@dvmkit/sdk 0.1.5-rc.8 → 0.2.0-rc.9

package/dist/{job-store-BUGqvCfL.d.ts → job-store-B2uZvga4.d.ts}

@@ -1,5 +1,5 @@
 import { ProofLike } from '@cashu/cashu-ts';
-import { a1 as Message, ah as FundingMethod, X as FundingReceipt, bO as CreditSnapshot, Y as JobReceipt, ax as StepRecord, a2 as MessageType } from './step-cache-5dljDqrQ.js';
+import { a1 as Message, ah as FundingMethod, X as FundingReceipt, bO as CreditSnapshot, Y as JobReceipt, ax as StepRecord, a2 as MessageType } from './step-cache-CXg7ziML.js';
 
 /** Job status values that can be persisted. */
 type JobStatus = "processing" | "completed" | "failed" | "awaiting-input" | "cancelled" | "working";
@@ -8,7 +8,7 @@ interface JobRecord {
     id: string;
     tags: string[];
     /**
-     * Capability name this job dispatches to (internal-review). Populated from the
+     * Capability name this job dispatches to. Populated from the
      * `POST /v1/job` body's `capability` field at submission time; persisted
      * so reactivation on another machine routes to the same handler.
      */
@@ -18,7 +18,7 @@ interface JobRecord {
     requesterId: string;
     /**
      * SHA-256 hex of the per-job opaque token issued at creation time for
-     * anonymous requesters (internal-review). When set, all `/v1/job/:id/*` reads/writes
+     * anonymous requesters. When set, all `/v1/job/:id/*` reads/writes
      * gate on the caller presenting the matching `X-Job-Token` header — this is
      * the mechanism that prevents cross-caller transcript leaks for free DVMs
      * where every caller otherwise resolves to `requesterId === "anonymous"`.
@@ -27,7 +27,7 @@ interface JobRecord {
      */
     requesterTokenHash?: string;
     /**
-     * The `job_token` itself, in the clear (internal-review). Kept so a caller whose
+     * The `job_token` itself, in the clear. Kept so a caller whose
      * paid submit timed out can replay it and be handed back the very token the
      * lost response carried — the alternative (minting a fresh one) would be
      * rejected by whichever machine is still running the job, since its
@@ -41,14 +41,14 @@ interface JobRecord {
      */
     requesterToken?: string;
     /**
-     * Fingerprint of the submission that created this job (internal-review) — see
+     * Fingerprint of the submission that created this job — see
      * `requestFingerprint`. The replay gate: a retried paid submit is handed the
      * original job only when it reproduces this.
      */
     requestFingerprint?: string;
     /**
      * secp256k1 x-only pubkey of the caller that signed the submission, on
-     * DVMs with descriptor-level auth (internal-review). Second half of the replay
+     * DVMs with descriptor-level auth. Second half of the replay
      * gate — the signature envelope is re-minted on every resume attempt, so
      * the identity behind it is pinned here instead.
      */
@@ -58,6 +58,16 @@ interface JobRecord {
     /** HTTP path whose live auth gate accepted the persisted caller proof. */
     authRequestPath?: string;
     status: JobStatus;
+    /** False on jobs accepted before complete lifecycle timing was available. */
+    timingKnown?: boolean;
+    /** SDK terminal attribution; never accepted from a handler. */
+    endedBy?: "caller" | "provider";
+    /** Unix ms when the terminal status committed; immutable afterwards. */
+    terminalAtMs?: number;
+    /** Accumulated awaiting-input time, excluding the currently open stretch. */
+    callerWaitMs?: number;
+    /** Unix ms at which the current awaiting-input stretch began. */
+    awaitingInputAtMs?: number;
     summary?: string;
     messages: Message[];
     seq: number;
@@ -68,22 +78,22 @@ interface JobRecord {
     /**
      * Settlement reference threaded into the platform revenue ledger
      * (`revenue_events.tx_hash`). EVM tx hash for x402, mppx `challenge.id`
-     * for mpp (internal-review); cashu accumulator path sets this to the
-     * `X-Cashu-Request-Id` UUID (internal-review). Persisted so it survives durable
+     * for mpp; cashu accumulator path sets this to the
+     * `X-Cashu-Request-Id` UUID. Persisted so it survives durable
      * replay.
      */
     paymentTxHash?: string;
     /** Chain transaction returned to callers recovering x402 or Tempo acceptance. */
     paymentTransactionHash?: string;
-    /** Rail-native upfront amount (sats / USDC microunits). internal-review. */
+    /** Rail-native upfront amount (sats or USDC microunits). */
