@dvmkit/sdk 0.1.5-rc.8 → 0.2.0-rc.9

package/dist/{chunk-MLRCSJYX.js → chunk-V7EVFLAK.js}

@@ -208,7 +208,7 @@ var PostgresX402ChannelStorage = class {
    *
    * Both accessors run on the settlement pool: every caller reads or writes the
    * marker while {@link withFleetSettlementLock} holds a host-pool client, which
-   * is the nesting the internal-review split exists to keep off a non-terminal pool.
+   * is the nesting the split exists to keep off a non-terminal pool.
    */
   async isSettlePending(scope) {
     const reader = await this.settlementWriter();
@@ -235,9 +235,9 @@ var PostgresX402ChannelStorage = class {
    *
    * On the dedicated settlement pool like every other marker, and for a sharper
    * reason than they had: this and {@link prepareSettlement} now run *inside*
-   * the channel transaction (internal-review), which holds a host-pool client for its
+   * the channel transaction, which holds a host-pool client for its
    * whole duration. Taking a second client from that same pool is the
-   * self-deadlock internal-review fixed — at pool max every client is a holder and a
+   * self-deadlock fixed — at pool max every client is a holder and a
    * waiter — and moving these calls under the transaction is exactly what would
    * reintroduce it.
    */
@@ -250,7 +250,7 @@ var PostgresX402ChannelStorage = class {
   }
   /**
    * The refund on this channel that is neither finished nor abandoned, if there
-   * is one — the credit ledger's spend gate (internal-review).
+   * is one — the credit ledger's spend gate.
    *
    * `statuses` is the caller's, because the two gates disagree by design: a
    * draw is blocked by {@link X402_SPEND_BLOCKING_SETTLEMENT_STATUSES}, a fresh
@@ -258,12 +258,12 @@ var PostgresX402ChannelStorage = class {
    *
    * On the dedicated settlement pool, and that is what makes the gate callable
    * at all: a draw routinely runs inside an open channel transaction holding a
-   * host-pool client, and taking a second one from that pool is the internal-review
+   * host-pool client, and taking a second one from that pool is the
    * self-deadlock. The oldest blocking row wins, so a channel that somehow
    * accumulated two names the one an operator should reach for first.
    *
    * Projects three columns rather than decoding a whole {@link
-   * X402SettlementIntent}: the decoder refuses a pre-internal-review row that carries
+   * X402SettlementIntent}: the decoder refuses a legacy row that carries
    * no reconciliation snapshot, and a gate that throws on one would take every
    * draw on that channel down with it — when the row is exactly the kind that
    * ought to block them.
@@ -282,7 +282,7 @@ var PostgresX402ChannelStorage = class {
   }
   /**
    * Read one settlement by its own identifier — the handle an operator holds
-   * (internal-review). Same dedicated pool as {@link getSettlement}, for the same
+   * Same dedicated pool as {@link getSettlement}, for the same
    * reason: the repair reads this while a channel transaction may be open.
    */
   async getSettlementById(settlementId) {
@@ -308,7 +308,7 @@ var PostgresX402ChannelStorage = class {
   }
   /**
    * The operator's repair queue: settlements stuck between "chain paid" and
-   * "ledger booked", oldest write first (internal-review).
+   * "ledger booked", oldest write first.
    *
    * Keyset-paginated on `(created_at, settlement_id)` for the reason the
    * blocked-invoice queue is: a wedged row never self-clears, so a fixed first
@@ -350,7 +350,7 @@ var PostgresX402ChannelStorage = class {
     };
   }
   /**
-   * Close a wedged settlement without booking anything (internal-review).
+   * Close a wedged settlement without booking anything.
    *
    * A single-statement CAS on the wedged statuses, on the settlement pool —
    * there is no ledger effect to be atomic with, which is the whole point:
@@ -460,7 +460,7 @@ var PostgresX402ChannelStorage = class {
    * Mark that the next operation is the ambiguous external-call boundary.
    *
    * `channelAtSubmission` is the live channel the facilitator is about to size
-   * and sign the settlement against (internal-review) — bookmarked here, with the
+   * and sign the settlement against — bookmarked here, with the
    * block height, because these two are the only description of that instant
    * that survives the call.
    */
@@ -521,7 +521,7 @@ var PostgresX402ChannelStorage = class {
   /**
    * Mark the external settlement and ledger effect complete in the active transaction.
