@dvmkit/sdk 0.2.0-rc.9 → 0.2.1-rc.9

package/dist/{credit-menu-D4Gcdgc4.d.ts → credit-menu-kDA9RVzD.d.ts}

@@ -1,16 +1,15 @@
-import { ah as FundingMethod, o as PaymentMethod, bM as CreditLedgerLike, a1 as Message, X as FundingReceipt, bO as CreditSnapshot, Y as JobReceipt, S as SDKJobContext, aw as StepCache, u as ResponseContent, P as PaymentContent, a2 as MessageType, bj as X402Receipt, aE as X402Config, bi as X402ExactVersionSupport, cT as X402SettlementIntent, aq as PaymentRequirementsV2, c1 as CreditLedgerQuerier, cU as X402SettlementCursor, bQ as X402SettlementStatus, cV as X402SettlementWriteOff, bN as X402RefundSettlementGate, cW as X402FacilitatorAuth, cX as X402BatchSettlementConfig, cz as PostgresX402ChannelStorage, cY as X402PayoutObserver, br as MppxServer, ab as CashuMode, cZ as CreditDepositEnqueue, c_ as X402SettlementReconciliationReason, ao as PaymentRequirements, a0 as MppxCredential, bm as CreditDepositPayload, bP as DrawResult, cn as CreditLedgerError, a6 as ReceiptCredit, ae as DrainReceiptEvent, ad as DrainReceipt, K as KVStore, y as SignedRequestAudience, c$ as CreditDrawReleaseEnqueue, cx as JobCostReportPayload, cy as JobTerminalReportPayload, cB as RevenueSkippedNoRailPayload, Z as ZodLike, a as DVMDescriptor, bV as CreditInvoiceRecord, bW as InvoiceSettlement, ch as ClientCompatibilityGate, cf as ClientCompatibility, bu as PayoutReporter, R as ResolvedCreditConfig, g as CreditView } from './step-cache-CXg7ziML.js';
+import { ah as FundingMethod, o as PaymentMethod, bM as CreditLedgerLike, a1 as Message, X as FundingReceipt, bO as CreditSnapshot, Y as JobReceipt, S as SDKJobContext, aw as StepCache, u as ResponseContent, P as PaymentContent, a2 as MessageType, bj as X402Receipt, aE as X402Config, bi as X402ExactVersionSupport, cT as X402SettlementIntent, aq as PaymentRequirementsV2, c1 as CreditLedgerQuerier, cU as X402SettlementCursor, bQ as X402SettlementStatus, cV as X402SettlementWriteOff, bN as X402RefundSettlementGate, cW as X402FacilitatorAuth, cX as X402BatchSettlementConfig, cz as PostgresX402ChannelStorage, cY as X402PayoutObserver, br as MppxServer, ab as CashuMode, cZ as CreditDepositEnqueue, c_ as X402SettlementReconciliationReason, ao as PaymentRequirements, a0 as MppxCredential, bm as CreditDepositPayload, bP as DrawResult, cn as CreditLedgerError, a6 as ReceiptCredit, ae as DrainReceiptEvent, ad as DrainReceipt, K as KVStore, y as SignedRequestAudience, c$ as CreditDrawReleaseEnqueue, cx as JobCostReportPayload, cy as JobTerminalReportPayload, cB as RevenueSkippedNoRailPayload, Z as ZodLike, a as DVMDescriptor, bV as CreditInvoiceRecord, bW as InvoiceSettlement, ch as ClientCompatibilityGate, cf as ClientCompatibility, bu as PayoutReporter, R as ResolvedCreditConfig, g as CreditView } from './step-cache-v2yhyhSZ.js';
 import { ProofLike, SerializedDLEQ, Proof } from '@cashu/cashu-ts';
 import { Hono, Context } from 'hono';
 import { Pool } from 'pg';
-import { b as FxRateSnapshot, F as FxFetcher } from './fx-B0SLBe5x.js';
-import { g as LockPubkey, f as CheckMintHealthOptions, b as LightningBackend, A as AttestationPayload } from './lightning-backend-CQBnQgsT.js';
-import { T as TopUpCapUnenforcedReason, A as AppendOutgoingOptions, J as JobRecord, b as JobStore } from './job-store-B2uZvga4.js';
+import { b as FxRateSnapshot, F as FxFetcher } from './fx-DhyT1Cjh.js';
+import { g as LockPubkey, f as CheckMintHealthOptions, b as LightningBackend, A as AttestationPayload } from './lightning-backend-BhsyrBLa.js';
+import { T as TopUpCapUnenforcedReason, A as AppendOutgoingOptions, J as JobRecord, b as JobStore } from './job-store-D3CcZp_g.js';
 import { Challenge } from 'mppx';
 import { SettleResponse, SupportedResponse } from '@x402/core/types';
 import { Channel, AutoSettlementConfig } from '@x402/evm/batch-settlement/server';
 import { FacilitatorClient } from '@x402/core/server';
 
-/** A row in the per-DVM `wallet_accumulator` table. */
 interface WalletAccumulatorRow {
     id: string;
     dvmId: string;
@@ -36,11 +35,8 @@ interface WalletAccumulatorRow {
      * rows created before the column existed.
      */
     meltQuoteId: string | null;
-    /**
-     * NUT-11 locktime captured at accept time (ms since epoch). Null when the
-     * accepted proof has no `locktime` tag. Drives oldest-first
-     * ordering and the future `wallet_accumulator_batch_expiring_soon` monitor.
-     */
+    /** NUT-11 locktime at acceptance, in epoch ms; null without a tag.
+     * Drives oldest-first ordering and expiring-soon monitoring. */
     tExpire: number | null;
 }
 /**
@@ -174,7 +170,6 @@ interface DisposableCashuCommit {
     commit(requestId: string, proofs: Proof[], account: (ledger: CreditLedgerLike) => Promise<void>): Promise<void>;
 }
 
-/** How often the sweep runs, and how long after boot its first pass fires. */
 interface CreditExpirySweepOpts {
     /** Sweep period. Defaults to {@link DEFAULT_SWEEP_INTERVAL_MS}; `0` disables the timer. */
     intervalMs?: number;
@@ -183,21 +178,17 @@ interface CreditExpirySweepOpts {
      * disables the boot pass, leaving only the interval.
      */
     bootDelayMs?: number;
-    /** Credits released per pass. Passed straight to the ledger. */
     limit?: number;
 }
 
-/** Promise resolver for a pending client prompt response. */
 interface PromptResolver {
     resolve: (value: ResponseContent) => void;
     reject: (reason: Error) => void;
 }
-/** Promise resolver for a pending client payment. */
 interface PaymentResolver {
     resolve: (value: PaymentContent) => void;
     reject: (reason: Error) => void;
 }
-/** In-memory representation of a running job. */
 interface ServerJob {
     id: string;
     tags: string[];
@@ -262,17 +253,13 @@ interface ServerJob {
     /** Chain transaction returned to callers recovering x402 or Tempo acceptance. */
     paymentTransactionHash?: string;
     /**
-     * Rail-native amount accumulated across all successful credits on this
-     * job (sats for mpp, USDC microunits for x402). The single
-     * `revenue_events` row written at completion uses this as `gross_native`,
-     * so multi-credit jobs sum the per-credit native amounts.
-     * The upfront credit initializes this value; mid-job credits accumulate same-rail
-     * and reset on a cross-rail switch (see `processIncomingPayment`).
+     * Rail-native atomic units accumulated across same-rail credits: Tempo and
+     * x402 use stablecoin micro-units. A rail switch resets this amount; Cashu
+     * revenue is derived from paidMsats instead.
      */
     nativeAmount?: number;
     /** Native asset tag paired with `nativeAmount`. */
     nativeAsset?: "sats" | "usdc" | "usdc.e" | "usd-cents";
-    /** Cashu flow discriminator written into `revenue_events.metadata.cashu_flow`. */
     cashuFlow?: "p2pk_accumulator";
     /**
      * What this job cost the **builder** to serve, in 1e-6 of
@@ -316,8 +303,8 @@ interface ServerJob {
      * nonce issued by `requestPayment` and stamped onto the outbound x402
      * envelope; the caller signs `TransferWithAuthorization` against this exact
      * `bytes32`. Verification rejects an incoming `x402_payment` whose decoded
-     * authorization nonce differs, blocking a cross-job replay before the
-     * facilitator settles. Cleared on successful credit.
+     * authorization nonce differs before crediting the job. Cleared on
+     * successful credit.
      */
     pendingX402Nonce?: string;
     /**
@@ -415,9 +402,8 @@ interface ServerJob {
     /** Unix ms timestamp of last activity (message, yield, terminal). */
     lastActivityAt: number;
 }
-/** Extract the persistent fields from a ServerJob into a JobRecord. */
 declare function toJobRecord(job: ServerJob): JobRecord;
-/** Reconstitute a ServerJob from a persisted JobRecord with fresh runtime fields. */
+/** Restored snapshots receive fresh process-local listeners, cancellation and prompt state. */
 declare function fromJobRecord(record: JobRecord): ServerJob;
 /**
  * Signal cancellation to a running handler. Idempotent — aborting an
@@ -433,40 +419,14 @@ declare function abortJob(job: ServerJob, reason: string): void;
 declare class JobCancelledError extends Error {
     constructor(message?: string);
 }
-/** Append a provider-sent message to the job and notify SSE listeners. */
 declare function providerMessage(job: ServerJob, type: MessageType, content: Record<string, unknown> | object): void;
 declare function isTerminal(status: ServerJob["status"]): boolean;
-/** Check if a message is a yield point (ends the provider's turn). */
 declare function isYieldMessage(msg: Message): boolean;
 
