@dvmkit/sdk 0.5.0-rc.1 → 0.6.0-rc.1

package/dist/{lightning-backend-BAx2Y8pP.d.ts → lightning-backend-40fIzz1W.d.ts}

@@ -1,4 +1,4 @@
-import { W as JsonValue } from './step-cache-QG_h5-3G.js';
+import { W as JsonValue } from './step-cache-CPdH1hei.js';
 
 declare const lockPubkeyBrand: unique symbol;
 /**

package/dist/{postgres-consumed-credential-store-CUQJKRSL.js → postgres-consumed-credential-store-BUVCAPLS.js}

@@ -51,6 +51,19 @@ var PostgresConsumedCredentialStore = class {
     );
     return (rowCount ?? 0) > 0;
   }
+  async consume(realm, challengeId, ttlSeconds) {
+    const now = this.now();
+    const { rowCount } = await this.pool.query(
+      `INSERT INTO ${this.tableName}(realm,challenge_id,expires_at) VALUES($1,$2,$3)
+       ON CONFLICT(realm,challenge_id) DO UPDATE SET expires_at=EXCLUDED.expires_at
+       WHERE ${this.tableName}.expires_at <= $4`,
+      [realm, challengeId, now + ttlSeconds * 1e3, now]
+    );
+    if (rowCount === 1 && this.gcSampleRate > 0 && Math.random() < this.gcSampleRate) {
+      this.gcSweep(now);
+    }
+    return rowCount === 1;
+  }
   async mark(realm, challengeId, ttlSeconds) {
     const now = this.now();
     const expiresAt = now + ttlSeconds * 1e3;

package/dist/{postgres-job-store-VLXLWXUQ.js → postgres-job-store-VHLQBJZC.js}

@@ -1,6 +1,8 @@
 import {
   PostgresJobStore
-} from "./chunk-PB4FYZET.js";
+} from "./chunk-EQLA4FFY.js";
+import "./chunk-AFV77S4C.js";
+import "./chunk-BQJIFRAZ.js";
 import "./chunk-COYKJRMM.js";
 import "./chunk-ETXDTUJO.js";
 export {

