@dvmkit/sdk 0.8.1 → 0.9.0

package/dist/{chunk-JIZ4ZIXX.js → chunk-73C4JN2E.js}

@@ -1,16 +1,11 @@
 import {
-  TEMPO_MODERATO_CHAIN_ID,
-  TEMPO_MODERATO_RPC,
-  advertisedMethods,
-  challengeMeta,
-  installHostedTempoChargeGuard,
-  installHostedTempoCloseGuard,
-  isTempoInsufficientFundsError,
-  resolveTempoNetwork
-} from "./chunk-QKE5NDPF.js";
+  MemoryProcessedPaymentStore,
+  PostgresProcessedPaymentStore,
+  ProcessedPaymentReplayError
+} from "./chunk-XRLKGCAW.js";
 import {
   x402EarnedCeiling
-} from "./chunk-J5J63WDC.js";
+} from "./chunk-K2MSIKMM.js";
 import {
   createX402FacilitatorAuthHeaders,
   createX402FacilitatorClient,
@@ -19,13 +14,13 @@ import {
   verifyWithFacilitator,
   withPaymentDiagnostics,
   withPaymentStage
-} from "./chunk-AVV5SYGO.js";
+} from "./chunk-GAZBBMAA.js";
 import {
   MemoryCreditLedger
-} from "./chunk-AGE5XZKE.js";
+} from "./chunk-ZBQKXAYK.js";
 import {
   PostgresJobStore
-} from "./chunk-G3MPHW5I.js";
+} from "./chunk-GODOH2AF.js";
 import {
   parseStoreValue
 } from "./chunk-YG7G4DPZ.js";
@@ -36,7 +31,7 @@ import {
   humanizeZodIssues,
   signedRequestInput,
   zodIssuesOf
-} from "./chunk-ILBSZMJL.js";
+} from "./chunk-4VV7WACY.js";
 import {
   MemoryJobStore,
   UNCAPPABLE_ASK_TOTAL,
@@ -45,7 +40,7 @@ import {
   isJobRetentionStore,
   isReceiptIssuingStore,
   isStreamableJobStore
-} from "./chunk-IHQUBATH.js";
+} from "./chunk-TFDR2YP2.js";
 import {
   ContentHoldError,
   JobCancelledError,
@@ -85,7 +80,7 @@ import {
   signReceipt,
   toLockPubkey,
   verifyChallenge
-} from "./chunk-ZEPJF4JC.js";
+} from "./chunk-LW7KZQHG.js";
 import {
   X402_BATCH_SETTLEMENT_SCHEME,
   X402_DEFAULT_FACILITATOR,
@@ -113,13 +108,7 @@ import {
 } from "./chunk-UKD3R2KU.js";
 import {
   createConsoleLogger
-} from "./chunk-OP7VCGQR.js";
-import {
-  loggers,
-  pinDimension,
-  withSpan,
-  withTraceContext
-} from "./chunk-IOQIXRGM.js";
+} from "./chunk-TRY7BJA4.js";
 import {
   StepCache
 } from "./chunk-BQJIFRAZ.js";
@@ -136,7 +125,7 @@ import {
   roundUsd,
   satsToFiat,
   validateCurrency
-} from "./chunk-2U6LAASN.js";
+} from "./chunk-HC4I7LAV.js";
 import {
   CreditLedger,
   CreditLedgerError,
@@ -152,26 +141,38 @@ import {
   isNonChannelBitcoinRail,
   netOwedSats,
   x402SettlementPending
-} from "./chunk-FM6QAGJC.js";
+} from "./chunk-YYRY32NR.js";
+import {
+  withSdkInitLock
+} from "./chunk-COYKJRMM.js";
 import {
   withPostgresRecoveryContext
-} from "./chunk-7PM4R4GD.js";
+} from "./chunk-IBX2ORBV.js";
 import {
   DvmError,
   x402NetworkByCaip2
 } from "./chunk-BPYMEMQX.js";
 import {
-  createDiagnosticCapabilityAuthority,
-  diagnosticConsole
-} from "./chunk-BFGQG4WY.js";
+  TEMPO_MODERATO_CHAIN_ID,
+  TEMPO_MODERATO_RPC,
+  TempoCloseDescriptorError,
+  advertisedMethods,
+  challengeMeta,
+  installHostedTempoChargeGuard,
+  installHostedTempoCloseGuard,
+  isTempoInsufficientFundsError,
+  resolveTempoNetwork
+} from "./chunk-LFVIZH2G.js";
 import {
-  MemoryProcessedPaymentStore,
-  PostgresProcessedPaymentStore,
-  ProcessedPaymentReplayError
-} from "./chunk-XRLKGCAW.js";
+  loggers,
+  pinDimension,
+  withSpan,
+  withTraceContext
+} from "./chunk-QSZW2I5Y.js";
 import {
-  withSdkInitLock
-} from "./chunk-COYKJRMM.js";
+  createDiagnosticCapabilityAuthority,
+  diagnosticConsole
+} from "./chunk-OIP44KBB.js";
 
 // src/sdk/server/lock-pubkey-store.ts
 async function initLockPubkeyTable(db) {
@@ -3883,7 +3884,7 @@ async function verifyUpfrontPaymentInScope(opts) {
           x402Requirements
         });
       }
-      const { verifyX402Payment } = await import("./x402-HQ5GRQZU.js");
+      const { verifyX402Payment } = await import("./x402-SL36LSOD.js");
       const receipt = await withPaymentStage("verifier_broadcast", () => verifyX402Payment(
         x402Payment,
         x402Config,
@@ -4896,7 +4897,7 @@ async function verifyIncomingPaymentInScope(body, opts, snapshot) {
           snapshot
         });
       }
-      const { verifyX402Payment } = await import("./x402-HQ5GRQZU.js");
+      const { verifyX402Payment } = await import("./x402-SL36LSOD.js");
       const receipt = await withPaymentStage("verifier_broadcast", () => verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -5327,7 +5328,7 @@ async function processIncomingPaymentInScope(job, body, opts) {
     try {
       const requiredMsats = job.pendingPaymentMsats ?? 0;
       const requiredUsdcMicro = job.pendingX402AmountUsdcMicro !== void 0 ? BigInt(job.pendingX402AmountUsdcMicro) : BigInt(msatsToUsdc(requiredMsats, rate));
-      const { verifyX402Payment } = await import("./x402-HQ5GRQZU.js");
+      const { verifyX402Payment } = await import("./x402-SL36LSOD.js");
       const receipt = await withPaymentStage("verifier_broadcast", () => verifyX402Payment(
         body.content.x402_payment,
         opts.x402Config,
@@ -6953,6 +6954,10 @@ async function completeTempoChannelDrain(args) {
           tx_hash: args.reference,
           channel_id: args.channelId,
           ...settlementEvidence,
+          ...args.finalization && {
+            terminal_outcome: args.finalization.outcome,
+            credit_unbacked: args.finalization.creditUnbacked
+          },
