@dvmkit/sdk 0.3.3-rc.10 → 0.4.0-rc.1

package/dist/{chunk-YRDA7EWN.js → chunk-W2EQGDF5.js}

@@ -4,28 +4,25 @@ import {
   listCredits,
   maxAdvertisedMicro,
   withinAdvertisedTolerance
-} from "./chunk-C2AGARLM.js";
+} from "./chunk-2VGWYG4P.js";
 import {
   authorizeProtectedRemoval,
   isValidEvmPrivateKey,
   loadConfig,
   updateConfig
-} from "./chunk-MG67KXU7.js";
+} from "./chunk-MZRJR2CW.js";
 import {
   X402_DEFAULT_NETWORK,
   X402_V1_VERSION,
   X402_VERSION,
-  assertSupportedX402Network,
   buildPaymentRequirements,
   chainIdFromCaip2,
   encodePayment,
   usdcContractFor,
   usdcDomainNameFor,
   usdcDomainVersionFor,
-  x402NetworkByCaip2,
-  x402NetworkToCaip2,
-  x402SupportedNetworksHint
-} from "./chunk-Z4BNLUZF.js";
+  x402NetworkToCaip2
+} from "./chunk-IWQHUSMO.js";
 import {
   costAnchor,
   fetchBtcUsdRate,
@@ -34,18 +31,25 @@ import {
   getLastKnownBtcRate,
   msatsToUsdc,
   usdcToMsats
-} from "./chunk-A4CM2BD3.js";
+} from "./chunk-3MHE725Z.js";
 import {
-  DvmError,
   X402_CHANNELS_FILE,
   ensureConfigDir,
   resolveRpcHttpTransportOptions,
   resolveRpcOverride
-} from "./chunk-MKI6OVW4.js";
+} from "./chunk-CZULM42S.js";
 import {
   redactUrl,
   redactUrlsInText
 } from "./chunk-FUJ36YDV.js";
+import {
+  assertSupportedX402Network,
+  x402NetworkByCaip2,
+  x402SupportedNetworksHint
+} from "./chunk-RLTSCKRI.js";
+import {
+  DvmError
+} from "./chunk-LIRAHP7B.js";
 
 // src/lib/x402/asset.ts
 function resolveX402Asset(network = X402_DEFAULT_NETWORK) {

package/dist/{chunk-EAMZZ2B4.js → chunk-X7EZ5CLI.js}

@@ -17,9 +17,16 @@ var PostgresTempoSessionStore = class {
     this.update = this.update.bind(this);
   }
   pool;
+  hostingCleanupFence;
+  useHostingCleanupFence(fence) {
+    this.hostingCleanupFence = fence;
+  }
   acceptance = new AsyncLocalStorage();
   async init() {
     await withSdkInitLock(this.pool, async () => {
+      const before = await this.pool.query(
+        "SELECT to_regclass('mpp_tempo_channels') IS NOT NULL AS existed"
+      );
       await this.pool.query(`
         CREATE TABLE IF NOT EXISTS mpp_tempo_channels (
           channel_key TEXT PRIMARY KEY,
@@ -31,6 +38,24 @@ var PostgresTempoSessionStore = class {
         `CREATE INDEX IF NOT EXISTS idx_mpp_tempo_channels_updated
            ON mpp_tempo_channels(updated_at)`
       );
+      await this.pool.query(`
+        CREATE TABLE IF NOT EXISTS mpp_tempo_channel_tombstones (
+          channel_key TEXT PRIMARY KEY,
+          state_json TEXT NOT NULL,
+          deleted_at_ms BIGINT NOT NULL
+        )
+      `);
+      await this.pool.query(`
+        CREATE TABLE IF NOT EXISTS mpp_tempo_channel_history (
+          singleton BOOLEAN PRIMARY KEY CHECK (singleton),
+          complete BOOLEAN NOT NULL
+        )
+      `);
+      await this.pool.query(
+        `INSERT INTO mpp_tempo_channel_history (singleton,complete) VALUES (TRUE,$1)
+         ON CONFLICT (singleton) DO NOTHING`,
+        [!before.rows[0].existed]
+      );
       await this.pool.query(`
         CREATE TABLE IF NOT EXISTS mpp_tempo_close_intents (
           channel_id      TEXT PRIMARY KEY,
@@ -75,6 +100,17 @@ var PostgresTempoSessionStore = class {
   }
   /** Compose voucher acceptance and its ledger mutation under the channel-row lock. */
   async withVoucherAcceptance(voucher, commit, operation) {
+    if (this.hostingCleanupFence) {
+      if (!voucher.hostingFunding) throw new Error("Hosted Tempo voucher has no original funding admission");
+      const reservation = voucher.hostingFunding;
+      await this.hostingCleanupFence.withNewIntent({
+        admissionId: reservation.admissionId,
+        creditId: reservation.creditId,
+        fundId: reservation.fundId,
+        callerPubkey: reservation.callerPubkey,
+        fundingCommitment: reservation.commitment
+      }, (tx) => this.hostingCleanupFence.assertFundingReservation(tx, reservation));
+    }
     const context = {
       commit,
       channelId: voucher.channelId.toLowerCase(),
@@ -365,6 +401,16 @@ var PostgresTempoSessionStore = class {
         };
       }
       assertMonotonicTransition(current, value);
+      if (current === null) {
+        const prior = await client.query(
+          "SELECT state_json FROM mpp_tempo_channel_tombstones WHERE channel_key=$1 FOR UPDATE",
+          [key]
+        );
+        if (prior.rows[0]) assertMonotonicTransition(parseStoreValue(prior.rows[0].state_json), value);
+      }
+      if (!acceptance && this.hostingCleanupFence && (current === null || (asBigInt(value.highestVoucherAmount) ?? 0n) > (isRecord(current) ? asBigInt(current.highestVoucherAmount) ?? 0n : 0n))) {
+        await this.hostingCleanupFence.assertNewIntent(client);
+      }
       await client.query(
         `INSERT INTO mpp_tempo_channels (channel_key, state_json, updated_at)
          VALUES ($1, $2, $3)
@@ -382,6 +428,19 @@ var PostgresTempoSessionStore = class {
         });
       }
     } else if (change.op === "delete") {
+      if (current !== null) {
+        const prior = await client.query(
+          "SELECT state_json FROM mpp_tempo_channel_tombstones WHERE channel_key=$1 FOR UPDATE",
+          [key]
+        );
+        if (prior.rows[0]) assertMonotonicTransition(parseStoreValue(prior.rows[0].state_json), current);
+        await client.query(
+          `INSERT INTO mpp_tempo_channel_tombstones (channel_key,state_json,deleted_at_ms)
+           VALUES ($1,$2,$3) ON CONFLICT (channel_key) DO UPDATE
+             SET state_json=EXCLUDED.state_json,deleted_at_ms=EXCLUDED.deleted_at_ms`,
+          [key, rows[0].state_json, Date.now()]
+        );
+      }
       await client.query(`DELETE FROM mpp_tempo_channels WHERE channel_key = $1`, [key]);
     }
     return change.result;

