@dvmkit/sdk 0.1.5-rc.9 → 0.2.0-rc.9

package/dist/internal/caller.js

@@ -55,7 +55,7 @@ import {
   withIdentitiesLock,
   withTempoChannelLock,
   withholdsTempoCreditSession
-} from "../chunk-TQWGQCNV.js";
+} from "../chunk-OMIQMMME.js";
 import {
   TEMPO_CHAIN_ID,
   TEMPO_MODERATO_CHAIN_ID,
@@ -71,7 +71,7 @@ import {
   tempoTokenReference,
   tempoWrongAssetHint,
   tryResolveTempoAsset
-} from "../chunk-2UUXIIOC.js";
+} from "../chunk-O2X2CCKH.js";
 import {
   DvmX402ChannelStorage,
   X402_EXACT_AUTHORIZATION_TTL_SECONDS,
@@ -116,7 +116,7 @@ import {
   x402PendingStale,
   x402PendingUnsettled,
   x402WrongAssetHint
-} from "../chunk-BIP6G74V.js";
+} from "../chunk-2ATUAUAO.js";
 import {
   RAIL_FLAGS,
   SUPPORTED_PROTOCOL_VERSION,
@@ -181,10 +181,10 @@ import {
   retireConfigBackup,
   rollbackConfig,
   updateConfig
-} from "../chunk-CGKZDODG.js";
+} from "../chunk-MG67KXU7.js";
 import {
   CAPABILITY_NAME_RE
-} from "../chunk-BTZY7VPH.js";
+} from "../chunk-GAIPXGM3.js";
 import {
   DbTransport,
   NwcBackend,
@@ -209,10 +209,10 @@ import {
   sha256hex,
   validateX402Env,
   withNwcPool
-} from "../chunk-CEOAHV2I.js";
+} from "../chunk-FDKRXOZO.js";
 import {
   MemoryKVStore
-} from "../chunk-RW5LP57K.js";
+} from "../chunk-SDK6KDJN.js";
 import {
   ADMIN_STATE_UNAVAILABLE,
   DEFAULT_AGENT_MINT_URL,
@@ -398,7 +398,7 @@ import {
   randomTraceId,
   setEmitter,
   withTraceContext
-} from "../chunk-E4EVGPDX.js";
+} from "../chunk-XQXJKJ3P.js";
 import "../chunk-66HGCPBU.js";
 import {
   redactUrl,
@@ -408,7 +408,7 @@ import {
   FX_CACHE_TTL_MS,
   FX_RETRY_COUNT,
   warmFxSnapshot
-} from "../chunk-27V2ILSR.js";
+} from "../chunk-4A2RAKCW.js";
 import {
   InvalidUsdPriceError,
   parseUsdPrice
@@ -503,7 +503,7 @@ async function enforceGlobalBudget(opts) {
         window: check.window,
         spent: {
           display: `$${formatUsd(check.spentUsd)}`,
-          // internal-review: the cap counts both what the agent paid DVMs and what it
+          // the cap counts both what the agent paid DVMs and what it
           // moved out of the Lightning float, so name the split rather than
           // leaving the user to wonder why the number is higher than their jobs.
           jobs: `$${formatUsd(check.breakdown.jobsUsd)}`,
@@ -1154,11 +1154,6 @@ function toFloatError(err) {
           next_step: "Add funds to the wallet, or ask for a smaller amount."
         }
       );
-    // NIP-47 draws a line here that the remedy depends on entirely (internal-review).
-    // `UNAUTHORIZED` is the wallet saying it has never heard of this
-    // connection; `RESTRICTED` is the wallet saying it knows the connection
-    // perfectly well and will not let it do *this*. Recreating the connection
-    // fixes the first and reproduces the second, verbatim, forever.
     case "UNAUTHORIZED":
       return new DvmError(
         "float_unauthorized",
@@ -1189,11 +1184,6 @@ function toFloatError(err) {
           next_step: "Switch to a wallet that can pay invoices over a connection, such as Alby Hub."
         }
       );
-    // The wallet's own reason is the payload here (internal-review): a routing-floor
-    // failure and a transient liquidity blip look identical without it, and
-    // the drill lost two round trips to an unconditional "retry" hint that a
-    // floor failure can never satisfy. Surface the reason and let the caller
-    // that knows an advertised floor (credit-fund.ts) sharpen the hint.
     case "PAYMENT_FAILED":
       return new DvmError(
         "float_payment_failed",
@@ -4291,7 +4281,7 @@ async function prepareAgentSpend(args) {
           swapping: void 0,
           cashu_token: cashuToken,
           ...boundContext ? { context: boundContext } : {},
-          // What a later reclaim needs (internal-review). Only the swap path
+          // What a later reclaim needs. Only the swap path
           // writes these: reserve-direct entries ship proofs that still
           // live in `wallet.proofs[]`, and `release` / the in-flight
           // revert already own their recovery.
