@dvmkit/sdk 0.1.5-rc.9 → 0.2.1-rc.9

package/dist/{step-cache-5dljDqrQ.d.ts → step-cache-v2yhyhSZ.d.ts}

@@ -25,11 +25,8 @@ declare class InvalidCurrencyError extends Error {
     constructor(raw: unknown);
 }
 /**
- * Thrown by the SDK's mid-job fiat-form `requestPayment` when the operator
- * passes a currency the runtime can't live-convert to sats. v1 supports only
- * "usd" (the bundled fx fetcher is USD/BTC); EUR/GBP/JPY land when a
- * multi-currency fx fetcher does. The message names the supported set so
- * operators see exactly what's missing.
+ * A valid currency code that the configured FX snapshot cannot price.
+ * The error message names the supported set so the builder can correct it.
  */
 declare class UnsupportedCurrencyError extends Error {
     readonly raw: string;
@@ -128,7 +125,7 @@ interface X402Config {
      * When true (default), the SDK includes x402 `PaymentRequirements` on the
      * 402 response body alongside MPP's `WWW-Authenticate: Payment` header so
      * x402-speaking agents (Coinbase reference client, thirdweb-ecosystem)
-     * can pay. Flip to `false` for MPP-only DVMs (internal-review).
+     * can pay. Flip to `false` for MPP-only DVMs.
      */
     dualServe?: boolean;
     /** Human-readable description carried on the `PaymentRequirements`. */
@@ -156,7 +153,7 @@ interface X402Receipt {
     verified: boolean;
     amountMsats: number;
     /**
-     * Native USDC amount in 6-decimal microunits (internal-review). Captured from the
+     * Native USDC amount in 6-decimal microunits. Captured from the
      * payment payload's `value` field so the platform revenue ledger records
      * the rail-native value without re-deriving it from `amountMsats` + a
      * fresh BTC rate (lossy and racy across the boundary).
@@ -166,27 +163,14 @@ interface X402Receipt {
     txHash?: string;
     /**
      * Base64-encoded `SettleResponse` for the `X-PAYMENT-RESPONSE` header the
-     * server attaches to the 2xx response per x402 spec (internal-review).
+     * server attaches to the 2xx response per x402 spec.
      */
     settleResponseHeader?: string;
     /** When `verified === false`, a short stable code surfacing the reason. */
     invalidReason?: string;
 }
 
-/**
- * dvmkit's x402 wire-format implementation — the v1/v2 `PaymentRequirements` /
- * `PaymentPayload` envelope shapes, payment-header encode/decode, and the
- * facilitator verify/settle calls that a deployed DVM's 402 response and
- * payment parsing are built from. A wire-format change lands here.
- *
- * **On a change here, or an x402 reference-client upgrade, run the conformance
- * check** — `public compatibility guide`. Our own SDK round-trips
- * against itself (the vitest tiers, `money-loop:x402`), so only a client
- * that isn't dvmkit can catch a *mutual* misreading of the spec. The runbook
- * names the out-of-tree v1 and v2 clients plus the funded Base Sepolia key
- * (`public compatibility guide`); the runbook carries a run log of
- * what it last ran against.
- */
+/** Wire compatibility requires independent v1 and v2 reference-client checks. */
 
 /** Current x402 protocol version preferred by dvmkit clients and servers. */
 declare const X402_VERSION = 2;
@@ -197,13 +181,13 @@ type X402Version = typeof X402_V1_VERSION | typeof X402_VERSION;
 /**
  * Chain a caller's x402 wallet reads when it was connected without an explicit
  * `--network`. Single source of truth for the default: the wallet loader, the
- * connect output and the asset resolver all read it from here (internal-review).
+ * connect output and the asset resolver all read it from here.
  */
 declare const X402_DEFAULT_NETWORK = "eip155:8453";
 /**
  * Scheme name of the per-call rail — one signed authorization settling one
  * resource. Shared with the credit funding menu's `x402.schemes` block, which
- * has to name the same string the requirement carries (internal-review).
+ * has to name the same string the requirement carries.
  */
 declare const X402_EXACT_SCHEME = "exact";
 /**
@@ -212,7 +196,7 @@ declare const X402_EXACT_SCHEME = "exact";
  * the caller's requirement selection, and the credit menu's `x402.schemes`
  * block all read it from here — the menu advertises exactly what the challenge
  * will carry, so a rename cannot leave one of them advertising a flavour the
- * others no longer speak (internal-review).
+ * others no longer speak.
  */
 declare const X402_BATCH_SETTLEMENT_SCHEME = "batch-settlement";
 
@@ -344,11 +328,8 @@ interface BuildPaymentRequirementsOpts {
     version?: X402Version;
 }
 /**
- * Build a single x402 `PaymentRequirements` entry from the DVM's `X402Config`,
- * the resolved per-call USDC amount, and the live request's resource URL.
- * The resource string is bound into the EIP-3009 `extra` field on signing in
- * the reference clients, so it must match exactly between the 402 response
- * and the retry payload — pass the request URL the client will retry against.
+ * V1 carries the resource URL in each requirement; v2 carries it in the outer
+ * response. This metadata is not part of the EIP-3009 authorization signature.
  */
 declare function buildPaymentRequirements(opts: BuildPaymentRequirementsOpts & {
     version: typeof X402_V1_VERSION;
@@ -364,13 +345,7 @@ declare function buildPaymentRequiredV2(opts: Omit<BuildPaymentRequirementsOpts,
 }): PaymentRequiredV2;
 /** Convert the server's legacy body requirements into the parallel v2 declaration. */
 declare function paymentRequiredV2FromV1(requirements: PaymentRequirementsV1[], error?: string): PaymentRequiredV2;
-/**
- * Translate a CAIP-2 chain id (`eip155:8453`) to the x402-spec network slug
- * (`base`). Operators configure DVMs in CAIP-2 because it's the lingua-franca
- * across our other rails; the x402 facilitator API only accepts named slugs.
- * Unknown CAIP-2 ids fall through to the original string so non-EVM rails
- * (Solana mainnet, etc.) can also be plumbed once supported.
- */
+/** Legacy v1 network slugs; unknown identifiers pass through unchanged. */
 declare function caip2ToX402Network(network: string): string;
 /** Translate a legacy x402 network slug back to its CAIP-2 chain id. */
 declare function x402NetworkToCaip2(network: string): string;
@@ -378,12 +353,6 @@ declare function x402NetworkToCaip2(network: string): string;
 declare function chainIdFromCaip2(network: string): number;
 /** USDC contract address for a network slug (post-translation). */
 declare function usdcContractFor(networkSlug: string): `0x${string}` | undefined;
-/**
- * USDC contract address for a CAIP-2 chain id (e.g. `eip155:8453`). Resolves
- * via {@link caip2ToX402Network} so the one network table is the source of
- * truth — keeps callers that hold the CAIP-2 form (CLI wallet) in lockstep
- * with the SDK 402-builder which already speaks x402 slugs.
- */
 declare function usdcContractByCaip2(caip2: string): `0x${string}` | undefined;
 /** USDC EIP-712 domain `name` for a network slug. */
 declare function usdcDomainNameFor(networkSlug: string): string | undefined;
@@ -410,29 +379,24 @@ declare function decodePaymentRequiredHeader(header: string): PaymentRequiredV2;
 declare function exactEvmAuthorization(payload: PaymentPayload): ExactEvmPayloadAuthorization;
 /**
  * Encode a `SettleResponse` for the `X-PAYMENT-RESPONSE` header that the
- * server emits on a 2xx after a successful settlement (internal-review, per the
+ * server emits on a 2xx after a successful settlement (per the
  * x402 spec).
  */
 declare function encodeSettleResponseHeader(response: SettleResponse): string;
 
-/** Identifies which side of the conversation sent a message. */
 type MessageFrom = "requester" | "provider";
 /** Single mppx-shaped MPP challenge carried in `payment-request` messages. */
 type MppxChallenge = Challenge.Challenge;
 /** Structured MPP credential (`{ challenge, payload, source? }`) carried in `payment` messages. */
 type MppxCredential = Credential.Credential;
-/** All supported message types in the conversation protocol. */
 type MessageType = "text" | "prompt" | "response" | "artifact" | "payment-request" | "payment" | "approval" | "cancel" | "complete" | "working" | "progress";
-/** Common fields shared by all message variants. */
 interface MessageBase {
     /** Monotonic sequence number, assigned by provider/server. */
     seq: number;
-    /** Which side sent this message. */
     from: MessageFrom;
     /** Unix timestamp (seconds). */
     timestamp: number;
 }
-/** Free-form text message content. */
 interface TextContent {
     text: string;
 }
@@ -453,15 +417,12 @@ interface ResponseContent {
 }
 /** Job output — inline data or a URL reference. */
 interface ArtifactContent {
-    /** Human-readable name for the artifact. */
     name?: string;
-    /** MIME type of the artifact. */
     mime_type?: string;
     /** Inline data (string or base64 for binary). */
     data?: string;
     /** Encoding of inline data: "utf-8" for text, "base64" for binary. */
     encoding?: "utf-8" | "base64";
-    /** URL to fetch the artifact from. */
     url?: string;
     /** Size in bytes (for URL-referenced artifacts). */
     size_bytes?: number;
@@ -487,7 +448,7 @@ interface PaymentRequestContent {
     mints?: string[];
     min_locktime_seconds?: number;
     /**
-     * NUT-11 P2PK lock pubkey the requester should lock cashu outputs to (internal-review).
+     * NUT-11 P2PK lock pubkey the requester should lock cashu outputs to.
      * When absent, the requester falls back to `/v1/info`'s `cashu.lock_pubkeys[0]`.
      */
     lock_pubkey?: string;
@@ -506,7 +467,7 @@ interface PaymentRequestContent {
          * caller MUST use when signing `TransferWithAuthorization` for this
          * payment-request. Binds the credential to this job so a payload signed
          * for job A cannot satisfy job B within the pre-settlement window
-         * (internal-review). Optional on the wire for backwards-compat — pre-fix DVMs
+         * Optional on the wire for backwards-compat — pre-fix DVMs
          * never set it; verify-side gate keys on `pendingX402Nonce !== undefined`.
          */
         nonce?: string;
@@ -527,7 +488,7 @@ interface PaymentContent {
     mint?: string;
     amount_msats?: number;
     /**
-     * UUIDv4 per-call identifier for the agent-wallet path (internal-review).
+     * UUIDv4 per-call identifier for the agent-wallet path.
      * Mid-job equivalent of the upfront flow's `X-Cashu-Request-Id` header —
      * threaded into the SDK accumulator's `(dvm_id, request_id)` replay key.
      */
@@ -545,7 +506,7 @@ interface PaymentContent {
      */
     tempo_credential?: MppxCredential;
     /**
-     * Dev-only: satisfy the ask with no proof at all (internal-review). The `/_dev`
+     * Dev-only: satisfy the ask with no proof at all. The `/_dev`
      * console has no wallet, so its auto-approve button sends this instead of a
      * rail credential. Admitted only by a `devMode` server, and only on a
      * message that carries none of the proofs above — money on the wire always
@@ -586,7 +547,6 @@ interface ProgressContent {
     /** Optional human-readable hint about what's happening right now. */
     hint?: string;
 }
-/** A single message in a job conversation — discriminated union on `type`. */
 type Message = (MessageBase & {
     type: "text";
     content: TextContent;
@@ -621,37 +581,30 @@ type Message = (MessageBase & {
     type: "progress";
     content: ProgressContent;
 });
-/** Type guard: message is a prompt from the provider. */
 declare function isPromptMessage(msg: Message): msg is MessageBase & {
     type: "prompt";
     content: PromptContent;
 };
-/** Type guard: message contains an artifact. */
 declare function isArtifactMessage(msg: Message): msg is MessageBase & {
     type: "artifact";
     content: ArtifactContent;
 };
-/** Type guard: message is a payment request. */
 declare function isPaymentRequestMessage(msg: Message): msg is MessageBase & {
     type: "payment-request";
     content: PaymentRequestContent;
 };
-/** Type guard: message is a text message. */
 declare function isTextMessage(msg: Message): msg is MessageBase & {
     type: "text";
     content: TextContent;
 };
-/** Type guard: message signals completion. */
 declare function isCompleteMessage(msg: Message): msg is MessageBase & {
     type: "complete";
     content: CompleteContent;
 };
-/** Type guard: message is a cancellation. */
 declare function isCancelMessage(msg: Message): msg is MessageBase & {
     type: "cancel";
     content: CancelContent;
 };
-/** Type guard: message is a working signal. */
 declare function isWorkingMessage(msg: Message): msg is MessageBase & {
     type: "working";
     content: WorkingContent;
@@ -697,7 +650,6 @@ declare const CLIENT_COMPATIBILITY_HEADERS: {
     readonly protocolVersion: "DVM-Protocol-Version";
     readonly capabilities: "DVM-Client-Capabilities";
 };
-/** A parsed SemVer value carried by `DVM-Client`. */
 interface ClientSemVer {
     readonly version: string;
     readonly major: number;
@@ -705,7 +657,6 @@ interface ClientSemVer {
     readonly patch: number;
     readonly prerelease: readonly (string | number)[];
 }
-/** Validated compatibility metadata from one HTTP request. */
 interface ClientCompatibility {
     readonly clientVersion?: ClientSemVer;
     readonly protocolVersion?: number;
@@ -721,16 +672,13 @@ interface ClientCompatibility {
         readonly capabilities: boolean;
     };
 }
-/** Compatibility requirement attached to one endpoint. */
 interface ClientCompatibilityRequirement {
     /** Additive capability tokens the caller must advertise. */
     readonly requiredCapabilities?: readonly string[];
     /** Lowest `dvm` SemVer accepted by this endpoint. */
     readonly minimumClientVersion?: string;
 }
-/** Factory for compatibility middleware attached to one custom route. */
 type ClientCompatibilityGate = (requirement: ClientCompatibilityRequirement) => MiddlewareHandler<ClientCompatibilityEnv>;
-/** Hono variables installed by the SDK compatibility middleware. */
 interface ClientCompatibilityEnv {
     Variables: {
         clientCompatibility?: ClientCompatibility;
@@ -748,62 +696,35 @@ declare function parseClientCapabilities(value: string): readonly string[] | und
 declare function clientCompatibilityAttributes(compatibility: ClientCompatibility): Record<string, unknown>;
 /** Parse request metadata and advertise the server protocol version on every response. */
 declare function clientCompatibilityMiddleware(): MiddlewareHandler<ClientCompatibilityEnv>;
-/** Build pre-handler enforcement middleware for one endpoint declaration. */
 declare const requireClientCompatibility: ClientCompatibilityGate;
-/** Render the normal structured HTTP 426 compatibility error. */
 declare function clientUpgradeRequired(c: Context, compatibility: ClientCompatibility, requirement: ClientCompatibilityRequirement): Response;
 
-/**
- * Canonical JSON serialisation used for secp256k1+BIP-340 Schnorr request
- * signing in cast (internal-review).
- *
- * Single source of truth for both the cast DVM's verifier (internal-review) and the
- * client signing helper (internal-review). The same function on both sides guarantees
- * that what the client signs is byte-identical to what the server hashes.
- *
- * Algorithm: recursively sort object keys lexicographically (UTF-16 code-unit
- * order — JavaScript's default), then JSON.stringify with no whitespace.
- * Arrays preserve order. Numbers, strings, booleans, null pass through as
- * `JSON.stringify` formats them. Values of `undefined` or functions are
- * forbidden (we throw rather than silently drop, since both sides must agree).
- */
-/** Any JSON-serialisable value accepted by `canonicalize`. */
 type JsonValue = string | number | boolean | null | JsonValue[] | {
     [key: string]: JsonValue;
 };
 /**
- * Serialise `value` to its canonical JSON form (sorted keys, no whitespace).
- *
- * `undefined` properties on objects are silently omitted (mirroring
- * `JSON.stringify`), so callers don't need to explicitly delete optional fields
- * that weren't set. Throws `TypeError` for unsupported scalar types (functions,
- * symbols, non-finite numbers). The caller is responsible for stripping fields
- * that shouldn't appear in the signed payload (e.g. `signature` itself).
+ * Object keys sort recursively in UTF-16 code-unit order; arrays preserve order.
+ * Undefined object properties are omitted. Unsupported scalars, including
+ * non-finite numbers, throw TypeError. Callers strip unsigned fields themselves.
  */
 declare function canonicalize(value: JsonValue): string;
 /**
- * Canonicalise `value` and return the UTF-8 bytes the signer should produce a
- * signature over. Both the cast client signer (`signAddEpisode`) and the
- * server verifier (`verifyCanonicalSignedRequest`) call this — sharing the function
- * guarantees byte-identical input on both sides.
+ * UTF-8 encoding of the canonical JSON form.
  */
 declare function canonicaliseForSigning(value: JsonValue): Uint8Array;
 
-/** Terminal outcome a receipt attests. Mirrors the SDK's terminal job statuses. */
 type ReceiptOutcome = "completed" | "failed" | "cancelled";
-/** What the caller paid for the job, as persisted on the job record. */
 interface ReceiptPayment {
     /** Total credited millisats. `0` on free jobs — they still get receipts. */
     msats: number;
     /**
      * Rail of the most recent successful credit; `null` when nothing was paid.
      * `lightning` appears on a draw against a credit the caller funded by
-     * invoice (internal-review) — it is a funding rail, never an attached-proof one.
+     * invoice — it is a funding rail, never an attached-proof one.
      */
     rail: "cashu" | "x402" | "tempo" | "lightning" | null;
     /** Rail-native upfront amount (sats / USDC microunits), `null` when absent. */
     native_amount: number | null;
-    /** Native asset tag paired with `native_amount`. */
     native_asset: string | null;
     /** Settlement reference: EVM tx hash (x402), mppx challenge id, or the Cashu request id. */
     tx_hash: string | null;
@@ -811,8 +732,8 @@ interface ReceiptPayment {
     mint: string | null;
 }
 /**
- * Credit-draw countersignature block (internal-review / internal-review; emitted since
- * internal-review). Present on every job whose payment funded/drew the credit
+ * Credit-draw countersignature block. Present on every job whose payment funded
+ * or drew the credit
  * ledger — including implicit N=1 per-job payments, which fund and draw a
  * single-use credit in the same request. A caller holding a DVM-signed
  * balance trajectory plus its own caller-signed draw intents can prove
@@ -820,23 +741,21 @@ interface ReceiptPayment {
  * because the countersignature rides the receipt.
  *
  * Absence is signature-compatible: `canonicalize` omits absent keys, so a
- * ledger-less (or free) job's receipt signs identically to a pre-internal-review
+ * ledger-less (or free) job's receipt signs identically to a legacy
  * receipt.
  */
 interface ReceiptCredit {
-    /** Credit the draw was taken against. */
     credit_id: string;
     /** This draw's identifier — matches the caller-signed draw intent. */
     draw_id: string;
     /** Amount drawn, in the credit's denomination. */
     amount: number;
-    /** Credit balance after this draw. */
     balance_after: number;
     /** Per-credit monotonic draw counter. */
     ledger_seq: number;
 }
 /**
- * A DVM-signed proof of what a job did and what it cost (internal-review).
+ * A DVM-signed proof of what a job did and what it cost.
  *
  * Signed once at the terminal transition by the per-DVM receipt key, whose
  * authority chains to the builder identity key through the deploy-time
@@ -845,18 +764,22 @@ interface ReceiptCredit {
  * and on every later re-read — the bytes are persisted, not recomputed.
  */
 interface JobReceipt {
-    /** Receipt schema version. Currently always `1`. */
     v: 1;
-    /** The job this receipt attests. */
     job_id: string;
     /** Immutable DVM identity bound into the builder attestation. */
     dvm_id: string;
     /** DVM slug, as bound in the builder attestation. */
     dvm: string;
-    /** Capability the job dispatched to. */
     capability: string;
-    /** Terminal outcome. */
     outcome: ReceiptOutcome;
+    /** Signed Unix millisecond lifecycle times; absent on legacy receipts. */
+    timing?: {
+        accepted_at_ms: number;
+        terminal_at_ms: number;
+        caller_wait_ms: number;
+    };
+    /** SDK-derived attribution on failure/cancellation; absent on completion and legacy receipts. */
+    ended_by?: "caller" | "provider";
     /** Terminal reason on `failed`/`cancelled` (e.g. `worker_died_mid_job`); `null` on success. */
     reason: string | null;
     /** Per-DVM monotonic terminal counter. Gaps expose receipt suppression. */
@@ -865,7 +788,6 @@ interface JobReceipt {
     issued_at: number;
     /** Caller's x-only pubkey when signed-request auth was used; `null` otherwise. */
     requester_pubkey: string | null;
-    /** What the caller paid. */
     paid: ReceiptPayment;
     /**
      * {@link computeResultHash} over the delivered result; `null` when nothing
@@ -878,7 +800,7 @@ interface JobReceipt {
     /** BIP-340 Schnorr signature over the canonical receipt minus `signature` (128 hex chars). */
     signature: string;
     /**
-     * Credit-draw countersignature (internal-review) — present when the job's payment
+     * Credit-draw countersignature — present when the job's payment
      * funded/drew the credit ledger. See {@link ReceiptCredit}. `balance_after`
      * reflects the terminal resolution: the recorded draw trajectory on a
      * settled (completed) job, the restored available balance on a released
@@ -886,12 +808,10 @@ interface JobReceipt {
      */
     credit?: ReceiptCredit;
 }
-/** A receipt before signing — every field but the signature itself. */
 type UnsignedJobReceipt = Omit<JobReceipt, "signature">;
-/** Reclaim lifecycle event a {@link DrainReceipt} attests (internal-review, spec §5). */
 type DrainReceiptEvent = "requested" | "parked" | "picked_up" | "sent" | "released";
 /**
- * A DVM-signed proof of one reclaim event (internal-review). One receipt per
+ * A DVM-signed proof of one reclaim event. One receipt per
  * lifecycle transition — `requested` (the balance debited into the drain
  * liability), `parked` (Cashu notes locked to the caller's refund key,
  * parked for pickup), `picked_up` (the caller collected them), `sent` (a
@@ -907,24 +827,20 @@ type DrainReceiptEvent = "requested" | "parked" | "picked_up" | "sent" | "releas
  * same canonicalisation, so one attestation chain covers both.
  */
 interface DrainReceipt {
-    /** Receipt schema version. Currently always `1`. */
     v: 1;
     /** Discriminator separating this from a `JobReceipt` in mixed stores. */
     kind: "credit_drain";
-    /** Credit the drain was taken against. */
     credit_id: string;
     /** This drain's identifier — matches the caller-signed drain request. */
     drain_id: string;
-    /** The lifecycle event this receipt attests. */
     event: DrainReceiptEvent;
     /** Payout rail: `cashu` | `x402` | `tempo`. */
     method: string;
     /** Amount reclaimed, micro-units of the credit's currency. */
     amount_micro: number;
     /**
-     * Credit balance immediately after the drain debit (micro-units) — the
-     * pending job holds at request time, fixed when the drain was recorded.
-     * Every event's receipt attests this same figure.
+     * Credit balance left after the drain debit, in micro-units. It includes
+     * pending job holds at request time and is fixed across this drain's event receipts.
      */
     balance_after_micro: number;
     /** Per-credit monotonic sequence the drain consumed, shared with draws. */
@@ -942,19 +858,16 @@ interface DrainReceipt {
     /** BIP-340 Schnorr signature over the canonical receipt minus `signature`. */
     signature: string;
 }
-/** A drain receipt before signing — every field but the signature itself. */
 type UnsignedDrainReceipt = Omit<DrainReceipt, "signature">;
 /**
- * A DVM-signed proof that one payment funded a prepaid credit (internal-review).
+ * A DVM-signed proof that one payment funded a prepaid credit.
  * The balance and sequence are the values fixed when the funding committed;
  * retries return this original artifact even when the credit moved later.
  */
 interface FundingReceipt {
-    /** Receipt schema version. Currently always `1`. */
     v: 1;
     /** Discriminator separating funding evidence from job and drain receipts. */
     kind: "credit_funding";
-    /** Credit that received the value. */
     credit_id: string;
     /** Caller fund id, or the attached rail payment id for fund-and-draw. */
     fund_id: string;
@@ -972,12 +885,10 @@ interface FundingReceipt {
     dvm_id: string;
     /** DVM slug, as bound in the builder attestation. */
     dvm: string;
-    /** x-only secp256k1 pubkey that signed this receipt. */
     receipt_pubkey: string;
     /** BIP-340 Schnorr signature over the canonical receipt minus `signature`. */
     signature: string;
 }
-/** A funding receipt before signing. */
 type UnsignedFundingReceipt = Omit<FundingReceipt, "signature">;
 /**
  * Hash the delivered result so a receipt binds to *what* was returned, not
@@ -997,13 +908,6 @@ type UnsignedFundingReceipt = Omit<FundingReceipt, "signature">;
  * issuer does the same (`resultHashFor` in `sdk/server/receipt-issuer.ts`).
  */
 declare function computeResultHash(summary: string | undefined, artifactContents: JsonValue[]): string;
-/**
- * Sign an unsigned receipt with the DVM's receipt secret, returning the
- * complete receipt. Signs `canonicaliseForSigning(receipt)` — the same
- * sorted-key canonical JSON the caller-auth envelope and the builder
- * attestation use, so {@link verifyReceipt} is symmetric with
- * `verifyCanonicalSignedRequest`. There is no second canonicalisation.
- */
 declare function signReceipt(unsigned: UnsignedJobReceipt, secretHex: string): JobReceipt;
 /**
  * Verify a receipt's self-consistency: the BIP-340 signature over the
@@ -1042,9 +946,7 @@ declare function isSignedJobReceipt(value: unknown): value is JobReceipt;
 declare function signDrainReceipt(unsigned: UnsignedDrainReceipt, secretHex: string): DrainReceipt;
 /** Sign an unsigned funding receipt using the common receipt canonicalisation. */
 declare function signFundingReceipt(unsigned: UnsignedFundingReceipt, secretHex: string): FundingReceipt;
-/** Structural guard for a funding receipt received over the wire or from disk. */
 declare function isFundingReceipt(value: unknown): value is FundingReceipt;
-/** Verify a funding receipt's inner BIP-340 signature. */
 declare function verifyFundingReceipt(receipt: FundingReceipt): boolean;
 /**
  * Structural guard on a drain receipt from outside this process — off a
@@ -1061,33 +963,16 @@ declare function verifyFundingReceipt(receipt: FundingReceipt): boolean;
 declare function isDrainReceipt(value: unknown): value is DrainReceipt;
 /**
  * Verify a drain receipt's self-consistency, mirroring {@link verifyReceipt}
- * — the same provenance caveat applies: check `receipt_pubkey` against the
+ * the same provenance caveat applies: check `receipt_pubkey` against the
  * DVM's attested `receipt_pubkey` for the outer link.
  */
 declare function verifyDrainReceipt(receipt: DrainReceipt): boolean;
 
 /**
- * Funding lots: the in-kind basis of a non-channel Bitcoin credit (internal-review).
- *
- * A reusable Bitcoin credit is a deposit, and internal-review decided the provider
- * owes back the **asset it received** rather than a dollar figure re-priced at
- * reclaim time: fund 1,151 sats, draw 1.2% of the credit's value, reclaim
- * 98.8% of 1,151 sats. That obligation is only expressible if each funding
- * event's `{sats_funded, credited_micro}` pair survives — the ledger's pooled
- * `credits.msats_remaining` blends every funding into one ratio, which answers
- * a different question (what share of the credit's rail value does *this draw*
- * consume) and cannot say what a top-up taken at a different rate is worth.
- *
- * Everything here is pure integer arithmetic over that pair, shared by the
- * Postgres and in-memory ledgers so the two cannot drift — the arrangement
- * `allocateDrawValue` already holds for the pooled basis.
- *
- * Since internal-review these lots are also what a *settling* draw is priced at on
- * these rails, not only a reclaim: `inKindDrawMsats` turns the depletion a
- * settle already performs into the draw's booked rail value, so one credit has
- * one answer to "what were these sats" and the pooled remainder stops being a
- * second authority: settled draw sats plus reclaim sats must equal the sats
- * that credit's funding lots received.
+ * Cashu and Lightning credits owe unused sats back at each deposit's funding
+ * rate. Keep the sats/micro basis per funding lot: a pooled ratio loses the
+ * basis of top-ups made at different rates. Settled draws and reclaims share
+ * these lots so their total equals the sats funded.
  */
 /**
  * The rails whose credits carry a Bitcoin deposit this ledger owes back in
@@ -1100,9 +985,7 @@ declare function verifyDrainReceipt(receipt: DrainReceipt): boolean;
  * {@link FundingMethod} must be a decision here rather than a default.
  */
 declare const NON_CHANNEL_BITCOIN_RAILS: readonly ["cashu", "lightning"];
-/** A rail whose unused credit is a sats deposit the provider owes back. */
 type NonChannelBitcoinRail = (typeof NON_CHANNEL_BITCOIN_RAILS)[number];
-/** True when `rail` funds a credit with sats the provider holds and owes back. */
 declare function isNonChannelBitcoinRail(rail: string | null | undefined): rail is NonChannelBitcoinRail;
 /**
  * One funding event's deposit: the sats that arrived and the credit micro they
@@ -1110,7 +993,7 @@ declare function isNonChannelBitcoinRail(rail: string | null | undefined): rail
  *
  * `remainingMicro` is depleted FIFO by settled draws and by reclaims, so the
  * sum of a credit's lots tracks `credits.balance_micro` exactly — with one
- * deliberate exception: an expiry release (internal-review) zeroes the balance and
+ * deliberate exception: an expiry release zeroes the balance and
  * leaves the lots standing, because a revival restores that balance and its
  * in-kind basis has to still be there. A released credit is excluded from the
  * sweep floor by `BITCOIN_CREDIT_PREDICATE`'s own `balance_micro > 0`, so the
@@ -1124,24 +1007,19 @@ interface FundingLot {
     satsFunded: number;
     /** Credit micro this funding bought — the lot's denominator, never depleted. */
     creditedMicro: number;
-    /** Credit micro of this lot not yet drawn or reclaimed. */
     remainingMicro: number;
     /** Rail settlement reference, provenance only. */
     fundingRef: string | null;
     createdAt: number;
 }
-/** One lot's share of a depletion, and what that share is worth in kind. */
 interface LotDebit {
     lotId: string;
-    /** Credit micro taken out of this lot. */
     micro: number;
-    /** Sats that micro is worth at this lot's own funding rate, floored. */
+    /** Decrease in this lot's floored sats obligation after taking the micro debit. */
     sats: number;
 }
-/** What a FIFO depletion took, and what it could not cover. */
 interface LotDepletion {
     debits: LotDebit[];
-    /** In-kind value of everything taken — the reclaim obligation. */
     satsOwed: number;
     /** Micro the lots could not cover. Non-zero means the credit's lots are short. */
     uncoveredMicro: number;
@@ -1149,32 +1027,15 @@ interface LotDepletion {
     backedMicro: number;
 }
 /**
- * Take `amountMicro` out of `lots`, oldest first, and price what was taken at
- * each lot's own rate.
- *
- * FIFO rather than pro rata across the pool, so a top-up taken at a different
- * rate is reclaimed at *that* rate once the earlier deposit is spent. A
- * fraction of a satoshi cannot be handed back, so the conversion floors and
- * the dust stays with the provider rather than being rounded into a payout the
- * deposit does not cover.
- *
- * A slice is priced as the **decrement in the lot's own obligation** —
- * `lotSats(before) - lotSats(after)` — rather than by flooring the slice on
- * its own. The two agree whenever a lot is taken whole, which is every
- * ordinary reclaim; they diverge once a lot is drawn down in pieces, and there
- * the independent floor loses up to a satoshi *per piece*, permanently. That
- * matters since internal-review, where each settling draw is priced through here: the
- * slices have to telescope, or a lot spent over many jobs pays out less than
- * it took in and the residue is exactly the unattributable one this was meant
- * to remove. It also makes {@link lotOwedSats} exact rather than conservative
- * — the remaining obligation is precisely what future depletions will pay.
- *
- * `lots` must already be in FIFO order ({@link fifoOrder}).
+ * Deplete lots in FIFO order, supplied by fifoOrder. Price each debit as
+ * lotSats(before) - lotSats(after), not the independently floored slice: small
+ * draws then telescope to the full deposit instead of losing up to one sat
+ * per draw. Fractional remaining sats stay with the provider.
  */
 declare function depleteLots(lots: FundingLot[], amountMicro: number): LotDepletion;
 /**
  * What a settling draw's fiat debit was worth in kind, in millisatoshis
- * (internal-review) — `null` where the lots cannot price it.
+ * `null` where the lots cannot price it.
  *
  * This is the single sats authority for a non-channel Bitcoin credit. The
  * settle already depletes the lots the draw consumed, so the figure costs no
@@ -1196,25 +1057,9 @@ declare function inKindDrawMsats(depletion: LotDepletion, amountMicro: number):
  */
 declare function lotOwedSats(lots: FundingLot[]): number;
 /**
- * Sats held back from every non-channel Bitcoin reclaim to pay for handing it
- * over (internal-review).
- *
- * Delivering a refund costs money whichever way it is fulfilled: an
- * accumulator swap pays the mint's per-input fee, and a just-in-time mint pays
- * the mint's quote plus whatever the Lightning hop routes for. internal-review puts
- * that cost on the caller — but charging *actual* fees would mean re-publishing
- * a smaller figure after the reclaim was already promised, and internal-review fixed
- * `owed_sats` at request time precisely so it cannot move between the promise
- * and the payout. A flat reserve keeps both: the caller is quoted one final
- * number, net, and the provider spends the reserve on delivery.
- *
- * It is deliberately a constant rather than a policy knob. The figure only has
- * to cover a small mint fee and one Lightning hop — the live hub's last hop
- * measured 1.1 sats on a 2,000-sat payment (internal-review) — so there is headroom
- * without a number anyone has to tune, and a knob nobody sets is a knob that
- * drifts. What the reserve does not cover on some future expensive route is
- * absorbed, and what it over-covers stays with the provider as dust, the same
- * rule the per-lot flooring already follows.
+ * Refund delivery uses a fixed eight-sat reserve so owed_sats cannot shrink
+ * after it is promised. Extra delivery cost is absorbed by the provider;
+ * unused reserve stays with the provider, like fractional-sat dust.
  */
 declare const DRAIN_DELIVERY_RESERVE_SATS = 8;
 /**
@@ -1237,59 +1082,50 @@ declare function netOwedSats(grossSats: number): number;
  */
 declare function fifoOrder(left: FundingLot, right: FundingLot): number;
 /**
- * Whether a depletion may be settled in kind, or has to fall back to pricing
- * the fiat balance at a live rate.
- *
- * Both failure modes are real and neither is the caller's fault: a credit's
- * lots can be short (a coverage hole the boot backfill is meant to close), and
- * a credit funded before internal-review recorded a rail basis at all has lots whose
- * `satsFunded` is 0 — pricing *that* in kind would answer "we owe you nothing"
- * for a deposit we plainly hold. Mixed coverage is treated as unbacked too:
- * blending a lot rate with a live rate produces a figure neither basis
- * supports.
+ * Missing lot coverage or a zero legacy sats basis requires pooled pricing.
+ * Mixed backed/unbacked lots also fall back: combining lot and live rates
+ * would claim a value neither basis supports.
  */
 declare function isInKindDepletion(depletion: LotDepletion, amountMicro: number): boolean;
 
