@dvmkit/sdk 0.1.5-rc.8 → 0.2.0-rc.9

package/README.md

@@ -102,6 +102,18 @@ Use the Node.js release in `.nvmrc` (Node 22). Install with `npm ci`, then run t
 
 The public surface is exactly `@dvmkit/sdk`, `@dvmkit/sdk/server`, and `@dvmkit/sdk/testing`.
 
+When you pass `env` to `serve()` or `createDVMHost()`, that object is the complete host
+environment. SDK configuration, including provenance, builder and owner identity, and
+mint-health defaults, reads only from it. Omit `env` to use `process.env`.
+
+## Terminal evidence
+
+New job receipts keep schema version `1` and add optional signed `timing` with `accepted_at_ms`, `terminal_at_ms`, and cumulative `caller_wait_ms`. Acceptance and termination use Unix milliseconds; `issued_at` remains signing time in Unix seconds. Non-completed receipts also include SDK-derived `ended_by`: explicit caller cancellation and unanswered prompt/payment expiry are `caller`; handler failures, worker death, and idle expiry during processing or working are `provider`. Handlers cannot choose this attribution. Legacy receipts omit these fields and still verify. Jobs accepted before this change, including jobs still active during an upgrade, omit the additions and do not produce terminal reports because earlier caller waits are unknown; the SDK does not invent historical fault evidence.
+
+Hosted servers with platform URL, token, DVM identity and durable database configured enqueue every terminal job, including free jobs, through the durable report outbox to `/_internal/job-terminal`. The payload contains the DVM/job identity, capability, outcome, attribution, payment-presence flag, timing and optional receipt sequence. It contains no caller identity, payment references or amounts, input, or output. The permanent deduplication claim and outbox insert commit together; startup and periodic recovery cover a crash after terminal persistence. Deliveries can repeat, so the platform deduplicates by DVM/job identity.
+
+Deploy the platform endpoint before deploying report-emitting servers. These reports use the existing revenue transport policy: transport/5xx failures retry and abandon after 24 hours; 4xx responses, including 404, become permanently stale. The portable receipt and report contract is in `protocol-fixtures/job-terminal-evidence.json`; compatibility is tested with the pinned published `@dvmkit/sdk@0.1.5-rc.9` verifier.
+
 ## Compatibility and versioning
 
 This is pre-1.0 alpha software and the promises match that. Breaking changes can land in any release, they are announced in the release notes for the release that carries them, and there is no long-term support release. Security fixes are made on the latest published release rather than backported.