package/dist/server/index.d.ts

@@ -1,21 +1,24 @@
-import { ac as CashuMode, bK as CreditDrainEnqueue, bL as HostedSettlementReportObligations, R as ResolvedCreditConfig, bM as DVMAuthScheme, z as SignedRequestDomain, bN as CreditLedgerLike, bO as X402RefundSettlementGate, bP as CreditSnapshot, bQ as DrawResult, bR as X402SettlementStatus, bS as X402UnresolvedRefund, bT as GrownDrawResult, bU as DrawResolution, bV as FundingRecord, X as FundingReceipt, bW as CreditInvoiceRecord, bX as InvoiceSettlement, bY as BlockedInvoiceCursor, bZ as InvoiceReconciliation, b_ as InvoiceWriteOff, b$ as DrawRecord, c0 as StalePendingDrawCursor, c1 as TempoCreditLossEvidence, c2 as CreditLedgerQuerier, c3 as TempoCreditLoss, c4 as X402CreditLossEvidence, c5 as X402CreditLoss, c6 as DrainMethod, c7 as DrainRequestResult, c8 as BitcoinDepositLiability, bo as FundingLot, c9 as CreditDrainRecord, ca as ChannelDrainCursor, cb as DrainWriteOff, cc as DrainReleaseResult, cd as DrainFulfilment, ce as DrainTransitionResult, cf as HostingCleanupFence, Y as JobReceipt, a1 as Message, K as KVStore, F as SignedRequestReplayStore, Z as ZodLike, a as DVMDescriptor } from '../step-cache-QG_h5-3G.js';
-export { cg as CLIENT_COMPATIBILITY_HEADERS, d as CanonicalEnvelope, ch as ClientCompatibility, ci as ClientCompatibilityEnv, cj as ClientCompatibilityGate, ck as ClientCompatibilityRequirement, cl as ClientSemVer, e as CreateSignedRequestVerifierOpts, cm as CreditFundingBasis, cn as CreditInvoiceStatus, co as CreditLedger, cp as CreditLedgerError, cq as CreditLedgerErrorCode, cr as CreditLedgerErrorDetails, cs as CreditLedgerPool, ct as CreditStatus, cu as DRAIN_DELIVERY_RESERVE_SATS, cv as DVM_PROTOCOL_VERSION, cw as DrainConflictReason, cx as DrawRailValue, cy as DrawStatus, cz as JobCostReportPayload, cA as JobTerminalReportPayload, cB as PostgresX402ChannelStorage, cC as ReplayStoreBackend, cD as RevenueSkippedNoRailPayload, cE as RevenueSkippedNoRailReason, w as SIGNED_REQUEST_AUTH_ID, x as SIGNED_REQUEST_STATEMENT_VERSION, cF as Secp256k1AuthOpts, y as SignedRequestAudience, B as SignedRequestError, E as SignedRequestFailure, G as SignedRequestSignOpts, H as SignedRequestStatementHeader, M as SignedRequestVerifier, cG as X402ChannelStorageOpts, cH as X402RelayLockHolder, cI as X402RelaySubmissionLock, cJ as X402RelaySubmissionLockError, cK as allocateDrawValue, cL as clientCompatibilityAttributes, cM as clientCompatibilityMiddleware, cN as clientUpgradeRequired, N as createSignedRequestVerifier, cO as parseClientCapabilities, cP as parseClientCompatibility, cQ as parseDvmClient, cR as parseProtocolVersion, cS as requireClientCompatibility, cT as secp256k1Auth, cU as signedRequestInput, T as signedRequestStatementHeader } from '../step-cache-QG_h5-3G.js';
+import { ac as CashuMode, bK as CreditDrainEnqueue, bL as HostedSettlementReportObligations, R as ResolvedCreditConfig, bM as DVMAuthScheme, z as SignedRequestDomain, bN as CreditLedgerLike, bO as X402RefundSettlementGate, bP as CreditSnapshot, bQ as DrawResult, bR as X402SettlementStatus, bS as X402UnresolvedRefund, bT as GrownDrawResult, bU as DrawResolution, bV as FundingRecord, X as FundingReceipt, bW as CreditInvoiceRecord, bX as InvoiceSettlement, bY as BlockedInvoiceCursor, bZ as InvoiceReconciliation, b_ as InvoiceWriteOff, b$ as DrawRecord, c0 as StalePendingDrawCursor, c1 as TempoCreditLossEvidence, c2 as CreditLedgerQuerier, c3 as TempoCreditLoss, c4 as X402CreditLossEvidence, c5 as X402CreditLoss, c6 as DrainMethod, c7 as DrainRequestResult, c8 as BitcoinDepositLiability, bo as FundingLot, c9 as CreditDrainRecord, ca as ChannelDrainCursor, cb as DrainWriteOff, cc as DrainReleaseResult, cd as DrainFulfilment, ce as DrainTransitionResult, cf as HostingCleanupFence, Y as JobReceipt, a1 as Message, K as KVStore, F as SignedRequestReplayStore, Z as ZodLike, a as DVMDescriptor } from '../step-cache-CPdH1hei.js';
+export { cg as CLIENT_COMPATIBILITY_HEADERS, d as CanonicalEnvelope, ch as ClientCompatibility, ci as ClientCompatibilityEnv, cj as ClientCompatibilityGate, ck as ClientCompatibilityRequirement, cl as ClientSemVer, e as CreateSignedRequestVerifierOpts, cm as CreditFundingBasis, cn as CreditInvoiceStatus, co as CreditLedger, cp as CreditLedgerError, cq as CreditLedgerErrorCode, cr as CreditLedgerErrorDetails, cs as CreditLedgerPool, ct as CreditStatus, cu as DRAIN_DELIVERY_RESERVE_SATS, cv as DVM_PROTOCOL_VERSION, cw as DrainConflictReason, cx as DrawRailValue, cy as DrawStatus, cz as JobCostReportPayload, cA as JobTerminalReportPayload, cB as PostgresX402ChannelStorage, cC as ReplayStoreBackend, cD as RevenueSkippedNoRailPayload, cE as RevenueSkippedNoRailReason, w as SIGNED_REQUEST_AUTH_ID, x as SIGNED_REQUEST_STATEMENT_VERSION, cF as Secp256k1AuthOpts, y as SignedRequestAudience, B as SignedRequestError, E as SignedRequestFailure, G as SignedRequestSignOpts, H as SignedRequestStatementHeader, M as SignedRequestVerifier, cG as X402ChannelStorageOpts, cH as X402RelayLockHolder, cI as X402RelaySubmissionLock, cJ as X402RelaySubmissionLockError, cK as allocateDrawValue, cL as clientCompatibilityAttributes, cM as clientCompatibilityMiddleware, cN as clientUpgradeRequired, N as createSignedRequestVerifier, cO as parseClientCapabilities, cP as parseClientCompatibility, cQ as parseDvmClient, cR as parseProtocolVersion, cS as requireClientCompatibility, cT as secp256k1Auth, cU as signedRequestInput, T as signedRequestStatementHeader } from '../step-cache-CPdH1hei.js';
 import { Pool } from 'pg';
-import { al as CreditMenu, b as AppEnv, U as UpfrontPaymentOpts, h as PaymentInfo, am as ReceiptIssuer, an as LightningReceive, ao as TempoSettlementReadiness, ap as DVMHostOpts, aq as DVMServeResult } from '../credit-menu-CAfqe8IY.js';
