {
+    if (!(error instanceof CreditLedgerError)) throw error;
+    const hints = {
+      draw_not_found: "Check the job ID or credit/draw IDs. If they are correct, this DVM may lack trusted ownership evidence; ask an operator to inspect that evidence. Retrying alone cannot establish ownership.",
+      draw_not_completed: "Wait for the job to complete. Failed or cancelled jobs release their pending hold automatically.",
+      refund_exceeds_draw: "Refund no more than the remaining unrefunded charge. Omit amountMicro to refund that remainder.",
+      credit_not_open: "The original credit is closed or expired. Ask an operator to inspect the original payment before arranging a refund.",
+      credit_refund_channel_unsupported: "This channel returns unused collateral through its normal exit. Ask an operator about refunding completed spending.",
+      credit_refund_basis_unavailable: "The original payment value cannot be proven automatically. Ask an operator to inspect independent original-payment evidence before arranging a repair. Retrying alone cannot establish that evidence.",
+      credit_refund_state_unavailable: "The original credit reopening order cannot be proven automatically. Ask an operator to inspect independent funding and drain evidence before arranging a repair. Retrying alone cannot establish that evidence.",
+      refund_conflict: "Repeat the original arguments, or deliberately choose a new refund ID for a different refund."
+    };
+    const hint = hints[error.code];
+    if (!hint) throw error;
+    return c.json({ error: error.code, hint }, error.code === "draw_not_found" ? 404 : error.code === "refund_conflict" ? 409 : 422);
+  }
+}
 async function handleX402ExactSettlements(c, opts) {
   const auth = await requireAuth(c, opts);
   if ("response" in auth) return auth.response;
@@ -17318,6 +17672,9 @@ async function handleTempoLosses(c, opts) {
       currency: loss.currency,
       former_balance_micro: loss.formerBalanceMicro,
       settled_on_chain_native: loss.settledOnChainNative.toString(),
+      refunded_to_payer_native: loss.refundedToPayerNative?.toString() ?? null,
+      loss_native: loss.lossNative?.toString() ?? null,
+      loss_basis: loss.lossBasis ?? null,
       highest_voucher_native: loss.highestVoucherNative.toString(),
       consumed_service_micro: loss.consumedServiceMicro,
       consumed_native: loss.consumedNative.toString(),
@@ -18304,13 +18661,18 @@ async function handleTempoDrains(c, opts) {
     ...after ? { after } : {},
     createdBeforeMs: nowMs - minAge,
     rail: "tempo",
-    includeResolved: c.req.query("include_resolved") === "true"
+    includeResolved: c.req.query("include_resolved") === "true",
+    includeWrittenOff: true
   });
   const wantsEvidence = c.req.query("evidence") !== "false";
   const rows2 = [];
   for (const drain of drains) {
     const evidence = wantsEvidence && drain.channelId ? await classifyTempoCloseEvidence(rail.rail, drain.channelId) : void 0;
-    rows2.push(tempoDrainBody(drain, evidence));
+    const closeReports = drain.channelId && opts.hostedSettlementReports ? await opts.hostedSettlementReports.store.listTempoCloseReports({ limit: 50, all: true, channelId: drain.channelId }) : [];
+    rows2.push({
+      ...tempoDrainBody(drain, evidence),
+      close_reports: closeReports.map((row) => ({ obligation_id: row.id, status: row.status, written_off: row.writtenOff }))
+    });
   }
   const last = drains.length === limit ? drains[drains.length - 1] : void 0;
   return c.json({
@@ -18324,6 +18686,90 @@ async function handleTempoDrains(c, opts) {
     } : {}
   });
 }
+async function handleTempoDrainDecision(c, opts, decision) {
+  const auth = await requireAuth(c, opts);
