@dvmkit/sdk 0.16.0 → 0.16.2

package/dist/{chunk-SGSHDMHP.js → chunk-KERFCBT7.js}

@@ -428,6 +428,14 @@ async function insertAccumulatorRows(db, args) {
     client.release();
   }
 }
+async function hasAccumulatedProof(db, dvmId, secrets) {
+  if (secrets.length === 0) return false;
+  const { rows: rows2 } = await db.query(
+    `SELECT 1 FROM wallet_accumulator WHERE dvm_id = $1 AND proof_secret_hash = ANY($2::text[]) LIMIT 1`,
+    [dvmId, secrets.map(hashProofSecret)]
+  );
+  return rows2.length > 0;
+}
 async function listPendingBatches(db, dvmId) {
   const { rows: rows2 } = await db.query(
     `SELECT id, lock_pubkey, mint_url, proof_keyset_id, proof_secret, proof_c, proof_amount, proof_dleq, received_at, melt_quote_id, t_expire
@@ -3341,7 +3349,11 @@ import {
   Amount as Amount2,
   CheckStateEnum,
   getP2PKExpectedWitnessPubkeys,
+  getSecretData,
+  getSecretKind,
   getTagInt,
+  getTags,
+  parseP2PKSecret,
   verifyDleqIfPresent
 } from "@cashu/cashu-ts";
 function valueCashuFunding(wallet, proofs) {
@@ -3358,6 +3370,91 @@ function valueCashuFunding(wallet, proofs) {
     netMsats: netSats.multiplyBy(1e3).toNumber()
   };
 }
+var CASHU_MIN_LOCKTIME_SECONDS = 604800;
+var CASHU_LOCKTIME_RESUME_MARGIN_SECONDS = 86400;
+var P2PK_TAG_KEYS = /* @__PURE__ */ new Set(["locktime", "refund", "pubkeys", "n_sigs", "sigflag", "n_sigs_refund"]);
+var SINGLE_VALUE_TAG_KEYS = /* @__PURE__ */ new Set(["locktime", "n_sigs", "sigflag", "n_sigs_refund"]);
+function assessCashuLock(secret, lockPubkeys, nowSec) {
+  try {
+    parseP2PKSecret(secret);
+    if (getSecretKind(secret) !== "P2PK") throw new Error("not P2PK");
+  } catch {
+    return { kind: "rejected", code: "not_p2pk_locked", message: "Proof secret is not a NUT-11 P2PK secret." };
+  }
+  const dvmKeyFor = (x) => x === void 0 ? void 0 : lockPubkeys.find((pk) => compressedX(pk) === x);
+  const data = getSecretData(secret).data;
+  const dataX = typeof data === "string" ? compressedX(data) : void 0;
+  const lockPubkey = dvmKeyFor(dataX);
+  if (!dataX || !lockPubkey) {
+    return {
+      kind: "rejected",
+      code: "wrong_lock_pubkey",
+      message: "Proof is not locked to one of this DVM's active lock pubkeys, spelled as a 33-byte compressed hex key."
+    };
+  }
+  const notExclusive = (message, locktimeBelowFloor) => ({
+    kind: "rejected",
+    code: "lock_not_exclusive",
+    message,
+    ...locktimeBelowFloor && { locktimeBelowFloor }
+  });
+  try {
+    getP2PKExpectedWitnessPubkeys(secret);
+  } catch (err) {
+    return notExclusive(`Proof carries an unreadable spending condition: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const tags = /* @__PURE__ */ new Map();
+  for (const tag of getTags(secret)) {
+    if (!Array.isArray(tag) || !tag.every((item) => typeof item === "string")) {
+      return notExclusive("Proof carries a malformed tag.");
+    }
+    const [key, ...values] = tag;
+    if (key === void 0 || !P2PK_TAG_KEYS.has(key)) return notExclusive(`Proof carries the unsupported tag ${JSON.stringify(key)}.`);
+    if (tags.has(key)) return notExclusive(`Proof repeats the ${key} tag.`);
+    if (values.length === 0) return notExclusive(`Proof carries a ${key} tag without a value.`);
+    if (SINGLE_VALUE_TAG_KEYS.has(key) && values.length !== 1) return notExclusive(`Proof's ${key} tag must carry exactly one value.`);
+    tags.set(key, values);
+  }
+  const sigflag = tags.get("sigflag")?.[0];
+  if (sigflag !== void 0 && sigflag !== "SIG_INPUTS") {
+    return notExclusive(`Proof requires sigflag ${sigflag}; this DVM accepts SIG_INPUTS only.`);
+  }
+  const nSigs = tags.get("n_sigs")?.[0];
+  if (nSigs !== void 0 && nSigs !== "1") {
+    return notExclusive(`Proof requires n_sigs=${nSigs}; this DVM accepts a single-signature lock only.`);
+  }
+  const mainX = [dataX];
+  for (const key of tags.get("pubkeys") ?? []) {
+    const x = compressedX(key);
+    if (!x || !dvmKeyFor(x)) return notExclusive("Proof's pubkeys tag names a key other than this DVM's lock pubkeys.");
+    if (mainX.includes(x)) return notExclusive("Proof repeats a key across data and pubkeys.");
+    mainX.push(x);
+  }
+  const refundX = [];
+  for (const key of tags.get("refund") ?? []) {
+    const x = compressedX(key);
+    if (!x) return notExclusive("Proof's refund tag names a key that is not a 33-byte compressed hex key.");
+    if (refundX.includes(x)) return notExclusive("Proof repeats a key in its refund tag.");