-/**
- * Per-DVM runtime mint-health tracker. Alongside the platform's
- * durable mint-health cron, probes every configured
- * mint on a timer, tracks consecutive failures, and flips a mint to `sick`
- * once the threshold is crossed. The SDK uses the resulting view to:
- *
- * 1. Filter `/v1/info`'s advertised `mints` to currently-healthy ones.
- * 2. Reject new accumulator receives at sick mints before they touch the
- * DB (`cashu_mint_sick` 503 from `verifyAccumulatorReceipt`).
- *
- * Since this tracker is the sole owner of mint health: boot no longer
- * runs a fail-fast check before binding the port. To preserve what boot used
- * to guarantee it (a) treats a mint as healthy only when it's reachable AND
- * NUT-compliant (reproducing `assertNutSupport` via `nutCompliant`), and (b)
- * exposes `initialProbeComplete()` so the paid path holds calls at
- * `mint_health_pending` until the first probe validates ≥1 mint.
- *
- * Existing accumulator entries are not touched — they're P2PK-locked to the
- * original mint and stay put until `dvmctl melt-pending` drains them. The
- * accumulator monitor's `wallet_accumulator_batch_expiring_soon` already
- * pages the builder when a stuck batch nears `t_expire`.
- *
- * In-memory only — no DB persistence. The platform cron keeps the durable
- * record + email path; the SDK only needs fresh in-process state
- * to make routing decisions.
- */
+/** In-process mint health gates advertising and new receives. Paid calls wait for
+ * the first probe; NUT incompatibility fails immediately, transient failures
+ * use a consecutive threshold. Existing accumulator proofs remain at their mint. */
 
-/** Per-mint runtime view exposed by `snapshot()`. */
 interface MintHealthSnapshot {
     /** Last-observed wall-clock latency of the probe in ms. */
     latencyMs?: number;
@@ -486,9 +446,7 @@ interface MintHealthSnapshot {
      * never resolves without a config/mint change.
      */
     nutIncompatible?: boolean;
-    /** Mint version reported by the last successful probe. */
     version?: string;
-    /** Error category from the most recent failed probe. */
     errorCode?: string;
 }
 interface MintHealthTrackerOptions {
@@ -508,22 +466,9 @@ interface MintHealthTrackerOptions {
     consecutiveFailuresToSick?: number;
     fetchImpl?: typeof fetch;
     now?: () => number;
-    /**
-     * Per-probe timeout / retry / backoff, forwarded to {@link checkMintHealth}.
-     * Defaults to that function's own defaults — 3 attempts with `[200, 500]`
-     * backoff, which is what a real tick should do.
-     *
-     * Tests that drive several failing ticks set `backoffMs: [0]`: a failing
-     * probe otherwise costs 700ms of real `setTimeout`, and four of them put a
-     * unit test within a loaded CI runner's reach of the 5s default timeout.
-     * `fetchImpl` is set on the tracker, not here.
-     */
+    /** Forwarded to checkMintHealth; fetchImpl is supplied on the tracker. */
     probe?: Omit<CheckMintHealthOptions, "fetchImpl">;
 }
-/**
- * Runtime mint-health tracker. Owns its own timer; `start()` runs an initial
- * probe immediately so the first received call doesn't see a stale snapshot.
- */
 declare class MintHealthTracker {
     private readonly mints;
     private readonly tickIntervalMs;
@@ -569,60 +514,31 @@ declare class MintHealthTracker {
      * where a merely-flapping mint is still published.
      */
     isNutIncompatible(mintUrl: string): boolean;
-    /** Plain-object snapshot keyed by mint URL — for tests + observability. */
     snapshot(): Record<string, MintHealthSnapshot>;
     private applyResult;
-    /**
-     * One-shot structured summary emitted after the first probe tick. Replaces
-     * the boot check's per-mint `cashu_mint_startup_health` lines and surfaces an
-     * all-mints-unhealthy warning — the operator alert that the Fly restart-loop
-     * used to be before boot stopped refusing to start.
-     */
+    /** One boot summary, including an all-unhealthy warning. */
     private logBootHealth;
 }
 
 /**
- * Credit fields carried inside the signed request body.
+ * Credit fields belong to the raw signed body. The funding commitment hashes the header
+ * artifact, binding money outside that body to its intended credit.
  *
- * An explicit draw references the credit INSIDE the secp256k1/Schnorr-signed
- * `body.data` — no new caller crypto. Wire field names (snake_case, matching
- * the rest of the wire surface):
- *
- * - `credit_id` — the credit to draw against.
- * - `draw_id` — client-generated draw id; the ledger's idempotency key.
- * - `fund` — optional `{ amount_micro, commitment }` funding commitment:
- * present iff a funding artifact (X-Cashu / X-PAYMENT / mpp credential)
- * rides the same request. `commitment` is the SHA-256 hex over the raw
- * artifact bytes, binding the header-borne proof — which sits OUTSIDE the
- * signed body — to the credit its sender intended (the funding-commitment rule).
- *
- * These are envelope-level fields, not capability input: **the SDK** removes
- * them before any builder-owned schema parses ({@link stripCreditEnvelope} in
- * `JobManager.parseInput` and on the quote path; {@link
- * creditEnvelopeIgnoreFields} feeding the auth verifier's own schema check), so
- * handlers never see them and a top-level `.strict()` capability schema is
- * fine. Relying on Zod's default strip mode instead was the trap:
- * `.strict()` rejects unknown keys, so an explicit draw 400'd at parse before
- * the envelope was ever extracted.
- *
- * The strip never touches the canonical signing bytes. Every auth call site
- * verifies the raw wire body (`signedRequestInput`), so the credit
- * fields are in the verified bytes because they were never taken out of them —
- * the strip is only ever applied to what a schema is about to parse.
+ * Schema projection strips undeclared protocol keys before builder input parsing, without
+ * changing canonical signing bytes. Signature verification must use the original wire body; a
+ * parsed projection may omit credit fields.
  */
 interface CreditEnvelope {
     creditId: string;
     drawId: string;
     fund?: CreditFundCommitment;
 }
-/** The signed funding commitment for a fund-and-draw request. */
 interface CreditFundCommitment {
     /** Funding amount in 1e-6 units of the credit's currency. */
     amountMicro: number;
     /** SHA-256 hex over the raw funding artifact bytes. */
     commitment: string;
 }
-/** Wire keys reserved for the credit envelope inside `body.data`. */
 declare const CREDIT_ENVELOPE_KEYS: readonly ["credit_id", "draw_id", "fund"];
 /**
  * Thrown by {@link extractCreditEnvelope} on a structurally invalid credit
@@ -640,28 +556,16 @@ declare class CreditEnvelopeError extends Error {
  */
 declare function extractCreditEnvelope(data: unknown): CreditEnvelope | undefined;
 /**
- * The reserved keys `schema` does not itself declare — the ones the SDK is
- * free to remove before handing it an input.
- *
- * A capability schema declares none of them, so all three are removable. The
- * one exception this exists for is `/v1/credit`'s own `CREDIT_REQUEST_SCHEMA`,
- * where `credit_id` and `fund` are real fields on a different wire shape and
- * removing them would empty the request. It is not an escape hatch for a
- * capability: the three names stay reserved on `body.data`, and declaring one
- * doesn't win a builder their own value — `app.ts` runs
- * {@link extractCreditEnvelope} over the raw body on every submit, so a
- * capability that declares `fund` answers `invalid_credit_fields` instead.
+ * Return protocol keys not declared by the schema. Schema-declared keys remain available,
+ * including /v1/credit’s differently shaped credit_id and fund fields. Submit separately
+ * extracts and validates the credit envelope from raw body.data; declaring a key does not
+ * bypass that validation.
  */
 declare function creditEnvelopeIgnoreFields(schema: unknown): readonly string[];
 /**
- * Remove the reserved credit keys from `data` before `schema` parses it, so a
- * strict schema doesn't reject the protocol's own envelope. Keys
- * `schema` declares are left alone — see {@link creditEnvelopeIgnoreFields}.
- *
- * Returns `data` unchanged when it isn't a plain object or carries none of the
- * removable keys, so the ordinary no-credit request allocates nothing. Never
- * use the result to derive canonical signing bytes: those cover the wire form,
- * credit fields included (`signedRequestInput`).
+ * Remove undeclared credit keys before schema parsing. Preserve nonobject/array inputs and
+ * objects with no removable keys. Never derive signing bytes from this projection; signatures
+ * cover the raw wire body.
  */
 declare function stripCreditEnvelope(schema: unknown, data: unknown): unknown;
 