 /** The rails a payout lands on. Lightning never pays out: credits fund straight into the receive wallet. */
 type PayoutRail = "cashu" | "x402" | "tempo";
 /**
- * What gathered the payments into one transfer: a cashu accumulator melt, an
- * x402 batch settle to `pay_to`, a Tempo channel's cooperative close, or a
- * Tempo channel's scheduled / manual settlement to the recipient.
+ * Transfers aggregate payments: a Cashu melt, x402 batch to pay_to, or Tempo recipient
+ * settlement/close.
  */
 type PayoutKind = "melt" | "batch" | "close" | "settle";
-/** Which repair verb completed a stuck movement. Only `tempo_close_reconciled` is produced here today. */
 type PayoutRepairKind = "x402_settlement_reconciled" | "lightning_invoice_reconciled" | "tempo_close_reconciled";
 /**
- * JSON wire shape POSTed to the platform's `/_internal/payout` endpoint —
- * one landed movement into the builder's custody. Idempotent platform-side
- * on `(dvmId, payoutId)`, so the durable retry loop can redeliver freely; a
- * `repaired` redelivery of an id that already landed upgrades that row rather
- * than adding a second.
+ * One landed movement into builder custody. Platform retries deduplicate by (dvmId,
+ * payoutId); repaired redelivery upgrades that movement rather than adding another.
  */
 interface PayoutReportPayload {
-    /** Required. Platform DVM record ID (`dvms.id`); must match the bearer token's DVM. */
+    /**
+     * Platform record ID; must match the bearer token’s DVM.
+     */
     dvmId: string;
     /** Required. The DVM's own id for the movement — `cashu:melt:<quote>`, `x402:batch:<uuid>`, `tempo:<tx>`. */
     payoutId: string;
     rail: PayoutRail;
     kind: PayoutKind;
-    /** Required. Rail-native atomic units: sats, or USDC micro. Always > 0. */
+    /**
+     * Positive rail-native atomic units: sats or USDC micro.
+     */
     nativeAmount: number;
-    /** Required. `sats` for cashu, `usdc` for the stablecoin rails. */
     nativeAsset: "sats" | "usdc";
     /** Where it landed; `null` for a melt, whose Lightning destination the platform never records. */
     recipient: string | null;
-    /** Mechanism references — mint, melt quote, tx hash, batch id, voucher count, channel id. Description material, never arithmetic. */
+    /**
+     * Descriptive mechanism references, never an arithmetic basis.
+     */
     refs: Record<string, unknown>;
     /** Required. When the money landed (epoch ms). */
     landedAt: number;
-    /** Set when a repair verb completed this movement. */
     repaired?: boolean;
     /** Required iff `repaired`. */
     repairKind?: PayoutRepairKind;
 }
-/** A stuck movement inside a pending snapshot. */
 interface PayoutWedge {
     id: string;
     /**
@@ -1309,17 +1145,14 @@ interface PayoutWedge {
     /** Rail-native amount held up, when known. */
     native?: number;
 }
-/** One pool inside a rail's pending figure — a mint, a batch, a channel. */
 interface PayoutPool {
     id: string;
     native: number;
     label?: string;
 }
 /**
- * JSON wire shape POSTed to the platform's `/_internal/payout-pending`
- * endpoint — one rail's snapshot of money still moving toward the builder,
- * replaced on each report. Best-effort: a lost one is superseded by the next
- * tick, so it rides no durable queue.
+ * A replaceable snapshot of one rail’s pending builder funds. Best-effort delivery uses no
+ * durable queue; a later tick supersedes a lost report.
  */
 interface PayoutPendingPayload {
     dvmId: string;
@@ -1327,14 +1160,12 @@ interface PayoutPendingPayload {
     /** Everything on this rail still moving toward the builder, in atomic units. */
     poolNative: number;
     nativeAsset: "sats" | "usdc";
-    /** How many pools the figure is made of. */
     items: number;
     pools: PayoutPool[];
     wedged: PayoutWedge[];
     /** This DVM's clock when the snapshot was taken (epoch ms). */
     snapshotAt: number;
 }
-/** The delivery seam — implemented by `RevenueReporter`, stubbed in tests. */
 interface PayoutTransport {
     /**
      * Queue a payout through the caller's open transaction, so the row and the
@@ -1351,19 +1182,13 @@ interface PayoutTransport {
     drainPending?(): Promise<void>;
 }
 /**
- * A money-path hook whose report must commit with the fact it describes.
- * `enqueue` runs inside the caller's transaction, and a throw rolls the fact
- * back with it — the drain report's own discipline (internal-review): a call the
- * caller has to repeat costs a round trip, where a landed movement with no
- * row understates paid-out forever. `committed` runs once that transaction
- * has committed, for the delivery and the snapshot that must not read
- * uncommitted state.
+ * enqueue joins the money transaction and must throw on failure so its fact rolls back.
+ * committed runs after commit, when delivery and snapshots can safely read the new state.
  */
 interface TransactionalPayoutHook<E> {
     enqueue(event: E, tx: RevenueReporterQuerier): Promise<void>;
     committed(): void;
 }
-/** What `/admin/cashu/mark-melted` knows once the rows are marked. */
 interface CashuMeltCompleted {
     rows: {
         id: string;
@@ -1373,7 +1198,6 @@ interface CashuMeltCompleted {
     meltQuoteId: string;
     paymentPreimage: string;
 }
-/** What mppx reports after a Tempo channel settlement or close confirmed on chain. */
 interface TempoSessionSettled {
     txHash: string;
     channelId: string;
@@ -1383,27 +1207,23 @@ interface TempoSessionSettled {
     /** Newly settled to the payee by this transaction, atomic units. */
     delta: bigint;
 }
-/** What `reconcile-tempo-drain` re-read from the close receipt it booked against. */
 interface TempoCloseReconciled {
     channelId: string;
     txHash: string;
     /** Captured by the payee — this DVM — per the receipt, atomic units as a decimal string. */
     settledToPayee: string;
 }
-/** The channel view the tracker sums claims over. */
 interface X402TrackedChannel {
     channelId: string;
     chargedCumulativeAmount: string;
     totalClaimed: string;
 }
-/** A refund settlement wedged between chain and ledger (internal-review), for the wedge list. */
 interface X402WedgedRefund {
     settlementId: string;
     /** Epoch ms the settlement was first prepared. */
     createdAt: number;
     native?: number;
 }
-/** What the batch-settlement server hands the tracker once it knows its scope. */
 interface X402PayoutContext {
     /** `${network}|${payTo}|${token}` — the scope the settle-pending marker is keyed on. */
     scope: string;
@@ -1416,7 +1236,6 @@ interface X402PayoutContext {
     settleIntervalMs: number;
     listWedgedRefunds?: () => Promise<X402WedgedRefund[]>;
 }
-/** The two manager verbs the tracker wraps. */
 interface X402TrackedManager {
     claim(...args: never[]): Promise<{
         vouchers: number;
@@ -1439,9 +1258,7 @@ interface X402PayoutObserver {
     /** A settle attempt that failed outside the tracked manager. One call per attempt a builder would count as one. */
     recordSettleFailure(error: unknown): Promise<void>;
 }
-/** The Tempo readers the host attaches after mounting. */
 interface TempoPayoutReader {
-    /** The recipient address every Tempo payout names. */
     recipient?: string;
     /** CAIP-2 network for the refs, when known. */
     network?: string;
@@ -1461,11 +1278,8 @@ interface TempoPayoutReader {
     }) => Promise<CreditDrainRecord[]>;
 }
 /**
- * The claims gathered since the last settle — the batch the next settle pays
- * out. Durable across machines because claims run under the fleet lock on
- * whichever machine won the tick, and the settle that finally moves the money
- * may run on another: an in-process figure would report a partial amount
- * after any restart in between.
+ * Claims accumulated since the last settle. The batch is durable across machines: claims and
+ * eventual settlement can run on different hosts under the fleet lock.
  */
 interface X402OpenBatch {
     scope: string;
@@ -1479,55 +1293,39 @@ interface X402OpenBatch {
     lastError: string | null;
     nextRetryAt: number | null;
 }
-/** Where the open batch lives — Postgres beside the settlement rows, or memory in dev. */
 interface X402BatchStore {
     get(scope: string): Promise<X402OpenBatch | undefined>;
     put(batch: X402OpenBatch): Promise<void>;
     delete(scope: string): Promise<void>;
     /**
-     * Close the open batch and run `enqueue` in the same transaction, so the
-     * payout row is queued exactly when the batch is gone and never otherwise:
-     * a settle can never lose its payout, because a failed enqueue leaves the
-     * batch open for the next settle to report in full. `false` when the batch
-     * under `scope` is no longer `batchId` — a sibling settled it first — in
-     * which case nothing is queued.
+     * Atomically delete the matching batch and enqueue its payout. Failed enqueue preserves the
+     * batch for retry; false means the scope no longer holds batchId and nothing was queued.
      */
     settle(scope: string, batchId: string, enqueue: (tx?: RevenueReporterQuerier) => Promise<void>): Promise<boolean>;
 }
-/** Construction options for {@link PayoutReporter}. */
 interface PayoutReporterOpts {
-    /** Platform DVM record ID, bound into every report. */
     dvmId: string;
     transport: PayoutTransport;
     /**
-     * The SDK's Postgres. Reads the cashu accumulator for the pending pool and
-     * holds the open x402 batch; without it the batch lives in memory (dev) and
-     * no cashu snapshot is taken.
+     * Postgres holds durable x402 batches and supplies Cashu snapshots. Without it, the default
+     * batch store is memory and Cashu snapshots are omitted.
      */
     db?: Pool;
     /**
-     * Whether this DVM runs the cashu accumulator. The cashu snapshot reads
-     * `wallet_accumulator`, which only that mode creates — on any other DVM the
-     * read would fail every tick and warn about a rail it does not carry.
+     * Only accumulator hosts create wallet_accumulator; enabling this on another host makes
+     * each snapshot query fail.
      */
     cashu?: boolean;
     /** Override the batch store (tests); defaults to Postgres on `db`, memory without. */
     batchStore?: X402BatchStore;
     /** Snapshot cadence, ms. Default 5 minutes. */
     snapshotIntervalMs?: number;
-    /** Override for the current time (tests). */
     now?: () => number;
 }
 /**
- * Builds the payout and pending reports from the SDK's money paths and hands
- * them to the transport.
- *
- * Two entry points are transactional: `cashuMelted` and `tempoCloseReconciled`
- * queue their row inside the caller's transaction and throw when they cannot,
- * so the melt or the reconciled close rolls back with its missing report rather
- * than landing without one. The x402 settle and the pending snapshots are
- * fail-safe instead: a report that cannot be built or queued there is logged and
- * picked up on the next tick, never thrown into the settle that produced it.
+ * Cashu melts and repaired Tempo closes enqueue inside their caller’s transaction and
+ * propagate failures. x402 reporting and pending snapshots instead log failures; failed x402
+ * enqueue preserves the open batch for retry.
  */
 declare class PayoutReporter implements PayoutTransport {
     private readonly dvmId;
@@ -1544,7 +1342,6 @@ declare class PayoutReporter implements PayoutTransport {
     private timer;
     private warmup;
     constructor(opts: PayoutReporterOpts);
-    /** Boot DDL for the durable batch store, when this reporter owns one. */
     init(): Promise<void>;
     /**
      * Start the snapshot loop. Unref'd, so it never keeps a scale-to-zero
@@ -1558,23 +1355,13 @@ declare class PayoutReporter implements PayoutTransport {
     reportPayoutPending(payload: PayoutPendingPayload): Promise<void>;
     /** Deliver what is queued now; a transport without the seam waits for its retry loop. */
     flush(): Promise<void>;
-    /** The hook `mark-melted` runs inside its transaction: the mark and its payout commit together. */
     meltHook(): TransactionalPayoutHook<CashuMeltCompleted>;
     /**
-     * A melt completed: the accumulator rows are SPENT at the mint and the
-     * Lightning payment reached the builder's destination. One payout per mint
-     * in the call — a `mark-melted` normally names one, since a melt quote
-     * belongs to one mint. The amount is the face value melted; the mint's fee
-     * and the Lightning amount received are builder-machine facts this DVM does
-     * not see.
-     *
-     * Queued through `tx` when the caller is inside the transaction that marks
-     * the rows, and a failure is thrown rather than swallowed so that mark rolls
-     * back with it — see {@link TransactionalPayoutHook}. Without `tx` the rows
-     * are queued on their own and delivered at once.
+     * Report melted face value per mint, not the Lightning amount received after fees. Hash the
+     * payment preimage; do not publish it. With tx, propagate enqueue failures and defer
+     * delivery until commit. Without tx, enqueue independently and start delivery.
      */
     cashuMelted(event: CashuMeltCompleted, tx?: RevenueReporterQuerier): Promise<void>;
-    /** The host attaches the session store and ledger readers once they exist. */
     attachTempo(reader: TempoPayoutReader): void;
     /**
      * A Tempo channel settled or closed on chain. `delta` is what this
@@ -1582,29 +1369,18 @@ declare class PayoutReporter implements PayoutTransport {
      * (a close of a fully settled channel) is no payout.
      */
     tempoSettled(event: TempoSessionSettled): Promise<void>;
-    /** The hook `reconcile-tempo-drain` runs inside its transaction: the booking and its payout commit together. */
     tempoRepairHook(): TransactionalPayoutHook<TempoCloseReconciled>;
     /**
-     * The operator repaired a wedged cooperative close (internal-review). The close's
-     * payee side landed on chain when the close did; if the live hook reported
-     * it, this upgrades that row to `repair`, otherwise it is the row. The
-     * figure is the receipt's payee total for the channel.
-     *
-     * Queued through `tx` when the caller is inside the transaction that books
-     * the drain, and thrown rather than swallowed so that booking rolls back
-     * with it — see {@link TransactionalPayoutHook}.
+     * Report the receipt’s payee total under the live close’s transaction ID, flagged repaired.
+     * The platform upgrades a live row if one exists. Join tx and propagate enqueue failures;
+     * this does not report the caller refund.
      */
     tempoCloseReconciled(event: TempoCloseReconciled, tx?: RevenueReporterQuerier): Promise<void>;
-    /** The observer the batch-settlement server attaches to and routes its manager through. */
     x402Observer(): X402PayoutObserver;
     /**
-     * Wrap the upstream channel manager so every claim grows the open batch and
-     * every settle closes it. The claim delta is read off storage rather than
-     * off upstream's result, which carries only a voucher count; under the
-     * fleet lock the before/after read is consistent. A channel the claim
-     * removed on its way through — a refund's claim-then-delete (internal-review) —
-     * moved whatever it still owed before it went, and that value reaches
-     * `pay_to` in this batch too, so it counts at its pre-claim figure.
+     * Read claim deltas from storage because upstream returns voucher counts. Under the fleet
+     * lock, before/after reads are consistent. A deleted channel contributes its pre-claim
+     * unclaimed value, including refund claim-then-delete.
      */
     private trackX402Manager;
     private recordX402Claim;
@@ -1627,7 +1403,7 @@ declare class PayoutReporter implements PayoutTransport {
     /**
      * Tempo: each active channel's spent-but-unsettled balance — earned, not
      * yet paid to the recipient — and the cooperative closes wedged between
-     * chain and ledger (internal-review), aged past the same floor the repair queue
+     * chain and ledger, aged past the same floor the repair queue
      * uses so an in-flight close is not reported as stuck.
      */
     snapshotTempo(): Promise<void>;
@@ -1636,65 +1412,57 @@ declare class PayoutReporter implements PayoutTransport {
 /**
  * JSON wire shape POSTed to the platform's `/_internal/job-revenue` endpoint
  * and stored in `pending_dvm_reports.payload` for durable retry.
- *
- * The platform-side consumer is `OnJobCompleted`, implemented by
- * `createRevenueCallback`. Keep the two shapes in sync: the SDK and platform
- * deploy in lockstep, and any
- * backwards-incompatible field change requires a coordinated release. No `version`
- * field is included pre-launch because there are no external container-runtime
- * consumers yet; add one once the first third-party builder ships a container-runtime
- * DVM (trigger condition: external builder onboarded via `dvmctl deploy --container`).
  */
 interface RevenueReportPayload {
-    /** Required. Platform DVM record ID (`dvms.id`). Identifies which DVM earned the revenue. */
+    /** Platform DVM record ID (`dvms.id`). Identifies which DVM earned the revenue. */
     dvmId: string;
-    /** Required. Job identifier used by the platform to de-duplicate revenue rows and link to the job record. */
+    /** Job identifier used by the platform to de-duplicate revenue rows and link to the job record. */
     jobId: string;
     /**
-     * Optional. Capability selected by dispatch for this job. Omitted for
+     * Capability selected by dispatch for this job. Omitted for
      * reports from older SDKs and legacy persisted jobs that predate capability
      * dispatch; absence must not be rewritten as a capability name.
      */
     capability?: string;
-    /** Required. Total amount paid by the caller in millisatoshis, across all credits that satisfied the job. */
+    /** Total amount paid by the caller in millisatoshis, across all credits that satisfied the job. */
     paidMsats: number;
-    /** Optional. Cashu mint URL from which the payment tokens were issued. Set only for the `cashu` rail; omitted for all other rails. */
+    /** Cashu mint URL from which the payment tokens were issued. Set only for the `cashu` rail; omitted for all other rails. */
     paymentMint?: string;
     /**
-     * Required. Payment rail identifier (`"cashu"`, `"tempo"`, `"x402"`, `"stripe"`).
+     * Payment rail identifier (`"cashu"`, `"tempo"`, `"x402"`, `"stripe"`).
      * Mirrors `PaymentMethod` on the platform; carried as a plain string over the wire
      * so the SDK has no platform-type dependency.
      */
     rail: string;
     /**
-     * Optional. Settlement reference for the credit: EVM tx hash for `x402`, credential
+     * Settlement reference for the credit: EVM tx hash for `x402`, credential
      * challenge ID for `tempo`, `X-Cashu-Request-Id` UUID for `cashu`. Required by the
      * platform revenue ledger for `tempo`/`x402` rails (recordJobRevenue throws without it);
      * nullable for `cashu`.
      */
     paymentTxHash?: string;
     /**
-     * Optional. Rail-native payment amount in atomic units: satoshis for `tempo`, USDC
-     * microunits for `x402`, USD cents for `stripe`. Omitted for `cashu` (platform derives
+     * Rail-native payment amount in atomic units: USDC microunits for `tempo` and
+     * `x402`, USD cents for `stripe`. Omitted for `cashu` (platform derives
      * `paidMsats / 1000`). Must be set together with `nativeAsset`.
      */
     nativeAmount?: number;
     /**
-     * Optional. Asset tag paired with `nativeAmount`: `"sats"`, `"usdc"`, `"usdc.e"`, or
+     * Asset tag paired with `nativeAmount`: `"sats"`, `"usdc"`, `"usdc.e"`, or
      * `"usd-cents"`. Both fields must be present for the platform to write a non-cashu
      * revenue row.
      */
     nativeAsset?: string;
     /**
-     * Optional. Cashu flow discriminator. Set to `"p2pk_accumulator"` when the cashu
-     * accumulator path (internal-review) satisfied the job; omitted for legacy cashu. Written into
+     * Cashu flow discriminator. Set to `"p2pk_accumulator"` when the cashu
+     * accumulator path satisfied the job; omitted for legacy cashu. Written into
      * `revenue_events.metadata.cashu_flow` by the platform so ops can split per-call cashu
      * rows by source.
      */
     cashuFlow?: string;
     /**
-     * Optional. What the job cost the **builder** to serve, as declared by the
-     * handler through `ctx.cost()` (internal-review) — the other half of the
+     * What the job cost the **builder** to serve, as declared by the
+     * handler through `ctx.cost()` — the other half of the
      * margin the dashboard states. `amountMicro` is 1e-6 of `currency`, which
      * is the currency the builder incurred the cost in and need not be the
      * credit's.
@@ -1715,37 +1483,50 @@ interface RevenueReportPayload {
         currency: string;
     };
     /**
-     * Optional. Credit this job's payment drew against (internal-review). Present on
+     * Credit this job's payment drew against. Present on
      * every job a ledger-backed payment satisfied; its presence is what tells
      * the platform the row is a **draw-keyed** revenue event rather than a
      * pre-credits per-call one.
      */
     creditId?: string;
-    /** Optional. The draw this job settled — one draw, one revenue row. */
+    /** The draw this job settled — one draw, one revenue row. */
     drawId?: string;
-    /** Optional. The draw's fiat amount, 1e-6 of `creditCurrency`. The exact liability offset. */
+    /** The draw's fiat amount, 1e-6 of `creditCurrency`. The exact liability offset. */
     drawAmountMicro?: number;
-    /** Optional. Currency the credit is denominated in (lowercase ISO, e.g. `usd`). */
+    /** Currency the credit is denominated in (lowercase ISO, e.g. `usd`). */
     creditCurrency?: string;
     /**
-     * Optional. Settlement instant (epoch ms) — draws are revenue *when they
+     * Settlement instant (epoch ms) — draws are revenue *when they
      * settle*, so this dates the row. Omitted for pre-credits rows, which the
      * platform dates at record time as before.
      */
     settledAt?: number;
-    /** Optional. The funding's own rail reference, for reconciling a draw back to its deposit. */
+    /** The funding's own rail reference, for reconciling a draw back to its deposit. */
     fundingRef?: string;
     /**
-     * Optional. Revenue class when this row is not ordinary service revenue.
+     * Revenue class when this row is not ordinary service revenue.
      * `short_pay_forfeit` marks money kept from an underpayment that bought no
-     * job (internal-review operator ruling) so analytics can exclude it.
+     * job so analytics can exclude it.
      */
     kind?: string;
 }
+/** Privacy-preserving terminal evidence; contains no caller or payment references. */
+interface JobTerminalReportPayload {
+    dvmId: string;
+    jobId: string;
+    capability: string;
+    outcome: "completed" | "failed" | "cancelled";
+    endedBy: "caller" | "provider" | null;
+    paid: boolean;
+    acceptedAtMs: number;
+    terminalAtMs: number;
+    callerWaitMs: number;
+    receiptSeq: number | null;
+}
 /**
  * JSON wire shape POSTed to the platform's `/_internal/job-cost` endpoint
  * when a terminal job incurred a declared builder cost but produced no
- * revenue report (internal-review).
+ * revenue report.
  *
  * Unlike {@link RevenueReportPayload}, this event has no payment rail or
  * revenue amount: a failed, cancelled, or free job is not a sale. The
@@ -1756,16 +1537,16 @@ interface RevenueReportPayload {
  * delivery order.
  */
 interface JobCostReportPayload {
-    /** Required. Platform DVM record ID (`dvms.id`); bound to the authenticating token. */
+    /** Platform DVM record ID (`dvms.id`); bound to the authenticating token. */
     dvmId: string;
-    /** Required. Job identifier and the report's platform-side idempotency key. */
+    /** Job identifier and the report's platform-side idempotency key. */
     jobId: string;
-    /** Optional. Capability selected by dispatch; absent only on legacy persisted jobs. */
+    /** Capability selected by dispatch; absent only on legacy persisted jobs. */
     capability?: string;
-    /** Required. Terminal outcome that explains why this event carries no revenue. */
+    /** Terminal outcome that explains why this event carries no revenue. */
     outcome: "completed" | "failed" | "cancelled";
     /**
-     * Required. Number of declarations incorporated into `cost`; the
+     * Number of declarations incorporated into `cost`; the
      * platform keeps the payload with the highest revision for this job.
      */
     costRevision: number;
@@ -1781,45 +1562,44 @@ interface JobCostReportPayload {
 }
 /**
  * JSON wire shape POSTed to the platform's `/_internal/credit-deposit`
- * endpoint (internal-review). A funding event is a **deposit** — a liability until
- * drawn — reported separately and never summed into revenue (spec §10).
+ * endpoint. A funding event is a **deposit** — a liability until
+ * drawn — reported separately and never summed into revenue (the deposit-accounting rule).
  *
  * Idempotent on `(dvmId, creditId, fundingId)`, so the shared retry loop can
  * redeliver freely.
  */
 interface CreditDepositPayload {
-    /** Required. Platform DVM record ID (`dvms.id`); must match the bearer token's DVM. */
+    /** Platform DVM record ID (`dvms.id`); must match the bearer token's DVM. */
     dvmId: string;
-    /** Required. Credit the funding landed on. */
     creditId: string;
-    /** Required. Canonical owner of the funded credit. */
+    /** Canonical owner of the funded credit. */
     callerPubkey: string;
-    /** Required. The rail's settlement reference — the deposit's idempotency key. */
+    /** The rail's settlement reference — the deposit's idempotency key. */
     fundingId: string;
-    /** Required. Payment rail (`"cashu"`, `"tempo"`, `"x402"`). */
+    /** Payment rail (`"cashu"`, `"tempo"`, `"x402"`). */
     rail: string;
-    /** Required. Rail value received, in millisatoshis. */
+    /** Rail value received, in millisatoshis. */
     paidMsats: number;
     /** Cashu only. Full received proof face before its receiver input fee. */
     grossPaidMsats?: number;
     /** Cashu only. Standalone NUT-02 fee reserved by the received proofs. */
     cashuInputFeeMsats?: number;
-    /** Optional. Rail-native atomic units; omitted for cashu (derived from `paidMsats`). */
+    /** Rail-native atomic units; omitted for cashu (derived from `paidMsats`). */
     nativeAmount?: number;
-    /** Optional. Asset tag paired with `nativeAmount`. */
+    /** Asset tag paired with `nativeAmount`. */
     nativeAsset?: string;
-    /** Optional. Cashu mint URL the funding proofs were issued from. */
+    /** Cashu mint URL the funding proofs were issued from. */
     paymentMint?: string;
-    /** Required. Fiat micro credited to the ledger — the liability this deposit creates. */
+    /** Fiat micro credited to the ledger — the liability this deposit creates. */
     amountMicro: number;
-    /** Required. Currency `amountMicro` is 1e-6 of. */
+    /** Currency `amountMicro` is 1e-6 of. */
     creditCurrency: string;
-    /** Required. When the funding committed (epoch ms). */
+    /** When the funding committed (epoch ms). */
     fundedAt: number;
-    /** Required. Current credit expiry after this funding committed (epoch ms). */
+    /** Current credit expiry after this funding committed (epoch ms). */
     expiryMs: number;
     /**
-     * Tempo session funding only (internal-review): the TIP-1034 channel this deposit
+     * Tempo session funding only: the TIP-1034 channel this deposit
      * arrived on, registered so the platform's close observer can route a
      * `CloseRequested` event back to the DVM that owns the channel.
      *
@@ -1841,14 +1621,14 @@ interface CreditDepositPayload {
         payee?: string;
     };
     /**
-     * Tempo session funding only (internal-review): which channel this deposit's voucher
+     * Tempo session funding only: which channel this deposit's voucher
      * was accepted on, emitted **whenever the funding was session-based** —
      * independently of whether {@link CreditDepositPayload.tempoChannel} could be
      * read. That independence is the entire point: `rail: "tempo"` covers both
      * `tempo/session` and the `tempo/charge` one-shot, and a charge legitimately
      * carries no channel at all, so without this the platform cannot tell a
      * routine charge deposit from a session whose chain binding was lost — the
-     * internal-review shape, where the close observer silently never watches the escrow.
+     * shape, where the close observer silently never watches the escrow.
      *
      * Carries only the channel id, not the chain binding: a DVM that could read
      * the binding sends `tempoChannel` too, and one that could not still names
@@ -1859,7 +1639,7 @@ interface CreditDepositPayload {
         channelId: string;
     };
     /**
-     * Set by the blocked-invoice repair (internal-review): this deposit is a paid
+     * Set by the blocked-invoice repair: this deposit is a paid
      * Lightning invoice the builder's agent reconciled onto a credit. The money
      * landed in the receive wallet at payment time and this deposit is the one
      * row it gets, so the settlements table types it `repair` off this flag
@@ -1869,7 +1649,7 @@ interface CreditDepositPayload {
 }
 /**
  * JSON wire shape POSTed to the platform's `/_internal/credit-draw-release`
- * endpoint (internal-review). A released hold leaves the credit balance intact, but
+ * endpoint. A released hold leaves the credit balance intact, but
  * marks that slice of the outstanding liability as failure churn rather than
  * untouched prefunding.
  *
@@ -1877,62 +1657,45 @@ interface CreditDepositPayload {
  * redeliver freely.
  */
 interface CreditDrawReleasePayload {
-    /** Required. Platform DVM record ID (`dvms.id`); must match the bearer token's DVM. */
+    /** Platform DVM record ID (`dvms.id`); must match the bearer token's DVM. */
     dvmId: string;
-    /** Required. Credit whose hold was released. */
     creditId: string;
-    /** Required. Released draw; the platform idempotency key with DVM and credit. */
+    /** Released draw; the platform idempotency key with DVM and credit. */
     drawId: string;
-    /** Required. Fiat micro restored to availability. */
+    /** Fiat micro restored to availability. */
     amountMicro: number;
-    /** Required. Currency `amountMicro` is 1e-6 of. */
+    /** Currency `amountMicro` is 1e-6 of. */
     creditCurrency: string;
-    /** Required. Per-credit gap-free sequence assigned when the draw was placed. */
+    /** Per-credit gap-free sequence assigned when the draw was placed. */
     ledgerSeq: number;
-    /** Required. When the hold reached `released` (epoch ms). */
+    /** When the hold reached `released` (epoch ms). */
     releasedAt: number;
 }
-/** Repair verbs that can finish a caller-facing credit reclaim. */
 type CreditDrainRepairKind = "x402_settlement_reconciled" | "tempo_close_reconciled";
 /**
- * JSON wire shape POSTed to the platform's `/_internal/credit-drain`
- * endpoint (internal-review). A drain is a **reclaim**: deposited money paid back to
- * the caller, which extinguishes the liability the funding created. Reported
- * so outstanding liability nets out to `deposited − drawn − drained`; never
- * summed into revenue, and never a revenue row — no job was sold.
- *
- * Reported only on the drain's **terminal** transition (`picked_up` for cashu,
- * `sent` for the other rails), because that is where the money has verifiably
- * left. `requested` and `parked` have not paid the caller yet.
- *
- * Idempotent on `(dvmId, creditId, drainId)`, so the shared retry loop can
- * redeliver freely.
- *
- * Fiat micro only, with no `paidMsats` sibling: `credit_drains` holds no rail
- * value (the sats figure is derived at read time from a live rate), so there
- * would be nothing truthful to put in one — and the liability arithmetic this
- * feeds is exact fiat micro on all three of its terms.
+ * Terminal picked_up/sent drains report reclaimed fiat micro-units, reducing
+ * outstanding liability rather than adding revenue. Requested or parked drains
+ * have not paid the caller. Idempotency key: (dvmId, creditId, drainId).
  */
 interface CreditDrainPayload {
-    /** Required. Platform DVM record ID (`dvms.id`); must match the bearer token's DVM. */
+    /** Platform DVM record ID (`dvms.id`); must match the bearer token's DVM. */
     dvmId: string;
-    /** Required. Credit the reclaim came off. */
     creditId: string;
-    /** Required. Canonical owner of the reclaimed credit. */
+    /** Canonical owner of the reclaimed credit. */
     callerPubkey: string;
-    /** Required. The drain's own idempotency key. */
+    /** The drain's own idempotency key. */
     drainId: string;
-    /** Required. Payout rail the reclaim shipped on (`"cashu"`, `"x402"`, `"tempo"`). */
+    /** Payout rail (`"cashu"`, `"x402"`, `"tempo"`). */
     method: string;
-    /** Required. Fiat micro reclaimed — the liability this drain extinguishes. */
+    /** Fiat micro reclaimed — the liability this drain extinguishes. */
     amountMicro: number;
-    /** Required. Currency `amountMicro` is 1e-6 of. */
+    /** Currency `amountMicro` is 1e-6 of. */
     creditCurrency: string;
-    /** Required. Terminal state reached: `"picked_up"` (cashu) or `"sent"` (other rails). */
+    /** Terminal state: `"picked_up"` for cashu, `"sent"` for other rails. */
     status: string;
-    /** Required. When the money left (epoch ms). */
+    /** When the money left (epoch ms). */
     drainedAt: number;
-    /** Optional. Per-credit gap-free ledger sequence, for reconciling against the DVM's ledger. */
+    /** Per-credit gap-free ledger sequence, for reconciling against the DVM's ledger. */
     ledgerSeq?: number;
     /** Set when an operator repair verb completed this reclaim. */
     repaired?: boolean;
@@ -1957,7 +1720,7 @@ type CreditDepositEnqueue = (tx: RevenueReporterQuerier, payload: CreditDepositP
 type CreditDrawReleaseEnqueue = (tx: RevenueReporterQuerier, payload: CreditDrawReleasePayload) => Promise<void>;
 /**
  * Transactional drain-outbox seam threaded through each terminal drain
- * transition (internal-review).
+ * transition.
  *
  * Implemented by {@link RevenueReporter.enqueueCreditDrain}; callers must await
  * it before committing the status CAS that moved the money.
@@ -1965,7 +1728,7 @@ type CreditDrawReleaseEnqueue = (tx: RevenueReporterQuerier, payload: CreditDraw
 type CreditDrainEnqueue = (tx: RevenueReporterQuerier, payload: CreditDrainPayload) => Promise<void>;
 /**
  * JSON wire shape POSTed to the platform's `/_internal/credit-expiry-release`
- * endpoint (internal-review). A prepaid credit that reaches its TTL with an undrawn
+ * endpoint. A prepaid credit that reaches its TTL with an undrawn
  * remainder RELEASES that remainder to the builder: on cashu, Lightning and
  * x402 the funding value reached builder custody at funding time or on the
  * settlement cycle, so expiry extinguishes the caller's remaining claim.
@@ -1981,39 +1744,37 @@ type CreditDrainEnqueue = (tx: RevenueReporterQuerier, payload: CreditDrainPaylo
  *
  * - **The release**, written by the expiry sweep with `reversedAt` absent.
  * - **The reversal**, written when a later funding revives the credit
- *   (`CreditLedger.fund` overwrites `expiry_ms`, so the recorded remainder is
- *   no longer final). It repeats the whole payload rather than sending a
- *   reference, because the retry loop can deliver the two out of order and the
- *   platform's upsert must be able to land either one first.
+ * (`CreditLedger.fund` overwrites `expiry_ms`, so the recorded remainder is
+ * no longer final). It repeats the whole payload rather than sending a
+ * reference, because the retry loop can deliver the two out of order and the
+ * platform's upsert must be able to land either one first.
  *
  * Idempotent on `(dvmId, creditId, releaseId)`, so the shared retry loop can
  * redeliver freely.
  */
 interface CreditExpiryReleasePayload {
-    /** Required. Platform DVM record ID (`dvms.id`); must match the bearer token's DVM. */
+    /** Platform DVM record ID (`dvms.id`); must match the bearer token's DVM. */
     dvmId: string;
-    /** Required. Credit whose remainder expired. */
     creditId: string;
-    /** Required. Per-expiry-episode key; the platform idempotency key with DVM and credit. */
+    /** Per-expiry-episode key; the platform idempotency key with DVM and credit. */
     releaseId: string;
-    /** Required. Caller whose claim on the remainder ended. */
     callerPubkey: string;
     /** Funding rail. `null` on a credit funded before the basis became mandatory. */
     rail: string | null;
-    /** Required. Fiat micro released — the liability this expiry extinguishes. */
+    /** Fiat micro released — the liability this expiry extinguishes. */
     amountMicro: number;
-    /** Required. Currency `amountMicro` is 1e-6 of. */
+    /** Currency `amountMicro` is 1e-6 of. */
     creditCurrency: string;
-    /** Required. When the credit's TTL ran out (epoch ms) — when the liability ended. */
+    /** When the credit's TTL ran out (epoch ms) — when the liability ended. */
     expiryMs: number;
-    /** Required. When the sweep observed the expiry (epoch ms). */
+    /** When the sweep observed the expiry (epoch ms). */
     releasedAt: number;
     /** Set only on the reversal report: when the revival funding landed (epoch ms). */
     reversedAt?: number | null;
 }
 /**
  * Transactional expiry-release outbox seam, threaded through the sweep's insert
- * and through the funding that reverses a release (internal-review).
+ * and through the funding that reverses a release.
  *
  * Implemented by {@link RevenueReporter.enqueueCreditExpiryRelease}; callers
  * must await it before committing the write that made the release (or its
@@ -2023,7 +1784,7 @@ interface CreditExpiryReleasePayload {
 type CreditExpiryReleaseEnqueue = (tx: RevenueReporterQuerier, payload: CreditExpiryReleasePayload) => Promise<void>;
 /**
  * JSON wire shape POSTed to the platform's `/_internal/paid-job-death` endpoint
- * (internal-review) when the stale-job reaper force-fails a *paid* job — its pending
+ * when the stale-job reaper force-fails a *paid* job — its pending
  * credit draw is released rather than settled, so the caller's payment is back
  * on their credit balance and reclaimable by drain. The platform resolves fiat
  * + owner and sends an ambient notice via the shared alert sink. Unlike
@@ -2032,52 +1793,45 @@ type CreditExpiryReleaseEnqueue = (tx: RevenueReporterQuerier, payload: CreditEx
  * report degrades to log-only rather than blocking the sweep.
  */
 interface PaidJobDeathPayload {
-    /** Required. Platform DVM record ID (`dvms.id`). Bound to the authenticating token. */
+    /** Platform DVM record ID (`dvms.id`). Bound to the authenticating token. */
     dvmId: string;
-    /** Required. Job identifier the reaper force-failed. */
     jobId: string;
-    /** Required. Capability the job dispatched to (e.g. `"add-episode"`). */
     capability: string;
-    /** Required. Amount of the released credit draw in millisatoshis. */
+    /** Amount of the released credit draw in millisatoshis. */
     paidMsats: number;
-    /** Required. Payment rail of the credit draw (`"cashu"` / `"tempo"` / `"x402"`). */
+    /** Payment rail of the released draw (`"cashu"`, `"tempo"`, `"x402"`). */
     rail: string;
-    /** Required. Terminal reason the reaper set: dead worker vs never-terminal idle. */
+    /** Reaper reason: dead worker or never-terminal idle job. */
     reason: string;
-    /** Optional. Rail-native released amount, paired with `nativeAsset`. */
+    /** Rail-native released amount, paired with `nativeAsset`. */
     nativeAmount?: number;
-    /** Optional. Asset tag for `nativeAmount` (`"sats"` / `"usdc"` / …). */
+    /** Asset tag for `nativeAmount` (`"sats"` / `"usdc"` / …). */
     nativeAsset?: string;
-    /** Optional. Cashu mint URL the credit draw's tokens were issued from. */
+    /** Cashu mint URL the credit draw's tokens were issued from. */
     paymentMint?: string;
 }
-/** Distinct causes for a settled credit draw that could not book revenue. */
 type RevenueSkippedNoRailReason = "credit_rail_null" | "credit_rail_unrecognized" | "job_rail_missing" | "ledger_not_configured";
 /**
  * JSON wire shape POSTed to the platform's `/_internal/revenue-skipped-no-rail`
- * endpoint (internal-review) when a settled credit draw has no usable payment rail
+ * endpoint when a settled credit draw has no usable payment rail
  * for its revenue event. This is an operator notice rather than a durable
  * accounting report: the SDK's structured log remains the durable backstop,
  * and a failed alert must never block terminal handling or reconciliation.
  */
 interface RevenueSkippedNoRailPayload {
-    /** Required. Platform DVM record ID (`dvms.id`). Bound to the authenticating token. */
+    /** Platform DVM record ID (`dvms.id`). Bound to the authenticating token. */
     dvmId: string;
-    /** Required. Job whose settled draw could not be booked. */
     jobId: string;
-    /** Required. Credit carrying the settled draw. */
     creditId: string;
-    /** Required. Settled draw that has no revenue event. */
     drawId: string;
-    /** Required. Caller payment captured for the job, in millisatoshis. */
+    /** Caller payment captured for the job, in millisatoshis. */
     paidMsats: number;
-    /** Optional. Settled draw amount in 1e-6 of `creditCurrency`. */
+    /** Settled draw amount in 1e-6 of `creditCurrency`. */
     drawAmountMicro?: number;
-    /** Optional. Currency the draw amount is denominated in. */
+    /** Currency the draw amount is denominated in. */
     creditCurrency?: string;
     /** Credit funding rail as stored on the draw, or null for legacy rows. */
     creditRail: string | null;
-    /** Required classification of why the revenue rail was unavailable. */
     reason: RevenueSkippedNoRailReason;
 }
 /** Gas-balance observation POSTed by a platform-hosted x402 self-relay. */
@@ -2147,11 +1901,13 @@ interface TempoSettlementFailurePayload {
     drainId?: string;
 }
 /**
- * Durable revenue reporter for container-runtime DVMs (internal-review).
+ * Durable revenue reporter for container-runtime DVMs.
  *
  * On job completion the SDK calls `report()`, which persists the payload to
  * a local Postgres table and attempts an immediate POST to the platform.
  * A background retry loop picks up un-acked rows with exponential backoff.
+ * Gauge and health notifications are best-effort: failed delivery is logged
+ * and dropped rather than queued for retry.
  */
 declare class RevenueReporter {
     private readonly db;
@@ -2164,16 +1920,17 @@ declare class RevenueReporter {
     constructor(db: Pool, platformUrl: string, platformToken: string);
     /** Create the pending-reports table and migrate the legacy SDK outbox (idempotent). */
     init(): Promise<void>;
-    /** The boot DDL itself — always runs under {@link withSdkInitLock} (internal-review). */
     private createTables;
-    /** Copy rows from the old SDK-owned table without touching the platform's table of that name. */
     private migrateLegacySdkOutbox;
-    /** Refuse a pre-existing relation whose columns cannot safely serve as the SDK outbox. */
     private assertSdkTableShape;
     private assertSdkColumns;
     private tableColumns;
     /** Persist a revenue report and attempt immediate delivery. */
     report(payload: RevenueReportPayload): Promise<void>;
+    /** The permanent deduplication claim and outbox insert commit together.
+     * The claim survives successful delivery, including for custom job stores.
+     */
+    reportTerminal(payload: JobTerminalReportPayload): Promise<void>;
     /** Persist a zero-revenue job cost and attempt immediate delivery. */
     reportCost(payload: JobCostReportPayload): Promise<void>;
     /**
@@ -2187,21 +1944,13 @@ declare class RevenueReporter {
     /** Join a released draw to the transaction that made the hold terminal. */
     enqueueCreditDrawRelease(tx: RevenueReporterQuerier, payload: CreditDrawReleasePayload): Promise<void>;
     /**
-     * Join a credit drain to the transaction that made it terminal (internal-review).
-     *
-     * Same discipline as {@link enqueueDeposit} and the same reason: no network
-     * I/O here, only the durable queue row, written through `tx` so the report
-     * and the status CAS commit or roll back together. A drain whose row was
-     * lost between the two would overstate outstanding liability forever —
-     * the mirror image of a lost deposit.
-     *
-     * Named for the payload rather than the verb because `drain` already means
-     * "flush the queue" in this class (see {@link drainPending}).
+     * Await durable queue insertion through tx so the terminal drain and its
+     * report commit or roll back together; no network I/O here.
      */
     enqueueCreditDrain(tx: RevenueReporterQuerier, payload: CreditDrainPayload): Promise<void>;
     /**
      * Join a payout to the transaction that commits the movement it reports
-     * (internal-review) — the batch close, the accumulator mark, the drain booking.
+     * the batch close, the accumulator mark, the drain booking.
      * No network I/O, only the durable queue row through `tx`, the discipline
      * {@link enqueueCreditDrain} set and for the same reason: the money has
      * already moved on a rail this ledger does not own, so the platform row is
@@ -2219,25 +1968,19 @@ declare class RevenueReporter {
      */
     reportPayout(payload: PayoutReportPayload): Promise<void>;
     /**
-     * Report one rail's pending-pool snapshot (internal-review). Best-effort and
+     * Report one rail's pending-pool snapshot. Best-effort and
      * fire-and-forget, deliberately unlike {@link reportPayout}: a snapshot is
      * replaced by the next tick, so queueing a stale one behind an outage would
      * only deliver figures the platform already has newer ones for.
      */
     reportPayoutPending(payload: PayoutPendingPayload): Promise<void>;
     /**
-     * Join a credit-expiry release — or the revival that reverses one — to the
-     * transaction that made it true (internal-review).
-     *
-     * Same discipline as {@link enqueueCreditDrain}: no network I/O, only the
-     * durable queue row written through `tx`. A release whose row was lost after
-     * the sweep committed would understate committed value forever; a lost
-     * reversal would overstate it, which is the worse direction — the builder
-     * would see money as theirs that a revived credit can still buy work with.
+     * Await durable queue insertion through tx so expiry release or reversal and
+     * its report commit together. A missing reversal would overstate builder value.
      */
     enqueueCreditExpiryRelease(tx: RevenueReporterQuerier, payload: CreditExpiryReleasePayload): Promise<void>;
     /**
-     * Report a reaper-force-failed paid job to the platform (internal-review) so the
+     * Report a reaper-force-failed paid job to the platform so the
      * operator receives an ambient notice that a DVM died or wedged mid-job.
      * Best-effort and fire-and-forget: unlike {@link report} there is no local
      * durable queue — a non-2xx or transport failure is structured-logged
@@ -2247,24 +1990,18 @@ declare class RevenueReporter {
      */
     reportPaidJobDeath(payload: PaidJobDeathPayload): Promise<void>;
     /**
-     * Report a settled draw whose revenue event was skipped (internal-review).
+     * Report a settled draw whose revenue event was skipped.
      * Best-effort and fire-and-forget: the SDK's structured
      * `revenue_skipped_no_rail` log is the durable backstop, so a failed notice
      * must never wedge terminal handling or the orphan-draw reconciler.
      */
     reportRevenueSkippedNoRail(payload: RevenueSkippedNoRailPayload): Promise<void>;
-    /** Report the self-relay's Base gas gauge for platform-side paging and recovery. */
     reportX402SelfRelayGasBalance(payload: X402SelfRelayGasBalancePayload): Promise<void>;
-    /** Report redacted self-relay RPC health for platform-side paging and recovery. */
     reportX402SelfRelayRpcHealth(payload: X402SelfRelayRpcHealthPayload): Promise<void>;
-    /** Report the Tempo operator's fee-token gauge for paging and recovery. */
     reportTempoSettlementBalance(payload: TempoSettlementBalancePayload): Promise<void>;
-    /** Report a redacted operator fee rejection immediately. */
     reportTempoSettlementFailure(payload: TempoSettlementFailurePayload): Promise<void>;
     private postTempoSettlementReadiness;
-    /** Start the background retry loop. */
     startRetryLoop(): void;
-    /** Stop the background retry loop. */
     stop(): void;
     /**
      * Operator-facing queue snapshot: distinguishes the live retry queue from
@@ -2280,16 +2017,13 @@ declare class RevenueReporter {
     /**
      * Deliver one bounded batch from the durable queue.
      *
-     * Public so startup/recovery tests and operator tooling can drive the same
-     * drain the background timer uses without reaching into private state.
+     * Processes due, non-stale rows; failures back off up to five minutes and
+     * become terminal after 24 hours. Successful deliveries remove their rows.
      */
     drainPending(): Promise<void>;
-    /** Durably queue one report of either kind, then try it once immediately. */
     private enqueue;
-    /** Insert one pending report through either the pool or an open transaction. */
     private insertPending;
     private attemptDelivery;
-    /** Mark a pending row terminal (stale) with a classification reason. */
     private markStale;
 }
 
