@dvmkit/sdk 0.21.2 → 0.22.0

package/dist/{chunk-NRE4NOCY.js → chunk-JMTLK2SZ.js}

@@ -1,7 +1,7 @@
 import {
   emitDiagnostic,
   projectDiagnosticFields
-} from "./chunk-MA55LUNR.js";
+} from "./chunk-2WWVI32F.js";
 
 // src/sdk/logger.ts
 function createConsoleLogger(_jobId) {

package/dist/{chunk-LSANCGLP.js → chunk-L35WYOH2.js}

@@ -1,6 +1,6 @@
 import {
   diagnosticConsole
-} from "./chunk-MA55LUNR.js";
+} from "./chunk-2WWVI32F.js";
 
 // src/lib/pg-retry.ts
 import { AsyncLocalStorage } from "async_hooks";

package/dist/{chunk-27QB2D3Z.js → chunk-LCNRFKP7.js}

@@ -1,9 +1,9 @@
 import {
   loggers
-} from "./chunk-7KNFEDFW.js";
+} from "./chunk-ZH5CLGO6.js";
 import {
   diagnosticConsole
-} from "./chunk-MA55LUNR.js";
+} from "./chunk-2WWVI32F.js";
 
 // src/sdk/server/mpp-setup.ts
 import { createHash, randomUUID } from "crypto";

package/dist/{chunk-2AGADOX3.js → chunk-QMKGYIBM.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-COYKJRMM.js";
 import {
   diagnosticConsole
-} from "./chunk-MA55LUNR.js";
+} from "./chunk-2WWVI32F.js";
 
 // src/sdk/server/revenue-reporter.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-JOSNSNS7.js → chunk-SEIMPHIP.js}

@@ -10,13 +10,13 @@ import {
 } from "./chunk-5UC7TOQC.js";
 import {
   applyRetryToPool
-} from "./chunk-LSANCGLP.js";
+} from "./chunk-L35WYOH2.js";
 import {
   x402NetworkByCaip2
 } from "./chunk-BPYMEMQX.js";
 import {
   diagnosticConsole
-} from "./chunk-MA55LUNR.js";
+} from "./chunk-2WWVI32F.js";
 
