@dvmkit/sdk 0.1.5-rc.9 → 0.2.1-rc.9

package/dist/server/index.js

@@ -1,12 +1,12 @@
 import {
   PostgresReplayStore
-} from "../chunk-L4OYF4DQ.js";
+} from "../chunk-AJNFXR7J.js";
 import {
   PostgresJobStore
-} from "../chunk-SSSZUVWM.js";
+} from "../chunk-JAHRF5X3.js";
 import {
   PostgresKVStore
-} from "../chunk-FROTD5XQ.js";
+} from "../chunk-V5ZRATJH.js";
 import {
   SSRFError,
   assertSafeUrl,
@@ -21,10 +21,10 @@ import {
   parseNwcUri,
   validateX402Env,
   withNwcPool
-} from "../chunk-CEOAHV2I.js";
+} from "../chunk-FDKRXOZO.js";
 import {
   MemoryKVStore
-} from "../chunk-RW5LP57K.js";
+} from "../chunk-SDK6KDJN.js";
 import {
   AccumulatorReplayError,
   CLIENT_COMPATIBILITY_HEADERS,
@@ -78,16 +78,16 @@ import {
   stripProtocolEnvelope,
   toCreditView,
   unknownRouteNotFound
-} from "../chunk-5PBOA25N.js";
+} from "../chunk-JNKQZVZX.js";
 import {
   MemoryProcessedPaymentStore,
   PostgresProcessedPaymentStore,
   ProcessedPaymentReplayError
-} from "../chunk-DMNLFNTW.js";
+} from "../chunk-XRLKGCAW.js";
 import "../chunk-BQ2NMWKE.js";
 import {
   MemoryCreditLedger
-} from "../chunk-KVEHHC7W.js";
+} from "../chunk-U5VNEALI.js";
 import {
   SignedRequestError,
   createDefaultReplayStore,
@@ -96,12 +96,12 @@ import {
 } from "../chunk-H2MEFVH6.js";
 import {
   isStreamableJobStore
-} from "../chunk-U6M3ATSG.js";
+} from "../chunk-MD3H3BF7.js";
 import {
   generateEphemeralReceiptKey,
   isTestMintUrl,
   receiptPubkeyFromSecret
-} from "../chunk-KXCKFIJI.js";
+} from "../chunk-QX52F6IB.js";
 import {
   X402_DEFAULT_FACILITATOR,
   X402_DEFAULT_NETWORK,
@@ -110,7 +110,7 @@ import {
 } from "../chunk-Z4BNLUZF.js";
 import {
   IMPLICIT_CREDIT_TTL_MS
-} from "../chunk-5URG56JJ.js";
+} from "../chunk-A4CM2BD3.js";
 import {
   resolveRpcOverride
 } from "../chunk-MKI6OVW4.js";
@@ -121,10 +121,10 @@ import {
 } from "../chunk-KXZUCCEY.js";
 import {
   initLoggers
-} from "../chunk-E4EVGPDX.js";
+} from "../chunk-YO56VCTQ.js";
 import "../chunk-66HGCPBU.js";
 import "../chunk-FUJ36YDV.js";
-import "../chunk-27V2ILSR.js";
+import "../chunk-4A2RAKCW.js";
 import "../chunk-AT6V3SY7.js";
 import {
   CreditLedger,
@@ -133,11 +133,11 @@ import {
   PostgresX402ChannelStorage,
   X402RelaySubmissionLockError,
   allocateDrawValue
-} from "../chunk-MLRCSJYX.js";
+} from "../chunk-2D75MNNG.js";
 import {
   SDK_INIT_ADVISORY_LOCK,
   withSdkInitLock
-} from "../chunk-S3XAHZQY.js";
+} from "../chunk-COYKJRMM.js";
 import {
   applyRetryToPool
 } from "../chunk-C3MTFLC6.js";
@@ -147,7 +147,7 @@ import {
   TEMPO_SETTLEMENT_DEFAULT_LOW_BALANCE_MICRO,
   TempoSettlementReadiness,
   resolveTempoNetwork
-} from "../chunk-M7LHFJ5K.js";
+} from "../chunk-XZ7LW4S5.js";
 
 // src/sdk/server/cashu-env.ts
 async function resolveCashuOptsFromEnv(env, pool, cashuModeHint) {
@@ -221,6 +221,7 @@ async function resolveCashuOptsFromEnv(env, pool, cashuModeHint) {
           error: err instanceof Error ? err.message : String(err)
         })
       );
+      if (cashuMode === "p2pk-accumulator") throw err;
       db = void 0;
     }
   }
@@ -320,7 +321,6 @@ var PlatformLightningRailHealth = class {
   lastAttemptAtMs;
   inFlight;
   ceilingLoggedForMs;
-  /** Prime the signal during boot without making a menu request wait for it. */
   async refresh() {
     if (this.inFlight) return this.inFlight;
     this.lastAttemptAtMs = this.now();
@@ -332,7 +332,6 @@ var PlatformLightningRailHealth = class {
       this.inFlight = void 0;