@@ -2298,7 +2032,7 @@ type X402ChannelQuerier = Pick<Pool, "query">;
 /**
  * Durable phase of an irreversible x402 facilitator settlement.
  *
- * `written_off` is the operator's terminal (internal-review): a settlement whose
+ * `written_off` is the operator's terminal: a settlement whose
  * ledger leg cannot be completed, reviewed and closed so it leaves the repair
  * queue without pretending it booked. It is deliberately reversible — a later
  * reconcile still accepts it, because it moved nothing.
@@ -2317,7 +2051,7 @@ interface X402SettlementIntent {
     /**
      * The channel as it stood when the settlement was handed to the facilitator —
      * after the refund's mandatory on-chain refresh, which {@link channelBefore}
-     * precedes (internal-review).
+     * precedes.
      *
      * The facilitator sizes a cooperative refund from *live* state
      * (`balance − chargedCumulativeAmount`) and signs it against the *live*
@@ -2363,7 +2097,7 @@ interface X402SettlementPage {
     nextAfter?: X402SettlementCursor;
 }
 /**
- * Fleet-wide serialisation of the self-relay's chain submissions (internal-review).
+ * Fleet-wide serialisation of the self-relay's chain submissions.
  *
  * Narrow on purpose, and implemented by {@link PostgresX402ChannelStorage}: the
  * relay asks for one thing — exclusive use of its gas EOA for the length of one
@@ -2374,7 +2108,6 @@ interface X402SettlementPage {
 interface X402RelaySubmissionLock {
     withRelaySubmissionLock<T>(key: string, operation: () => Promise<T>): Promise<T>;
 }
-/** Construction options for {@link PostgresX402ChannelStorage}. */
 interface X402ChannelStorageOpts {
     /**
      * Override the relay submission lock's wait ceiling, in milliseconds.
@@ -2411,7 +2144,7 @@ interface X402RelayLockHolder {
  * fault in the payment: a fleet-mate whose RPC is retrying holds the lock, and
  * the same request works once it lets go. It refuses rather than proceeding —
  * two machines submitting from one EOA collide on the nonce — and it refuses
- * rather than blocking, which is the internal-review defect: the old acquire had no
+ * rather than blocking, which is the defect: the old acquire had no
  * `lock_timeout`, so a wedged holder pinned a host-pool client and a channel
  * advisory lock for as long as it took.
  */
@@ -2428,7 +2161,7 @@ interface X402SettlementWriteOff {
     intent: X402SettlementIntent;
     written: boolean;
 }
-/** The refund standing between a channel and the credit it backs (internal-review). */
+/** The refund standing between a channel and the credit it backs. */
 interface X402UnresolvedRefund {
     settlementId: string;
     /** `${creditId}:${drainId}` — the drain this settlement belongs to. */
@@ -2436,7 +2169,7 @@ interface X402UnresolvedRefund {
     status: X402SettlementStatus;
 }
 /**
- * The credit ledger's read into durable x402 settlement state (internal-review).
+ * The credit ledger's read into durable x402 settlement state.
  *
  * Narrow on purpose: the ledger asks one question — is this channel's refund
  * still unresolved — and must not acquire the ability to move a settlement.
@@ -2454,7 +2187,7 @@ interface X402RefundSettlementGate {
  * transaction to the credit ledger: the fixed lock order is channel first,
  * credit second, and no credit-ledger path calls back into this store.
  *
- * Two pools, and the split is load-bearing (internal-review). The settlement markers
+ * Two pools, and the split is load-bearing. The settlement markers
  * must write *outside* the ledger transaction, which means a second connection
  * taken while the transaction's client is still checked out — on the shared
  * host pool that is a self-deadlock the moment concurrent deposits reach its
@@ -2475,7 +2208,6 @@ declare class PostgresX402ChannelStorage implements ChannelStorage {
     private readonly relayLockTimeoutMs;
     private readonly terminalizeUnbackedCredit?;
     constructor(pool: Pool, opts?: X402ChannelStorageOpts);
-    /** Create the durable channel table under the SDK-wide DDL lock. */
     init(): Promise<void>;
     /**
      * Read the fleet's durable "claimed funds are awaiting transfer" marker.
@@ -2487,7 +2219,7 @@ declare class PostgresX402ChannelStorage implements ChannelStorage {
      *
      * Both accessors run on the settlement pool: every caller reads or writes the
      * marker while {@link withFleetSettlementLock} holds a host-pool client, which
-     * is the nesting the internal-review split exists to keep off a non-terminal pool.
+     * is the nesting the split exists to keep off a non-terminal pool.
      */
     isSettlePending(scope: string): Promise<boolean>;
     /** Record whether a claim's funds still need a `settle(receiver, token)` transfer. */
@@ -2497,16 +2229,16 @@ declare class PostgresX402ChannelStorage implements ChannelStorage {
      *
      * On the dedicated settlement pool like every other marker, and for a sharper
      * reason than they had: this and {@link prepareSettlement} now run *inside*
-     * the channel transaction (internal-review), which holds a host-pool client for its
+     * the channel transaction, which holds a host-pool client for its
      * whole duration. Taking a second client from that same pool is the
-     * self-deadlock internal-review fixed — at pool max every client is a holder and a
+     * self-deadlock fixed — at pool max every client is a holder and a
      * waiter — and moving these calls under the transaction is exactly what would
      * reintroduce it.
      */
     getSettlement(operation: "fund" | "refund", effectId: string): Promise<X402SettlementIntent | undefined>;
     /**
      * The refund on this channel that is neither finished nor abandoned, if there
-     * is one — the credit ledger's spend gate (internal-review).
+     * is one — the credit ledger's spend gate.
      *
      * `statuses` is the caller's, because the two gates disagree by design: a
      * draw is blocked by {@link X402_SPEND_BLOCKING_SETTLEMENT_STATUSES}, a fresh
@@ -2514,12 +2246,12 @@ declare class PostgresX402ChannelStorage implements ChannelStorage {
      *
      * On the dedicated settlement pool, and that is what makes the gate callable
      * at all: a draw routinely runs inside an open channel transaction holding a
-     * host-pool client, and taking a second one from that pool is the internal-review
+     * host-pool client, and taking a second one from that pool is the
      * self-deadlock. The oldest blocking row wins, so a channel that somehow
      * accumulated two names the one an operator should reach for first.
      *
      * Projects three columns rather than decoding a whole {@link
-     * X402SettlementIntent}: the decoder refuses a pre-internal-review row that carries
+     * X402SettlementIntent}: the decoder refuses a legacy row that carries
      * no reconciliation snapshot, and a gate that throws on one would take every
      * draw on that channel down with it — when the row is exactly the kind that
      * ought to block them.
@@ -2527,7 +2259,7 @@ declare class PostgresX402ChannelStorage implements ChannelStorage {
     pendingRefundSettlement(channelId: string, statuses: X402SettlementStatus[]): Promise<X402UnresolvedRefund | undefined>;
     /**
      * Read one settlement by its own identifier — the handle an operator holds
-     * (internal-review). Same dedicated pool as {@link getSettlement}, for the same
+     * Same dedicated pool as {@link getSettlement}, for the same
      * reason: the repair reads this while a channel transaction may be open.
      */
     getSettlementById(settlementId: string): Promise<X402SettlementIntent | undefined>;
@@ -2535,7 +2267,7 @@ declare class PostgresX402ChannelStorage implements ChannelStorage {
     normalizeLegacyPaymentId(settlementId: string, operation: "fund" | "refund", legacyPaymentId: string, paymentId: string): Promise<X402SettlementIntent>;
     /**
      * The operator's repair queue: settlements stuck between "chain paid" and
-     * "ledger booked", oldest write first (internal-review).
+     * "ledger booked", oldest write first.
      *
      * Keyset-paginated on `(created_at, settlement_id)` for the reason the
      * blocked-invoice queue is: a wedged row never self-clears, so a fixed first
@@ -2560,7 +2292,7 @@ declare class PostgresX402ChannelStorage implements ChannelStorage {
         after?: X402SettlementCursor;
     }): Promise<X402SettlementPage>;
     /**
-     * Close a wedged settlement without booking anything (internal-review).
+     * Close a wedged settlement without booking anything.
      *
      * A single-statement CAS on the wedged statuses, on the settlement pool —
      * there is no ledger effect to be atomic with, which is the whole point:
@@ -2580,7 +2312,7 @@ declare class PostgresX402ChannelStorage implements ChannelStorage {
      * Mark that the next operation is the ambiguous external-call boundary.
      *
      * `channelAtSubmission` is the live channel the facilitator is about to size
-     * and sign the settlement against (internal-review) — bookmarked here, with the
+     * and sign the settlement against — bookmarked here, with the
      * block height, because these two are the only description of that instant
      * that survives the call.
      */
@@ -2602,12 +2334,11 @@ declare class PostgresX402ChannelStorage implements ChannelStorage {
     /**
      * Mark the external settlement and ledger effect complete in the active transaction.
      *
-     * `resolvedAtMs` is set only by the operator repair (internal-review), so an audit
+     * `resolvedAtMs` is set only by the operator repair, so an audit
      * read can tell a settlement that completed on its own from one a human had
      * to finish.
      */
     completeSettlement(settlementId: string, resolvedAtMs?: number): Promise<void>;
-    /** Load one channel snapshot. */
     get(channelId: string): Promise<Channel | undefined>;
     /** List all channel snapshots in stable channel-id order. */
     list(): Promise<Channel[]>;
@@ -2629,7 +2360,7 @@ declare class PostgresX402ChannelStorage implements ChannelStorage {
      * this is how the settlement layer says "this exact decrease is the one the
      * payer's verified refund voucher authorises". Outside this scope a decrease
      * of `chargedCumulativeAmount` is refused flat, which is what keeps the
-     * arbitrary-decrease guard meaningful (internal-review).
+     * arbitrary-decrease guard meaningful.
      */
     withSanctionedRefundBase<T>(base: string, operation: () => Promise<T>): Promise<T>;
     withChannelTransaction<T>(channelId: string, operation: (tx: PoolClient) => Promise<T>): Promise<T>;
@@ -2639,7 +2370,7 @@ declare class PostgresX402ChannelStorage implements ChannelStorage {
      * The lock is session-scoped, so its client stays checked out for the whole
      * operation — and `operation()` (upstream's claim/settle) re-enters the pool
      * through {@link updateChannel}. Two bounds keep that from wedging the pool
-     * (internal-review): local callers are serialized in-process, so this holds at most
+     * local callers are serialized in-process, so this holds at most
      * one client per process no matter how many requests arrive, and a waiting
      * acquire carries a `lock_timeout` so a wedged fleet-mate can't pin that
      * client — and the caller's request — indefinitely. A timeout reports the
@@ -2652,7 +2383,7 @@ declare class PostgresX402ChannelStorage implements ChannelStorage {
      */
     withFleetSettlementLock(operation: () => Promise<unknown>, wait?: boolean): Promise<boolean>;
     /**
-     * Hold the fleet-wide self-relay submission lock for one chain submission (internal-review).
+     * Hold the fleet-wide self-relay submission lock for one chain submission.
      *
      * The session lock keeps one per-DVM gas EOA to one in-flight submission
      * across the whole fleet — two machines submitting at once collide on the
@@ -2683,7 +2414,6 @@ declare class PostgresX402ChannelStorage implements ChannelStorage {
     private updateInTransaction;
 }
 