 // src/sdk/server/credit-ledger.ts
 import { randomUUID } from "crypto";
@@ -26,6 +26,10 @@ var NON_CHANNEL_BITCOIN_RAILS = [
   "cashu",
   "lightning"
 ];
+var CARD_FUNDED_RAILS = ["stripe"];
+function isCardFundedRail(rail) {
+  return typeof rail === "string" && CARD_FUNDED_RAILS.includes(rail);
+}
 function isNonChannelBitcoinRail(rail) {
   return typeof rail === "string" && NON_CHANNEL_BITCOIN_RAILS.includes(rail);
 }
@@ -1414,6 +1418,7 @@ var CreditLedger = class {
     await this.pool.query(`ALTER TABLE credit_drains ADD COLUMN IF NOT EXISTS proven_refund_native NUMERIC(78,0)`);
     await this.pool.query(`ALTER TABLE credit_drains ADD COLUMN IF NOT EXISTS refund_payment_proven BOOLEAN NOT NULL DEFAULT FALSE`);
     await this.pool.query(`ALTER TABLE credit_drains ADD COLUMN IF NOT EXISTS fulfilment JSONB`);
+    await this.pool.query(`ALTER TABLE credit_drains ADD COLUMN IF NOT EXISTS card_refund JSONB`);
     await this.pool.query(`ALTER TABLE credit_drains ADD COLUMN IF NOT EXISTS write_off_note TEXT`);
     await this.pool.query(
       `ALTER TABLE credit_drains ADD COLUMN IF NOT EXISTS written_off_at BIGINT`
@@ -1774,7 +1779,9 @@ var CreditLedger = class {
   /**
    * Release expired undrawn balances, retaining readable credit records. Tempo rail or
    * channel-backed credits are excluded because their collateral returns to the caller
-   * through the channel lifecycle.
+   * through the channel lifecycle. Card-funded credits are excluded because an expired card
+   * balance is owed back to the card, never released to the builder: it stays on the credit,
+   * where expiry already refuses new draws, until a card refund returns it.
    *
    * Pending holds prevent release: jobs accepted before expiry may still settle or release.
    * Candidates are rechecked under the same parent-credit lock used by draw writes. The
@@ -1793,6 +1800,7 @@ var CreditLedger = class {
           AND c.status = 'active'
           AND c.tempo_channel_id IS NULL
           AND COALESCE(c.rail, '') <> 'tempo'
+          AND NOT (COALESCE(c.rail, '') = ANY($3::text[]))
           AND NOT EXISTS (
             SELECT 1 FROM credit_expiry_releases r
              WHERE r.credit_id = c.credit_id AND r.reversed_at IS NULL
@@ -1803,7 +1811,7 @@ var CreditLedger = class {
           )
         ORDER BY c.expiry_ms
         LIMIT $2`,
-      [nowMs, limit]
+      [nowMs, limit, [...CARD_FUNDED_RAILS]]
     );
     const released = [];
     for (const candidate of candidates) {
@@ -1828,6 +1836,7 @@ var CreditLedger = class {
     const balanceMicro = toSafeInt(credit.balance_micro);
     if (expiryMs > nowMs || balanceMicro <= 0 || credit.status !== "active") return void 0;
     if (credit.tempo_channel_id !== null || credit.rail === "tempo") return void 0;
+    if (isCardFundedRail(credit.rail)) return void 0;
     const pending = await this.pendingSums(client, credit.credit_id);
     if (pending.micro > 0) return void 0;
     const { rows: open } = await client.query(
@@ -1871,13 +1880,14 @@ var CreditLedger = class {
   /**
    * Record non-channel Bitcoin funding lots on the funding transaction. An implicit payment
    * also needs a lot: its draw is initially only a hold, and failure releases the whole
-   * balance for reclaim. Channel collateral is excluded from Bitcoin lots.
+   * balance for reclaim. Channel collateral is excluded from Bitcoin lots. A card funding
+   * records a lot per charge so a later refund can address the charge that bought it.
    *
    * A zero-sats basis still records a lot, distinguishing covered but basisless credit from a
    * missing-lot coverage gap.
    */
   async recordFundingLot(q, creditId, amountMicro, basis, nowMs) {
-    if (!isNonChannelBitcoinRail(basis.rail)) return;
+    if (!isNonChannelBitcoinRail(basis.rail) && !isCardFundedRail(basis.rail)) return;
     if (basis.tempoSession || basis.x402Channel) return;
     await q.query(
       `INSERT INTO credit_funding_lots
@@ -3238,6 +3248,7 @@ var CreditLedger = class {