@@ -904,18 +808,8 @@ declare function derivedFundCreditId(callerPubkey: string, fundId: string): stri
 declare function drawSettlementRef(dvmId: string, creditId: string, drawId: string): string;
 
 /**
- * Durable marker for a rail payment that already funded the credit ledger
- * (the funding-commitment rule). The x402 and mpp rails have no dvmkit-side
- * commit point of their own — the money moves at the facilitator / the payer's
- * mpp server — so the marker row, inserted in the SAME transaction as
- * `CreditLedger.fund` + `draw`, is what makes a crash-replayed credential
- * unable to fund twice: the second attempt collides on the primary key and
- * surfaces as {@link ProcessedPaymentReplayError}, which the verifier routes
- * into the recovery gates instead of a second fund.
- *
- * The Cashu rail does not use this store — its accumulator insert is already
- * the durable commit point, and its replay key (the `X-Cashu-Request-Id`
- * regime) must stay exactly as-is (dual-idempotency rule, the signed credit contract).
+ * x402/Tempo marker, funding and draw commit in one transaction so a retry
+ * cannot fund twice. Cashu retains its separate accumulator replay regime.
  */
 interface ProcessedPaymentStore {
     /**
@@ -941,11 +835,8 @@ interface ProcessedPaymentStore {
         paymentId: string;
     }): Promise<ProcessedPaymentRecord | undefined>;
     /**
-     * Run `fn` inside one transaction (Postgres: BEGIN → fn → COMMIT, rollback
-     * on throw). The verifier funds and draws the ledger inside `fn`, passing
-     * the handle through to `record` / `CreditLedger.fund` / `draw` so all
-     * three commit atomically. The memory implementation invokes `fn` with no
-     * handle — its operations are synchronous-atomic in-process.
+     * Postgres supplies a transaction for marker, fund and draw; failure rolls it
+     * back. Memory invokes fn without a transactional handle or rollback.
      */
     withTx<T>(fn: (tx?: ProcessedPaymentQuerier) => Promise<T>): Promise<T>;
 }
@@ -1024,7 +915,6 @@ declare class MemoryProcessedPaymentStore implements ProcessedPaymentStore {
  */
 type AccumulatorRejectionCode = "missing_request_id" | "missing_lock_pubkey" | "not_p2pk_locked" | "wrong_lock_pubkey" | "proof_not_unspent" | "proof_pending" | "replay_rejected" | "mint_unreachable" | "invalid_token";
 
-/** Durable state of one exact x402 authorization. */
 type X402ExactSettlementStatus = "prepared" | "submitting" | "settled" | "local_committed" | "ambiguous" | "rejected" | "complete";
 /** Serializable local economic effect that follows an exact settlement. */
 interface X402ExactSettlementEffect {
@@ -1073,7 +963,6 @@ interface X402ExactAuthorizationFacts {
     nonce: string;
     fingerprint: string;
 }
-/** One durable exact-x402 settlement intent. */
 interface X402ExactSettlementIntent extends X402ExactAuthorizationFacts {
     id: string;
     dvmId: string;
@@ -1128,11 +1017,9 @@ interface X402ExactSettlementStore {
     }): Promise<X402ExactSettlementIntent[]>;
     attempts(dvmId: string, intentId: string): Promise<X402ExactSettlementAttempt[]>;
 }
-/** Postgres-backed exact settlement intent store. */
 declare class PostgresX402ExactSettlementStore implements X402ExactSettlementStore {
     private readonly pool;
     constructor(pool: Pick<Pool, "query" | "connect">);
-    /** Create the exact settlement tables. */
     init(): Promise<void>;
     prepare(intent: Omit<X402ExactSettlementIntent, "status" | "createdAt" | "updatedAt" | "resolvedAt">): Promise<X402ExactSettlementIntent>;
     get(dvmId: string, intentId: string): Promise<X402ExactSettlementIntent | undefined>;
@@ -1241,7 +1128,6 @@ type X402ExactAcceptance<T> = {
     intentId: string;
     reason: string;
 };
-/** Dependencies for the durable exact x402 settlement coordinator. */
 interface X402ExactSettlementServerOpts {
     store: X402ExactSettlementStore;
     evidence?: X402ExactSettlementEvidenceReader;
@@ -1264,13 +1150,11 @@ declare class X402ExactSettlementServer {
         effect?: X402ExactSettlementEffect;
         commit: (receipt: X402Receipt, tx?: ProcessedPaymentQuerier, effect?: X402ExactSettlementEffect) => Promise<T>;
     }): Promise<X402ExactAcceptance<T>>;
-    /** Read the operator queue. */
     list(args: {
         dvmId: string;
         limit: number;
         includeResolved?: boolean;
     }): Promise<X402ExactSettlementIntent[]>;
-    /** Read durable attempt evidence for one intent. */
     attempts(dvmId: string, intentId: string): Promise<X402ExactSettlementAttempt[]>;
     /** Reconcile and finish one intent from chain evidence. */
     reconcile(dvmId: string, intentId: string): Promise<{
@@ -1614,7 +1498,6 @@ interface CreateX402BatchSettlementServerOpts {
  */
 declare function createX402BatchSettlementServer(opts: CreateX402BatchSettlementServerOpts): Promise<X402BatchSettlementServer>;
 