     nativeAmount?: number;
-    /** Native asset tag — paired with `nativeAmount`. internal-review. */
+    /** Native asset tag paired with `nativeAmount`. */
     nativeAsset?: "sats" | "usdc" | "usdc.e" | "usd-cents";
-    /** Cashu flow discriminator written into `revenue_events.metadata.cashu_flow` (internal-review). */
+    /** Cashu flow discriminator written into `revenue_events.metadata.cashu_flow`. */
     cashuFlow?: "p2pk_accumulator";
     /**
      * What this job cost the **builder** to serve, in 1e-6 of
-     * {@link JobRecord.costCurrency} (internal-review). Mirror of
+     * {@link JobRecord.costCurrency}. Mirror of
      * `ServerJob.costAmountMicro`; see that field. Absent means unreported,
      * which the platform treats differently from a declared zero.
      */
@@ -97,12 +107,12 @@ interface JobRecord {
      */
     costRevision?: number;
     /**
-     * Credit the upfront payment funded/drew (internal-review). The terminal funnel
+     * Credit the upfront payment funded/drew. The terminal funnel
      * settles the draw on success and releases it on failure/cancel, and the
      * receipt countersigns the `ReceiptCredit` block from it.
      */
     creditId?: string;
-    /** The draw placed for this job on `creditId` (internal-review). */
+    /** The draw placed for this job on `creditId`. */
     drawId?: string;
     /** Funding-time evidence returned on explicit fund-and-draw submissions. */
     fundingReceipt?: FundingReceipt;
@@ -110,11 +120,11 @@ interface JobRecord {
     receivedProofs: ProofLike[];
     pendingPaymentMsats?: number;
     /**
-     * Per-job MPP credential binding (internal-review). Challenge ids issued in the
+     * Per-job MPP credential binding. Challenge ids issued in the
      * most-recent `requestPayment` yield; the SDK rejects mid-job credentials
      * whose `challenge.id` isn't in this set.
      *
-     * Keeps its `mpp` spelling past internal-review's rail rename (internal-review). The ids
+     * Keeps its `mpp` spelling past rail rename. The ids
      * are mppx challenge ids — objects of the MPP envelope the Tempo rail rides,
      * which is not itself a rail — and this is server-internal anti-replay state
      * that is never serialised to a caller. It persists as
@@ -122,7 +132,7 @@ interface JobRecord {
      */
     pendingMppChallengeIds?: string[];
     /**
-     * Per-job x402 credential binding (internal-review). 0x-prefixed 32-byte hex nonce
+     * Per-job x402 credential binding. 0x-prefixed 32-byte hex nonce
      * issued in the most-recent `requestPayment` yield; the SDK rejects mid-job
      * x402 payments whose decoded `authorization.nonce` differs from this value.
      */
@@ -135,7 +145,7 @@ interface JobRecord {
     pendingX402AmountUsdcMicro?: string;
     /**
      * The outstanding `requestPayment` ask denominated in fiat micro-units, pinned
-     * when the payment-request was emitted (internal-review) — the mid-job analogue of
+     * when the payment-request was emitted — the mid-job analogue of
      * `resolvePriceFiat` pinning the quote. The ledger is fiat-denominated, so the
      * top-up's `fund` + `growDraw` need a figure that doesn't move with the BTC/USD
      * rate between the ask and the payment. Absent when the ask couldn't be priced
@@ -146,7 +156,7 @@ interface JobRecord {
     pendingPaymentFiatCurrency?: string;
     /**
      * What this job has **cumulatively** asked for mid-job, in fiat micro-units
-     * of {@link askedTopUpCurrency} (internal-review) — the ceiling `growDraw` caps the
+     * of {@link askedTopUpCurrency} — the ceiling `growDraw` caps the
      * job's draw growth at. Monotonic: written by the same Tx A that emits each
      * payment-request, and never decremented, which is exactly what
      * `pendingPaymentFiatMicro` is not (Tx C drains it as payments land). A cap
@@ -154,7 +164,7 @@ interface JobRecord {
      * in the window before Tx C see a full ask that the winner had already
      * bought.
      *
-     * `-1` is a sticky "not expressible" sentinel — after internal-review the one door
+     * `-1` is a sticky "not expressible" sentinel — after the one door
      * left to it is an ask the rate provider was down for. Undefined means no
      * mid-job ask has been recorded (including a row written before this
      * existed). Either way the cap is skipped and growth is unbounded, as it was
@@ -163,13 +173,13 @@ interface JobRecord {
     askedTopUpMicro?: number;
     /**