package/dist/{chunk-7X6UDVCQ.js → chunk-Z4ZT5LNT.js}

@@ -38,14 +38,16 @@ var PLATFORM_REPORT_TABLE_COLUMNS = [
 ];
 var RevenueReporter = class _RevenueReporter {
   // 24h of failed retries
-  constructor(db, platformUrl, platformToken) {
+  constructor(db, platformUrl, platformToken, hostedObligations) {
     this.db = db;
     this.platformUrl = platformUrl;
     this.platformToken = platformToken;
+    this.hostedObligations = hostedObligations;
   }
   db;
   platformUrl;
   platformToken;
+  hostedObligations;
   retryTimer = null;
   static RETRY_INTERVAL_MS = 3e4;
   static MAX_BACKOFF_MS = 3e5;
@@ -188,8 +190,44 @@ var RevenueReporter = class _RevenueReporter {
    * loop redelivers freely.
    */
   async enqueuePayout(payload, tx) {
+    if (this.hostedObligations && (payload.rail === "x402" || payload.rail === "tempo") && await this.hostedObligations.hasCompleteHistory(tx ?? this.db)) {
+      throw new Error("Hosted channel payout requires its original settlement obligation");
+    }
     await this.insertPending(tx ?? this.db, "payout", payload);
   }
+  async enqueueHostedPayout(payload, obligationIds, tx) {
+    if (!this.hostedObligations || payload.rail !== "x402" && payload.rail !== "tempo") {
+      throw new Error("Hosted channel payout has no managed obligation recorder");
+    }
+    const enqueue = async (query) => {
+      if (await this.hostedObligations.hasOriginalReport(
+        obligationIds,
+        payload.payoutId,
+        payload,
+        query
+      )) return;
+      const reportId = await this.insertPending(query, "payout", payload);
+      await this.hostedObligations.queueReport(
+        obligationIds,
+        payload.payoutId,
+        reportId,
+        payload,
+        query
+      );
+    };
+    if (tx) return enqueue(tx);
+    const client = await this.db.connect();
+    try {
+      await client.query("BEGIN");
+      await enqueue(client);
+      await client.query("COMMIT");
+    } catch (error) {
+      await client.query("ROLLBACK").catch(() => void 0);
+      throw error;
+    } finally {
+      client.release();
+    }
+  }
   /**
    * Report one landed payout on its own and try to deliver it at once — the
    * live Tempo settlement, which has no dvmkit transaction to join. Durable
@@ -518,6 +556,12 @@ var RevenueReporter = class _RevenueReporter {
     }
   }
   async enqueue(kind, payload, label) {
+    if (kind === "payout" && this.hostedObligations) {
+      const rail = payload.rail;
+      if ((rail === "x402" || rail === "tempo") && await this.hostedObligations.hasCompleteHistory()) {
+        throw new Error("Hosted channel payout requires its original settlement obligation");
+      }
+    }
     const id = await this.insertPending(this.db, kind, payload);
     void this.attemptDelivery(id, payload, kind, label).catch(() => {
     });
@@ -532,6 +576,9 @@ var RevenueReporter = class _RevenueReporter {
     return id;
   }
   async attemptDelivery(id, payload, kind, label) {
+    if (kind === "payout" && this.hostedObligations && (payload.rail === "x402" || payload.rail === "tempo")) {
+      await this.hostedObligations.assertReportReady(id, payload);
+    }
     const url = `${this.platformUrl}${ENDPOINTS[kind]}`;
     let res;
     try {
@@ -552,7 +599,24 @@ var RevenueReporter = class _RevenueReporter {
       throw err;
     }
     if (res.ok) {
-      await this.db.query(`DELETE FROM ${PENDING_DVM_REPORTS_TABLE} WHERE id = $1`, [id]);
+      if (this.hostedObligations && kind === "payout") {
+        const client = await this.db.connect();
+        try {
+          await client.query("BEGIN");
+          const rail = payload.rail;
+          const requireLinked = (rail === "x402" || rail === "tempo") && await this.hostedObligations.hasCompleteHistory(client);
+          await this.hostedObligations.acknowledgeDelivered(id, client, requireLinked);
+          await client.query(`DELETE FROM ${PENDING_DVM_REPORTS_TABLE} WHERE id = $1`, [id]);
+          await client.query("COMMIT");
+        } catch (error) {
+          await client.query("ROLLBACK").catch(() => void 0);
+          throw error;
+        } finally {
+          client.release();
+        }
+      } else {
+        await this.db.query(`DELETE FROM ${PENDING_DVM_REPORTS_TABLE} WHERE id = $1`, [id]);
+      }
       diagnosticConsole.log(`[revenue-reporter] reported ${kind} ${label}`);
       return;
     }

