@dvmkit/sdk 0.2.0-rc.9 → 0.3.0-rc.9

package/dist/{chunk-PCUQZDZA.js → chunk-LTAIBLS2.js}

@@ -1,7 +1,7 @@
 import {
   MemoryProcessedPaymentStore,
   ProcessedPaymentReplayError
-} from "./chunk-QT4ONTST.js";
+} from "./chunk-XRLKGCAW.js";
 import {
   createX402FacilitatorAuthHeaders,
   createX402FacilitatorClient,
@@ -10,7 +10,10 @@ import {
 } from "./chunk-BQ2NMWKE.js";
 import {
   MemoryCreditLedger
-} from "./chunk-PHHAYRQV.js";
+} from "./chunk-U5VNEALI.js";
+import {
+  PostgresJobStore
+} from "./chunk-HHTL3ZFT.js";
 import {
   SIGNED_ENVELOPE_FIELDS,
   SignedRequestError,
@@ -35,7 +38,7 @@ import {
   localMessage,
   providerMessage,
   toJobRecord
-} from "./chunk-JDT5LCJC.js";
+} from "./chunk-MD3H3BF7.js";
 import {
   ADMIN_AUTH_CLOCK_SKEW_SECONDS,
   ADMIN_AUTH_NONCE_TTL_SECONDS,
@@ -60,7 +63,7 @@ import {
   toLockPubkey,
   verifyCashuToken,
   verifyChallenge
-} from "./chunk-KXCKFIJI.js";
+} from "./chunk-QX52F6IB.js";
 import {
   X402_BATCH_SETTLEMENT_SCHEME,
   X402_DEFAULT_FACILITATOR,
@@ -83,7 +86,7 @@ import {
   msatsToUsd,
   msatsToUsdc,
   usdcToMsats
-} from "./chunk-5URG56JJ.js";
+} from "./chunk-A4CM2BD3.js";
 import {
   resolveRpcOverride
 } from "./chunk-MKI6OVW4.js";
@@ -100,7 +103,7 @@ import {
   pinDimension,
   withSpan,
   withTraceContext
-} from "./chunk-XQXJKJ3P.js";
+} from "./chunk-YO56VCTQ.js";
 import {
   FxRateUnavailableError,
   InvalidCurrencyError,
@@ -130,10 +133,10 @@ import {
   isNonChannelBitcoinRail,
   netOwedSats,
   x402SettlementPending
-} from "./chunk-V7EVFLAK.js";
+} from "./chunk-2D75MNNG.js";
 import {
   withSdkInitLock
-} from "./chunk-S3XAHZQY.js";
+} from "./chunk-COYKJRMM.js";
 import {
   withPostgresRecoveryContext
 } from "./chunk-C3MTFLC6.js";
@@ -141,7 +144,7 @@ import {
   advertisedMethods,
   challengeMeta,
   isTempoInsufficientFundsError
-} from "./chunk-KMZXTBLA.js";
+} from "./chunk-XZ7LW4S5.js";
 
 // src/sdk/server/lock-pubkey-store.ts
 async function initLockPubkeyTable(db) {
@@ -881,16 +884,13 @@ async function buildCreditMenu(args) {
     ttl_ms: args.config.ttlSeconds * 1e3,
     currency,
     funding,
-    // Rendered when either half has something to say: a DVM configured for
-    // sessions only would otherwise lose the whole block the moment the gate
-    // closed, taking its capability signal with it.
+    // Keep withheld Tempo capability discoverable even when no method is currently offered.
     ...(tempoMethods.length > 0 || tempoWithheld.length > 0) && {
       tempo: {
         methods: tempoMethods,
         ...tempoWithheld.length > 0 && { withheld: tempoWithheld }
       }
     },
-    // Tied to the rail's own presence, the way `lightning_min_micro` is below:
     // a builder who overrides `paymentMethods` can drop x402 from `funding`
     // while the rail stays wired, and terms for a rail the menu doesn't offer
     // are the same misadvertisement in the other direction.
@@ -3651,7 +3651,7 @@ async function verifyUpfrontPayment(opts) {
           x402Requirements
         });
       }
-      const { verifyX402Payment } = await import("./x402-7S2EFINY.js");
+      const { verifyX402Payment } = await import("./x402-CI6PSHNO.js");
       const receipt = await verifyX402Payment(
         x402Payment,
         x402Config,
@@ -4585,7 +4585,7 @@ async function verifyIncomingPayment(body, opts, snapshot) {
           snapshot
         });
       }
-      const { verifyX402Payment } = await import("./x402-7S2EFINY.js");
+      const { verifyX402Payment } = await import("./x402-CI6PSHNO.js");
       const receipt = await verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -5002,7 +5002,7 @@ async function processIncomingPayment(job, body, opts) {
     try {
       const requiredMsats = job.pendingPaymentMsats ?? 0;
       const requiredUsdcMicro = job.pendingX402AmountUsdcMicro !== void 0 ? BigInt(job.pendingX402AmountUsdcMicro) : BigInt(msatsToUsdc(requiredMsats, rate));
-      const { verifyX402Payment } = await import("./x402-7S2EFINY.js");
+      const { verifyX402Payment } = await import("./x402-CI6PSHNO.js");
       const receipt = await verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -6691,14 +6691,8 @@ var CREDIT_REQUEST_SCHEMA = z.object({
     /** Client-generated idempotency key — the same id polls/collects one drain. */
     drain_id: z.string().min(1),
     /**
-     * Payout rail. Required on the first request; optional on a poll.
-     *
-     * Deliberately a bare string rather than the `DrainMethod` enum, so a
-     * rail this build does not carry is answered by `validateDrainTarget`
-     * with a typed `drain_method_unsupported` naming the rails that do
-     * work — not by a Zod parse failure that says only "invalid enum". The
-     * caller of a removed rail (`lightning`) and the caller of a
-     * typo deserve the same actionable refusal.
+     * Required on a fresh drain, optional on poll. Keep this a string so an unsupported
+     * rail receives its specific typed refusal before payout-shape validation.
      */
     method: z.string().min(1).optional(),
     /**
@@ -6765,6 +6759,18 @@ async function handleCreditRequest(c, deps) {
       await deps.settleLightning(callerPubkey, body.credit_id);
       return handleDrain(c, deps, { callerPubkey, body, envelope });
     case "fund":
+      if (deps.withFundingAdmission && body.fund) {
+        const creditId = body.credit_id ?? derivedFundCreditId(callerPubkey, body.fund.fund_id);
+        const [prior, invoice] = await Promise.all([
+          deps.ledger.getFunding({ creditId, fundId: body.fund.fund_id }),
+          body.fund.method === "lightning" ? deps.ledger.getInvoice({ creditId, fundId: body.fund.fund_id }) : Promise.resolve(void 0)
+        ]);
+        const priorCredit = prior ? await deps.ledger.get(creditId) : void 0;
+        if (priorCredit?.callerPubkey === callerPubkey || invoice?.callerPubkey === callerPubkey) {
+          return handleFund(c, deps, { callerPubkey, body, envelope, menu });
+        }
+        return deps.withFundingAdmission(c, body, () => handleFund(c, deps, { callerPubkey, body, envelope, menu }));
+      }
       return handleFund(c, deps, { callerPubkey, body, envelope, menu });
   }
 }
@@ -6824,17 +6830,12 @@ async function handleBalance(c, deps, args) {
   const primary = pickPrimary(all, args.menu.currency);
   return c.json({
     op: "balance",
-    // Expired credits are included: expiry ends spending, never ownership
-    // (the caller-ownership contract), so stranded value must stay visible to whoever owns it.
+    // Keep expired credit records visible. Nominal expiry alone does not release ownership;
+    // an expiry sweep can later zero the undrawn balance.
     credits: all.map(
       (credit) => creditBody(credit, pendingChannels.has(credit.tempoChannelId ?? ""))
     ),
     ...primary ? { credit: creditBody(primary, pendingChannels.has(primary.tempoChannelId ?? "")) } : {},
-    // the funding menu the quote and 402 surfaces already advertise,
-    // echoed here so one read answers "what do I hold, and what may I add".
-    // Under the key `menu`, not `credit` — that one is the credit projection on
-    // this route. Carried without the caller echo fields: `credits[]` above says
-    // the same thing in more detail, so `deps.menu()` is called without a pubkey.
     menu: args.menu
   });
 }
@@ -7113,11 +7114,8 @@ async function completeTempoDrain(c, deps, record, expectedChannelId, credit) {
       resourcePath: c.req.path,
       action: "close",
       expectedChannelId,
-      // The close intent is re-asserted from inside the verifier, once the
-      // credential is bound to this credit's own channel and before anything
-      // broadcasts. Run above the call instead and a credential
-      // signed for another channel touches the reservation on its way to a
-      // refusal that was never going to close anything.