-export { ar as BuildCreditMenuArgs, as as BuilderIdentity, at as CREDIT_ENVELOPE_KEYS, C as ConsumedCredentialStore, au as CreateX402BatchSettlementServerOpts, av as CreditEnvelope, aw as CreditEnvelopeError, ax as CreditFundCommitment, ay as CreditTerms, az as DEFAULT_INVOICE_TTL_SECONDS, aA as DVMHost, aB as HostingClosureCommand, aC as HostingClosureEvidence, aD as HostingControlCommand, aE as HostingControlConfig, aF as HostingControlStatus, aG as JobManager, aH as JobManagerOpts, aI as LightningReceiveConfig, aJ as MIN_INVOICE_TTL_SECONDS, aK as MemoryConsumedCredentialStore, aL as MemoryConsumedCredentialStoreOpts, aM as MemoryProcessedPaymentStore, aN as MemoryX402ExactSettlementStore, aO as MountOpts, aP as OwnerDisplay, aQ as PaidJobCompletion, aR as PaymentMode, aS as PlatformReporterOpts, aT as PostgresProcessedPaymentStore, aU as PostgresX402ExactSettlementStore, aV as PriceFiat, aW as ProcessedPaymentQuerier, aX as ProcessedPaymentRail, aY as ProcessedPaymentRecord, aZ as ProcessedPaymentReplayError, a_ as ProcessedPaymentStore, a$ as X402BatchAcceptance, b0 as X402BatchFunding, b1 as X402BatchRefusal, b2 as X402BatchSettlementServer, b3 as X402ExactAcceptance, b4 as X402ExactIntentConflictError, b5 as X402ExactSettlementAttempt, b6 as X402ExactSettlementChainEvidence, b7 as X402ExactSettlementEffect, b8 as X402ExactSettlementEvidenceMissingError, b9 as X402ExactSettlementEvidenceReader, ba as X402ExactSettlementIntent, bb as X402ExactSettlementNotReadyError, bc as X402ExactSettlementServer, bd as X402ExactSettlementServerOpts, be as X402ExactSettlementStatus, bf as X402ExactSettlementStore, bg as X402SettlementChainEvidence, bh as X402SettlementEvidenceReader, bi as X402SettlementSubmissionError, bj as X402_BATCH_AUTO_SETTLEMENT, bk as X402_BATCH_MIN_WITHDRAW_DELAY_SECONDS, bl as X402_BATCH_SETTLEMENT_NETWORK, bm as attachCreditMenu, bn as buildCreditMenu, bo as createDVMHost, bp as createX402BatchSettlementServer, bq as creditEnvelopeIgnoreFields, br as drawSettlementRef, bs as extractCreditEnvelope, bt as fundingCommitment, bu as selectPrimaryCredit, bv as signHostingClosure, bw as signHostingControl, bx as stripCreditEnvelope, by as toCreditView } from '../credit-menu-CAfqe8IY.js';
-import { Context } from 'hono';
+import { au as CreditMenu, a as AppEnv, U as UpfrontPaymentOpts, i as PaymentInfo, av as ReceiptIssuer, aw as LightningReceive, ax as TempoSettlementReadiness, ay as DVMHostOpts, az as DVMServeResult, L as LockPubkeyStateLoader, C as ConsumedCredentialStore } from '../credit-menu-BAsrRu3z.js';
+export { aA as BuildCreditMenuArgs, aB as BuilderIdentity, aC as CREDIT_ENVELOPE_KEYS, aD as CreateX402BatchSettlementServerOpts, aE as CreditEnvelope, aF as CreditEnvelopeError, aG as CreditFundCommitment, aH as CreditTerms, aI as DEFAULT_INVOICE_TTL_SECONDS, aJ as DVMHost, aK as HostingClosureCommand, aL as HostingClosureEvidence, aM as HostingControlCommand, aN as HostingControlConfig, aO as HostingControlStatus, aP as JobManager, aQ as JobManagerOpts, aR as LightningReceiveConfig, aS as MIN_INVOICE_TTL_SECONDS, aT as MemoryConsumedCredentialStore, aU as MemoryConsumedCredentialStoreOpts, aV as MemoryProcessedPaymentStore, aW as MemoryX402ExactSettlementStore, aX as MountOpts, aY as OwnerDisplay, aZ as PaidJobCompletion, a_ as PaymentMode, a$ as PlatformReporterOpts, b0 as PostgresProcessedPaymentStore, b1 as PostgresX402ExactSettlementStore, b2 as PriceFiat, b3 as ProcessedPaymentQuerier, b4 as ProcessedPaymentRail, b5 as ProcessedPaymentRecord, b6 as ProcessedPaymentReplayError, b7 as ProcessedPaymentStore, b8 as X402BatchAcceptance, b9 as X402BatchFunding, ba as X402BatchRefusal, bb as X402BatchSettlementServer, bc as X402ExactAcceptance, bd as X402ExactIntentConflictError, be as X402ExactSettlementAttempt, bf as X402ExactSettlementChainEvidence, bg as X402ExactSettlementEffect, bh as X402ExactSettlementEvidenceMissingError, bi as X402ExactSettlementEvidenceReader, bj as X402ExactSettlementIntent, bk as X402ExactSettlementNotReadyError, bl as X402ExactSettlementServer, bm as X402ExactSettlementServerOpts, bn as X402ExactSettlementStatus, bo as X402ExactSettlementStore, bp as X402SettlementChainEvidence, bq as X402SettlementEvidenceReader, br as X402SettlementSubmissionError, bs as X402_BATCH_AUTO_SETTLEMENT, bt as X402_BATCH_MIN_WITHDRAW_DELAY_SECONDS, bu as X402_BATCH_SETTLEMENT_NETWORK, bv as attachCreditMenu, bw as buildCreditMenu, bx as createDVMHost, by as createX402BatchSettlementServer, bz as creditEnvelopeIgnoreFields, bA as drawSettlementRef, bB as extractCreditEnvelope, bC as fundingCommitment, bD as selectPrimaryCredit, bE as signHostingClosure, bF as signHostingControl, bG as stripCreditEnvelope, bH as toCreditView } from '../credit-menu-BAsrRu3z.js';
+import { Context, Hono } from 'hono';
 import { z } from 'zod';
-import { F as FxFetcher } from '../fx-D9nsN3n4.js';
-import { c as StreamableJobStore, R as ReceiptIssuingStore, J as JobRecord, d as RequestIdClaim, e as RequestIdClaimResult, f as JobRetentionCursor, O as OutgoingMessage, A as AppendOutgoingOptions, P as PaymentCreditDelta, V as VerifyAndCreditResult, g as JobCounters } from '../job-store-Bx-VFRjg.js';
-export { a as JobStatus, b as JobStore, h as isStreamableJobStore } from '../job-store-Bx-VFRjg.js';
+import { F as FxFetcher } from '../fx-BgDmyTdd.js';
+import { c as StreamableJobStore, R as ReceiptIssuingStore, J as JobRecord, d as RequestIdClaim, e as RequestIdClaimResult, f as JobRetentionCursor, O as OutgoingMessage, A as AppendOutgoingOptions, P as PaymentCreditDelta, V as VerifyAndCreditResult, g as JobCounters, b as JobStore } from '../job-store-BVeF5_Jq.js';
+export { a as JobStatus, h as isStreamableJobStore } from '../job-store-BVeF5_Jq.js';
+import { C as ContentHoldHistory, a as ContentHoldMutation } from '../content-retention-BTGSQRfP.js';
+export { b as ContentHold, c as ContentHoldError, d as ContentHoldEvent, e as ContentHoldStore, f as ContentHoldsResponse, J as JobContentMetadata, g as baselineContentExpiry, h as contentMetadata, i as isContentHoldStore } from '../content-retention-BTGSQRfP.js';
 export { P as PinnedFetch, S as SSRFError, a as SSRFGuardOpts, b as SSRFReason, c as SSRFResolver, d as assertSafeUrl, e as createPinnedFetch } from '../ssrf-dMooihtY.js';
+import { Env, BlankSchema } from 'hono/types';
 import 'mppx';
 import '@x402/core/server';
 import '@x402/evm/batch-settlement/server';
 import '@x402/core/types';
 import 'viem';
+import '../lightning-backend-40fIzz1W.js';
 import '@cashu/cashu-ts';
-import '../lightning-backend-BAx2Y8pP.js';
 
