@dvmkit/sdk 0.16.2 → 0.17.0

package/dist/{chunk-KERFCBT7.js → chunk-4QYADZFN.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-XRLKGCAW.js";
 import {
   x402EarnedCeiling
-} from "./chunk-ICHC4VDZ.js";
+} from "./chunk-KRX7VNBG.js";
 import {
   createX402FacilitatorAuthHeaders,
   createX402FacilitatorClient,
@@ -14,13 +14,13 @@ import {
   verifyWithFacilitator,
   withPaymentDiagnostics,
   withPaymentStage
-} from "./chunk-F2LNWZCV.js";
+} from "./chunk-3KRFFLAT.js";
 import {
   MemoryCreditLedger
-} from "./chunk-PP5WHB6T.js";
+} from "./chunk-C5XNZLZ7.js";
 import {
   PostgresJobStore
-} from "./chunk-N4SBDUVD.js";
+} from "./chunk-A6EY4K46.js";
 import {
   SIGNED_ENVELOPE_FIELDS,
   SignedRequestError,
@@ -28,7 +28,7 @@ import {
   humanizeZodIssues,
   signedRequestInput,
   zodIssuesOf
-} from "./chunk-V73WRF46.js";
+} from "./chunk-5CCQEAQV.js";
 import {
   MemoryJobStore,
   UNCAPPABLE_ASK_TOTAL,
@@ -37,7 +37,7 @@ import {
   isJobRetentionStore,
   isReceiptIssuingStore,
   isStreamableJobStore
-} from "./chunk-V4CBI5HB.js";
+} from "./chunk-Y6JJDOGO.js";
 import {
   ContentHoldError,
   JobCancelledError,
@@ -78,7 +78,7 @@ import {
   receiptPubkeyFromSecret,
   toLockPubkey,
   verifyChallenge
-} from "./chunk-XBQTFOIT.js";
+} from "./chunk-7RWE6ELV.js";
 import {
   X402_BATCH_SETTLEMENT_SCHEME,
   X402_DEFAULT_FACILITATOR,
@@ -105,7 +105,7 @@ import {
 } from "./chunk-SXL44PL5.js";
 import {
   createConsoleLogger
-} from "./chunk-VQHBJXBL.js";
+} from "./chunk-QTKGFG3I.js";
 import {
   StepCache
 } from "./chunk-BQJIFRAZ.js";
@@ -122,7 +122,7 @@ import {
   roundUsd,
   satsToFiat,
   validateCurrency
-} from "./chunk-7QGS27UT.js";
+} from "./chunk-72A4PHLD.js";
 import {
   CreditLedger,
   CreditLedgerError,
@@ -138,7 +138,7 @@ import {
   isNonChannelBitcoinRail,
   netOwedSats,
   x402SettlementPending
-} from "./chunk-K4ZQE7IB.js";
+} from "./chunk-B5MPLDRC.js";
 import {
   parseStoreValue
 } from "./chunk-YG7G4DPZ.js";
@@ -156,7 +156,7 @@ import {
 } from "./chunk-5UC7TOQC.js";
 import {
   withPostgresRecoveryContext
-} from "./chunk-ELNWQS24.js";
+} from "./chunk-EIDRCGTY.js";
 import {
   DvmError,
   x402NetworkByCaip2
@@ -174,17 +174,17 @@ import {
   installHostedTempoCloseGuard,
   isTempoInsufficientFundsError,
   resolveTempoNetwork
-} from "./chunk-7N5VDCG3.js";
+} from "./chunk-MWDUGMN2.js";
 import {
   loggers,
   pinDimension,
   withSpan,
   withTraceContext
-} from "./chunk-TN6MWTZI.js";
+} from "./chunk-LY2JYSJS.js";
 import {
   createDiagnosticCapabilityAuthority,
   diagnosticConsole
-} from "./chunk-5U2RG3ZW.js";
+} from "./chunk-ALTE7I6C.js";
 
 // src/sdk/server/lock-pubkey-store.ts
 async function initLockPubkeyTable(db) {
@@ -428,13 +428,26 @@ async function insertAccumulatorRows(db, args) {
     client.release();
   }
 }
-async function hasAccumulatedProof(db, dvmId, secrets) {
-  if (secrets.length === 0) return false;
+async function claimAccumulatorRequestId(tx, dvmId, requestId) {
+  await tx.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [
+    JSON.stringify(["wallet_accumulator_request", dvmId, requestId])
+  ]);
+  const { rows: rows2 } = await tx.query(
+    `SELECT 1 FROM wallet_accumulator WHERE dvm_id = $1 AND request_id = $2 LIMIT 1`,
+    [dvmId, requestId]
+  );
+  if (rows2.length > 0) throw new AccumulatorReplayError(dvmId, requestId);
+}
+async function acceptedRequestIds(db, dvmId, secrets) {
+  if (secrets.length === 0) return [];
+  const hashes = secrets.map(hashProofSecret);
   const { rows: rows2 } = await db.query(
-    `SELECT 1 FROM wallet_accumulator WHERE dvm_id = $1 AND proof_secret_hash = ANY($2::text[]) LIMIT 1`,
-    [dvmId, secrets.map(hashProofSecret)]
+    `SELECT proof_secret_hash, request_id FROM wallet_accumulator
+      WHERE dvm_id = $1 AND proof_secret_hash = ANY($2::text[])`,
+    [dvmId, hashes]
   );
-  return rows2.length > 0;
+  const byHash = new Map(rows2.map((row) => [row.proof_secret_hash, row.request_id]));
+  return hashes.map((hash3) => byHash.get(hash3));
 }
 async function listPendingBatches(db, dvmId) {
   const { rows: rows2 } = await db.query(
@@ -3234,7 +3247,7 @@ function paymentFailureFields(error) {
 }
 
 // src/sdk/server/payment.ts
-import { createHash as createHash4, randomBytes, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash5, randomBytes, randomUUID as randomUUID2 } from "crypto";
 import { Challenge } from "mppx";
 
 // src/lib/cashu/verify.ts
@@ -3328,6 +3341,63 @@ function methodNativeAmountToDecimal(amount, methodName) {
   return `${nativeAmount2 / scale}.${(nativeAmount2 % scale).toString().padStart(decimals, "0")}`;
 }
 
+// src/sdk/server/cashu-payment-request.ts
+import { createHash as createHash4 } from "crypto";
+import { PaymentRequest } from "@cashu/cashu-ts";
+function cashuPaymentRequest(args) {
+  return new PaymentRequest(
+    void 0,
+    void 0,
+    Math.ceil(args.requiredMsats / 1e3),
+    "sat",
+    args.mints,
+    void 0,
+    false,
+    { kind: "P2PK", data: args.lockPubkey, tags: [] }
+  ).toEncodedCreqA();
+}
+function proofSetRequestId(secrets) {
+  const canonical = JSON.stringify([...secrets].sort());
+  return `${DERIVED_REQUEST_ID_PREFIX}${createHash4("sha256").update(canonical).digest("hex")}`;
+}
+var DERIVED_REQUEST_ID_PREFIX = "nut24-";
+function withFxHistory(inner, opts = {}) {
+  const holdWindowMs = opts.holdWindowMs ?? FX_HOLD_WINDOW_MS;
+  const now = opts.now ?? Date.now;
+  const history = [];
+  return {
+    async fetch() {
+      const snapshot = await inner.fetch();
+      const latest = history.at(-1);
+      if (latest && sameRates(latest.snapshot, snapshot)) {
+        latest.lastPricedAt = now();
+      } else {
+        history.push({ snapshot, lastPricedAt: now() });
+        if (history.length > 4) history.shift();
+      }
+      return snapshot;
+    },
+    supportedCurrencies: () => inner.supportedCurrencies(),
+    ...inner.lastKnown && { lastKnown: inner.lastKnown.bind(inner) },
+    previousFor(pricedAt) {
+      for (let i = history.length - 1; i > 0; i--) {
+        if (!sameRates(history[i].snapshot, pricedAt)) continue;
+        const replaced = history[i - 1];
+        return now() - replaced.lastPricedAt <= holdWindowMs ? replaced.snapshot : void 0;
+      }
+      return void 0;
+    }
+  };
+}
+function sameRates(a, b) {
+  const keys = /* @__PURE__ */ new Set([...Object.keys(a.rates), ...Object.keys(b.rates)]);
+  for (const key of keys) {
+    if (a.rates[key] !== b.rates[key]) return false;
+  }
+  return true;
+}
+var FX_HOLD_WINDOW_MS = 10 * 6e4;
+
 // src/lib/mints.ts
 function isTestMintUrl(url) {
   let host;
@@ -3459,13 +3529,20 @@ async function acceptAccumulatorPayment(opts) {
   if (opts.disposable && !opts.mints.every(isTestMintUrl)) {
     throw new Error("Disposable Cashu accepts only known test or loopback mints.");
   }
-  if (!opts.requestId) {
+  if (!opts.requestId && !opts.deriveRequestId) {
     return {
       kind: "rejected",
       code: "missing_request_id",
       message: "X-Cashu-Request-Id header required for the agent-wallet path."
