@dvmkit/sdk 0.7.0-rc.1 → 0.7.0-rc.10

package/dist/{chunk-EQLA4FFY.js → chunk-OHUXCAOM.js}

@@ -2,12 +2,12 @@ import {
   ContentHoldError,
   applyContentHoldMutation
 } from "./chunk-AFV77S4C.js";
+import {
+  diagnosticConsole
+} from "./chunk-ZCNPIILZ.js";
 import {
   withSdkInitLock
 } from "./chunk-COYKJRMM.js";
-import {
-  diagnosticConsole
-} from "./chunk-ETXDTUJO.js";
 
 // src/sdk/server/postgres-job-store.ts
 import { createHash } from "crypto";
@@ -286,10 +286,20 @@ var PostgresJobStore = class {
       CREATE INDEX IF NOT EXISTS idx_jobs_retention
         ON jobs (last_activity_at, id)
         WHERE redacted_at IS NULL AND status IN ('completed', 'failed', 'cancelled');
-      CREATE INDEX IF NOT EXISTS idx_jobs_pending_cost_report
+      -- Terminal cost recovery runs at boot and every 30s on each machine.
+      -- Indexing only rows whose latest revision is not yet enqueued keeps each
+      -- pass proportional to that backlog; marking a row drops it from the
+      -- index. listUnreportedTerminalCosts' WHERE clause must imply this
+      -- predicate or the planner falls back to scanning terminal history.
+      DROP INDEX IF EXISTS idx_jobs_pending_cost_report;
+      CREATE INDEX IF NOT EXISTS idx_jobs_unreported_terminal_cost
         ON jobs (dvm_id, id)
         WHERE cost_revision IS NOT NULL
-          AND status IN ('completed', 'failed', 'cancelled');
+          AND (cost_reported_revision IS NULL OR cost_reported_revision < cost_revision)
+          AND (
+            status IN ('failed', 'cancelled')
+            OR (status = 'completed' AND paid_msats = 0)
+          );
       -- the idempotent-replay lookup. payment_tx_hash carries the
       -- caller's X-Cashu-Request-Id on the accumulator path, so a retried paid
       -- submit finds the job its payment already created.
@@ -689,7 +699,8 @@ var PostgresJobStore = class {
   }
   /**
    * Read terminal zero-revenue jobs whose latest declared-cost revision has
-   * not yet reached the durable reporter outbox.
+   * not yet reached the durable reporter outbox. Keep the filter in step with
+   * `idx_jobs_unreported_terminal_cost`, which bounds each pass to the backlog.
    */
   async listUnreportedTerminalCosts(args) {
     const { rows } = await this.pool.query(

package/dist/{chunk-FWGWLPXF.js → chunk-PZ5IAWFD.js}

@@ -4,7 +4,7 @@ import {
 import {
   diagnosticConsole,
   projectSpanRow
-} from "./chunk-ETXDTUJO.js";
+} from "./chunk-ZCNPIILZ.js";
 
 // src/lib/x402/env.ts
 import { isAddress } from "viem";

package/dist/{chunk-IXR5RFK7.js → chunk-R3TQSXWT.js}

@@ -1,6 +1,9 @@
+import {
+  loggers
+} from "./chunk-KCQDXIJU.js";
 import {
   diagnosticConsole
-} from "./chunk-ETXDTUJO.js";
+} from "./chunk-ZCNPIILZ.js";
 
