@antseed/node 0.2.106 → 0.2.107

package/dist/payments/buyer-payment-manager.js

@@ -1,1040 +1,3 @@
-import { randomBytes } from 'node:crypto';
-import { DepositsClient } from './evm/deposits-client.js';
-import { signSpendingAuth, signReserveAuth, makeChannelsDomain, computeMetadataHash, encodeMetadata, ZERO_METADATA, ZERO_METADATA_HASH, computeChannelId, } from './evm/signatures.js';
-import { debugLog, debugWarn } from '../utils/debug.js';
-import { peerIdToAddress } from '../types/peer.js';
-import { CHANNEL_ROLE, CHANNEL_STATUS } from './channel-store.js';
-import { advanceUsageMetadata, CountedRequestTracker, RequestServiceTracker } from './channel-usage-accounting.js';
-import { estimateCostFromBytes, computeCostUsdc } from './pricing.js';
-/** Default tolerance: accept seller claims up to 1.4x buyer's estimate. */
-const DEFAULT_COST_TOLERANCE = 1.4;
-/** Fraction of reserve ceiling at which to signal a top-up is needed.
- *  Trigger well before the contract's TOP_UP_SETTLED_THRESHOLD_BPS (85%)
- *  so that by the time the seller calls topUp() on-chain, enough has been
- *  settled to pass the threshold check. */
-const DEFAULT_TOPUP_THRESHOLD = 0.65;
-/**
- * Manages buyer-side payment sessions using EIP-712 SpendingAuth
- * with cumulative authorization, bytes/4 cost verification, and overdraft control.
- */
-export class BuyerPaymentManager {
-    _identity;
-    _signer;
-    _depositsClient;
-    _config;
-    _channelStore;
-    /** In-memory map of active confirmed sessions by seller peerId for fast lookups. */
-    _confirmedPeers = new Set();
-    /** Peers that explicitly rejected our spending auth. */
-    _rejectedPeers = new Set();
-    _sellerAddressResolver;
-    /** sellerPeerId -> cumulative USDC amount in the latest SpendingAuth */
-    _cumulativeAmount = new Map();
-    /** sellerPeerId -> cumulative metadata for SpendingAuth */
-    _metadata = new Map();
-    /** sellerPeerId -> buyer-verified cumulative cost from bytes/4 */
-    _verifiedCost = new Map();
-    /** requestId -> service/model the buyer requested (from its own request body).
-     *  Used in handleNeedAuth to validate cost with the correct pricing tier
-     *  without trusting the seller's claim of which service was used. */
-    _requestService = new RequestServiceTracker();
-    /** sellerPeerId -> full pricing map (defaults + per-service overrides from peer metadata / 402) */
-    _sessionPricing = new Map();
-    /** Cumulative response token totals per seller, tracked independently of signing metadata. */
-    _responseTokenTotals = new Map();
-    /** sellerPeerId -> current on-chain reserve ceiling (can grow with top-ups) */
-    _currentReserveCeiling = new Map();
-    /** sellerPeerId -> original first-reserve amount for replaying reserve() safely. */
-    _initialReserveAmount = new Map();
-    /** sellerPeerId -> salt used in the current reserve */
-    _reserveSalt = new Map();
-    /** Cached EIP-712 domain — static for the lifetime of this manager. */
-    _channelsDomain;
-    constructor(identity, config, channelStore, sellerAddressResolver) {
-        this._identity = identity;
-        this._config = config;
-        this._sellerAddressResolver = sellerAddressResolver;
-        this._signer = identity.wallet;
-        this._depositsClient = new DepositsClient({
-            rpcUrl: config.rpcUrl,
-            ...(config.fallbackRpcUrls ? { fallbackRpcUrls: config.fallbackRpcUrls } : {}),
-            contractAddress: config.depositsContractAddress,
-            usdcAddress: config.usdcAddress,
-            evmChainId: config.chainId,
-        });
-        this._channelStore = channelStore;
-        this._channelsDomain = makeChannelsDomain(config.chainId, config.channelsContractAddress);
-        // Hydrate cumulative maps from persisted active sessions
-        this._hydrateFromStore();
-    }
-    /** Hydrate cumulative tracking maps from persisted active buyer sessions. */
-    _hydrateFromStore() {
-        const activeChannels = this._channelStore.getActiveChannelsByBuyer(CHANNEL_ROLE.BUYER, this._identity.wallet.address);
-        for (const channel of activeChannels) {
-            const peerId = channel.peerId;
-            const persistedCumulative = BigInt(channel.authMax);
-            this._cumulativeAmount.set(peerId, persistedCumulative);
-            const metadata = this._sanitizeMetadata(this._channelStore.getChannelMetadata(channel));
-            this._metadata.set(peerId, metadata);
-            if (!this._disableMetadataV2Services) {
-                this._persistServiceMetadata(channel.sessionId, metadata);
-            }
-            // Hydrate verifiedCost to authMax so _maxSignable can grow beyond maxPerRequestUsdc.
-            // Without this, maxSignable = 0 + maxPerRequestUsdc after restart, permanently capping
-            // the cumulative and causing non-monotonic SpendingAuth rejections on the seller.