     };
   }
+  if (opts.requestId?.startsWith(DERIVED_REQUEST_ID_PREFIX)) {
+    return {
+      kind: "rejected",
+      code: "reserved_request_id",
+      message: `A Cashu request id may not start with "${DERIVED_REQUEST_ID_PREFIX}".`
+    };
+  }
   if (opts.lockPubkeys.length === 0) {
     return {
       kind: "rejected",
@@ -3486,6 +3563,9 @@ async function acceptAccumulatorPayment(opts) {
     if (meta.unit !== "sat" || proofs.length === 0) {
       throw new Error("Cashu payment requires nonempty sat proofs.");
     }
+    if (new Set(proofs.map((proof) => proof.secret)).size !== proofs.length) {
+      throw new Error("Cashu payment carries the same proof more than once.");
+    }
     for (const proof of proofs) {
       if (!proof.dleq || !verifyDleqIfPresent(proof, wallet.getKeyset(proof.id))) {
         throw new Error(
@@ -3501,10 +3581,12 @@ async function acceptAccumulatorPayment(opts) {
       message: err instanceof Error ? err.message : "Cashu token decode failed"
     };
   }
+  const requestId = opts.requestId || proofSetRequestId(proofs.map((proof) => proof.secret));
   const acceptedValue = {
     ...valuation,
     mintUrl,
-    paidMsats: valuation.netMsats
+    paidMsats: valuation.netMsats,
+    requestId
   };
   const nowSec = Math.floor(Date.now() / 1e3);
   const tExpireMsByIndex = [];
@@ -3521,9 +3603,8 @@ async function acceptAccumulatorPayment(opts) {
     tExpireMsByIndex.push(parseNut11LocktimeMs(p.secret));
   }
   if (belowFloorMessage) {
-    const secrets = proofs.map((p) => p.secret);
-    const banked = opts.disposable ? await opts.disposable.hasAccepted(secrets) : opts.db ? await hasAccumulatedProof(opts.db, opts.dvmId, secrets) : false;
-    if (banked) return replayRejected();
+    const banked = await acceptedUnder(opts, proofs);
+    if (banked.some((id) => id !== void 0)) return replayRejected(banked, requestId);
     return { kind: "rejected", code: "lock_not_exclusive", message: belowFloorMessage };
   }
   try {
@@ -3567,23 +3648,24 @@ async function acceptAccumulatorPayment(opts) {
     lockPubkeyByIndex: matchedLockPubkeyByIndex,
     mintUrl,
     proofs,
-    requestId: opts.requestId,
+    requestId,
     tExpireMsByIndex
   };
   try {
     if (opts.disposable) {
       const account = opts.withDisposableLedger;
       if (!account) throw new Error("Disposable Cashu requires atomic credit accounting.");
-      await opts.disposable.commit(opts.requestId, proofs, (ledger) => account(ledger, acceptedValue));
+      await opts.disposable.commit(requestId, proofs, (ledger) => account(ledger, acceptedValue));
     } else if (!opts.db) {
       throw new Error("Cashu accumulator requires a storage backend.");
-    } else if (opts.withCommitTx) {
-      const withCommitTx = opts.withCommitTx;
+    } else {
       const client = await opts.db.connect();
       try {
         await client.query("BEGIN");
+        await client.query("SET TRANSACTION ISOLATION LEVEL READ COMMITTED");
+        await claimAccumulatorRequestId(client, opts.dvmId, requestId);
         await insertAccumulatorRows(opts.db, { ...insertArgs, tx: client });
-        await withCommitTx(client, acceptedValue);
+        await opts.withCommitTx?.(client, acceptedValue);
         await client.query("COMMIT");
       } catch (err) {
         try {
@@ -3594,11 +3676,13 @@ async function acceptAccumulatorPayment(opts) {
       } finally {
         client.release();
       }
-    } else {
-      await insertAccumulatorRows(opts.db, insertArgs);
     }
   } catch (err) {
-    if (err instanceof AccumulatorReplayError) return replayRejected();
+    if (err instanceof AccumulatorReplayError) {
+      const banked = await acceptedUnder(opts, proofs);
+      if (banked.every((id) => id === void 0)) return requestIdReused(requestId);
+      return replayRejected(banked, requestId);
+    }
     throw err;
   }
   return {
@@ -3607,14 +3691,33 @@ async function acceptAccumulatorPayment(opts) {
     grossMsats: valuation.grossMsats,
     inputFeeMsats: valuation.inputFeeMsats,
     netMsats: valuation.netMsats,
-    mintUrl
+    mintUrl,
+    requestId
   };
 }
-function replayRejected() {
+async function acceptedUnder(opts, proofs) {
+  const secrets = proofs.map((p) => p.secret);
+  if (opts.disposable) return await opts.disposable.acceptedRequestIds(secrets);
+  if (opts.db) return await acceptedRequestIds(opts.db, opts.dvmId, secrets);
+  return secrets.map(() => void 0);
+}
+function requestIdReused(requestId) {
+  return {
+    kind: "rejected",
+    code: "request_id_reused",
+    requestId,
+    message: "This request id already carries a different payment at this DVM; these proofs were not accepted."
+  };
+}
+function replayRejected(accepted, requestId) {
+  const [first] = accepted;
+  const bound = first !== void 0 && accepted.every((id) => id === first);
   return {
     kind: "rejected",
     code: "replay_rejected",
-    message: "Proofs or request id already accepted at this DVM."
+    message: "Proofs or request id already accepted at this DVM.",
+    requestId,
+    ...bound && { acceptedRequestId: first }
   };
 }
 function parseNut11LocktimeMs(secret) {
@@ -3850,7 +3953,7 @@ async function verifyUpfrontPaymentInScope(opts) {
         }
       };
     }
-    if (opts.cashuMode === "p2pk-accumulator" && (opts.accumulatorDb || opts.disposableCashu) && opts.dvmId && opts.lockPubkeys && opts.lockPubkeys.length > 0) {
+    if (cashuAccumulatorReady(opts)) {
       return verifyAccumulatorReceipt(opts, mints, requiredMsats, ledgerCtx);
     }
     return {
@@ -4014,7 +4117,7 @@ async function verifyUpfrontPaymentInScope(opts) {
           x402Requirements
         });
       }
-      const { verifyX402Payment } = await import("./x402-6T73AZQ6.js");
+      const { verifyX402Payment } = await import("./x402-HVCUEWWU.js");
       const receipt = await withPaymentStage("verifier_broadcast", () => verifyX402Payment(
         x402Payment,
         x402Config,
@@ -4469,6 +4572,8 @@ async function verifyUpfrontPaymentInScope(opts) {
       opts.fundOnly?.allowOneShotStablecoin,
       opts.priceFiat
     ) : void 0;
+    const lockPubkey = opts.lockPubkeys?.[0];
+    const cashuRequest = opts.nut24 && opts.nut24.mints.length > 0 && !opts.fundOnly && cashuAccumulatorReady(opts) && lockPubkey ? cashuPaymentRequest({ requiredMsats, mints: opts.nut24.mints, lockPubkey }) : void 0;
     return {
       paidMsats: 0,
       receivedProofs: [],
@@ -4479,6 +4584,7 @@ async function verifyUpfrontPaymentInScope(opts) {
           ...mints && { mints }
         },
         status: 402,
+        ...cashuRequest && { cashuPaymentRequest: cashuRequest },
         ...mppChallenges && { mppChallenges },
         ...x402Requirements && { x402Requirements },
         ...x402BatchRequirements && { x402V2Requirements: x402BatchRequirements }
@@ -4612,6 +4718,11 @@ var PAYMENT_ERROR_COPY = {
     hint: "Request a fresh quote and pay again \u2014 the previous payment can't be reused.",
     retryable: false
   },
+  payment_method_requires_signature: {
+    display: "This service accepts unsigned requests only when they are paid with Cashu, so this payment was not applied to the job.",
+    hint: "Pay with Cashu to call without signing, or sign the request (secp256k1 Schnorr) to use another payment method.",
+    retryable: false
+  },
   x402_not_offered: {
     display: "This service does not offer x402 payment for prices in its configured currency. Nothing was charged.",
     hint: "Use one of the payment methods advertised by this service and submit the request again.",
@@ -4837,6 +4948,11 @@ var PAYMENT_ERROR_COPY = {
     hint: "Include the X-Cashu-Request-Id header and pay again.",
     retryable: false
   },
+  reserved_request_id: {
+    display: "The payment's request identifier isn't allowed, so the payment wasn't processed. Nothing was charged.",
+    hint: 'Send a fresh UUIDv4 as X-Cashu-Request-Id. Ids starting with "nut24-" are reserved for payments sent without one.',
+    retryable: false
+  },
   missing_lock_pubkey: {
     display: "This service can't accept the payment right now. Nothing was charged.",
     hint: "The service is missing payment configuration; retrying won't help. Contact the service operator.",
@@ -4903,6 +5019,11 @@ var PAYMENT_ERROR_COPY = {
     // agent could follow straight into paying twice for the same charge.
