@dvmkit/sdk 0.2.0-rc.9 → 0.3.0-rc.9

package/dist/server/index.js

@@ -1,12 +1,9 @@
 import {
   PostgresReplayStore
-} from "../chunk-FT6HTUM4.js";
-import {
-  PostgresJobStore
-} from "../chunk-QP53RWAD.js";
+} from "../chunk-AJNFXR7J.js";
 import {
   PostgresKVStore
-} from "../chunk-JLXYOV4Y.js";
+} from "../chunk-V5ZRATJH.js";
 import {
   SSRFError,
   assertSafeUrl,
@@ -74,20 +71,24 @@ import {
   revenueReporterBannerState,
   seedLockPubkeyState,
   selectPrimaryCredit,
+  signHostingControl,
   stripCreditEnvelope,
   stripProtocolEnvelope,
   toCreditView,
   unknownRouteNotFound
-} from "../chunk-PCUQZDZA.js";
+} from "../chunk-LTAIBLS2.js";
 import {
   MemoryProcessedPaymentStore,
   PostgresProcessedPaymentStore,
   ProcessedPaymentReplayError
-} from "../chunk-QT4ONTST.js";
+} from "../chunk-XRLKGCAW.js";
 import "../chunk-BQ2NMWKE.js";
 import {
   MemoryCreditLedger
-} from "../chunk-PHHAYRQV.js";
+} from "../chunk-U5VNEALI.js";
+import {
+  PostgresJobStore
+} from "../chunk-HHTL3ZFT.js";
 import {
   SignedRequestError,
   createDefaultReplayStore,
@@ -96,12 +97,12 @@ import {
 } from "../chunk-H2MEFVH6.js";
 import {
   isStreamableJobStore
-} from "../chunk-JDT5LCJC.js";
+} from "../chunk-MD3H3BF7.js";
 import {
   generateEphemeralReceiptKey,
   isTestMintUrl,
   receiptPubkeyFromSecret
-} from "../chunk-KXCKFIJI.js";
+} from "../chunk-QX52F6IB.js";
 import {
   X402_DEFAULT_FACILITATOR,
   X402_DEFAULT_NETWORK,
@@ -110,7 +111,7 @@ import {
 } from "../chunk-Z4BNLUZF.js";
 import {
   IMPLICIT_CREDIT_TTL_MS
-} from "../chunk-5URG56JJ.js";
+} from "../chunk-A4CM2BD3.js";
 import {
   resolveRpcOverride
 } from "../chunk-MKI6OVW4.js";
@@ -121,7 +122,7 @@ import {
 } from "../chunk-KXZUCCEY.js";
 import {
   initLoggers
-} from "../chunk-XQXJKJ3P.js";
+} from "../chunk-YO56VCTQ.js";
 import "../chunk-66HGCPBU.js";
 import "../chunk-FUJ36YDV.js";
 import "../chunk-4A2RAKCW.js";
@@ -133,11 +134,11 @@ import {
   PostgresX402ChannelStorage,
   X402RelaySubmissionLockError,
   allocateDrawValue
-} from "../chunk-V7EVFLAK.js";
+} from "../chunk-2D75MNNG.js";
 import {
   SDK_INIT_ADVISORY_LOCK,
   withSdkInitLock
-} from "../chunk-S3XAHZQY.js";
+} from "../chunk-COYKJRMM.js";
 import {
   applyRetryToPool
 } from "../chunk-C3MTFLC6.js";
@@ -147,7 +148,7 @@ import {
   TEMPO_SETTLEMENT_DEFAULT_LOW_BALANCE_MICRO,
   TempoSettlementReadiness,
   resolveTempoNetwork
-} from "../chunk-KMZXTBLA.js";
+} from "../chunk-XZ7LW4S5.js";
 
 // src/sdk/server/cashu-env.ts
 async function resolveCashuOptsFromEnv(env, pool, cashuModeHint) {
@@ -221,6 +222,7 @@ async function resolveCashuOptsFromEnv(env, pool, cashuModeHint) {
           error: err instanceof Error ? err.message : String(err)
         })
       );
+      if (cashuMode === "p2pk-accumulator") throw err;
       db = void 0;
     }
   }
@@ -320,7 +322,6 @@ var PlatformLightningRailHealth = class {
   lastAttemptAtMs;
   inFlight;
   ceilingLoggedForMs;
-  /** Prime the signal during boot without making a menu request wait for it. */
   async refresh() {
     if (this.inFlight) return this.inFlight;
     this.lastAttemptAtMs = this.now();
@@ -332,7 +333,6 @@ var PlatformLightningRailHealth = class {
       this.inFlight = void 0;
     }
   }
-  /** Answer from cache and begin a non-blocking refresh once it is due. */
   available() {
     const nowMs = this.now();
     if (this.lastAttemptAtMs === void 0 || nowMs - this.lastAttemptAtMs >= this.refreshTtlMs) {
@@ -463,16 +463,10 @@ var LightningReceive = class _LightningReceive {
   permissionRefusal;
   railHealth;
   /**
-   * Validate the configured connection and build the receive leg, or return
-   * `undefined` when this DVM didn't configure one.
