@dvmkit/sdk 0.1.5-rc.8 → 0.2.0-rc.9

package/dist/{step-cache-5dljDqrQ.d.ts → step-cache-CXg7ziML.d.ts}

@@ -25,11 +25,8 @@ declare class InvalidCurrencyError extends Error {
     constructor(raw: unknown);
 }
 /**
- * Thrown by the SDK's mid-job fiat-form `requestPayment` when the operator
- * passes a currency the runtime can't live-convert to sats. v1 supports only
- * "usd" (the bundled fx fetcher is USD/BTC); EUR/GBP/JPY land when a
- * multi-currency fx fetcher does. The message names the supported set so
- * operators see exactly what's missing.
+ * A valid currency code that the configured FX snapshot cannot price.
+ * The error message names the supported set so the builder can correct it.
  */
 declare class UnsupportedCurrencyError extends Error {
     readonly raw: string;
@@ -128,7 +125,7 @@ interface X402Config {
      * When true (default), the SDK includes x402 `PaymentRequirements` on the
      * 402 response body alongside MPP's `WWW-Authenticate: Payment` header so
      * x402-speaking agents (Coinbase reference client, thirdweb-ecosystem)
-     * can pay. Flip to `false` for MPP-only DVMs (internal-review).
+     * can pay. Flip to `false` for MPP-only DVMs.
      */
     dualServe?: boolean;
     /** Human-readable description carried on the `PaymentRequirements`. */
@@ -156,7 +153,7 @@ interface X402Receipt {
     verified: boolean;
     amountMsats: number;
     /**
-     * Native USDC amount in 6-decimal microunits (internal-review). Captured from the
+     * Native USDC amount in 6-decimal microunits. Captured from the
      * payment payload's `value` field so the platform revenue ledger records
      * the rail-native value without re-deriving it from `amountMsats` + a
      * fresh BTC rate (lossy and racy across the boundary).
@@ -166,7 +163,7 @@ interface X402Receipt {
     txHash?: string;
     /**
      * Base64-encoded `SettleResponse` for the `X-PAYMENT-RESPONSE` header the
-     * server attaches to the 2xx response per x402 spec (internal-review).
+     * server attaches to the 2xx response per x402 spec.
      */
     settleResponseHeader?: string;
     /** When `verified === false`, a short stable code surfacing the reason. */
@@ -197,13 +194,13 @@ type X402Version = typeof X402_V1_VERSION | typeof X402_VERSION;
 /**
  * Chain a caller's x402 wallet reads when it was connected without an explicit
  * `--network`. Single source of truth for the default: the wallet loader, the
- * connect output and the asset resolver all read it from here (internal-review).
+ * connect output and the asset resolver all read it from here.
  */
 declare const X402_DEFAULT_NETWORK = "eip155:8453";
 /**
  * Scheme name of the per-call rail — one signed authorization settling one
  * resource. Shared with the credit funding menu's `x402.schemes` block, which
- * has to name the same string the requirement carries (internal-review).
+ * has to name the same string the requirement carries.
  */
 declare const X402_EXACT_SCHEME = "exact";
 /**
@@ -212,7 +209,7 @@ declare const X402_EXACT_SCHEME = "exact";
  * the caller's requirement selection, and the credit menu's `x402.schemes`
  * block all read it from here — the menu advertises exactly what the challenge
  * will carry, so a rename cannot leave one of them advertising a flavour the
- * others no longer speak (internal-review).
+ * others no longer speak.
  */
 declare const X402_BATCH_SETTLEMENT_SCHEME = "batch-settlement";
 
@@ -410,29 +407,24 @@ declare function decodePaymentRequiredHeader(header: string): PaymentRequiredV2;
 declare function exactEvmAuthorization(payload: PaymentPayload): ExactEvmPayloadAuthorization;
 /**
  * Encode a `SettleResponse` for the `X-PAYMENT-RESPONSE` header that the
- * server emits on a 2xx after a successful settlement (internal-review, per the
+ * server emits on a 2xx after a successful settlement (per the
  * x402 spec).
  */
 declare function encodeSettleResponseHeader(response: SettleResponse): string;
 
-/** Identifies which side of the conversation sent a message. */
 type MessageFrom = "requester" | "provider";
 /** Single mppx-shaped MPP challenge carried in `payment-request` messages. */
 type MppxChallenge = Challenge.Challenge;
 /** Structured MPP credential (`{ challenge, payload, source? }`) carried in `payment` messages. */
 type MppxCredential = Credential.Credential;
-/** All supported message types in the conversation protocol. */
 type MessageType = "text" | "prompt" | "response" | "artifact" | "payment-request" | "payment" | "approval" | "cancel" | "complete" | "working" | "progress";
-/** Common fields shared by all message variants. */
 interface MessageBase {
     /** Monotonic sequence number, assigned by provider/server. */
     seq: number;
-    /** Which side sent this message. */
     from: MessageFrom;
     /** Unix timestamp (seconds). */
     timestamp: number;
 }
-/** Free-form text message content. */
 interface TextContent {
     text: string;
 }
@@ -453,15 +445,12 @@ interface ResponseContent {
 }
 /** Job output — inline data or a URL reference. */
 interface ArtifactContent {
-    /** Human-readable name for the artifact. */
     name?: string;
-    /** MIME type of the artifact. */
     mime_type?: string;
     /** Inline data (string or base64 for binary). */
     data?: string;
     /** Encoding of inline data: "utf-8" for text, "base64" for binary. */
     encoding?: "utf-8" | "base64";
-    /** URL to fetch the artifact from. */
     url?: string;
     /** Size in bytes (for URL-referenced artifacts). */
     size_bytes?: number;
@@ -487,7 +476,7 @@ interface PaymentRequestContent {
     mints?: string[];
     min_locktime_seconds?: number;
     /**
-     * NUT-11 P2PK lock pubkey the requester should lock cashu outputs to (internal-review).
+     * NUT-11 P2PK lock pubkey the requester should lock cashu outputs to.
      * When absent, the requester falls back to `/v1/info`'s `cashu.lock_pubkeys[0]`.
      */
     lock_pubkey?: string;
@@ -506,7 +495,7 @@ interface PaymentRequestContent {
          * caller MUST use when signing `TransferWithAuthorization` for this
          * payment-request. Binds the credential to this job so a payload signed
          * for job A cannot satisfy job B within the pre-settlement window
-         * (internal-review). Optional on the wire for backwards-compat — pre-fix DVMs
+         * Optional on the wire for backwards-compat — pre-fix DVMs
          * never set it; verify-side gate keys on `pendingX402Nonce !== undefined`.
          */
         nonce?: string;
@@ -527,7 +516,7 @@ interface PaymentContent {
     mint?: string;
     amount_msats?: number;
     /**
-     * UUIDv4 per-call identifier for the agent-wallet path (internal-review).
+     * UUIDv4 per-call identifier for the agent-wallet path.
      * Mid-job equivalent of the upfront flow's `X-Cashu-Request-Id` header —
      * threaded into the SDK accumulator's `(dvm_id, request_id)` replay key.
      */
@@ -545,7 +534,7 @@ interface PaymentContent {
      */
     tempo_credential?: MppxCredential;
     /**
-     * Dev-only: satisfy the ask with no proof at all (internal-review). The `/_dev`
+     * Dev-only: satisfy the ask with no proof at all. The `/_dev`
      * console has no wallet, so its auto-approve button sends this instead of a
      * rail credential. Admitted only by a `devMode` server, and only on a
      * message that carries none of the proofs above — money on the wire always
@@ -754,18 +743,9 @@ declare const requireClientCompatibility: ClientCompatibilityGate;
 declare function clientUpgradeRequired(c: Context, compatibility: ClientCompatibility, requirement: ClientCompatibilityRequirement): Response;
 
 /**
- * Canonical JSON serialisation used for secp256k1+BIP-340 Schnorr request
- * signing in cast (internal-review).
- *
- * Single source of truth for both the cast DVM's verifier (internal-review) and the
- * client signing helper (internal-review). The same function on both sides guarantees
- * that what the client signs is byte-identical to what the server hashes.
- *
  * Algorithm: recursively sort object keys lexicographically (UTF-16 code-unit
  * order — JavaScript's default), then JSON.stringify with no whitespace.
- * Arrays preserve order. Numbers, strings, booleans, null pass through as
- * `JSON.stringify` formats them. Values of `undefined` or functions are
- * forbidden (we throw rather than silently drop, since both sides must agree).
+ * Arrays preserve order.
  */
 /** Any JSON-serialisable value accepted by `canonicalize`. */
 type JsonValue = string | number | boolean | null | JsonValue[] | {
@@ -789,21 +769,18 @@ declare function canonicalize(value: JsonValue): string;
  */
 declare function canonicaliseForSigning(value: JsonValue): Uint8Array;
 
-/** Terminal outcome a receipt attests. Mirrors the SDK's terminal job statuses. */
 type ReceiptOutcome = "completed" | "failed" | "cancelled";
-/** What the caller paid for the job, as persisted on the job record. */
 interface ReceiptPayment {
     /** Total credited millisats. `0` on free jobs — they still get receipts. */
     msats: number;
     /**
      * Rail of the most recent successful credit; `null` when nothing was paid.
      * `lightning` appears on a draw against a credit the caller funded by
-     * invoice (internal-review) — it is a funding rail, never an attached-proof one.
+     * invoice — it is a funding rail, never an attached-proof one.
      */
     rail: "cashu" | "x402" | "tempo" | "lightning" | null;
     /** Rail-native upfront amount (sats / USDC microunits), `null` when absent. */
     native_amount: number | null;
-    /** Native asset tag paired with `native_amount`. */
     native_asset: string | null;
     /** Settlement reference: EVM tx hash (x402), mppx challenge id, or the Cashu request id. */
     tx_hash: string | null;
@@ -811,8 +788,8 @@ interface ReceiptPayment {
     mint: string | null;
 }
 /**
- * Credit-draw countersignature block (internal-review / internal-review; emitted since
- * internal-review). Present on every job whose payment funded/drew the credit
+ * Credit-draw countersignature block. Present on every job whose payment funded
+ * or drew the credit
  * ledger — including implicit N=1 per-job payments, which fund and draw a
  * single-use credit in the same request. A caller holding a DVM-signed
  * balance trajectory plus its own caller-signed draw intents can prove
@@ -820,23 +797,21 @@ interface ReceiptPayment {
  * because the countersignature rides the receipt.
  *
  * Absence is signature-compatible: `canonicalize` omits absent keys, so a
- * ledger-less (or free) job's receipt signs identically to a pre-internal-review
+ * ledger-less (or free) job's receipt signs identically to a legacy
  * receipt.
  */
 interface ReceiptCredit {
-    /** Credit the draw was taken against. */
     credit_id: string;
     /** This draw's identifier — matches the caller-signed draw intent. */
     draw_id: string;
     /** Amount drawn, in the credit's denomination. */
     amount: number;
-    /** Credit balance after this draw. */
     balance_after: number;
     /** Per-credit monotonic draw counter. */
     ledger_seq: number;
 }
 /**
- * A DVM-signed proof of what a job did and what it cost (internal-review).
+ * A DVM-signed proof of what a job did and what it cost.
  *
  * Signed once at the terminal transition by the per-DVM receipt key, whose
  * authority chains to the builder identity key through the deploy-time
@@ -845,18 +820,22 @@ interface ReceiptCredit {
  * and on every later re-read — the bytes are persisted, not recomputed.
  */
 interface JobReceipt {
-    /** Receipt schema version. Currently always `1`. */
     v: 1;
-    /** The job this receipt attests. */
     job_id: string;
     /** Immutable DVM identity bound into the builder attestation. */
     dvm_id: string;
     /** DVM slug, as bound in the builder attestation. */
     dvm: string;
-    /** Capability the job dispatched to. */
     capability: string;
-    /** Terminal outcome. */
     outcome: ReceiptOutcome;
+    /** Signed Unix millisecond lifecycle times; absent on legacy receipts. */
+    timing?: {
+        accepted_at_ms: number;
+        terminal_at_ms: number;
+        caller_wait_ms: number;
+    };
+    /** SDK-derived attribution on failure/cancellation; absent on completion and legacy receipts. */
+    ended_by?: "caller" | "provider";
     /** Terminal reason on `failed`/`cancelled` (e.g. `worker_died_mid_job`); `null` on success. */
     reason: string | null;
     /** Per-DVM monotonic terminal counter. Gaps expose receipt suppression. */
@@ -865,7 +844,6 @@ interface JobReceipt {
     issued_at: number;
     /** Caller's x-only pubkey when signed-request auth was used; `null` otherwise. */
     requester_pubkey: string | null;
-    /** What the caller paid. */
     paid: ReceiptPayment;
     /**
      * {@link computeResultHash} over the delivered result; `null` when nothing
@@ -878,7 +856,7 @@ interface JobReceipt {
     /** BIP-340 Schnorr signature over the canonical receipt minus `signature` (128 hex chars). */
     signature: string;
     /**
-     * Credit-draw countersignature (internal-review) — present when the job's payment
+     * Credit-draw countersignature — present when the job's payment
      * funded/drew the credit ledger. See {@link ReceiptCredit}. `balance_after`
      * reflects the terminal resolution: the recorded draw trajectory on a
      * settled (completed) job, the restored available balance on a released
@@ -886,12 +864,10 @@ interface JobReceipt {
      */
     credit?: ReceiptCredit;
 }
-/** A receipt before signing — every field but the signature itself. */
 type UnsignedJobReceipt = Omit<JobReceipt, "signature">;
-/** Reclaim lifecycle event a {@link DrainReceipt} attests (internal-review, spec §5). */
 type DrainReceiptEvent = "requested" | "parked" | "picked_up" | "sent" | "released";
 /**
- * A DVM-signed proof of one reclaim event (internal-review). One receipt per
+ * A DVM-signed proof of one reclaim event. One receipt per
  * lifecycle transition — `requested` (the balance debited into the drain
  * liability), `parked` (Cashu notes locked to the caller's refund key,
  * parked for pickup), `picked_up` (the caller collected them), `sent` (a
@@ -907,15 +883,12 @@ type DrainReceiptEvent = "requested" | "parked" | "picked_up" | "sent" | "releas
  * same canonicalisation, so one attestation chain covers both.
  */
 interface DrainReceipt {
-    /** Receipt schema version. Currently always `1`. */
     v: 1;
     /** Discriminator separating this from a `JobReceipt` in mixed stores. */
     kind: "credit_drain";
-    /** Credit the drain was taken against. */
     credit_id: string;
     /** This drain's identifier — matches the caller-signed drain request. */
     drain_id: string;
-    /** The lifecycle event this receipt attests. */
     event: DrainReceiptEvent;
     /** Payout rail: `cashu` | `x402` | `tempo`. */
     method: string;
@@ -942,19 +915,16 @@ interface DrainReceipt {
     /** BIP-340 Schnorr signature over the canonical receipt minus `signature`. */
     signature: string;
 }
-/** A drain receipt before signing — every field but the signature itself. */
 type UnsignedDrainReceipt = Omit<DrainReceipt, "signature">;
 /**
- * A DVM-signed proof that one payment funded a prepaid credit (internal-review).
+ * A DVM-signed proof that one payment funded a prepaid credit.
  * The balance and sequence are the values fixed when the funding committed;
  * retries return this original artifact even when the credit moved later.
  */
 interface FundingReceipt {
-    /** Receipt schema version. Currently always `1`. */
     v: 1;
     /** Discriminator separating funding evidence from job and drain receipts. */
     kind: "credit_funding";
-    /** Credit that received the value. */
     credit_id: string;
     /** Caller fund id, or the attached rail payment id for fund-and-draw. */
     fund_id: string;
@@ -972,12 +942,10 @@ interface FundingReceipt {
     dvm_id: string;
     /** DVM slug, as bound in the builder attestation. */
     dvm: string;
-    /** x-only secp256k1 pubkey that signed this receipt. */
     receipt_pubkey: string;
     /** BIP-340 Schnorr signature over the canonical receipt minus `signature`. */
     signature: string;
 }
-/** A funding receipt before signing. */
 type UnsignedFundingReceipt = Omit<FundingReceipt, "signature">;
 /**
  * Hash the delivered result so a receipt binds to *what* was returned, not
@@ -1042,9 +1010,7 @@ declare function isSignedJobReceipt(value: unknown): value is JobReceipt;
 declare function signDrainReceipt(unsigned: UnsignedDrainReceipt, secretHex: string): DrainReceipt;
 /** Sign an unsigned funding receipt using the common receipt canonicalisation. */
 declare function signFundingReceipt(unsigned: UnsignedFundingReceipt, secretHex: string): FundingReceipt;
-/** Structural guard for a funding receipt received over the wire or from disk. */
 declare function isFundingReceipt(value: unknown): value is FundingReceipt;
-/** Verify a funding receipt's inner BIP-340 signature. */
 declare function verifyFundingReceipt(receipt: FundingReceipt): boolean;
 /**
  * Structural guard on a drain receipt from outside this process — off a
@@ -1061,33 +1027,16 @@ declare function verifyFundingReceipt(receipt: FundingReceipt): boolean;
 declare function isDrainReceipt(value: unknown): value is DrainReceipt;
 /**
  * Verify a drain receipt's self-consistency, mirroring {@link verifyReceipt}
- * — the same provenance caveat applies: check `receipt_pubkey` against the
+ * the same provenance caveat applies: check `receipt_pubkey` against the
  * DVM's attested `receipt_pubkey` for the outer link.
  */
 declare function verifyDrainReceipt(receipt: DrainReceipt): boolean;
 
 /**
- * Funding lots: the in-kind basis of a non-channel Bitcoin credit (internal-review).
- *
- * A reusable Bitcoin credit is a deposit, and internal-review decided the provider
- * owes back the **asset it received** rather than a dollar figure re-priced at
- * reclaim time: fund 1,151 sats, draw 1.2% of the credit's value, reclaim
- * 98.8% of 1,151 sats. That obligation is only expressible if each funding
- * event's `{sats_funded, credited_micro}` pair survives — the ledger's pooled
- * `credits.msats_remaining` blends every funding into one ratio, which answers
- * a different question (what share of the credit's rail value does *this draw*
- * consume) and cannot say what a top-up taken at a different rate is worth.
- *
- * Everything here is pure integer arithmetic over that pair, shared by the
- * Postgres and in-memory ledgers so the two cannot drift — the arrangement
- * `allocateDrawValue` already holds for the pooled basis.
- *
- * Since internal-review these lots are also what a *settling* draw is priced at on
- * these rails, not only a reclaim: `inKindDrawMsats` turns the depletion a
- * settle already performs into the draw's booked rail value, so one credit has
- * one answer to "what were these sats" and the pooled remainder stops being a
- * second authority: settled draw sats plus reclaim sats must equal the sats
- * that credit's funding lots received.
+ * Cashu and Lightning credits owe unused sats back at each deposit's funding
+ * rate. Keep the sats/micro basis per funding lot: a pooled ratio loses the
+ * basis of top-ups made at different rates. Settled draws and reclaims share
+ * these lots so their total equals the sats funded.
  */
 /**
  * The rails whose credits carry a Bitcoin deposit this ledger owes back in
@@ -1100,9 +1049,7 @@ declare function verifyDrainReceipt(receipt: DrainReceipt): boolean;
  * {@link FundingMethod} must be a decision here rather than a default.
  */
 declare const NON_CHANNEL_BITCOIN_RAILS: readonly ["cashu", "lightning"];
-/** A rail whose unused credit is a sats deposit the provider owes back. */
 type NonChannelBitcoinRail = (typeof NON_CHANNEL_BITCOIN_RAILS)[number];
-/** True when `rail` funds a credit with sats the provider holds and owes back. */
 declare function isNonChannelBitcoinRail(rail: string | null | undefined): rail is NonChannelBitcoinRail;
 /**
  * One funding event's deposit: the sats that arrived and the credit micro they
@@ -1110,7 +1057,7 @@ declare function isNonChannelBitcoinRail(rail: string | null | undefined): rail
  *
  * `remainingMicro` is depleted FIFO by settled draws and by reclaims, so the
  * sum of a credit's lots tracks `credits.balance_micro` exactly — with one
- * deliberate exception: an expiry release (internal-review) zeroes the balance and
+ * deliberate exception: an expiry release zeroes the balance and
  * leaves the lots standing, because a revival restores that balance and its
  * in-kind basis has to still be there. A released credit is excluded from the
  * sweep floor by `BITCOIN_CREDIT_PREDICATE`'s own `balance_micro > 0`, so the
@@ -1124,24 +1071,19 @@ interface FundingLot {
     satsFunded: number;
     /** Credit micro this funding bought — the lot's denominator, never depleted. */
     creditedMicro: number;
-    /** Credit micro of this lot not yet drawn or reclaimed. */
     remainingMicro: number;
     /** Rail settlement reference, provenance only. */
     fundingRef: string | null;
     createdAt: number;
 }
-/** One lot's share of a depletion, and what that share is worth in kind. */
 interface LotDebit {
     lotId: string;
-    /** Credit micro taken out of this lot. */
     micro: number;
-    /** Sats that micro is worth at this lot's own funding rate, floored. */
+    /** Decrease in this lot's floored sats obligation after taking the micro debit. */
     sats: number;
 }
-/** What a FIFO depletion took, and what it could not cover. */
 interface LotDepletion {
     debits: LotDebit[];
-    /** In-kind value of everything taken — the reclaim obligation. */
     satsOwed: number;
     /** Micro the lots could not cover. Non-zero means the credit's lots are short. */
     uncoveredMicro: number;
@@ -1149,32 +1091,15 @@ interface LotDepletion {
     backedMicro: number;
 }
 /**
- * Take `amountMicro` out of `lots`, oldest first, and price what was taken at
- * each lot's own rate.
- *
- * FIFO rather than pro rata across the pool, so a top-up taken at a different
- * rate is reclaimed at *that* rate once the earlier deposit is spent. A
- * fraction of a satoshi cannot be handed back, so the conversion floors and
- * the dust stays with the provider rather than being rounded into a payout the
- * deposit does not cover.
