@antseed/node 0.2.25 → 0.2.27

package/dist/payments/buyer-payment-manager.d.ts

@@ -1,122 +1,63 @@
-import { type AbstractSigner, Wallet } from 'ethers';
+import { type AbstractSigner } from 'ethers';
 import type { Identity } from '../p2p/identity.js';
 import type { PaymentMux } from '../p2p/payment-mux.js';
-import type { SessionLockConfirmPayload, SessionLockRejectPayload, SellerReceiptPayload, TopUpRequestPayload } from '../types/protocol.js';
+import type { AuthAckPayload, SellerReceiptPayload, TopUpRequestPayload } from '../types/protocol.js';
 import { BaseEscrowClient } from './evm/escrow-client.js';
+import { IdentityClient } from './evm/identity-client.js';
+import { SessionStore, type StoredSession } from './session-store.js';
 export interface BuyerPaymentConfig {
-    /** Default lock amount in USDC base units (6 decimals). e.g. "1000000" = 1 USDC */
-    defaultLockAmountUSDC: string;
-    /** Base JSON-RPC endpoint */
     rpcUrl: string;
-    /** Deployed AntseedEscrow contract address */
     contractAddress: string;
-    /** USDC token contract address */
     usdcAddress: string;
-    /** Auto-acknowledge seller receipts. Default: true */
-    autoAck?: boolean;
-    /** Auto-approve top-up requests. Default: true */
-    autoTopUp?: boolean;
-    /** Maximum total amount the buyer will commit per session (USDC base units). Default: "10000000" (10 USDC) */
-    maxSessionBudgetUSDC?: string;
-}
-export type BuyerSessionStatus = 'pending' | 'confirmed' | 'active' | 'ending' | 'ended';
-export interface BuyerSessionState {
-    sessionId: string;
-    sellerPeerId: string;
-    sellerEvmAddress: string;
-    lockedAmount: bigint;
-    status: BuyerSessionStatus;
-    txSignature: string | null;
-    lastRunningTotal: bigint;
-    lastRequestCount: number;
-    createdAt: number;
-    updatedAt: number;
+    identityAddress: string;
+    chainId: number;
+    defaultMaxAmountUsdc: bigint;
+    defaultAuthDurationSecs: number;
+    autoAck: boolean;
+    dataDir: string;
 }
 /**
- * Manages buyer-side bilateral payment sessions across seller connections.
- *
- * Handles the full lifecycle: lock initiation, receipt acknowledgement,
- * top-up approval, and session settlement.
+ * Manages buyer-side payment sessions using EIP-712 SpendingAuth
+ * with persistent session storage.
  */
 export declare class BuyerPaymentManager {
     private readonly _identity;
     private _signer;
     private readonly _escrowClient;
     private readonly _config;
-    private readonly _sessions;
-    constructor(identity: Identity, config: BuyerPaymentConfig);
+    private readonly _sessionStore;
+    /** In-memory map of active confirmed sessions by seller peerId for fast lookups. */
+    private readonly _confirmedPeers;
+    /** Peers that explicitly rejected our spending auth. */
+    private readonly _rejectedPeers;
+    private _nonceCounter;
+    constructor(identity: Identity, config: BuyerPaymentConfig, sessionStore: SessionStore);
     get signer(): AbstractSigner;
-    /** @deprecated Use .signer instead */
-    get wallet(): Wallet;
-    /** Replace the signer at runtime (e.g. with a WalletConnect signer). */
     setSigner(signer: AbstractSigner): void;
     get escrowClient(): BaseEscrowClient;
-    /** Get a snapshot of all active sessions. */
-    getActiveSessions(): BuyerSessionState[];
-    /** Get the session for a given seller peer, if it exists. */
-    getSession(sellerPeerId: string): BuyerSessionState | undefined;
-    /**
-     * Generate a session ID, sign a lock authorization, and send it
-     * to the seller via PaymentMux.
-     */
-    initiateLock(sellerPeerId: string, sellerEvmAddress: string, paymentMux: PaymentMux, lockAmount?: string): Promise<string>;
-    /**
-     * Called when the seller confirms the lock was committed on-chain.
-     */
-    handleLockConfirm(sellerPeerId: string, payload: SessionLockConfirmPayload): void;
-    /**
-     * Called when the seller rejects the lock.