-            this._verifiedCost.set(peerId, persistedCumulative);
-            this._responseTokenTotals.set(peerId, {
-                input: Number(channel.tokensDelivered),
-                output: Number(channel.previousConsumption),
-                requests: channel.requestCount,
-            });
-        }
-    }
-    get signer() {
-        return this._signer;
-    }
-    setSigner(signer) {
-        this._signer = signer;
-    }
-    get depositsClient() {
-        return this._depositsClient;
-    }
-    get _costTolerance() {
-        return this._config.costToleranceMultiplier ?? DEFAULT_COST_TOLERANCE;
-    }
-    get _disableMetadataV2Services() {
-        return this._config.disableMetadataV2Services === true;
-    }
-    _sanitizeMetadata(metadata) {
-        const current = metadata ?? ZERO_METADATA;
-        if (!this._disableMetadataV2Services)
-            return current;
-        return {
-            cumulativeInputTokens: current.cumulativeInputTokens,
-            cumulativeOutputTokens: current.cumulativeOutputTokens,
-            cumulativeRequestCount: current.cumulativeRequestCount,
-            services: [],
-        };
-    }
-    _advanceUsageMetadata(previous, service, delta) {
-        return advanceUsageMetadata(this._sanitizeMetadata(previous), this._disableMetadataV2Services ? undefined : service, delta);
-    }
-    _getCeiling(sellerPeerId) {
-        return this._currentReserveCeiling.get(sellerPeerId) ?? this._config.maxReserveAmountUsdc;
-    }
-    /** Clean up all in-memory state for a seller when the session ends. */
-    cleanupSession(sellerPeerId) {
-        this._cumulativeAmount.delete(sellerPeerId);
-        this._metadata.delete(sellerPeerId);
-        this._verifiedCost.delete(sellerPeerId);
-        this._sessionPricing.delete(sellerPeerId);
-        this._currentReserveCeiling.delete(sellerPeerId);
-        this._initialReserveAmount.delete(sellerPeerId);
-        this._reserveSalt.delete(sellerPeerId);
-        this._confirmedPeers.delete(sellerPeerId);
-        this._rejectedPeers.delete(sellerPeerId);
-        this._responseTokenTotals.delete(sellerPeerId);
-    }
-    getActiveSession(sellerPeerId) {
-        return this._channelStore.getActiveChannelByPeerAndBuyer(sellerPeerId, CHANNEL_ROLE.BUYER, this._identity.wallet.address);
-    }
-    retireSession(sellerPeerId, status, settledAmount) {
-        const session = this.getActiveSession(sellerPeerId);
-        if (session) {
-            this._channelStore.updateChannelStatus(session.sessionId, status, settledAmount !== undefined ? settledAmount.toString() : undefined);
-        }
-        this.cleanupSession(sellerPeerId);
-    }
-    canReplayReserveAuth(sellerPeerId) {
-        return this._reserveSalt.has(sellerPeerId);
-    }
-    clearLockConfirmation(sellerPeerId) {
-        this._confirmedPeers.delete(sellerPeerId);
-        this._rejectedPeers.delete(sellerPeerId);
-    }
-    async resendCurrentSpendingAuth(sellerPeerId, paymentMux) {
-        const session = this.getActiveSession(sellerPeerId);
-        if (!session) {
-            throw new Error(`[BuyerPayment] No active session for seller ${sellerPeerId.slice(0, 12)}...`);
-        }
-        const cumulativeAmount = this._cumulativeAmount.get(sellerPeerId) ?? BigInt(session.authMax);
-        const currentMeta = this._sanitizeMetadata(this._metadata.get(sellerPeerId));
-        const metadataHashHex = computeMetadataHash(currentMeta);
-        const encodedMetadata = encodeMetadata(currentMeta);
-        const metadataMsg = {
-            channelId: session.sessionId,
-            cumulativeAmount,
-            metadataHash: metadataHashHex,
-        };
-        const spendingAuthSig = await signSpendingAuth(this._signer, this._channelsDomain, metadataMsg);
-        paymentMux.sendSpendingAuth({
-            channelId: session.sessionId,
-            cumulativeAmount: cumulativeAmount.toString(),
-            metadataHash: metadataHashHex,
-            metadata: encodedMetadata,
-            spendingAuthSig,
-        });
-        return session.sessionId;
-    }
-    async extendCurrentSpendingAuth(sellerPeerId, minBudgetPerRequest, paymentMux, targetCumulative) {
-        const session = this.getActiveSession(sellerPeerId);
-        if (!session) {
-            throw new Error(`[BuyerPayment] No active session for seller ${sellerPeerId.slice(0, 12)}...`);
-        }
-        const currentCumulative = this._cumulativeAmount.get(sellerPeerId) ?? BigInt(session.authMax);
-        let maxSignable = this._maxSignable(sellerPeerId);
-        maxSignable = this._reopenOverdraftWindowIfCollapsed(sellerPeerId, currentCumulative, maxSignable, 'extendCurrentSpendingAuth');
-        const ceiling = this._getCeiling(sellerPeerId);
-        // Prefer the seller-supplied target when present — a raw
-        // `currentCumulative + minBudgetPerRequest` advance may still fall short
-        // of what the seller has already spent, producing an infinite 402 loop.
-        const minAdvance = currentCumulative + minBudgetPerRequest;
-        const requestedAmount = targetCumulative != null && targetCumulative > minAdvance
-            ? targetCumulative
-            : minAdvance;
-        const nextCumulative = requestedAmount < maxSignable ? requestedAmount : maxSignable;
-        const extendNeedsTopUp = this._needsCeilingAdvance(requestedAmount, maxSignable, ceiling);
-        if (nextCumulative <= currentCumulative) {
-            // Nothing to sign at current ceiling — try topUp anyway for next round
-            if (extendNeedsTopUp) {
-                await this._topUpAfterSpendAuthBestEffort(sellerPeerId, paymentMux, 'extendCurrentSpendingAuth');
-            }
-            debugWarn(`[BuyerPayment] Cannot extend active session for ${sellerPeerId.slice(0, 12)}... ` +
-                `(current=${currentCumulative} maxSignable=${maxSignable} target=${targetCumulative ?? 'n/a'})`);
-            return session.sessionId;
-        }
-        const currentMeta = this._sanitizeMetadata(this._metadata.get(sellerPeerId));
-        await this._sendUpdatedSpendingAuth(session, sellerPeerId, nextCumulative, currentMeta, paymentMux);
-        // Send topUp AFTER the SpendingAuth so the seller processes the higher
-        // cumulative first, meeting the on-chain settle threshold for topUp.
-        if (extendNeedsTopUp) {
-            await this._topUpAfterSpendAuthBestEffort(sellerPeerId, paymentMux, 'extendCurrentSpendingAuth');
-        }
-        return session.sessionId;
-    }
-    /**
-     * Build a CloseChannelRequest for an active session.
-     *
-     * With `includeAuth` (the default) the buyer signs its current cumulative so
-     * a seller that lost the last SpendingAuth can still close at the full
-     * amount owed. Signing costs nothing extra: the cumulative is unchanged, so
-     * this authorizes no more than the seller could already claim. Pass
-     * `includeAuth: false` to send a bare request and let the seller close using
-     * whatever auth it already holds.
-     */
-    async buildCloseChannelRequest(sellerPeerId, { includeAuth = true } = {}) {
-        const session = this.getActiveSession(sellerPeerId);
-        if (!session) {
-            throw new Error(`[BuyerPayment] No active session for seller ${sellerPeerId.slice(0, 12)}...`);
-        }
-        const cumulativeAmount = this._cumulativeAmount.get(sellerPeerId) ?? BigInt(session.authMax);
-        if (!includeAuth || cumulativeAmount <= 0n) {
-            return { version: 1, channelId: session.sessionId };
-        }
-        const currentMeta = this._sanitizeMetadata(this._metadata.get(sellerPeerId));
-        const metadataHash = computeMetadataHash(currentMeta);
-        const metadataMsg = {
-            channelId: session.sessionId,
-            cumulativeAmount,
-            metadataHash,
-        };
-        return {
-            version: 1,
-            channelId: session.sessionId,
-            cumulativeAmount: cumulativeAmount.toString(),
-            metadataHash,
-            metadata: encodeMetadata(currentMeta),
-            spendingAuthSig: await signSpendingAuth(this._signer, this._channelsDomain, metadataMsg),
-        };
-    }
-    async resendReserveAuth(sellerPeerId, paymentMux) {
-        const session = this.getActiveSession(sellerPeerId);
-        const salt = this._reserveSalt.get(sellerPeerId);
-        if (!session || !salt) {
-            throw new Error(`[BuyerPayment] No replayable reserve for seller ${sellerPeerId.slice(0, 12)}...`);
-        }
-        // Force a fresh AuthAck after replaying the reserve path.
