@antseed/node 0.2.129 → 0.2.130

package/dist/payments/seller-payment-manager.js

@@ -3,7 +3,7 @@ import { ChannelsClient } from './evm/channels-client.js';
 import { SPENDING_AUTH_TYPES, RESERVE_AUTH_TYPES, makeChannelsDomain, encodeMetadata, ZERO_METADATA, } from './evm/signatures.js';
 import { debugLog, debugWarn } from '../utils/debug.js';
 import { peerIdToAddress } from '../types/peer.js';
-import { CHANNEL_ROLE, CHANNEL_STATUS } from './channel-store.js';
+import { CHANNEL_KIND, CHANNEL_ROLE, CHANNEL_STATUS } from './channel-store.js';
 import { classifyOnChainChannel, matchesChannelParties } from './channel-session-state.js';
 /** Default minimum budget per request: $0.50 USDC (base units). */
 const DEFAULT_MIN_BUDGET_PER_REQUEST = '500000';
@@ -24,6 +24,15 @@ const INSUFFICIENT_BALANCE_SELECTOR = '0xf4d678b8';
 const IN_FLIGHT_TX_LIMIT_PHRASE = 'in-flight transaction limit';
 /** Backoff stays well inside the buyer's 30-second AuthAck timeout. */
 const RESERVE_BACKPRESSURE_RETRY_DELAYS_MS = [250, 500, 1_000, 2_000, 4_000];
+/** How long a one-off plan offered in a 402 stays valid for the buyer's opening auth. */
+const ONE_OFF_PLAN_TTL_MS = 2 * 60_000;
+/**
+ * A one-off channel whose request was never paid is closed after this long,
+ * releasing the buyer's reserve. Long enough to finish and download a video.
+ */
+export const ONE_OFF_CHANNEL_TTL_MS = 24 * 60 * 60_000;
+/** A one-off channel whose request never started is closed after this long. */
+export const ONE_OFF_UNCLAIMED_TTL_MS = 10 * 60_000;
 /**
  * Manages seller-side payment sessions.
  * The buyer sends a single SpendingAuth signature with a monotonically
@@ -97,6 +106,14 @@ export class SellerPaymentManager {
      *  process. Lets the idle-settle loop skip the `getSession` RPC when the
      *  local accepted cumulative hasn't moved since our last settle. */
     _lastSettledCumulative = new Map();
+    /** buyerPeerId + requestId -> one-off channel terms offered in a 402. */
+    _pendingOneOffPlans = new Map();
+    /**
+     * Active one-off channels. They share the channel-keyed maps above but are
+     * never a buyer's session channel: they are not in `_activeBuyers`, are not
+     * closed on disconnect, and never supersede the buyer's session channel.
+     */
+    _oneOffChannelIds = new Set();
     _minSettleDelta;
     _serveWhileClosePending;
     /** Max close() retries before giving up (buyer must requestClose on-chain) */
@@ -150,6 +167,20 @@ export class SellerPaymentManager {
                 });
             }
         }
+        for (const channel of this._channelStore.getActiveChannels(CHANNEL_ROLE.SELLER, CHANNEL_KIND.ONE_OFF)) {
+            this._oneOffChannelIds.add(channel.sessionId);
+            this._acceptedCumulative.set(channel.sessionId, BigInt(channel.authMax || '0'));
+            this._spent.set(channel.sessionId, BigInt(channel.tokensDelivered || '0'));
+            this._reserveMax.set(channel.sessionId, BigInt(channel.previousConsumption || '0'));
+            if (channel.latestSpendingAuthSig) {
+                this._latestAuth.set(channel.sessionId, {
+                    spendingAuthSig: channel.latestSpendingAuthSig,
+                    cumulativeAmount: BigInt(channel.authMax),
+                    metadataHash: '',
+                    metadata: channel.latestMetadata ?? '',
+                });
+            }
+        }
     }
     /**
      * Validate hydrated channels against on-chain state.