- *
- * A slice is priced as the **decrement in the lot's own obligation** —
- * `lotSats(before) - lotSats(after)` — rather than by flooring the slice on
- * its own. The two agree whenever a lot is taken whole, which is every
- * ordinary reclaim; they diverge once a lot is drawn down in pieces, and there
- * the independent floor loses up to a satoshi *per piece*, permanently. That
- * matters since internal-review, where each settling draw is priced through here: the
- * slices have to telescope, or a lot spent over many jobs pays out less than
- * it took in and the residue is exactly the unattributable one this was meant
- * to remove. It also makes {@link lotOwedSats} exact rather than conservative
- * — the remaining obligation is precisely what future depletions will pay.
- *
- * `lots` must already be in FIFO order ({@link fifoOrder}).
+ * Deplete lots in FIFO order, supplied by fifoOrder. Price each debit as
+ * lotSats(before) - lotSats(after), not the independently floored slice: small
+ * draws then telescope to the full deposit instead of losing up to one sat
+ * per draw. Fractional remaining sats stay with the provider.
  */
 declare function depleteLots(lots: FundingLot[], amountMicro: number): LotDepletion;
 /**
  * What a settling draw's fiat debit was worth in kind, in millisatoshis
- * (internal-review) — `null` where the lots cannot price it.
+ * `null` where the lots cannot price it.
  *
  * This is the single sats authority for a non-channel Bitcoin credit. The
  * settle already depletes the lots the draw consumed, so the figure costs no
@@ -1196,25 +1121,9 @@ declare function inKindDrawMsats(depletion: LotDepletion, amountMicro: number):
  */
 declare function lotOwedSats(lots: FundingLot[]): number;
 /**
- * Sats held back from every non-channel Bitcoin reclaim to pay for handing it
- * over (internal-review).
- *
- * Delivering a refund costs money whichever way it is fulfilled: an
- * accumulator swap pays the mint's per-input fee, and a just-in-time mint pays
- * the mint's quote plus whatever the Lightning hop routes for. internal-review puts
- * that cost on the caller — but charging *actual* fees would mean re-publishing
- * a smaller figure after the reclaim was already promised, and internal-review fixed
- * `owed_sats` at request time precisely so it cannot move between the promise
- * and the payout. A flat reserve keeps both: the caller is quoted one final
- * number, net, and the provider spends the reserve on delivery.
- *
- * It is deliberately a constant rather than a policy knob. The figure only has
- * to cover a small mint fee and one Lightning hop — the live hub's last hop
- * measured 1.1 sats on a 2,000-sat payment (internal-review) — so there is headroom
- * without a number anyone has to tune, and a knob nobody sets is a knob that
- * drifts. What the reserve does not cover on some future expensive route is
- * absorbed, and what it over-covers stays with the provider as dust, the same
- * rule the per-lot flooring already follows.
+ * Refund delivery uses a fixed eight-sat reserve so owed_sats cannot shrink
+ * after it is promised. Extra delivery cost is absorbed by the provider;
+ * unused reserve stays with the provider, like fractional-sat dust.
  */
 declare const DRAIN_DELIVERY_RESERVE_SATS = 8;
 /**
@@ -1237,16 +1146,9 @@ declare function netOwedSats(grossSats: number): number;
  */
 declare function fifoOrder(left: FundingLot, right: FundingLot): number;
 /**
- * Whether a depletion may be settled in kind, or has to fall back to pricing
- * the fiat balance at a live rate.
- *
- * Both failure modes are real and neither is the caller's fault: a credit's
- * lots can be short (a coverage hole the boot backfill is meant to close), and
- * a credit funded before internal-review recorded a rail basis at all has lots whose
- * `satsFunded` is 0 — pricing *that* in kind would answer "we owe you nothing"
- * for a deposit we plainly hold. Mixed coverage is treated as unbacked too:
- * blending a lot rate with a live rate produces a figure neither basis
- * supports.
+ * Missing lot coverage or a zero legacy sats basis requires pooled pricing.
+ * Mixed backed/unbacked lots also fall back: combining lot and live rates
+ * would claim a value neither basis supports.
  */
 declare function isInKindDepletion(depletion: LotDepletion, amountMicro: number): boolean;
 
@@ -1353,7 +1255,7 @@ interface PayoutTransport {
 /**
  * A money-path hook whose report must commit with the fact it describes.
  * `enqueue` runs inside the caller's transaction, and a throw rolls the fact
- * back with it — the drain report's own discipline (internal-review): a call the
+ * back with it — the drain report's own discipline: a call the
  * caller has to repeat costs a round trip, where a landed movement with no
  * row understates paid-out forever. `committed` runs once that transaction
  * has committed, for the delivery and the snapshot that must not read
@@ -1396,7 +1298,7 @@ interface X402TrackedChannel {
     chargedCumulativeAmount: string;
     totalClaimed: string;
 }
-/** A refund settlement wedged between chain and ledger (internal-review), for the wedge list. */
+/** A refund settlement wedged between chain and ledger, for the wedge list. */
 interface X402WedgedRefund {
     settlementId: string;
     /** Epoch ms the settlement was first prepared. */
@@ -1585,7 +1487,7 @@ declare class PayoutReporter implements PayoutTransport {
     /** The hook `reconcile-tempo-drain` runs inside its transaction: the booking and its payout commit together. */
     tempoRepairHook(): TransactionalPayoutHook<TempoCloseReconciled>;
     /**
-     * The operator repaired a wedged cooperative close (internal-review). The close's
+     * The operator repaired a wedged cooperative close. The close's
      * payee side landed on chain when the close did; if the live hook reported
      * it, this upgrades that row to `repair`, otherwise it is the row. The
      * figure is the receipt's payee total for the channel.
@@ -1602,7 +1504,7 @@ declare class PayoutReporter implements PayoutTransport {
      * every settle closes it. The claim delta is read off storage rather than
      * off upstream's result, which carries only a voucher count; under the
      * fleet lock the before/after read is consistent. A channel the claim
-     * removed on its way through — a refund's claim-then-delete (internal-review) —
+     * removed on its way through — a refund's claim-then-delete —
      * moved whatever it still owed before it went, and that value reaches
      * `pay_to` in this batch too, so it counts at its pre-claim figure.
      */
@@ -1627,7 +1529,7 @@ declare class PayoutReporter implements PayoutTransport {
     /**
      * Tempo: each active channel's spent-but-unsettled balance — earned, not
      * yet paid to the recipient — and the cooperative closes wedged between
-     * chain and ledger (internal-review), aged past the same floor the repair queue
+     * chain and ledger, aged past the same floor the repair queue
      * uses so an in-flight close is not reported as stuck.
      */
     snapshotTempo(): Promise<void>;
@@ -1636,14 +1538,6 @@ declare class PayoutReporter implements PayoutTransport {
 /**
  * JSON wire shape POSTed to the platform's `/_internal/job-revenue` endpoint
  * and stored in `pending_dvm_reports.payload` for durable retry.
- *
- * The platform-side consumer is `OnJobCompleted`, implemented by
- * `createRevenueCallback`. Keep the two shapes in sync: the SDK and platform
- * deploy in lockstep, and any
- * backwards-incompatible field change requires a coordinated release. No `version`
- * field is included pre-launch because there are no external container-runtime
- * consumers yet; add one once the first third-party builder ships a container-runtime
- * DVM (trigger condition: external builder onboarded via `dvmctl deploy --container`).
  */
 interface RevenueReportPayload {
     /** Required. Platform DVM record ID (`dvms.id`). Identifies which DVM earned the revenue. */
@@ -1674,8 +1568,8 @@ interface RevenueReportPayload {
      */
     paymentTxHash?: string;
     /**
-     * Optional. Rail-native payment amount in atomic units: satoshis for `tempo`, USDC
-     * microunits for `x402`, USD cents for `stripe`. Omitted for `cashu` (platform derives
+     * Rail-native payment amount in atomic units: USDC microunits for `tempo` and
+     * `x402`, USD cents for `stripe`. Omitted for `cashu` (platform derives
      * `paidMsats / 1000`). Must be set together with `nativeAsset`.
      */
     nativeAmount?: number;
@@ -1687,14 +1581,14 @@ interface RevenueReportPayload {
     nativeAsset?: string;
     /**
      * Optional. Cashu flow discriminator. Set to `"p2pk_accumulator"` when the cashu
-     * accumulator path (internal-review) satisfied the job; omitted for legacy cashu. Written into
+     * accumulator path satisfied the job; omitted for legacy cashu. Written into
      * `revenue_events.metadata.cashu_flow` by the platform so ops can split per-call cashu
      * rows by source.
      */
     cashuFlow?: string;
     /**
      * Optional. What the job cost the **builder** to serve, as declared by the
-     * handler through `ctx.cost()` (internal-review) — the other half of the
+     * handler through `ctx.cost()` — the other half of the
      * margin the dashboard states. `amountMicro` is 1e-6 of `currency`, which
      * is the currency the builder incurred the cost in and need not be the
      * credit's.
@@ -1715,7 +1609,7 @@ interface RevenueReportPayload {
         currency: string;
     };
     /**
-     * Optional. Credit this job's payment drew against (internal-review). Present on
+     * Optional. Credit this job's payment drew against. Present on
      * every job a ledger-backed payment satisfied; its presence is what tells
      * the platform the row is a **draw-keyed** revenue event rather than a
      * pre-credits per-call one.
@@ -1738,14 +1632,27 @@ interface RevenueReportPayload {
     /**
      * Optional. Revenue class when this row is not ordinary service revenue.
      * `short_pay_forfeit` marks money kept from an underpayment that bought no
-     * job (internal-review operator ruling) so analytics can exclude it.
+     * job so analytics can exclude it.
      */
     kind?: string;
 }
+/** Privacy-preserving terminal evidence; contains no caller or payment references. */
+interface JobTerminalReportPayload {
+    dvmId: string;
+    jobId: string;
+    capability: string;
+    outcome: "completed" | "failed" | "cancelled";
+    endedBy: "caller" | "provider" | null;
+    paid: boolean;
+    acceptedAtMs: number;
+    terminalAtMs: number;
+    callerWaitMs: number;
+    receiptSeq: number | null;
+}
 /**
  * JSON wire shape POSTed to the platform's `/_internal/job-cost` endpoint
  * when a terminal job incurred a declared builder cost but produced no
- * revenue report (internal-review).
+ * revenue report.
  *
  * Unlike {@link RevenueReportPayload}, this event has no payment rail or
  * revenue amount: a failed, cancelled, or free job is not a sale. The
@@ -1781,8 +1688,8 @@ interface JobCostReportPayload {
 }
 /**
  * JSON wire shape POSTed to the platform's `/_internal/credit-deposit`
- * endpoint (internal-review). A funding event is a **deposit** — a liability until
- * drawn — reported separately and never summed into revenue (spec §10).
+ * endpoint. A funding event is a **deposit** — a liability until
+ * drawn — reported separately and never summed into revenue (the deposit-accounting rule).
  *
  * Idempotent on `(dvmId, creditId, fundingId)`, so the shared retry loop can
  * redeliver freely.
@@ -1790,13 +1697,12 @@ interface JobCostReportPayload {
 interface CreditDepositPayload {
     /** Required. Platform DVM record ID (`dvms.id`); must match the bearer token's DVM. */
     dvmId: string;
-    /** Required. Credit the funding landed on. */
     creditId: string;
     /** Required. Canonical owner of the funded credit. */
     callerPubkey: string;
     /** Required. The rail's settlement reference — the deposit's idempotency key. */
     fundingId: string;
-    /** Required. Payment rail (`"cashu"`, `"tempo"`, `"x402"`). */
+    /** Payment rail (`"cashu"`, `"tempo"`, `"x402"`). */
     rail: string;
     /** Required. Rail value received, in millisatoshis. */
     paidMsats: number;
@@ -1819,7 +1725,7 @@ interface CreditDepositPayload {
     /** Required. Current credit expiry after this funding committed (epoch ms). */
     expiryMs: number;
     /**
-     * Tempo session funding only (internal-review): the TIP-1034 channel this deposit
+     * Tempo session funding only: the TIP-1034 channel this deposit
      * arrived on, registered so the platform's close observer can route a
      * `CloseRequested` event back to the DVM that owns the channel.
      *
@@ -1841,14 +1747,14 @@ interface CreditDepositPayload {
         payee?: string;
     };
     /**
-     * Tempo session funding only (internal-review): which channel this deposit's voucher
+     * Tempo session funding only: which channel this deposit's voucher
      * was accepted on, emitted **whenever the funding was session-based** —
      * independently of whether {@link CreditDepositPayload.tempoChannel} could be
      * read. That independence is the entire point: `rail: "tempo"` covers both
      * `tempo/session` and the `tempo/charge` one-shot, and a charge legitimately
      * carries no channel at all, so without this the platform cannot tell a
      * routine charge deposit from a session whose chain binding was lost — the
-     * internal-review shape, where the close observer silently never watches the escrow.
+     * shape, where the close observer silently never watches the escrow.
      *
      * Carries only the channel id, not the chain binding: a DVM that could read
      * the binding sends `tempoChannel` too, and one that could not still names
@@ -1859,7 +1765,7 @@ interface CreditDepositPayload {
         channelId: string;
     };
     /**
-     * Set by the blocked-invoice repair (internal-review): this deposit is a paid
+     * Set by the blocked-invoice repair: this deposit is a paid
      * Lightning invoice the builder's agent reconciled onto a credit. The money
      * landed in the receive wallet at payment time and this deposit is the one
      * row it gets, so the settlements table types it `repair` off this flag
@@ -1869,7 +1775,7 @@ interface CreditDepositPayload {
 }
 /**
  * JSON wire shape POSTed to the platform's `/_internal/credit-draw-release`
- * endpoint (internal-review). A released hold leaves the credit balance intact, but
+ * endpoint. A released hold leaves the credit balance intact, but
  * marks that slice of the outstanding liability as failure churn rather than
  * untouched prefunding.
  *
@@ -1879,7 +1785,6 @@ interface CreditDepositPayload {
 interface CreditDrawReleasePayload {
     /** Required. Platform DVM record ID (`dvms.id`); must match the bearer token's DVM. */
     dvmId: string;
-    /** Required. Credit whose hold was released. */
     creditId: string;
     /** Required. Released draw; the platform idempotency key with DVM and credit. */
     drawId: string;
@@ -1892,11 +1797,10 @@ interface CreditDrawReleasePayload {
     /** Required. When the hold reached `released` (epoch ms). */
     releasedAt: number;
 }
-/** Repair verbs that can finish a caller-facing credit reclaim. */
 type CreditDrainRepairKind = "x402_settlement_reconciled" | "tempo_close_reconciled";
 /**
  * JSON wire shape POSTed to the platform's `/_internal/credit-drain`
- * endpoint (internal-review). A drain is a **reclaim**: deposited money paid back to
+ * endpoint. A drain is a **reclaim**: deposited money paid back to
  * the caller, which extinguishes the liability the funding created. Reported
  * so outstanding liability nets out to `deposited − drawn − drained`; never
  * summed into revenue, and never a revenue row — no job was sold.
@@ -1916,19 +1820,18 @@ type CreditDrainRepairKind = "x402_settlement_reconciled" | "tempo_close_reconci
 interface CreditDrainPayload {
     /** Required. Platform DVM record ID (`dvms.id`); must match the bearer token's DVM. */
     dvmId: string;
-    /** Required. Credit the reclaim came off. */
     creditId: string;
     /** Required. Canonical owner of the reclaimed credit. */
     callerPubkey: string;
     /** Required. The drain's own idempotency key. */
     drainId: string;
-    /** Required. Payout rail the reclaim shipped on (`"cashu"`, `"x402"`, `"tempo"`). */
+    /** Payout rail (`"cashu"`, `"x402"`, `"tempo"`). */
     method: string;
     /** Required. Fiat micro reclaimed — the liability this drain extinguishes. */
     amountMicro: number;
     /** Required. Currency `amountMicro` is 1e-6 of. */
     creditCurrency: string;
-    /** Required. Terminal state reached: `"picked_up"` (cashu) or `"sent"` (other rails). */
+    /** Terminal state: `"picked_up"` for cashu, `"sent"` for other rails. */
     status: string;
     /** Required. When the money left (epoch ms). */
     drainedAt: number;
@@ -1957,7 +1860,7 @@ type CreditDepositEnqueue = (tx: RevenueReporterQuerier, payload: CreditDepositP
 type CreditDrawReleaseEnqueue = (tx: RevenueReporterQuerier, payload: CreditDrawReleasePayload) => Promise<void>;
 /**
  * Transactional drain-outbox seam threaded through each terminal drain
- * transition (internal-review).
+ * transition.
  *
  * Implemented by {@link RevenueReporter.enqueueCreditDrain}; callers must await
  * it before committing the status CAS that moved the money.
@@ -1965,7 +1868,7 @@ type CreditDrawReleaseEnqueue = (tx: RevenueReporterQuerier, payload: CreditDraw
 type CreditDrainEnqueue = (tx: RevenueReporterQuerier, payload: CreditDrainPayload) => Promise<void>;
 /**
  * JSON wire shape POSTed to the platform's `/_internal/credit-expiry-release`
- * endpoint (internal-review). A prepaid credit that reaches its TTL with an undrawn
+ * endpoint. A prepaid credit that reaches its TTL with an undrawn
  * remainder RELEASES that remainder to the builder: on cashu, Lightning and
  * x402 the funding value reached builder custody at funding time or on the
  * settlement cycle, so expiry extinguishes the caller's remaining claim.
@@ -1981,10 +1884,10 @@ type CreditDrainEnqueue = (tx: RevenueReporterQuerier, payload: CreditDrainPaylo
  *
  * - **The release**, written by the expiry sweep with `reversedAt` absent.
  * - **The reversal**, written when a later funding revives the credit
- *   (`CreditLedger.fund` overwrites `expiry_ms`, so the recorded remainder is
- *   no longer final). It repeats the whole payload rather than sending a
- *   reference, because the retry loop can deliver the two out of order and the
- *   platform's upsert must be able to land either one first.
+ * (`CreditLedger.fund` overwrites `expiry_ms`, so the recorded remainder is
+ * no longer final). It repeats the whole payload rather than sending a
+ * reference, because the retry loop can deliver the two out of order and the
+ * platform's upsert must be able to land either one first.
  *
  * Idempotent on `(dvmId, creditId, releaseId)`, so the shared retry loop can
  * redeliver freely.
@@ -1992,11 +1895,9 @@ type CreditDrainEnqueue = (tx: RevenueReporterQuerier, payload: CreditDrainPaylo
 interface CreditExpiryReleasePayload {
     /** Required. Platform DVM record ID (`dvms.id`); must match the bearer token's DVM. */
     dvmId: string;
-    /** Required. Credit whose remainder expired. */
     creditId: string;
     /** Required. Per-expiry-episode key; the platform idempotency key with DVM and credit. */
     releaseId: string;
-    /** Required. Caller whose claim on the remainder ended. */
     callerPubkey: string;
     /** Funding rail. `null` on a credit funded before the basis became mandatory. */
     rail: string | null;
@@ -2013,7 +1914,7 @@ interface CreditExpiryReleasePayload {
 }
 /**
  * Transactional expiry-release outbox seam, threaded through the sweep's insert
- * and through the funding that reverses a release (internal-review).
+ * and through the funding that reverses a release.
  *
  * Implemented by {@link RevenueReporter.enqueueCreditExpiryRelease}; callers
  * must await it before committing the write that made the release (or its
@@ -2023,7 +1924,7 @@ interface CreditExpiryReleasePayload {
 type CreditExpiryReleaseEnqueue = (tx: RevenueReporterQuerier, payload: CreditExpiryReleasePayload) => Promise<void>;
 /**
  * JSON wire shape POSTed to the platform's `/_internal/paid-job-death` endpoint
- * (internal-review) when the stale-job reaper force-fails a *paid* job — its pending
+ * when the stale-job reaper force-fails a *paid* job — its pending
  * credit draw is released rather than settled, so the caller's payment is back
  * on their credit balance and reclaimable by drain. The platform resolves fiat
  * + owner and sends an ambient notice via the shared alert sink. Unlike
@@ -2034,15 +1935,13 @@ type CreditExpiryReleaseEnqueue = (tx: RevenueReporterQuerier, payload: CreditEx
 interface PaidJobDeathPayload {
     /** Required. Platform DVM record ID (`dvms.id`). Bound to the authenticating token. */
     dvmId: string;
-    /** Required. Job identifier the reaper force-failed. */
     jobId: string;
-    /** Required. Capability the job dispatched to (e.g. `"add-episode"`). */
     capability: string;
     /** Required. Amount of the released credit draw in millisatoshis. */
     paidMsats: number;
-    /** Required. Payment rail of the credit draw (`"cashu"` / `"tempo"` / `"x402"`). */
+    /** Payment rail of the released draw (`"cashu"`, `"tempo"`, `"x402"`). */
     rail: string;
-    /** Required. Terminal reason the reaper set: dead worker vs never-terminal idle. */
+    /** Reaper reason: dead worker or never-terminal idle job. */
     reason: string;
     /** Optional. Rail-native released amount, paired with `nativeAsset`. */
     nativeAmount?: number;
@@ -2051,11 +1950,10 @@ interface PaidJobDeathPayload {
     /** Optional. Cashu mint URL the credit draw's tokens were issued from. */
     paymentMint?: string;
 }
-/** Distinct causes for a settled credit draw that could not book revenue. */
 type RevenueSkippedNoRailReason = "credit_rail_null" | "credit_rail_unrecognized" | "job_rail_missing" | "ledger_not_configured";
 /**
  * JSON wire shape POSTed to the platform's `/_internal/revenue-skipped-no-rail`
- * endpoint (internal-review) when a settled credit draw has no usable payment rail
+ * endpoint when a settled credit draw has no usable payment rail
  * for its revenue event. This is an operator notice rather than a durable
  * accounting report: the SDK's structured log remains the durable backstop,
  * and a failed alert must never block terminal handling or reconciliation.
@@ -2063,11 +1961,8 @@ type RevenueSkippedNoRailReason = "credit_rail_null" | "credit_rail_unrecognized
 interface RevenueSkippedNoRailPayload {
     /** Required. Platform DVM record ID (`dvms.id`). Bound to the authenticating token. */
     dvmId: string;
-    /** Required. Job whose settled draw could not be booked. */
     jobId: string;
-    /** Required. Credit carrying the settled draw. */
     creditId: string;
-    /** Required. Settled draw that has no revenue event. */
     drawId: string;
     /** Required. Caller payment captured for the job, in millisatoshis. */
     paidMsats: number;
@@ -2077,7 +1972,6 @@ interface RevenueSkippedNoRailPayload {
     creditCurrency?: string;
     /** Credit funding rail as stored on the draw, or null for legacy rows. */
     creditRail: string | null;
-    /** Required classification of why the revenue rail was unavailable. */
     reason: RevenueSkippedNoRailReason;
 }
 /** Gas-balance observation POSTed by a platform-hosted x402 self-relay. */
@@ -2147,11 +2041,13 @@ interface TempoSettlementFailurePayload {
     drainId?: string;
 }
 /**
- * Durable revenue reporter for container-runtime DVMs (internal-review).