+      // Reassert the intent only after the verifier binds the credential to this channel, and
+      // before broadcast. A wrong-channel signature cannot create or cancel its close intent.
       onBound: async () => {
         await beginClose(expectedChannelId, record.drainId);
         recoveryVersion = await deps.tempoSettlementReadiness?.captureRecoveryVersion();
@@ -7419,9 +7417,6 @@ async function handleX402ChannelDrain(c, deps, args) {
       amount: "0",
       operation: "refund",
       effectId: `${args.credit.creditId}:${args.drainId}`,
-      // The voucher the caller presents is what actually gets revoked and paid,
-      // so the settlement layer refuses one signed for any other channel before
-      // it touches anything.
       expectedChannelId: channelId,
       refundBoundNative,
       commit: async (_funding, tx) => {
@@ -7640,12 +7635,9 @@ function drainBody(record) {
     status: record.status,
     amount_micro: record.amountMicro,
     currency: record.currency,
-    // The in-kind obligation, where there is one: a Bitcoin
-    // reclaim returns the deposited sats pro rata, at the rate each funding
-    // landed at, so this figure was fixed when the reclaim was requested and
-    // does not move with the market. Published beside the fiat one rather than
-    // instead of it — the fiat figure is what the caller's balance was
-    // denominated in, and both are things an agent relays.
+    // Fixed in-kind Bitcoin refund obligation after the delivery reserve. It reflects the
+    // funding lots remaining at request time; null means no whole-balance in-kind price was
+    // available.
     ...record.owedSats !== null ? { owed_sats: record.owedSats } : {},
     ledger_seq: record.ledgerSeq,
     created_at: record.createdAt,
@@ -7659,17 +7651,7 @@ function drainCopy(record) {
     case "pending":
       if (record.method === "cashu") {
         return {
-          display: record.owedSats === null ? "The refund is approved and being prepared. The balance is already set aside for you." : (
-            // Named because it is the obligation, and because it is
-            // fixed: a Bitcoin refund returns the share of the Bitcoin you
-            // deposited that you never spent, so it does not move if the
-            // price does before you collect it. The mint's own
-            // redemption charge is named rather than glossed — it is a sat
-            // or two at a fee-charging mint and nothing at a free one, and
-            // a figure an agent relays to a human should not be a promise
-            // that lands short.
-            `The refund is approved and being prepared: ${record.owedSats} sats, the share of the Bitcoin you deposited that you haven't spent, less whatever the mint charges to hand it over. That figure won't move while you wait, whatever the price does.`
-          ),
+          display: record.owedSats === null ? "The refund is approved and being prepared. The balance is already set aside for you." : `The refund is approved and being prepared: ${record.owedSats} sats, the share of the Bitcoin you deposited that you haven't spent, less whatever the mint charges to hand it over. That figure won't move while you wait, whatever the price does.`,
           hint: "Poll this op with the same drain_id until a token appears. Preparation can be delayed (e.g. the mint is temporarily down) \u2014 the refund stays owed to you either way."
         };
       }
@@ -7795,11 +7777,6 @@ async function handleFund(c, deps, args) {
     fundId: fund.fund_id,
     amountMicro: fund.amount_micro,
     menu,
-    // Lightning and MPP name their rail in the signed body. Header-attached
-    // Cashu and x402 are discriminated by `verifyUpfrontPayment`, which still
-    // refuses their mismatches before money moves. Lightning must be checked
-    // here because past this point the bolt11 is minted and payable; MPP is
-    // checked here so discovery never advertises the wrong Tempo instrument.
     rail: fund.method,
     tempoIntent: fund.method === "tempo" ? fund.intent : void 0
   });
@@ -8090,9 +8067,8 @@ function lightningInvoiceBlock(invoice) {
       invoice: invoice.bolt11,
       payment_hash: invoice.paymentHash,
       amount_msats: invoice.amountMsats,
-      // Named for its unit, like every other timestamp an agent reads off this
-      // API (`ttl_ms`, `expiry_ms`): bolt11 expiries are conventionally quoted
-      // in seconds, and a bare `expires_at` invites a reader to assume that.
+      // Wire timestamp is milliseconds; bolt11 lifetimes are conventionally expressed in
+      // seconds.
       expires_at_ms: invoice.expiresAt
     }
   };
@@ -8323,26 +8299,13 @@ var DRAIN_CONFLICT_COPY = {
     retryable: true,
     drainRegistered: false
   },
-  // Deliberately rail-neutral: `refundFloorEvidence` is one floor over both
-  // channel rails, and two doors with two answers about one shortfall is the
-  // drift consolidating it was meant to prevent. Tempo answers its
-  // own through `tempoFloorRefusal`, which reaches the same conclusion a step
-  // earlier and adds the one rail-specific fact — its channel is already closed.
   refund_floor: {
     display: "The refund reached the chain, but it paid less than the balance this service had recorded, so nothing was booked here. Your on-chain refund arrived; the difference has to be reconciled by the service operator.",
     hint: ({ creditId, drainId }) => `Report drain ${drainId} on credit ${creditId} to the service operator \u2014 only they can reconcile the difference. Retrying this drain, or requesting a new drain_id, lands here again.`,
-    // Terminal for the caller, unlike the two above: no amount of waiting or
-    // re-signing changes what the chain already paid.
     retryable: false,
-    // True even though the ledger transaction that would have written the drain
-    // row rolled back around this refusal. The wedged settlement row is recorded
-    // outside that transaction and holds this drain id as its
-    // `effect_id`, which is the id `X402SettlementRepair.reconcile` books the
-    // drain under — so the caller has to keep it. Dropping it mints a fresh one
-    // that the wedged-channel gate refuses as `settlement_pending` anyway, and
-    // re-presenting *this* id is that gate's own documented exemption. Tempo
-    // reaches the same `true` one artifact earlier, off a `credit_drains` row
-    // its close-intent reservation already committed.
+    // The settlement evidence survives outside the rolled-back ledger transaction. Keep
+    // drain_registered:true so the caller retains this effect ID for repair even when no
+    // drain row committed.
     drainRegistered: true
   }
 };
@@ -8388,8 +8351,6 @@ function drainLedgerErrorResponse(error, creditId, drainId) {
       message: error.message,
       display: copy?.display,
       hint: copy?.hint({ creditId, drainId }),
-      // An unclassified conflict keeps the duplicate-payout copy's own
-      // `retryable`, and the id it was never told anything about.
       retryable: copy?.retryable,
       extra: { drain_registered: copy?.drainRegistered ?? false }
     });
@@ -8440,8 +8401,8 @@ function creditBody(credit, reconciliationPending = false) {
     remaining_micro: credit.availableMicro,
     expiry_ms: credit.expiryMs,
     expired: credit.expired,
-    // Reclaimable via op "drain" — true whenever spendable-or-
-    // expired value remains. Expiry ends spending, never ownership.
+    // Nominal expiry does not itself reclaim ownership; a committed sweep can remove undrawn
+    // value.