-/** Durable channel seam used to compose a settled draw with consumed Tempo value. */
 interface TempoSessionSettlementStore {
     withDrawPlacement<value>(channelId: string, operation: (tx: CreditLedgerQuerier, lifecycle: TempoSessionLifecycle$1) => Promise<value>, tx?: CreditLedgerQuerier): Promise<value>;
     withTerminalConsumption<value>(channelId: string, operation: (tx: CreditLedgerQuerier, lifecycle: TempoSessionLifecycle$1) => Promise<{
@@ -2692,7 +2422,6 @@ interface TempoSessionSettlementStore {
         consume: boolean;
     }>): Promise<value>;
 }
-/** Tempo channel state read while holding its durable row lock. */
 interface TempoSessionLifecycle$1 {
     finalized: boolean;
     closeRequestedAt: bigint;
@@ -2708,7 +2437,6 @@ interface TempoCreditLossEvidence {
     consumedNative: bigint;
     observedAt?: number;
 }
-/** Immutable audit record for one terminal, unbacked Tempo credit. */
 interface TempoCreditLoss {
     creditId: string;
     channelId: string;
@@ -2728,7 +2456,6 @@ interface X402CreditLossEvidence {
     totalClaimedNative: bigint;
     observedAt?: number;
 }
-/** Immutable audit record for one terminal, unbacked x402 credit. */
 interface X402CreditLoss {
     creditId: string;
     channelId: string;
@@ -2741,300 +2468,115 @@ interface X402CreditLoss {
     observedAt: number;
 }
 /**
- * Money-safe credit ledger (internal-review) — the SDK-owned settlement primitive the
- * credits spec (§2 condition 2) requires every DVM to use for prepaid balances.
- * Two tables in the DVM's own Postgres (`credits`, `credit_draws`), two-phase
- * draws (`pending` at job-accept → `settled` on success / `released` on
- * failure), and a per-credit gap-free `ledger_seq` for the receipt evidence
- * chain (`ReceiptCredit` in `lib/receipt.ts`).
- *
- * Concurrency contract: **every write to `credit_draws` happens inside a
- * transaction that first takes `SELECT … FOR UPDATE` on the parent `credits`
- * row.** The pending-hold SUM that defines available balance is only stable
- * because of that lock — never add a `credit_draws` write path that skips it.
- * `ctx.store` / KV is prohibited for credit state: last-write-wins KV on a
- * multi-machine fleet loses money under concurrency (spec condition 2).
+ * Every write to credit_draws takes SELECT … FOR UPDATE on its parent credit within the same
+ * transaction. That lock keeps the pending-hold sum and available balance stable across
+ * machines; KV storage cannot provide this money boundary.
  *
- * Scope note: the ledger is host-wide, keyed only by `credit_id` /
- * `caller_pubkey`. A multi-mount host shares one ledger across its mounts —
- * same operator, same money destination, so not a money hazard; a `dvm_id`
- * column can be added by idempotent migration if per-mount ledgers are ever
- * needed.
+ * The ledger is host-wide: credit_id and caller_pubkey identify rows, without a per-mount
+ * dvm_id. Draws hold funds until settlement or release, and share a gap-free per-credit
+ * ledger_seq with drains.
  */
 declare class CreditLedger {
     private readonly pool;
     private readonly tempoSessionStore?;
     /**
      * Postgres-backed: balances survive a restart and are shared across the
-     * fleet, so this DVM may advertise credit (internal-review).
+     * fleet, so this DVM may advertise credit.
      */
     readonly durable = true;
     private x402Settlements?;
     private expiryReleaseOutbox?;
     constructor(pool: CreditLedgerPool, tempoSessionStore?: TempoSessionSettlementStore | undefined);
     /**
-     * Bind the durable x402 settlement state this ledger gates spending on
-     * (internal-review).
-     *
-     * Late, because the settlement store is built with the batch-settlement
-     * server, which is built *after* the ledger it reads earned draws from. An
-     * unbound ledger simply does not gate — correct for a DVM with no x402
-     * channel storage, where no settlement row can exist to wedge.
+     * Bound after construction because the settlement store shares this ledger and is
+     * initialized separately. Ledger effects and route preflights use the same refund gate.
      */
     useX402SettlementGate(gate: X402RefundSettlementGate): void;
     /**
-     * Bind the durable outbox that reports credit-expiry releases and their
-     * revivals to the platform (internal-review).
-     *
-     * Held on the ledger rather than threaded through {@link fund} for the same
-     * reason as the gate above: the revival half fires from *every* funding path
-     * — Cashu commit, x402 exact and channel, Tempo, the Lightning invoice
-     * settle, the implicit N=1 per-call payment — and a seam each of those has to
-     * remember to pass is a seam one of them will eventually forget.
-     *
-     * Unbound (a `dvmctl dev` server, a self-hosted builder, a test host) the
-     * sweep and the reversal still run and still write the ledger's own rows;
-     * only the platform report is skipped. Reporting is bookkeeping and must
-     * never gate the ledger.
+     * Expiry release and revival reports join the ledger transaction. A caller-owned funding
+     * transaction must not commit a reversal independently of its outbox row. Without this
+     * wiring, ledger transitions still run.
      */
     useCreditExpiryReleaseOutbox(outbox: CreditExpiryReleaseOutbox): void;
-    /** Create the `credits` / `credit_draws` tables if absent. Call once at SDK boot. */
     init(): Promise<void>;
-    /** The boot DDL itself — always runs under {@link withSdkInitLock} (internal-review). */
     private createTables;
     /**
-     * Give every open non-channel Bitcoin credit a funding lot (internal-review).
-     *
-     * Runs inside the boot DDL, is guarded per credit by `NOT EXISTS`, and is
-     * therefore both the one-time migration and a standing self-heal for a
-     * credit that somehow reaches a positive balance with no lot behind it.
-     *
-     * The lot is derived from `credits.msats_remaining`, not replayed out of
-     * `credit_fundings`. That is not a shortcut: `credit_fundings` records only
-     * `{amount_micro, rail}` — no instrument amount at all — and is not written
-     * on every funding path, whereas `msats_remaining` **is** the credit's
-     * current unspent rail value, maintained pro rata on every draw since
-     * internal-review. One synthetic lot pairing it with `balance_micro` therefore
-     * reproduces today's in-kind position exactly, and FIFO over a single lot is
-     * trivially correct. Historic per-funding rates are unrecoverable and would
-     * change nothing: only the remaining position is owed.
-     *
-     * The semantics change is deliberately retroactive (internal-review) — every
-     * current holder is first-party, so there is one regime and no legacy
-     * branch.
+     * Backfill an open non-channel Bitcoin credit only when it has no funding lot. Pair
+     * balance_micro with current msats_remaining; credit_fundings lacks historical instrument
+     * amounts and does not cover every funding path. Historical per-funding rates cannot be
+     * recovered. Existing lots are left untouched, so this does not repair partial coverage
+     * gaps.
      */
     private backfillFundingLots;
     /**
-     * Create a credit, or top up an existing one (same `creditId`). Top-ups add
-     * to the balance and overwrite `expiry_ms` with the provided value — funding
-     * an expired credit revives it (spec §5 carry-forward: the credit is a
-     * rolling buffer, not per-job escrow). The existing row's `caller_pubkey`
-     * and `currency` must match or the fund is refused with a typed error —
-     * without that check a top-up against someone else's `credit_id` would
-     * silently merge two callers' money.
+     * Funding adds balance and overwrites expiry, reviving an expired credit. It is additive,
+     * not idempotent: the caller’s rail marker or funding record must prevent replay. Owner and
+     * currency must match; rail and reusable-channel bindings cannot be mixed with other
+     * instruments. A legacy NULL rail adopts its first typed top-up.
      *
-     * Pass `tx` (a client inside a caller-owned `BEGIN`) to commit the rail
-     * receive and the ledger credit atomically (spec condition 3 — the internal-review
-     * verifier does this). The ledger issues **no** transaction control on `tx`.
+     * With tx, all writes join the caller’s transaction without transaction control. Otherwise
+     * the ledger owns a transaction covering balance, funding lot, reversal of standing expiry
+     * releases and their reports. A partial revival would leave restored balance with a release
+     * still counted.
      *
-     * Without `tx` it opens one of its own, because a funding is no longer a
-     * single statement: it upserts the credit, records its funding lot
-     * (internal-review), and reverses any standing expiry release (internal-review) — and that
-     * last leg restores balance and queues a report. A crash between the upsert
-     * and the reversal would leave a revived credit whose release still stands,
-     * which the sweep's own exclusion then makes permanent: `balance_micro > 0`
-     * but a standing release means it is neither drainable nor re-releasable.
-     *
-     * `basis` records the rail value behind the fiat (internal-review) so each draw can
-     * be allocated its share of the rail-native amount actually received. A
-     * top-up on a different rail than the credit's is refused with
-     * `rail_mismatch`: sats and USDC microunits aren't summable, so a blended
-     * credit would have no coherent native basis to allocate from.
-     *
-     * It is **required** (internal-review), in the type and again at runtime via
-     * {@link assertFundingBasis}. A basis-less fund wrote `rail = NULL`, and a
-     * draw against such a credit settles — a real debit — while
-     * `railAsFundingMethod` correctly declines to guess a rail, so `bookRevenue`
-     * books nothing and outstanding liability (`deposits − draw revenue`) stays
-     * overstated by the drawn amount forever. `credits.rail` stays nullable
-     * because rows written before this change still exist in live databases:
-     * **write is closed, read is not.** A legacy row adopts a rail from its first
-     * typed top-up via the `COALESCE` below.
-     *
-     * The rail-native **instrument** is pinned at first funding too, and both
-     * channel guards are symmetric for the same reason (internal-review). A reusable
-     * channel — Tempo session or x402 batch-settlement — may only ever top up
-     * the credit it opened, and a credit opened by a one-shot (a Tempo charge, an
-     * x402 exact authorization) may never adopt one. The x402 half used to admit
-     * `credits.x402_channel_id IS NULL`, so a channel deposit bound itself to a
-     * credit already holding exact-funded value: `earnedNativeForX402Channel`
-     * then read that credit's whole settled-draw history as the channel's
-     * earnings, and the first claim tick swept a deposit nobody had consumed,
-     * while the unspent balance lost every exit (the drain's refund base goes
-     * below `totalClaimed`, and a channel-bound credit refuses every non-x402
-     * drain). `credits_x402_channel_uidx` does not cover this: it guards
-     * one-credit-per-channel, not one-source-per-credit.
-     *
-     * An x402 channel deposit is additionally refused `settlement_pending` while
-     * that channel carries an unresolved refund (internal-review) — see the gate read
-     * below. This method is the authority on that rule, as it is on the binding
-     * rules above; every door preflights it where a refusal is still free.
+     * An incoming x402 channel with an unresolved refund is refused before the upsert. That
+     * preflight is not atomic with a concurrent cooperative drain; see the incoming-channel
+     * gate below.
      */
     fund(args: CreditFundArgs): Promise<CreditSnapshot>;
-    /**
-     * The funding itself, on whichever handle {@link fund} chose. Every refusal
-     * it raises is the caller's to see unchanged; a self-opened transaction rolls
-     * back around it.
-     */
     private fundOn;
     /**
-     * Undo any expiry release this credit still carries, because a funding just
-     * landed on it (internal-review — the revival rule), restoring the balance the
-     * release took.
+     * Funding reverses standing expiry releases, restores their released micro and queues
+     * reversal reports on the funding transaction. Do this even when the new expiry is already
+     * past: the next sweep must release the enlarged remainder as a new episode.
      *
-     * A release records the credit's **final** undrawn remainder and zeroes it
-     * (see {@link releaseExpiredCreditLocked}). Funding adds to the balance and
-     * overwrites `expiry_ms` (spec §5 carry-forward: the credit is a rolling
-     * buffer), so the moment money arrives the recorded remainder is no longer
-     * final: the release stops counting and its micro come back.
-     *
-     * Deliberately unconditional on the incoming expiry rather than gated on
-     * `expiryMs > nowMs`. A release exists only for a credit that had already
-     * lapsed, so any funding that reaches one is money the release did not
-     * account for — and a funding that arrives with an already-past expiry leaves
-     * a credit the very next sweep re-releases at its new, larger remainder. One
-     * rule, self-healing in both directions, and it never needs to read the
-     * pre-funding expiry the upsert has already overwritten.
-     *
-     * Runs on the funding's own handle — which {@link fund} now guarantees is a
-     * transaction — so the reversal, the restored balance and the report commit
-     * with the money or not at all. A reversal that committed without its report
-     * would be unrecoverable: `WHERE reversed_at IS NULL` means no later pass
-     * re-derives it.
-     *
-     * @returns the credit row as the restore left it, or undefined when there was
-     *   nothing to reverse. The caller reads its snapshot off this rather than off
-     *   the funding upsert's `RETURNING`, which predates the restore.
+     * Returns the row after restoration, or undefined when no release stood. The upsert’s
+     * RETURNING row predates the restoration and is not the final balance.
      */
     private reverseExpiryReleases;
     /**
-     * Release the undrawn remainder of every credit whose TTL has run out
-     * (internal-review). Returns the releases this pass recorded.
-     *
-     * **What is released.** The credit's whole `balance_micro`. Expiry ends
-     * spending but never ownership of the record, so the balance stays readable;
-     * what ends is the caller's claim on it, and on the prepaid rails the value
-     * behind it is already in builder custody.
-     *
-     * **Tempo is excluded**, at both of its markers (`tempo_channel_id` and a
-     * `tempo` rail). A Tempo credit is channel-backed and its undrawn value
-     * returns to the *caller* at channel exit, so releasing it would book the
-     * builder money the chain is about to hand back.
+     * Release expired undrawn balances, retaining readable credit records. Tempo rail or
+     * channel-backed credits are excluded because their collateral returns to the caller
+     * through the channel lifecycle.
      *
-     * **A credit with a pending hold is skipped, not partially released.** A draw
-     * placed before expiry stays settleable afterwards (`draw`'s replay lookup
-     * runs above the expiry check, so a lost response is still recoverable), so
-     * the remainder is not final while a hold is outstanding. Skipping costs one
-     * sweep interval and keeps the released figure exactly "what nothing bought";
-     * holds do resolve — the orphan-draw watchdog (internal-review) is what guarantees
-     * a stranded one still reaches a terminal state.
-     *
-     * **Idempotent** two ways. `release_id` is derived from the expiry instant,
-     * so a re-sweep after a crash between the insert and its report collides on
-     * the same primary key instead of writing a second row; and the candidate
-     * scan excludes any credit that already has an un-reversed release.
-     *
-     * Each candidate is re-checked under the credit row lock every
-     * `credit_draws` write is taken under, so a draw racing the sweep either
-     * loses the race (its credit is already released and it would have been
-     * refused `credit_expired` anyway) or wins it and leaves a pending hold the
-     * locked re-check sees.
+     * Pending holds prevent release: jobs accepted before expiry may still settle or release.
+     * Candidates are rechecked under the same parent-credit lock used by draw writes. The
+     * balance debit, episode record and report commit together; standing releases exclude
+     * repeat work. A later revival may reuse the expiry instant but receives a new release
+     * sequence.
      */
     sweepExpiredCredits(args?: {
         nowMs?: number;
-        /** Credits released per pass. Bounds the work a long-idle DVM does at boot. */
         limit?: number;
     }): Promise<{
         released: CreditExpiryRelease[];
     }>;
     /**
-     * Write one credit's expiry release under its row lock, zero the balance it
-     * released, and re-assert every condition the unlocked candidate scan tested.
-     * Returns undefined when the credit no longer qualifies — funded, drawn
-     * against, or already released between the scan and the lock.
-     *
-     * **Zeroing the balance is what makes the release real**, and it is the whole
-     * reason this runs under the lock rather than as a bare INSERT. The row alone
-     * records that the caller's claim ended; it does not *end* it. `requestDrain`
-     * has no expiry check by design (expiry gates new draws, not reclaims), so a
-     * credit whose remainder had been released and reported was still fully
-     * drainable: the DVM would pay out money the platform had already booked as
-     * the builder's, and `deposited - drawn - drained - released` would go
-     * negative on the same micro. With the balance at zero, `requestDrain`'s
-     * existing `availableMicro <= 0` guard refuses with `nothing_to_drain` and no
-     * new check is needed anywhere. {@link reverseExpiryReleases} puts the
-     * balance back when a funding revives the credit.
+     * Recheck eligibility under the credit lock and zero the released balance in the same
+     * transaction as its episode/report. Otherwise requestDrain, which intentionally ignores
+     * expiry, could reclaim value already released to the builder.
      *
-     * `status` deliberately stays `active`: a released credit must remain
-     * fundable, or the revival rule has nothing to revive.
-     *
-     * The zeroed balance also takes the credit out of `BITCOIN_CREDIT_PREDICATE`
-     * (`balance_micro > 0`), so the in-kind sweep floor stops counting sats the
-     * builder no longer owes back — and counts them again after a revival, with
-     * the credit's funding lots untouched throughout.
+     * Keep status active so future funding can revive it. Funding lots remain intact: balance
+     * zero excludes this credit from Bitcoin liability, and reversal restores that liability.
      */
     private releaseExpiredCreditLocked;
     /**
-     * Record this funding's in-kind basis as a lot (internal-review).
-     *
-     * Called from inside {@link fund}, on the same handle, so the lot shares
-     * whatever transaction the rail opened — `withCommitTx` for Cashu,
-     * `ProcessedPaymentStore.withTx` for x402/Tempo, `settleInvoice`'s own
-     * `BEGIN` for Lightning. The funding-atomicity invariant therefore extends
-     * to it structurally rather than by every call site remembering: a lot
-     * cannot exist without its ledger credit, or the credit without its lot.
-     *
-     * Only a **channel-backed** credit writes no lot: it is in-kind already —
-     * the escrow itself retains the unused value — so a lot on one would be
-     * counted as Bitcoin deposit liability the hub does not hold.
+     * Record non-channel Bitcoin funding lots on the funding transaction. An implicit payment
+     * also needs a lot: its draw is initially only a hold, and failure releases the whole
+     * balance for reclaim. Channel collateral is excluded from Bitcoin lots.
      *
-     * Every other non-channel Bitcoin funding writes one, the implicit N=1
-     * per-call payment included. That one funds and draws the same amount in
-     * this transaction, so it looks like a lot born depleted — but the draw is a
-     * *pending hold*, not a debit, and only a `completed` job settles it
-     * (`JobManager.settlesDraw`). A failed, cancelled or stale-swept job
-     * releases the hold and the whole funded amount becomes reclaimable balance,
-     * so suppressing the lot here would leave routine traffic reclaiming off a
-     * live rate and missing from the sweep floor. One small insert on the hot
-     * path buys the invariant the liability read depends on: open lots cover
-     * `balance_micro` for every Bitcoin credit, always.
-     *
-     * A zero-sats basis still writes a lot. It is honest — the credit exists and
-     * we know its rail — and it is what makes "covered but unbacked" a
-     * distinguishable state from "no lot at all" for the reclaim and the
-     * liability rollup, instead of both reading as a gap.
+     * A zero-sats basis still records a lot, distinguishing covered but basisless credit from a
+     * missing-lot coverage gap.
      */
     private recordFundingLot;
     /**
-     * Place a two-phase `pending` hold of `amountMicro` against the credit and
-     * assign the next `ledger_seq`. Idempotent on `(creditId, drawId)`: a replay
-     * returns the original `{balanceAfterMicro, ledgerSeq}` with
-     * `replayed: true` and places no second hold — this is how a caller recovers
-     * a lost response (spec condition 1). A replay whose `amountMicro` or
-     * `jobId` differs from the recorded draw is not a replay but a money bug in
-     * the caller, refused with `draw_conflict`.
-     *
-     * The replay lookup runs **before** the expiry check, deliberately: a draw
-     * placed pre-expiry must stay recoverable after the credit expires, or the
-     * DVM holds a debit the caller can never reconcile. Fresh draws on an
-     * expired credit are refused with `credit_expired`; the balance stays
-     * intact and readable (spec §5: expiry ends spending, never ownership).
+     * Place a pending hold with the next shared per-credit sequence. A matching (creditId,
+     * drawId) replay returns its recorded tuple without another hold; conflicting amount or
+     * jobId is draw_conflict.
      *
-     * Pass `tx` (a client inside a caller-owned `BEGIN`) to place the hold in
-     * the same transaction as the rail commit and the `fund` upsert (spec
-     * condition 3 — the internal-review implicit N=1 path). The ledger issues no
-     * transaction control on `tx`; the `SELECT … FOR UPDATE` row lock is still
-     * taken on the caller's transaction, so the locking invariant holds.
+     * Replay precedes expiry and settlement gates so a lost response stays recoverable. Fresh
+     * draws require spendable credit. With tx, take the parent-credit lock on the caller’s
+     * transaction without issuing transaction control.
      */
     draw(args: {
         creditId: string;
@@ -3047,63 +2589,23 @@ declare class CreditLedger {
         nowMs?: number;
     }): Promise<DrawResult>;
     /**
-     * The unresolved refund on `channelId` that must stop this ledger effect, if
-     * any (internal-review).
-     *
-     * `undefined` whenever there is nothing to ask — an unbound credit, or a DVM
-     * with no durable settlement store, where a settlement row cannot exist.
-     *
-     * Public since internal-review, so `/v1/credit`'s pre-payment preflight can ask the
-     * same question `fund` will ask from inside the rail transaction — one read,
-     * one answer, rather than a second copy of the rule in the routes.
+     * Return the unresolved refund that blocks an effect on this channel, or undefined. Route
+     * preflights use the same rule before moving money; draw and drain also read it under the
+     * credit lock.
      */
     blockingX402Refund(channelId: string | null | undefined, statuses: X402SettlementStatus[]): Promise<X402UnresolvedRefund | undefined>;
     /**
-     * Grow a pending draw by `addAmountMicro` (internal-review) — the ledger half of a
-     * mid-job `requestPayment` top-up. One job keeps **one** draw: the mid-job
-     * money funds the same credit and enlarges the hold the upfront leg placed,
-     * so the receipt's `ReceiptCredit` block countersigns the job's full cost
-     * and `revenue_events` still books exactly one row per job.
-     *
-     * `draw()` cannot express this: a same-`draw_id` call with a different
-     * amount is `draw_conflict` by design (a replayed draw must never re-price).
+     * Grow an accepted job’s pending hold while preserving its original ledger_seq. The balance
+     * tuple is updated at that sequence, so interleaved draws need not form a monotonic balance
+     * trajectory. No expiry check applies to an already accepted job.
      *
-     * The arithmetic is `draw()`'s, unchanged: `addAmountMicro` is checked
-     * against — and `balance_after_micro` recomputed from — the balance net of
-     * **every** pending hold, this draw's own included. That is deliberately the
-     * conservative reading (a fresh draw of `addAmountMicro` would see exactly
-     * the same figure), and it is what keeps the total held after growth inside
-     * the credit's balance.
+     * Available balance excludes every pending hold, including this one. An earmark allocates
+     * the incoming funding’s rail value; absent one, growth uses the pool.
      *
-     * The increment's rail value comes from {@link growthRailValue}: earmarked
-     * to the funding that backs it when the caller names one (the mid-job case),
-     * pro-rata otherwise. Either way the draws of a credit keep summing to
-     * precisely what the rails paid (internal-review).
-     *
-     * **`ledger_seq` is not re-taken.** The per-credit sequence is gap-free
-     * (`credit_draws_seq_uidx`), so moving this draw forward would strand its
-     * original number. The consequence is deliberate and worth knowing: the
-     * recorded `balance_after_micro` is the post-growth figure stamped at the
-     * *original* seq, so a credit with interleaved sibling activity has a
-     * trajectory that is truthful per draw rather than monotonic across seqs.
-     *
-     * **No expiry check**, matching `settle`/`release`: the job was accepted
-     * pre-expiry and is still running. Refusing here would strand the handler
-     * mid-flight over a clock the caller can't influence.
-     *
-     * **Not idempotent by itself.** Growth carries no key of its own — it
-     * inherits the rail's (the accumulator's `(dvm_id, request_id)` UNIQUE rolls
-     * the whole transaction back on replay; x402/mpp collide on the
-     * `processed_payments` marker). Never call it outside a rail commit.
-     *
-     * **`capMicro` bounds cumulative growth at what the job cumulatively asked
-     * (internal-review)**, and it is the only ceiling that can refuse a top-up: the
-     * available-balance check cannot, because the `fund` a moment earlier in
-     * this same transaction raised the balance by exactly the amount being
-     * drawn. Excess is **granted partially or not at all rather than thrown** —
-     * this runs inside the rail commit, so a throw would roll back cashu proofs
-     * the caller already sent. The refused remainder stays funded balance the
-     * caller owns and can drain.
+     * Growth has no independent replay key: compose it with the rail’s replay protection in one
+     * transaction. capMicro bounds cumulative growth at the job’s cumulative ask. Excess
+     * remains caller-owned funded balance; partial or zero growth returns that excess rather
+     * than throwing and rolling back accepted proofs.
      */
     growDraw(args: {
         creditId: string;
@@ -3111,7 +2613,7 @@ declare class CreditLedger {
         addAmountMicro: number;
         /**
          * Rail value that funded this growth, earmarked to the increment instead
-         * of allocated pro-rata (internal-review). Pass it whenever `addAmountMicro` is
+         * of allocated pro-rata. Pass it whenever `addAmountMicro` is
          * money that landed in this same transaction; omit it when the growth
          * spends balance the credit already held.
          */
@@ -3121,7 +2623,7 @@ declare class CreditLedger {
         };
         /**
          * Ceiling on this draw's **cumulative** growth, in fiat micro of the
-         * credit's currency (internal-review) — the job's total mid-job ask. Growth is
+         * credit's currency — the job's total mid-job ask. Growth is
          * clipped to `capMicro - grown_micro`; a second payment for an ask the
          * first already satisfied gets zero. Omit it only when the caller genuinely
          * has no ask total to bound against; growth is then unbounded, as before.
@@ -3155,7 +2657,7 @@ declare class CreditLedger {
     }): Promise<DrawResolution>;
     /**
      * Release a pending draw: the hold evaporates, the balance is untouched —
-     * this is how "no debit on job failure" is mechanically real (spec §1).
+     * this is how "no debit on job failure" is mechanically real (the credit lifecycle contract).
      * Idempotent: releasing a released draw returns the original tuple. A
      * settled draw cannot be released (`invalid_draw_state`) — un-settling
      * booked revenue is a reconciliation problem, not a ledger verb.
@@ -3167,18 +2669,9 @@ declare class CreditLedger {
         nowMs?: number;
     }): Promise<DrawResolution>;
     /**
-     * Record a fund-only top-up under its client-generated `fundId` (internal-review).
-     * The deposit half of the evidence chain, and the top-up path's idempotency
-     * key: `PRIMARY KEY (credit_id, fund_id)` means a concurrent duplicate
-     * loses with a typed `funding_replayed` rather than crediting twice.
-     *
-     * Call it inside the same `tx` as {@link fund} — the rail commit, the
-     * funding record, and the balance increment must land together or not at
-     * all (spec §2 condition 3). Like `fund`, this issues no transaction
-     * control on `tx`; it is a single statement.
-     *
-     * This does **not** move money on its own. `fund` still does the crediting;
-     * this row is what lets a retry be answered with the original outcome.
+     * Record the fund-only replay key without moving money. A duplicate (credit_id, fund_id)
+     * raises funding_replayed. Compose this insert, fund and rail acceptance on the same
+     * caller-owned transaction; a retry reads the recorded funding outcome.
      */
     recordFunding(args: {
         creditId: string;
@@ -3216,7 +2709,7 @@ declare class CreditLedger {
         receipt: FundingReceipt;
     }): Promise<FundingReceipt>;
     /**
-     * Record the bolt11 issued for a `(creditId, fundId)` top-up (internal-review), or
+     * Record the bolt11 issued for a `(creditId, fundId)` top-up, or
      * return the one already issued for it.
      *
      * **Returning the existing row is the point.** A caller re-polling an unpaid
@@ -3237,7 +2730,6 @@ declare class CreditLedger {
         expiresAt: number;
         nowMs?: number;
     }): Promise<CreditInvoiceRecord>;
-    /** Read one invoice (no lock). */
     getInvoice(args: {
         creditId: string;
         fundId: string;
@@ -3253,35 +2745,22 @@ declare class CreditLedger {
         limit: number;
     }): Promise<CreditInvoiceRecord[]>;
     /**
-     * Apply an observed Lightning settlement to the ledger — **the exactly-once
-     * boundary** (internal-review; spec §2 condition 3 for a rail whose commit happens
-     * off-box).
-     *
-     * One transaction covers the funding record, the balance, and the invoice's
-     * own status flip, so the three can never disagree. A crash anywhere inside
-     * leaves the invoice `pending` and the balance untouched: the next
-     * `lookup_invoice` observes the same settled payment and credits it, once.
-     * A replayed check after the commit sees `settled` and moves nothing.
-     *
-     * The lock is on the **invoice** row, not the credit row: the first
-     * Lightning top-up is what opens the credit, so there is frequently no
-     * `credits` row to take `FOR UPDATE` yet. That does not weaken the ledger's
-     * concurrency contract — no `credit_draws` write happens here, and `fund`'s
-     * upsert is a single statement — while still serialising two settlement
-     * checks racing on the same invoice.
+     * Serialize settlement on the invoice row, which exists before the first credit does.
+     * Funding record, balance, invoice status and optional deposit outbox commit together. An
+     * interrupted transaction leaves the prior invoice status intact for retry; a settled replay
+     * moves no money.
      */
     settleInvoice(args: {
         creditId: string;
         fundId: string;
         expiryMs: number;
         /**
-         * Rail-value basis, pinned when the invoice was issued (internal-review). Required
-         * by internal-review — it is what `fund` writes to `credits.rail`.
+         * Funding rail value pinned when this invoice was issued.
          */
         basis: CreditFundingBasis;
         /**
          * Reporter-owned deposit outbox write. Runs on the invoice transaction
-         * after the ledger/status writes and before COMMIT (internal-review).
+         * after the ledger/status writes and before COMMIT.
          */
         depositOutbox?: {
             enqueue: CreditDepositEnqueue;
@@ -3300,39 +2779,20 @@ declare class CreditLedger {
         fundId: string;
     }): Promise<CreditInvoiceRecord | undefined>;
     /**
-     * Retire an invoice that **was paid** and can never be credited (internal-review).
-     *
-     * Distinct from `expired` because the money is the opposite way round: an
-     * expired invoice was never paid and owes nobody anything, whereas a blocked
-     * one has sats sitting in the builder's wallet with no ledger row to put them
-     * on. Only an operator can resolve that, so the row records `reason` and
-     * stops being swept — leaving it `pending` would spend one of the sweep's few
-     * slots re-deriving the same verdict on every request the caller makes, and
-     * three of them would wedge that caller's sweep so a genuinely payable
-     * invoice behind them never credits.
-     *
-     * A CAS on `pending`, like the expiry retirement: a settlement observed
-     * concurrently must win.
+     * Mark a paid invoice blocked when its payment cannot be credited. This removes it from the
+     * bounded pending sweep and leaves its reason for operator repair. The pending-only CAS
+     * cannot overwrite a committed settlement.
      */
     markInvoiceBlocked(args: {
         creditId: string;
         fundId: string;
         reason: string;
     }): Promise<CreditInvoiceRecord | undefined>;
-    /** Read one invoice by the wallet's own identifier for the payment (no lock). */
     getInvoiceByPaymentHash(paymentHash: string): Promise<CreditInvoiceRecord | undefined>;
     /**
-     * The operator's queue: invoices the sweep gave up on (internal-review).
-     *
-     * **Keyset-paginated, not offset.** Blocked rows are terminal and never
-     * self-clear, so a row the operator declines to act on sits at the head of
-     * the age ordering forever; a fixed first page would starve everything
-     * behind it on every run, which is the internal-review shape one page up.
-     *
-     * `includeResolved` widens to the operator-resolved statuses so a run can be
-     * audited after the fact — the acceptance criterion this verb exists for.
-     * Host-wide, like `listPendingDrains`: the ledger has no `dvm_id`, so on a
-     * multi-mount host one builder's admin credential reads every mount's rows.
+     * Host-wide operator queue, keyset-paginated so an untouched blocked row does not starve
+     * later rows. includeResolved also exposes reconciled and written-off history; the ledger
+     * has no per-mount dvm_id.
      */
     listBlockedInvoices(args: {
         limit: number;
@@ -3340,44 +2800,22 @@ declare class CreditLedger {
         includeResolved?: boolean;
     }): Promise<CreditInvoiceRecord[]>;
     /**
-     * Apply a blocked invoice's payment to a credit an operator named — the
-     * repair for the one Lightning outcome the DVM cannot fix itself (internal-review).
-     *
-     * Shaped statement-for-statement on {@link settleInvoice}, because it is the
-     * same money doing the same thing a different way: one transaction covering
-     * the funding record, the balance, the invoice's status flip and the deposit
-     * outbox row, so the four can never disagree. Three deliberate differences:
+     * Apply a blocked or written-off invoice to an operator-named credit. Lock the invoice by
+     * its unique payment_hash before funding the credit, matching settlement’s
+     * invoice-to-credit lock order. Funding, balance, resolution and optional outbox share one
+     * transaction.
      *
-     * - **The lock is taken on `payment_hash`**, which is UNIQUE and is the
-     *   identifier the operator actually holds (it is what the
-     *   `lightning_settlement_blocked` log carries and what names the payment in
-     *   their wallet). Invoice row first, credit row second via `fund`'s upsert —
-     *   the same order `settleInvoice` takes, which is what keeps a reconcile and
-     *   a concurrent settlement check from deadlocking against each other.
-     * - **The funding lands at `(targetCreditId, paymentHash)`, not the invoice's
-     *   own `(credit_id, fund_id)`.** That key is frequently the reason the row
-     *   is blocked at all — `funding_replayed_on_cashu` means something else
-     *   already holds it — and the operator's most natural target is that very
-     *   credit. The payment hash cannot collide with it, and it makes all three
-     *   references to this payment agree: `basis.fundingRef`, the deposit's
-     *   `funding_id`, and the funding row's `fund_id`.
-     * - **`written_off` is an accepted input status.** A write-off unwound
-     *   nothing, so an operator who closed a row by mistake must not need raw SQL
-     *   against a money table to reopen it.
-     *
-     * The invoice row's status — never the funding row — is the idempotency
-     * source of truth. `fund_id` is caller-chosen and the payment hash is
-     * disclosed to them, so a caller *can* squat `(theirCredit, thatHash)` with a
-     * top-up on another rail; when they have, `recordFunding` throws
-     * `funding_replayed` and that surfaces as its own loud failure rather than
-     * being absorbed as "already reconciled".
+     * The repair funding key is (targetCreditId, paymentHash), distinct from the original
+     * caller-chosen fundId. Invoice status determines replay. A caller can still occupy the
+     * repair key with another payment; funding_replayed must remain a refusal, not be absorbed
+     * as already reconciled. Preserve blocked_reason and the wallet’s settlement instant.
      */
     reconcileBlockedInvoice(args: {
         paymentHash: string;
         /** Credit the money lands on. The caller identity comes off the invoice row. */
         targetCreditId: string;
         expiryMs: number;
-        /** Rail-value basis, rebuilt from the invoice row by the caller (internal-review). */
+        /** Rail-value basis, rebuilt from the invoice row by the caller. */
         basis: CreditFundingBasis;
         /** The wallet's settlement instant, re-observed by the operator's verb. */
         settledAtMs?: number;
@@ -3388,17 +2826,9 @@ declare class CreditLedger {
         nowMs?: number;
     }): Promise<InvoiceReconciliation>;
     /**
-     * Record that an operator reviewed a blocked invoice and chose not to credit
-     * it (internal-review) — no ledger effect, purely a queue transition.
-     *
-     * A CAS on `blocked`, and idempotent: re-running returns the recorded row
-     * rather than overwriting the first note. It cannot capture a `reconciled`
-     * row, because that one moved money.
-     *
-     * `written` reports whether *this* call was the transition. The caller has
-     * no other way to tell — the row reads identically either way — and the
-     * write-off's audit log is the only record of the amount, so a re-emitted
-     * one reads as a second decision about the same sats.
+     * Write off an invoice without crediting or moving money. Only the first transition records
+     * the note; its written bit controls the audit event. An operator can later reconcile a
+     * written-off invoice, because write-off did not return its payment.
      */
     writeOffBlockedInvoice(args: {
         paymentHash: string;
@@ -3413,38 +2843,24 @@ declare class CreditLedger {
     getForCaller(callerPubkey: string, opts?: {
         nowMs?: number;
     }): Promise<CreditSnapshot[]>;
-    /** Read one draw (no lock), with its credit's rail basis joined in. */
     getDraw(args: {
         creditId: string;
         drawId: string;
     }): Promise<DrawRecord | undefined>;
     /** Read the sole draw bound to a pre-allocated job id; ambiguity fails closed. */
     getDrawByJobId(jobId: string): Promise<DrawRecord | undefined>;
-    /** Read every draw linked to a job, including already-resolved rows. */
     listDrawsByJobId(jobId: string): Promise<DrawRecord[]>;
     /**
      * All pending holds on a credit, in `ledger_seq` order (no lock). Read
-     * surface for the internal-review sweeper wiring — a worker that dies mid-job
+     * surface for the sweeper wiring — a worker that dies mid-job
      * leaves its hold `pending` until something releases it.
      */
     listPendingDraws(creditId: string): Promise<DrawRecord[]>;
     /**
-     * One page of pending holds host-wide placed before `createdBeforeMs`,
-     * oldest first (no lock). The orphan sweeper's read surface (internal-review): a
-     * draw commits with its `job_id` before the job row is persisted, so a crash
-     * or a fail-closed refusal in that window strands a hold nothing can ever
-     * resolve — the only release path keys off the `credit_id`/`draw_id` written
-     * on the job row.
-     *
-     * Host-wide like {@link listPendingDrains}, not per-credit: the sweeper has
-     * no candidate credit to start from. Age-bounded so it never sees a draw
-     * whose job row is merely still in flight.
-     *
-     * `limit` is required and `after` keyset-paginates: an aged hold whose job
-     * row *does* exist is legitimately un-sweepable and stays `pending`
-     * indefinitely, so a caller that re-issues the same first page would never
-     * see past a `limit`-sized wall of them. Pass the last row's
-     * {@link StalePendingDrawCursor} to advance.
+     * Page host-wide pending holds older than createdBeforeMs by (created_at, credit_id,
+     * ledger_seq). Use the same compound key for ordering and continuation, preserving
+     * same-millisecond rows. Terminal resolution still rechecks state under the parent-credit
+     * lock.
      */
     listStalePendingDraws(args: {
         createdBeforeMs: number;
@@ -3452,38 +2868,18 @@ declare class CreditLedger {
         after?: StalePendingDrawCursor;
     }): Promise<DrawRecord[]>;
     /**
-     * Rail-native value the credit an x402 settlement channel funded has
-     * actually earned — the sum of its **settled** draws, in the credit's native
-     * atomic units (USDC micro on this rail). The batch-settlement claim job's
-     * ceiling (internal-review): a channel is claimable up to what its credit's draws
-     * have earned, never up to the deposit that funded it.
-     *
-     * `undefined` when no credit is bound to the channel, which the claim job
-     * treats as "cannot be resolved" and claims nothing for — distinct from a
-     * resolved credit that has earned `0`.
-     *
-     * Deliberately a sum over settled draws rather than `funded − remaining`:
-     * a drain lowers `native_remaining` without earning anything, so the
-     * subtraction would read the caller's own reclaim as revenue. Pending holds
-     * are excluded for the mirror reason — a hold is work in flight, and
-     * claiming against it would take money a release still owes back.
+     * Sum settled draws’ native value for the credit bound to this x402 channel.
+     * Pending/released holds and drains earn nothing. Return undefined for an unbound channel,
+     * distinct from earned zero, so settlement cannot guess a claim limit.
      */
     earnedNativeForX402Channel(channelId: string): Promise<number | undefined>;
     /**
-     * The credit an x402 settlement channel funded, if one is bound to it — the
-     * binding is UNIQUE, so at most one row can answer (internal-review).
-     *
-     * The operator repair's entry point: a wedged settlement row carries the
-     * channel and an `effect_id`, and this is what turns them back into the
-     * credit id, the caller pubkey, and the drain id the effect encodes. Deriving
-     * the credit id by splitting `effect_id` instead would be wrong — credit ids
-     * carry their own colons (`imp:`, `fnd:` and the rail segment inside them).
+     * Resolve the unique credit bound to the channel. The ID is opaque and can contain colons;
+     * do not reconstruct it by splitting settlement effect IDs.
      */
     getCreditByX402Channel(channelId: string): Promise<CreditSnapshot | undefined>;
-    /** Retire every active credit backed by a chain-proven lost Tempo channel. */
     terminalizeTempoCredits(evidence: TempoCreditLossEvidence, tx?: CreditLedgerQuerier): Promise<TempoCreditLoss[]>;
     private terminalizeTempoCreditsLocked;
-    /** List terminal Tempo credit losses, newest observation first. */
     listTempoCreditLosses(args?: {
         limit?: number;
     }): Promise<TempoCreditLoss[]>;
@@ -3498,36 +2894,21 @@ declare class CreditLedger {
      */
     terminalizeX402Credit(evidence: X402CreditLossEvidence, tx?: CreditLedgerQuerier): Promise<X402CreditLoss[]>;
     private terminalizeX402CreditLocked;
-    /** List terminal x402 credit losses, newest observation first. */
     listX402CreditLosses(args?: {
         limit?: number;
     }): Promise<X402CreditLoss[]>;
     /**
-     * Debit the caller's entire available balance into a drain liability
-     * (spec §5: expiry ends spending, never ownership — this is the
-     * builder-honored reclaim floor). Runs under the credit row lock: the
-     * amount is `balance − pending holds` read under `FOR UPDATE`, the balance
-     * is decremented in the same transaction, and the drain takes the next
-     * gap-free `ledger_seq` — so the balance zeroes exactly once however many
-     * machines race the request.
+     * Move all available balance to a drain liability under the credit lock; pending holds stay
+     * reserved. Expiry alone does not prevent reclaim before a sweep releases the balance.
+     * Repeating (creditId, drainId) returns the recorded liability; owner, method and payout
+     * conflicts refuse.
      *
-     * Idempotent on `(creditId, drainId)`: a replay returns the recorded drain
-     * (this is also the poll/pickup read). A replay whose `method` or `payout`
-     * differs from the recorded drain is refused with `drain_conflict` —
-     * silently honouring a changed payout would ship the caller's money to a
-     * destination they never signed alongside this `drain_id`.
-     *
-     * Pending holds are NOT drained — in-flight jobs keep their money until
-     * they settle or release. A release after a drain restores available
-     * balance the caller reclaims with a **new** `drain_id`; drains are ledger
-     * arithmetic, not a terminal credit state, so `status` stays `active`.
-     *
-     * Deliberately **no expiry check**: draining works before and after
-     * expiry. The one thing expiry gates is new draws.
+     * An unresolved channel refund blocks fresh drain IDs but admits its own effect ID for
+     * repair. Caller-supplied payout validation belongs to the route. With tx, join the channel
+     * transaction without controlling it.
      */
     requestDrain(args: {
         creditId: string;
-        /** Client-generated drain id from the signed request body. */
         drainId: string;
         /** Verified caller pubkey — a drain may only be requested by the owner. */
         callerPubkey: string;
@@ -3540,37 +2921,22 @@ declare class CreditLedger {
         tx?: CreditLedgerQuerier;
         nowMs?: number;
     }): Promise<DrainRequestResult>;
-    /** Read one drain (no lock), joined with its credit for currency + owner. */
     getDrain(args: {
         creditId: string;
         drainId: string;
     }): Promise<CreditDrainRecord | undefined>;
     /**
-     * One credit's undepleted funding lots, oldest first (internal-review) — the
+     * One credit's undepleted funding lots, oldest first — the
      * public read behind the reclaim's own arithmetic, for anything that needs
      * to show its work.
      */
     listFundingLots(creditId: string): Promise<FundingLot[]>;
     /**
-     * What this DVM owes back in satoshis if every open non-channel Bitcoin
-     * credit reclaimed right now (internal-review) — the deposit half of the hub
-     * balance, and the floor a payout sweep must never go below.
-     *
-     * Read entirely off the funding lots, at their own funding rates, with no
-     * exchange-rate lookup anywhere: the obligation is in kind, so a rate has
-     * nothing to say about it. Pending job holds are deliberately **not**
-     * subtracted — a hold either settles into revenue or releases back to the
-     * caller, and until it does, treating it as already earned would understate
-     * the floor. The figure is conservative by exactly that amount.
-     *
-     * The two coverage holes ride along rather than being folded in silently, so
-     * a gap reads as a gap: `uncovered` is a credit whose lots fall short of its
-     * balance, `unbacked` is one holding any open micro with no sats basis. A
-     * reclaim on either prices the **whole** balance off a live rate — the
-     * depletion refuses a mixture rather than blending two bases — so both are
-     * reported as the whole balance, and neither contributes to `depositSats`.
-     * A figure that counted the backed half of a mixed credit would be a floor
-     * the payout never matches.
+     * Host-wide in-kind Bitcoin deposit liability, excluding channel collateral. Credits with
+     * missing coverage or any basisless lot are reported as gaps and use the live-rate fallback
+     * rather than a guessed sats obligation. Group fiat micro by currency; never sum
+     * denominations.
+     * Pending job holds remain liabilities until settled because they may release to the caller.
      */
     bitcoinDepositLiability(): Promise<BitcoinDepositLiability>;
     /**
@@ -3583,46 +2949,21 @@ declare class CreditLedger {
      */
     listPendingDrains(): Promise<CreditDrainRecord[]>;
     /**
-     * One page of still-`pending` drains on a channel-backed credit, oldest
-     * first (no lock) — the operator's repair queue (internal-review).
-     *
-     * Keyset-paginated for the x402 settlement queue's reason: a wedged row
-     * never self-clears, so a caller that re-issues the same first page would
-     * never see past a `limit`-sized wall of them. The keyset is
-     * `(created_at, credit_id, drain_id)` — `created_at` is immutable, so no
-     * concurrent write can push an unexamined row past the cursor. It is a
-     * BIGINT of epoch milliseconds rather than a `TIMESTAMPTZ`, so the
-     * microsecond-vs-millisecond cursor trap that bit `listSettlements` cannot
-     * arise here: the value round-trips as the integer it already is.
-     *
-     * `createdBeforeMs` is the staleness floor. A healthy cooperative close
-     * moves the drain to `sent` inside the request that opened it, so anything
-     * younger is in flight rather than stuck.
-     *
-     * The method filter is `'tempo'`, and it is the one line here worth a second
-     * look: `init()` migrates the pre-internal-review `'mpp'` spelling away and
-     * `DrainMethod` no longer carries it, so a query naming it matches nothing a
-     * DVM has ever written. It named it anyway until internal-review's rename sweep and
-     * internal-review's live rung caught it independently — the whole operator queue
-     * read empty in production while every route test stayed green, because
-     * those run on `MemoryCreditLedger`, which filters on the typed value. The
-     * two implementations of this one predicate must be read together.
-     *
-     * A written-off row is excluded unless `includeResolved`: the operator has
-     * already decided about it, and leaving it on the live queue would re-serve
-     * a closed decision on every walk.
+     * Page pending Tempo-channel drains by (created_at, credit_id, drain_id), optionally
+     * age-bounded, excluding written-off rows. Accept the legacy mpp stored method as well as
+     * tempo so pre-migration drains remain repairable. Use the compound key for both ordering
+     * and continuation.
      */
     listChannelDrains(args: {
         limit: number;
         after?: ChannelDrainCursor;
         createdBeforeMs: number;
-        /** Which channel binding to walk. Today only Tempo has a repair. */
         rail: "tempo";
         includeResolved?: boolean;
     }): Promise<CreditDrainRecord[]>;
     /**
      * Record that an operator reviewed a floor-refused channel drain and is not
-     * booking it (internal-review). Books nothing anywhere — no status change, no
+     * booking it. Books nothing anywhere — no status change, no
      * balance movement, no platform report.
      *
      * A single-statement CAS on `written_off_at IS NULL`, so the first note on
@@ -3680,7 +3021,7 @@ declare class CreditLedger {
         creditId: string;
         drainId: string;
         token: string;
-        /** Cost evidence for a just-in-time mint (internal-review); absent on an accumulator park. */
+        /** Cost evidence for a just-in-time mint; absent on an accumulator park. */
         fulfilment?: DrainFulfilment;
         tx?: CreditLedgerQuerier;
         nowMs?: number;
@@ -3691,7 +3032,7 @@ declare class CreditLedger {
      * loss, so the caller's re-poll keeps returning the same token either way.
      *
      * Returns `replayed` because this is a **terminal** transition and the money
-     * has left at exactly one of these calls (internal-review): the platform drain
+     * has left at exactly one of these calls: the platform drain
      * report must be emitted by that caller and no other. Pass `tx` to write the
      * report through the same transaction as the CAS.
      */
@@ -3722,11 +3063,9 @@ declare class CreditLedger {
         nowMs?: number;
     }): Promise<DrainTransitionResult>;
     /**
-     * Append a countersigned reclaim-event receipt to the drain's evidence
-     * trail. A single-statement JSONB append — receipts are emitted after the
-     * state transition they attest, and losing one never loses money (the
-     * transition is the source of truth; the receipt is the proof the caller
-     * can carry away).
+     * Append an opaque supplied receipt observation to the drain’s JSONB evidence array.
+     * Issuance and authentication belong to callers/consumers; this store does not verify
+     * signatures. Preserve append order on replay/poll reads.
      */
     appendDrainReceipt(args: {
         creditId: string;
@@ -3735,35 +3074,17 @@ declare class CreditLedger {
         tx?: CreditLedgerQuerier;
     }): Promise<void>;
     private readDrain;
-    /** Re-read the credit join fields for a freshly-updated drain row. */
     private rejoin;
-    /** Shared refusal tail for the CAS transitions: idempotent replay or typed error. */
     private refuseTransition;
     /**
-     * Price a reclaim in kind and say which lots it takes (internal-review).
-     *
-     * The debits are returned whether or not the reclaim can be priced, and the
-     * caller applies them either way: the money is leaving the credit, so the
-     * lots have to shrink with it or the deposit-liability rollup would keep
-     * counting a balance that is gone.
-     *
-     * `owedSats` is `null` where {@link isInKindDepletion} refuses — the lots
-     * are short of the balance, or the covering lots carry no sats basis (a
-     * credit funded before internal-review). That row is priced off a live rate by the
-     * admin surface instead, which is what *every* row did before this change,
-     * so the fallback is the old behaviour rather than a new failure mode.
-     *
-     * What it publishes is **net of the delivery reserve** (internal-review): handing a
-     * refund over costs a mint fee and, when the notes have to be minted just in
-     * time, a Lightning hop. The caller carries that cost per internal-review, and a
-     * flat reserve is how they carry it without the figure moving — an
-     * actual-fee true-up could only be applied after the promise was made. The
-     * debits stay gross because they are denominated in micro and are what
-     * `releaseDrain` restores; only the sats figure is netted.
+     * Deplete FIFO lots even when they cannot price the reclaim; stale open lots must not
+     * remain behind a debited balance. Publish owedSats only with complete positive sats
+     * coverage, net of one delivery reserve. Otherwise preserve null for a live-rate fallback.
+     * Returned debits allow an unpaid drain release to restore the exact lots.
      */
     private reclaimInKind;
     /**
-     * This credit's undepleted funding lots, oldest first (internal-review).
+     * This credit's undepleted funding lots, oldest first.
      *
      * Ordered in SQL on the same `(created_at, lot_id)` key the partial index
      * carries, so FIFO is the index's own order rather than something a reader
@@ -3779,7 +3100,6 @@ declare class CreditLedger {
      * as every other balance move is.
      */
     private applyLotDebits;
-    /** Shared settle/release state machine — see the public JSDoc on each verb. */
     private resolveDraw;
     private resolveDrawLocked;
     /**
@@ -3788,13 +3108,12 @@ declare class CreditLedger {
      * success (harmless for read-only replay paths), rolls back on throw.
      */
     private withCreditLock;
-    /** `SELECT … FOR UPDATE` the credit row on `q` (which must be inside a transaction). */
     private lockCreditRow;
     private readDraw;
     /**
      * Held-but-unresolved totals for a credit, in all three units at once — the
      * fiat micro that defines available balance plus the rail-value remainders
-     * a new draw allocates against (internal-review). One round-trip, since every
+     * a new draw allocates against. One round-trip, since every
      * caller needs the micro sum anyway.
      */
     private pendingSums;
@@ -3803,24 +3122,20 @@ declare class CreditLedger {
     private readX402CreditLosses;
 }
 /**
- * The ledger surface the SDK server codes against (internal-review). Implemented by
- * the Postgres {@link CreditLedger} (production — spec condition 2 requires
- * the DVM's own Postgres) and by `MemoryCreditLedger` (devMode / in-process
- * tests / pool-less `createDVMServer` setups, mirroring the `MemoryJobStore`
- * precedent). The `tx` handles on `fund`/`draw` are meaningful only on the
- * Postgres implementation; the memory ledger ignores them — its operations
- * are synchronous-atomic in-process, so there is no rail transaction to join.
+ * Implemented by durable Postgres and per-process memory ledgers. Production funding menus
+ * require durable storage; memory is for explicit development and tests. Mutations accepting
+ * tx join the caller’s transaction; memory implementations ignore that handle.
  */
 interface CreditLedgerLike {
     /**
      * True when balances survive a restart and are visible fleet-wide
-     * (internal-review). The funding menu is suppressed on a non-durable ledger
+     * The funding menu is suppressed on a non-durable ledger
      * outside devMode: a caller who funds on machine A and draws on machine B
      * would get `credit_not_found`, so advertising credit there misadvertises.
      */
     readonly durable: boolean;
     /**
-     * Bind the durable x402 settlement state spending is gated on (internal-review).
+     * Bind the durable x402 settlement state spending is gated on.
      *
      * Optional because a host may wire a ledger implementation that has no such
      * gate; the SDK's own two both do. See
@@ -3829,7 +3144,6 @@ interface CreditLedgerLike {
     useX402SettlementGate?(gate: X402RefundSettlementGate): void;
     /**
      * Bind the outbox that reports credit-expiry releases and their revivals
-     * (internal-review).
      *
      * Optional, and absent on `MemoryCreditLedger`: an expiry release is a
      * durable liability fact, and a ledger whose balances do not survive a
@@ -3838,7 +3152,7 @@ interface CreditLedgerLike {
      */
     useCreditExpiryReleaseOutbox?(outbox: CreditExpiryReleaseOutbox): void;
     /**
-     * Release the undrawn remainder of every credit past its TTL (internal-review).
+     * Release the undrawn remainder of every credit past its TTL.
      * Optional on the same terms as the binder above. See
      * {@link CreditLedger.sweepExpiredCredits}.
      */
@@ -3850,7 +3164,7 @@ interface CreditLedgerLike {
     }>;
     /**
      * Ask that gate directly, so a route can refuse a wedged channel **before**
-     * the rail moves anything (internal-review). Optional on the same terms as the
+     * the rail moves anything. Optional on the same terms as the
      * binder above; an implementation without it simply gets no preflight, and
      * the ledger effect stays the authority. See
      * {@link CreditLedger.blockingX402Refund}.
@@ -3999,9 +3313,7 @@ interface CreditLedgerLike {
         creditId: string;
         drawId: string;
     }): Promise<DrawRecord | undefined>;
-    /** Read the sole draw linked to a stable pre-payment job id. */
     getDrawByJobId(jobId: string): Promise<DrawRecord | undefined>;
-    /** Read every draw linked to a job so retention can resolve all holds before redaction. */
     listDrawsByJobId(jobId: string): Promise<DrawRecord[]>;
     listPendingDraws(creditId: string): Promise<DrawRecord[]>;
     listStalePendingDraws(args: {
@@ -4034,9 +3346,8 @@ interface CreditLedgerLike {
         drainId: string;
     }): Promise<CreditDrainRecord | undefined>;
     listPendingDrains(): Promise<CreditDrainRecord[]>;
-    /** See {@link CreditLedger.bitcoinDepositLiability} — the in-kind deposit floor (internal-review). */
+    /** See {@link CreditLedger.bitcoinDepositLiability} — the in-kind deposit floor. */
     bitcoinDepositLiability(): Promise<BitcoinDepositLiability>;
-    /** One credit's undepleted funding lots, oldest first (internal-review). */
     listFundingLots(creditId: string): Promise<FundingLot[]>;
     listChannelDrains(args: {
         limit: number;
@@ -4098,14 +3409,12 @@ interface CreditLedgerLike {
 interface CreditLedgerQuerier {
     query: Pool["query"];
 }
-/** Reporter outbox joined to a draw release's own transaction (internal-review). */
 interface CreditDrawReleaseOutbox {
     /** Platform DVM record ID bound into the report. */
     dvmId: string;
     /** Reporter-owned insert executed through the ledger transaction. */
     enqueue: CreditDrawReleaseEnqueue;
 }
-/** Reporter seam for credit-expiry releases and the revivals that reverse them (internal-review). */
 interface CreditExpiryReleaseOutbox {
     /** Platform DVM record ID bound into the report. */
     dvmId: string;
@@ -4113,16 +3422,15 @@ interface CreditExpiryReleaseOutbox {
     enqueue: CreditExpiryReleaseEnqueue;
 }
 /**
- * One recorded expiry episode: a credit's undrawn remainder passing to the
- * builder when its TTL ran out (internal-review).
- *
- * `reversedAt` is set when a later funding revived the credit, at which point
- * the release stops counting against committed value — the row stays as the
- * record that it once did.
+ * One committed expiry episode. The sweep releases the undrawn remainder; later funding sets
+ * reversedAt and restores that release on the same transaction. Multiple episodes may share
+ * an expiry instant.
  */
 interface CreditExpiryRelease {
     creditId: string;
-    /** Per-expiry-episode key, derived from {@link CreditExpiryRelease.expiryMs}. */
+    /**
+     * Key derived from expiry instant and the release sequence counted under the credit lock.
+     */
     releaseId: string;
     callerPubkey: string;
     currency: string;
@@ -4130,31 +3438,29 @@ interface CreditExpiryRelease {
     rail: string | null;
     /** Fiat micro released, 1e-6 of `currency`. */
     amountMicro: number;
-    /** When the credit's TTL ran out — when the liability ended. */
+    /**
+     * Nominal credit expiry, ms since epoch; the claim is released only when the sweep commits.
+     */
     expiryMs: number;
-    /** When the sweep observed the expiry. */
+    /**
+     * When the sweep recorded this release, ms since epoch.
+     */
     releasedAt: number;
     /** When a funding revived the credit and undid this release. */
     reversedAt: number | null;
 }
-/** Pool-shaped handle (`query` + `connect`). Required for the locked write paths. */
 type CreditLedgerPool = Pick<Pool, "query" | "connect">;
 /**
- * Credit lifecycle status. `unbacked` is the terminal audit state for a Tempo
- * channel that finalized below its accepted voucher; its nominal balance is
- * preserved, but it can never be drawn, funded, grown, or drained.
+ * unbacked credit is unavailable for spending or reclaim while channel collateral is gone. An
+ * x402 credit with no remaining liability can be restored to active by channel
+ * reconciliation.
  */
 type CreditStatus = "active" | "unbacked";
 /** Draw lifecycle: two-phase hold → terminal settle/release. */
 type DrawStatus = "pending" | "settled" | "released";
 /**
- * Rails a drain can pay out on (internal-review, spec §5 tier 3).
- *
- * Direct Lightning payout is deliberately absent (internal-review / internal-review): a
- * first-party deployment holds no send-capable Lightning credential by design
- * (the funding NWC is receive-only, internal-review), so P2PK-locked Cashu notes are
- * the only non-channel Bitcoin reclaim path. Adding `lightning` back means
- * re-deciding that, not just widening a union.
+ * Drain payout rails. Direct Lightning send is excluded: deployments reclaiming Bitcoin can
+ * use Cashu notes without putting a spending wallet credential in the DVM.
  */
 type DrainMethod = "cashu" | "x402" | "tempo";
 /**
@@ -4167,7 +3473,7 @@ type DrainMethod = "cashu" | "x402" | "tempo";
  */
 type DrainStatus = "pending" | "parked" | "picked_up" | "sent" | "released";
 /**
- * The sats a DVM owes back on undrawn non-channel Bitcoin credit (internal-review) —
+ * The sats a DVM owes back on undrawn non-channel Bitcoin credit —
  * the deposit pot inside the hub's balance, which the operator's sweep may
  * never bank below.
  */
@@ -4193,16 +3499,24 @@ interface BitcoinDepositLiability {
     }[];
     /** Credits holding balance no funding lot backs — a defect, not a liability figure. */
     uncoveredCredits: number;
-    /** Their whole balance: a short-covered credit reclaims off a live rate entirely. */
-    uncoveredMicro: number;
+    /** Whole balances of short-covered credits, by ledger currency; reclaim uses a live rate. */
+    uncoveredByCurrency: {
+        currency: string;
+        micro: number;
+        credits: number;
+    }[];
     /** Credits holding any open micro with no sats basis, so their reclaim prices off a live rate. */
     unbackedCredits: number;
-    /** Their whole balance, for the same all-or-nothing reason. */
-    unbackedMicro: number;
+    /** Whole balances of basisless credits, by ledger currency. */
+    unbackedByCurrency: {
+        currency: string;
+        micro: number;
+        credits: number;
+    }[];
 }
 /**
  * What it cost to put a just-in-time-minted refund in the caller's hands
- * (internal-review), itemized on the drain row so the spend is auditable against the
+ * itemized on the drain row so the spend is auditable against the
  * hub's own transaction history long after the worker's log has rotated.
  *
  * `faceSats` is what the caller receives and equals the drain's published
@@ -4236,16 +3550,9 @@ interface CreditDrainRecord {
     currency: string;
     method: DrainMethod;
     /**
-     * The channel this drain's credit is bound to (Tempo session or x402
-     * settlement channel), `null` on a one-payment or Cashu/Lightning credit.
-     *
-     * The method alone does not say who settles a reclaim: an `mpp` or `x402`
-     * drain on a channel-bound credit is closed by the channel itself, and a
-     * `pending` one is routinely mid-reconciliation rather than owed by anybody
-     * — `completeTempoDrain` leaves every ambiguous close pending on purpose for
-     * `recoverTempoSessionClose` to finish on the caller's next poll. Carrying
-     * the binding on the record is what lets a reader tell that apart from a
-     * one-payment reclaim only a person can settle (internal-review).
+     * Reusable Tempo or x402 channel backing this drain, or null for one-payment/non-channel
+     * credit. The channel’s cooperative lifecycle owns fulfillment; the operator’s manual sent
+     * route refuses channel-bound drains.
      */
     channelId: string | null;
     /** Method-specific payout target as signed by the caller. */
@@ -4257,16 +3564,14 @@ interface CreditDrainRecord {
      * `null` on a rail that reports no native basis. This — not `amountMicro` —
      * is what an on-chain payout must be sized against, because the fiat figure
      * and the rail figure drift with the rate between funding and drain
-     * (internal-review).
      */
     drainedNative: number | null;
     /**
-     * What this reclaim owes in satoshis, computed from the credit's funding
-     * lots when it was requested and never re-priced (internal-review): the deposited
-     * sats, pro rata to the share of the credit being reclaimed, floored per
-     * lot. `null` on a channel rail (in-kind structurally, through the escrow)
-     * and on a Bitcoin credit whose lots cannot price it — that one falls back
-     * to a live rate on the admin surface.
+     * In-kind sats obligation fixed at request time: the decrease in FIFO lots’ remaining
+     * floored obligations, net of one delivery reserve. A non-null obligation is not repriced.
+     * Null on unpriceable non-channel Bitcoin refunds requires the live-rate Cashu fallback.
+     * Channel and stablecoin refunds also use null: they have no sats obligation and follow
+     * their native/channel payout lifecycle, using `drainedNative` where applicable.
      */
     owedSats: number | null;
     /**
@@ -4283,7 +3588,7 @@ interface CreditDrainRecord {
     /** Settlement evidence, present on `sent`. */
     sentRef: Record<string, unknown> | null;
     /**
-     * How a parked refund was sourced and what delivering it cost (internal-review).
+     * How a parked refund was sourced and what delivering it cost.
      *
      * `null` on an accumulator park — there the consumed rows *are* the record —
      * and on every non-cashu rail. Set only where the notes were minted just in
@@ -4292,7 +3597,10 @@ interface CreditDrainRecord {
      * already holding.
      */
     fulfilment: DrainFulfilment | null;
-    /** Countersigned reclaim-event receipts, in emission order. */
+    /**
+     * Opaque supplied reclaim-event observations in append order; consumers shape-check and
+     * authenticate them.
+     */
     receipts: Record<string, unknown>[];
     createdAt: number;
     parkedAt: number | null;
@@ -4301,7 +3609,7 @@ interface CreditDrainRecord {
     /** When an unfulfilled Tempo drain was restored to the credit balance. */
     releasedAt: number | null;
     /**
-     * Why an operator closed this drain out without booking it (internal-review), and
+     * Why an operator closed this drain out without booking it, and
      * when. Set only on a channel drain the payout floor refused: the chain paid
      * the caller less than this ledger was extinguishing, the operator reviewed
      * the two figures and is not booking the difference.
@@ -4336,7 +3644,6 @@ interface DrainWriteOff {
     drain: CreditDrainRecord;
     written: boolean;
 }
-/** Result of restoring an unfulfilled Tempo drain to its credit. */
 interface DrainReleaseResult {
     drain: CreditDrainRecord;
     credit: CreditSnapshot;
@@ -4344,7 +3651,7 @@ interface DrainReleaseResult {
 }
 /**
  * Result of a terminal drain transition — {@link CreditLedger.markDrainPickedUp}
- * and {@link CreditLedger.markDrainSent} (internal-review).
+ * and {@link CreditLedger.markDrainSent}.
  *
  * The record alone can't answer "did I move this money", because the CAS
  * winner and an idempotent replay return the same row. Anything that must
@@ -4356,7 +3663,6 @@ interface DrainTransitionResult {
     /** True when the drain was already terminal and this call changed nothing. */
     replayed: boolean;
 }
-/** Result of {@link CreditLedger.requestDrain}. */
 interface DrainRequestResult {
     drain: CreditDrainRecord;
     /** The credit as of this call — balance already debited on a fresh drain. */
@@ -4365,9 +3671,8 @@ interface DrainRequestResult {
     replayed: boolean;
 }
 /**
- * Read-model of one credit. `availableMicro` = `balanceMicro` − pending
- * holds; `expired` is computed from `expiryMs` at read time (expiry ends
- * spending, never ownership — the balance stays readable).
+ * Read model with funded balance and pending holds. Expiry is computed at read time and does
+ * not erase the record; unbacked credit has no available balance.
  */
 interface CreditSnapshot {
     creditId: string;
@@ -4375,23 +3680,26 @@ interface CreditSnapshot {
     currency: string;
     /** Funded balance, 1e-6 currency units. Pending holds are NOT subtracted. */
     balanceMicro: number;
-    /** Spendable balance: `balanceMicro` minus pending holds. */
+    /**
+     * Balance minus pending holds, or zero while backing is unbacked.
+     */
     availableMicro: number;
     /**
      * `availableMicro` in the funding rail's own units — the ceiling any
      * rail-denominated payout must respect. `null` marks a rail that reports no
      * native basis, which is why a channel drain refuses rather than guessing
-     * (internal-review).
      */
     nativeAvailable: number | null;
     expiryMs: number;
     expired: boolean;
     status: CreditStatus;
-    /** High-water `ledger_seq` — the seq of the most recent draw. */
+    /**
+     * High-water sequence shared by draw placements and drains.
+     */
     lastLedgerSeq: number;
     createdAt: number;
     /**
-     * The rail this balance was funded on (internal-review); `null` on a credit opened
+     * The rail this balance was funded on; `null` on a credit opened
      * before rail basis was recorded, which conflicts with nothing. Exposed so a
      * route can refuse a cross-rail top-up **before** taking the payment `fund`
      * would then refuse `rail_mismatch`.
@@ -4402,37 +3710,30 @@ interface CreditSnapshot {
     /** Reusable x402 channel bound to this credit, if one funded it. */
     x402ChannelId: string | null;
 }
-/**
- * Result of a draw — carries the receipt tuple the internal-review countersignature
- * consumes (`ReceiptCredit`: `draw_id`, `amount`, `balance_after`,
- * `ledger_seq`). `balanceAfterMicro` and `ledgerSeq` are the values recorded
- * when the draw was first placed; a replay returns them unchanged.
- */
 interface DrawResult {
     creditId: string;
     drawId: string;
     amountMicro: number;
-    /** Available balance immediately after this draw's hold, as first recorded. */
+    /**
+     * Recorded balance after placement or latest growth, at the draw’s original sequence.
+     */
     balanceAfterMicro: number;
-    /** Per-credit monotonic, gap-free draw counter. */
+    /**
+     * Per-credit gap-free sequence shared with drains; growth keeps the original value.
+     */
     ledgerSeq: number;
     status: DrawStatus;
     /** True when this call was an idempotent replay of an already-recorded state. */
     replayed: boolean;
-    /** Rail value allocated to this draw, plus the credit's rail identity (internal-review). */
+    /** Rail value allocated to this draw, plus the credit's rail identity. */
     railValue: DrawRailValue;
     /** When the draw reached its terminal state; `null` while pending. */
     resolvedAt: number | null;
 }
 /**
- * The rail-native slice of a credit that one draw carries (internal-review) — what
- * makes a settled draw bookable as a revenue event on the funding's rail.
- *
- * Allocated at draw time as `remaining × amountMicro / availableMicro`, where
- * both remainders are net of pending holds. The draw that consumes a credit's
- * last micro therefore takes ratio 1 and the exact remainder, so the draws of
- * a credit sum to precisely the value funded — no rounding residue, and no
- * last-draw special case.
+ * A draw’s rail value and funding identity. Placement records a pooled forecast; settling
+ * non-channel Bitcoin can replace it with FIFO lot pricing while retaining the original as
+ * allocatedMsats. Native null means no native amount was reported, distinct from zero.
  */
 interface DrawRailValue {
     /** Millisatoshis of rail value allocated to this draw. */
@@ -4441,7 +3742,7 @@ interface DrawRailValue {
     drawNative: number | null;
     /**
      * Rail that funded the credit — a {@link FundingMethod} on any row `fund`
-     * wrote, `null` on one it opened before internal-review recorded the column. Stays
+     * wrote, `null` on one it opened before recorded the column. Stays
      * `string` rather than the union: this is a database read, and a fleet
      * mid-rollout can hold a rail a newer build wrote ({@link isFundingRail}).
      */
@@ -4456,7 +3757,7 @@ interface DrawRailValue {
     creditCurrency: string | null;
 }
 /**
- * Result of `growDraw` (internal-review) — the draw's post-growth tuple, plus the
+ * Result of `growDraw` — the draw's post-growth tuple, plus the
  * slice this top-up added. The added slice is what the mid-job rail result
  * reports as its `paidMsats` delta: the job's counters accumulate increments,
  * not the running total the draw now holds.
@@ -4470,7 +3771,7 @@ interface GrownDrawResult extends DrawResult {
     /** Fiat micro this growth added — `amountMicro` minus the pre-growth amount. */
     addedAmountMicro: number;
     /**
-     * Fiat micro the internal-review cap refused, because growing by it would have
+     * Fiat micro the cap refused, because growing by it would have
      * pushed the draw past what the job cumulatively asked. Zero on every
      * ordinary top-up. Non-zero means money landed on the credit that this job
      * did not buy anything with — it stays the caller's available balance, and
@@ -4485,13 +3786,12 @@ interface DrawResolution extends DrawResult {
     /** Settlement instant — the timestamp a draw-keyed revenue event is dated by. */
     resolvedAt: number;
 }
-/** Full persisted draw row, camel-cased. */
 interface DrawRecord extends Omit<DrawResult, "replayed"> {
     jobId: string | null;
     createdAt: number;
     /**
      * What `allocateDrawValue` allocated this draw when the payment landed
-     * (internal-review) — the pro-rata slice of the credit's pooled rail value that
+     * the pro-rata slice of the credit's pooled rail value that
      * `withDrawBasis` mirrored onto the job's `paidMsats` counter.
      *
      * Equal to `railValue.drawMsats` on every draw the settle did not re-price,
@@ -4504,8 +3804,8 @@ interface DrawRecord extends Omit<DrawResult, "replayed"> {
     allocatedMsats: number;
 }
 /**
- * Keyset cursor into {@link CreditLedgerLike.listStalePendingDraws} (internal-review)
- * — the sort key of the last row a caller examined. Offset paging would not
+ * Keyset cursor into {@link CreditLedgerLike.listStalePendingDraws}, holding the
+ * sort key of the last row a caller examined; offset paging would not
  * do: the scan skips holds it can't resolve (their job row exists), so those
  * rows stay `pending` and reappear at the head of every subsequent page. The
  * tuple is `(createdAt, creditId, ledgerSeq)`, matching the read's `ORDER BY`;
@@ -4518,7 +3818,7 @@ interface StalePendingDrawCursor {
     ledgerSeq: number;
 }
 /**
- * Rail value one funding contributes to a credit (internal-review). Recorded so a
+ * Rail value one funding contributes to a credit. Recorded so a
  * later draw can be allocated its share of what the rail actually paid, and so
  * the platform can book the funding as a deposit.
  */
@@ -4527,11 +3827,11 @@ interface CreditFundingBasis {
      * The rail whose value this funding carries. A top-up on another rail is
      * refused (`rail_mismatch`).
      *
-     * Narrowed from `string` to {@link FundingMethod} by internal-review — the same type
+     * Narrowed from `string` to {@link FundingMethod} by — the same type
      * {@link FUNDING_RAILS} is keyed by — so a rail cannot enter `credits.rail`
      * that the terminal has no way to book revenue under. That silently costs
      * every draw the credit backs its booking, which is what happened when
-     * `lightning` reached the ledger before the reader's allow-list (internal-review).
+     * `lightning` reached the ledger before the reader's allow-list.
      */
     rail: FundingMethod;
     /** Rail payment value in millisatoshis. */
@@ -4555,9 +3855,11 @@ interface CreditFundingBasis {
         maxClaimableAmount: string;
     };
 }
-/** What {@link CreditLedger.fund} takes. Named so the private body can share the shape. */
 interface CreditFundArgs {
-    /** Omit to mint a fresh credit id; provide to top up (or idempotently create). */
+    /**
+     * Omit to mint a credit ID; provide to add funding to that credit. Replay prevention is the
+     * caller’s responsibility.
+     */
     creditId?: string;
     callerPubkey: string;
     /** The DVM's pricing currency; `amountMicro` is 1e-6 of it. */
@@ -4565,14 +3867,18 @@ interface CreditFundArgs {
     amountMicro: number;
     /** Absolute expiry, ms since epoch. Overwrites the previous value on top-up. */
     expiryMs: number;
-    /** Rail-value basis this funding contributes (internal-review, required by internal-review). */
+    /**
+     * Rail value contributed by this funding; required on writes.
+     */
     basis: CreditFundingBasis;
-    /** External transaction handle — caller owns BEGIN/COMMIT (spec condition 3). */
+    /**
+     * External transaction handle; caller owns BEGIN, COMMIT and ROLLBACK.
+     */
     tx?: CreditLedgerQuerier;
     nowMs?: number;
 }
 /**
- * Allocate a draw's share of a credit's unspent rail value (internal-review). Pure —
+ * Allocate a draw's share of a credit's unspent rail value. Pure —
  * shared by the Postgres and in-memory ledgers so the two can't drift.
  *
  * `availableMicro` and both remainders must be net of pending holds; the
@@ -4587,7 +3893,6 @@ declare function allocateDrawValue(args: {
     drawMsats: number;
     drawNative: number | null;
 };
-/** Full persisted `credit_fundings` row, camel-cased (internal-review). */
 interface FundingRecord {
     creditId: string;
     fundId: string;
@@ -4603,7 +3908,7 @@ interface FundingRecord {
     receipt: FundingReceipt | null;
 }
 /**
- * Lifecycle of a Lightning funding invoice (internal-review).
+ * Lifecycle of a Lightning funding invoice.
  *
  * Only `pending` is live; everything else is terminal. The two that carry no
  * balance carry opposite money: `expired` was never paid and owes nobody
@@ -4611,7 +3916,7 @@ interface FundingRecord {
  * operator. Both exist so that a row the sweep can never advance stops being
  * swept.
  *
- * `reconciled` and `written_off` (internal-review) are where a `blocked` row goes once
+ * `reconciled` and `written_off` are where a `blocked` row goes once
  * that operator acts — respectively, the money was credited onto a credit they
  * named, or they decided it would not be. Neither is `settled`: that one means
  * the ledger applied the payment to the top-up the caller asked for, and
@@ -4619,7 +3924,6 @@ interface FundingRecord {
  * human had to intervene.
  */
 type CreditInvoiceStatus = "pending" | "settled" | "expired" | "blocked" | "reconciled" | "written_off";
-/** Full persisted `credit_invoices` row, camel-cased (internal-review). */
 interface CreditInvoiceRecord {
     creditId: string;
     fundId: string;
@@ -4638,7 +3942,7 @@ interface CreditInvoiceRecord {
      * trail for why a human had to touch this row at all.
      */
     blockedReason: string | null;
-    /** Credit an operator sent a blocked invoice's money to (internal-review). */
+    /** Credit an operator sent a blocked invoice's money to. */
     reconciledCreditId: string | null;
     /** Funding key on that credit — the payment hash. See `reconcileBlockedInvoice`. */
     reconciledFundId: string | null;
@@ -4652,20 +3956,17 @@ interface CreditInvoiceRecord {
     /** When the payment landed at the wallet — never the instant an operator acted on it. */
     settledAt: number | null;
 }
-/** Outcome of applying an observed settlement to the ledger (internal-review). */
 interface InvoiceSettlement {
     invoice: CreditInvoiceRecord;
-    /** The `credit_fundings` row; absent only if a pre-internal-review row somehow lacks one. */
+    /** The `credit_fundings` row; absent only if a legacy row somehow lacks one. */
     funding: FundingRecord | undefined;
     credit: CreditSnapshot | undefined;
     /** True when this settlement had already been applied — nothing moved. */
     replayed: boolean;
 }
 /**
- * Outcome of an operator crediting a blocked invoice onto a credit they named
- * (internal-review). Same shape as {@link InvoiceSettlement}, but `funding` and
- * `credit` describe the **target** credit, not the one the invoice was minted
- * against.
+ * Reconciliation keeps the original invoice identity; funding and credit describe the
+ * operator-selected target credit, which may differ from the invoice’s original credit.
  */
 interface InvoiceReconciliation {
     invoice: CreditInvoiceRecord;
@@ -4674,7 +3975,6 @@ interface InvoiceReconciliation {
     /** True when this reconcile had already been applied — nothing moved. */
     replayed: boolean;
 }
-/** Outcome of `writeOffBlockedInvoice` — the recorded row, plus whether this call wrote it. */
 interface InvoiceWriteOff {
     invoice: CreditInvoiceRecord;
     /** False when the invoice was already written off, so nothing changed. */
@@ -4686,31 +3986,13 @@ interface BlockedInvoiceCursor {
     creditId: string;
     fundId: string;
 }
-/** Typed failure codes for {@link CreditLedgerError}. */
 type CreditLedgerErrorCode = "credit_not_found" | "credit_expired" | "credit_unbacked" | "tempo_channel_closing" | "tempo_settlement_pending" | "settlement_pending" | "insufficient_credit" | "draw_conflict" | "draw_not_found" | "invalid_draw_state" | "funding_replayed" | "currency_mismatch" | "caller_mismatch" | "rail_mismatch" | "invalid_amount" | "invalid_expiry" | "invalid_basis" | "nothing_to_drain" | "drain_below_dust" | "drain_not_found" | "drain_conflict" | "invalid_drain_state" | "invoice_not_found" | "invoice_conflict" | "invoice_not_blocked" | "below_rail_minimum";
 /**
- * Which conflict a `drain_conflict` is, for the routes that answer one (internal-review).
- *
- * One code covers refusals whose only common property is that no drain was
- * booked; the copy a caller relays to a human differs entirely between them.
- * A tag rather than a message substring because that is what the copy used to
- * key on, and both of the x402 commit leg's conflicts missed it by a word —
- * silently, since the fallback is a well-formed answer about a different
- * refusal.
- *
- * The three are not one shape with three causes. `pending_draws` and
- * `balance_moved` roll back with nothing on any chain and clear on their own;
- * `refund_floor` is the opposite — the cooperative refund reached the chain and
- * paid short, so the caller's money moved and only the operator repair resolves
- * it (internal-review). A route's `retryable` and `drain_registered` follow from which
- * one it is, so the tag has to reach it.
- *
- * Absent means the duplicate-payout conflict `PAYMENT_ERROR_COPY.drain_conflict`
- * was written for, which is also the conservative default for a conflict nobody
- * has classified yet.
+ * Structured drain_conflict reasons select caller instructions without matching prose. A
+ * refund_floor shortfall needs operator resolution, unlike duplicate payout; foreign_credit
+ * discloses no liability to the wrong owner; drain_id_retired requires a fresh ID.
  */
 type DrainConflictReason = "pending_draws" | "balance_moved" | "refund_floor";
-/** Structured context on a {@link CreditLedgerError}, per code. */
 interface CreditLedgerErrorDetails {
     /** On `drain_conflict`: which conflict it is, so a route can answer it without matching on prose. */
     drainConflict?: DrainConflictReason;
@@ -4740,13 +4022,13 @@ interface CreditLedgerErrorDetails {
     settlementId?: string;
     /** On `settlement_pending`: that settlement's status, so an operator sees which repair applies. */
     settlementStatus?: string;
-    /** On `settlement_pending`: the drain id that settlement is under — the one id this gate admits (internal-review). */
+    /** On `settlement_pending`: the drain id that settlement is under — the one id this gate admits. */
     blockingDrainId?: string;
 }
 /**
  * Thrown by every {@link CreditLedger} method on refusal. Carries a `code`
  * discriminator (plus structured `details`) so callers branch on a field
- * instead of string-matching messages — the internal-review quote surface maps
+ * instead of string-matching messages — the quote surface maps
  * `insufficient_credit` + `details.availableMicro` onto the structured
  * 402-class wire error.
  */
@@ -4810,7 +4092,8 @@ interface TempoSessionLifecycle {
  *
  * Every mutation takes an advisory transaction lock keyed by the channel
  * before locking its row with `FOR UPDATE`, applies mppx's synchronous
- * transition exactly once, and commits before returning. The advisory lock
+ * transition and commits before returning. Transaction recovery may retry a callback
+ * attempt; a rolled-back attempt is not a second committed transition. The advisory lock
  * covers a channel's first write, when there is no row for `FOR UPDATE` to
  * lock. Together these are the cross-machine linearization point for voucher,
  * top-up, spend, and close state; mppx's process-local fallback is
@@ -4822,14 +4105,14 @@ interface TempoSessionLifecycle {
  * parent-credit lock through the same client.
  *
  * {@link withVoucherAcceptance} acquires its pooled client **lazily**, on the
- * first store mutation rather than up front (internal-review). Its `operation` is
+ * first store mutation rather than up front. Its `operation` is
  * mppx's credential verification, which does the chain work before it touches
  * the store: an `open` submits the escrow transaction and awaits its receipt,
  * a `voucher` reads channel state over public RPC. Holding a connection across
  * that starves everything else on the shared host pool — `/v1/job`, the job
  * store, KV, the credit ledger, the replay store — and exposes the open
  * transaction to `idle_in_transaction_session_timeout`. This is the same shape
- * internal-review removed from the x402 settlement path. Laziness costs nothing in
+ * removed from the x402 settlement path. Laziness costs nothing in
  * atomicity: the `FOR UPDATE` row lock was always taken at the first mutation,
  * never at `BEGIN`, so the critical section is unchanged — only the
  * connection-holding window shrinks to the database work it actually covers.
@@ -4838,13 +4121,10 @@ declare class PostgresTempoSessionStore implements Store.AtomicStore {
     private readonly pool;
     private readonly acceptance;
     constructor(pool: Pool);
-    /** Create the channel table under the SDK-wide migration lock. */
     init(): Promise<void>;
-    /** Read one channel snapshot. */
     get(key: string): Promise<unknown>;
     /** Replace one channel snapshot. Used by mppx only for non-RMW maintenance. */
     put(key: string, value: unknown): Promise<void>;
-    /** Delete one channel snapshot. */
     delete(key: string): Promise<void>;
     /** Atomic read-modify-write using a row lock shared by every SDK replica. */
     update<result>(key: string, fn: (current: unknown) => Store.Change<unknown, result>): Promise<result>;
@@ -4933,14 +4213,14 @@ interface MppOpts {
     /**
      * When set, only register MPP methods whose name appears in this list, even
      * if the per-rail env var (`DVMKIT_TEMPO_RECIPIENT`) is configured
-     * (internal-review). Lets operators temporarily disable a rail without unsetting
+     * Lets operators temporarily disable a rail without unsetting
      * other knobs. Empty/undefined falls back to "register everything that has
      * a configured recipient".
      */
     methodsAllowlist?: string[];
     /**
      * Durable replay protection for the one-shot `tempo/charge` method
-     * (internal-review). Omit and mppx falls back to `Store.memory()`, whose consumed
+     * Omit and mppx falls back to `Store.memory()`, whose consumed
      * transaction hashes are per-process — invisible to sibling machines and lost
      * on restart. Pass a cross-machine store (`PostgresTempoChargeStore`) on any
      * multi-instance deploy.
@@ -4970,7 +4250,7 @@ interface MppOpts {
             amount?: string | bigint;
             intervalMs?: number;
             /**
-             * How long a settlement holds its in-flight lease (internal-review). Defaults to
+             * How long a settlement holds its in-flight lease. Defaults to
              * {@link TEMPO_SETTLEMENT_LEASE_MS}, which documents the receipt-timeout
              * floor an override has to stay above.
              */
@@ -5031,7 +4311,7 @@ interface MppxServer {
      * Reconcile active TIP-1034 channels; present only on a durable session
      * handle. `inFlight` counts channels the sweep found due but declined to
      * settle because another path already holds their settlement lease
-     * (internal-review) — a deferral, not a failure.
+     * a deferral, not a failure.
      */
     sweepTempoSessions?: () => Promise<{
         scanned: number;
@@ -5041,7 +4321,7 @@ interface MppxServer {
     }>;
     /**
      * Reconcile and, if the channel is at risk, settle exactly one TIP-1034
-     * channel (internal-review). The forced-close protection path: a verified on-chain
+     * channel. The forced-close protection path: a verified on-chain
      * `CloseRequested` event authorises this and nothing else.
      *
      * Needs no `listActive`, unlike {@link sweepTempoSessions} — a store that
@@ -5074,7 +4354,7 @@ interface MppxServer {
     /** Recover a close result after a process failure between chain and ledger commits. */
     recoverTempoSessionClose?: (channelId: string, drainId: string) => Promise<string | null>;
     /**
-     * Read a channel's close intent without touching it (internal-review).
+     * Read a channel's close intent without touching it.
      *
      * The operator repair needs the reference a confirmed close already carries,
      * and it must not be `recoverTempoSessionClose`: that one *writes* — an
@@ -5086,14 +4366,14 @@ interface MppxServer {
     /** Read terminally consumed value for an exact cooperative-close challenge. */
     getTempoSessionSpent?: (channelId: string) => Promise<bigint>;
     /**
-     * Read the immutable chain binding of a stored channel (internal-review), or `null`
+     * Read the immutable chain binding of a stored channel, or `null`
      * when this DVM holds no such channel. What a close event must match before
      * it may authorise anything.
      */
     getTempoSessionBinding?: (channelId: string) => Promise<TempoChannelBinding | null>;
     /**
      * Fetch a transaction receipt from this DVM's **own** configured Tempo RPC
-     * (internal-review) — the independent read that makes a close-event locator
+     * the independent read that makes a close-event locator
      * self-verifying rather than something the platform asserts.
      */
     getTempoReceipt?: (args: {
@@ -5107,7 +4387,7 @@ interface MppxServer {
         }[];
     } | null>;
     /**
-     * Read what a landed cooperative close actually paid out (internal-review).
+     * Read what a landed cooperative close actually paid out.
      *
      * mppx decodes `ChannelClosed` while verifying the close credential and then
      * drops both amounts — its session receipt carries only the channel, the
@@ -5132,7 +4412,7 @@ interface TempoChannelCloseAmounts {
     refundedToPayer: bigint;
 }
 /**
- * What a targeted single-channel settlement did (internal-review).
+ * What a targeted single-channel settlement did.
  *
  * The platform's close observer acknowledges its durable event on a terminal
  * outcome and retries otherwise, so the distinctions here are a delivery
@@ -5140,16 +4420,16 @@ interface TempoChannelCloseAmounts {
  *
  * - `settled` — a settlement transaction landed for this channel.
  * - `already_safe` — the on-chain watermark already covers every accepted
- *   voucher, so there is nothing to protect. A replay lands here.
+ * voucher, so there is nothing to protect. A replay lands here.
  * - `unknown_channel` — not in this DVM's durable store. Terminal: a DVM must
- *   never settle a channel it does not own.
+ * never settle a channel it does not own.
  * - `finalized_before_protection` — the channel finalized while it still owed
- *   us value. A **money incident**, not a success: the grace period elapsed
- *   without settlement and the deposit is gone. Preserved and paged, never
- *   quietly acknowledged.
+ * us value. A **money incident**, not a success: the grace period elapsed
+ * without settlement and the deposit is gone. Preserved and paged, never
+ * quietly acknowledged.
  * - `retryable_failure` — a chain read or settlement attempt failed, or another
- *   path is already broadcasting a settlement for this channel (internal-review). The
- *   event stays pending and is retried inside the grace period.
+ * path is already broadcasting a settlement for this channel. The
+ * event stays pending and is retried inside the grace period.
  */
 type TempoChannelSettlementOutcome = {
     outcome: "settled";
@@ -5174,7 +4454,6 @@ type TempoChannelSettlementOutcome = {
 };
 /**
  * The immutable chain identity a TIP-1034 channel was opened against
- * (internal-review).
  *
  * Doubles as the close-event authorisation record and as what the DVM reports
  * to the platform so a close can be routed back to it. `payee` is the DVM's
@@ -5225,7 +4504,6 @@ declare const _testing: {
     attachTempoSessionRuntime: typeof attachTempoSessionRuntime;
 };
 