-        this._confirmedPeers.delete(sellerPeerId);
-        const replayAmount = this._initialReserveAmount.get(sellerPeerId)
-            ?? this._currentReserveCeiling.get(sellerPeerId)
-            ?? this._config.maxReserveAmountUsdc;
-        const maxAmount = replayAmount > this._config.maxReserveAmountUsdc
-            ? this._config.maxReserveAmountUsdc
-            : replayAmount;
-        const deadline = Math.floor(Date.now() / 1000) + this._config.defaultAuthDurationSecs;
-        const reserveMsg = {
-            channelId: session.sessionId,
-            maxAmount,
-            deadline: BigInt(deadline),
-        };
-        const reserveAuthSig = await signReserveAuth(this._signer, this._channelsDomain, reserveMsg);
-        paymentMux.sendSpendingAuth({
-            channelId: session.sessionId,
-            cumulativeAmount: session.authMax,
-            metadataHash: ZERO_METADATA_HASH,
-            metadata: encodeMetadata(this._sanitizeMetadata(this._metadata.get(sellerPeerId))),
-            spendingAuthSig: reserveAuthSig,
-            reserveSalt: salt,
-            reserveMaxAmount: maxAmount.toString(),
-            reserveDeadline: deadline,
-        });
-        return session.sessionId;
-    }
-    _reopenOverdraftWindowIfCollapsed(sellerPeerId, currentCumulative, maxSignable, context) {
-        // Overdraft-window unblock: when the buyer has already signed up to
-        // `verified + maxPerRequest` and the seller returned 402 because `spent`
-        // caught up, advance `verifiedCost` to the current signed cumulative so
-        // the window reopens. The buyer has already committed to pay
-        // `currentCumulative` via the signed SpendingAuth, so the seller can
-        // already claim that much on-chain — advancing verified to match doesn't
-        // expose new funds, it just reclaims overdraft headroom.
-        //
-        // SECURITY: the trust anchor here is `currentCumulative`, NOT any
-        // seller-supplied target. A malicious seller could overstate required
-        // spend in a 402 / NeedAuth path in an attempt to drain the reserve. We
-        // defend by only advancing verifiedCost to the amount the buyer has
-        // already signed. Seller-provided values remain destination hints bounded
-        // by `verifiedCost + maxPerRequestUsdc` and are never used to mint new
-        // trust directly.
-        if (maxSignable > currentCumulative)
-            return maxSignable;
-        const previousVerified = this._verifiedCost.get(sellerPeerId) ?? 0n;
-        if (currentCumulative <= previousVerified)
-            return maxSignable;
-        this._verifiedCost.set(sellerPeerId, currentCumulative);
-        const reopened = this._maxSignable(sellerPeerId);
-        debugLog(`[BuyerPayment] ${context}: advanced verifiedCost ${previousVerified} → ${currentCumulative} ` +
-            `to unblock overdraft window for ${sellerPeerId.slice(0, 12)}...`);
-        return reopened;
-    }
-    _needsCeilingAdvance(requestedAmount, maxSignable, ceiling) {
-        return requestedAmount > maxSignable && maxSignable >= ceiling;
-    }
-    /**
-     * Both signPerRequestAuth (buyer-initiated) and handleNeedAuth (seller-initiated)
-     * can fire for the same request when the proactive auth doesn't fully cover the
-     * seller's required cumulative. Whichever path counts a request's tokens first
-     * records its requestId here so the other path attributes only the amount delta.
-     */
-    _serviceTokensCounted = new CountedRequestTracker();
-    _spendListener = null;
-    /**
-     * Observe per-request spend as it is signed. Used to attribute cost to the
-     * caller's own unit of work (a tool conversation, say), which only the layer
-     * that issued the request can know.
-     */
-    setSpendListener(listener) {
-        this._spendListener = listener;
-    }
-    _reportSpend(event) {
-        if (!this._spendListener)
-            return;
-        try {
-            this._spendListener(event);
-        }
-        catch (err) {
-            // Accounting is a bystander here — never let it break the payment path.
-            debugWarn(`[BuyerPayment] spend listener threw: ${err instanceof Error ? err.message : err}`);
-        }
-    }
-    _persistServiceMetadata(sessionId, metadata) {
-        this._channelStore.replaceMetadataServiceTotals(sessionId, this._sanitizeMetadata(metadata).services);
-    }
-    async _sendUpdatedSpendingAuth(session, sellerPeerId, cumulativeAmount, metadata, paymentMux) {
-        const sanitizedMetadata = this._sanitizeMetadata(metadata);
-        const metadataHashHex = computeMetadataHash(sanitizedMetadata);
-        const encodedMetadata = encodeMetadata(sanitizedMetadata);
-        const metadataMsg = {
-            channelId: session.sessionId,
-            cumulativeAmount,
-            metadataHash: metadataHashHex,
-        };
-        const spendingAuthSig = await signSpendingAuth(this._signer, this._channelsDomain, metadataMsg);
-        this._cumulativeAmount.set(sellerPeerId, cumulativeAmount);
-        this._persistServiceMetadata(session.sessionId, sanitizedMetadata);
-        this._channelStore.upsertChannel({
-            ...session,
-            authMax: cumulativeAmount.toString(),
-            updatedAt: Date.now(),
-        });
-        paymentMux.sendSpendingAuth({
-            channelId: session.sessionId,
-            cumulativeAmount: cumulativeAmount.toString(),
-            metadataHash: metadataHashHex,
-            metadata: encodedMetadata,
-            spendingAuthSig,
-        });
-    }
-    async _topUpAfterSpendAuthBestEffort(sellerPeerId, paymentMux, context) {
-        try {
-            await this.topUpReserve(sellerPeerId, paymentMux);
-        }
-        catch (err) {
-            debugWarn(`[BuyerPayment] ${context}: topUpReserve failed: ${err instanceof Error ? err.message : err}`);
-        }
-    }
-    // ── Spending Authorization ────────────────────────────────────
-    /**
-     * Sign and send an initial EIP-712 SpendingAuth to a seller.
-     * The initial cumulativeAmount is set to the seller's minBudgetPerRequest.
-     *
-     * @param pricing Token pricing from the seller's 402 / peer metadata.
-     * @param pricingMap Full pricing map (defaults + per-service) from peer metadata. If provided,
-     *   merges with existing session pricing. The `pricing` arg is used as the service-specific
-     *   override for the service that triggered the 402.
-     */
-    async authorizeSpending(sellerPeerId, paymentMux, minBudgetPerRequest, reserveAmountOrPricing, pricingArg, pricingMap, metadataArg) {
-        const sellerEvmAddr = this._sellerAddressResolver
-            ? await this._sellerAddressResolver.resolveSellerAddress(sellerPeerId, metadataArg)
-            : peerIdToAddress(sellerPeerId);
-        const reserveAmount = typeof reserveAmountOrPricing === 'bigint'
-            ? reserveAmountOrPricing
-            : this._config.maxReserveAmountUsdc;
-        const pricing = typeof reserveAmountOrPricing === 'bigint'
-            ? pricingArg
-            : reserveAmountOrPricing;
-        // Budget validation: reject if seller demands more than buyer's overdraft limit
-        if (minBudgetPerRequest > this._config.maxPerRequestUsdc) {
-            debugWarn(`[BuyerPayment] Seller ${sellerPeerId.slice(0, 12)}... minBudgetPerRequest=${minBudgetPerRequest} exceeds maxPerRequestUsdc=${this._config.maxPerRequestUsdc} — not authorizing`);
-            return '';
-        }
-        // Clear confirmation state so we wait for a fresh AuthAck on the new session
-        this._confirmedPeers.delete(sellerPeerId);
-        // Store full pricing map (defaults + all per-service overrides).