+    refundX.push(x);
+  }
+  const nSigsRefund = tags.get("n_sigs_refund")?.[0];
+  if (nSigsRefund !== void 0 && !(/^[1-9][0-9]*$/.test(nSigsRefund) && Number(nSigsRefund) <= refundX.length)) {
+    return notExclusive(`Proof's n_sigs_refund ${nSigsRefund} is not a count between 1 and its number of refund keys.`);
+  }
+  const locktimeValue = tags.get("locktime")?.[0];
+  if (locktimeValue !== void 0) {
+    const locktime = /^(0|[1-9][0-9]*)$/.test(locktimeValue) ? Number(locktimeValue) : NaN;
+    if (!Number.isSafeInteger(locktime)) return notExclusive(`Proof's locktime ${locktimeValue} is not a unix-seconds integer.`);
+    const floor = nowSec + CASHU_MIN_LOCKTIME_SECONDS - CASHU_LOCKTIME_RESUME_MARGIN_SECONDS;
+    if (locktime < floor) {
+      return notExclusive(
+        `Proof locktime ${locktime} is earlier than the accepted floor ${floor} (unix seconds).`,
+        true
+      );
+    }
+  }
+  return { kind: "exclusive", lockPubkey };
+}
 async function acceptAccumulatorPayment(opts) {
   if (opts.disposable && !opts.mints.every(isTestMintUrl)) {
     throw new Error("Disposable Cashu accepts only known test or loopback mints.");
@@ -3409,41 +3506,26 @@ async function acceptAccumulatorPayment(opts) {
     mintUrl,
     paidMsats: valuation.netMsats
   };
+  const nowSec = Math.floor(Date.now() / 1e3);
   const tExpireMsByIndex = [];
   const matchedLockPubkeyByIndex = [];
+  let belowFloorMessage;
   for (const p of proofs) {
-    let allowed;
-    try {
-      allowed = getP2PKExpectedWitnessPubkeys(p.secret);
-    } catch {
-      return {
-        kind: "rejected",
-        code: "not_p2pk_locked",
-        message: "Proof secret is not a NUT-11 P2PK secret."
-      };
-    }
-    if (allowed.length === 0) {
-      return {
-        kind: "rejected",
-        code: "not_p2pk_locked",
-        message: "Proof is unlocked or the P2PK lock has expired."
-      };
-    }
-    const allowedNormalised = allowed.map(toLockPubkey);
-    if (opts.disposable && (allowedNormalised.length !== 1 || (getTagInt(p.secret, "n_sigs") ?? 1) !== 1)) {
-      return { kind: "rejected", code: "not_p2pk_locked", message: "Disposable Cashu requires an exclusive single-signature P2PK lock." };
+    const lock = assessCashuLock(p.secret, accepted, nowSec);
+    if (lock.kind === "rejected") {
+      if (!lock.locktimeBelowFloor) return { kind: "rejected", code: lock.code, message: lock.message };
+      belowFloorMessage ??= lock.message;
+      continue;
     }
-    const match = accepted.find((pk) => allowedNormalised.includes(pk));
-    if (!match) {
-      return {
-        kind: "rejected",
-        code: "wrong_lock_pubkey",
-        message: "Proof is not locked to one of this DVM's active lock pubkeys."
-      };
-    }
-    matchedLockPubkeyByIndex.push(match);
+    matchedLockPubkeyByIndex.push(lock.lockPubkey);
     tExpireMsByIndex.push(parseNut11LocktimeMs(p.secret));
   }
+  if (belowFloorMessage) {
+    const secrets = proofs.map((p) => p.secret);
+    const banked = opts.disposable ? await opts.disposable.hasAccepted(secrets) : opts.db ? await hasAccumulatedProof(opts.db, opts.dvmId, secrets) : false;
+    if (banked) return replayRejected();
+    return { kind: "rejected", code: "lock_not_exclusive", message: belowFloorMessage };
+  }
   try {
     const walletProvider = opts.walletProvider ?? getWallet;
     const wallet = await walletProvider(mintUrl);
@@ -3516,13 +3598,7 @@ async function acceptAccumulatorPayment(opts) {
       await insertAccumulatorRows(opts.db, insertArgs);
     }
   } catch (err) {
-    if (err instanceof AccumulatorReplayError) {
-      return {
-        kind: "rejected",
-        code: "replay_rejected",
-        message: "Proofs or request id already accepted at this DVM."
-      };
-    }
+    if (err instanceof AccumulatorReplayError) return replayRejected();
     throw err;
   }
   return {
@@ -3534,6 +3610,13 @@ async function acceptAccumulatorPayment(opts) {
     mintUrl
   };
 }
+function replayRejected() {
+  return {
+    kind: "rejected",
+    code: "replay_rejected",
+    message: "Proofs or request id already accepted at this DVM."
+  };
+}
 function parseNut11LocktimeMs(secret) {
   try {
     const secs = getTagInt(secret, "locktime");
@@ -3542,6 +3625,9 @@ function parseNut11LocktimeMs(secret) {
     return null;
   }
 }
+function compressedX(raw) {
+  return /^0[23][0-9a-fA-F]{64}$/.test(raw) ? raw.slice(2).toLowerCase() : void 0;
+}
 