package/dist/{chunk-BIP6G74V.js → chunk-2ATUAUAO.js}

@@ -10,7 +10,7 @@ import {
   isValidEvmPrivateKey,
   loadConfig,
   updateConfig
-} from "./chunk-CGKZDODG.js";
+} from "./chunk-MG67KXU7.js";
 import {
   X402_DEFAULT_NETWORK,
   X402_V1_VERSION,
@@ -190,7 +190,7 @@ function x402PendingFundingJson(entry) {
     amount_micro: entry.amountMicro,
     // What the ERC-3009 authorization can still pull, which is the figure a
     // `--force` retirement is really deciding about: a deposit's authorized
-    // value can exceed the amount funded (internal-review), so `amount_micro` alone
+    // value can exceed the amount funded, so `amount_micro` alone
     // understates it. Null on a voucher-only payload, which authorizes no
     // deposit at all.
     deposit_micro: entry.depositMicro ?? null,
@@ -243,7 +243,7 @@ var DvmX402ChannelStorage = class {
   /**
    * Upstream's ordinary write. Its chain-recovery paths are authoritative and
    * clear the unreconciled stamp. DVM-response paths scope this same write to
-   * persist their weaker provenance atomically with the balance (internal-review).
+   * persist their weaker provenance atomically with the balance.
    */
   set(key, context) {
     return fromSynchronousStore(() => {
@@ -266,7 +266,7 @@ var DvmX402ChannelStorage = class {
   }
   /**
    * Write a context whose `balance` carries a deposit this machine added on its
-   * own authority, and stamp the record as unreconciled (internal-review).
+   * own authority, and stamp the record as unreconciled.
    *
    * Separate from {@link set} because the two differ in exactly one thing that
    * matters later: where the figure came from. Nothing else about the write
@@ -279,7 +279,7 @@ var DvmX402ChannelStorage = class {
   }
   /**
    * Write a context whose `balance` is byte-for-byte the one already stored,
-   * leaving the unreconciled stamp exactly as it found it (internal-review).
+   * leaving the unreconciled stamp exactly as it found it.
    *
    * The replay acknowledgement's idempotent second pass is what needs this: it
    * restates a cumulative base without adding to the balance, so it observes
@@ -294,7 +294,7 @@ var DvmX402ChannelStorage = class {
   }
   /**
    * Seed upstream's cooperative-refund probe without changing the acknowledged
-   * base. Records written before internal-review have only the upstream context, so
+   * base. Records written before have only the upstream context, so
    * `hold` adopts its acknowledged value rather than losing that base to the
    * chain floor this seeds. The seed itself is a `channels()` read, so it is
    * `observed` and settles the unreconciled question like any other.
@@ -605,7 +605,7 @@ function loadFile() {
       channels: raw.channels,
       pending: raw.pending,
       // Tolerated rather than required, unlike its two siblings: every file
-      // written before internal-review lacks the key, and failing closed on it would
+      // written before lacks the key, and failing closed on it would
       // read as a corrupt journal on a store that is perfectly intact.
       exact: Array.isArray(raw.exact) ? raw.exact : []
     };
@@ -753,7 +753,7 @@ async function getX402Balance(wallet) {
       usdc: Number(balance) / 1e6,
       network: w.network,
       tokenAddress: spec.usdc,
-      // internal-review: redacted here rather than at a display surface, so the clear
+      // redacted here rather than at a display surface, so the clear
       // endpoint never leaves this function on the success path either.
       rpcUrlRedacted: rpcUrl ? redactUrl(rpcUrl) : void 0,
       rpcSource

package/dist/{chunk-27V2ILSR.js → chunk-4A2RAKCW.js}

@@ -42,8 +42,8 @@ var FxRateUnavailableError = class extends Error {
   display;
   hint;
   /**
-   * Set only when the platform explicitly refused a *known-stale* snapshot
-   * (internal-review). Absent means transient/unreachable — a distinction the payment
+   * Set only when the platform explicitly refused a *known-stale* snapshot.
+   * Absent means transient/unreachable — a distinction the payment
    * rail's amount computation branches on: refuse on `knownStale`, degrade to
    * the last-known rate without it. See {@link FxKnownStale}.
    */