 // src/sdk/server/mpp-setup.ts
 import { createHash, randomUUID } from "crypto";
@@ -533,7 +536,7 @@ function buildMppMethods(opts, env) {
       })
     );
     if (opts.tempoSession) {
-      methods.push(
+      methods.push(withAuthenticationOnlyValidation(
         tempo.session({
           recipient: opts.tempoRecipient,
           account: opts.tempoSession.account,
@@ -557,12 +560,25 @@ function buildMppMethods(opts, env) {
             onSessionSettlement: opts.tempoSession.onSessionSettlement
           }
         })
-      );
+      ));
     }
   }
   if (methods.length === 0 || !tempoConfiguration) return void 0;
   return { methods, tempoConfiguration };
 }
+function withAuthenticationOnlyValidation(method) {
+  if (method.validate) return method;
+  const validate = async ({ credential, request }) => ({
+    challenge: credential.challenge,
+    credential,
+    details: void 0,
+    intent: method.intent,
+    method: method.name,
+    request,
+    ...credential.source !== void 0 && { source: credential.source }
+  });
+  return { ...method, validate };
+}
 function resolveTempoNetwork(env) {
   const testnet = env.DVMKIT_TEMPO_TESTNET === "1" || env.DVMKIT_TEMPO_TESTNET === "true";
   const rawChainId = env.DVMKIT_TEMPO_CHAIN_ID?.trim();
@@ -612,6 +628,9 @@ function wrapMppx(mppx) {
   };
   return Object.assign(server, { issueChallenge });
 }
+var TEMPO_CLOSE_LOG_WINDOW = 5000n;
+var TEMPO_CLOSE_LOG_SLACK_MS = 10 * 60 * 1e3;
+var TEMPO_CLOSE_LOG_MAX_WINDOWS = 500;
 var DEFAULT_TEMPO_SESSION_CHAIN_OPS = {
   getChannelStatesBatch: TempoSession.Precompile.Chain.getChannelStatesBatch,
   settle: TempoSession.Server.settle,
@@ -621,7 +640,32 @@ var DEFAULT_TEMPO_SESSION_CHAIN_OPS = {
       "ChannelClosed",
       channelId
     )
-  )
+  ),
+  findChannelClose: async (client, channelId, escrowContract, notBeforeMs) => {
+    const { getBlock, getBlockNumber, getLogs } = await import("viem/actions");
+    const event = TempoSession.Precompile.escrowAbi.find(
+      (item) => item.type === "event" && item.name === "ChannelClosed"
+    );
+    if (!event || event.type !== "event") throw new Error("Tempo escrow ABI has no ChannelClosed event");
+    let toBlock = await getBlockNumber(client);
+    for (let window = 0; window < TEMPO_CLOSE_LOG_MAX_WINDOWS; window += 1) {
+      const fromBlock = toBlock >= TEMPO_CLOSE_LOG_WINDOW ? toBlock - TEMPO_CLOSE_LOG_WINDOW + 1n : 0n;
+      const logs = await getLogs(client, {
+        address: escrowContract,
+        event,
+        args: { channelId },
+        fromBlock,
+        toBlock
+      });
+      const closed = logs.find((log) => log.transactionHash);
+      if (closed?.transactionHash) return closed.transactionHash;
+      if (fromBlock === 0n) return null;
+      const start = await getBlock(client, { blockNumber: fromBlock });
+      if (Number(start.timestamp) * 1e3 < notBeforeMs - TEMPO_CLOSE_LOG_SLACK_MS) return null;
+      toBlock = fromBlock - 1n;
+    }
+    throw new Error(`Tempo close search for channel ${channelId} exceeded its block budget`);
+  }
 };
 function attachTempoSessionRuntime(mppx, config, chainOpOverrides = {}) {
   let creditLedger;
@@ -642,6 +686,102 @@ function attachTempoSessionRuntime(mppx, config, chainOpOverrides = {}) {
   }
   if (store) {
     Object.assign(mppx, {
+      assertTempoSessionCloseVoucher: async (voucher) => {
+        const descriptor = readChannelDescriptor(voucher.descriptor);
+        if (!descriptor) {
+          throw new MppxErrors.VerificationFailedError({