-     */
-    handleLockReject(sellerPeerId: string, payload: SessionLockRejectPayload): void;
     /**
-     * Handle a running-total receipt from the seller.
-     * If autoAck is enabled, automatically counter-sign and send BuyerAck.
+     * Sign and send an EIP-712 SpendingAuth to a seller.
+     * Loads the latest session to build the proof chain.
      */
+    authorizeSpending(sellerPeerId: string, sellerEvmAddr: string, paymentMux: PaymentMux, maxAmount?: bigint): Promise<string>;
+    handleAuthAck(sellerPeerId: string, payload: AuthAckPayload): void;
     handleSellerReceipt(sellerPeerId: string, receipt: SellerReceiptPayload, paymentMux: PaymentMux): Promise<void>;
-    /**
-     * Handle a top-up request from the seller.
-     * If autoTopUp is enabled and budget allows, sign and send TopUpAuth.
-     * Otherwise, end the session.
-     */
     handleTopUpRequest(sellerPeerId: string, request: TopUpRequestPayload, paymentMux: PaymentMux): Promise<void>;
-    /**
-     * End a session with the given seller. Signs a settlement message
-     * with ECDSA and sends SessionEnd.
-     */
-    endSession(sellerPeerId: string, paymentMux: PaymentMux, score?: number): Promise<void>;
-    /**
-     * Deposit USDC into the escrow contract.
-     * @param amount Amount in USDC base units (6 decimals).
-     */
+    /** Check if a session has been confirmed via AuthAck. */
+    isAuthorized(sellerPeerId: string): boolean;
+    /** Alias for isAuthorized (used by polling loop). */
+    isLockConfirmed(sellerPeerId: string): boolean;
+    /** Check if the lock was explicitly rejected (not just never-contacted). */
+    isLockRejected(sellerPeerId: string): boolean;
+    /** Mark a peer as having rejected our spending auth. */
+    markRejected(sellerPeerId: string): void;
+    getSessionHistory(sellerPeerId: string): StoredSession[];
     deposit(amount: bigint): Promise<string>;
-    /**
-     * Withdraw USDC from the escrow contract.
-     * @param amount Amount in USDC base units (6 decimals).
-     */
     withdraw(amount: bigint): Promise<string>;
-    /**
-     * Get the buyer's on-chain escrow balance.
-     */
     getBalance(): Promise<{
-        deposited: bigint;
-        committed: bigint;
         available: bigint;
+        reserved: bigint;
     }>;
-    /**
-     * Release an expired lock (buyer reclaims funds).
-     */
-    releaseExpiredLock(sessionId: string): Promise<string>;
-    /**
-     * Respond to a dispute opened by the seller.
-     */
-    respondToDispute(sessionId: string): Promise<string>;
-    /**
-     * Check if a session lock has been confirmed (for polling).
-     */
-    isLockConfirmed(sellerPeerId: string): boolean;
-    /**
-     * Check if a session lock has been rejected (for polling).
-     */
-    isLockRejected(sellerPeerId: string): boolean;
+    submitFeedback(sellerPeerId: string, qualityScore: number, identityClient: IdentityClient): Promise<string | null>;
 }
 //# sourceMappingURL=buyer-payment-manager.d.ts.map

package/dist/payments/buyer-payment-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"buyer-payment-manager.d.ts","sourceRoot":"","sources":["../../src/payments/buyer-payment-manager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,EACV,yBAAyB,EACzB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAa1D,MAAM,WAAW,kBAAkB;IACjC,mFAAmF;IACnF,qBAAqB,EAAE,MAAM,CAAC;IAC9B,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,eAAe,EAAE,MAAM,CAAC;IACxB,kCAAkC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kDAAkD;IAClD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,8GAA8G;IAC9G,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEzF,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAW;IACrC,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAmB;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;gBAEtD,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB;IAW1D,IAAI,MAAM,IAAI,cAAc,CAE3B;IAED,sCAAsC;IACtC,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,wEAAwE;IACxE,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAIvC,IAAI,YAAY,IAAI,gBAAgB,CAEnC;IAED,6CAA6C;IAC7C,iBAAiB,IAAI,iBAAiB,EAAE;IAMxC,6DAA6D;IAC7D,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAM/D;;;OAGG;IACG,YAAY,CAChB,YAAY,EAAE,MAAM,EACpB,gBAAgB,EAAE,MAAM,EACxB,UAAU,EAAE,UAAU,EACtB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC;IA0ClB;;OAEG;IACH,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,GAAG,IAAI;IAiBjF;;OAEG;IACH,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,wBAAwB,GAAG,IAAI;IAa/E;;;OAGG;IACG,mBAAmB,CACvB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,oBAAoB,EAC7B,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,IAAI,CAAC;IA2ChB;;;;OAIG;IACG,kBAAkB,CACtB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,mBAAmB,EAC5B,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,IAAI,CAAC;IAkDhB;;;OAGG;IACG,UAAU,CACd,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,UAAU,EACtB,KAAK,GAAE,MAAW,GACjB,OAAO,CAAC,IAAI,CAAC;IAuChB;;;OAGG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK9C;;;OAGG;IACG,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK/C;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAOxF;;OAEG;IACG,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK5D;;OAEG;IACG,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK1D;;OAEG;IACH,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAK9C;;OAEG;IACH,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;CAG9C"}
+{"version":3,"file":"buyer-payment-manager.d.ts","sourceRoot":"","sources":["../../src/payments/buyer-payment-manager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,cAAc,EAAuB,MAAM,QAAQ,CAAC;AAClE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAa1D,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEtE,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,uBAAuB,EAAE,MAAM,CAAC;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAID;;;GAGG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAW;IACrC,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAmB;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAe;IAC7C,oFAAoF;IACpF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IACrD,wDAAwD;IACxD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,aAAa,CAAS;gBAElB,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,YAAY;IAetF,IAAI,MAAM,IAAI,cAAc,CAE3B;IAED,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAIvC,IAAI,YAAY,IAAI,gBAAgB,CAEnC;IAID;;;OAGG;IACG,iBAAiB,CACrB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,UAAU,EAAE,UAAU,EACtB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;IAsFlB,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,IAAI;IAiB5D,mBAAmB,CACvB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,oBAAoB,EAC7B,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,IAAI,CAAC;IAuFV,kBAAkB,CACtB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,mBAAmB,EAC5B,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,IAAI,CAAC;IA2BhB,yDAAyD;IACzD,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAI3C,qDAAqD;IACrD,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAI9C,4EAA4E;IAC5E,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAI7C,wDAAwD;IACxD,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI;IAKxC,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,aAAa,EAAE;IAelD,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKxC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKzC,UAAU,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAQ9D,cAAc,CAClB,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAS1B"}

package/dist/payments/buyer-payment-manager.js

@@ -1,22 +1,27 @@
 import { randomBytes } from 'node:crypto';
+import { encodeBytes32String } from 'ethers';
 import { BaseEscrowClient } from './evm/escrow-client.js';
 import { identityToEvmWallet, identityToEvmAddress } from './evm/keypair.js';
-import { buildLockMessageHash, buildSettlementMessageHash, buildExtendLockMessageHash, signMessageEcdsa, buildAckMessage, signMessageEd25519, } from './evm/signatures.js';
+import { signSpendingAuth, makeEscrowDomain, buildAckMessage, signMessageEd25519, verifyMessageEd25519, buildReceiptMessage, } from './evm/signatures.js';
 import { bytesToHex, hexToBytes } from '../utils/hex.js';
 import { debugLog, debugWarn } from '../utils/debug.js';
+const ZERO_SESSION_ID = '0x' + '0'.repeat(64);
 /**
- * Manages buyer-side bilateral payment sessions across seller connections.
- *
- * Handles the full lifecycle: lock initiation, receipt acknowledgement,
- * top-up approval, and session settlement.
+ * Manages buyer-side payment sessions using EIP-712 SpendingAuth
+ * with persistent session storage.
