@dvmkit/sdk 0.7.0-rc.9 → 0.8.1

package/dist/{chunk-G7IXOVKV.js → chunk-JIZ4ZIXX.js}

@@ -7,10 +7,10 @@ import {
   installHostedTempoCloseGuard,
   isTempoInsufficientFundsError,
   resolveTempoNetwork
-} from "./chunk-QN3CQOE2.js";
+} from "./chunk-QKE5NDPF.js";
 import {
   x402EarnedCeiling
-} from "./chunk-YNHXOONR.js";
+} from "./chunk-J5J63WDC.js";
 import {
   createX402FacilitatorAuthHeaders,
   createX402FacilitatorClient,
@@ -19,13 +19,13 @@ import {
   verifyWithFacilitator,
   withPaymentDiagnostics,
   withPaymentStage
-} from "./chunk-FYETJDBB.js";
+} from "./chunk-AVV5SYGO.js";
 import {
   MemoryCreditLedger
-} from "./chunk-YE53E4BT.js";
+} from "./chunk-AGE5XZKE.js";
 import {
   PostgresJobStore
-} from "./chunk-6JZDFYQL.js";
+} from "./chunk-G3MPHW5I.js";
 import {
   parseStoreValue
 } from "./chunk-YG7G4DPZ.js";
@@ -36,7 +36,7 @@ import {
   humanizeZodIssues,
   signedRequestInput,
   zodIssuesOf
-} from "./chunk-YS6PWVCZ.js";
+} from "./chunk-ILBSZMJL.js";
 import {
   MemoryJobStore,
   UNCAPPABLE_ASK_TOTAL,
@@ -45,7 +45,7 @@ import {
   isJobRetentionStore,
   isReceiptIssuingStore,
   isStreamableJobStore
-} from "./chunk-2HAFZ5GC.js";
+} from "./chunk-IHQUBATH.js";
 import {
   ContentHoldError,
   JobCancelledError,
@@ -85,7 +85,7 @@ import {
   signReceipt,
   toLockPubkey,
   verifyChallenge
-} from "./chunk-5TIFEMHJ.js";
+} from "./chunk-ZEPJF4JC.js";
 import {
   X402_BATCH_SETTLEMENT_SCHEME,
   X402_DEFAULT_FACILITATOR,
@@ -112,12 +112,14 @@ import {
   isZodSchema
 } from "./chunk-UKD3R2KU.js";
 import {
-  createConsoleLogger,
+  createConsoleLogger
+} from "./chunk-OP7VCGQR.js";
+import {
   loggers,
   pinDimension,
   withSpan,
   withTraceContext
-} from "./chunk-RGSWVNQG.js";
+} from "./chunk-IOQIXRGM.js";
 import {
   StepCache
 } from "./chunk-BQJIFRAZ.js";
@@ -134,7 +136,7 @@ import {
   roundUsd,
   satsToFiat,
   validateCurrency
-} from "./chunk-5CSR33B5.js";
+} from "./chunk-2U6LAASN.js";
 import {
   CreditLedger,
   CreditLedgerError,
@@ -150,10 +152,10 @@ import {
   isNonChannelBitcoinRail,
   netOwedSats,
   x402SettlementPending
-} from "./chunk-IOKEKMIU.js";
+} from "./chunk-FM6QAGJC.js";
 import {
   withPostgresRecoveryContext
-} from "./chunk-QM2OS3NJ.js";
+} from "./chunk-7PM4R4GD.js";
 import {
   DvmError,
   x402NetworkByCaip2
@@ -161,7 +163,7 @@ import {
 import {
   createDiagnosticCapabilityAuthority,
   diagnosticConsole
-} from "./chunk-5PLQOC4B.js";
+} from "./chunk-BFGQG4WY.js";
 import {
   MemoryProcessedPaymentStore,
   PostgresProcessedPaymentStore,
@@ -3118,6 +3120,10 @@ function decodeBatchPayment(header) {
   if (!isBatchSettlementDepositPayload2(parsed.payload) && !isBatchSettlementVoucherPayload(parsed.payload) && !isBatchSettlementRefundPayload2(parsed.payload)) {
     throw new Error("invalid batch-settlement payload");
   }
+  const voucher = parsed.payload.voucher;
+  if (typeof voucher.channelId !== "string" || typeof voucher.maxClaimableAmount !== "string" || typeof voucher.signature !== "string") {
+    throw new Error("invalid batch-settlement voucher");
+  }
   return parsed;
 }
 function batchVoucher(payload) {
@@ -3877,7 +3883,7 @@ async function verifyUpfrontPaymentInScope(opts) {
           x402Requirements
         });
       }
-      const { verifyX402Payment } = await import("./x402-T7WVKDD4.js");
+      const { verifyX402Payment } = await import("./x402-HQ5GRQZU.js");
       const receipt = await withPaymentStage("verifier_broadcast", () => verifyX402Payment(
         x402Payment,
         x402Config,
@@ -4040,6 +4046,30 @@ async function verifyUpfrontPaymentInScope(opts) {
       }
       const expectedAmount = opts.priceFiat?.currency === "usd" ? fiatMicroToMethodAmount(opts.priceFiat.amountMicro, cred.challenge.method) : msatsToMethodAmount(requiredMsats, cred.challenge.method, rate);