-        // Merge 402-negotiated pricing on top of peer-metadata defaults so
-        // the seller's live rate takes precedence over cached peer metadata.
-        if (pricingMap) {
-            const mergedDefaults = pricing
-                ? { ...pricingMap.defaults, ...pricing }
-                : pricingMap.defaults;
-            this._sessionPricing.set(sellerPeerId, { defaults: mergedDefaults, services: pricingMap.services });
-        }
-        else if (pricing) {
-            // Legacy: single pricing, store as defaults
-            const existing = this._sessionPricing.get(sellerPeerId);
-            this._sessionPricing.set(sellerPeerId, {
-                defaults: pricing,
-                services: existing?.services ?? {},
-            });
-        }
-        // Generate random salt and compute deterministic channelId
-        const salt = '0x' + randomBytes(32).toString('hex');
-        const buyerEvmAddr = this._identity.wallet.address;
-        const channelId = computeChannelId(buyerEvmAddr, sellerEvmAddr, salt);
-        const deadline = Math.floor(Date.now() / 1000) + this._config.defaultAuthDurationSecs;
-        debugLog(`[BuyerPayment] authorizeSpending: channel=${channelId.slice(0, 18)}... seller=${sellerPeerId.slice(0, 12)}... amount=${minBudgetPerRequest}`);
-        // Sign ReserveAuth — binds channelId, maxAmount, deadline on-chain
-        const channelsDomain = this._channelsDomain;
-        const maxAmount = reserveAmount;
-        const reserveMsg = {
-            channelId,
-            maxAmount,
-            deadline: BigInt(deadline),
-        };
-        const reserveAuthSig = await signReserveAuth(this._signer, channelsDomain, reserveMsg);
-        // Initialize state for this session.
-        // Start cumulative at 0 — the initial message is a ReserveAuth (not a SpendingAuth).
-        // The first real SpendingAuth will be sent by handleNeedAuth after the seller serves
-        // the first request and reports its cost.
-        this._cumulativeAmount.set(sellerPeerId, 0n);
-        this._metadata.set(sellerPeerId, this._sanitizeMetadata({ ...ZERO_METADATA }));
-        this._verifiedCost.set(sellerPeerId, 0n);
-        this._currentReserveCeiling.set(sellerPeerId, maxAmount);
-        this._initialReserveAmount.set(sellerPeerId, maxAmount);
-        this._reserveSalt.set(sellerPeerId, salt);
-        // Store session
-        const now = Date.now();
-        const session = {
-            sessionId: channelId,
-            peerId: sellerPeerId,
-            role: CHANNEL_ROLE.BUYER,
-            sellerEvmAddr,
-            buyerEvmAddr: this._identity.wallet.address,
-            nonce: 0,
-            authMax: '0',
-            deadline,
-            previousSessionId: '0x' + '0'.repeat(64),
-            previousConsumption: '0',
-            tokensDelivered: '0',
-            requestCount: 0,
-            reservedAt: now,
-            settledAt: null,
-            settledAmount: null,
-            status: CHANNEL_STATUS.ACTIVE,
-            latestBuyerSig: null,
-            latestSpendingAuthSig: null,
-            latestMetadata: null,
-            createdAt: now,
-            updatedAt: now,
-        };
-        this._channelStore.upsertChannel(session);
-        // Send SpendingAuth via PaymentMux — reserve carries ReserveAuth sig
-        paymentMux.sendSpendingAuth({
-            channelId,
-            cumulativeAmount: '0',
-            metadataHash: ZERO_METADATA_HASH,
-            metadata: encodeMetadata(ZERO_METADATA),
-            spendingAuthSig: reserveAuthSig,
-            reserveSalt: salt,
-            reserveMaxAmount: maxAmount.toString(),
-            reserveDeadline: deadline,
-        });
-        return channelId;
-    }
-    // ── AuthAck handler ───────────────────────────────────────────
-    handleAuthAck(sellerPeerId, payload) {
-        const session = this.getActiveSession(sellerPeerId);
-        if (!session) {
-            debugWarn(`[BuyerPayment] AuthAck for unknown seller: ${sellerPeerId.slice(0, 12)}...`);
-            return;
-        }
-        if (session.sessionId !== payload.channelId) {
-            debugWarn(`[BuyerPayment] AuthAck channel mismatch: expected=${session.sessionId.slice(0, 18)}... got=${payload.channelId.slice(0, 18)}...`);
-            return;
-        }
-        this._confirmedPeers.add(sellerPeerId);
-        debugLog(`[BuyerPayment] AuthAck confirmed: channel=${session.sessionId.slice(0, 18)}...`);
-    }
-    // ── Buyer-side cost verification ──────────────────────────────
-    /**
-     * Estimate tokens and cost from response content without updating state.
-     */
-    _estimateResponseCost(sellerPeerId, inputBytes, outputBytes, service) {
-        const pricing = this.getSessionPricing(sellerPeerId, service);
-        if (!pricing)
-            return null;
-        return estimateCostFromBytes(inputBytes, outputBytes, pricing);
-    }
-    /**
-     * Accumulate a cost estimate into verifiedCost.
-     */
-    _accumulateVerifiedCost(sellerPeerId, estimate) {
-        const prev = this._verifiedCost.get(sellerPeerId) ?? 0n;
-        const newVerified = prev + estimate.cost;
-        this._verifiedCost.set(sellerPeerId, newVerified);
-        return newVerified;
-    }
-    /**
-     * Record response content and update the buyer's verified cost.
-     * Call this after receiving each response from the seller.
-     *
-     * NOTE: Do not call this AND signPerRequestAuth for the same response —
-     * signPerRequestAuth already updates verifiedCost internally.
-     *
-     * @returns The updated verified cost and estimated tokens, or null if no pricing is available.
-     */
-    recordResponseBytes(sellerPeerId, inputBytes, outputBytes) {
-        const estimate = this._estimateResponseCost(sellerPeerId, inputBytes, outputBytes);
-        if (!estimate)
-            return null;
-        const newVerified = this._accumulateVerifiedCost(sellerPeerId, estimate);
-        const inSize = inputBytes.length;
-        const outSize = outputBytes.length;
-        debugLog(`[BuyerPayment] recordResponseBytes: seller=${sellerPeerId.slice(0, 12)}... ` +
-            `in=${inSize}B→${estimate.inputTokens}tok out=${outSize}B→${estimate.outputTokens}tok ` +
-            `requestCost=${estimate.cost} verifiedCost=${newVerified}`);
-        return { verifiedCost: newVerified, inputTokens: estimate.inputTokens, outputTokens: estimate.outputTokens };
-    }
-    // ── Per-request authorization (overdraft model) ─────────────
-    /**
-     * Compute the max signable cumulative amount based on the overdraft model:
-     * maxSignable = verifiedCost + maxPerRequestUsdc, capped at reserve ceiling.