 /** Lifetime of a per-call implicit credit before the ledger refuses new draws. */
 declare const IMPLICIT_CREDIT_TTL_MS: number;
@@ -395,6 +398,11 @@ declare class PostgresJobStore implements StreamableJobStore, ReceiptIssuingStor
         expectedLastActivityAt: number;
         redactedAt: number;
     }): Promise<boolean>;
+    getContentSnapshot(jobId: string, dvmId?: string): Promise<{
+        job: JobRecord;
+        history: ContentHoldHistory;
+    } | undefined>;
+    mutateContentHold(jobId: string, mutation: ContentHoldMutation, dvmId?: string): Promise<ContentHoldHistory>;
     claimReceiptSeq(jobId: string): Promise<number>;
     saveReceipt(jobId: string, receipt: JobReceipt): Promise<JobReceipt | undefined>;
     appendOutgoing(jobId: string, message: OutgoingMessage, opts?: AppendOutgoingOptions): Promise<number>;
@@ -513,4 +521,14 @@ declare function hasInvalidRequestId(data: unknown): boolean;
 /** Single-DVM host. Use createDVMHost for multiple mounts with distinct prefixes. */
 declare function serve<State, InputSchema extends ZodLike | undefined = undefined>(descriptor: DVMDescriptor<State, InputSchema>, opts?: DVMHostOpts): Promise<DVMServeResult>;
 