package/dist/{chunk-EVBK675R.js → chunk-6GRIKOFB.js}

@@ -5,6 +5,7 @@ import {
 // src/sdk/server/revenue-reporter.ts
 import { randomUUID } from "crypto";
 var ENDPOINTS = {
+  job_terminal: "/_internal/job-terminal",
   revenue: "/_internal/job-revenue",
   cost: "/_internal/job-cost",
   deposit: "/_internal/credit-deposit",
@@ -51,7 +52,6 @@ var RevenueReporter = class _RevenueReporter {
   async init() {
     await withSdkInitLock(this.db, () => this.createTables());
   }
-  /** The boot DDL itself — always runs under {@link withSdkInitLock} (internal-review). */
   async createTables() {
     await this.db.query(`
       CREATE TABLE IF NOT EXISTS ${PENDING_DVM_REPORTS_TABLE} (
@@ -65,6 +65,10 @@ var RevenueReporter = class _RevenueReporter {
         kind          TEXT NOT NULL DEFAULT 'revenue'
       )
     `);
+    await this.db.query(`CREATE TABLE IF NOT EXISTS reported_job_terminals (
+      dvm_id TEXT NOT NULL, job_id TEXT NOT NULL, created_at BIGINT NOT NULL,
+      PRIMARY KEY (dvm_id, job_id)
+    )`);
     await this.assertSdkTableShape(PENDING_DVM_REPORTS_TABLE);
     await this.db.query(
       `ALTER TABLE ${PENDING_DVM_REPORTS_TABLE} ADD COLUMN IF NOT EXISTS stale_reason TEXT`
@@ -74,7 +78,6 @@ var RevenueReporter = class _RevenueReporter {
     );
     await this.migrateLegacySdkOutbox();
   }
-  /** Copy rows from the old SDK-owned table without touching the platform's table of that name. */
   async migrateLegacySdkOutbox() {
     const columns = await this.tableColumns(LEGACY_PENDING_REPORTS_TABLE);
     if (columns.size === 0) return;
@@ -106,7 +109,6 @@ var RevenueReporter = class _RevenueReporter {
          )
     `);
   }
-  /** Refuse a pre-existing relation whose columns cannot safely serve as the SDK outbox. */
   async assertSdkTableShape(tableName) {
     this.assertSdkColumns(tableName, await this.tableColumns(tableName));
   }
@@ -130,6 +132,21 @@ var RevenueReporter = class _RevenueReporter {
   async report(payload) {
     return this.enqueue("revenue", payload, payload.jobId);
   }
+  /** The permanent deduplication claim and outbox insert commit together.
+   * The claim survives successful delivery, including for custom job stores.
+   */
+  async reportTerminal(payload) {
+    const id = randomUUID();
+    const { rowCount } = await this.db.query(
+      `WITH claimed AS (
+         INSERT INTO reported_job_terminals (dvm_id, job_id, created_at)
+         VALUES ($5, $1, $4) ON CONFLICT DO NOTHING RETURNING job_id
+       ) INSERT INTO ${PENDING_DVM_REPORTS_TABLE} (id, payload, created_at, kind)
+         SELECT $2, $3::jsonb, $4, 'job_terminal' FROM claimed`,
+      [payload.jobId, id, JSON.stringify(payload), Date.now(), payload.dvmId]
+    );
+    if (rowCount) void this.attemptDelivery(id, payload, "job_terminal", payload.jobId).catch(() => void 0);
+  }
   /** Persist a zero-revenue job cost and attempt immediate delivery. */
   async reportCost(payload) {
     return this.enqueue("cost", payload, payload.jobId);
@@ -149,23 +166,20 @@ var RevenueReporter = class _RevenueReporter {
     await this.insertPending(tx, "release", payload);
   }
   /**
-   * Join a credit drain to the transaction that made it terminal (internal-review).
+   * Join a credit drain to the transaction that made it terminal.
    *
    * Same discipline as {@link enqueueDeposit} and the same reason: no network
    * I/O here, only the durable queue row, written through `tx` so the report
    * and the status CAS commit or roll back together. A drain whose row was
    * lost between the two would overstate outstanding liability forever —
    * the mirror image of a lost deposit.
-   *
-   * Named for the payload rather than the verb because `drain` already means
-   * "flush the queue" in this class (see {@link drainPending}).
    */
   async enqueueCreditDrain(tx, payload) {
     await this.insertPending(tx, "drain", payload);
   }
   /**
    * Join a payout to the transaction that commits the movement it reports
-   * (internal-review) — the batch close, the accumulator mark, the drain booking.
+   * the batch close, the accumulator mark, the drain booking.
    * No network I/O, only the durable queue row through `tx`, the discipline
    * {@link enqueueCreditDrain} set and for the same reason: the money has
    * already moved on a rail this ledger does not own, so the platform row is
@@ -187,7 +201,7 @@ var RevenueReporter = class _RevenueReporter {
     return this.enqueue("payout", payload, payload.payoutId);
   }
   /**
-   * Report one rail's pending-pool snapshot (internal-review). Best-effort and
+   * Report one rail's pending-pool snapshot. Best-effort and