     drainable: credit.status === "active" && credit.availableMicro > 0,
     ...reconciliationPending && { reconciliation_pending: true },
     ledger_seq: credit.lastLedgerSeq
@@ -8975,11 +8936,9 @@ var X402ExactSettlementServer = class {
     }
     return this.finalize(intent, args.btcUsdRate, args.commit);
   }
-  /** Read the operator queue. */
   list(args) {
     return this.opts.store.list(args);
   }
-  /** Read durable attempt evidence for one intent. */
   attempts(dvmId, intentId) {
     return this.opts.store.attempts(dvmId, intentId);
   }
@@ -9127,6 +9086,269 @@ function safeError(err) {
   return "settlement_transport_error";
 }
 
+// src/sdk/server/hosting-control.ts
+import { createHmac, timingSafeEqual } from "crypto";
+function signHostingControl(secret, command) {
+  return createHmac("sha256", secret).update(JSON.stringify([
+    "dvmkit-hosting-v1",
+    command.action,
+    command.scope,
+    command.dvmId,
+    command.generation ?? null,
+    command.deadlineMs ?? null,
+    command.timestampMs,
+    command.nonce
+  ])).digest("hex");
+}
+var HostingControl = class {
+  constructor(pool, dvmId, config) {
+    this.pool = pool;
+    this.dvmId = dvmId;
+    this.config = config;
+    if (Buffer.byteLength(config.secret) < 32 || !config.scope) {
+      throw new Error("Hosting control requires a 32-byte secret and a non-empty scope");
+    }
+  }
+  pool;
+  dvmId;
+  config;
+  async init() {
+    await withSdkInitLock(this.pool, async () => {
+      await this.pool.query(`
+      CREATE TABLE IF NOT EXISTS sdk_hosting_control (
+        dvm_id TEXT NOT NULL, scope TEXT NOT NULL, state TEXT NOT NULL,
+        generation BIGINT NOT NULL, deadline_ms BIGINT,
+        PRIMARY KEY (dvm_id, scope)
+      );
+      CREATE TABLE IF NOT EXISTS sdk_hosting_nonces (
+        dvm_id TEXT NOT NULL, scope TEXT NOT NULL, nonce TEXT NOT NULL,
+        created_at_ms BIGINT NOT NULL,
+        PRIMARY KEY (dvm_id, scope, nonce)
+      );
+      CREATE TABLE IF NOT EXISTS sdk_hosting_admissions (
+        id TEXT PRIMARY KEY, dvm_id TEXT NOT NULL, scope TEXT NOT NULL,
+        job_id TEXT NOT NULL, admitted_at_ms BIGINT NOT NULL,
+        outcome TEXT NOT NULL DEFAULT 'pending', drain_deadline_ms BIGINT,
+        credit_id TEXT, fund_id TEXT, payment_artifact_hash TEXT
+      );
+      ALTER TABLE sdk_hosting_admissions ADD COLUMN IF NOT EXISTS drain_deadline_ms BIGINT;
+      ALTER TABLE sdk_hosting_admissions ADD COLUMN IF NOT EXISTS credit_id TEXT;
+      ALTER TABLE sdk_hosting_admissions ADD COLUMN IF NOT EXISTS fund_id TEXT;
+      ALTER TABLE sdk_hosting_admissions ADD COLUMN IF NOT EXISTS payment_artifact_hash TEXT;
+      CREATE INDEX IF NOT EXISTS sdk_hosting_admissions_pending
+        ON sdk_hosting_admissions (dvm_id, scope) WHERE outcome = 'pending';
+      CREATE INDEX IF NOT EXISTS sdk_hosting_admissions_unresolved
+        ON sdk_hosting_admissions (dvm_id, scope) WHERE outcome = 'unresolved';
+      CREATE INDEX IF NOT EXISTS sdk_hosting_admissions_artifact
+        ON sdk_hosting_admissions (dvm_id, scope, payment_artifact_hash)
+        WHERE payment_artifact_hash IS NOT NULL;
+      CREATE INDEX IF NOT EXISTS sdk_hosting_admissions_job
+        ON sdk_hosting_admissions (dvm_id, job_id, scope);
+      CREATE INDEX IF NOT EXISTS sdk_hosting_nonces_age ON sdk_hosting_nonces (created_at_ms);
+      `);
+      await this.pool.query(
+        `INSERT INTO sdk_hosting_control (dvm_id, scope, state, generation)
+         VALUES ($1, $2, 'accepting', 0) ON CONFLICT DO NOTHING`,
+        [this.dvmId, this.config.scope]
+      );
+    });
+  }
+  async authorize(command, signature) {
+    if (command.scope !== this.config.scope || command.dvmId !== this.dvmId || !Number.isSafeInteger(command.timestampMs) || Math.abs(Date.now() - command.timestampMs) > 3e5 || typeof command.nonce !== "string" || !/^[A-Za-z0-9_-]{16,128}$/.test(command.nonce) || !signature || !/^[0-9a-f]{64}$/i.test(signature)) return false;
+    const actual = Buffer.from(signature, "hex");
+    const expected = Buffer.from(signHostingControl(this.config.secret, command), "hex");
+    if (!timingSafeEqual(actual, expected)) return false;
+    const result = await this.pool.query(
+      `INSERT INTO sdk_hosting_nonces (dvm_id, scope, nonce, created_at_ms)
+       VALUES ($1, $2, $3, $4) ON CONFLICT DO NOTHING`,
+      [this.dvmId, this.config.scope, command.nonce, Date.now()]
+    );
+    await this.pool.query("DELETE FROM sdk_hosting_nonces WHERE created_at_ms < $1", [Date.now() - 6e5]);
+    return result.rowCount === 1;
+  }
+  async admit(id, jobId, details) {
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      const { rows } = await client.query(
+        `SELECT state FROM sdk_hosting_control WHERE dvm_id=$1 AND scope=$2 FOR UPDATE`,
+        [this.dvmId, this.config.scope]
+      );
+      if (rows[0]?.state !== "accepting") {
+        await client.query("ROLLBACK");
+        return false;
+      }
+      await client.query(
+        `INSERT INTO sdk_hosting_admissions
+         (id, dvm_id, scope, job_id, admitted_at_ms, credit_id, fund_id, payment_artifact_hash)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`,
+        [
+          id,
+          this.dvmId,
+          this.config.scope,
+          jobId,
+          Date.now(),
+          details?.creditId ?? null,
+          details?.fundId ?? null,
+          details?.paymentArtifactHash ?? null
+        ]
+      );
+      await client.query("COMMIT");
+      return true;
+    } catch (error) {
+      await client.query("ROLLBACK").catch(() => void 0);
+      throw error;
+    } finally {
+      client.release();
+    }
+  }
+  async acceptedJobByPaymentArtifactHash(hash2) {
+    const { rows } = await this.pool.query(
+      `SELECT a.job_id FROM sdk_hosting_admissions a
+       JOIN jobs j ON j.id=a.job_id
+       WHERE a.dvm_id=$1 AND a.scope=$2 AND a.payment_artifact_hash=$3
+         AND a.outcome IN ('accepted', 'unresolved', 'pending')
+       ORDER BY a.admitted_at_ms DESC LIMIT 1`,
+      [this.dvmId, this.config.scope, hash2]
+    );
+    return rows[0]?.job_id;
+  }
+  async rebindAdmissionJob(id, jobId) {
+    await this.pool.query(
+      `UPDATE sdk_hosting_admissions SET job_id=$2 WHERE id=$1 AND outcome='pending'`,
+      [id, jobId]
+    );
+  }
+  async finishAdmission(id, outcome, jobId) {
+    await this.pool.query(
+      `UPDATE sdk_hosting_admissions SET outcome=$2, job_id=COALESCE($3, job_id)
+       WHERE id=$1 AND outcome='pending'`,
+      [id, outcome, jobId ?? null]
+    );
+  }
+  async jobDeadline(jobId) {
+    const { rows } = await this.pool.query(
+      `SELECT MAX(drain_deadline_ms)::text AS drain_deadline_ms
+       FROM sdk_hosting_admissions WHERE dvm_id=$1 AND scope=$2 AND job_id=$3`,
+      [this.dvmId, this.config.scope, jobId]
+    );
+    return rows[0]?.drain_deadline_ms === null || !rows[0] ? null : Number(rows[0].drain_deadline_ms);
+  }
+  async transition(command) {
+    if (command.action !== "drain" && command.action !== "resume" || !Number.isSafeInteger(command.generation) || command.generation < 1 || command.action === "drain" && !Number.isSafeInteger(command.deadlineMs) || command.action === "resume" && command.deadlineMs !== void 0) return "conflict";
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      const { rows } = await client.query(
+        `SELECT state, generation, deadline_ms FROM sdk_hosting_control
+         WHERE dvm_id=$1 AND scope=$2 FOR UPDATE`,
+        [this.dvmId, this.config.scope]
+      );
+      const prior = rows[0];
+      const generation = Number(prior.generation);
+      const nextState = command.action === "drain" ? "draining" : "accepting";
+      if (command.generation === generation && prior.state === nextState && Number(prior.deadline_ms ?? 0) === (command.deadlineMs ?? 0)) {
+        await client.query("COMMIT");
+        return "ok";
+      }
+      if (command.generation <= generation) {
+        await client.query("ROLLBACK");
+        return "conflict";
+      }
+      if (command.action === "drain" && (command.deadlineMs <= Date.now() || command.deadlineMs > Date.now() + 864e5)) {
+        await client.query("ROLLBACK");
+        return "conflict";
+      }
+      await client.query(
+        `UPDATE sdk_hosting_control SET state=$3, generation=$4, deadline_ms=$5
+         WHERE dvm_id=$1 AND scope=$2`,
+        [this.dvmId, this.config.scope, nextState, command.generation, command.deadlineMs ?? null]
+      );
+      if (command.action === "drain") {
+        await client.query(
+          `UPDATE sdk_hosting_admissions SET drain_deadline_ms=$3
+           WHERE dvm_id=$1 AND scope=$2 AND outcome='pending'`,
+          [this.dvmId, this.config.scope, command.deadlineMs]
+        );
+      }
+      await client.query("COMMIT");
+      return "ok";
+    } catch (error) {