-     */
-    _maxSignable(sellerPeerId) {
-        const verified = this._verifiedCost.get(sellerPeerId) ?? 0n;
-        const ceiling = this._getCeiling(sellerPeerId);
-        const maxSignable = verified + this._config.maxPerRequestUsdc;
-        return maxSignable < ceiling ? maxSignable : ceiling;
-    }
-    /**
-     * Check whether the current cumulative amount is approaching the reserve ceiling
-     * and a top-up should be triggered.
-     */
-    _needsTopUp(sellerPeerId) {
-        const ceiling = this._getCeiling(sellerPeerId);
-        const current = this._cumulativeAmount.get(sellerPeerId) ?? 0n;
-        const threshold = BigInt(Math.floor(Number(ceiling) * DEFAULT_TOPUP_THRESHOLD));
-        return current >= threshold;
-    }
-    /**
-     * Sign an updated SpendingAuth after receiving a response.
-     *
-     * The buyer uses the seller's claimed cost to advance the cumulative amount,
-     * but validates it against the buyer's bytes/4 estimate. If the seller's claim
-     * exceeds the buyer's estimate by more than the configured tolerance, the buyer
-     * caps at tolerance * buyerEstimate. The cumulative is also capped at the
-     * overdraft limit (verifiedCost + maxPerRequestUsdc) and the reserve ceiling.
-     *
-     * @param sellerPeerId Seller peer ID.
-     * @param responseStats Byte counts from the last response and seller's claimed cost.
-     * @returns The signed payload and whether a reserve top-up is needed.
-     */
-    async signPerRequestAuth(sellerPeerId, responseStats) {
-        const session = this.getActiveSession(sellerPeerId);
-        if (!session) {
-            throw new Error(`[BuyerPayment] No active session for seller ${sellerPeerId.slice(0, 12)}... — call authorizeSpending() first`);
-        }
-        // Prefer reported token counts (from seller headers or buyer's parsed response usage)
-        // over byte-based estimation. Byte estimation inflates tokens due to JSON/SSE overhead.
-        // Also treat seller-claimed cost of 0 as authoritative — don't fall back to byte estimation.
-        const hasReportedTokens = (responseStats.reportedInputTokens != null && responseStats.reportedInputTokens > 0n) ||
-            (responseStats.reportedOutputTokens != null && responseStats.reportedOutputTokens > 0n) ||
-            (responseStats.sellerClaimedCost != null && responseStats.sellerClaimedCost === 0n);
-        let estimatedInputTokens;
-        let estimatedOutputTokens;
-        let estimatedCachedInputTokens = 0n;
-        let buyerEstimatedRequestCost;
-        if (hasReportedTokens) {
-            estimatedInputTokens = responseStats.reportedInputTokens ?? 0n;
-            estimatedOutputTokens = responseStats.reportedOutputTokens ?? 0n;
-            const cachedInputTokens = responseStats.reportedCachedInputTokens ?? 0n;
-            estimatedCachedInputTokens = cachedInputTokens;
-            // For cost estimation, reportedInputTokens is normalized to total logical
-            // input tokens (fresh + cached), so split fresh by subtracting cached.
-            const freshInputTokens = cachedInputTokens > 0n
-                ? BigInt(Math.max(0, Number(estimatedInputTokens) - Number(cachedInputTokens)))
-                : estimatedInputTokens;
-            // Compute cost from reported tokens using service-specific pricing
-            const pricing = this.getSessionPricing(sellerPeerId, responseStats.service);
-            if (pricing) {
-                const cost = computeCostUsdc(Number(freshInputTokens), Number(estimatedOutputTokens), pricing, Number(cachedInputTokens));
-                buyerEstimatedRequestCost = cost;
-                this._accumulateVerifiedCost(sellerPeerId, { cost, inputTokens: Number(estimatedInputTokens), outputTokens: Number(estimatedOutputTokens) });
-            }
-            else if (responseStats.sellerClaimedCost != null && responseStats.sellerClaimedCost > 0n) {
-                // No local pricing available (e.g. after buyer restart before session pricing is restored).
-                // Use seller's claimed cost for verifiedCost accumulation so _maxSignable can grow.
-                // The seller's claim is still validated against tolerance below.
-                buyerEstimatedRequestCost = responseStats.sellerClaimedCost;
-                this._accumulateVerifiedCost(sellerPeerId, { cost: responseStats.sellerClaimedCost, inputTokens: Number(estimatedInputTokens), outputTokens: Number(estimatedOutputTokens) });
-            }
-            else {
-                buyerEstimatedRequestCost = 0n;
-            }
-            debugLog(`[BuyerPayment] Using reported tokens: in=${estimatedInputTokens} cached=${cachedInputTokens} out=${estimatedOutputTokens} cost=${buyerEstimatedRequestCost}`);
-        }
-        else {
-            // Fall back to byte-based estimation
-            const estimate = this._estimateResponseCost(sellerPeerId, responseStats.inputBytes, responseStats.outputBytes, responseStats.service);
-            estimatedInputTokens = estimate ? BigInt(estimate.inputTokens) : 0n;
-            estimatedOutputTokens = estimate ? BigInt(estimate.outputTokens) : 0n;
-            buyerEstimatedRequestCost = estimate ? estimate.cost : 0n;
-            if (estimate) {
-                this._accumulateVerifiedCost(sellerPeerId, estimate);
-            }
-            debugLog(`[BuyerPayment] Byte-estimated tokens (no reported): in=${estimatedInputTokens} out=${estimatedOutputTokens} cost=${buyerEstimatedRequestCost}`);
-        }
-        // Determine the accepted cost for this request:
-        // When the seller reports a cost within tolerance, accept the seller's claim so the
-        // buyer doesn't underpay due to minor parsing differences. Only cap when the seller's
-        // claim exceeds the tolerance threshold.
-        let acceptedCost;
-        if (responseStats.sellerClaimedCost != null && responseStats.sellerClaimedCost > 0n) {
-            if (buyerEstimatedRequestCost > 0n) {
-                const maxAcceptable = BigInt(Math.ceil(Number(buyerEstimatedRequestCost) * this._costTolerance));
-                if (responseStats.sellerClaimedCost > maxAcceptable) {
-                    debugWarn(`[BuyerPayment] Seller claimed ${responseStats.sellerClaimedCost} exceeds ${this._costTolerance}x buyer estimate ${buyerEstimatedRequestCost} — capping at ${maxAcceptable}`);
-                    acceptedCost = maxAcceptable;
-                }
-                else {
-                    // Seller's claim is within tolerance — accept it as-is
-                    acceptedCost = responseStats.sellerClaimedCost;
-                }
-            }
-            else {
-                // No buyer estimate available — accept seller's claim
-                acceptedCost = responseStats.sellerClaimedCost;
-            }
-        }
-        else {
-            acceptedCost = buyerEstimatedRequestCost;
-        }
-        // If cost is 0, the cumulative amount stays the same — no spending auth needed
-        // but we still sign one to keep the seller's session alive.
-        // Advance cumulative amount by the accepted cost, then add overdraft headroom
-        // for the next request (so the seller has budget to serve it).