     }
   }
-  /** Answer from cache and begin a non-blocking refresh once it is due. */
   available() {
     const nowMs = this.now();
     if (this.lastAttemptAtMs === void 0 || nowMs - this.lastAttemptAtMs >= this.refreshTtlMs) {
@@ -463,16 +462,10 @@ var LightningReceive = class _LightningReceive {
   permissionRefusal;
   railHealth;
   /**
-   * Validate the configured connection and build the receive leg, or return
-   * `undefined` when this DVM didn't configure one.
-   *
-   * **Throws on a credential that is wrong, degrades on one that is merely
-   * unreachable.** A wallet outage at boot must not stop a DVM whose other
-   * rails are fine — the menu simply omits `lightning` until a later probe
-   * succeeds. A connection that can spend, or one that can't state what it can
-   * do, is a different thing entirely: it is a standing money risk that no
-   * amount of retrying fixes, so it fails the boot loudly with the fix in the
-   * message.
+   * Return undefined when unconfigured. Permission/URI failures refuse construction with a
+   * corrective message; wallet transport failure constructs an unavailable receive leg so
+   * other rails can still boot. Recovery must validate method scope before advertising
+   * Lightning.
    */
   static async create(config) {
     const invoiceTtlSeconds = resolveInvoiceTtl(config.invoiceTtlSeconds);
@@ -528,26 +521,17 @@ var LightningReceive = class _LightningReceive {
     );
   }
   /**
-   * Whether `lightning` belongs on the funding menu right now.
-   *
-   * Reads the cached observation and never blocks; a stale one kicks off a
-   * background refresh and answers with what we last knew. Advertising a rail
-   * whose wallet is down would hand the caller an option that 402s on use —
-   * the §4 posture is to drop it and let the sale survive on the others.
+   * Answer from cached wallet and optional rail-health observations without blocking. A stale
+   * wallet observation starts a background refresh.
    */
   available() {
     if (Date.now() - this.checkedAtMs > HEALTH_TTL_MS) void this.refresh();
     return this.health === "healthy" && (this.railHealth?.available() ?? true);
   }
   /**
-   * Issue (or re-issue) the bolt11 funding `(creditId, fundId)`.
-   *
-   * The invoice is minted **for** the credit and amount named in the caller's
-   * signed body — that binding is the internal-review condition-3 commitment on this
-   * rail, and it is why no artifact hash rides the request: there is no
-   * caller-supplied artifact to hash. A re-poll returns the stored row rather
-   * than minting again; a second bolt11 for one `fund_id` would leave two
-   * payable invoices against a funding that can only be credited once.
+   * Return the stored invoice on retry: two payable bolt11s for one fund ID could charge
+   * twice while only one credits. Caller and amount are bound to the recorded credit/funding
+   * pair, without a caller-supplied artifact hash.
    */
   async issue(ledger, args) {
     const existing = await ledger.getInvoice({ creditId: args.creditId, fundId: args.fundId });
@@ -582,9 +566,8 @@ var LightningReceive = class _LightningReceive {
       fundId: args.fundId,
       callerPubkey: args.callerPubkey,
       currency: args.currency,
-      // Both amounts are pinned here and never recomputed at settle time: a
-      // rate that moved between issuance and payment must not change what the
-      // caller was quoted (the internal-review shape).