+      await client.query("ROLLBACK").catch(() => void 0);
+      throw error;
+    } finally {
+      client.release();
+    }
+  }
+  async status() {
+    await this.pool.query(
+      `UPDATE sdk_hosting_admissions a SET outcome='accepted'
+       WHERE a.dvm_id=$1 AND a.scope=$2 AND a.outcome='pending'
+         AND EXISTS (SELECT 1 FROM jobs j WHERE j.id=a.job_id)`,
+      [this.dvmId, this.config.scope]
+    );
+    const creditTable = await this.pool.query(
+      "SELECT to_regclass('credit_fundings') IS NOT NULL AS present"
+    );
+    await this.pool.query(
+      `UPDATE sdk_hosting_admissions a SET outcome='accepted'
+       WHERE a.dvm_id=$1 AND a.scope=$2 AND a.outcome='unresolved'
+         AND (EXISTS (SELECT 1 FROM jobs j WHERE j.id=a.job_id)
+           ${creditTable.rows[0].present ? `OR (a.credit_id IS NOT NULL AND EXISTS (
+             SELECT 1 FROM credit_fundings f WHERE f.credit_id=a.credit_id AND f.fund_id=a.fund_id
+           ))` : ""})`,
+      [this.dvmId, this.config.scope]
+    );
+    const { rows } = await this.pool.query(
+      `SELECT state, generation, deadline_ms FROM sdk_hosting_control WHERE dvm_id=$1 AND scope=$2`,
+      [this.dvmId, this.config.scope]
+    );
+    const active = await this.pool.query(
+      `SELECT j.id FROM jobs j WHERE j.dvm_id=$1
+         AND j.status IN ('processing', 'working', 'awaiting-input')
+         AND EXISTS (SELECT 1 FROM sdk_hosting_admissions a
+           WHERE a.dvm_id=j.dvm_id AND a.job_id=j.id AND a.scope=$2)
+       ORDER BY j.id`,
+      [this.dvmId, this.config.scope]
+    );
+    const unowned = await this.pool.query(
+      `SELECT j.id FROM jobs j WHERE j.dvm_id=$1
+         AND j.status IN ('processing', 'working', 'awaiting-input')
+         AND NOT EXISTS (SELECT 1 FROM sdk_hosting_admissions a
+           WHERE a.dvm_id=j.dvm_id AND a.job_id=j.id)
+       ORDER BY j.id`,
+      [this.dvmId]
+    );
+    const pending = await this.pool.query(
+      `SELECT COUNT(*) FILTER (WHERE outcome='pending')::text AS pending,
+              COUNT(*) FILTER (WHERE outcome='unresolved')::text AS unresolved
+       FROM sdk_hosting_admissions WHERE dvm_id=$1 AND scope=$2`,
+      [this.dvmId, this.config.scope]
+    );
+    const unresolved = await this.pool.query(
+      `SELECT id, job_id FROM sdk_hosting_admissions
+       WHERE dvm_id=$1 AND scope=$2 AND outcome='unresolved' ORDER BY admitted_at_ms, id`,
+      [this.dvmId, this.config.scope]
+    );
+    const inFlight = await this.pool.query(
+      `SELECT id, job_id FROM sdk_hosting_admissions
+       WHERE dvm_id=$1 AND scope=$2 AND outcome='pending' ORDER BY admitted_at_ms, id`,
+      [this.dvmId, this.config.scope]
+    );
+    return {
+      state: rows[0].state,
+      generation: Number(rows[0].generation),
+      deadlineMs: rows[0].deadline_ms === null ? null : Number(rows[0].deadline_ms),
+      activeJobIds: active.rows.map((row) => row.id),
+      unownedActiveJobIds: unowned.rows.map((row) => row.id),
+      pendingAdmissionCount: Number(pending.rows[0].pending),
+      pendingAdmissions: inFlight.rows.map((row) => ({ admissionId: row.id, workId: row.job_id })),
+      unresolvedAdmissionCount: Number(pending.rows[0].unresolved),
+      unresolvedAdmissions: unresolved.rows.map((row) => ({ admissionId: row.id, jobId: row.job_id }))
+    };
+  }
+};
+
 // src/sdk/server/job-credential.ts
 function jobCredentialGate(opts) {
   const alternative = opts.acceptsBearer ? ", or the Authorization: Bearer token the job was submitted with" : "";
@@ -9756,20 +9978,10 @@ var ReceiptIssuer = class {
     this.pubkey = receiptPubkeyFromSecret(opts.secret);
   }
   /**
-   * Build and sign the receipt for a terminal job. `seq` comes from
-   * `JobStore.claimReceiptSeq`; `issuedAt` is epoch seconds and defaults to now.
-   *
-   * Free jobs get receipts too, with `paid.msats: 0` — they still consume a
-   * sequence number and still attest an outcome. Whether feedback is
-   * paid-only is the feedback layer's call, not this one's.
-   *
-   * Timing and attribution come from the committed terminal row, not signing
-   * time or handler input. Legacy rows without those durable inputs omit the
-   * optional blocks rather than inventing historical evidence.
-   *
-   * `credit` is the resolved draw block — present on every job
-   * whose payment funded/drew the ledger, absent otherwise. Signature-
-   * compatible either way: `canonicalize` omits absent keys.
+   * seq is store-allocated; issuedAt is epoch seconds. Free jobs also consume a
+   * sequence and attest their outcome. Timing/attribution comes from the committed
+   * terminal row; legacy rows omit unknown historical fields. credit is present
+   * only for a resolved ledger draw.
    */
   issue(record, seq, issuedAt, credit) {
     const unsigned = {
@@ -9880,7 +10092,6 @@ function resultHashFor(record) {
 }
 
 // src/lib/cashu/mint-info.ts
-var MINT_INFO_TTL_MS = 5 * 6e4;
 async function getKeysetFinalExpiry(mintUrl, keysetId) {
   try {
     const wallet = await getWallet(mintUrl);
@@ -10324,11 +10535,9 @@ var JobManager = class {
   get receiptsEnabled() {
     return this.opts.receiptIssuer !== void 0 && isReceiptIssuingStore(this.jobStore);
   }
-  /** True when the named capability exists on this descriptor. */
   hasCapability(name) {
     return Object.prototype.hasOwnProperty.call(this.descriptor.capabilities, name);
   }
-  /** Names of every capability this descriptor exposes — used for error envelopes. */
   capabilityNames() {
     return Object.keys(this.descriptor.capabilities);
   }
@@ -10925,7 +11134,6 @@ var JobManager = class {
       job.messageAppenderTail = next;
     };
   }
-  /** Start (or restart) the idle timer for a job. */
   startIdleTimer(job) {
     this.clearIdleTimer(job.id);
     const timeoutMs = this.descriptor.idleTimeout * 1e3;
@@ -10934,7 +11142,6 @@ var JobManager = class {
     }, timeoutMs);
     this.idleTimers.set(job.id, timer);
   }
-  /** Clear the idle timer for a job. */
   clearIdleTimer(id) {
     const timer = this.idleTimers.get(id);
     if (timer) {
@@ -12533,7 +12740,6 @@ var JobManager = class {
     for (const record of records) await this.reportTerminalJob(record.id);
     this.terminalReportRecoveryCursor = records.length === 100 ? records[records.length - 1].id : void 0;
   }
-  /** Handle job reaching terminal state (completed, failed, cancelled). */
   async handleJobTerminal(job) {
     this.clearIdleTimer(job.id);
     if (await this.adoptDurableTerminal(job)) return;
@@ -12809,7 +13015,6 @@ var JobManager = class {
     }, 6e4);
     this.cleanupTimers.set(job.id, timer);
   }
-  /** Clear all timers. Called on server shutdown to allow clean exit. */
   shutdown() {
     for (const [id] of this.idleTimers) {
       this.clearIdleTimer(id);
@@ -13054,7 +13259,6 @@ var MintHealthTracker = class {
   isNutIncompatible(mintUrl) {
     return this.state.get(normaliseMintUrl(mintUrl))?.nutIncompatible ?? false;
   }
-  /** Plain-object snapshot keyed by mint URL — for tests + observability. */
   snapshot() {
     return Object.fromEntries(Array.from(this.state.entries()).map(([k, v]) => [k, { ...v }]));
   }
@@ -13112,12 +13316,7 @@ var MintHealthTracker = class {
       );
     }
   }
-  /**
-   * One-shot structured summary emitted after the first probe tick. Replaces
-   * the boot check's per-mint `cashu_mint_startup_health` lines and surfaces an
-   * all-mints-unhealthy warning — the operator alert that the Fly restart-loop
-   * used to be before boot stopped refusing to start.
-   */
+  /** One boot summary, including an all-unhealthy warning. */
   logBootHealth() {
     const mints = Object.entries(this.snapshot()).map(([mintUrl, s]) => ({
       mintUrl,
@@ -13248,7 +13447,6 @@ var PostgresX402ExactSettlementStore = class {
     this.pool = pool;
   }
   pool;
-  /** Create the exact settlement tables. */
   async init() {
     await withSdkInitLock(this.pool, async () => {
       await this.pool.query(`
@@ -14194,20 +14392,11 @@ async function handlePendingDrains(c, opts) {
       amount_micro: d.amountMicro,
       amount_sats: amountSats,
       amount_msats: amountSats === null ? null : amountSats * 1e3,
-      // Whether this row's sats figure is the in-kind obligation or a live-rate
-      // conversion. An operator settling a refund should be able to see which,
-      // and the servicer's own logs carry it for the same reason.
       sats_basis: amountSats === null ? null : d.owedSats === null ? "rate" : "in_kind",
-      // The figure a `manual` payout is actually sized in: `amount_micro` is
-      // fiat, and the operator sends the rail's own token. It is the same debit
-      // `completeX402ChannelDrain` treats as its settlement floor,
-      // so publishing it is what lets an operator settle from the row instead
-      // of assuming their stablecoin happens to be six-decimal.