+  if ("response" in auth) return auth.response;
+  const body = await c.req.json().catch(() => null);
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    return c.json({ error: "invalid_body", message: "Request body must be a JSON object." }, 400);
+  }
+  const value = body;
+  const text = (item, max) => typeof item === "string" && item.trim().length > 0 && item.trim().length <= max;
+  if (Object.keys(value).some((key) => !["credit_id", "drain_id", "reason", "evidence"].includes(key)) || typeof value.credit_id !== "string" || value.credit_id.length === 0 || typeof value.drain_id !== "string" || value.drain_id.length === 0 || !text(value.reason, 2e3) || value.evidence !== void 0 && !text(value.evidence, 4e3)) {
+    return c.json({ error: "invalid_body", message: "Provide credit_id, drain_id, a reason of 1\u20132000 characters, and optional evidence of 1\u20134000 characters." }, 400);
+  }
+  if (!opts.ledger.durable || !opts.ledger.decideTempoDrain) {
+    return c.json({ error: "tempo_drain_decision_unavailable", message: "A durable Tempo decision store is required." }, 503);
+  }
+  const args = {
+    creditId: value.credit_id,
+    drainId: value.drain_id,
+    decision,
+    reason: value.reason.trim(),
+    ...value.evidence === void 0 ? {} : { evidence: value.evidence.trim() },
+    nowMs: opts.now ? opts.now() : Date.now()
+  };
+  if (decision === "book_refunded" && opts.requireDrainReport && !opts.enqueueCreditDrain) {
+    const existing = await opts.ledger.getDrain(args);
+    if (existing && !existing.operatorDecision && (existing.status === "pending" || existing.status === "exit_required")) {
+      return c.json({ error: "tempo_drain_decision_unavailable", message: "Hosted booking requires a transactional drain reporter. Restore its configuration, then retry the original decision." }, 503);
+    }
+  }
+  const client = await opts.db.connect();
+  let result;
+  try {
+    await client.query("BEGIN");
+    let decided;
+    const transition = async () => {
+      decided = await opts.ledger.decideTempoDrain({ ...args, tx: client });
+      return decided;
+    };
+    if (decision === "book_refunded") {
+      await commitTerminalDrain({ db: opts.db, dvmId: opts.dvmId, enqueueCreditDrain: opts.enqueueCreditDrain }, transition, client);
+    } else {
+      await transition();
+    }
+    result = decided;
+    await client.query("COMMIT");
+  } catch (error) {
+    await client.query("ROLLBACK").catch(() => void 0);
+    if (error instanceof CreditLedgerError) {
+      return c.json(
+        { error: error.code, message: error.message },
+        error.code === "drain_not_found" || error.code === "credit_not_found" ? 404 : ["drain_decision_conflict", "tempo_drain_close_pending", "tempo_drain_refund_paid", "tempo_drain_refund_unknown"].includes(error.code) ? 409 : 422
+      );
+    }
+    throw error;
+  } finally {
+    client.release();
+  }
+  if (!result.replayed) {
+    diagnosticConsole.warn({
+      dataset: "tempo",
+      event: decision === "book_refunded" ? "tempo_drain_booked_as_refunded" : "tempo_drain_released",
+      credit_id: result.drain.creditId,
+      drain_id: result.drain.drainId,
+      channel_id: result.drain.channelId,
+      drain_reference: `sha256:${bytesToHex(sha256(new TextEncoder().encode(JSON.stringify([result.drain.creditId, result.drain.drainId]))))}`,
+      amount_micro: result.drain.amountMicro,
+      amount_native: result.drain.drainedNative?.toString() ?? null,
+      currency: result.drain.currency
+    });
+  }
+  return c.json({
+    status: result.drain.status,
+    credit_id: result.drain.creditId,
+    drain_id: result.drain.drainId,
+    channel_id: result.drain.channelId,
+    amount_micro: result.drain.amountMicro,