      * Currency of {@link askedTopUpMicro} (lowercase ISO-4217) — and, from
-     * internal-review, the job's own ask denomination: first-write-wins, and read back
+     * the job's own ask denomination: first-write-wins, and read back
      * by `ctx.requestPayment` so every later ask pins in it too. That is what
      * makes a mid-job currency switch unexpressible rather than merely unlikely.
      */
     askedTopUpCurrency?: string;
     /**
-     * Why this job's draw growth is **not** capped, when it isn't (internal-review) —
+     * Why this job's draw growth is **not** capped, when it isn't —
      * the durable half of the `-1` sentinel, so an operator can list the affected
      * jobs after the fact rather than reconstruct them from log lines. Sticky
      * first-writer-wins, like the sentinel itself. Null on every job whose ceiling
@@ -179,7 +189,7 @@ interface JobRecord {
     /** Price the job was charged at (msats). Used to detect overpayment for change/melt gating. */
     requiredMsats?: number;
     /**
-     * The DVM-signed proof of this job's outcome (internal-review). Written once at the
+     * The DVM-signed proof of this job's outcome. Written once at the
      * terminal transition via `saveReceipt` and never rewritten — `save` leaves
      * the column alone so a stale in-memory snapshot can't clear it. Absent on
      * non-terminal jobs, and on every job when the DVM has no receipt key wired.
@@ -194,8 +204,8 @@ interface JobRecord {
 }
 /**
  * Counter snapshot used by the NOTIFY-driven resolver and the
- * `verifyAndCredit` flow (internal-review). Carries just the handler-visible state
- * needed to decide whether a pending payment yield can resolve, plus (internal-review)
+ * `verifyAndCredit` flow. Carries just the handler-visible state
+ * needed to decide whether a pending payment yield can resolve, plus
  * the terminal reason so a machine adopting another machine's cancel can hand
  * the caller's own words to `ctx.signal.reason` and the `onCancel` hook.
  */
@@ -211,7 +221,7 @@ interface JobCounters {
     summary?: string;
 }
 /**
- * Credit delta written inside the Tx C transaction (internal-review) when an
+ * Credit delta written inside the Tx C transaction when an
  * inbound payment verifies. Fields mirror what the rails produce in
  * `payment.ts`; `paidMsatsDelta` is the only required key.
  */
@@ -230,7 +240,7 @@ interface PaymentCreditDelta {
     /** Clear the pending nonce + advertised amount after an x402 credit succeeds. */
     clearPendingX402Binding?: boolean;
     /**
-     * Credit this payment funded (internal-review). Only ever set when the mid-job
+     * Credit this payment funded. Only ever set when the mid-job
      * top-up minted a *fresh* implicit credit — a free-then-paid job whose
      * upfront leg placed no draw. Written set-if-null: a job already bound to a
      * credit keeps that binding, because the top-up grew its existing draw
@@ -242,12 +252,14 @@ interface PaymentCreditDelta {
 }
 /** Atomic side effects applied with an outgoing provider message. */
 interface AppendOutgoingOptions {
+    /** A suspending SDK prompt/payment yield; event-driven messages leave status unchanged. */
+    awaitingInput?: boolean;
     pendingPaymentDelta?: number;
     pendingMppChallengeIds?: string[];
     pendingX402Nonce?: string;
     pendingX402AmountUsdcMicro?: string;
     /**
-     * Fiat envelope pinned for this ask (internal-review). Accumulates alongside
+     * Fiat envelope pinned for this ask. Accumulates alongside
      * `pendingPaymentDelta` when the currency matches what's already recorded,
      * and replaces it when it doesn't — the same shape `pending_payment_msats`
      * uses, so stacked asks stay summable.
@@ -256,16 +268,16 @@ interface AppendOutgoingOptions {
     pendingPaymentFiatCurrency?: string;
 }
 /**
- * Why a job's cumulative ask total can't bound its draw growth (internal-review).
+ * Why a job's cumulative ask total can't bound its draw growth.
  *
  * - `ask_unpriceable` — an ask the rate provider was down for, or one whose
- *   fiat figure isn't a safe integer. The only door left after internal-review, and
- *   deliberately still open: failing the charge to protect a ledger comparison
- *   would break a payment that doesn't need the rate to be quoted or collected.
+ * fiat figure isn't a safe integer. The only door left after and
+ * deliberately still open: failing the charge to protect a ledger comparison