           ...args.repaired ? { repaired: true, repair_kind: "tempo_close_reconciled" } : {}
         },
         tx: innerTx
@@ -7231,14 +7236,14 @@ async function handleDrain(c, deps, args) {
       404
     );
   }
-  if (credit.status === "unbacked") {
+  let existing = await deps.ledger.getDrain({ creditId, drainId: drain.drain_id });
+  if (credit.status === "unbacked" && existing?.status !== "sent") {
     const rejected2 = await burnNonce(c, deps, args.envelope);
     if (rejected2) return rejected2;
     return jsonPaymentError("credit_unbacked", 409, {
       message: `Credit ${creditId} is terminal because its Tempo backing finalized before the DVM was protected.`
     });
   }
-  let existing = await deps.ledger.getDrain({ creditId, drainId: drain.drain_id });
   if (existing) {
     const tempoDiscovery = existing.method === "tempo" && existing.status === "pending" && drain.method === "tempo" && !!credit.tempoChannelId && !c.req.header("Authorization");
     if (!tempoDiscovery) {
@@ -7254,6 +7259,17 @@ async function handleDrain(c, deps, args) {
       const released = await releaseTempoDrain(c, deps, existing, credit.tempoChannelId);
       return respondDrain(c, deps, { record: released, credit });
     }
+    if (existing.status === "exit_required") {
+      const mpp = (await deps.railOpts(c)).mpp;
+      if (mpp && credit.tempoChannelId) {
+        const recovered = await recoverTempoDrain(deps, mpp, existing, credit.tempoChannelId);
+        if (recovered) {
+          if (isHttpResponse(recovered)) return recovered;
+          return respondDrain(c, deps, { record: recovered, credit });
+        }
+      }
+      return tempoExitRequiredResponse(existing);
+    }
     if (existing.method === "tempo" && existing.status === "pending" && credit.tempoChannelId) {
       if (credit.balanceMicro !== credit.availableMicro) {
         const released = await releaseTempoDrain(c, deps, existing, credit.tempoChannelId);
@@ -7491,7 +7507,8 @@ async function completeTempoDrain(c, deps, record, expectedChannelId, credit) {
             deps.hostedSettlementReports,
             rail.mpp,
             record,
-            expectedChannelId
+            expectedChannelId,
+            deps.ledger
           );
           if (!rail.mpp?.permitHostedTempoClose) {
             throw new Error("Hosted Tempo close credential guard is unavailable");
@@ -7521,13 +7538,21 @@ async function completeTempoDrain(c, deps, record, expectedChannelId, credit) {
     }
     const wrongChannel = tempoWrongChannelRefusal(error, record);
     if (wrongChannel) return wrongChannel;
-    if (error instanceof HostedTempoCloseAttemptsExhaustedError) {
-      return jsonPaymentError("tempo_channel_exit_required", 409, {
-        message: `Tempo drain ${record.drainId} reached its limit of cooperative close attempts that never reached the chain.`,
-        display: "The service could not complete a cooperative close of this stablecoin channel after several attempts. Your funds stay in the channel; use the timed on-chain exit to recover them.",
-        hint: "Start the channel's timed on-chain exit. Retrying this drain with another close credential is refused.",
-        extra: { drain_registered: true, drain_id: record.drainId, channel_id: expectedChannelId }
-      });
+    if (error instanceof HostedTempoCloseAttemptsExhaustedError || error instanceof TempoCloseDescriptorError) {
+      const result = deps.ledger.requireTempoDrainExit ? await deps.ledger.requireTempoDrainExit({ creditId: record.creditId, drainId: record.drainId }) : { drain: record, replayed: false };
+      if (!result.replayed && error instanceof TempoCloseDescriptorError) {
+        loggers.tempo.warn("tempo_session_close_descriptor_refused", {
+          credit_id: record.creditId,
+          drain_id: record.drainId,
+          channel_id: expectedChannelId,
+          amount_at_stake_native: record.drainedNative?.toString() ?? null,
+          amount_at_stake_micro: record.amountMicro,
+          currency: record.currency,
+          error: error.message
+        });
+      }
+      if (result.drain.status === "sent") return respondDrain(c, deps, { record: result.drain, credit });
+      return tempoExitRequiredResponse(result.drain);
     }
     const refused = tempoFloorRefusal(error, record);
     if (refused) return refused;
@@ -7580,13 +7605,15 @@ var HOSTED_TEMPO_CLOSE_MAX_RELEASES = 3;
 var HOSTED_TEMPO_CLOSE_IN_FLIGHT = "Hosted Tempo close already has an original effect attempt";
 var HostedTempoCloseAttemptsExhaustedError = class extends Error {
 };
-async function reserveHostedTempoClose(reports, mpp, record, channelId) {
+async function reserveHostedTempoClose(reports, mpp, record, channelId, ledger) {
   const pending = await reports.pendingTempoClose(channelId, record.drainId);
   if (!pending) {
     const reserved = await reports.reserveTempo(channelId, "close", record.drainId);
     if (reserved.replayed) throw new Error(HOSTED_TEMPO_CLOSE_IN_FLIGHT);
     return reserved.id;
   }
+  if (pending.state === "exhausted") throw new HostedTempoCloseAttemptsExhaustedError();
+  if (pending.state === "unmatched") throw new Error("Hosted Tempo close report requires an operator retry");
   if (pending.txHash || !mpp.getTempoSessionDrainState) throw new Error(HOSTED_TEMPO_CLOSE_IN_FLIGHT);