-export { BitcoinDepositLiability, BlockedInvoiceCursor, CREDIT_REQUEST_SCHEMA, CreditInvoiceRecord, CreditLedgerLike, CreditLedgerQuerier, CreditMenu, type CreditRequest, type CreditRouteDeps, CreditSnapshot, DVMAuthScheme, DVMHostOpts, DVMServeResult, DrawRecord, DrawResolution, DrawResult, FundingRecord, GrownDrawResult, IMPLICIT_CREDIT_TTL_MS, type InitLockPool, InvoiceReconciliation, InvoiceSettlement, InvoiceWriteOff, JobRecord, LightningReceive, MemoryCreditLedger, PostgresJobStore, PostgresKVStore, PostgresReplayStore, type PostgresReplayStoreOpts, REQUEST_ID_FIELD, type ResolvedCashuOpts, SDK_INIT_ADVISORY_LOCK, SignedRequestDomain, SignedRequestReplayStore, StalePendingDrawCursor, StreamableJobStore, handleCreditRequest, hasInvalidRequestId, protocolEnvelopeIgnoreFields, requestIdFromEnvelope, resolveCashuOptsFromEnv, serve, stripProtocolEnvelope, withSdkInitLock };
+interface InstallAdminContentRoutesOpts {
+    dvmId: string;
+    store: JobStore;
+    retentionDays: number;
+    getLockPubkeyState: LockPubkeyStateLoader;
+    nonceStore: ConsumedCredentialStore;
+    now?: () => number;
+}
+declare function installAdminContentRoutes<E extends Env = Env, S extends BlankSchema = BlankSchema>(app: Hono<E, S>, opts: InstallAdminContentRoutesOpts): void;
+
+export { BitcoinDepositLiability, BlockedInvoiceCursor, CREDIT_REQUEST_SCHEMA, ConsumedCredentialStore, ContentHoldHistory, ContentHoldMutation, CreditInvoiceRecord, CreditLedgerLike, CreditLedgerQuerier, CreditMenu, type CreditRequest, type CreditRouteDeps, CreditSnapshot, DVMAuthScheme, DVMHostOpts, DVMServeResult, DrawRecord, DrawResolution, DrawResult, FundingRecord, GrownDrawResult, IMPLICIT_CREDIT_TTL_MS, type InitLockPool, type InstallAdminContentRoutesOpts, InvoiceReconciliation, InvoiceSettlement, InvoiceWriteOff, JobRecord, JobStore, LightningReceive, MemoryCreditLedger, PostgresJobStore, PostgresKVStore, PostgresReplayStore, type PostgresReplayStoreOpts, REQUEST_ID_FIELD, type ResolvedCashuOpts, SDK_INIT_ADVISORY_LOCK, SignedRequestDomain, SignedRequestReplayStore, StalePendingDrawCursor, StreamableJobStore, handleCreditRequest, hasInvalidRequestId, installAdminContentRoutes, protocolEnvelopeIgnoreFields, requestIdFromEnvelope, resolveCashuOptsFromEnv, serve, stripProtocolEnvelope, withSdkInitLock };