+ * would break a payment that doesn't need the rate to be quoted or collected.
  * - `ask_currency_switch` — two asks on one job in different denominations.
- *   Unreachable through `ctx.requestPayment`, which pins every ask in the job's
- *   own sticky denomination; kept as the backstop for a record written by an
- *   older build, and because the accumulator must not silently sum two units.
+ * Unreachable through `ctx.requestPayment`, which pins every ask in the job's
+ * own sticky denomination; kept as the backstop for a record written by an
+ * older build, and because the accumulator must not silently sum two units.
  */
 type TopUpCapUnenforcedReason = "ask_unpriceable" | "ask_currency_switch";
 /**
@@ -278,7 +290,7 @@ interface VerifyAndCreditResult {
     alreadyVerified: boolean;
     /**
      * The credit the job row holds **after** this call — the authoritative
-     * answer, read back rather than assumed (internal-review).
+     * answer, read back rather than assumed.
      *
      * {@link PaymentCreditDelta.creditId} is written set-if-null, so a caller
      * that passes one cannot know whether it won the bind: on a free-then-paid
@@ -318,7 +330,7 @@ interface JobStore {
     /** Retrieve a job record by ID. Returns undefined if not found. */
     get(id: string): Promise<JobRecord | undefined>;
     /**
-     * Retrieve the job a settlement reference paid for (internal-review). On the cashu
+     * Retrieve the job a settlement reference paid for. On the cashu
      * accumulator path `paymentTxHash` is the caller's `X-Cashu-Request-Id`, so
      * this is what makes a retried paid submit idempotent: the replay finds the
      * job its (already-spent) payment created instead of a bare 409.
@@ -347,7 +359,6 @@ interface JobStore {
     releaseRequestIdClaim?(claim: RequestIdClaim): Promise<void>;
     /** Upsert a job record. */
     save(record: JobRecord): Promise<void>;
-    /** Delete a job record. */
     delete(id: string): Promise<void>;
 }
 /** Total-order cursor for terminal job retention scans. */
@@ -356,7 +367,7 @@ interface JobRetentionCursor {
     id: string;
 }
 /**
- * JobStore extension for signed job receipts (internal-review). Implemented by both
+ * JobStore extension for signed job receipts. Implemented by both
  * container-tier stores (`MemoryJobStore`, `PostgresJobStore`); the isolate
  * tier's `IsolateJobStore` deliberately doesn't, which is what keeps the
  * out-of-scope isolate gap a compile-time fact rather than a runtime surprise.
@@ -385,24 +396,24 @@ interface ReceiptIssuingStore {
     saveReceipt(jobId: string, receipt: JobReceipt): Promise<JobReceipt | undefined>;
 }
 /**
- * JobStore extension for cross-machine message streaming + the internal-review
+ * JobStore extension for cross-machine message streaming + the
  * transactional model (Tx A / Tx B / Tx C).
  *
  * Tx A — outgoing message + immediate counter consequence (`appendOutgoing`).
- *   Single tx: server-allocate seq, append `job_messages` row with
- *   `status='verified'`, bump `pending_payment_msats` for payment-request
- *   messages, and `pg_notify`.
+ * Single tx: server-allocate seq, append `job_messages` row with
+ * `status='verified'`, bump `pending_payment_msats` for payment-request
+ * messages, and `pg_notify`.
  *
  * Tx B — incoming message marked `pending-verification` (`recordInbound`).
- *   Single tx: server-allocate seq, append `job_messages` row with
- *   `status='pending-verification'`, and `pg_notify`. External verification
- *   (Cashu mint, x402 facilitator, MPP server) runs OUTSIDE the tx.
+ * Single tx: server-allocate seq, append `job_messages` row with
+ * `status='pending-verification'`, and `pg_notify`. External verification
+ * (Cashu mint, x402 facilitator, MPP server) runs OUTSIDE the tx.
  *
  * Tx C — verification outcome + credit (`verifyAndCredit`). Single tx:
- *   flip the `job_messages.status` to `'verified'`, bump `paid_msats` /
- *   clear `pending_payment_msats` per the credit delta, and `pg_notify`.
- *   Idempotent — a repeat call returns `alreadyVerified: true` without
- *   re-crediting.
+ * flip the `job_messages.status` to `'verified'`, bump `paid_msats` /
+ * clear `pending_payment_msats` per the credit delta, and `pg_notify`.
+ * Idempotent — a repeat call returns `alreadyVerified: true` without
+ * re-crediting.
  */
 interface StreamableJobStore extends JobStore {
     /**
@@ -430,7 +441,7 @@ interface StreamableJobStore extends JobStore {