@@ -157,6 +188,7 @@ export class SellerPaymentManager {
      * Must be called after construction (async, cannot run in constructor).
      */
     async validateHydratedChannels() {
+        await this._checkOneOffChannels();
         const activeChannels = this._channelStore.getActiveChannels(CHANNEL_ROLE.SELLER);
         if (activeChannels.length === 0)
             return;
@@ -221,7 +253,8 @@ export class SellerPaymentManager {
         this._blockedChannels.delete(channelId);
         this._lastSettledCumulative.delete(channelId);
         this._releaseAcceptedWaiters(channelId);
-        this._deactivateBuyerForChannel(peerId, channelId);
+        if (!this._oneOffChannelIds.delete(channelId))
+            this._deactivateBuyerForChannel(peerId, channelId);
         debugLog(`[SellerPayment] Evicted stale channel ${channelId.slice(0, 18)}... — ${reason}`);
     }
     /** Remove connectivity only if it still belongs to the channel being cleaned up. */
@@ -362,14 +395,27 @@ export class SellerPaymentManager {
      */
     async handleSpendingAuth(buyerPeerId, payload, paymentMux) {
         const disconnectMarker = this._buyerDisconnectMarkers.get(buyerPeerId);
-        // Per-buyer mutex: serialize concurrent auths for the same buyer
-        const existing = this._buyerLocks.get(buyerPeerId);
+        // Per-buyer mutex: serialize concurrent auths for the same buyer. A one-off
+        // channel gets its own lock so opening it (reserve + topUp on-chain) never
+        // delays the buyer's session-channel auths.
+        const isOneOff = payload.oneOffRequestId != null || this._oneOffChannelIds.has(payload.channelId);
+        const lockKey = isOneOff ? `${buyerPeerId}\n${payload.channelId.toLowerCase()}` : buyerPeerId;
+        const existing = this._buyerLocks.get(lockKey);
         let result = 'rejected';
         const lock = (existing ?? Promise.resolve()).then(async () => {
-            result = await this._handleSpendingAuthInner(buyerPeerId, payload, paymentMux, disconnectMarker);
+            result = isOneOff
+                ? await this._handleOneOffSpendingAuth(buyerPeerId, payload, paymentMux)
+                : await this._handleSpendingAuthInner(buyerPeerId, payload, paymentMux, disconnectMarker);
         });
-        this._buyerLocks.set(buyerPeerId, lock.catch(() => { }));
-        await lock;
+        const tail = lock.catch(() => { });
+        this._buyerLocks.set(lockKey, tail);
+        try {
+            await lock;
+        }
+        finally {
+            if (isOneOff && this._buyerLocks.get(lockKey) === tail)
+                this._buyerLocks.delete(lockKey);
+        }
         return result;
     }
     /**
@@ -627,6 +673,336 @@ export class SellerPaymentManager {
             return 'rejected';
         }
     }
+    /**
+     * Verify a reserve batch: a threshold SpendingAuth within the opening
+     * reserve plus a ReserveAuth for a larger final ceiling, both signed by the
+     * buyer. Returns the SpendingAuth to submit with topUp(), or null.
