@dvmkit/sdk 0.5.0-rc.1 → 0.6.0-rc.1

package/README.md

@@ -96,6 +96,12 @@ For Bitcoin credit monitoring, `GET /admin/credit/bitcoin-liability` reports exa
 
 The public [SDK guide](https://dvmkit.com/docs/sdk) covers signed requests, custom routes, rail configuration, credit reclaim, persistence, and deployment in depth. The [protocol guide](https://dvmkit.com/docs/protocol) specifies the HTTP contract.
 
+## Diagnostic retention
+
+The SDK advertises 730 days of retention for sanitized diagnostics in every existing span dataset: `platform`, `cashu`, `lightning`, `stripe`, `x402`, `tempo`, `isolate`, `audit`, and `cron`. Dataset names, producer permissions, and query semantics remain unchanged; only operator services may write to `audit`.
+
+This metadata describes the retention schedule. The SDK does not automatically delete diagnostics or override platform destruction or case controls. The platform must enforce the schedule and those controls.
+
 ## Repository development
 
 Use the Node.js release in `.nvmrc` (Node 22). Install with `npm ci`, then run the same gate CI runs with `npm run verify`. The gate checks repository metadata in the checkout, copies only tracked and unignored source into an isolated directory, installs its locked dependencies, and runs lint, build, typecheck (including the release scripts under `checkJs`), unit and database tests, API, package, consumer, packed-artifact safety, and release checks there. The clean source tree owns the complete build and test pass, so verification never depends on the checkout's `node_modules` or pre-existing `dist` and does not repeat the full suite; after every check passes, its verified `dist` replaces the checkout's build output for release packaging.
@@ -182,3 +188,97 @@ None of this claims exclusive rights in the phrase "digital vending machine" or
 ## License
 