@@ -4968,7 +4958,7 @@ async function shipEntry(entry, httpPost) {
       }
       return { kind: "still_pending", entry, reason: errCode };
     }
-    if (errCode === "wrong_lock_pubkey" || errCode === "not_p2pk_locked" || errCode === "payment_invalid" || errCode === "proof_not_unspent" || // Credit-route permanent refusals (internal-review): the fund can never land
+    if (errCode === "wrong_lock_pubkey" || errCode === "not_p2pk_locked" || errCode === "payment_invalid" || errCode === "proof_not_unspent" || // Credit-route permanent refusals: the fund can never land
     // under this signed body.
     errCode === "credit_id_unavailable" || errCode === "caller_mismatch" || errCode === "credit_not_supported") {
       return { kind: "abandoned", entry, reason: errCode };
@@ -5152,7 +5142,7 @@ function jobRecordFromEntry(entry, jobId, body, feedbackClaim) {
     ...ctx?.policy ? { policy: ctx.policy } : {},
     ...ctx?.strict_per_call ? { strictPerCall: true } : {},
     ...ctx?.max_cashu_fee_sats !== void 0 ? { maxCashuFeeSats: ctx.max_cashu_fee_sats } : {},
-    // internal-review: the per-job token an anonymous caller needs on every later read.
+    // the per-job token an anonymous caller needs on every later read.
     ...typeof body?.job_token === "string" ? { jobToken: body.job_token } : {}
   };
 }
@@ -5309,7 +5299,7 @@ async function releaseAgentReserve(opts) {
     throw new DvmError(
       "missing_canonical_id",
       "DVM advertises no `cashu.canonical_id` on /v1/info.",
-      "Release needs canonical_id so the agent can derive the matching per-DVM refund subkey. Upgrade the builder SDK (internal-review+)."
+      "Release needs canonical_id so the agent can derive the matching per-DVM refund subkey. Upgrade the builder SDK."
     );
   }
   const outputMode = opts.outputMode ?? "locked";
@@ -5475,7 +5465,7 @@ async function reserveAgentWallet(amountSats, opts) {
     throw new DvmError(
       "missing_cashu_info",
       "DVM does not advertise a `cashu` object on /v1/info.",
-      "Reserve requires the builder to expose lock_pubkeys, mints, and canonical_id. Check the builder is running an SDK that supports pre-fund (internal-review+)."
+      "Reserve requires the builder to expose lock_pubkeys, mints, and canonical_id. Check the builder is running an SDK that supports pre-fund."
     );
   }
   const lockPubkey = cashu.lock_pubkeys[0];
@@ -5497,7 +5487,7 @@ async function reserveAgentWallet(amountSats, opts) {
     throw new DvmError(
       "missing_canonical_id",
       "DVM advertises no `cashu.canonical_id` on /v1/info.",
-      "Pre-fund requires canonical_id so the agent can derive a per-DVM refund subkey. Upgrade the builder SDK to one that advertises it (internal-review+)."
+      "Pre-fund requires canonical_id so the agent can derive a per-DVM refund subkey. Upgrade the builder SDK to one that advertises it."
     );
   }
   if (!cashu.mints.includes(opts.mintUrl)) {
@@ -6154,7 +6144,7 @@ async function refundX402BatchChannelLocked(args) {
       // own `balance <= charged` guard lets the request out. How much comes
       // back is the DVM's to decide: it settles against a base derived from
       // the credit it owes, and corrects this one over a 402 when they differ
-      // (internal-review). Deliberately no `amount` below, for the same reason.
+      // Deliberately no `amount` below, for the same reason.
       //
       // The exposure above deliberately does *not* raise this seed. The
       // voucher signed here is fresh claim authority handed to the DVM, and
@@ -7342,7 +7332,7 @@ async function fundOverX402(args, fundId, resumed, corrected = false, locked = f
         channelId: payment.channelId,
         requestedAt: Date.now(),
         // What the signature covers, not what the funding asked for. The exit's
-        // exposure report uses this, and the two figures differ (internal-review).
+        // exposure report uses this, and the two figures differ.
         maxClaimableMicro: payment.maxClaimableMicro,
         ...payment.depositMicro !== void 0 ? { depositMicro: payment.depositMicro } : {},
         ...payment.authorizationValidBefore !== void 0 ? { authorizationValidBefore: payment.authorizationValidBefore } : {}
@@ -7386,13 +7376,8 @@ async function fundOverX402(args, fundId, resumed, corrected = false, locked = f
       base,
       result,
       void 0,
-      // The chain this channel was opened on (internal-review), read back from the
-      // record `createX402BatchPayment` wrote at signing time from the
-      // requirement's own `accepted.network`. Keyed by channel id, so it is the
-      // chain *this* funding rode rather than the wallet's pin — which is what
-      // makes it survive a resume that crosses an `x402-network` re-pin, and
-      // what keeps a re-pinned wallet from re-stating the credit's chain as
-      // wherever it points today.
+      // Record the accepted channel's chain, rather than a wallet pin that may have changed
+      // during a replay.
       findX402Channel({ channelId: pending.channelId })?.network
     );
     recordSpendOnce({
@@ -7544,7 +7529,7 @@ function x402BindingRefusalCopy(err, creditId) {
   return {
     display: "This prepaid balance was opened by a one-off x402 payment, so x402's reusable channel can't top it up. Nothing was credited.",
     // The flavour is not the caller's to pick, but it is no longer the live
-    // menu's either: internal-review records the binding this refusal just named, so
+    // menu's either: records the binding this refusal just named, so
     // the next top-up of this credit signs a one-off payment rather than
     // another channel deposit. That makes the retry the fix wherever this DVM
     // still takes one — and where it doesn't, the answer is refused locally
@@ -7628,7 +7613,7 @@ async function fundOverCashu(args, fundId) {
     cashuP2pk: {
       mints: args.cashuMint ? [args.cashuMint] : [...cashu.mints],
       lock_pubkey: lockPubkey,
-      // internal-review: refund clause on the funding outputs too — a top-up the DVM
+      // refund clause on the funding outputs too — a top-up the DVM
       // never confirms is the same stranded capital a per-call spend would be.