       const sessionBasis = mppSessionBasis(cred);
+      const replayRealm = mpp.realm ?? cred.challenge.realm;
+      if (consumedCredentialStore && await withPaymentStage("replay_store", () => consumedCredentialStore.has(replayRealm, cred.challenge.id))) {
+        const mppChallenges = await issueUpfrontChallenges(
+          mpp,
+          requiredMsats,
+          resourcePath ?? "/v1/job",
+          rate,
+          sessionIssuable,
+          opts.fundOnly?.allowOneShotStablecoin,
+          opts.priceFiat
+        );
+        return {
+          paidMsats: 0,
+          receivedProofs: [],
+          error: {
+            body: paymentErrorBody("payment_invalid", {
+              message: "MPP credential already used"
+            }),
+            status: 402,
+            mppChallenges,
+            ...x402Requirements && { x402Requirements }
+          }
+        };
+      }
       let tempoReceipt;
       const broadcast = async () => {
         const receipt = await loggers.tempo.span(
@@ -4157,35 +4187,12 @@ async function verifyUpfrontPaymentInScope(opts) {
           }
         };
       }
-      if (consumedCredentialStore) {
-        const realm = mpp.realm;
-        const id = cred.challenge.id;
-        if (await withPaymentStage("replay_store", () => consumedCredentialStore.has(realm, id))) {
-          const mppChallenges = await issueUpfrontChallenges(
-            mpp,
-            requiredMsats,
-            resourcePath ?? "/v1/job",
-            rate,
-            sessionIssuable,
-            opts.fundOnly?.allowOneShotStablecoin,
-            opts.priceFiat
-          );
-          return {
-            paidMsats: 0,
-            receivedProofs: [],
-            error: {
-              body: paymentErrorBody("payment_invalid", {
-                message: "MPP credential already used"
-              }),
-              status: 402,
-              mppChallenges,
-              ...x402Requirements && { x402Requirements }
-            }
-          };
-        }
-        if (!sessionBasis) {
-          await withPaymentStage("replay_store", () => consumedCredentialStore.mark(realm, id, CONSUMED_CREDENTIAL_TTL_MS / 1e3));
-        }
+      if (consumedCredentialStore && !sessionBasis) {
+        await withPaymentStage("replay_store", () => consumedCredentialStore.mark(
+          replayRealm,
+          cred.challenge.id,
+          CONSUMED_CREDENTIAL_TTL_MS / 1e3
+        ));
       }
       if (ledgerCtx) {
         try {
@@ -4208,10 +4215,18 @@ async function verifyUpfrontPaymentInScope(opts) {
       }
       if (sessionBasis && consumedCredentialStore) {
         await withPaymentStage("replay_store", () => consumedCredentialStore.mark(
-          mpp.realm,
+          replayRealm,
           cred.challenge.id,
           CONSUMED_CREDENTIAL_TTL_MS / 1e3
-        ));
+        )).catch((error) => {
+          diagnosticConsole.warn({
+            level: "warn",
+            event: "tempo_replay_mark_failed",
+            phase: "upfront",
+            rail: "tempo",
+            ...paymentFailureFields(error)
+          });
+        });
       }
       if (credited) {
         await mpp.completeHostedTempoCharge?.(cred.challenge.id).catch((error) => {
@@ -4420,6 +4435,22 @@ async function verifyTempoSessionManagementCredential(args) {
       throw new Error("Hosted Tempo close requires non-mutating credential validation");
     }
     await args.mpp.validateCredential(credential, verifyOptions);
+    if (args.action === "close") {
+      if (!args.mpp.assertTempoSessionCloseVoucher) {
+        throw new Error("Hosted Tempo close requires stored-channel voucher validation");