     hint: "Don't re-send this payment \u2014 the proofs already landed under this request id. Only a genuinely new charge needs a fresh token and request id.",
     retryable: false
+  },
+  request_id_reused: {
+    display: "This payment was not accepted and nothing was charged.",
+    hint: "Each X-Cashu-Request-Id belongs to the first payment made under it. Send these proofs again under a new request id.",
+    retryable: false
   }
 };
 function paymentErrorBody(code, opts) {
@@ -5044,7 +5165,7 @@ async function verifyIncomingPaymentInScope(body, opts, snapshot) {
           snapshot
         });
       }
-      const { verifyX402Payment } = await import("./x402-6T73AZQ6.js");
+      const { verifyX402Payment } = await import("./x402-HVCUEWWU.js");
       const receipt = await withPaymentStage("verifier_broadcast", () => verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -5495,7 +5616,7 @@ async function processIncomingPaymentInScope(job, body, opts) {
     try {
       const requiredMsats = job.pendingPaymentMsats ?? 0;
       const requiredUsdcMicro = job.pendingX402AmountUsdcMicro !== void 0 ? BigInt(job.pendingX402AmountUsdcMicro) : BigInt(msatsToUsdc(requiredMsats, rate));
-      const { verifyX402Payment } = await import("./x402-6T73AZQ6.js");
+      const { verifyX402Payment } = await import("./x402-HVCUEWWU.js");
       const receipt = await withPaymentStage("verifier_broadcast", () => verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -5620,6 +5741,16 @@ function creditPendingPayment(job) {
     job.pendingPaymentMsats = void 0;
   }
 }
+function cashuAccumulatorReady(opts) {
+  return opts.cashuMode === "p2pk-accumulator" && Boolean(opts.accumulatorDb || opts.disposableCashu) && Boolean(opts.dvmId) && (opts.lockPubkeys?.length ?? 0) > 0;
+}
+var NUT24_PAYER_FIXABLE = /* @__PURE__ */ new Set([
+  "invalid_token",
+  "not_p2pk_locked",
+  "wrong_lock_pubkey",
+  "lock_not_exclusive",
+  "payment_insufficient"
+]);
 async function verifyAccumulatorReceipt(opts, mints, requiredMsats, ledgerCtx) {
   const { cashuToken, accumulatorDb, dvmId, lockPubkeys, mintHealthTracker } = opts;
   if (!cashuToken || !accumulatorDb && !opts.disposableCashu || !dvmId || !lockPubkeys || lockPubkeys.length === 0) {
@@ -5668,7 +5799,13 @@ async function verifyAccumulatorReceipt(opts, mints, requiredMsats, ledgerCtx) {
     };
   }
   let credited;
-  const requestId = opts.requestId;
+  const headerless = !opts.requestId && opts.nut24 !== void 0;
+  const previousRequired = headerless ? opts.nut24?.previousRequiredMsats : void 0;
+  const requiredFor = (paidMsats) => requiredMsats !== void 0 && paidMsats < requiredMsats && previousRequired !== void 0 && paidMsats >= previousRequired ? previousRequired : requiredMsats;
+  const held = (ctx, paidMsats) => ({
+    ...ctx,
+    requiredMsats: requiredFor(paidMsats) ?? ctx.requiredMsats
+  });
   const signedFund = ledgerCtx?.creditEnvelope?.fund;
   const beforeCommit = ledgerCtx && signedFund ? (accepted) => {
     const expected = fundedMicroFor(
@@ -5680,12 +5817,12 @@ async function verifyAccumulatorReceipt(opts, mints, requiredMsats, ledgerCtx) {
       throw new CashuFundingAmountMismatchError(signedFund.amountMicro, expected);
     }
   } : void 0;
-  const withCommitTx = ledgerCtx && requestId ? async (tx, accepted) => {
+  const withCommitTx = ledgerCtx ? async (tx, accepted) => {
     credited = await fundAndDraw(
-      ledgerCtx,
+      held(ledgerCtx, accepted.paidMsats),
       {
         rail: "cashu",
-        paymentId: requestId,
+        paymentId: accepted.requestId,
         paidMsats: accepted.paidMsats,
         grossPaidMsats: accepted.grossMsats,
         cashuInputFeeMsats: accepted.inputFeeMsats,
@@ -5699,13 +5836,14 @@ async function verifyAccumulatorReceipt(opts, mints, requiredMsats, ledgerCtx) {
     result = await acceptAccumulatorPayment({
       cashuToken,
       requestId: opts.requestId,
+      deriveRequestId: headerless,
       mints,
       db: accumulatorDb,
       disposable: opts.disposableCashu,
-      withDisposableLedger: ledgerCtx && requestId ? async (ledger, accepted) => {
-        credited = await fundAndDraw({ ...ledgerCtx, ledger }, {
+      withDisposableLedger: ledgerCtx ? async (ledger, accepted) => {
+        credited = await fundAndDraw({ ...held(ledgerCtx, accepted.paidMsats), ledger }, {
           rail: "cashu",
-          paymentId: requestId,
+          paymentId: accepted.requestId,
           paidMsats: accepted.paidMsats,
           grossPaidMsats: accepted.grossMsats,
           cashuInputFeeMsats: accepted.inputFeeMsats,
@@ -5729,24 +5867,35 @@ async function verifyAccumulatorReceipt(opts, mints, requiredMsats, ledgerCtx) {
     throw err;
   }
   if (result.kind === "rejected") {
-    const status = result.code === "replay_rejected" ? 409 : 402;
+    const status = result.code === "replay_rejected" || result.code === "request_id_reused" ? 409 : result.code === "reserved_request_id" || headerless && NUT24_PAYER_FIXABLE.has(result.code) ? 400 : 402;
+    const requestId = result.requestId;
     return {
       paidMsats: 0,
       receivedProofs: [],
       error: {
-        body: paymentErrorBody(result.code, { message: result.message, extra: { mints } }),
+        body: paymentErrorBody(result.code, {
+          message: result.message,
+          // Without a request id the proof set is the payment's identity, so
+          // only these exact proofs with the original body recover its job.
+          ...headerless && result.code === "replay_rejected" && {
+            hint: "These proofs already paid for an earlier request. Resend them with that request's exact body to fetch its job; a new request needs new proofs."
+          },
+          extra: { mints }
+        }),
         status,
-        // The accumulator keys replay on the request id, which is also the
-        // funding id a mid-job top-up committed under, so the route can hand
-        // back the original draw funding evidence beside the 409.
-        ...status === 409 && requestId && { replayPaymentId: requestId }
+        // The request id is also the funding id a mid-job top-up committed
+        // under and the job's payment reference, so the route can return the
+        // original evidence beside the 409. It is passed on only when every
+        // presented proof was accepted under this same request id.