    * fire-and-forget, deliberately unlike {@link reportPayout}: a snapshot is
    * replaced by the next tick, so queueing a stale one behind an outage would
    * only deliver figures the platform already has newer ones for.
@@ -225,7 +239,7 @@ var RevenueReporter = class _RevenueReporter {
   }
   /**
    * Join a credit-expiry release — or the revival that reverses one — to the
-   * transaction that made it true (internal-review).
+   * transaction that made it true.
    *
    * Same discipline as {@link enqueueCreditDrain}: no network I/O, only the
    * durable queue row written through `tx`. A release whose row was lost after
@@ -237,7 +251,7 @@ var RevenueReporter = class _RevenueReporter {
     await this.insertPending(tx, "expiry_release", payload);
   }
   /**
-   * Report a reaper-force-failed paid job to the platform (internal-review) so the
+   * Report a reaper-force-failed paid job to the platform so the
    * operator receives an ambient notice that a DVM died or wedged mid-job.
    * Best-effort and fire-and-forget: unlike {@link report} there is no local
    * durable queue — a non-2xx or transport failure is structured-logged
@@ -277,7 +291,7 @@ var RevenueReporter = class _RevenueReporter {
     }
   }
   /**
-   * Report a settled draw whose revenue event was skipped (internal-review).
+   * Report a settled draw whose revenue event was skipped.
    * Best-effort and fire-and-forget: the SDK's structured
    * `revenue_skipped_no_rail` log is the durable backstop, so a failed notice
    * must never wedge terminal handling or the orphan-draw reconciler.
@@ -317,7 +331,6 @@ var RevenueReporter = class _RevenueReporter {
       );
     }
   }
-  /** Report the self-relay's Base gas gauge for platform-side paging and recovery. */
   async reportX402SelfRelayGasBalance(payload) {
     const url = `${this.platformUrl}/_internal/x402-self-relay-gas-balance`;
     try {
@@ -349,7 +362,6 @@ var RevenueReporter = class _RevenueReporter {
       );
     }
   }
-  /** Report redacted self-relay RPC health for platform-side paging and recovery. */
   async reportX402SelfRelayRpcHealth(payload) {
     const url = `${this.platformUrl}/_internal/x402-self-relay-rpc-health`;
     try {
@@ -381,11 +393,9 @@ var RevenueReporter = class _RevenueReporter {
       );
     }
   }
-  /** Report the Tempo operator's fee-token gauge for paging and recovery. */
   async reportTempoSettlementBalance(payload) {
     await this.postTempoSettlementReadiness("balance", payload);
   }
-  /** Report a redacted operator fee rejection immediately. */
   async reportTempoSettlementFailure(payload) {
     await this.postTempoSettlementReadiness("failure", payload);
   }
@@ -422,14 +432,12 @@ var RevenueReporter = class _RevenueReporter {
       );
     }
   }
-  /** Start the background retry loop. */
   startRetryLoop() {
     if (this.retryTimer) return;
     this.retryTimer = setInterval(() => {
       void this.drainPending();
     }, _RevenueReporter.RETRY_INTERVAL_MS);
   }
-  /** Stop the background retry loop. */
   stop() {
     if (this.retryTimer) {
       clearInterval(this.retryTimer);
@@ -466,8 +474,8 @@ var RevenueReporter = class _RevenueReporter {
   /**
    * Deliver one bounded batch from the durable queue.
    *
-   * Public so startup/recovery tests and operator tooling can drive the same
-   * drain the background timer uses without reaching into private state.
+   * Processes due, non-stale rows; failures back off up to five minutes and
+   * become terminal after 24 hours. Successful deliveries remove their rows.
    */
   async drainPending() {
     try {
@@ -517,13 +525,11 @@ var RevenueReporter = class _RevenueReporter {
       console.error("[revenue-reporter] Retry loop error:", err);
     }
   }
-  /** Durably queue one report of either kind, then try it once immediately. */
   async enqueue(kind, payload, label) {
     const id = await this.insertPending(this.db, kind, payload);
     void this.attemptDelivery(id, payload, kind, label).catch(() => {
     });
   }
-  /** Insert one pending report through either the pool or an open transaction. */
   async insertPending(q, kind, payload) {
     const id = randomUUID();
     await q.query(
@@ -575,7 +581,6 @@ var RevenueReporter = class _RevenueReporter {
     console.warn(`[revenue-reporter] delivery failed for ${id}: HTTP ${res.status} \u2014 will retry`);
     throw new Error(`Platform returned ${res.status}`);
   }
-  /** Mark a pending row terminal (stale) with a classification reason. */
   async markStale(id, reason) {
     await this.db.query(
       `UPDATE ${PENDING_DVM_REPORTS_TABLE} SET stale = true, stale_reason = $1 WHERE id = $2`,