+      }
+      const { cumulativeAmount, signature } = credential.payload;
+      if (typeof cumulativeAmount !== "string" || typeof signature !== "string") {
+        throw new Error("Expected a Tempo session close voucher");
+      }
+      await args.mpp.assertTempoSessionCloseVoucher({
+        channelId: payload.channelId,
+        cumulativeAmount: BigInt(cumulativeAmount),
+        signature,
+        descriptor: credential.payload.descriptor,
+        request: credential.challenge.request
+      });
+    }
   }
   await args.onBound?.();
   const receipt = await args.mpp.broadcastCredential(credential, verifyOptions);
@@ -4865,7 +4896,7 @@ async function verifyIncomingPaymentInScope(body, opts, snapshot) {
           snapshot
         });
       }
-      const { verifyX402Payment } = await import("./x402-T7WVKDD4.js");
+      const { verifyX402Payment } = await import("./x402-HQ5GRQZU.js");
       const receipt = await withPaymentStage("verifier_broadcast", () => verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -5296,7 +5327,7 @@ async function processIncomingPaymentInScope(job, body, opts) {
     try {
       const requiredMsats = job.pendingPaymentMsats ?? 0;
       const requiredUsdcMicro = job.pendingX402AmountUsdcMicro !== void 0 ? BigInt(job.pendingX402AmountUsdcMicro) : BigInt(msatsToUsdc(requiredMsats, rate));
-      const { verifyX402Payment } = await import("./x402-T7WVKDD4.js");
+      const { verifyX402Payment } = await import("./x402-HQ5GRQZU.js");
       const receipt = await withPaymentStage("verifier_broadcast", () => verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -7456,17 +7487,16 @@ async function completeTempoDrain(c, deps, record, expectedChannelId, credit) {
         await beginClose(expectedChannelId, record.drainId);
         recoveryVersion = await deps.tempoSettlementReadiness?.captureRecoveryVersion();
         if (deps.hostedSettlementReports) {
-          const reserved = await deps.hostedSettlementReports.reserveTempo(
-            expectedChannelId,
-            "close",
-            record.drainId
+          hostedObligationId = await reserveHostedTempoClose(
+            deps.hostedSettlementReports,
+            rail.mpp,
+            record,
+            expectedChannelId
           );
-          if (reserved.replayed) throw new Error("Hosted Tempo close already has an original effect attempt");
-          hostedObligationId = reserved.id;
           if (!rail.mpp?.permitHostedTempoClose) {
             throw new Error("Hosted Tempo close credential guard is unavailable");
           }
-          rail.mpp.permitHostedTempoClose(rail.mppCredential, reserved.id);
+          rail.mpp.permitHostedTempoClose(rail.mppCredential, hostedObligationId);
         }
       }
     });
@@ -7491,6 +7521,14 @@ async function completeTempoDrain(c, deps, record, expectedChannelId, credit) {
     }
     const wrongChannel = tempoWrongChannelRefusal(error, record);
     if (wrongChannel) return wrongChannel;
+    if (error instanceof HostedTempoCloseAttemptsExhaustedError) {
+      return jsonPaymentError("tempo_channel_exit_required", 409, {
+        message: `Tempo drain ${record.drainId} reached its limit of cooperative close attempts that never reached the chain.`,
+        display: "The service could not complete a cooperative close of this stablecoin channel after several attempts. Your funds stay in the channel; use the timed on-chain exit to recover them.",
+        hint: "Start the channel's timed on-chain exit. Retrying this drain with another close credential is refused.",
+        extra: { drain_registered: true, drain_id: record.drainId, channel_id: expectedChannelId }
+      });
+    }
     const refused = tempoFloorRefusal(error, record);