+      // Pin fiat and millisatoshi amounts at issue time; settlement does not reprice them
+      // after FX changes.
       amountMicro: args.amountMicro,
       amountMsats: created.amountMsats || args.amountMsats,
       paymentHash: created.paymentHash,
@@ -593,24 +576,9 @@ var LightningReceive = class _LightningReceive {
     });
   }
   /**
-   * Ask the wallet whether one payment hash is paid, and when (internal-review).
-   *
-   * The operator's reconcile verb runs this before it credits anything. A
-   * `blocked` row implies payment — {@link applyOne} returns above the block
-   * classification when the lookup says unpaid — but that is *this fleet's
-   * belief, recorded possibly weeks ago*, and the verb it gates mints balance
-   * against it. One round trip turns the belief into a fact and recovers the
-   * true settlement instant for `settled_at`, which a blocked row never got to
-   * write.
-   *
-   * Unlike {@link settlePending} this **throws**: there is no request whose
-   * latency it protects, and crediting on an unverifiable wallet is exactly
-   * what it exists to prevent. `NOT_FOUND` is the one exception, and it is not
-   * an outage — it is the wallet saying it has never seen this hash, the same
-   * reading {@link applyOne} and the caller-side reconcile in `src/lib/nwc.ts`
-   * take. It comes back as `known: false` because the operator's repair for it
-   * ("you are pointed at a different wallet than the one that minted this")
-   * is not the repair for an unpaid invoice, and certainly not for a retry.
+   * Re-observe the wallet payment before an operator credits a blocked invoice and recover
+   * its settlement instant. Unlike settlePending, lookup failures throw. NOT_FOUND returns
+   * known:false, distinguishing the wrong wallet/unknown hash from an unpaid known invoice.
    */
   async lookupSettlement(paymentHash) {
     try {
@@ -627,23 +595,12 @@ var LightningReceive = class _LightningReceive {
     }
   }
   /**
-   * Consult the wallet about this caller's outstanding invoices and credit the
-   * ones that settled — the pull half of pull-based crediting.
-   *
-   * The pending rows are read locally first, so the common case (nothing
-   * outstanding) costs one indexed SELECT and no network at all. Bounded to
-   * {@link MAX_SETTLE_CHECKS} invoices on a short deadline, and **never throws
-   * into the request**: a wallet failure here means the caller's balance is
-   * merely not updated yet, which the ordinary `insufficient_credit` path
-   * already states honestly.
+   * Read pending invoices locally, then check at most MAX_SETTLE_CHECKS on bounded wallet
+   * deadlines. Log failures without throwing into the request.
    *
-   * **Each invoice gets its own failure boundary.** The sweep window is a few
-   * rows wide, so a row that fails on its own terms — a `fund_id` the caller
-   * reused on another rail, a credit someone else opened first — must not take
-   * the rest of the pass down with it: the next invoice in the window may be
-   * the paid one, and it would never be looked up. Only a transport failure
-   * ends the pass early, because there the wallet itself is gone and the
-   * remaining lookups would just spend the caller's latency confirming it.
+   * An invoice-specific failure must not suppress payable siblings; wallet transport failure
+   * ends the pass. Deterministic refusals retire that row as blocked for operator repair,
+   * while transient failures remain pending.
    */
   async settlePending(ledger, args) {
     let pending;
@@ -683,14 +640,6 @@ var LightningReceive = class _LightningReceive {
     }
     return settled;
   }
-  // ── Internal ───────────────────────────────────────────────────────────
-  /**
-   * One invoice's settlement check. Returns the applied settlement, or
-   * `undefined` when nothing changed (still unpaid, or retired unpaid).
-   *
-   * Throws whatever the wallet or the ledger threw — classifying that is
-   * {@link retireOrLog}'s job, so this stays one invoice's happy path.
-   */
   async applyOne(ledger, backend, invoice, opts) {
     let status;
     try {
@@ -741,18 +690,9 @@ var LightningReceive = class _LightningReceive {
     });
   }
   /**
-   * Decide what one invoice's failure means, and retire the invoice when the
-   * answer is "this can never succeed".
-   *
-   * The split that matters is permanent-versus-transient, because it decides
-   * whether the row keeps a slot in the sweep window. A transient failure — the
-   * database blinked, the wallet answered oddly — leaves it `pending` and the
-   * caller's next request retries it. A **permanent** one means the ledger will
-   * refuse this invoice identically forever, so leaving it pending costs a
-   * `lookup_invoice` on every subsequent request and, at
-   * {@link MAX_SETTLE_CHECKS} of them, fills the window so a genuinely payable
-   * invoice behind them is never even looked up. Those get `blocked`, which
-   * drops them out of the sweep and hands the operator the payment hash.