-        // maxSignable already caps at reserve ceiling, so one cap is sufficient
-        const prevAmount = this._cumulativeAmount.get(sellerPeerId) ?? 0n;
-        const maxSignable = this._maxSignable(sellerPeerId);
-        let newAmount = prevAmount + acceptedCost;
-        if (newAmount > maxSignable)
-            newAmount = maxSignable;
-        this._cumulativeAmount.set(sellerPeerId, newAmount);
-        const signedDelta = newAmount - prevAmount;
-        // Update cumulative metadata
-        // If handleNeedAuth already counted this request (seller-initiated NeedAuth
-        // raced ahead), skip service attribution entirely: service totals are
-        // documented as lower bounds, so undercounting beats double-counting.
-        const alreadyCounted = this._serviceTokensCounted.has(responseStats.requestId);
-        const newMeta = this._advanceUsageMetadata(this._metadata.get(sellerPeerId), alreadyCounted ? undefined : responseStats.service, {
-            amount: signedDelta,
-            inputTokens: estimatedInputTokens,
-            cachedInputTokens: estimatedCachedInputTokens,
-            outputTokens: estimatedOutputTokens,
-            requests: 1n,
-        });
-        if (!alreadyCounted)
-            this._serviceTokensCounted.mark(responseStats.requestId);
-        this._metadata.set(sellerPeerId, newMeta);
-        this._persistServiceMetadata(session.sessionId, newMeta);
-        this._reportSpend({
-            sellerPeerId,
-            requestId: responseStats.requestId ?? null,
-            amountUsdc: signedDelta.toString(),
-            inputTokens: (alreadyCounted ? 0n : estimatedInputTokens).toString(),
-            cachedInputTokens: (alreadyCounted ? 0n : estimatedCachedInputTokens).toString(),
-            outputTokens: (alreadyCounted ? 0n : estimatedOutputTokens).toString(),
-        });
-        debugLog(`[BuyerPayment] signPerRequestAuth #${newMeta.cumulativeRequestCount}: ` +
-            `thisReq in=${estimatedInputTokens} out=${estimatedOutputTokens} | ` +
-            `cumulative in=${newMeta.cumulativeInputTokens} out=${newMeta.cumulativeOutputTokens} | ` +
-            `acceptedCost=${acceptedCost} cumulativeAmount=${newAmount}`);
-        // Compute metadata hash and encode metadata
-        const metadataHashHex = computeMetadataHash(newMeta);
-        const encodedMetadata = encodeMetadata(newMeta);
-        // Sign EIP-712 SpendingAuth
-        const channelsDomain = this._channelsDomain;
-        const metadataMsg = {
-            channelId: session.sessionId,
-            cumulativeAmount: newAmount,
-            metadataHash: metadataHashHex,
-        };
-        const spendingAuthSig = await signSpendingAuth(this._signer, channelsDomain, metadataMsg);
-        // Persist updated cumulative values to ChannelStore
-        this._channelStore.upsertChannel({
-            ...session,
-            authMax: newAmount.toString(),
-            requestCount: Number(newMeta.cumulativeRequestCount),
-            updatedAt: Date.now(),
-        });
-        const payload = {
-            channelId: session.sessionId,
-            cumulativeAmount: newAmount.toString(),
-            metadataHash: metadataHashHex,
-            metadata: encodedMetadata,
-            spendingAuthSig,
-        };
-        const topUpNeeded = this._needsTopUp(sellerPeerId);
-        return { payload, topUpNeeded };
-    }
-    // ── NeedAuth handler ───────────────────────────────────────────
-    /**
-     * Handle seller-initiated NeedAuth messages sent after every served request.
-     * The seller includes the cost of the last request; the buyer validates it
-     * against its own token count and signs a new SpendingAuth for the required
-     * cumulative amount, capped at the reserve ceiling.
-     */
-    async handleNeedAuth(sellerPeerId, payload, paymentMux) {
-        const session = this.getActiveSession(sellerPeerId);
-        if (!session) {
-            debugWarn(`[BuyerPayment] NeedAuth for unknown seller: ${sellerPeerId.slice(0, 12)}...`);
-            return;
-        }
-        const buyerService = this._requestService.get(payload.requestId);
-        const requiredCumulativeAmount = BigInt(payload.requiredCumulativeAmount);
-        const currentCumulative = this._cumulativeAmount.get(sellerPeerId) ?? 0n;
-        // Reject stale/lower NeedAuth (monotonicity guard)
-        if (requiredCumulativeAmount <= currentCumulative) {
-            debugLog(`[BuyerPayment] NeedAuth stale: required=${requiredCumulativeAmount} <= current=${currentCumulative} — ignoring`);
-            return;
-        }
-        this._requestService.take(payload.requestId);
-        let acceptedServiceCost = 0n;
-        const reportedInputTokens = BigInt(payload.inputTokens ?? '0');
-        const reportedCachedInputTokens = BigInt(payload.cachedInputTokens ?? '0');
-        const reportedOutputTokens = BigInt(payload.outputTokens ?? '0');
-        // Validate the seller's claimed cost if reported
-        if (payload.lastRequestCost) {
-            const sellerCost = BigInt(payload.lastRequestCost);
-            const sellerIn = reportedInputTokens;
-            const sellerOut = reportedOutputTokens;
-            const sellerCached = reportedCachedInputTokens;
-            acceptedServiceCost = sellerCost;
-            // Prefer seller-supplied freshInputTokens to avoid OpenAI-vs-Anthropic
-            // cached-semantics ambiguity (OpenAI: prompt_tokens includes cached;
-            // Anthropic: input_tokens excludes cached). Fall back to OpenAI-style
-            // subtraction for older sellers that don't emit the field.
-            const sellerFreshExplicit = payload.freshInputTokens != null
-                ? BigInt(payload.freshInputTokens)
-                : null;
-            // Use the buyer's own knowledge of which service it requested, not the seller's claim.
-            // A malicious seller could set service to a more expensive model to inflate the ceiling.
-            const pricing = this.getSessionPricing(sellerPeerId, buyerService);
-            if (pricing && sellerCost > 0n) {
-                const freshIn = sellerFreshExplicit ?? (sellerCached > 0n
-                    ? BigInt(Math.max(0, Number(sellerIn) - Number(sellerCached)))
-                    : sellerIn);
-                const buyerEstimate = computeCostUsdc(Number(freshIn), Number(sellerOut), pricing, Number(sellerCached));
-                const maxAcceptable = BigInt(Math.ceil(Number(buyerEstimate) * this._costTolerance));
-                if (buyerEstimate > 0n && sellerCost > maxAcceptable) {
-                    debugWarn(`[BuyerPayment] NeedAuth: seller claimed cost ${sellerCost} exceeds ${this._costTolerance}x buyer estimate ${buyerEstimate} — rejecting`);
-                    return;
-                }
-                debugLog(`[BuyerPayment] NeedAuth: seller cost=${sellerCost} buyer estimate=${buyerEstimate} (in=${sellerIn} cached=${sellerCached} out=${sellerOut}) — validated`);
-            }
-            else {
-                debugLog(`[BuyerPayment] NeedAuth: seller cost=${sellerCost} (no local pricing, accepting)`);
-            }
-            // Accumulate verified cost from the seller's report
-            this._accumulateVerifiedCost(sellerPeerId, {
-                cost: sellerCost,
-                inputTokens: Number(sellerIn),
-                outputTokens: Number(sellerOut),
-            });
-        }
-        // Cap at overdraft limit: verifiedCost + maxPerRequestUsdc, then at reserve ceiling.