     if (refused) return refused;
     if (tempoCloseCredentialNeedsRefresh(error)) {
@@ -7537,6 +7575,49 @@ async function completeTempoDrain(c, deps, record, expectedChannelId, credit) {
     });
   }
 }
+var HOSTED_TEMPO_CLOSE_STALE_MS = 3e5;
+var HOSTED_TEMPO_CLOSE_MAX_RELEASES = 3;
+var HOSTED_TEMPO_CLOSE_IN_FLIGHT = "Hosted Tempo close already has an original effect attempt";
+var HostedTempoCloseAttemptsExhaustedError = class extends Error {
+};
+async function reserveHostedTempoClose(reports, mpp, record, channelId) {
+  const pending = await reports.pendingTempoClose(channelId, record.drainId);
+  if (!pending) {
+    const reserved = await reports.reserveTempo(channelId, "close", record.drainId);
+    if (reserved.replayed) throw new Error(HOSTED_TEMPO_CLOSE_IN_FLIGHT);
+    return reserved.id;
+  }
+  if (pending.txHash || !mpp.getTempoSessionDrainState) throw new Error(HOSTED_TEMPO_CLOSE_IN_FLIGHT);
+  const state = await mpp.getTempoSessionDrainState(channelId);
+  if (state.finalized || state.deposit === 0n || state.closeRequestedAt !== 0n) {
+    throw new Error(HOSTED_TEMPO_CLOSE_IN_FLIGHT);
+  }
+  const result = await reports.releaseStaleTempoClose(pending.id, channelId, record.drainId, {
+    staleAfterMs: HOSTED_TEMPO_CLOSE_STALE_MS,
+    maxReleases: HOSTED_TEMPO_CLOSE_MAX_RELEASES
+  });
+  if (result.outcome === "in_flight") throw new Error(HOSTED_TEMPO_CLOSE_IN_FLIGHT);
+  if (result.outcome === "exhausted") {
+    loggers.tempo.warn("tempo_session_close_attempts_exhausted", {
+      credit_id: record.creditId,
+      drain_id: record.drainId,
+      channel_id: channelId,
+      obligation_id: pending.id,
+      attempt: result.releases + 1
+    });
+    throw new HostedTempoCloseAttemptsExhaustedError(
+      `Tempo drain ${record.drainId} exhausted its cooperative close attempts`
+    );
+  }
+  loggers.tempo.warn("tempo_session_close_reservation_released", {
+    credit_id: record.creditId,
+    drain_id: record.drainId,
+    channel_id: channelId,
+    obligation_id: pending.id,
+    attempt: result.releases + 1
+  });
+  return result.id;
+}
 function tempoCloseCredentialNeedsRefresh(error) {
   return error instanceof MppxErrors.InvalidChallengeError || error instanceof MppxErrors.PaymentExpiredError;
 }
@@ -9900,6 +9981,8 @@ var HostedSettlementReportObligations = class {
           created_at_ms BIGINT NOT NULL DEFAULT FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint,
           updated_at_ms BIGINT NOT NULL DEFAULT FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint
         );
+        ALTER TABLE sdk_hosted_settlement_report_obligations
+          ADD COLUMN IF NOT EXISTS close_search_before BIGINT;
         CREATE INDEX IF NOT EXISTS sdk_hosted_settlement_report_pending
           ON sdk_hosted_settlement_report_obligations (dvm_id,scope,state)
           WHERE state NOT IN ('delivered','no_report');
@@ -10006,53 +10089,109 @@ var HostedSettlementReportObligations = class {
     });
   }
   async reserveTempo(channelId, operation, drainId) {
-    const config = this.tempo;
-    if (!config || !hex(channelId, 32)) throw new Error("Hosted Tempo settlement configuration is unavailable");
+    return transaction(this.pool, (tx) => this.reserveTempoIn(tx, channelId, operation, drainId));
+  }
+  /**
+   * Retire a close reservation that never recorded a transaction and reserve
+   * the drain's next attempt, in one transaction, so the drain always keeps one
+   * outstanding close obligation. A close from the retired attempt that lands
+   * late is a close of the same channel: `recordSubmitted` on the retired row
+   * writes it onto the successor, and recovery attaches it there if that
+   * attempt never got to write, so it is reported once.