       canonical_id: cashu.canonical_id,
       min_locktime: cashu.min_locktime
@@ -7852,7 +7837,7 @@ async function fundOverMppCharge(args, fundId, resumed, locked = false) {
         privateKey: account.privateKey,
         // This funding's own intent is the basis the ceiling is measured against:
         // the DVM authors the figure that gets signed, and a challenge more than
-        // the shared tolerance above the ask is refused unsigned (internal-review).
+        // the shared tolerance above the ask is refused unsigned.
         basisMicro: args.amountMicro,
         onError: "throw"
       });
@@ -8493,7 +8478,7 @@ async function fundOverLightning(args, fundId, resumed) {
       // it wrote none, its message appended to ours. A wallet that said "no
       // route to the destination" is telling the caller something a generic
       // "didn't go through" throws away, and this is the one funding failure a
-      // human has to act on themselves (internal-review).
+      // human has to act on themselves.
       display: typeof mapped?.data?.display === "string" ? mapped.data.display : `The Lightning payment for this credit didn't go through${mapped ? ` (${mapped.code})` : ""}. The credit was not funded.${mapped?.message ? ` ${mapped.message}` : ""}`,
       hint: belowKnownFloor ? `This amount is below the $${formatUsd((args.menu?.lightning_min_micro ?? 0) / 1e6)} minimum this DVM sets for Lightning, so no retry can pay it. Refill the agent's ecash pocket with 'dvm wallet fund' and fund with ecash instead.` : mapped?.hint
     };
@@ -8594,13 +8579,13 @@ function settled(args, base, result, spentSats, x402ChannelNetwork) {
       targetMicro: args.targetMicro ?? result.credit.remaining_micro,
       // The rail is a pin, not a preference: every later top-up of this credit
       // has to arrive on it or the DVM refuses. Within x402 the instrument is
-      // pinned the same way and for the same reason (internal-review).
+      // pinned the same way and for the same reason.
       rail: base.rail,
       ...base.x402Flavour ? { x402Instrument: x402InstrumentForFlavour(base.x402Flavour) } : {},
       ...x402ChannelNetwork ? { x402ChannelNetwork } : {},
       ...args.menu ? { menu: args.menu } : {},
       // Identity, so the offline headroom view can match a `trustOverrides`
-      // pre-grant without re-describing the DVM (internal-review).
+      // pre-grant without re-describing the DVM.
       ...args.providerInfo?.builder?.pubkey ? { builderPubkey: args.providerInfo.builder.pubkey } : {},
       sequenced: result.replayed !== true
     });
@@ -9322,9 +9307,6 @@ async function probeLightning(timeoutMs) {
       error: {
         code: mapped.code,
         message: mapped.message,
-        // The same drop fixed one branch down: `float_invalid_uri` knows to say
-        // "reconnect with a URI copied whole", and the row was rendering the
-        // generic rail hint over the top of it (internal-review).
         ...mapped.hint ? { hint: mapped.hint } : {},
         ...refusalFields(mapped.data)
       }
@@ -9363,10 +9345,6 @@ async function probeLightning(timeoutMs) {
       error: {
         code: probe.error?.code ?? "float_wallet_offline",
         message: probe.error?.message ?? "The Lightning wallet did not respond.",
-        // Lightning was the one rail dropping the probe's own diagnosis here,
-        // so every float failure rendered as the generic "re-connect" remedy —
-        // the wrong move for a connection the wallet refused on a permission
-        // (internal-review). x402 and Tempo already forward theirs via `classifyError`.
         ...probe.error?.hint ? { hint: probe.error.hint } : {},
         ...refusalFields(probe.error?.data)
       }
@@ -9376,7 +9354,6 @@ async function probeLightning(timeoutMs) {
     rail: "lightning",
     configured: true,
     reachable: true,
-    // Left absent, never coerced to 0 — see `details.balance_unknown` above.
     ...probe.balanceMsats === void 0 ? {} : { balanceMsats: probe.balanceMsats },
     details
   };
@@ -9420,7 +9397,7 @@ async function probeX402(x402, timeoutMs) {
   let network;
   let address;
   try {
-    const { loadX402Wallet: loadX402Wallet2, getX402Balance: getX402Balance2, ensureAddress: ensureAddress2, usdcContractByCaip2: usdcContractByCaip22 } = await import("../x402-5H27DCBE.js");
+    const { loadX402Wallet: loadX402Wallet2, getX402Balance: getX402Balance2, ensureAddress: ensureAddress2, usdcContractByCaip2: usdcContractByCaip22 } = await import("../x402-7S2EFINY.js");
     const wallet = loadX402Wallet2();
     if (!wallet) {
       const storedKey = x402.privateKey;
@@ -9450,16 +9427,10 @@ async function probeX402(x402, timeoutMs) {
       configured: true,
       reachable: true,
       balanceUsdc: balance.usdc,
-      // internal-review: record the contract the balance was actually read against —
-      // a zero here only means "none of *this* token, on *this* chain". Map
-      // lookup off the network already resolved; no second RPC.
       details: {
         address: w.address,
         network: w.network,
         token: usdcContractByCaip22(w.network),
-        // internal-review: and the endpoint that answered, which the caller can
-        // point elsewhere — a wrong one reads as a plausible $0.00 otherwise.
