@dvmkit/sdk 0.2.1-rc.9 → 0.3.0-rc.10

package/dist/{chunk-JNKQZVZX.js → chunk-4VHTKNOR.js}

@@ -11,6 +11,9 @@ import {
 import {
   MemoryCreditLedger
 } from "./chunk-U5VNEALI.js";
+import {
+  PostgresJobStore
+} from "./chunk-HHTL3ZFT.js";
 import {
   SIGNED_ENVELOPE_FIELDS,
   SignedRequestError,
@@ -6756,6 +6759,18 @@ async function handleCreditRequest(c, deps) {
       await deps.settleLightning(callerPubkey, body.credit_id);
       return handleDrain(c, deps, { callerPubkey, body, envelope });
     case "fund":
+      if (deps.withFundingAdmission && body.fund) {
+        const creditId = body.credit_id ?? derivedFundCreditId(callerPubkey, body.fund.fund_id);
+        const [prior, invoice] = await Promise.all([
+          deps.ledger.getFunding({ creditId, fundId: body.fund.fund_id }),
+          body.fund.method === "lightning" ? deps.ledger.getInvoice({ creditId, fundId: body.fund.fund_id }) : Promise.resolve(void 0)
+        ]);
+        const priorCredit = prior ? await deps.ledger.get(creditId) : void 0;
+        if (priorCredit?.callerPubkey === callerPubkey || invoice?.callerPubkey === callerPubkey) {
+          return handleFund(c, deps, { callerPubkey, body, envelope, menu });
+        }
+        return deps.withFundingAdmission(c, body, () => handleFund(c, deps, { callerPubkey, body, envelope, menu }));
+      }
       return handleFund(c, deps, { callerPubkey, body, envelope, menu });
   }
 }
@@ -9071,6 +9086,371 @@ function safeError(err) {
   return "settlement_transport_error";
 }
 