 // src/sdk/server/payment.ts
 var UPFRONT_CHALLENGE_TTL_MS = 5 * 60 * 1e3;
@@ -4771,6 +4857,11 @@ var PAYMENT_ERROR_COPY = {
     hint: "Re-fetch this service's current lock key from /v1/info and lock a fresh token to it.",
     retryable: false
   },
+  lock_not_exclusive: {
+    display: "The payment token's lock would let a key other than this service's spend it, so it wasn't accepted. Nothing was charged.",
+    hint: "Lock a fresh token with data set to cashu.lock_pubkeys[0] from /v1/info as a 33-byte compressed hex key. Use only the locktime, refund, pubkeys, n_sigs, sigflag and n_sigs_refund tags, each once and with a value: pubkeys may list only other cashu.lock_pubkeys entries, n_sigs must be 1, sigflag SIG_INPUTS, refund keys compressed and distinct, n_sigs_refund at most the number of refund keys, and any locktime at least cashu.min_locktime minus 24 hours in the future.",
+    retryable: false
+  },
   proof_not_unspent: {
     display: "The payment token has already been spent. Nothing was charged.",
     hint: "Those funds are gone; pay with a fresh token.",
@@ -22455,7 +22546,7 @@ var DVMServer = class {
         mints,
         lock_pubkeys: activePubkeySet(active),
         lock_pubkey_grace_seconds: this.graceSeconds(),
-        min_locktime: 604800,
+        min_locktime: CASHU_MIN_LOCKTIME_SECONDS,
         canonical_id: this.opts.canonicalDvmId ?? this.opts.dvmId ?? null
       };
     }