-        // Redacted here, at the boundary where the URL becomes display.
         ...rpcDetails(balance.rpcUrlRedacted, balance.rpcSource)
       }
     };
@@ -9478,7 +9449,7 @@ async function probeMpp(mpp, timeoutMs) {
   if (!mpp) return null;
   if (mpp.method === "tempo") {
     try {
-      const { connectedTempoAccount: connectedTempoAccount2, getTempoUsdcBalance: getTempoUsdcBalance2, resolveTempoNetwork: resolveTempoNetwork2 } = await import("../tempo-wallet-4QKSV65O.js");
+      const { connectedTempoAccount: connectedTempoAccount2, getTempoUsdcBalance: getTempoUsdcBalance2, resolveTempoNetwork: resolveTempoNetwork2 } = await import("../tempo-wallet-O67H5M4N.js");
       const account = await connectedTempoAccount2();
       if (!account) {
         return {
@@ -9499,13 +9470,10 @@ async function probeMpp(mpp, timeoutMs) {
           configured: true,
           reachable: true,
           balanceUsdc: balance.usdc,
-          // internal-review: record the contract the balance was actually read
-          // against — a zero here only means "none of *this* token".
           details: {
             address: account.address,
             chain_id: balance.chainId,
             token: balance.tokenAddress,
-            // internal-review: as on x402 above — which endpoint the number came from.
             ...rpcDetails(balance.rpcUrlRedacted, balance.rpcSource)
           }
         };

package/dist/internal/server.d.ts

@@ -1,23 +1,23 @@
 import { FacilitatorConfig } from '@x402/core/server';
-import { aj as PaymentPayload, ap as PaymentRequirementsV1, aq as PaymentRequirementsV2, aE as X402Config, av as SettleResponse, aC as VerifyResponse, bi as X402ExactVersionSupport, bj as X402Receipt, bk as TransactionalPayoutHook, bl as CashuMeltCompleted } from '../step-cache-5dljDqrQ.js';
-export { bm as CreditDepositPayload, bn as CreditDrainPayload, bo as FundingLot, bp as LotDebit, bq as LotDepletion, br as MppxServer, bs as NON_CHANNEL_BITCOIN_RAILS, bt as NonChannelBitcoinRail, bu as PayoutReporter, bv as PostgresTempoSessionStore, bw as RevenueReporter, bx as SIGNED_ENVELOPE_FIELDS, by as SIGNED_ENVELOPE_TYPES, bz as X402TrackedChannel, bA as _testing, bB as createDefaultReplayStore, bC as depleteLots, bD as fifoOrder, bE as inKindDrawMsats, bF as isInKindDepletion, bG as isNonChannelBitcoinRail, bH as lotOwedSats, bI as netOwedSats, bJ as wrapMppx } from '../step-cache-5dljDqrQ.js';
+import { aj as PaymentPayload, ap as PaymentRequirementsV1, aq as PaymentRequirementsV2, aE as X402Config, av as SettleResponse, aC as VerifyResponse, bi as X402ExactVersionSupport, bj as X402Receipt, bk as TransactionalPayoutHook, bl as CashuMeltCompleted } from '../step-cache-CXg7ziML.js';
+export { bm as CreditDepositPayload, bn as CreditDrainPayload, bo as FundingLot, bp as LotDebit, bq as LotDepletion, br as MppxServer, bs as NON_CHANNEL_BITCOIN_RAILS, bt as NonChannelBitcoinRail, bu as PayoutReporter, bv as PostgresTempoSessionStore, bw as RevenueReporter, bx as SIGNED_ENVELOPE_FIELDS, by as SIGNED_ENVELOPE_TYPES, bz as X402TrackedChannel, bA as _testing, bB as createDefaultReplayStore, bC as depleteLots, bD as fifoOrder, bE as inKindDrawMsats, bF as isInKindDepletion, bG as isNonChannelBitcoinRail, bH as lotOwedSats, bI as netOwedSats, bJ as wrapMppx } from '../step-cache-CXg7ziML.js';
 import { Hono } from 'hono';
 import { Env, BlankSchema } from 'hono/types';
 import { Pool } from 'pg';
 export { Pool } from 'pg';
-import { g as getWallet } from '../wallet-CJC8lwxx.js';
-import { A as AccumulatorPool, a as AccumulatorQuerier, C as ConsumedCredentialStore } from '../credit-menu-enwMbn55.js';
-export { b as AppEnv, c as CreditFundingReport, F as FiatDenomination, d as FiatDenominationFailure, e as FundOnlyRequest, I as IncomingPaymentOpts, J as JobCancelledError, M as MintHealthTracker, P as PAYMENT_PROOF_KEYS, f as PaymentErrorCode, g as PaymentErrorDetail, h as PaymentInfo, R as ReporterBannerOpts, i as ResolvedFx, j as RevenueBootCheckOpts, S as SDKServerOpts, k as ServerJob, l as ShortPayForfeit, T as TempoChannelReport, m as TempoObserverHealth, n as TempoSessionChannelMismatchError, U as UpfrontPaymentOpts, V as VerifiedIncomingPayment, o as VerifyIncomingSnapshot, X as X402BatchChannelObservation, p as X402FacilitatorHealth, q as X402SettlementEvidenceOutcome, r as X402SettlementRepair, s as X402SettlementRepairRefusal, t as X402SettlementRepaired, u as X402WedgedSettlement, v as X402WedgedSettlementPage, w as X402_BATCH_SETTLEMENT_MAINNET_NETWORK, x as abortJob, y as applyPaymentInfoToJob, z as assertRevenueReporterReady, B as