+     */
+    _verifyReserveBatch(channelId, batch, openingReserve, buyerEvmAddr, channelsDomain) {
+        const cumulativeAmount = BigInt(batch.cumulativeAmount);
+        const finalReserveMax = BigInt(batch.maxAmount);
+        if (cumulativeAmount <= 0n
+            || cumulativeAmount > openingReserve
+            || finalReserveMax <= openingReserve
+            || keccak256(batch.metadata) !== batch.metadataHash) {
+            debugWarn(`[SellerPayment] Invalid reserve batch for channel ${channelId.slice(0, 18)}...`);
+            return null;
+        }
+        const spendingRecovered = verifyTypedData(channelsDomain, SPENDING_AUTH_TYPES, {
+            channelId,
+            cumulativeAmount,
+            metadataHash: batch.metadataHash,
+        }, batch.spendingAuthSig);
+        const topUpRecovered = verifyTypedData(channelsDomain, RESERVE_AUTH_TYPES, {
+            channelId,
+            maxAmount: finalReserveMax,
+            deadline: BigInt(batch.deadline),
+        }, batch.reserveAuthSig);
+        if (spendingRecovered.toLowerCase() !== buyerEvmAddr.toLowerCase()
+            || topUpRecovered.toLowerCase() !== buyerEvmAddr.toLowerCase()) {
+            debugWarn(`[SellerPayment] Invalid reserve batch signatures for channel ${channelId.slice(0, 18)}...`);
+            return null;
+        }
+        return {
+            spendingAuthSig: batch.spendingAuthSig,
+            cumulativeAmount,
+            metadataHash: batch.metadataHash,
+            metadata: batch.metadata,
+        };
+    }
+    // ── One-off channels ──────────────────────────────────────────
+    /**
+     * Offer a one-off channel for a single request (a video create). The plan is
+     * what the buyer must sign; the opening SpendingAuth is only accepted when it
+     * matches a plan this seller offered for the same buyer and requestId.
+     */
+    registerOneOffPlan(buyerPeerId, requestId, plan) {
+        const now = Date.now();
+        for (const [key, pending] of this._pendingOneOffPlans) {
+            if (pending.expiresAt <= now)
+                this._pendingOneOffPlans.delete(key);
+        }
+        this._pendingOneOffPlans.set(oneOffPlanKey(buyerPeerId, requestId), {
+            openingReserveAmount: BigInt(plan.openingReserveAmount),
+            requiredCumulativeAmount: BigInt(plan.requiredCumulativeAmount),
+            requestCost: BigInt(plan.requestCost),
+            expiresAt: now + ONE_OFF_PLAN_TTL_MS,
+        });
+    }
+    /** The active one-off channel opened for this buyer's request, or null. */
+    getOneOffChannelForRequest(buyerPeerId, requestId) {
+        const channel = this._channelStore.getOneOffChannelByRequest(buyerPeerId, CHANNEL_ROLE.SELLER, requestId);
+        if (!channel || channel.status !== CHANNEL_STATUS.ACTIVE || !this._oneOffChannelIds.has(channel.sessionId))
+            return null;
+        return channel;
+    }
+    /** Any channel this seller tracks, active or not. */
+    getChannel(channelId) {
+        return this._channelStore.getChannel(channelId);
+    }
+    isOneOffChannel(channelId) {
+        return this._oneOffChannelIds.has(channelId);
+    }
+    /**
+     * Mark the one-off channel's single request as started. Returns false when
+     * it already ran, so a resent request cannot start a second job on it.
+     */
+    claimOneOffChannel(channelId) {
+        const channel = this._channelStore.getChannel(channelId);
+        if (!channel || !this._oneOffChannelIds.has(channelId) || channel.status !== CHANNEL_STATUS.ACTIVE)
+            return false;
+        if (channel.requestCount > 0)
+            return false;
+        this._channelStore.upsertChannel({ ...channel, requestCount: 1, updatedAt: Date.now() });
+        return true;
+    }
+    /**
+     * Close a one-off channel with the buyer's latest SpendingAuth (or the
+     * already-settled amount when there is none), releasing the rest of the
+     * reserve to the buyer. Used once the request is paid, and when it failed
+     * or was abandoned.