    *
-   * `resolvedAtMs` is set only by the operator repair (internal-review), so an audit
+   * `resolvedAtMs` is set only by the operator repair, so an audit
    * read can tell a settlement that completed on its own from one a human had
    * to finish.
    */
@@ -591,7 +591,7 @@ var PostgresX402ChannelStorage = class {
    * this is how the settlement layer says "this exact decrease is the one the
    * payer's verified refund voucher authorises". Outside this scope a decrease
    * of `chargedCumulativeAmount` is refused flat, which is what keeps the
-   * arbitrary-decrease guard meaningful (internal-review).
+   * arbitrary-decrease guard meaningful.
    */
   withSanctionedRefundBase(base, operation) {
     return this.refundBase.run(base, operation);
@@ -617,7 +617,7 @@ var PostgresX402ChannelStorage = class {
    * The lock is session-scoped, so its client stays checked out for the whole
    * operation — and `operation()` (upstream's claim/settle) re-enters the pool
    * through {@link updateChannel}. Two bounds keep that from wedging the pool
-   * (internal-review): local callers are serialized in-process, so this holds at most
+   * local callers are serialized in-process, so this holds at most
    * one client per process no matter how many requests arrive, and a waiting
    * acquire carries a `lock_timeout` so a wedged fleet-mate can't pin that
    * client — and the caller's request — indefinitely. A timeout reports the
@@ -640,7 +640,7 @@ var PostgresX402ChannelStorage = class {
     }
   }
   /**
-   * Hold the fleet-wide self-relay submission lock for one chain submission (internal-review).
+   * Hold the fleet-wide self-relay submission lock for one chain submission.
    *
    * The session lock keeps one per-DVM gas EOA to one in-flight submission
    * across the whole fleet — two machines submitting at once collide on the
@@ -997,14 +997,13 @@ var CreditLedger = class {
   tempoSessionStore;
   /**
    * Postgres-backed: balances survive a restart and are shared across the
-   * fleet, so this DVM may advertise credit (internal-review).
+   * fleet, so this DVM may advertise credit.
    */
   durable = true;
   x402Settlements;
   expiryReleaseOutbox;
   /**
    * Bind the durable x402 settlement state this ledger gates spending on
-   * (internal-review).
    *
    * Late, because the settlement store is built with the batch-settlement
    * server, which is built *after* the ledger it reads earned draws from. An
@@ -1016,11 +1015,11 @@ var CreditLedger = class {
   }
   /**
    * Bind the durable outbox that reports credit-expiry releases and their
-   * revivals to the platform (internal-review).
+   * revivals to the platform.
    *
    * Held on the ledger rather than threaded through {@link fund} for the same
    * reason as the gate above: the revival half fires from *every* funding path
-   * — Cashu commit, x402 exact and channel, Tempo, the Lightning invoice
+   * Cashu commit, x402 exact and channel, Tempo, the Lightning invoice
    * settle, the implicit N=1 per-call payment — and a seam each of those has to
    * remember to pass is a seam one of them will eventually forget.
    *
@@ -1036,7 +1035,7 @@ var CreditLedger = class {
   async init() {
     await withSdkInitLock(this.pool, () => this.createTables());
   }
-  /** The boot DDL itself — always runs under {@link withSdkInitLock} (internal-review). */
+  /** The boot DDL itself — always runs under {@link withSdkInitLock}. */
   async createTables() {
     await this.pool.query(`
       CREATE TABLE IF NOT EXISTS credits (
@@ -1314,7 +1313,7 @@ var CreditLedger = class {
     );
   }
   /**
-   * Give every open non-channel Bitcoin credit a funding lot (internal-review).
+   * Give every open non-channel Bitcoin credit a funding lot.
    *
    * Runs inside the boot DDL, is guarded per credit by `NOT EXISTS`, and is
    * therefore both the one-time migration and a standing self-heal for a
@@ -1325,12 +1324,12 @@ var CreditLedger = class {
    * `{amount_micro, rail}` — no instrument amount at all — and is not written
    * on every funding path, whereas `msats_remaining` **is** the credit's
    * current unspent rail value, maintained pro rata on every draw since
-   * internal-review. One synthetic lot pairing it with `balance_micro` therefore
+   * One synthetic lot pairing it with `balance_micro` therefore
    * reproduces today's in-kind position exactly, and FIFO over a single lot is
    * trivially correct. Historic per-funding rates are unrecoverable and would
    * change nothing: only the remaining position is owed.