+        ...requestId && result.acceptedRequestId === requestId && { replayPaymentId: requestId }
       }
     };
   }
   if (credited?.drawRefusal) {
     return creditLedgerErrorResult(credited.drawRefusal, void 0, credited.deposit);
   }
-  if (requiredMsats && result.paidMsats < requiredMsats && !ledgerCtx?.fundOnly && !ledgerCtx?.creditEnvelope) {
+  const heldRequired = requiredFor(result.paidMsats);
+  if (heldRequired && result.paidMsats < heldRequired && !ledgerCtx?.fundOnly && !ledgerCtx?.creditEnvelope) {
     let forfeit;
     if (credited?.draw && ledgerCtx && !ledgerCtx.midJob) {
       const drawId = credited.draw.drawId;
@@ -5768,36 +5917,39 @@ async function verifyAccumulatorReceipt(opts, mints, requiredMsats, ledgerCtx) {
         });
       }
     }
-    const held = ledgerCtx?.midJob ? credited : void 0;
+    const held2 = ledgerCtx?.midJob ? credited : void 0;
     return {
       paidMsats: 0,
       receivedProofs: [],
       error: {
         body: paymentErrorBody("payment_insufficient", {
           message: `Payment of ${result.paidMsats} msats is short of the ${requiredMsats} msats required.`,
-          ...held && {
+          ...held2 && {
             // Per-code copy can't say where the money went, and this is the one
             // site where that is the caller's next action.
-            hint: `The ${result.paidMsats} msats already sent are held on credit ${held.creditId} and do not reduce what is owed \u2014 retry with a single payment of required_msats, or reclaim the held balance with op "drain" at POST /v1/credit.`
+            hint: `The ${result.paidMsats} msats already sent are held on credit ${held2.creditId} and do not reduce what is owed \u2014 retry with a single payment of required_msats, or reclaim the held balance with op "drain" at POST /v1/credit.`
+          },
+          ...!held2 && headerless && {
+            hint: "The proofs already sent are kept and do not count toward this request. Pay again with new proofs worth required_msats after the mint's input fee."
           },
           extra: {
             required_msats: requiredMsats,
             received_msats: result.paidMsats,
             mints,
-            ...held && {
-              credit_id: held.creditId,
-              credited_micro: held.deposit.amountMicro,
-              credit_currency: held.deposit.currency
+            ...held2 && {
+              credit_id: held2.creditId,
+              credited_micro: held2.deposit.amountMicro,
+              credit_currency: held2.deposit.currency
             }
           }
         }),
-        status: 402,
+        status: headerless ? 400 : 402,
         forfeit,
         // Report the deposit on the failure path too, or the platform never
         // learns about a liability it is carrying. Mutually exclusive with
         // `forfeit` by construction: one is money still owed, the other is
         // money nothing is owed against.
-        ...held && { funding: held.deposit }
+        ...held2 && { funding: held2.deposit }
       }
     };
   }
@@ -5807,13 +5959,11 @@ async function verifyAccumulatorReceipt(opts, mints, requiredMsats, ledgerCtx) {
       paymentMint: result.mintUrl,
       paymentRail: "cashu",
       receivedProofs: [],
-      // requestId is non-null here because acceptAccumulatorPayment returns
-      // kind:"rejected" with code "missing_request_id" when unset (handled by
-      // the rejected branch above). Thread it as the per-call settlement
-      // reference for revenue_events.tx_hash. Unique per
-      // (dvm_id, request_id) by the wallet_accumulator UNIQUE constraint, so
-      // it serves as a stable id even though it isn't an on-chain hash.
-      paymentTxHash: opts.requestId,
+      // The request id the proofs were banked under, supplied or derived, is
+      // the per-call settlement reference for revenue_events.tx_hash. Unique
+      // per (dvm_id, request_id) by the wallet_accumulator UNIQUE constraint,
+      // so it serves as a stable id even though it isn't an on-chain hash.
+      paymentTxHash: result.requestId,
       cashuFlow: "p2pk_accumulator"
     },
     ledgerCtx,
@@ -5889,7 +6039,7 @@ async function resolveTopUpLedgerContext(opts, snapshot, binding) {
         draw_id: snapshot.drawId,
         ...extra,
         ...typeof opts.jobId === "string" && {
-          job_id_hash: createHash4("sha256").update(opts.jobId, "utf8").digest("hex")
+          job_id_hash: createHash5("sha256").update(opts.jobId, "utf8").digest("hex")
         }
       }
     );
@@ -9592,7 +9742,7 @@ async function handle(c, opts, action) {
 }
 
 // src/sdk/server/x402-exact-settlement.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 var X402ExactSettlementServer = class {
   constructor(opts) {
     this.opts = opts;
@@ -9918,7 +10068,7 @@ function settlementMayHaveMoved(response) {
   return reason.includes("authorization_already_used") || reason.includes("authorization already used") || /facilitator_status_5\d\d/.test(reason);
 }
 function hash(parts) {
-  return createHash5("sha256").update(JSON.stringify(parts)).digest("hex");
+  return createHash6("sha256").update(JSON.stringify(parts)).digest("hex");
 }
 function safeError(err) {
   if (err instanceof Error) return err.name;
@@ -9926,7 +10076,7 @@ function safeError(err) {
 }
 
 // src/sdk/server/hosting-settlement-report-obligations.ts
-import { createHash as createHash6, randomUUID as randomUUID3 } from "crypto";
+import { createHash as createHash7, randomUUID as randomUUID3 } from "crypto";
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
 import { BATCH_SETTLEMENT_ADDRESS as BATCH_SETTLEMENT_ADDRESS3 } from "@x402/evm";
 import { computeChannelId as computeChannelId2 } from "@x402/evm/batch-settlement/client";
@@ -9999,7 +10149,7 @@ var TEMPO_CLOSED_EVENT = TempoSession.Precompile.escrowAbi.find(
   (item) => item.type === "event" && item.name === "ChannelClosed"
 );
 function hash2(value) {
-  return createHash6("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash7("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function hex(value, bytes) {
   return typeof value === "string" && new RegExp(`^0x[0-9a-fA-F]{${bytes * 2}}$`).test(value);
@@ -11387,7 +11537,7 @@ var HostingCleanupFence = class {
 };
 
 // src/sdk/server/hosting-channel-evidence.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 import { Session as TempoSession2 } from "mppx/tempo";
 import { createPublicClient as createPublicClient5, http as http5 } from "viem";
 import { BATCH_SETTLEMENT_ADDRESS as BATCH_SETTLEMENT_ADDRESS4 } from "@x402/evm";
@@ -11438,7 +11588,7 @@ async function readHostedChannelSnapshot(query) {
   };
   const x402HistoryComplete = await history(names[6]);
   const tempoHistoryComplete = await history(names[7]);
-  const digest = createHash7("sha256").update(JSON.stringify({
+  const digest = createHash8("sha256").update(JSON.stringify({
     present: [...exists].sort(),
     x402,
     x402Tombstones,
@@ -12588,9 +12738,9 @@ import { AsyncLocalStorage } from "async_hooks";
 import { randomBytes as randomBytes3 } from "crypto";
 
 // src/sdk/server/instrumented-kv.ts
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 function hashKey(key) {
-  return createHash8("sha256").update(key).digest("hex").slice(0, 16);
+  return createHash9("sha256").update(key).digest("hex").slice(0, 16);
 }
 function instrumentKVStore(inner) {
   return {
@@ -12904,7 +13054,7 @@ function buildContext(job, opts) {
         let x402Nonce;
         let x402AmountUsdcMicro;
         const hasExplicitX402 = Boolean(payOpts?.x402);
-        if ((opts.pricingCurrency ?? "usd") === "usd") {
+        if (!opts.cashuOnly && (opts.pricingCurrency ?? "usd") === "usd") {
           if (payOpts?.x402) {
             paymentRequestContent.x402 = payOpts.x402;
           } else if (opts.paymentMethods?.includes("x402") && opts.x402 && (opts.x402FacilitatorHealth?.support().available ?? true)) {
@@ -12943,7 +13093,8 @@ function buildContext(job, opts) {
         job.pendingX402Nonce = x402Nonce;
         job.pendingX402AmountUsdcMicro = x402AmountUsdcMicro;
         let mppChallengeIds;
-        if (payOpts?.mpp) {
+        if (opts.cashuOnly) {
+        } else if (payOpts?.mpp) {
           const challenges = payOpts.mpp.challenges.filter((c) => c.intent !== "session");
           if (challenges.length > 0) {
             paymentRequestContent.tempo = { challenges };
@@ -13351,6 +13502,39 @@ function resultHashFor(record) {
   return computeResultHash(summary, artifacts);
 }
 
+// src/sdk/server/unsigned-request.ts
+function takesUnsignedPath(auth, body) {
+  if (!auth?.allowUnsignedPaid) return false;
+  const raw = signedRequestInput(body);
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return true;
+  return !SIGNED_ENVELOPE_FIELDS.some((field) => field in raw);
+}
+function carriesCreditFields(raw) {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return false;
+  return CREDIT_ENVELOPE_KEYS.some((field) => field in raw);
+}
+function unsignedInputSchema(schema) {
+  if (narrowed.has(schema)) return narrowed.get(schema);
+  const result = narrow(schema);
+  narrowed.set(schema, result);
+  return result;
+}
+var narrowed = /* @__PURE__ */ new WeakMap();
+function narrow(schema) {
+  const candidate = schema;
+  const def = candidate._zod?.def;
+  if (def?.type !== "object" || typeof candidate.clone !== "function" || candidate.shape === null || typeof candidate.shape !== "object") {
+    return void 0;
+  }
+  const shape = { ...candidate.shape };
+  for (const field of SIGNED_ENVELOPE_FIELDS) delete shape[field];
+  try {
+    return candidate.clone({ ...def, shape });
+  } catch {
+    return void 0;
+  }
+}
+
 // src/lib/cashu/mint-info.ts
 async function getKeysetFinalExpiry(mintUrl, keysetId) {
   try {
@@ -13814,11 +13998,12 @@ var JobManager = class {
    * `"$X.XX"` is parsed as USD and converted via the SDK's shared fx fetcher.