package/dist/{credit-ledger-A35WH2TI.js → credit-ledger-MI2H7NEC.js}

@@ -10,9 +10,11 @@ import {
   isDrainMethod,
   isFundingRail,
   x402SettlementPending
-} from "./chunk-2SD2W2BG.js";
+} from "./chunk-JH3SX3LY.js";
 import "./chunk-COYKJRMM.js";
 import "./chunk-P6QON7ER.js";
+import "./chunk-RLTSCKRI.js";
+import "./chunk-LIRAHP7B.js";
 import "./chunk-ETXDTUJO.js";
 export {
   CreditLedger,

package/dist/{credit-menu-0-UtJ3hh.d.ts → credit-menu-B8_p_vUz.d.ts}

@@ -1,15 +1,93 @@
-import { ah as FundingMethod, o as PaymentMethod, bM as CreditLedgerLike, a1 as Message, X as FundingReceipt, bO as CreditSnapshot, Y as JobReceipt, S as SDKJobContext, aw as StepCache, u as ResponseContent, P as PaymentContent, a2 as MessageType, bj as X402Receipt, aE as X402Config, bi as X402ExactVersionSupport, cT as X402SettlementIntent, aq as PaymentRequirementsV2, c1 as CreditLedgerQuerier, cU as X402SettlementCursor, bQ as X402SettlementStatus, cV as X402SettlementWriteOff, bN as X402RefundSettlementGate, cW as X402FacilitatorAuth, cX as X402BatchSettlementConfig, cz as PostgresX402ChannelStorage, cY as X402PayoutObserver, br as MppxServer, ab as CashuMode, cZ as CreditDepositEnqueue, c_ as X402SettlementReconciliationReason, ao as PaymentRequirements, a0 as MppxCredential, bm as CreditDepositPayload, bP as DrawResult, cn as CreditLedgerError, a6 as ReceiptCredit, ae as DrainReceiptEvent, ad as DrainReceipt, K as KVStore, y as SignedRequestAudience, c$ as CreditDrawReleaseEnqueue, cx as JobCostReportPayload, cy as JobTerminalReportPayload, cB as RevenueSkippedNoRailPayload, Z as ZodLike, a as DVMDescriptor, bV as CreditInvoiceRecord, bW as InvoiceSettlement, ch as ClientCompatibilityGate, cf as ClientCompatibility, bu as PayoutReporter, R as ResolvedCreditConfig, g as CreditView } from './step-cache-v2yhyhSZ.js';
+import { cf as HostingCleanupFence, cV as HostedIntent, ah as FundingMethod, o as PaymentMethod, bN as CreditLedgerLike, a1 as Message, X as FundingReceipt, bP as CreditSnapshot, Y as JobReceipt, S as SDKJobContext, aw as StepCache, u as ResponseContent, P as PaymentContent, a2 as MessageType, bj as X402Receipt, aE as X402Config, bi as X402ExactVersionSupport, cW as X402SettlementIntent, aq as PaymentRequirementsV2, cX as HostedFundingReservation, c2 as CreditLedgerQuerier, cY as X402SettlementCursor, bR as X402SettlementStatus, cZ as X402SettlementWriteOff, bO as X402RefundSettlementGate, c_ as X402FacilitatorAuth, c$ as X402BatchSettlementConfig, cB as PostgresX402ChannelStorage, d0 as X402PayoutObserver, bL as HostedSettlementReportObligations, br as MppxServer, ab as CashuMode, d1 as CreditDepositEnqueue, d2 as X402SettlementReconciliationReason, ao as PaymentRequirements, a0 as MppxCredential, bm as CreditDepositPayload, bQ as DrawResult, cp as CreditLedgerError, a6 as ReceiptCredit, ae as DrainReceiptEvent, ad as DrainReceipt, K as KVStore, y as SignedRequestAudience, d3 as CreditDrawReleaseEnqueue, cz as JobCostReportPayload, cA as JobTerminalReportPayload, cD as RevenueSkippedNoRailPayload, Z as ZodLike, a as DVMDescriptor, bW as CreditInvoiceRecord, bX as InvoiceSettlement, cj as ClientCompatibilityGate, ch as ClientCompatibility, bv as PostgresTempoSessionStore, bu as PayoutReporter, R as ResolvedCreditConfig, g as CreditView } from './step-cache-Bi43A0JN.js';
 import { ProofLike, SerializedDLEQ, Proof } from '@cashu/cashu-ts';
 import { Hono, Context } from 'hono';
 import { Pool } from 'pg';
-import { b as FxRateSnapshot, F as FxFetcher } from './fx-DhyT1Cjh.js';
-import { g as LockPubkey, f as CheckMintHealthOptions, b as LightningBackend, A as AttestationPayload } from './lightning-backend-BhsyrBLa.js';
-import { T as TopUpCapUnenforcedReason, A as AppendOutgoingOptions, J as JobRecord, b as JobStore } from './job-store-D3CcZp_g.js';
-import { Challenge } from 'mppx';
+import { b as FxRateSnapshot, F as FxFetcher } from './fx-DuaYHvVn.js';
+import { Store, Challenge } from 'mppx';
+import { g as LockPubkey, f as CheckMintHealthOptions, b as LightningBackend, A as AttestationPayload } from './lightning-backend-BaeCPmx7.js';
+import { T as TopUpCapUnenforcedReason, A as AppendOutgoingOptions, J as JobRecord, b as JobStore } from './job-store-D6Rjj5Oi.js';
 import { SettleResponse, SupportedResponse } from '@x402/core/types';
 import { Channel, AutoSettlementConfig } from '@x402/evm/batch-settlement/server';
 import { FacilitatorClient } from '@x402/core/server';
 