package/dist/{credit-menu-B239nIY5.d.ts → credit-menu-BfXaeHgR.d.ts}

@@ -339,6 +339,8 @@ interface PaidJobCompletion {
 /** Typed transaction boundary; proof ownership and accounting commit together. */
 interface DisposableCashuCommit {
     commit(requestId: string, proofs: Proof[], account: (ledger: CreditLedgerLike) => Promise<void>): Promise<void>;
+    /** Whether any of these proof secrets has already been committed. */
+    hasAccepted(secrets: string[]): Promise<boolean>;
 }
 
 interface CreditExpirySweepOpts {
@@ -1159,7 +1161,7 @@ declare class MemoryProcessedPaymentStore implements ProcessedPaymentStore {
  * so the payment-error builder in `payment.ts` folds them into `PaymentErrorCode`
  * and keeps display/hint/retryable copy in lockstep with this union.
  */
-type AccumulatorRejectionCode = "missing_request_id" | "missing_lock_pubkey" | "not_p2pk_locked" | "wrong_lock_pubkey" | "proof_not_unspent" | "proof_pending" | "replay_rejected" | "mint_unreachable" | "invalid_token";
+type AccumulatorRejectionCode = "missing_request_id" | "missing_lock_pubkey" | "not_p2pk_locked" | "wrong_lock_pubkey" | "lock_not_exclusive" | "proof_not_unspent" | "proof_pending" | "replay_rejected" | "mint_unreachable" | "invalid_token";
 
 type X402ExactSettlementStatus = "prepared" | "submitting" | "settled" | "local_committed" | "ambiguous" | "rejected" | "complete";
 /** Serializable local economic effect that follows an exact settlement. */