-   *
-   * **Throws on a credential that is wrong, degrades on one that is merely
-   * unreachable.** A wallet outage at boot must not stop a DVM whose other
-   * rails are fine — the menu simply omits `lightning` until a later probe
-   * succeeds. A connection that can spend, or one that can't state what it can
-   * do, is a different thing entirely: it is a standing money risk that no
-   * amount of retrying fixes, so it fails the boot loudly with the fix in the
-   * message.
+   * Return undefined when unconfigured. Permission/URI failures refuse construction with a
+   * corrective message; wallet transport failure constructs an unavailable receive leg so
+   * other rails can still boot. Recovery must validate method scope before advertising
+   * Lightning.
    */
   static async create(config) {
     const invoiceTtlSeconds = resolveInvoiceTtl(config.invoiceTtlSeconds);
@@ -528,26 +522,17 @@ var LightningReceive = class _LightningReceive {
     );
   }
   /**
-   * Whether `lightning` belongs on the funding menu right now.
-   *
-   * Reads the cached observation and never blocks; a stale one kicks off a
-   * background refresh and answers with what we last knew. Advertising a rail
-   * whose wallet is down would hand the caller an option that 402s on use —
-   * the §4 posture is to drop it and let the sale survive on the others.
+   * Answer from cached wallet and optional rail-health observations without blocking. A stale
+   * wallet observation starts a background refresh.
    */
   available() {
     if (Date.now() - this.checkedAtMs > HEALTH_TTL_MS) void this.refresh();
     return this.health === "healthy" && (this.railHealth?.available() ?? true);
   }
   /**
-   * Issue (or re-issue) the bolt11 funding `(creditId, fundId)`.
-   *
-   * The invoice is minted **for** the credit and amount named in the caller's
-   * signed body — that binding is the condition-3 commitment on this
-   * rail, and it is why no artifact hash rides the request: there is no
-   * caller-supplied artifact to hash. A re-poll returns the stored row rather
-   * than minting again; a second bolt11 for one `fund_id` would leave two
-   * payable invoices against a funding that can only be credited once.
+   * Return the stored invoice on retry: two payable bolt11s for one fund ID could charge
+   * twice while only one credits. Caller and amount are bound to the recorded credit/funding
+   * pair, without a caller-supplied artifact hash.
    */
   async issue(ledger, args) {
     const existing = await ledger.getInvoice({ creditId: args.creditId, fundId: args.fundId });
@@ -582,9 +567,8 @@ var LightningReceive = class _LightningReceive {
       fundId: args.fundId,
       callerPubkey: args.callerPubkey,
       currency: args.currency,
-      // Both amounts are pinned here and never recomputed at settle time: a
-      // rate that moved between issuance and payment must not change what the
-      // caller was quoted (the shape).
+      // Pin fiat and millisatoshi amounts at issue time; settlement does not reprice them
+      // after FX changes.
       amountMicro: args.amountMicro,
       amountMsats: created.amountMsats || args.amountMsats,
       paymentHash: created.paymentHash,
@@ -593,24 +577,9 @@ var LightningReceive = class _LightningReceive {
     });
   }
   /**
-   * Ask the wallet whether one payment hash is paid, and when.
-   *
-   * The operator's reconcile verb runs this before it credits anything. A
-   * `blocked` row implies payment — {@link applyOne} returns above the block
-   * classification when the lookup says unpaid — but that is *this fleet's
-   * belief, recorded possibly weeks ago*, and the verb it gates mints balance
-   * against it. One round trip turns the belief into a fact and recovers the
-   * true settlement instant for `settled_at`, which a blocked row never got to
-   * write.
-   *
-   * Unlike {@link settlePending} this **throws**: there is no request whose
-   * latency it protects, and crediting on an unverifiable wallet is exactly
-   * what it exists to prevent. `NOT_FOUND` is the one exception, and it is not
-   * an outage — it is the wallet saying it has never seen this hash, the same
-   * reading {@link applyOne} and the caller-side reconcile in `src/lib/nwc.ts`
-   * take. It comes back as `known: false` because the operator's repair for it
-   * ("you are pointed at a different wallet than the one that minted this")
-   * is not the repair for an unpaid invoice, and certainly not for a retry.