+ * Durable revenue reporter for container-runtime DVMs.
  *
  * On job completion the SDK calls `report()`, which persists the payload to
  * a local Postgres table and attempts an immediate POST to the platform.
  * A background retry loop picks up un-acked rows with exponential backoff.
+ * Gauge and health notifications are best-effort: failed delivery is logged
+ * and dropped rather than queued for retry.
  */
 declare class RevenueReporter {
     private readonly db;
@@ -2164,16 +2060,17 @@ declare class RevenueReporter {
     constructor(db: Pool, platformUrl: string, platformToken: string);
     /** Create the pending-reports table and migrate the legacy SDK outbox (idempotent). */
     init(): Promise<void>;
-    /** The boot DDL itself — always runs under {@link withSdkInitLock} (internal-review). */
     private createTables;
-    /** Copy rows from the old SDK-owned table without touching the platform's table of that name. */
     private migrateLegacySdkOutbox;
-    /** Refuse a pre-existing relation whose columns cannot safely serve as the SDK outbox. */
     private assertSdkTableShape;
     private assertSdkColumns;
     private tableColumns;
     /** Persist a revenue report and attempt immediate delivery. */
     report(payload: RevenueReportPayload): Promise<void>;
+    /** The permanent deduplication claim and outbox insert commit together.
+     * The claim survives successful delivery, including for custom job stores.
+     */
+    reportTerminal(payload: JobTerminalReportPayload): Promise<void>;
     /** Persist a zero-revenue job cost and attempt immediate delivery. */
     reportCost(payload: JobCostReportPayload): Promise<void>;
     /**
@@ -2187,21 +2084,18 @@ declare class RevenueReporter {
     /** Join a released draw to the transaction that made the hold terminal. */
     enqueueCreditDrawRelease(tx: RevenueReporterQuerier, payload: CreditDrawReleasePayload): Promise<void>;
     /**
-     * Join a credit drain to the transaction that made it terminal (internal-review).
+     * Join a credit drain to the transaction that made it terminal.
      *
      * Same discipline as {@link enqueueDeposit} and the same reason: no network
      * I/O here, only the durable queue row, written through `tx` so the report
      * and the status CAS commit or roll back together. A drain whose row was
      * lost between the two would overstate outstanding liability forever —
      * the mirror image of a lost deposit.
-     *
-     * Named for the payload rather than the verb because `drain` already means
-     * "flush the queue" in this class (see {@link drainPending}).
      */
     enqueueCreditDrain(tx: RevenueReporterQuerier, payload: CreditDrainPayload): Promise<void>;
     /**
      * Join a payout to the transaction that commits the movement it reports
-     * (internal-review) — the batch close, the accumulator mark, the drain booking.
+     * the batch close, the accumulator mark, the drain booking.
      * No network I/O, only the durable queue row through `tx`, the discipline
      * {@link enqueueCreditDrain} set and for the same reason: the money has
      * already moved on a rail this ledger does not own, so the platform row is
@@ -2219,7 +2113,7 @@ declare class RevenueReporter {
      */
     reportPayout(payload: PayoutReportPayload): Promise<void>;
     /**
-     * Report one rail's pending-pool snapshot (internal-review). Best-effort and
+     * Report one rail's pending-pool snapshot. Best-effort and
      * fire-and-forget, deliberately unlike {@link reportPayout}: a snapshot is
      * replaced by the next tick, so queueing a stale one behind an outage would
      * only deliver figures the platform already has newer ones for.
@@ -2227,7 +2121,7 @@ declare class RevenueReporter {
     reportPayoutPending(payload: PayoutPendingPayload): Promise<void>;
     /**
      * Join a credit-expiry release — or the revival that reverses one — to the
-     * transaction that made it true (internal-review).
+     * transaction that made it true.
      *
      * Same discipline as {@link enqueueCreditDrain}: no network I/O, only the
      * durable queue row written through `tx`. A release whose row was lost after
@@ -2237,7 +2131,7 @@ declare class RevenueReporter {
      */
     enqueueCreditExpiryRelease(tx: RevenueReporterQuerier, payload: CreditExpiryReleasePayload): Promise<void>;
     /**
-     * Report a reaper-force-failed paid job to the platform (internal-review) so the
+     * Report a reaper-force-failed paid job to the platform so the
      * operator receives an ambient notice that a DVM died or wedged mid-job.
      * Best-effort and fire-and-forget: unlike {@link report} there is no local
      * durable queue — a non-2xx or transport failure is structured-logged
@@ -2247,24 +2141,18 @@ declare class RevenueReporter {
      */
     reportPaidJobDeath(payload: PaidJobDeathPayload): Promise<void>;
     /**
-     * Report a settled draw whose revenue event was skipped (internal-review).
+     * Report a settled draw whose revenue event was skipped.
      * Best-effort and fire-and-forget: the SDK's structured
      * `revenue_skipped_no_rail` log is the durable backstop, so a failed notice
      * must never wedge terminal handling or the orphan-draw reconciler.
      */
     reportRevenueSkippedNoRail(payload: RevenueSkippedNoRailPayload): Promise<void>;
-    /** Report the self-relay's Base gas gauge for platform-side paging and recovery. */
     reportX402SelfRelayGasBalance(payload: X402SelfRelayGasBalancePayload): Promise<void>;
-    /** Report redacted self-relay RPC health for platform-side paging and recovery. */
     reportX402SelfRelayRpcHealth(payload: X402SelfRelayRpcHealthPayload): Promise<void>;
-    /** Report the Tempo operator's fee-token gauge for paging and recovery. */
     reportTempoSettlementBalance(payload: TempoSettlementBalancePayload): Promise<void>;
-    /** Report a redacted operator fee rejection immediately. */
     reportTempoSettlementFailure(payload: TempoSettlementFailurePayload): Promise<void>;
     private postTempoSettlementReadiness;
-    /** Start the background retry loop. */
     startRetryLoop(): void;
-    /** Stop the background retry loop. */
     stop(): void;
     /**
      * Operator-facing queue snapshot: distinguishes the live retry queue from
@@ -2280,16 +2168,13 @@ declare class RevenueReporter {
     /**
      * Deliver one bounded batch from the durable queue.
      *
-     * Public so startup/recovery tests and operator tooling can drive the same
-     * drain the background timer uses without reaching into private state.
+     * Processes due, non-stale rows; failures back off up to five minutes and
+     * become terminal after 24 hours. Successful deliveries remove their rows.
      */
     drainPending(): Promise<void>;
-    /** Durably queue one report of either kind, then try it once immediately. */
     private enqueue;
-    /** Insert one pending report through either the pool or an open transaction. */
     private insertPending;
     private attemptDelivery;
-    /** Mark a pending row terminal (stale) with a classification reason. */
     private markStale;
 }
 
@@ -2298,7 +2183,7 @@ type X402ChannelQuerier = Pick<Pool, "query">;
 /**
  * Durable phase of an irreversible x402 facilitator settlement.
  *
- * `written_off` is the operator's terminal (internal-review): a settlement whose
+ * `written_off` is the operator's terminal: a settlement whose
  * ledger leg cannot be completed, reviewed and closed so it leaves the repair
  * queue without pretending it booked. It is deliberately reversible — a later
  * reconcile still accepts it, because it moved nothing.
@@ -2317,7 +2202,7 @@ interface X402SettlementIntent {
     /**
      * The channel as it stood when the settlement was handed to the facilitator —
      * after the refund's mandatory on-chain refresh, which {@link channelBefore}
-     * precedes (internal-review).
+     * precedes.
      *
      * The facilitator sizes a cooperative refund from *live* state
      * (`balance − chargedCumulativeAmount`) and signs it against the *live*
@@ -2363,7 +2248,7 @@ interface X402SettlementPage {
     nextAfter?: X402SettlementCursor;
 }
 /**
- * Fleet-wide serialisation of the self-relay's chain submissions (internal-review).
+ * Fleet-wide serialisation of the self-relay's chain submissions.
  *
  * Narrow on purpose, and implemented by {@link PostgresX402ChannelStorage}: the
  * relay asks for one thing — exclusive use of its gas EOA for the length of one
@@ -2411,7 +2296,7 @@ interface X402RelayLockHolder {
  * fault in the payment: a fleet-mate whose RPC is retrying holds the lock, and
  * the same request works once it lets go. It refuses rather than proceeding —
  * two machines submitting from one EOA collide on the nonce — and it refuses
- * rather than blocking, which is the internal-review defect: the old acquire had no
+ * rather than blocking, which is the defect: the old acquire had no
  * `lock_timeout`, so a wedged holder pinned a host-pool client and a channel
  * advisory lock for as long as it took.
  */
@@ -2428,7 +2313,7 @@ interface X402SettlementWriteOff {
     intent: X402SettlementIntent;
     written: boolean;
 }
-/** The refund standing between a channel and the credit it backs (internal-review). */
+/** The refund standing between a channel and the credit it backs. */
 interface X402UnresolvedRefund {
     settlementId: string;
     /** `${creditId}:${drainId}` — the drain this settlement belongs to. */
@@ -2436,7 +2321,7 @@ interface X402UnresolvedRefund {
     status: X402SettlementStatus;
 }
 /**
- * The credit ledger's read into durable x402 settlement state (internal-review).
+ * The credit ledger's read into durable x402 settlement state.
  *
  * Narrow on purpose: the ledger asks one question — is this channel's refund
  * still unresolved — and must not acquire the ability to move a settlement.
@@ -2454,7 +2339,7 @@ interface X402RefundSettlementGate {
  * transaction to the credit ledger: the fixed lock order is channel first,
  * credit second, and no credit-ledger path calls back into this store.
  *
- * Two pools, and the split is load-bearing (internal-review). The settlement markers
+ * Two pools, and the split is load-bearing. The settlement markers
  * must write *outside* the ledger transaction, which means a second connection
  * taken while the transaction's client is still checked out — on the shared
  * host pool that is a self-deadlock the moment concurrent deposits reach its
@@ -2487,7 +2372,7 @@ declare class PostgresX402ChannelStorage implements ChannelStorage {
      *
      * Both accessors run on the settlement pool: every caller reads or writes the
      * marker while {@link withFleetSettlementLock} holds a host-pool client, which
-     * is the nesting the internal-review split exists to keep off a non-terminal pool.
+     * is the nesting the split exists to keep off a non-terminal pool.
      */
     isSettlePending(scope: string): Promise<boolean>;
     /** Record whether a claim's funds still need a `settle(receiver, token)` transfer. */
@@ -2497,16 +2382,16 @@ declare class PostgresX402ChannelStorage implements ChannelStorage {
      *
      * On the dedicated settlement pool like every other marker, and for a sharper
      * reason than they had: this and {@link prepareSettlement} now run *inside*
-     * the channel transaction (internal-review), which holds a host-pool client for its
+     * the channel transaction, which holds a host-pool client for its
      * whole duration. Taking a second client from that same pool is the
-     * self-deadlock internal-review fixed — at pool max every client is a holder and a
+     * self-deadlock fixed — at pool max every client is a holder and a
      * waiter — and moving these calls under the transaction is exactly what would
      * reintroduce it.
      */
     getSettlement(operation: "fund" | "refund", effectId: string): Promise<X402SettlementIntent | undefined>;
     /**
      * The refund on this channel that is neither finished nor abandoned, if there
-     * is one — the credit ledger's spend gate (internal-review).
+     * is one — the credit ledger's spend gate.
      *
      * `statuses` is the caller's, because the two gates disagree by design: a
      * draw is blocked by {@link X402_SPEND_BLOCKING_SETTLEMENT_STATUSES}, a fresh
@@ -2514,12 +2399,12 @@ declare class PostgresX402ChannelStorage implements ChannelStorage {
      *
      * On the dedicated settlement pool, and that is what makes the gate callable
      * at all: a draw routinely runs inside an open channel transaction holding a
-     * host-pool client, and taking a second one from that pool is the internal-review
+     * host-pool client, and taking a second one from that pool is the
      * self-deadlock. The oldest blocking row wins, so a channel that somehow
      * accumulated two names the one an operator should reach for first.
      *
      * Projects three columns rather than decoding a whole {@link
-     * X402SettlementIntent}: the decoder refuses a pre-internal-review row that carries
+     * X402SettlementIntent}: the decoder refuses a legacy row that carries
      * no reconciliation snapshot, and a gate that throws on one would take every
      * draw on that channel down with it — when the row is exactly the kind that
      * ought to block them.
@@ -2527,7 +2412,7 @@ declare class PostgresX402ChannelStorage implements ChannelStorage {
     pendingRefundSettlement(channelId: string, statuses: X402SettlementStatus[]): Promise<X402UnresolvedRefund | undefined>;
     /**
      * Read one settlement by its own identifier — the handle an operator holds
-     * (internal-review). Same dedicated pool as {@link getSettlement}, for the same
+     * Same dedicated pool as {@link getSettlement}, for the same
      * reason: the repair reads this while a channel transaction may be open.
      */
     getSettlementById(settlementId: string): Promise<X402SettlementIntent | undefined>;
@@ -2535,7 +2420,7 @@ declare class PostgresX402ChannelStorage implements ChannelStorage {
     normalizeLegacyPaymentId(settlementId: string, operation: "fund" | "refund", legacyPaymentId: string, paymentId: string): Promise<X402SettlementIntent>;
     /**
      * The operator's repair queue: settlements stuck between "chain paid" and
-     * "ledger booked", oldest write first (internal-review).
+     * "ledger booked", oldest write first.
      *
      * Keyset-paginated on `(created_at, settlement_id)` for the reason the
      * blocked-invoice queue is: a wedged row never self-clears, so a fixed first
@@ -2560,7 +2445,7 @@ declare class PostgresX402ChannelStorage implements ChannelStorage {
         after?: X402SettlementCursor;
     }): Promise<X402SettlementPage>;
     /**
-     * Close a wedged settlement without booking anything (internal-review).
+     * Close a wedged settlement without booking anything.
      *
      * A single-statement CAS on the wedged statuses, on the settlement pool —
      * there is no ledger effect to be atomic with, which is the whole point:
@@ -2580,7 +2465,7 @@ declare class PostgresX402ChannelStorage implements ChannelStorage {
      * Mark that the next operation is the ambiguous external-call boundary.
      *
      * `channelAtSubmission` is the live channel the facilitator is about to size
-     * and sign the settlement against (internal-review) — bookmarked here, with the
+     * and sign the settlement against — bookmarked here, with the
      * block height, because these two are the only description of that instant
      * that survives the call.
      */
@@ -2602,7 +2487,7 @@ declare class PostgresX402ChannelStorage implements ChannelStorage {
     /**
      * Mark the external settlement and ledger effect complete in the active transaction.
      *
-     * `resolvedAtMs` is set only by the operator repair (internal-review), so an audit
+     * `resolvedAtMs` is set only by the operator repair, so an audit
      * read can tell a settlement that completed on its own from one a human had
      * to finish.
      */
@@ -2629,7 +2514,7 @@ declare class PostgresX402ChannelStorage implements ChannelStorage {
      * this is how the settlement layer says "this exact decrease is the one the
      * payer's verified refund voucher authorises". Outside this scope a decrease
      * of `chargedCumulativeAmount` is refused flat, which is what keeps the
-     * arbitrary-decrease guard meaningful (internal-review).
+     * arbitrary-decrease guard meaningful.
      */
     withSanctionedRefundBase<T>(base: string, operation: () => Promise<T>): Promise<T>;
     withChannelTransaction<T>(channelId: string, operation: (tx: PoolClient) => Promise<T>): Promise<T>;
@@ -2639,7 +2524,7 @@ declare class PostgresX402ChannelStorage implements ChannelStorage {
      * The lock is session-scoped, so its client stays checked out for the whole
      * operation — and `operation()` (upstream's claim/settle) re-enters the pool
      * through {@link updateChannel}. Two bounds keep that from wedging the pool
-     * (internal-review): local callers are serialized in-process, so this holds at most
+     * local callers are serialized in-process, so this holds at most
      * one client per process no matter how many requests arrive, and a waiting
      * acquire carries a `lock_timeout` so a wedged fleet-mate can't pin that
      * client — and the caller's request — indefinitely. A timeout reports the
@@ -2652,7 +2537,7 @@ declare class PostgresX402ChannelStorage implements ChannelStorage {
      */
     withFleetSettlementLock(operation: () => Promise<unknown>, wait?: boolean): Promise<boolean>;
     /**
-     * Hold the fleet-wide self-relay submission lock for one chain submission (internal-review).
+     * Hold the fleet-wide self-relay submission lock for one chain submission.
      *
      * The session lock keeps one per-DVM gas EOA to one in-flight submission
      * across the whole fleet — two machines submitting at once collide on the
@@ -2741,8 +2626,8 @@ interface X402CreditLoss {
     observedAt: number;
 }
 /**
- * Money-safe credit ledger (internal-review) — the SDK-owned settlement primitive the
- * credits spec (§2 condition 2) requires every DVM to use for prepaid balances.
+ * Money-safe credit ledger — the SDK-owned settlement primitive required for
+ * prepaid balances in production DVMs.
  * Two tables in the DVM's own Postgres (`credits`, `credit_draws`), two-phase
  * draws (`pending` at job-accept → `settled` on success / `released` on
  * failure), and a per-credit gap-free `ledger_seq` for the receipt evidence
@@ -2766,7 +2651,7 @@ declare class CreditLedger {
     private readonly tempoSessionStore?;
     /**
      * Postgres-backed: balances survive a restart and are shared across the
-     * fleet, so this DVM may advertise credit (internal-review).
+     * fleet, so this DVM may advertise credit.
      */
     readonly durable = true;
     private x402Settlements?;
@@ -2774,7 +2659,6 @@ declare class CreditLedger {
     constructor(pool: CreditLedgerPool, tempoSessionStore?: TempoSessionSettlementStore | undefined);
     /**
      * Bind the durable x402 settlement state this ledger gates spending on
-     * (internal-review).
      *
      * Late, because the settlement store is built with the batch-settlement
      * server, which is built *after* the ledger it reads earned draws from. An
@@ -2784,11 +2668,11 @@ declare class CreditLedger {
     useX402SettlementGate(gate: X402RefundSettlementGate): void;
     /**
      * Bind the durable outbox that reports credit-expiry releases and their
-     * revivals to the platform (internal-review).
+     * revivals to the platform.
      *
      * Held on the ledger rather than threaded through {@link fund} for the same
      * reason as the gate above: the revival half fires from *every* funding path
-     * — Cashu commit, x402 exact and channel, Tempo, the Lightning invoice
+     * Cashu commit, x402 exact and channel, Tempo, the Lightning invoice
      * settle, the implicit N=1 per-call payment — and a seam each of those has to
      * remember to pass is a seam one of them will eventually forget.
      *
@@ -2800,10 +2684,10 @@ declare class CreditLedger {
     useCreditExpiryReleaseOutbox(outbox: CreditExpiryReleaseOutbox): void;
     /** Create the `credits` / `credit_draws` tables if absent. Call once at SDK boot. */
     init(): Promise<void>;
-    /** The boot DDL itself — always runs under {@link withSdkInitLock} (internal-review). */
+    /** The boot DDL itself — always runs under {@link withSdkInitLock}. */
     private createTables;
     /**
-     * Give every open non-channel Bitcoin credit a funding lot (internal-review).
+     * Give every open non-channel Bitcoin credit a funding lot.
      *
      * Runs inside the boot DDL, is guarded per credit by `NOT EXISTS`, and is
      * therefore both the one-time migration and a standing self-heal for a
@@ -2814,12 +2698,12 @@ declare class CreditLedger {
      * `{amount_micro, rail}` — no instrument amount at all — and is not written
      * on every funding path, whereas `msats_remaining` **is** the credit's
      * current unspent rail value, maintained pro rata on every draw since
-     * internal-review. One synthetic lot pairing it with `balance_micro` therefore
+     * One synthetic lot pairing it with `balance_micro` therefore
      * reproduces today's in-kind position exactly, and FIFO over a single lot is
      * trivially correct. Historic per-funding rates are unrecoverable and would
      * change nothing: only the remaining position is owed.
      *
-     * The semantics change is deliberately retroactive (internal-review) — every
+     * The semantics change is deliberately retroactive — every
      * current holder is first-party, so there is one regime and no legacy
      * branch.
      */
@@ -2827,31 +2711,31 @@ declare class CreditLedger {
     /**
      * Create a credit, or top up an existing one (same `creditId`). Top-ups add
      * to the balance and overwrite `expiry_ms` with the provided value — funding
-     * an expired credit revives it (spec §5 carry-forward: the credit is a
+     * an expired credit revives it (the caller-ownership contract carry-forward: the credit is a
      * rolling buffer, not per-job escrow). The existing row's `caller_pubkey`
      * and `currency` must match or the fund is refused with a typed error —
      * without that check a top-up against someone else's `credit_id` would
      * silently merge two callers' money.
      *
      * Pass `tx` (a client inside a caller-owned `BEGIN`) to commit the rail
-     * receive and the ledger credit atomically (spec condition 3 — the internal-review
+     * receive and the ledger credit atomically (spec condition 3 — the
      * verifier does this). The ledger issues **no** transaction control on `tx`.
      *
      * Without `tx` it opens one of its own, because a funding is no longer a
      * single statement: it upserts the credit, records its funding lot
-     * (internal-review), and reverses any standing expiry release (internal-review) — and that
+     * and reverses any standing expiry release — and that
      * last leg restores balance and queues a report. A crash between the upsert
      * and the reversal would leave a revived credit whose release still stands,
      * which the sweep's own exclusion then makes permanent: `balance_micro > 0`
      * but a standing release means it is neither drainable nor re-releasable.
      *
-     * `basis` records the rail value behind the fiat (internal-review) so each draw can
+     * `basis` records the rail value behind the fiat so each draw can
      * be allocated its share of the rail-native amount actually received. A
      * top-up on a different rail than the credit's is refused with
      * `rail_mismatch`: sats and USDC microunits aren't summable, so a blended
      * credit would have no coherent native basis to allocate from.