+   *
+   * The caller has just read the channel open on chain. The age bound only
+   * spares a reservation young enough to be inside its first receipt wait; an
+   * attempt slowed past it by a degraded RPC can still be running.
+   */
+  async releaseStaleTempoClose(id, channelId, drainId, limits) {
     return transaction(this.pool, async (tx) => {
-      const state = await tx.query(
-        "SELECT state_json FROM mpp_tempo_channels WHERE channel_key=$1",
-        [channelId.toLowerCase()]
+      await this.lockIdentity(tx);
+      const row = await this.lockRow(tx, id);
+      if (row.rail !== "tempo" || row.operation !== "close" || row.channel_id !== channelId.toLowerCase() || row.original.drainId !== drainId || row.state !== "reserved" || row.tx_hash) {
+        return { outcome: "in_flight" };
+      }
+      const age = await tx.query(
+        `SELECT updated_at_ms <= FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint - $2 AS stale
+         FROM sdk_hosted_settlement_report_obligations WHERE id=$1`,
+        [id, limits.staleAfterMs]
       );
-      if (!state.rows[0]) throw new Error("Hosted Tempo channel is not durable");
-      const identity = await this.lockIdentity(tx);
-      const parsed = parseStoreValue(state.rows[0].state_json);
-      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("Hosted Tempo state is invalid");
-      const row = parsed;
-      if (row.chainId !== Number(config.network.split(":")[1]) || String(row.escrowContract).toLowerCase() !== config.escrow.toLowerCase() || String(row.payee).toLowerCase() !== config.payee.toLowerCase() || String(row.token).toLowerCase() !== config.token.toLowerCase()) {
-        throw new Error("Hosted Tempo channel has another chain or recipient");
-      }
-      if (operation === "close") {
-        if (!drainId) throw new Error("Hosted Tempo close requires the original drain");
-        const close = await tx.query(
-          "SELECT drain_id FROM mpp_tempo_close_intents WHERE channel_id=$1",
-          [channelId.toLowerCase()]
-        );
-        if (close.rows[0]?.drain_id !== drainId) throw new Error("Hosted Tempo close has no matching drain");
-      }
-      const highestVoucherAmount = nativeAmount(row.highestVoucherAmount);
-      const settledOnChain = nativeAmount(row.settledOnChain);
-      const spent = nativeAmount(row.spent);
-      if (BigInt(settledOnChain) > BigInt(highestVoucherAmount) || BigInt(spent) > BigInt(highestVoucherAmount)) {
-        throw new Error("Hosted Tempo settlement source has inconsistent amounts");
-      }
-      const original = operation === "settle" ? {
-        highestVoucherAmount,
-        settledOnChain,
-        spent
-      } : { drainId, highestVoucherAmount, settledOnChain, spent };
-      return this.insert(
-        tx,
-        identity,
-        "tempo",
-        operation,
-        config.network,
-        config.escrow,
-        channelId.toLowerCase(),
-        original,
-        operation === "close" ? [drainId] : [highestVoucherAmount]
+      if (!age.rows[0]?.stale) return { outcome: "in_flight" };
+      const released = Number((await tx.query(
+        `SELECT COUNT(*)::text AS n FROM sdk_hosted_settlement_report_obligations
+         WHERE dvm_id=$1 AND scope=$2 AND rail='tempo' AND operation='close' AND channel_id=$3
+           AND original->>'drainId'=$4 AND state='no_report' AND tx_hash IS NULL`,
+        [this.dvmId, this.scope, channelId.toLowerCase(), drainId]
+      )).rows[0].n);
+      if (released >= limits.maxReleases) return { outcome: "exhausted", releases: released };
+      await tx.query(
+        `UPDATE sdk_hosted_settlement_report_obligations SET state='no_report',
+           updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint WHERE id=$1`,
+        [id]
       );
+      const next = await this.reserveTempoIn(tx, channelId, "close", drainId);
+      return { outcome: "reserved", id: next.id, releases: released + 1 };
     });
   }
+  /**
+   * Resolve an unsubmitted close reservation whose channel the payer exited
+   * on its own: no cooperative close of ours can land on a finalized channel.