-/** Envelope fields the verifier validates around the signed payload. */
 interface CanonicalEnvelope {
     pubkey: string;
     signature: string;
@@ -5233,26 +4511,24 @@ interface CanonicalEnvelope {
     nonce: string;
     auth_statement?: SignedRequestStatementHeader;
 }
-/** Options for `createSignedRequestVerifier`. */
 interface CreateSignedRequestVerifierOpts {
     /** Fixed audience/operation for a custom signed route or standalone verifier. */
     domain?: SignedRequestDomain;
     /**
-     * Permitted clock drift in seconds. Defaults to 300 (5 minutes — matches
-     * cast's `SIGNATURE_DRIFT_SECONDS`).
+     * Permitted clock drift in seconds; default 300.
      */
     driftSeconds?: number;
     /**
-     * Field names to strip from the parsed input when computing the canonical
-     * bytes the signature covers. Defaults to `["signature"]`. The signature
-     * itself is always stripped (callers don't need to repeat it).
+     * Fields stripped from raw input when forming signing bytes; default signature,
+     * which is always stripped even when additional fields are configured.
      */
     envelopeFields?: string[];
     /**
      * Field names removed from the input before `schema` validates it — and
      * **kept** in the canonical bytes the signature covers. For protocol-reserved
-     * keys the caller signs but the schema never declares: the internal-review credit
-     * envelope riding a capability schema (internal-review). Defaults to none.
+     * keys the caller signs but the schema never declares: the credit
+     * envelope riding a capability schema. No additional fields are ignored by default;
+     * auth_statement is always excluded from schema validation.
      *
      * This is the one place where "what is validated" and "what is signed"
      * legitimately differ. Don't reach for it to paper over a schema mismatch —
@@ -5267,7 +4543,6 @@ interface CreateSignedRequestVerifierOpts {
     /** Current Unix-seconds source. Defaults to `() => Math.floor(Date.now() / 1000)`. */
     now?: () => number;
 }
-/** Minimal replay-store contract — same shape as cast's `ReplayStore`. */
 interface SignedRequestReplayStore {
     /**
      * True iff (pubkey, timestamp, nonce) was already seen within the retention
@@ -5277,7 +4552,6 @@ interface SignedRequestReplayStore {
      */
     checkAndRecord(pubkey: string, timestamp: number, nonce: string, now: number): Promise<boolean>;
 }
-/** Options for the signer half. */
 interface SignedRequestSignOpts {
     /** Unix timestamp in seconds. Defaults to `now()`. */
     timestamp?: number;
@@ -5285,21 +4559,9 @@ interface SignedRequestSignOpts {
     nonce?: string;
 }
 /**
- * Round-trip verifier + signer for secp256k1+BIP-340 Schnorr-signed protocol
- * requests (internal-review, internal-review, internal-review).
- *
- * Authentication is two-step so the replay nonce is committed iff a job is
- * created, not on every request entry:
- *
- * 1. {@link checkAuth} runs schema → drift → signature at request entry on
- *    both `/v1/quote` and `/v1/job`. Sync; no replay-store touch.
- * 2. {@link recordReplay} commits `(pubkey, timestamp, nonce)` to the replay
- *    store. Called from `/v1/job` only, after upfront payment is verified
- *    and immediately before `jobManager.createJob`.
- *
- * The unpaid `/v1/job` warmup probe (price discovery → 402) thus no longer
- * burns the nonce — clients can re-submit the same envelope with a real
- * payment.
+ * Authentication does not touch replay state. Job submission commits replay
+ * only after upfront payment verification, so unpaid discovery cannot burn
+ * the nonce. Reactivation rechecks the persisted signature without drift/replay.
  */
 interface SignedRequestVerifier<T> {
     /**
@@ -5310,7 +4572,7 @@ interface SignedRequestVerifier<T> {
     checkAuth(input: unknown, domain?: SignedRequestDomain): T & CanonicalEnvelope;
     /**
      * Schema + signature check against `input`, without the drift window check
-     * or replay-store touch (internal-review). For the reactivation path where the
+     * or replay-store touch. For the reactivation path where the
      * persisted timestamp is from the original signing instant (could be hours
      * or days ago) and the replay nonce was already committed at submission.
      * Returns the verified envelope; throws {@link SignedRequestError} with
@@ -5333,20 +4595,11 @@ interface SignedRequestVerifier<T> {
      */
     signRequest(privkey: Uint8Array, body: Record<string, unknown>, opts?: SignedRequestSignOpts, domain?: SignedRequestDomain): T & CanonicalEnvelope;
 }
-/** Failure mode taxonomy returned from `verify()`. */
 type SignedRequestFailure = "schema_invalid" | "timestamp_drift" | "signature_invalid" | "replay_detected";
 /**
- * The four fields every signed-request envelope carries around the payload,
- * with the runtime type each must have once the schema has parsed.
- *
- * The single definition of "which part of a schema failure is the envelope's":
- * the post-parse shape check in `parse()` iterates it, and `authErrorBody`'s
- * internal-review classifier reads its keys to decide whether a `schema_invalid` throw
- * is the caller's *input* being wrong (disclosable: the schema is public on
- * `/v1/info`) or their *signing* being wrong (folded into `signature_invalid`,
- * one answer for every key and signature failure). `satisfies` pins it to
- * {@link CanonicalEnvelope}, so a fifth envelope field can't be added to the
- * type without both readers picking it up.
+ * One definition of envelope field types shared by the runtime shape guard
+ * and error disclosure classifier. Envelope failures stay private; violations
+ * of the published builder input schema can be disclosed.
  */
 declare const SIGNED_ENVELOPE_TYPES: {
     readonly pubkey: "string";
@@ -5355,14 +4608,12 @@ declare const SIGNED_ENVELOPE_TYPES: {
     readonly nonce: "string";
     readonly auth_statement: "object";
 };
-/** The envelope field names — {@link SIGNED_ENVELOPE_TYPES}' keys. */
 declare const SIGNED_ENVELOPE_FIELDS: readonly (keyof CanonicalEnvelope)[];
-/** Structured error from `verify()` — `sub_reason` is the failure kind. */
 declare class SignedRequestError extends Error {
     readonly sub_reason: SignedRequestFailure;
     /**
      * The Zod issues behind a `schema_invalid`, when the failure came from a
-     * `safeParse` that produced any (internal-review). `authErrorBody` reads their
+     * `safeParse` that produced any. `authErrorBody` reads their
      * paths to tell an input violation from an envelope one, and renders the
      * input half into the caller-facing `display`. Absent on every other
      * `sub_reason`, and on the `schema_invalid` throws that aren't a parse
@@ -5374,7 +4625,7 @@ declare class SignedRequestError extends Error {
     constructor(message: string, sub_reason: SignedRequestFailure, 
     /**
      * The Zod issues behind a `schema_invalid`, when the failure came from a
-     * `safeParse` that produced any (internal-review). `authErrorBody` reads their
+     * `safeParse` that produced any. `authErrorBody` reads their
      * paths to tell an input violation from an envelope one, and renders the
      * input half into the caller-facing `display`. Absent on every other
      * `sub_reason`, and on the `schema_invalid` throws that aren't a parse
@@ -5384,39 +4635,15 @@ declare class SignedRequestError extends Error {
     issues?: readonly z.core.$ZodIssue[] | undefined);
 }
 /**
- * Build a secp256k1+BIP-340 Schnorr-over-canonical-JSON request verifier
- * (internal-review, internal-review, internal-review).
- *
- * Generalises cast's `canonicalSignedPayload` + `verifyCanonicalSignedRequest`
- * into a reusable primitive — `(schema, opts) -> { verify, canonicalBytes, signRequest }`.
- * Both halves derive their canonical bytes through the same function so any
- * Zod schema change automatically propagates to both signer and verifier.
+ * Signatures cover the raw input, not Zod-parsed output. Schema validation
+ * may apply defaults or transformations without changing the signed bytes.
  */
 declare function createSignedRequestVerifier<T = unknown>(schema: ZodLike<T>, opts?: CreateSignedRequestVerifierOpts): SignedRequestVerifier<T>;
 /**
- * The wire object the caller signed, taken out of a request body (internal-review).
- *
- * **The single definition of which bytes get verified, and every auth call site
- * reads it**: `/v1/quote`, the `/v1/job` submit, and the internal-review reactivation
- * re-verify. They used to disagree — quote checked the raw `body.data`, submit
- * checked `JobManager.parseInput`'s Zod output — so the two agreed only where
- * the parse happened to be an identity on the caller's payload. A nested
- * `.default()`, a `.transform()`, a `z.coerce.*`, or any key the caller sent
- * that the schema doesn't declare made the quote pass and the paid submit 401
- * `signature_invalid`, blaming the signature for a schema shape the caller
- * never saw.
- *
- * Raw is what `public SDK documentation` specifies ("take the body, remove the
- * `signature` field, and canonicalise"), what the CLI signs, and what the SDK
- * persists as `record.input` — so the parsed form has no claim here. The
- * capability schema still validates what the handler receives; it just doesn't
- * get to rewrite the bytes the signature covers. It also means the credit
- * envelope needs no re-merge: it never left.
- *
- * `body.data` wins when present; otherwise the JSON-encoded `body.input` form
- * is parsed. Anything else — no input at all, a non-JSON legacy string — yields
- * `{}`, which carries no envelope and so fails the auth check, exactly as
- * before.
+ * Raw structured input for authentication and durable replay. data wins;
+ * otherwise input is parsed as JSON, with absent/legacy text becoming {}.
+ * Builder validation may transform the handler input but cannot rewrite these
+ * signing bytes, including protocol-owned credit fields.
  */
 declare function signedRequestInput(body: {
     input?: string;
@@ -5427,13 +4654,13 @@ declare function signedRequestInput(body: {
  * cross-machine `SignedRequestReplayStore` is supplied. 10-minute retention
  * window, 100k entry cap, per-process. Exported so `secp256k1Auth(...)` can
  * pre-build one and share it across every per-schema verifier plus its own
- * `recordReplay` path (internal-review).
+ * `recordReplay` path.
  *
  * When the cap is hit after the time-expired sweep, fresh inserts are
  * **rejected** (return `true` — treated as replay at the wire) rather than
  * silently evicting an in-window entry. Silent eviction would flush a
  * still-valid nonce back to "unseen" and let an attacker who can drive cap
- * pressure replay it (internal-review). A rate-limited structured warning fires so
+ * pressure replay it. A rate-limited structured warning fires so
  * operators see saturation in `fly logs`; reaching cap means in-memory has
  * been pushed past where it's safe and the deploy should move to
  * `PostgresReplayStore`.
@@ -5441,55 +4668,15 @@ declare function signedRequestInput(body: {
 declare function createDefaultReplayStore(): SignedRequestReplayStore;
 