   const state = await mpp.getTempoSessionDrainState(channelId);
   if (state.finalized || state.deposit === 0n || state.closeRequestedAt !== 0n) {
@@ -7594,7 +7621,10 @@ async function reserveHostedTempoClose(reports, mpp, record, channelId) {
   }
   const result = await reports.releaseStaleTempoClose(pending.id, channelId, record.drainId, {
     staleAfterMs: HOSTED_TEMPO_CLOSE_STALE_MS,
-    maxReleases: HOSTED_TEMPO_CLOSE_MAX_RELEASES
+    maxReleases: HOSTED_TEMPO_CLOSE_MAX_RELEASES,
+    onExhausted: async (tx) => {
+      await ledger.requireTempoDrainExit?.({ creditId: record.creditId, drainId: record.drainId, tx });
+    }
   });
   if (result.outcome === "in_flight") throw new Error(HOSTED_TEMPO_CLOSE_IN_FLIGHT);
   if (result.outcome === "exhausted") {
@@ -7603,7 +7633,8 @@ async function reserveHostedTempoClose(reports, mpp, record, channelId) {
       drain_id: record.drainId,
       channel_id: channelId,
       obligation_id: pending.id,
-      attempt: result.releases + 1
+      attempt: result.releases + 1,
+      amount_at_stake_native: await reports.tempoCloseAmountAtStake(pending.id)
     });
     throw new HostedTempoCloseAttemptsExhaustedError(
       `Tempo drain ${record.drainId} exhausted its cooperative close attempts`
@@ -7618,6 +7649,20 @@ async function reserveHostedTempoClose(reports, mpp, record, channelId) {
   });
   return result.id;
 }
+function tempoExitRequiredResponse(record) {
+  const terminal = record.status === "exit_required";
+  return jsonPaymentError("tempo_channel_exit_required", 409, {
+    message: terminal ? `Tempo drain ${record.drainId} cannot cooperatively close this channel.` : `This Tempo close credential cannot complete drain ${record.drainId}.`,
+    display: "Your funds remain in the channel. Use the timed on-chain exit to recover them.",
+    hint: terminal ? "Start the channel's timed on-chain exit. A corrected close credential does not reopen this drain or debit it again." : "This drain remains pending. Use the channel's timed on-chain exit, or retry the same drain with a valid close credential if cooperative attempts remain. Retrying does not debit it again.",
+    extra: {
+      drain_registered: true,
+      drain_id: record.drainId,
+      channel_id: record.channelId,
+      status: record.status
+    }
+  });
+}
 function tempoCloseCredentialNeedsRefresh(error) {
   return error instanceof MppxErrors.InvalidChallengeError || error instanceof MppxErrors.PaymentExpiredError;
 }
@@ -8109,6 +8154,11 @@ function drainCopy(record) {
         display: "The refund was sent to the payout destination you provided.",
         hint: "See `sent` for the settlement reference (e.g. the on-chain transaction hash)."
       };
+    case "exit_required":
+      return {
+        display: "This drain cannot cooperatively close the channel. Your funds remain in the channel.",
+        hint: "Use the channel's timed on-chain exit. A corrected credential does not reopen this drain."
+      };
     case "released":
       return {
         display: "The channel could not complete this refund, so the service restored the amount to your prepaid balance.",
@@ -9586,172 +9636,6 @@ function safeError(err) {
   return "settlement_transport_error";
 }
 
-// src/sdk/server/hosting-control.ts
-import { createHmac, randomUUID as randomUUID4, timingSafeEqual } from "crypto";
-
-// src/sdk/server/hosting-cleanup-fence.ts
-var HostingCleanupFence = class {
-  constructor(pool, dvmId, scope) {
-    this.pool = pool;
-    this.dvmId = dvmId;
-    this.scope = scope;
-  }
-  pool;
-  dvmId;
-  scope;
-  async assertNewIntent(tx, intent) {
-    const continuation = intent?.admissionId || intent?.paymentSeq !== void 0 || intent?.invoicePaymentHash || intent?.invoiceRepairPaymentHash || intent?.creditId && intent.fundId && intent.callerPubkey;
-    const { rows: rows2 } = await tx.query(
-      `SELECT state, closed_at_ms, closed_at_us FROM sdk_hosting_control
-       WHERE dvm_id=$1 AND scope=$2 ${continuation ? "" : "FOR UPDATE"}`,
-      [this.dvmId, this.scope]
-    );
-    const control = rows2[0];
-    if (!control) throw new Error("Hosted obligation fence is unavailable");
-    if (control.state === "closed" && (control.closed_at_ms === null || control.closed_at_us === null)) {
-      throw new Error("Hosted closure cutoff is unavailable");
-    }
-    if (control.state !== "closed" && !continuation) return;
-    if (intent?.invoicePaymentHash || intent?.invoiceRepairPaymentHash) {
-      const repair = !!intent.invoiceRepairPaymentHash;
-      const invoice = await tx.query(
-        `SELECT i.payment_hash FROM credit_invoices i
-         LEFT JOIN sdk_hosting_admissions a ON a.id=i.hosting_admission_id
-         WHERE i.payment_hash=$1 AND i.caller_pubkey=$4 AND i.amount_micro=$5
-           AND (($10::boolean AND $3=i.payment_hash AND i.status IN ('blocked','written_off'))
-             OR (NOT $10::boolean AND i.credit_id=$2 AND i.fund_id=$3 AND i.status='pending'))
-           AND ((i.hosting_admission_id IS NULL AND
-                 ($9::bigint IS NULL OR i.created_at_db_us <= $9)) OR
-             (a.dvm_id=$6 AND a.scope=$7 AND a.credit_id=i.credit_id
-              AND a.fund_id=i.fund_id AND a.caller_pubkey=i.caller_pubkey