package/dist/{chunk-CEOAHV2I.js → chunk-FDKRXOZO.js}

@@ -162,13 +162,11 @@ var SpanWriter = class {
       void this.flush().catch(noop);
     }
   }
-  /** Start periodic flush to the transport. */
   startFlush() {
     this.flushTimer = setInterval(() => {
       void this.flush().catch(noop);
     }, this.flushIntervalMs);
   }
-  /** Stop periodic flush. */
   stopFlush() {
     if (this.flushTimer) {
       clearInterval(this.flushTimer);
@@ -216,12 +214,10 @@ var SpanWriter = class {
       this.flushing = false;
     }
   }
-  /** Flush remaining spans on shutdown. */
   async shutdown() {
     this.stopFlush();
     await this.flush();
   }
-  /** Number of spans dropped due to buffer overflow. */
   getDropCount() {
     return this.dropCount;
   }
@@ -229,7 +225,6 @@ var SpanWriter = class {
   getTruncatedSpanCount() {
     return this.truncatedSpanCount;
   }
-  /** Current buffer size. */
   getBufferSize() {
     return this.buffer.length;
   }

package/dist/{chunk-L4OYF4DQ.js → chunk-FT6HTUM4.js}

@@ -28,7 +28,7 @@ var PostgresReplayStore = class {
   async init() {
     await withSdkInitLock(this.pool, () => this.createTables());
   }
-  /** The boot DDL itself — always runs under {@link withSdkInitLock} (internal-review). */
+  /** The boot DDL itself — always runs under {@link withSdkInitLock}. */
   async createTables() {
     await this.pool.query(`
       CREATE TABLE IF NOT EXISTS ${this.tableName} (

package/dist/{chunk-BTZY7VPH.js → chunk-GAIPXGM3.js}

@@ -8,7 +8,7 @@ import {
 import {
   InvalidCurrencyError,
   validateCurrency
-} from "./chunk-27V2ILSR.js";
+} from "./chunk-4A2RAKCW.js";
 import {
   parseUsdPrice
 } from "./chunk-AT6V3SY7.js";