 Apache-2.0. See [LICENSE](./LICENSE) and [NOTICE](./NOTICE).
+
+## Job content retention and case holds
+
+`configureDVM` defaults `jobRetentionDays` to 730. Set a shorter or longer whole-day
+window explicitly, or `0` to disable automatic age expiry. Only completed, failed,
+and cancelled jobs are eligible. The terminal `lastActivityAt` is frozen: reads,
+receipt delivery, late messages, and re-saving an outcome do not renew it. The
+sweep removes input, params, summary, messages, state, caches, and bearer proofs;
+it preserves durable status, signed receipts, payment amounts, and recovery linkage.
+
+Authenticated job submit, request-result, status and JSON message responses expose
+`content_expires_at` (epoch milliseconds or `null`) and `content_available` (boolean).
+A null deadline means the job is active, expiry is disabled, or an active hold
+suppresses it. A past deadline can still have available content until the sweep
+runs. Missing fields on an older service or unsupported custom store mean unknown.
+SSE messages retain their existing event format; read job status for expiry.
+
+With durable service-admin configuration, use signed `Authorization: P2PK`
+requests on the service-local routes:
+
+| Method | Path | JSON body |
+| --- | --- | --- |
+| GET | `/admin/jobs/:jobId/content-holds` | none |
+| POST | `/admin/jobs/:jobId/content-holds` | `purpose`, `reason`, `review_due_at` |
+| POST | `/admin/jobs/:jobId/content-holds/:holdId/renew` | `reason`, `review_due_at` |
+| POST | `/admin/jobs/:jobId/content-holds/:holdId/clear` | `reason` |
+
+Purpose is `support` or `dispute`; reason is 1–1000 characters and review dates
+are future epoch millisecond integers. Unknown body fields are rejected. Hold IDs,
+actor public keys, and creation/clear times are server-derived. Authentication uses
+the existing method/path/service-bound admin challenge, current and grace-period
+keys, and atomic durable nonce consumption. A hold request does not grant access
+to job content. Authentication failure returns 401 with a reason; an unsupported
+store returns `content_holds_unavailable` (503), missing jobs return 404, and a
+redacted job or inactive hold returns 409. Holds cannot restore redacted content.
+
+Responses include `job_id`, caller content metadata, `baseline_content_expires_at`,
+`holds`, and append-only `events`. Each hold contains `id`, `job_id`, `purpose`,
+`reason`, original `actor`, `created_at`, `review_due_at`, `cleared_at`, and computed
+`review_overdue`. Each event contains `id`, `hold_id`, `job_id`, `action`, `actor`,
+`reason`, `at`, `review_due_at`. Renew and clear preserve the original actor and
+creation date; their authenticated actors are in history. Any active hold suppresses
+the effective deadline. Overdue review flags work; it does not release the hold.
+The baseline remains visible for review. Clearing the last hold restores the
+baseline and can make content immediately eligible for the next sweep.
+
+`PostgresJobStore.init()` adds `job_content_holds` and `job_content_hold_events`
+with job-scoped indexes; existing jobs need no expiry column or backfill. Placement
+and sweep lock the same job row and check redaction/terminal activity/active holds
+inside the transaction. Admin operations refuse jobs bound to another service;
+legacy unbound rows belong to the local service database. A committed hold wins any later competing sweep; if
+redaction wins first, placement fails. `MemoryJobStore` supplies the same contract
+for development. Custom stores must implement `ContentHoldStore` and atomic
+redaction fencing to support holds and truthful metadata.
+
+Before explicitly destroying a service database, use your existing database
+connection/proxy and the packaged `recipes/postgres/financial-export-v1.sql`:
+
+```sh
+psql "$DATABASE_URL" -X -q -t -A -v ON_ERROR_STOP=1 \
+  -f node_modules/@dvmkit/sdk/recipes/postgres/financial-export-v1.sql \
+  > financial-evidence.json
+```
+
+The versioned JSON export takes a consistent read-only snapshot and includes signed
+receipt tuples, ledger balances/amounts/currencies, job/payment links, and recovery
+outcomes. Funding lots preserve every deposit's original sats and credit basis,
+including depleted lots. Draws retain both the original allocation and settled
+amount. Refunds retain fulfilment costs and funding-lot linkage. Optional channel
+projections preserve amounts and settlement links while excluding authorization
+signatures and vouchers; Tempo bigint amounts are decimal strings.
+Unsigned JSON blocks use typed financial projections: unsupported fields and
+objects or arrays in scalar positions are excluded. Optional ledger tables absent from a service become empty arrays. It
+excludes raw input/output, bearer tokens/proofs, payout descriptors, and operational
+credentials. Signed receipts may retain their signed terminal reason and result
+hash; supported version-1 job, funding, and drain receipts are returned unchanged.
+Unsupported receipt versions, kinds, fields, or nested extensions fail the entire
+export before any JSON is emitted. Update the recipe for that schema before
+destruction; a failed export is not retained financial evidence. Verify receipt
+signatures and check the file before destruction, then keep it securely with this recipe
+and the service's public receipt-key attestation. The builder owns this export;
+the platform retains its separate financial history. An export does not settle
+caller balances or refunds: resolve liabilities through their existing lifecycle.
+Case holds affect age expiry, not explicit erasure or contract/lifecycle destruction.
+The active-service window does not extend any contractual maximum for copies after
+explicit destruction, including a 90-day post-destruction limit where applicable.
+
+The wire fields and routes are additive within protocol version 1. Existing explicit
+retention settings retain their value. The new default also applies to existing
+unredacted terminal rows; previously removed content stays unavailable. Upgrade
+all replicas before relying on holds: older SDKs do not recognize the hold fence.
+Do not downgrade or mix old replicas with active holds unless automatic sweeping
+is disabled on those replicas. The SQL export format is versioned independently
+of the package and is not a raw database backup or a content archive.