-              AND a.outcome IN ('pending','accepted','unresolved')
-              AND ($8::bigint IS NULL OR a.admitted_at_ms <= $8)))`,
-        [
-          intent.invoicePaymentHash ?? intent.invoiceRepairPaymentHash,
-          intent.creditId,
-          intent.fundId,
-          intent.callerPubkey,
-          intent.amountMicro,
-          this.dvmId,
-          this.scope,
-          control.closed_at_ms,
-          control.closed_at_us,
-          repair
-        ]
-      );
-      if (invoice.rows[0]) return;
-      throw new Error("Hosted invoice has no original payable admission");
-    }
-    if (intent?.paymentSeq !== void 0 && intent.jobId) {
-      const payment = await tx.query(
-        `SELECT m.job_id FROM job_messages m JOIN jobs j ON j.id=m.job_id
-         WHERE m.job_id=$1 AND m.seq=$2 AND m.status='pending-verification'
-           AND m.created_at_ms IS NOT NULL
-           AND ($3::bigint IS NULL OR m.created_at_ms <= $3) AND j.dvm_id=$4
-           AND ($6::text IS NULL OR m.data->'content'->'tempo_credential'->'challenge'->>'id'=$6)
-           AND EXISTS (SELECT 1 FROM sdk_hosting_admissions a
-             WHERE a.dvm_id=$4 AND a.scope=$5 AND a.job_id=m.job_id AND a.outcome <> 'failed')`,
-        [
-          intent.jobId,
-          intent.paymentSeq,
-          control.closed_at_ms,
-          this.dvmId,
-          this.scope,
-          intent.challengeId ?? null
-        ]
-      );
-      if (payment.rows[0]) return;
-      throw new Error("Hosted payment has no pre-closure inbound intent");
-    }
-    if (!intent?.admissionId && !intent?.jobId && !(intent?.creditId && intent.fundId && intent.callerPubkey) || !intent?.jobId && !(intent?.creditId && intent.fundId)) {
-      throw new Error("Hosted obligations are closed to new intents");
-    }
-    const accepted = await tx.query(
-      `SELECT id FROM sdk_hosting_admissions
-       WHERE ($1::text IS NULL OR id=$1) AND dvm_id=$2 AND scope=$3
-         AND ($4::bigint IS NULL OR admitted_at_ms <= $4)
-         AND (outcome IN ('pending', 'unresolved') OR ($11::boolean AND outcome='accepted'))
-         AND ($5::text IS NULL OR job_id=$5)
-         AND ($6::text IS NULL OR credit_id=$6)
-         AND ($7::text IS NULL OR fund_id=$7)
-         AND ($8::text IS NULL OR caller_pubkey=$8)
-         AND ($9::text IS NULL OR funding_commitment=$9)
-         AND ($10::text IS NULL OR payment_artifact_hash=$10)`,
-      [
-        intent.admissionId ?? null,
-        this.dvmId,
-        this.scope,
-        control.closed_at_ms,
-        intent.jobId ?? null,
-        intent.creditId ?? null,
-        intent.fundId ?? null,
-        intent.callerPubkey ?? null,
-        intent.fundingCommitment ?? null,
-        intent.paymentArtifactHash ?? null,
-        control.state !== "closed"
-      ]
-    );
-    if (!accepted.rows[0]) throw new Error("Hosted obligation has no pre-closure admission");
-  }
-  async withNewIntent(intent, operation) {
-    return this.withNewIntentOn(this.pool, intent, operation);
-  }
-  async assertFundingReservation(tx, reservation) {
-    await this.assertNewIntent(tx, {
-      admissionId: reservation.admissionId,
-      creditId: reservation.creditId,
-      fundId: reservation.fundId,
-      callerPubkey: reservation.callerPubkey,
-      fundingCommitment: reservation.commitment,
-      paymentArtifactHash: reservation.paymentArtifactHash
-    });
-    const verified = await tx.query(
-      `SELECT id FROM sdk_hosting_admissions
-       WHERE id=$1 AND dvm_id=$2 AND scope=$3 AND credit_id=$4 AND fund_id=$5
-         AND caller_pubkey=$6 AND funding_commitment=$7 AND payment_artifact_hash=$8
-         AND outcome IN ('pending','accepted','unresolved')`,
-      [
-        reservation.admissionId,
-        this.dvmId,
-        this.scope,
-        reservation.creditId,
-        reservation.fundId,
-        reservation.callerPubkey,
-        reservation.commitment,
-        reservation.paymentArtifactHash
-      ]
-    );
-    if (!verified.rows[0]) throw new Error("Hosted funding has no authentic admission");
-  }
-  async fundingAdmission(tx, creditId, fundId, callerPubkey) {
-    await this.assertNewIntent(tx, { creditId, fundId, callerPubkey });
-    const { rows: rows2 } = await tx.query(
-      `SELECT id FROM sdk_hosting_admissions
-       WHERE dvm_id=$1 AND scope=$2 AND credit_id=$3 AND fund_id=$4
-         AND caller_pubkey=$5 AND outcome IN ('pending','unresolved')
-       ORDER BY admitted_at_ms,id LIMIT 2`,
-      [this.dvmId, this.scope, creditId, fundId, callerPubkey]
-    );
-    if (rows2.length !== 1) throw new Error("Hosted invoice funding admission is missing or ambiguous");
-    return rows2[0].id;
-  }
-  async withNewIntentOn(db, intent, operation) {
-    const tx = await db.connect();
-    try {
-      await tx.query("BEGIN");
-      await this.assertNewIntent(tx, intent);
-      const result = await operation(tx);
-      await tx.query("COMMIT");
-      return result;
-    } catch (error) {
-      await tx.query("ROLLBACK").catch(() => void 0);
-      throw error;
-    } finally {
-      tx.release();
-    }
-  }
-};
-
 // src/sdk/server/hosting-settlement-report-obligations.ts