+// src/sdk/server/hosting-control.ts
+import { createHmac, timingSafeEqual } from "crypto";
+function signHostingControl(secret, command) {
+  const signed = command.version === 2 ? [
+    "dvmkit-hosting-v2",
+    command.action,
+    command.scope,
+    command.dvmId,
+    command.generation ?? null,
+    command.leaseExpiresAtMs ?? null,
+    command.deadlineMs ?? null,
+    command.timestampMs,
+    command.nonce
+  ] : [
+    "dvmkit-hosting-v1",
+    command.action,
+    command.scope,
+    command.dvmId,
+    command.generation ?? null,
+    command.deadlineMs ?? null,
+    command.timestampMs,
+    command.nonce
+  ];
+  return createHmac("sha256", secret).update(JSON.stringify(signed)).digest("hex");
+}
+var HostingControl = class {
+  constructor(pool, dvmId, config) {
+    this.pool = pool;
+    this.dvmId = dvmId;
+    this.config = config;
+    if (Buffer.byteLength(config.secret) < 32 || !config.scope) {
+      throw new Error("Hosting control requires a 32-byte secret and a non-empty scope");
+    }
+  }
+  pool;
+  dvmId;
+  config;
+  async init() {
+    await withSdkInitLock(this.pool, async () => {
+      await this.pool.query(`
+      CREATE TABLE IF NOT EXISTS sdk_hosting_control (
+        dvm_id TEXT NOT NULL, scope TEXT NOT NULL, state TEXT NOT NULL,
+        generation BIGINT NOT NULL, deadline_ms BIGINT, lease_expires_at_ms BIGINT,
+        PRIMARY KEY (dvm_id, scope)
+      );
+      CREATE TABLE IF NOT EXISTS sdk_hosting_nonces (
+        dvm_id TEXT NOT NULL, scope TEXT NOT NULL, nonce TEXT NOT NULL,
+        created_at_ms BIGINT NOT NULL,
+        PRIMARY KEY (dvm_id, scope, nonce)
+      );
+      CREATE TABLE IF NOT EXISTS sdk_hosting_admissions (
+        id TEXT PRIMARY KEY, dvm_id TEXT NOT NULL, scope TEXT NOT NULL,
+        job_id TEXT NOT NULL, admitted_at_ms BIGINT NOT NULL,
+        outcome TEXT NOT NULL DEFAULT 'pending', drain_deadline_ms BIGINT,
+        credit_id TEXT, fund_id TEXT, payment_artifact_hash TEXT
+      );
+      ALTER TABLE sdk_hosting_admissions ADD COLUMN IF NOT EXISTS drain_deadline_ms BIGINT;
+      ALTER TABLE sdk_hosting_admissions ADD COLUMN IF NOT EXISTS credit_id TEXT;
+      ALTER TABLE sdk_hosting_admissions ADD COLUMN IF NOT EXISTS fund_id TEXT;
+      ALTER TABLE sdk_hosting_admissions ADD COLUMN IF NOT EXISTS payment_artifact_hash TEXT;
+      ALTER TABLE sdk_hosting_control ADD COLUMN IF NOT EXISTS lease_expires_at_ms BIGINT;
+      CREATE INDEX IF NOT EXISTS sdk_hosting_admissions_pending
+        ON sdk_hosting_admissions (dvm_id, scope) WHERE outcome = 'pending';
+      CREATE INDEX IF NOT EXISTS sdk_hosting_admissions_unresolved
+        ON sdk_hosting_admissions (dvm_id, scope) WHERE outcome = 'unresolved';
+      CREATE INDEX IF NOT EXISTS sdk_hosting_admissions_artifact
+        ON sdk_hosting_admissions (dvm_id, scope, payment_artifact_hash)
+        WHERE payment_artifact_hash IS NOT NULL;
+      CREATE INDEX IF NOT EXISTS sdk_hosting_admissions_job
+        ON sdk_hosting_admissions (dvm_id, job_id, scope);
+      CREATE INDEX IF NOT EXISTS sdk_hosting_nonces_age ON sdk_hosting_nonces (created_at_ms);
+      `);
+      await this.pool.query(
+        `INSERT INTO sdk_hosting_control (dvm_id, scope, state, generation)
+         VALUES ($1, $2, 'draining', 0) ON CONFLICT DO NOTHING`,
+        [this.dvmId, this.config.scope]
+      );
+      const client = await this.pool.connect();
+      try {
+        await client.query("BEGIN");
+        const migrated = await client.query(
+          `UPDATE sdk_hosting_control SET state='draining',
+             deadline_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint + 3600000
+           WHERE dvm_id=$1 AND scope=$2 AND state='accepting' AND lease_expires_at_ms IS NULL
+           RETURNING deadline_ms`,
+          [this.dvmId, this.config.scope]
+        );
+        if (migrated.rows[0]) await this.pinAdmissionDeadlines(client, Number(migrated.rows[0].deadline_ms));
+        await client.query("COMMIT");
+      } catch (error) {
+        await client.query("ROLLBACK").catch(() => void 0);
+        throw error;
+      } finally {
+        client.release();
+      }
+    });
+  }
+  async authorize(command, signature) {
+    if (command.version !== void 0 && command.version !== 2 || command.version === 2 && command.action !== "resume" || command.version === void 0 && command.leaseExpiresAtMs !== void 0 || command.scope !== this.config.scope || command.dvmId !== this.dvmId || !Number.isSafeInteger(command.timestampMs) || Math.abs(Date.now() - command.timestampMs) > 3e5 || typeof command.nonce !== "string" || !/^[A-Za-z0-9_-]{16,128}$/.test(command.nonce) || !signature || !/^[0-9a-f]{64}$/i.test(signature)) return false;
+    const actual = Buffer.from(signature, "hex");
+    const expected = Buffer.from(signHostingControl(this.config.secret, command), "hex");
+    if (!timingSafeEqual(actual, expected)) return false;
+    const result = await this.pool.query(
+      `INSERT INTO sdk_hosting_nonces (dvm_id, scope, nonce, created_at_ms)
+       VALUES ($1, $2, $3, $4) ON CONFLICT DO NOTHING`,
+      [this.dvmId, this.config.scope, command.nonce, Date.now()]
+    );
+    await this.pool.query("DELETE FROM sdk_hosting_nonces WHERE created_at_ms < $1", [Date.now() - 6e5]);
+    return result.rowCount === 1;
+  }
+  async admit(id, jobId, details) {
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      const { rows } = await client.query(
+        `SELECT state, lease_expires_at_ms, deadline_ms FROM sdk_hosting_control WHERE dvm_id=$1 AND scope=$2 FOR UPDATE`,
+        [this.dvmId, this.config.scope]
+      );
+      const now = await this.databaseNow(client);
+      const current = rows[0];
+      if (current) await this.expireIfNeeded(client, current, now);
+      if (current?.state !== "accepting" || current.lease_expires_at_ms === null || Number(current.lease_expires_at_ms) <= now) {
+        await client.query("COMMIT");
+        return false;
+      }
+      await client.query(
+        `INSERT INTO sdk_hosting_admissions
+         (id, dvm_id, scope, job_id, admitted_at_ms, credit_id, fund_id, payment_artifact_hash)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`,
+        [
+          id,
+          this.dvmId,
+          this.config.scope,
+          jobId,
+          now,
+          details?.creditId ?? null,
+          details?.fundId ?? null,
+          details?.paymentArtifactHash ?? null
+        ]
+      );
+      await client.query("COMMIT");
+      return true;
+    } catch (error) {
+      await client.query("ROLLBACK").catch(() => void 0);
+      throw error;
+    } finally {
+      client.release();
+    }
+  }
+  async acceptedJobByPaymentArtifactHash(hash2) {
+    const { rows } = await this.pool.query(
+      `SELECT a.job_id FROM sdk_hosting_admissions a
+       JOIN jobs j ON j.id=a.job_id
+       WHERE a.dvm_id=$1 AND a.scope=$2 AND a.payment_artifact_hash=$3
+         AND a.outcome IN ('accepted', 'unresolved', 'pending')
+       ORDER BY a.admitted_at_ms DESC LIMIT 1`,
+      [this.dvmId, this.config.scope, hash2]
+    );
+    return rows[0]?.job_id;
+  }
+  async rebindAdmissionJob(id, jobId) {
+    await this.pool.query(
+      `UPDATE sdk_hosting_admissions SET job_id=$2 WHERE id=$1 AND outcome='pending'`,
+      [id, jobId]
+    );
+  }
+  async finishAdmission(id, outcome, jobId) {
+    await this.pool.query(
+      `UPDATE sdk_hosting_admissions SET outcome=$2, job_id=COALESCE($3, job_id)
+       WHERE id=$1 AND outcome='pending'`,
+      [id, outcome, jobId ?? null]
+    );
+  }
+  async jobDeadline(jobId) {
+    const { rows } = await this.pool.query(
+      `SELECT MIN(drain_deadline_ms)::text AS drain_deadline_ms
+       FROM sdk_hosting_admissions WHERE dvm_id=$1 AND scope=$2 AND job_id=$3`,
+      [this.dvmId, this.config.scope, jobId]
+    );
+    return rows[0]?.drain_deadline_ms === null || !rows[0] ? null : Number(rows[0].drain_deadline_ms);
+  }
+  async dispatchDeadlineReached(jobId) {
+    const { rows } = await this.pool.query(
+      `SELECT EXISTS (
+         SELECT 1 FROM sdk_hosting_admissions
+         WHERE dvm_id=$1 AND scope=$2 AND job_id=$3
+           AND drain_deadline_ms <= FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint
+       ) OR EXISTS (
+         SELECT 1 FROM sdk_hosting_control
+         WHERE dvm_id=$1 AND scope=$2 AND state='draining'
+           AND deadline_ms <= FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint
+       ) AS reached`,
+      [this.dvmId, this.config.scope, jobId]
+    );
+    return rows[0]?.reached ?? false;
+  }
+  async databaseNow(client) {
+    const { rows } = await client.query(
+      `SELECT FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint AS now_ms`
+    );
+    return Number(rows[0].now_ms);
+  }
+  async pinAdmissionDeadlines(client, deadlineMs) {
+    await client.query(
+      `UPDATE sdk_hosting_admissions SET drain_deadline_ms=
+         CASE WHEN drain_deadline_ms IS NULL THEN $3 ELSE LEAST(drain_deadline_ms, $3) END
+       WHERE dvm_id=$1 AND scope=$2 AND outcome <> 'failed'`,
+      [this.dvmId, this.config.scope, deadlineMs]
+    );
+  }
+  async expireIfNeeded(client, row, now) {
+    if (row.state !== "accepting" || row.lease_expires_at_ms !== null && Number(row.lease_expires_at_ms) > now) return;
+    const deadline = row.deadline_ms === null ? now + 36e5 : Number(row.deadline_ms);
+    await client.query(
+      `UPDATE sdk_hosting_control SET state='draining', deadline_ms=$3
+       WHERE dvm_id=$1 AND scope=$2`,
+      [this.dvmId, this.config.scope, deadline]
+    );
+    row.state = "draining";
+    row.deadline_ms = String(deadline);
+    await this.pinAdmissionDeadlines(client, deadline);
+  }
+  async transition(command) {
+    if (command.action !== "drain" && command.action !== "resume" || !Number.isSafeInteger(command.generation) || command.generation < 1 || command.action === "drain" && (command.version !== void 0 || !Number.isSafeInteger(command.deadlineMs) || command.leaseExpiresAtMs !== void 0) || command.action === "resume" && (command.version !== 2 || !Number.isSafeInteger(command.leaseExpiresAtMs) || !Number.isSafeInteger(command.deadlineMs))) return "conflict";
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      const { rows } = await client.query(
+        `SELECT state, generation, deadline_ms, lease_expires_at_ms FROM sdk_hosting_control
+         WHERE dvm_id=$1 AND scope=$2 FOR UPDATE`,
+        [this.dvmId, this.config.scope]
+      );
+      const prior = rows[0];
+      if (!prior) throw new Error("Hosting control was not initialized");
+      const now = await this.databaseNow(client);
+      await this.expireIfNeeded(client, prior, now);
+      const generation = Number(prior.generation);
+      const nextState = command.action === "drain" ? "draining" : "accepting";
+      if (command.generation === generation && prior.state === nextState && Number(prior.deadline_ms ?? 0) === (command.deadlineMs ?? 0) && (command.action !== "resume" || Number(prior.lease_expires_at_ms ?? 0) === command.leaseExpiresAtMs)) {
+        await client.query("COMMIT");
+        return "ok";
+      }
+      if (command.generation <= generation) {
+        await client.query("ROLLBACK");
+        return "conflict";
+      }
+      if (command.action === "drain" && (command.deadlineMs <= now || command.deadlineMs > now + 864e5)) {
+        await client.query("ROLLBACK");
+        return "conflict";
+      }
+      if (command.action === "resume" && (command.leaseExpiresAtMs <= now || command.leaseExpiresAtMs > now + 36e5 || command.deadlineMs <= command.leaseExpiresAtMs || command.deadlineMs > command.leaseExpiresAtMs + 36e5)) {
+        await client.query("ROLLBACK");
+        return "conflict";
+      }
+      await client.query(
+        `UPDATE sdk_hosting_control SET state=$3, generation=$4, deadline_ms=$5,
+           lease_expires_at_ms=$6
+         WHERE dvm_id=$1 AND scope=$2`,
+        [
+          this.dvmId,
+          this.config.scope,
+          nextState,
+          command.generation,
+          command.deadlineMs ?? null,
+          command.action === "resume" ? command.leaseExpiresAtMs : null
+        ]
+      );
+      if (command.action === "drain") {
+        await this.pinAdmissionDeadlines(client, command.deadlineMs);
+      }
+      await client.query("COMMIT");
+      return "ok";
+    } catch (error) {
+      await client.query("ROLLBACK").catch(() => void 0);
+      throw error;
+    } finally {
+      client.release();
+    }
+  }
+  async status() {
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      const locked = await client.query(
+        `SELECT state, deadline_ms, lease_expires_at_ms FROM sdk_hosting_control
+         WHERE dvm_id=$1 AND scope=$2 FOR UPDATE`,
+        [this.dvmId, this.config.scope]
+      );
+      if (locked.rows[0]) await this.expireIfNeeded(client, locked.rows[0], await this.databaseNow(client));
+      await client.query("COMMIT");
+    } catch (error) {
+      await client.query("ROLLBACK").catch(() => void 0);
+      throw error;
+    } finally {
+      client.release();
+    }
+    await this.pool.query(
+      `UPDATE sdk_hosting_admissions a SET outcome='accepted'
+       WHERE a.dvm_id=$1 AND a.scope=$2 AND a.outcome='pending'
+         AND EXISTS (SELECT 1 FROM jobs j WHERE j.id=a.job_id)`,
+      [this.dvmId, this.config.scope]
+    );
+    const creditTable = await this.pool.query(
+      "SELECT to_regclass('credit_fundings') IS NOT NULL AS present"
+    );
+    await this.pool.query(
+      `UPDATE sdk_hosting_admissions a SET outcome='accepted'
+       WHERE a.dvm_id=$1 AND a.scope=$2 AND a.outcome='unresolved'
+         AND (EXISTS (SELECT 1 FROM jobs j WHERE j.id=a.job_id)
+           ${creditTable.rows[0].present ? `OR (a.credit_id IS NOT NULL AND EXISTS (
+             SELECT 1 FROM credit_fundings f WHERE f.credit_id=a.credit_id AND f.fund_id=a.fund_id
+           ))` : ""})`,
+      [this.dvmId, this.config.scope]
+    );
+    const { rows } = await this.pool.query(
+      `SELECT state, generation, deadline_ms, lease_expires_at_ms FROM sdk_hosting_control WHERE dvm_id=$1 AND scope=$2`,
+      [this.dvmId, this.config.scope]
+    );
+    const active = await this.pool.query(
+      `SELECT j.id FROM jobs j WHERE j.dvm_id=$1
+         AND j.status IN ('processing', 'working', 'awaiting-input')
+         AND EXISTS (SELECT 1 FROM sdk_hosting_admissions a
+           WHERE a.dvm_id=j.dvm_id AND a.job_id=j.id AND a.scope=$2)
+       ORDER BY j.id`,
+      [this.dvmId, this.config.scope]
+    );
+    const unowned = await this.pool.query(
+      `SELECT j.id FROM jobs j WHERE j.dvm_id=$1
+         AND j.status IN ('processing', 'working', 'awaiting-input')
