@antseed/cli 0.1.195 → 0.1.197

package/dist/gateway/accounting.d.ts

@@ -1,5 +1,6 @@
 import type { AttributedSpendEvent } from '../proxy/spend-attribution.js';
 import { type BudgetLimits, type LimitBreach } from './limits.js';
+export { videoJobKey } from './video-jobs.js';
 import type { ApiKeyRecord, GatewayStore, MemberRecord, WorkspaceRecord } from './store.js';
 /**
  * The member and workspace a key's request is accounted to, when the caller
@@ -12,22 +13,55 @@ export interface KeyContext {
 }
 /** The key's cap per period: the lower of the admins' and the owner's. */
 export declare function effectiveKeyLimits(key: Pick<ApiKeyRecord, 'limits' | 'ownerLimits'>): BudgetLimits;
+/** The buyer's default limit for one video ($5), when its config sets none. */
+export declare const DEFAULT_MAX_VIDEO_REQUEST_USDC = 5000000;
 export interface GatewayAccountingOptions {
     /**
      * Worst-case cost of one request, reserved against the key's caps while it
      * is in flight. The buyer's maxPerRequestUsdc is the natural bound.
      */
     holdUsdc: number;
+    /**
+     * The most one video may cost: the buyer's maxVideoRequestUsdc. A video
+     * create reserves up to this much of a key's room while it is priced.
+     */
+    maxVideoRequestUsdc?: number;
     settleGraceMs?: number;
+    videoCommitmentMs?: number;
     now?: () => number;
+    onLog?: (message: string) => void;
 }
 export declare function newRequestTag(): string;
-export type Admission = {
+export interface AdmitOptions {
+    /** A video create: reserve the room it may spend (up to one video's limit) until its price is known. */
+    videoCreate?: boolean;
+    /** A video job's own poll or download, admitted without that job's commitment. */
+    videoJob?: string;
+}
+export type Admission = 
+/**
+ * `remainingUsdc`: the least room left under any cap before this request's
+ * hold, or for a video create the allowance reserved for it; null when
+ * nothing is capped.
+ */
+{
     ok: true;
     tag: string;
+    remainingUsdc: number | null;
 } | {
     ok: false;
     breach: LimitBreach;
+}
+/**
+ * `video_storage`: a capped video create whose reservation could not be
+ * stored; it is not started. `video_pricing`: the request only fails
+ * because video creates still being priced hold the room they may spend;
+ * it fits once they are priced (seconds), so it may be retried.
+ */
+ | {
+    ok: false;
+    breach: null;
+    reason: 'video_storage' | 'video_pricing';
 };
 /**
  * Hold → settle accounting per key. Admission reserves a hold so concurrent
@@ -39,14 +73,90 @@ export declare class GatewayAccounting {
     private readonly _store;
     private readonly _options;
     private readonly _holds;
+    /** Accepted video jobs, by `videoJobKey`: their price counts against the caps until delivered, failed or expired. */
+    private readonly _videoCommitments;
+    /**
+     * Commitment writes that failed, retried before admitting a capped request
+     * (null: a delete). A job's write also removes its create's reservation
+     * (`replaces`), in the same transaction.
+     */
+    private readonly _pendingVideoWrites;
+    /** Whether the stored commitments were read; until then a capped request cannot be admitted safely. */
+    private _videoCommitmentsLoaded;
     private readonly _settleGraceMs;
+    private readonly _videoCommitmentMs;
+    private readonly _maxVideoRequestUsdc;
     private readonly _now;
     constructor(_store: GatewayStore, _options: GatewayAccountingOptions);
-    heldUsdc(keyId: string): number;
+    /** In-flight holds plus accepted videos not yet charged, optionally leaving one video job out. */
+    heldUsdc(keyId: string, excludeVideoJob?: string, withoutVideoCreates?: boolean): number;
     /** Holds in flight for every key a member owns. */
-    heldForMember(memberId: string): number;
-    heldForWorkspace(workspaceId: string): number;
+    heldForMember(memberId: string, excludeVideoJob?: string, withoutVideoCreates?: boolean): number;
+    heldForWorkspace(workspaceId: string, excludeVideoJob?: string, withoutVideoCreates?: boolean): number;
     private _held;
+    /**
+     * A video create was accepted: remember which key owns the job (only that
+     * key may retrieve it) and keep `amountUsdc` counted against the caps of the
+     * key, member and workspace the create was admitted for until the buyer's
+     * charge for its delivery arrives, the buyer retires the job, or the record
+     * expires. A key without caps records the price too, so caps added later
+     * count the job.