     verifyAndCredit(jobId: string, seq: number, credit: PaymentCreditDelta | null): Promise<VerifyAndCreditResult>;
     /**
      * Read back what Tx C committed for an inbound message, without opening a
-     * transaction of its own (internal-review).
+     * transaction of its own.
      *
      * A `verifyAndCredit` that throws is ambiguous: the error may have been
      * raised at or after its COMMIT, in which case the write is durable and the
@@ -454,7 +465,7 @@ interface StreamableJobStore extends JobStore {
     /** Read the counters used by the resolver (status / paid / pending). */
     getCounters(jobId: string): Promise<JobCounters | undefined>;
     /**
-     * Single-execution claim (internal-review). Atomically flip a job from
+     * Single-execution claim. Atomically flip a job from
      * `awaiting-input` to `processing`, returning `true` only for the caller
      * that won the transition. After a mid-job payment lands cross-machine, the
      * live original handler (woken via NOTIFY) and a reactivation replay on the
@@ -490,13 +501,13 @@ interface StreamableJobStore extends JobStore {
     /**
      * Subscribe to raw NOTIFY events for a job. Fires once per `pg_notify`
      * delivery; no message decoding. Used by `Context.requestPayment` to
-     * re-read counters when cross-machine credit lands (internal-review).
+     * re-read counters when cross-machine credit lands.
      */
     subscribeNotifications(jobId: string, onNotify: () => void): Promise<() => void>;
     /** Read messages from the `job_messages` table for a job. */
     getMessages(jobId: string, afterSeq: number): Promise<Message[]>;
     /**
-     * Find stale non-terminal jobs (internal-review / internal-review). Two status-aware
+     * Find stale non-terminal jobs. Two status-aware
      * cutoffs (both Unix ms): `processing`/`working` rows older than
      * `processingThresholdMs` (worker-liveness watchdog — the SDK heartbeats
      * live workers, so a frozen `last_activity_at` here means the worker died),
@@ -515,7 +526,7 @@ interface StreamableJobStore extends JobStore {
     /**
      * Atomically transition a stale job to `terminalStatus` (`failed` for a
      * dead worker, `cancelled` for an idle caller-wait) and append a final
-     * `cancel` message in the same transaction (internal-review / internal-review). The
+     * `cancel` message in the same transaction. The
      * `expectedActivityBefore` clause is an optimistic CAS — the flip only
      * lands when the job is still non-terminal AND `last_activity_at <=
      * expectedActivityBefore`. Returns true when this caller claimed the
@@ -525,8 +536,8 @@ interface StreamableJobStore extends JobStore {
      */
     cancelStaleJob(jobId: string, expectedActivityBefore: number, reason: string, terminalStatus: "failed" | "cancelled"): Promise<boolean>;
     /**
-     * Atomically cancel a job from a machine that isn't running its handler
-     * (internal-review). Same transaction shape as {@link cancelStaleJob} minus the
+     * Atomically cancel a job from a machine that isn't running its handler.
+     * Same transaction shape as {@link cancelStaleJob} minus the
      * activity cutoff — the CAS guards only on the job still being non-terminal,
      * so this replaces the read-then-`save` the DELETE route used to do (a TOCTOU
      * against a concurrent terminal write).
@@ -541,7 +552,7 @@ interface StreamableJobStore extends JobStore {
     cancelJob(jobId: string, reason: string): Promise<boolean>;
     /**
      * Bump `last_activity_at` to `now` (Unix ms) for the given jobs that are
-     * still in `processing`/`working` (internal-review worker heartbeat). Called on a
+     * still in `processing`/`working`. Called on a
      * tick by the `JobManager` for its locally-active jobs so a live worker's
      * row stays fresh and the processing watchdog only fires when the process
      * has actually died. A no-op for rows that have since gone terminal or
@@ -571,7 +582,7 @@ interface OutgoingMessage {
  */
 declare function isStreamableJobStore(store: JobStore): store is StreamableJobStore;
 /**
- * The stale-job reaper surface (internal-review) — the two methods a sweeper needs to
+ * The stale-job reaper surface — the two methods a sweeper needs to
  * find and atomically reap worker-stranded jobs. A strict subset of
  * `StreamableJobStore`: `MemoryJobStore` and `PostgresJobStore` satisfy it via
  * the full streamable interface, and the platform's `IsolateJobStore` (a plain