+      // Rail-native debit, distinct from fiat amount_micro. This is the channel refund floor
+      // and the size a manual payout must cover.
       amount_native: d.drainedNative,
       settlement,
-      // Why this row is classified as it is, and the channel an operator would
-      // look up to see the close land. `payout` cannot answer it: a
-      // channel-backed mpp drain carries `{}`.
       channel_id: d.channelId,
       created_at: d.createdAt
     };
@@ -14218,13 +14407,7 @@ async function handlePendingDrains(c, opts) {
       acc[method] = pending.filter((d) => d.method === method).reduce((sum, d) => sum + d.amountMicro, 0);
       return acc;
     }, {}),
-    // What no job will ever pay down: the operator's own worklist, in the one
-    // denomination these rows have.
     manual_micro: drains.filter((d) => d.settlement === "manual").reduce((sum, d) => sum + d.amount_micro, 0),
-    // The rest of the stablecoin liability — owed, but by a channel close in
-    // flight rather than by a person. Published beside `manual_micro` so the
-    // difference between the two is visible rather than inferred from a
-    // `by_method_micro` figure neither of them matches.
     channel_micro: drains.filter((d) => d.settlement === "channel").reduce((sum, d) => sum + d.amount_micro, 0)
   };
   return c.json({ drains, liability, mints: opts.mints?.() ?? [] });
@@ -14253,17 +14436,21 @@ async function handleBitcoinLiability(c, opts) {
     drain_liability_sats: drainSats,
     drain_count: promised.length,
     total_owed_sats: deposit.depositSats + drainSats,
-    // Money this figure does not speak for, published rather than folded in:
-    // `uncovered` is a credit whose lots fall short of its balance, `unbacked`
-    // is one holding any open micro with no sats basis. A reclaim on either
-    // prices the whole balance off a live rate, so both are reported whole and
-    // neither contributes to `deposit_liability_sats` — a sweep computed
-    // against `total_owed_sats` alone is short by whatever they turn out to be
-    // worth.
+    // Uncovered or basisless balances require whole-balance live-rate pricing and do not
+    // contribute to deposit_liability_sats. total_owed_sats alone cannot reserve their
+    // eventual refunds.
     uncovered_credits: deposit.uncoveredCredits,
-    uncovered_micro: deposit.uncoveredMicro,
+    uncovered_by_currency: deposit.uncoveredByCurrency.map((currency) => ({
+      currency: currency.currency,
+      micro: currency.micro,
+      credits: currency.credits
+    })),
     unbacked_credits: deposit.unbackedCredits,
-    unbacked_micro: deposit.unbackedMicro,
+    unbacked_by_currency: deposit.unbackedByCurrency.map((currency) => ({
+      currency: currency.currency,
+      micro: currency.micro,
+      credits: currency.credits
+    })),
     unpriced_drains: drainsUnpriced
   });
 }
@@ -14701,9 +14888,6 @@ async function handleReconcileInvoice(c, opts) {
     const result = await opts.ledger.reconcileBlockedInvoice({
       paymentHash,
       targetCreditId,
-      // `fund`'s upsert OVERWRITES `expiry_ms`, so a bare `now + ttl` would
-      // shorten a target credit with more life left on it — destroying
-      // spendable value while purporting to add some.
       expiryMs,
       basis,
       ...settledAtMs === void 0 ? {} : { settledAtMs },
@@ -14724,9 +14908,6 @@ async function handleReconcileInvoice(c, opts) {
             creditCurrency: invoice.currency,
             fundedAt: settledAtMs ?? invoice.settledAt ?? nowMs,
             expiryMs,
-            // The settlements table types this deposit `repair` off the
-            // flag: the sats landed at payment time and the
-            // deposit is the one row they get.
             repaired: true
           }
         }
@@ -14809,8 +14990,6 @@ async function handleWriteOffInvoice(c, opts) {
     amount_micro: written.amountMicro,
     currency: written.currency,
     note: written.writeOffNote,
-    // Mirrors the reconcile's `replayed`: the operator asked for a decision and
-    // finds one already recorded, possibly with someone else's note on it.
     replayed: !outcome.written
   });
 }
@@ -16829,6 +17008,7 @@ async function createDVMServer(descriptor, opts) {
   let x402ChannelStorage;
   let x402BatchSettlement;
   let server;
+  let hostingControl;
   let shutdownPromise;
   const shutdown = () => shutdownPromise ??= (async () => {
     const errors = [];
@@ -16880,12 +17060,12 @@ async function createDVMServer(descriptor, opts) {
     const platformUrl = opts.platformUrl ?? envMaybe.DVMKIT_PLATFORM_URL;
     const dvmId = opts.dvmId;
     if (!opts.onJobCompleted && platformToken && platformUrl && dvmId && opts.db) {
-      const { RevenueReporter } = await import("./revenue-reporter-NNCNRY4C.js");
+      const { RevenueReporter } = await import("./revenue-reporter-O75BGYFK.js");
       const reporter = new RevenueReporter(opts.db, platformUrl, platformToken);
       revenueReporter = reporter;
       await reporter.init();
       reporter.startRetryLoop();
-      const { MemoryX402BatchStore, PayoutReporter } = await import("./payout-reporter-5PIRYFVQ.js");
+      const { MemoryX402BatchStore, PayoutReporter } = await import("./payout-reporter-KEMUXEUO.js");
       payoutReporter = new PayoutReporter({
         dvmId,
         db: opts.db,
@@ -17022,8 +17202,19 @@ async function createDVMServer(descriptor, opts) {
         });
       }
     }) : void 0;
+    if (opts.hostingControl) {
+      if (!opts.db || !opts.dvmId || !(opts.jobStore instanceof PostgresJobStore)) {
+        throw new Error("Hosting control requires a Postgres pool, dvmId, and PostgresJobStore");
+      }
+      if (descriptor.credit && !opts.creditLedger?.durable) {
+        throw new Error("Hosting control with credit requires a durable credit ledger");
+      }
+      hostingControl = new HostingControl(opts.db, opts.dvmId, opts.hostingControl);
+      await hostingControl.init();
+    }
     server = new DVMServer(descriptor, {
       ...opts,
+      hostingControlInstance: hostingControl,
       creditLedger,
       processedPayments,
       onJobCompleted: effectiveOnJobCompleted,
@@ -17100,6 +17291,7 @@ var DVMServer = class {
   x402ExactSettlement;
   /** Withdraws this mount's Tempo session capability from the poll. */
   undeclareSessionCapability;
+  hostingSweepTimer;
   constructor(descriptor, opts) {
     this.descriptor = descriptor;
     this.pricingCurrency = descriptor.currency ?? "usd";
@@ -17143,17 +17335,9 @@ var DVMServer = class {
       mints: opts.mints,
       jobStore: opts.jobStore,
       devMode: opts.devMode,
-      // Derived, not raw. `ctx.requestPayment` gates its x402 and
-      // Tempo challenge issuance on this list, while `/v1/info`, `/v1/quote`
-      // and the upfront 402 all read `resolvePaymentMethods()` — so passing the
-      // raw option meant a DVM that never set `paymentMethods` (no first-party
-      // one does; the descriptor documents it as "derived from configured
-      // rails") advertised both rails, took the upfront payment on either, and
-      // then emitted a mid-job payment-request carrying no rail at all. The
-      // caller's responder had nothing to sign and the job stalled at
-      // needs-approval — reachable only from a rung that raises a real mid-job
-      // ask, which nothing above L1 did. Facilitator availability is still
-      // re-checked per ask in `context.ts`, so a static list is safe here.
+      // Use the same derived rail list as discovery/upfront payment; otherwise
+      // default-configured rails vanish from mid-job asks. Availability is rechecked
+      // per ask.
       paymentMethods: (opts.paymentMethods ?? this.defaultPaymentMethods()).filter(
         (method) => method !== "x402" || this.x402CurrencySupported()
       ),
@@ -17191,6 +17375,17 @@ var DVMServer = class {
     this.app = new Hono();
     try {
       this.registerRoutes();
+      if (opts.hostingControlInstance) {
+        this.hostingSweepTimer = setInterval(() => {
+          void this.sweepHostingDeadline().catch((error) => {
+            console.error("Hosting deadline sweep failed:", error);
+          });
+        }, 1e3);
+        this.hostingSweepTimer.unref();
+        void this.sweepHostingDeadline().catch((error) => {
+          console.error("Hosting deadline sweep failed:", error);
+        });
+      }
       if (this.ownsMintHealthTracker) this.mintHealthTracker?.start();
       if (this.opts.tempoObserverHealth?.declareSessionCapability) {
         this.undeclareSessionCapability = this.opts.tempoObserverHealth.declareSessionCapability(
@@ -17224,6 +17419,7 @@ var DVMServer = class {
    * and host teardown layers can finish later cleanup before surfacing it.