    * Returns `undefined` for dynamic-priced capabilities (those that declare
    * `onQuote`) — the caller falls back to `computeDynamicPrice` in that path.
+   * A caller that already holds the snapshot it prices at passes it as `fx`.
    */
-  async currentPriceMsats(capability) {
+  async currentPriceMsats(capability, fx) {
     const cap = this.requireCapability(capability);
     if (cap.price === void 0) return void 0;
-    return resolveStaticPriceMsats(cap.price, this.opts.fxFetcher);
+    return resolveStaticPriceMsats(cap.price, fx ?? await this.opts.fxFetcher.fetch());
   }
   /**
    * Translate a capability's static `price` into the fiat envelope used by
@@ -13851,12 +14036,16 @@ var JobManager = class {
    * explicit draw as an unknown key, before the envelope was even extracted.
    * The persisted `record.input` the reactivation path re-reads is the
    * pre-Zod wire form, so it comes through the second branch carrying them too.
+   *
+   * `unsigned` validates against the schema without its envelope fields; pass
+   * it only when {@link unsignedPaidInput} accepted the same body.
    */
-  parseInput(body, capability) {
+  parseInput(body, capability, unsigned2 = false) {
     const cap = this.requireCapability(capability);
     const rawSchema = cap.input;
     if (!rawSchema || !isZodSchema(rawSchema)) return body.input ?? "";
-    const schema = rawSchema;
+    const schema = unsigned2 ? unsignedInputSchema(rawSchema) : rawSchema;
+    if (!schema) throw new Error(`capability "${capability}" cannot validate unsigned input`);
     if (body.data !== void 0) {
       return schema.parse(stripProtocolEnvelope(schema, body.data));
     }
@@ -13866,6 +14055,16 @@ var JobManager = class {
     }
     throw new MissingStructuredInputError();
   }
+  /**
+   * Whether this body takes the unsigned paid path: the auth scheme allows it,
+   * the raw input carries no envelope field, and the capability schema can be
+   * narrowed to exclude the envelope. Otherwise the signed path applies.
+   */
+  unsignedPaidInput(body, capability) {
+    if (!takesUnsignedPath(this.descriptor.auth, body)) return false;
+    const rawSchema = this.requireCapability(capability).input;
+    return isZodSchema(rawSchema) && unsignedInputSchema(rawSchema) !== void 0;
+  }
   /**
    * Look up the per-capability descriptor by name. Throws when the
    * name doesn't exist — the route layer validates body.capability first, so
@@ -15352,8 +15551,9 @@ var JobManager = class {
    * it re-verified clean.
    */
   reactivateJob(record) {
-    const parsedInput = this.parseInput({ input: record.input }, record.capability);
-    if (this.descriptor.auth) {
+    const unsigned2 = record.authRequestPath === void 0 && record.requesterPubkey === void 0 && this.unsignedPaidInput({ input: record.input }, record.capability);
+    const parsedInput = this.parseInput({ input: record.input }, record.capability, unsigned2);
+    if (this.descriptor.auth && !unsigned2) {
       const cap = this.requireCapability(record.capability);
       if (!cap.input || !isZodSchema(cap.input)) {
         throw new ReactivationAuthSchemaError(record.id, record.capability);
@@ -15897,6 +16097,7 @@ var JobManager = class {
       store: this.opts.store,
       env: this.opts.env,
       paymentMethods: this.opts.paymentMethods,
+      cashuOnly: Boolean(this.descriptor.auth?.allowUnsignedPaid) && job.requesterPubkey === void 0,
       x402: this.opts.x402,
       x402FacilitatorHealth: this.opts.x402FacilitatorHealth,
       mpp: this.opts.mpp,
@@ -16701,9 +16902,8 @@ function unappliedCopy(reason, creditId) {
     }
   }[reason];
 }
-async function resolveStaticPriceMsats(price, fxFetcher) {
+function resolveStaticPriceMsats(price, fx) {
   const usd = parseUsdPrice(price, "price");
-  const fx = await fxFetcher.fetch();
   return fiatToSatsCeil(usd, fxRateFor(fx, "usd")) * 1e3;
 }
 function deriveAuthFromParsedInput(descriptor, parsedInput) {
@@ -17769,7 +17969,7 @@ function withWallClockDeadline(promise, timeoutMs) {
 }
 
 // src/sdk/server/balance-payment.ts
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 import { z as z2 } from "zod";
 var BALANCE_PAYMENT_SCHEMA = z2.object({
   credit_id: z2.string().min(1).max(256),
@@ -17799,7 +17999,7 @@ async function commitBalancePayment(args) {
   args.auth.recheckSignature(BALANCE_PAYMENT_SCHEMA, args.raw, args.domain);
   const auth = BALANCE_PAYMENT_SCHEMA.parse(args.raw);
   const { pubkey, credit_id, draw_id, payment_id, request_seq, amount_micro, currency } = auth;
-  const fingerprint = createHash9("sha256").update(JSON.stringify([
+  const fingerprint = createHash10("sha256").update(JSON.stringify([
     args.domain,
     args.jobId,
     pubkey,
@@ -17923,7 +18123,7 @@ async function commitBalancePayment(args) {
 }
 
 // src/sdk/server/app.ts
-import { createHash as createHash11, randomBytes as randomBytes5, randomUUID as randomUUID6 } from "crypto";
+import { createHash as createHash12, randomBytes as randomBytes5, randomUUID as randomUUID6 } from "crypto";
 import { Hono } from "hono";
 import { getCookie } from "hono/cookie";
 import { cors } from "hono/cors";
@@ -20974,7 +21174,7 @@ initSchemaForm();
 }
 
 // src/sdk/server/request-fingerprint.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 function requestFingerprint(req, opts) {
   const canonical = canonicalize({
     capability: req.capability,
@@ -20982,7 +21182,7 @@ function requestFingerprint(req, opts) {
     params: req.params ?? {},
     data: opts.stripAuthEnvelope ? stripEnvelope(req.data) : req.data
   });
-  return createHash10("sha256").update(canonical).digest("hex");
+  return createHash11("sha256").update(canonical).digest("hex");
 }
 var ENVELOPE_KEYS = /* @__PURE__ */ new Set(["pubkey", "signature", "timestamp", "nonce", "auth_statement"]);
 function stripEnvelope(data) {
@@ -21105,7 +21305,7 @@ async function createDVMServer(descriptor, opts) {
       }
     }
     if (!opts.onJobCompleted && platformToken && platformUrl && dvmId && opts.db) {
-      const { RevenueReporter } = await import("./revenue-reporter-2P3PWJJM.js");
+      const { RevenueReporter } = await import("./revenue-reporter-6XARUEG6.js");
       const reporter = new RevenueReporter(
         opts.db,
         platformUrl,
@@ -21115,7 +21315,7 @@ async function createDVMServer(descriptor, opts) {
       revenueReporter = reporter;
       await reporter.init();
       reporter.startRetryLoop();
-      const { MemoryX402BatchStore, PayoutReporter } = await import("./payout-reporter-P3652TLG.js");
+      const { MemoryX402BatchStore, PayoutReporter } = await import("./payout-reporter-5QAHCYIO.js");
       payoutReporter = new PayoutReporter({
         dvmId,
         db: opts.db,
@@ -21396,7 +21596,9 @@ var DVMServer = class {
     this.consumedCredentialStore = opts.consumedCredentialStore ?? new MemoryConsumedCredentialStore();
     this.adminCashuNonceStore = opts.adminCashuNonceStore ?? createAdminCashuNonceStore();
     const fxEnv = opts.env;