+   * Re-observe the wallet payment before an operator credits a blocked invoice and recover
+   * its settlement instant. Unlike settlePending, lookup failures throw. NOT_FOUND returns
+   * known:false, distinguishing the wrong wallet/unknown hash from an unpaid known invoice.
    */
   async lookupSettlement(paymentHash) {
     try {
@@ -627,23 +596,12 @@ var LightningReceive = class _LightningReceive {
     }
   }
   /**
-   * Consult the wallet about this caller's outstanding invoices and credit the
-   * ones that settled — the pull half of pull-based crediting.
+   * Read pending invoices locally, then check at most MAX_SETTLE_CHECKS on bounded wallet
+   * deadlines. Log failures without throwing into the request.
    *
-   * The pending rows are read locally first, so the common case (nothing
-   * outstanding) costs one indexed SELECT and no network at all. Bounded to
-   * {@link MAX_SETTLE_CHECKS} invoices on a short deadline, and **never throws
-   * into the request**: a wallet failure here means the caller's balance is
-   * merely not updated yet, which the ordinary `insufficient_credit` path
-   * already states honestly.
-   *
-   * **Each invoice gets its own failure boundary.** The sweep window is a few
-   * rows wide, so a row that fails on its own terms — a `fund_id` the caller
-   * reused on another rail, a credit someone else opened first — must not take
-   * the rest of the pass down with it: the next invoice in the window may be
-   * the paid one, and it would never be looked up. Only a transport failure
-   * ends the pass early, because there the wallet itself is gone and the
-   * remaining lookups would just spend the caller's latency confirming it.
+   * An invoice-specific failure must not suppress payable siblings; wallet transport failure
+   * ends the pass. Deterministic refusals retire that row as blocked for operator repair,
+   * while transient failures remain pending.
    */
   async settlePending(ledger, args) {
     let pending;
@@ -683,13 +641,6 @@ var LightningReceive = class _LightningReceive {
     }
     return settled;
   }
-  /**
-   * One invoice's settlement check. Returns the applied settlement, or
-   * `undefined` when nothing changed (still unpaid, or retired unpaid).
-   *
-   * Throws whatever the wallet or the ledger threw — classifying that is
-   * {@link retireOrLog}'s job, so this stays one invoice's happy path.
-   */
   async applyOne(ledger, backend, invoice, opts) {
     let status;
     try {
@@ -740,18 +691,9 @@ var LightningReceive = class _LightningReceive {
     });
   }
   /**
-   * Decide what one invoice's failure means, and retire the invoice when the
-   * answer is "this can never succeed".
-   *
-   * The split that matters is permanent-versus-transient, because it decides
-   * whether the row keeps a slot in the sweep window. A transient failure — the
-   * database blinked, the wallet answered oddly — leaves it `pending` and the
-   * caller's next request retries it. A **permanent** one means the ledger will
-   * refuse this invoice identically forever, so leaving it pending costs a
-   * `lookup_invoice` on every subsequent request and, at
-   * {@link MAX_SETTLE_CHECKS} of them, fills the window so a genuinely payable
-   * invoice behind them is never even looked up. Those get `blocked`, which
-   * drops them out of the sweep and hands the operator the payment hash.
+   * Retire a deterministic uncreditable payment as blocked so it no longer occupies the
+   * bounded sweep window. Transient failures stay pending for a later request; report the
+   * payment hash for operator repair.
    */
   async retireOrLog(ledger, invoice, err) {
     const reason = await this.blockingReason(ledger, invoice, err);
@@ -784,21 +726,10 @@ var LightningReceive = class _LightningReceive {
     );
   }
   /**
-   * The reason this invoice can never be credited, or `undefined` if the
-   * failure was transient.
-   *
-   * Every code here is decided by state a retry cannot move — a row the ledger
-   * has already committed (a `credit_fundings` entry at this
-   * `(credit_id, fund_id)`, or a `credits` row whose owner, denomination or
-   * rail disagrees with the invoice), or the basis this module rebuilds
-   * identically from the invoice row on every pass. None of them is a race.
-   *
-   * `funding_replayed` is the one that needs a second read to classify.