+   */
+  async resolveTempoCloseExit(id) {
+    const result = await this.pool.query(
+      `UPDATE sdk_hosted_settlement_report_obligations SET state='no_report',
+         updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint
+       WHERE id=$1 AND dvm_id=$2 AND scope=$3 AND rail='tempo' AND operation='close'
+         AND state='reserved' AND tx_hash IS NULL`,
+      [id, this.dvmId, this.scope]
+    );
+    return result.rowCount === 1;
+  }
+  async reserveTempoIn(tx, channelId, operation, drainId) {
+    const config = this.tempo;
+    if (!config || !hex(channelId, 32)) throw new Error("Hosted Tempo settlement configuration is unavailable");
+    const state = await tx.query(
+      "SELECT state_json FROM mpp_tempo_channels WHERE channel_key=$1",
+      [channelId.toLowerCase()]
+    );
+    if (!state.rows[0]) throw new Error("Hosted Tempo channel is not durable");
+    const identity = await this.lockIdentity(tx);
+    const parsed = parseStoreValue(state.rows[0].state_json);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("Hosted Tempo state is invalid");
+    const row = parsed;
+    if (row.chainId !== Number(config.network.split(":")[1]) || String(row.escrowContract).toLowerCase() !== config.escrow.toLowerCase() || String(row.payee).toLowerCase() !== config.payee.toLowerCase() || String(row.token).toLowerCase() !== config.token.toLowerCase()) {
+      throw new Error("Hosted Tempo channel has another chain or recipient");
+    }
+    if (operation === "close") {
+      if (!drainId) throw new Error("Hosted Tempo close requires the original drain");
+      const close = await tx.query(
+        "SELECT drain_id FROM mpp_tempo_close_intents WHERE channel_id=$1",
+        [channelId.toLowerCase()]
+      );
+      if (close.rows[0]?.drain_id !== drainId) throw new Error("Hosted Tempo close has no matching drain");
+    }
+    const highestVoucherAmount = nativeAmount(row.highestVoucherAmount);
+    const settledOnChain = nativeAmount(row.settledOnChain);
+    const spent = nativeAmount(row.spent);
+    if (BigInt(settledOnChain) > BigInt(highestVoucherAmount) || BigInt(spent) > BigInt(highestVoucherAmount)) {
+      throw new Error("Hosted Tempo settlement source has inconsistent amounts");
+    }
+    const original = operation === "settle" ? {
+      highestVoucherAmount,
+      settledOnChain,
+      spent
+    } : { drainId, highestVoucherAmount, settledOnChain, spent };
+    return this.insert(
+      tx,
+      identity,
+      "tempo",
+      operation,
+      config.network,
+      config.escrow,
+      channelId.toLowerCase(),
+      original,
+      operation === "close" ? [drainId] : [highestVoucherAmount]
+    );
+  }
   async findPendingTempo(channelId, operation) {
     const result = await this.pool.query(
       `SELECT * FROM sdk_hosted_settlement_report_obligations
@@ -10062,6 +10201,36 @@ var HostedSettlementReportObligations = class {
     );
     return result.rows[0];
   }
+  /** The original close obligation reserved for this drain, while its report is outstanding. */
+  async pendingTempoClose(channelId, drainId) {
+    const result = await this.pool.query(
+      `SELECT id,tx_hash,created_at_ms,close_search_before FROM sdk_hosted_settlement_report_obligations
+       WHERE dvm_id=$1 AND scope=$2 AND rail='tempo' AND operation='close' AND channel_id=$3
+         AND original->>'drainId'=$4 AND state NOT IN ('delivered','no_report')
+       ORDER BY created_at_ms DESC LIMIT 1`,
+      [this.dvmId, this.scope, channelId.toLowerCase(), drainId]
+    );
+    const row = result.rows[0];
+    return row && {
+      id: row.id,
+      txHash: row.tx_hash,
+      reservedAtMs: Number(row.created_at_ms),
+      searchBefore: searchCursor(row.close_search_before)
+    };
+  }
+  /**
+   * Where the next search for this close obligation's transaction resumes. It
+   * lives on the obligation, not the drain's close intent, because releasing
+   * the drain deletes the intent while the obligation still needs the search.