-    this.fxFetcher = opts.fxFetcher ?? createFxFetcher({ source: resolveFxSourceFromEnv(fxEnv) });
+    this.fxFetcher = withFxHistory(
+      opts.fxFetcher ?? createFxFetcher({ source: resolveFxSourceFromEnv(fxEnv) })
+    );
     const fxCurrencies = this.fxFetcher.supportedCurrencies();
     if (!fxCurrencies.includes(this.pricingCurrency)) {
       throw new Error(
@@ -21505,6 +21707,15 @@ var DVMServer = class {
     this.app = new Hono();
     try {
       this.registerRoutes();
+      if (opts.mints?.length && !this.resolvePaymentMethods().includes("cashu")) {
+        diagnosticConsole.warn({
+          event: "cashu_not_advertised",
+          cashu_explicitly_excluded: opts.paymentMethods !== void 0 && !opts.paymentMethods.includes("cashu"),
+          cashu_mode_missing: opts.cashuMode !== "p2pk-accumulator",
+          cashu_lock_pubkey_missing: !opts.lockPubkey,
+          cashu_store_missing: !opts.db && !opts.disposableCashu
+        });
+      }
       if (opts.hostingControlInstance) {
         this.hostingSweepTimer = setInterval(() => {
           void this.sweepHostingDeadline().catch((error) => {
@@ -21714,7 +21925,7 @@ var DVMServer = class {
       })
     );
     if (this.opts.devMode) {
-      this.app.use("*", cors());
+      this.app.use("*", cors({ exposeHeaders: ["X-Cashu"] }));
       this.app.get("/_dev", (c) => c.html(devPageHtml(this.descriptor.name)));
       this.app.all("/_proxy/*", (c) => this.handleProxy(c));
     }
@@ -22028,7 +22239,7 @@ var DVMServer = class {
       const dvmId = this.opts.dvmId ?? `dev:${this.descriptor.name}`;
       return {
         dvm_id: dvmId,
-        builder_pubkey: createHash11("sha256").update(`dvmkit-dev:${dvmId}`).digest("hex")
+        builder_pubkey: createHash12("sha256").update(`dvmkit-dev:${dvmId}`).digest("hex")
       };
     }
     throw new AuthAudienceError();
@@ -22126,7 +22337,7 @@ var DVMServer = class {
     const methods = this.resolvePaymentMethods().filter(
       (method) => method !== "tempo" || creditMpp
     );
-    if (this.x402CurrencySupported() && this.x402BatchAvailable() && !methods.includes("x402")) {
+    if ((this.opts.paymentMethods === void 0 || this.opts.paymentMethods.includes("x402")) && this.x402CurrencySupported() && this.x402BatchAvailable() && !methods.includes("x402")) {
       methods.push("x402");
     }
     if (this.opts.lightningReceive?.available()) methods.push("lightning");
@@ -22149,7 +22360,9 @@ var DVMServer = class {
    * distinction, and a reason it can relay.
    */
   creditMppSplit() {
-    if (!this.opts.mpp) return { offered: [], withheld: [] };
+    if (!this.opts.mpp || !this.resolvePaymentMethods().includes("tempo")) {
+      return { offered: [], withheld: [] };
+    }
     const configured = advertisedMethods(this.opts.mpp).filter(
       (method) => method.intent === "charge" || method.intent === "session"
     ).sort(
@@ -22381,7 +22594,7 @@ var DVMServer = class {
         const paymentAuthorization = ctx.req.header("Authorization");
         const mppArtifact = paymentAuthorization ? (await import("mppx")).Credential.extractPaymentScheme(paymentAuthorization) : void 0;
         const attachedPayment = ctx.req.header("X-Cashu") ?? ctx.req.header("PAYMENT-SIGNATURE") ?? ctx.req.header("X-PAYMENT") ?? mppArtifact;
-        const paymentArtifactHash = attachedPayment ? createHash11("sha256").update(attachedPayment).digest("hex") : void 0;
+        const paymentArtifactHash = attachedPayment ? createHash12("sha256").update(attachedPayment).digest("hex") : void 0;
         hostingFundingArtifactHash = paymentArtifactHash;
         if (!await control.admit(admissionId, workId, {
           creditId,
@@ -22481,7 +22694,7 @@ var DVMServer = class {
       name: this.descriptor.name,
       description: this.descriptor.description || void 0,
       tags: this.descriptor.tags,
-      auth: this.descriptor.auth ? [this.descriptor.auth.id] : ["none"],
+      auth: !this.descriptor.auth ? ["none"] : this.descriptor.auth.allowUnsignedPaid ? [this.descriptor.auth.id, "none"] : [this.descriptor.auth.id],
       ...this.authAudience ? { auth_audience: this.authAudience } : {},
       protocol_version: 1,
       sdk_sha: this.opts.env.GIT_SHA ?? "unknown",
@@ -22500,7 +22713,7 @@ var DVMServer = class {
     if (this.opts.mints) info.mints = this.advertisedMints();
     info.capabilities = this.renderCapabilities();
     info.payment = { methods: this.resolvePaymentMethods() };
-    if (this.x402CurrencySupported() && this.opts.x402 && this.x402Support()?.available) {
+    if (info.payment.methods.includes("x402") && this.opts.x402 && this.x402Support()?.available) {
       info.x402 = {
         pay_to: this.opts.x402.payTo,
         network: this.opts.x402.network,
@@ -22510,7 +22723,7 @@ var DVMServer = class {
         dual_serve: this.opts.x402.dualServe ?? true
       };
     }
-    if (this.opts.mpp) {
+    if (info.payment.methods.includes("tempo") && this.opts.mpp) {
       const configured = advertisedMethods(this.opts.mpp);
       const withheld = configured.flatMap((method) => {
         const reason = this.tempoSessionWithheldReason(method);
@@ -22885,6 +23098,48 @@ var DVMServer = class {
       400
     );
   }
+  /**
+   * Refuse an x402 or Tempo mid-job payment on an unsigned paid job before it
+   * is recorded or verified: those rails settle into credit owned by a caller
+   * pubkey, which the job lacks. Signed jobs always store their pubkey.
+   */
+  unsignedJobRailRefusal(job, body) {
+    if (!this.descriptor.auth?.allowUnsignedPaid || job.requesterPubkey !== void 0) return void 0;
+    if (body.type !== "payment" || !body.content.x402_payment && !body.content.tempo_credential) {
+      return void 0;
+    }
+    return buildPaymentErrorResponse(
+      paymentErrorBody("payment_method_requires_signature", {
+        message: "Unsigned jobs may be paid only with Cashu; an x402 or Tempo payment was sent."
+      }),
+      void 0,
+      void 0,
+      402
+    );
+  }
+  /** Whether this DVM takes Cashu, the only rail an unsigned payer may use. */
+  unsignedCashuOffered() {
+    return (this.opts.mints?.length ?? 0) > 0 && this.resolvePaymentMethods().includes("cashu");
+  }
+  /**
+   * The error the signed path raises for this envelope-free body, so a refused
+   * unsigned request reads exactly as it does on a DVM without the option.
+   */
+  unsignedRequestRefusal(c, schema, body, capabilityName) {
+    try {
+      if (this.descriptor.auth && isZodSchema(schema)) {
+        this.descriptor.auth.checkAuth(
+          schema,
+          signedRequestInput(body),
+          this.signedRequestDomain(c, capabilityName)
+        );
+      }
+    } catch (err) {
+      if (err instanceof SignedRequestError) return err;
+      throw err;
+    }
+    return new SignedRequestError("signed request required", "signature_invalid");
+  }
   /**
    * On authenticated DVMs, envelope-only parse failures defer to auth
    * (401 signature_invalid). Builder input issues remain 400 invalid_input.