      *
-     * It is **required** (internal-review), in the type and again at runtime via
+     * It is **required**, in the type and again at runtime via
      * {@link assertFundingBasis}. A basis-less fund wrote `rail = NULL`, and a
      * draw against such a credit settles — a real debit — while
      * `railAsFundingMethod` correctly declines to guess a rail, so `bookRevenue`
@@ -2862,7 +2746,7 @@ declare class CreditLedger {
      * typed top-up via the `COALESCE` below.
      *
      * The rail-native **instrument** is pinned at first funding too, and both
-     * channel guards are symmetric for the same reason (internal-review). A reusable
+     * channel guards are symmetric for the same reason. A reusable
      * channel — Tempo session or x402 batch-settlement — may only ever top up
      * the credit it opened, and a credit opened by a one-shot (a Tempo charge, an
      * x402 exact authorization) may never adopt one. The x402 half used to admit
@@ -2876,7 +2760,7 @@ declare class CreditLedger {
      * one-credit-per-channel, not one-source-per-credit.
      *
      * An x402 channel deposit is additionally refused `settlement_pending` while
-     * that channel carries an unresolved refund (internal-review) — see the gate read
+     * that channel carries an unresolved refund — see the gate read
      * below. This method is the authority on that rule, as it is on the binding
      * rules above; every door preflights it where a refusal is still free.
      */
@@ -2889,12 +2773,12 @@ declare class CreditLedger {
     private fundOn;
     /**
      * Undo any expiry release this credit still carries, because a funding just
-     * landed on it (internal-review — the revival rule), restoring the balance the
+     * landed on it (the revival rule), restoring the balance the
      * release took.
      *
      * A release records the credit's **final** undrawn remainder and zeroes it
      * (see {@link releaseExpiredCreditLocked}). Funding adds to the balance and
-     * overwrites `expiry_ms` (spec §5 carry-forward: the credit is a rolling
+     * overwrites `expiry_ms` (the caller-ownership contract carry-forward: the credit is a rolling
      * buffer), so the moment money arrives the recorded remainder is no longer
      * final: the release stops counting and its micro come back.
      *
@@ -2913,13 +2797,13 @@ declare class CreditLedger {
      * re-derives it.
      *
      * @returns the credit row as the restore left it, or undefined when there was
-     *   nothing to reverse. The caller reads its snapshot off this rather than off
-     *   the funding upsert's `RETURNING`, which predates the restore.
+     * nothing to reverse. The caller reads its snapshot off this rather than off
+     * the funding upsert's `RETURNING`, which predates the restore.
      */
     private reverseExpiryReleases;
     /**
      * Release the undrawn remainder of every credit whose TTL has run out
-     * (internal-review). Returns the releases this pass recorded.
+     * Returns the releases this pass recorded.
      *
      * **What is released.** The credit's whole `balance_micro`. Expiry ends
      * spending but never ownership of the record, so the balance stays readable;
@@ -2936,7 +2820,7 @@ declare class CreditLedger {
      * runs above the expiry check, so a lost response is still recoverable), so
      * the remainder is not final while a hold is outstanding. Skipping costs one
      * sweep interval and keeps the released figure exactly "what nothing bought";
-     * holds do resolve — the orphan-draw watchdog (internal-review) is what guarantees
+     * holds do resolve — the orphan-draw watchdog is what guarantees
      * a stranded one still reaches a terminal state.
      *
      * **Idempotent** two ways. `release_id` is derived from the expiry instant,
@@ -2985,7 +2869,7 @@ declare class CreditLedger {
      */
     private releaseExpiredCreditLocked;
     /**
-     * Record this funding's in-kind basis as a lot (internal-review).
+     * Record this funding's in-kind basis as a lot.
      *
      * Called from inside {@link fund}, on the same handle, so the lot shares
      * whatever transaction the rail opened — `withCommitTx` for Cashu,
@@ -3028,11 +2912,11 @@ declare class CreditLedger {
      * placed pre-expiry must stay recoverable after the credit expires, or the
      * DVM holds a debit the caller can never reconcile. Fresh draws on an
      * expired credit are refused with `credit_expired`; the balance stays
-     * intact and readable (spec §5: expiry ends spending, never ownership).
+     * intact and readable (the caller-ownership contract: expiry ends spending, never ownership).
      *
      * Pass `tx` (a client inside a caller-owned `BEGIN`) to place the hold in
      * the same transaction as the rail commit and the `fund` upsert (spec
-     * condition 3 — the internal-review implicit N=1 path). The ledger issues no
+     * condition 3 — the implicit N=1 path). The ledger issues no
      * transaction control on `tx`; the `SELECT … FOR UPDATE` row lock is still
      * taken on the caller's transaction, so the locking invariant holds.
      */
@@ -3048,18 +2932,18 @@ declare class CreditLedger {
     }): Promise<DrawResult>;
     /**
      * The unresolved refund on `channelId` that must stop this ledger effect, if
-     * any (internal-review).
+     * any.
      *
      * `undefined` whenever there is nothing to ask — an unbound credit, or a DVM
      * with no durable settlement store, where a settlement row cannot exist.
      *
-     * Public since internal-review, so `/v1/credit`'s pre-payment preflight can ask the
+     * Public since the behavior was introduced, so `/v1/credit`'s pre-payment preflight can ask the
      * same question `fund` will ask from inside the rail transaction — one read,
      * one answer, rather than a second copy of the rule in the routes.
      */
     blockingX402Refund(channelId: string | null | undefined, statuses: X402SettlementStatus[]): Promise<X402UnresolvedRefund | undefined>;
     /**
-     * Grow a pending draw by `addAmountMicro` (internal-review) — the ledger half of a
+     * Grow a pending draw by `addAmountMicro` — the ledger half of a
      * mid-job `requestPayment` top-up. One job keeps **one** draw: the mid-job
      * money funds the same credit and enlarges the hold the upfront leg placed,
      * so the receipt's `ReceiptCredit` block countersigns the job's full cost
@@ -3078,7 +2962,7 @@ declare class CreditLedger {
      * The increment's rail value comes from {@link growthRailValue}: earmarked
      * to the funding that backs it when the caller names one (the mid-job case),
      * pro-rata otherwise. Either way the draws of a credit keep summing to
-     * precisely what the rails paid (internal-review).
+     * precisely what the rails paid.
      *
      * **`ledger_seq` is not re-taken.** The per-credit sequence is gap-free
      * (`credit_draws_seq_uidx`), so moving this draw forward would strand its
@@ -3096,8 +2980,8 @@ declare class CreditLedger {
      * the whole transaction back on replay; x402/mpp collide on the
      * `processed_payments` marker). Never call it outside a rail commit.
      *
-     * **`capMicro` bounds cumulative growth at what the job cumulatively asked
-     * (internal-review)**, and it is the only ceiling that can refuse a top-up: the
+     * **`capMicro` bounds cumulative growth at what the job cumulatively asked,**
+     * and it is the only ceiling that can refuse a top-up: the
      * available-balance check cannot, because the `fund` a moment earlier in
      * this same transaction raised the balance by exactly the amount being
      * drawn. Excess is **granted partially or not at all rather than thrown** —
@@ -3111,7 +2995,7 @@ declare class CreditLedger {
         addAmountMicro: number;
         /**
          * Rail value that funded this growth, earmarked to the increment instead
-         * of allocated pro-rata (internal-review). Pass it whenever `addAmountMicro` is
+         * of allocated pro-rata. Pass it whenever `addAmountMicro` is
          * money that landed in this same transaction; omit it when the growth
          * spends balance the credit already held.
          */
@@ -3121,7 +3005,7 @@ declare class CreditLedger {
         };
         /**
          * Ceiling on this draw's **cumulative** growth, in fiat micro of the
-         * credit's currency (internal-review) — the job's total mid-job ask. Growth is
+         * credit's currency — the job's total mid-job ask. Growth is
          * clipped to `capMicro - grown_micro`; a second payment for an ask the
          * first already satisfied gets zero. Omit it only when the caller genuinely
          * has no ask total to bound against; growth is then unbounded, as before.
@@ -3155,7 +3039,7 @@ declare class CreditLedger {
     }): Promise<DrawResolution>;
     /**
      * Release a pending draw: the hold evaporates, the balance is untouched —
-     * this is how "no debit on job failure" is mechanically real (spec §1).
+     * this is how "no debit on job failure" is mechanically real (the credit lifecycle contract).
      * Idempotent: releasing a released draw returns the original tuple. A
      * settled draw cannot be released (`invalid_draw_state`) — un-settling
      * booked revenue is a reconciliation problem, not a ledger verb.
@@ -3167,14 +3051,14 @@ declare class CreditLedger {
         nowMs?: number;
     }): Promise<DrawResolution>;
     /**
-     * Record a fund-only top-up under its client-generated `fundId` (internal-review).
+     * Record a fund-only top-up under its client-generated `fundId`.
      * The deposit half of the evidence chain, and the top-up path's idempotency
      * key: `PRIMARY KEY (credit_id, fund_id)` means a concurrent duplicate
      * loses with a typed `funding_replayed` rather than crediting twice.
      *
      * Call it inside the same `tx` as {@link fund} — the rail commit, the
      * funding record, and the balance increment must land together or not at
-     * all (spec §2 condition 3). Like `fund`, this issues no transaction
+     * all (the funding-commitment rule). Like `fund`, this issues no transaction
      * control on `tx`; it is a single statement.
      *
      * This does **not** move money on its own. `fund` still does the crediting;
@@ -3216,7 +3100,7 @@ declare class CreditLedger {
         receipt: FundingReceipt;
     }): Promise<FundingReceipt>;
     /**
-     * Record the bolt11 issued for a `(creditId, fundId)` top-up (internal-review), or
+     * Record the bolt11 issued for a `(creditId, fundId)` top-up, or
      * return the one already issued for it.
      *
      * **Returning the existing row is the point.** A caller re-polling an unpaid
@@ -3254,7 +3138,7 @@ declare class CreditLedger {
     }): Promise<CreditInvoiceRecord[]>;
     /**
      * Apply an observed Lightning settlement to the ledger — **the exactly-once
-     * boundary** (internal-review; spec §2 condition 3 for a rail whose commit happens
+     * boundary** (the funding-commitment rule for a rail whose commit happens
      * off-box).
      *
      * One transaction covers the funding record, the balance, and the invoice's
@@ -3275,13 +3159,13 @@ declare class CreditLedger {
         fundId: string;
         expiryMs: number;
         /**
-         * Rail-value basis, pinned when the invoice was issued (internal-review). Required
-         * by internal-review — it is what `fund` writes to `credits.rail`.
+         * Rail-value basis, pinned when the invoice was issued. Required
+         * by — it is what `fund` writes to `credits.rail`.
          */
         basis: CreditFundingBasis;
         /**
          * Reporter-owned deposit outbox write. Runs on the invoice transaction
-         * after the ledger/status writes and before COMMIT (internal-review).
+         * after the ledger/status writes and before COMMIT.
          */
         depositOutbox?: {
             enqueue: CreditDepositEnqueue;
@@ -3300,7 +3184,7 @@ declare class CreditLedger {
         fundId: string;
     }): Promise<CreditInvoiceRecord | undefined>;
     /**
-     * Retire an invoice that **was paid** and can never be credited (internal-review).
+     * Retire an invoice that **was paid** and can never be credited.
      *
      * Distinct from `expired` because the money is the opposite way round: an
      * expired invoice was never paid and owes nobody anything, whereas a blocked
@@ -3322,15 +3206,15 @@ declare class CreditLedger {
     /** Read one invoice by the wallet's own identifier for the payment (no lock). */
     getInvoiceByPaymentHash(paymentHash: string): Promise<CreditInvoiceRecord | undefined>;
     /**
-     * The operator's queue: invoices the sweep gave up on (internal-review).
+     * The operator's queue: invoices the sweep gave up on.
      *
      * **Keyset-paginated, not offset.** Blocked rows are terminal and never
      * self-clear, so a row the operator declines to act on sits at the head of
      * the age ordering forever; a fixed first page would starve everything
-     * behind it on every run, which is the internal-review shape one page up.
+     * behind it on every run, which is the shape one page up.
      *
      * `includeResolved` widens to the operator-resolved statuses so a run can be
-     * audited after the fact — the acceptance criterion this verb exists for.
+     * audited after the fact.
      * Host-wide, like `listPendingDrains`: the ledger has no `dvm_id`, so on a
      * multi-mount host one builder's admin credential reads every mount's rows.
      */
@@ -3341,7 +3225,7 @@ declare class CreditLedger {
     }): Promise<CreditInvoiceRecord[]>;
     /**
      * Apply a blocked invoice's payment to a credit an operator named — the
-     * repair for the one Lightning outcome the DVM cannot fix itself (internal-review).
+     * repair for the one Lightning outcome the DVM cannot fix itself.
      *
      * Shaped statement-for-statement on {@link settleInvoice}, because it is the
      * same money doing the same thing a different way: one transaction covering
@@ -3349,21 +3233,21 @@ declare class CreditLedger {
      * outbox row, so the four can never disagree. Three deliberate differences:
      *
      * - **The lock is taken on `payment_hash`**, which is UNIQUE and is the
-     *   identifier the operator actually holds (it is what the
-     *   `lightning_settlement_blocked` log carries and what names the payment in
-     *   their wallet). Invoice row first, credit row second via `fund`'s upsert —
-     *   the same order `settleInvoice` takes, which is what keeps a reconcile and
-     *   a concurrent settlement check from deadlocking against each other.
+     * identifier the operator actually holds (it is what the
+     * `lightning_settlement_blocked` log carries and what names the payment in
+     * their wallet). Invoice row first, credit row second via `fund`'s upsert —
+     * the same order `settleInvoice` takes, which is what keeps a reconcile and
+     * a concurrent settlement check from deadlocking against each other.
      * - **The funding lands at `(targetCreditId, paymentHash)`, not the invoice's
-     *   own `(credit_id, fund_id)`.** That key is frequently the reason the row
-     *   is blocked at all — `funding_replayed_on_cashu` means something else
-     *   already holds it — and the operator's most natural target is that very
-     *   credit. The payment hash cannot collide with it, and it makes all three
-     *   references to this payment agree: `basis.fundingRef`, the deposit's
-     *   `funding_id`, and the funding row's `fund_id`.
+     * own `(credit_id, fund_id)`.** That key is frequently the reason the row
+     * is blocked at all — `funding_replayed_on_cashu` means something else
+     * already holds it — and the operator's most natural target is that very
+     * credit. The payment hash cannot collide with it, and it makes all three
+     * references to this payment agree: `basis.fundingRef`, the deposit's
+     * `funding_id`, and the funding row's `fund_id`.
      * - **`written_off` is an accepted input status.** A write-off unwound
-     *   nothing, so an operator who closed a row by mistake must not need raw SQL
-     *   against a money table to reopen it.
+     * nothing, so an operator who closed a row by mistake must not need raw SQL
+     * against a money table to reopen it.
      *
      * The invoice row's status — never the funding row — is the idempotency
      * source of truth. `fund_id` is caller-chosen and the payment hash is
@@ -3377,7 +3261,7 @@ declare class CreditLedger {
         /** Credit the money lands on. The caller identity comes off the invoice row. */
         targetCreditId: string;
         expiryMs: number;
-        /** Rail-value basis, rebuilt from the invoice row by the caller (internal-review). */
+        /** Rail-value basis, rebuilt from the invoice row by the caller. */
         basis: CreditFundingBasis;
         /** The wallet's settlement instant, re-observed by the operator's verb. */
         settledAtMs?: number;
@@ -3389,7 +3273,7 @@ declare class CreditLedger {
     }): Promise<InvoiceReconciliation>;
     /**
      * Record that an operator reviewed a blocked invoice and chose not to credit
-     * it (internal-review) — no ledger effect, purely a queue transition.
+     * it — no ledger effect, purely a queue transition.
      *
      * A CAS on `blocked`, and idempotent: re-running returns the recorded row
      * rather than overwriting the first note. It cannot capture a `reconciled`
@@ -3424,13 +3308,13 @@ declare class CreditLedger {
     listDrawsByJobId(jobId: string): Promise<DrawRecord[]>;
     /**
      * All pending holds on a credit, in `ledger_seq` order (no lock). Read
-     * surface for the internal-review sweeper wiring — a worker that dies mid-job
+     * surface for the sweeper wiring — a worker that dies mid-job
      * leaves its hold `pending` until something releases it.
      */
     listPendingDraws(creditId: string): Promise<DrawRecord[]>;
     /**
      * One page of pending holds host-wide placed before `createdBeforeMs`,
-     * oldest first (no lock). The orphan sweeper's read surface (internal-review): a
+     * oldest first (no lock). The orphan sweeper's read surface: a
      * draw commits with its `job_id` before the job row is persisted, so a crash
      * or a fail-closed refusal in that window strands a hold nothing can ever
      * resolve — the only release path keys off the `credit_id`/`draw_id` written
@@ -3455,7 +3339,7 @@ declare class CreditLedger {
      * Rail-native value the credit an x402 settlement channel funded has
      * actually earned — the sum of its **settled** draws, in the credit's native
      * atomic units (USDC micro on this rail). The batch-settlement claim job's
-     * ceiling (internal-review): a channel is claimable up to what its credit's draws
+     * ceiling: a channel is claimable up to what its credit's draws
      * have earned, never up to the deposit that funded it.
      *
      * `undefined` when no credit is bound to the channel, which the claim job
@@ -3471,7 +3355,7 @@ declare class CreditLedger {
     earnedNativeForX402Channel(channelId: string): Promise<number | undefined>;
     /**
      * The credit an x402 settlement channel funded, if one is bound to it — the
-     * binding is UNIQUE, so at most one row can answer (internal-review).
+     * binding is UNIQUE, so at most one row can answer.
      *
      * The operator repair's entry point: a wedged settlement row carries the
      * channel and an `effect_id`, and this is what turns them back into the
@@ -3504,7 +3388,7 @@ declare class CreditLedger {
     }): Promise<X402CreditLoss[]>;
     /**
      * Debit the caller's entire available balance into a drain liability
-     * (spec §5: expiry ends spending, never ownership — this is the
+     * (the caller-ownership contract: expiry ends spending, never ownership — this is the
      * builder-honored reclaim floor). Runs under the credit row lock: the
      * amount is `balance − pending holds` read under `FOR UPDATE`, the balance
      * is decremented in the same transaction, and the drain takes the next
@@ -3546,14 +3430,14 @@ declare class CreditLedger {
         drainId: string;
     }): Promise<CreditDrainRecord | undefined>;
     /**
-     * One credit's undepleted funding lots, oldest first (internal-review) — the
+     * One credit's undepleted funding lots, oldest first — the
      * public read behind the reclaim's own arithmetic, for anything that needs
      * to show its work.
      */
     listFundingLots(creditId: string): Promise<FundingLot[]>;
     /**
      * What this DVM owes back in satoshis if every open non-channel Bitcoin
-     * credit reclaimed right now (internal-review) — the deposit half of the hub
+     * credit reclaimed right now — the deposit half of the hub
      * balance, and the floor a payout sweep must never go below.
      *
      * Read entirely off the funding lots, at their own funding rates, with no
@@ -3584,7 +3468,7 @@ declare class CreditLedger {
     listPendingDrains(): Promise<CreditDrainRecord[]>;
     /**
      * One page of still-`pending` drains on a channel-backed credit, oldest
-     * first (no lock) — the operator's repair queue (internal-review).
+     * first (no lock) — the operator's repair queue.
      *
      * Keyset-paginated for the x402 settlement queue's reason: a wedged row
      * never self-clears, so a caller that re-issues the same first page would
@@ -3600,10 +3484,10 @@ declare class CreditLedger {
      * younger is in flight rather than stuck.
      *
      * The method filter is `'tempo'`, and it is the one line here worth a second
-     * look: `init()` migrates the pre-internal-review `'mpp'` spelling away and
+     * look: `init()` migrates the legacy `'mpp'` spelling away and
      * `DrainMethod` no longer carries it, so a query naming it matches nothing a
-     * DVM has ever written. It named it anyway until internal-review's rename sweep and
-     * internal-review's live rung caught it independently — the whole operator queue
+     * DVM has ever written. It named it anyway until rename sweep and
+     * live rung caught it independently — the whole operator queue
      * read empty in production while every route test stayed green, because
      * those run on `MemoryCreditLedger`, which filters on the typed value. The
      * two implementations of this one predicate must be read together.
@@ -3622,7 +3506,7 @@ declare class CreditLedger {
     }): Promise<CreditDrainRecord[]>;
     /**
      * Record that an operator reviewed a floor-refused channel drain and is not
-     * booking it (internal-review). Books nothing anywhere — no status change, no
+     * booking it. Books nothing anywhere — no status change, no
      * balance movement, no platform report.
      *
      * A single-statement CAS on `written_off_at IS NULL`, so the first note on
@@ -3680,7 +3564,7 @@ declare class CreditLedger {
         creditId: string;
         drainId: string;
         token: string;
-        /** Cost evidence for a just-in-time mint (internal-review); absent on an accumulator park. */
+        /** Cost evidence for a just-in-time mint; absent on an accumulator park. */
         fulfilment?: DrainFulfilment;
         tx?: CreditLedgerQuerier;
         nowMs?: number;
@@ -3691,7 +3575,7 @@ declare class CreditLedger {
      * loss, so the caller's re-poll keeps returning the same token either way.
      *
      * Returns `replayed` because this is a **terminal** transition and the money
-     * has left at exactly one of these calls (internal-review): the platform drain
+     * has left at exactly one of these calls: the platform drain
      * report must be emitted by that caller and no other. Pass `tx` to write the
      * report through the same transaction as the CAS.
      */
@@ -3740,7 +3624,7 @@ declare class CreditLedger {
     /** Shared refusal tail for the CAS transitions: idempotent replay or typed error. */
     private refuseTransition;
     /**
-     * Price a reclaim in kind and say which lots it takes (internal-review).
+     * Price a reclaim in kind and say which lots it takes.