package/dist/internal/server.d.ts

@@ -6,8 +6,8 @@ import { Env, BlankSchema } from 'hono/types';
 import { Pool } from 'pg';
 export { Pool } from 'pg';
 import { g as getWallet } from '../wallet-Dwjs5n_M.js';
-import { C as ConsumedCredentialStore, L as LockPubkeyStateLoader } from '../credit-menu-B239nIY5.js';
-export { A as AccumulatorPool, a as AppEnv, b as CreditFundingReport, D as DEFAULT_LOCK_PUBKEY_GRACE_SECONDS, F as FiatDenomination, c as FiatDenominationFailure, d as FundOnlyRequest, I as IncomingPaymentOpts, J as JobCancelledError, e as LockPubkeyPool, f as LockPubkeyState, M as MintHealthTracker, P as PAYMENT_PROOF_KEYS, g as PaymentErrorCode, h as PaymentErrorDetail, i as PaymentInfo, j as PostgresTempoChargeStore, R as ReporterBannerOpts, k as ResolvedFx, l as RevenueBootCheckOpts, S as SDKServerOpts, m as ServerJob, n as ShortPayForfeit, T as TempoChannelReport, o as TempoObserverHealth, p as TempoSessionChannelMismatchError, U as UpfrontPaymentOpts, V as VerifiedIncomingPayment, q as VerifyIncomingSnapshot, X as X402BatchChannelObservation, r as X402FacilitatorHealth, s as X402SettlementEvidenceOutcome, t as X402SettlementRepair, u as X402SettlementRepairRefusal, v as X402SettlementRepaired, w as X402WedgedSettlement, x as X402WedgedSettlementPage, y as X402_BATCH_SETTLEMENT_MAINNET_NETWORK, z as abortJob, B as activePubkeySet, E as applyPaymentInfoToJob, G as assertRevenueReporterReady, H as buildPaymentErrorResponse, K as clearAccumulatorForDvm, N as createDVMServer, O as creditDepositPayload, Q as derivedFundCreditId, W as devModeSkipsPaymentVerification, Y as fromJobRecord, Z as fundedMicroFor, _ as hasPaymentProof, $ as hashLockKey, a0 as implicitCreditId, a1 as initLockPubkeyTable, a2 as initWalletAccumulatorTable, a3 as insertAccumulatorRows, a4 as isDerivedCreditId, a5 as isTerminal, a6 as isYieldMessage, a7 as issueUpfrontChallenges, a8 as loadLockPubkeyState, a9 as msatsToFiatMicro, aa as paymentErrorBody, ab as pinAskFiat, ac as priceFiatMicro, ad as processIncomingPayment, ae as providerMessage, af as pruneRetired, ag as repairX402ExactSettlementEffect, ah as resolveFxSnapshot, ai as resolvePriceFiat, aj as revenueReporterBannerState, ak as rotateLockPubkey, al as seedLockPubkeyState, am as toCreditTerms, an as toJobRecord, ao as unknownRouteNotFound, ap as verifyIncomingPayment, aq as verifyTempoSessionManagementCredential, ar as verifyUpfrontPayment, as as x402RequiredUsdcMicro, at as x402SettledShare } from '../credit-menu-B239nIY5.js';
+import { C as ConsumedCredentialStore, L as LockPubkeyStateLoader } from '../credit-menu-BfXaeHgR.js';
+export { A as AccumulatorPool, a as AppEnv, b as CreditFundingReport, D as DEFAULT_LOCK_PUBKEY_GRACE_SECONDS, F as FiatDenomination, c as FiatDenominationFailure, d as FundOnlyRequest, I as IncomingPaymentOpts, J as JobCancelledError, e as LockPubkeyPool, f as LockPubkeyState, M as MintHealthTracker, P as PAYMENT_PROOF_KEYS, g as PaymentErrorCode, h as PaymentErrorDetail, i as PaymentInfo, j as PostgresTempoChargeStore, R as ReporterBannerOpts, k as ResolvedFx, l as RevenueBootCheckOpts, S as SDKServerOpts, m as ServerJob, n as ShortPayForfeit, T as TempoChannelReport, o as TempoObserverHealth, p as TempoSessionChannelMismatchError, U as UpfrontPaymentOpts, V as VerifiedIncomingPayment, q as VerifyIncomingSnapshot, X as X402BatchChannelObservation, r as X402FacilitatorHealth, s as X402SettlementEvidenceOutcome, t as X402SettlementRepair, u as X402SettlementRepairRefusal, v as X402SettlementRepaired, w as X402WedgedSettlement, x as X402WedgedSettlementPage, y as X402_BATCH_SETTLEMENT_MAINNET_NETWORK, z as abortJob, B as activePubkeySet, E as applyPaymentInfoToJob, G as assertRevenueReporterReady, H as buildPaymentErrorResponse, K as clearAccumulatorForDvm, N as createDVMServer, O as creditDepositPayload, Q as derivedFundCreditId, W as devModeSkipsPaymentVerification, Y as fromJobRecord, Z as fundedMicroFor, _ as hasPaymentProof, $ as hashLockKey, a0 as implicitCreditId, a1 as initLockPubkeyTable, a2 as initWalletAccumulatorTable, a3 as insertAccumulatorRows, a4 as isDerivedCreditId, a5 as isTerminal, a6 as isYieldMessage, a7 as issueUpfrontChallenges, a8 as loadLockPubkeyState, a9 as msatsToFiatMicro, aa as paymentErrorBody, ab as pinAskFiat, ac as priceFiatMicro, ad as processIncomingPayment, ae as providerMessage, af as pruneRetired, ag as repairX402ExactSettlementEffect, ah as resolveFxSnapshot, ai as resolvePriceFiat, aj as revenueReporterBannerState, ak as rotateLockPubkey, al as seedLockPubkeyState, am as toCreditTerms, an as toJobRecord, ao as unknownRouteNotFound, ap as verifyIncomingPayment, aq as verifyTempoSessionManagementCredential, ar as verifyUpfrontPayment, as as x402RequiredUsdcMicro, at as x402SettledShare } from '../credit-menu-BfXaeHgR.js';
 export { O as OutgoingMessage, S as StaleJobReapable, i as isStaleJobReapable } from '../job-store-CA7u1nHV.js';
 import { z } from 'zod';
 export { f as LockPubkeyStoreLockPubkey, t as lockPubkeyStoreToLockPubkey } from '../lightning-backend-BOcopzXk.js';

package/dist/internal/server.js

@@ -61,7 +61,7 @@ import {
   verifyUpfrontPayment,
   x402RequiredUsdcMicro,
   x402SettledShare
-} from "../chunk-SGSHDMHP.js";
+} from "../chunk-KERFCBT7.js";
 import "../chunk-XRLKGCAW.js";
 import {
   PayoutReporter