@@ -22914,6 +23169,25 @@ var DVMServer = class {
     if (healthy.length > 0) return healthy;
     return all.filter((m) => !tracker.isNutIncompatible(m));
   }
+  /**
+   * This request's price at the rates `pricedAt` replaced, or `undefined` when
+   * there are none or they were replaced longer ago than the hold window.
+   * Computed the way the current price is, so the figure matches the one an
+   * earlier 402 quoted.
+   */
+  previousPriceMsats(cap, dynamicUpfront, pricedAt) {
+    const previous = pricedAt && this.fxFetcher.previousFor(pricedAt);
+    if (!previous) return void 0;
+    try {
+      if (dynamicUpfront) {
+        return fiatToSatsCeil(dynamicUpfront.amount, fxRateFor(previous, dynamicUpfront.currency)) * 1e3;
+      }
+      if (cap.price === void 0) return void 0;
+      return fiatToSatsCeil(parseUsdPrice(cap.price, "price"), fxRateFor(previous, "usd")) * 1e3;
+    } catch {
+      return void 0;
+    }
+  }
   /** Authenticated, read-only recovery of a previously accepted public request id. */
   async handleRequestResult(c) {
     const requestId = c.req.param("requestId");
@@ -22984,6 +23258,14 @@ var DVMServer = class {
         400
       );
     }
+    if (c.req.header("X-Cashu-Request-Id")?.startsWith(DERIVED_REQUEST_ID_PREFIX)) {
+      return c.json(
+        paymentErrorBody("reserved_request_id", {
+          message: `X-Cashu-Request-Id may not start with "${DERIVED_REQUEST_ID_PREFIX}".`
+        }),
+        400
+      );
+    }
     const publicRequestId = requestIdFromEnvelope(body.data);
     const recoveryStore = requestRecoveryStore(this.jobManager.store);
     const resumedRequestId = resumeOnly ? c.req.param("requestId") : void 0;
@@ -23002,6 +23284,17 @@ var DVMServer = class {
     const capabilityResult = this.requireCapabilityFromBody(c, body.capability);
     if ("error" in capabilityResult) return capabilityResult.error;
     const capabilityName = capabilityResult.name;
+    const unsignedPaid = this.jobManager.unsignedPaidInput(body, capabilityName);
+    if (unsignedPaid && publicRequestId) {
+      return c.json(
+        {
+          error: "request_recovery_unsupported",
+          message: "Public request ids require a signed request.",
+          hint: "Sign the request to use request_id recovery, or omit request_id."
+        },
+        400
+      );
+    }
     pinDimension("capability", capabilityName);
     const cap = this.descriptor.capabilities[capabilityName];
     let parsedInput;
@@ -23010,13 +23303,23 @@ var DVMServer = class {
       parsedInput = await loggers.isolate.span(
         "dvm.input.validate",
         { capability: capabilityName, stage: "input" },
-        () => this.jobManager.parseInput(body, capabilityName),
+        () => this.jobManager.parseInput(body, capabilityName, unsignedPaid),
         { onError: () => ({ "error.code": "invalid_input" }) }
       );
     } catch (err) {
-      if (!this.deferToAuthGate(err)) return this.invalidInputResponse(c, err);
+      if (unsignedPaid || !this.deferToAuthGate(err)) return this.invalidInputResponse(c, err);
       deferredInputError = err;
     }
+    if (unsignedPaid && carriesCreditFields(signedRequestInput(body))) {
+      return c.json(
+        {
+          error: "invalid_credit_fields",
+          message: "credit_id, draw_id and fund require a signed request.",
+          hint: "Sign the request to draw on or fund prepaid credit, or remove the credit fields and pay per call."
+        },
+        400
+      );
+    }
     let creditEnvelope;
     try {
       creditEnvelope = extractCreditEnvelope(body.data);
@@ -23033,9 +23336,26 @@ var DVMServer = class {
       }
       throw err;
     }
+    if (unsignedPaid && (cap.price === void 0 && !cap.onQuote || devModeSkipsPaymentVerification(this.opts) || !this.unsignedCashuOffered())) {
+      return buildAuthErrorResponse(
+        c,
+        this.unsignedRequestRefusal(c, cap.input, body, capabilityName),
+        this.publicOrigin
+      );
+    }
+    if (unsignedPaid && await carriesNonCashuPayment(c)) {
+      return buildPaymentErrorResponse(
+        paymentErrorBody("payment_method_requires_signature", {
+          message: "Unsigned requests may pay only with Cashu; an x402 or Tempo payment was attached."
+        }),
+        void 0,
+        void 0,
+        402
+      );
+    }
     let authEnvelope;
     let authPubkey;
-    if (this.descriptor.auth) {
+    if (this.descriptor.auth && !unsignedPaid) {
       const auth = this.descriptor.auth;
       try {
         const result = await loggers.isolate.span(
@@ -23083,14 +23403,14 @@ var DVMServer = class {
       { capability: capabilityName, input: body.input, params: body.params, data: body.data },
       { stripAuthEnvelope: this.descriptor.auth !== void 0 }
     );
-    const authFingerprint = this.descriptor.auth ? requestFingerprint(
+    const authFingerprint = authEnvelope ? requestFingerprint(
       { capability: capabilityName, input: body.input, params: body.params, data: body.data },
       { stripAuthEnvelope: false }
     ) : void 0;
     const authorization = c.req.header("Authorization");
     const mppArtifact = authorization ? (await import("mppx")).Credential.extractPaymentScheme(authorization) : void 0;
     const attachedPayment = c.req.header("X-Cashu") ?? c.req.header("PAYMENT-SIGNATURE") ?? c.req.header("X-PAYMENT") ?? mppArtifact;
-    const hostingPaymentArtifactHash = attachedPayment ? createHash11("sha256").update(attachedPayment).digest("hex") : void 0;
+    const hostingPaymentArtifactHash = attachedPayment ? createHash12("sha256").update(attachedPayment).digest("hex") : void 0;
     if (!resumeOnly && this.opts.hostingControlInstance && hostingPaymentArtifactHash) {
       const priorId = await this.opts.hostingControlInstance.acceptedJobByPaymentArtifactHash(
         hostingPaymentArtifactHash
@@ -23172,9 +23492,11 @@ var DVMServer = class {
       }
       const skipPayment = devModeSkipsPaymentVerification(this.opts);
       let priceMsats = resumeOnly ? payment.paidMsats || void 0 : void 0;
+      let pricedAt;
       if (!resumeOnly && !skipPayment) {
         try {
-          priceMsats = await this.jobManager.currentPriceMsats(capabilityName);
+          if (cap.price !== void 0) pricedAt = await this.fxFetcher.fetch();
+          priceMsats = await this.jobManager.currentPriceMsats(capabilityName, pricedAt);
         } catch (err) {
           const fxErr = pickFxRateUnavailable(err);
           if (fxErr) return c.json({ error: fxErr }, 503);
@@ -23188,17 +23510,26 @@ var DVMServer = class {
           parsedInput,
           normalisedBody,
           authPubkey,
-          skipPayment
+          skipPayment,
+          unsignedPaid
         );
         if (dyn.error) return c.json(dyn.error.body, dyn.error.status);
         priceMsats = dyn.priceMsats;
         dynamicUpfront = dyn.upfront;
+        pricedAt = dyn.pricedAt;
       }
       const priceFiat = resumeOnly ? void 0 : resolvePriceFiat({
         price: typeof cap.price === "string" ? cap.price : void 0,
         priceMsats,
         dynamicUpfront
       });
+      if (unsignedPaid && !priceMsats) {
+        return buildAuthErrorResponse(
+          c,
+          this.unsignedRequestRefusal(c, cap.input, body, capabilityName),
+          this.publicOrigin
+        );
+      }
       if (!resumeOnly && creditEnvelope?.creditId) {
         await this.settleLightningFunding(authPubkey, creditEnvelope.creditId);
       }
@@ -23221,7 +23552,13 @@ var DVMServer = class {
         }
       }
       if (!skipPayment && !resumedAcceptedPayment) {
-        const railOpts = await this.railVerifyOpts(c);
+        const railOpts = unsignedPaid ? cashuOnlyRailOpts(await this.railVerifyOpts(c)) : await this.railVerifyOpts(c);
+        if (!this.descriptor.auth || unsignedPaid) {
+          railOpts.nut24 = {
+            mints: this.advertisedMints(),
+            previousRequiredMsats: this.previousPriceMsats(cap, dynamicUpfront, pricedAt)
+          };
+        }
         hostingPaymentMayHaveLanded = Boolean(
           creditEnvelope || railOpts.cashuToken || railOpts.x402Payment || railOpts.mppCredential