      *
      * The debits are returned whether or not the reclaim can be priced, and the
      * caller applies them either way: the money is leaving the credit, so the
@@ -3749,13 +3633,13 @@ declare class CreditLedger {
      *
      * `owedSats` is `null` where {@link isInKindDepletion} refuses — the lots
      * are short of the balance, or the covering lots carry no sats basis (a
-     * credit funded before internal-review). That row is priced off a live rate by the
+     * legacy credit whose funding recorded no sats basis. That row is priced off a live rate by the
      * admin surface instead, which is what *every* row did before this change,
      * so the fallback is the old behaviour rather than a new failure mode.
      *
-     * What it publishes is **net of the delivery reserve** (internal-review): handing a
+     * What it publishes is **net of the delivery reserve**: handing a
      * refund over costs a mint fee and, when the notes have to be minted just in
-     * time, a Lightning hop. The caller carries that cost per internal-review, and a
+     * time, a Lightning hop. The caller carries that cost per and a
      * flat reserve is how they carry it without the figure moving — an
      * actual-fee true-up could only be applied after the promise was made. The
      * debits stay gross because they are denominated in micro and are what
@@ -3763,7 +3647,7 @@ declare class CreditLedger {
      */
     private reclaimInKind;
     /**
-     * This credit's undepleted funding lots, oldest first (internal-review).
+     * This credit's undepleted funding lots, oldest first.
      *
      * Ordered in SQL on the same `(created_at, lot_id)` key the partial index
      * carries, so FIFO is the index's own order rather than something a reader
@@ -3794,7 +3678,7 @@ declare class CreditLedger {
     /**
      * Held-but-unresolved totals for a credit, in all three units at once — the
      * fiat micro that defines available balance plus the rail-value remainders
-     * a new draw allocates against (internal-review). One round-trip, since every
+     * a new draw allocates against. One round-trip, since every
      * caller needs the micro sum anyway.
      */
     private pendingSums;
@@ -3803,7 +3687,7 @@ declare class CreditLedger {
     private readX402CreditLosses;
 }
 /**
- * The ledger surface the SDK server codes against (internal-review). Implemented by
+ * The ledger surface the SDK server codes against. Implemented by
  * the Postgres {@link CreditLedger} (production — spec condition 2 requires
  * the DVM's own Postgres) and by `MemoryCreditLedger` (devMode / in-process
  * tests / pool-less `createDVMServer` setups, mirroring the `MemoryJobStore`
@@ -3814,13 +3698,13 @@ declare class CreditLedger {
 interface CreditLedgerLike {
     /**
      * True when balances survive a restart and are visible fleet-wide
-     * (internal-review). The funding menu is suppressed on a non-durable ledger
+     * The funding menu is suppressed on a non-durable ledger
      * outside devMode: a caller who funds on machine A and draws on machine B
      * would get `credit_not_found`, so advertising credit there misadvertises.
      */
     readonly durable: boolean;
     /**
-     * Bind the durable x402 settlement state spending is gated on (internal-review).
+     * Bind the durable x402 settlement state spending is gated on.
      *
      * Optional because a host may wire a ledger implementation that has no such
      * gate; the SDK's own two both do. See
@@ -3829,7 +3713,6 @@ interface CreditLedgerLike {
     useX402SettlementGate?(gate: X402RefundSettlementGate): void;
     /**
      * Bind the outbox that reports credit-expiry releases and their revivals
-     * (internal-review).
      *
      * Optional, and absent on `MemoryCreditLedger`: an expiry release is a
      * durable liability fact, and a ledger whose balances do not survive a
@@ -3838,7 +3721,7 @@ interface CreditLedgerLike {
      */
     useCreditExpiryReleaseOutbox?(outbox: CreditExpiryReleaseOutbox): void;
     /**
-     * Release the undrawn remainder of every credit past its TTL (internal-review).
+     * Release the undrawn remainder of every credit past its TTL.
      * Optional on the same terms as the binder above. See
      * {@link CreditLedger.sweepExpiredCredits}.
      */
@@ -3850,7 +3733,7 @@ interface CreditLedgerLike {
     }>;
     /**
      * Ask that gate directly, so a route can refuse a wedged channel **before**
-     * the rail moves anything (internal-review). Optional on the same terms as the
+     * the rail moves anything. Optional on the same terms as the
      * binder above; an implementation without it simply gets no preflight, and
      * the ledger effect stays the authority. See
      * {@link CreditLedger.blockingX402Refund}.
@@ -4034,9 +3917,9 @@ interface CreditLedgerLike {
         drainId: string;
     }): Promise<CreditDrainRecord | undefined>;
     listPendingDrains(): Promise<CreditDrainRecord[]>;
-    /** See {@link CreditLedger.bitcoinDepositLiability} — the in-kind deposit floor (internal-review). */
+    /** See {@link CreditLedger.bitcoinDepositLiability} — the in-kind deposit floor. */
     bitcoinDepositLiability(): Promise<BitcoinDepositLiability>;
-    /** One credit's undepleted funding lots, oldest first (internal-review). */
+    /** One credit's undepleted funding lots, oldest first. */
     listFundingLots(creditId: string): Promise<FundingLot[]>;
     listChannelDrains(args: {
         limit: number;
@@ -4098,14 +3981,14 @@ interface CreditLedgerLike {
 interface CreditLedgerQuerier {
     query: Pool["query"];
 }
-/** Reporter outbox joined to a draw release's own transaction (internal-review). */
+/** Reporter outbox joined to a draw release's own transaction. */
 interface CreditDrawReleaseOutbox {
     /** Platform DVM record ID bound into the report. */
     dvmId: string;
     /** Reporter-owned insert executed through the ledger transaction. */
     enqueue: CreditDrawReleaseEnqueue;
 }
-/** Reporter seam for credit-expiry releases and the revivals that reverse them (internal-review). */
+/** Reporter seam for credit-expiry releases and the revivals that reverse them. */
 interface CreditExpiryReleaseOutbox {
     /** Platform DVM record ID bound into the report. */
     dvmId: string;
@@ -4114,7 +3997,7 @@ interface CreditExpiryReleaseOutbox {
 }
 /**
  * One recorded expiry episode: a credit's undrawn remainder passing to the
- * builder when its TTL ran out (internal-review).
+ * builder when its TTL ran out.
  *
  * `reversedAt` is set when a later funding revived the credit, at which point
  * the release stops counting against committed value — the row stays as the
@@ -4148,11 +4031,11 @@ type CreditStatus = "active" | "unbacked";
 /** Draw lifecycle: two-phase hold → terminal settle/release. */
 type DrawStatus = "pending" | "settled" | "released";
 /**
- * Rails a drain can pay out on (internal-review, spec §5 tier 3).
+ * Rails a drain can pay out on (the reclaim contract).
  *
- * Direct Lightning payout is deliberately absent (internal-review / internal-review): a
+ * Direct Lightning payout is deliberately absent: a
  * first-party deployment holds no send-capable Lightning credential by design
- * (the funding NWC is receive-only, internal-review), so P2PK-locked Cashu notes are
+ * (the funding NWC is receive-only), so P2PK-locked Cashu notes are
  * the only non-channel Bitcoin reclaim path. Adding `lightning` back means
  * re-deciding that, not just widening a union.
  */
@@ -4167,7 +4050,7 @@ type DrainMethod = "cashu" | "x402" | "tempo";
  */
 type DrainStatus = "pending" | "parked" | "picked_up" | "sent" | "released";
 /**
- * The sats a DVM owes back on undrawn non-channel Bitcoin credit (internal-review) —
+ * The sats a DVM owes back on undrawn non-channel Bitcoin credit —
  * the deposit pot inside the hub's balance, which the operator's sweep may
  * never bank below.
  */
@@ -4202,7 +4085,7 @@ interface BitcoinDepositLiability {
 }
 /**
  * What it cost to put a just-in-time-minted refund in the caller's hands
- * (internal-review), itemized on the drain row so the spend is auditable against the
+ * itemized on the drain row so the spend is auditable against the
  * hub's own transaction history long after the worker's log has rotated.
  *
  * `faceSats` is what the caller receives and equals the drain's published
@@ -4242,10 +4125,10 @@ interface CreditDrainRecord {
      * The method alone does not say who settles a reclaim: an `mpp` or `x402`
      * drain on a channel-bound credit is closed by the channel itself, and a
      * `pending` one is routinely mid-reconciliation rather than owed by anybody
-     * — `completeTempoDrain` leaves every ambiguous close pending on purpose for
+     * `completeTempoDrain` leaves every ambiguous close pending on purpose for
      * `recoverTempoSessionClose` to finish on the caller's next poll. Carrying
      * the binding on the record is what lets a reader tell that apart from a
-     * one-payment reclaim only a person can settle (internal-review).
+     * one-payment reclaim only a person can settle.
      */
     channelId: string | null;
     /** Method-specific payout target as signed by the caller. */
@@ -4257,12 +4140,11 @@ interface CreditDrainRecord {
      * `null` on a rail that reports no native basis. This — not `amountMicro` —
      * is what an on-chain payout must be sized against, because the fiat figure
      * and the rail figure drift with the rate between funding and drain
-     * (internal-review).
      */
     drainedNative: number | null;
     /**
      * What this reclaim owes in satoshis, computed from the credit's funding
-     * lots when it was requested and never re-priced (internal-review): the deposited
+     * lots when it was requested and never re-priced: the deposited
      * sats, pro rata to the share of the credit being reclaimed, floored per
      * lot. `null` on a channel rail (in-kind structurally, through the escrow)
      * and on a Bitcoin credit whose lots cannot price it — that one falls back
@@ -4283,7 +4165,7 @@ interface CreditDrainRecord {
     /** Settlement evidence, present on `sent`. */
     sentRef: Record<string, unknown> | null;
     /**
-     * How a parked refund was sourced and what delivering it cost (internal-review).
+     * How a parked refund was sourced and what delivering it cost.
      *
      * `null` on an accumulator park — there the consumed rows *are* the record —
      * and on every non-cashu rail. Set only where the notes were minted just in
@@ -4301,7 +4183,7 @@ interface CreditDrainRecord {
     /** When an unfulfilled Tempo drain was restored to the credit balance. */
     releasedAt: number | null;
     /**
-     * Why an operator closed this drain out without booking it (internal-review), and
+     * Why an operator closed this drain out without booking it, and
      * when. Set only on a channel drain the payout floor refused: the chain paid
      * the caller less than this ledger was extinguishing, the operator reviewed
      * the two figures and is not booking the difference.
@@ -4336,7 +4218,6 @@ interface DrainWriteOff {
     drain: CreditDrainRecord;
     written: boolean;
 }
-/** Result of restoring an unfulfilled Tempo drain to its credit. */
 interface DrainReleaseResult {
     drain: CreditDrainRecord;
     credit: CreditSnapshot;
@@ -4344,7 +4225,7 @@ interface DrainReleaseResult {
 }
 /**
  * Result of a terminal drain transition — {@link CreditLedger.markDrainPickedUp}
- * and {@link CreditLedger.markDrainSent} (internal-review).
+ * and {@link CreditLedger.markDrainSent}.
  *
  * The record alone can't answer "did I move this money", because the CAS
  * winner and an idempotent replay return the same row. Anything that must
@@ -4356,7 +4237,6 @@ interface DrainTransitionResult {
     /** True when the drain was already terminal and this call changed nothing. */
     replayed: boolean;
 }
-/** Result of {@link CreditLedger.requestDrain}. */
 interface DrainRequestResult {
     drain: CreditDrainRecord;
     /** The credit as of this call — balance already debited on a fresh drain. */
@@ -4381,7 +4261,6 @@ interface CreditSnapshot {
      * `availableMicro` in the funding rail's own units — the ceiling any
      * rail-denominated payout must respect. `null` marks a rail that reports no
      * native basis, which is why a channel drain refuses rather than guessing
-     * (internal-review).
      */
     nativeAvailable: number | null;
     expiryMs: number;
@@ -4391,7 +4270,7 @@ interface CreditSnapshot {
     lastLedgerSeq: number;
     createdAt: number;
     /**
-     * The rail this balance was funded on (internal-review); `null` on a credit opened
+     * The rail this balance was funded on; `null` on a credit opened
      * before rail basis was recorded, which conflicts with nothing. Exposed so a
      * route can refuse a cross-rail top-up **before** taking the payment `fund`
      * would then refuse `rail_mismatch`.
@@ -4403,7 +4282,7 @@ interface CreditSnapshot {
     x402ChannelId: string | null;
 }
 /**
- * Result of a draw — carries the receipt tuple the internal-review countersignature
+ * Result of a draw — carries the receipt tuple the countersignature
  * consumes (`ReceiptCredit`: `draw_id`, `amount`, `balance_after`,
  * `ledger_seq`). `balanceAfterMicro` and `ledgerSeq` are the values recorded
  * when the draw was first placed; a replay returns them unchanged.
@@ -4419,13 +4298,13 @@ interface DrawResult {
     status: DrawStatus;
     /** True when this call was an idempotent replay of an already-recorded state. */
     replayed: boolean;
-    /** Rail value allocated to this draw, plus the credit's rail identity (internal-review). */
+    /** Rail value allocated to this draw, plus the credit's rail identity. */
     railValue: DrawRailValue;
     /** When the draw reached its terminal state; `null` while pending. */
     resolvedAt: number | null;
 }
 /**
- * The rail-native slice of a credit that one draw carries (internal-review) — what
+ * The rail-native slice of a credit that one draw carries — what
  * makes a settled draw bookable as a revenue event on the funding's rail.
  *
  * Allocated at draw time as `remaining × amountMicro / availableMicro`, where
@@ -4441,7 +4320,7 @@ interface DrawRailValue {
     drawNative: number | null;
     /**
      * Rail that funded the credit — a {@link FundingMethod} on any row `fund`
-     * wrote, `null` on one it opened before internal-review recorded the column. Stays
+     * wrote, `null` on one it opened before recorded the column. Stays
      * `string` rather than the union: this is a database read, and a fleet
      * mid-rollout can hold a rail a newer build wrote ({@link isFundingRail}).
      */
@@ -4456,7 +4335,7 @@ interface DrawRailValue {
     creditCurrency: string | null;
 }
 /**
- * Result of `growDraw` (internal-review) — the draw's post-growth tuple, plus the
+ * Result of `growDraw` — the draw's post-growth tuple, plus the
  * slice this top-up added. The added slice is what the mid-job rail result
  * reports as its `paidMsats` delta: the job's counters accumulate increments,
  * not the running total the draw now holds.
@@ -4470,7 +4349,7 @@ interface GrownDrawResult extends DrawResult {
     /** Fiat micro this growth added — `amountMicro` minus the pre-growth amount. */
     addedAmountMicro: number;
     /**
-     * Fiat micro the internal-review cap refused, because growing by it would have
+     * Fiat micro the cap refused, because growing by it would have
      * pushed the draw past what the job cumulatively asked. Zero on every
      * ordinary top-up. Non-zero means money landed on the credit that this job
      * did not buy anything with — it stays the caller's available balance, and
@@ -4491,7 +4370,7 @@ interface DrawRecord extends Omit<DrawResult, "replayed"> {
     createdAt: number;
     /**
      * What `allocateDrawValue` allocated this draw when the payment landed
-     * (internal-review) — the pro-rata slice of the credit's pooled rail value that
+     * the pro-rata slice of the credit's pooled rail value that
      * `withDrawBasis` mirrored onto the job's `paidMsats` counter.
      *
      * Equal to `railValue.drawMsats` on every draw the settle did not re-price,
@@ -4504,8 +4383,8 @@ interface DrawRecord extends Omit<DrawResult, "replayed"> {
     allocatedMsats: number;
 }
 /**
- * Keyset cursor into {@link CreditLedgerLike.listStalePendingDraws} (internal-review)
- * — the sort key of the last row a caller examined. Offset paging would not
+ * Keyset cursor into {@link CreditLedgerLike.listStalePendingDraws}, holding the
+ * sort key of the last row a caller examined; offset paging would not
  * do: the scan skips holds it can't resolve (their job row exists), so those
  * rows stay `pending` and reappear at the head of every subsequent page. The
  * tuple is `(createdAt, creditId, ledgerSeq)`, matching the read's `ORDER BY`;
@@ -4518,7 +4397,7 @@ interface StalePendingDrawCursor {
     ledgerSeq: number;
 }
 /**
- * Rail value one funding contributes to a credit (internal-review). Recorded so a
+ * Rail value one funding contributes to a credit. Recorded so a
  * later draw can be allocated its share of what the rail actually paid, and so
  * the platform can book the funding as a deposit.
  */
@@ -4527,11 +4406,11 @@ interface CreditFundingBasis {
      * The rail whose value this funding carries. A top-up on another rail is
      * refused (`rail_mismatch`).
      *
-     * Narrowed from `string` to {@link FundingMethod} by internal-review — the same type
+     * Narrowed from `string` to {@link FundingMethod} by — the same type
      * {@link FUNDING_RAILS} is keyed by — so a rail cannot enter `credits.rail`
      * that the terminal has no way to book revenue under. That silently costs
      * every draw the credit backs its booking, which is what happened when
-     * `lightning` reached the ledger before the reader's allow-list (internal-review).
+     * `lightning` reached the ledger before the reader's allow-list.
      */
     rail: FundingMethod;
     /** Rail payment value in millisatoshis. */
@@ -4565,14 +4444,14 @@ interface CreditFundArgs {
     amountMicro: number;
     /** Absolute expiry, ms since epoch. Overwrites the previous value on top-up. */
     expiryMs: number;
-    /** Rail-value basis this funding contributes (internal-review, required by internal-review). */
+    /** Rail-value basis this funding contributes (required by ). */
     basis: CreditFundingBasis;
     /** External transaction handle — caller owns BEGIN/COMMIT (spec condition 3). */
     tx?: CreditLedgerQuerier;
     nowMs?: number;
 }
 /**
- * Allocate a draw's share of a credit's unspent rail value (internal-review). Pure —
+ * Allocate a draw's share of a credit's unspent rail value. Pure —
  * shared by the Postgres and in-memory ledgers so the two can't drift.
  *
  * `availableMicro` and both remainders must be net of pending holds; the
@@ -4587,7 +4466,7 @@ declare function allocateDrawValue(args: {
     drawMsats: number;
     drawNative: number | null;
 };
-/** Full persisted `credit_fundings` row, camel-cased (internal-review). */
+/** Full persisted `credit_fundings` row, camel-cased. */
 interface FundingRecord {
     creditId: string;
     fundId: string;
@@ -4603,7 +4482,7 @@ interface FundingRecord {
     receipt: FundingReceipt | null;
 }
 /**
- * Lifecycle of a Lightning funding invoice (internal-review).
+ * Lifecycle of a Lightning funding invoice.
  *
  * Only `pending` is live; everything else is terminal. The two that carry no
  * balance carry opposite money: `expired` was never paid and owes nobody
@@ -4611,7 +4490,7 @@ interface FundingRecord {
  * operator. Both exist so that a row the sweep can never advance stops being
  * swept.
  *
- * `reconciled` and `written_off` (internal-review) are where a `blocked` row goes once
+ * `reconciled` and `written_off` are where a `blocked` row goes once
  * that operator acts — respectively, the money was credited onto a credit they
  * named, or they decided it would not be. Neither is `settled`: that one means
  * the ledger applied the payment to the top-up the caller asked for, and
@@ -4619,7 +4498,7 @@ interface FundingRecord {
  * human had to intervene.
  */
 type CreditInvoiceStatus = "pending" | "settled" | "expired" | "blocked" | "reconciled" | "written_off";
-/** Full persisted `credit_invoices` row, camel-cased (internal-review). */
+/** Full persisted `credit_invoices` row, camel-cased. */
 interface CreditInvoiceRecord {
     creditId: string;
     fundId: string;
@@ -4638,7 +4517,7 @@ interface CreditInvoiceRecord {
      * trail for why a human had to touch this row at all.
      */
     blockedReason: string | null;
-    /** Credit an operator sent a blocked invoice's money to (internal-review). */
+    /** Credit an operator sent a blocked invoice's money to. */
     reconciledCreditId: string | null;
     /** Funding key on that credit — the payment hash. See `reconcileBlockedInvoice`. */
     reconciledFundId: string | null;
@@ -4652,18 +4531,18 @@ interface CreditInvoiceRecord {
     /** When the payment landed at the wallet — never the instant an operator acted on it. */
     settledAt: number | null;
 }
-/** Outcome of applying an observed settlement to the ledger (internal-review). */
+/** Outcome of applying an observed settlement to the ledger. */
 interface InvoiceSettlement {
     invoice: CreditInvoiceRecord;
-    /** The `credit_fundings` row; absent only if a pre-internal-review row somehow lacks one. */
+    /** The `credit_fundings` row; absent only if a legacy row somehow lacks one. */
     funding: FundingRecord | undefined;
     credit: CreditSnapshot | undefined;
     /** True when this settlement had already been applied — nothing moved. */
     replayed: boolean;
 }
 /**
- * Outcome of an operator crediting a blocked invoice onto a credit they named
- * (internal-review). Same shape as {@link InvoiceSettlement}, but `funding` and
+ * Outcome of an operator crediting a blocked invoice onto a credit they named;
+ * it has the same shape as {@link InvoiceSettlement}, but `funding` and
  * `credit` describe the **target** credit, not the one the invoice was minted
  * against.
  */
@@ -4689,7 +4568,7 @@ interface BlockedInvoiceCursor {
 /** Typed failure codes for {@link CreditLedgerError}. */
 type CreditLedgerErrorCode = "credit_not_found" | "credit_expired" | "credit_unbacked" | "tempo_channel_closing" | "tempo_settlement_pending" | "settlement_pending" | "insufficient_credit" | "draw_conflict" | "draw_not_found" | "invalid_draw_state" | "funding_replayed" | "currency_mismatch" | "caller_mismatch" | "rail_mismatch" | "invalid_amount" | "invalid_expiry" | "invalid_basis" | "nothing_to_drain" | "drain_below_dust" | "drain_not_found" | "drain_conflict" | "invalid_drain_state" | "invoice_not_found" | "invoice_conflict" | "invoice_not_blocked" | "below_rail_minimum";
 /**
- * Which conflict a `drain_conflict` is, for the routes that answer one (internal-review).
+ * Which conflict a `drain_conflict` is, for the routes that answer one.
  *
  * One code covers refusals whose only common property is that no drain was
  * booked; the copy a caller relays to a human differs entirely between them.