+     */
+    async closeOneOffChannel(channelId, reason) {
+        if (!this._oneOffChannelIds.has(channelId))
+            return false;
+        const channel = this._channelStore.getChannel(channelId);
+        if (!channel)
+            return false;
+        const retries = this._closeRetryCount.get(channelId) ?? 0;
+        if (retries >= SellerPaymentManager.MAX_CLOSE_RETRIES) {
+            debugWarn(`[SellerPayment] One-off close failed ${retries} times for ${channelId.slice(0, 18)}... — leaving it to the buyer's requestClose()`);
+            this._channelStore.updateChannelStatus(channelId, CHANNEL_STATUS.TIMEOUT);
+            this._forgetChannel(channelId, channel.peerId);
+            return false;
+        }
+        const { amount, metadata, sig } = this._getSettleParams(channelId);
+        debugLog(`[SellerPayment] Closing one-off channel ${channelId.slice(0, 18)}... at ${amount} (${reason})`);
+        const closeResult = await this._submitClose(channelId, amount, () => this._channelsClient.close(this._signer, channelId, amount, metadata, sig));
+        if (!closeResult.closed) {
+            if (!this._isRetryableTxSubmissionFailure(closeResult.error))
+                this._closeRetryCount.set(channelId, retries + 1);
+            debugWarn(`[SellerPayment] Failed to close one-off channel ${channelId.slice(0, 18)}...: ${this._formatError(closeResult.error)}`);
+            return false;
+        }
+        this._channelStore.updateChannelStatus(channelId, CHANNEL_STATUS.SETTLED, closeResult.amount.toString());
+        this._closeRetryCount.delete(channelId);
+        this._forgetChannel(channelId, channel.peerId);
+        return true;
+    }
+    async _handleOneOffSpendingAuth(buyerPeerId, payload, paymentMux) {
+        try {
+            if (!this._metadataMatchesHash(payload)) {
+                debugWarn(`[SellerPayment] Rejecting one-off SpendingAuth: metadataHash mismatch channel=${payload.channelId.slice(0, 18)}...`);
+                return 'rejected';
+            }
+            const { channels: channelsAddr } = await this._resolvedAddresses;
+            const channelsDomain = makeChannelsDomain(this._config.chainId, channelsAddr);
+            if (this._oneOffChannelIds.has(payload.channelId)) {
+                return await this._acceptOneOffSpendingAuth(buyerPeerId, payload, channelsDomain);
+            }
+            return await this._openOneOffChannel(buyerPeerId, payload, paymentMux, channelsDomain);
+        }
+        catch (err) {
+            debugWarn(`[SellerPayment] Failed to process one-off SpendingAuth: ${this._formatError(err)}`);
+            return 'rejected';
+        }
+    }
+    /**
+     * Open a one-off channel: reserve() the opening amount and, for a price
+     * above it, topUp() to the full price with the buyer's threshold auth in the
+     * same flow. Never touches the buyer's session channel.
+     */
+    async _openOneOffChannel(buyerPeerId, payload, paymentMux, channelsDomain) {
+        const requestId = payload.oneOffRequestId;
+        const channelId = payload.channelId;
+        const buyerEvmAddr = peerIdToAddress(buyerPeerId);
+        if (!requestId || !payload.reserveSalt || !payload.reserveMaxAmount || payload.reserveDeadline == null) {
+            debugWarn(`[SellerPayment] Rejecting one-off auth without reserve fields for ${channelId.slice(0, 18)}...`);
+            return 'rejected';
+        }
+        const planKey = oneOffPlanKey(buyerPeerId, requestId);
+        const plan = this._pendingOneOffPlans.get(planKey);
+        if (!plan || plan.expiresAt <= Date.now()) {
+            debugWarn(`[SellerPayment] Rejecting one-off channel ${channelId.slice(0, 18)}...: no offered plan for request ${requestId}`);
+            return 'rejected';
+        }
+        if (this._channelStore.getOneOffChannelByRequest(buyerPeerId, CHANNEL_ROLE.SELLER, requestId)?.status === CHANNEL_STATUS.ACTIVE) {
+            debugWarn(`[SellerPayment] Rejecting one-off channel ${channelId.slice(0, 18)}...: request ${requestId} already has one`);
+            return 'rejected';
+        }
+        const openingReserve = BigInt(payload.reserveMaxAmount);
+        const reserveDeadline = payload.reserveDeadline;
+        if (openingReserve !== plan.openingReserveAmount) {
+            debugWarn(`[SellerPayment] One-off opening reserve ${openingReserve} does not match plan ${plan.openingReserveAmount}`);
+            return 'rejected';
+        }
+        const reserveRecovered = verifyTypedData(channelsDomain, RESERVE_AUTH_TYPES, {
+            channelId,
+            maxAmount: openingReserve,