+            reason: "descriptor required for TIP-1034 session action"
+          });
+        }
+        const details = isStateRecord(voucher.request.methodDetails) ? voucher.request.methodDetails : {};
+        const stored = await store.get(voucher.channelId.toLowerCase());
+        const state = readTempoSessionState(stored);
+        const chainId = typeof details.chainId === "number" ? details.chainId : state?.chainId;
+        const escrow = typeof details.escrowContract === "string" ? details.escrowContract : state?.escrowContract;
+        if (chainId === void 0 || escrow === void 0) {
+          throw new MppxErrors.VerificationFailedError({ reason: "invalid session request" });
+        }
+        const computed = TempoSession.Precompile.Channel.computeId({
+          ...descriptor,
+          chainId,
+          escrow
+        });
+        if (computed.toLowerCase() !== voucher.channelId.toLowerCase()) {
+          throw new MppxErrors.VerificationFailedError({
+            reason: "channel descriptor does not match channelId"
+          });
+        }
+        if (!sameHex(descriptor.payee, voucher.request.recipient)) {
+          throw new MppxErrors.VerificationFailedError({
+            reason: "channel descriptor payee does not match server destination"
+          });
+        }
+        if (!sameHex(descriptor.token, voucher.request.currency)) {
+          throw new MppxErrors.VerificationFailedError({
+            reason: "channel descriptor token does not match server token"
+          });
+        }
+        if (!sameHex(descriptor.operator, details.operator ?? ZERO_ADDRESS)) {
+          throw new MppxErrors.VerificationFailedError({
+            reason: "channel descriptor operator does not match server operator"
+          });
+        }
+        if (!state || !isStateRecord(stored)) {
+          throw new MppxErrors.ChannelNotFoundError({ reason: "channel not found" });
+        }
+        if (stored.backend !== "precompile") {
+          throw new MppxErrors.VerificationFailedError({
+            reason: "channel is not precompile-backed"
+          });
+        }
+        const storedDescriptor = readChannelDescriptor(stored.descriptor);
+        if (!storedDescriptor || !sameDescriptor(descriptor, storedDescriptor)) {
+          throw new MppxErrors.VerificationFailedError({
+            reason: "credential descriptor does not match stored channel"
+          });
+        }
+        const signer = stored.authorizedSigner;
+        if (typeof signer !== "string" || !HEX_ADDRESS_RE.test(signer)) {
+          throw new MppxErrors.ChannelNotFoundError({ reason: "channel not found" });
+        }
+        if (state.finalized) {
+          throw new MppxErrors.ChannelClosedError({ reason: "channel is already finalized" });
+        }
+        if (state.closeRequestedAt !== 0n) {
+          throw new MppxErrors.ChannelClosedError({ reason: "channel has a pending close request" });
+        }
+        if (state.deposit === 0n && (voucher.cumulativeAmount !== 0n || state.spent !== 0n)) {
+          throw new MppxErrors.ChannelClosedError({ reason: "channel deposit is zero (settled)" });
+        }
+        if (voucher.cumulativeAmount < state.spent) {
+          throw new MppxErrors.VerificationFailedError({
+            reason: `close voucher amount must be >= ${state.spent} (spent)`
+          });
+        }
+        if (voucher.cumulativeAmount < state.settledOnChain) {
+          throw new MppxErrors.VerificationFailedError({
+            reason: `close voucher amount must be >= ${state.settledOnChain} (on-chain settled)`