package/dist/chunk-AFV77S4C.js

@@ -0,0 +1,258 @@
+import {
+  StepCache
+} from "./chunk-BQJIFRAZ.js";
+
+// src/sdk/server/job.ts
+function toJobRecord(job) {
+  return {
+    id: job.id,
+    tags: job.tags,
+    capability: job.capability,
+    input: job.input,
+    params: job.params,
+    requesterId: job.requesterId,
+    requesterTokenHash: job.requesterTokenHash,
+    requesterToken: job.requesterToken,
+    requestFingerprint: job.requestFingerprint,
+    requesterPubkey: job.requesterPubkey,
+    requestId: job.requestId,
+    authRequestPath: job.authRequestPath,
+    status: job.status,
+    summary: job.summary,
+    timingKnown: job.timingKnown,
+    endedBy: job.endedBy,
+    terminalAtMs: job.terminalAtMs,
+    callerWaitMs: job.callerWaitMs,
+    awaitingInputAtMs: job.awaitingInputAtMs,
+    messages: job.messages,
+    seq: job.seq,
+    paidMsats: job.paidMsats,
+    paymentMint: job.paymentMint,
+    paymentRail: job.paymentRail,
+    paymentTxHash: job.paymentTxHash,
+    paymentTransactionHash: job.paymentTransactionHash,
+    nativeAmount: job.nativeAmount,
+    nativeAsset: job.nativeAsset,
+    cashuFlow: job.cashuFlow,
+    costAmountMicro: job.costAmountMicro,
+    costCurrency: job.costCurrency,
+    costRevision: job.costRevision,
+    creditId: job.creditId,
+    drawId: job.drawId,
+    fundingReceipt: job.fundingReceipt,
+    fundingCredit: job.fundingCredit,
+    receivedProofs: job.receivedProofs,
+    pendingPaymentMsats: job.pendingPaymentMsats,
+    pendingMppChallengeIds: job.pendingMppChallengeIds,
+    pendingX402Nonce: job.pendingX402Nonce,
+    pendingX402AmountUsdcMicro: job.pendingX402AmountUsdcMicro,
+    pendingPaymentFiatMicro: job.pendingPaymentFiatMicro,
+    pendingPaymentFiatCurrency: job.pendingPaymentFiatCurrency,
+    askedTopUpMicro: job.askedTopUpMicro,
+    askedTopUpCurrency: job.askedTopUpCurrency,
+    topUpCapUnenforcedReason: job.topUpCapUnenforcedReason,
+    requiredMsats: job.requiredMsats,
+    receipt: job.receipt,
+    stepCache: job.stepCache.serialize(),
+    state: job.state,
+    createdAt: job.createdAt,
+    lastActivityAt: job.lastActivityAt
+  };
+}
+function fromJobRecord(record) {
+  return {
+    id: record.id,
+    tags: record.tags,
+    capability: record.capability,
+    input: record.input,
+    params: record.params,
+    requesterId: record.requesterId,
+    requesterTokenHash: record.requesterTokenHash,
+    status: record.status,
+    summary: record.summary,
+    timingKnown: record.timingKnown,
+    endedBy: record.endedBy,
+    terminalAtMs: record.terminalAtMs,
+    callerWaitMs: record.callerWaitMs,
+    awaitingInputAtMs: record.awaitingInputAtMs,
+    messages: [...record.messages],
+    seq: record.seq,
+    paidMsats: record.paidMsats,
+    paymentMint: record.paymentMint,
+    paymentRail: record.paymentRail,
+    paymentTxHash: record.paymentTxHash,
+    paymentTransactionHash: record.paymentTransactionHash,
+    nativeAmount: record.nativeAmount,
+    nativeAsset: record.nativeAsset,
+    cashuFlow: record.cashuFlow,
+    costAmountMicro: record.costAmountMicro,