-        // This prevents a malicious seller from claiming a small cost but requesting the full reserve.
-        let maxSignable = this._maxSignable(sellerPeerId);
-        const ceiling = this._getCeiling(sellerPeerId);
-        let needsTopUp = this._needsCeilingAdvance(requiredCumulativeAmount, maxSignable, ceiling);
-        if (maxSignable <= currentCumulative && !needsTopUp) {
-            maxSignable = this._reopenOverdraftWindowIfCollapsed(sellerPeerId, currentCumulative, maxSignable, 'handleNeedAuth');
-            needsTopUp = this._needsCeilingAdvance(requiredCumulativeAmount, maxSignable, ceiling);
-            if (maxSignable <= currentCumulative && !needsTopUp) {
-                debugWarn(`[BuyerPayment] NeedAuth: maxSignable=${maxSignable} <= currentCumulative=${currentCumulative} — overdraft limit reached`);
-                return;
-            }
-        }
-        // When a topUp is needed, first sign at the current ceiling so the seller
-        // has a high-enough settled amount to pass the on-chain TopUpThresholdNotMet
-        // check (contract requires 85% of deposit to be settleable before topUp).
-        // We cap at the old ceiling here; the topUp is sent AFTER so the seller
-        // processes the SpendingAuth first, then the topUp with adequate settle amount.
-        const effectiveAmount = needsTopUp
-            ? (maxSignable > currentCumulative ? maxSignable : currentCumulative)
-            : (requiredCumulativeAmount < maxSignable ? requiredCumulativeAmount : maxSignable);
-        if (effectiveAmount <= currentCumulative) {
-            // Nothing to sign — trigger topUp anyway to extend ceiling for next round
-            if (needsTopUp) {
-                await this._topUpAfterSpendAuthBestEffort(sellerPeerId, paymentMux, 'handleNeedAuth');
-            }
-            debugWarn(`[BuyerPayment] NeedAuth: effectiveAmount=${effectiveAmount} <= currentCumulative=${currentCumulative} — cannot advance`);
-            return;
-        }
-        debugLog(`[BuyerPayment] NeedAuth: channel=${session.sessionId.slice(0, 18)}... required=${requiredCumulativeAmount} effective=${effectiveAmount}`);
-        // Advance cumulative metadata. requestCount always increments so the
-        // on-chain metadata stays consistent even when older sellers omit token
-        // fields; absent token fields contribute 0 to the running totals.
-        const signedDelta = effectiveAmount - currentCumulative;
-        const serviceAmountDelta = acceptedServiceCost > 0n
-            ? (acceptedServiceCost < signedDelta ? acceptedServiceCost : signedDelta)
-            : 0n;
-        // If signPerRequestAuth already counted this request (buyer-initiated auth
-        // raced ahead but didn't fully cover the seller's required cumulative), skip
-        // service attribution entirely: service totals are documented as lower
-        // bounds, so undercounting beats double-counting.
-        const alreadyCounted = this._serviceTokensCounted.has(payload.requestId);
-        const newMeta = this._advanceUsageMetadata(this._metadata.get(sellerPeerId), alreadyCounted ? undefined : buyerService, {
-            amount: serviceAmountDelta,
-            inputTokens: reportedInputTokens,
-            cachedInputTokens: reportedCachedInputTokens,
-            outputTokens: reportedOutputTokens,
-            requests: 1n,
-        });
-        if (!alreadyCounted)
-            this._serviceTokensCounted.mark(payload.requestId);
-        this._metadata.set(sellerPeerId, newMeta);
-        // Send via PaymentMux
-        try {
-            await this._sendUpdatedSpendingAuth(session, sellerPeerId, effectiveAmount, newMeta, paymentMux);
-            this._reportSpend({
-                sellerPeerId,
-                requestId: payload.requestId ?? null,
-                amountUsdc: signedDelta.toString(),
-                inputTokens: (alreadyCounted ? 0n : reportedInputTokens).toString(),
-                cachedInputTokens: (alreadyCounted ? 0n : reportedCachedInputTokens).toString(),
-                outputTokens: (alreadyCounted ? 0n : reportedOutputTokens).toString(),
-            });
-            debugLog(`[BuyerPayment] NeedAuth responded: new cumulativeAmount=${effectiveAmount}`);
-        }
-        catch {
-            debugLog(`[BuyerPayment] NeedAuth: connection closed before SpendingAuth could be sent`);
-        }
-        // Send topUp AFTER the SpendingAuth so the seller processes the higher
-        // cumulative first — this ensures the on-chain settle amount meets the
-        // contract's TopUpThresholdNotMet requirement (85% of deposit must be
-        // settleable before topUp is allowed). Also proactively send the top-up
-        // once the signed cumulative reaches the buyer's 65% threshold; the seller
-        // may defer the on-chain topUp until the contract's 85% gate is satisfied.
-        if (needsTopUp || this._needsTopUp(sellerPeerId)) {
-            await this._topUpAfterSpendAuthBestEffort(sellerPeerId, paymentMux, 'handleNeedAuth');
-        }
-    }
-    // ── Reserve top-up ─────────────────────────────────────────────
-    /**
-     * Sign a new ReserveAuth with a higher maxAmount to extend the session's reserve ceiling.
-     * The seller must call reserve() on-chain again with the new signature.
-     * Note: requires contract support for top-up (increaseDeposit on existing channelId).
-     */
-    async topUpReserve(sellerPeerId, paymentMux) {
-        const session = this.getActiveSession(sellerPeerId);
-        if (!session) {
-            debugWarn(`[BuyerPayment] topUpReserve: no active session for ${sellerPeerId.slice(0, 12)}...`);
-            return;
-        }
-        const prevCeiling = this._getCeiling(sellerPeerId);
-        const newCeiling = prevCeiling + this._config.maxReserveAmountUsdc;
-        const additionalReserve = newCeiling - prevCeiling;
-        const deadline = Math.floor(Date.now() / 1000) + this._config.defaultAuthDurationSecs;
-        try {
-            const balance = await this.getBalance();
-            if (balance.available < additionalReserve) {
-                throw new Error(`Insufficient buyer deposits for reserve top-up: available=${balance.available} required=${additionalReserve}`);
-            }
-        }
-        catch (err) {
-            if (err instanceof Error && err.message.startsWith('Insufficient buyer deposits')) {
-                throw err;
-            }
-            debugWarn(`[BuyerPayment] topUpReserve: unable to verify buyer deposits before signing top-up: ` +
-                `${err instanceof Error ? err.message : err}`);
-        }
-        debugLog(`[BuyerPayment] topUpReserve: channel=${session.sessionId.slice(0, 18)}... ceiling ${prevCeiling} → ${newCeiling}`);
-        // Sign ReserveAuth with new maxAmount
-        const channelsDomain = this._channelsDomain;
-        const reserveMsg = {
-            channelId: session.sessionId,
-            maxAmount: newCeiling,
-            deadline: BigInt(deadline),
-        };
-        const reserveAuthSig = await signReserveAuth(this._signer, channelsDomain, reserveMsg);
-        const currentCumulative = this._cumulativeAmount.get(sellerPeerId) ?? 0n;
-        const currentMeta = this._sanitizeMetadata(this._metadata.get(sellerPeerId));
-        const metadataHashHex = computeMetadataHash(currentMeta);
-        const encodedMetadata = encodeMetadata(currentMeta);
-        const salt = this._reserveSalt.get(sellerPeerId) ?? '0x' + '00'.repeat(32);
-        // Send ReserveAuth sig with reserve fields (same pattern as initial authorizeSpending).