@@ -4702,7 +4581,7 @@ type CreditLedgerErrorCode = "credit_not_found" | "credit_expired" | "credit_unb
  * `balance_moved` roll back with nothing on any chain and clear on their own;
  * `refund_floor` is the opposite — the cooperative refund reached the chain and
  * paid short, so the caller's money moved and only the operator repair resolves
- * it (internal-review). A route's `retryable` and `drain_registered` follow from which
+ * it. A route's `retryable` and `drain_registered` follow from which
  * one it is, so the tag has to reach it.
  *
  * Absent means the duplicate-payout conflict `PAYMENT_ERROR_COPY.drain_conflict`
@@ -4740,13 +4619,13 @@ interface CreditLedgerErrorDetails {
     settlementId?: string;
     /** On `settlement_pending`: that settlement's status, so an operator sees which repair applies. */
     settlementStatus?: string;
-    /** On `settlement_pending`: the drain id that settlement is under — the one id this gate admits (internal-review). */
+    /** On `settlement_pending`: the drain id that settlement is under — the one id this gate admits. */
     blockingDrainId?: string;
 }
 /**
  * Thrown by every {@link CreditLedger} method on refusal. Carries a `code`
  * discriminator (plus structured `details`) so callers branch on a field
- * instead of string-matching messages — the internal-review quote surface maps
+ * instead of string-matching messages — the quote surface maps
  * `insufficient_credit` + `details.availableMicro` onto the structured
  * 402-class wire error.
  */
@@ -4822,14 +4701,14 @@ interface TempoSessionLifecycle {
  * parent-credit lock through the same client.
  *
  * {@link withVoucherAcceptance} acquires its pooled client **lazily**, on the
- * first store mutation rather than up front (internal-review). Its `operation` is
+ * first store mutation rather than up front. Its `operation` is
  * mppx's credential verification, which does the chain work before it touches
  * the store: an `open` submits the escrow transaction and awaits its receipt,
  * a `voucher` reads channel state over public RPC. Holding a connection across
  * that starves everything else on the shared host pool — `/v1/job`, the job
  * store, KV, the credit ledger, the replay store — and exposes the open
  * transaction to `idle_in_transaction_session_timeout`. This is the same shape
- * internal-review removed from the x402 settlement path. Laziness costs nothing in
+ * removed from the x402 settlement path. Laziness costs nothing in
  * atomicity: the `FOR UPDATE` row lock was always taken at the first mutation,
  * never at `BEGIN`, so the critical section is unchanged — only the
  * connection-holding window shrinks to the database work it actually covers.
@@ -4933,14 +4812,14 @@ interface MppOpts {
     /**
      * When set, only register MPP methods whose name appears in this list, even
      * if the per-rail env var (`DVMKIT_TEMPO_RECIPIENT`) is configured
-     * (internal-review). Lets operators temporarily disable a rail without unsetting
+     * Lets operators temporarily disable a rail without unsetting
      * other knobs. Empty/undefined falls back to "register everything that has
      * a configured recipient".
      */
     methodsAllowlist?: string[];
     /**
      * Durable replay protection for the one-shot `tempo/charge` method
-     * (internal-review). Omit and mppx falls back to `Store.memory()`, whose consumed
+     * Omit and mppx falls back to `Store.memory()`, whose consumed
      * transaction hashes are per-process — invisible to sibling machines and lost
      * on restart. Pass a cross-machine store (`PostgresTempoChargeStore`) on any
      * multi-instance deploy.
@@ -4970,7 +4849,7 @@ interface MppOpts {
             amount?: string | bigint;
             intervalMs?: number;
             /**
-             * How long a settlement holds its in-flight lease (internal-review). Defaults to
+             * How long a settlement holds its in-flight lease. Defaults to
              * {@link TEMPO_SETTLEMENT_LEASE_MS}, which documents the receipt-timeout
              * floor an override has to stay above.
              */
@@ -5031,7 +4910,7 @@ interface MppxServer {
      * Reconcile active TIP-1034 channels; present only on a durable session
      * handle. `inFlight` counts channels the sweep found due but declined to
      * settle because another path already holds their settlement lease
-     * (internal-review) — a deferral, not a failure.
+     * a deferral, not a failure.
      */
     sweepTempoSessions?: () => Promise<{
         scanned: number;
@@ -5041,7 +4920,7 @@ interface MppxServer {
     }>;
     /**
      * Reconcile and, if the channel is at risk, settle exactly one TIP-1034
-     * channel (internal-review). The forced-close protection path: a verified on-chain
+     * channel. The forced-close protection path: a verified on-chain
      * `CloseRequested` event authorises this and nothing else.
      *
      * Needs no `listActive`, unlike {@link sweepTempoSessions} — a store that
@@ -5074,7 +4953,7 @@ interface MppxServer {
     /** Recover a close result after a process failure between chain and ledger commits. */
     recoverTempoSessionClose?: (channelId: string, drainId: string) => Promise<string | null>;
     /**
-     * Read a channel's close intent without touching it (internal-review).
+     * Read a channel's close intent without touching it.
      *
      * The operator repair needs the reference a confirmed close already carries,
      * and it must not be `recoverTempoSessionClose`: that one *writes* — an
@@ -5086,14 +4965,14 @@ interface MppxServer {
     /** Read terminally consumed value for an exact cooperative-close challenge. */
     getTempoSessionSpent?: (channelId: string) => Promise<bigint>;
     /**
-     * Read the immutable chain binding of a stored channel (internal-review), or `null`
+     * Read the immutable chain binding of a stored channel, or `null`
      * when this DVM holds no such channel. What a close event must match before
      * it may authorise anything.
      */
     getTempoSessionBinding?: (channelId: string) => Promise<TempoChannelBinding | null>;
     /**
      * Fetch a transaction receipt from this DVM's **own** configured Tempo RPC
-     * (internal-review) — the independent read that makes a close-event locator
+     * the independent read that makes a close-event locator
      * self-verifying rather than something the platform asserts.
      */
     getTempoReceipt?: (args: {
@@ -5107,7 +4986,7 @@ interface MppxServer {
         }[];
     } | null>;
     /**
-     * Read what a landed cooperative close actually paid out (internal-review).
+     * Read what a landed cooperative close actually paid out.
      *
      * mppx decodes `ChannelClosed` while verifying the close credential and then
      * drops both amounts — its session receipt carries only the channel, the
@@ -5132,7 +5011,7 @@ interface TempoChannelCloseAmounts {
     refundedToPayer: bigint;
 }
 /**
- * What a targeted single-channel settlement did (internal-review).
+ * What a targeted single-channel settlement did.
  *
  * The platform's close observer acknowledges its durable event on a terminal
  * outcome and retries otherwise, so the distinctions here are a delivery
@@ -5140,16 +5019,16 @@ interface TempoChannelCloseAmounts {
  *
  * - `settled` — a settlement transaction landed for this channel.
  * - `already_safe` — the on-chain watermark already covers every accepted
- *   voucher, so there is nothing to protect. A replay lands here.
+ * voucher, so there is nothing to protect. A replay lands here.
  * - `unknown_channel` — not in this DVM's durable store. Terminal: a DVM must
- *   never settle a channel it does not own.
+ * never settle a channel it does not own.
  * - `finalized_before_protection` — the channel finalized while it still owed
- *   us value. A **money incident**, not a success: the grace period elapsed
- *   without settlement and the deposit is gone. Preserved and paged, never
- *   quietly acknowledged.
+ * us value. A **money incident**, not a success: the grace period elapsed
+ * without settlement and the deposit is gone. Preserved and paged, never
+ * quietly acknowledged.
  * - `retryable_failure` — a chain read or settlement attempt failed, or another
- *   path is already broadcasting a settlement for this channel (internal-review). The
- *   event stays pending and is retried inside the grace period.
+ * path is already broadcasting a settlement for this channel. The
+ * event stays pending and is retried inside the grace period.
  */
 type TempoChannelSettlementOutcome = {
     outcome: "settled";
@@ -5174,7 +5053,6 @@ type TempoChannelSettlementOutcome = {
 };
 /**
  * The immutable chain identity a TIP-1034 channel was opened against
- * (internal-review).
  *
  * Doubles as the close-event authorisation record and as what the DVM reports
  * to the platform so a close can be routed back to it. `payee` is the DVM's
@@ -5233,7 +5111,6 @@ interface CanonicalEnvelope {
     nonce: string;
     auth_statement?: SignedRequestStatementHeader;
 }
-/** Options for `createSignedRequestVerifier`. */
 interface CreateSignedRequestVerifierOpts {
     /** Fixed audience/operation for a custom signed route or standalone verifier. */
     domain?: SignedRequestDomain;
@@ -5251,8 +5128,8 @@ interface CreateSignedRequestVerifierOpts {
     /**
      * Field names removed from the input before `schema` validates it — and
      * **kept** in the canonical bytes the signature covers. For protocol-reserved
-     * keys the caller signs but the schema never declares: the internal-review credit
-     * envelope riding a capability schema (internal-review). Defaults to none.
+     * keys the caller signs but the schema never declares: the credit
+     * envelope riding a capability schema. Defaults to none.
      *
      * This is the one place where "what is validated" and "what is signed"
      * legitimately differ. Don't reach for it to paper over a schema mismatch —
@@ -5277,7 +5154,6 @@ interface SignedRequestReplayStore {
      */
     checkAndRecord(pubkey: string, timestamp: number, nonce: string, now: number): Promise<boolean>;
 }
-/** Options for the signer half. */
 interface SignedRequestSignOpts {
     /** Unix timestamp in seconds. Defaults to `now()`. */
     timestamp?: number;
@@ -5285,17 +5161,16 @@ interface SignedRequestSignOpts {
     nonce?: string;
 }
 /**
- * Round-trip verifier + signer for secp256k1+BIP-340 Schnorr-signed protocol
- * requests (internal-review, internal-review, internal-review).
+ * Round-trip verifier + signer for secp256k1+BIP-340 Schnorr-signed protocol requests.
  *
  * Authentication is two-step so the replay nonce is committed iff a job is
  * created, not on every request entry:
  *
  * 1. {@link checkAuth} runs schema → drift → signature at request entry on
- *    both `/v1/quote` and `/v1/job`. Sync; no replay-store touch.
+ * both `/v1/quote` and `/v1/job`. Sync; no replay-store touch.
  * 2. {@link recordReplay} commits `(pubkey, timestamp, nonce)` to the replay
- *    store. Called from `/v1/job` only, after upfront payment is verified
- *    and immediately before `jobManager.createJob`.
+ * store. Called from `/v1/job` only, after upfront payment is verified
+ * and immediately before `jobManager.createJob`.
  *
  * The unpaid `/v1/job` warmup probe (price discovery → 402) thus no longer
  * burns the nonce — clients can re-submit the same envelope with a real
@@ -5310,7 +5185,7 @@ interface SignedRequestVerifier<T> {
     checkAuth(input: unknown, domain?: SignedRequestDomain): T & CanonicalEnvelope;
     /**
      * Schema + signature check against `input`, without the drift window check
-     * or replay-store touch (internal-review). For the reactivation path where the
+     * or replay-store touch. For the reactivation path where the
      * persisted timestamp is from the original signing instant (could be hours
      * or days ago) and the replay nonce was already committed at submission.
      * Returns the verified envelope; throws {@link SignedRequestError} with
@@ -5341,7 +5216,7 @@ type SignedRequestFailure = "schema_invalid" | "timestamp_drift" | "signature_in
  *
  * The single definition of "which part of a schema failure is the envelope's":
  * the post-parse shape check in `parse()` iterates it, and `authErrorBody`'s
- * internal-review classifier reads its keys to decide whether a `schema_invalid` throw
+ * classifier reads its keys to decide whether a `schema_invalid` throw
  * is the caller's *input* being wrong (disclosable: the schema is public on
  * `/v1/info`) or their *signing* being wrong (folded into `signature_invalid`,
  * one answer for every key and signature failure). `satisfies` pins it to
@@ -5362,7 +5237,7 @@ declare class SignedRequestError extends Error {
     readonly sub_reason: SignedRequestFailure;
     /**
      * The Zod issues behind a `schema_invalid`, when the failure came from a
-     * `safeParse` that produced any (internal-review). `authErrorBody` reads their
+     * `safeParse` that produced any. `authErrorBody` reads their
      * paths to tell an input violation from an envelope one, and renders the
      * input half into the caller-facing `display`. Absent on every other
      * `sub_reason`, and on the `schema_invalid` throws that aren't a parse
@@ -5374,7 +5249,7 @@ declare class SignedRequestError extends Error {
     constructor(message: string, sub_reason: SignedRequestFailure, 
     /**
      * The Zod issues behind a `schema_invalid`, when the failure came from a
-     * `safeParse` that produced any (internal-review). `authErrorBody` reads their
+     * `safeParse` that produced any. `authErrorBody` reads their
      * paths to tell an input violation from an envelope one, and renders the
      * input half into the caller-facing `display`. Absent on every other
      * `sub_reason`, and on the `schema_invalid` throws that aren't a parse
@@ -5384,8 +5259,7 @@ declare class SignedRequestError extends Error {
     issues?: readonly z.core.$ZodIssue[] | undefined);
 }
 /**
- * Build a secp256k1+BIP-340 Schnorr-over-canonical-JSON request verifier
- * (internal-review, internal-review, internal-review).
+ * Build a secp256k1+BIP-340 Schnorr-over-canonical-JSON request verifier.
  *
  * Generalises cast's `canonicalSignedPayload` + `verifyCanonicalSignedRequest`
  * into a reusable primitive — `(schema, opts) -> { verify, canonicalBytes, signRequest }`.
@@ -5394,10 +5268,10 @@ declare class SignedRequestError extends Error {
  */
 declare function createSignedRequestVerifier<T = unknown>(schema: ZodLike<T>, opts?: CreateSignedRequestVerifierOpts): SignedRequestVerifier<T>;
 /**
- * The wire object the caller signed, taken out of a request body (internal-review).
+ * The wire object the caller signed, taken out of a request body.
  *
  * **The single definition of which bytes get verified, and every auth call site
- * reads it**: `/v1/quote`, the `/v1/job` submit, and the internal-review reactivation
+ * reads it**: `/v1/quote`, the `/v1/job` submit, and the reactivation
  * re-verify. They used to disagree — quote checked the raw `body.data`, submit
  * checked `JobManager.parseInput`'s Zod output — so the two agreed only where
  * the parse happened to be an identity on the caller's payload. A nested
@@ -5427,13 +5301,13 @@ declare function signedRequestInput(body: {
  * cross-machine `SignedRequestReplayStore` is supplied. 10-minute retention
  * window, 100k entry cap, per-process. Exported so `secp256k1Auth(...)` can
  * pre-build one and share it across every per-schema verifier plus its own
- * `recordReplay` path (internal-review).
+ * `recordReplay` path.
  *
  * When the cap is hit after the time-expired sweep, fresh inserts are
  * **rejected** (return `true` — treated as replay at the wire) rather than
  * silently evicting an in-window entry. Silent eviction would flush a
  * still-valid nonce back to "unseen" and let an attacker who can drive cap
- * pressure replay it (internal-review). A rate-limited structured warning fires so
+ * pressure replay it. A rate-limited structured warning fires so
  * operators see saturation in `fly logs`; reaching cap means in-memory has
  * been pushed past where it's safe and the deploy should move to
  * `PostgresReplayStore`.
@@ -5442,25 +5316,25 @@ declare function createDefaultReplayStore(): SignedRequestReplayStore;
 
 /**
  * A DVM-level auth scheme, declared on `DVMDescriptor.auth`. Authentication
- * is two-step (internal-review):
+ * is two-step:
  *
  * 1. {@link checkAuth} fires at request entry on `/v1/quote` and `/v1/job`,
- *    before payment verification. Schema / drift / signature checks only —
- *    no replay-store touch. Unsigned / malformed / stale / wrong-sig
- *    envelopes reject with HTTP 401 with no Cashu round-trip and no pending
- *    revenue row (internal-review).
+ * before payment verification. Schema / drift / signature checks only —
+ * no replay-store touch. Unsigned / malformed / stale / wrong-sig
+ * envelopes reject with HTTP 401 with no Cashu round-trip and no pending
+ * revenue row.
  * 2. {@link recordReplay} fires on `/v1/job` only, after upfront payment is
- *    verified and immediately before `jobManager.createJob`. Commits the
- *    `(pubkey, timestamp, nonce)` tuple to the replay store; throws 401
- *    `replay_detected` on duplicate. The unpaid 402-discovery hop does not
- *    burn the nonce, so clients can re-submit with payment.
+ * verified and immediately before `jobManager.createJob`. Commits the
+ * `(pubkey, timestamp, nonce)` tuple to the replay store; throws 401
+ * `replay_detected` on duplicate. The unpaid 402-discovery hop does not
+ * burn the nonce, so clients can re-submit with payment.
  *
  * On `replay_detected` after payment was already accepted, the SDK responds
  * 401 fail-closed uniformly across cashu / mppx / x402 — no rail-specific
- * refund or compensation logic (internal-review / internal-review). The Cashu accept path
+ * refund or compensation logic. The Cashu accept path
  * commits proofs into the accumulator wallet inside `verifyUpfrontPayment`
- * before `recordReplay` runs (internal-review rejects unlocked Cashu upstream, so
- * the accumulator is the only production path), so no proofs are held to
+ * before `recordReplay` runs. Unlocked Cashu is rejected upstream, so the
+ * accumulator is the only production path and no proofs are held to
  * refund; mppx / x402 credentials are single-use and already consumed by
  * the facilitator.
  *
@@ -5473,20 +5347,20 @@ declare function createDefaultReplayStore(): SignedRequestReplayStore;
  * signature covers it. Those keys are the protocol's, not the capability's, so
  * a scheme must not fail a schema that doesn't declare them — `secp256k1Auth`
  * removes them for the schema check only, keeping the signing bytes verbatim
- * (internal-review). A custom scheme owes callers the same tolerance, or every strict
+ * A custom scheme owes callers the same tolerance, or every strict
  * schema 401s on an explicit draw.
  */
 /**
- * The replay-store backend resolved at host-boot time (internal-review). Surfaced in
+ * The replay-store backend resolved at host-boot time. Surfaced in
  * the boot summary so operators see which protection is active.
  *
  * - `postgres` — SDK auto-wired a `PostgresReplayStore` against the host's
- *   pool. Cross-machine safe.
+ * pool. Cross-machine safe.
  * - `memory` — SDK fell back to the in-memory FIFO. Per-process; unsafe for
- *   multi-machine deploys. `createDVMHost` emits a warning (or throws under
- *   `DVMKIT_FAIL_FAST=true`) when this kicks in outside `devMode`.
+ * multi-machine deploys. `createDVMHost` emits a warning (or throws under
+ * `DVMKIT_FAIL_FAST=true`) when this kicks in outside `devMode`.
  * - `user-supplied` — user passed an explicit `replayStore` at factory time.
- *   SDK doesn't override.
+ * SDK doesn't override.
  * - `disabled` — user passed `replayStore: null`. No replay tracking.
  */
 type ReplayStoreBackend = "postgres" | "memory" | "user-supplied" | "disabled";
@@ -5500,7 +5374,7 @@ interface DVMAuthScheme {
     };
     /**
      * Re-verify the signature on a persisted envelope at reactivation time
-     * (internal-review). Schema + signature only — no drift check, no replay-store
+     * Schema + signature only — no drift check, no replay-store
      * touch. Catches DB-layer tampering: persisted `record.input` would
      * otherwise be trusted as authentic, and a compromised row could feed an
      * attacker-supplied pubkey/envelope into the handler. Throws
@@ -5511,7 +5385,7 @@ interface DVMAuthScheme {
     /** Commit the envelope's `(pubkey, timestamp, nonce)` to the replay store. Throws on duplicate. */
     recordReplay(envelope: CanonicalEnvelope): Promise<void>;
     /**
-     * Called by `createDVMHost` after the Postgres pool is resolved (internal-review).
+     * Called by `createDVMHost` after the Postgres pool is resolved.
      * The SDK passes a Postgres store when one is available; the scheme adopts
      * it iff the user did not supply `replayStore` explicitly at factory time.
      * Returns the resolved backend for boot-summary logging. User code should
@@ -5521,7 +5395,6 @@ interface DVMAuthScheme {
         postgresStore?: SignedRequestReplayStore;
     }): ReplayStoreBackend;
 }
-/** Options for `secp256k1Auth()`. */
 interface Secp256k1AuthOpts {
     /**
      * Override the replay-window store. Most callers should omit this opt:
@@ -5529,7 +5402,7 @@ interface Secp256k1AuthOpts {
      * pool is available, and falls back to a bounded in-memory FIFO (10-min
      * window, 100k cap) only when no pool exists — emitting a warning (or
      * throwing under `DVMKIT_FAIL_FAST=true`) outside `devMode` so multi-machine
-     * deploys can't silently inherit the per-process default (internal-review).
+     * deploys can't silently inherit the per-process default.
      *
      * Pass a custom `SignedRequestReplayStore` here only to override that
      * default (e.g. a different cross-machine backend), or pass `null` to
@@ -5543,8 +5416,7 @@ interface Secp256k1AuthOpts {
     now?: () => number;
 }
 /**
- * Build a descriptor-level secp256k1+BIP-340 Schnorr auth scheme (internal-review,
- * internal-review).
+ * Build a descriptor-level secp256k1+BIP-340 Schnorr auth scheme.
  *
  * Declare on `configureDVM({ auth: secp256k1Auth({...}) })` to gate every
  * capability's `/v1/job` and `/v1/quote` on a signed request envelope
@@ -5579,7 +5451,7 @@ interface ZodLike<T = unknown> {
 /** Extract the output type from a ZodLike schema, or default to string. */
 type InputType<T> = T extends ZodLike<infer O> ? O : string;
 /**
- * Narrowed type for capability `example` payloads (internal-review).
+ * Narrowed type for capability `example` payloads.