+    costCurrency: record.costCurrency,
+    costRevision: record.costRevision,
+    creditId: record.creditId,
+    drawId: record.drawId,
+    fundingReceipt: record.fundingReceipt,
+    fundingCredit: record.fundingCredit,
+    receivedProofs: [...record.receivedProofs],
+    pendingPaymentMsats: record.pendingPaymentMsats,
+    pendingMppChallengeIds: record.pendingMppChallengeIds ? [...record.pendingMppChallengeIds] : void 0,
+    requesterToken: record.requesterToken,
+    requestFingerprint: record.requestFingerprint,
+    requesterPubkey: record.requesterPubkey,
+    requestId: record.requestId,
+    authRequestPath: record.authRequestPath,
+    pendingX402Nonce: record.pendingX402Nonce,
+    pendingX402AmountUsdcMicro: record.pendingX402AmountUsdcMicro,
+    pendingPaymentFiatMicro: record.pendingPaymentFiatMicro,
+    pendingPaymentFiatCurrency: record.pendingPaymentFiatCurrency,
+    askedTopUpMicro: record.askedTopUpMicro,
+    askedTopUpCurrency: record.askedTopUpCurrency,
+    topUpCapUnenforcedReason: record.topUpCapUnenforcedReason,
+    requiredMsats: record.requiredMsats,
+    receipt: record.receipt,
+    listeners: /* @__PURE__ */ new Set(),
+    abort: new AbortController(),
+    messageAppender: void 0,
+    messageAppenderTail: void 0,
+    stepCache: StepCache.deserialize(record.stepCache),
+    state: record.state,
+    pendingPrompts: /* @__PURE__ */ new Map(),
+    pendingPayment: null,
+    replayHighSeq: null,
+    replayProviderSkip: 0,
+    replayPaymentIndex: 0,
+    createdAt: record.createdAt,
+    lastActivityAt: record.lastActivityAt
+  };
+}
+function abortJob(job, reason) {
+  job.abort.abort(new JobCancelledError(reason));
+}
+var JobCancelledError = class extends Error {
+  constructor(message = "Job cancelled") {
+    super(message);
+    this.name = "JobCancelledError";
+  }
+};
+function providerMessage(job, type, content) {
+  if (job.replayProviderSkip > 0) {
+    job.replayProviderSkip--;
+    return;
+  }
+  const msg = localMessage(job, "provider", type, content);
+  if (type === "payment-request") {
+    const paymentRequest = content;
+    const pendingPaymentDelta = typeof paymentRequest.amount_msats === "number" ? paymentRequest.amount_msats : void 0;
+    const pendingMppChallengeIds = paymentRequest.tempo?.challenges?.map((challenge) => challenge.id).filter((id) => typeof id === "string");
+    job.messageAppender?.(msg, {
+      awaitingInput: job.status === "awaiting-input",
+      pendingPaymentDelta,
+      pendingMppChallengeIds,
+      pendingX402Nonce: typeof paymentRequest.x402?.nonce === "string" ? paymentRequest.x402.nonce : void 0,
+      pendingX402AmountUsdcMicro: typeof paymentRequest.x402?.required_usdc_micro === "string" ? paymentRequest.x402.required_usdc_micro : void 0,
+      // read off the job rather than the content — the fiat envelope
+      // is ledger state, not part of the wire shape, and `requestPayment` has
+      // already pinned it on the job by the time this fires (same ordering the
+      // `pendingPaymentMsats` comment above describes).