buildPaymentErrorResponse, D as clearAccumulatorForDvm, E as createDVMServer, G as creditDepositPayload, H as derivedFundCreditId, K as devModeSkipsPaymentVerification, L as fromJobRecord, N as fundedMicroFor, O as hasPaymentProof, Q as hashLockKey, W as implicitCreditId, Y as initWalletAccumulatorTable, Z as insertAccumulatorRows, _ as isDerivedCreditId, $ as isTerminal, a0 as isYieldMessage, a1 as issueUpfrontChallenges, a2 as msatsToFiatMicro, a3 as paymentErrorBody, a4 as pinAskFiat, a5 as priceFiatMicro, a6 as processIncomingPayment, a7 as providerMessage, a8 as repairX402ExactSettlementEffect, a9 as resolveFxSnapshot, aa as resolvePriceFiat, ab as revenueReporterBannerState, ac as toCreditTerms, ad as toJobRecord, ae as unknownRouteNotFound, af as verifyIncomingPayment, ag as verifyTempoSessionManagementCredential, ah as verifyUpfrontPayment, ai as x402RequiredUsdcMicro, aj as x402SettledShare } from '../credit-menu-enwMbn55.js';
-import { g as LockPubkey } from '../lightning-backend-BozcevPZ.js';
-export { t as lockPubkeyStoreToLockPubkey } from '../lightning-backend-BozcevPZ.js';
-export { O as OutgoingMessage, S as StaleJobReapable, i as isStaleJobReapable } from '../job-store-BUGqvCfL.js';
+import { g as getWallet } from '../wallet-Dwjs5n_M.js';
+import { A as AccumulatorPool, a as AccumulatorQuerier, C as ConsumedCredentialStore } from '../credit-menu-D4Gcdgc4.js';
+export { b as AppEnv, c as CreditFundingReport, F as FiatDenomination, d as FiatDenominationFailure, e as FundOnlyRequest, I as IncomingPaymentOpts, J as JobCancelledError, M as MintHealthTracker, P as PAYMENT_PROOF_KEYS, f as PaymentErrorCode, g as PaymentErrorDetail, h as PaymentInfo, R as ReporterBannerOpts, i as ResolvedFx, j as RevenueBootCheckOpts, S as SDKServerOpts, k as ServerJob, l as ShortPayForfeit, T as TempoChannelReport, m as TempoObserverHealth, n as TempoSessionChannelMismatchError, U as UpfrontPaymentOpts, V as VerifiedIncomingPayment, o as VerifyIncomingSnapshot, X as X402BatchChannelObservation, p as X402FacilitatorHealth, q as X402SettlementEvidenceOutcome, r as X402SettlementRepair, s as X402SettlementRepairRefusal, t as X402SettlementRepaired, u as X402WedgedSettlement, v as X402WedgedSettlementPage, w as X402_BATCH_SETTLEMENT_MAINNET_NETWORK, x as abortJob, y as applyPaymentInfoToJob, z as assertRevenueReporterReady, B as buildPaymentErrorResponse, D as clearAccumulatorForDvm, E as createDVMServer, G as creditDepositPayload, H as derivedFundCreditId, K as devModeSkipsPaymentVerification, L as fromJobRecord, N as fundedMicroFor, O as hasPaymentProof, Q as hashLockKey, W as implicitCreditId, Y as initWalletAccumulatorTable, Z as insertAccumulatorRows, _ as isDerivedCreditId, $ as isTerminal, a0 as isYieldMessage, a1 as issueUpfrontChallenges, a2 as msatsToFiatMicro, a3 as paymentErrorBody, a4 as pinAskFiat, a5 as priceFiatMicro, a6 as processIncomingPayment, a7 as providerMessage, a8 as repairX402ExactSettlementEffect, a9 as resolveFxSnapshot, aa as resolvePriceFiat, ab as revenueReporterBannerState, ac as toCreditTerms, ad as toJobRecord, ae as unknownRouteNotFound, af as verifyIncomingPayment, ag as verifyTempoSessionManagementCredential, ah as verifyUpfrontPayment, ai as x402RequiredUsdcMicro, aj as x402SettledShare } from '../credit-menu-D4Gcdgc4.js';
+import { g as LockPubkey } from '../lightning-backend-CQBnQgsT.js';
+export { t as lockPubkeyStoreToLockPubkey } from '../lightning-backend-CQBnQgsT.js';
+export { O as OutgoingMessage, S as StaleJobReapable, i as isStaleJobReapable } from '../job-store-B2uZvga4.js';
 import { Store } from 'mppx';
 import { z } from 'zod';
 import '@x402/evm/batch-settlement/server';
 import 'viem';
 import '@x402/core/types';
 import '@cashu/cashu-ts';
-import '../fx-D860pZvP.js';
+import '../fx-B0SLBe5x.js';
 
 /** POST a verify request to the configured facilitator. */
 declare function verifyWithFacilitator(payload: PaymentPayload, requirements: PaymentRequirementsV1 | PaymentRequirementsV2, config?: Pick<X402Config, "facilitator" | "facilitatorAuth">, createAuthHeaders?: FacilitatorConfig["createAuthHeaders"] | undefined): Promise<VerifyResponse>;
@@ -25,17 +25,17 @@ declare function verifyWithFacilitator(payload: PaymentPayload, requirements: Pa
 declare function settleWithFacilitator(payload: PaymentPayload, requirements: PaymentRequirementsV1 | PaymentRequirementsV2, config?: Pick<X402Config, "facilitator" | "facilitatorAuth">, createAuthHeaders?: FacilitatorConfig["createAuthHeaders"] | undefined): Promise<SettleResponse>;
 
 /**
- * Verify an x402 `X-PAYMENT` header per the x402 spec (internal-review).