+     *
+     * Part of the price may already be spent by the create itself (a one-off
+     * channel's opening fee counts toward the video): what is already in the
+     * ledger is not held again, and a charge on the create that arrives later
+     * lowers the commitment like any other charge of the job (see `ingest`).
+     */
+    commitVideo(tag: string, job: string, amountUsdc: number): void;
+    /** A video create ended without an accepted job: its reservation goes. */
+    videoNotAccepted(tag: string): void;
+    /** The key that created a video job through this gateway, if it is still remembered. */
+    videoJobOwner(job: string): string | null;
+    /** What a video job still holds against the caps (0 once charged, or for an uncapped key). */
+    videoJobHeldUsdc(job: string): number;
+    /**
+     * The buyer retired the job: it failed, its seller no longer has it, or the
+     * buyer has no record of it. It can never be delivered or charged.
+     */
+    dropVideo(job: string): void;
+    /** A retrieve streamed the job's whole file: its charge should follow (see DELIVERY_CHARGE_WAIT_MS). */
+    videoDelivered(job: string): void;
+    /**
+     * The buyer charged `amountUsdc` for the job's delivery: that much is in the
+     * ledger now, so the job holds that much less. Spend plus what the job still
+     * holds stays the same, whatever request the charge names. Ownership stays,
+     * so its owner can download it again (the buyer does not charge twice).
+     */
+    private _videoCharged;
+    private _setVideoHeld;
+    private _forgetVideo;
+    /**
+     * Commitments live in memory first and are stored so a restart keeps them.
+     * A failed write (for example another process holding the database lock)
+     * does not fail the request that caused it; it is retried, and until it
+     * succeeds capped requests are refused (see `videoCommitmentsReady`).
+     * A restart before the retry still keeps the job counted: its create's
+     * reservation, stored before the create was sent, is only removed in the
+     * same transaction that stores the job (see `_loadVideoCommitments`).
+     */
+    private _storeVideo;
+    /**
+     * Reads the stored commitments. A create's reservation still stored was
+     * left by a gateway that stopped before storing the create's job: when the
+     * request log names the job, the reservation becomes that job's commitment
+     * (the whole room the create was told about, less what it already spent),
+     * since its key can still retrieve it and be charged; otherwise the create
+     * was not accepted, or its job cannot be retrieved through this gateway
+     * (no record names its owner), so it is never charged and the reservation
+     * goes.
+     */
+    private _loadVideoCommitments;
+    /**
+     * Whether every video commitment is read and stored, so caps can be applied:
+     * retries a failed load and failed writes first. A delete that still fails
+     * only over-counts after a restart (the safe side) and does not block.
+     */
+    videoCommitmentsReady(): boolean;
     /** Whether any level above or at the key caps spend (so admission depends on the spend feed). */
     hasBudgets(key: ApiKeyRecord, context?: KeyContext): boolean;
     /** The key (the lower of its admin and owner caps), the member who owns it and its workspace. */
@@ -58,9 +168,11 @@ export declare class GatewayAccounting {
      * Member and workspace spend is the ledger as attributed at request time,
      * so a member who revokes a key and creates a new one still counts
      * everything spent before against the member's caps. Levels and periods
-     * without a cap cost no query.
+     * without a cap cost no query. A video job's own polls and delivery are
+     * admitted without its own commitment (`videoJob`), which they would
+     * otherwise count twice.