+   */
+  async recordTempoCloseSearch(id, resumeAt) {
+    await this.pool.query(
+      `UPDATE sdk_hosted_settlement_report_obligations
+          SET close_search_before = LEAST(COALESCE(close_search_before, $4), $4)
+        WHERE id=$1 AND dvm_id=$2 AND scope=$3 AND rail='tempo' AND operation='close'`,
+      [id, this.dvmId, this.scope, resumeAt.toString()]
+    );
+  }
   async submittedIds(rail, operation, txHash, batchId) {
     if (!hex(txHash, 32)) throw new Error("Hosted effect has no exact transaction hash");
     const result = await this.pool.query(
@@ -10168,17 +10337,67 @@ var HostedSettlementReportObligations = class {
     if (!hex(txHash, 32)) throw new Error("Hosted settlement has no transaction hash");
     const write = this.x402SettlementStore ? this.x402Transaction.bind(this) : (operation) => transaction(this.pool, operation);
     await write(async (tx) => {
-      const row = await this.lockRow(tx, id);
+      let row = await this.lockRow(tx, id);
+      if (row.state === "no_report" && !row.tx_hash) {
+        row = await this.successorOfRetiredClose(tx, row);
+      }
       if (row.tx_hash && row.tx_hash.toLowerCase() !== txHash.toLowerCase()) {
         throw new Error("Hosted settlement transaction replay conflicts");
       }
       await tx.query(
         `UPDATE sdk_hosted_settlement_report_obligations SET tx_hash=COALESCE(tx_hash,$2),
            updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint WHERE id=$1`,
-        [id, txHash.toLowerCase()]
+        [row.id, txHash.toLowerCase()]
       );
     });
   }
+  /**
+   * Close reservations that never recorded a transaction, oldest first. Each
+   * one owes a payout report only if its close lands, so it stays unresolved
+   * until a reconcile reads how its channel finalized.
+   */
+  async unsubmittedTempoCloses(limit = 100) {
+    const result = await this.pool.query(
+      `SELECT id,channel_id,original->>'drainId' AS drain_id,created_at_ms,close_search_before
+         FROM sdk_hosted_settlement_report_obligations
+        WHERE dvm_id=$1 AND scope=$2 AND rail='tempo' AND operation='close'
+          AND state='reserved' AND tx_hash IS NULL
+        ORDER BY created_at_ms,id LIMIT $3`,
+      [this.dvmId, this.scope, limit]
+    );
+    return result.rows.flatMap((row) => row.drain_id === null ? [] : [{
+      id: row.id,
+      channelId: row.channel_id,
+      drainId: row.drain_id,
+      reservedAtMs: Number(row.created_at_ms),
+      searchBefore: searchCursor(row.close_search_before)
+    }]);
+  }
+  /**
+   * A retired close reservation's attempt can still be running when its
+   * successor is reserved, and its close can land. The close is the same
+   * channel's, so it belongs to the drain's outstanding obligation; writing it
+   * onto the retired row would leave that obligation without a transaction and
+   * the payout unreported.