    *
-   * The semantics change is deliberately retroactive (internal-review) — every
+   * The semantics change is deliberately retroactive — every
    * current holder is first-party, so there is one regime and no legacy
    * branch.
    */
@@ -1370,31 +1369,31 @@ var CreditLedger = class {
   /**
    * Create a credit, or top up an existing one (same `creditId`). Top-ups add
    * to the balance and overwrite `expiry_ms` with the provided value — funding
-   * an expired credit revives it (spec §5 carry-forward: the credit is a
+   * an expired credit revives it (the caller-ownership contract carry-forward: the credit is a
    * rolling buffer, not per-job escrow). The existing row's `caller_pubkey`
    * and `currency` must match or the fund is refused with a typed error —
    * without that check a top-up against someone else's `credit_id` would
    * silently merge two callers' money.
    *
    * Pass `tx` (a client inside a caller-owned `BEGIN`) to commit the rail
-   * receive and the ledger credit atomically (spec condition 3 — the internal-review
+   * receive and the ledger credit atomically (spec condition 3 — the
    * verifier does this). The ledger issues **no** transaction control on `tx`.
    *
    * Without `tx` it opens one of its own, because a funding is no longer a
    * single statement: it upserts the credit, records its funding lot
-   * (internal-review), and reverses any standing expiry release (internal-review) — and that
+   * and reverses any standing expiry release — and that
    * last leg restores balance and queues a report. A crash between the upsert
    * and the reversal would leave a revived credit whose release still stands,
    * which the sweep's own exclusion then makes permanent: `balance_micro > 0`
    * but a standing release means it is neither drainable nor re-releasable.
    *
-   * `basis` records the rail value behind the fiat (internal-review) so each draw can
+   * `basis` records the rail value behind the fiat so each draw can
    * be allocated its share of the rail-native amount actually received. A
    * top-up on a different rail than the credit's is refused with
    * `rail_mismatch`: sats and USDC microunits aren't summable, so a blended
    * credit would have no coherent native basis to allocate from.
    *
-   * It is **required** (internal-review), in the type and again at runtime via
+   * It is **required**, in the type and again at runtime via
    * {@link assertFundingBasis}. A basis-less fund wrote `rail = NULL`, and a
    * draw against such a credit settles — a real debit — while
    * `railAsFundingMethod` correctly declines to guess a rail, so `bookRevenue`
@@ -1405,7 +1404,7 @@ var CreditLedger = class {
    * typed top-up via the `COALESCE` below.
    *
    * The rail-native **instrument** is pinned at first funding too, and both
-   * channel guards are symmetric for the same reason (internal-review). A reusable
+   * channel guards are symmetric for the same reason. A reusable
    * channel — Tempo session or x402 batch-settlement — may only ever top up
    * the credit it opened, and a credit opened by a one-shot (a Tempo charge, an
    * x402 exact authorization) may never adopt one. The x402 half used to admit
@@ -1419,7 +1418,7 @@ var CreditLedger = class {
    * one-credit-per-channel, not one-source-per-credit.
    *
    * An x402 channel deposit is additionally refused `settlement_pending` while
-   * that channel carries an unresolved refund (internal-review) — see the gate read
+   * that channel carries an unresolved refund — see the gate read
    * below. This method is the authority on that rule, as it is on the binding
    * rules above; every door preflights it where a refusal is still free.
    */
@@ -1592,12 +1591,12 @@ var CreditLedger = class {
   }
   /**
    * Undo any expiry release this credit still carries, because a funding just
-   * landed on it (internal-review — the revival rule), restoring the balance the
+   * landed on it (the revival rule), restoring the balance the
    * release took.
    *
    * A release records the credit's **final** undrawn remainder and zeroes it
    * (see {@link releaseExpiredCreditLocked}). Funding adds to the balance and
-   * overwrites `expiry_ms` (spec §5 carry-forward: the credit is a rolling
+   * overwrites `expiry_ms` (the caller-ownership contract carry-forward: the credit is a rolling
    * buffer), so the moment money arrives the recorded remainder is no longer
    * final: the release stops counting and its micro come back.