package/dist/server/index.js

@@ -62,6 +62,7 @@ import {
   hasInvalidRequestId,
   initLockPubkeyTable,
   initWalletAccumulatorTable,
+  installAdminContentRoutes,
   parseClientCapabilities,
   parseClientCompatibility,
   parseDvmClient,
@@ -78,7 +79,7 @@ import {
   stripProtocolEnvelope,
   toCreditView,
   unknownRouteNotFound
-} from "../chunk-EYTHFFFU.js";
+} from "../chunk-HHBDBMEO.js";
 import {
   MemoryProcessedPaymentStore,
   PostgresProcessedPaymentStore,
@@ -90,22 +91,28 @@ import {
 } from "../chunk-FYRR2UEZ.js";
 import {
   PostgresJobStore
-} from "../chunk-PB4FYZET.js";
+} from "../chunk-EQLA4FFY.js";
 import "../chunk-YG7G4DPZ.js";
 import {
   SignedRequestError,
   createDefaultReplayStore,
   createSignedRequestVerifier,
   signedRequestInput
-} from "../chunk-Z4KLECAC.js";
+} from "../chunk-N5RZ5HVB.js";
 import {
   isStreamableJobStore
-} from "../chunk-O5AT6S5T.js";
+} from "../chunk-IV6Q7NRW.js";
+import {
+  ContentHoldError,
+  baselineContentExpiry,
+  contentMetadata,
+  isContentHoldStore
+} from "../chunk-AFV77S4C.js";
 import {
   generateEphemeralReceiptKey,
   isTestMintUrl,
   receiptPubkeyFromSecret
-} from "../chunk-TUA7PYH7.js";
+} from "../chunk-OQA7IHI4.js";
 import {
   X402_DEFAULT_FACILITATOR,
   X402_DEFAULT_NETWORK,
@@ -121,13 +128,14 @@ import {
   SIGNED_REQUEST_AUTH_ID,
   SIGNED_REQUEST_STATEMENT_VERSION,
   signedRequestStatementHeader
-} from "../chunk-A4YFWZ7R.js";
+} from "../chunk-RCM3P2HE.js";
 import "../chunk-OFVV37XC.js";
 import {
   initLoggers
-} from "../chunk-6DOGTAHA.js";
+} from "../chunk-QR2EF2NI.js";
 import "../chunk-66HGCPBU.js";
 import "../chunk-FUJ36YDV.js";
+import "../chunk-BQJIFRAZ.js";
 import "../chunk-BYCEKO65.js";
 import "../chunk-AT6V3SY7.js";
 import {
@@ -1145,7 +1153,7 @@ function createDVMHost(opts = {}) {
       });
       applyRetryToPool(pool, "dvm-host");
       pgPool = pool;
-      const { PostgresJobStore: PostgresJobStore2 } = await import("../postgres-job-store-VLXLWXUQ.js");
+      const { PostgresJobStore: PostgresJobStore2 } = await import("../postgres-job-store-VHLQBJZC.js");
       const pgJobStore = new PostgresJobStore2(pool);
       pendingInits.push(pgJobStore.init(), pgJobStore.initStreaming());
       jobStore = pgJobStore;
@@ -1453,7 +1461,7 @@ ${config.facilitatorAuth?.keyId ?? ""}`;
     }
     let sharedPgConsumedStore;
     if (pgPool) {
-      const { PostgresConsumedCredentialStore } = await import("../postgres-consumed-credential-store-CUQJKRSL.js");
+      const { PostgresConsumedCredentialStore } = await import("../postgres-consumed-credential-store-BUVCAPLS.js");
       const consumedStore = new PostgresConsumedCredentialStore(pgPool);
       pendingInits.push(consumedStore.init());
       sharedPgConsumedStore = consumedStore;
@@ -2096,6 +2104,7 @@ export {
   CLIENT_COMPATIBILITY_HEADERS,
   CREDIT_ENVELOPE_KEYS,
   CREDIT_REQUEST_SCHEMA,
+  ContentHoldError,
   CreditEnvelopeError,
   CreditLedger,
   CreditLedgerError,
@@ -2135,10 +2144,12 @@ export {
   allocateDrawValue,
   assertSafeUrl,
   attachCreditMenu,
+  baselineContentExpiry,
   buildCreditMenu,
   clientCompatibilityAttributes,
   clientCompatibilityMiddleware,
   clientUpgradeRequired,
+  contentMetadata,
   createDVMHost,
   createPinnedFetch,
   createSignedRequestVerifier,
@@ -2149,6 +2160,8 @@ export {
   fundingCommitment,
   handleCreditRequest,
   hasInvalidRequestId,
+  installAdminContentRoutes,
+  isContentHoldStore,
   isStreamableJobStore,
   parseClientCapabilities,
   parseClientCompatibility,

package/dist/{step-cache-QG_h5-3G.d.ts → step-cache-CPdH1hei.d.ts}

@@ -5427,7 +5427,7 @@ declare const DEFAULT_CREDIT_MAX: PriceValue;
 /** Platform default for {@link CreditConfig.ttl}: 30 days. */
 declare const DEFAULT_CREDIT_TTL_SECONDS: number;
 /** Default lifetime of caller-controlled job content before it is redacted. */
-declare const DEFAULT_JOB_RETENTION_DAYS = 90;
+declare const DEFAULT_JOB_RETENTION_DAYS = 730;
 /**
  * Per-capability configuration for the multi-capability shape.
  * Each capability is an independent unit a caller pays for: its own input
@@ -5591,7 +5591,7 @@ interface DVMConfig<State = Record<string, unknown>, InputSchema extends ZodLike
     /**
      * Days terminal job content remains available before the SDK redacts it.
      * The durable row, payment linkage, and signed receipt remain for accounting
-     * and request-id safety. Default: 90. Set to `0` to disable automatic
+     * and request-id safety. Default: 730. Set to `0` to disable automatic
      * redaction.
      */
     jobRetentionDays?: number;

package/dist/testing/index.d.ts

@@ -1,5 +1,6 @@
-import { Y as JobReceipt, a1 as Message, a2 as MessageType, K as KVStore, L as Logger, u as ResponseContent, P as PaymentContent, S as SDKJobContext } from '../step-cache-QG_h5-3G.js';
-import { c as StreamableJobStore, R as ReceiptIssuingStore, J as JobRecord, d as RequestIdClaim, e as RequestIdClaimResult, f as JobRetentionCursor, O as OutgoingMessage, A as AppendOutgoingOptions, P as PaymentCreditDelta, V as VerifyAndCreditResult, g as JobCounters } from '../job-store-Bx-VFRjg.js';
+import { C as ContentHoldHistory, a as ContentHoldMutation } from '../content-retention-BTGSQRfP.js';
+import { Y as JobReceipt, a1 as Message, a2 as MessageType, K as KVStore, L as Logger, u as ResponseContent, P as PaymentContent, S as SDKJobContext } from '../step-cache-CPdH1hei.js';
+import { c as StreamableJobStore, R as ReceiptIssuingStore, J as JobRecord, d as RequestIdClaim, e as RequestIdClaimResult, f as JobRetentionCursor, O as OutgoingMessage, A as AppendOutgoingOptions, P as PaymentCreditDelta, V as VerifyAndCreditResult, g as JobCounters } from '../job-store-BVeF5_Jq.js';
 import 'hono';
 import 'mppx';
 import '@x402/core/server';
@@ -16,6 +17,7 @@ import '@cashu/cashu-ts';
  * concurrency control beyond JS's single-threaded execution.
  */
 declare class MemoryJobStore implements StreamableJobStore, ReceiptIssuingStore {
+    private contentHolds;
     private data;
     private messages;
     private nextSeq;
@@ -44,6 +46,11 @@ declare class MemoryJobStore implements StreamableJobStore, ReceiptIssuingStore
         expectedLastActivityAt: number;
         redactedAt: number;
     }): Promise<boolean>;
+    getContentSnapshot(jobId: string): Promise<{
+        job: JobRecord;
+        history: ContentHoldHistory;
+    } | undefined>;
+    mutateContentHold(jobId: string, mutation: ContentHoldMutation): Promise<ContentHoldHistory>;
     claimReceiptSeq(jobId: string): Promise<number>;
     saveReceipt(jobId: string, receipt: JobReceipt): Promise<JobReceipt | undefined>;
     appendOutgoing(jobId: string, message: OutgoingMessage, opts?: AppendOutgoingOptions): Promise<number>;