+          });
+        }
+        const valid = TempoSession.Precompile.Voucher.verifyVoucher(
+          escrow,
+          chainId,
+          {
+            channelId: voucher.channelId,
+            cumulativeAmount: voucher.cumulativeAmount,
+            signature: voucher.signature
+          },
+          signer
+        );
+        if (!valid) {
+          throw new MppxErrors.InvalidSignatureError({ reason: "invalid voucher signature" });
+        }
+        if (maxBigInt(state.spent, state.settledOnChain) > state.deposit) {
+          throw new MppxErrors.AmountExceedsDepositError({
+            reason: "close capture amount exceeds on-chain deposit"
+          });
+        }
+      },
       getTempoSessionSpent: async (channelId) => {
         const state = readTempoSessionState(await store.get(channelId.toLowerCase()));
         if (!state) throw new Error(`Tempo session channel ${channelId} not found`);
@@ -984,7 +1124,32 @@ function attachTempoSessionRuntime(mppx, config, chainOpOverrides = {}) {
       finalized = chainState.deposit === 0n;
     }
     if (!finalized) return null;
-    const recovered = await store.confirmClose(channelId, drainId, `channel:${channelId}`);
+    const pending = await config.hostedObligations?.pendingTempoClose(channelId, drainId);
+    let reference = pending?.txHash ?? void 0;
+    if (pending && !reference) {
+      const client = await getClient({ chainId: current.chainId });
+      const txHash = await chainOps.findChannelClose(
+        client,
+        current.channelId,
+        current.escrowContract,
+        pending.reservedAtMs
+      );
+      if (txHash) {
+        await config.hostedObligations.recordSubmitted(pending.id, txHash);
+        reference = txHash;
+      } else {
+        loggers.tempo.warn("tempo_session_close_recovery_unmatched", {
+          channel_id: current.channelId,
+          drain_id: drainId,
+          obligation_id: pending.id
+        });
+      }
+    }
+    const recovered = await store.confirmClose(
+      channelId,
+      drainId,
+      reference ?? `channel:${channelId}`
+    );
     return recovered.reference;
   };
   const getClose = store.getClose?.bind(store) ?? (() => Promise.resolve(null));
@@ -1028,6 +1193,27 @@ function maxBigInt(left, right) {
 function isStateRecord(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
+var ZERO_ADDRESS = `0x${"00".repeat(20)}`;
+var DESCRIPTOR_ADDRESSES = ["payer", "payee", "operator", "token", "authorizedSigner"];
+var DESCRIPTOR_WORDS = ["salt", "expiringNonceHash"];
+function readChannelDescriptor(value) {
+  if (!isStateRecord(value)) return void 0;
+  for (const field of DESCRIPTOR_ADDRESSES) {
+    if (typeof value[field] !== "string" || !HEX_ADDRESS_RE.test(value[field])) return void 0;
+  }
+  for (const field of DESCRIPTOR_WORDS) {
+    if (typeof value[field] !== "string" || !/^0x[0-9a-fA-F]{64}$/.test(value[field])) {
+      return void 0;
+    }
+  }
+  return value;
+}
+function sameHex(left, right) {
+  return typeof left === "string" && typeof right === "string" && left.toLowerCase() === right.toLowerCase();
+}
+function sameDescriptor(left, right) {
+  return DESCRIPTOR_ADDRESSES.every((field) => sameHex(left[field], right[field])) && DESCRIPTOR_WORDS.every((field) => sameHex(left[field], right[field]));
+}
 function tempoSettlementDue(args) {
   const { channel, chainSettled, forcedClose, intervalMs } = args;
   const settlementBoundary = Date.parse(channel.lastSettlementAt ?? channel.createdAt ?? "");