+         AND NOT EXISTS (SELECT 1 FROM sdk_hosting_admissions a
+           WHERE a.dvm_id=j.dvm_id AND a.job_id=j.id)
+       ORDER BY j.id`,
+      [this.dvmId]
+    );
+    const pending = await this.pool.query(
+      `SELECT COUNT(*) FILTER (WHERE outcome='pending')::text AS pending,
+              COUNT(*) FILTER (WHERE outcome='unresolved')::text AS unresolved
+       FROM sdk_hosting_admissions WHERE dvm_id=$1 AND scope=$2`,
+      [this.dvmId, this.config.scope]
+    );
+    const unresolved = await this.pool.query(
+      `SELECT id, job_id FROM sdk_hosting_admissions
+       WHERE dvm_id=$1 AND scope=$2 AND outcome='unresolved' ORDER BY admitted_at_ms, id`,
+      [this.dvmId, this.config.scope]
+    );
+    const inFlight = await this.pool.query(
+      `SELECT id, job_id FROM sdk_hosting_admissions
+       WHERE dvm_id=$1 AND scope=$2 AND outcome='pending' ORDER BY admitted_at_ms, id`,
+      [this.dvmId, this.config.scope]
+    );
+    return {
+      state: rows[0].state,
+      generation: Number(rows[0].generation),
+      deadlineMs: rows[0].deadline_ms === null ? null : Number(rows[0].deadline_ms),
+      leaseExpiresAtMs: rows[0].lease_expires_at_ms === null ? null : Number(rows[0].lease_expires_at_ms),
+      activeJobIds: active.rows.map((row) => row.id),
+      unownedActiveJobIds: unowned.rows.map((row) => row.id),
+      pendingAdmissionCount: Number(pending.rows[0].pending),
+      pendingAdmissions: inFlight.rows.map((row) => ({ admissionId: row.id, workId: row.job_id })),
+      unresolvedAdmissionCount: Number(pending.rows[0].unresolved),
+      unresolvedAdmissions: unresolved.rows.map((row) => ({ admissionId: row.id, jobId: row.job_id }))
+    };
+  }
+};
+
 // src/sdk/server/job-credential.ts
 function jobCredentialGate(opts) {
   const alternative = opts.acceptsBearer ? ", or the Authorization: Bearer token the job was submitted with" : "";
@@ -16730,6 +17110,7 @@ async function createDVMServer(descriptor, opts) {
   let x402ChannelStorage;
   let x402BatchSettlement;
   let server;
+  let hostingControl;
   let shutdownPromise;
   const shutdown = () => shutdownPromise ??= (async () => {
     const errors = [];
@@ -16923,8 +17304,19 @@ async function createDVMServer(descriptor, opts) {
         });
       }
     }) : void 0;
+    if (opts.hostingControl) {
+      if (!opts.db || !opts.dvmId || !(opts.jobStore instanceof PostgresJobStore)) {
+        throw new Error("Hosting control requires a Postgres pool, dvmId, and PostgresJobStore");
+      }
+      if (descriptor.credit && !opts.creditLedger?.durable) {
+        throw new Error("Hosting control with credit requires a durable credit ledger");
+      }
+      hostingControl = new HostingControl(opts.db, opts.dvmId, opts.hostingControl);
+      await hostingControl.init();
+    }
     server = new DVMServer(descriptor, {
       ...opts,
+      hostingControlInstance: hostingControl,
       creditLedger,
       processedPayments,
       onJobCompleted: effectiveOnJobCompleted,
@@ -17001,6 +17393,7 @@ var DVMServer = class {
   x402ExactSettlement;
   /** Withdraws this mount's Tempo session capability from the poll. */
   undeclareSessionCapability;
+  hostingSweepTimer;
   constructor(descriptor, opts) {
     this.descriptor = descriptor;
     this.pricingCurrency = descriptor.currency ?? "usd";
@@ -17084,6 +17477,17 @@ var DVMServer = class {
     this.app = new Hono();
     try {
       this.registerRoutes();
+      if (opts.hostingControlInstance) {
+        this.hostingSweepTimer = setInterval(() => {
+          void this.sweepHostingDeadline().catch((error) => {
+            console.error("Hosting deadline sweep failed:", error);
+          });
+        }, 1e3);
+        this.hostingSweepTimer.unref();
+        void this.sweepHostingDeadline().catch((error) => {
+          console.error("Hosting deadline sweep failed:", error);
+        });
+      }
       if (this.ownsMintHealthTracker) this.mintHealthTracker?.start();
       if (this.opts.tempoObserverHealth?.declareSessionCapability) {
         this.undeclareSessionCapability = this.opts.tempoObserverHealth.declareSessionCapability(
@@ -17117,6 +17521,7 @@ var DVMServer = class {
    * and host teardown layers can finish later cleanup before surfacing it.
    */
   shutdown() {
+    if (this.hostingSweepTimer) clearInterval(this.hostingSweepTimer);
     this.jobManager.shutdown();
     const settlement = this.x402BatchSettlementInit ?? Promise.resolve(this.x402BatchSettlement);
     const stopped = settlement.then((s) => s?.stop());
@@ -17125,6 +17530,40 @@ var DVMServer = class {
     this.undeclareSessionCapability = void 0;
     return stopped;
   }
+  async sweepHostingDeadline() {
+    const control = this.opts.hostingControlInstance;
+    if (!control) return;
+    const status = await control.status();
+    const store = this.jobManager.store;
+    if (!(store instanceof PostgresJobStore)) return;
+    for (const jobId of status.activeJobIds) {
+      if (await control.dispatchDeadlineReached(jobId) && await store.cancelJobForHosting(jobId, "Hosting drain deadline reached")) {
+        await this.jobManager.finalizeStoredTerminal(jobId);
+      }
+    }
+  }
+  async handleHostingCommand(c, statusOnly) {
+    const control = this.opts.hostingControlInstance;
+    if (!control) return c.json({ error: "not_found" }, 404);
+    let command;
+    try {
+      command = await c.req.json();
+    } catch {
+      return c.json({ error: "invalid_hosting_control" }, 400);
+    }
+    if (!command || (statusOnly ? command.action !== "status" : command.action !== "drain" && command.action !== "resume")) {
+      return c.json({ error: "invalid_hosting_control" }, 400);
+    }
+    if (!await control.authorize(command, c.req.header("X-DVM-Hosting-Signature"))) {
+      return c.json({ error: "hosting_control_unauthorized" }, 401);
+    }
+    if (!statusOnly && command.action === "resume") await this.sweepHostingDeadline();
+    if (!statusOnly && await control.transition(command) === "conflict") {
+      return c.json({ error: "hosting_generation_conflict" }, 409);
+    }
+    if (!statusOnly) await this.sweepHostingDeadline();
+    return c.json(await control.status());
+  }
   registerRoutes() {
     const dvmSlug = this.descriptor.name;
     const builderPubkey = this.opts.builder?.pubkey;
@@ -17232,6 +17671,10 @@ var DVMServer = class {
     this.app.get("/v1/info", (c) => this.handleInfo(c));
     this.app.post("/v1/quote", (c) => this.handleQuote(c));
     this.app.post("/v1/job", (c) => this.handleCreateJob(c));
+    if (this.opts.hostingControlInstance) {
+      this.app.post("/_hosting/control", (c) => this.handleHostingCommand(c, false));
+      this.app.post("/_hosting/status", (c) => this.handleHostingCommand(c, true));
+    }
     this.app.post("/v1/request-resume/:requestId", (c) => this.handleCreateJob(c, true));
     this.app.post("/v1/request-result/:requestId", (c) => this.handleRequestResult(c));
     this.app.get("/v1/job/:id", (c) => this.handleGetJob(c));
@@ -17850,6 +18293,32 @@ var DVMServer = class {
       receiptIssuer: this.receiptIssuer,
       lightning: this.opts.lightningReceive ? { receive: this.opts.lightningReceive } : void 0,
       settleLightning: (callerPubkey, creditId) => this.settleLightningFunding(callerPubkey, creditId),
+      withFundingAdmission: this.opts.hostingControlInstance ? async (ctx, body, run) => {
+        const control = this.opts.hostingControlInstance;
+        const admissionId = randomUUID4();
+        const fundId = body.fund?.fund_id ?? admissionId;
+        const creditId = body.credit_id ?? derivedFundCreditId(body.pubkey, fundId);
+        const workId = `credit-fund:${creditId}:${fundId}`;
+        if (!await control.admit(admissionId, workId, { creditId, fundId })) {
+          return ctx.json({
+            error: "hosting_draining",
+            message: "This service is draining and is not accepting new credit funding.",
+            hint: "Balance, reclaim, and already-issued funding recovery remain available."
+          }, 503);
+        }
+        const authorization = ctx.req.header("Authorization");
+        const paymentArtifact = Boolean(
+          ctx.req.header("X-Cashu") || ctx.req.header("PAYMENT-SIGNATURE") || ctx.req.header("X-PAYMENT") || authorization && /^Payment\s/i.test(authorization)
+        );
+        let outcome = paymentArtifact ? "unresolved" : "failed";
+        try {
+          const response = await run();
+          if (response.ok || body.fund?.method === "lightning" && await this.creditLedger.getInvoice({ creditId, fundId })) outcome = "accepted";
+          return response;
+        } finally {
+          await control.finishAdmission(admissionId, outcome);
+        }
+      } : void 0,
       tempoSettlementReadiness: this.opts.tempoSettlementReadiness
     });
   }
@@ -18514,8 +18983,40 @@ var DVMServer = class {
       { capability: capabilityName, input: body.input, params: body.params, data: body.data },
       { stripAuthEnvelope: false }
     ) : void 0;
+    const authorization = c.req.header("Authorization");
+    const attachedPayment = c.req.header("X-Cashu") ?? c.req.header("PAYMENT-SIGNATURE") ?? c.req.header("X-PAYMENT") ?? (authorization && /^Payment\s/i.test(authorization) ? authorization : void 0);
+    const hostingPaymentArtifactHash = attachedPayment ? createHash7("sha256").update(attachedPayment).digest("hex") : void 0;
+    if (!resumeOnly && this.opts.hostingControlInstance && hostingPaymentArtifactHash) {
+      const priorId = await this.opts.hostingControlInstance.acceptedJobByPaymentArtifactHash(
+        hostingPaymentArtifactHash
+      );
+      const prior = priorId ? await this.jobManager.store.get(priorId) : void 0;
+      if (prior && prior.requestFingerprint === fingerprint && prior.requesterId === c.get("requesterId") && (!this.descriptor.auth || prior.requesterPubkey === authPubkey)) {
+        await this.jobManager.ensureReceipt(prior);
+        return buildSubmitResponse(c, prior, prior.requesterToken);
+      }
+    }
+    if (!resumeOnly && this.opts.hostingControlInstance && creditEnvelope && authPubkey) {
+      const draw = await this.creditLedger.getDraw({
+        creditId: creditEnvelope.creditId,
+        drawId: creditEnvelope.drawId
+      });
+      if (draw?.jobId && await this.jobManager.store.get(draw.jobId)) {
+        const recovered = await this.recoverDrawnJob(c, {
+          creditId: creditEnvelope.creditId,
+          drawId: creditEnvelope.drawId,
+          jobId: draw.jobId,
+          fingerprint,
+          callerPubkey: authPubkey
+        });
+        if (recovered) return recovered;
+      }
+    }
     let publicRequestClaim;
     let publicRequestClaimResult;
+    let hostingAdmissionId;
+    let hostingAdmissionAccepted = false;
+    let hostingPaymentMayHaveLanded = false;
     if (publicRequestId && authPubkey && recoveryStore) {
       publicRequestClaim = {
         requestId: publicRequestId,
@@ -18538,6 +19039,18 @@ var DVMServer = class {
         }
       }
       let jobId = publicRequestClaimResult?.jobId ?? this.jobManager.allocateJobId();
+      if (!resumeOnly && this.opts.hostingControlInstance) {
+        hostingAdmissionId = randomUUID4();
+        if (!await this.opts.hostingControlInstance.admit(hostingAdmissionId, jobId, {
+          paymentArtifactHash: hostingPaymentArtifactHash
+        })) {
+          return c.json({
+            error: "hosting_draining",
+            message: "This service is draining and is not accepting new jobs or payments.",
+            hint: "Keep any existing job token to fetch its result or reclaim unused credit. Retry a new job after service resumes."
+          }, 503);
+        }
+      }
       let payment = { paidMsats: 0, receivedProofs: [] };
       let resumedAcceptedPayment = false;
       if (resumeOnly) {
@@ -18594,6 +19107,9 @@ var DVMServer = class {
       const skipPayment = devModeSkipsPaymentVerification(this.opts);
       if (!skipPayment && !resumedAcceptedPayment) {
         const railOpts = await this.railVerifyOpts(c);
+        hostingPaymentMayHaveLanded = Boolean(
+          creditEnvelope || railOpts.cashuToken || railOpts.x402Payment || railOpts.mppCredential
+        );
         try {
           payment = await loggers.isolate.span(
             "dvm.payment.validate",
@@ -18707,8 +19223,12 @@ var DVMServer = class {
         );
       }
       const exactAdmission = payment.x402ExactAdmission;
+      hostingPaymentMayHaveLanded ||= resumedAcceptedPayment || payment.paidMsats > 0 || Boolean(payment.funding || exactAdmission);
       if (exactAdmission) {
         jobId = exactAdmission.jobId;
+        if (hostingAdmissionId) {
+          await this.opts.hostingControlInstance.rebindAdmissionJob(hostingAdmissionId, jobId);
+        }
         const prior = await this.jobManager.store.get(jobId);
         if (prior) {
           if (prior.requestFingerprint !== fingerprint || prior.requesterPubkey !== authPubkey || prior.requesterId !== c.get("requesterId")) {
@@ -18769,6 +19289,19 @@ var DVMServer = class {
         }
       );
       await jm.persistJob(job);
+      if (hostingAdmissionId) {
+        await this.opts.hostingControlInstance.finishAdmission(hostingAdmissionId, "accepted", jobId);
+        hostingAdmissionAccepted = true;
+      }
+      await this.opts.hostingControlInstance?.status();
+      if (this.opts.hostingControlInstance && await this.opts.hostingControlInstance.dispatchDeadlineReached(jobId)) {
+        const store = jm.store;
+        if (store instanceof PostgresJobStore && await store.cancelJobForHosting(jobId, "Hosting drain deadline reached")) {
+          await jm.finalizeStoredTerminal(jobId);
+        }
+        const terminal = await store.get(jobId);
+        if (terminal) return buildSubmitResponse(c, terminal, jobToken);
+      }
       if (exactAdmission) {
         await this.x402ExactSettlement?.completeAdmission(
           this.opts.dvmId ?? "",
@@ -18790,6 +19323,12 @@ var DVMServer = class {
       }
       return response;
     } finally {
+      if (hostingAdmissionId && !hostingAdmissionAccepted) {
+        await this.opts.hostingControlInstance.finishAdmission(
+          hostingAdmissionId,
+          hostingPaymentMayHaveLanded ? "unresolved" : "failed"
+        );
+      }
       if (publicRequestClaim && recoveryStore) {
         await recoveryStore.releaseRequestIdClaim(publicRequestClaim);
       }
@@ -19921,6 +20460,7 @@ export {
   createAdminCashuNonceStore,
   X402ExactSettlementServer,
   X402ExactSettlementEvidenceMissingError,
+  signHostingControl,
   jobCredentialGate,
   REQUEST_ID_FIELD,
   protocolEnvelopeIgnoreFields,