+      pendingPaymentFiatMicro: job.pendingPaymentFiatMicro,
+      pendingPaymentFiatCurrency: job.pendingPaymentFiatCurrency
+    });
+    return;
+  }
+  job.messageAppender?.(msg, type === "prompt" ? { awaitingInput: job.status === "awaiting-input" } : void 0);
+}
+function localMessage(job, from, type, content) {
+  job.seq++;
+  const msg = {
+    seq: job.seq,
+    from,
+    timestamp: Math.floor(Date.now() / 1e3),
+    type,
+    content
+  };
+  job.messages.push(msg);
+  for (const listener of job.listeners) {
+    listener(msg);
+  }
+  return msg;
+}
+function isTerminal(status) {
+  return status === "completed" || status === "failed" || status === "cancelled";
+}
+function isYieldMessage(msg) {
+  return msg.type === "prompt" || msg.type === "payment-request" || msg.type === "working" || msg.type === "complete" || msg.type === "cancel";
+}
+
+// src/sdk/server/content-retention.ts
+import { randomUUID } from "crypto";
+var ContentHoldError = class extends Error {
+  constructor(code) {
+    super(code);
+    this.code = code;
+  }
+  code;
+};
+function isContentHoldStore(store) {
+  return "getContentSnapshot" in store && "mutateContentHold" in store;
+}
+function contentMetadata(job, retentionDays, holds = []) {
+  const baseline = baselineContentExpiry(job, retentionDays);
+  return {
+    content_expires_at: holds.some((hold) => hold.cleared_at === null) ? null : baseline,
+    content_available: job.redactedAt === void 0
+  };
+}
+function baselineContentExpiry(job, retentionDays) {
+  return retentionDays > 0 && isTerminal(job.status) ? job.lastActivityAt + retentionDays * 864e5 : null;
+}
+function applyContentHoldMutation(job, history, mutation) {
+  if (job.redactedAt !== void 0) throw new ContentHoldError("content_unavailable");
+  const result = structuredClone(history);
+  let hold;
+  if (mutation.action === "placed") {
+    hold = {
+      id: randomUUID(),
+      job_id: job.id,
+      purpose: mutation.purpose,
+      reason: mutation.reason,
+      actor: mutation.actor,
+      created_at: mutation.at,
+      review_due_at: mutation.review_due_at,
+      cleared_at: null
+    };
+    result.holds.push(hold);
+  } else {
+    const existing = result.holds.find((item) => item.id === mutation.hold_id && item.cleared_at === null);
+    if (!existing) throw new ContentHoldError("hold_not_active");
+    hold = existing;
+    if (mutation.action === "cleared") hold.cleared_at = mutation.at;
+    else hold.review_due_at = mutation.review_due_at;
+    hold.reason = mutation.reason;
+  }
+  result.events.push({
+    id: randomUUID(),
+    hold_id: hold.id,
+    job_id: job.id,
+    action: mutation.action,
+    actor: mutation.actor,
+    reason: mutation.reason,
+    at: mutation.at,
+    review_due_at: hold.review_due_at
+  });
+  return result;
+}
+
+export {
+  toJobRecord,
+  fromJobRecord,
+  abortJob,
+  JobCancelledError,
+  providerMessage,
+  localMessage,
+  isTerminal,
+  isYieldMessage,
+  ContentHoldError,
+  isContentHoldStore,
+  contentMetadata,
+  baselineContentExpiry,
+  applyContentHoldMutation
+};