+ * Verify an x402 `X-PAYMENT` header per the x402 spec.
  *
  * Flow:
- *  1. Decode the base64 `PaymentPayload`
- *  2. Rebuild the `PaymentRequirements` the server advertised on the 402 — the
- *     facilitator deep-equals these against the payload's authorization, so a
- *     credential bought against any other set fails verification.
- *  3. Call the facilitator's `/verify`
- *  4. On valid, call the facilitator's `/settle` to broadcast the EIP-3009
- *     `transferWithAuthorization`. The on-chain tx hash flows through to the
- *     receipt and into `X-PAYMENT-RESPONSE` for the client.
+ * 1. Decode the base64 `PaymentPayload`
+ * 2. Rebuild the `PaymentRequirements` the server advertised on the 402 — the
+ * facilitator deep-equals these against the payload's authorization, so a
+ * credential bought against any other set fails verification.
+ * 3. Call the facilitator's `/verify`
+ * 4. On valid, call the facilitator's `/settle` to broadcast the EIP-3009
+ * `transferWithAuthorization`. The on-chain tx hash flows through to the
+ * receipt and into `X-PAYMENT-RESPONSE` for the client.
  *
  * A positive `btcUsdRate` converts the settled USDC back to msats. Zero means
  * the requirement was already stated exactly in USD and no rate was needed;
@@ -48,8 +48,8 @@ declare function verifyX402Payment(paymentHeader: string, config: X402Config, re
 /**
  * Snapshot of a DVM's published lock-pubkey state at a point in time. `current`
  * is what the SDK advertises as `cashu.lock_pubkeys[0]`; `retired` are the
- * pubkeys that have been rotated out but still fall inside the rotation grace
- * window (`cashu.lock_pubkey_grace_seconds`). Both halves are needed by the
+ * pubkeys inside the rotation grace window plus legacy sentinel-0 entries
+ * kept until explicitly cleaned up. Both halves are needed by the
  * receive path (accept proofs locked to any entry) and the admin auth verifier
  * (accept signatures from any entry during grace).
  */
@@ -67,10 +67,6 @@ interface LockPubkeyState {
  * a process restart.
  */
 type LockPubkeyStateLoader = () => Promise<LockPubkeyState>;
-/**
- * Subset of pg.Pool used by the lock-pubkey store. Sharing `AccumulatorPool`
- * keeps the SDK's "pass me a Postgres pool" surface uniform across stores.
- */
 type LockPubkeyPool = AccumulatorPool;
 /**
  * Create the `dvm_lock_pubkeys` table if absent. Each row is one entry in a
@@ -90,20 +86,16 @@ declare function initLockPubkeyTable(db: LockPubkeyPool): Promise<void>;
  * Also backfills any distinct `lock_pubkey` values found in
  * `wallet_accumulator` for this DVM that aren't yet in `dvm_lock_pubkeys`,
  * inserting them as retired rows with `retired_at_ms = 0` — the
- * "long-retired-still-meltable" sentinel. This handles pre-internal-review batches
+ * "long-retired-still-meltable" sentinel. This handles legacy batches
  * that would otherwise trip the monitor's `orphan_lock_pubkey` alarm every
  * tick. Sentinel-0 rows are exempt from grace-window filtering and
  * `pruneRetired` so they stay visible until the operator melts the legacy
  * batches and the receive path keeps accepting in-flight tokens locked to
  * them.
  *
- * Two simultaneous cold boots can both pass the `WHERE NOT EXISTS` guard, and
- * the loser then takes a 23505 on `dvm_lock_pubkeys_current_uidx` — the shape
- * internal-review fixed for `mpp_secret_state`, reached here through the same
- * first-boot window. Closed the same way, with `ON CONFLICT DO NOTHING` on
- * that partial index: the boot lock (internal-review) serializes the cross-machine
- * half, but two callers on one pool share its acquisition (a fire-and-forget
- * hydrate overlapping boot's), so the guard has to hold without it.
+ * `ON CONFLICT DO NOTHING` must remain even under the boot lock: callers on
+ * one pool share its acquisition, so concurrent seeds can both pass the
+ * `WHERE NOT EXISTS` check before either insert commits.