package/dist/server/index.d.ts

@@ -1,8 +1,8 @@
 import { ag as CashuMode, bR as CreditLedgerQuerier, bS as CreditDrainEnqueue, bT as HostedSettlementReportObligations, R as ResolvedCreditConfig, bU as DVMAuthScheme, B as SignedRequestDomain, bV as CreditLedgerLike, bW as X402RefundSettlementGate, bX as CreditSnapshot, bY as CreditDrawRefundArgs, bZ as CreditDrawRefundResult, b_ as DrawResult, b$ as X402SettlementStatus, c0 as X402UnresolvedRefund, c1 as GrownDrawResult, c2 as DrawResolution, c3 as FundingRecord, c4 as CreditFundingEvidence, c5 as CreditInvoiceRecord, c6 as InvoiceSettlement, c7 as BlockedInvoiceCursor, c8 as InvoiceReconciliation, c9 as InvoiceWriteOff, ca as DrawRecord, cb as StalePendingDrawCursor, cc as TempoCreditLossEvidence, cd as TempoCreditLoss, ce as X402CreditLossEvidence, cf as X402CreditLoss, cg as DrainMethod, ch as DrainRequestResult, ci as BitcoinDepositLiability, bv as FundingLot, cj as CreditDrainRecord, ck as ChannelDrainCursor, cl as DrainWriteOff, cm as DrainTransitionResult, cn as DrainReleaseResult, co as DrainFulfilment, cp as HostingCleanupFence, aA as StepRecord, a2 as JobReceipt, a7 as Message, K as KVStore, G as SignedRequestReplayStore, Z as ZodLike, a as DVMDescriptor } from '../step-cache-BCRHimiY.js';
 export { cq as CLIENT_COMPATIBILITY_HEADERS, d as CanonicalEnvelope, cr as ClientCompatibility, cs as ClientCompatibilityEnv, ct as ClientCompatibilityGate, cu as ClientCompatibilityRequirement, cv as ClientSemVer, f as CreateSignedRequestVerifierOpts, cw as CreditFundingBasis, cx as CreditInvoiceStatus, cy as CreditLedger, cz as CreditLedgerError, cA as CreditLedgerErrorCode, cB as CreditLedgerErrorDetails, cC as CreditLedgerPool, cD as CreditStatus, cE as DRAIN_DELIVERY_RESERVE_SATS, cF as DVM_PROTOCOL_VERSION, cG as DrainConflictReason, cH as DrawRailValue, cI as DrawStatus, cJ as HostedTempoCloseReportWriteOff, cK as JobCostReportPayload, cL as JobTerminalReportPayload, cM as PostgresX402ChannelStorage, cN as ReplayStoreBackend, cO as RevenueSkippedNoRailPayload, cP as RevenueSkippedNoRailReason, x as SIGNED_REQUEST_AUTH_ID, y as SIGNED_REQUEST_STATEMENT_VERSION, cQ as Secp256k1AuthOpts, z as SignedRequestAudience, E as SignedRequestError, F as SignedRequestFailure, H as SignedRequestSignOpts, M as SignedRequestStatementHeader, N as SignedRequestVerifier, cR as TempoDrainDecision, cS as TempoDrainDecisionArgs, cT as TempoDrainDecisionResult, cU as TempoDrainHoldReason, O as UpfrontPayment, cV as X402ChannelStorageOpts, cW as X402RelayLockHolder, cX as X402RelaySubmissionLock, cY as X402RelaySubmissionLockError, cZ as allocateDrawValue, c_ as clientCompatibilityAttributes, c$ as clientCompatibilityMiddleware, d0 as clientUpgradeRequired, T as createSignedRequestVerifier, d1 as parseClientCapabilities, d2 as parseClientCompatibility, d3 as parseDvmClient, d4 as parseProtocolVersion, d5 as requireClientCompatibility, d6 as retryHostedTempoCloseReport, d7 as secp256k1Auth, d8 as signedRequestInput, W as signedRequestStatementHeader, d9 as writeOffHostedTempoCloseReport } from '../step-cache-BCRHimiY.js';
 import { Pool } from 'pg';
-import { au as CreditMenu, a as AppEnv, U as UpfrontPaymentOpts, i as PaymentInfo, av as ReceiptIssuer, aw as LightningReceive, ax as TempoSettlementReadiness, ay as DVMHostOpts, az as DVMServeResult, L as LockPubkeyStateLoader, C as ConsumedCredentialStore } from '../credit-menu-B239nIY5.js';
-export { aA as BuildCreditMenuArgs, aB as BuilderIdentity, aC as CREDIT_ENVELOPE_KEYS, aD as CreateX402BatchSettlementServerOpts, aE as CreditEnvelope, aF as CreditEnvelopeError, aG as CreditFundCommitment, aH as CreditTerms, aI as DEFAULT_INVOICE_TTL_SECONDS, aJ as DVMHost, aK as HostingClosureCommand, aL as HostingClosureEvidence, aM as HostingControlCommand, aN as HostingControlConfig, aO as HostingControlStatus, aP as JobManager, aQ as JobManagerOpts, aR as LightningReceiveConfig, aS as MIN_INVOICE_TTL_SECONDS, aT as MemoryConsumedCredentialStore, aU as MemoryConsumedCredentialStoreOpts, aV as MemoryProcessedPaymentStore, aW as MemoryX402ExactSettlementStore, aX as MountOpts, aY as