    *
@@ -1616,8 +1615,8 @@ var CreditLedger = class {
    * re-derives it.
    *
    * @returns the credit row as the restore left it, or undefined when there was
-   *   nothing to reverse. The caller reads its snapshot off this rather than off
-   *   the funding upsert's `RETURNING`, which predates the restore.
+   * nothing to reverse. The caller reads its snapshot off this rather than off
+   * the funding upsert's `RETURNING`, which predates the restore.
    */
   async reverseExpiryReleases(q, creditId, nowMs) {
     const { rows } = await q.query(
@@ -1643,7 +1642,7 @@ var CreditLedger = class {
   }
   /**
    * Release the undrawn remainder of every credit whose TTL has run out
-   * (internal-review). Returns the releases this pass recorded.
+   * Returns the releases this pass recorded.
    *
    * **What is released.** The credit's whole `balance_micro`. Expiry ends
    * spending but never ownership of the record, so the balance stays readable;
@@ -1660,7 +1659,7 @@ var CreditLedger = class {
    * runs above the expiry check, so a lost response is still recoverable), so
    * the remainder is not final while a hold is outstanding. Skipping costs one
    * sweep interval and keeps the released figure exactly "what nothing bought";
-   * holds do resolve — the orphan-draw watchdog (internal-review) is what guarantees
+   * holds do resolve — the orphan-draw watchdog is what guarantees
    * a stranded one still reaches a terminal state.
    *
    * **Idempotent** two ways. `release_id` is derived from the expiry instant,
@@ -1779,7 +1778,7 @@ var CreditLedger = class {
     return row;
   }
   /**
-   * Record this funding's in-kind basis as a lot (internal-review).
+   * Record this funding's in-kind basis as a lot.
    *
    * Called from inside {@link fund}, on the same handle, so the lot shares
    * whatever transaction the rail opened — `withCommitTx` for Cashu,
@@ -1839,11 +1838,11 @@ var CreditLedger = class {
    * placed pre-expiry must stay recoverable after the credit expires, or the
    * DVM holds a debit the caller can never reconcile. Fresh draws on an
    * expired credit are refused with `credit_expired`; the balance stays
-   * intact and readable (spec §5: expiry ends spending, never ownership).
+   * intact and readable (the caller-ownership contract: expiry ends spending, never ownership).
    *
    * Pass `tx` (a client inside a caller-owned `BEGIN`) to place the hold in
    * the same transaction as the rail commit and the `fund` upsert (spec
-   * condition 3 — the internal-review implicit N=1 path). The ledger issues no
+   * condition 3 — the implicit N=1 path). The ledger issues no
    * transaction control on `tx`; the `SELECT … FOR UPDATE` row lock is still
    * taken on the caller's transaction, so the locking invariant holds.
    */
@@ -1962,12 +1961,12 @@ var CreditLedger = class {
   }
   /**
    * The unresolved refund on `channelId` that must stop this ledger effect, if
-   * any (internal-review).
+   * any.
    *
    * `undefined` whenever there is nothing to ask — an unbound credit, or a DVM
    * with no durable settlement store, where a settlement row cannot exist.
    *
-   * Public since internal-review, so `/v1/credit`'s pre-payment preflight can ask the
+   * Public since the behavior was introduced, so `/v1/credit`'s pre-payment preflight can ask the
    * same question `fund` will ask from inside the rail transaction — one read,
    * one answer, rather than a second copy of the rule in the routes.
    */
@@ -1976,7 +1975,7 @@ var CreditLedger = class {
     return this.x402Settlements.pendingRefundSettlement(channelId, statuses);
   }
   /**
-   * Grow a pending draw by `addAmountMicro` (internal-review) — the ledger half of a
+   * Grow a pending draw by `addAmountMicro` — the ledger half of a
    * mid-job `requestPayment` top-up. One job keeps **one** draw: the mid-job
    * money funds the same credit and enlarges the hold the upfront leg placed,
    * so the receipt's `ReceiptCredit` block countersigns the job's full cost
@@ -1995,7 +1994,7 @@ var CreditLedger = class {
    * The increment's rail value comes from {@link growthRailValue}: earmarked
    * to the funding that backs it when the caller names one (the mid-job case),
    * pro-rata otherwise. Either way the draws of a credit keep summing to
-   * precisely what the rails paid (internal-review).