package/dist/{chunk-VHNPVGSA.js → chunk-T5DIXOLR.js}

@@ -1,9 +1,9 @@
+import {
+  diagnosticConsole
+} from "./chunk-ZCNPIILZ.js";
 import {
   withSdkInitLock
 } from "./chunk-COYKJRMM.js";
-import {
-  diagnosticConsole
-} from "./chunk-ETXDTUJO.js";
 
 // src/sdk/server/postgres-replay-store.ts
 var DEFAULT_TABLE_NAME = "signed_request_replays";

package/dist/{chunk-RCM3P2HE.js → chunk-UKD3R2KU.js}

@@ -1,7 +1,3 @@
-import {
-  canonicaliseForSigning
-} from "./chunk-OFVV37XC.js";
-
 // src/sdk/types.ts
 function isZodSchema(value) {
   return typeof value === "object" && value !== null && "_zod" in value && "parse" in value && "safeParse" in value;
@@ -16,6 +12,58 @@ var DEFAULT_CREDIT_MAX = "$5.00";
 var DEFAULT_CREDIT_TTL_SECONDS = 30 * 24 * 60 * 60;
 var DEFAULT_JOB_RETENTION_DAYS = 730;
 
+// src/lib/cast-auth/canonical-json.ts
+function canonicalize(value) {
+  return JSON.stringify(sortDeep(value));
+}
+function canonicaliseForSigning(value) {
+  return new TextEncoder().encode(canonicalize(value));
+}
+function sortDeep(value) {
+  if (value === null) return null;
+  if (typeof value === "string" || typeof value === "boolean") return value;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new TypeError(`canonicalize: non-finite number is not JSON-serialisable`);
+    }
+    return value;
+  }
+  if (Array.isArray(value)) return value.map(sortDeep);
+  if (typeof value === "object") {
+    const sorted = {};
+    for (const key of Object.keys(value).sort()) {
+      const v = value[key];
+      if (v === void 0) continue;
+      sorted[key] = sortDeep(v);
+    }
+    return sorted;
+  }
+  throw new TypeError(`canonicalize: unsupported value of type ${typeof value}`);
+}
+
+// src/lib/cast-auth/verify.ts
+import { schnorr } from "@noble/curves/secp256k1.js";
+function verifyCanonicalSignedRequest(payload, signatureHex, pubkeyHex) {
+  if (!/^[0-9a-f]{64}$/i.test(pubkeyHex) || !/^[0-9a-f]{128}$/i.test(signatureHex)) {
+    return false;
+  }
+  const data = canonicaliseForSigning(payload);
+  const signature = hexToBytes(signatureHex);
+  const pubkey = hexToBytes(pubkeyHex);
+  try {
+    return schnorr.verify(signature, data, pubkey);
+  } catch {
+    return false;
+  }
+}
+function hexToBytes(hex) {
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) {
+    out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return out;
+}
+
 // src/lib/signed-request-statement.ts
 var SIGNED_REQUEST_AUTH_ID = "secp256k1-schnorr-v2";
 var SIGNED_REQUEST_STATEMENT_VERSION = 2;
@@ -81,6 +129,9 @@ export {
   DEFAULT_CREDIT_MAX,
   DEFAULT_CREDIT_TTL_SECONDS,
   DEFAULT_JOB_RETENTION_DAYS,
+  canonicalize,
+  canonicaliseForSigning,
+  verifyCanonicalSignedRequest,
   SIGNED_REQUEST_AUTH_ID,
   SIGNED_REQUEST_STATEMENT_VERSION,
   signedRequestStatementHeader,