 /**
- * A DVM-level auth scheme, declared on `DVMDescriptor.auth`. Authentication
- * is two-step (internal-review):
- *
- * 1. {@link checkAuth} fires at request entry on `/v1/quote` and `/v1/job`,
- *    before payment verification. Schema / drift / signature checks only —
- *    no replay-store touch. Unsigned / malformed / stale / wrong-sig
- *    envelopes reject with HTTP 401 with no Cashu round-trip and no pending
- *    revenue row (internal-review).
- * 2. {@link recordReplay} fires on `/v1/job` only, after upfront payment is
- *    verified and immediately before `jobManager.createJob`. Commits the
- *    `(pubkey, timestamp, nonce)` tuple to the replay store; throws 401
- *    `replay_detected` on duplicate. The unpaid 402-discovery hop does not
- *    burn the nonce, so clients can re-submit with payment.
- *
- * On `replay_detected` after payment was already accepted, the SDK responds
- * 401 fail-closed uniformly across cashu / mppx / x402 — no rail-specific
- * refund or compensation logic (internal-review / internal-review). The Cashu accept path
- * commits proofs into the accumulator wallet inside `verifyUpfrontPayment`
- * before `recordReplay` runs (internal-review rejects unlocked Cashu upstream, so
- * the accumulator is the only production path), so no proofs are held to
- * refund; mppx / x402 credentials are single-use and already consumed by
- * the facilitator.
- *
- * The SDK picks the active capability's `input` schema and dispatches the
- * `checkAuth` call against it — schemes themselves take no schema parameter,
- * so one declaration covers every capability under a multi-capability DVM.
- *
- * A scheme validates the input it is handed, and on `/v1/job` that input
- * carries the credit envelope (`credit_id` / `draw_id` / `fund`) because the
- * signature covers it. Those keys are the protocol's, not the capability's, so
- * a scheme must not fail a schema that doesn't declare them — `secp256k1Auth`
- * removes them for the schema check only, keeping the signing bytes verbatim
- * (internal-review). A custom scheme owes callers the same tolerance, or every strict
- * schema 401s on an explicit draw.
+ * Boot-summary backend: postgres is shared across machines; memory is per-process.
+ * Explicit user-supplied stores and null (disabled) are never overridden.
  */
+type ReplayStoreBackend = "postgres" | "memory" | "user-supplied" | "disabled";
 /**
- * The replay-store backend resolved at host-boot time (internal-review). Surfaced in
- * the boot summary so operators see which protection is active.
- *
- * - `postgres` — SDK auto-wired a `PostgresReplayStore` against the host's
- *   pool. Cross-machine safe.
- * - `memory` — SDK fell back to the in-memory FIFO. Per-process; unsafe for
- *   multi-machine deploys. `createDVMHost` emits a warning (or throws under
- *   `DVMKIT_FAIL_FAST=true`) when this kicks in outside `devMode`.
- * - `user-supplied` — user passed an explicit `replayStore` at factory time.
- *   SDK doesn't override.
- * - `disabled` — user passed `replayStore: null`. No replay tracking.
+ * Auth runs before payment; replay commits after accepted upfront payment.
+ * Custom schemes must validate builder input while tolerating signed protocol
+ * fields (credit, recovery and auth statement) outside the builder schema.
  */
-type ReplayStoreBackend = "postgres" | "memory" | "user-supplied" | "disabled";
 interface DVMAuthScheme {
     /** Wire-level identifier surfaced on `/v1/info#auth`. */
     readonly id: typeof SIGNED_REQUEST_AUTH_ID;
@@ -5499,19 +4686,15 @@ interface DVMAuthScheme {
         envelope: T & CanonicalEnvelope;
     };
     /**
-     * Re-verify the signature on a persisted envelope at reactivation time
-     * (internal-review). Schema + signature only — no drift check, no replay-store
-     * touch. Catches DB-layer tampering: persisted `record.input` would
-     * otherwise be trusted as authentic, and a compromised row could feed an
-     * attacker-supplied pubkey/envelope into the handler. Throws
-     * {@link SignedRequestError} with `sub_reason: "signature_invalid"` or
-     * `"schema_invalid"` on failure.
+     * Reactivation validates schema and signature without timestamp drift or replay
+     * checks: the original timestamp and already-committed nonce must remain usable.
+     * Throws signature_invalid or schema_invalid on failed validation.
      */
     recheckSignature<T>(schema: ZodLike<T>, input: unknown, domain?: SignedRequestDomain): void;
     /** Commit the envelope's `(pubkey, timestamp, nonce)` to the replay store. Throws on duplicate. */
     recordReplay(envelope: CanonicalEnvelope): Promise<void>;
     /**
-     * Called by `createDVMHost` after the Postgres pool is resolved (internal-review).
+     * Called by `createDVMHost` after the Postgres pool is resolved.
      * The SDK passes a Postgres store when one is available; the scheme adopts
      * it iff the user did not supply `replayStore` explicitly at factory time.
      * Returns the resolved backend for boot-summary logging. User code should
@@ -5521,20 +4704,11 @@ interface DVMAuthScheme {
         postgresStore?: SignedRequestReplayStore;
     }): ReplayStoreBackend;
 }
-/** Options for `secp256k1Auth()`. */
 interface Secp256k1AuthOpts {
     /**
-     * Override the replay-window store. Most callers should omit this opt:
-     * `createDVMHost` auto-wires a cross-machine `PostgresReplayStore` when a
-     * pool is available, and falls back to a bounded in-memory FIFO (10-min
-     * window, 100k cap) only when no pool exists — emitting a warning (or
-     * throwing under `DVMKIT_FAIL_FAST=true`) outside `devMode` so multi-machine
-     * deploys can't silently inherit the per-process default (internal-review).
-     *
-     * Pass a custom `SignedRequestReplayStore` here only to override that
-     * default (e.g. a different cross-machine backend), or pass `null` to
-     * disable replay tracking entirely. Any explicit value — including `null` —
-     * locks the choice: the host-boot wiring never overrides it.
+     * Omitting this lets the host adopt Postgres, otherwise falling back to a
+     * bounded per-process store with a warning or fail-fast refusal outside dev mode.
+     * Any explicit store, including null to disable replay tracking, is locked.
      */
     replayStore?: SignedRequestReplayStore | null;
     /** Permitted clock drift in seconds. Defaults to 300 (5 minutes). */
@@ -5543,31 +4717,16 @@ interface Secp256k1AuthOpts {
     now?: () => number;
 }
 /**
- * Build a descriptor-level secp256k1+BIP-340 Schnorr auth scheme (internal-review,
- * internal-review).
- *
- * Declare on `configureDVM({ auth: secp256k1Auth({...}) })` to gate every
- * capability's `/v1/job` and `/v1/quote` on a signed request envelope
- * (`pubkey` / `signature` / `timestamp` / `nonce`) over the canonical JSON
- * form of the capability's input. The SDK calls {@link DVMAuthScheme.checkAuth}
- * at request entry on both endpoints, and {@link DVMAuthScheme.recordReplay}
- * on `/v1/job` only — after upfront payment is verified, just before the job
- * is created. The 402-discovery hop on `/v1/job` therefore does not consume
- * the replay nonce; the same signed envelope is accepted on the paid resubmit.
- *
- * One scheme instance covers every capability under the DVM — internally
- * the SDK caches a per-schema verifier so each capability's Zod schema is
- * compiled once. The replay store is shared across all capabilities.
+ * One scheme covers all capabilities and shares their replay store. Per-schema
+ * verifiers validate without touching replay state; the host commits replay
+ * only after upfront payment verification, immediately before job creation.
  */
 declare function secp256k1Auth(opts?: Secp256k1AuthOpts): DVMAuthScheme;
 