package/dist/{lightning-backend-BozcevPZ.d.ts → lightning-backend-CQBnQgsT.d.ts}

@@ -1,4 +1,4 @@
-import { W as JsonValue } from './step-cache-5dljDqrQ.js';
+import { W as JsonValue } from './step-cache-CXg7ziML.js';
 
 declare const lockPubkeyBrand: unique symbol;
 /**
@@ -23,11 +23,9 @@ type LockPubkey = string & {
 declare function toLockPubkey(raw: string): LockPubkey;
 
 /**
- * Canonical deploy-time attestation payload (internal-review). One signature serves
+ * Canonical deploy-time attestation payload. One signature serves
  * both auth-on-deploy and the `/v1/info#builder` attestation — the bytes the
- * builder signs are the canonical JSON of this object. Making a field required
- * also requires the coordinated fleet-before-caller release note in
- * `public compatibility guide`.
+ * builder signs are the canonical JSON of this object.
  */
 interface AttestationPayload {
     /** Immutable platform or self-hosted DVM identifier this attestation applies to. */
@@ -35,12 +33,12 @@ interface AttestationPayload {
     /** DVM slug the attestation applies to (must match the deploy request's slug). */
     slug: string;
     /** sha256(`canonicaliseForSigning(capabilities)`) hex. Binds the attestation
-     *  to the capability shape declared at deploy time. */
+     * to the capability shape declared at deploy time. */
     capabilities_hash: string;
     /** Builder identity x-only secp256k1 pubkey, hex (32 bytes / 64 chars). */
     builder_pubkey: string;
     /**
-     * Per-DVM receipt-signing x-only pubkey, hex (internal-review). Binds the key the
+     * Per-DVM receipt-signing x-only pubkey, hex. Binds the key the
      * deployed DVM signs job receipts with to the cold builder identity: the
      * builder signs this payload, so a receipt verifying under
      * `receipt_pubkey` inherits the builder's authority.
@@ -54,14 +52,12 @@ interface AttestationPayload {
     /** Unix seconds at which the attestation was signed. */
     deployed_at: number;
 }
-/** Result of {@link generateIdentity}: hex pubkey + hex secret. */
 interface BuilderIdentityKeypair {
     /** secp256k1 BIP-340 x-only pubkey, 32 bytes hex (64 chars). */
     pubkey: string;
     /** secp256k1 secret, 32 bytes hex (64 chars). */
     secret: string;
 }
-/** Generate a fresh BIP-340 Schnorr keypair for builder identity. */
 declare function generateIdentity(): BuilderIdentityKeypair;
 /**
  * Read the builder identity secret from `~/.dvmkit/builder.key`. Returns
@@ -96,7 +92,7 @@ declare function writeIdentity(keypair: BuilderIdentityKeypair, opts?: {
  */
 declare function hashCapabilities(capabilities: JsonValue): string;
 /**
- * Assemble the deploy-time attestation payload (internal-review). `deployedAt`
+ * Assemble the deploy-time attestation payload. `deployedAt`
  * defaults to the current Unix second; tests can pin it for reproducibility.
  */
 declare function buildAttestation(args: {
@@ -104,8 +100,8 @@ declare function buildAttestation(args: {
     slug: string;
     capabilities: JsonValue;
     builderPubkey: string;
-    /** Receipt-signing pubkey to attest (internal-review). Omitted when the deploy path
-     *  can't provision the matching `DVMKIT_RECEIPT_KEY`. */
+    /** Receipt-signing pubkey to attest. Omitted when the deploy path
+     * can't provision the matching `DVMKIT_RECEIPT_KEY`. */
     receiptPubkey?: string;
     deployedAt?: number;
 }): AttestationPayload;
@@ -126,7 +122,7 @@ declare function verifyAttestation(payload: AttestationPayload, signatureHex: st
 