+            deadline: BigInt(reserveDeadline),
+        }, payload.spendingAuthSig);
+        if (reserveRecovered.toLowerCase() !== buyerEvmAddr.toLowerCase()) {
+            debugWarn(`[SellerPayment] Invalid one-off ReserveAuth signature: recovered=${reserveRecovered} expected=${buyerEvmAddr}`);
+            return 'rejected';
+        }
+        const batch = payload.reserveBatch;
+        let latestAuth = { spendingAuthSig: '', cumulativeAmount: 0n, metadataHash: payload.metadataHash, metadata: payload.metadata };
+        let finalReserve = openingReserve;
+        let finalDeadline = reserveDeadline;
+        if (plan.requiredCumulativeAmount > 0n) {
+            if (!batch) {
+                debugWarn(`[SellerPayment] One-off channel ${channelId.slice(0, 18)}... needs a reserve batch`);
+                return 'rejected';
+            }
+            const verified = this._verifyReserveBatch(channelId, batch, openingReserve, buyerEvmAddr, channelsDomain);
+            if (!verified
+                || verified.cumulativeAmount !== plan.requiredCumulativeAmount
+                || BigInt(batch.maxAmount) !== plan.requestCost) {
+                debugWarn(`[SellerPayment] One-off reserve batch does not match plan for ${channelId.slice(0, 18)}...`);
+                return 'rejected';
+            }
+            latestAuth = verified;
+            finalReserve = plan.requestCost;
+            finalDeadline = batch.deadline;
+        }
+        else if (batch || openingReserve !== plan.requestCost) {
+            debugWarn(`[SellerPayment] Unexpected one-off reserve batch for ${channelId.slice(0, 18)}...`);
+            return 'rejected';
+        }
+        this._pendingOneOffPlans.delete(planKey);
+        await this._reserveWithBackpressureRetry(channelId, () => this._channelsClient.reserve(this._signer, buyerEvmAddr, payload.reserveSalt, openingReserve, BigInt(reserveDeadline), payload.spendingAuthSig));
+        if (batch) {
+            try {
+                await this._channelsClient.topUp(this._signer, channelId, latestAuth.cumulativeAmount, batch.metadata, batch.spendingAuthSig, finalReserve, BigInt(finalDeadline), batch.reserveAuthSig);
+            }
+            catch (err) {
+                try {
+                    await this._channelsClient.close(this._signer, channelId, 0n, encodeMetadata(ZERO_METADATA), '0x');
+                }
+                catch (closeErr) {
+                    debugWarn(`[SellerPayment] Failed to release one-off reserve after top-up failure: ${this._formatError(closeErr)}`);
+                }
+                throw err;
+            }
+        }
+        const now = Date.now();
+        const { seller: sellerEvmAddr } = await this._resolvedAddresses;
+        const session = {
+            sessionId: channelId,
+            peerId: buyerPeerId,
+            role: CHANNEL_ROLE.SELLER,
+            channelKind: CHANNEL_KIND.ONE_OFF,
+            oneOffRequestId: requestId,
+            sellerEvmAddr,
+            buyerEvmAddr,
+            nonce: 0,
+            authMax: latestAuth.cumulativeAmount.toString(),
+            previousConsumption: finalReserve.toString(), // repurposed: stores reserveMax
+            deadline: finalDeadline,
+            previousSessionId: '',
+            tokensDelivered: '0',
+            requestCount: 0,
+            reservedAt: now,
+            settledAt: null,
+            settledAmount: null,
+            status: CHANNEL_STATUS.ACTIVE,
+            latestBuyerSig: latestAuth.spendingAuthSig || payload.spendingAuthSig,
+            latestSpendingAuthSig: latestAuth.spendingAuthSig || null,
+            latestMetadata: latestAuth.metadata,
+            createdAt: now,
+            updatedAt: now,
+        };
+        this._channelStore.upsertChannel(session);
+        this._oneOffChannelIds.add(channelId);
+        this._acceptedCumulative.set(channelId, latestAuth.cumulativeAmount);
+        this._reserveMax.set(channelId, finalReserve);
+        this._spent.set(channelId, 0n);
+        this._latestAuth.set(channelId, latestAuth);
+        if (latestAuth.cumulativeAmount > 0n)
+            this._lastSettledCumulative.set(channelId, latestAuth.cumulativeAmount);
+        paymentMux.sendAuthAck({ channelId });
+        debugLog(`[SellerPayment] One-off channel ${channelId.slice(0, 18)}... opened for request ${requestId} (reserve=${finalReserve}, settled=${latestAuth.cumulativeAmount})`);
+        return 'reserved';
+    }
+    /**
+     * Accept a later SpendingAuth on a one-off channel. Once it covers the
+     * recorded charge, the request is paid and the channel is closed at once.