package/dist/{chunk-U6M3ATSG.js → chunk-JDT5LCJC.js}

@@ -1,7 +1,7 @@
 import {
   StepCache,
   loggers
-} from "./chunk-E4EVGPDX.js";
+} from "./chunk-XQXJKJ3P.js";
 import {
   redactUrl
 } from "./chunk-FUJ36YDV.js";
@@ -23,6 +23,11 @@ function toJobRecord(job) {
     authRequestPath: job.authRequestPath,
     status: job.status,
     summary: job.summary,
+    timingKnown: job.timingKnown,
+    endedBy: job.endedBy,
+    terminalAtMs: job.terminalAtMs,
+    callerWaitMs: job.callerWaitMs,
+    awaitingInputAtMs: job.awaitingInputAtMs,
     messages: job.messages,
     seq: job.seq,
     paidMsats: job.paidMsats,
@@ -69,6 +74,11 @@ function fromJobRecord(record) {
     requesterTokenHash: record.requesterTokenHash,
     status: record.status,
     summary: record.summary,
+    timingKnown: record.timingKnown,
+    endedBy: record.endedBy,
+    terminalAtMs: record.terminalAtMs,
+    callerWaitMs: record.callerWaitMs,
+    awaitingInputAtMs: record.awaitingInputAtMs,
     messages: [...record.messages],
     seq: record.seq,
     paidMsats: record.paidMsats,
@@ -138,11 +148,12 @@ function providerMessage(job, type, content) {
     const pendingPaymentDelta = typeof paymentRequest.amount_msats === "number" ? paymentRequest.amount_msats : void 0;
     const pendingMppChallengeIds = paymentRequest.tempo?.challenges?.map((challenge) => challenge.id).filter((id) => typeof id === "string");
     job.messageAppender?.(msg, {
+      awaitingInput: job.status === "awaiting-input",
       pendingPaymentDelta,
       pendingMppChallengeIds,
       pendingX402Nonce: typeof paymentRequest.x402?.nonce === "string" ? paymentRequest.x402.nonce : void 0,
       pendingX402AmountUsdcMicro: typeof paymentRequest.x402?.required_usdc_micro === "string" ? paymentRequest.x402.required_usdc_micro : void 0,
-      // internal-review: read off the job rather than the content — the fiat envelope
+      // read off the job rather than the content — the fiat envelope
       // is ledger state, not part of the wire shape, and `requestPayment` has
       // already pinned it on the job by the time this fires (same ordering the
       // `pendingPaymentMsats` comment above describes).
@@ -151,7 +162,7 @@ function providerMessage(job, type, content) {
     });
     return;
   }
-  job.messageAppender?.(msg);
+  job.messageAppender?.(msg, type === "prompt" ? { awaitingInput: job.status === "awaiting-input" } : void 0);
 }
 function localMessage(job, from, type, content) {
   job.seq++;
@@ -215,9 +226,7 @@ var MemoryJobStore = class {
   notifySubscribers = /* @__PURE__ */ new Map();
   reactivationLocks = /* @__PURE__ */ new Set();
   requestIdClaims = /* @__PURE__ */ new Map();
-  /** Per-DVM monotonic receipt counter (internal-review) — the `receipt_counter` row. */
   receiptCounter = 0;
-  /** Receipt sequence already allocated to a job, keyed by job id. */
   receiptSeqs = /* @__PURE__ */ new Map();
   get(id) {
     const record = this.data.get(id);
@@ -280,7 +289,10 @@ var MemoryJobStore = class {
       return Promise.resolve();
     }
     const snapshot = structuredClone(record);
+    if (existing) snapshot.createdAt = existing.createdAt;
     if (existing?.receipt) snapshot.receipt = existing.receipt;
+    snapshot.timingKnown = existing ? existing.timingKnown ?? false : record.timingKnown ?? true;
+    applyTiming(snapshot, existing, Date.now());
     this.data.set(record.id, snapshot);
     const cur = this.nextSeq.get(record.id) ?? 1;
     this.nextSeq.set(record.id, Math.max(cur, record.seq + 1));
@@ -351,6 +363,10 @@ var MemoryJobStore = class {
     }
     const seq = this.allocateSeq(jobId);
     const fullMessage = { ...message, seq };
+    if (opts?.awaitingInput && !isTerminal(record.status)) {
+      applyTiming(record, structuredClone(record), Date.now(), "awaiting-input");
+      record.status = "awaiting-input";
+    }
     this.messagesFor(jobId).push({ message: fullMessage, status: "verified" });
     if (opts?.pendingPaymentDelta !== void 0) {
       if (opts.pendingPaymentDelta !== 0) {
@@ -503,6 +519,7 @@ var MemoryJobStore = class {
   claimForProcessing(jobId) {
     const record = this.data.get(jobId);
     if (record?.status !== "awaiting-input") return Promise.resolve(false);
+    applyTiming(record, structuredClone(record), Date.now(), "processing");
     record.status = "processing";
     record.lastActivityAt = Date.now();
     return Promise.resolve(true);
@@ -565,7 +582,6 @@ var MemoryJobStore = class {
     this.notifySubscribers.clear();
     return Promise.resolve();
   }
-  // ── Internal helpers ──────────────────────────────────────────────────
   /**
    * Shared body of `cancelStaleJob` (activity cutoff supplied) and `cancelJob`
    * (`null` cutoff — unconditional). Mirrors `PostgresJobStore.terminateJob`:
@@ -586,6 +602,8 @@ var MemoryJobStore = class {
       content: { reason }
     };
     this.messagesFor(jobId).push({ message: cancelMsg, status: "verified" });
+    record.endedBy = expectedActivityBefore === null || record.status === "awaiting-input" ? "caller" : "provider";
+    applyTiming(record, structuredClone(record), Date.now(), terminalStatus);
     record.status = terminalStatus;
     record.summary = record.summary ?? reason;
     record.messages = [...record.messages, cancelMsg];
@@ -645,6 +663,22 @@ function snapshotCounters(record) {
     summary: record.summary
   };
 }
+function applyTiming(next, prior, now, status = next.status) {
+  if (prior && isTerminal(prior.status)) {
+    next.endedBy = prior.endedBy;
+    next.terminalAtMs = prior.terminalAtMs;
+    next.callerWaitMs = prior.callerWaitMs;
+    next.awaitingInputAtMs = void 0;
+    return;
+  }
+  const start = prior?.awaitingInputAtMs ?? (prior?.status === "awaiting-input" ? prior.lastActivityAt : void 0);
+  next.callerWaitMs = (prior?.callerWaitMs ?? next.callerWaitMs ?? 0) + (start !== void 0 && status !== "awaiting-input" ? Math.max(0, now - start) : 0);
+  next.awaitingInputAtMs = status === "awaiting-input" ? start ?? now : void 0;
+  if (isTerminal(status)) {
+    next.terminalAtMs = now;
+    next.endedBy = status === "completed" ? void 0 : next.endedBy ?? "provider";
+  }
+}
 