+   * precisely what the rails paid.
    *
    * **`ledger_seq` is not re-taken.** The per-credit sequence is gap-free
    * (`credit_draws_seq_uidx`), so moving this draw forward would strand its
@@ -2013,8 +2012,8 @@ var CreditLedger = class {
    * the whole transaction back on replay; x402/mpp collide on the
    * `processed_payments` marker). Never call it outside a rail commit.
    *
-   * **`capMicro` bounds cumulative growth at what the job cumulatively asked
-   * (internal-review)**, and it is the only ceiling that can refuse a top-up: the
+   * **`capMicro` bounds cumulative growth at what the job cumulatively asked,**
+   * and it is the only ceiling that can refuse a top-up: the
    * available-balance check cannot, because the `fund` a moment earlier in
    * this same transaction raised the balance by exactly the amount being
    * drawn. Excess is **granted partially or not at all rather than thrown** —
@@ -2204,7 +2203,7 @@ var CreditLedger = class {
   }
   /**
    * Release a pending draw: the hold evaporates, the balance is untouched —
-   * this is how "no debit on job failure" is mechanically real (spec §1).
+   * this is how "no debit on job failure" is mechanically real (the credit lifecycle contract).
    * Idempotent: releasing a released draw returns the original tuple. A
    * settled draw cannot be released (`invalid_draw_state`) — un-settling
    * booked revenue is a reconciliation problem, not a ledger verb.
@@ -2213,14 +2212,14 @@ var CreditLedger = class {
     return this.resolveDraw({ ...args, to: "released" });
   }
   /**
-   * Record a fund-only top-up under its client-generated `fundId` (internal-review).
+   * Record a fund-only top-up under its client-generated `fundId`.
    * The deposit half of the evidence chain, and the top-up path's idempotency
    * key: `PRIMARY KEY (credit_id, fund_id)` means a concurrent duplicate
    * loses with a typed `funding_replayed` rather than crediting twice.
    *
    * Call it inside the same `tx` as {@link fund} — the rail commit, the
    * funding record, and the balance increment must land together or not at
-   * all (spec §2 condition 3). Like `fund`, this issues no transaction
+   * all (the funding-commitment rule). Like `fund`, this issues no transaction
    * control on `tx`; it is a single statement.
    *
    * This does **not** move money on its own. `fund` still does the crediting;
@@ -2295,7 +2294,7 @@ var CreditLedger = class {
     return rows[0].receipt;
   }
   /**
-   * Record the bolt11 issued for a `(creditId, fundId)` top-up (internal-review), or
+   * Record the bolt11 issued for a `(creditId, fundId)` top-up, or
    * return the one already issued for it.
    *
    * **Returning the existing row is the point.** A caller re-polling an unpaid
@@ -2375,7 +2374,7 @@ var CreditLedger = class {
   }
   /**
    * Apply an observed Lightning settlement to the ledger — **the exactly-once
-   * boundary** (internal-review; spec §2 condition 3 for a rail whose commit happens
+   * boundary** (the funding-commitment rule for a rail whose commit happens
    * off-box).
    *
    * One transaction covers the funding record, the balance, and the invoice's
@@ -2483,7 +2482,7 @@ var CreditLedger = class {
     return this.getInvoice(args);
   }
   /**
-   * Retire an invoice that **was paid** and can never be credited (internal-review).
+   * Retire an invoice that **was paid** and can never be credited.
    *
    * Distinct from `expired` because the money is the opposite way round: an
    * expired invoice was never paid and owes nobody anything, whereas a blocked
@@ -2514,15 +2513,15 @@ var CreditLedger = class {
     return rows.length > 0 ? invoiceRecordFromRow(rows[0]) : void 0;
   }
   /**
-   * The operator's queue: invoices the sweep gave up on (internal-review).
+   * The operator's queue: invoices the sweep gave up on.
    *
    * **Keyset-paginated, not offset.** Blocked rows are terminal and never
    * self-clear, so a row the operator declines to act on sits at the head of
    * the age ordering forever; a fixed first page would starve everything
-   * behind it on every run, which is the internal-review shape one page up.
+   * behind it on every run, which is the shape one page up.
    *
    * `includeResolved` widens to the operator-resolved statuses so a run can be
-   * audited after the fact — the acceptance criterion this verb exists for.