 import { createHash as createHash6, randomUUID as randomUUID3 } from "crypto";
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
@@ -9975,14 +9859,13 @@ var HostedSettlementReportObligations = class {
           operation TEXT NOT NULL CHECK (operation IN ('claim','refund','settle','close')),
           network TEXT NOT NULL, contract TEXT NOT NULL, channel_id TEXT NOT NULL,
           original JSONB NOT NULL,
-          state TEXT NOT NULL CHECK (state IN ('reserved','observed','report_queued','delivered','no_report')),
+          state TEXT NOT NULL CHECK (state IN ('reserved','observed','report_queued','delivered','no_report','exhausted','unmatched')),
+          close_search_before BIGINT, close_write_off_note TEXT,
           tx_hash TEXT, block_number BIGINT, block_hash TEXT, delta_native NUMERIC(78,0),
           payout_id TEXT, report_id TEXT, report_payload JSONB, delivered_at_ms BIGINT,
           created_at_ms BIGINT NOT NULL DEFAULT FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint,
           updated_at_ms BIGINT NOT NULL DEFAULT FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint
         );
-        ALTER TABLE sdk_hosted_settlement_report_obligations
-          ADD COLUMN IF NOT EXISTS close_search_before BIGINT;
         CREATE INDEX IF NOT EXISTS sdk_hosted_settlement_report_pending
           ON sdk_hosted_settlement_report_obligations (dvm_id,scope,state)
           WHERE state NOT IN ('delivered','no_report');
@@ -9990,6 +9873,29 @@ var HostedSettlementReportObligations = class {
           ON sdk_hosted_settlement_report_obligations (report_id)
           WHERE report_id IS NOT NULL;
       `);
+      const columns = await this.pool.query(
+        `SELECT attname FROM pg_attribute
+         WHERE attrelid='sdk_hosted_settlement_report_obligations'::regclass AND NOT attisdropped`
+      );
+      for (const [name, type] of [["close_search_before", "BIGINT"], ["close_write_off_note", "TEXT"]]) {
+        if (!columns.rows.some((column) => column.attname === name)) {
+          await this.pool.query(`ALTER TABLE sdk_hosted_settlement_report_obligations ADD COLUMN ${name} ${type}`);
+        }
+      }
+      const constraint = await this.pool.query(
+        `SELECT pg_get_constraintdef(oid) AS definition FROM pg_constraint
+         WHERE conrelid='sdk_hosted_settlement_report_obligations'::regclass
+           AND conname='sdk_hosted_settlement_report_obligations_state_check'`
+      );
+      const states = ["reserved", "observed", "report_queued", "delivered", "no_report", "exhausted", "unmatched"];
+      const expected = `CHECK ((state = ANY (ARRAY[${states.map((state) => `'${state}'::text`).join(", ")}])))`;
+      if (constraint.rows[0]?.definition !== expected) {
+        await this.pool.query(`ALTER TABLE sdk_hosted_settlement_report_obligations
+          DROP CONSTRAINT IF EXISTS sdk_hosted_settlement_report_obligations_state_check;
+          ALTER TABLE sdk_hosted_settlement_report_obligations
+          ADD CONSTRAINT sdk_hosted_settlement_report_obligations_state_check
+          CHECK (state IN ('reserved','observed','report_queued','delivered','no_report','exhausted','unmatched'))`);
+      }
       await this.pool.query(
         `INSERT INTO sdk_hosted_settlement_report_history (singleton,complete)
          VALUES (TRUE,$1) ON CONFLICT (singleton) DO NOTHING`,
@@ -10093,9 +9999,9 @@ var HostedSettlementReportObligations = class {
   }
   /**
    * Retire a close reservation that never recorded a transaction and reserve
-   * the drain's next attempt, in one transaction, so the drain always keeps one
-   * outstanding close obligation. A close from the retired attempt that lands
-   * late is a close of the same channel: `recordSubmitted` on the retired row
+   * the drain's next attempt in one transaction. At the retry cap the final
+   * row becomes terminal `exhausted` and remains claimable by a late landing.
+   * A close from the retired attempt that lands late is the same channel's close: `recordSubmitted` on the retired row
    * writes it onto the successor, and recovery attaches it there if that
    * attempt never got to write, so it is reported once.
    *
@@ -10122,7 +10028,15 @@ var HostedSettlementReportObligations = class {
            AND original->>'drainId'=$4 AND state='no_report' AND tx_hash IS NULL`,
         [this.dvmId, this.scope, channelId.toLowerCase(), drainId]
       )).rows[0].n);
-      if (released >= limits.maxReleases) return { outcome: "exhausted", releases: released };
+      if (released >= limits.maxReleases) {
+        await tx.query(
+          `UPDATE sdk_hosted_settlement_report_obligations SET state='exhausted',
+             updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint WHERE id=$1`,
+          [id]
+        );
+        await limits.onExhausted?.(tx);
+        return { outcome: "exhausted", releases: released };
+      }
       await tx.query(
         `UPDATE sdk_hosted_settlement_report_obligations SET state='no_report',
            updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint WHERE id=$1`,
@@ -10141,11 +10055,63 @@ var HostedSettlementReportObligations = class {
       `UPDATE sdk_hosted_settlement_report_obligations SET state='no_report',
          updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint
        WHERE id=$1 AND dvm_id=$2 AND scope=$3 AND rail='tempo' AND operation='close'
-         AND state='reserved' AND tx_hash IS NULL`,
+         AND state IN ('reserved','exhausted') AND tx_hash IS NULL`,
+      [id, this.dvmId, this.scope]
+    );
+    return result.rowCount === 1;
+  }
+  async tempoCloseAmountAtStake(id) {
+    const row = await this.lockRow(this.pool, id);
+    if (row.rail !== "tempo" || row.operation !== "close") throw new Error("Not a Tempo close obligation");
+    return (BigInt(String(row.original.highestVoucherAmount)) - BigInt(String(row.original.settledOnChain))).toString();
+  }
+  /** Stop automatic searches without declaring a possibly missing payout discharged. */
+  async markTempoCloseUnmatched(id) {
+    const result = await this.pool.query(
+      `UPDATE sdk_hosted_settlement_report_obligations SET state='unmatched',
+         updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint
+       WHERE id=$1 AND dvm_id=$2 AND scope=$3 AND rail='tempo' AND operation='close'
+         AND state IN ('reserved','exhausted') AND tx_hash IS NULL`,
       [id, this.dvmId, this.scope]
     );
     return result.rowCount === 1;
   }
+  async writeOffTempoClose(id, note) {
+    const result = await this.pool.query(
+      `UPDATE sdk_hosted_settlement_report_obligations SET state='no_report', close_write_off_note=$4,
+         updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint
+       WHERE id=$1 AND dvm_id=$2 AND scope=$3 AND rail='tempo' AND operation='close'
+         AND state='unmatched' AND tx_hash IS NULL RETURNING channel_id,original`,
+      [id, this.dvmId, this.scope, note]
+    );
+    const row = result.rows[0];
+    return row && { channelId: row.channel_id, amount: (BigInt(String(row.original.highestVoucherAmount)) - BigInt(String(row.original.settledOnChain))).toString() };
+  }
+  async reopenTempoClose(id) {
+    return transaction(this.pool, async (tx) => {
+      const owned = await tx.query(
+        "SELECT id FROM sdk_hosted_settlement_report_obligations WHERE id=$1 AND dvm_id=$2 AND scope=$3",
+        [id, this.dvmId, this.scope]
+      );
+      if (!owned.rowCount) return false;
+      await this.lockIdentity(tx);
+      const result = await tx.query(
+        `UPDATE sdk_hosted_settlement_report_obligations target
+         SET state='reserved', close_search_before=NULL,
+           updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint
+         WHERE id=$1 AND dvm_id=$2 AND scope=$3 AND rail='tempo' AND operation='close'
+           AND state IN ('unmatched','no_report') AND tx_hash IS NULL
+           AND NOT EXISTS (
+             SELECT 1 FROM sdk_hosted_settlement_report_obligations other
+             WHERE other.dvm_id=target.dvm_id AND other.scope=target.scope
+               AND other.rail='tempo' AND other.operation='close' AND other.channel_id=target.channel_id
+               AND other.id<>target.id AND (other.state<>'no_report' OR other.tx_hash IS NOT NULL)
+           )`,
+        [id, this.dvmId, this.scope]
+      );
+      return result.rowCount === 1;
+    });
+  }
   async reserveTempoIn(tx, channelId, operation, drainId) {
     const config = this.tempo;
     if (!config || !hex(channelId, 32)) throw new Error("Hosted Tempo settlement configuration is unavailable");
@@ -10204,7 +10170,7 @@ var HostedSettlementReportObligations = class {
   /** The original close obligation reserved for this drain, while its report is outstanding. */
   async pendingTempoClose(channelId, drainId) {
     const result = await this.pool.query(
-      `SELECT id,tx_hash,created_at_ms,close_search_before FROM sdk_hosted_settlement_report_obligations
+      `SELECT id,state,tx_hash,created_at_ms,close_search_before FROM sdk_hosted_settlement_report_obligations
        WHERE dvm_id=$1 AND scope=$2 AND rail='tempo' AND operation='close' AND channel_id=$3
          AND original->>'drainId'=$4 AND state NOT IN ('delivered','no_report')
        ORDER BY created_at_ms DESC LIMIT 1`,
@@ -10213,6 +10179,7 @@ var HostedSettlementReportObligations = class {
     const row = result.rows[0];
     return row && {
       id: row.id,
+      state: row.state,
       txHash: row.tx_hash,
       reservedAtMs: Number(row.created_at_ms),
       searchBefore: searchCursor(row.close_search_before)
@@ -10346,6 +10313,7 @@ var HostedSettlementReportObligations = class {
       }
       await tx.query(
         `UPDATE sdk_hosted_settlement_report_obligations SET tx_hash=COALESCE(tx_hash,$2),
+           state=CASE WHEN state IN ('exhausted','unmatched') THEN 'reserved' ELSE state END,
            updated_at_ms=FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint WHERE id=$1`,
         [row.id, txHash.toLowerCase()]
       );
@@ -10353,15 +10321,15 @@ var HostedSettlementReportObligations = class {
   }
   /**
    * Close reservations that never recorded a transaction, oldest first. Each
-   * one owes a payout report only if its close lands, so it stays unresolved
-   * until a reconcile reads how its channel finalized.
+   * one owes a payout report if its close lands. Exhausted attempts remain
+   * observable for late landings; unmatched searches require an explicit retry.