 // src/sdk/server/instrumented-fetch.ts
 function createInstrumentedFetch(signal) {

package/dist/{chunk-FROTD5XQ.js → chunk-JLXYOV4Y.js}

@@ -12,12 +12,11 @@ var PostgresKVStore = class {
   async init() {
     await withSdkInitLock(this.pool, () => this.createTables());
   }
-  /** The boot DDL itself — always runs under {@link withSdkInitLock} (internal-review). */
   async createTables() {
     await this.pool.query(`
       -- Single-tenant KV table aligned with the platform's isolate storage schema.
       -- The only structural difference is the absence of dvm_id (SDK is single-DVM-per-DB).
-      -- Any column addition should land on both schemas; see M06 / internal-review for the convergence precedent.
+      -- Keep column additions aligned with the platform isolate schema.
       CREATE TABLE IF NOT EXISTS kv_store (
         key        TEXT PRIMARY KEY,
         value      JSONB NOT NULL,

package/dist/{chunk-M7LHFJ5K.js → chunk-KMZXTBLA.js}

@@ -454,7 +454,7 @@ function buildMppMethods(opts, env) {
         // Without this mppx installs `Store.memory()`, so the consumed-hash
         // guard is per-process and a credential replayed onto a sibling machine
         // (or after a restart) reaches a broadcast the chain then rejects
-        // instead of a cheap refusal (internal-review).
+        // instead of a cheap refusal.
         ...opts.tempoCharge && { store: opts.tempoCharge.store }
       })
     );
@@ -468,7 +468,7 @@ function buildMppMethods(opts, env) {
           // A server-driven settle/close must spend fees from the same TIP-20
           // token the channel carries. Leaving this implicit lets an account's
           // stale fee preference win even when that token has too little left
-          // to broadcast, while the channel token is funded (internal-review).
+          // to broadcast, while the channel token is funded.
           feeToken: tempoCurrency,
           decimals: 6,
           unitType: "request",

package/dist/{chunk-6BQM7TOW.js → chunk-L67WTZX2.js}

@@ -200,7 +200,6 @@ var PayoutReporter = class {
       warn("payout_flush_failed", { error: message(err) });
     }
   }
-  // ── cashu ─────────────────────────────────────────────────────────────
   /** The hook `mark-melted` runs inside its transaction: the mark and its payout commit together. */
   meltHook() {
     return {
@@ -262,7 +261,6 @@ var PayoutReporter = class {
       void this.snapshotCashu();
     }
   }
-  // ── tempo ─────────────────────────────────────────────────────────────
   /** The host attaches the session store and ledger readers once they exist. */
   attachTempo(reader) {
     this.tempo = reader;
@@ -307,7 +305,7 @@ var PayoutReporter = class {
     };
   }
   /**
-   * The operator repaired a wedged cooperative close (internal-review). The close's
+   * The operator repaired a wedged cooperative close. The close's
    * payee side landed on chain when the close did; if the live hook reported
    * it, this upgrades that row to `repair`, otherwise it is the row. The
    * figure is the receipt's payee total for the channel.
@@ -345,7 +343,6 @@ var PayoutReporter = class {
       void this.snapshotTempo();
     }
   }
-  // ── x402 ──────────────────────────────────────────────────────────────
   /** The observer the batch-settlement server attaches to and routes its manager through. */
   x402Observer() {
     return {
@@ -370,7 +367,7 @@ var PayoutReporter = class {
    * every settle closes it. The claim delta is read off storage rather than
    * off upstream's result, which carries only a voucher count; under the
    * fleet lock the before/after read is consistent. A channel the claim
-   * removed on its way through — a refund's claim-then-delete (internal-review) —
+   * removed on its way through — a refund's claim-then-delete —
    * moved whatever it still owed before it went, and that value reaches
    * `pay_to` in this batch too, so it counts at its pre-claim figure.
    */
@@ -502,7 +499,6 @@ var PayoutReporter = class {
       warn("payout_batch_track_failed", { scope: ctx.scope, error: message(trackErr) });
     }
   }
-  // ── snapshots ─────────────────────────────────────────────────────────
   /** Every rail this reporter can read, each on its own failure boundary. */
   async snapshot() {
     await this.snapshotCashu();
@@ -639,7 +635,7 @@ var PayoutReporter = class {
   /**
    * Tempo: each active channel's spent-but-unsettled balance — earned, not
    * yet paid to the recipient — and the cooperative closes wedged between
-   * chain and ledger (internal-review), aged past the same floor the repair queue
+   * chain and ledger, aged past the same floor the repair queue
    * uses so an in-flight close is not reported as stuck.
    */
   async snapshotTempo() {