           `credit ${args.creditId} belongs to a different caller pubkey`
         );
       }
+      assertCardDrainMatchesRail(args.creditId, credit.rail, args.method);
       const existing = await this.readDrain(client, args.creditId, args.drainId);
       if (existing) {
         if (existing.method !== args.method || JSON.stringify(existing.payout) !== JSON.stringify(args.payout)) {
@@ -3253,6 +3264,10 @@ var CreditLedger = class {
         };
       }
       if (credit.status !== "active") throw terminalCreditError(args.creditId, credit.status);
+      if (args.method === "stripe") {
+        const blockingDrainId = await this.pendingCardRefundDrainId(client, args.creditId);
+        if (blockingDrainId) throw cardRefundPendingConflict(args.creditId, blockingDrainId);
+      }
       const blocking = await this.blockingX402Refund(
         credit.x402_channel_id,
         X402_WEDGED_SETTLEMENT_STATUSES
@@ -3346,6 +3361,154 @@ var CreditLedger = class {
     );
     return rows.length > 0 ? drainRecordFromJoinRow(rows[0]) : void 0;
   }
+  /**
+   * Store a card refund's plan or progress on its pending `stripe` drain. With `onlyIfUnset`
+   * the first plan wins and every later caller gets that stored plan back, so concurrent
+   * retries send one set of amounts under one set of idempotency keys. Returns what is
+   * stored after the write; null when the drain is not a pending stripe drain with a plan.
+   */
+  async saveCardRefund(args) {
+    const { rows } = await this.pool.query(
+      `UPDATE credit_drains SET card_refund = $3
+        WHERE credit_id = $1 AND drain_id = $2 AND method = 'stripe' AND status = 'pending'
+          AND ($4::boolean IS FALSE OR card_refund IS NULL)
+        RETURNING card_refund`,
+      [args.creditId, args.drainId, JSON.stringify(args.plan), args.onlyIfUnset === true]
+    );
+    if (rows.length > 0) return rows[0].card_refund;
+    return (await this.readDrain(this.pool, args.creditId, args.drainId))?.card_refund ?? null;
+  }
+  /**
+   * Expired card credits still holding balance, with no pending holds and no card refund in
+   * progress, oldest expiry first. A credit waiting on its refund drops out of the page, so
+   * one that can never finish does not crowd out the rest.
+   */
+  async listExpiredCardCredits(args = {}) {
+    const { rows } = await this.pool.query(
+      `SELECT c.credit_id FROM credits c
+        WHERE c.expiry_ms <= $1 AND c.balance_micro > 0 AND c.status = 'active'
+          AND c.rail = ANY($3::text[])
+          AND NOT EXISTS (
+            SELECT 1 FROM credit_draws d WHERE d.credit_id = c.credit_id AND d.status = 'pending'
+          )
+          AND NOT EXISTS (
+            SELECT 1 FROM credit_drains r
+             WHERE r.credit_id = c.credit_id AND r.method = 'stripe' AND r.status = 'pending'
+          )
+        ORDER BY c.expiry_ms
+        LIMIT $2`,
+      [args.nowMs ?? Date.now(), args.limit ?? DEFAULT_EXPIRY_SWEEP_LIMIT, [...CARD_FUNDED_RAILS]]
+    );
+    return rows.map((row) => row.credit_id);
+  }
+  /**
+   * Turn an expired card credit's whole balance into a pending `stripe` drain owed back to
+   * the card, and close the credit (`refunded`) in the same transaction. Closing is what
+   * makes this terminal: a later top-up cannot revive a balance that went back to the card,
+   * and the builder never receives it. Returns undefined when the credit no longer
+   * qualifies under its lock (not card, not expired, empty, holds pending, or closed).
+   */
+  async openCardExpiryRefund(args) {
+    const nowMs = args.nowMs ?? Date.now();
+    return this.withCreditLock(args.creditId, async (client, credit) => {
+      const balanceMicro = toSafeInt(credit.balance_micro);
+      const expiryMs = toSafeInt(credit.expiry_ms);
+      if (!isCardFundedRail(credit.rail) || credit.status !== "active") return void 0;
+      if (expiryMs > nowMs || balanceMicro <= 0) return void 0;
+      if ((await this.pendingSums(client, credit.credit_id)).micro > 0) return void 0;
+      if (await this.pendingCardRefundDrainId(client, credit.credit_id)) return void 0;