 /** Structural type matching any Zod schema. Avoids a hard dependency on zod. */
 interface ZodLike<T = unknown> {
-    /** Internal Zod metadata (used for duck-type detection). */
     _zod: unknown;
-    /** Parse and validate data, throwing on failure. */
     parse(data: unknown): T;
-    /** Parse and validate data, returning a result object instead of throwing. */
     safeParse(data: unknown): {
         success: true;
         data: T;
@@ -5576,28 +4735,13 @@ interface ZodLike<T = unknown> {
         error: unknown;
     };
 }
-/** Extract the output type from a ZodLike schema, or default to string. */
 type InputType<T> = T extends ZodLike<infer O> ? O : string;
 /**
- * Narrowed type for capability `example` payloads (internal-review).
- *
- * Surfaces the Zod schema's output type so a drifted example produces a
- * TypeScript error at the `configureDVM` call site. Falls back to
- * `Record<string, unknown>` when `InputSchema` is undefined or a plain JSON
- * Schema object (which can't validate at type-level; the runtime
- * `validateExampleAgainstInput` in `configure.ts` covers schema-less paths).
- *
- * Approximation: `ZodLike<T>` exposes only one type param. True `z.input`
- * distinguishes pre-coercion input from post-coercion output for schemas
- * that use `.transform()` or `z.coerce.*`. None of the first-party DVMs do
- * that on their input schemas today. Revisit — extend `ZodLike` to a
- * two-param shape `ZodLike<Output, Input = Output>` — if a builder ever
- * hits a real divergence on `example`.
+ * Zod examples use the schema output type, including transforms. Plain JSON Schema examples have
+ * no equivalent static validation.
  */
 type ExampleType<InputSchema> = [InputSchema] extends [ZodLike<infer O>] ? O : Record<string, unknown>;
-/** Runtime check for whether a value is a Zod schema. */
 declare function isZodSchema(value: unknown): value is ZodLike;
-/** Structured logging interface injected via ctx.log. */
 interface Logger {
     debug(message: string, data?: Record<string, unknown>): void;
     info(message: string, data?: Record<string, unknown>): void;
@@ -5612,21 +4756,17 @@ interface KVStore {
     set(key: string, value: unknown, opts?: {
         ttl?: number;
     }): Promise<void>;
-    /** Delete a key. */
     delete(key: string): Promise<void>;
     /** List keys, optionally filtered by prefix. */
     list(prefix?: string): Promise<string[]>;
 }
-/** Options for ctx.prompt(). */
 interface PromptOpts {
     /** Preset choices the client can select from. */
     options?: string[];
     /** JSON Schema describing the expected structured response. */
     schema?: Record<string, unknown>;
 }
-/** Options for ctx.requestPayment(). */
 interface SDKPaymentRequestOpts {
-    /** Cashu mints accepted for this payment. */
     mints?: string[];
     /** Minimum P2PK locktime in seconds. */
     minLocktimeSeconds?: number;
@@ -5642,11 +4782,11 @@ interface SDKPaymentRequestOpts {
      * pre-issued mppx challenge per accepted method/intent. Overrides the
      * SDK's auto-issued challenges; if omitted, and the SDK is configured for
      * MPP, challenges are issued automatically. Each challenge's `id` becomes
-     * part of this job's per-job replay binding (internal-review).
+     * part of this job's per-job replay binding.
      *
      * `session`-intent challenges are dropped from this list, whoever issued
      * them: reusable channels fund credits on `POST /v1/credit` and are refused
-     * everywhere on the job surface (internal-review).
+     * everywhere on the job surface.
      */
     mpp?: {
         challenges: MppxChallenge[];
@@ -5679,22 +4819,18 @@ interface JobCost {
     /** ISO 4217 lowercase, e.g. `"usd"`. */
     currency: Currency;
 }
-/** Extended job context provided by the SDK runtime to DVM handlers. */
 interface SDKJobContext<State = Record<string, unknown>, Input = string> {
-    /** Server-assigned job ID. */
     readonly jobId: string;
-    /** Tags from the DVM descriptor (what this DVM handles). */
     readonly tags: string[];
     /** Job input — raw string or parsed/validated object when an input schema is defined. */
     readonly input: Input;
-    /** Job parameters as key-value pairs. */
     readonly params: Record<string, string>;
     /** Opaque requester identifier (derived from auth token or "anonymous"). */
     readonly requesterId: string;
     /** Total msats paid so far for this job. */
     readonly paidMsats: number;
     /**
-     * Verified caller identity from the descriptor's `auth` scheme (internal-review).
+     * Verified caller identity from the descriptor's `auth` scheme.
      * Present when the DVM declares `auth: secp256k1Auth(...)`; undefined for
      * DVMs without descriptor-level auth. The envelope is the same `T &
      * CanonicalEnvelope` the auth scheme produced — handlers can read
@@ -5704,24 +4840,17 @@ interface SDKJobContext<State = Record<string, unknown>, Input = string> {
         pubkey: string;
         envelope: CanonicalEnvelope & Record<string, unknown>;
     };
-    /** Send a progress text message to the client. */
     text(message: string): void;
-    /** Send an artifact (output data) to the client. */
     artifact(content: ArtifactContent): void;
     /** Send a raw typed message (escape hatch). */
     sendMessage(type: MessageType, content: Record<string, unknown>): void;
     /** Ask the client a question. Resolves when the client responds. */
     prompt(id: string, text: string, opts?: PromptOpts): Promise<ResponseContent>;
     /**
-     * Request payment from the client. Resolves when payment is received.
-     *
-     * - `number` = msats raw (sats-native operators).
-     * - `{ amount, currency }` = fiat envelope; the SDK converts to sats at
-     *   send-time via its centralised fx fetcher. v1 supports `currency: "usd"`
-     *   only; other currencies throw `UnsupportedCurrencyError`.
-     *
-     * The legacy `string` form (`"$0.05"`) was removed in internal-review under the
-     * project's no-shims convention. Migrate callers to the fiat envelope.
+     * Request payment; resolves when the ask is satisfied by the upfront pool or a payment.
+     * Numbers are millisatoshis. Fiat envelopes use major units in the supplied
+     * supported currency; the ledger pin is converted into the job's denomination.
+     * x402 is offered only for USD; other configured rails can use supported FX currencies.
      */
     requestPayment(amount: number | {
         amount: number;
@@ -5742,14 +4871,14 @@ interface SDKJobContext<State = Record<string, unknown>, Input = string> {
     /**
      * Fail the job with an error message. No debit happens either way — the
      * terminal funnel releases the credit draw ({@link RAIL_REFUNDABLE}).
-     * `{ refund: true }` annotates the failure as caller-fault (internal-review); it
+     * `{ refund: true }` annotates the failure as caller-fault; it
      * moves no money on any rail and never has.
      */
     fail(error: string, opts?: {
         refund?: boolean;
     }): void;
     /**
-     * Declare what this job cost **you**, the builder, to serve (internal-review).
+     * Declare what this job cost **you**, the builder, to serve.
      *
      * The SDK reports it to the platform alongside the job's revenue, so the
      * dashboard can state a margin. Without it the margin is unknowable, and the
@@ -5777,9 +4906,9 @@ interface SDKJobContext<State = Record<string, unknown>, Input = string> {
      *
      * ```ts
      * const r = await ctx.step("transcribe", async () => {
-     *   const result = await whisper(audio);
-     *   ctx.cost({ amount: result.seconds * 0.0001, currency: "usd" });
-     *   return result;
+     * const result = await whisper(audio);
+     * ctx.cost({ amount: result.seconds * 0.0001, currency: "usd" });
+     * return result;
      * });
      * ```
      *
@@ -5805,7 +4934,7 @@ interface SDKJobContext<State = Record<string, unknown>, Input = string> {
     step<T>(id: string, fn: () => Promise<T>): Promise<T>;
     /** Per-job typed state, auto-loaded and auto-persisted. */
     state: State;
-    /** Persistent cross-job KV storage. */
+    /** Persistent storage shared across jobs. */
     store: KVStore;
     /**
      * Instrumented fetch — emits `dvm.fetch` spans with redacted URLs, and
@@ -5814,7 +4943,7 @@ interface SDKJobContext<State = Record<string, unknown>, Input = string> {
      */
     fetch: typeof globalThis.fetch;
     /**
-     * Cancellation signal for this job (internal-review). Aborts when the caller
+     * Cancellation signal for this job. Aborts when the caller
      * cancels, the job idles out, or the handler is superseded. `ctx.fetch`
      * already carries it; pass it into anything else that can be torn down —
      * a provider SDK's `signal` option, a `spawn`, your own sleeps — so a
@@ -5822,24 +4951,20 @@ interface SDKJobContext<State = Record<string, unknown>, Input = string> {
      * / `ctx.fail` are no-ops: the job stays `cancelled`.
      */
     readonly signal: AbortSignal;
-    /** Environment variables configured by the operator. */
     env: Record<string, string>;
-    /** Structured logging. */
     log: Logger;
 }
-/** Context provided to the onQuote handler. */
 interface QuoteContext<QuoteData = Record<string, unknown>> {
-    /** Parsed quote data — typed when a Zod schema is provided. */
+    /** Quote data, parsed by the configured Zod schema when present. */
     data: QuoteData;
-    /** Raw input string from the client, if provided. */
+    /** The client's raw input string, when supplied. */
     input?: string;
-    /** Job parameters from the client, if provided. */
     params?: Record<string, string>;
     /**
      * Operator environment — same object threaded into `JobContext.env`.
      * Quote handlers read it for pre-payment checks (API-key presence, feature
      * flags, model overrides) so failures surface as a structured 400 rather
-     * than after the upfront fee has been debited. internal-review.
+     * than after the upfront fee has been debited.
      */
     env: Record<string, string>;
     /**
@@ -5849,16 +4974,16 @@ interface QuoteContext<QuoteData = Record<string, unknown>> {
      */
     fetch: typeof globalThis.fetch;
     /**
-     * Verified caller pubkey from the signed-request envelope (internal-review, credits
-     * spec §7). Present only when the descriptor declares an auth scheme and the
+     * Verified caller pubkey from the signed-request envelope. Present only when
+     * the descriptor declares an auth scheme and the
      * envelope verified — `/v1/quote` runs `checkAuth` before the handler, so by
      * the time this is set the signature is good. Undefined on unauthenticated
      * DVMs; quote handlers that price per-caller must handle that.
      */
     callerPubkey?: string;
     /**
-     * The authenticated caller's standing prepaid credit at this DVM, if any
-     * (internal-review, spec §7) — so one round trip answers "cost + my remaining
+     * The authenticated caller's standing prepaid credit at this DVM, if any,
+     * so one round trip answers "cost + my remaining
      * credit". Undefined when the DVM doesn't offer credit, the caller is
      * unauthenticated, or they hold no live credit in this DVM's currency.
      *
@@ -5869,8 +4994,8 @@ interface QuoteContext<QuoteData = Record<string, unknown>> {
     credit?: CreditView;
 }
 /**
- * Read-only snapshot of a caller's credit, surfaced on {@link QuoteContext}
- * (internal-review). Mirrors the ledger's `CreditSnapshot` minus the write surface
+ * Read-only snapshot of a caller's credit, surfaced on {@link QuoteContext};
+ * it mirrors the ledger's `CreditSnapshot` minus the write surface
  * and the fields a quote handler has no business branching on.
  */
 interface CreditView {
@@ -5888,7 +5013,7 @@ interface CreditView {
     expired: boolean;
 }
 /**
- * Result returned by the onQuote handler — the fiat-first envelope (internal-review).
+ * Result returned by the onQuote handler — the fiat-first envelope.
  *
  * The protocol enforces exactly one hard invariant — `upfront` — and pushes
  * every other pricing detail into prose. LLM-agent intermediaries read
@@ -5955,35 +5080,29 @@ interface QuoteResult {
         max_units?: number;
     };
 }
-/** Quote handler configuration with a Zod schema for structured quote data. */
 interface QuoteConfig<QuoteData = Record<string, unknown>> {
-    /** Schema describing the data clients must provide for a quote. */
     schema: ZodLike<QuoteData> | Record<string, unknown>;
-    /** Compute a price based on the structured quote data. */
     handler(ctx: QuoteContext<QuoteData>): Promise<QuoteResult>;
 }
-/** Incoming message shape for the onMessage catch-all handler. */
 interface IncomingMessage {
     /** Message type (e.g. "response", "payment", "approval", "cancel"). */
     type: MessageType;
-    /** Raw message content. */
     content: Record<string, unknown>;
 }
 /**
  * A builder-declared price — a USD literal, always (`"$0.05"`).
  *
- * Fiat is the only static price form (internal-review). The credit ledger is
+ * Fiat is the only static price form. The credit ledger is
  * fiat-micro denominated, so a raw-msats price could only reach the ledger
  * through a BTC/USD lookup that may be unavailable — which is how a
  * numeric-priced DVM under a cold-start rate outage used to take money and
- * record no draw (internal-review). Rails are unaffected: callers still pay sats,
+ * record no draw. Rails are unaffected: callers still pay sats,
  * the SDK converts at request time.
  */
 type PriceValue = string;
-/** Accepted payment rail identifier. */
 type PaymentMethod = "cashu" | "x402" | "tempo";
 /**
- * Rails a prepaid **credit** may be funded over (internal-review, credits spec §4).
+ * Rails that may fund a prepaid **credit**.
  *
  * A deliberate superset of {@link PaymentMethod}, not a widening of it.
  * `lightning` funds a credit through the interactive invoice leg on
@@ -5991,59 +5110,40 @@ type PaymentMethod = "cashu" | "x402" | "tempo";
  * connection and credits when settlement is observed — but it is **not** an
  * attached-proof wire method: there is no header a caller can hang a bolt11
  * on, nothing to verify inline, and no `lightning` entry in `/v1/info` or
- * `/v1/quote`'s `payment.methods` (internal-review stands; internal-review deleted the last
- * remnants of the per-call surface). Keeping the two types distinct is what
+ * `/v1/quote`'s `payment.methods`. Keeping the two types distinct is what
  * stops that dead rail from reappearing every time the funding menu grows.
  */
 type FundingMethod = PaymentMethod | "lightning";
 /**
- * Whether a failed job on a given rail can return the caller's funds (internal-review).
- *
- * **No rail refunds on `ctx.fail`, and no code behind the idea any more.** Under
- * the P2PK-accumulator Cashu path — the only Cashu path post-internal-review/internal-review —
- * `verifyAccumulatorReceipt` commits the caller's proofs straight into
- * `wallet_accumulator` and leaves `job.receivedProofs` empty; every producer in
- * `payment.ts` returns `[]`. The `ctx.fail(err, { refund: true })` branch that
- * used to send proofs back gated on those held proofs, so it had been an
- * unreachable no-op for as long as the accumulator has been the commit boundary,
- * and internal-review deleted it. This fail-closed posture was locked by internal-review
- * (Decision C) and pinned by internal-review. mpp (Tempo) and x402 credentials are
- * single-use, final-settlement — no SDK-managed reversal path either.
- *
- * **This is a rail-level question, and since internal-review it is no longer the whole
- * story.** A failed job never debits: the draw is a hold the terminal funnel
- * releases (`JobManager.resolveCreditDraw`), so the value stays on the caller's
- * credit. What this flag reports is narrower and still true — no rail hands
- * value backwards — and reclaiming a released balance runs through the
- * internal-review `drain` op, which exists only on a DVM that advertises credit.
+ * Whether the payment rail returns value when a job fails. No rail reverses
+ * `ctx.fail`: Cashu proofs are committed to the accumulator; Tempo and x402
+ * credentials settle without an SDK reversal.
  *
- * `{ refund: true }` survives as a **caller-fault annotation only** — first-party
- * handlers tag which errors were the caller's doing, and `sdk/testing`'s
- * `createTestContext` exposes it — and it is not a hook waiting to be re-wired.
- * internal-review, the accumulator-debit rewrite that would have flipped `cashu` back to
- * `true`, was cancelled as superseded: the ledger is where reclaim lives now.
- * x402 refund parity remains a deferred internal-review exploration.
+ * Failed credit jobs release their draw hold back to the caller's balance.
+ * Reclaiming that balance uses `drain`; this flag describes rail reversal,
+ * independently of the credit ledger. `{ refund: true }` records caller fault
+ * and does not move funds.
  */
 declare const RAIL_REFUNDABLE: Record<PaymentMethod, boolean>;
 /**
- * Cashu receive mode for builder DVMs (internal-review).
+ * Cashu receive mode for builder DVMs.
  *
  * `"p2pk-accumulator"` — accept P2PK-locked proofs from agent wallets and persist
  * them in `wallet_accumulator`. Melting runs builder-local via `dvmctl melt-pending`
- * (internal-review / internal-review); the SDK only monitors batches for `t_expire` proximity.
+ * the SDK only monitors batches for `t_expire` proximity.
  */
 type CashuMode = "p2pk-accumulator";
 /**
- * Prepaid-credit sizing this DVM advertises (internal-review, credits spec §6).
+ * Prepaid-credit sizing this DVM advertises.
  *
  * Declaring the block is the opt-in: a DVM without `credit` never offers the
  * funding menu on `/v1/quote` or the 402, and `/v1/credit` refuses with
  * `credit_not_supported`. Every payment still funds and draws the ledger
- * internally (the implicit N=1 case, internal-review) — this block is only about
+ * internally (the implicit N=1 case) — this block is only about
  * whether callers may hold a balance across jobs.
  *
  * Isolate-runtime DVMs never advertise credit regardless of this config
- * (spec §3): they have no Postgres of their own, so the money-safety
+ * (the isolate-runtime rule): they have no Postgres of their own, so the money-safety
  * conditions the ledger relies on can't hold there.
  */
 interface CreditConfig {
@@ -6058,14 +5158,14 @@ interface CreditConfig {
     min?: PriceValue;
     /**
      * Largest **residual balance** a caller may hold, as a `PriceValue`.
-     * Binds the balance, not the funding amount (spec §6): a job priced above
+     * Binds the balance, not the funding amount (the balance-sizing contract): a job priced above
      * `max` still clears as fund-and-immediately-draw. Bounds the DVM's
      * prepaid-deposit liability. Default `"$5.00"`.
      */
     max?: PriceValue;
     /**
      * Credit lifetime in **seconds**, from the most recent funding. Post-TTL
-     * the credit refuses new draws; the balance stays the caller's (spec §5).
+     * the credit refuses new draws; the balance stays the caller's (the caller-ownership contract).
      * Default 30 days.
      */
     ttl?: number;
@@ -6099,17 +5199,17 @@ interface ResolvedCreditConfig {
 declare const DEFAULT_CREDIT_MIN: PriceValue;
 /**
  * Platform default for {@link CreditConfig.max} — the largest residual balance
- * a caller may hold. Pocket-money sizing (spec §11: prepaid exposure is
+ * a caller may hold. Pocket-money sizing (the exposure limit: prepaid exposure is
  * capped by policy at pocket-money size), set above the caller-side tier-1
  * cap of $2 so an established caller can actually reach the builder ceiling.
  */
 declare const DEFAULT_CREDIT_MAX: PriceValue;
-/** Platform default for {@link CreditConfig.ttl} — 30 days (credits spec §15, ratified). */
+/** Platform default for {@link CreditConfig.ttl}: 30 days. */
 declare const DEFAULT_CREDIT_TTL_SECONDS: number;
 /** Default lifetime of caller-controlled job content before it is redacted. */
 declare const DEFAULT_JOB_RETENTION_DAYS = 90;
 /**
- * Per-capability configuration for the multi-capability shape (internal-review).
+ * Per-capability configuration for the multi-capability shape.
  * Each capability is an independent unit a caller pays for: its own input
  * schema, pricing, handler, and (optional) message handlers. DVM-level
  * concerns (auth, payment rails, tags, builder) stay on the parent
@@ -6121,13 +5221,13 @@ interface CapabilityConfig<State = Record<string, unknown>, InputSchema extends
     /** Zod schema for structured job input. When set, ctx.input is parsed and typed. */
     input?: InputSchema;
     /**
-     * Example input payload surfaced on `/v1/info` (internal-review). Lets the CLI render
+     * Example input payload surfaced on `/v1/info`. Lets the CLI render
      * a runnable `dvm quote --data '<payload>'` line when the JSON Schema alone
      * is ambiguous — e.g. cross-field Zod refinements that don't survive
      * serialization (narrate's `text` XOR `dialogue`). Must satisfy the schema
      * including any `.refine()` checks.
      *
-     * Typed via `ExampleType<InputSchema>` (internal-review): narrows to the schema's
+     * Typed via `ExampleType<InputSchema>`: narrows to the schema's
      * output type when `input` is a Zod schema, falls back to
      * `Record<string, unknown>` otherwise.
      */
@@ -6136,7 +5236,6 @@ interface CapabilityConfig<State = Record<string, unknown>, InputSchema extends
     state?: State;
     /** Static price — a USD literal ("$0.05"). Free capabilities omit this and `onQuote`. */
     price?: PriceValue;
-    /** Quote handler for dynamic pricing. */
     onQuote?: QuoteConfig;
     /** Handle a newly submitted job for this capability (required). */
     onJob: (ctx: SDKJobContext<State, InputType<InputSchema>>) => void | Promise<void>;
@@ -6152,7 +5251,7 @@ interface CapabilityConfig<State = Record<string, unknown>, InputSchema extends
     onMessage?: (ctx: SDKJobContext<State, InputType<InputSchema>>, msg: IncomingMessage) => void | Promise<void>;
 }
 /**
- * Desugared per-capability descriptor (internal-review). `configureDVM` produces one
+ * Desugared per-capability descriptor. `configureDVM` produces one
  * of these per capability — the SDK runtime always operates on this shape.
  */
 interface CapabilityDescriptor<State = unknown, InputSchema extends ZodLike | undefined = undefined> {
@@ -6162,15 +5261,13 @@ interface CapabilityDescriptor<State = unknown, InputSchema extends ZodLike | un
     readonly description: string;
     /** Zod schema for structured job input. */
     readonly input?: InputSchema;
-    /** Example input payload surfaced on `/v1/info` (internal-review). See `CapabilityConfig.example`. */
+    /** Example input payload surfaced on `/v1/info`. See `CapabilityConfig.example`. */
     readonly example?: ExampleType<InputSchema>;
     /** Default per-job state for jobs of this capability. */
     readonly state: State;
     /** Static price — a USD literal ("$0.05"). Undefined for dynamic-priced or free. */
     readonly price?: PriceValue;
-    /** Quote handler for dynamic pricing. */
     readonly onQuote?: QuoteConfig;
-    /** Handle a newly submitted job. */
     readonly onJob: (ctx: SDKJobContext<State, InputType<InputSchema>>) => void | Promise<void>;
     /** Handle a client response to a prompt. */
     readonly onResponse?: (ctx: SDKJobContext<State, InputType<InputSchema>>, content: ResponseContent) => void | Promise<void>;
@@ -6186,30 +5283,28 @@ interface CapabilityDescriptor<State = unknown, InputSchema extends ZodLike | un
 /**
  * Configuration object passed to configureDVM().
  *
- * Two equivalent shapes (internal-review):
+ * Two equivalent shapes:
  *
  * - **Flat single-capability shape** — declare `capability: "<name>"` plus
- *   the per-capability fields (`input`, `state`, `price`/`onQuote`, `onJob`,
- *   `onResponse`, …) at the top level. Desugars internally to a one-entry
- *   `capabilities` map. Ergonomic for the common case (narrate, scribe,
- *   scrape).
+ * the per-capability fields (`input`, `state`, `price`/`onQuote`, `onJob`,
+ * `onResponse`, …) at the top level. Desugars internally to a one-entry
+ * `capabilities` map. Ergonomic for the common case (narrate, scribe,
+ * scrape).
  *
  * - **Explicit multi-capability shape** — declare `capabilities: { "<name>":
- *   { input, onJob, … } }`. Used by services that expose several operations
- *   on a shared resource model (cast's add-episode / update-feed /
- *   delete-episode / delete-feed).
+ * { input, onJob, … } }`. Used by services that expose several operations
+ * on a shared resource model (cast's add-episode / update-feed /
+ * delete-episode / delete-feed).
  *
  * The two are mutually exclusive: providing both throws at `configureDVM`.
  * DVM-level concerns (tags, payment rails, idle timeout, lifecycle,
  * descriptor routes) live on `DVMConfig` regardless of shape.
  */
 interface DVMConfig<State = Record<string, unknown>, InputSchema extends ZodLike | undefined = undefined> {
-    /** Display name for the DVM. */
     name: string;
-    /** Human-readable description. */
     description?: string;
     /**
-     * Single-capability name for the flat shape (internal-review). Mutually exclusive
+     * Single-capability name for the flat shape. Mutually exclusive
      * with `capabilities`. Single-capability DVMs declare it here and put the
      * per-capability fields (`input`, `state`, `price`/`onQuote`, `onJob`,
      * `onResponse`, …) at the top level; `configureDVM` desugars to a
@@ -6217,7 +5312,7 @@ interface DVMConfig<State = Record<string, unknown>, InputSchema extends ZodLike
      */
     capability?: string;
     /**
-     * Explicit multi-capability block (internal-review). Mutually exclusive with the
+     * Explicit multi-capability block. Mutually exclusive with the
      * flat shape's `capability` + top-level handler fields. Each key is a
      * capability name (tag-shape: lowercase letters/digits/hyphens, no
      * slashes); each value carries its own `input`, `state`, `price`/`onQuote`,
@@ -6230,7 +5325,7 @@ interface DVMConfig<State = Record<string, unknown>, InputSchema extends ZodLike
     tags?: string[];
     /**
      * The currency this DVM prices in — and therefore the one its credit ledger
-     * is denominated in (internal-review). ISO 4217 lowercase; default `"usd"`.
+     * is denominated in. ISO 4217 lowercase; default `"usd"`.
      *
      * The single authoritative answer to "what denomination does this DVM deal
      * in", read by the funding menu, `POST /v1/credit`, and the quote balance
@@ -6241,11 +5336,11 @@ interface DVMConfig<State = Record<string, unknown>, InputSchema extends ZodLike
      * Two consequences, both enforced rather than documented:
      *
      * - **`onQuote` must return it.** A quote denominated in anything else is a
-     *   builder config error, refused as `quote_currency_mismatch` — never
-     *   coerced, never converted.
+     * builder config error, refused as `quote_currency_mismatch` — never
+     * coerced, never converted.
      * - **Static `price` literals are USD-only** (`"$0.05"` — that is the whole
-     *   grammar), so declaring a non-USD currency alongside one is a
-     *   `configureDVM` error. Price a non-USD DVM dynamically with `onQuote`.
+     * grammar), so declaring a non-USD currency alongside one is a
+     * `configureDVM` error. Price a non-USD DVM dynamically with `onQuote`.
      *
      * The rails are unaffected: callers still pay sats, and the SDK converts at
      * request time through whichever rate the fx fetcher carries for this
@@ -6256,7 +5351,7 @@ interface DVMConfig<State = Record<string, unknown>, InputSchema extends ZodLike
     price?: PriceValue;
     /** Zod schema for structured job input. Flat shape only. */
     input?: InputSchema;
-    /** Example input payload surfaced on `/v1/info` (internal-review). Flat shape only — see `CapabilityConfig.example`. */
+    /** Example input payload surfaced on `/v1/info`. Flat shape only — see `CapabilityConfig.example`. */
     example?: ExampleType<InputSchema>;
     /** Per-job state shape and defaults. Flat shape only. */
     state?: State;
@@ -6265,7 +5360,7 @@ interface DVMConfig<State = Record<string, unknown>, InputSchema extends ZodLike
     /**
      * Seconds a job may sit in `processing`/`working` with no SDK liveness
      * heartbeat before the stale-job watchdog declares its worker dead and marks
-     * it `failed` (internal-review). The SDK heartbeats locally-active jobs every ~30s,
+     * it `failed`. The SDK heartbeats locally-active jobs every ~30s,
      * so this bounds *crashed/OOM-killed-worker* detection — not legitimate
      * handler runtime, which the heartbeat keeps fresh regardless of how long it
      * runs. Distinct from `idleTimeout`, which governs the `awaiting-input`
@@ -6281,7 +5376,7 @@ interface DVMConfig<State = Record<string, unknown>, InputSchema extends ZodLike
      */
     jobRetentionDays?: number;
     /**
-     * Descriptor-level auth scheme (internal-review). Fires on `/v1/job` and
+     * Descriptor-level auth scheme. Fires on `/v1/job` and
      * `/v1/quote` before payment verification and handler dispatch — unsigned
      * or malformed envelopes reject with HTTP 401, no payment is attempted.
      *
@@ -6319,14 +5414,14 @@ interface DVMConfig<State = Record<string, unknown>, InputSchema extends ZodLike
     /** MPP multi-rail payment handle (provider-side, built via `createMppFromOpts`). */
     mpp?: MppxServer;
     /**
-     * Prepaid-credit sizing (internal-review). Declaring the block opts this DVM into
+     * Prepaid-credit sizing. Declaring the block opts this DVM into
      * the funding menu on `/v1/quote` / the 402 and into `POST /v1/credit`;
      * omitting it leaves callers on per-call payment. See {@link CreditConfig}.
      */
     credit?: CreditConfig;
     /**
      * Register DVM-scoped non-protocol routes on the descriptor's Hono sub-app
-     * (internal-review). Invoked once per `host.mount(dvm)` against the sub-app that
+     * Invoked once per `host.mount(dvm)` against the sub-app that
      * receives `/v1/info`, `/v1/job`, etc. — any prefix passed to `host.mount`
      * applies automatically, so a route registered as `/feeds/:owner/:slug` on
      * a DVM mounted under `/cast` becomes `/cast/feeds/:owner/:slug` externally.
@@ -6349,14 +5444,12 @@ interface DVMRouteContext {
 }
 /** Immutable descriptor returned by configureDVM(). */
 interface DVMDescriptor<State = Record<string, unknown>, InputSchema extends ZodLike | undefined = undefined> {
-    /** Display name for the DVM. */
     readonly name: string;
     /** Human-readable description (empty string if not provided). */
     readonly description: string;
-    /** Freeform tags this DVM handles. */
     readonly tags: string[];
     /**
-     * Resolved pricing currency (internal-review) — `config.currency` after validation,
+     * Resolved pricing currency — `config.currency` after validation,
      * or `"usd"` when the builder declared none. Always present, so no consumer
      * re-derives the default, and always the exact code the ledger compares
      * against (`"EUR"` is a `configureDVM` error, not a case to normalise: the
@@ -6385,14 +5478,14 @@ interface DVMDescriptor<State = Record<string, unknown>, InputSchema extends Zod
     readonly state: State;
     /** Seconds before an idle job is auto-cancelled. */
     readonly idleTimeout: number;
-    /** Seconds before a worker-stranded `processing`/`working` job is marked `failed` (internal-review). Undefined → SDK default (5 min). */
+    /** Seconds before a worker-stranded `processing`/`working` job is marked `failed`. Undefined → SDK default (5 min). */
     readonly processingWatchdog?: number;
     /** Days terminal job content is retained; `0` disables automatic redaction. */
     readonly jobRetentionDays: number;
     /** Reference to the original DVMConfig (handler functions, quote config, etc.). */
     readonly config: DVMConfig<State, InputSchema>;
     /**
-     * Desugared per-capability descriptors (internal-review). The SDK runtime always
+     * Desugared per-capability descriptors. The SDK runtime always
      * operates on this map: single-capability DVMs have one entry keyed by
      * `config.capability`; multi-capability DVMs have N entries with the
      * names declared in `config.capabilities`.
@@ -6410,24 +5503,22 @@ interface DVMDescriptor<State = Record<string, unknown>, InputSchema extends Zod
     /** MPP multi-rail payment handle. */
     readonly mpp?: MppxServer;
     /**
-     * Prepaid-credit sizing (internal-review), with every optional field resolved to
+     * Prepaid-credit sizing, with every optional field resolved to
      * its platform default. Present iff `configureDVM` was called with a
      * `credit` block — the presence check IS the opt-in gate.
      */
     readonly credit?: ResolvedCreditConfig;
     /**
-     * Descriptor-level auth scheme (internal-review). Set when `configureDVM` was
+     * Descriptor-level auth scheme. Set when `configureDVM` was
      * called with `auth: secp256k1Auth(...)` — the SDK fires this on
      * `/v1/job` and `/v1/quote` before payment verification.
      */
     readonly auth?: DVMAuthScheme;
 }
 