  *
  * Surfaces the Zod schema's output type so a drifted example produces a
  * TypeScript error at the `configureDVM` call site. Falls back to
@@ -5612,19 +5484,16 @@ interface KVStore {
     set(key: string, value: unknown, opts?: {
         ttl?: number;
     }): Promise<void>;
-    /** Delete a key. */
     delete(key: string): Promise<void>;
     /** List keys, optionally filtered by prefix. */
     list(prefix?: string): Promise<string[]>;
 }
-/** Options for ctx.prompt(). */
 interface PromptOpts {
     /** Preset choices the client can select from. */
     options?: string[];
     /** JSON Schema describing the expected structured response. */
     schema?: Record<string, unknown>;
 }
-/** Options for ctx.requestPayment(). */
 interface SDKPaymentRequestOpts {
     /** Cashu mints accepted for this payment. */
     mints?: string[];
@@ -5642,11 +5511,11 @@ interface SDKPaymentRequestOpts {
      * pre-issued mppx challenge per accepted method/intent. Overrides the
      * SDK's auto-issued challenges; if omitted, and the SDK is configured for
      * MPP, challenges are issued automatically. Each challenge's `id` becomes
-     * part of this job's per-job replay binding (internal-review).
+     * part of this job's per-job replay binding.
      *
      * `session`-intent challenges are dropped from this list, whoever issued
      * them: reusable channels fund credits on `POST /v1/credit` and are refused
-     * everywhere on the job surface (internal-review).
+     * everywhere on the job surface.
      */
     mpp?: {
         challenges: MppxChallenge[];
@@ -5687,14 +5556,13 @@ interface SDKJobContext<State = Record<string, unknown>, Input = string> {
     readonly tags: string[];
     /** Job input — raw string or parsed/validated object when an input schema is defined. */
     readonly input: Input;
-    /** Job parameters as key-value pairs. */
     readonly params: Record<string, string>;
     /** Opaque requester identifier (derived from auth token or "anonymous"). */
     readonly requesterId: string;
     /** Total msats paid so far for this job. */
     readonly paidMsats: number;
     /**
-     * Verified caller identity from the descriptor's `auth` scheme (internal-review).
+     * Verified caller identity from the descriptor's `auth` scheme.
      * Present when the DVM declares `auth: secp256k1Auth(...)`; undefined for
      * DVMs without descriptor-level auth. The envelope is the same `T &
      * CanonicalEnvelope` the auth scheme produced — handlers can read
@@ -5717,10 +5585,10 @@ interface SDKJobContext<State = Record<string, unknown>, Input = string> {
      *
      * - `number` = msats raw (sats-native operators).
      * - `{ amount, currency }` = fiat envelope; the SDK converts to sats at
-     *   send-time via its centralised fx fetcher. v1 supports `currency: "usd"`
-     *   only; other currencies throw `UnsupportedCurrencyError`.
+     * send-time via its centralised fx fetcher. v1 supports `currency: "usd"`
+     * only; other currencies throw `UnsupportedCurrencyError`.
      *
-     * The legacy `string` form (`"$0.05"`) was removed in internal-review under the
+     * The legacy `string` form (`"$0.05"`) was removed in under the
      * project's no-shims convention. Migrate callers to the fiat envelope.
      */
     requestPayment(amount: number | {
@@ -5742,14 +5610,14 @@ interface SDKJobContext<State = Record<string, unknown>, Input = string> {
     /**
      * Fail the job with an error message. No debit happens either way — the
      * terminal funnel releases the credit draw ({@link RAIL_REFUNDABLE}).
-     * `{ refund: true }` annotates the failure as caller-fault (internal-review); it
+     * `{ refund: true }` annotates the failure as caller-fault; it
      * moves no money on any rail and never has.
      */
     fail(error: string, opts?: {
         refund?: boolean;
     }): void;
     /**
-     * Declare what this job cost **you**, the builder, to serve (internal-review).
+     * Declare what this job cost **you**, the builder, to serve.
      *
      * The SDK reports it to the platform alongside the job's revenue, so the
      * dashboard can state a margin. Without it the margin is unknowable, and the
@@ -5777,9 +5645,9 @@ interface SDKJobContext<State = Record<string, unknown>, Input = string> {
      *
      * ```ts
      * const r = await ctx.step("transcribe", async () => {
-     *   const result = await whisper(audio);
-     *   ctx.cost({ amount: result.seconds * 0.0001, currency: "usd" });
-     *   return result;
+     * const result = await whisper(audio);
+     * ctx.cost({ amount: result.seconds * 0.0001, currency: "usd" });
+     * return result;
      * });
      * ```
      *
@@ -5814,7 +5682,7 @@ interface SDKJobContext<State = Record<string, unknown>, Input = string> {
      */
     fetch: typeof globalThis.fetch;
     /**
-     * Cancellation signal for this job (internal-review). Aborts when the caller
+     * Cancellation signal for this job. Aborts when the caller
      * cancels, the job idles out, or the handler is superseded. `ctx.fetch`
      * already carries it; pass it into anything else that can be torn down —
      * a provider SDK's `signal` option, a `spawn`, your own sleeps — so a
@@ -5824,7 +5692,6 @@ interface SDKJobContext<State = Record<string, unknown>, Input = string> {
     readonly signal: AbortSignal;
     /** Environment variables configured by the operator. */
     env: Record<string, string>;
-    /** Structured logging. */
     log: Logger;
 }
 /** Context provided to the onQuote handler. */
@@ -5839,7 +5706,7 @@ interface QuoteContext<QuoteData = Record<string, unknown>> {
      * Operator environment — same object threaded into `JobContext.env`.
      * Quote handlers read it for pre-payment checks (API-key presence, feature
      * flags, model overrides) so failures surface as a structured 400 rather
-     * than after the upfront fee has been debited. internal-review.
+     * than after the upfront fee has been debited.
      */
     env: Record<string, string>;
     /**
@@ -5849,16 +5716,16 @@ interface QuoteContext<QuoteData = Record<string, unknown>> {
      */
     fetch: typeof globalThis.fetch;
     /**
-     * Verified caller pubkey from the signed-request envelope (internal-review, credits
-     * spec §7). Present only when the descriptor declares an auth scheme and the
+     * Verified caller pubkey from the signed-request envelope. Present only when
+     * the descriptor declares an auth scheme and the
      * envelope verified — `/v1/quote` runs `checkAuth` before the handler, so by
      * the time this is set the signature is good. Undefined on unauthenticated
      * DVMs; quote handlers that price per-caller must handle that.
      */
     callerPubkey?: string;
     /**
-     * The authenticated caller's standing prepaid credit at this DVM, if any
-     * (internal-review, spec §7) — so one round trip answers "cost + my remaining
+     * The authenticated caller's standing prepaid credit at this DVM, if any,
+     * so one round trip answers "cost + my remaining
      * credit". Undefined when the DVM doesn't offer credit, the caller is
      * unauthenticated, or they hold no live credit in this DVM's currency.
      *
@@ -5869,8 +5736,8 @@ interface QuoteContext<QuoteData = Record<string, unknown>> {
     credit?: CreditView;
 }
 /**
- * Read-only snapshot of a caller's credit, surfaced on {@link QuoteContext}
- * (internal-review). Mirrors the ledger's `CreditSnapshot` minus the write surface
+ * Read-only snapshot of a caller's credit, surfaced on {@link QuoteContext};
+ * it mirrors the ledger's `CreditSnapshot` minus the write surface
  * and the fields a quote handler has no business branching on.
  */
 interface CreditView {
@@ -5888,7 +5755,7 @@ interface CreditView {
     expired: boolean;
 }
 /**
- * Result returned by the onQuote handler — the fiat-first envelope (internal-review).
+ * Result returned by the onQuote handler — the fiat-first envelope.
  *
  * The protocol enforces exactly one hard invariant — `upfront` — and pushes
  * every other pricing detail into prose. LLM-agent intermediaries read
@@ -5966,24 +5833,23 @@ interface QuoteConfig<QuoteData = Record<string, unknown>> {
 interface IncomingMessage {
     /** Message type (e.g. "response", "payment", "approval", "cancel"). */
     type: MessageType;
-    /** Raw message content. */
     content: Record<string, unknown>;
 }
 /**
  * A builder-declared price — a USD literal, always (`"$0.05"`).
  *
- * Fiat is the only static price form (internal-review). The credit ledger is
+ * Fiat is the only static price form. The credit ledger is
  * fiat-micro denominated, so a raw-msats price could only reach the ledger
  * through a BTC/USD lookup that may be unavailable — which is how a
  * numeric-priced DVM under a cold-start rate outage used to take money and
- * record no draw (internal-review). Rails are unaffected: callers still pay sats,
+ * record no draw. Rails are unaffected: callers still pay sats,
  * the SDK converts at request time.
  */
 type PriceValue = string;
 /** Accepted payment rail identifier. */
 type PaymentMethod = "cashu" | "x402" | "tempo";
 /**
- * Rails a prepaid **credit** may be funded over (internal-review, credits spec §4).
+ * Rails that may fund a prepaid **credit**.
  *
  * A deliberate superset of {@link PaymentMethod}, not a widening of it.
  * `lightning` funds a credit through the interactive invoice leg on
@@ -5991,59 +5857,40 @@ type PaymentMethod = "cashu" | "x402" | "tempo";
  * connection and credits when settlement is observed — but it is **not** an
  * attached-proof wire method: there is no header a caller can hang a bolt11
  * on, nothing to verify inline, and no `lightning` entry in `/v1/info` or
- * `/v1/quote`'s `payment.methods` (internal-review stands; internal-review deleted the last
- * remnants of the per-call surface). Keeping the two types distinct is what
+ * `/v1/quote`'s `payment.methods`. Keeping the two types distinct is what
  * stops that dead rail from reappearing every time the funding menu grows.
  */
 type FundingMethod = PaymentMethod | "lightning";
 /**
- * Whether a failed job on a given rail can return the caller's funds (internal-review).
- *
- * **No rail refunds on `ctx.fail`, and no code behind the idea any more.** Under
- * the P2PK-accumulator Cashu path — the only Cashu path post-internal-review/internal-review —
- * `verifyAccumulatorReceipt` commits the caller's proofs straight into
- * `wallet_accumulator` and leaves `job.receivedProofs` empty; every producer in
- * `payment.ts` returns `[]`. The `ctx.fail(err, { refund: true })` branch that
- * used to send proofs back gated on those held proofs, so it had been an
- * unreachable no-op for as long as the accumulator has been the commit boundary,
- * and internal-review deleted it. This fail-closed posture was locked by internal-review
- * (Decision C) and pinned by internal-review. mpp (Tempo) and x402 credentials are
- * single-use, final-settlement — no SDK-managed reversal path either.
- *
- * **This is a rail-level question, and since internal-review it is no longer the whole
- * story.** A failed job never debits: the draw is a hold the terminal funnel
- * releases (`JobManager.resolveCreditDraw`), so the value stays on the caller's
- * credit. What this flag reports is narrower and still true — no rail hands
- * value backwards — and reclaiming a released balance runs through the
- * internal-review `drain` op, which exists only on a DVM that advertises credit.
+ * Whether the payment rail returns value when a job fails. No rail reverses
+ * `ctx.fail`: Cashu proofs are committed to the accumulator; Tempo and x402
+ * credentials settle without an SDK reversal.
  *
- * `{ refund: true }` survives as a **caller-fault annotation only** — first-party
- * handlers tag which errors were the caller's doing, and `sdk/testing`'s
- * `createTestContext` exposes it — and it is not a hook waiting to be re-wired.
- * internal-review, the accumulator-debit rewrite that would have flipped `cashu` back to
- * `true`, was cancelled as superseded: the ledger is where reclaim lives now.
- * x402 refund parity remains a deferred internal-review exploration.
+ * Failed credit jobs release their draw hold back to the caller's balance.
+ * Reclaiming that balance uses `drain`; this flag describes rail reversal,
+ * independently of the credit ledger. `{ refund: true }` records caller fault
+ * and does not move funds.
  */
 declare const RAIL_REFUNDABLE: Record<PaymentMethod, boolean>;
 /**
- * Cashu receive mode for builder DVMs (internal-review).
+ * Cashu receive mode for builder DVMs.
  *
  * `"p2pk-accumulator"` — accept P2PK-locked proofs from agent wallets and persist
  * them in `wallet_accumulator`. Melting runs builder-local via `dvmctl melt-pending`
- * (internal-review / internal-review); the SDK only monitors batches for `t_expire` proximity.
+ * the SDK only monitors batches for `t_expire` proximity.
  */
 type CashuMode = "p2pk-accumulator";
 /**
- * Prepaid-credit sizing this DVM advertises (internal-review, credits spec §6).
+ * Prepaid-credit sizing this DVM advertises.
  *
  * Declaring the block is the opt-in: a DVM without `credit` never offers the
  * funding menu on `/v1/quote` or the 402, and `/v1/credit` refuses with
  * `credit_not_supported`. Every payment still funds and draws the ledger
- * internally (the implicit N=1 case, internal-review) — this block is only about
+ * internally (the implicit N=1 case) — this block is only about
  * whether callers may hold a balance across jobs.
  *
  * Isolate-runtime DVMs never advertise credit regardless of this config
- * (spec §3): they have no Postgres of their own, so the money-safety
+ * (the isolate-runtime rule): they have no Postgres of their own, so the money-safety
  * conditions the ledger relies on can't hold there.
  */
 interface CreditConfig {
@@ -6058,14 +5905,14 @@ interface CreditConfig {
     min?: PriceValue;
     /**
      * Largest **residual balance** a caller may hold, as a `PriceValue`.
-     * Binds the balance, not the funding amount (spec §6): a job priced above
+     * Binds the balance, not the funding amount (the balance-sizing contract): a job priced above
      * `max` still clears as fund-and-immediately-draw. Bounds the DVM's
      * prepaid-deposit liability. Default `"$5.00"`.
      */
     max?: PriceValue;
     /**
      * Credit lifetime in **seconds**, from the most recent funding. Post-TTL
-     * the credit refuses new draws; the balance stays the caller's (spec §5).
+     * the credit refuses new draws; the balance stays the caller's (the caller-ownership contract).
      * Default 30 days.
      */
     ttl?: number;
@@ -6099,17 +5946,17 @@ interface ResolvedCreditConfig {
 declare const DEFAULT_CREDIT_MIN: PriceValue;
 /**
  * Platform default for {@link CreditConfig.max} — the largest residual balance
- * a caller may hold. Pocket-money sizing (spec §11: prepaid exposure is
+ * a caller may hold. Pocket-money sizing (the exposure limit: prepaid exposure is
  * capped by policy at pocket-money size), set above the caller-side tier-1
  * cap of $2 so an established caller can actually reach the builder ceiling.
  */
 declare const DEFAULT_CREDIT_MAX: PriceValue;
-/** Platform default for {@link CreditConfig.ttl} — 30 days (credits spec §15, ratified). */
+/** Platform default for {@link CreditConfig.ttl}: 30 days. */
 declare const DEFAULT_CREDIT_TTL_SECONDS: number;
 /** Default lifetime of caller-controlled job content before it is redacted. */
 declare const DEFAULT_JOB_RETENTION_DAYS = 90;
 /**
- * Per-capability configuration for the multi-capability shape (internal-review).
+ * Per-capability configuration for the multi-capability shape.
  * Each capability is an independent unit a caller pays for: its own input
  * schema, pricing, handler, and (optional) message handlers. DVM-level
  * concerns (auth, payment rails, tags, builder) stay on the parent
@@ -6121,13 +5968,13 @@ interface CapabilityConfig<State = Record<string, unknown>, InputSchema extends
     /** Zod schema for structured job input. When set, ctx.input is parsed and typed. */
     input?: InputSchema;
     /**
-     * Example input payload surfaced on `/v1/info` (internal-review). Lets the CLI render
+     * Example input payload surfaced on `/v1/info`. Lets the CLI render
      * a runnable `dvm quote --data '<payload>'` line when the JSON Schema alone
      * is ambiguous — e.g. cross-field Zod refinements that don't survive
      * serialization (narrate's `text` XOR `dialogue`). Must satisfy the schema
      * including any `.refine()` checks.
      *
-     * Typed via `ExampleType<InputSchema>` (internal-review): narrows to the schema's
+     * Typed via `ExampleType<InputSchema>`: narrows to the schema's
      * output type when `input` is a Zod schema, falls back to
      * `Record<string, unknown>` otherwise.
      */
@@ -6136,7 +5983,6 @@ interface CapabilityConfig<State = Record<string, unknown>, InputSchema extends
     state?: State;
     /** Static price — a USD literal ("$0.05"). Free capabilities omit this and `onQuote`. */
     price?: PriceValue;
-    /** Quote handler for dynamic pricing. */
     onQuote?: QuoteConfig;
     /** Handle a newly submitted job for this capability (required). */
     onJob: (ctx: SDKJobContext<State, InputType<InputSchema>>) => void | Promise<void>;
@@ -6152,7 +5998,7 @@ interface CapabilityConfig<State = Record<string, unknown>, InputSchema extends
     onMessage?: (ctx: SDKJobContext<State, InputType<InputSchema>>, msg: IncomingMessage) => void | Promise<void>;
 }
 /**
- * Desugared per-capability descriptor (internal-review). `configureDVM` produces one
+ * Desugared per-capability descriptor. `configureDVM` produces one
  * of these per capability — the SDK runtime always operates on this shape.
  */
 interface CapabilityDescriptor<State = unknown, InputSchema extends ZodLike | undefined = undefined> {
@@ -6162,15 +6008,13 @@ interface CapabilityDescriptor<State = unknown, InputSchema extends ZodLike | un
     readonly description: string;
     /** Zod schema for structured job input. */
     readonly input?: InputSchema;
-    /** Example input payload surfaced on `/v1/info` (internal-review). See `CapabilityConfig.example`. */
+    /** Example input payload surfaced on `/v1/info`. See `CapabilityConfig.example`. */
     readonly example?: ExampleType<InputSchema>;
     /** Default per-job state for jobs of this capability. */
     readonly state: State;
     /** Static price — a USD literal ("$0.05"). Undefined for dynamic-priced or free. */
     readonly price?: PriceValue;
-    /** Quote handler for dynamic pricing. */
     readonly onQuote?: QuoteConfig;
-    /** Handle a newly submitted job. */
     readonly onJob: (ctx: SDKJobContext<State, InputType<InputSchema>>) => void | Promise<void>;
     /** Handle a client response to a prompt. */
     readonly onResponse?: (ctx: SDKJobContext<State, InputType<InputSchema>>, content: ResponseContent) => void | Promise<void>;
@@ -6186,30 +6030,28 @@ interface CapabilityDescriptor<State = unknown, InputSchema extends ZodLike | un
 /**
  * Configuration object passed to configureDVM().
  *
- * Two equivalent shapes (internal-review):
+ * Two equivalent shapes:
  *
  * - **Flat single-capability shape** — declare `capability: "<name>"` plus
- *   the per-capability fields (`input`, `state`, `price`/`onQuote`, `onJob`,
- *   `onResponse`, …) at the top level. Desugars internally to a one-entry
- *   `capabilities` map. Ergonomic for the common case (narrate, scribe,
- *   scrape).
+ * the per-capability fields (`input`, `state`, `price`/`onQuote`, `onJob`,
+ * `onResponse`, …) at the top level. Desugars internally to a one-entry
+ * `capabilities` map. Ergonomic for the common case (narrate, scribe,
+ * scrape).
  *
  * - **Explicit multi-capability shape** — declare `capabilities: { "<name>":
- *   { input, onJob, … } }`. Used by services that expose several operations
- *   on a shared resource model (cast's add-episode / update-feed /
- *   delete-episode / delete-feed).
+ * { input, onJob, … } }`. Used by services that expose several operations
+ * on a shared resource model (cast's add-episode / update-feed /
+ * delete-episode / delete-feed).
  *
  * The two are mutually exclusive: providing both throws at `configureDVM`.
  * DVM-level concerns (tags, payment rails, idle timeout, lifecycle,
  * descriptor routes) live on `DVMConfig` regardless of shape.
  */
 interface DVMConfig<State = Record<string, unknown>, InputSchema extends ZodLike | undefined = undefined> {
-    /** Display name for the DVM. */
     name: string;
-    /** Human-readable description. */
     description?: string;
     /**
-     * Single-capability name for the flat shape (internal-review). Mutually exclusive
+     * Single-capability name for the flat shape. Mutually exclusive
      * with `capabilities`. Single-capability DVMs declare it here and put the
      * per-capability fields (`input`, `state`, `price`/`onQuote`, `onJob`,
      * `onResponse`, …) at the top level; `configureDVM` desugars to a
@@ -6217,7 +6059,7 @@ interface DVMConfig<State = Record<string, unknown>, InputSchema extends ZodLike
      */
     capability?: string;
     /**
-     * Explicit multi-capability block (internal-review). Mutually exclusive with the
+     * Explicit multi-capability block. Mutually exclusive with the
      * flat shape's `capability` + top-level handler fields. Each key is a
      * capability name (tag-shape: lowercase letters/digits/hyphens, no
      * slashes); each value carries its own `input`, `state`, `price`/`onQuote`,
@@ -6230,7 +6072,7 @@ interface DVMConfig<State = Record<string, unknown>, InputSchema extends ZodLike
     tags?: string[];
     /**
      * The currency this DVM prices in — and therefore the one its credit ledger
-     * is denominated in (internal-review). ISO 4217 lowercase; default `"usd"`.
+     * is denominated in. ISO 4217 lowercase; default `"usd"`.
      *
      * The single authoritative answer to "what denomination does this DVM deal
      * in", read by the funding menu, `POST /v1/credit`, and the quote balance
@@ -6241,11 +6083,11 @@ interface DVMConfig<State = Record<string, unknown>, InputSchema extends ZodLike
      * Two consequences, both enforced rather than documented:
      *
      * - **`onQuote` must return it.** A quote denominated in anything else is a
-     *   builder config error, refused as `quote_currency_mismatch` — never
-     *   coerced, never converted.
+     * builder config error, refused as `quote_currency_mismatch` — never
+     * coerced, never converted.
      * - **Static `price` literals are USD-only** (`"$0.05"` — that is the whole
-     *   grammar), so declaring a non-USD currency alongside one is a
-     *   `configureDVM` error. Price a non-USD DVM dynamically with `onQuote`.
+     * grammar), so declaring a non-USD currency alongside one is a
+     * `configureDVM` error. Price a non-USD DVM dynamically with `onQuote`.