      */
-    admit(key: ApiKeyRecord, context?: KeyContext): Admission;
+    admit(key: ApiKeyRecord, context?: KeyContext, { videoCreate, videoJob }?: AdmitOptions): Admission;
     /** Drops a hold at once, for a request that never reached the buyer. */
     release(tag: string): void;
     /** The response is over; keep the hold briefly for spend that is signed late. */

package/dist/gateway/accounting.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"accounting.d.ts","sourceRoot":"","sources":["../../src/gateway/accounting.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AACzE,OAAO,EAAoF,KAAK,YAAY,EAAE,KAAK,WAAW,EAAoB,MAAM,aAAa,CAAA;AAErK,OAAO,KAAK,EAAE,YAAY,EAAe,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAExG;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,YAAY,GAAG,IAAI,CAAA;IAC3B,SAAS,EAAE,eAAe,GAAG,IAAI,CAAA;CAClC;AAED,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,aAAa,CAAC,GAAG,YAAY,CAMlG;AAKD,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAmBD,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,MAAM,MAAM,SAAS,GACjB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,CAAA;AAEtC;;;;;GAKG;AACH,qBAAa,iBAAiB;IAKhB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAgB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAJ5E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IACjD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAc;gBAEN,MAAM,EAAE,YAAY,EAAmB,QAAQ,EAAE,wBAAwB;IAKtG,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAI/B,mDAAmD;IACnD,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAIvC,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;IAI7C,OAAO,CAAC,KAAK;IAMb,iGAAiG;IACjG,UAAU,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,GAAE,UAA+B,GAAG,OAAO;IAIhF,iGAAiG;IACjG,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,QAAQ;IAOhB;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,GAAE,UAA+B,GAAG,SAAS;IAoB7E,wEAAwE;IACxE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAM1B,iFAAiF;IACjF,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAQzB;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,oBAAoB,EAAE,GAAG,MAAM;IAkCvE,OAAO,IAAI,IAAI;CAIhB"}
+{"version":3,"file":"accounting.d.ts","sourceRoot":"","sources":["../../src/gateway/accounting.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AACzE,OAAO,EAAoF,KAAK,YAAY,EAAE,KAAK,WAAW,EAAoB,MAAM,aAAa,CAAA;AAGrK,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAe,YAAY,EAAE,YAAY,EAAyB,eAAe,EAAE,MAAM,YAAY,CAAA;AAE/H;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,YAAY,GAAG,IAAI,CAAA;IAC3B,SAAS,EAAE,eAAe,GAAG,IAAI,CAAA;CAClC;AAED,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,aAAa,CAAC,GAAG,YAAY,CAMlG;AAoBD,+EAA+E;AAC/E,eAAO,MAAM,8BAA8B,UAAY,CAAA;AAEvD,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAClC;AA8BD,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,MAAM,WAAW,YAAY;IAC3B,wGAAwG;IACxG,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,SAAS;AACnB;;;;GAIG;AACD;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACvD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE;AACpC;;;;;GAKG;GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAAA;CAAE,CAAA;AAE1E;;;;;GAKG;AACH,qBAAa,iBAAiB;IAiBhB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAgB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAhB5E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IACjD,qHAAqH;IACrH,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAqC;IACvE;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAiF;IACrH,uGAAuG;IACvG,OAAO,CAAC,uBAAuB,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAQ;IAC3C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAQ;IAC7C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAc;gBAEN,MAAM,EAAE,YAAY,EAAmB,QAAQ,EAAE,wBAAwB;IAQtG,kGAAkG;IAClG,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,EAAE,mBAAmB,UAAQ,GAAG,MAAM;IAItF,mDAAmD;IACnD,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,EAAE,mBAAmB,UAAQ,GAAG,MAAM;IAI9F,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,EAAE,mBAAmB,UAAQ,GAAG,MAAM;IAIpG,OAAO,CAAC,KAAK;IAuCb;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IA+B/D,0EAA0E;IAC1E,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAQnC,wFAAwF;IACxF,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAKzC,8FAA8F;IAC9F,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAIrC;;;OAGG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAI5B,wGAAwG;IACxG,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAOjC;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,aAAa;IAKrB,OAAO,CAAC,YAAY;IAKpB;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAW;IAWnB;;;;;;;;;OASG;IACH,OAAO,CAAC,qBAAqB;IAkC7B;;;;OAIG;IACH,qBAAqB,IAAI,OAAO;IAOhC,iGAAiG;IACjG,UAAU,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,GAAE,UAA+B,GAAG,OAAO;IAIhF,iGAAiG;IACjG,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,QAAQ;IAOhB;;;;;;;;;OASG;IACH,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,GAAE,UAA+B,EAAE,EAAE,WAAmB,EAAE,QAAQ,EAAE,GAAE,YAAiB,GAAG,SAAS;IA4DnI,wEAAwE;IACxE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAM1B,iFAAiF;IACjF,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAQzB;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,oBAAoB,EAAE,GAAG,MAAM;IAsCvE,OAAO,IAAI,IAAI;CAMhB"}