  */
 export class BuyerPaymentManager {
     _identity;
     _signer;
     _escrowClient;
     _config;
-    _sessions = new Map();
-    constructor(identity, config) {
+    _sessionStore;
+    /** In-memory map of active confirmed sessions by seller peerId for fast lookups. */
+    _confirmedPeers = new Set();
+    /** Peers that explicitly rejected our spending auth. */
+    _rejectedPeers = new Set();
+    _nonceCounter;
+    constructor(identity, config, sessionStore) {
         this._identity = identity;
         this._config = config;
         this._signer = identityToEvmWallet(identity);
@@ -25,121 +30,165 @@ export class BuyerPaymentManager {
             contractAddress: config.contractAddress,
             usdcAddress: config.usdcAddress,
         });
+        this._sessionStore = sessionStore;
+        // Restore nonce counter from persisted sessions to avoid duplicates across restarts
+        this._nonceCounter = sessionStore.getMaxNonce('buyer');
     }
     get signer() {
         return this._signer;
     }
-    /** @deprecated Use .signer instead */
-    get wallet() {
-        return this._signer;
-    }
-    /** Replace the signer at runtime (e.g. with a WalletConnect signer). */
     setSigner(signer) {
         this._signer = signer;
     }
     get escrowClient() {
         return this._escrowClient;
     }
-    /** Get a snapshot of all active sessions. */
-    getActiveSessions() {
-        return [...this._sessions.values()].filter((s) => s.status !== 'ended');
-    }
-    /** Get the session for a given seller peer, if it exists. */
-    getSession(sellerPeerId) {
-        return this._sessions.get(sellerPeerId);
-    }
-    // ── Lock initiation ─────────────────────────────────────────────
+    // ── Spending Authorization ────────────────────────────────────
     /**
-     * Generate a session ID, sign a lock authorization, and send it
-     * to the seller via PaymentMux.
+     * Sign and send an EIP-712 SpendingAuth to a seller.
+     * Loads the latest session to build the proof chain.
      */
-    async initiateLock(sellerPeerId, sellerEvmAddress, paymentMux, lockAmount) {
-        const amount = lockAmount ?? this._config.defaultLockAmountUSDC;
-        const amountBigInt = BigInt(amount);
-        // Generate a 32-byte session ID as 0x-prefixed hex (bytes32)
+    async authorizeSpending(sellerPeerId, sellerEvmAddr, paymentMux, maxAmount) {
+        const amount = maxAmount ?? this._config.defaultMaxAmountUsdc;
+        // Clear confirmation state so we wait for a fresh AuthAck on the new session
+        this._confirmedPeers.delete(sellerPeerId);
+        // Load latest session to build proof chain.
+        // Only chain if the session is settled or active-with-delivery (the seller
+        // will settle it on-chain before reserving the new one).
+        // Fall back to first-sign for timed-out/ghost sessions.
+        const latestSession = this._sessionStore.getLatestSession(sellerPeerId, 'buyer');
+        const canChain = latestSession
+            && latestSession.status !== 'timeout'
+            && latestSession.status !== 'ghost'
+            && BigInt(latestSession.tokensDelivered) > 0n;
+        const previousConsumption = canChain
+            ? BigInt(latestSession.tokensDelivered)
+            : 0n;
+        const previousSessionId = canChain
+            ? latestSession.sessionId
+            : ZERO_SESSION_ID;
+        // Generate a 32-byte session ID
         const sessionIdBytes = randomBytes(32);
         const sessionId = '0x' + sessionIdBytes.toString('hex');
-        debugLog(`[BuyerPayment] Initiating lock: session=${sessionId.slice(0, 18)}... seller=${sellerPeerId.slice(0, 12)}... amount=${amount}`);
-        // Sign the lock message with ECDSA (for on-chain verification)
-        const messageHash = buildLockMessageHash(sessionId, sellerEvmAddress, amountBigInt);
-        const buyerSig = await signMessageEcdsa(this._signer, messageHash);
-        // Store session state
+        const nonce = ++this._nonceCounter;
+        const deadline = Math.floor(Date.now() / 1000) + this._config.defaultAuthDurationSecs;
+        debugLog(`[BuyerPayment] authorizeSpending: session=${sessionId.slice(0, 18)}... seller=${sellerPeerId.slice(0, 12)}... amount=${amount}`);