+      const ledgerSeq = toSafeInt(credit.last_ledger_seq) + 1;
+      const { rows } = await client.query(
+        `INSERT INTO credit_drains
+           (credit_id, drain_id, method, payout, amount_micro, balance_after_micro,
+            drained_msats, drained_native, owed_sats, lot_debits, ledger_seq, status, created_at)
+         VALUES ($1, $2, 'stripe', '{}'::jsonb, $3, 0, $4, $5, NULL, NULL, $6, 'pending', $7)
+         ON CONFLICT (credit_id, drain_id) DO NOTHING
+         RETURNING *`,
+        [
+          credit.credit_id,
+          cardExpiryDrainId(expiryMs),
+          balanceMicro,
+          toSafeInt(credit.msats_remaining),
+          credit.native_remaining === null ? null : toSafeInt(credit.native_remaining),
+          ledgerSeq,
+          nowMs
+        ]
+      );
+      if (rows.length === 0) return void 0;
+      await client.query(
+        `UPDATE credits
+            SET balance_micro = 0, last_ledger_seq = $2, msats_remaining = 0,
+                native_remaining = CASE WHEN native_remaining IS NULL THEN NULL ELSE 0 END,
+                status = 'refunded'
+          WHERE credit_id = $1`,
+        [credit.credit_id, ledgerSeq]
+      );
+      return drainRecordFromRow(rows[0], credit);
+    });
+  }
+  /**
+   * Freeze every active credit a disputed card payment funded (`disputed`): no draw, top-up
+   * or drain moves its balance while the card network decides. Returns the credits this
+   * call froze; already-frozen or closed credits are left as they are.
+   */
+  async freezeCardCreditsForPaymentIntent(paymentIntentId) {
+    const { rows } = await this.pool.query(
+      `SELECT DISTINCT credit_id FROM credit_funding_lots
+        WHERE funding_ref = $1 AND rail = ANY($2::text[])`,
+      [paymentIntentId, [...CARD_FUNDED_RAILS]]
+    );
+    const frozen = [];
+    for (const { credit_id } of rows) {
+      const changed = await this.withCreditLock(credit_id, async (client, credit) => {
+        if (credit.status !== "active") return false;
+        await client.query(`UPDATE credits SET status = 'disputed' WHERE credit_id = $1`, [
+          credit_id
+        ]);
+        return true;
+      });
+      if (changed) frozen.push(credit_id);
+    }
+    return frozen;
+  }
+  /**
+   * Frozen credits this PaymentIntent funded, each with every card PaymentIntent that funded
+   * it: the sweep checks all of them with Stripe before lifting a freeze.
+   */
+  async disputedCardCreditsFundedBy(paymentIntentId) {
+    const { rows } = await this.pool.query(
+      `SELECT l.credit_id, array_agg(DISTINCT l.funding_ref) AS refs
+         FROM credit_funding_lots l JOIN credits c ON c.credit_id = l.credit_id
+        WHERE c.status = 'disputed' AND l.rail = ANY($2::text[]) AND l.funding_ref IS NOT NULL
+          AND l.credit_id IN (
+            SELECT credit_id FROM credit_funding_lots WHERE funding_ref = $1 AND rail = ANY($2::text[])
+          )
+        GROUP BY l.credit_id`,
+      [paymentIntentId, [...CARD_FUNDED_RAILS]]
+    );
+    return rows.map((row) => ({ creditId: row.credit_id, paymentIntentIds: row.refs }));
+  }
+  /**
+   * Lift a dispute freeze: the credit is `active` and refundable again, including at expiry.
+   * The caller decides that no top-up of the credit has an open or lost dispute. Returns
+   * false when the credit was not frozen.
+   */
+  async unfreezeCardCredit(creditId) {
+    return this.withCreditLock(creditId, async (client, credit) => {
+      if (credit.status !== "disputed") return false;
+      await client.query(`UPDATE credits SET status = 'active' WHERE credit_id = $1`, [creditId]);
+      return true;
+    });
+  }
+  /** True when a funding lot books this PaymentIntent: the charge reached a credit. */
+  async cardFundingBooked(paymentIntentId) {
+    const { rows } = await this.pool.query(
+      `SELECT 1 FROM credit_funding_lots
+        WHERE funding_ref = $1 AND rail = ANY($2::text[]) LIMIT 1`,
+      [paymentIntentId, [...CARD_FUNDED_RAILS]]
+    );