+   * Retire a deterministic uncreditable payment as blocked so it no longer occupies the
+   * bounded sweep window. Transient failures stay pending for a later request; report the
+   * payment hash for operator repair.
    */
   async retireOrLog(ledger, invoice, err) {
     const reason = await this.blockingReason(ledger, invoice, err);
@@ -785,21 +725,10 @@ var LightningReceive = class _LightningReceive {
     );
   }
   /**
-   * The reason this invoice can never be credited, or `undefined` if the
-   * failure was transient.
-   *
-   * Every code here is decided by state a retry cannot move — a row the ledger
-   * has already committed (a `credit_fundings` entry at this
-   * `(credit_id, fund_id)`, or a `credits` row whose owner, denomination or
-   * rail disagrees with the invoice), or the basis this module rebuilds
-   * identically from the invoice row on every pass. None of them is a race.
-   *
-   * `funding_replayed` is the one that needs a second read to classify.
-   * Usually it *is* benign — a concurrent check won the race and the money is
-   * credited either way — but the key is `(credit_id, fund_id)` and `fund_id`
-   * is **caller-chosen**: reuse it on cashu or x402 after this bolt11 was
-   * minted and the row that collided is a different payment entirely, so the
-   * sats this invoice received have nowhere to land.
+   * Classify funding_replayed by reading the existing funding’s rail. A Lightning row can
+   * represent a concurrent applied check; another rail at this caller-chosen key is a
+   * different payment, leaving the invoice’s sats uncredited. A failed diagnostic read
+   * remains transient, never a guessed permanent refusal.
    */
   async blockingReason(ledger, invoice, err) {
     if (!(err instanceof CreditLedgerError)) return void 0;
@@ -835,7 +764,6 @@ var LightningReceive = class _LightningReceive {
       throw err;
     }
   }
-  /** Record activity without letting it promote an unvalidated connection. */
   noteOperationOk() {
     if (this.health !== "healthy") return;
     this.checkedAtMs = Date.now();
@@ -1028,7 +956,6 @@ var PostgresTempoSettlementReadinessStore = class {
   address;
   token;
   now;
-  /** Create the shared latch table under the SDK-wide boot migration lock. */
   async init() {
     await withSdkInitLock(this.pool, async () => {
       await this.pool.query(`
@@ -1181,7 +1108,7 @@ function createDVMHost(opts = {}) {
     const dbRequired = !opts.jobStore && !opts.devMode && !opts.pool;
     if (!databaseUrl && dbRequired) {
       throw new Error(
-        "createDVMHost requires a Postgres database. Pass `database` opt or set DATABASE_URL env. See public design rationale (internal-review)."
+        "createDVMHost requires a Postgres database. Pass `database` opt or set DATABASE_URL env."