 /**
  * Per-method amount limits a mint advertises on its NUT-4 / NUT-5 bolt11/sat
- * entry (internal-review). Both values are in the method's own unit — `sat` here,
+ * entry. Both values are in the method's own unit — `sat` here,
  * never msats.
  *
  * `null` means the mint advertised nothing in that direction, which reads as
@@ -167,7 +163,7 @@ interface MintHealthCheckResult {
      * is not switched off (`disabled: true`). Distinct from
      * {@link bolt11SatMintSupported}, which only asks whether the method exists:
      * a mint in melt-only recovery keeps advertising the method and turns the
-     * flag on. Consulted when picking a funding default (internal-review).
+     * flag on. Consulted when picking a funding default.
      */
     mintingEnabled?: boolean;
     /** Same question for NUT-05 (melt) — whether the mint can currently pay out. */
@@ -176,12 +172,11 @@ interface MintHealthCheckResult {
      * True when the mint can currently serve `/v1/swap` — see {@link canSwap} for
      * why an unadvertised NUT-3 reads as `true`. This is what a per-call spend
      * needs, so a `false` here is the reason a spend routes around this mint
-     * (internal-review).
      */
     swapEnabled?: boolean;
     /**
      * Amount limits the mint advertises for issuing (NUT-04 bolt11/sat), in sats
-     * (internal-review). Consulted when picking a funding default and when refusing an
+     * Consulted when picking a funding default and when refusing an
      * amount locally, so a fund outside the range never opens a Lightning quote.
      */
     mintAmountBounds?: MintAmountBounds;
@@ -191,7 +186,7 @@ interface MintHealthCheckResult {
      * True when the mint passes the full {@link assertNutSupport} gate — every
      * required NUT present (not `supported: false`) and bolt11/sat on NUT-4 +
      * NUT-5. The runtime `MintHealthTracker` treats a mint as healthy only when
-     * this is true, reproducing the boot-time NUT gate post-`listen` (internal-review).
+     * this is true, reproducing the boot-time NUT gate post-`listen`.
      */
     nutCompliant?: boolean;
     /** Raw `nuts` object from the `/v1/info` response. Used by `assertNutSupport`. */
@@ -202,7 +197,6 @@ interface MintHealthCheckResult {
         message: string;
     };
 }
-/** Tunables for `checkMintHealth`. */
 interface CheckMintHealthOptions {
     /** Per-attempt timeout in ms. Default: 5000. */
     timeoutMs?: number;
@@ -221,11 +215,10 @@ interface CheckMintHealthOptions {
 declare function checkMintHealth(mintUrl: string, opts?: CheckMintHealthOptions): Promise<MintHealthCheckResult>;
 /**
  * Whether the mint can currently serve `/v1/swap` — the operation every
- * per-call Cashu payment depends on (internal-review).
+ * per-call Cashu payment depends on.
  *
  * **An absent NUT-3 means yes.** Swap is a baseline mint operation and healthy
- * mints do not enumerate it — neither coinos nor lnvoltz advertises a `"3"` key
- * (see `public design rationale`).
+ * mints do not enumerate it — neither coinos nor lnvoltz advertises a `"3"` key.
  * Reading silence as "incapable" would rule out every working mint.
  *
  * A mint that has *switched swaps off* does say so: a mint in melt-only
@@ -250,11 +243,11 @@ declare function amountBoundsVerdict(sats: number, bounds?: MintAmountBounds): A
 /**
  * Assert that a mint's NUT-06 `nuts` object advertises all required capabilities.
  * Two-phase check:
- *   1. Dict-level — each NUT in `requiredNuts` must be present and not have
- *      `supported: false`. Throws naming the missing NUT numbers and mint URL.
- *   2. Method-level — NUT-4 and NUT-5 must each advertise a `bolt11`/`sat`
- *      entry in their `methods` array (covers NUT-23). Throws naming the
- *      missing method.
+ * 1. Dict-level — each NUT in `requiredNuts` must be present and not have
+ * `supported: false`. Throws naming the missing NUT numbers and mint URL.
+ * 2. Method-level — NUT-4 and NUT-5 must each advertise a `bolt11`/`sat`
+ * entry in their `methods` array (covers NUT-23). Throws naming the
+ * missing method.
  */
 declare function assertNutSupport(mintUrl: string, nuts: Record<string, unknown>, requiredNuts?: readonly number[]): void;
 
@@ -269,7 +262,6 @@ interface CreatedInvoice {
     /** Unix milliseconds when the invoice expires. */
     expiresAt: number;
 }
-/** Result of looking up an invoice's settlement status. */
 interface InvoiceStatus {
     /** True once the invoice has been paid and preimage is known. */
     settled: boolean;

package/dist/{memory-credit-ledger-MNUOTQO5.js → memory-credit-ledger-ZOH6C3N4.js}