+        // Sign EIP-712 SpendingAuth
+        const domain = makeEscrowDomain(this._config.chainId, this._config.contractAddress);
+        const msg = {
+            seller: sellerEvmAddr,
+            sessionId,
+            maxAmount: amount,
+            nonce,
+            deadline,
+            previousConsumption,
+            previousSessionId,
+        };
+        const buyerSig = await signSpendingAuth(this._signer, domain, msg);
+        const buyerEvmAddr = identityToEvmAddress(this._identity);
+        // Store session
         const now = Date.now();
         const session = {
             sessionId,
-            sellerPeerId,
-            sellerEvmAddress,
-            lockedAmount: amountBigInt,
-            status: 'pending',
-            txSignature: null,
-            lastRunningTotal: 0n,
-            lastRequestCount: 0,
+            peerId: sellerPeerId,
+            role: 'buyer',
+            sellerEvmAddr,
+            buyerEvmAddr,
+            nonce,
+            authMax: amount.toString(),
+            deadline,
+            previousSessionId,
+            previousConsumption: previousConsumption.toString(),
+            tokensDelivered: '0',
+            requestCount: 0,
+            reservedAt: now,
+            settledAt: null,
+            settledAmount: null,
+            status: 'active',
             createdAt: now,
             updatedAt: now,
         };
-        this._sessions.set(sellerPeerId, session);
-        // Send the lock auth message
-        paymentMux.sendSessionLockAuth({
+        this._sessionStore.upsertSession(session);
+        // Send SpendingAuth via PaymentMux
+        paymentMux.sendSpendingAuth({
             sessionId,
-            lockedAmount: amount,
+            maxAmountUsdc: amount.toString(),
+            nonce,
+            deadline,
             buyerSig,
+            buyerEvmAddr,
+            previousConsumption: previousConsumption.toString(),
+            previousSessionId,
         });
         return sessionId;
     }
-    // ── Lock confirmation / rejection handlers ──────────────────────
-    /**
-     * Called when the seller confirms the lock was committed on-chain.
-     */
-    handleLockConfirm(sellerPeerId, payload) {
-        const session = this._sessions.get(sellerPeerId);
+    // ── AuthAck handler ───────────────────────────────────────────
+    handleAuthAck(sellerPeerId, payload) {
+        const session = this._sessionStore.getActiveSessionByPeer(sellerPeerId, 'buyer');
         if (!session) {
-            debugWarn(`[BuyerPayment] Lock confirm for unknown seller: ${sellerPeerId.slice(0, 12)}...`);
+            debugWarn(`[BuyerPayment] AuthAck for unknown seller: ${sellerPeerId.slice(0, 12)}...`);
             return;
         }
         if (session.sessionId !== payload.sessionId) {
-            debugWarn(`[BuyerPayment] Lock confirm session mismatch: expected=${session.sessionId.slice(0, 18)}... got=${payload.sessionId.slice(0, 18)}...`);
+            debugWarn(`[BuyerPayment] AuthAck session mismatch: expected=${session.sessionId.slice(0, 18)}... got=${payload.sessionId.slice(0, 18)}...`);
             return;
         }
-        session.status = 'confirmed';
-        session.txSignature = payload.txSignature;
-        session.updatedAt = Date.now();
-        debugLog(`[BuyerPayment] Lock confirmed: session=${session.sessionId.slice(0, 18)}... tx=${payload.txSignature.slice(0, 12)}...`);
+        this._confirmedPeers.add(sellerPeerId);
+        debugLog(`[BuyerPayment] AuthAck confirmed: session=${session.sessionId.slice(0, 18)}...`);
     }
-    /**
-     * Called when the seller rejects the lock.
-     */
-    handleLockReject(sellerPeerId, payload) {
-        const session = this._sessions.get(sellerPeerId);
-        if (!session) {
-            debugWarn(`[BuyerPayment] Lock reject for unknown seller: ${sellerPeerId.slice(0, 12)}...`);
-            return;
-        }
-        debugWarn(`[BuyerPayment] Lock rejected: session=${session.sessionId.slice(0, 18)}... reason=${payload.reason}`);
-        this._sessions.delete(sellerPeerId);
-    }
-    // ── Receipt handling ────────────────────────────────────────────
-    /**
-     * Handle a running-total receipt from the seller.
-     * If autoAck is enabled, automatically counter-sign and send BuyerAck.