package/dist/chunk-BQJIFRAZ.js

@@ -0,0 +1,36 @@
+// src/sdk/step-cache.ts
+var StepCache = class _StepCache {
+  cache = /* @__PURE__ */ new Map();
+  has(id) {
+    return this.cache.has(id);
+  }
+  get(id) {
+    return this.getRecord(id).value;
+  }
+  getRecord(id) {
+    const record = this.cache.get(id);
+    if (record === void 0) throw new Error(`StepCache: no cached result for step "${id}"`);
+    return record;
+  }
+  set(id, value, costs) {
+    this.cache.set(id, {
+      id,
+      value,
+      ...costs !== void 0 && costs.length > 0 ? { costs: costs.map(({ amount, currency }) => ({ amount, currency })) } : {}
+    });
+  }
+  serialize() {
+    return [...this.cache.values()];
+  }
+  static deserialize(records) {
+    const cache = new _StepCache();
+    for (const { id, value, costs } of records) {
+      cache.set(id, value, costs);
+    }
+    return cache;
+  }
+};
+
+export {
+  StepCache
+};

package/dist/{chunk-PB4FYZET.js → chunk-EQLA4FFY.js}

@@ -1,3 +1,7 @@
+import {
+  ContentHoldError,
+  applyContentHoldMutation
+} from "./chunk-AFV77S4C.js";
 import {
   withSdkInitLock
 } from "./chunk-COYKJRMM.js";
@@ -228,6 +232,18 @@ var PostgresJobStore = class {
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS receipt JSONB;
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS receipt_seq BIGINT;
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS redacted_at BIGINT;
+      CREATE TABLE IF NOT EXISTS job_content_holds (
+        id TEXT PRIMARY KEY, job_id TEXT NOT NULL REFERENCES jobs(id) ON DELETE CASCADE,
+        data JSONB NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS job_content_holds_job_idx ON job_content_holds(job_id);
+      CREATE TABLE IF NOT EXISTS job_content_hold_events (
+        event_position BIGSERIAL UNIQUE,
+        id TEXT PRIMARY KEY, job_id TEXT NOT NULL REFERENCES jobs(id) ON DELETE CASCADE,
+        data JSONB NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS job_content_hold_events_job_idx ON job_content_hold_events(job_id);
+
       -- credit-ledger linkage. Written at submission alongside the
       -- payment fields; the terminal funnel settles/releases the draw and the
       -- receipt countersigns the ReceiptCredit block from it.
@@ -536,7 +552,7 @@ var PostgresJobStore = class {
         required_msats = EXCLUDED.required_msats,
         step_cache = EXCLUDED.step_cache,
         state = EXCLUDED.state,
-        last_activity_at = EXCLUDED.last_activity_at
+        last_activity_at = CASE WHEN jobs.status IN ('completed', 'failed', 'cancelled') THEN jobs.last_activity_at ELSE EXCLUDED.last_activity_at END
       -- terminal is terminal. On a multi-machine DVM a DELETE can
       -- land on a machine that isn't running the handler, which cancels the
       -- job in the store only; the handler's machine never learns of it and
@@ -737,6 +753,7 @@ var PostgresJobStore = class {
     const client = await this.pool.connect();
     try {
       await client.query("BEGIN");
+      await client.query("SELECT id FROM jobs WHERE id = $1 FOR UPDATE", [args.jobId]);
       const { rowCount } = await client.query(
         `UPDATE jobs SET
          input = '',
@@ -760,6 +777,7 @@ var PostgresJobStore = class {
          AND last_activity_at = $2
          AND redacted_at IS NULL
          AND status IN ('completed', 'failed', 'cancelled')
+         AND NOT EXISTS (SELECT 1 FROM job_content_holds h WHERE h.job_id=jobs.id AND h.data->'cleared_at' = 'null'::jsonb)
          AND ($4::boolean = false OR NOT EXISTS (
            SELECT 1 FROM job_messages m WHERE m.job_id=jobs.id
              AND m.data->>'type'='payment'
@@ -781,6 +799,38 @@ var PostgresJobStore = class {
       client.release();
     }
   }
+  async getContentSnapshot(jobId, dvmId) {
+    const { rows } = await this.pool.query(
+      `SELECT j.*, COALESCE((SELECT jsonb_agg(h.data ORDER BY h.data->>'created_at', h.id) FROM job_content_holds h WHERE h.job_id=j.id), '[]'::jsonb) AS content_holds,
+       COALESCE((SELECT jsonb_agg(e.data ORDER BY e.event_position) FROM job_content_hold_events e WHERE e.job_id=j.id), '[]'::jsonb) AS content_hold_events
+       FROM jobs j WHERE j.id=$1 AND ($2::text IS NULL OR j.dvm_id IS NULL OR j.dvm_id=$2)`,
+      [jobId, dvmId ?? null]