-/** Payment state from upfront token verification. */
 interface PaymentInfo {
     /**
      * Rail value this payment contributes to the job, in millisatoshis.
@@ -1647,12 +1530,10 @@ interface PaymentInfo {
     /** Chain transaction returned to a caller recovering this accepted request. */
     paymentTransactionHash?: string;
     /**
-     * Rail-native payment amount in atomic units. Sats for mpp,
-     * USDC microunits for x402. Cashu leaves it unset — the existing
-     * `paidMsats / 1000` derivation in the platform callback covers it.
+     * Stablecoin micro-units for Tempo and x402. Cashu leaves this unset; its revenue is derived
+     * from paidMsats.
      */
     nativeAmount?: number;
-    /** Native asset tag matching `revenue_events.native_asset`. */
     nativeAsset?: "sats" | "usdc" | "usdc.e" | "usd-cents";
     /**
      * Discriminator written into `revenue_events.metadata.cashu_flow` so ops
@@ -1801,7 +1682,6 @@ interface UpfrontPaymentOpts {
      * no per-process replay protection beyond mppx's own expiry check.
      */
     consumedCredentialStore?: ConsumedCredentialStore;
-    /** Cashu receive mode. Routes the receive path. */
     cashuMode?: CashuMode;
     /** Per-DVM Postgres pool — required for the `p2pk-accumulator` path. */
     accumulatorDb?: AccumulatorPool;
@@ -1834,12 +1714,9 @@ interface UpfrontPaymentOpts {
      */
     fxFetcher?: FxFetcher;
     /**
-     * Credit ledger every payment funds and draws through (the credit lifecycle contract):
-     * an attached rail payment is an implicit N=1 funding — `fund` the paid
-     * amount + `draw` it, atomically with the rail commit. When absent (or
-     * when the price can't be fiat-denominated), the payment is accepted with
-     * legacy semantics and a structured warning — money is never refused
-     * because the ledger is unavailable.
+     * Attached payments fund and draw an implicit per-job credit atomically with
+     * rail accounting. Omitting the ledger uses the legacy ledgerless path;
+     * a configured ledger requires a fiat-denominated price before acceptance.
      */
     creditLedger?: CreditLedgerLike;
     /**
@@ -1917,7 +1794,6 @@ interface FundOnlyRequest {
      */
     commitment: string;
 }
-/** Structured payment validation error detail carried through `PaymentValidationError`. */
 interface PaymentErrorDetail {
     body: Record<string, unknown>;
     status: number;
@@ -2065,7 +1941,6 @@ declare function hasPaymentProof(content: Record<string, unknown>): boolean;
  * surfaces always keep charge.
  */
 declare function issueUpfrontChallenges(mpp: MppxServer, requiredMsats: number, resourcePath: string, btcUsdRate: number, sessionIssuable?: boolean, allowOneShotStablecoin?: unknown, priceFiat?: PriceFiat): Promise<Challenge.Challenge[]>;
-/** Verify an upfront payment on job submission (Cashu, x402, or MPP). */
 declare function verifyUpfrontPayment(opts: UpfrontPaymentOpts): Promise<PaymentResult>;
 /**
  * A management credential signed for a channel other than the one required
@@ -2117,25 +1992,9 @@ declare function verifyTempoSessionManagementCredential(args: {
  */
 type PaymentErrorCode = "payment_invalid" | "x402_not_offered" | "x402_settlement_ambiguous" | "cashu_unavailable" | "cashu_not_p2pk_locked" | "mint_health_pending" | "cashu_mint_sick" | "payment_insufficient" | "payment_unapplied" | "insufficient_credit" | "credit_expired" | "credit_unbacked" | "credit_not_found" | "tempo_channel_closing" | "settlement_pending" | "draw_conflict" | "funding_commitment_mismatch" | "credit_not_supported" | "one_shot_credit_not_supported" | "credit_below_min" | "below_rail_minimum" | "credit_over_max" | "credit_id_unavailable" | "nothing_to_drain" | "drain_below_dust" | "drain_not_found" | "drain_conflict" | "drain_method_unsupported" | "tempo_channel_exit_required" | "x402_settlement_submission_failed" | X402SettlementReconciliationReason | "lightning_settlement_pending" | "lightning_invoice_expired" | "lightning_unavailable" | AccumulatorRejectionCode;
 /**
- * Build a flat payment-error body carrying the four agent-facing fields every
- * payment error must have: the machine `code`, the operator-facing
- * `message`, and the `display`/`hint`/`retryable` copy an agent relays to a
- * human and branches retries on. `display`, `hint`, and `retryable` default from
- * {@link PAYMENT_ERROR_COPY} keyed on `code`; `message` is the per-site operator
- * log line. The prose fields can be overridden for dynamic cases (e.g.
- * `cashu_mint_sick` naming the currently-healthy mints, or a retained deposit
- * distinguishing "not spent" from "not paid"). `extra` carries a code's ad-hoc
- * fields (`mints`, `required_msats`, `received_msats`) and is merged last so
- * those are preserved.
- *
- * `retryable` overrides on the same terms, and for the same reason: a code that
- * covers more than one refusal can be terminal for one of them and clear on its
- * own for another — `drain_conflict` is both. Override it only
- * alongside the `hint`, since the two are one answer: a hint that says retry
- * under `retryable: false` is the disagreement this exists to prevent.
- *
- * Upstream of {@link buildPaymentErrorResponse}, which serializes the body onto
- * a `Response` — this shapes it.
+ * Per-code display, hint and retryability may be overridden for a particular
+ * refusal. Keep the hint and retry decision consistent. Extra fields merge
+ * last, so callers can supply code-specific amounts and alternatives.
  */
 declare function paymentErrorBody(code: PaymentErrorCode, opts: {
     message: string;
@@ -2216,14 +2075,9 @@ interface IncomingPaymentOpts {
     creditTtlMs?: number;
 }
 /**
- * Pure verification of an incoming mid-job payment. Runs the
- * rail-specific verify path and returns the credit shape; does not mutate
- * the job. The caller (`JobManager.processPayment`) applies the result
- * inside Tx C so verify+credit land atomically.
- *
- * `snapshot` carries the read-only job state the verification path needs
- * (`pendingPaymentMsats` for amount checks, the MPP/x402 per-job bindings,
- * `paymentRail` for the same-rail accumulator check).
+ * Job state read by incoming-payment verification; the job itself is not mutated. Rail
+ * acceptance and ledger funding can still occur before the caller applies the returned credit in
+ * Tx C.
  */
 interface VerifyIncomingSnapshot {
     pendingPaymentMsats?: number;
@@ -2326,16 +2180,8 @@ declare function verifyIncomingPayment(body: {
  */
 declare function applyPaymentInfoToJob(job: ServerJob, info: VerifiedIncomingPayment): void;
 /**
- * Process an incoming payment message. Returns an error body on failure.
- *
- * **The isolate-runtime path, and deliberately ledger-less** (the isolate-runtime rule). Its
- * only caller is `platform/isolate-job-manager.ts`; isolate DVMs have no
- * Postgres of their own, so they run implicit N=1 with today's semantics
- * preserved and never advertise credit. The credits-carrying mid-job path is
- * {@link verifyIncomingPayment} + `JobManager.processPayment` (Tx C), where
- * wired `fund` + `growDraw`. Wiring a ledger here would need a
- * platform-side ledger leg with its own funding-atomicity and receipt-key
- * story — the trust-surface expansion exists to decide.
+ * Legacy ledgerless payment path. Mutates the job on acceptance; durable credit hosts use
+ * verifyIncomingPayment and apply its result in Tx C.
  */
 declare function processIncomingPayment(job: ServerJob, body: {
     type: MessageType;
@@ -2414,14 +2260,8 @@ interface ReceiptIssuerOpts {
     dvmId: string;
 }
 /**
- * Signs job receipts for one DVM.
- *
- * Constructed only when a receipt key is wired, so the presence of an issuer
- * *is* the "this DVM emits receipts" signal that `/v1/info` advertises. Pure:
- * it holds the key and the slug and turns a terminal `JobRecord` plus an
- * allocated sequence number into signed bytes — sequence allocation and
- * persistence belong to the store, which is what makes issuance idempotent
- * across machines.
+ * An issuer indicates receipt support. Sequence allocation and write-once
+ * persistence belong to the store; signing alone does not provide idempotency.
  */
 declare class ReceiptIssuer {
     /** x-only pubkey this issuer signs under; the attested `receipt_pubkey`. */
@@ -2431,20 +2271,10 @@ declare class ReceiptIssuer {
     private readonly dvmId;
     constructor(opts: ReceiptIssuerOpts);
     /**
-     * Build and sign the receipt for a terminal job. `seq` comes from
-     * `JobStore.claimReceiptSeq`; `issuedAt` is epoch seconds and defaults to now.
-     *
-     * Free jobs get receipts too, with `paid.msats: 0` — they still consume a
-     * sequence number and still attest an outcome. Whether feedback is
-     * paid-only is the feedback layer's call, not this one's.
-     *
-     * Timing and attribution come from the committed terminal row, not signing
-     * time or handler input. Legacy rows without those durable inputs omit the
-     * optional blocks rather than inventing historical evidence.
-     *
-     * `credit` is the resolved draw block — present on every job
-     * whose payment funded/drew the ledger, absent otherwise. Signature-
-     * compatible either way: `canonicalize` omits absent keys.
+     * seq is store-allocated; issuedAt is epoch seconds. Free jobs also consume a
+     * sequence and attest their outcome. Timing/attribution comes from the committed
+     * terminal row; legacy rows omit unknown historical fields. credit is present
+     * only for a resolved ledger draw.
      */
     issue(record: JobRecord, seq: number, issuedAt?: number, credit?: ReceiptCredit): JobReceipt;
     /**
@@ -2544,9 +2374,9 @@ interface JobManagerOpts {
     env: Record<string, string>;
     store: KVStore;
     mints?: string[];
-    /** Persistent backing store for job records. Default: in-memory. */
+    /** Durable in production; defaults to memory only in development/test mode. */
     jobStore?: JobStore;
-    /** When true, payment messages auto-credit without verification. */
+    /** Skips payment only when no payment rail is configured. Wired rails still verify. */
     devMode?: boolean;
     /** Payment methods this DVM accepts. Default: derived by the server from configured rails. */
     paymentMethods?: PaymentMethod[];
@@ -2555,9 +2385,7 @@ interface JobManagerOpts {
     x402ExactSettlement?: X402ExactSettlementServer;
     /** Live facilitator capabilities for version-specific mid-job payment handling. */
     x402FacilitatorHealth?: X402FacilitatorHealthLike;
-    /** MPP multi-rail payment handle (built via `createMppFromOpts`). */
     mpp?: MppxServer;
-    /** Cashu receive mode. */
     cashuMode?: CashuMode;
     /** Builder's NUT-11 P2PK lock pubkey. Required for accumulator mode. */
     lockPubkey?: string;
@@ -2693,16 +2521,10 @@ interface JobManagerOpts {
      */
     onRevenueSkippedNoRail?: (info: RevenueSkippedNoRailPayload) => void | Promise<void>;
     /**
-     * Stale-job sweep threshold in ms. Jobs in a non-terminal status
-     * (`processing` / `working` / `awaiting-input`) whose `lastActivityAt` is
-     * older than this are force-cancelled with reason `stale_no_terminal_status`,
-     * so callers always reach a terminal status instead of polling forever after
-     * a worker crash, OOM, or silent `messageAppender` failure. Default:
-     * `2 × descriptor.idleTimeout + STALE_JOB_WATCHDOG_HEADROOM_MS`, which keeps
-     * the default beyond scrape's `JOB_TIMEOUT_MS`.
-     * Builders whose per-handler wall-clock bound exceeds 90s must override
-     * this — otherwise the watchdog fires on a legitimate in-flight handler.
-     * Set to `0` to disable (test seam).
+     * Awaiting-input age in milliseconds before cancellation. Defaults to
+     * twice descriptor.idleTimeout (seconds), converted to milliseconds, plus
+     * STALE_JOB_WATCHDOG_HEADROOM_MS. Set to 0 to disable this arm; processing
+     * jobs use processingWatchdogMs.
      */
     staleJobTimeoutMs?: number;
     /**
@@ -2907,9 +2729,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * never promise something `issueReceipt` silently declines to do.
      */
     get receiptsEnabled(): boolean;
-    /** True when the named capability exists on this descriptor. */
     hasCapability(name: string): boolean;
-    /** Names of every capability this descriptor exposes — used for error envelopes. */
     capabilityNames(): string[];
     /**
      * Resolve a capability's static `price` to msats.
@@ -3101,9 +2921,7 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
      * `artifact`'s NOTIFY silently drops the artifact.
      */
     private wireMessageAppender;
-    /** Start (or restart) the idle timer for a job. */
     startIdleTimer(job: ServerJob): void;
-    /** Clear the idle timer for a job. */
     clearIdleTimer(id: string): void;
     /** Cancel a job due to idle timeout. Exposed for the reactivation path's idle-expiry guard. */
     cancelJobIdle(job: ServerJob): Promise<void>;
@@ -3609,7 +3427,6 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     private reportTerminalJob;
     private terminalReportRecoveryCursor?;
     private recoverTerminalReports;
-    /** Handle job reaching terminal state (completed, failed, cancelled). */
     private handleJobTerminal;
     /**
      * Re-enqueue terminal cost-only rows left between the job commit and outbox
@@ -3671,19 +3488,16 @@ declare class JobManager<State, InputSchema extends ZodLike | undefined> {
     private bookRevenue;
     /** Schedule job removal from activeJobs after a delay so clients can still poll final status. */
     scheduleCleanup(job: ServerJob): void;
-    /** Clear all timers. Called on server shutdown to allow clean exit. */
     shutdown(): void;
 }
 