package/dist/testing/index.js

@@ -2,15 +2,18 @@ import {
   MemoryKVStore
 } from "../chunk-SDK6KDJN.js";
 import {
-  JobCancelledError,
   MemoryJobStore,
   createInstrumentedFetch
-} from "../chunk-O5AT6S5T.js";
+} from "../chunk-IV6Q7NRW.js";
+import {
+  JobCancelledError
+} from "../chunk-AFV77S4C.js";
 import {
   createNoopLogger
-} from "../chunk-6DOGTAHA.js";
+} from "../chunk-QR2EF2NI.js";
 import "../chunk-66HGCPBU.js";
 import "../chunk-FUJ36YDV.js";
+import "../chunk-BQJIFRAZ.js";
 import {
   validateCurrency
 } from "../chunk-BYCEKO65.js";

package/dist/{usd-EwRqCPF-.d.ts → usd-AWlrwlM5.d.ts}

@@ -1,4 +1,4 @@
-import { C as Currency } from './step-cache-QG_h5-3G.js';
+import { C as Currency } from './step-cache-CPdH1hei.js';
 
 /**
  * Thrown by `fiatToSatsCeil` / `satsToFiat` when the supplied `ratePerBtc` is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dvmkit/sdk",
-  "version": "0.5.0-rc.1",
+  "version": "0.6.0-rc.1",
   "description": "SDK for building accountless, pay-per-use Digital Vending Machines",
   "license": "Apache-2.0",
   "repository": {
@@ -36,7 +36,8 @@
   },
   "files": [
     "dist",
-    "NOTICE"
+    "NOTICE",
+    "recipes"
   ],
   "engines": {
     "node": ">=22"