+    amount_native: result.drain.drainedNative,
+    currency: result.drain.currency,
+    decision: result.drain.operatorDecision,
+    balance_micro: result.credit.balanceMicro,
+    spendable_micro: result.spendableMicro,
+    replayed: result.replayed
+  });
+}
 async function handleReconcileTempo(c, opts) {
   const auth = await requireAuth(c, opts);
   if ("response" in auth) return auth.response;
@@ -18337,6 +18783,12 @@ async function handleReconcileTempo(c, opts) {
   if (record.status === "sent") return tempoReconciledBody(c, record, channelId, true);
   const evidence = await classifyTempoCloseEvidence(rail.rail, channelId);
   if (evidence.chain !== "found") return tempoEvidenceRefusal(c, evidence);
+  try {
+    await opts.ledger.recordTempoDrainRefund?.({ creditId: record.creditId, drainId: record.drainId, refundedNative: evidence.refundedToPayer });
+  } catch (error) {
+    diagnosticConsole.warn({ dataset: "tempo", event: "tempo_drain_refund_evidence_write_failed", amount_micro: record.amountMicro });
+    throw error;
+  }
   const client = await opts.db.connect();
   let booked;
   try {
@@ -18825,6 +19277,10 @@ function tempoDrainBody(drain, evidence) {
     created_at: drain.createdAt,
     write_off_note: drain.writeOffNote,
     written_off_at: drain.writtenOffAt,
+    decision: drain.operatorDecision ?? null,
+    proven_refund_native: drain.provenRefundNative ?? null,
+    refund_payment_proven: drain.refundPaymentProven ?? false,
+    held_reason: drain.status === "pending" || drain.status === "exit_required" ? drain.holdReason ?? (evidence?.chain === "found" && drain.drainedNative !== null && BigInt(evidence.refundedToPayer) < BigInt(drain.drainedNative) ? "refund_short" : drain.status === "exit_required" ? "exit_required" : "refund_unproven") : null,
     ...evidence ? { chain: evidence } : {}
   };
 }
@@ -20039,7 +20495,7 @@ initSchemaForm();
 }
 
 // src/sdk/server/request-fingerprint.ts
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 function requestFingerprint(req, opts) {
   const canonical = canonicalize({
     capability: req.capability,
@@ -20047,7 +20503,7 @@ function requestFingerprint(req, opts) {
     params: req.params ?? {},
     data: opts.stripAuthEnvelope ? stripEnvelope(req.data) : req.data
   });
-  return createHash9("sha256").update(canonical).digest("hex");
+  return createHash10("sha256").update(canonical).digest("hex");
 }
 var ENVELOPE_KEYS = /* @__PURE__ */ new Set(["pubkey", "signature", "timestamp", "nonce", "auth_statement"]);
 function stripEnvelope(data) {
@@ -20170,7 +20626,7 @@ async function createDVMServer(descriptor, opts) {
       }
     }
     if (!opts.onJobCompleted && platformToken && platformUrl && dvmId && opts.db) {
-      const { RevenueReporter } = await import("./revenue-reporter-EV3K5L6B.js");
+      const { RevenueReporter } = await import("./revenue-reporter-HD4GMXGD.js");
       const reporter = new RevenueReporter(
         opts.db,
         platformUrl,
@@ -20180,7 +20636,7 @@ async function createDVMServer(descriptor, opts) {
       revenueReporter = reporter;
       await reporter.init();
       reporter.startRetryLoop();
-      const { MemoryX402BatchStore, PayoutReporter } = await import("./payout-reporter-HVJ6WUF3.js");
+      const { MemoryX402BatchStore, PayoutReporter } = await import("./payout-reporter-NXWQVKXW.js");
       payoutReporter = new PayoutReporter({
         dvmId,
         db: opts.db,
@@ -20208,6 +20664,7 @@ async function createDVMServer(descriptor, opts) {
     const effectiveOnRevenueSkippedNoRail = opts.onRevenueSkippedNoRail ?? (activeRevenueReporter ? (info) => activeRevenueReporter.reportRevenueSkippedNoRail(info) : void 0);