 /** Cached liveness signal for a platform-hosted DVM's Lightning receive rail. */
 interface LightningRailHealth {
-    /** Whether the receive rail may be advertised at this instant. */
     available(): boolean;
     /** Prime the cached signal at boot when the source supports it. */
     refresh?(): Promise<void>;
 }
 
-/** Builder-facing wiring for the Lightning receive leg. */
 interface LightningReceiveConfig {
     /**
      * Receive-only NWC connection URI (`DVMKIT_NWC_RECEIVE_URI`). Validated at
@@ -3722,25 +3536,14 @@ declare const DEFAULT_INVOICE_TTL_SECONDS = 900;
  */
 declare const MIN_INVOICE_TTL_SECONDS = 600;
 /**
- * The builder-side Lightning receive leg for funding prepaid credit.
- *
- * Issues a bolt11 over a **receive-only** NWC connection while the DVM is
- * awake serving the 402, and credits the ledger when a later request observes
- * settlement. Two properties are load-bearing:
+ * Prepaid Lightning funding over a receive-safe NWC connection. URI construction validates
+ * the advertised method allowlist, refusing spending or unknown authority; the injected
+ * backend seam bypasses that probe. Receive-safe methods include invoice, read and
+ * hold-invoice operations.
  *
- * - **It never holds a send credential.** `pay_invoice` on this connection is
- * refused at construction, so a compromised DVM can mint invoices and
- * nothing else. The drain/refund sender is a separate, budgeted
- * connection by rule.
- * - **Crediting is pull-based — there is no settlement watcher.** The caller's
- * next request drives `lookup_invoice`, which is what makes this work on a
- * suspend-to-zero fleet: a machine that is asleep has nothing to miss.
- * Wallet downtime at that moment delays crediting; it never loses money,
- * because the invoice→credit binding is a durable row.
- *
- * Reachability is **cached**, never probed per request: the funding menu is
- * assembled on every quote and every 402, so a live NIP-47 round trip there
- * would put a nostr relay in the latency path of every priced call.
+ * Crediting is pull-based: later requests observe settlement against the durable invoice
+ * binding, so sleeping hosts need no watcher. Reachability is cached and refreshed in the
+ * background for funding menus.
  */
 declare class LightningReceive {
     private readonly source;
@@ -3753,36 +3556,21 @@ declare class LightningReceive {
     private constructor();
     private readonly railHealth;
     /**
-     * Validate the configured connection and build the receive leg, or return
-     * `undefined` when this DVM didn't configure one.
-     *
-     * **Throws on a credential that is wrong, degrades on one that is merely
-     * unreachable.** A wallet outage at boot must not stop a DVM whose other
-     * rails are fine — the menu simply omits `lightning` until a later probe
-     * succeeds. A connection that can spend, or one that can't state what it can
-     * do, is a different thing entirely: it is a standing money risk that no
-     * amount of retrying fixes, so it fails the boot loudly with the fix in the
-     * message.
+     * Return undefined when unconfigured. Permission/URI failures refuse construction with a
+     * corrective message; wallet transport failure constructs an unavailable receive leg so
+     * other rails can still boot. Recovery must validate method scope before advertising
+     * Lightning.
      */
     static create(config: LightningReceiveConfig): Promise<LightningReceive | undefined>;
     /**
-     * Whether `lightning` belongs on the funding menu right now.
-     *
-     * Reads the cached observation and never blocks; a stale one kicks off a
-     * background refresh and answers with what we last knew. Advertising a rail
-     * whose wallet is down would hand the caller an option that 402s on use —
-     * the §4 posture is to drop it and let the sale survive on the others.
+     * Answer from cached wallet and optional rail-health observations without blocking. A stale
+     * wallet observation starts a background refresh.
      */
     available(): boolean;
     /**
-     * Issue (or re-issue) the bolt11 funding `(creditId, fundId)`.
-     *
-     * The invoice is minted **for** the credit and amount named in the caller's
-     * signed body — that binding is the condition-3 commitment on this
-     * rail, and it is why no artifact hash rides the request: there is no
-     * caller-supplied artifact to hash. A re-poll returns the stored row rather
-     * than minting again; a second bolt11 for one `fund_id` would leave two
-     * payable invoices against a funding that can only be credited once.
+     * Return the stored invoice on retry: two payable bolt11s for one fund ID could charge
+     * twice while only one credits. Caller and amount are bound to the recorded credit/funding
+     * pair, without a caller-supplied artifact hash.
      */
     issue(ledger: CreditLedgerLike, args: {
         creditId: string;
@@ -3794,24 +3582,9 @@ declare class LightningReceive {
         description?: string;
     }): Promise<CreditInvoiceRecord>;
     /**
-     * Ask the wallet whether one payment hash is paid, and when.
-     *
-     * The operator's reconcile verb runs this before it credits anything. A
-     * `blocked` row implies payment — {@link applyOne} returns above the block
-     * classification when the lookup says unpaid — but that is *this fleet's
-     * belief, recorded possibly weeks ago*, and the verb it gates mints balance
-     * against it. One round trip turns the belief into a fact and recovers the
-     * true settlement instant for `settled_at`, which a blocked row never got to
-     * write.
-     *
-     * Unlike {@link settlePending} this **throws**: there is no request whose
-     * latency it protects, and crediting on an unverifiable wallet is exactly
-     * what it exists to prevent. `NOT_FOUND` is the one exception, and it is not
-     * an outage — it is the wallet saying it has never seen this hash, the same
-     * reading {@link applyOne} and the caller-side reconcile in `src/lib/nwc.ts`
-     * take. It comes back as `known: false` because the operator's repair for it
-     * ("you are pointed at a different wallet than the one that minted this")
-     * is not the repair for an unpaid invoice, and certainly not for a retry.
+     * Re-observe the wallet payment before an operator credits a blocked invoice and recover
+     * its settlement instant. Unlike settlePending, lookup failures throw. NOT_FOUND returns
+     * known:false, distinguishing the wrong wallet/unknown hash from an unpaid known invoice.
      */
     lookupSettlement(paymentHash: string): Promise<{
         settled: boolean;
@@ -3819,23 +3592,12 @@ declare class LightningReceive {
         known: boolean;
     }>;
     /**
-     * Consult the wallet about this caller's outstanding invoices and credit the
-     * ones that settled — the pull half of pull-based crediting.
-     *
-     * The pending rows are read locally first, so the common case (nothing
-     * outstanding) costs one indexed SELECT and no network at all. Bounded to
-     * {@link MAX_SETTLE_CHECKS} invoices on a short deadline, and **never throws
-     * into the request**: a wallet failure here means the caller's balance is
-     * merely not updated yet, which the ordinary `insufficient_credit` path
-     * already states honestly.
+     * Read pending invoices locally, then check at most MAX_SETTLE_CHECKS on bounded wallet
+     * deadlines. Log failures without throwing into the request.
      *
-     * **Each invoice gets its own failure boundary.** The sweep window is a few
-     * rows wide, so a row that fails on its own terms — a `fund_id` the caller
-     * reused on another rail, a credit someone else opened first — must not take
-     * the rest of the pass down with it: the next invoice in the window may be
-     * the paid one, and it would never be looked up. Only a transport failure
-     * ends the pass early, because there the wallet itself is gone and the
-     * remaining lookups would just spend the caller's latency confirming it.
+     * An invoice-specific failure must not suppress payable siblings; wallet transport failure
+     * ends the pass. Deterministic refusals retire that row as blocked for operator repair,