-   * Usually it *is* benign — a concurrent check won the race and the money is
-   * credited either way — but the key is `(credit_id, fund_id)` and `fund_id`
-   * is **caller-chosen**: reuse it on cashu or x402 after this bolt11 was
-   * minted and the row that collided is a different payment entirely, so the
-   * sats this invoice received have nowhere to land.
+   * Classify funding_replayed by reading the existing funding’s rail. A Lightning row can
+   * represent a concurrent applied check; another rail at this caller-chosen key is a
+   * different payment, leaving the invoice’s sats uncredited. A failed diagnostic read
+   * remains transient, never a guessed permanent refusal.
    */
   async blockingReason(ledger, invoice, err) {
     if (!(err instanceof CreditLedgerError)) return void 0;
@@ -834,7 +765,6 @@ var LightningReceive = class _LightningReceive {
       throw err;
     }
   }
-  /** Record activity without letting it promote an unvalidated connection. */
   noteOperationOk() {
     if (this.health !== "healthy") return;
     this.checkedAtMs = Date.now();
@@ -1027,7 +957,6 @@ var PostgresTempoSettlementReadinessStore = class {
   address;
   token;
   now;
-  /** Create the shared latch table under the SDK-wide boot migration lock. */
   async init() {
     await withSdkInitLock(this.pool, async () => {
       await this.pool.query(`
@@ -1170,6 +1099,12 @@ function createDVMHost(opts = {}) {
       )
     );
     const envMaybe = env;
+    const hostingSecret = envMaybe.DVMKIT_HOSTING_CONTROL_SECRET;
+    const hostingScope = envMaybe.DVMKIT_HOSTING_CONTROL_SCOPE;
+    if (!opts.hostingControl && Boolean(hostingSecret) !== Boolean(hostingScope)) {
+      throw new Error("Hosting control requires both DVMKIT_HOSTING_CONTROL_SECRET and DVMKIT_HOSTING_CONTROL_SCOPE");
+    }
+    const hostingControl = opts.hostingControl ?? (hostingSecret && hostingScope ? { secret: hostingSecret, scope: hostingScope } : void 0);
     const port = serveOpts?.port ?? opts.port ?? Number(envMaybe.PORT ?? "8080");
     const bootStart = Date.now();
     const phaseMarks = [];
@@ -1199,13 +1134,13 @@ function createDVMHost(opts = {}) {
       });
       applyRetryToPool(pool, "dvm-host");
       pgPool = pool;
-      const { PostgresJobStore: PostgresJobStore2 } = await import("../postgres-job-store-OGQ6IT4U.js");
+      const { PostgresJobStore: PostgresJobStore2 } = await import("../postgres-job-store-VE2JRUEC.js");
       const pgJobStore = new PostgresJobStore2(pool);
       pendingInits.push(pgJobStore.init(), pgJobStore.initStreaming());
       jobStore = pgJobStore;
       pgStreamStore = pgJobStore;
       if (!opts.store) {
-        const { PostgresKVStore: PostgresKVStore2 } = await import("../postgres-kv-store-D5E2EZ24.js");
+        const { PostgresKVStore: PostgresKVStore2 } = await import("../postgres-kv-store-DXGTKXLU.js");
         const pgKvStore = new PostgresKVStore2(pool);
         pendingInits.push(pgKvStore.init());
         store = pgKvStore;
@@ -1290,11 +1225,11 @@ ${config.facilitatorAuth?.keyId ?? ""}`;
     let tempoChargeBackend = "user-supplied";
     const mppTempoRecipient = envMaybe.DVMKIT_TEMPO_RECIPIENT;
     if (!mpp && mppTempoRecipient) {
-      const { createMppFromOpts, createDualKeyMppxFromOpts, parseMppMethodsAllowlist } = await import("../mpp-setup-IOJBF7DB.js");
+      const { createMppFromOpts, createDualKeyMppxFromOpts, parseMppMethodsAllowlist } = await import("../mpp-setup-MPP3ST5X.js");
       tempoChargeBackend = pgPool ? "postgres" : "memory";
       let tempoCharge;
       if (pgPool) {
-        const { PostgresTempoChargeStore } = await import("../tempo-charge-store-76TDAF34.js");
+        const { PostgresTempoChargeStore } = await import("../tempo-charge-store-SDTUNTKA.js");
         const chargeStore = new PostgresTempoChargeStore(pgPool);
         pendingInits.push(chargeStore.init());
         tempoCharge = { store: chargeStore };
@@ -1313,7 +1248,7 @@ ${config.facilitatorAuth?.keyId ?? ""}`;
