@dvmkit/sdk 0.14.0 → 0.14.1

package/dist/{chunk-TVI4V7GF.js → chunk-LBMHV2DK.js}

@@ -6,7 +6,8 @@ function envFlag(value) {
 // src/sdk/server/ssrf.ts
 import { lookup } from "dns/promises";
 import { isIPv4, isIPv6 } from "net";
-import { Agent } from "undici";
+import { Readable } from "stream";
+import { Agent, getGlobalDispatcher } from "undici";
 var SSRFError = class extends Error {
   code = "ssrf_blocked";
   reason;
@@ -44,25 +45,27 @@ async function createPinnedFetch(url, opts) {
   const pinnedFetch = async (input, init) => {
     let request = new Request(input, init);
     let redirects = 0;
-    for (; ; ) {
-      const target = await targetFor(request.url);
-      const response = await baseFetch(
-        request,
-        target.agent ? { redirect: "manual", dispatcher: target.agent } : { redirect: "manual" }
-      );
-      if (!isRedirect(response.status) || request.redirect === "manual") return response;
-      const location = response.headers.get("location");
-      if (location === null) return response;
-      await discardResponse(response);
-      if (request.redirect === "error") {
-        throw new TypeError("fetch failed: redirect mode is set to error");
-      }
-      if (redirects >= MAX_PINNED_REDIRECTS) {
-        throw new TypeError("fetch failed: maximum redirect count exceeded");
+    try {
+      for (; ; ) {
+        const target = await targetFor(request.url);
+        const response = await fetchPinnedHop(request, target, baseFetch);
+        if (!isRedirect(response.status) || request.redirect === "manual") return response;
+        const location = response.headers.get("location");
+        if (location === null) return response;
+        await discardResponse(response);
+        if (request.redirect === "error") {
+          throw new TypeError("fetch failed: redirect mode is set to error");
+        }
+        if (redirects >= MAX_PINNED_REDIRECTS) {
+          throw new TypeError("fetch failed: maximum redirect count exceeded");
+        }
+        request = requestForRedirect(request, new URL(location, request.url), response.status);
+        redirects += 1;
+        opts?.onRedirectFollowed?.();
       }
-      request = requestForRedirect(request, new URL(location, request.url), response.status);
-      redirects += 1;
-      opts?.onRedirectFollowed?.();
+    } catch (error) {
+      await request.body?.cancel(error).catch(() => void 0);
+      throw error;
     }
   };
   return {
@@ -74,6 +77,64 @@ async function createPinnedFetch(url, opts) {
     }
   };
 }
+async function fetchPinnedHop(request, target, baseFetch) {
+  if (!request.body) {
+    return baseFetch(request, target.agent ? { redirect: "manual", dispatcher: target.agent } : { redirect: "manual" });
+  }
+  const body = request.body;
+  let reader;
+  let stopped = false;
+  let dispatched = false;
+  const upload = Readable.from((async function* () {
+    if (stopped) return;
+    reader = body.getReader();
+    try {
+      while (!stopped) {
+        const next = await reader.read();
+        if (next.done || stopped) return;
+        yield next.value;
+      }
+    } finally {
+      reader.releaseLock();
+      reader = void 0;
+    }
+  })(), { objectMode: false, highWaterMark: 64 * 1024 });
+  const stop = async (reason) => {
+    if (stopped) return;
+    stopped = true;
+    await (reader ? reader.cancel(reason) : body.cancel(reason)).catch(() => void 0);
+  };
+  const onAbort = () => {
+    void stop(request.signal.reason);
+  };
+  request.signal.addEventListener("abort", onAbort, { once: true });
+  const dispatcher = {
+    dispatch(options, handler) {
+      if (dispatched) throw new TypeError("fetch failed: cannot safely replay a request body");
+      dispatched = true;
+      return (target.agent ?? getGlobalDispatcher()).dispatch({
+        ...options,
+        body: upload
+      }, handler);
+    }
+  };
+  try {
+    return await baseFetch(request, {
+      redirect: "manual",
+      // A stream also prevents native automatic body replay (e.g. on HTTP 421).
+      body: new ReadableStream({ start(controller) {
+        controller.close();
+      } }),
+      duplex: "half",
+      // Node's keepalive is a no-op, but rejects streaming request envelopes.
+      keepalive: false,
+      dispatcher
+    });
+  } finally {
+    request.signal.removeEventListener("abort", onAbort);
+    await stop();
+  }
+}
 var MAX_PINNED_REDIRECTS = 20;
 function isRedirect(status) {
   return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;

package/dist/index.js

@@ -3,7 +3,7 @@ import {
   assertSafeUrl,
   createPinnedFetch,
   envFlag
-} from "./chunk-TVI4V7GF.js";
+} from "./chunk-LBMHV2DK.js";
 import {
   CAPABILITY_NAME_RE
 } from "./chunk-A262WVYX.js";

package/dist/internal/caller.d.ts

@@ -1461,8 +1461,14 @@ interface JobStatus {
 }
 /**
  * What a provider's `201` to a job message carries, when the transport
- * surfaces it. `seq` names the durable inbound message; `drawFundingReceipt`
- * is the signed fact a mid-job rail payment funded the job's own draw.
+ * surfaces it. The successful standard message response's `seq` is the latest
+ * message position observed after dispatch, so it can equal or exceed the
+ * accepted payment's sequence. `drawFundingReceipt` is the signed fact a mid-job
+ * rail payment funded the job's own draw: its optional `payment_seq` fixes the
+ * accepted inbound payment sequence, while `ledger_seq` names the credit draw's
+ * ledger position. Cursor equality is not a funding-validity requirement;
+ * signature verification and all funding bindings still apply. Separately,
+ * `503 job_snapshot_unavailable.seq` identifies the recorded inbound payment.
  */
 interface SendMessageResult {
     seq: number;

package/dist/server/index.js

@@ -9,7 +9,7 @@ import {
   assertSafeUrl,
   createPinnedFetch,
   envFlag
-} from "../chunk-TVI4V7GF.js";
+} from "../chunk-LBMHV2DK.js";
 import {
   HttpTransport,
   NwcBackend,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dvmkit/sdk",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "description": "SDK for building Digital Vending Machines: pay-per-use HTTPS services AI agents can find, pay, and call with no account or API key",
   "author": "DVM Technologies Ltd",
   "keywords": [