package/dist/gateway/accounting.js

@@ -1,6 +1,8 @@
 import { randomUUID } from 'node:crypto';
 import { BUDGET_PERIODS, cappedPeriods, findLimitBreach, hasSpendLimits } from './limits.js';
 import { parseBaseUnits } from './money.js';
+import { isVideoReservationKey, videoReservationKey } from './video-jobs.js';
+export { videoJobKey } from './video-jobs.js';
 /** The key's cap per period: the lower of the admins' and the owner's. */
 export function effectiveKeyLimits(key) {
     const result = {};
@@ -11,6 +13,21 @@ export function effectiveKeyLimits(key) {
 }
 /** Spend can be signed after the response ends (seller-initiated auth). */
 const DEFAULT_SETTLE_GRACE_MS = 60_000;
+/**
+ * An accepted video nobody downloads stops counting against the caps after
+ * this long: as long as the buyer keeps the job's route and billing (30 days),
+ * so a video that can still be delivered and charged is never forgotten first.
+ */
+const DEFAULT_VIDEO_COMMITMENT_MS = 30 * 24 * 60 * 60_000;
+/**
+ * A delivered video is charged right after its file is received; if no charge
+ * has arrived this long after a complete delivery, none will (the buyer had no
+ * billing for the job, or the seller did not bill it), and the job stops
+ * holding its price.
+ */
+const DELIVERY_CHARGE_WAIT_MS = 60 * 60_000;
+/** The buyer's default limit for one video ($5), when its config sets none. */
+export const DEFAULT_MAX_VIDEO_REQUEST_USDC = 5_000_000;
 export function newRequestTag() {
     return `gw_${randomUUID()}`;
 }
@@ -24,44 +41,274 @@ export class GatewayAccounting {
     _store;
     _options;
     _holds = new Map();
+    /** Accepted video jobs, by `videoJobKey`: their price counts against the caps until delivered, failed or expired. */
+    _videoCommitments = new Map();
+    /**
+     * Commitment writes that failed, retried before admitting a capped request
+     * (null: a delete). A job's write also removes its create's reservation
+     * (`replaces`), in the same transaction.
+     */
+    _pendingVideoWrites = new Map();
+    /** Whether the stored commitments were read; until then a capped request cannot be admitted safely. */
+    _videoCommitmentsLoaded = false;
     _settleGraceMs;
+    _videoCommitmentMs;
+    _maxVideoRequestUsdc;
     _now;
     constructor(_store, _options) {
         this._store = _store;
         this._options = _options;
         this._settleGraceMs = _options.settleGraceMs ?? DEFAULT_SETTLE_GRACE_MS;
+        this._videoCommitmentMs = _options.videoCommitmentMs ?? DEFAULT_VIDEO_COMMITMENT_MS;
+        this._maxVideoRequestUsdc = _options.maxVideoRequestUsdc ?? DEFAULT_MAX_VIDEO_REQUEST_USDC;
         this._now = _options.now ?? (() => Date.now());
+        this._loadVideoCommitments();
     }
-    heldUsdc(keyId) {
-        return this._held((hold) => hold.keyId === keyId);
+    /** In-flight holds plus accepted videos not yet charged, optionally leaving one video job out. */
+    heldUsdc(keyId, excludeVideoJob, withoutVideoCreates = false) {
+        return this._held((hold) => hold.keyId === keyId, excludeVideoJob, withoutVideoCreates);
     }
     /** Holds in flight for every key a member owns. */
-    heldForMember(memberId) {
-        return this._held((hold) => hold.memberId === memberId);
+    heldForMember(memberId, excludeVideoJob, withoutVideoCreates = false) {
+        return this._held((hold) => hold.memberId === memberId, excludeVideoJob, withoutVideoCreates);
     }
-    heldForWorkspace(workspaceId) {
-        return this._held((hold) => hold.workspaceId === workspaceId);
+    heldForWorkspace(workspaceId, excludeVideoJob, withoutVideoCreates = false) {
+        return this._held((hold) => hold.workspaceId === workspaceId, excludeVideoJob, withoutVideoCreates);
     }
-    _held(match) {
+    _held(match, excludeVideoJob, withoutVideoCreates = false) {
         let held = 0;
         for (const hold of this._holds.values())
-            if (match(hold))
+            if (match(hold) && !(withoutVideoCreates && hold.videoCreate))
                 held += hold.amountUsdc;
+        const now = this._now();
+        // A revoked key cannot retrieve its jobs any more (only the creating key may), so they are never charged:
+        // unless a retrieve admitted before the revocation is still running, or a delivery's charge is still to come.