+interface PostgresTempoChargeStoreOpts {
+    /** Table name. Defaults to `"mpp_tempo_charge_replays"`. Must match `/^[a-zA-Z_][a-zA-Z0-9_]*$/`. */
+    tableName?: string;
+    /**
+     * How long a row survives its last write, in milliseconds. Defaults to one
+     * hour — see the class doc for why that is both generous and safe.
+     */
+    retentionMs?: number;
+    /**
+     * Probability (per write) of firing a fire-and-forget GC sweep that deletes
+     * expired rows. Defaults to 0.01 — every ~100 writes runs one DELETE. Set to
+     * 0 to disable GC entirely (rely on an external sweeper).
+     */
+    gcSampleRate?: number;
+    /** Clock source (ms). Defaults to `Date.now`. Test seam for deterministic TTL. */
+    now?: () => number;
+}
+/**
+ * Postgres implementation of the atomic store mppx's `tempo.charge` uses for
+ * replay protection.
+ *
+ * mppx refuses a charge credential whose transaction hash it has already taken
+ * (`markHashUsed`), and refuses a zero-dollar proof credential whose challenge
+ * id it has already taken — but only against the store it is handed. Omitting
+ * one leaves it on `Store.memory()`: per-process, lost on restart, invisible to
+ * sibling machines. A replayed credential then reaches a broadcast the chain
+ * rejects instead of the cheap `Transaction hash has already been used`.
+ *
+ * {@link PostgresTempoSessionStore} cannot serve this keyspace — its `update`
+ * asserts a monotonic *channel-state object*, and a replay marker is the number
+ * `Date.now()`. Values here are deliberately opaque JSON: mppx writes a number
+ * for a replay marker and a `SponsorBudget.State` object for the fee-sponsor
+ * budget, which shares this store unprefixed so aggregate in-flight fee
+ * exposure is sponsor-wide rather than per-process.
+ *
+ * **Retention is ours — mppx has no TTL at any layer of `Store`.** Every row
+ * carries an `expires_at` refreshed on each write, swept by a sampled in-line
+ * DELETE. The window is uniform rather than per-keyspace because it is safe for
+ * both kinds of row: a replay marker guards a credential whose transaction is
+ * settleable for about twenty-five seconds and whose challenge expires in
+ * minutes, and a sponsor-budget reservation is bounded by that same expiring
+ * nonce (plus a thirty-second lease while it is `prepared`), so an hour-idle
+ * budget row holds only reservations `SponsorBudget.reconcile` would release on
+ * sight. Sweeping such a row is equivalent to reconciling it, and the next
+ * reservation recreates it. The hosted fence pins mppx's charge key forms;
+ * a version that changes those forms must update the reservation derivation.
+ *
+ * `expires_at` is a GC marker only: reads do not filter on it, so protection
+ * lapses when a row is swept and never before.
+ */
+declare class PostgresTempoChargeStore implements Store.AtomicStore {
+    private hostingCleanupFence?;
+    useHostingCleanupFence(fence: HostingCleanupFence): void;
+    reserveHostedCharge(serializedCredential: string, intent: HostedIntent): Promise<void>;
+    completeHostedCharge(challengeId: string): Promise<void>;
+    private readonly pool;
+    private readonly tableName;
+    private readonly retentionMs;
+    private readonly gcSampleRate;
+    private readonly now;
+    constructor(pool: Pool, opts?: PostgresTempoChargeStoreOpts);
+    /** Run the CREATE TABLE migration. Idempotent — safe to call repeatedly. */
+    init(): Promise<void>;
+    /** Read one stored value, or `null` when absent — mppx's miss sentinel. */
+    get(key: string): Promise<unknown>;
+    put(key: string, value: unknown): Promise<void>;
+    /** Delete one stored value — mppx's compensating release on a failed broadcast. */
+    delete(key: string): Promise<void>;
+    /**
+     * Advisory locking covers the absent-row first write before the row lock.
+     * Both competing presentations of one credential and the shared sponsor
+     * budget need this serialization. The transaction contains no chain call.
+     */
+    update<result>(key: string, fn: (current: unknown) => Store.Change<unknown, result>): Promise<result>;
+    private createTables;
+    private maybeSweep;
+}
+
 interface WalletAccumulatorRow {
     id: string;
     dvmId: string;
@@ -201,8 +279,36 @@ interface HostingControlCommand {
 }
 /** Ordered JSON arrays are the versioned wire signing contract. */
 declare function signHostingControl(secret: string, command: HostingControlCommand): string;
+interface HostingClosureCommand {
+    version: 3;
+    action: "close" | "certificate";
+    scope: string;
+    dvmId: string;
+    generation: number;
+    operationId: string;
+    timestampMs: number;
+    nonce: string;
+}