+   * audited after the fact.
    * Host-wide, like `listPendingDrains`: the ledger has no `dvm_id`, so on a
    * multi-mount host one builder's admin credential reads every mount's rows.
    */
@@ -2547,7 +2546,7 @@ var CreditLedger = class {
   }
   /**
    * Apply a blocked invoice's payment to a credit an operator named — the
-   * repair for the one Lightning outcome the DVM cannot fix itself (internal-review).
+   * repair for the one Lightning outcome the DVM cannot fix itself.
    *
    * Shaped statement-for-statement on {@link settleInvoice}, because it is the
    * same money doing the same thing a different way: one transaction covering
@@ -2555,21 +2554,21 @@ var CreditLedger = class {
    * outbox row, so the four can never disagree. Three deliberate differences:
    *
    * - **The lock is taken on `payment_hash`**, which is UNIQUE and is the
-   *   identifier the operator actually holds (it is what the
-   *   `lightning_settlement_blocked` log carries and what names the payment in
-   *   their wallet). Invoice row first, credit row second via `fund`'s upsert —
-   *   the same order `settleInvoice` takes, which is what keeps a reconcile and
-   *   a concurrent settlement check from deadlocking against each other.
+   * identifier the operator actually holds (it is what the
+   * `lightning_settlement_blocked` log carries and what names the payment in
+   * their wallet). Invoice row first, credit row second via `fund`'s upsert —
+   * the same order `settleInvoice` takes, which is what keeps a reconcile and
+   * a concurrent settlement check from deadlocking against each other.
    * - **The funding lands at `(targetCreditId, paymentHash)`, not the invoice's
-   *   own `(credit_id, fund_id)`.** That key is frequently the reason the row
-   *   is blocked at all — `funding_replayed_on_cashu` means something else
-   *   already holds it — and the operator's most natural target is that very
-   *   credit. The payment hash cannot collide with it, and it makes all three
-   *   references to this payment agree: `basis.fundingRef`, the deposit's
-   *   `funding_id`, and the funding row's `fund_id`.
+   * own `(credit_id, fund_id)`.** That key is frequently the reason the row
+   * is blocked at all — `funding_replayed_on_cashu` means something else
+   * already holds it — and the operator's most natural target is that very
+   * credit. The payment hash cannot collide with it, and it makes all three
+   * references to this payment agree: `basis.fundingRef`, the deposit's
+   * `funding_id`, and the funding row's `fund_id`.
    * - **`written_off` is an accepted input status.** A write-off unwound
-   *   nothing, so an operator who closed a row by mistake must not need raw SQL
-   *   against a money table to reopen it.
+   * nothing, so an operator who closed a row by mistake must not need raw SQL
+   * against a money table to reopen it.
    *
    * The invoice row's status — never the funding row — is the idempotency
    * source of truth. `fund_id` is caller-chosen and the payment hash is
@@ -2677,7 +2676,7 @@ var CreditLedger = class {
   }
   /**
    * Record that an operator reviewed a blocked invoice and chose not to credit
-   * it (internal-review) — no ledger effect, purely a queue transition.
+   * it — no ledger effect, purely a queue transition.
    *
    * A CAS on `blocked`, and idempotent: re-running returns the recorded row
    * rather than overwriting the first note. It cannot capture a `reconciled`
@@ -2746,7 +2745,7 @@ var CreditLedger = class {
   }
   /**
    * All pending holds on a credit, in `ledger_seq` order (no lock). Read
-   * surface for the internal-review sweeper wiring — a worker that dies mid-job
+   * surface for the sweeper wiring — a worker that dies mid-job
    * leaves its hold `pending` until something releases it.
    */
   async listPendingDraws(creditId) {
@@ -2758,7 +2757,7 @@ var CreditLedger = class {
   }
   /**
    * One page of pending holds host-wide placed before `createdBeforeMs`,
-   * oldest first (no lock). The orphan sweeper's read surface (internal-review): a
+   * oldest first (no lock). The orphan sweeper's read surface: a
    * draw commits with its `job_id` before the job row is persisted, so a crash
    * or a fail-closed refusal in that window strands a hold nothing can ever
    * resolve — the only release path keys off the `credit_id`/`draw_id` written
@@ -2797,7 +2796,7 @@ var CreditLedger = class {
    * Rail-native value the credit an x402 settlement channel funded has
    * actually earned — the sum of its **settled** draws, in the credit's native
    * atomic units (USDC micro on this rail). The batch-settlement claim job's
-   * ceiling (internal-review): a channel is claimable up to what its credit's draws
+   * ceiling: a channel is claimable up to what its credit's draws
    * have earned, never up to the deposit that funded it.