       );
     }
     let store = opts.store ?? new MemoryKVStore();
@@ -1200,13 +1127,13 @@ function createDVMHost(opts = {}) {
       });
       applyRetryToPool(pool, "dvm-host");
       pgPool = pool;
-      const { PostgresJobStore: PostgresJobStore2 } = await import("../postgres-job-store-3RAXMNSY.js");
+      const { PostgresJobStore: PostgresJobStore2 } = await import("../postgres-job-store-MZZZMS2B.js");
       const pgJobStore = new PostgresJobStore2(pool);
       pendingInits.push(pgJobStore.init(), pgJobStore.initStreaming());
       jobStore = pgJobStore;
       pgStreamStore = pgJobStore;
       if (!opts.store) {
-        const { PostgresKVStore: PostgresKVStore2 } = await import("../postgres-kv-store-JFBDP5IP.js");
+        const { PostgresKVStore: PostgresKVStore2 } = await import("../postgres-kv-store-DXGTKXLU.js");
         const pgKvStore = new PostgresKVStore2(pool);
         pendingInits.push(pgKvStore.init());
         store = pgKvStore;
@@ -1238,7 +1165,7 @@ function createDVMHost(opts = {}) {
       if (testMints.length > 0) {
         if (!envFlag(envMaybe.DVMKIT_ALLOW_TEST_MINTS)) {
           throw new Error(
-            `[FATAL] Refusing to boot: platform-hosted DVM configured with test mint(s) [${testMints.join(", ")}]. A test/FakeWallet mint settles no real money \u2014 every payment would silently no-op and revenue would read $0. If this is intentional (dev stack, smoke test, or the staging fleet), set DVMKIT_ALLOW_TEST_MINTS=true. (internal-review)`
+            `[FATAL] Refusing to boot: platform-hosted DVM configured with test mint(s) [${testMints.join(", ")}]. A test/FakeWallet mint settles no real money \u2014 every payment would silently no-op and revenue would read $0. If this is intentional (dev stack, smoke test, or the staging fleet), set DVMKIT_ALLOW_TEST_MINTS=true.`
           );
         }
         console.warn(
@@ -1246,7 +1173,7 @@ function createDVMHost(opts = {}) {
             level: "warn",
             event: "platform_hosted_test_mint_allowed",
             mints: testMints,
-            message: "Platform-hosted DVM booting with test mint(s) because DVMKIT_ALLOW_TEST_MINTS=true \u2014 payments settle no real money. (internal-review)"
+            message: "Platform-hosted DVM booting with test mint(s) because DVMKIT_ALLOW_TEST_MINTS=true \u2014 payments settle no real money."
           })
         );
       }
@@ -1291,11 +1218,11 @@ ${config.facilitatorAuth?.keyId ?? ""}`;
     let tempoChargeBackend = "user-supplied";
     const mppTempoRecipient = envMaybe.DVMKIT_TEMPO_RECIPIENT;
     if (!mpp && mppTempoRecipient) {
-      const { createMppFromOpts, createDualKeyMppxFromOpts, parseMppMethodsAllowlist } = await import("../mpp-setup-4FJD6ZHV.js");
+      const { createMppFromOpts, createDualKeyMppxFromOpts, parseMppMethodsAllowlist } = await import("../mpp-setup-MPP3ST5X.js");
       tempoChargeBackend = pgPool ? "postgres" : "memory";
       let tempoCharge;
       if (pgPool) {
-        const { PostgresTempoChargeStore } = await import("../tempo-charge-store-RIFTALZK.js");
+        const { PostgresTempoChargeStore } = await import("../tempo-charge-store-SDTUNTKA.js");
         const chargeStore = new PostgresTempoChargeStore(pgPool);
         pendingInits.push(chargeStore.init());
         tempoCharge = { store: chargeStore };
@@ -1314,7 +1241,7 @@ ${config.facilitatorAuth?.keyId ?? ""}`;
           { createPublicClient, createWalletClient, erc20Abi, http },
           { tempo: tempoMainnet, tempoModerato }
         ] = await Promise.all([
-          import("../tempo-session-store-2JNOKJGX.js"),
+          import("../tempo-session-store-WF3VZXNF.js"),
           import("viem/accounts"),
           import("viem"),
           import("viem/chains")
@@ -1372,7 +1299,7 @@ ${config.facilitatorAuth?.keyId ?? ""}`;
               chain: selectedChain,
               // Trimmed, so a blank DVMKIT_TEMPO_RPC_URL falls back to the
               // chain's bundled endpoint rather than becoming the transport
-              // target (internal-review).
+              // target.