package/dist/{chunk-JAHRF5X3.js → chunk-HHTL3ZFT.js}

@@ -1053,10 +1053,13 @@ var PostgresJobStore = class {
     );
   }
   cancelStaleJob(jobId, expectedActivityBefore, reason, terminalStatus) {
-    return this.terminateJob(jobId, reason, terminalStatus, expectedActivityBefore);
+    return this.terminateJob(jobId, reason, terminalStatus, expectedActivityBefore, null);
   }
   cancelJob(jobId, reason) {
-    return this.terminateJob(jobId, reason, "cancelled", null);
+    return this.terminateJob(jobId, reason, "cancelled", null, "caller");
+  }
+  cancelJobForHosting(jobId, reason) {
+    return this.terminateJob(jobId, reason, "cancelled", null, "provider");
   }
   async getCounters(jobId) {
     const { rows } = await this.pool.query(
@@ -1209,7 +1212,7 @@ var PostgresJobStore = class {
    * machine running the handler wakes as soon as the terminal status is
    * visible.
    */
-  async terminateJob(jobId, reason, terminalStatus, expectedActivityBefore) {
+  async terminateJob(jobId, reason, terminalStatus, expectedActivityBefore, endedBy) {
     const staleOnly = expectedActivityBefore !== null;
     const client = await this.pool.connect();
     try {
@@ -1241,7 +1244,7 @@ var PostgresJobStore = class {
       );
       await client.query(
         `UPDATE jobs SET
-           ended_by = CASE WHEN $7::boolean OR status = 'awaiting-input' THEN 'caller' ELSE 'provider' END,
+           ended_by = COALESCE($7::text, CASE WHEN status = 'awaiting-input' THEN 'caller' ELSE 'provider' END),
            terminal_at_ms = $5,
            caller_wait_ms = caller_wait_ms + CASE WHEN status = 'awaiting-input'
              THEN GREATEST(0, $5 - COALESCE(awaiting_input_at_ms, last_activity_at)) ELSE 0 END,
@@ -1253,7 +1256,7 @@ var PostgresJobStore = class {
            next_seq = $4 + 1,
            last_activity_at = $5
          WHERE id = $1`,
-        [jobId, reason, JSON.stringify([cancelMsg]), nextSeq, now, terminalStatus, !staleOnly]
+        [jobId, reason, JSON.stringify([cancelMsg]), nextSeq, now, terminalStatus, endedBy]
       );
       await client.query("SELECT pg_notify('job_messages', $1)", [jobId]);
       await client.query("COMMIT");