    */
   shutdown() {
+    if (this.hostingSweepTimer) clearInterval(this.hostingSweepTimer);
     this.jobManager.shutdown();
     const settlement = this.x402BatchSettlementInit ?? Promise.resolve(this.x402BatchSettlement);
     const stopped = settlement.then((s) => s?.stop());
@@ -17232,6 +17428,42 @@ var DVMServer = class {
     this.undeclareSessionCapability = void 0;
     return stopped;
   }
+  async sweepHostingDeadline() {
+    const control = this.opts.hostingControlInstance;
+    if (!control) return;
+    const status = await control.status();
+    if (status.state !== "draining" || status.deadlineMs === null || Date.now() < status.deadlineMs)
+      return;
+    const store = this.jobManager.store;
+    if (!(store instanceof PostgresJobStore)) return;
+    for (const jobId of status.activeJobIds) {
+      if (await store.cancelJobForHosting(jobId, "Hosting drain deadline reached")) {
+        await this.jobManager.finalizeStoredTerminal(jobId);
+      }
+    }
+  }
+  async handleHostingCommand(c, statusOnly) {
+    const control = this.opts.hostingControlInstance;
+    if (!control) return c.json({ error: "not_found" }, 404);
+    let command;
+    try {
+      command = await c.req.json();
+    } catch {
+      return c.json({ error: "invalid_hosting_control" }, 400);
+    }
+    if (!command || (statusOnly ? command.action !== "status" : command.action !== "drain" && command.action !== "resume")) {
+      return c.json({ error: "invalid_hosting_control" }, 400);
+    }
+    if (!await control.authorize(command, c.req.header("X-DVM-Hosting-Signature"))) {
+      return c.json({ error: "hosting_control_unauthorized" }, 401);
+    }
+    if (!statusOnly && command.action === "resume") await this.sweepHostingDeadline();
+    if (!statusOnly && await control.transition(command) === "conflict") {
+      return c.json({ error: "hosting_generation_conflict" }, 409);
+    }
+    if (!statusOnly) await this.sweepHostingDeadline();
+    return c.json(await control.status());
+  }
   registerRoutes() {
     const dvmSlug = this.descriptor.name;
     const builderPubkey = this.opts.builder?.pubkey;
@@ -17339,6 +17571,10 @@ var DVMServer = class {
     this.app.get("/v1/info", (c) => this.handleInfo(c));
     this.app.post("/v1/quote", (c) => this.handleQuote(c));
     this.app.post("/v1/job", (c) => this.handleCreateJob(c));
+    if (this.opts.hostingControlInstance) {
+      this.app.post("/_hosting/control", (c) => this.handleHostingCommand(c, false));
+      this.app.post("/_hosting/status", (c) => this.handleHostingCommand(c, true));
+    }
     this.app.post("/v1/request-resume/:requestId", (c) => this.handleCreateJob(c, true));
     this.app.post("/v1/request-result/:requestId", (c) => this.handleRequestResult(c));
     this.app.get("/v1/job/:id", (c) => this.handleGetJob(c));
@@ -17411,12 +17647,8 @@ var DVMServer = class {
     return state;
   }
   /**
-   * Resolve the active lock-pubkey set for the mid-job cashu accept path
-   * Returns the same `[current, ...retired_in_grace]` shape the
-   * upfront flow uses at lines 709-718 so accept-time rotation tolerance is
-   * consistent across upfront and mid-job. Falls back to `undefined` when
-   * accumulator mode isn't wired (the receive path then rejects with
-   * `cashu_not_p2pk_locked`).
+   * Mid-job and upfront receive paths use current plus grace-period retired keys.
+   * Without accumulator mode this is undefined and the receive path refuses it.
    */
   async resolveLockPubkeysForReceive() {
     if (this.opts.disposableCashu && this.opts.lockPubkey) return [toLockPubkey(this.opts.lockPubkey)];
@@ -17431,12 +17663,8 @@ var DVMServer = class {
     }
   }
   /**
-   * Best-effort lock-pubkey state for read-only consumers (`/v1/info` and the
-   * accept path). Tries Postgres; on failure falls back to the last-good
-   * cached state, and only as a final resort to the env-derived seed in a
-   * single-entry array. The cache makes the degradation safe across a
-   * rotation — without it the env seed advertises and accepts the retired
-   * pubkey while the DB is unreachable.
+   * Read Postgres first, then fall back to last-observed state, then the env seed.
+   * Caching avoids reverting an observed rotation to the old seed during an outage.
    */
   async lockPubkeyStateForRead(db, dvmId) {
     try {
@@ -17448,22 +17676,9 @@ var DVMServer = class {
     }
   }
   /**
-   * Run the routine Tempo settlement cadence opportunistically, on ordinary
-   * traffic.
-   *
-   * Routine settlement used to ride the per-DVM watcher machine's four-minute
-   * poll, which is exactly what kept an idle DVM awake and billing. It cannot
-   * move to a timer for the same reason — a timer on a machine that ought to
-   * be suspended either does not fire or defeats the suspension. So it rides
-   * requests instead, the way Lightning funding is credited: a DVM
-   * with no traffic has nothing to settle on a 24-hour cadence anyway, and the
-   * forced-close guarantee does not depend on this path at all — that is the
-   * chain-event wake, which reaches a suspended DVM through Fly Proxy.
-   *
-   * Fire-and-forget and self-throttled: the request never waits on it, only
-   * one runs at a time, and a failure is logged rather than surfaced. The
-   * sweep re-checks each channel's own schedule, so the throttle here only
-   * bounds how often we pay for the store scan.
+   * Opportunistic traffic avoids a timer that keeps an idle machine awake. Forced
+   * close servicing is independent. Fire-and-forget, one sweep at a time; failures
+   * are logged. The throttle bounds scans, not each channel's settlement schedule.
    */
   maybeSweepTempoSessions() {
     const sweep = this.opts.mpp?.sweepTempoSessions;
@@ -17528,22 +17743,9 @@ var DVMServer = class {
     ]);
   }
   /**
-   * Whether this DVM is **configured** to take TIP-1034 session channels — the
-   * value the observer-health poll carries back to the platform, where it keeps
-   * `dvms.tempo_session_advertised_at` current between container deploys
-   *
-   * Deliberately the same question the platform's post-deploy `/v1/info` probe
-   * answers (`infoAdvertisesTempoSession`), from the same two facts: the credit
-   * menu exists at all, and the configured MPP methods include `tempo/session`.
-   * Credit-scoped because sessions are confined to `POST /v1/credit` — a
-   * top-level session method with no credit menu is not a channel anyone can
-   * open, so it is not a candidate the payee fallback should reach for.
-   *
-   * It reads `advertisedMethods` rather than {@link creditMppSplit}'s `offered`,
-   * and never {@link tempoSessionOffered}: what the column records is
-   * capability, not availability, so an observer blip must leave it alone. That
-   * distinction is the whole of and answering it here from the gate
-   * would reintroduce it on a one-minute cadence.
+   * Report configured session capability independently of current availability.
+   * A temporary observer outage must not remove the platform's watch signal.
+   * Credit menu, auth and session method configuration still gate that capability.
    */
   tempoSessionCapability() {
     if (!this.opts.mpp) return false;
@@ -17561,25 +17763,11 @@ var DVMServer = class {
     );
   }
   /**
-   * `POST /_internal/tempo-close-event` — the forced-close wake path
-   * replacing the per-DVM `tempo-session-watch` Fly Machine.
-   *
-   * Deliberately **unauthenticated**, and that is the design rather than an
-   * omission: the body is an event locator, so the DVM re-reads the event from
-   * its own Tempo RPC and verifies chain, escrow, topic and local channel
-   * ownership before touching money (see `handleTempoCloseEvent`). An
-   * unverifiable locator can therefore do nothing, which is what lets the
-   * platform wake a DVM without holding a signing key or a recoverable copy of
-   * the DVM's bearer token.
-   *
-   * What an unauthenticated caller *can* do is spend the DVM's resources: each
-   * POST is an unthrottled outbound `eth_getTransactionReceipt` against the
-   * builder's own Tempo provider, billed to them, before anything about the
-   * locator has been checked — the verification needs the receipt to happen at
-   * all. So the cost of an open endpoint is metered RPC calls, not money: no
-   * locator can move value except one naming a real close of a channel this
-   * DVM owns, and settling that is what the routine cadence would do anyway.
-   * Watch the provider's quota rather than the ledger.
+   * Unauthenticated wake carrying only an event locator. After parsing, verify
+   * the receipt from the DVM's own RPC, including chain, escrow, topic and local
+   * channel ownership before settlement. The observer needs no spending secret.
+   * Syntactically valid requests can still consume unthrottled provider RPC quota;
+   * malformed locators return 400 before that read.