OwnerDisplay, aZ as PaidJobCompletion, a_ as PaymentMode, a$ as PlatformReporterOpts, b0 as PostgresProcessedPaymentStore, b1 as PostgresX402ExactSettlementStore, b2 as PriceFiat, b3 as ProcessedPaymentQuerier, b4 as ProcessedPaymentRail, b5 as ProcessedPaymentRecord, b6 as ProcessedPaymentReplayError, b7 as ProcessedPaymentStore, b8 as X402BatchAcceptance, b9 as X402BatchFunding, ba as X402BatchRefusal, bb as X402BatchSettlementServer, bc as X402ExactAcceptance, bd as X402ExactIntentConflictError, be as X402ExactSettlementAttempt, bf as X402ExactSettlementChainEvidence, bg as X402ExactSettlementEffect, bh as X402ExactSettlementEvidenceMissingError, bi as X402ExactSettlementEvidenceReader, bj as X402ExactSettlementIntent, bk as X402ExactSettlementNotReadyError, bl as X402ExactSettlementServer, bm as X402ExactSettlementServerOpts, bn as X402ExactSettlementStatus, bo as X402ExactSettlementStore, bp as X402SettlementChainEvidence, bq as X402SettlementEvidenceReader, br as X402SettlementSubmissionError, bs as X402_BATCH_AUTO_SETTLEMENT, bt as X402_BATCH_MIN_WITHDRAW_DELAY_SECONDS, bu as X402_BATCH_SETTLEMENT_NETWORK, bv as attachCreditMenu, bw as buildCreditMenu, bx as createDVMHost, by as createX402BatchSettlementServer, bz as creditEnvelopeIgnoreFields, bA as drawSettlementRef, bB as extractCreditEnvelope, bC as fundingCommitment, bD as selectPrimaryCredit, bE as signHostingClosure, bF as signHostingControl, bG as stripCreditEnvelope, bH as toCreditView } from '../credit-menu-B239nIY5.js';
+import { au as CreditMenu, a as AppEnv, U as UpfrontPaymentOpts, i as PaymentInfo, av as ReceiptIssuer, aw as LightningReceive, ax as TempoSettlementReadiness, ay as DVMHostOpts, az as DVMServeResult, L as LockPubkeyStateLoader, C as ConsumedCredentialStore } from '../credit-menu-BfXaeHgR.js';
+export { aA as BuildCreditMenuArgs, aB as BuilderIdentity, aC as CREDIT_ENVELOPE_KEYS, aD as CreateX402BatchSettlementServerOpts, aE as CreditEnvelope, aF as CreditEnvelopeError, aG as CreditFundCommitment, aH as CreditTerms, aI as DEFAULT_INVOICE_TTL_SECONDS, aJ as DVMHost, aK as HostingClosureCommand, aL as HostingClosureEvidence, aM as HostingControlCommand, aN as HostingControlConfig, aO as HostingControlStatus, aP as JobManager, aQ as JobManagerOpts, aR as LightningReceiveConfig, aS as MIN_INVOICE_TTL_SECONDS, aT as MemoryConsumedCredentialStore, aU as MemoryConsumedCredentialStoreOpts, aV as MemoryProcessedPaymentStore, aW as MemoryX402ExactSettlementStore, aX as MountOpts, aY as OwnerDisplay, aZ as PaidJobCompletion, a_ as PaymentMode, a$ as PlatformReporterOpts, b0 as PostgresProcessedPaymentStore, b1 as PostgresX402ExactSettlementStore, b2 as PriceFiat, b3 as ProcessedPaymentQuerier, b4 as ProcessedPaymentRail, b5 as ProcessedPaymentRecord, b6 as ProcessedPaymentReplayError, b7 as ProcessedPaymentStore, b8 as X402BatchAcceptance, b9 as X402BatchFunding, ba as X402BatchRefusal, bb as X402BatchSettlementServer, bc as X402ExactAcceptance, bd as X402ExactIntentConflictError, be as X402ExactSettlementAttempt, bf as X402ExactSettlementChainEvidence, bg as X402ExactSettlementEffect, bh as X402ExactSettlementEvidenceMissingError, bi as X402ExactSettlementEvidenceReader, bj as X402ExactSettlementIntent, bk as X402ExactSettlementNotReadyError, bl as X402ExactSettlementServer, bm as X402ExactSettlementServerOpts, bn as X402ExactSettlementStatus, bo as X402ExactSettlementStore, bp as X402SettlementChainEvidence, bq as X402SettlementEvidenceReader, br as X402SettlementSubmissionError, bs as X402_BATCH_AUTO_SETTLEMENT, bt as X402_BATCH_MIN_WITHDRAW_DELAY_SECONDS, bu as X402_BATCH_SETTLEMENT_NETWORK, bv as attachCreditMenu, bw as buildCreditMenu, bx as createDVMHost, by as createX402BatchSettlementServer, bz as creditEnvelopeIgnoreFields, bA as drawSettlementRef, bB as extractCreditEnvelope, bC as fundingCommitment, bD as selectPrimaryCredit, bE as signHostingClosure, bF as signHostingControl, bG as stripCreditEnvelope, bH as toCreditView } from '../credit-menu-BfXaeHgR.js';
 import { Context, Hono } from 'hono';
 import { z } from 'zod';
 import { F as FxFetcher } from '../fx-BmvWGISH.js';