+declare function signHostingClosure(secret: string, command: HostingClosureCommand): string;
+interface HostingClosureEvidence {
+    dvmId: string;
+    scope: string;
+    instanceId: string;
+    bootEpoch: number;
+    generation: number;
+    operationId: string;
+    cutoffTxid: string;
+    closedAtMs: number;
+    complete: boolean;
+    eligible: boolean;
+    reasons: string[];
+    liabilities: {
+        currency: string;
+        amountMicro: string;
+    }[];
+}
 interface HostingControlStatus {
-    state: "accepting" | "draining";
+    state: "accepting" | "draining" | "closed";
     generation: number;
     deadlineMs: number | null;
     leaseExpiresAtMs: number | null;
@@ -965,6 +1071,8 @@ interface X402ExactSettlementEffect {
     callerId: string;
     dvmId: string;
     jobId?: string;
+    hostingAdmissionId?: string;
+    hostingPaymentSeq?: number;
     /** Upfront job request bound to this payment; omitted for credit-only and mid-job effects. */
     jobAdmission?: {
         requestFingerprint: string;
@@ -1058,6 +1166,8 @@ interface X402ExactSettlementStore {
 }
 declare class PostgresX402ExactSettlementStore implements X402ExactSettlementStore {
     private readonly pool;
+    private hostingCleanupFence?;
+    useHostingCleanupFence(fence: HostingCleanupFence): void;
     constructor(pool: Pick<Pool, "query" | "connect">);
     init(): Promise<void>;
     prepare(intent: Omit<X402ExactSettlementIntent, "status" | "createdAt" | "updatedAt" | "resolvedAt">): Promise<X402ExactSettlementIntent>;
@@ -1436,6 +1546,7 @@ interface X402BatchSettlementServer {
          * figure, since this one is read before the channel lock is taken.
          */
         refundBoundNative?: number;
+        hostingFunding?: HostedFundingReservation;
         commit: (funding: X402BatchFunding, tx?: CreditLedgerQuerier) => Promise<T>;
         complete?: (settlement: SettleResponse, committed: T, tx?: CreditLedgerQuerier) => Promise<T>;
     } & ({
@@ -1528,6 +1639,8 @@ interface CreateX402BatchSettlementServerOpts {
      * builder surface, and not part of the extractable SDK contract.
      */
     payout?: X402PayoutObserver;
+    /** Server-installed managed-host settlement recorder. */
+    hostedObligations?: HostedSettlementReportObligations;
 }
 /**
  * Initialize upstream's scheme and channel manager against dvmkit storage.
@@ -1670,6 +1783,9 @@ interface TempoChannelReport {
     payee?: string;
 }
 interface UpfrontPaymentOpts {
+    /** Server-created hosted admission that predates rail side effects. */
+    hostingAdmissionId?: string;
+    hostingPaymentArtifactHash?: string;
     cashuToken?: string;
     requiredMsats?: number;
     mints?: string[];
@@ -2003,6 +2119,8 @@ declare function verifyTempoSessionManagementCredential(args: {
     resourcePath: string;
     action: "close" | "topUp" | "open";
     expectedChannelId?: string;
+    /** Hosted close only: authenticate the credential without a rail write before reserving its effect. */
+    preflightBeforeBound?: boolean;
     /**
      * Runs once the credential is decoded and bound to `expectedChannelId`, and
      * before anything broadcasts.
@@ -2063,6 +2181,8 @@ declare function paymentErrorBody(code: PaymentErrorCode, opts: {
  */
 declare function buildPaymentErrorResponse(body: Record<string, unknown>, challenges?: Challenge.Challenge[], x402Requirements?: PaymentRequirements[], status?: number, x402V2Requirements?: PaymentRequirementsV2[], x402V2Resource?: string, x402ExactVersions?: X402ExactVersionSupport, x402ErrorCode?: string): Response;
 interface IncomingPaymentOpts {
+    /** Durable pending-verification message sequence written before this rail is touched. */
+    hostingPaymentSeq?: number;
     mints?: string[];
     x402Config?: X402Config;
     /** Declared DVM pricing currency. x402 is accepted only when this is USD. */
@@ -4097,6 +4217,12 @@ interface SDKServerOpts {
     db?: Pool;
     /** Enables authenticated, durable hosting admission and bounded drain. Requires Postgres and dvmId. */
     hostingControl?: HostingControlConfig;
+    /** Internal host wiring: shared ledger rows cannot certify one of several mounts. */
+    hostingCleanupSingleMount?: boolean;
+    /** Internal host wiring: every configured rail uses SDK-owned durable stores. */
+    hostingCleanupKnownRailStores?: boolean;
+    hostingTempoSessionStore?: PostgresTempoSessionStore;
+    hostingTempoChargeStore?: PostgresTempoChargeStore;
     /**
      * Host strict-mode flag. Reporter readiness follows hosted context regardless
      * of this value.
@@ -4413,4 +4539,4 @@ declare function attachCreditMenu(body: Record<string, unknown>, menu: CreditMen
  */
 declare function toCreditTerms(menu: CreditMenu): CreditTerms;
 