  */
 declare function seedLockPubkeyState(db: LockPubkeyPool, dvmId: string, pubkey: string, now?: number): Promise<void>;
 /**
@@ -137,18 +129,12 @@ declare function rotateLockPubkey(db: LockPubkeyPool, dvmId: string, newPubkey:
  */
 declare function pruneRetired(db: AccumulatorQuerier, dvmId: string, graceMs: number, now?: number): Promise<number>;
 /**
- * Default rotation grace window — 24h, per §4.5 of the cashu-integration
- * design note. Operators tune via `BUILDER_LOCK_PUBKEY_GRACE_SECONDS`.
+ * Default rotation grace window in seconds. Override through
+ * `SDKServerOpts.lockPubkeyGraceSeconds`.
  */
 declare const DEFAULT_LOCK_PUBKEY_GRACE_SECONDS = 86400;
-/**
- * Lift a single pubkey + grace-filtered retired list into the flat array the
- * accept path checks against. Convenience for call sites that don't care
- * about the retired-row structure.
- */
 declare function activePubkeySet(state: LockPubkeyState): LockPubkey[];
 
-/** Options for `installAdminCashuRoutes`. */
 interface InstallAdminCashuRoutesOpts {
     /** Pool against the SDK's accumulator DB. */
     db: Pool;
@@ -157,7 +143,7 @@ interface InstallAdminCashuRoutesOpts {
     /**
      * Live lock-pubkey state loader. Auth accepts a signature from the current
      * pubkey or any retired pubkey still within the rotation grace window
-     * (internal-review). The `/admin/cashu/rotate-lock-pubkey` route narrows that to
+     * The `/admin/cashu/rotate-lock-pubkey` route narrows that to
      * current-only.
      */
     getLockPubkeyState: LockPubkeyStateLoader;
@@ -166,7 +152,7 @@ interface InstallAdminCashuRoutesOpts {
     /** Replay-protection store keyed by nonce. */
     nonceStore: ConsumedCredentialStore;
     /**
-     * Runs inside the transaction that marks the rows melted (internal-review): the
+     * Runs inside the transaction that marks the rows melted: the
      * proofs are SPENT and the Lightning payment reached the builder, so the
      * melt is a landed payout, and its report commits with the mark or not at
      * all. `enqueue` throwing rolls the mark back and fails the call — the CLI's
@@ -194,7 +180,7 @@ declare function createAdminCashuNonceStore(): ConsumedCredentialStore;
 
 /**
  * The `fx_rate_unavailable` payment-error detail, shaped like every other flat
- * payment error (internal-review): a flat machine `error` code plus `message` and the
+ * payment error: a flat machine `error` code plus `message` and the
  * `display`/`hint`/`retryable` fields an agent relays verbatim and branches
  * retries on — the shape the `paymentErrorBody` builder enforces for the sibling
  * 503s (`mint_health_pending`, `cashu_mint_sick`) and the 402 family alike. This
@@ -211,11 +197,7 @@ declare function rateUnavailablePaymentError(): {
 /**
  * Create a fetch wrapper that emits `dvm.fetch` spans via `loggers.isolate`.
  *
- * Attributes include the redacted URL, HTTP method, and (post-response)
- * status code. When observability is disabled, `loggers.isolate` is the no-op
- * logger — `span()` calls `fn()` directly with zero overhead.
- *
- * `signal` (internal-review) is the job's cancellation signal. When supplied, every
+ * `signal` is the job's cancellation signal. When supplied, every
  * request made through this fetch aborts on job cancel — that is what stops
  * provider spend mid-job. It is *merged* with any caller-supplied
  * `init.signal` rather than replacing it, so a per-request timeout (scrapfly,
@@ -232,7 +214,7 @@ interface JobCredentialRequest {
     header(name: string): string | undefined;
 }
 /**
- * internal-review: the credential gate on a runtime's `/v1/job/:id/*` routes — the
+ * the credential gate on a runtime's `/v1/job/:id/*` routes — the
  * "did this request present anything?" predicate and the 401 body that answers
  * when it didn't, built together so the copy can never describe a credential
  * the predicate doesn't accept.
@@ -244,20 +226,20 @@ interface JobCredentialGate {
     body(): Record<string, unknown>;
 }
 /**
- * internal-review: build the credential gate for one runtime.
+ * build the credential gate for one runtime.
  *
  * `acceptsBearer` is what separates them. The isolate tier derives
  * `requesterId` from `Authorization: Bearer`, so a Bearer token really is a
  * job credential there. The SDK server does not — its auth middleware pins
  * `requesterId` to `anonymous`/`dev-anonymous`, so every SDK job is gated on
- * the internal-review `X-Job-Token` and a Bearer header proves nothing. Counting it
+ * the `X-Job-Token` and a Bearer header proves nothing. Counting it
  * anyway would send a stale client that happens to send one back to the
  * opaque 404 this exists to eliminate.
  *
  * A request carrying no accepted credential can be refused before the job is
  * ever looked up, which is what makes {@link JobCredentialGate.body} safe to
  * be specific about — the 404-not-403 choice on a *failed* ownership check is
- * deliberate (internal-review: a wrong credential must never confirm a job id exists),
+ * deliberate (a wrong credential must never confirm a job id exists),
  * and that property is untouched here because this body is returned before any
  * store lookup, identical whether or not the job exists.