    */
   registerTempoCloseEventRoute() {
     const mpp = this.opts.mpp;
@@ -17640,16 +17828,8 @@ var DVMServer = class {
     });
   }
   /**
-   * Compose the `/v1/info#builder` block from `opts.builder` (inline SDK
-   * config) with a fallback to deploy-injected env vars. Each
-   * field is independently sourced (opts wins per-field, env fills gaps);
-   * all three of pubkey / attestation / signature must resolve to emit the
-   * block — partial state is treated as absent rather than half-emitted.
-   *
-   * Env-var form: `DVMKIT_BUILDER_ATTESTATION` is a JSON string (Fly secrets
-   * can't carry structured data), so it's parsed here. A malformed JSON
-   * string drops the block rather than throwing, so a corrupted env var
-   * can't take the DVM down.
+   * Options override environment per field. Emit only when pubkey, attestation
+   * and signature all exist; malformed attestation JSON omits the block.
    */
   builderAttestationBlock() {
     const builder = this.opts.builder;
@@ -18013,6 +18193,32 @@ var DVMServer = class {
       receiptIssuer: this.receiptIssuer,
       lightning: this.opts.lightningReceive ? { receive: this.opts.lightningReceive } : void 0,
       settleLightning: (callerPubkey, creditId) => this.settleLightningFunding(callerPubkey, creditId),
+      withFundingAdmission: this.opts.hostingControlInstance ? async (ctx, body, run) => {
+        const control = this.opts.hostingControlInstance;
+        const admissionId = randomUUID4();
+        const fundId = body.fund?.fund_id ?? admissionId;
+        const creditId = body.credit_id ?? derivedFundCreditId(body.pubkey, fundId);
+        const workId = `credit-fund:${creditId}:${fundId}`;
+        if (!await control.admit(admissionId, workId, { creditId, fundId })) {
+          return ctx.json({
+            error: "hosting_draining",
+            message: "This service is draining and is not accepting new credit funding.",
+            hint: "Balance, reclaim, and already-issued funding recovery remain available."
+          }, 503);
+        }
+        const authorization = ctx.req.header("Authorization");
+        const paymentArtifact = Boolean(
+          ctx.req.header("X-Cashu") || ctx.req.header("PAYMENT-SIGNATURE") || ctx.req.header("X-PAYMENT") || authorization && /^Payment\s/i.test(authorization)
+        );
+        let outcome = paymentArtifact ? "unresolved" : "failed";
+        try {
+          const response = await run();
+          if (response.ok || body.fund?.method === "lightning" && await this.creditLedger.getInvoice({ creditId, fundId })) outcome = "accepted";
+          return response;
+        } finally {
+          await control.finishAdmission(admissionId, outcome);
+        }
+      } : void 0,
       tempoSettlementReadiness: this.opts.tempoSettlementReadiness
     });
   }
@@ -18032,11 +18238,8 @@ var DVMServer = class {
     return this.pricingCurrency;
   }
   /**
-   * Quote-response `payment` block. Carries the same `methods` array
-   * `/v1/info` advertises plus a per-rail `refundable` map keyed by method, so a
-   * caller can see which rails return funds on failure before committing. The
-   * `methods` shape stays identical to `/v1/info` and the platform isolate route
-   * (current nested `payment.methods`); refundability rides alongside.
+   * Advertise the same method list as info. Refundability describes the rail
+   * itself; failed jobs release their pending credit draw separately.
    */
   quotePaymentBlock() {
     const methods = this.resolvePaymentMethods();
@@ -18149,12 +18352,8 @@ var DVMServer = class {
     return c.json(info);
   }
   /**
-   * Render the `/v1/info.capabilities` block. Each capability
-   * advertises its `description`, optional `input_schema`, and optional
-   * `pricing` block — `pricing.quote.schema` for dynamic-priced capabilities,
-   * `pricing.max` for static-priced ones. Capabilities without an `input`
-   * schema or any pricing surface omit those fields entirely; free
-   * capabilities (no `price`) omit `pricing` entirely.
+   * Input-mode JSON Schema keeps defaulted fields optional on the advertised
+   * wire contract. Capability names are the descriptor's keys.
    */
   renderCapabilities() {
     const out = {};
@@ -18355,11 +18554,8 @@ var DVMServer = class {
     return c.json(res);
   }
   /**
-   * Build the {@link QuoteContext} a pricing handler receives. Extracted so
-   * the two callers — `/v1/quote` and `computeDynamicPrice` on the submit
-   * path — cannot drift: a field added for one is present in the other by
-   * construction, and both paths price against the same view of the caller's
-   * credit.
+   * Callers supply quote-schema-parsed data when a quote schema exists, alongside
+   * raw input text and params. Quote and job pricing share these runtime helpers.
    */
   async buildQuoteContext(args) {
     const ctx = {
@@ -18381,16 +18577,8 @@ var DVMServer = class {
     return ctx;
   }
   /**
-   * Validate the `capability` field on a `/v1/job` or `/v1/quote` body
-   * Returns the canonical name when set + known; otherwise a
-   * structured 400 envelope agents can relay verbatim to a human caller.
-   *
-   * - **Missing** — `body.capability` is absent or empty. Surface as
-   * `capability_required` with a hint pointing at `/v1/info` so the agent
-   * can re-discover the capability set.
-   * - **Unknown** — `body.capability` is set but doesn't match any
-   * capability on this descriptor. Surface as `unknown_capability` listing
-   * the known names so the agent can correct without a round-trip.
+   * Missing or unknown capabilities return structured errors with the current
+   * info-schema URL.
    */
   requireCapabilityFromBody(c, capability) {
     const known = this.jobManager.capabilityNames();
@@ -18494,22 +18682,9 @@ var DVMServer = class {
     );
   }
   /**
-   * True when a failed capability-input parse is the auth gate's answer rather
-   * than {@link invalidInputResponse}'s.
-   *
-   * A capability schema may declare the signing-envelope fields required
-   * (cast's `addEpisodeSchema`) or optional (scribe's `transcribeSchema`). On
-   * the required shape an *unsigned* request fails the input parse naming
-   * `pubkey` / `signature` — a signing failure, and answering it with "your
-   * input is invalid: pubkey required" is the mistake in reverse. So a
-   * parse whose issues are **only** envelope-side falls through to the auth
-   * gate, which answers 401 `signature_invalid` with the remedy that works.
-   *
-   * Deferring is safe because the gate below re-parses the same schema over the
-   * same bytes, so a caller that reaches it with an envelope-side failure is
-   * rejected there for certain; both routes still carry a backstop for the
-   * impossible case. It applies only to a DVM that declares `auth` — with no
-   * gate below, the 400 is the only answer available.
+   * On authenticated DVMs, envelope-only parse failures defer to auth
+   * (401 signature_invalid). Builder input issues remain 400 invalid_input.
+   * Auth reparses the same schema/raw input; a backstop refuses disagreement.
    */
   deferToAuthGate(err) {
     if (!this.descriptor.auth) return false;
@@ -18708,8 +18883,40 @@ var DVMServer = class {
       { capability: capabilityName, input: body.input, params: body.params, data: body.data },
       { stripAuthEnvelope: false }
     ) : void 0;
+    const authorization = c.req.header("Authorization");
+    const attachedPayment = c.req.header("X-Cashu") ?? c.req.header("PAYMENT-SIGNATURE") ?? c.req.header("X-PAYMENT") ?? (authorization && /^Payment\s/i.test(authorization) ? authorization : void 0);
+    const hostingPaymentArtifactHash = attachedPayment ? createHash7("sha256").update(attachedPayment).digest("hex") : void 0;
+    if (!resumeOnly && this.opts.hostingControlInstance && hostingPaymentArtifactHash) {
+      const priorId = await this.opts.hostingControlInstance.acceptedJobByPaymentArtifactHash(
+        hostingPaymentArtifactHash
+      );
+      const prior = priorId ? await this.jobManager.store.get(priorId) : void 0;
+      if (prior && prior.requestFingerprint === fingerprint && prior.requesterId === c.get("requesterId") && (!this.descriptor.auth || prior.requesterPubkey === authPubkey)) {
+        await this.jobManager.ensureReceipt(prior);
+        return buildSubmitResponse(c, prior, prior.requesterToken);
+      }
+    }
+    if (!resumeOnly && this.opts.hostingControlInstance && creditEnvelope && authPubkey) {
+      const draw = await this.creditLedger.getDraw({
+        creditId: creditEnvelope.creditId,
+        drawId: creditEnvelope.drawId
+      });
+      if (draw?.jobId && await this.jobManager.store.get(draw.jobId)) {
+        const recovered = await this.recoverDrawnJob(c, {
+          creditId: creditEnvelope.creditId,
+          drawId: creditEnvelope.drawId,
+          jobId: draw.jobId,
+          fingerprint,
+          callerPubkey: authPubkey
+        });
+        if (recovered) return recovered;
+      }
+    }
     let publicRequestClaim;
     let publicRequestClaimResult;
+    let hostingAdmissionId;
+    let hostingAdmissionAccepted = false;
+    let hostingPaymentMayHaveLanded = false;
     if (publicRequestId && authPubkey && recoveryStore) {
       publicRequestClaim = {
         requestId: publicRequestId,
@@ -18732,6 +18939,18 @@ var DVMServer = class {
         }
       }
       let jobId = publicRequestClaimResult?.jobId ?? this.jobManager.allocateJobId();
+      if (!resumeOnly && this.opts.hostingControlInstance) {
+        hostingAdmissionId = randomUUID4();
+        if (!await this.opts.hostingControlInstance.admit(hostingAdmissionId, jobId, {
+          paymentArtifactHash: hostingPaymentArtifactHash
+        })) {
+          return c.json({
+            error: "hosting_draining",
+            message: "This service is draining and is not accepting new jobs or payments.",
+            hint: "Keep any existing job token to fetch its result or reclaim unused credit. Retry a new job after service resumes."