-export { isTerminal as $, type AccumulatorPool as A, buildPaymentErrorResponse as B, type ConsumedCredentialStore as C, clearAccumulatorForDvm as D, createDVMServer as E, type FiatDenomination as F, creditDepositPayload as G, derivedFundCreditId as H, type IncomingPaymentOpts as I, JobCancelledError as J, devModeSkipsPaymentVerification as K, fromJobRecord as L, MintHealthTracker as M, fundedMicroFor as N, hasPaymentProof as O, PAYMENT_PROOF_KEYS as P, hashLockKey as Q, type ReporterBannerOpts as R, type SDKServerOpts as S, type TempoChannelReport as T, type UpfrontPaymentOpts as U, type VerifiedIncomingPayment as V, implicitCreditId as W, type X402BatchChannelObservation as X, initWalletAccumulatorTable as Y, insertAccumulatorRows as Z, isDerivedCreditId as _, type AccumulatorQuerier as a, type X402BatchSettlementServer as a$, isYieldMessage as a0, issueUpfrontChallenges as a1, msatsToFiatMicro as a2, paymentErrorBody as a3, pinAskFiat as a4, priceFiatMicro as a5, processIncomingPayment as a6, providerMessage as a7, repairX402ExactSettlementEffect as a8, resolveFxSnapshot as a9, type HostingControlCommand as aA, type HostingControlConfig as aB, type HostingControlStatus as aC, JobManager as aD, type JobManagerOpts as aE, type LightningReceiveConfig as aF, MIN_INVOICE_TTL_SECONDS as aG, MemoryConsumedCredentialStore as aH, type MemoryConsumedCredentialStoreOpts as aI, MemoryProcessedPaymentStore as aJ, MemoryX402ExactSettlementStore as aK, type MountOpts as aL, type OwnerDisplay as aM, type PaidJobCompletion as aN, type PaymentMode as aO, type PlatformReporterOpts as aP, PostgresProcessedPaymentStore as aQ, PostgresX402ExactSettlementStore as aR, type PriceFiat as aS, type ProcessedPaymentQuerier as aT, type ProcessedPaymentRail as aU, type ProcessedPaymentRecord as aV, ProcessedPaymentReplayError as aW, type ProcessedPaymentStore as aX, type X402BatchAcceptance as aY, type X402BatchFunding as aZ, type X402BatchRefusal as a_, resolvePriceFiat as aa, revenueReporterBannerState as ab, toCreditTerms as ac, toJobRecord as ad, unknownRouteNotFound as ae, verifyIncomingPayment as af, verifyTempoSessionManagementCredential as ag, verifyUpfrontPayment as ah, x402RequiredUsdcMicro as ai, x402SettledShare as aj, type CreditMenu as ak, ReceiptIssuer as al, LightningReceive as am, TempoSettlementReadiness as an, type DVMHostOpts as ao, type DVMServeResult as ap, type BuildCreditMenuArgs as aq, type BuilderIdentity as ar, CREDIT_ENVELOPE_KEYS as as, type CreateX402BatchSettlementServerOpts as at, type CreditEnvelope as au, CreditEnvelopeError as av, type CreditFundCommitment as aw, type CreditTerms as ax, DEFAULT_INVOICE_TTL_SECONDS as ay, type DVMHost as az, type AppEnv as b, type X402ExactAcceptance as b0, X402ExactIntentConflictError as b1, type X402ExactSettlementAttempt as b2, type X402ExactSettlementChainEvidence as b3, type X402ExactSettlementEffect as b4, X402ExactSettlementEvidenceMissingError as b5, type X402ExactSettlementEvidenceReader as b6, type X402ExactSettlementIntent as b7, X402ExactSettlementNotReadyError as b8, X402ExactSettlementServer as b9, type X402ExactSettlementServerOpts as ba, type X402ExactSettlementStatus as bb, type X402ExactSettlementStore as bc, type X402SettlementChainEvidence as bd, type X402SettlementEvidenceReader as be, X402SettlementSubmissionError as bf, X402_BATCH_AUTO_SETTLEMENT as bg, X402_BATCH_MIN_WITHDRAW_DELAY_SECONDS as bh, X402_BATCH_SETTLEMENT_NETWORK as bi, attachCreditMenu as bj, buildCreditMenu as bk, createDVMHost as bl, createX402BatchSettlementServer as bm, creditEnvelopeIgnoreFields as bn, drawSettlementRef as bo, extractCreditEnvelope as bp, fundingCommitment as bq, selectPrimaryCredit as br, signHostingControl as bs, stripCreditEnvelope as bt, toCreditView as bu, type CreditFundingReport as c, type FiatDenominationFailure as d, type FundOnlyRequest as e, type PaymentErrorCode as f, type PaymentErrorDetail as g, type PaymentInfo as h, type ResolvedFx as i, type RevenueBootCheckOpts as j, type ServerJob as k, type ShortPayForfeit as l, type TempoObserverHealth as m, TempoSessionChannelMismatchError as n, type VerifyIncomingSnapshot as o, X402FacilitatorHealth as p, type X402SettlementEvidenceOutcome as q, type X402SettlementRepair as r, type X402SettlementRepairRefusal as s, type X402SettlementRepaired as t, type X402WedgedSettlement as u, type X402WedgedSettlementPage as v, X402_BATCH_SETTLEMENT_MAINNET_NETWORK as w, abortJob as x, applyPaymentInfoToJob as y, assertRevenueReporterReady as z };