package/dist/{credit-menu-kDA9RVzD.d.ts → credit-menu-0-UtJ3hh.d.ts}

@@ -181,6 +181,45 @@ interface CreditExpirySweepOpts {
     limit?: number;
 }
 
+interface HostingControlConfig {
+    /** Dedicated management key. Use at least 32 random bytes; never reuse a caller or builder key. */
+    secret: string;
+    /** Deployment scope shared by the platform and this DVM, independent of its caller origin. */
+    scope: string;
+}
+interface HostingControlCommand {
+    /** Version two is required for resume; version one remains valid for drain and status. */
+    version?: 2;
+    action: "drain" | "resume" | "status";
+    scope: string;
+    dvmId: string;
+    timestampMs: number;
+    nonce: string;
+    generation?: number;
+    deadlineMs?: number;
+    leaseExpiresAtMs?: number;
+}
+/** Ordered JSON arrays are the versioned wire signing contract. */
+declare function signHostingControl(secret: string, command: HostingControlCommand): string;
+interface HostingControlStatus {
+    state: "accepting" | "draining";
+    generation: number;
+    deadlineMs: number | null;
+    leaseExpiresAtMs: number | null;
+    activeJobIds: string[];
+    unownedActiveJobIds: string[];
+    pendingAdmissionCount: number;
+    pendingAdmissions: {
+        admissionId: string;
+        workId: string;
+    }[];
+    unresolvedAdmissionCount: number;
+    unresolvedAdmissions: {
+        admissionId: string;
+        jobId: string;
+    }[];
+}
+
 interface PromptResolver {
     resolve: (value: ResponseContent) => void;
     reject: (reason: Error) => void;
@@ -3676,6 +3715,8 @@ interface DVMServeResult {
     paymentModes: PaymentMode[];
 }
 interface DVMHostOpts {
+    /** Dedicated hosting-management authority for each mounted DVM. Requires durable Postgres. */
+    hostingControl?: HostingControlConfig;
     /**
      * Postgres connection string. Defaults to `DATABASE_URL` env.
      * Required at runtime. Boot fails when missing unless `jobStore`
@@ -4054,6 +4095,8 @@ interface SDKServerOpts {
     canonicalDvmId?: string;
     /** Postgres pool for builder admin state and wallet accumulator persistence. */
     db?: Pool;
+    /** Enables authenticated, durable hosting admission and bounded drain. Requires Postgres and dvmId. */
+    hostingControl?: HostingControlConfig;
     /**
      * Host strict-mode flag. Reporter readiness follows hosted context regardless
      * of this value.
@@ -4370,4 +4413,4 @@ declare function attachCreditMenu(body: Record<string, unknown>, menu: CreditMen
  */
 declare function toCreditTerms(menu: CreditMenu): CreditTerms;
 
-export { isTerminal as $, type AccumulatorPool as A, buildPaymentErrorResponse as B, type ConsumedCredentialStore as C, clearAccumulatorForDvm as D, createDVMServer as E, type FiatDenomination as F, creditDepositPayload as G, derivedFundCreditId as H, type IncomingPaymentOpts as I, JobCancelledError as J, devModeSkipsPaymentVerification as K, fromJobRecord as L, MintHealthTracker as M, fundedMicroFor as N, hasPaymentProof as O, PAYMENT_PROOF_KEYS as P, hashLockKey as Q, type ReporterBannerOpts as R, type SDKServerOpts as S, type TempoChannelReport as T, type UpfrontPaymentOpts as U, type VerifiedIncomingPayment as V, implicitCreditId as W, type X402BatchChannelObservation as X, initWalletAccumulatorTable as Y, insertAccumulatorRows as Z, isDerivedCreditId as _, type AccumulatorQuerier as a, type X402ExactSettlementAttempt as a$, isYieldMessage as a0, issueUpfrontChallenges as a1, msatsToFiatMicro as a2, paymentErrorBody as a3, pinAskFiat as a4, priceFiatMicro as a5, processIncomingPayment as a6, providerMessage as a7, repairX402ExactSettlementEffect as a8, resolveFxSnapshot as a9, JobManager as aA, type JobManagerOpts as aB, type LightningReceiveConfig as aC, MIN_INVOICE_TTL_SECONDS as aD, MemoryConsumedCredentialStore as aE, type MemoryConsumedCredentialStoreOpts as aF, MemoryProcessedPaymentStore as aG, MemoryX402ExactSettlementStore as aH, type MountOpts as aI, type OwnerDisplay as aJ, type PaidJobCompletion as aK, type PaymentMode as aL, type PlatformReporterOpts as aM, PostgresProcessedPaymentStore as aN, PostgresX402ExactSettlementStore as aO, type PriceFiat as aP, type ProcessedPaymentQuerier as aQ, type ProcessedPaymentRail as aR, type ProcessedPaymentRecord as aS, ProcessedPaymentReplayError as aT, type ProcessedPaymentStore as aU, type X402BatchAcceptance as aV, type X402BatchFunding as aW, type X402BatchRefusal as aX, type X402BatchSettlementServer as aY, type X402ExactAcceptance as aZ, X402ExactIntentConflictError as a_, resolvePriceFiat as aa, revenueReporterBannerState as ab, toCreditTerms as ac, toJobRecord as ad, unknownRouteNotFound as ae, verifyIncomingPayment as af, verifyTempoSessionManagementCredential as ag, verifyUpfrontPayment as ah, x402RequiredUsdcMicro as ai, x402SettledShare as aj, type CreditMenu as ak, ReceiptIssuer as al, LightningReceive as am, TempoSettlementReadiness as an, type DVMHostOpts as ao, type DVMServeResult as ap, type BuildCreditMenuArgs as aq, type BuilderIdentity as ar, CREDIT_ENVELOPE_KEYS as as, type CreateX402BatchSettlementServerOpts as at, type CreditEnvelope as au, CreditEnvelopeError as av, type CreditFundCommitment as aw, type CreditTerms as ax, DEFAULT_INVOICE_TTL_SECONDS as ay, type DVMHost as az, type AppEnv as b, type X402ExactSettlementChainEvidence as b0, type X402ExactSettlementEffect as b1, X402ExactSettlementEvidenceMissingError as b2, type X402ExactSettlementEvidenceReader as b3, type X402ExactSettlementIntent as b4, X402ExactSettlementNotReadyError as b5, X402ExactSettlementServer as b6, type X402ExactSettlementServerOpts as b7, type X402ExactSettlementStatus as b8, type X402ExactSettlementStore as b9, type X402SettlementChainEvidence as ba, type X402SettlementEvidenceReader as bb, X402SettlementSubmissionError as bc, X402_BATCH_AUTO_SETTLEMENT as bd, X402_BATCH_MIN_WITHDRAW_DELAY_SECONDS as be, X402_BATCH_SETTLEMENT_NETWORK as bf, attachCreditMenu as bg, buildCreditMenu as bh, createDVMHost as bi, createX402BatchSettlementServer as bj, creditEnvelopeIgnoreFields as bk, drawSettlementRef as bl, extractCreditEnvelope as bm, fundingCommitment as bn, selectPrimaryCredit as bo, stripCreditEnvelope as bp, toCreditView as bq, type CreditFundingReport as c, type FiatDenominationFailure as d, type FundOnlyRequest as e, type PaymentErrorCode as f, type PaymentErrorDetail as g, type PaymentInfo as h, type ResolvedFx as i, type RevenueBootCheckOpts as j, type ServerJob as k, type ShortPayForfeit as l, type TempoObserverHealth as m, TempoSessionChannelMismatchError as n, type VerifyIncomingSnapshot as o, X402FacilitatorHealth as p, type X402SettlementEvidenceOutcome as q, type X402SettlementRepair as r, type X402SettlementRepairRefusal as s, type X402SettlementRepaired as t, type X402WedgedSettlement as u, type X402WedgedSettlementPage as v, X402_BATCH_SETTLEMENT_MAINNET_NETWORK as w, abortJob as x, applyPaymentInfoToJob as y, assertRevenueReporterReady as z };
+export { isTerminal as $, type AccumulatorPool as A, buildPaymentErrorResponse as B, type ConsumedCredentialStore as C, clearAccumulatorForDvm as D, createDVMServer as E, type FiatDenomination as F, creditDepositPayload as G, derivedFundCreditId as H, type IncomingPaymentOpts as I, JobCancelledError as J, devModeSkipsPaymentVerification as K, fromJobRecord as L, MintHealthTracker as M, fundedMicroFor as N, hasPaymentProof as O, PAYMENT_PROOF_KEYS as P, hashLockKey as Q, type ReporterBannerOpts as R, type SDKServerOpts as S, type TempoChannelReport as T, type UpfrontPaymentOpts as U, type VerifiedIncomingPayment as V, implicitCreditId as W, type X402BatchChannelObservation as X, initWalletAccumulatorTable as Y, insertAccumulatorRows as Z, isDerivedCreditId as _, type AccumulatorQuerier as a, type X402BatchSettlementServer as a$, isYieldMessage as a0, issueUpfrontChallenges as a1, msatsToFiatMicro as a2, paymentErrorBody as a3, pinAskFiat as a4, priceFiatMicro as a5, processIncomingPayment as a6, providerMessage as a7, repairX402ExactSettlementEffect as a8, resolveFxSnapshot as a9, type HostingControlCommand as aA, type HostingControlConfig as aB, type HostingControlStatus as aC, JobManager as aD, type JobManagerOpts as aE, type LightningReceiveConfig as aF, MIN_INVOICE_TTL_SECONDS as aG, MemoryConsumedCredentialStore as aH, type MemoryConsumedCredentialStoreOpts as aI, MemoryProcessedPaymentStore as aJ, MemoryX402ExactSettlementStore as aK, type MountOpts as aL, type OwnerDisplay as aM, type PaidJobCompletion as aN, type PaymentMode as aO, type PlatformReporterOpts as aP, PostgresProcessedPaymentStore as aQ, PostgresX402ExactSettlementStore as aR, type PriceFiat as aS, type ProcessedPaymentQuerier as aT, type ProcessedPaymentRail as aU, type ProcessedPaymentRecord as aV, ProcessedPaymentReplayError as aW, type ProcessedPaymentStore as aX, type X402BatchAcceptance as aY, type X402BatchFunding as aZ, type X402BatchRefusal as a_, resolvePriceFiat as aa, revenueReporterBannerState as ab, toCreditTerms as ac, toJobRecord as ad, unknownRouteNotFound as ae, verifyIncomingPayment as af, verifyTempoSessionManagementCredential as ag, verifyUpfrontPayment as ah, x402RequiredUsdcMicro as ai, x402SettledShare as aj, type CreditMenu as ak, ReceiptIssuer as al, LightningReceive as am, TempoSettlementReadiness as an, type DVMHostOpts as ao, type DVMServeResult as ap, type BuildCreditMenuArgs as aq, type BuilderIdentity as ar, CREDIT_ENVELOPE_KEYS as as, type CreateX402BatchSettlementServerOpts as at, type CreditEnvelope as au, CreditEnvelopeError as av, type CreditFundCommitment as aw, type CreditTerms as ax, DEFAULT_INVOICE_TTL_SECONDS as ay, type DVMHost as az, type AppEnv as b, type X402ExactAcceptance as b0, X402ExactIntentConflictError as b1, type X402ExactSettlementAttempt as b2, type X402ExactSettlementChainEvidence as b3, type X402ExactSettlementEffect as b4, X402ExactSettlementEvidenceMissingError as b5, type X402ExactSettlementEvidenceReader as b6, type X402ExactSettlementIntent as b7, X402ExactSettlementNotReadyError as b8, X402ExactSettlementServer as b9, type X402ExactSettlementServerOpts as ba, type X402ExactSettlementStatus as bb, type X402ExactSettlementStore as bc, type X402SettlementChainEvidence as bd, type X402SettlementEvidenceReader as be, X402SettlementSubmissionError as bf, X402_BATCH_AUTO_SETTLEMENT as bg, X402_BATCH_MIN_WITHDRAW_DELAY_SECONDS as bh, X402_BATCH_SETTLEMENT_NETWORK as bi, attachCreditMenu as bj, buildCreditMenu as bk, createDVMHost as bl, createX402BatchSettlementServer as bm, creditEnvelopeIgnoreFields as bn, drawSettlementRef as bo, extractCreditEnvelope as bp, fundingCommitment as bq, selectPrimaryCredit as br, signHostingControl as bs, stripCreditEnvelope as bt, toCreditView as bu, type CreditFundingReport as c, type FiatDenominationFailure as d, type FundOnlyRequest as e, type PaymentErrorCode as f, type PaymentErrorDetail as g, type PaymentInfo as h, type ResolvedFx as i, type RevenueBootCheckOpts as j, type ServerJob as k, type ShortPayForfeit as l, type TempoObserverHealth as m, TempoSessionChannelMismatchError as n, type VerifyIncomingSnapshot as o, X402FacilitatorHealth as p, type X402SettlementEvidenceOutcome as q, type X402SettlementRepair as r, type X402SettlementRepairRefusal as s, type X402SettlementRepaired as t, type X402WedgedSettlement as u, type X402WedgedSettlementPage as v, X402_BATCH_SETTLEMENT_MAINNET_NETWORK as w, abortJob as x, applyPaymentInfoToJob as y, assertRevenueReporterReady as z };