         );
@@ -23259,7 +23596,7 @@ var DVMServer = class {
             this.reportShortPayForfeit(err.detail.forfeit);
             if (err.detail.body.error === "replay_rejected") {
               const recovered = await this.recoverReplayedJob(c, {
-                requestId: err.detail.replayPaymentId ?? c.req.header("X-Cashu-Request-Id"),
+                requestId: err.detail.replayPaymentId,
                 fingerprint,
                 callerPubkey: authPubkey
               });
@@ -23287,15 +23624,17 @@ var DVMServer = class {
               }
             }
             if (!resumedAcceptedPayment) {
-              attachCreditMenu(
-                err.detail.body,
-                await this.creditMenu(this.creditCurrency(), authPubkey)
-              );
+              if (!unsignedPaid) {
+                attachCreditMenu(
+                  err.detail.body,
+                  await this.creditMenu(this.creditCurrency(), authPubkey)
+                );
+              }
               if (priceFiat) {
                 err.detail.body.price_micro = priceFiat.amountMicro;
                 err.detail.body.price_currency = priceFiat.currency;
               }
-              return buildPaymentErrorResponse(
+              const response2 = buildPaymentErrorResponse(
                 err.detail.body,
                 err.detail.mppChallenges,
                 err.detail.x402Requirements,
@@ -23305,6 +23644,11 @@ var DVMServer = class {
                 this.x402Support()?.exact,
                 err.detail.x402ErrorCode
               );
+              if (err.detail.cashuPaymentRequest) {
+                response2.headers.set("X-Cashu", err.detail.cashuPaymentRequest);
+                response2.headers.set("Cache-Control", "no-store");
+              }
+              return response2;
             }
           }
           throw err;
@@ -23388,7 +23732,7 @@ var DVMServer = class {
       }
       const isAnonymous = requesterId === "anonymous" || requesterId === "dev-anonymous";
       const jobToken = isAnonymous ? randomBytes5(32).toString("hex") : void 0;
-      const requesterTokenHash = jobToken ? createHash11("sha256").update(jobToken).digest("hex") : void 0;
+      const requesterTokenHash = jobToken ? createHash12("sha256").update(jobToken).digest("hex") : void 0;
       const job = jm.createJob(
         normalisedBody,
         requesterId,
@@ -23401,7 +23745,7 @@ var DVMServer = class {
           requestFingerprint: fingerprint,
           requesterPubkey: authPubkey,
           requestId: publicRequestId,
-          authRequestPath: this.descriptor.auth ? canonicalRequestPath(c.req.url) : void 0,
+          authRequestPath: authEnvelope ? canonicalRequestPath(c.req.url) : void 0,
           jobId
         }
       );
@@ -23497,15 +23841,16 @@ var DVMServer = class {
   }
   /**
    * Recover a lost paid response only for matching request fingerprint,
-   * authenticated pubkey and requester identity. A spent bearer token alone
-   * is not proof of request ownership.
+   * authenticated pubkey and requester identity. `requestId` must be the
+   * payment reference the rail bound the presented payment to; a spent bearer
+   * token alone is not proof of request ownership.
    */
   async recoverReplayedJob(c, opts) {
     if (!opts.requestId) return void 0;
     const prior = await this.jobManager.store.findJobByPaymentTxHash(opts.requestId);
     if (!prior) return void 0;
     const bodyMatches = prior.requestFingerprint !== void 0 && prior.requestFingerprint === opts.fingerprint;
-    const pubkeyMatches = this.descriptor.auth === void 0 || prior.requesterPubkey !== void 0 && prior.requesterPubkey === opts.callerPubkey;
+    const pubkeyMatches = this.descriptor.auth === void 0 || prior.requesterPubkey === opts.callerPubkey;
     const requesterMatches = prior.requesterId === c.get("requesterId");
     if (!bodyMatches || !pubkeyMatches || !requesterMatches) {
       diagnosticConsole.warn(
@@ -23638,16 +23983,17 @@ var DVMServer = class {
    * schema separately. Refuse invalid input/results, currency mismatch or missing
    * FX when payment needs a price (400/500/503 as classified below).
    */
-  async computeDynamicPrice(onQuote, parsedInput, body, callerPubkey, skipRateConversion = false) {
+  async computeDynamicPrice(onQuote, parsedInput, body, callerPubkey, skipRateConversion = false, unsigned2 = false) {
     let data = parsedInput;
     if (isZodSchema(onQuote.schema)) {
-      const parsed = onQuote.schema.safeParse(parsedInput);
+      const schema = unsigned2 ? unsignedInputSchema(onQuote.schema) ?? onQuote.schema : onQuote.schema;
+      const parsed = schema.safeParse(parsedInput);
       if (!parsed.success) {
         return {
           error: {
             body: {
               error: "quote_unavailable",
-              message: "DVM uses dynamic pricing but the job input does not satisfy onQuote.schema. Submit the same payload to /v1/quote to confirm pricing."
+              message: unsigned2 ? "DVM uses dynamic pricing but the unsigned job input does not satisfy onQuote.schema. Sign the request, or send input that matches the published schema." : "DVM uses dynamic pricing but the job input does not satisfy onQuote.schema. Submit the same payload to /v1/quote to confirm pricing."
             },
             status: 400
           }
@@ -23677,7 +24023,8 @@ var DVMServer = class {
       const priceMsats = fiatToSatsCeil(validated.upfront.amount, fxRateFor(fx, upfrontCurrency)) * 1e3;
       return {
         priceMsats,
-        upfront: { amount: validated.upfront.amount, currency: upfrontCurrency }
+        upfront: { amount: validated.upfront.amount, currency: upfrontCurrency },
+        pricedAt: fx
       };
     } catch (err) {
       if (err instanceof InvalidCurrencyError || err instanceof UnsupportedCurrencyError) {
@@ -23959,6 +24306,8 @@ var DVMServer = class {
         this.opts.devMode === true
       );
       if (contentErr2) return c.json({ error: "invalid_message", message: contentErr2 }, 400);
+      const railRefusal2 = this.unsignedJobRailRefusal(activeJob, body2);
+      if (railRefusal2) return railRefusal2;
       const inboundSeq2 = await jm.recordInboundPending(activeJob, body2.type, body2.content);
       const lockPubkeys2 = await this.resolveLockPubkeysForReceive();
       let unappliedCredit2;
@@ -24019,6 +24368,8 @@ var DVMServer = class {
     }
     const contentErr = validateMessageContent(body.type, body.content, this.opts.devMode === true);
     if (contentErr) return c.json({ error: "invalid_message", message: contentErr }, 400);
+    const railRefusal = this.unsignedJobRailRefusal(record, body);
+    if (railRefusal) return railRefusal;
     if (isStreamableJobStore(jm.store)) {
       record.messages = await jm.store.getMessages(id, 0);
       record.seq = Math.max(record.seq, ...record.messages.map((message) => message.seq));
@@ -24218,7 +24569,7 @@ function isJobOwner(c, job) {
   if (job.requesterTokenHash) {
     const token = c.req.header("X-Job-Token");
     if (!token) return false;
-    const provided = createHash11("sha256").update(token).digest("hex");
+    const provided = createHash12("sha256").update(token).digest("hex");
     return timingSafeEqualHex(provided, job.requesterTokenHash);
   }
   return c.get("requesterId") === job.requesterId;
@@ -24341,6 +24692,24 @@ function removeUnavailableContent(fields) {
     delete fields.payload_in;
   }
 }
+async function carriesNonCashuPayment(c) {
+  if (c.req.header("PAYMENT-SIGNATURE") || c.req.header("X-PAYMENT")) return true;
+  const authorization = c.req.header("Authorization");
+  if (!authorization) return false;
+  return Boolean((await import("mppx")).Credential.extractPaymentScheme(authorization));
+}
+function cashuOnlyRailOpts(opts) {
+  return {
+    ...opts,
+    x402Payment: void 0,
+    x402Config: void 0,
+    x402ExactSettlement: void 0,
+    x402ExactVersions: void 0,
+    x402BatchSettlement: void 0,
+    mppCredential: void 0,
+    mpp: void 0
+  };
+}
 function terminalResponseFields(job) {
   const fields = {};
   if (job.upfrontPayment !== void 0) fields.upfront_payment = job.upfrontPayment;