    */
   async unsubmittedTempoCloses(limit = 100) {
     const result = await this.pool.query(
       `SELECT id,channel_id,original->>'drainId' AS drain_id,created_at_ms,close_search_before
          FROM sdk_hosted_settlement_report_obligations
         WHERE dvm_id=$1 AND scope=$2 AND rail='tempo' AND operation='close'
-          AND state='reserved' AND tx_hash IS NULL
+          AND state IN ('reserved','exhausted') AND tx_hash IS NULL
         ORDER BY created_at_ms,id LIMIT $3`,
       [this.dvmId, this.scope, limit]
     );
@@ -10859,10 +10827,192 @@ var HostedSettlementReportObligations = class {
     return { id: row.id, replayed: true };
   }
 };
+async function retryHostedTempoCloseReport(args) {
+  const obligations = new HostedSettlementReportObligations(args.db, args.dvmId, args.scope);
+  return obligations.reopenTempoClose(args.obligationId);
+}
+async function writeOffHostedTempoCloseReport(args) {
+  const note = args.note.trim();
+  if (!note || note.length > 2e3) throw new Error("A write-off requires a note of 1 to 2000 characters");
+  const row = await new HostedSettlementReportObligations(args.db, args.dvmId, args.scope).writeOffTempoClose(args.obligationId, note);
+  if (!row) return false;
+  loggers.tempo.warn("tempo_session_close_report_written_off", {
+    channel_id: row.channelId,
+    obligation_id: args.obligationId,
+    amount_forgone_native: row.amount
+  });
+  return true;
+}
 function searchCursor(value) {
   return value === null ? null : BigInt(value);
 }
 
+// src/sdk/server/hosting-control.ts
+import { createHmac, randomUUID as randomUUID4, timingSafeEqual } from "crypto";
+
+// src/sdk/server/hosting-cleanup-fence.ts
+var HostingCleanupFence = class {
+  constructor(pool, dvmId, scope) {
+    this.pool = pool;
+    this.dvmId = dvmId;
+    this.scope = scope;
+  }
+  pool;
+  dvmId;
+  scope;
+  async assertNewIntent(tx, intent) {
+    const continuation = intent?.admissionId || intent?.paymentSeq !== void 0 || intent?.invoicePaymentHash || intent?.invoiceRepairPaymentHash || intent?.creditId && intent.fundId && intent.callerPubkey;
+    const { rows: rows2 } = await tx.query(
+      `SELECT state, closed_at_ms, closed_at_us FROM sdk_hosting_control
+       WHERE dvm_id=$1 AND scope=$2 ${continuation ? "" : "FOR UPDATE"}`,
+      [this.dvmId, this.scope]
+    );
+    const control = rows2[0];
+    if (!control) throw new Error("Hosted obligation fence is unavailable");
+    if (control.state === "closed" && (control.closed_at_ms === null || control.closed_at_us === null)) {
+      throw new Error("Hosted closure cutoff is unavailable");
+    }
+    if (control.state !== "closed" && !continuation) return;
+    if (intent?.invoicePaymentHash || intent?.invoiceRepairPaymentHash) {
+      const repair = !!intent.invoiceRepairPaymentHash;
+      const invoice = await tx.query(
+        `SELECT i.payment_hash FROM credit_invoices i
+         LEFT JOIN sdk_hosting_admissions a ON a.id=i.hosting_admission_id
+         WHERE i.payment_hash=$1 AND i.caller_pubkey=$4 AND i.amount_micro=$5
+           AND (($10::boolean AND $3=i.payment_hash AND i.status IN ('blocked','written_off'))
+             OR (NOT $10::boolean AND i.credit_id=$2 AND i.fund_id=$3 AND i.status='pending'))
+           AND ((i.hosting_admission_id IS NULL AND
+                 ($9::bigint IS NULL OR i.created_at_db_us <= $9)) OR
+             (a.dvm_id=$6 AND a.scope=$7 AND a.credit_id=i.credit_id
+              AND a.fund_id=i.fund_id AND a.caller_pubkey=i.caller_pubkey
+              AND a.outcome IN ('pending','accepted','unresolved')
+              AND ($8::bigint IS NULL OR a.admitted_at_ms <= $8)))`,
+        [
+          intent.invoicePaymentHash ?? intent.invoiceRepairPaymentHash,
+          intent.creditId,
+          intent.fundId,
+          intent.callerPubkey,
+          intent.amountMicro,
+          this.dvmId,
+          this.scope,
+          control.closed_at_ms,
+          control.closed_at_us,
+          repair
+        ]
+      );
+      if (invoice.rows[0]) return;
+      throw new Error("Hosted invoice has no original payable admission");
+    }
+    if (intent?.paymentSeq !== void 0 && intent.jobId) {
+      const payment = await tx.query(
+        `SELECT m.job_id FROM job_messages m JOIN jobs j ON j.id=m.job_id
+         WHERE m.job_id=$1 AND m.seq=$2 AND m.status='pending-verification'
+           AND m.created_at_ms IS NOT NULL
+           AND ($3::bigint IS NULL OR m.created_at_ms <= $3) AND j.dvm_id=$4
+           AND ($6::text IS NULL OR m.data->'content'->'tempo_credential'->'challenge'->>'id'=$6)
+           AND EXISTS (SELECT 1 FROM sdk_hosting_admissions a
+             WHERE a.dvm_id=$4 AND a.scope=$5 AND a.job_id=m.job_id AND a.outcome <> 'failed')`,
+        [
+          intent.jobId,
+          intent.paymentSeq,
+          control.closed_at_ms,
+          this.dvmId,
+          this.scope,
+          intent.challengeId ?? null
+        ]
+      );
+      if (payment.rows[0]) return;
+      throw new Error("Hosted payment has no pre-closure inbound intent");
+    }
+    if (!intent?.admissionId && !intent?.jobId && !(intent?.creditId && intent.fundId && intent.callerPubkey) || !intent?.jobId && !(intent?.creditId && intent.fundId)) {
+      throw new Error("Hosted obligations are closed to new intents");
+    }
+    const accepted = await tx.query(
+      `SELECT id FROM sdk_hosting_admissions
+       WHERE ($1::text IS NULL OR id=$1) AND dvm_id=$2 AND scope=$3
+         AND ($4::bigint IS NULL OR admitted_at_ms <= $4)
+         AND (outcome IN ('pending', 'unresolved') OR ($11::boolean AND outcome='accepted'))
+         AND ($5::text IS NULL OR job_id=$5)
+         AND ($6::text IS NULL OR credit_id=$6)
+         AND ($7::text IS NULL OR fund_id=$7)
+         AND ($8::text IS NULL OR caller_pubkey=$8)
+         AND ($9::text IS NULL OR funding_commitment=$9)
+         AND ($10::text IS NULL OR payment_artifact_hash=$10)`,
+      [
+        intent.admissionId ?? null,
+        this.dvmId,
+        this.scope,
+        control.closed_at_ms,
+        intent.jobId ?? null,
+        intent.creditId ?? null,