+          }, 503);
+        }
+      }
       let payment = { paidMsats: 0, receivedProofs: [] };
       let resumedAcceptedPayment = false;
       if (resumeOnly) {
@@ -18788,6 +19007,9 @@ var DVMServer = class {
       const skipPayment = devModeSkipsPaymentVerification(this.opts);
       if (!skipPayment && !resumedAcceptedPayment) {
         const railOpts = await this.railVerifyOpts(c);
+        hostingPaymentMayHaveLanded = Boolean(
+          creditEnvelope || railOpts.cashuToken || railOpts.x402Payment || railOpts.mppCredential
+        );
         try {
           payment = await loggers.isolate.span(
             "dvm.payment.validate",
@@ -18901,8 +19123,12 @@ var DVMServer = class {
         );
       }
       const exactAdmission = payment.x402ExactAdmission;
+      hostingPaymentMayHaveLanded ||= resumedAcceptedPayment || payment.paidMsats > 0 || Boolean(payment.funding || exactAdmission);
       if (exactAdmission) {
         jobId = exactAdmission.jobId;
+        if (hostingAdmissionId) {
+          await this.opts.hostingControlInstance.rebindAdmissionJob(hostingAdmissionId, jobId);
+        }
         const prior = await this.jobManager.store.get(jobId);
         if (prior) {
           if (prior.requestFingerprint !== fingerprint || prior.requesterPubkey !== authPubkey || prior.requesterId !== c.get("requesterId")) {
@@ -18953,10 +19179,6 @@ var DVMServer = class {
         priceMsats,
         capabilityName,
         requesterTokenHash,
-        // everything the idempotent-replay path needs to recognise a
-        // retry of THIS call and re-issue the token its lost response carried.
-        // `jobId` is the pre-allocated id the payment's ledger draw
-        // already committed under.
         {
           requesterToken: jobToken,
           requestFingerprint: fingerprint,
@@ -18967,6 +19189,21 @@ var DVMServer = class {
         }
       );
       await jm.persistJob(job);
+      if (hostingAdmissionId) {
+        await this.opts.hostingControlInstance.finishAdmission(hostingAdmissionId, "accepted", jobId);
+        hostingAdmissionAccepted = true;
+      }
+      const reservedDrainDeadline = this.opts.hostingControlInstance ? await this.opts.hostingControlInstance.jobDeadline(jobId) : null;
+      const hostingStatus = await this.opts.hostingControlInstance?.status();
+      const currentDrainDeadline = hostingStatus?.state === "draining" ? hostingStatus.deadlineMs : null;
+      if (reservedDrainDeadline !== null && Date.now() >= reservedDrainDeadline || currentDrainDeadline !== null && currentDrainDeadline !== void 0 && Date.now() >= currentDrainDeadline) {
+        const store = jm.store;
+        if (store instanceof PostgresJobStore && await store.cancelJobForHosting(jobId, "Hosting drain deadline reached")) {
+          await jm.finalizeStoredTerminal(jobId);
+        }
+        const terminal = await store.get(jobId);
+        if (terminal) return buildSubmitResponse(c, terminal, jobToken);
+      }
       if (exactAdmission) {
         await this.x402ExactSettlement?.completeAdmission(
           this.opts.dvmId ?? "",
@@ -18988,6 +19225,12 @@ var DVMServer = class {
       }
       return response;
     } finally {
+      if (hostingAdmissionId && !hostingAdmissionAccepted) {
+        await this.opts.hostingControlInstance.finishAdmission(
+          hostingAdmissionId,
+          hostingPaymentMayHaveLanded ? "unresolved" : "failed"
+        );
+      }
       if (publicRequestClaim && recoveryStore) {
         await recoveryStore.releaseRequestIdClaim(publicRequestClaim);
       }
@@ -19039,20 +19282,9 @@ var DVMServer = class {
     });
   }
   /**
-   * The idempotent half of `POST /v1/job`. A paid submit whose
-   * response the caller lost is safe to retry — the accumulator's
-   * `UNIQUE(dvm_id, request_id, proof_secret)` makes the duplicate a no-op —
-   * but until now it was also useless: the caller got a 409 and the `job_id` /
-   * `job_token` it paid for stayed unreachable forever.
-   *
-   * Returns the original job's submit response iff the retry proves it is the
-   * original caller. Proof is reproducing the request, **not** possessing the
-   * spent Cashu token: the token is a bearer secret, so gating on it alone
-   * would hand the job (and its result) to anyone who lifted it. The legitimate
-   * retry always has the body — the resume sweep re-POSTs it — while a
-   * token thief does not. On a descriptor-auth DVM the caller pubkey must match
-   * too. Anything short of that falls through to the 409 the caller has always
-   * gotten.
+   * Recover a lost paid response only for matching request fingerprint,
+   * authenticated pubkey and requester identity. A spent bearer token alone
+   * is not proof of request ownership.
    */
   async recoverReplayedJob(c, opts) {
     if (!opts.requestId) return void 0;
@@ -19076,16 +19308,9 @@ var DVMServer = class {
     return buildSubmitResponse(c, prior, prior.requesterToken);
   }
   /**
-   * The draw-keyed half of idempotent recovery. The signed body's
-   * `(credit_id, draw_id)` matched a recorded draw;
-   * resolve the job it paid for (the draw carries its pre-allocated job id)
-   * and re-issue the original response under the SAME proof-of-origin gates
-   * as the header regime: reproduce the fingerprint, sign as the same caller
-   * (explicit draws only exist on descriptor-auth DVMs), match requesterId.
-   *
-   * A recorded draw whose job row never landed (crash between the ledger
-   * commit and the job persist) has nothing to hand back — refuse with the
-   * 409 and log loudly; the pending hold is surfaced by `listPendingDraws`.
+   * Resolve the recorded draw's job under the same fingerprint/pubkey/requester
+   * checks as header recovery. If no job exists, the caller may still recover a
+   * pending durable acceptance under its bound public request-id claim.
    */
   async recoverDrawnJob(c, opts) {
     let jobId = opts.jobId;
@@ -19195,12 +19420,9 @@ var DVMServer = class {
     return payment;
   }
   /**
-   * Recompute the upfront price for a dynamic-priced capability by
-   * re-invoking its `onQuote.handler` with the parsed job input as `data`
-   * Returns a 400-style error envelope when the input doesn't
-   * satisfy `onQuote.schema` or the handler throws — failing closed is the
-   * right default, since the alternative (running the job with
-   * `requiredMsats=undefined`) lets unpaid jobs through.
+   * Recompute dynamic upfront pricing from parsed job input, applying the quote
+   * schema separately. Refuse invalid input/results, currency mismatch or missing
+   * FX rather than running without a price (400/500/503 as classified below).
    */
   async computeDynamicPrice(onQuote, parsedInput, body, callerPubkey) {
     let data = parsedInput;
@@ -19977,16 +20199,9 @@ var PlatformTempoObserverHealth = class {
     };
   }
   /**
-   * Prime the signal during boot without making a menu request wait.
-   *
-   * De-dupes on the probe in flight, but only while that probe still speaks for
-   * the current set of declarations. `host.ts` primes this client before any
-   * mount exists, so at boot there is routinely an open probe carrying **no**
-   * `tempo_session` at all — handing it back to the mount that just declared
-   * one would leave a scale-to-zero DVM unstamped until traffic arrived, which
-   * is exactly the container-restart case is about. Same shape with
-   * two mounts: the second would join a probe whose URL already read the first
-   * one's `false`.
+   * De-duplicate probes only while their declaration epoch is current. A mount
+   * declared during boot or another mount's probe must await a fresh probe so
+   * the platform receives the updated capability, even before traffic arrives.
    */
   async refresh() {
     const open = this.inFlight;
@@ -20147,6 +20362,7 @@ export {
   createAdminCashuNonceStore,
   X402ExactSettlementServer,
   X402ExactSettlementEvidenceMissingError,
+  signHostingControl,
   jobCredentialGate,
   REQUEST_ID_FIELD,
   protocolEnvelopeIgnoreFields,