     const enqueueCreditDeposit = !opts.onCreditFunded && activeRevenueReporter ? activeRevenueReporter.enqueueDeposit.bind(activeRevenueReporter) : void 0;
     const enqueueCreditDrain = activeRevenueReporter ? activeRevenueReporter.enqueueCreditDrain.bind(activeRevenueReporter) : void 0;
+    const enqueueCreditDrawRefund = activeRevenueReporter ? activeRevenueReporter.enqueueCreditDrawRefund.bind(activeRevenueReporter) : void 0;
     const enqueueCreditDrawRelease = activeRevenueReporter ? activeRevenueReporter.enqueueCreditDrawRelease.bind(activeRevenueReporter) : void 0;
     unsubscribeTempoSettlementReadiness = opts.tempoSettlementReadiness?.subscribe({
       onBalance: (observation) => activeRevenueReporter && dvmId ? activeRevenueReporter.reportTempoSettlementBalance({
@@ -20363,6 +20820,7 @@ async function createDVMServer(descriptor, opts) {
     } : void 0;
     server = new DVMServer(descriptor, {
       ...opts,
+      platformUrl,
       hostingControlInstance: hostingControl,
       hostedSettlementReports,
       hostingClosureSupport,
@@ -20377,6 +20835,7 @@ async function createDVMServer(descriptor, opts) {
       enqueueCreditDeposit,
       enqueueCreditDrain,
       enqueueCreditDrawRelease,
+      enqueueCreditDrawRefund,
       x402BatchSettlement,
       x402BatchSettlementFactory,
       x402ExactSettlement,
@@ -20832,8 +21291,10 @@ var DVMServer = class {
         receiptIssuer: this.receiptIssuer,
         creditTtlMs: () => this.creditTtlMs(),
         creditCurrency: () => this.creditCurrency(),
+        enqueueCreditDrawRefund: this.opts.enqueueCreditDrawRefund,
         enqueueCreditDeposit: this.opts.enqueueCreditDeposit,
         enqueueCreditDrain: this.opts.enqueueCreditDrain,
+        requireDrainReport: !!this.opts.platformUrl,
         lightningReceive: this.opts.lightningReceive,
         // x402 repair queue rides the same surface, and resolves
         // the rail the same lazy way the verify path does — constructing the
@@ -21088,7 +21549,7 @@ var DVMServer = class {
       const dvmId = this.opts.dvmId ?? `dev:${this.descriptor.name}`;
       return {
         dvm_id: dvmId,
-        builder_pubkey: createHash10("sha256").update(`dvmkit-dev:${dvmId}`).digest("hex")
+        builder_pubkey: createHash11("sha256").update(`dvmkit-dev:${dvmId}`).digest("hex")
       };
     }
     throw new AuthAudienceError();
@@ -21369,6 +21830,9 @@ var DVMServer = class {
       creditTtlMs: this.descriptor.credit ? this.descriptor.credit.ttlSeconds * 1e3 : void 0
     };
   }
+  balancePaymentSupported(includeDisabled = false) {
+    return (includeDisabled || this.opts.env.DVMKIT_BALANCE_PAYMENTS !== "false") && !!this.descriptor.credit && !!this.opts.db && this.creditLedger instanceof CreditLedger && this.jobManager.store instanceof PostgresJobStore && !!this.authAudience && !!this.descriptor.auth;
+  }
   /**
    * Assemble this DVM's funding menu for a response denominated in
    * `currency`. All the refusal logic — including the credits-spec
@@ -21379,7 +21843,7 @@ var DVMServer = class {
   async creditMenu(currency, callerPubkey) {
     await this.ensureTempoSessionHealth();
     const mppSplit = this.creditMppSplit();
-    return buildCreditMenu({
+    const menu = await buildCreditMenu({
       runtime: "container",
       config: this.descriptor.credit,
       currency,
@@ -21398,6 +21862,8 @@ var DVMServer = class {
       devMode: this.opts.devMode,
       callerPubkey
     });
+    if (menu && this.balancePaymentSupported()) menu.balance_payment = true;
+    return menu;
   }
   async handleCredit(c) {
     let hostingFundingAdmissionId;
@@ -21436,7 +21902,7 @@ var DVMServer = class {
         const paymentAuthorization = ctx.req.header("Authorization");