               transport: http(tempoRpc)
             });
           },
@@ -1415,7 +1342,7 @@ ${config.facilitatorAuth?.keyId ?? ""}`;
           applyMppSecretRotation,
           loadMppSecretState,
           DEFAULT_ROTATION_WINDOW_MS
-        } = await import("../mpp-secret-state-WNAQQ6K4.js");
+        } = await import("../mpp-secret-state-B5GCILVH.js");
         await initMppSecretStateTable(pgPool);
         const rotation = await applyMppSecretRotation(
           pgPool,
@@ -1445,7 +1372,7 @@ ${config.facilitatorAuth?.keyId ?? ""}`;
       }
     }
     const fxSource = envMaybe.DVMKIT_FX_SOURCE;
-    const { createFxFetcher, resolveFxSourceFromEnv, warmFxSnapshot } = await import("../pricing-4CEB34RM.js");
+    const { createFxFetcher, resolveFxSourceFromEnv, warmFxSnapshot } = await import("../pricing-MU5GNUJZ.js");
     const fxFetcher = opts.fx ?? createFxFetcher({ source: resolveFxSourceFromEnv(envMaybe) });
     const hostRailConfigured = (opts.paymentMethods?.length ?? 0) > 0 || (effectiveMints?.length ?? 0) > 0 || !!x402WithDualServe || !!mpp;
     if (mounts.some((entry) => mountNeedsFx(entry, hostRailConfigured))) warmFxSnapshot(fxFetcher);
@@ -1455,7 +1382,7 @@ ${config.facilitatorAuth?.keyId ?? ""}`;
     assertReceiptIdentity(envMaybe, opts.builder, receiptKey, cashuOpts.dvmId, opts.devMode);
     let sharedPgReplayStore;
     if (pgPool) {
-      const { PostgresReplayStore: PostgresReplayStore2 } = await import("../postgres-replay-store-UJXRT6VO.js");
+      const { PostgresReplayStore: PostgresReplayStore2 } = await import("../postgres-replay-store-ZF4JNZOW.js");
       const store2 = new PostgresReplayStore2(pgPool);
       pendingInits.push(store2.init());
       sharedPgReplayStore = store2;
@@ -1467,7 +1394,7 @@ ${config.facilitatorAuth?.keyId ?? ""}`;
       const backend = auth.resolveReplayStore ? auth.resolveReplayStore({ postgresStore: sharedPgReplayStore }) : "user-supplied";
       replayStoreSummaries.push({ mount: entry.descriptor.name, backend });
       if (backend === "memory" && !opts.devMode) {
-        const msg = `secp256k1Auth on "${entry.descriptor.name}" fell back to the in-memory replay store. Multi-machine deploys MUST use a cross-machine store (e.g. PostgresReplayStore) \u2014 each machine's per-process window otherwise lets an attacker replay a captured signed envelope once per machine via the load balancer. Set DATABASE_URL or pass \`replayStore\` to secp256k1Auth(). (internal-review)`;
+        const msg = `secp256k1Auth on "${entry.descriptor.name}" fell back to the in-memory replay store. Multi-machine deploys MUST use a cross-machine store (e.g. PostgresReplayStore) \u2014 each machine's per-process window otherwise lets an attacker replay a captured signed envelope once per machine via the load balancer. Set DATABASE_URL or pass \`replayStore\` to secp256k1Auth().`;
         if (failFast) {
           throw new Error(`[FATAL] ${msg}`);
         }
@@ -1483,24 +1410,24 @@ ${config.facilitatorAuth?.keyId ?? ""}`;
     }
     let sharedPgConsumedStore;
     if (pgPool) {
-      const { PostgresConsumedCredentialStore } = await import("../postgres-consumed-credential-store-VHBT4KEA.js");
+      const { PostgresConsumedCredentialStore } = await import("../postgres-consumed-credential-store-6N2V5MJN.js");
       const consumedStore = new PostgresConsumedCredentialStore(pgPool);
       pendingInits.push(consumedStore.init());
       sharedPgConsumedStore = consumedStore;
     }
     if (pgPool) {
-      const { CreditLedger: CreditLedger2 } = await import("../credit-ledger-2DFQHNLB.js");
+      const { CreditLedger: CreditLedger2 } = await import("../credit-ledger-MHA652TV.js");
       const pgLedger = new CreditLedger2(pgPool, tempoSessionStore);
       pendingInits.push(pgLedger.init());
       creditLedger = pgLedger;
-      const { PostgresProcessedPaymentStore: PostgresProcessedPaymentStore2 } = await import("../processed-payment-store-HAA4SFNK.js");
+      const { PostgresProcessedPaymentStore: PostgresProcessedPaymentStore2 } = await import("../processed-payment-store-GKMAWOM3.js");
       const pgProcessed = new PostgresProcessedPaymentStore2(pgPool);
       pendingInits.push(pgProcessed.init());
       processedPayments = pgProcessed;