-        // The seller uses this to call topUp() on-chain with the new maxAmount.
-        try {
-            paymentMux.sendSpendingAuth({
-                channelId: session.sessionId,
-                cumulativeAmount: currentCumulative.toString(),
-                metadataHash: metadataHashHex,
-                metadata: encodedMetadata,
-                spendingAuthSig: reserveAuthSig,
-                reserveSalt: salt,
-                reserveMaxAmount: newCeiling.toString(),
-                reserveDeadline: deadline,
-            });
-            // Only commit the new ceiling after the message is delivered
-            this._currentReserveCeiling.set(sellerPeerId, newCeiling);
-            debugLog(`[BuyerPayment] topUpReserve sent: newCeiling=${newCeiling}`);
-        }
-        catch {
-            debugLog(`[BuyerPayment] topUpReserve: connection closed before ReserveAuth could be sent`);
-        }
-    }
-    // ── Queries ───────────────────────────────────────────────────
-    /** Max USDC overdraft (unverified exposure) from buyer config. */
-    get maxPerRequestUsdc() {
-        return this._config.maxPerRequestUsdc;
-    }
-    /** Max USDC per ReserveAuth signature from buyer config. */
-    get maxReserveAmountUsdc() {
-        return this._config.maxReserveAmountUsdc;
-    }
-    /** Current buyer-verified cost for a seller. */
-    getVerifiedCost(sellerPeerId) {
-        return this._verifiedCost.get(sellerPeerId) ?? 0n;
-    }
-    /** Current reserve ceiling for a seller (may be higher than initial after top-ups). */
-    getReserveCeiling(sellerPeerId) {
-        return this._currentReserveCeiling.get(sellerPeerId) ?? this._config.maxReserveAmountUsdc;
-    }
-    /** Current cumulative signed amount for a seller. */
-    getCumulativeAmount(sellerPeerId) {
-        return this._cumulativeAmount.get(sellerPeerId) ?? 0n;
-    }
-    /** Live cumulative token counts for a seller (in-memory, always up-to-date). */
-    getCumulativeTokens(sellerPeerId) {
-        const meta = this._sanitizeMetadata(this._metadata.get(sellerPeerId));
-        return { inputTokens: meta.cumulativeInputTokens, outputTokens: meta.cumulativeOutputTokens };
-    }
-    /**
-     * Accumulate response token counts and persist to the channel store.
-     * Tracks its own running totals independently of signPerRequestAuth metadata,
-     * so the persisted data is always up-to-date after each response.
-     */
-    recordAndPersistTokens(sellerPeerId, inputTokens, outputTokens) {
-        const session = this.getActiveSession(sellerPeerId);
-        if (!session)
-            return;
-        const prev = this._responseTokenTotals.get(sellerPeerId) ?? {
-            input: Number(session.tokensDelivered),
-            output: Number(session.previousConsumption),
-            requests: session.requestCount,
-        };
-        debugLog(`[BuyerPayment] recordTokens: thisReq in=${inputTokens} out=${outputTokens} | ` +
-            `prevTotal in=${prev.input} out=${prev.output} reqs=${prev.requests}`);
-        const totals = {
-            input: prev.input + inputTokens,
-            output: prev.output + outputTokens,
-            requests: prev.requests + 1,
-        };
-        this._responseTokenTotals.set(sellerPeerId, totals);
-        this._channelStore.upsertChannel({
-            ...session,
-            tokensDelivered: String(totals.input),
-            previousConsumption: String(totals.output),
-            requestCount: totals.requests,
-            updatedAt: Date.now(),
-        });
-    }
-    /** Register which service the buyer requested for a given requestId. */
-    trackRequestService(requestId, service) {
-        this._requestService.track(requestId, service);
-    }
-    /** Get the live response token totals for a seller, or null if none recorded this session. */
-    getResponseTokenTotals(sellerPeerId) {
-        return this._responseTokenTotals.get(sellerPeerId) ?? null;
-    }
-    /** Get the session pricing for a seller+service. Resolves service-specific pricing first, then defaults. */
-    getSessionPricing(sellerPeerId, service) {
-        const map = this._sessionPricing.get(sellerPeerId);
-        if (!map)
-            return null;
-        if (service) {
-            const servicePricing = map.services[service];
-            if (servicePricing)
-                return servicePricing;
-        }
-        return map.defaults;
-    }
-    /** Check if a session has been confirmed via AuthAck. */
-    isAuthorized(sellerPeerId) {
-        return this._confirmedPeers.has(sellerPeerId);
-    }
-    /** Alias for isAuthorized (used by polling loop). */
-    isLockConfirmed(sellerPeerId) {
-        return this.isAuthorized(sellerPeerId);
-    }
-    /** Check if the lock was explicitly rejected (not just never-contacted). */
-    isLockRejected(sellerPeerId) {
-        return this._rejectedPeers.has(sellerPeerId);
-    }
-    /** Mark a peer as having rejected our spending auth. */
-    markRejected(sellerPeerId) {
-        this._rejectedPeers.add(sellerPeerId);
-        debugLog(`[BuyerPayment] Peer ${sellerPeerId.slice(0, 12)}... marked as rejected`);
-    }
-    getSessionHistory(sellerPeerId) {
-        const session = this._channelStore.getLatestChannelByPeerAndBuyer(sellerPeerId, 'buyer', this._identity.wallet.address);
-        return session ? [session] : [];
-    }
-    // ── Deposit operations ──────────────────────────────────────────
-    async deposit(amount) {
-        debugLog(`[BuyerPayment] Depositing ${amount} to deposits`);
-        const buyer = this._identity.wallet.address;
-        return this._depositsClient.deposit(this._signer, buyer, amount);
-    }
-    async withdraw(amount) {
-        debugLog(`[BuyerPayment] Withdrawing ${amount} from deposits`);
-        return this._depositsClient.withdraw(this._signer, this._identity.wallet.address, amount);
-    }
-    async getBalance() {
-        const buyerAddr = this._identity.wallet.address;
-        const info = await this._depositsClient.getBuyerBalance(buyerAddr);
-        return { available: info.available, reserved: info.reserved };
-    }
-}
+// Moved to @antseed/buyer-core; re-exported for compatibility.
+export * from '@antseed/buyer-core/buyer-payment-manager';
 //# sourceMappingURL=buyer-payment-manager.js.map