+        let retrieving = null;
+        const chargeable = (job, commitment) => {
+            if (commitment.deliveredAt !== null)
+                return true;
+            retrieving ??= new Set([...this._holds.values()].flatMap((hold) => hold.videoJob ? [hold.videoJob] : []));
+            return retrieving.has(job);
+        };
+        const active = new Map();
+        const isActive = (keyId) => {
+            let result = active.get(keyId);
+            if (result === undefined) {
+                try {
+                    result = this._store.getKey(keyId)?.status !== 'revoked';
+                }
+                catch {
+                    // Unreadable: keep counting it, the safe side.
+                    result = true;
+                }
+                active.set(keyId, result);
+            }
+            return result;
+        };
+        for (const [job, commitment] of this._videoCommitments) {
+            if (commitment.expiresAt <= now) {
+                this._forgetVideo(job);
+                continue;
+            }
+            if (commitment.amountUsdc > 0 && commitment.deliveredAt !== null && now - commitment.deliveredAt >= DELIVERY_CHARGE_WAIT_MS) {
+                this._setVideoHeld(job, commitment, 0);
+            }
+            if (commitment.amountUsdc > 0 && job !== excludeVideoJob && match(commitment) && (isActive(commitment.keyId) || chargeable(job, commitment)))
+                held += commitment.amountUsdc;
+        }
         return held;
     }
+    /**
+     * A video create was accepted: remember which key owns the job (only that
+     * key may retrieve it) and keep `amountUsdc` counted against the caps of the
+     * key, member and workspace the create was admitted for until the buyer's
+     * charge for its delivery arrives, the buyer retires the job, or the record
+     * expires. A key without caps records the price too, so caps added later
+     * count the job.
+     *
+     * Part of the price may already be spent by the create itself (a one-off
+     * channel's opening fee counts toward the video): what is already in the
+     * ledger is not held again, and a charge on the create that arrives later
+     * lowers the commitment like any other charge of the job (see `ingest`).
+     */
+    commitVideo(tag, job, amountUsdc) {
+        const hold = this._holds.get(tag);
+        if (!hold)
+            return;
+        const existing = this._videoCommitments.get(job);
+        if (existing && existing.keyId !== hold.keyId && existing.expiresAt > this._now()) {
+            // Another key's job by the same ID: it keeps its owner and commitment. This create's job cannot be
+            // retrieved by its key (only the owner may), so it is never charged to it.
+            this._options.onLog?.('gateway ignored a video job ID that another key already owns');
+            this.videoNotAccepted(tag);
+            return;
+        }
+        let spent = 0;
+        try {
+            spent = this._store.spendForRequest(tag);
+        }
+        catch {
+            // Unreadable now: hold the whole price, never less than the job can still be charged.