+export { isDerivedCreditId as $, type AccumulatorPool as A, assertRevenueReporterReady as B, type ConsumedCredentialStore as C, buildPaymentErrorResponse as D, clearAccumulatorForDvm as E, type FiatDenomination as F, createDVMServer as G, creditDepositPayload as H, type IncomingPaymentOpts as I, JobCancelledError as J, derivedFundCreditId as K, devModeSkipsPaymentVerification as L, MintHealthTracker as M, fromJobRecord as N, fundedMicroFor as O, PAYMENT_PROOF_KEYS as P, hasPaymentProof as Q, type ReporterBannerOpts as R, type SDKServerOpts as S, type TempoChannelReport as T, type UpfrontPaymentOpts as U, type VerifiedIncomingPayment as V, hashLockKey as W, type X402BatchChannelObservation as X, implicitCreditId as Y, initWalletAccumulatorTable as Z, insertAccumulatorRows as _, type AccumulatorQuerier as a, type X402BatchAcceptance as a$, isTerminal as a0, isYieldMessage as a1, issueUpfrontChallenges as a2, msatsToFiatMicro as a3, paymentErrorBody as a4, pinAskFiat as a5, priceFiatMicro as a6, processIncomingPayment as a7, providerMessage as a8, repairX402ExactSettlementEffect as a9, type DVMHost as aA, type HostingClosureCommand as aB, type HostingClosureEvidence as aC, type HostingControlCommand as aD, type HostingControlConfig as aE, type HostingControlStatus as aF, JobManager as aG, type JobManagerOpts as aH, type LightningReceiveConfig as aI, MIN_INVOICE_TTL_SECONDS as aJ, MemoryConsumedCredentialStore as aK, type MemoryConsumedCredentialStoreOpts as aL, MemoryProcessedPaymentStore as aM, MemoryX402ExactSettlementStore as aN, type MountOpts as aO, type OwnerDisplay as aP, type PaidJobCompletion as aQ, type PaymentMode as aR, type PlatformReporterOpts as aS, PostgresProcessedPaymentStore as aT, PostgresX402ExactSettlementStore as aU, type PriceFiat as aV, type ProcessedPaymentQuerier as aW, type ProcessedPaymentRail as aX, type ProcessedPaymentRecord as aY, ProcessedPaymentReplayError as aZ, type ProcessedPaymentStore as a_, resolveFxSnapshot as aa, resolvePriceFiat as ab, revenueReporterBannerState as ac, toCreditTerms as ad, toJobRecord as ae, unknownRouteNotFound as af, verifyIncomingPayment as ag, verifyTempoSessionManagementCredential as ah, verifyUpfrontPayment as ai, x402RequiredUsdcMicro as aj, x402SettledShare as ak, type CreditMenu as al, ReceiptIssuer as am, LightningReceive as an, TempoSettlementReadiness as ao, type DVMHostOpts as ap, type DVMServeResult as aq, type BuildCreditMenuArgs as ar, type BuilderIdentity as as, CREDIT_ENVELOPE_KEYS as at, type CreateX402BatchSettlementServerOpts as au, type CreditEnvelope as av, CreditEnvelopeError as aw, type CreditFundCommitment as ax, type CreditTerms as ay, DEFAULT_INVOICE_TTL_SECONDS as az, type AppEnv as b, type X402BatchFunding as b0, type X402BatchRefusal as b1, type X402BatchSettlementServer as b2, type X402ExactAcceptance as b3, X402ExactIntentConflictError as b4, type X402ExactSettlementAttempt as b5, type X402ExactSettlementChainEvidence as b6, type X402ExactSettlementEffect as b7, X402ExactSettlementEvidenceMissingError as b8, type X402ExactSettlementEvidenceReader as b9, type X402ExactSettlementIntent as ba, X402ExactSettlementNotReadyError as bb, X402ExactSettlementServer as bc, type X402ExactSettlementServerOpts as bd, type X402ExactSettlementStatus as be, type X402ExactSettlementStore as bf, type X402SettlementChainEvidence as bg, type X402SettlementEvidenceReader as bh, X402SettlementSubmissionError as bi, X402_BATCH_AUTO_SETTLEMENT as bj, X402_BATCH_MIN_WITHDRAW_DELAY_SECONDS as bk, X402_BATCH_SETTLEMENT_NETWORK as bl, attachCreditMenu as bm, buildCreditMenu as bn, createDVMHost as bo, createX402BatchSettlementServer as bp, creditEnvelopeIgnoreFields as bq, drawSettlementRef as br, extractCreditEnvelope as bs, fundingCommitment as bt, selectPrimaryCredit as bu, signHostingClosure as bv, signHostingControl as bw, stripCreditEnvelope as bx, toCreditView as by, type CreditFundingReport as c, type FiatDenominationFailure as d, type FundOnlyRequest as e, type PaymentErrorCode as f, type PaymentErrorDetail as g, type PaymentInfo as h, PostgresTempoChargeStore as i, type ResolvedFx as j, type RevenueBootCheckOpts as k, type ServerJob as l, type ShortPayForfeit as m, type TempoObserverHealth as n, TempoSessionChannelMismatchError as o, type VerifyIncomingSnapshot as p, X402FacilitatorHealth as q, type X402SettlementEvidenceOutcome as r, type X402SettlementRepair as s, type X402SettlementRepairRefusal as t, type X402SettlementRepaired as u, type X402WedgedSettlement as v, type X402WedgedSettlementPage as w, X402_BATCH_SETTLEMENT_MAINNET_NETWORK as x, abortJob as y, applyPaymentInfoToJob as z };