     } else {
-      const { MemoryCreditLedger: MemoryCreditLedger2 } = await import("../memory-credit-ledger-MNUOTQO5.js");
+      const { MemoryCreditLedger: MemoryCreditLedger2 } = await import("../memory-credit-ledger-BYBATRN3.js");
       creditLedger = disposableCashu?.ledger ?? new MemoryCreditLedger2();
-      const { MemoryProcessedPaymentStore: MemoryProcessedPaymentStore2 } = await import("../processed-payment-store-HAA4SFNK.js");
+      const { MemoryProcessedPaymentStore: MemoryProcessedPaymentStore2 } = await import("../processed-payment-store-GKMAWOM3.js");
       processedPayments = new MemoryProcessedPaymentStore2();
     }
     await Promise.all(pendingInits);
@@ -1509,7 +1436,7 @@ ${config.facilitatorAuth?.keyId ?? ""}`;
     const checkStoreFallback = (label, event, active, backend, hazardHint) => {
       storeSummaries.push({ label, backend });
       if (active && backend === "memory" && !opts.devMode) {
-        const msg = `The ${label} store fell back to in-memory. Multi-machine deploys MUST use a cross-machine store (set DATABASE_URL) \u2014 each machine's per-process window otherwise lets an attacker ${hazardHint} once per machine via the load balancer. (internal-review)`;
+        const msg = `The ${label} store fell back to in-memory. Multi-machine deploys MUST use a cross-machine store (set DATABASE_URL) \u2014 each machine's per-process window otherwise lets an attacker ${hazardHint} once per machine via the load balancer.`;
         if (failFast) {
           throw new Error(`[FATAL] ${msg}`);
         }
@@ -1691,8 +1618,9 @@ ${config.facilitatorAuth?.keyId ?? ""}`;
       replayStores: replayStoreSummaries,
       stores: storeSummaries
     });
-    return new Promise((resolvePromise) => {
+    return new Promise((resolvePromise, rejectPromise) => {
       const server = honoServe({ fetch: app.fetch, port }, (info) => {
+        server.off("error", rejectPromise);
         const url = `http://{authority}`.replace("{authority}", `localhost:${info.port}`);
         nodeServer = server;
         const portBindMs = Date.now() - bootStart;
@@ -1708,7 +1636,7 @@ ${config.facilitatorAuth?.keyId ?? ""}`;
             level: "dvm_boot_phase_timings",
             totalMsToPortBind: portBindMs,
             phaseMs: deltas
-            // internal-review removed the pre-`listen` `mint_wait` phase: mint health
+            // removed the pre-`listen` `mint_wait` phase: mint health
             // is now validated by the runtime tracker after the port binds, so
             // `totalMsToPortBind` no longer carries the mint-probe tail.
           })
@@ -1722,6 +1650,7 @@ ${config.facilitatorAuth?.keyId ?? ""}`;
           }
         });
       });
+      server.once("error", rejectPromise);
     });
   }
   async function serveFn(serveOpts) {
@@ -2071,7 +2000,7 @@ function secp256k1Auth(opts = {}) {
       replayStore: null,
       driftSeconds,
       now,
-      // internal-review: the caller signs over the credit envelope, so it has to be in
+      // the caller signs over the credit envelope, so it has to be in
       // the canonical bytes — but it is protocol-level, not capability input, so
       // the builder's schema must not have to tolerate it. Resolved once per
       // schema, cached with the verifier below.

package/dist/{ssrf-DbFkpDv0.d.ts → ssrf-dMooihtY.d.ts}

@@ -26,7 +26,6 @@ type SSRFResolver = (host: string) => Promise<{
  * baseline denylist; extra entries compose with (never replace) the defaults.
  */
 interface SSRFGuardOpts {
-    /** Custom DNS resolver — typically a test stub. */
     resolver?: SSRFResolver;
     /** Additional exact hostnames to deny on top of the defaults (lowercased on input). */
     extraHostnamesExact?: Iterable<string>;
@@ -61,7 +60,7 @@ interface SSRFGuardOpts {
  * link-local IP ranges, the AWS / GCP metadata IP, Fly's `*.internal`
  * service-discovery names, and a small denylist of obviously-internal
  * hostnames. Defence-in-depth — full mitigation belongs at the egress firewall
- * and at fetch-time IP pinning (`createPinnedFetch`, internal-review).
+ * and at fetch-time IP pinning (`createPinnedFetch`).
  *
  * Throws `SSRFError` with a `reason` discriminator so callers can branch onto
  * their own typed error taxonomy.