+     */
+    async _acceptOneOffSpendingAuth(buyerPeerId, payload, channelsDomain) {
+        const channelId = payload.channelId;
+        const cumulativeAmount = BigInt(payload.cumulativeAmount);
+        const channel = this._channelStore.getChannel(channelId);
+        if (!channel || channel.peerId !== buyerPeerId || channel.status !== CHANNEL_STATUS.ACTIVE)
+            return 'rejected';
+        const recovered = verifyTypedData(channelsDomain, SPENDING_AUTH_TYPES, {
+            channelId,
+            cumulativeAmount,
+            metadataHash: payload.metadataHash,
+        }, payload.spendingAuthSig);
+        if (recovered.toLowerCase() !== peerIdToAddress(buyerPeerId).toLowerCase()) {
+            debugWarn(`[SellerPayment] Invalid one-off SpendingAuth signature for ${channelId.slice(0, 18)}...`);
+            return 'rejected';
+        }
+        const accepted = this._acceptedCumulative.get(channelId) ?? 0n;
+        const spent = this._spent.get(channelId) ?? 0n;
+        const reserveMax = this._reserveMax.get(channelId) ?? 0n;
+        if (cumulativeAmount < accepted || cumulativeAmount < spent || cumulativeAmount > reserveMax) {
+            debugWarn(`[SellerPayment] Rejecting one-off SpendingAuth cumulative=${cumulativeAmount} (accepted=${accepted} spent=${spent} reserve=${reserveMax})`);
+            return 'rejected';
+        }
+        if (cumulativeAmount > accepted) {
+            const auth = {
+                spendingAuthSig: payload.spendingAuthSig,
+                cumulativeAmount,
+                metadataHash: payload.metadataHash,
+                metadata: payload.metadata,
+            };
+            this._acceptedCumulative.set(channelId, cumulativeAmount);
+            this._latestAuth.set(channelId, auth);
+            this._channelStore.upsertChannel({
+                ...channel,
+                authMax: cumulativeAmount.toString(),
+                latestBuyerSig: payload.spendingAuthSig,
+                latestSpendingAuthSig: payload.spendingAuthSig,
+                latestMetadata: payload.metadata,
+                updatedAt: Date.now(),
+            });
+            this._notifyAcceptedUpdate(channelId, cumulativeAmount);
+        }
+        if (spent > 0n && cumulativeAmount >= spent) {
+            await this.closeOneOffChannel(channelId, 'request paid');
+        }
+        return 'accepted';
+    }
+    /** Close one-off channels that are gone on-chain, unpaid past their TTL, or never used. */
+    async _checkOneOffChannels() {
+        const now = Date.now();
+        for (const channel of this._channelStore.getActiveChannels(CHANNEL_ROLE.SELLER, CHANNEL_KIND.ONE_OFF)) {
+            try {
+                const state = classifyOnChainChannel(await this._channelsClient.getSession(channel.sessionId));
+                if (!state.exists || (state.status !== 'active' && state.status !== 'unknown')) {
+                    this._evictStaleChannel(channel.sessionId, channel.peerId, `one-off on-chain status=${state.exists ? state.status : 'missing'}`);
+                    continue;
+                }
+                this._oneOffChannelIds.add(channel.sessionId);
+                const age = now - channel.reservedAt;
+                const spent = this._spent.get(channel.sessionId) ?? 0n;
+                const accepted = this._acceptedCumulative.get(channel.sessionId) ?? 0n;
+                if (spent > 0n && accepted >= spent) {