    *
    * `undefined` when no credit is bound to the channel, which the claim job
@@ -2829,7 +2828,7 @@ var CreditLedger = class {
   }
   /**
    * The credit an x402 settlement channel funded, if one is bound to it — the
-   * binding is UNIQUE, so at most one row can answer (internal-review).
+   * binding is UNIQUE, so at most one row can answer.
    *
    * The operator repair's entry point: a wedged settlement row carries the
    * channel and an `effect_id`, and this is what turns them back into the
@@ -3008,10 +3007,9 @@ var CreditLedger = class {
   async listX402CreditLosses(args) {
     return this.readX402CreditLosses(this.pool, { limit: args?.limit ?? 50 });
   }
-  // ── Drains (internal-review) ─────────────────────────────────────────────────
   /**
    * Debit the caller's entire available balance into a drain liability
-   * (spec §5: expiry ends spending, never ownership — this is the
+   * (the caller-ownership contract: expiry ends spending, never ownership — this is the
    * builder-honored reclaim floor). Runs under the credit row lock: the
    * amount is `balance − pending holds` read under `FOR UPDATE`, the balance
    * is decremented in the same transaction, and the drain takes the next
@@ -3151,7 +3149,7 @@ var CreditLedger = class {
     return rows.length > 0 ? drainRecordFromJoinRow(rows[0]) : void 0;
   }
   /**
-   * One credit's undepleted funding lots, oldest first (internal-review) — the
+   * One credit's undepleted funding lots, oldest first — the
    * public read behind the reclaim's own arithmetic, for anything that needs
    * to show its work.
    */
@@ -3160,7 +3158,7 @@ var CreditLedger = class {
   }
   /**
    * What this DVM owes back in satoshis if every open non-channel Bitcoin
-   * credit reclaimed right now (internal-review) — the deposit half of the hub
+   * credit reclaimed right now — the deposit half of the hub
    * balance, and the floor a payout sweep must never go below.
    *
    * Read entirely off the funding lots, at their own funding rates, with no
@@ -3255,7 +3253,7 @@ var CreditLedger = class {
   }
   /**
    * One page of still-`pending` drains on a channel-backed credit, oldest
-   * first (no lock) — the operator's repair queue (internal-review).
+   * first (no lock) — the operator's repair queue.
    *
    * Keyset-paginated for the x402 settlement queue's reason: a wedged row
    * never self-clears, so a caller that re-issues the same first page would
@@ -3271,10 +3269,10 @@ var CreditLedger = class {
    * younger is in flight rather than stuck.
    *
    * The method filter is `'tempo'`, and it is the one line here worth a second
-   * look: `init()` migrates the pre-internal-review `'mpp'` spelling away and
+   * look: `init()` migrates the legacy `'mpp'` spelling away and
    * `DrainMethod` no longer carries it, so a query naming it matches nothing a
-   * DVM has ever written. It named it anyway until internal-review's rename sweep and
-   * internal-review's live rung caught it independently — the whole operator queue
+   * DVM has ever written. It named it anyway until rename sweep and
+   * live rung caught it independently — the whole operator queue
    * read empty in production while every route test stayed green, because
    * those run on `MemoryCreditLedger`, which filters on the typed value. The
    * two implementations of this one predicate must be read together.
@@ -3307,7 +3305,7 @@ var CreditLedger = class {
   }
   /**
    * Record that an operator reviewed a floor-refused channel drain and is not
-   * booking it (internal-review). Books nothing anywhere — no status change, no
+   * booking it. Books nothing anywhere — no status change, no
    * balance movement, no platform report.
    *
    * A single-statement CAS on `written_off_at IS NULL`, so the first note on
@@ -3450,7 +3448,7 @@ var CreditLedger = class {
    * loss, so the caller's re-poll keeps returning the same token either way.