+     * while transient failures remain pending.
      */
     settlePending(ledger: CreditLedgerLike, args: {
         callerPubkey: string;
@@ -3845,49 +3607,21 @@ declare class LightningReceive {
         enqueueCreditDeposit?: CreditDepositEnqueue;
         nowMs?: number;
     }): Promise<InvoiceSettlement[]>;
-    /**
-     * One invoice's settlement check. Returns the applied settlement, or
-     * `undefined` when nothing changed (still unpaid, or retired unpaid).
-     *
-     * Throws whatever the wallet or the ledger threw — classifying that is
-     * {@link retireOrLog}'s job, so this stays one invoice's happy path.
-     */
     private applyOne;
     /**
-     * Decide what one invoice's failure means, and retire the invoice when the
-     * answer is "this can never succeed".
-     *
-     * The split that matters is permanent-versus-transient, because it decides
-     * whether the row keeps a slot in the sweep window. A transient failure — the
-     * database blinked, the wallet answered oddly — leaves it `pending` and the
-     * caller's next request retries it. A **permanent** one means the ledger will
-     * refuse this invoice identically forever, so leaving it pending costs a
-     * `lookup_invoice` on every subsequent request and, at
-     * {@link MAX_SETTLE_CHECKS} of them, fills the window so a genuinely payable
-     * invoice behind them is never even looked up. Those get `blocked`, which
-     * drops them out of the sweep and hands the operator the payment hash.
+     * Retire a deterministic uncreditable payment as blocked so it no longer occupies the
+     * bounded sweep window. Transient failures stay pending for a later request; report the
+     * payment hash for operator repair.
      */
     private retireOrLog;
     /**
-     * The reason this invoice can never be credited, or `undefined` if the
-     * failure was transient.
-     *
-     * Every code here is decided by state a retry cannot move — a row the ledger
-     * has already committed (a `credit_fundings` entry at this
-     * `(credit_id, fund_id)`, or a `credits` row whose owner, denomination or
-     * rail disagrees with the invoice), or the basis this module rebuilds
-     * identically from the invoice row on every pass. None of them is a race.
-     *
-     * `funding_replayed` is the one that needs a second read to classify.
-     * Usually it *is* benign — a concurrent check won the race and the money is
-     * credited either way — but the key is `(credit_id, fund_id)` and `fund_id`
-     * is **caller-chosen**: reuse it on cashu or x402 after this bolt11 was
-     * minted and the row that collided is a different payment entirely, so the
-     * sats this invoice received have nowhere to land.
+     * Classify funding_replayed by reading the existing funding’s rail. A Lightning row can
+     * represent a concurrent applied check; another rail at this caller-chosen key is a
+     * different payment, leaving the invoice’s sats uncredited. A failed diagnostic read
+     * remains transient, never a guessed permanent refusal.
      */
     private blockingReason;
     private withBackend;
-    /** Record activity without letting it promote an unvalidated connection. */
     private noteOperationOk;
     private notePermissionsOk;
     private notePermissionRefused;
@@ -3910,7 +3644,7 @@ interface OwnerDisplay {
     avatarUrl?: string | null;
     type: "builder" | "org";
 }
-/** Optional builder identity surfaced on `/v1/info` (forward-compatible stub). */
+/** Builder identity advertised on /v1/info. */
 interface BuilderIdentity {
     id?: string;
     name?: string;
@@ -3935,7 +3669,6 @@ interface PlatformReporterOpts {
     /** Platform internal URL. Defaults to `DVMKIT_PLATFORM_URL` env. */
     url?: string;
 }
-/** Running host handle returned by serve(). */
 interface DVMServeResult {
     url: string;
     close: () => Promise<void>;
@@ -3957,7 +3690,6 @@ interface DVMHostOpts {
      * to ambient process variables.
      */
     env?: Record<string, string>;
-    /** Builder identity for `/v1/info` (forward-compatible). */
     builder?: BuilderIdentity;
     /** Owner display identity for `/v1/info#owner`. Falls back to env vars. */
     owner?: OwnerDisplay;
@@ -3985,7 +3717,6 @@ interface DVMHostOpts {
     pool?: Pool;
     /** Cashu mints accepted. Defaults to env `DVMKIT_CASHU_MINTS`. */
     mints?: string[];
-    /** Cashu receive mode override. */
     cashuMode?: CashuMode;
     /** MPP handle override. Defaults to env-resolved via `createMppFromOpts`. */
     mpp?: MppxServer;
@@ -4008,9 +3739,7 @@ interface DVMHostOpts {
     onPaidJobCompleted?: (event: PaidJobCompletion) => void | Promise<void>;
     /** When true, payment is skipped only when no payment rail is configured. */
     devMode?: boolean;
-    /** Consumed-credential store override (test seam). */
     consumedCredentialStore?: ConsumedCredentialStore;
-    /** Mint-health tracker override (test seam). */
     mintHealthTracker?: MintHealthTracker;
     /** Operator-alert boundary for failed terminal-job retention passes. */
     onJobRetentionSweepFailed?: JobManagerOpts["onJobRetentionSweepFailed"];
@@ -4023,12 +3752,10 @@ interface DVMHostOpts {
      */
     wrapRouteClientCompatibility?: (sdkGate: ClientCompatibilityGate) => ClientCompatibilityGate;
 }
-/** Per-mount options. Currently only `prefix` is supported. */
 interface MountOpts {
     /** Path prefix for this DVM's protocol routes (e.g. `/delete-feed`). */
     prefix?: string;
 }
-/** Live DVM host. Single wiring locus for the SDK. */
 interface DVMHost {
     /**
      * Underlying Hono app for custom non-protocol routes that belong to the
@@ -4057,7 +3784,6 @@ interface DVMHost {
      * a single mount with no prefix attaches at root.
      */
     mount<S, I extends ZodLike | undefined>(descriptor: DVMDescriptor<S, I>, opts?: MountOpts): void;
-    /** Start listening. Returns the live server handle. */
     serve(opts?: {
         port?: number;
     }): Promise<DVMServeResult>;
@@ -4101,22 +3827,10 @@ interface TempoObserverHealth {
     /** Prime the cached signal at boot. */
     refresh?(): Promise<void>;
     /**
-     * Register a mount's `tempo/session` **capability** so the poll can carry it
-     * back to the platform.
-     *
-     * The platform's `dvms.tempo_session_advertised_at` — the only filter on the
-     * close observer's payee-fallback rung 2 — was written once per container
-     * deploy and never refreshed, so a builder flipping sessions on with
-     * `dvmctl env --set` stayed invisible to the fallback indefinitely. That is a
-     * `no_route` on the first close of that DVM's first channel, which is exactly
-     * the race the rung exists to cover.
-     *
-     * The reader must answer from **configuration**, never from
-     * {@link TempoObserverHealth.available} — a fail-closed gate blip must not
-     * de-stamp the DVM, which is the failure through a new door.
-     *
-     * Returns a disposer the mount calls on shutdown, so a torn-down capability
-     * stops voting in the OR below.
+     * Report the OR of mounted session capabilities to keep the platform's
+     * observer watch signal current. Readers must use configuration, not current
+     * availability: an observer outage must not erase the capability it watches.
+     * The returned disposer removes a mount's contribution on shutdown.
      */
     declareSessionCapability?(read: () => boolean): () => void;
 }
@@ -4164,7 +3878,6 @@ interface TempoSettlementReadinessStateStore {
     clearFailureIfRefilled(version: string, balanceMicro: bigint, lowBalanceMicro: bigint): Promise<boolean>;
     clearFailureAfterSuccessfulTransaction(version: string): Promise<boolean>;
 }
-/** Construction inputs for {@link TempoSettlementReadiness}. */
 interface TempoSettlementReadinessOptions {
     address: `0x${string}`;
     network: string;
@@ -4211,7 +3924,6 @@ declare class TempoSettlementReadiness {
     start(): void;
     /** Stop the cadence without affecting any in-flight reading. */
     stop(): void;
-    /** Read and report the configured fee-token balance now. */
     checkBalance(opts?: {
         successfulTransaction?: boolean;
         recoveryVersion?: string;
@@ -4234,24 +3946,11 @@ declare class TempoSettlementReadiness {
     private notify;
 }
 