+                    await this.closeOneOffChannel(channel.sessionId, 'request paid');
+                }
+                else if (age > ONE_OFF_CHANNEL_TTL_MS) {
+                    await this.closeOneOffChannel(channel.sessionId, 'unpaid past TTL');
+                }
+                else if (channel.requestCount === 0 && age > ONE_OFF_UNCLAIMED_TTL_MS) {
+                    await this.closeOneOffChannel(channel.sessionId, 'request never started');
+                }
+            }
+            catch (err) {
+                debugWarn(`[SellerPayment] Failed to check one-off channel ${channel.sessionId.slice(0, 18)}...: ${this._formatError(err)}`);
+            }
+        }
+    }
     _canAcknowledgeRetainedChannel(buyerPeerId, channelId, disconnectMarker) {
         const session = this._channelStore.getActiveChannelByPeer(buyerPeerId, CHANNEL_ROLE.SELLER);
         return session?.sessionId === channelId
@@ -923,8 +1299,10 @@ export class SellerPaymentManager {
         }
         const newSpent = current + costUsdc;
         this._spent.set(sessionId, newSpent);
-        // Persist spent amount to ChannelStore (using tokensDelivered field)
-        this._channelStore.updateTokensDelivered(sessionId, newSpent.toString(), 0);
+        // Persist spent amount to ChannelStore (using tokensDelivered field). Keep
+        // the request count: it marks a one-off channel's create as started.
+        const requestCount = this._channelStore.getChannel(sessionId)?.requestCount ?? 0;
+        this._channelStore.updateTokensDelivered(sessionId, newSpent.toString(), requestCount);
     }
     // ── Settlement ──────────────────────────────────────────────
     /** Get the latest SpendingAuth params for a channel, or zero-auth if none exists. */
@@ -1008,6 +1386,14 @@ export class SellerPaymentManager {
      * touch persisted status — callers set that first (SETTLED / TIMEOUT).
      */
     _forgetChannel(channelId, buyerPeerId) {
+        if (this._oneOffChannelIds.delete(channelId)) {
+            this._forgetChannelState(channelId);
+            return;
+        }
+        this._forgetChannelState(channelId);
+        this._deactivateBuyerForChannel(buyerPeerId, channelId);
+    }
+    _forgetChannelState(channelId) {
         this._acceptedCumulative.delete(channelId);
         this._spent.delete(channelId);
         this._latestAuth.delete(channelId);
@@ -1018,7 +1404,6 @@ export class SellerPaymentManager {
         this._lastSettledCumulative.delete(channelId);
         this._hydratedChannelIds.delete(channelId);
         this._releaseAcceptedWaiters(channelId);
-        this._deactivateBuyerForChannel(buyerPeerId, channelId);
     }
     // ── In-flight request tracking ────────────────────────────────
     /** Mark a billable request as started for this buyer. */
@@ -1083,6 +1468,7 @@ export class SellerPaymentManager {
      * Called periodically and on startup for recovery.
      */
     async checkTimeouts() {
+        await this._checkOneOffChannels();
         const nowSecs = Math.floor(Date.now() / 1000);
         const activeChannels = this._channelStore.getActiveChannels(CHANNEL_ROLE.SELLER);
         for (const channel of activeChannels) {
@@ -1504,4 +1890,7 @@ export class SellerPaymentManager {
         // ChannelStore is shared with BuyerPaymentManager, closed from node.ts
     }
 }
+function oneOffPlanKey(buyerPeerId, requestId) {
+    return `${buyerPeerId.toLowerCase()}\n${requestId}`;
+}
 //# sourceMappingURL=seller-payment-manager.js.map