+        }
+        const commitment = {
+            keyId: hold.keyId,
+            memberId: hold.memberId,
+            workspaceId: hold.workspaceId,
+            amountUsdc: Math.max(0, Math.floor(amountUsdc) - spent),
+            expiresAt: this._now() + this._videoCommitmentMs,
+            deliveredAt: null,
+        };
+        this._videoCommitments.set(job, commitment);
+        this._storeVideo(job, { job, ...commitment }, hold.reserved ? videoReservationKey(tag) : undefined);
+        hold.reserved = false;
+        hold.videoCreate = false;
+    }
+    /** A video create ended without an accepted job: its reservation goes. */
+    videoNotAccepted(tag) {
+        const hold = this._holds.get(tag);
+        if (!hold?.reserved)
+            return;
+        hold.reserved = false;
+        hold.videoCreate = false;
+        this._storeVideo(videoReservationKey(tag), null);
+    }
+    /** The key that created a video job through this gateway, if it is still remembered. */
+    videoJobOwner(job) {
+        const commitment = this._videoCommitments.get(job);
+        return commitment && commitment.expiresAt > this._now() ? commitment.keyId : null;
+    }
+    /** What a video job still holds against the caps (0 once charged, or for an uncapped key). */
+    videoJobHeldUsdc(job) {
+        return this._videoCommitments.get(job)?.amountUsdc ?? 0;
+    }
+    /**
+     * The buyer retired the job: it failed, its seller no longer has it, or the
+     * buyer has no record of it. It can never be delivered or charged.
+     */
+    dropVideo(job) {
+        if (this._videoCommitments.has(job))
+            this._forgetVideo(job);
+    }
+    /** A retrieve streamed the job's whole file: its charge should follow (see DELIVERY_CHARGE_WAIT_MS). */
+    videoDelivered(job) {
+        const commitment = this._videoCommitments.get(job);
+        if (!commitment || commitment.deliveredAt !== null)
+            return;
+        commitment.deliveredAt = this._now();
+        this._storeVideo(job, { job, ...commitment });
+    }
+    /**
+     * The buyer charged `amountUsdc` for the job's delivery: that much is in the
+     * ledger now, so the job holds that much less. Spend plus what the job still
+     * holds stays the same, whatever request the charge names. Ownership stays,
+     * so its owner can download it again (the buyer does not charge twice).
+     */
+    _videoCharged(job, amountUsdc) {
+        const commitment = this._videoCommitments.get(job);
+        if (!commitment || commitment.amountUsdc === 0)
+            return;
+        this._setVideoHeld(job, commitment, Math.max(0, commitment.amountUsdc - amountUsdc));
+    }
+    _setVideoHeld(job, commitment, amountUsdc) {
+        commitment.amountUsdc = amountUsdc;
+        this._storeVideo(job, { job, ...commitment });
+    }
+    _forgetVideo(job) {
+        this._videoCommitments.delete(job);
+        this._storeVideo(job, null);
+    }
+    /**
+     * Commitments live in memory first and are stored so a restart keeps them.
+     * A failed write (for example another process holding the database lock)
+     * does not fail the request that caused it; it is retried, and until it
+     * succeeds capped requests are refused (see `videoCommitmentsReady`).
+     * A restart before the retry still keeps the job counted: its create's
+     * reservation, stored before the create was sent, is only removed in the
+     * same transaction that stores the job (see `_loadVideoCommitments`).
+     */
+    _storeVideo(job, record, replaces) {
+        this._pendingVideoWrites.delete(job);
+        try {
+            if (record)
+                this._store.saveVideoCommitment(record, replaces);
+            else
+                this._store.deleteVideoCommitment(job);
+        }
+        catch (error) {
+            this._pendingVideoWrites.set(job, { record, ...(replaces !== undefined ? { replaces } : {}) });
+            this._options.onLog?.(`gateway could not store a video commitment: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /**
+     * Reads the stored commitments. A create's reservation still stored was
+     * left by a gateway that stopped before storing the create's job: when the
+     * request log names the job, the reservation becomes that job's commitment
+     * (the whole room the create was told about, less what it already spent),
+     * since its key can still retrieve it and be charged; otherwise the create
+     * was not accepted, or its job cannot be retrieved through this gateway
+     * (no record names its owner), so it is never charged and the reservation
+     * goes.
+     */
+    _loadVideoCommitments() {
+        try {
+            const rows = this._store.listVideoCommitments(this._now());
+            const stored = new Set(rows.map((row) => row.job));
+            for (const { job, ...commitment } of rows) {
+                if (!isVideoReservationKey(job)) {
+                    if (!this._videoCommitments.has(job) && !this._pendingVideoWrites.has(job))
+                        this._videoCommitments.set(job, commitment);
+                    continue;
+                }
+                const tag = job.slice(videoReservationKey('').length);
+                const created = this._store.videoCreateJob(tag);
+                if (!created || stored.has(created) || this._videoCommitments.has(created)) {
+                    this._store.deleteVideoCommitment(job);
+                    continue;
+                }
+                // Everything already charged for the job (its create, polls and delivery) is spend, not held again; a
+                // delivered job gets the same hour for its charge as any other.