-     */
+    // ── Seller Receipt handler ────────────────────────────────────
     async handleSellerReceipt(sellerPeerId, receipt, paymentMux) {
-        const session = this._sessions.get(sellerPeerId);
+        const session = this._sessionStore.getActiveSessionByPeer(sellerPeerId, 'buyer');
         if (!session) {
             debugWarn(`[BuyerPayment] Receipt for unknown seller: ${sellerPeerId.slice(0, 12)}...`);
             return;
         }
-        if (session.status === 'confirmed') {
-            session.status = 'active';
+        if (session.sessionId !== receipt.sessionId) {
+            debugWarn(`[BuyerPayment] Receipt session ID mismatch: active=${session.sessionId.slice(0, 18)}... receipt=${receipt.sessionId.slice(0, 18)}... — discarding stale receipt`);
+            return;
         }
-        // Update running total
-        session.lastRunningTotal = BigInt(receipt.runningTotal);
-        session.lastRequestCount = receipt.requestCount;
-        session.updatedAt = Date.now();
+        // Verify seller's Ed25519 signature
+        try {
+            const sellerPublicKey = hexToBytes(sellerPeerId);
+            const sessionIdBytes = hexToBytes(receipt.sessionId.replace(/^0x/, ''));
+            const responseHashBytes = hexToBytes(receipt.responseHash);
+            const receiptMsg = buildReceiptMessage(sessionIdBytes, BigInt(receipt.runningTotal), receipt.requestCount, responseHashBytes);
+            const sigBytes = hexToBytes(receipt.sellerSig);
+            const valid = await verifyMessageEd25519(sellerPublicKey, sigBytes, receiptMsg);
+            if (!valid) {
+                debugWarn(`[BuyerPayment] Invalid seller receipt signature from ${sellerPeerId.slice(0, 12)}...`);
+                return;
+            }
+        }
+        catch (err) {
+            debugWarn(`[BuyerPayment] Failed to verify receipt: ${err instanceof Error ? err.message : err}`);
+            return;
+        }
+        // Validate monotonic increase: runningTotal must exceed previous
+        const newTotal = BigInt(receipt.runningTotal);
+        const prevTotal = BigInt(session.tokensDelivered);
+        if (newTotal <= prevTotal) {
+            debugWarn(`[BuyerPayment] Receipt runningTotal not monotonic: new=${newTotal} prev=${prevTotal}`);
+            return;
+        }
+        // Note: we don't compare token count against authMax (USDC) here because
+        // they're in different units (tokens vs USDC base units). The on-chain
+        // settle() caps chargeAmount = min(tokenCount * tokenRate, maxAmount),
+        // so the buyer's EIP-712 signature is the real USDC protection.
         debugLog(`[BuyerPayment] Receipt: session=${session.sessionId.slice(0, 18)}... total=${receipt.runningTotal} count=${receipt.requestCount}`);
-        const autoAck = this._config.autoAck ?? true;
-        if (autoAck) {
-            // Build ack message and sign with Ed25519
-            const sessionIdBytes = hexToBytes(session.sessionId.startsWith('0x') ? session.sessionId.slice(2) : session.sessionId);
+        // Atomically update tokens delivered and store receipt
+        this._sessionStore.updateDeliveredAndInsertReceipt(session.sessionId, receipt.runningTotal, receipt.requestCount, {
+            sessionId: session.sessionId,
+            runningTotal: receipt.runningTotal,
+            requestCount: receipt.requestCount,
+            responseHash: receipt.responseHash,
+            sellerSig: receipt.sellerSig,
+            buyerAckSig: null,
+            createdAt: Date.now(),
+        });
+        // Auto-ack if configured
+        if (this._config.autoAck) {
+            const sessionIdBytes = hexToBytes(session.sessionId.replace(/^0x/, ''));
             const ackMsg = buildAckMessage(sessionIdBytes, BigInt(receipt.runningTotal), receipt.requestCount);
             const sigBytes = await signMessageEd25519(this._identity, ackMsg);
             const buyerSig = bytesToHex(sigBytes);
@@ -152,129 +201,75 @@ export class BuyerPaymentManager {
             debugLog(`[BuyerPayment] Auto-ack sent for session=${session.sessionId.slice(0, 18)}...`);
         }
     }
-    // ── Top-up handling ─────────────────────────────────────────────
-    /**
-     * Handle a top-up request from the seller.
-     * If autoTopUp is enabled and budget allows, sign and send TopUpAuth.
-     * Otherwise, end the session.