package/dist/internal/server.d.ts

@@ -6,8 +6,8 @@ import { Env, BlankSchema } from 'hono/types';
 import { Pool } from 'pg';
 export { Pool } from 'pg';
 import { g as getWallet } from '../wallet-Dwjs5n_M.js';
-import { A as AccumulatorPool, a as AccumulatorQuerier, C as ConsumedCredentialStore } from '../credit-menu-kDA9RVzD.js';
-export { b as AppEnv, c as CreditFundingReport, F as FiatDenomination, d as FiatDenominationFailure, e as FundOnlyRequest, I as IncomingPaymentOpts, J as JobCancelledError, M as MintHealthTracker, P as PAYMENT_PROOF_KEYS, f as PaymentErrorCode, g as PaymentErrorDetail, h as PaymentInfo, R as ReporterBannerOpts, i as ResolvedFx, j as RevenueBootCheckOpts, S as SDKServerOpts, k as ServerJob, l as ShortPayForfeit, T as TempoChannelReport, m as TempoObserverHealth, n as TempoSessionChannelMismatchError, U as UpfrontPaymentOpts, V as VerifiedIncomingPayment, o as VerifyIncomingSnapshot, X as X402BatchChannelObservation, p as X402FacilitatorHealth, q as X402SettlementEvidenceOutcome, r as X402SettlementRepair, s as X402SettlementRepairRefusal, t as X402SettlementRepaired, u as X402WedgedSettlement, v as X402WedgedSettlementPage, w as X402_BATCH_SETTLEMENT_MAINNET_NETWORK, x as abortJob, y as applyPaymentInfoToJob, z as assertRevenueReporterReady, B as buildPaymentErrorResponse, D as clearAccumulatorForDvm, E as createDVMServer, G as creditDepositPayload, H as derivedFundCreditId, K as devModeSkipsPaymentVerification, L as fromJobRecord, N as fundedMicroFor, O as hasPaymentProof, Q as hashLockKey, W as implicitCreditId, Y as initWalletAccumulatorTable, Z as insertAccumulatorRows, _ as isDerivedCreditId, $ as isTerminal, a0 as isYieldMessage, a1 as issueUpfrontChallenges, a2 as msatsToFiatMicro, a3 as paymentErrorBody, a4 as pinAskFiat, a5 as priceFiatMicro, a6 as processIncomingPayment, a7 as providerMessage, a8 as repairX402ExactSettlementEffect, a9 as resolveFxSnapshot, aa as resolvePriceFiat, ab as revenueReporterBannerState, ac as toCreditTerms, ad as toJobRecord, ae as unknownRouteNotFound, af as verifyIncomingPayment, ag as verifyTempoSessionManagementCredential, ah as verifyUpfrontPayment, ai as x402RequiredUsdcMicro, aj as x402SettledShare } from '../credit-menu-kDA9RVzD.js';
+import { A as AccumulatorPool, a as AccumulatorQuerier, C as ConsumedCredentialStore } from '../credit-menu-0-UtJ3hh.js';
+export { b as AppEnv, c as CreditFundingReport, F as FiatDenomination, d as FiatDenominationFailure, e as FundOnlyRequest, I as IncomingPaymentOpts, J as JobCancelledError, M as MintHealthTracker, P as PAYMENT_PROOF_KEYS, f as PaymentErrorCode, g as PaymentErrorDetail, h as PaymentInfo, R as ReporterBannerOpts, i as ResolvedFx, j as RevenueBootCheckOpts, S as SDKServerOpts, k as ServerJob, l as ShortPayForfeit, T as TempoChannelReport, m as TempoObserverHealth, n as TempoSessionChannelMismatchError, U as UpfrontPaymentOpts, V as VerifiedIncomingPayment, o as VerifyIncomingSnapshot, X as X402BatchChannelObservation, p as X402FacilitatorHealth, q as X402SettlementEvidenceOutcome, r as X402SettlementRepair, s as X402SettlementRepairRefusal, t as X402SettlementRepaired, u as X402WedgedSettlement, v as X402WedgedSettlementPage, w as X402_BATCH_SETTLEMENT_MAINNET_NETWORK, x as abortJob, y as applyPaymentInfoToJob, z as assertRevenueReporterReady, B as buildPaymentErrorResponse, D as clearAccumulatorForDvm, E as createDVMServer, G as creditDepositPayload, H as derivedFundCreditId, K as devModeSkipsPaymentVerification, L as fromJobRecord, N as fundedMicroFor, O as hasPaymentProof, Q as hashLockKey, W as implicitCreditId, Y as initWalletAccumulatorTable, Z as insertAccumulatorRows, _ as isDerivedCreditId, $ as isTerminal, a0 as isYieldMessage, a1 as issueUpfrontChallenges, a2 as msatsToFiatMicro, a3 as paymentErrorBody, a4 as pinAskFiat, a5 as priceFiatMicro, a6 as processIncomingPayment, a7 as providerMessage, a8 as repairX402ExactSettlementEffect, a9 as resolveFxSnapshot, aa as resolvePriceFiat, ab as revenueReporterBannerState, ac as toCreditTerms, ad as toJobRecord, ae as unknownRouteNotFound, af as verifyIncomingPayment, ag as verifyTempoSessionManagementCredential, ah as verifyUpfrontPayment, ai as x402RequiredUsdcMicro, aj as x402SettledShare } from '../credit-menu-0-UtJ3hh.js';
 import { g as LockPubkey } from '../lightning-backend-BhsyrBLa.js';
 export { t as lockPubkeyStoreToLockPubkey } from '../lightning-backend-BhsyrBLa.js';
 export { O as OutgoingMessage, S as StaleJobReapable, i as isStaleJobReapable } from '../job-store-D3CcZp_g.js';