package/dist/{chunk-CGKZDODG.js → chunk-MG67KXU7.js}

@@ -30,7 +30,6 @@ var PROTECTED_CONFIG_FIELDS = ["nwcUri", "defaultIdentity", "tempo", "x402"];
 var ProtectedFieldAuthorization = class {
   /** Targets this authorization covers. A field also covers its own leaves. */
   targets;
-  /** Prefer {@link authorizeProtectedRemoval}; this exists for it to call. */
   constructor(targets) {
     this.targets = [...targets];
   }
@@ -304,11 +303,7 @@ function protectedRemovalError(targets, reason) {
 }
 var PROTECTED_FIELDS = {
   nwcUri: { aliases: [], credentialLeaves: [], secret: true, hexCredential: false },
-  // A pointer at a key, not a key: worth protecting from removal, and never
-  // worth stripping out of a stored copy — that is recovery lost for nothing.
   defaultIdentity: { aliases: [], credentialLeaves: [], secret: false, hexCredential: false },
-  // `mpp` is the pre-internal-review name; a caller who has not run a mutating command
-  // since the rename still has their private key under it.
   tempo: { aliases: ["mpp"], credentialLeaves: ["apiKey"], secret: true, hexCredential: true },
   x402: { aliases: [], credentialLeaves: ["privateKey"], secret: true, hexCredential: true }
 };

package/dist/{chunk-JZWELPFH.js → chunk-MRAGS5VP.js}

@@ -106,7 +106,7 @@ var PostgresTempoChargeStore = class {
       client.release();
     }
   }
-  /** The boot DDL itself — always runs under {@link withSdkInitLock} (internal-review). */
+  /** The boot DDL itself — always runs under {@link withSdkInitLock}. */
   async createTables() {
     await this.pool.query(`
       CREATE TABLE IF NOT EXISTS ${this.tableName} (

package/dist/{chunk-2UUXIIOC.js → chunk-O2X2CCKH.js}

@@ -2,7 +2,7 @@ import {
   isValidEvmPrivateKey,
   loadConfig,
   updateConfig
-} from "./chunk-CGKZDODG.js";
+} from "./chunk-MG67KXU7.js";
 import {
   DvmError,
   resolveRpcHttpTransportOptions,
@@ -101,7 +101,7 @@ async function generateTempoKey(opts = {}) {
     );
   }
   if (existing && opts.force) {
-    const { assertTempoWalletIdle } = await import("./tempo-lifecycle-DFIXQ54Q.js");
+    const { assertTempoWalletIdle } = await import("./tempo-lifecycle-DXM7QXJQ.js");
     await assertTempoWalletIdle("replace");
   }
   const { privateKeyToAccount, generatePrivateKey } = await import("viem/accounts");
@@ -155,7 +155,7 @@ async function getTempoUsdcBalance(account) {
       usdc: Number(raw) / 1e6,
       tokenAddress,
       chainId: network.chainId,
-      // internal-review: redacted here rather than at a display surface, so the clear
+      // redacted here rather than at a display surface, so the clear
       // endpoint never leaves this function on the success path either.
       rpcUrlRedacted: redactUrl(rpcUrl),
       rpcSource,