Builds a topUp operation: a buyer's cleared cash becomes spendable credit. On commit it
credits the user's spendable account against STORED_VALUE, and a second posting books the
backing USD into TRUST_CASH at par with the buy-vs-par spread recognized in REVENUE_USD —
the USD paid is derived from the CREDIT-to-USD buy rate, never passed in. The source selects
the new credits' maturity horizon; an unrecognized source falls back to the long default. With
a purchase catalog configured, an off-catalog amount faults OP.MALFORMED. Restricted to a
system or operator actor — an end user can never mint credit — and it rejects only with
RISK_DENIED when the user's recent top-up volume crosses the velocity window. A retried
submit under the same idempotencyKey returns the original transaction as duplicate.
Builds a
topUpoperation: a buyer's cleared cash becomes spendable credit. On commit it credits the user'sspendableaccount againstSTORED_VALUE, and a second posting books the backing USD intoTRUST_CASHat par with the buy-vs-par spread recognized inREVENUE_USD— the USD paid is derived from the CREDIT-to-USD buy rate, never passed in. Thesourceselects the new credits' maturity horizon; an unrecognized source falls back to the long default. With a purchase catalog configured, an off-catalogamountfaultsOP.MALFORMED. Restricted to asystemoroperatoractor — an end user can never mint credit — and it rejects only withRISK_DENIEDwhen the user's recent top-up volume crosses the velocity window. A retried submit under the sameidempotencyKeyreturns the original transaction asduplicate.