package/dist/internal/server.js

@@ -65,13 +65,14 @@ import {
   verifyUpfrontPayment,
   x402RequiredUsdcMicro,
   x402SettledShare
-} from "../chunk-JNKQZVZX.js";
+} from "../chunk-4VHTKNOR.js";
 import "../chunk-XRLKGCAW.js";
 import {
   settleWithFacilitator,
   verifyWithFacilitator
 } from "../chunk-BQ2NMWKE.js";
 import "../chunk-U5VNEALI.js";
+import "../chunk-HHTL3ZFT.js";
 import {
   SIGNED_ENVELOPE_FIELDS,
   SIGNED_ENVELOPE_TYPES,

package/dist/{postgres-job-store-MZZZMS2B.js → postgres-job-store-VE2JRUEC.js}

@@ -1,6 +1,6 @@
 import {
   PostgresJobStore
-} from "./chunk-JAHRF5X3.js";
+} from "./chunk-HHTL3ZFT.js";
 import "./chunk-COYKJRMM.js";
 export {
   PostgresJobStore

package/dist/server/index.d.ts

@@ -1,8 +1,8 @@
 import { ab as CashuMode, bK as CreditDrainEnqueue, R as ResolvedCreditConfig, bL as DVMAuthScheme, z as SignedRequestDomain, bM as CreditLedgerLike, bN as X402RefundSettlementGate, bO as CreditSnapshot, bP as DrawResult, bQ as X402SettlementStatus, bR as X402UnresolvedRefund, bS as GrownDrawResult, bT as DrawResolution, bU as FundingRecord, X as FundingReceipt, bV as CreditInvoiceRecord, bW as InvoiceSettlement, bX as BlockedInvoiceCursor, bY as InvoiceReconciliation, bZ as InvoiceWriteOff, b_ as DrawRecord, b$ as StalePendingDrawCursor, c0 as TempoCreditLossEvidence, c1 as CreditLedgerQuerier, c2 as TempoCreditLoss, c3 as X402CreditLossEvidence, c4 as X402CreditLoss, c5 as DrainMethod, c6 as DrainRequestResult, c7 as BitcoinDepositLiability, bo as FundingLot, c8 as CreditDrainRecord, c9 as ChannelDrainCursor, ca as DrainWriteOff, cb as DrainReleaseResult, cc as DrainFulfilment, cd as DrainTransitionResult, Y as JobReceipt, a1 as Message, K as KVStore, F as SignedRequestReplayStore, Z as ZodLike, a as DVMDescriptor } from '../step-cache-v2yhyhSZ.js';
 export { ce as CLIENT_COMPATIBILITY_HEADERS, d as CanonicalEnvelope, cf as ClientCompatibility, cg as ClientCompatibilityEnv, ch as ClientCompatibilityGate, ci as ClientCompatibilityRequirement, cj as ClientSemVer, e as CreateSignedRequestVerifierOpts, ck as CreditFundingBasis, cl as CreditInvoiceStatus, cm as CreditLedger, cn as CreditLedgerError, co as CreditLedgerErrorCode, cp as CreditLedgerErrorDetails, cq as CreditLedgerPool, cr as CreditStatus, cs as DRAIN_DELIVERY_RESERVE_SATS, ct as DVM_PROTOCOL_VERSION, cu as DrainConflictReason, cv as DrawRailValue, cw as DrawStatus, cx as JobCostReportPayload, cy as JobTerminalReportPayload, cz as PostgresX402ChannelStorage, cA as ReplayStoreBackend, cB as RevenueSkippedNoRailPayload, cC as RevenueSkippedNoRailReason, w as SIGNED_REQUEST_AUTH_ID, x as SIGNED_REQUEST_STATEMENT_VERSION, cD as Secp256k1AuthOpts, y as SignedRequestAudience, B as SignedRequestError, E as SignedRequestFailure, G as SignedRequestSignOpts, H as SignedRequestStatementHeader, M as SignedRequestVerifier, cE as X402ChannelStorageOpts, cF as X402RelayLockHolder, cG as X402RelaySubmissionLock, cH as X402RelaySubmissionLockError, cI as allocateDrawValue, cJ as clientCompatibilityAttributes, cK as clientCompatibilityMiddleware, cL as clientUpgradeRequired, N as createSignedRequestVerifier, cM as parseClientCapabilities, cN as parseClientCompatibility, cO as parseDvmClient, cP as parseProtocolVersion, cQ as requireClientCompatibility, cR as secp256k1Auth, cS as signedRequestInput, T as signedRequestStatementHeader } from '../step-cache-v2yhyhSZ.js';
 import { Pool } from 'pg';
-import { ak as CreditMenu, b as AppEnv, U as UpfrontPaymentOpts, h as PaymentInfo, al as ReceiptIssuer, am as LightningReceive, an as TempoSettlementReadiness, ao as DVMHostOpts, ap as DVMServeResult } from '../credit-menu-kDA9RVzD.js';
-export { aq as BuildCreditMenuArgs, ar as BuilderIdentity, as as CREDIT_ENVELOPE_KEYS, C as ConsumedCredentialStore, at as CreateX402BatchSettlementServerOpts, au as CreditEnvelope, av as CreditEnvelopeError, aw as CreditFundCommitment, ax as CreditTerms, ay as DEFAULT_INVOICE_TTL_SECONDS, az as DVMHost, aA as JobManager, aB as JobManagerOpts, aC as LightningReceiveConfig, aD as MIN_INVOICE_TTL_SECONDS, aE as MemoryConsumedCredentialStore, aF as MemoryConsumedCredentialStoreOpts, aG as MemoryProcessedPaymentStore, aH as MemoryX402ExactSettlementStore, aI as MountOpts, aJ as OwnerDisplay, aK as PaidJobCompletion, aL as PaymentMode, aM as PlatformReporterOpts, aN as PostgresProcessedPaymentStore, aO as PostgresX402ExactSettlementStore, aP as PriceFiat, aQ as ProcessedPaymentQuerier, aR as ProcessedPaymentRail, aS as ProcessedPaymentRecord, aT as ProcessedPaymentReplayError, aU as ProcessedPaymentStore, aV as X402BatchAcceptance, aW as X402BatchFunding, aX as X402BatchRefusal, aY as X402BatchSettlementServer, aZ as X402ExactAcceptance, a_ as X402ExactIntentConflictError, a$ as X402ExactSettlementAttempt, b0 as X402ExactSettlementChainEvidence, b1 as X402ExactSettlementEffect, b2 as X402ExactSettlementEvidenceMissingError, b3 as X402ExactSettlementEvidenceReader, b4 as X402ExactSettlementIntent, b5 as X402ExactSettlementNotReadyError, b6 as X402ExactSettlementServer, b7 as X402ExactSettlementServerOpts, b8 as X402ExactSettlementStatus, b9 as X402ExactSettlementStore, ba as X402SettlementChainEvidence, bb as X402SettlementEvidenceReader, bc as X402SettlementSubmissionError, bd as X402_BATCH_AUTO_SETTLEMENT, be as X402_BATCH_MIN_WITHDRAW_DELAY_SECONDS, bf as X402_BATCH_SETTLEMENT_NETWORK, bg as attachCreditMenu, bh as buildCreditMenu, bi as createDVMHost, bj as createX402BatchSettlementServer, bk as creditEnvelopeIgnoreFields, bl as drawSettlementRef, bm as extractCreditEnvelope, bn as fundingCommitment, bo as selectPrimaryCredit, bp as stripCreditEnvelope, bq as toCreditView } from '../credit-menu-kDA9RVzD.js';
+import { ak as CreditMenu, b as AppEnv, U as UpfrontPaymentOpts, h as PaymentInfo, al as ReceiptIssuer, am as LightningReceive, an as TempoSettlementReadiness, ao as DVMHostOpts, ap as DVMServeResult } from '../credit-menu-0-UtJ3hh.js';
+export { aq as BuildCreditMenuArgs, ar as BuilderIdentity, as as CREDIT_ENVELOPE_KEYS, C as ConsumedCredentialStore, at as CreateX402BatchSettlementServerOpts, au as CreditEnvelope, av as CreditEnvelopeError, aw as CreditFundCommitment, ax as CreditTerms, ay as DEFAULT_INVOICE_TTL_SECONDS, az as DVMHost, aA as HostingControlCommand, aB as HostingControlConfig, aC as HostingControlStatus, aD as JobManager, aE as JobManagerOpts, aF as LightningReceiveConfig, aG as MIN_INVOICE_TTL_SECONDS, aH as MemoryConsumedCredentialStore, aI as MemoryConsumedCredentialStoreOpts, aJ as MemoryProcessedPaymentStore, aK as MemoryX402ExactSettlementStore, aL as MountOpts, aM as OwnerDisplay, aN as PaidJobCompletion, aO as PaymentMode, aP as PlatformReporterOpts, aQ as PostgresProcessedPaymentStore, aR as PostgresX402ExactSettlementStore, aS as PriceFiat, aT as ProcessedPaymentQuerier, aU as ProcessedPaymentRail, aV as ProcessedPaymentRecord, aW as ProcessedPaymentReplayError, aX as ProcessedPaymentStore, aY as X402BatchAcceptance, aZ as X402BatchFunding, a_ as X402BatchRefusal, a$ as X402BatchSettlementServer, b0 as X402ExactAcceptance, b1 as X402ExactIntentConflictError, b2 as X402ExactSettlementAttempt, b3 as X402ExactSettlementChainEvidence, b4 as X402ExactSettlementEffect, b5 as X402ExactSettlementEvidenceMissingError, b6 as X402ExactSettlementEvidenceReader, b7 as X402ExactSettlementIntent, b8 as X402ExactSettlementNotReadyError, b9 as X402ExactSettlementServer, ba as X402ExactSettlementServerOpts, bb as X402ExactSettlementStatus, bc as X402ExactSettlementStore, bd as X402SettlementChainEvidence, be as X402SettlementEvidenceReader, bf as X402SettlementSubmissionError, bg as X402_BATCH_AUTO_SETTLEMENT, bh as X402_BATCH_MIN_WITHDRAW_DELAY_SECONDS, bi as X402_BATCH_SETTLEMENT_NETWORK, bj as attachCreditMenu, bk as buildCreditMenu, bl as createDVMHost, bm as createX402BatchSettlementServer, bn as creditEnvelopeIgnoreFields, bo as drawSettlementRef, bp as extractCreditEnvelope, bq as fundingCommitment, br as selectPrimaryCredit, bs as signHostingControl, bt as stripCreditEnvelope, bu as toCreditView } from '../credit-menu-0-UtJ3hh.js';
 import { Context } from 'hono';
 import { z } from 'zod';
 import { F as FxFetcher } from '../fx-DhyT1Cjh.js';
@@ -129,6 +129,8 @@ interface CreditRouteDeps {
      * invoice on the same credit is swept with it.
      */
     settleLightning: (callerPubkey: string, creditId?: string) => Promise<void>;
+    /** Hosting gate around a fresh funding operation, after caller auth and before any rail effect. */
+    withFundingAdmission?: (c: Context<AppEnv>, body: CreditRequest, run: () => Promise<Response>) => Promise<Response>;
     tempoSettlementReadiness?: TempoSettlementReadiness;
 }
 declare function handleCreditRequest(c: Context<AppEnv>, deps: CreditRouteDeps): Promise<Response>;
@@ -401,6 +403,7 @@ declare class PostgresJobStore implements StreamableJobStore, ReceiptIssuingStor
     heartbeatActiveJobs(jobIds: string[], now: number): Promise<void>;
     cancelStaleJob(jobId: string, expectedActivityBefore: number, reason: string, terminalStatus: "failed" | "cancelled"): Promise<boolean>;
     cancelJob(jobId: string, reason: string): Promise<boolean>;
+    cancelJobForHosting(jobId: string, reason: string): Promise<boolean>;
     getCounters(jobId: string): Promise<JobCounters | undefined>;
     claimForProcessing(jobId: string): Promise<boolean>;
     tryReactivationLock<T>(jobId: string, fn: () => Promise<T>): Promise<{