+    return rows.length > 0;
+  }
   /**
    * One credit's undepleted funding lots, oldest first — the
    * public read behind the reclaim's own arithmetic, for anything that needs
@@ -4054,6 +4217,15 @@ var CreditLedger = class {
    * a new draw allocates against. One round-trip, since every
    * caller needs the micro sum anyway.
    */
+  async pendingCardRefundDrainId(q, creditId) {
+    const { rows } = await q.query(
+      `SELECT drain_id FROM credit_drains
+        WHERE credit_id = $1 AND method = 'stripe' AND status = 'pending'
+        ORDER BY created_at LIMIT 1`,
+      [creditId]
+    );
+    return rows[0]?.drain_id;
+  }
   async pendingSums(q, creditId) {
     const { rows } = await q.query(
       `SELECT COALESCE(SUM(amount_micro), 0) AS micro,
@@ -4082,7 +4254,7 @@ var CreditLedger = class {
       nativeAvailable: row.native_remaining === null ? null : live ? Math.max(0, toSafeInt(row.native_remaining) - pending.native) : 0,
       expiryMs,
       expired: expiryMs <= nowMs,
-      status: row.status === "unbacked" ? "unbacked" : "active",
+      status: creditStatusOf(row.status),
       lastLedgerSeq: toSafeInt(row.last_ledger_seq),
       createdAt: toSafeInt(row.created_at),
       rail: row.rail,
@@ -4111,7 +4283,12 @@ var CreditLedger = class {
     return rows.map(x402CreditLossFromRow);
   }
 };
-var DRAIN_METHODS = ["cashu", "x402", "tempo"];
+var DRAIN_METHODS = [
+  "cashu",
+  "x402",
+  "tempo",
+  "stripe"
+];
 function isDrainMethod(value) {
   return DRAIN_METHODS.includes(value);
 }
@@ -4119,7 +4296,8 @@ var FUNDING_RAILS = {
   cashu: true,
   x402: true,
   tempo: true,
-  lightning: true
+  lightning: true,
+  stripe: true
 };
 function isFundingRail(rail) {
   return typeof rail === "string" && Object.hasOwn(FUNDING_RAILS, rail);
@@ -4191,11 +4369,41 @@ function x402SettlementPending(creditId, refund) {
   );
 }
 function terminalCreditError(creditId, status) {
+  if (status === "refunded" || status === "disputed") {
+    return new CreditLedgerError(
+      "credit_closed",
+      status === "refunded" ? `credit ${creditId} is closed: its expired card balance was refunded to the card` : `credit ${creditId} is frozen: a card payment that funded it is disputed`,
+      { creditStatus: status }
+    );
+  }
   return new CreditLedgerError(
     "credit_unbacked",
     `credit ${creditId} is terminal (${status}); its Tempo backing finalized before the DVM was protected`
   );
 }
+function assertCardDrainMatchesRail(creditId, rail, method) {
+  const card = isCardFundedRail(rail);
+  if (card === (method === "stripe")) return;
+  throw new CreditLedgerError(
+    "rail_mismatch",
+    card ? `credit ${creditId} was funded by card and is refunded only to that card (method stripe)` : `credit ${creditId} was not funded by card, so it cannot be refunded to one`,
+    { expectedRail: rail }
+  );
+}
+var CARD_EXPIRY_DRAIN_PREFIX = "expiry-";
+function cardExpiryDrainId(expiryMs) {
+  return `${CARD_EXPIRY_DRAIN_PREFIX}${expiryMs}`;
+}
+function cardRefundPendingConflict(creditId, blockingDrainId) {
+  return new CreditLedgerError(
+    "drain_conflict",
+    `credit ${creditId} already has card refund ${blockingDrainId} in progress`,
+    { drainConflict: "card_refund_pending", blockingDrainId }
+  );
+}
+function creditStatusOf(status) {
+  return status === "unbacked" || status === "refunded" || status === "disputed" ? status : "active";
+}
 function isUniqueViolation(err) {
   return typeof err === "object" && err !== null && err.code === "23505";
 }
@@ -4329,7 +4537,8 @@ function drainRecordFromRow(row, credit) {
     operatorDecision: row.operator_decision ?? null,
     holdReason: row.hold_reason ?? null,
     provenRefundNative: row.proven_refund_native ?? null,
-    refundPaymentProven: row.refund_payment_proven ?? false
+    refundPaymentProven: row.refund_payment_proven ?? false,
+    cardRefund: row.card_refund ?? null
   };
 }
 function drainRecordFromJoinRow(row) {
@@ -4425,6 +4634,7 @@ function expiryReleaseReport(dvmId, row) {
 