-     */
+    // ── TopUp handler ─────────────────────────────────────────────
     async handleTopUpRequest(sellerPeerId, request, paymentMux) {
-        const session = this._sessions.get(sellerPeerId);
+        const session = this._sessionStore.getActiveSessionByPeer(sellerPeerId, 'buyer');
         if (!session) {
             debugWarn(`[BuyerPayment] Top-up for unknown seller: ${sellerPeerId.slice(0, 12)}...`);
             return;
         }
-        const additionalAmount = BigInt(request.additionalAmount);
-        const maxBudget = BigInt(this._config.maxSessionBudgetUSDC ?? '10000000');
-        const newTotal = session.lockedAmount + additionalAmount;
-        const autoTopUp = this._config.autoTopUp ?? true;
-        debugLog(`[BuyerPayment] Top-up request: session=${session.sessionId.slice(0, 18)}... additional=${request.additionalAmount} newTotal=${newTotal}`);
-        if (autoTopUp && newTotal <= maxBudget) {
-            // Check on-chain balance
-            const buyerAddr = identityToEvmAddress(this._identity);
-            const account = await this._escrowClient.getBuyerAccount(buyerAddr);
-            if (account.available >= additionalAmount) {
-                // Sign extend-lock authorization
-                const messageHash = buildExtendLockMessageHash(session.sessionId, session.sellerEvmAddress, additionalAmount);
-                const buyerSig = await signMessageEcdsa(this._signer, messageHash);
-                session.lockedAmount = newTotal;
-                session.updatedAt = Date.now();
-                paymentMux.sendTopUpAuth({
-                    sessionId: session.sessionId,
-                    additionalAmount: request.additionalAmount,
-                    buyerSig,
-                });
-                debugLog(`[BuyerPayment] Top-up authorized: session=${session.sessionId.slice(0, 18)}...`);
-                return;
-            }
-            debugWarn(`[BuyerPayment] Insufficient balance for top-up. Available=${account.available}, requested=${additionalAmount}`);
-        }
-        // Cannot or will not top up — end the session
-        debugLog(`[BuyerPayment] Declining top-up, ending session=${session.sessionId.slice(0, 18)}...`);
-        await this.endSession(sellerPeerId, paymentMux, 80);
+        debugLog(`[BuyerPayment] TopUp request: session=${session.sessionId.slice(0, 18)}... currentUsed=${request.currentUsed} currentMax=${request.currentMax}`);
+        // Sign a new SpendingAuth with increased cap
+        const currentMax = BigInt(session.authMax);
+        const additionalAmount = BigInt(request.requestedAdditional);
+        const newMax = currentMax + additionalAmount;
+        // The new auth embeds the current consumption as previousConsumption
+        await this.authorizeSpending(sellerPeerId, session.sellerEvmAddr, paymentMux, newMax);
+        debugLog(`[BuyerPayment] TopUp authorized: new auth sent with max=${newMax}`);
     }
-    // ── Session end ─────────────────────────────────────────────────
-    /**
-     * End a session with the given seller. Signs a settlement message
-     * with ECDSA and sends SessionEnd.
-     */
-    async endSession(sellerPeerId, paymentMux, score = 80) {
-        const session = this._sessions.get(sellerPeerId);
-        if (!session) {
-            debugWarn(`[BuyerPayment] Cannot end session for unknown seller: ${sellerPeerId.slice(0, 12)}...`);
-            return;
-        }
-        if (session.status === 'ending' || session.status === 'ended') {
-            return;
+    // ── Queries ───────────────────────────────────────────────────
+    /** Check if a session has been confirmed via AuthAck. */
+    isAuthorized(sellerPeerId) {
+        return this._confirmedPeers.has(sellerPeerId);
+    }
+    /** Alias for isAuthorized (used by polling loop). */
+    isLockConfirmed(sellerPeerId) {
+        return this.isAuthorized(sellerPeerId);
+    }
+    /** Check if the lock was explicitly rejected (not just never-contacted). */
+    isLockRejected(sellerPeerId) {
+        return this._rejectedPeers.has(sellerPeerId);
+    }
+    /** Mark a peer as having rejected our spending auth. */
+    markRejected(sellerPeerId) {
+        this._rejectedPeers.add(sellerPeerId);
+        debugLog(`[BuyerPayment] Peer ${sellerPeerId.slice(0, 12)}... marked as rejected`);
+    }