+                const jobId = created.slice(created.indexOf('\n') + 1);
+                const delivery = this._store.videoJobDeliveredAt(commitment.keyId, jobId);
+                const recovered = {
+                    ...commitment,
+                    amountUsdc: Math.max(0, commitment.amountUsdc - this._store.videoJobSpend(commitment.keyId, jobId)),
+                    deliveredAt: delivery,
+                };
+                this._store.saveVideoCommitment({ job: created, ...recovered }, job);
+                stored.add(created);
+                this._videoCommitments.set(created, recovered);
+            }
+            this._videoCommitmentsLoaded = true;
+        }
+        catch (error) {
+            this._options.onLog?.(`gateway could not load video commitments: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /**
+     * Whether every video commitment is read and stored, so caps can be applied:
+     * retries a failed load and failed writes first. A delete that still fails
+     * only over-counts after a restart (the safe side) and does not block.
+     */
+    videoCommitmentsReady() {
+        if (!this._videoCommitmentsLoaded)
+            this._loadVideoCommitments();
+        for (const [job, { record, replaces }] of [...this._pendingVideoWrites])
+            this._storeVideo(job, record, replaces);
+        return this._videoCommitmentsLoaded && [...this._pendingVideoWrites.values()].every(({ record }) => record === null);
+    }
     /** Whether any level above or at the key caps spend (so admission depends on the spend feed). */
     hasBudgets(key, context = this._context(key)) {
         return this._budgetChecks(key, context).some(({ limits }) => hasSpendLimits(limits));
     }
     /** The key (the lower of its admin and owner caps), the member who owns it and its workspace. */
-    _budgetChecks(key, { member, workspace }) {
+    _budgetChecks(key, { member, workspace }, excludeVideoJob) {
         const checks = [
-            { level: 'key', limits: effectiveKeyLimits(key), scope: { keyId: key.id }, held: () => this.heldUsdc(key.id) },
+            { level: 'key', limits: effectiveKeyLimits(key), scope: { keyId: key.id }, held: (without) => this.heldUsdc(key.id, excludeVideoJob, without) },
         ];
         if (member)
-            checks.push({ level: 'member', limits: member.limits, scope: { memberId: member.id }, held: () => this.heldForMember(member.id) });
+            checks.push({ level: 'member', limits: member.limits, scope: { memberId: member.id }, held: (without) => this.heldForMember(member.id, excludeVideoJob, without) });
         if (workspace)
-            checks.push({ level: 'workspace', limits: workspace.limits, scope: { workspaceId: workspace.id }, held: () => this.heldForWorkspace(workspace.id) });
+            checks.push({ level: 'workspace', limits: workspace.limits, scope: { workspaceId: workspace.id }, held: (without) => this.heldForWorkspace(workspace.id, excludeVideoJob, without) });
         return checks;
     }
     _context(key) {
@@ -76,28 +323,72 @@ export class GatewayAccounting {
      * Member and workspace spend is the ledger as attributed at request time,
      * so a member who revokes a key and creates a new one still counts
      * everything spent before against the member's caps. Levels and periods
-     * without a cap cost no query.
+     * without a cap cost no query. A video job's own polls and delivery are
+     * admitted without its own commitment (`videoJob`), which they would
+     * otherwise count twice.
      */
-    admit(key, context = this._context(key)) {
+    admit(key, context = this._context(key), { videoCreate = false, videoJob } = {}) {
         const now = this._now();
-        for (const { level, limits, scope, held } of this._budgetChecks(key, context)) {
+        // A job that still holds its price already covers its delivery's charge, and one that holds nothing (free,
+        // or already charged: the buyer charges a job once) has none to come: its own polls and download are
+        // admitted even when other spend has filled the caps since, so the job can always finish (or be retired).