           { createPublicClient, createWalletClient, erc20Abi, http },
           { tempo: tempoMainnet, tempoModerato }
         ] = await Promise.all([
-          import("../tempo-session-store-2JNOKJGX.js"),
+          import("../tempo-session-store-WF3VZXNF.js"),
           import("viem/accounts"),
           import("viem"),
           import("viem/chains")
@@ -1414,7 +1349,7 @@ ${config.facilitatorAuth?.keyId ?? ""}`;
           applyMppSecretRotation,
           loadMppSecretState,
           DEFAULT_ROTATION_WINDOW_MS
-        } = await import("../mpp-secret-state-WNAQQ6K4.js");
+        } = await import("../mpp-secret-state-B5GCILVH.js");
         await initMppSecretStateTable(pgPool);
         const rotation = await applyMppSecretRotation(
           pgPool,
@@ -1454,7 +1389,7 @@ ${config.facilitatorAuth?.keyId ?? ""}`;
     assertReceiptIdentity(envMaybe, opts.builder, receiptKey, cashuOpts.dvmId, opts.devMode);
     let sharedPgReplayStore;
     if (pgPool) {
-      const { PostgresReplayStore: PostgresReplayStore2 } = await import("../postgres-replay-store-IZFLTTAC.js");
+      const { PostgresReplayStore: PostgresReplayStore2 } = await import("../postgres-replay-store-ZF4JNZOW.js");
       const store2 = new PostgresReplayStore2(pgPool);
       pendingInits.push(store2.init());
       sharedPgReplayStore = store2;
@@ -1482,24 +1417,24 @@ ${config.facilitatorAuth?.keyId ?? ""}`;
     }
     let sharedPgConsumedStore;
     if (pgPool) {
-      const { PostgresConsumedCredentialStore } = await import("../postgres-consumed-credential-store-ISRHBMOU.js");
+      const { PostgresConsumedCredentialStore } = await import("../postgres-consumed-credential-store-6N2V5MJN.js");
       const consumedStore = new PostgresConsumedCredentialStore(pgPool);
       pendingInits.push(consumedStore.init());
       sharedPgConsumedStore = consumedStore;
     }
     if (pgPool) {
-      const { CreditLedger: CreditLedger2 } = await import("../credit-ledger-5ZEJRI46.js");
+      const { CreditLedger: CreditLedger2 } = await import("../credit-ledger-MHA652TV.js");
       const pgLedger = new CreditLedger2(pgPool, tempoSessionStore);
       pendingInits.push(pgLedger.init());
       creditLedger = pgLedger;
-      const { PostgresProcessedPaymentStore: PostgresProcessedPaymentStore2 } = await import("../processed-payment-store-FIDI3RNH.js");
+      const { PostgresProcessedPaymentStore: PostgresProcessedPaymentStore2 } = await import("../processed-payment-store-GKMAWOM3.js");
       const pgProcessed = new PostgresProcessedPaymentStore2(pgPool);
       pendingInits.push(pgProcessed.init());
       processedPayments = pgProcessed;
     } else {
-      const { MemoryCreditLedger: MemoryCreditLedger2 } = await import("../memory-credit-ledger-ZOH6C3N4.js");
+      const { MemoryCreditLedger: MemoryCreditLedger2 } = await import("../memory-credit-ledger-BYBATRN3.js");
       creditLedger = disposableCashu?.ledger ?? new MemoryCreditLedger2();
-      const { MemoryProcessedPaymentStore: MemoryProcessedPaymentStore2 } = await import("../processed-payment-store-FIDI3RNH.js");
+      const { MemoryProcessedPaymentStore: MemoryProcessedPaymentStore2 } = await import("../processed-payment-store-GKMAWOM3.js");
       processedPayments = new MemoryProcessedPaymentStore2();
     }
     await Promise.all(pendingInits);
@@ -1619,7 +1554,8 @@ ${config.facilitatorAuth?.keyId ?? ""}`;
         lockPubkey: cashuOpts.lockPubkey,
         lockPubkeyGraceSeconds: cashuOpts.lockPubkeyGraceSeconds,
         canonicalDvmId: cashuOpts.canonicalDvmId,
-        db: cashuOpts.db,
+        db: hostingControl ? pgPool : cashuOpts.db,
+        hostingControl,
         dvmId: cashuOpts.dvmId,
         failFast,
         mintHealthTracker: opts.mintHealthTracker,
@@ -2188,6 +2124,7 @@ export {
   secp256k1Auth,
   selectPrimaryCredit,
   serve,
+  signHostingControl,
   signedRequestInput,
   signedRequestStatementHeader,
   stripCreditEnvelope,