+    getSessionHistory(sellerPeerId) {
+        const sessions = [];
+        const seen = new Set();
+        let session = this._sessionStore.getLatestSession(sellerPeerId, 'buyer');
+        while (session && !seen.has(session.sessionId)) {
+            seen.add(session.sessionId);
+            sessions.unshift(session);
+            if (session.previousSessionId === ZERO_SESSION_ID)
+                break;
+            session = this._sessionStore.getSession(session.previousSessionId);
         }
-        session.status = 'ending';
-        session.updatedAt = Date.now();
-        debugLog(`[BuyerPayment] Ending session=${session.sessionId.slice(0, 18)}... total=${session.lastRunningTotal} score=${score}`);
-        // Sign settlement message with ECDSA
-        const messageHash = buildSettlementMessageHash(session.sessionId, session.lastRunningTotal, score);
-        const buyerSig = await signMessageEcdsa(this._signer, messageHash);
-        paymentMux.sendSessionEnd({
-            sessionId: session.sessionId,
-            runningTotal: session.lastRunningTotal.toString(),
-            requestCount: session.lastRequestCount,
-            score,
-            buyerSig,
-        });
-        session.status = 'ended';
-        session.updatedAt = Date.now();
-        debugLog(`[BuyerPayment] Session ended: ${session.sessionId.slice(0, 18)}...`);
+        return sessions;
     }
-    // ── Escrow operations ───────────────────────────────────────────
-    /**
-     * Deposit USDC into the escrow contract.
-     * @param amount Amount in USDC base units (6 decimals).
-     */
+    // ── Escrow operations ─────────────────────────────────────────
     async deposit(amount) {
         debugLog(`[BuyerPayment] Depositing ${amount} to escrow`);
         return this._escrowClient.deposit(this._signer, amount);
     }
-    /**
-     * Withdraw USDC from the escrow contract.
-     * @param amount Amount in USDC base units (6 decimals).
-     */
     async withdraw(amount) {
-        debugLog(`[BuyerPayment] Withdrawing ${amount} from escrow`);
-        return this._escrowClient.withdraw(this._signer, amount);
+        debugLog(`[BuyerPayment] Requesting withdrawal of ${amount} from escrow`);
+        return this._escrowClient.requestWithdrawal(this._signer, amount);
     }
-    /**
-     * Get the buyer's on-chain escrow balance.
-     */
     async getBalance() {
         const buyerAddr = identityToEvmAddress(this._identity);
-        return this._escrowClient.getBuyerAccount(buyerAddr);
-    }
-    // ── Dispute helpers ─────────────────────────────────────────────
-    /**
-     * Release an expired lock (buyer reclaims funds).
-     */
-    async releaseExpiredLock(sessionId) {
-        debugLog(`[BuyerPayment] Releasing expired lock: session=${sessionId.slice(0, 18)}...`);
-        return this._escrowClient.releaseExpiredLock(this._signer, sessionId);
-    }
-    /**
-     * Respond to a dispute opened by the seller.
-     */
-    async respondToDispute(sessionId) {
-        debugLog(`[BuyerPayment] Responding to dispute: session=${sessionId.slice(0, 18)}...`);
-        return this._escrowClient.respondDispute(this._signer, sessionId);
-    }
-    /**
-     * Check if a session lock has been confirmed (for polling).
-     */
-    isLockConfirmed(sellerPeerId) {
-        const session = this._sessions.get(sellerPeerId);
-        return session?.status === 'confirmed' || session?.status === 'active';
+        const info = await this._escrowClient.getBuyerBalance(buyerAddr);
+        return { available: info.available, reserved: info.reserved };
     }
-    /**
-     * Check if a session lock has been rejected (for polling).
-     */
-    isLockRejected(sellerPeerId) {
-        return !this._sessions.has(sellerPeerId);
+    // ── Feedback (Task 6) ─────────────────────────────────────────
+    async submitFeedback(sellerPeerId, qualityScore, identityClient) {
+        const session = this._sessionStore.getLatestSession(sellerPeerId, 'buyer');
+        if (!session || session.status !== 'settled')
+            return null;
+        const tokenId = await identityClient.getTokenId(session.sellerEvmAddr);
+        const tag = encodeBytes32String('quality');
+        return identityClient.submitFeedback(this._signer, tokenId, qualityScore, tag);
     }
 }
 //# sourceMappingURL=buyer-payment-manager.js.map