package/dist/{fx-DhyT1Cjh.d.ts → fx-DuaYHvVn.d.ts}

@@ -1,4 +1,4 @@
-import { C as Currency } from './step-cache-v2yhyhSZ.js';
+import { C as Currency } from './step-cache-Bi43A0JN.js';
 
 /**
  * Quote-time FX snapshot. `rates` maps configured lowercase currency codes to

package/dist/index.d.ts

@@ -1,17 +1,17 @@
-import { C as Currency, Z as ZodLike, D as DVMConfig, a as DVMDescriptor } from './step-cache-v2yhyhSZ.js';
-export { A as ApprovalContent, b as ArtifactContent, c as CancelContent, d as CanonicalEnvelope, e as CreateSignedRequestVerifierOpts, f as CreditConfig, g as CreditView, h as DEFAULT_CREDIT_MAX, i as DEFAULT_CREDIT_MIN, j as DEFAULT_CREDIT_TTL_SECONDS, k as DEFAULT_JOB_RETENTION_DAYS, l as DVMRouteContext, I as IncomingMessage, m as InputType, n as InvalidCurrencyError, J as JobCost, K as KVStore, L as Logger, P as PaymentContent, o as PaymentMethod, p as PriceValue, q as ProgressContent, r as PromptOpts, Q as QuoteConfig, s as QuoteContext, t as QuoteResult, R as ResolvedCreditConfig, u as ResponseContent, S as SDKJobContext, v as SDKPaymentRequestOpts, w as SIGNED_REQUEST_AUTH_ID, x as SIGNED_REQUEST_STATEMENT_VERSION, y as SignedRequestAudience, z as SignedRequestDomain, B as SignedRequestError, E as SignedRequestFailure, F as SignedRequestReplayStore, G as SignedRequestSignOpts, H as SignedRequestStatementHeader, M as SignedRequestVerifier, U as UnsupportedCurrencyError, N as createSignedRequestVerifier, O as isZodSchema, T as signedRequestStatementHeader, V as validateCurrency } from './step-cache-v2yhyhSZ.js';
-export { C as CreateFxFetcherOpts, D as DEFAULT_FX_CURRENCIES, a as DEFAULT_FX_RATE_SOURCE, F as FxFetcher, b as FxRateSnapshot, c as FxRateUnavailableError, P as PlatformFxSource, d as createFxFetcher, f as fxRateFor, r as resolveFxSourceFromEnv } from './fx-DhyT1Cjh.js';
-export { I as InvalidFxRateError, f as fiatToSatsCeil, a as formatFiat, b as formatUsd, r as roundUsd, s as satsToFiat } from './usd-Cu9G6xv2.js';
-export { J as JobRecord, a as JobStatus, b as JobStore } from './job-store-D3CcZp_g.js';
+import { C as Currency, Z as ZodLike, D as DVMConfig, a as DVMDescriptor } from './step-cache-Bi43A0JN.js';
+export { A as ApprovalContent, b as ArtifactContent, c as CancelContent, d as CanonicalEnvelope, e as CreateSignedRequestVerifierOpts, f as CreditConfig, g as CreditView, h as DEFAULT_CREDIT_MAX, i as DEFAULT_CREDIT_MIN, j as DEFAULT_CREDIT_TTL_SECONDS, k as DEFAULT_JOB_RETENTION_DAYS, l as DVMRouteContext, I as IncomingMessage, m as InputType, n as InvalidCurrencyError, J as JobCost, K as KVStore, L as Logger, P as PaymentContent, o as PaymentMethod, p as PriceValue, q as ProgressContent, r as PromptOpts, Q as QuoteConfig, s as QuoteContext, t as QuoteResult, R as ResolvedCreditConfig, u as ResponseContent, S as SDKJobContext, v as SDKPaymentRequestOpts, w as SIGNED_REQUEST_AUTH_ID, x as SIGNED_REQUEST_STATEMENT_VERSION, y as SignedRequestAudience, z as SignedRequestDomain, B as SignedRequestError, E as SignedRequestFailure, F as SignedRequestReplayStore, G as SignedRequestSignOpts, H as SignedRequestStatementHeader, M as SignedRequestVerifier, U as UnsupportedCurrencyError, N as createSignedRequestVerifier, O as isZodSchema, T as signedRequestStatementHeader, V as validateCurrency } from './step-cache-Bi43A0JN.js';
+export { C as CreateFxFetcherOpts, D as DEFAULT_FX_CURRENCIES, a as DEFAULT_FX_RATE_SOURCE, F as FxFetcher, b as FxRateSnapshot, c as FxRateUnavailableError, P as PlatformFxSource, d as createFxFetcher, f as fxRateFor, r as resolveFxSourceFromEnv } from './fx-DuaYHvVn.js';
+export { I as InvalidFxRateError, f as fiatToSatsCeil, a as formatFiat, b as formatUsd, r as roundUsd, s as satsToFiat } from './usd-AZPVq4eU.js';
+export { J as JobRecord, a as JobStatus, b as JobStore } from './job-store-D6Rjj5Oi.js';
 export { P as PinnedFetch, S as SSRFError, a as SSRFGuardOpts, b as SSRFReason, c as SSRFResolver, d as assertSafeUrl, e as createPinnedFetch } from './ssrf-dMooihtY.js';
 export { z } from 'zod';
 import 'hono';
 import 'mppx';
 import '@x402/core/server';
 import '@x402/evm/batch-settlement/server';
-import 'viem';
 import 'pg';
 import '@x402/core/types';
+import 'viem';
 import '@cashu/cashu-ts';
 
 /**