-/**
- * Options for the revenue reporter readiness assertion.
- *
- * The check branches on `platformUrl` presence — that's the unambiguous
- * "platform-hosted" signal. `failFast` stays on the opts as a general SDK
- * strict-mode flag but is not consulted by this assertion.
- */
 interface RevenueBootCheckOpts {
     /**
-     * General SDK strict-mode flag, sourced from `DVMKIT_FAIL_FAST` at the host
-     * boundary. Reserved for future warning-vs-fatal SDK checks; the
-     * reporter check itself ignores it, hence optional.
+     * Reporter readiness ignores this host strict-mode flag.
      */
     failFast?: boolean;
-    /**
-     * The SDK's canonical "this is a dev/test run" signal. Exempts the boot from
-     * the platform-hosted wiring requirement — see below.
-     */
     devMode?: boolean;
     platformToken: string | undefined;
     platformUrl: string | undefined;
@@ -4356,10 +4055,8 @@ interface SDKServerOpts {
     /** Postgres pool for builder admin state and wallet accumulator persistence. */
     db?: Pool;
     /**
-     * General SDK strict-mode flag, sourced from `DVMKIT_FAIL_FAST` at
-     * the host boundary. Reserved for future warning-vs-fatal SDK checks; the
-     * revenue-reporter boot check is gated on platform context, not on this
-     * flag.
+     * Host strict-mode flag. Reporter readiness follows hosted context regardless
+     * of this value.
      */
     failFast?: boolean;
     /** Agent-wallet: per-DVM identifier — drives the monitor advisory lock + replay key. */
@@ -4486,12 +4183,6 @@ interface SDKServerOpts {
      */
     creditExpirySweep?: CreditExpirySweepOpts;
 }
-/**
- * Builds a Hono sub-app for one DVM descriptor, wires payment verification,
- * auto-wires `RevenueReporter` when platform env + db + dvmId are present, and
- * runs the platform-hosted partial-wiring assertion — gated on
- * `DVMKIT_PLATFORM_URL` presence, independent of `DVMKIT_FAIL_FAST`.
- */
 declare function createDVMServer<State, InputSchema extends ZodLike | undefined>(descriptor: DVMDescriptor<State, InputSchema>, opts: SDKServerOpts): Promise<{
     app: Hono<AppEnv>;
     authAudience?: SignedRequestAudience;
@@ -4533,13 +4224,8 @@ interface AppEnv {
 declare function unknownRouteNotFound(c: Context): Response;
 