+        intent.fundId ?? null,
+        intent.callerPubkey ?? null,
+        intent.fundingCommitment ?? null,
+        intent.paymentArtifactHash ?? null,
+        control.state !== "closed"
+      ]
+    );
+    if (!accepted.rows[0]) throw new Error("Hosted obligation has no pre-closure admission");
+  }
+  async withNewIntent(intent, operation) {
+    return this.withNewIntentOn(this.pool, intent, operation);
+  }
+  async assertFundingReservation(tx, reservation) {
+    await this.assertNewIntent(tx, {
+      admissionId: reservation.admissionId,
+      creditId: reservation.creditId,
+      fundId: reservation.fundId,
+      callerPubkey: reservation.callerPubkey,
+      fundingCommitment: reservation.commitment,
+      paymentArtifactHash: reservation.paymentArtifactHash
+    });
+    const verified = await tx.query(
+      `SELECT id FROM sdk_hosting_admissions
+       WHERE id=$1 AND dvm_id=$2 AND scope=$3 AND credit_id=$4 AND fund_id=$5
+         AND caller_pubkey=$6 AND funding_commitment=$7 AND payment_artifact_hash=$8
+         AND outcome IN ('pending','accepted','unresolved')`,
+      [
+        reservation.admissionId,
+        this.dvmId,
+        this.scope,
+        reservation.creditId,
+        reservation.fundId,
+        reservation.callerPubkey,
+        reservation.commitment,
+        reservation.paymentArtifactHash
+      ]
+    );
+    if (!verified.rows[0]) throw new Error("Hosted funding has no authentic admission");
+  }
+  async fundingAdmission(tx, creditId, fundId, callerPubkey) {
+    await this.assertNewIntent(tx, { creditId, fundId, callerPubkey });
+    const { rows: rows2 } = await tx.query(
+      `SELECT id FROM sdk_hosting_admissions
+       WHERE dvm_id=$1 AND scope=$2 AND credit_id=$3 AND fund_id=$4
+         AND caller_pubkey=$5 AND outcome IN ('pending','unresolved')
+       ORDER BY admitted_at_ms,id LIMIT 2`,
+      [this.dvmId, this.scope, creditId, fundId, callerPubkey]
+    );
+    if (rows2.length !== 1) throw new Error("Hosted invoice funding admission is missing or ambiguous");
+    return rows2[0].id;
+  }
+  async withNewIntentOn(db, intent, operation) {
+    const tx = await db.connect();
+    try {
+      await tx.query("BEGIN");
+      await this.assertNewIntent(tx, intent);
+      const result = await operation(tx);
+      await tx.query("COMMIT");
+      return result;
+    } catch (error) {
+      await tx.query("ROLLBACK").catch(() => void 0);
+      throw error;
+    } finally {
+      tx.release();
+    }
+  }
+};
+
 // src/sdk/server/hosting-channel-evidence.ts
 import { createHash as createHash7 } from "crypto";
 import { Session as TempoSession2 } from "mppx/tempo";
@@ -18347,7 +18497,7 @@ async function requireWedgedTempoDrain(c, opts, args, admitBooked) {
       )
     };
   }
-  if (record.status !== "pending" && !(admitBooked && record.status === "sent")) {
+  if (record.status !== "pending" && !(admitBooked && (record.status === "sent" || record.status === "exit_required"))) {
     return { response: tempoNotWedgedRefusal(c, args, record.status) };
   }
   return { record, channelId: record.channelId };
@@ -19763,7 +19913,7 @@ async function createDVMServer(descriptor, opts) {
       }
     }
     if (!opts.onJobCompleted && platformToken && platformUrl && dvmId && opts.db) {
-      const { RevenueReporter } = await import("./revenue-reporter-KDUZLD5F.js");
+      const { RevenueReporter } = await import("./revenue-reporter-4EAVPWXS.js");
       const reporter = new RevenueReporter(
         opts.db,
         platformUrl,
@@ -19773,7 +19923,7 @@ async function createDVMServer(descriptor, opts) {
       revenueReporter = reporter;
       await reporter.init();
       reporter.startRetryLoop();
-      const { MemoryX402BatchStore, PayoutReporter } = await import("./payout-reporter-NN6K2IVQ.js");
+      const { MemoryX402BatchStore, PayoutReporter } = await import("./payout-reporter-TZX2S7KG.js");
       payoutReporter = new PayoutReporter({
         dvmId,
         db: opts.db,
@@ -20074,7 +20224,43 @@ var DVMServer = class {
       dvmId: this.receiptDvmId()
     }) : void 0;
     this.creditLedger = opts.creditLedger ?? new MemoryCreditLedger();
-    this.opts.mpp?.useTempoCreditLedger?.(this.creditLedger);
+    this.opts.mpp?.useTempoCreditLedger?.(this.creditLedger, async (drain, evidence) => {
+      const completed = await completeTempoChannelDrain({
+        deps: { ledger: this.creditLedger, drainReport: {
+          db: this.opts.db,
+          dvmId: this.opts.dvmId,
+          enqueueCreditDrain: this.opts.enqueueCreditDrain
+        } },
+        creditId: drain.creditId,
+        drainId: drain.drainId,
+        channelId: drain.channelId,
+        refundedNative: evidence.refundedNative,
+        debitedNative: drain.drainedNative,
+        reference: evidence.reference,
+        finalization: {
+          outcome: evidence.creditUnbacked ? `${evidence.outcome}_unbacked` : evidence.outcome,
+          creditUnbacked: evidence.creditUnbacked
+        }
+      });
+      if (!completed.replayed && this.receiptIssuer) {
+        const receipt = this.receiptIssuer.issueDrain({
+          creditId: drain.creditId,
+          drainId: drain.drainId,
+          event: "sent",
+          method: drain.method,
+          amountMicro: drain.amountMicro,
+          balanceAfterMicro: drain.balanceAfterMicro,
+          ledgerSeq: drain.ledgerSeq,
+          callerPubkey: drain.callerPubkey
+        });
+        await this.creditLedger.appendDrainReceipt({
+          creditId: drain.creditId,
+          drainId: drain.drainId,
+          receipt
+        });
+      }
+      return !completed.replayed;
+    });
     this.processedPayments = opts.processedPayments ?? new MemoryProcessedPaymentStore();
     this.jobManager = new JobManager(descriptor, {
       receiptIssuer: this.receiptIssuer,
@@ -23277,6 +23463,8 @@ export {
   X402ExactSettlementServer,
   X402ExactSettlementEvidenceMissingError,
   HostedSettlementReportObligations,
+  retryHostedTempoCloseReport,
+  writeOffHostedTempoCloseReport,
   signHostingControl,
   signHostingClosure,
   jobCredentialGate,