+        const own = videoJob ? this._videoCommitments.get(videoJob) : undefined;
+        if (own && own.keyId === key.id && own.expiresAt > now) {
+            const tag = newRequestTag();
+            this._holds.set(tag, { keyId: key.id, memberId: key.ownerMemberId, workspaceId: key.workspaceId, amountUsdc: 0, finished: false, timer: null, videoJob });
+            return { ok: true, tag, remainingUsdc: null };
+        }
+        let remainingUsdc = null;
+        for (const { level, limits, scope, held } of this._budgetChecks(key, context, videoJob)) {
             const periods = cappedPeriods(limits);
             if (periods.length === 0)
                 continue;
-            const breach = findLimitBreach(limits, this._store.spendByPeriod(scope, now, periods), held(), now);
-            if (breach)
+            const spent = this._store.spendByPeriod(scope, now, periods);
+            const heldUsdc = held();
+            const breach = findLimitBreach(limits, spent, heldUsdc, now);
+            if (breach) {
+                // Room a create holds while it is priced comes back in seconds: say so, rather than that the cap is reached.
+                if (findLimitBreach(limits, spent, held(true), now) === null)
+                    return { ok: false, breach: null, reason: 'video_pricing' };
                 return { ok: false, breach: { ...breach, level } };
+            }
+            for (const period of periods) {
+                const room = (limits[period] ?? 0) - (spent[period] ?? 0) - heldUsdc;
+                remainingUsdc = remainingUsdc === null ? room : Math.min(remainingUsdc, room);
+            }
         }
+        // A video create may start a job worth up to the room it is told about, so it
+        // holds all of that until the buyer reports the price: two creates in flight
+        // at once cannot both be told the same room.
+        if (videoCreate && remainingUsdc !== null)
+            remainingUsdc = Math.min(remainingUsdc, this._maxVideoRequestUsdc);
         const tag = newRequestTag();
-        this._holds.set(tag, {
+        const hold = {
             keyId: key.id,
             memberId: key.ownerMemberId,
             workspaceId: key.workspaceId,
-            amountUsdc: this._options.holdUsdc,
+            amountUsdc: videoCreate && remainingUsdc !== null ? remainingUsdc : this._options.holdUsdc,
             finished: false,
             timer: null,
-        });
-        return { ok: true, tag };
+        };
+        if (videoCreate && remainingUsdc !== null) {
+            // Stored before the create is sent, so a job the buyer accepts is never lost from the caps, even when
+            // its own commitment cannot be stored and the gateway restarts (see `_loadVideoCommitments`).
+            try {
+                this._store.saveVideoCommitment({
+                    job: videoReservationKey(tag), keyId: hold.keyId, memberId: hold.memberId, workspaceId: hold.workspaceId,
+                    amountUsdc: remainingUsdc, expiresAt: now + this._videoCommitmentMs, deliveredAt: null,
+                });
+            }
+            catch (error) {
+                this._options.onLog?.(`gateway could not store a video reservation: ${error instanceof Error ? error.message : String(error)}`);
+                return { ok: false, breach: null, reason: 'video_storage' };
+            }
+            hold.reserved = true;
+            hold.videoCreate = true;
+        }
+        this._holds.set(tag, hold);
+        return { ok: true, tag, remainingUsdc };
     }
     /** Drops a hold at once, for a request that never reached the buyer. */
     release(tag) {
@@ -142,10 +433,15 @@ export class GatewayAccounting {
                 memberId: request.memberId,
                 model: request.model,
                 endUser: request.endUser,
+                routingFee: event.purpose === 'routing',
             });
             if (!inserted)
                 continue;
             recorded += 1;
+            // A charge of a video job (its create's opening fee, a poll or its delivery): that much of its commitment is now spend.
+            // Spend without a request ID is only attributed to the seller's latest request, so it may not be the job's.
+            if (request.videoJob && event.requestId !== null)
+                this._videoCharged(request.videoJob, parseBaseUnits(event.amountUsdc));
             // Settled spend replaces that much of the request's worst-case hold.
             // The rest stays until the grace period ends: one request can sign
             // several deltas, and later ones still need to be covered.
@@ -160,6 +456,8 @@ export class GatewayAccounting {
             if (hold.timer)
                 clearTimeout(hold.timer);
         this._holds.clear();
+        // Commitments stay stored: the next gateway reloads them.
+        this._videoCommitments.clear();
     }
 }
 /** The stricter of two caps; null is no cap. */