         const mppArtifact = paymentAuthorization ? (await import("mppx")).Credential.extractPaymentScheme(paymentAuthorization) : void 0;
         const attachedPayment = ctx.req.header("X-Cashu") ?? ctx.req.header("PAYMENT-SIGNATURE") ?? ctx.req.header("X-PAYMENT") ?? mppArtifact;
-        const paymentArtifactHash = attachedPayment ? createHash10("sha256").update(attachedPayment).digest("hex") : void 0;
+        const paymentArtifactHash = attachedPayment ? createHash11("sha256").update(attachedPayment).digest("hex") : void 0;
         hostingFundingArtifactHash = paymentArtifactHash;
         if (!await control.admit(admissionId, workId, {
           creditId,
@@ -21739,7 +22205,7 @@ var DVMServer = class {
           );
         } catch (err) {
           const schemaUrl = infoSchemaUrl(c.req.url, this.publicOrigin);
-          const { message, hint } = err instanceof z2.ZodError ? humanizeZodError(err, { schemaUrl }) : {
+          const { message, hint } = err instanceof z3.ZodError ? humanizeZodError(err, { schemaUrl }) : {
             message: "Quote-input validation failed",
             hint: `Inspect ${schemaUrl} for the expected input schema.`
           };
@@ -22145,7 +22611,7 @@ var DVMServer = class {
     const authorization = c.req.header("Authorization");
     const mppArtifact = authorization ? (await import("mppx")).Credential.extractPaymentScheme(authorization) : void 0;
     const attachedPayment = c.req.header("X-Cashu") ?? c.req.header("PAYMENT-SIGNATURE") ?? c.req.header("X-PAYMENT") ?? mppArtifact;
-    const hostingPaymentArtifactHash = attachedPayment ? createHash10("sha256").update(attachedPayment).digest("hex") : void 0;
+    const hostingPaymentArtifactHash = attachedPayment ? createHash11("sha256").update(attachedPayment).digest("hex") : void 0;
     if (!resumeOnly && this.opts.hostingControlInstance && hostingPaymentArtifactHash) {
       const priorId = await this.opts.hostingControlInstance.acceptedJobByPaymentArtifactHash(
         hostingPaymentArtifactHash
@@ -22443,7 +22909,7 @@ var DVMServer = class {
       }
       const isAnonymous = requesterId === "anonymous" || requesterId === "dev-anonymous";
       const jobToken = isAnonymous ? randomBytes5(32).toString("hex") : void 0;
-      const requesterTokenHash = jobToken ? createHash10("sha256").update(jobToken).digest("hex") : void 0;
+      const requesterTokenHash = jobToken ? createHash11("sha256").update(jobToken).digest("hex") : void 0;
       const job = jm.createJob(
         normalisedBody,
         requesterId,
@@ -22939,6 +23405,53 @@ var DVMServer = class {
     const id = c.req.param("id") ?? "";
     const jm = this.jobManager;
     const activeJob = jm.activeJobs.get(id);
+    const wire = await c.req.raw.clone().json().catch(() => void 0);
+    if (wire?.type === "payment" && wire.content && typeof wire.content === "object" && "credit" in wire.content) {
+      const record2 = await jm.store.get(id);
+      if (!record2 || !isJobOwner(c, record2)) return c.json({ error: "Job not found" }, 404);
+      if (Object.keys(wire.content).some((key) => key !== "credit")) {
+        return c.json({ error: "invalid_message", message: "Credit authorization cannot be combined with a rail payment" }, 400);
+      }
+      if (!this.balancePaymentSupported(true) || !this.opts.db || !this.descriptor.auth || !(this.creditLedger instanceof CreditLedger)) {
+        return c.json({ error: "balance_payment_unavailable" }, 409);
+      }
+      try {
+        const result = await commitBalancePayment({
+          pool: this.opts.db,
+          ledger: this.creditLedger,
+          auth: this.descriptor.auth,
+          domain: this.signedRequestDomain(c, null),