package/dist/server/index.js

@@ -1,9 +1,6 @@
 import {
   PostgresReplayStore
 } from "../chunk-AJNFXR7J.js";
-import {
-  PostgresJobStore
-} from "../chunk-JAHRF5X3.js";
 import {
   PostgresKVStore
 } from "../chunk-V5ZRATJH.js";
@@ -74,11 +71,12 @@ import {
   revenueReporterBannerState,
   seedLockPubkeyState,
   selectPrimaryCredit,
+  signHostingControl,
   stripCreditEnvelope,
   stripProtocolEnvelope,
   toCreditView,
   unknownRouteNotFound
-} from "../chunk-JNKQZVZX.js";
+} from "../chunk-4VHTKNOR.js";
 import {
   MemoryProcessedPaymentStore,
   PostgresProcessedPaymentStore,
@@ -88,6 +86,9 @@ import "../chunk-BQ2NMWKE.js";
 import {
   MemoryCreditLedger
 } from "../chunk-U5VNEALI.js";
+import {
+  PostgresJobStore
+} from "../chunk-HHTL3ZFT.js";
 import {
   SignedRequestError,
   createDefaultReplayStore,
@@ -1098,6 +1099,12 @@ function createDVMHost(opts = {}) {
       )
     );
     const envMaybe = env;
+    const hostingSecret = envMaybe.DVMKIT_HOSTING_CONTROL_SECRET;
+    const hostingScope = envMaybe.DVMKIT_HOSTING_CONTROL_SCOPE;
+    if (!opts.hostingControl && Boolean(hostingSecret) !== Boolean(hostingScope)) {
+      throw new Error("Hosting control requires both DVMKIT_HOSTING_CONTROL_SECRET and DVMKIT_HOSTING_CONTROL_SCOPE");
+    }
+    const hostingControl = opts.hostingControl ?? (hostingSecret && hostingScope ? { secret: hostingSecret, scope: hostingScope } : void 0);
     const port = serveOpts?.port ?? opts.port ?? Number(envMaybe.PORT ?? "8080");
     const bootStart = Date.now();
     const phaseMarks = [];
@@ -1127,7 +1134,7 @@ function createDVMHost(opts = {}) {
       });
       applyRetryToPool(pool, "dvm-host");
       pgPool = pool;
-      const { PostgresJobStore: PostgresJobStore2 } = await import("../postgres-job-store-MZZZMS2B.js");
+      const { PostgresJobStore: PostgresJobStore2 } = await import("../postgres-job-store-VE2JRUEC.js");
       const pgJobStore = new PostgresJobStore2(pool);
       pendingInits.push(pgJobStore.init(), pgJobStore.initStreaming());
       jobStore = pgJobStore;
@@ -1547,7 +1554,8 @@ ${config.facilitatorAuth?.keyId ?? ""}`;
         lockPubkey: cashuOpts.lockPubkey,
         lockPubkeyGraceSeconds: cashuOpts.lockPubkeyGraceSeconds,
         canonicalDvmId: cashuOpts.canonicalDvmId,
-        db: cashuOpts.db,
+        db: hostingControl ? pgPool : cashuOpts.db,
+        hostingControl,
         dvmId: cashuOpts.dvmId,
         failFast,
         mintHealthTracker: opts.mintHealthTracker,
@@ -2116,6 +2124,7 @@ export {
   secp256k1Auth,
   selectPrimaryCredit,
   serve,
+  signHostingControl,
   signedRequestInput,
   signedRequestStatementHeader,
   stripCreditEnvelope,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dvmkit/sdk",
-  "version": "0.2.1-rc.9",
+  "version": "0.3.0-rc.10",
   "description": "SDK for building accountless, pay-per-use Digital Vending Machines",
   "license": "Apache-2.0",
   "repository": {