package/dist/chunk-WMGXJQI3.js

@@ -0,0 +1,120 @@
+import {
+  X402_DEFAULT_NETWORK,
+  resolveRpcHttpTransportOptions,
+  resolveRpcOverride
+} from "./chunk-62FI3NJF.js";
+import {
+  redactUrl,
+  redactUrlsInText
+} from "./chunk-FUJ36YDV.js";
+import {
+  DvmError,
+  x402NetworkByCaip2,
+  x402SupportedNetworksHint
+} from "./chunk-BPYMEMQX.js";
+
+// src/lib/x402/asset.ts
+function resolveX402Asset(network = X402_DEFAULT_NETWORK) {
+  const spec = x402NetworkByCaip2(network);
+  if (!spec) return null;
+  return {
+    address: spec.usdc,
+    symbol: "USDC",
+    // "native" is the load-bearing word: every contract in the table is
+    // Circle's own USDC, and the dollars that read as zero here are the
+    // bridged ones.
+    label: "native USDC",
+    unit: "USDC",
+    networkLabel: spec.label,
+    confusable: spec.confusable
+  };
+}
+
+// src/lib/evm-private-key.ts
+import { secp256k1 } from "@noble/curves/secp256k1.js";
+import { hexToBytes } from "@noble/hashes/utils.js";
+var EVM_PRIVATE_KEY_RE = /^0x[0-9a-fA-F]{64}$/;
+function isValidEvmPrivateKey(value) {
+  return EVM_PRIVATE_KEY_RE.test(value) && secp256k1.utils.isValidSecretKey(hexToBytes(value.slice(2)));
+}
+
+// src/lib/x402/wallet.ts
+async function ensureAddress(wallet) {
+  if (!isValidEvmPrivateKey(wallet.privateKey)) throw invalidX402PrivateKey();
+  if (wallet.address) return wallet;
+  const { privateKeyToAccount } = await import("viem/accounts");
+  const account = privateKeyToAccount(wallet.privateKey);
+  return { ...wallet, address: account.address };
+}
+async function generateX402PrivateKey() {
+  const { generatePrivateKey } = await import("viem/accounts");
+  return generatePrivateKey();
+}
+function invalidX402PrivateKey() {
+  return new DvmError(
+    "invalid_key",
+    "Invalid secp256k1 private key.",
+    "Reconnect with `dvm wallet x402-connect --key-file <path>`, set DVM_X402_KEY, or pipe a valid 0x-prefixed 32-byte secp256k1 private key through stdin."
+  );
+}
+async function getX402Balance(wallet) {
+  const w = await ensureAddress(wallet);
+  const spec = x402NetworkByCaip2(w.network);
+  if (!spec) {
+    throw new DvmError(
+      "x402_unsupported_network",
+      `The x402 wallet is configured for ${w.network}, a chain this rail can't settle on.`,
+      `${x402SupportedNetworksHint()} Re-pin the connected wallet without handling its key: 'dvm wallet x402-network ${X402_DEFAULT_NETWORK}'.`
+    );
+  }
+  const chains = await import("viem/chains");
+  const { createPublicClient, http, erc20Abi } = await import("viem");
+  const chain = chains[spec.viemChain];
+  const { url: rpcUrl, source: rpcSource } = resolveRpcOverride(
+    process.env.DVM_X402_RPC_URL,
+    chain?.rpcUrls.default.http[0]
+  );
+  try {
+    const transportOptions = resolveRpcHttpTransportOptions(
+      rpcSource,
+      process.env.DVM_X402_RPC_HEADERS_JSON
+    );
+    const client = createPublicClient({
+      chain,
+      transport: transportOptions ? http(rpcUrl, transportOptions) : http(rpcUrl)
+    });
+    const balance = await client.readContract({
+      address: spec.usdc,
+      abi: erc20Abi,
+      functionName: "balanceOf",
+      args: [w.address]
+    });
+    return {
+      address: w.address,
+      usdc: Number(balance) / 1e6,
+      network: w.network,
+      tokenAddress: spec.usdc,
+      // redacted here rather than at a display surface, so the clear
+      // endpoint never leaves this function on the success path either.
+      rpcUrlRedacted: rpcUrl ? redactUrl(rpcUrl) : void 0,
+      rpcSource
+    };
+  } catch (err) {
+    const cause = redactUrlsInText(err instanceof Error ? err.message : String(err));
+    throw new DvmError(
+      "x402_rpc_error",
+      `x402 USDC balance lookup on ${spec.label} failed: ${cause}`,
+      // A caller who set the override doesn't need to be told to set it. Which
+      // knob is theirs to turn depends on whose endpoint this was.
+      rpcSource === "override" ? `DVM_X402_RPC_URL sent this read to ${redactUrl(rpcUrl)}. Correct it, or unset it to fall back to ${spec.label}'s bundled endpoint.` : `Verify connectivity to ${spec.label}'s bundled endpoint${rpcUrl ? ` (${redactUrl(rpcUrl)})` : ""}, or send the read somewhere else with DVM_X402_RPC_URL.`
+    );
+  }
+}
+
+export {
+  resolveX402Asset,
+  isValidEvmPrivateKey,
+  ensureAddress,
+  generateX402PrivateKey,
+  getX402Balance
+};

package/dist/{chunk-N5RZ5HVB.js → chunk-X6S2CHFM.js}

@@ -4,10 +4,10 @@ import {
   signedRequestHeaderMatchesDomain,
   signedRequestStatementHeader,
   testOnlySignedRequestDomain
-} from "./chunk-RCM3P2HE.js";
+} from "./chunk-UKD3R2KU.js";
 import {
   diagnosticConsole
-} from "./chunk-ETXDTUJO.js";
+} from "./chunk-ZCNPIILZ.js";
 
 // src/sdk/server/zod-error.ts
 function humanizeZodError(err, opts) {