  *
@@ -268,7 +250,6 @@ declare function jobCredentialGate(opts: {
     acceptsBearer: boolean;
 }): JobCredentialGate;
 
-/** Options for `PostgresTempoChargeStore`. */
 interface PostgresTempoChargeStoreOpts {
     /** Table name. Defaults to `"mpp_tempo_charge_replays"`. Must match `/^[a-zA-Z_][a-zA-Z0-9_]*$/`. */
     tableName?: string;
@@ -288,7 +269,7 @@ interface PostgresTempoChargeStoreOpts {
 }
 /**
  * Postgres implementation of the atomic store mppx's `tempo.charge` uses for
- * replay protection (internal-review).
+ * replay protection.
  *
  * mppx refuses a charge credential whose transaction hash it has already taken
  * (`markHashUsed`), and refuses a zero-dollar proof credential whose challenge
@@ -350,7 +331,7 @@ declare class PostgresTempoChargeStore implements Store.AtomicStore {
      * connection is held for exactly that long and never across a chain call.
      */
     update<result>(key: string, fn: (current: unknown) => Store.Change<unknown, result>): Promise<result>;
-    /** The boot DDL itself — always runs under {@link withSdkInitLock} (internal-review). */
+    /** The boot DDL itself — always runs under {@link withSdkInitLock}. */
     private createTables;
     private maybeSweep;
 }
@@ -373,7 +354,6 @@ declare const TEMPO_CLOSE_REQUESTED_TOPIC = "0xf5a36fc00a96cbb9cf1f8f59299165e1d
  */
 declare const TEMPO_CLOSE_DB_RECOVERY_BUDGET_MS = 15000;
 
-/** Humanised `{ message, hint }` derived from a ZodError for the `invalid_input`/`invalid_quote_data` envelope. */
 interface HumanizedZodError {
     message: string;
     hint: string;
@@ -391,11 +371,6 @@ interface HumanizedZodError {
  * that fit: a chunking hint is the one output that tells a caller what to
  * actually do, and losing it because the oversized field sorted fourth is the
  * same class of unhelpful answer this whole path exists to avoid.
- *
- * The `ZodError.message` field is itself a JSON-stringified array of issues
- * (per Zod's default Error contract). Using it raw — as the SDK previously
- * did — leaks the unstructured array into the agent-facing response, which
- * is what internal-review fixes.
  */
 declare function humanizeZodError(err: z.ZodError, opts: {
     schemaUrl: string;

package/dist/internal/server.js

@@ -6,13 +6,13 @@ import {
 } from "../chunk-BIFLRKMO.js";
 import {
   RevenueReporter
-} from "../chunk-EVBK675R.js";
+} from "../chunk-6GRIKOFB.js";
 import {
   PayoutReporter
-} from "../chunk-6BQM7TOW.js";
+} from "../chunk-L67WTZX2.js";
 import {
   PostgresTempoChargeStore
-} from "../chunk-JZWELPFH.js";
+} from "../chunk-MRAGS5VP.js";
 import "../chunk-YG7G4DPZ.js";
 import {
   DEFAULT_LOCK_PUBKEY_GRACE_SECONDS,
@@ -65,13 +65,13 @@ import {
   verifyUpfrontPayment,
   x402RequiredUsdcMicro,
   x402SettledShare
-} from "../chunk-5PBOA25N.js";
-import "../chunk-DMNLFNTW.js";
+} from "../chunk-PCUQZDZA.js";
+import "../chunk-QT4ONTST.js";
 import {
   settleWithFacilitator,
   verifyWithFacilitator
 } from "../chunk-BQ2NMWKE.js";
-import "../chunk-KVEHHC7W.js";
+import "../chunk-PHHAYRQV.js";
 import {
   SIGNED_ENVELOPE_FIELDS,
   SIGNED_ENVELOPE_TYPES,
@@ -88,7 +88,7 @@ import {
   isYieldMessage,
   providerMessage,
   toJobRecord
-} from "../chunk-U6M3ATSG.js";
+} from "../chunk-JDT5LCJC.js";
 import {
   toLockPubkey
 } from "../chunk-KXCKFIJI.js";
@@ -96,10 +96,10 @@ import "../chunk-Z4BNLUZF.js";
 import "../chunk-5URG56JJ.js";
 import "../chunk-MKI6OVW4.js";
 import "../chunk-KXZUCCEY.js";
-import "../chunk-E4EVGPDX.js";
+import "../chunk-XQXJKJ3P.js";
 import "../chunk-66HGCPBU.js";
 import "../chunk-FUJ36YDV.js";
-import "../chunk-27V2ILSR.js";
+import "../chunk-4A2RAKCW.js";
 import "../chunk-AT6V3SY7.js";
 import {
   NON_CHANNEL_BITCOIN_RAILS,
@@ -110,13 +110,13 @@ import {
   isNonChannelBitcoinRail,
   lotOwedSats,
   netOwedSats
-} from "../chunk-MLRCSJYX.js";
+} from "../chunk-V7EVFLAK.js";
 import "../chunk-S3XAHZQY.js";
 import "../chunk-C3MTFLC6.js";
 import {
   _testing,
   wrapMppx
-} from "../chunk-M7LHFJ5K.js";
+} from "../chunk-KMZXTBLA.js";
 export {
   DEFAULT_LOCK_PUBKEY_GRACE_SECONDS,
   JobCancelledError,