+    );
+    if (!rows[0]) return void 0;
+    return { job: rowToRecord(rows[0]), history: { holds: rows[0].content_holds, events: rows[0].content_hold_events } };
+  }
+  async mutateContentHold(jobId, mutation, dvmId) {
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      const { rows } = await client.query("SELECT * FROM jobs WHERE id=$1 AND ($2::text IS NULL OR dvm_id IS NULL OR dvm_id=$2) FOR UPDATE", [jobId, dvmId ?? null]);
+      if (!rows[0]) throw new ContentHoldError("job_not_found");
+      const holds = await client.query("SELECT data FROM job_content_holds WHERE job_id=$1 ORDER BY data->>'created_at', id", [jobId]);
+      const events = await client.query("SELECT data FROM job_content_hold_events WHERE job_id=$1 ORDER BY event_position", [jobId]);
+      const history = applyContentHoldMutation(rowToRecord(rows[0]), { holds: holds.rows.map((row) => row.data), events: events.rows.map((row) => row.data) }, mutation);
+      const event = history.events.at(-1);
+      const hold = history.holds.find((item) => item.id === event.hold_id);
+      await client.query(`INSERT INTO job_content_holds(id,job_id,data) VALUES($1,$2,$3) ON CONFLICT(id) DO UPDATE SET data=EXCLUDED.data`, [hold.id, jobId, JSON.stringify(hold)]);
+      await client.query("INSERT INTO job_content_hold_events(id,job_id,data) VALUES($1,$2,$3)", [event.id, jobId, JSON.stringify(event)]);
+      await client.query("COMMIT");
+      return history;
+    } catch (error) {
+      await client.query("ROLLBACK");
+      throw error;
+    } finally {
+      client.release();
+    }
+  }
   async claimReceiptSeq(jobId) {
     const client = await this.pool.connect();
     try {
@@ -828,7 +878,7 @@ var PostgresJobStore = class {
     try {
       await client.query("BEGIN");
       const { rows } = await client.query(
-        `UPDATE jobs SET next_seq = next_seq + 1, last_activity_at = $2,
+        `UPDATE jobs SET next_seq = next_seq + 1, last_activity_at = CASE WHEN status IN ('completed','failed','cancelled') THEN last_activity_at ELSE $2 END,
            awaiting_input_at_ms = CASE WHEN $3::boolean AND status NOT IN ('completed', 'failed', 'cancelled')
              THEN COALESCE(awaiting_input_at_ms, $2) ELSE awaiting_input_at_ms END,
            status = CASE WHEN $3::boolean AND status NOT IN ('completed', 'failed', 'cancelled')
@@ -925,7 +975,7 @@ var PostgresJobStore = class {
       await client.query("BEGIN");
       if (message.type === "payment") await this.hostingCleanupFence?.assertNewIntent(client);
       const { rows } = await client.query(
-        `UPDATE jobs SET next_seq = next_seq + 1, last_activity_at = $2
+        `UPDATE jobs SET next_seq = next_seq + 1, last_activity_at = CASE WHEN status IN ('completed','failed','cancelled') THEN last_activity_at ELSE $2 END
            WHERE id = $1 AND redacted_at IS NULL
            RETURNING (next_seq - 1) AS seq`,
         [jobId, Date.now()]
@@ -1024,7 +1074,7 @@ var PostgresJobStore = class {
              cashu_flow = COALESCE($9, cashu_flow),
              pending_x402_nonce = CASE WHEN $11::boolean THEN NULL ELSE pending_x402_nonce END,
              pending_x402_amount_usdc_micro = CASE WHEN $11::boolean THEN NULL ELSE pending_x402_amount_usdc_micro END,
-             last_activity_at = $12
+             last_activity_at = CASE WHEN status IN ('completed','failed','cancelled') THEN last_activity_at ELSE $12 END
            WHERE id = $1
            RETURNING status, paid_msats, pending_payment_msats, credit_id, draw_id`,
           params

package/dist/{chunk-TZ2WKCDD.js → chunk-HCLVYZUZ.js}

@@ -4,7 +4,7 @@ import {
   DEFAULT_CREDIT_TTL_SECONDS,
   DEFAULT_JOB_RETENTION_DAYS,
   isZodSchema
-} from "./chunk-A4YFWZ7R.js";
+} from "./chunk-RCM3P2HE.js";
 import {
   InvalidCurrencyError,
   validateCurrency
@@ -47,7 +47,7 @@ function configureDVM(config) {
 }
 function resolveJobRetentionDays(raw) {
   const days = raw ?? DEFAULT_JOB_RETENTION_DAYS;
-  if (!Number.isSafeInteger(days) || days < 0) {
+  if (!Number.isSafeInteger(days) || days < 0 || days > Math.floor((Number.MAX_SAFE_INTEGER - Date.now()) / 864e5)) {
     throw new Error(
       `configureDVM: jobRetentionDays must be a non-negative whole number of days; received ${JSON.stringify(raw)}`
     );