package/recipes/postgres/financial-export-v1.sql

@@ -0,0 +1,137 @@
+-- Run with psql -X -q -t -A -v ON_ERROR_STOP=1 -f financial-export-v1.sql > financial-evidence.json
+-- The transaction gives every table one consistent snapshot. Optional rail tables
+-- absent from this service are empty arrays. Keep this file with the export.
+-- Receipts are signed over every field. Reject unsupported shapes instead of
+-- removing signed extensions and silently producing unverifiable evidence.
+CREATE OR REPLACE FUNCTION pg_temp.receipt_v1(value jsonb) RETURNS jsonb LANGUAGE plpgsql IMMUTABLE AS $$
+DECLARE allowed text[]; nested_allowed text[]; item record; nested_item record;
+BEGIN
+  IF value IS NULL OR value = 'null'::jsonb THEN RETURN value; END IF;
+  IF jsonb_typeof(value) <> 'object' OR value->'v' IS DISTINCT FROM '1'::jsonb THEN
+    RAISE EXCEPTION 'financial export v1: unsupported receipt version or shape';
+  END IF;
+  CASE value->>'kind'
+    WHEN 'credit_funding' THEN allowed := ARRAY['v','kind','credit_id','fund_id','funded_micro','balance_after_micro','ledger_seq','issued_at','caller_pubkey','dvm_id','dvm','receipt_pubkey','signature'];
+    WHEN 'credit_drain' THEN allowed := ARRAY['v','kind','credit_id','drain_id','event','method','amount_micro','balance_after_micro','ledger_seq','issued_at','caller_pubkey','dvm_id','dvm','receipt_pubkey','signature'];
+    ELSE
+      IF value ? 'kind' THEN RAISE EXCEPTION 'financial export v1: unsupported receipt kind'; END IF;
+      allowed := ARRAY['v','job_id','dvm_id','dvm','capability','outcome','reason','ended_by','seq','issued_at','requester_pubkey','result_hash','receipt_pubkey','signature','paid','timing','credit'];
+  END CASE;
+  FOR item IN SELECT key,val FROM jsonb_each(value) AS e(key,val) LOOP
+    IF NOT item.key = ANY(allowed) THEN
+      RAISE EXCEPTION 'financial export v1: unsupported signed receipt extension';
+    END IF;
+    IF item.key = ANY(ARRAY['paid','timing','credit']) THEN
+      IF jsonb_typeof(item.val) <> 'object' THEN
+        RAISE EXCEPTION 'financial export v1: unsupported receipt block';
+      END IF;
+      nested_allowed := CASE item.key
+        WHEN 'paid' THEN ARRAY['msats','rail','native_amount','native_asset','tx_hash','mint']
+        WHEN 'timing' THEN ARRAY['accepted_at_ms','terminal_at_ms','caller_wait_ms']
+        WHEN 'credit' THEN ARRAY['credit_id','draw_id','amount','balance_after','ledger_seq'] END;
+      FOR nested_item IN SELECT key,val FROM jsonb_each(item.val) AS n(key,val) LOOP
+        IF NOT nested_item.key = ANY(nested_allowed) OR jsonb_typeof(nested_item.val) = ANY(ARRAY['object','array']) THEN
+          RAISE EXCEPTION 'financial export v1: unsupported signed receipt block extension';
+        END IF;
+      END LOOP;
+    ELSIF jsonb_typeof(item.val) = ANY(ARRAY['object','array']) THEN
+      RAISE EXCEPTION 'financial export v1: unsupported receipt field shape';
+    END IF;
+  END LOOP;
+  RETURN value;
+END
+$$;
+-- Unsigned evidence uses explicit scalar projections. Objects/arrays in scalar
+-- positions are excluded, including inside the supported nested financial blocks.
+CREATE OR REPLACE FUNCTION pg_temp.scalars_v1(value jsonb, strings text[], numbers text[], booleans text[] DEFAULT ARRAY[]::text[]) RETURNS jsonb LANGUAGE sql IMMUTABLE AS $$
+  SELECT CASE WHEN jsonb_typeof(value) <> 'object' THEN NULL ELSE
+    (SELECT COALESCE(jsonb_object_agg(key,val), '{}'::jsonb) FROM jsonb_each(value) AS e(key,val)
+     WHERE (key=ANY(strings) AND jsonb_typeof(val) IN ('string','null'))
+        OR (key=ANY(numbers) AND (jsonb_typeof(val) IN ('number','null') OR (jsonb_typeof(val)='string' AND val #>> '{}' ~ '^-?[0-9]+$')))
+        OR (key=ANY(booleans) AND jsonb_typeof(val) IN ('boolean','null'))) END
+$$;
+CREATE OR REPLACE FUNCTION pg_temp.settlement_v1(value jsonb) RETURNS jsonb LANGUAGE sql IMMUTABLE AS $$
+  SELECT pg_temp.scalars_v1(value,
+    ARRAY['tx_hash','transaction','channel_id','network','repair_kind','payer'],
+    ARRAY['settledAmount','settled_amount','amount','refunded_native','debited_native','surplus_native'], ARRAY['success','repaired'])
+$$;
+CREATE OR REPLACE FUNCTION pg_temp.fulfilment_v1(value jsonb) RETURNS jsonb LANGUAGE sql IMMUTABLE AS $$
+  SELECT pg_temp.scalars_v1(value, ARRAY['source','mintUrl','quoteId'], ARRAY['faceSats','reserveSats','invoiceMsats','routingFeeMsats'])
+$$;
+CREATE OR REPLACE FUNCTION pg_temp.lot_debits_v1(value jsonb) RETURNS jsonb LANGUAGE sql IMMUTABLE AS $$
+  SELECT CASE WHEN jsonb_typeof(value) <> 'array' THEN NULL ELSE
+    (SELECT COALESCE(jsonb_agg(pg_temp.scalars_v1(item, ARRAY['lotId'], ARRAY['micro','sats'])), '[]'::jsonb)
+     FROM jsonb_array_elements(value) item WHERE jsonb_typeof(item)='object') END
+$$;
+CREATE OR REPLACE FUNCTION pg_temp.effect_v1(value jsonb) RETURNS jsonb LANGUAGE sql IMMUTABLE AS $$
+  SELECT pg_temp.scalars_v1(value, ARRAY['callerId','dvmId','jobId'],
+    ARRAY['requiredMsats','paidMsats','fundedMicro','nativeAmount','topUpCapMicro'], ARRAY['drawBasis','askSatisfied','midJob'])
+    || jsonb_strip_nulls(jsonb_build_object(
+      'priceFiat', pg_temp.scalars_v1(value->'priceFiat', ARRAY['currency'], ARRAY['amountMicro']),
+      'fundOnly', pg_temp.scalars_v1(value->'fundOnly', ARRAY['creditId','fundId'], ARRAY[]::text[]),
+      'topUp', pg_temp.scalars_v1(value->'topUp', ARRAY['creditId','drawId'], ARRAY[]::text[]),
+      'creditEnvelope', pg_temp.scalars_v1(value->'creditEnvelope', ARRAY['creditId','drawId'], ARRAY[]::text[])))
+$$;
+CREATE OR REPLACE FUNCTION pg_temp.channel_config_v1(value jsonb) RETURNS jsonb LANGUAGE sql IMMUTABLE AS $$
+  SELECT pg_temp.scalars_v1(value, ARRAY['payer','payerAuthorizer','receiver','receiverAuthorizer'], ARRAY['withdrawDelay'])
+    || CASE WHEN value->>'token' ~ '^0x[0-9a-fA-F]{40}$' THEN jsonb_build_object('token',value->'token') ELSE '{}'::jsonb END
+$$;
+CREATE OR REPLACE FUNCTION pg_temp.tempo_state_v1(value jsonb) RETURNS jsonb LANGUAGE plpgsql IMMUTABLE AS $$
+DECLARE state jsonb; amounts jsonb;
+BEGIN
+  IF value IS NULL OR value='null'::jsonb THEN RETURN NULL; END IF;
+  IF jsonb_typeof(value)<>'string' THEN RETURN NULL; END IF;
+  BEGIN state := (value #>> '{}')::jsonb;
+  EXCEPTION WHEN OTHERS THEN RAISE EXCEPTION 'financial export v1: unsupported Tempo state'; END;
+  IF jsonb_typeof(state)<>'object' THEN RETURN NULL; END IF;
+  -- Normalize the store's tagged bigints without retaining vouchers or signatures.
+  SELECT COALESCE(jsonb_object_agg(key, regexp_replace(val #>> '{}', '#__bigint$', '')), '{}'::jsonb) INTO amounts
+    FROM jsonb_each(state) AS e(key,val)
+    WHERE key=ANY(ARRAY['deposit','spent','settledOnChain','highestVoucherAmount','closeRequestedAt'])
+      AND jsonb_typeof(val) IN ('number','string') AND val #>> '{}' ~ '^[0-9]+(#__bigint)?$';
+  RETURN pg_temp.scalars_v1(state, ARRAY['channelId','escrowContract','payee','payer'], ARRAY['chainId','units'], ARRAY['finalized']) || amounts
+    || CASE WHEN state->>'token' ~ '^0x[0-9a-fA-F]{40}$' THEN jsonb_build_object('token',state->'token') ELSE '{}'::jsonb END;
+END
+$$;
+CREATE OR REPLACE FUNCTION pg_temp.financial_rows_v1(table_name text, columns text[]) RETURNS jsonb LANGUAGE plpgsql AS $$
+DECLARE result jsonb;
+BEGIN
+  IF to_regclass(table_name) IS NULL THEN RETURN '[]'::jsonb; END IF;
+  EXECUTE format('SELECT COALESCE(jsonb_agg(projected ORDER BY projected::text), ''[]''::jsonb) FROM (
+    SELECT (SELECT COALESCE(jsonb_object_agg(key,
+      CASE WHEN key=ANY(ARRAY[''sent_ref'',''settle_response'']) THEN pg_temp.settlement_v1(value)
+           WHEN key=''fulfilment'' THEN pg_temp.fulfilment_v1(value)
+           WHEN key=''lot_debits'' THEN pg_temp.lot_debits_v1(value)
+           WHEN key=''state_json'' THEN pg_temp.tempo_state_v1(value)
+           WHEN key=''channel_config'' THEN pg_temp.channel_config_v1(value)
+           WHEN key=''effect'' THEN pg_temp.effect_v1(value)
+           WHEN key=''receipt'' THEN pg_temp.receipt_v1(value)
+           WHEN key=''receipts'' THEN (SELECT COALESCE(jsonb_agg(pg_temp.receipt_v1(r)), ''[]''::jsonb) FROM jsonb_array_elements(value) r)
+           ELSE CASE WHEN jsonb_typeof(value) NOT IN (''object'',''array'') THEN value ELSE NULL END END), ''{}''::jsonb)
+      FROM jsonb_each(to_jsonb(t)) WHERE key=ANY($1)) projected FROM %I t) rows', table_name)
+    INTO result USING columns;
+  RETURN result;
+END
+$$;
+BEGIN TRANSACTION ISOLATION LEVEL REPEATABLE READ READ ONLY;
+SELECT jsonb_build_object(
+  'format', 'dvmkit-financial-evidence', 'version', 1,
+  'jobs', pg_temp.financial_rows_v1('jobs', ARRAY['id','dvm_id','request_id','requester_pubkey','capability','status','created_at','last_activity_at','terminal_at_ms','ended_by','receipt','receipt_seq','paid_msats','payment_rail','payment_tx_hash','payment_transaction_hash','native_amount','native_asset','credit_id','draw_id','cost_amount_micro','cost_currency']),
+  'credits', pg_temp.financial_rows_v1('credits', ARRAY['credit_id','caller_pubkey','currency','balance_micro','expiry_ms','status','last_ledger_seq','created_at','rail','native_asset','funding_ref','tempo_channel_id','x402_channel_id','msats_remaining','native_remaining']),
+  'fundings', pg_temp.financial_rows_v1('credit_fundings', ARRAY['credit_id','fund_id','caller_pubkey','amount_micro','rail','created_at','balance_after_micro','ledger_seq','receipt']),
+  'funding_lots', pg_temp.financial_rows_v1('credit_funding_lots', ARRAY['lot_id','credit_id','rail','sats_funded','credited_micro','remaining_micro','funding_ref','created_at']),
+  'draws', pg_temp.financial_rows_v1('credit_draws', ARRAY['credit_id','draw_id','job_id','amount_micro','ledger_seq','status','balance_after_micro','created_at','resolved_at','draw_msats','allocated_msats','draw_native','grown_micro']),
+  'drains', pg_temp.financial_rows_v1('credit_drains', ARRAY['credit_id','drain_id','method','amount_micro','balance_after_micro','drained_msats','drained_native','owed_sats','ledger_seq','status','receipts','sent_ref','fulfilment','lot_debits','created_at','parked_at','picked_up_at','sent_at','released_at','written_off_at']),
+  'invoices', pg_temp.financial_rows_v1('credit_invoices', ARRAY['credit_id','fund_id','caller_pubkey','currency','amount_micro','amount_msats','payment_hash','status','expires_at','created_at','settled_at','reconciled_credit_id','reconciled_fund_id','resolved_at']),
+  'expiry_releases', pg_temp.financial_rows_v1('credit_expiry_releases', ARRAY['credit_id','release_id','caller_pubkey','currency','rail','amount_micro','expiry_ms','released_at','reversed_at']),
+  'tempo_channels', pg_temp.financial_rows_v1('mpp_tempo_channels', ARRAY['channel_key','state_json','updated_at']),
+  'tempo_channel_tombstones', pg_temp.financial_rows_v1('mpp_tempo_channel_tombstones', ARRAY['channel_key','state_json','deleted_at_ms']),
+  'tempo_close_intents', pg_temp.financial_rows_v1('mpp_tempo_close_intents', ARRAY['channel_id','drain_id','reference','forecast_pending','updated_at']),
+  'x402_channels', pg_temp.financial_rows_v1('x402_batch_channels', ARRAY['channel_id','channel_config','charged_cumulative_amount','signed_max_claimable','balance','total_claimed','withdraw_requested_at','refund_nonce','onchain_synced_at','last_request_timestamp']),
+  'x402_channel_tombstones', pg_temp.financial_rows_v1('x402_batch_channel_tombstones', ARRAY['channel_id','charged_cumulative_amount','signed_max_claimable','refund_nonce','deleted_at_ms']),
+  'x402_batch_settlements', pg_temp.financial_rows_v1('x402_batch_settlements', ARRAY['settlement_id','channel_id','operation','effect_id','payment_id','status','submission_block','settle_response','created_at','updated_at','resolved_at']),
+  'x402_exact_settlements', pg_temp.financial_rows_v1('x402_exact_settlement_intents', ARRAY['dvm_id','intent_id','network','asset','authorizer','recipient','value','status','effect','submission_block','transaction','settle_response','last_outcome','created_at','updated_at','resolved_at']),
+  'tempo_losses', pg_temp.financial_rows_v1('tempo_credit_losses', ARRAY['credit_id','channel_id','caller_pubkey','currency','former_balance_micro','settled_on_chain_native','highest_voucher_native','consumed_service_micro','consumed_native','observed_at']),
+  'x402_losses', pg_temp.financial_rows_v1('x402_credit_losses', ARRAY['credit_id','channel_id','caller_pubkey','currency','former_balance_micro','channel_balance_native','total_claimed_native','consumed_service_micro','observed_at'])
+);
+ROLLBACK;