    *
    * Returns `replayed` because this is a **terminal** transition and the money
-   * has left at exactly one of these calls (internal-review): the platform drain
+   * has left at exactly one of these calls: the platform drain
    * report must be emitted by that caller and no other. Pass `tx` to write the
    * report through the same transaction as the CAS.
    */
@@ -3511,7 +3509,6 @@ var CreditLedger = class {
       [args.creditId, args.drainId, JSON.stringify([args.receipt])]
     );
   }
-  // ── Internals ─────────────────────────────────────────────────────────
   async readDrain(q, creditId, drainId) {
     const { rows } = await q.query(
       `SELECT * FROM credit_drains WHERE credit_id = $1 AND drain_id = $2`,
@@ -3544,7 +3541,7 @@ var CreditLedger = class {
     );
   }
   /**
-   * Price a reclaim in kind and say which lots it takes (internal-review).
+   * Price a reclaim in kind and say which lots it takes.
    *
    * The debits are returned whether or not the reclaim can be priced, and the
    * caller applies them either way: the money is leaving the credit, so the
@@ -3553,13 +3550,13 @@ var CreditLedger = class {
    *
    * `owedSats` is `null` where {@link isInKindDepletion} refuses — the lots
    * are short of the balance, or the covering lots carry no sats basis (a
-   * credit funded before internal-review). That row is priced off a live rate by the
+   * legacy credit whose funding recorded no sats basis. That row is priced off a live rate by the
    * admin surface instead, which is what *every* row did before this change,
    * so the fallback is the old behaviour rather than a new failure mode.
    *
-   * What it publishes is **net of the delivery reserve** (internal-review): handing a
+   * What it publishes is **net of the delivery reserve**: handing a
    * refund over costs a mint fee and, when the notes have to be minted just in
-   * time, a Lightning hop. The caller carries that cost per internal-review, and a
+   * time, a Lightning hop. The caller carries that cost per and a
    * flat reserve is how they carry it without the figure moving — an
    * actual-fee true-up could only be applied after the promise was made. The
    * debits stay gross because they are denominated in micro and are what
@@ -3575,7 +3572,7 @@ var CreditLedger = class {
     };
   }
   /**
-   * This credit's undepleted funding lots, oldest first (internal-review).
+   * This credit's undepleted funding lots, oldest first.
    *
    * Ordered in SQL on the same `(created_at, lot_id)` key the partial index
    * carries, so FIFO is the index's own order rather than something a reader
@@ -3739,7 +3736,7 @@ var CreditLedger = class {
   /**
    * Held-but-unresolved totals for a credit, in all three units at once — the
    * fiat micro that defines available balance plus the rail-value remainders
-   * a new draw allocates against (internal-review). One round-trip, since every
+   * a new draw allocates against. One round-trip, since every
    * caller needs the micro sum anyway.
    */
   async pendingSums(q, creditId) {
@@ -3814,7 +3811,7 @@ function isFundingRail(rail) {
 }
 function assertFundingBasis(basis) {
   if (!basis) {
-    throw new CreditLedgerError("invalid_basis", "basis is required (internal-review)");
+    throw new CreditLedgerError("invalid_basis", "basis is required");
   }
   if (!isFundingRail(basis.rail)) {
     throw new CreditLedgerError(

package/dist/{chunk-E4EVGPDX.js → chunk-XQXJKJ3P.js}

@@ -5,7 +5,6 @@ import {
 // src/sdk/step-cache.ts
 var StepCache = class _StepCache {
   cache = /* @__PURE__ */ new Map();
-  /** Check if a step result is cached. */
   has(id) {
     return this.cache.has(id);
   }
@@ -19,7 +18,6 @@ var StepCache = class _StepCache {
     if (record === void 0) throw new Error(`StepCache: no cached result for step "${id}"`);
     return record;
   }
-  /** Cache a step result. */
   set(id, value, costs) {
     this.cache.set(id, {
       id,

package/dist/{credit-ledger-2DFQHNLB.js → credit-ledger-5ZEJRI46.js}

@@ -10,7 +10,7 @@ import {
   isDrainMethod,
   isFundingRail,
   x402SettlementPending
-} from "./chunk-MLRCSJYX.js";
+} from "./chunk-V7EVFLAK.js";
 import "./chunk-S3XAHZQY.js";
 import "./chunk-C3MTFLC6.js";
 export {