 /**
- * The public prepaid-credit terms a DVM advertises before a caller identifies
- * itself. Snake_case: this is the wire shape.
- *
- * This type deliberately excludes the per-caller echo. `/v1/info` is public
- * and cacheable, so its type must make a caller credit ID or balance
- * unrepresentable rather than relying on the current handler not to ask for
- * one.
+ * Public, cacheable prepaid terms exclude caller IDs and balances. toCreditTerms explicitly
+ * whitelists this shape so later caller-specific menu fields cannot leak into /v1/info.
  */
 interface CreditTerms {
     /** Smallest funding accepted, in 1e-6 units of `currency`. */
@@ -4552,7 +4238,10 @@ interface CreditTerms {
     currency: string;
     /** Rails a top-up may be funded over. */
     funding: FundingMethod[];
-    /** MPP instruments offered or temporarily withheld for credit funding. */
+    /**
+     * Tempo methods are actionable. withheld names configured but temporarily unavailable
+     * instruments, preserving capability discovery without advertising them for funding.
+     */
     tempo?: {
         methods: {
             method: string;
@@ -4564,63 +4253,32 @@ interface CreditTerms {
             reason: string;
         }[];
     };
-    /** x402 flavours accepted for credit funding. */
+    /**
+     * Present with offered x402 funding. Reusable batch settlement is enabled by default; exact
+     * requires explicit acceptance of its manual refund obligation.
+     */
     x402?: {
         schemes: {
             scheme: string;
             network: string;
         }[];
     };
-    /** Smallest Lightning funding accepted, in 1e-6 units of `currency`. */
+    /**
+     * Configured Lightning receive floor in micro-units of currency, including the advertised
+     * FX margin. Issuance checks the raw sats floor at current rates; arbitrary drift can still
+     * make the advertised amount insufficient.
+     */
     lightning_min_micro?: number;
 }
 /**
- * The **funding menu** a DVM advertises on `/v1/quote` and in every 402;
- * this is the snake_case wire shape.
+ * Funding options and sizing in the wire denomination. max_micro limits residual balance,
+ * not a job’s price; fund-and-draw can spend a larger payment immediately. Lightning funds
+ * credit but is not an attached-proof payment method.
  *
- * `min_micro` / `max_micro` / `ttl_ms` are the DVM's sizing terms — `max_micro`
- * binds the **residual balance**, not a funding amount, so a job priced above
- * it still clears as fund-and-immediately-draw. `funding` is the rail list a
- * top-up may arrive on — a {@link FundingMethod}, not a `PaymentMethod`, since
- * `lightning` funds a credit without ever being an attached-proof wire method.
- * A rail whose backing wallet is unreachable drops out and the sale survives
- * on the others.
- *
- * The `credit_id` / `balance_micro` / `remaining_micro` / `expiry_ms` echo
- * appears only for an authenticated caller who already holds a live credit —
- * so one round trip answers "what does this cost, and what do I have left?"
- * through the signed credit endpoint.
+ * An authenticated caller’s live credit may add an echo with funded and spendable balance;
+ * pending holds are included only in the funded figure.
  */
 interface CreditMenu extends CreditTerms {
-    /**
-     * MPP instruments accepted for this credit, reusable sessions first when
-     * available.
-     *
-     * `withheld` names an instrument this DVM is configured for and is not
-     * offering at this instant, with the reason. Two audiences read
-     * it. An agent gets to relay *why* `tempo/session` vanished instead of
-     * inferring the DVM never had it. And the platform's deploy probe reads
-     * capability from `methods ∪ withheld`, so a deploy landing during an
-     * observer blip no longer stamps `tempo_session_advertised_at` NULL and
-     * drops the DVM out of the close observer's payee fallback permanently.
-     * `methods` stays the list a caller acts on — never widen it to include a
-     * withheld instrument.
-     */
-    /**
-     * Which x402 flavours a top-up may arrive on, and the chain each rides
-     * Present exactly when `funding` lists `x402`. Reusable
-     * `batch-settlement` is admitted by default; one-payment `exact` appears
-     * only when the builder explicitly accepts its manual refund obligation.
-     */
-    /**
-     * Smallest funding the `lightning` rail accepts, in 1e-6 units of
-     * `currency`. Present only when `funding` lists `lightning`. This is the
-     * deployment's sats-physical receive floor rendered into fiat
-     * with a ×{@link LIGHTNING_FLOOR_FX_MARGIN} margin absorbing rate drift
-     * between menu fetch and funding — issuance enforces the *raw* floor at
-     * request-time rates, so funding exactly this figure always clears. Rails
-     * without an entry (cashu) have no floor beyond `min_micro`.
-     */
     /** The caller's credit this echo describes. Present only with the echo. */
     credit_id?: string;
     /** Funded balance, pending holds NOT subtracted. */
@@ -4630,7 +4288,6 @@ interface CreditMenu extends CreditTerms {
     /** Absolute expiry of the echoed credit, ms since epoch. */
     expiry_ms?: number;
 }
-/** Everything {@link buildCreditMenu} needs, assembled per request. */
 interface BuildCreditMenuArgs {
     /**
      * Which runtime is answering. `"isolate"` is refused unconditionally — see
@@ -4640,13 +4297,8 @@ interface BuildCreditMenuArgs {
     /** The DVM's resolved `credit` block; `undefined` means it didn't opt in. */
     config: ResolvedCreditConfig | undefined;
     /**
-     * Currency the menu — and the credit it funds — denominates in: the DVM's
-     * declared `DVMConfig.currency`, which every call site reads off the single
-     * `DVMServer.creditCurrency()`. Deliberately *not* the currency of
-     * the response this menu rides on: a quote priced elsewhere is refused before
-     * it reaches here, so the two agree, and sourcing it from the response is
-     * what left `POST /v1/credit` — which has no response to read — funding in
-     * hardwired USD at a DVM whose jobs draw in something else.
+     * Use the DVM’s declared denomination, including /v1/credit where no quote response supplies
+     * it. Quote validation refuses a different denomination before menu construction.
      */
     currency: string;
     /** Rails this DVM settles over — the menu's funding options. */
@@ -4662,31 +4314,19 @@ interface BuildCreditMenuArgs {
         intent: "charge" | "session";
         reason: string;
     }[];
-    /**
-     * x402 flavours this DVM can actually accept a top-up on — one
-     * server read, so what the sub-block advertises is what `/v1/credit` will
-     * answer a 402 with.
-     */
     x402Schemes?: {
         scheme: string;
         network: string;
     }[];
     /**
-     * The deployment's Lightning receive floor in sats, when `lightning` is on
-     * the menu — rendered into `lightning_min_micro`. An fx failure during that
-     * rendering drops `lightning` from `funding` rather than suppressing the
-     * menu: a rail whose minimum we can't state honestly is a rail we must not
-     * advertise, but the other rails' sale survives.
+     * Configured raw receive floor in sats, rendered with an FX margin for the menu. Failure
+     * omits Lightning while allowing the rest of the menu; issuance checks the raw floor at
+     * current request-time rates.
      */
     lightningFundingMinSats?: number;
     /**
-     * Whether this DVM has at least one accepted Cashu mint configured
-     * Without one, no Bitcoin funding rail may be advertised — see
-     * the filter in {@link buildCreditMenu}.
-     *
-     * Read off the **configured** mint list, never the health-filtered
-     * advertised one: a mint blip must not make a funding rail appear and
-     * disappear between quotes.
+     * Read the configured accepted mint list, not its health-filtered advertisement. Non-channel
+     * Bitcoin refunds need a mint, but configuration alone does not establish refund solvency.
      */
     hasAcceptedMint?: boolean;
     fxFetcher: FxFetcher;
@@ -4699,50 +4339,18 @@ interface BuildCreditMenuArgs {
     callerPubkey?: string;
 }
 /**
- * Assemble the funding menu, or return `undefined` when this DVM must not
- * advertise credit. **The refusal ladder is the feature**; each rung exists
- * because advertising anyway would misadvertise:
+ * Return no menu for static ineligibility or unresolvable denomination bounds. Isolates
+ * currently lack durable credit storage; anonymous balances must not be advertised.
  *
- * 1. **Isolate runtime** (the isolate-runtime rule) — checked first and unconditionally,
- * before config is even read. Isolate DVMs have no Postgres of their own;
- * their only DVM-side persistence is the last-write-wins callback KV, which
- * the durable-ledger requirement prohibits for credit state. Until isolate
- * runtimes have durable credit storage, they run implicit N=1 only and their quote never offers
- * credit so nothing is misadvertised.
- * 2. **Not opted in** — no `credit` block on `configureDVM`.
- * 3. **No descriptor auth** — a credit belongs to a verified secp256k1 pubkey.
- * Without auth the ledger's funder identity degrades to the requester id or
- * `"anonymous"` (see `resolveLedgerContext`), which would pool every
- * anonymous caller's money into one balance. Advertising a per-caller
- * balance on such a DVM would be a lie at best and a disclosure at worst.
- * 4. **Non-durable ledger outside devMode** — a `MemoryCreditLedger` is
- * per-process, so a caller funding on machine A and drawing on machine B
- * gets `credit_not_found`. Advertise only what survives the fleet.
- * 5. **Bounds not expressible in `currency`** — an fx outage, or a currency the
- * snapshot doesn't carry. Omit rather than quote a number we can't state.
- *
- * The balance echo is added only when a verified `callerPubkey` holds a live,
- * same-currency credit.
- *
- * Rungs 1–4 live in {@link creditMenuConfigured}, which the capability refresh
- * reads too.
+ * Select the caller echo only from live, same-currency credits with spendable value.
  */
 declare function buildCreditMenu(args: BuildCreditMenuArgs): Promise<CreditMenu | undefined>;
 /**
- * The one credit a caller's quote echoes, from the several they may hold —
- * every implicit N=1 payment mints its own `imp:<rail>:<paymentId>` credit, so
- * this list grows with each paid job.
+ * Choose the largest live, active, same-currency spendable balance; newest creation breaks
+ * a tie. Released implicit payments can hold reclaimable value and are eligible too.
  *
- * Live, same-currency credits with something left in them; largest spendable
- * balance wins, newest breaks a tie. That is the credit a caller would in fact
- * draw against next. A failed job's released hold leaves a positive implicit
- * balance, which is real caller money (the credit lifecycle contract, no debit on failure) and is
- * echoed like any other.
- *
- * **Requires a verified pubkey.** Never call this with a requester id or
- * `"anonymous"`: on an auth-less DVM the ledger pools every anonymous caller
- * under one `caller_pubkey`, so echoing it would show one caller another's
- * balance.
+ * The caller supplies a verified pubkey. Anonymous/missing identity returns no credit; the
+ * ledger’s anonymous pool must not be exposed to an individual caller.
  */
 declare function selectPrimaryCredit(args: {
     ledger: CreditLedgerLike;
@@ -4750,20 +4358,15 @@ declare function selectPrimaryCredit(args: {
     currency: string;
     nowMs?: number;
 }): Promise<CreditSnapshot | undefined>;
-/** Narrow a ledger snapshot to the read-only shape a quote handler receives. */
 declare function toCreditView(snapshot: CreditSnapshot): CreditView;
 /**
- * Attach a menu to a response body when there is one. Keeps the "omit the key
- * entirely rather than emit `credit: null`" rule in one place — every consumer
- * checks presence, and the isolate tier depends on the key never appearing.
+ * Omit the credit key entirely when there is no menu; consumers use presence to determine
+ * whether credit is offered.
  */
 declare function attachCreditMenu(body: Record<string, unknown>, menu: CreditMenu | undefined): Record<string, unknown>;
 /**
- * Project a quote/402 menu onto the public, cache-safe `/v1/info` terms.
- *
- * This is an explicit whitelist rather than object rest syntax: a later
- * caller-specific field added to {@link CreditMenu} cannot cross this boundary
- * until someone deliberately adds it to {@link CreditTerms} and this copy.
+ * Explicitly whitelist public /v1/info terms. A future caller-specific menu field cannot
+ * cross this cacheable boundary merely by being added to CreditMenu.
  */
 declare function toCreditTerms(menu: CreditMenu): CreditTerms;