-/** Serializable record of a completed step. */
 interface StepRecord {
     /** Step identifier (must be unique within a job). */
     id: string;
-    /** Cached return value of the step function. */
     value: unknown;
     /** Cost declarations made while the step body ran, replayed on cache hits. */
     costs?: JobCost[];
@@ -6442,18 +5533,12 @@ interface StepRecord {
  */
 declare class StepCache {
     private cache;
-    /** Check if a step result is cached. */
     has(id: string): boolean;
-    /** Get a cached step result. Throws if not present. */
     get(id: string): unknown;
-    /** Get a cached step record, including replay metadata. Throws if not present. */
     getRecord(id: string): StepRecord;
-    /** Cache a step result. */
     set(id: string, value: unknown, costs?: readonly JobCost[]): void;
-    /** Export all cached steps for persistence. */
     serialize(): StepRecord[];
-    /** Restore a StepCache from persisted records. */
     static deserialize(records: StepRecord[]): StepCache;
 }
 
-export { type X402Version as $, type ApprovalContent as A, SignedRequestError as B, type Currency as C, type DVMConfig as D, type SignedRequestFailure as E, type SignedRequestReplayStore as F, type SignedRequestSignOpts as G, type SignedRequestStatementHeader as H, type IncomingMessage as I, type JobCost as J, type KVStore as K, type Logger as L, type SignedRequestVerifier as M, createSignedRequestVerifier as N, isZodSchema as O, type PaymentContent as P, type QuoteConfig as Q, type ResolvedCreditConfig as R, type SDKJobContext as S, signedRequestStatementHeader as T, UnsupportedCurrencyError as U, validateCurrency as V, type JsonValue as W, type FundingReceipt as X, type JobReceipt as Y, type ZodLike as Z, type PaymentRequired as _, type DVMDescriptor as a, isDrainReceipt as a$, type MppxCredential as a0, type Message as a1, type MessageType as a2, type MppxChallenge as a3, X402_BATCH_SETTLEMENT_SCHEME as a4, X402_EXACT_SCHEME as a5, type ReceiptCredit as a6, type X402Wallet as a7, type ResourceInfo as a8, type BuildPaymentRequirementsOpts as a9, type UnsignedFundingReceipt as aA, type UnsignedJobReceipt as aB, type VerifyResponse as aC, type WorkingContent as aD, type X402Config as aE, type X402ResponseBody as aF, type X402SelfRelayRpcFailureReason as aG, X402_DEFAULT_NETWORK as aH, X402_V1_VERSION as aI, X402_VERSION as aJ, buildPaymentRequiredV2 as aK, buildPaymentRequirements as aL, caip2ToX402Network as aM, canonicalRequestPath as aN, canonicaliseForSigning as aO, canonicalize as aP, chainIdFromCaip2 as aQ, computeResultHash as aR, decodePayment as aS, decodePaymentRequiredHeader as aT, encodePayment as aU, encodePaymentRequiredHeader as aV, encodeSettleResponseHeader as aW, exactEvmAuthorization as aX, isArtifactMessage as aY, isCancelMessage as aZ, isCompleteMessage as a_, type CapabilityDescriptor as aa, type CashuMode as ab, type CompleteContent as ac, type DrainReceipt as ad, type DrainReceiptEvent as ae, type ExactEvmPayload as af, type ExactEvmPayloadAuthorization as ag, type FundingMethod as ah, type MessageFrom as ai, type PaymentPayload as aj, type PaymentPayloadV1 as ak, type PaymentPayloadV2 as al, type PaymentRequestContent as am, type PaymentRequiredV2 as an, type PaymentRequirements as ao, type PaymentRequirementsV1 as ap, type PaymentRequirementsV2 as aq, type PromptContent as ar, RAIL_REFUNDABLE as as, type ReceiptOutcome as at, type ReceiptPayment as au, type SettleResponse as av, StepCache as aw, type StepRecord as ax, type TextContent as ay, type UnsignedDrainReceipt as az, type ArtifactContent as b, type StalePendingDrawCursor as b$, isFundingReceipt as b0, isPaymentRequestMessage as b1, isPromptMessage as b2, isSignedJobReceipt as b3, isTextMessage as b4, isWorkingMessage as b5, paymentRequiredV2FromV1 as b6, signDrainReceipt as b7, signFundingReceipt as b8, signReceipt as b9, _testing as bA, createDefaultReplayStore as bB, depleteLots as bC, fifoOrder as bD, inKindDrawMsats as bE, isInKindDepletion as bF, isNonChannelBitcoinRail as bG, lotOwedSats as bH, netOwedSats as bI, wrapMppx as bJ, type CreditDrainEnqueue as bK, type DVMAuthScheme as bL, type CreditLedgerLike as bM, type X402RefundSettlementGate as bN, type CreditSnapshot as bO, type DrawResult as bP, type X402SettlementStatus as bQ, type X402UnresolvedRefund as bR, type GrownDrawResult as bS, type DrawResolution as bT, type FundingRecord as bU, type CreditInvoiceRecord as bV, type InvoiceSettlement as bW, type BlockedInvoiceCursor as bX, type InvoiceReconciliation as bY, type InvoiceWriteOff as bZ, type DrawRecord as b_, usdcContractByCaip2 as ba, usdcContractFor as bb, usdcDomainNameFor as bc, usdcDomainVersionFor as bd, verifyDrainReceipt as be, verifyFundingReceipt as bf, verifyReceipt as bg, x402NetworkToCaip2 as bh, type X402ExactVersionSupport as bi, type X402Receipt as bj, type TransactionalPayoutHook as bk, type CashuMeltCompleted as bl, type CreditDepositPayload as bm, type CreditDrainPayload as bn, type FundingLot as bo, type LotDebit as bp, type LotDepletion as bq, type MppxServer as br, NON_CHANNEL_BITCOIN_RAILS as bs, type NonChannelBitcoinRail as bt, PayoutReporter as bu, PostgresTempoSessionStore as bv, RevenueReporter as bw, SIGNED_ENVELOPE_FIELDS as bx, SIGNED_ENVELOPE_TYPES as by, type X402TrackedChannel as bz, type CancelContent as c, type TempoCreditLossEvidence as c0, type CreditLedgerQuerier as c1, type TempoCreditLoss as c2, type X402CreditLossEvidence as c3, type X402CreditLoss as c4, type DrainMethod as c5, type DrainRequestResult as c6, type BitcoinDepositLiability as c7, type CreditDrainRecord as c8, type ChannelDrainCursor as c9, type RevenueSkippedNoRailPayload as cA, type RevenueSkippedNoRailReason as cB, type Secp256k1AuthOpts as cC, type X402ChannelStorageOpts as cD, type X402RelayLockHolder as cE, type X402RelaySubmissionLock as cF, X402RelaySubmissionLockError as cG, allocateDrawValue as cH, clientCompatibilityAttributes as cI, clientCompatibilityMiddleware as cJ, clientUpgradeRequired as cK, parseClientCapabilities as cL, parseClientCompatibility as cM, parseDvmClient as cN, parseProtocolVersion as cO, requireClientCompatibility as cP, secp256k1Auth as cQ, signedRequestInput as cR, type X402SettlementIntent as cS, type X402SettlementCursor as cT, type X402SettlementWriteOff as cU, type X402FacilitatorAuth as cV, type X402BatchSettlementConfig as cW, type X402PayoutObserver as cX, type CreditDepositEnqueue as cY, type X402SettlementReconciliationReason as cZ, type CreditDrawReleaseEnqueue as c_, type DrainWriteOff as ca, type DrainReleaseResult as cb, type DrainFulfilment as cc, type DrainTransitionResult as cd, CLIENT_COMPATIBILITY_HEADERS as ce, type ClientCompatibility as cf, type ClientCompatibilityEnv as cg, type ClientCompatibilityGate as ch, type ClientCompatibilityRequirement as ci, type ClientSemVer as cj, type CreditFundingBasis as ck, type CreditInvoiceStatus as cl, CreditLedger as cm, CreditLedgerError as cn, type CreditLedgerErrorCode as co, type CreditLedgerErrorDetails as cp, type CreditLedgerPool as cq, type CreditStatus as cr, DRAIN_DELIVERY_RESERVE_SATS as cs, DVM_PROTOCOL_VERSION as ct, type DrainConflictReason as cu, type DrawRailValue as cv, type DrawStatus as cw, type JobCostReportPayload as cx, PostgresX402ChannelStorage as cy, type ReplayStoreBackend as cz, type CanonicalEnvelope as d, type CreateSignedRequestVerifierOpts as e, type CreditConfig as f, type CreditView as g, DEFAULT_CREDIT_MAX as h, DEFAULT_CREDIT_MIN as i, DEFAULT_CREDIT_TTL_SECONDS as j, DEFAULT_JOB_RETENTION_DAYS as k, type DVMRouteContext as l, type InputType as m, InvalidCurrencyError as n, type PaymentMethod as o, type PriceValue as p, type ProgressContent as q, type PromptOpts as r, type QuoteContext as s, type QuoteResult as t, type ResponseContent as u, type SDKPaymentRequestOpts as v, SIGNED_REQUEST_AUTH_ID as w, SIGNED_REQUEST_STATEMENT_VERSION as x, type SignedRequestAudience as y, type SignedRequestDomain as z };
+export { type X402Version as $, type ApprovalContent as A, SignedRequestError as B, type Currency as C, type DVMConfig as D, type SignedRequestFailure as E, type SignedRequestReplayStore as F, type SignedRequestSignOpts as G, type SignedRequestStatementHeader as H, type IncomingMessage as I, type JobCost as J, type KVStore as K, type Logger as L, type SignedRequestVerifier as M, createSignedRequestVerifier as N, isZodSchema as O, type PaymentContent as P, type QuoteConfig as Q, type ResolvedCreditConfig as R, type SDKJobContext as S, signedRequestStatementHeader as T, UnsupportedCurrencyError as U, validateCurrency as V, type JsonValue as W, type FundingReceipt as X, type JobReceipt as Y, type ZodLike as Z, type PaymentRequired as _, type DVMDescriptor as a, isDrainReceipt as a$, type MppxCredential as a0, type Message as a1, type MessageType as a2, type MppxChallenge as a3, X402_BATCH_SETTLEMENT_SCHEME as a4, X402_EXACT_SCHEME as a5, type ReceiptCredit as a6, type X402Wallet as a7, type ResourceInfo as a8, type BuildPaymentRequirementsOpts as a9, type UnsignedFundingReceipt as aA, type UnsignedJobReceipt as aB, type VerifyResponse as aC, type WorkingContent as aD, type X402Config as aE, type X402ResponseBody as aF, type X402SelfRelayRpcFailureReason as aG, X402_DEFAULT_NETWORK as aH, X402_V1_VERSION as aI, X402_VERSION as aJ, buildPaymentRequiredV2 as aK, buildPaymentRequirements as aL, caip2ToX402Network as aM, canonicalRequestPath as aN, canonicaliseForSigning as aO, canonicalize as aP, chainIdFromCaip2 as aQ, computeResultHash as aR, decodePayment as aS, decodePaymentRequiredHeader as aT, encodePayment as aU, encodePaymentRequiredHeader as aV, encodeSettleResponseHeader as aW, exactEvmAuthorization as aX, isArtifactMessage as aY, isCancelMessage as aZ, isCompleteMessage as a_, type CapabilityDescriptor as aa, type CashuMode as ab, type CompleteContent as ac, type DrainReceipt as ad, type DrainReceiptEvent as ae, type ExactEvmPayload as af, type ExactEvmPayloadAuthorization as ag, type FundingMethod as ah, type MessageFrom as ai, type PaymentPayload as aj, type PaymentPayloadV1 as ak, type PaymentPayloadV2 as al, type PaymentRequestContent as am, type PaymentRequiredV2 as an, type PaymentRequirements as ao, type PaymentRequirementsV1 as ap, type PaymentRequirementsV2 as aq, type PromptContent as ar, RAIL_REFUNDABLE as as, type ReceiptOutcome as at, type ReceiptPayment as au, type SettleResponse as av, StepCache as aw, type StepRecord as ax, type TextContent as ay, type UnsignedDrainReceipt as az, type ArtifactContent as b, type StalePendingDrawCursor as b$, isFundingReceipt as b0, isPaymentRequestMessage as b1, isPromptMessage as b2, isSignedJobReceipt as b3, isTextMessage as b4, isWorkingMessage as b5, paymentRequiredV2FromV1 as b6, signDrainReceipt as b7, signFundingReceipt as b8, signReceipt as b9, _testing as bA, createDefaultReplayStore as bB, depleteLots as bC, fifoOrder as bD, inKindDrawMsats as bE, isInKindDepletion as bF, isNonChannelBitcoinRail as bG, lotOwedSats as bH, netOwedSats as bI, wrapMppx as bJ, type CreditDrainEnqueue as bK, type DVMAuthScheme as bL, type CreditLedgerLike as bM, type X402RefundSettlementGate as bN, type CreditSnapshot as bO, type DrawResult as bP, type X402SettlementStatus as bQ, type X402UnresolvedRefund as bR, type GrownDrawResult as bS, type DrawResolution as bT, type FundingRecord as bU, type CreditInvoiceRecord as bV, type InvoiceSettlement as bW, type BlockedInvoiceCursor as bX, type InvoiceReconciliation as bY, type InvoiceWriteOff as bZ, type DrawRecord as b_, usdcContractByCaip2 as ba, usdcContractFor as bb, usdcDomainNameFor as bc, usdcDomainVersionFor as bd, verifyDrainReceipt as be, verifyFundingReceipt as bf, verifyReceipt as bg, x402NetworkToCaip2 as bh, type X402ExactVersionSupport as bi, type X402Receipt as bj, type TransactionalPayoutHook as bk, type CashuMeltCompleted as bl, type CreditDepositPayload as bm, type CreditDrainPayload as bn, type FundingLot as bo, type LotDebit as bp, type LotDepletion as bq, type MppxServer as br, NON_CHANNEL_BITCOIN_RAILS as bs, type NonChannelBitcoinRail as bt, PayoutReporter as bu, PostgresTempoSessionStore as bv, RevenueReporter as bw, SIGNED_ENVELOPE_FIELDS as bx, SIGNED_ENVELOPE_TYPES as by, type X402TrackedChannel as bz, type CancelContent as c, type CreditDrawReleaseEnqueue as c$, type TempoCreditLossEvidence as c0, type CreditLedgerQuerier as c1, type TempoCreditLoss as c2, type X402CreditLossEvidence as c3, type X402CreditLoss as c4, type DrainMethod as c5, type DrainRequestResult as c6, type BitcoinDepositLiability as c7, type CreditDrainRecord as c8, type ChannelDrainCursor as c9, type ReplayStoreBackend as cA, type RevenueSkippedNoRailPayload as cB, type RevenueSkippedNoRailReason as cC, type Secp256k1AuthOpts as cD, type X402ChannelStorageOpts as cE, type X402RelayLockHolder as cF, type X402RelaySubmissionLock as cG, X402RelaySubmissionLockError as cH, allocateDrawValue as cI, clientCompatibilityAttributes as cJ, clientCompatibilityMiddleware as cK, clientUpgradeRequired as cL, parseClientCapabilities as cM, parseClientCompatibility as cN, parseDvmClient as cO, parseProtocolVersion as cP, requireClientCompatibility as cQ, secp256k1Auth as cR, signedRequestInput as cS, type X402SettlementIntent as cT, type X402SettlementCursor as cU, type X402SettlementWriteOff as cV, type X402FacilitatorAuth as cW, type X402BatchSettlementConfig as cX, type X402PayoutObserver as cY, type CreditDepositEnqueue as cZ, type X402SettlementReconciliationReason as c_, type DrainWriteOff as ca, type DrainReleaseResult as cb, type DrainFulfilment as cc, type DrainTransitionResult as cd, CLIENT_COMPATIBILITY_HEADERS as ce, type ClientCompatibility as cf, type ClientCompatibilityEnv as cg, type ClientCompatibilityGate as ch, type ClientCompatibilityRequirement as ci, type ClientSemVer as cj, type CreditFundingBasis as ck, type CreditInvoiceStatus as cl, CreditLedger as cm, CreditLedgerError as cn, type CreditLedgerErrorCode as co, type CreditLedgerErrorDetails as cp, type CreditLedgerPool as cq, type CreditStatus as cr, DRAIN_DELIVERY_RESERVE_SATS as cs, DVM_PROTOCOL_VERSION as ct, type DrainConflictReason as cu, type DrawRailValue as cv, type DrawStatus as cw, type JobCostReportPayload as cx, type JobTerminalReportPayload as cy, PostgresX402ChannelStorage as cz, type CanonicalEnvelope as d, type CreateSignedRequestVerifierOpts as e, type CreditConfig as f, type CreditView as g, DEFAULT_CREDIT_MAX as h, DEFAULT_CREDIT_MIN as i, DEFAULT_CREDIT_TTL_SECONDS as j, DEFAULT_JOB_RETENTION_DAYS as k, type DVMRouteContext as l, type InputType as m, InvalidCurrencyError as n, type PaymentMethod as o, type PriceValue as p, type ProgressContent as q, type PromptOpts as r, type QuoteContext as s, type QuoteResult as t, type ResponseContent as u, type SDKPaymentRequestOpts as v, SIGNED_REQUEST_AUTH_ID as w, SIGNED_REQUEST_STATEMENT_VERSION as x, type SignedRequestAudience as y, type SignedRequestDomain as z };