package/dist/server/index.js

@@ -82,7 +82,7 @@ import {
   toCreditView,
   unknownRouteNotFound,
   writeOffHostedTempoCloseReport
-} from "../chunk-SGSHDMHP.js";
+} from "../chunk-KERFCBT7.js";
 import {
   MemoryProcessedPaymentStore,
   PostgresProcessedPaymentStore,
@@ -342,6 +342,9 @@ function createDisposableCashuStore() {
           requests.add(requestId);
           for (const secret of incoming) secrets.add(secret);
         });
+      },
+      hasAccepted(incoming) {
+        return exclusive(() => Promise.resolve(incoming.some((secret) => secrets.has(secret))));
       }
     }
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dvmkit/sdk",
-  "version": "0.16.0",
+  "version": "0.16.2",
   "description": "SDK for building Digital Vending Machines: pay-per-use HTTPS services AI agents can find, pay, and call with no account or API key",
   "author": "DVM Technologies Ltd",
   "keywords": [
@@ -89,14 +89,14 @@
     "@scure/bip39": "2.0.1",
     "@x402/core": "2.21.0",
     "@x402/evm": "2.21.0",
-    "hono": "4.13.5",
+    "hono": "4.13.14",
     "jose": "6.2.1",
     "mppx": "0.8.15",
     "nostr-tools": "2.23.3",
     "proper-lockfile": "4.1.2",
-    "undici": "7.29.1",
+    "undici": "7.30.1",
     "ws": "8.21.0",
-    "zod": "4.4.3"
+    "zod": "4.6.7"
   },
   "optionalDependencies": {
     "pg": "8.20.0",