 export {
   NON_CHANNEL_BITCOIN_RAILS,
+  isCardFundedRail,
   isNonChannelBitcoinRail,
   depleteLots,
   inKindDrawMsats,
@@ -4451,5 +4661,9 @@ export {
   growthRailValue,
   clipEarmark,
   CreditLedgerError,
-  x402SettlementPending
+  x402SettlementPending,
+  assertCardDrainMatchesRail,
+  CARD_EXPIRY_DRAIN_PREFIX,
+  cardExpiryDrainId,
+  cardRefundPendingConflict
 };

package/dist/{chunk-Y746QPX7.js → chunk-SQOVLAJ2.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-COYKJRMM.js";
 import {
   diagnosticConsole
-} from "./chunk-MA55LUNR.js";
+} from "./chunk-2WWVI32F.js";
 
 // src/sdk/server/postgres-job-store.ts
 import { createHash } from "crypto";

package/dist/{chunk-XWG54M6T.js → chunk-UVRBD5GR.js}

@@ -1,6 +1,6 @@
 import {
   diagnosticConsole
-} from "./chunk-MA55LUNR.js";
+} from "./chunk-2WWVI32F.js";
 
 // src/sdk/pricing/currency.ts
 var InvalidCurrencyError = class extends Error {

package/dist/{chunk-5RGZN6WQ.js → chunk-XB644VN3.js}

@@ -2,7 +2,7 @@ import {
   X402_DEFAULT_NETWORK,
   resolveRpcHttpTransportOptions,
   resolveRpcOverride
-} from "./chunk-NUDHO4HV.js";
+} from "./chunk-LABJSMSJ.js";
 import {
   redactUrl,
   redactUrlsInText

package/dist/{chunk-2RZRYMCR.js → chunk-YNHFJE6U.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-COYKJRMM.js";
 import {
   diagnosticConsole
-} from "./chunk-MA55LUNR.js";
+} from "./chunk-2WWVI32F.js";
 
 // src/sdk/server/tempo-charge-store.ts
 import { Credential } from "mppx";

package/dist/{chunk-7KNFEDFW.js → chunk-ZH5CLGO6.js}

@@ -7,7 +7,7 @@ import {
   extendDiagnosticIdentityAuthority,
   projectDiagnosticFields,
   projectSpanRow
-} from "./chunk-MA55LUNR.js";
+} from "./chunk-2WWVI32F.js";
 
 // src/observability/context.ts
 import { AsyncLocalStorage } from "async_hooks";

package/dist/{content-retention-efjireLM.d.ts → content-retention-DEvY5vjM.d.ts}

@@ -1,4 +1,4 @@
-import { b as JobStore, J as JobRecord } from './job-store-DWVkleH3.js';
+import { b as JobStore, J as JobRecord } from './job-store-CjPnf0dd.js';
 
 /** Authenticated caller metadata; omitted fields on older services mean unknown. */
 interface JobContentMetadata {

package/dist/{credit-ledger-M3EBVMOP.js → credit-ledger-S76KU53A.js}

@@ -1,30 +1,38 @@
 import {
+  CARD_EXPIRY_DRAIN_PREFIX,
   CreditLedger,
   CreditLedgerError,
   DRAIN_METHODS,
   FUNDING_RAILS,
   allocateDrawValue,
+  assertCardDrainMatchesRail,
   assertFundingBasis,
+  cardExpiryDrainId,
+  cardRefundPendingConflict,
   clipEarmark,
   growthRailValue,
   isDrainMethod,
   isFundingRail,
   x402SettlementPending
-} from "./chunk-JOSNSNS7.js";
+} from "./chunk-SEIMPHIP.js";
 import "./chunk-YG7G4DPZ.js";
 import "./chunk-COYKJRMM.js";
 import "./chunk-5UC7TOQC.js";
-import "./chunk-LSANCGLP.js";
+import "./chunk-L35WYOH2.js";
 import "./chunk-BPYMEMQX.js";
 import "./chunk-H3GGFEE5.js";
-import "./chunk-MA55LUNR.js";
+import "./chunk-2WWVI32F.js";
 export {
+  CARD_EXPIRY_DRAIN_PREFIX,
   CreditLedger,
   CreditLedgerError,
   DRAIN_METHODS,
   FUNDING_RAILS,
   allocateDrawValue,
+  assertCardDrainMatchesRail,
   assertFundingBasis,
+  cardExpiryDrainId,
+  cardRefundPendingConflict,
   clipEarmark,
   growthRailValue,
   isDrainMethod,