+          jobId: id,
+          dvmId: this.opts.dvmId ?? "",
+          raw: wire.content.credit,
+          allowFresh: this.opts.env.DVMKIT_BALANCE_PAYMENTS !== "false"
+        });
+        try {
+          await this.opts.db.query("SELECT pg_notify('job_messages', $1)", [id]);
+          if (!activeJob) {
+            const fresh = await jm.store.get(id);
+            if (fresh?.status === "awaiting-input" && isStreamableJobStore(jm.store)) {
+              fresh.messages = await jm.store.getMessages(id, 0);
+              fresh.seq = Math.max(fresh.seq, ...fresh.messages.map((message) => message.seq));
+              const ask = fresh.messages.findLast((message) => message.from === "provider" && message.type === "payment-request");
+              const authorized = wire.content.credit;
+              if (ask?.seq === authorized.request_seq && !jm.activeJobs.has(id)) {
+                const { job: job2 } = jm.reactivateJob(fresh);
+                const lock = await jm.store.tryReactivationLock(id, () => this.runReactivation(jm, job2, { type: "payment", content: wire.content }, fresh.status));
+                if (!lock.acquired) this.teardownReactivationScaffold(jm, job2);
+              }
+            }
+          }
+        } catch {
+          diagnosticConsole.error({ level: "balance_payment_resume_unavailable", job_id: id });
+        }
+        return c.json(result.response, 201);
+      } catch (error) {
+        if (error instanceof SignedRequestError) return buildAuthErrorResponse(c, error, this.publicOrigin);
+        if (error instanceof BalancePaymentError) return c.json(error.body, error.status);
+        throw error;
+      }
+    }
     if (activeJob) {
       if (!isJobOwner(c, activeJob)) return c.json({ error: "Job not found" }, 404);
       if (isTerminal(activeJob.status)) {
@@ -23008,6 +23521,10 @@ var DVMServer = class {
     }
     const contentErr = validateMessageContent(body.type, body.content, this.opts.devMode === true);
     if (contentErr) return c.json({ error: "invalid_message", message: contentErr }, 400);
+    if (isStreamableJobStore(jm.store)) {
+      record.messages = await jm.store.getMessages(id, 0);
+      record.seq = Math.max(record.seq, ...record.messages.map((message) => message.seq));
+    }
     let job;
     try {
       ({ job } = jm.reactivateJob(record));
@@ -23108,6 +23625,10 @@ var DVMServer = class {
    */
   async runReactivation(jm, job, body, priorStatus) {
     if (priorStatus === "awaiting-input") {
+      if (jm.activeJobs.get(job.id) !== job) {
+        this.teardownReactivationScaffold(jm, job);
+        return;
+      }
       const claimed = await jm.claimAwaitingInputForReactivation(job.id);
       if (!claimed) {
         this.teardownReactivationScaffold(jm, job);
@@ -23137,9 +23658,11 @@ var DVMServer = class {
    * must not persist our stale snapshot; clearing the appender prevents that.
    */
   teardownReactivationScaffold(jm, job) {
-    jm.clearIdleTimer(job.id);
-    jm.unwatchDurableStatus(job.id);
-    jm.activeJobs.delete(job.id);
+    if (jm.activeJobs.get(job.id) === job) {
+      jm.clearIdleTimer(job.id);
+      jm.unwatchDurableStatus(job.id);
+      jm.activeJobs.delete(job.id);
+    }
     job.messageAppender = void 0;
   }
   async handleDeleteJob(c) {
@@ -23189,7 +23712,7 @@ function isJobOwner(c, job) {
   if (job.requesterTokenHash) {
     const token = c.req.header("X-Job-Token");
     if (!token) return false;
-    const provided = createHash10("sha256").update(token).digest("hex");
+    const provided = createHash11("sha256").update(token).digest("hex");
     return timingSafeEqualHex(provided, job.requesterTokenHash);
   }
   return c.get("requesterId") === job.requesterId;