+   */
+  async successorOfRetiredClose(tx, retired) {
+    const drainId = retired.original.drainId;
+    if (retired.rail !== "tempo" || retired.operation !== "close" || typeof drainId !== "string") {
+      throw new Error("Hosted settlement obligation was resolved without a transaction");
+    }
+    const successor = await tx.query(
+      `SELECT id FROM sdk_hosted_settlement_report_obligations
+        WHERE dvm_id=$1 AND scope=$2 AND rail='tempo' AND operation='close' AND channel_id=$3
+          AND original->>'drainId'=$4 AND state NOT IN ('delivered','no_report')
+        ORDER BY created_at_ms DESC LIMIT 1`,
+      [this.dvmId, this.scope, retired.channel_id, drainId]
+    );
+    if (!successor.rows[0]) {
+      throw new Error("Hosted Tempo close was retired and the drain has no outstanding obligation");
+    }
+    const locked = await this.lockRow(tx, successor.rows[0].id);
+    return locked.state === "no_report" && !locked.tx_hash ? this.successorOfRetiredClose(tx, locked) : locked;
+  }
   async recoveryCandidates() {
     const result = await this.pool.query(
       `SELECT * FROM sdk_hosted_settlement_report_obligations
@@ -10201,6 +10420,10 @@ var HostedSettlementReportObligations = class {
     }));
   }
   async recoverOriginalX402Refunds() {
+    const table = await this.pool.query(
+      "SELECT to_regclass('x402_batch_settlements') IS NOT NULL AS present"
+    );
+    if (!table.rows[0]?.present) return [];
     const rows2 = await this.pool.query(
       `SELECT obligation.id,settlement.settle_response AS response
        FROM sdk_hosted_settlement_report_obligations obligation
@@ -10636,6 +10859,9 @@ var HostedSettlementReportObligations = class {
     return { id: row.id, replayed: true };
   }
 };
+function searchCursor(value) {
+  return value === null ? null : BigInt(value);
+}
 
 // src/sdk/server/hosting-channel-evidence.ts
 import { createHash as createHash7 } from "crypto";
@@ -19537,7 +19763,7 @@ async function createDVMServer(descriptor, opts) {
       }
     }
     if (!opts.onJobCompleted && platformToken && platformUrl && dvmId && opts.db) {
-      const { RevenueReporter } = await import("./revenue-reporter-NRS2FANA.js");
+      const { RevenueReporter } = await import("./revenue-reporter-KDUZLD5F.js");
       const reporter = new RevenueReporter(
         opts.db,
         platformUrl,
@@ -19547,7 +19773,7 @@ async function createDVMServer(descriptor, opts) {
       revenueReporter = reporter;
       await reporter.init();
       reporter.startRetryLoop();
-      const { MemoryX402BatchStore, PayoutReporter } = await import("./payout-reporter-W3CCLYCN.js");
+      const { MemoryX402BatchStore, PayoutReporter } = await import("./payout-reporter-NN6K2IVQ.js");
       payoutReporter = new PayoutReporter({
         dvmId,
         db: opts.db,
@@ -20004,6 +20230,9 @@ var DVMServer = class {
     if (!certificateOnly && await control.close(command, support) === "conflict") {
       return c.json({ error: "hosting_closure_conflict" }, 409);
     }
+    await this.opts.mpp?.reconcileTempoSessionCloses?.().catch(() => {
+      diagnosticConsole.warn({ level: "tempo_routine_sweep_failed", dvm_id: this.opts.dvmId, error: void 0 });
+    });
     const evidence = await control.certificate({ ...command, action: "certificate" }, support);
     if (!evidence) return c.json({ error: "hosting_closure_stale" }, 409);
     return c.json(evidence);
@@ -20905,7 +21134,7 @@ var DVMServer = class {
         // sees only the shortened list cannot tell a DVM that never did
         // sessions from one whose observer is down for a minute.
         ...withheld.length && { withheld },
-        realm: this.opts.mpp.realm,
+        ...this.opts.mpp.realm && { realm: this.opts.mpp.realm },
         ...this.opts.mpp.tempoConfiguration && {
           recipient: this.opts.mpp.tempoConfiguration.recipient,
           payment_token: this.opts.mpp.tempoConfiguration.paymentToken,

package/dist/{chunk-ZLWPEIE2.js → chunk-NA2KOR6G.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-YG7G4DPZ.js";
 import {
   diagnosticConsole
-} from "./chunk-5PLQOC4B.js";
+} from "./chunk-BFGQG4WY.js";
 import {
   withSdkInitLock
 } from "./chunk-COYKJRMM.js";