      *
      * The rails are unaffected: callers still pay sats, and the SDK converts at
      * request time through whichever rate the fx fetcher carries for this
@@ -6256,7 +6098,7 @@ interface DVMConfig<State = Record<string, unknown>, InputSchema extends ZodLike
     price?: PriceValue;
     /** Zod schema for structured job input. Flat shape only. */
     input?: InputSchema;
-    /** Example input payload surfaced on `/v1/info` (internal-review). Flat shape only — see `CapabilityConfig.example`. */
+    /** Example input payload surfaced on `/v1/info`. Flat shape only — see `CapabilityConfig.example`. */
     example?: ExampleType<InputSchema>;
     /** Per-job state shape and defaults. Flat shape only. */
     state?: State;
@@ -6265,7 +6107,7 @@ interface DVMConfig<State = Record<string, unknown>, InputSchema extends ZodLike
     /**
      * Seconds a job may sit in `processing`/`working` with no SDK liveness
      * heartbeat before the stale-job watchdog declares its worker dead and marks
-     * it `failed` (internal-review). The SDK heartbeats locally-active jobs every ~30s,
+     * it `failed`. The SDK heartbeats locally-active jobs every ~30s,
      * so this bounds *crashed/OOM-killed-worker* detection — not legitimate
      * handler runtime, which the heartbeat keeps fresh regardless of how long it
      * runs. Distinct from `idleTimeout`, which governs the `awaiting-input`
@@ -6281,7 +6123,7 @@ interface DVMConfig<State = Record<string, unknown>, InputSchema extends ZodLike
      */
     jobRetentionDays?: number;
     /**
-     * Descriptor-level auth scheme (internal-review). Fires on `/v1/job` and
+     * Descriptor-level auth scheme. Fires on `/v1/job` and
      * `/v1/quote` before payment verification and handler dispatch — unsigned
      * or malformed envelopes reject with HTTP 401, no payment is attempted.
      *
@@ -6319,14 +6161,14 @@ interface DVMConfig<State = Record<string, unknown>, InputSchema extends ZodLike
     /** MPP multi-rail payment handle (provider-side, built via `createMppFromOpts`). */
     mpp?: MppxServer;
     /**
-     * Prepaid-credit sizing (internal-review). Declaring the block opts this DVM into
+     * Prepaid-credit sizing. Declaring the block opts this DVM into
      * the funding menu on `/v1/quote` / the 402 and into `POST /v1/credit`;
      * omitting it leaves callers on per-call payment. See {@link CreditConfig}.
      */
     credit?: CreditConfig;
     /**
      * Register DVM-scoped non-protocol routes on the descriptor's Hono sub-app
-     * (internal-review). Invoked once per `host.mount(dvm)` against the sub-app that
+     * Invoked once per `host.mount(dvm)` against the sub-app that
      * receives `/v1/info`, `/v1/job`, etc. — any prefix passed to `host.mount`
      * applies automatically, so a route registered as `/feeds/:owner/:slug` on
      * a DVM mounted under `/cast` becomes `/cast/feeds/:owner/:slug` externally.
@@ -6349,14 +6191,12 @@ interface DVMRouteContext {
 }
 /** Immutable descriptor returned by configureDVM(). */
 interface DVMDescriptor<State = Record<string, unknown>, InputSchema extends ZodLike | undefined = undefined> {
-    /** Display name for the DVM. */
     readonly name: string;
     /** Human-readable description (empty string if not provided). */
     readonly description: string;
-    /** Freeform tags this DVM handles. */
     readonly tags: string[];
     /**
-     * Resolved pricing currency (internal-review) — `config.currency` after validation,
+     * Resolved pricing currency — `config.currency` after validation,
      * or `"usd"` when the builder declared none. Always present, so no consumer
      * re-derives the default, and always the exact code the ledger compares
      * against (`"EUR"` is a `configureDVM` error, not a case to normalise: the
@@ -6385,14 +6225,14 @@ interface DVMDescriptor<State = Record<string, unknown>, InputSchema extends Zod
     readonly state: State;
     /** Seconds before an idle job is auto-cancelled. */
     readonly idleTimeout: number;
-    /** Seconds before a worker-stranded `processing`/`working` job is marked `failed` (internal-review). Undefined → SDK default (5 min). */
+    /** Seconds before a worker-stranded `processing`/`working` job is marked `failed`. Undefined → SDK default (5 min). */
     readonly processingWatchdog?: number;
     /** Days terminal job content is retained; `0` disables automatic redaction. */
     readonly jobRetentionDays: number;
     /** Reference to the original DVMConfig (handler functions, quote config, etc.). */
     readonly config: DVMConfig<State, InputSchema>;
     /**
-     * Desugared per-capability descriptors (internal-review). The SDK runtime always
+     * Desugared per-capability descriptors. The SDK runtime always
      * operates on this map: single-capability DVMs have one entry keyed by
      * `config.capability`; multi-capability DVMs have N entries with the
      * names declared in `config.capabilities`.
@@ -6410,13 +6250,13 @@ interface DVMDescriptor<State = Record<string, unknown>, InputSchema extends Zod
     /** MPP multi-rail payment handle. */
     readonly mpp?: MppxServer;
     /**
-     * Prepaid-credit sizing (internal-review), with every optional field resolved to
+     * Prepaid-credit sizing, with every optional field resolved to
      * its platform default. Present iff `configureDVM` was called with a
      * `credit` block — the presence check IS the opt-in gate.
      */
     readonly credit?: ResolvedCreditConfig;
     /**
-     * Descriptor-level auth scheme (internal-review). Set when `configureDVM` was
+     * Descriptor-level auth scheme. Set when `configureDVM` was
      * called with `auth: secp256k1Auth(...)` — the SDK fires this on
      * `/v1/job` and `/v1/quote` before payment verification.
      */
@@ -6442,13 +6282,11 @@ interface StepRecord {
  */
 declare class StepCache {
     private cache;
-    /** Check if a step result is cached. */
     has(id: string): boolean;
     /** Get a cached step result. Throws if not present. */
     get(id: string): unknown;
     /** Get a cached step record, including replay metadata. Throws if not present. */
     getRecord(id: string): StepRecord;
-    /** Cache a step result. */
     set(id: string, value: unknown, costs?: readonly JobCost[]): void;
     /** Export all cached steps for persistence. */
     serialize(): StepRecord[];
@@ -6456,4 +6294,4 @@ declare class StepCache {
     static deserialize(records: StepRecord[]): StepCache;
 }
 
-export { type X402Version as $, type ApprovalContent as A, SignedRequestError as B, type Currency as C, type DVMConfig as D, type SignedRequestFailure as E, type SignedRequestReplayStore as F, type SignedRequestSignOpts as G, type SignedRequestStatementHeader as H, type IncomingMessage as I, type JobCost as J, type KVStore as K, type Logger as L, type SignedRequestVerifier as M, createSignedRequestVerifier as N, isZodSchema as O, type PaymentContent as P, type QuoteConfig as Q, type ResolvedCreditConfig as R, type SDKJobContext as S, signedRequestStatementHeader as T, UnsupportedCurrencyError as U, validateCurrency as V, type JsonValue as W, type FundingReceipt as X, type JobReceipt as Y, type ZodLike as Z, type PaymentRequired as _, type DVMDescriptor as a, isDrainReceipt as a$, type MppxCredential as a0, type Message as a1, type MessageType as a2, type MppxChallenge as a3, X402_BATCH_SETTLEMENT_SCHEME as a4, X402_EXACT_SCHEME as a5, type ReceiptCredit as a6, type X402Wallet as a7, type ResourceInfo as a8, type BuildPaymentRequirementsOpts as a9, type UnsignedFundingReceipt as aA, type UnsignedJobReceipt as aB, type VerifyResponse as aC, type WorkingContent as aD, type X402Config as aE, type X402ResponseBody as aF, type X402SelfRelayRpcFailureReason as aG, X402_DEFAULT_NETWORK as aH, X402_V1_VERSION as aI, X402_VERSION as aJ, buildPaymentRequiredV2 as aK, buildPaymentRequirements as aL, caip2ToX402Network as aM, canonicalRequestPath as aN, canonicaliseForSigning as aO, canonicalize as aP, chainIdFromCaip2 as aQ, computeResultHash as aR, decodePayment as aS, decodePaymentRequiredHeader as aT, encodePayment as aU, encodePaymentRequiredHeader as aV, encodeSettleResponseHeader as aW, exactEvmAuthorization as aX, isArtifactMessage as aY, isCancelMessage as aZ, isCompleteMessage as a_, type CapabilityDescriptor as aa, type CashuMode as ab, type CompleteContent as ac, type DrainReceipt as ad, type DrainReceiptEvent as ae, type ExactEvmPayload as af, type ExactEvmPayloadAuthorization as ag, type FundingMethod as ah, type MessageFrom as ai, type PaymentPayload as aj, type PaymentPayloadV1 as ak, type PaymentPayloadV2 as al, type PaymentRequestContent as am, type PaymentRequiredV2 as an, type PaymentRequirements as ao, type PaymentRequirementsV1 as ap, type PaymentRequirementsV2 as aq, type PromptContent as ar, RAIL_REFUNDABLE as as, type ReceiptOutcome as at, type ReceiptPayment as au, type SettleResponse as av, StepCache as aw, type StepRecord as ax, type TextContent as ay, type UnsignedDrainReceipt as az, type ArtifactContent as b, type StalePendingDrawCursor as b$, isFundingReceipt as b0, isPaymentRequestMessage as b1, isPromptMessage as b2, isSignedJobReceipt as b3, isTextMessage as b4, isWorkingMessage as b5, paymentRequiredV2FromV1 as b6, signDrainReceipt as b7, signFundingReceipt as b8, signReceipt as b9, _testing as bA, createDefaultReplayStore as bB, depleteLots as bC, fifoOrder as bD, inKindDrawMsats as bE, isInKindDepletion as bF, isNonChannelBitcoinRail as bG, lotOwedSats as bH, netOwedSats as bI, wrapMppx as bJ, type CreditDrainEnqueue as bK, type DVMAuthScheme as bL, type CreditLedgerLike as bM, type X402RefundSettlementGate as bN, type CreditSnapshot as bO, type DrawResult as bP, type X402SettlementStatus as bQ, type X402UnresolvedRefund as bR, type GrownDrawResult as bS, type DrawResolution as bT, type FundingRecord as bU, type CreditInvoiceRecord as bV, type InvoiceSettlement as bW, type BlockedInvoiceCursor as bX, type InvoiceReconciliation as bY, type InvoiceWriteOff as bZ, type DrawRecord as b_, usdcContractByCaip2 as ba, usdcContractFor as bb, usdcDomainNameFor as bc, usdcDomainVersionFor as bd, verifyDrainReceipt as be, verifyFundingReceipt as bf, verifyReceipt as bg, x402NetworkToCaip2 as bh, type X402ExactVersionSupport as bi, type X402Receipt as bj, type TransactionalPayoutHook as bk, type CashuMeltCompleted as bl, type CreditDepositPayload as bm, type CreditDrainPayload as bn, type FundingLot as bo, type LotDebit as bp, type LotDepletion as bq, type MppxServer as br, NON_CHANNEL_BITCOIN_RAILS as bs, type NonChannelBitcoinRail as bt, PayoutReporter as bu, PostgresTempoSessionStore as bv, RevenueReporter as bw, SIGNED_ENVELOPE_FIELDS as bx, SIGNED_ENVELOPE_TYPES as by, type X402TrackedChannel as bz, type CancelContent as c, type TempoCreditLossEvidence as c0, type CreditLedgerQuerier as c1, type TempoCreditLoss as c2, type X402CreditLossEvidence as c3, type X402CreditLoss as c4, type DrainMethod as c5, type DrainRequestResult as c6, type BitcoinDepositLiability as c7, type CreditDrainRecord as c8, type ChannelDrainCursor as c9, type RevenueSkippedNoRailPayload as cA, type RevenueSkippedNoRailReason as cB, type Secp256k1AuthOpts as cC, type X402ChannelStorageOpts as cD, type X402RelayLockHolder as cE, type X402RelaySubmissionLock as cF, X402RelaySubmissionLockError as cG, allocateDrawValue as cH, clientCompatibilityAttributes as cI, clientCompatibilityMiddleware as cJ, clientUpgradeRequired as cK, parseClientCapabilities as cL, parseClientCompatibility as cM, parseDvmClient as cN, parseProtocolVersion as cO, requireClientCompatibility as cP, secp256k1Auth as cQ, signedRequestInput as cR, type X402SettlementIntent as cS, type X402SettlementCursor as cT, type X402SettlementWriteOff as cU, type X402FacilitatorAuth as cV, type X402BatchSettlementConfig as cW, type X402PayoutObserver as cX, type CreditDepositEnqueue as cY, type X402SettlementReconciliationReason as cZ, type CreditDrawReleaseEnqueue as c_, type DrainWriteOff as ca, type DrainReleaseResult as cb, type DrainFulfilment as cc, type DrainTransitionResult as cd, CLIENT_COMPATIBILITY_HEADERS as ce, type ClientCompatibility as cf, type ClientCompatibilityEnv as cg, type ClientCompatibilityGate as ch, type ClientCompatibilityRequirement as ci, type ClientSemVer as cj, type CreditFundingBasis as ck, type CreditInvoiceStatus as cl, CreditLedger as cm, CreditLedgerError as cn, type CreditLedgerErrorCode as co, type CreditLedgerErrorDetails as cp, type CreditLedgerPool as cq, type CreditStatus as cr, DRAIN_DELIVERY_RESERVE_SATS as cs, DVM_PROTOCOL_VERSION as ct, type DrainConflictReason as cu, type DrawRailValue as cv, type DrawStatus as cw, type JobCostReportPayload as cx, PostgresX402ChannelStorage as cy, type ReplayStoreBackend as cz, type CanonicalEnvelope as d, type CreateSignedRequestVerifierOpts as e, type CreditConfig as f, type CreditView as g, DEFAULT_CREDIT_MAX as h, DEFAULT_CREDIT_MIN as i, DEFAULT_CREDIT_TTL_SECONDS as j, DEFAULT_JOB_RETENTION_DAYS as k, type DVMRouteContext as l, type InputType as m, InvalidCurrencyError as n, type PaymentMethod as o, type PriceValue as p, type ProgressContent as q, type PromptOpts as r, type QuoteContext as s, type QuoteResult as t, type ResponseContent as u, type SDKPaymentRequestOpts as v, SIGNED_REQUEST_AUTH_ID as w, SIGNED_REQUEST_STATEMENT_VERSION as x, type SignedRequestAudience as y, type SignedRequestDomain as z };
+export { type X402Version as $, type ApprovalContent as A, SignedRequestError as B, type Currency as C, type DVMConfig as D, type SignedRequestFailure as E, type SignedRequestReplayStore as F, type SignedRequestSignOpts as G, type SignedRequestStatementHeader as H, type IncomingMessage as I, type JobCost as J, type KVStore as K, type Logger as L, type SignedRequestVerifier as M, createSignedRequestVerifier as N, isZodSchema as O, type PaymentContent as P, type QuoteConfig as Q, type ResolvedCreditConfig as R, type SDKJobContext as S, signedRequestStatementHeader as T, UnsupportedCurrencyError as U, validateCurrency as V, type JsonValue as W, type FundingReceipt as X, type JobReceipt as Y, type ZodLike as Z, type PaymentRequired as _, type DVMDescriptor as a, isDrainReceipt as a$, type MppxCredential as a0, type Message as a1, type MessageType as a2, type MppxChallenge as a3, X402_BATCH_SETTLEMENT_SCHEME as a4, X402_EXACT_SCHEME as a5, type ReceiptCredit as a6, type X402Wallet as a7, type ResourceInfo as a8, type BuildPaymentRequirementsOpts as a9, type UnsignedFundingReceipt as aA, type UnsignedJobReceipt as aB, type VerifyResponse as aC, type WorkingContent as aD, type X402Config as aE, type X402ResponseBody as aF, type X402SelfRelayRpcFailureReason as aG, X402_DEFAULT_NETWORK as aH, X402_V1_VERSION as aI, X402_VERSION as aJ, buildPaymentRequiredV2 as aK, buildPaymentRequirements as aL, caip2ToX402Network as aM, canonicalRequestPath as aN, canonicaliseForSigning as aO, canonicalize as aP, chainIdFromCaip2 as aQ, computeResultHash as aR, decodePayment as aS, decodePaymentRequiredHeader as aT, encodePayment as aU, encodePaymentRequiredHeader as aV, encodeSettleResponseHeader as aW, exactEvmAuthorization as aX, isArtifactMessage as aY, isCancelMessage as aZ, isCompleteMessage as a_, type CapabilityDescriptor as aa, type CashuMode as ab, type CompleteContent as ac, type DrainReceipt as ad, type DrainReceiptEvent as ae, type ExactEvmPayload as af, type ExactEvmPayloadAuthorization as ag, type FundingMethod as ah, type MessageFrom as ai, type PaymentPayload as aj, type PaymentPayloadV1 as ak, type PaymentPayloadV2 as al, type PaymentRequestContent as am, type PaymentRequiredV2 as an, type PaymentRequirements as ao, type PaymentRequirementsV1 as ap, type PaymentRequirementsV2 as aq, type PromptContent as ar, RAIL_REFUNDABLE as as, type ReceiptOutcome as at, type ReceiptPayment as au, type SettleResponse as av, StepCache as aw, type StepRecord as ax, type TextContent as ay, type UnsignedDrainReceipt as az, type ArtifactContent as b, type StalePendingDrawCursor as b$, isFundingReceipt as b0, isPaymentRequestMessage as b1, isPromptMessage as b2, isSignedJobReceipt as b3, isTextMessage as b4, isWorkingMessage as b5, paymentRequiredV2FromV1 as b6, signDrainReceipt as b7, signFundingReceipt as b8, signReceipt as b9, _testing as bA, createDefaultReplayStore as bB, depleteLots as bC, fifoOrder as bD, inKindDrawMsats as bE, isInKindDepletion as bF, isNonChannelBitcoinRail as bG, lotOwedSats as bH, netOwedSats as bI, wrapMppx as bJ, type CreditDrainEnqueue as bK, type DVMAuthScheme as bL, type CreditLedgerLike as bM, type X402RefundSettlementGate as bN, type CreditSnapshot as bO, type DrawResult as bP, type X402SettlementStatus as bQ, type X402UnresolvedRefund as bR, type GrownDrawResult as bS, type DrawResolution as bT, type FundingRecord as bU, type CreditInvoiceRecord as bV, type InvoiceSettlement as bW, type BlockedInvoiceCursor as bX, type InvoiceReconciliation as bY, type InvoiceWriteOff as bZ, type DrawRecord as b_, usdcContractByCaip2 as ba, usdcContractFor as bb, usdcDomainNameFor as bc, usdcDomainVersionFor as bd, verifyDrainReceipt as be, verifyFundingReceipt as bf, verifyReceipt as bg, x402NetworkToCaip2 as bh, type X402ExactVersionSupport as bi, type X402Receipt as bj, type TransactionalPayoutHook as bk, type CashuMeltCompleted as bl, type CreditDepositPayload as bm, type CreditDrainPayload as bn, type FundingLot as bo, type LotDebit as bp, type LotDepletion as bq, type MppxServer as br, NON_CHANNEL_BITCOIN_RAILS as bs, type NonChannelBitcoinRail as bt, PayoutReporter as bu, PostgresTempoSessionStore as bv, RevenueReporter as bw, SIGNED_ENVELOPE_FIELDS as bx, SIGNED_ENVELOPE_TYPES as by, type X402TrackedChannel as bz, type CancelContent as c, type CreditDrawReleaseEnqueue as c$, type TempoCreditLossEvidence as c0, type CreditLedgerQuerier as c1, type TempoCreditLoss as c2, type X402CreditLossEvidence as c3, type X402CreditLoss as c4, type DrainMethod as c5, type DrainRequestResult as c6, type BitcoinDepositLiability as c7, type CreditDrainRecord as c8, type ChannelDrainCursor as c9, type ReplayStoreBackend as cA, type RevenueSkippedNoRailPayload as cB, type RevenueSkippedNoRailReason as cC, type Secp256k1AuthOpts as cD, type X402ChannelStorageOpts as cE, type X402RelayLockHolder as cF, type X402RelaySubmissionLock as cG, X402RelaySubmissionLockError as cH, allocateDrawValue as cI, clientCompatibilityAttributes as cJ, clientCompatibilityMiddleware as cK, clientUpgradeRequired as cL, parseClientCapabilities as cM, parseClientCompatibility as cN, parseDvmClient as cO, parseProtocolVersion as cP, requireClientCompatibility as cQ, secp256k1Auth as cR, signedRequestInput as cS, type X402SettlementIntent as cT, type X402SettlementCursor as cU, type X402SettlementWriteOff as cV, type X402FacilitatorAuth as cW, type X402BatchSettlementConfig as cX, type X402PayoutObserver as cY, type CreditDepositEnqueue as cZ, type X402SettlementReconciliationReason as c_, type DrainWriteOff as ca, type DrainReleaseResult as cb, type DrainFulfilment as cc, type DrainTransitionResult as cd, CLIENT_COMPATIBILITY_HEADERS as ce, type ClientCompatibility as cf, type ClientCompatibilityEnv as cg, type ClientCompatibilityGate as ch, type ClientCompatibilityRequirement as ci, type ClientSemVer as cj, type CreditFundingBasis as ck, type CreditInvoiceStatus as cl, CreditLedger as cm, CreditLedgerError as cn, type CreditLedgerErrorCode as co, type CreditLedgerErrorDetails as cp, type CreditLedgerPool as cq, type CreditStatus as cr, DRAIN_DELIVERY_RESERVE_SATS as cs, DVM_PROTOCOL_VERSION as ct, type DrainConflictReason as cu, type DrawRailValue as cv, type DrawStatus as cw, type JobCostReportPayload as cx, type JobTerminalReportPayload as cy, PostgresX402ChannelStorage as cz, type CanonicalEnvelope as d, type CreateSignedRequestVerifierOpts as e, type CreditConfig as f, type CreditView as g, DEFAULT_CREDIT_MAX as h, DEFAULT_CREDIT_MIN as i, DEFAULT_CREDIT_TTL_SECONDS as j, DEFAULT_JOB_RETENTION_DAYS as k, type DVMRouteContext as l, type InputType as m, InvalidCurrencyError as n, type PaymentMethod as o, type PriceValue as p, type ProgressContent as q, type PromptOpts as r, type QuoteContext as s, type QuoteResult as t, type ResponseContent as u, type SDKPaymentRequestOpts as v, SIGNED_REQUEST_AUTH_ID as w, SIGNED_REQUEST_STATEMENT_VERSION as x, type SignedRequestAudience as y, type SignedRequestDomain as z };