@@ -1,7 +1,7 @@
 import {
   MemoryCreditLedger
-} from "./chunk-KVEHHC7W.js";
-import "./chunk-MLRCSJYX.js";
+} from "./chunk-PHHAYRQV.js";
+import "./chunk-V7EVFLAK.js";
 import "./chunk-S3XAHZQY.js";
 import "./chunk-C3MTFLC6.js";
 export {

package/dist/{mpp-setup-4FJD6ZHV.js → mpp-setup-IOJBF7DB.js}

@@ -17,7 +17,7 @@ import {
   parseMppMethodsAllowlist,
   resolveTempoNetwork,
   wrapMppx
-} from "./chunk-M7LHFJ5K.js";
+} from "./chunk-KMZXTBLA.js";
 export {
   MPPX_HMAC_MISMATCH_REASON,
   TEMPO_MAINNET_CHAIN_ID,

package/dist/{payout-reporter-RG6XNGPI.js → payout-reporter-5PIRYFVQ.js}

@@ -3,7 +3,7 @@ import {
   PAYOUT_SNAPSHOT_INTERVAL_MS,
   PayoutReporter,
   PostgresX402BatchStore
-} from "./chunk-6BQM7TOW.js";
+} from "./chunk-L67WTZX2.js";
 import "./chunk-S3XAHZQY.js";
 export {
   MemoryX402BatchStore,

package/dist/{postgres-consumed-credential-store-VHBT4KEA.js → postgres-consumed-credential-store-ISRHBMOU.js}

@@ -27,7 +27,7 @@ var PostgresConsumedCredentialStore = class {
   async init() {
     await withSdkInitLock(this.pool, () => this.createTables());
   }
-  /** The boot DDL itself — always runs under {@link withSdkInitLock} (internal-review). */
+  /** The boot DDL itself — always runs under {@link withSdkInitLock}. */
   async createTables() {
     await this.pool.query(`
       CREATE TABLE IF NOT EXISTS ${this.tableName} (

package/dist/{postgres-job-store-3RAXMNSY.js → postgres-job-store-OGQ6IT4U.js}

@@ -1,6 +1,6 @@
 import {
   PostgresJobStore
-} from "./chunk-SSSZUVWM.js";
+} from "./chunk-QP53RWAD.js";
 import "./chunk-S3XAHZQY.js";
 export {
   PostgresJobStore

package/dist/{postgres-kv-store-JFBDP5IP.js → postgres-kv-store-D5E2EZ24.js}

@@ -1,6 +1,6 @@
 import {
   PostgresKVStore
-} from "./chunk-FROTD5XQ.js";
+} from "./chunk-JLXYOV4Y.js";
 import "./chunk-S3XAHZQY.js";
 export {
   PostgresKVStore

package/dist/{postgres-replay-store-UJXRT6VO.js → postgres-replay-store-IZFLTTAC.js}

@@ -1,6 +1,6 @@
 import {
   PostgresReplayStore
-} from "./chunk-L4OYF4DQ.js";
+} from "./chunk-FT6HTUM4.js";
 import "./chunk-S3XAHZQY.js";
 export {
   PostgresReplayStore

package/dist/{pricing-4CEB34RM.js → pricing-MU5GNUJZ.js}

@@ -12,7 +12,7 @@ import {
   resolveFxSourceFromEnv,
   validateCurrency,
   warmFxSnapshot
-} from "./chunk-27V2ILSR.js";
+} from "./chunk-4A2RAKCW.js";
 import {
   InvalidFxRateError,
   InvalidUsdPriceError,

package/dist/{processed-payment-store-HAA4SFNK.js → processed-payment-store-FIDI3RNH.js}

@@ -2,7 +2,7 @@ import {
   MemoryProcessedPaymentStore,
   PostgresProcessedPaymentStore,
   ProcessedPaymentReplayError
-} from "./chunk-DMNLFNTW.js";
+} from "./chunk-QT4ONTST.js";
 import "./chunk-S3XAHZQY.js";
 export {
   MemoryProcessedPaymentStore,

package/dist/{revenue-reporter-ASZ7SHHH.js → revenue-reporter-NNCNRY4C.js}

@@ -1,6 +1,6 @@
 import {
   RevenueReporter
-} from "./chunk-EVBK675R.js";
+} from "./chunk-6GRIKOFB.js";
 import "./chunk-S3XAHZQY.js";
 export {
   RevenueReporter