@dvmkit/sdk 0.1.5-rc.8 → 0.2.0-rc.9

package/dist/{chunk-KVEHHC7W.js → chunk-PHHAYRQV.js}

@@ -15,14 +15,14 @@ import {
   lotOwedSats,
   netOwedSats,
   x402SettlementPending
-} from "./chunk-MLRCSJYX.js";
+} from "./chunk-V7EVFLAK.js";
 
 // src/sdk/server/memory-credit-ledger.ts
 import { randomUUID } from "crypto";
 var MemoryCreditLedger = class _MemoryCreditLedger {
   /**
    * Per-process and lost on restart, so a DVM backed by this ledger never
-   * advertises the funding menu outside devMode (internal-review) — funding on one
+   * advertises the funding menu outside devMode — funding on one
    * machine and drawing on another would `credit_not_found`.
    */
   durable = false;
@@ -42,7 +42,7 @@ var MemoryCreditLedger = class _MemoryCreditLedger {
     fork.x402Settlements = this.x402Settlements;
     return fork;
   }
-  /** See {@link CreditLedger.useX402SettlementGate} — same contract (internal-review). */
+  /** See {@link CreditLedger.useX402SettlementGate} — same contract. */
   useX402SettlementGate(gate) {
     this.x402Settlements = gate;
   }
@@ -62,12 +62,12 @@ var MemoryCreditLedger = class _MemoryCreditLedger {
     );
     return run(() => this.drawSync(args, blocking));
   }
-  /** See {@link CreditLedger.blockingX402Refund} — same contract (internal-review). */
+  /** See {@link CreditLedger.blockingX402Refund} — same contract. */
   async blockingX402Refund(channelId, statuses) {
     if (!channelId || !this.x402Settlements) return void 0;
     return this.x402Settlements.pendingRefundSettlement(channelId, statuses);
   }
-  /** The unresolved x402 refund that must stop an effect on `creditId` (internal-review). */
+  /** The unresolved x402 refund that must stop an effect on `creditId`. */
   blockingRefundForCredit(creditId, statuses) {
     return this.blockingX402Refund(this.credits.get(creditId)?.x402ChannelId, statuses);
   }
@@ -540,7 +540,7 @@ var MemoryCreditLedger = class _MemoryCreditLedger {
     credit.draws.set(args.drawId, draw);
     return { ...drawResult(draw, credit), replayed: false };
   }
-  /** Mid-job top-up growth (internal-review) — see `CreditLedger.growDraw` for the semantics. */
+  /** Mid-job top-up growth — see `CreditLedger.growDraw` for the semantics. */
   growDrawSync(args) {
     assertAmount(args.addAmountMicro, { min: 1 });
     const credit = this.requireCredit(args.creditId);
@@ -667,7 +667,7 @@ var MemoryCreditLedger = class _MemoryCreditLedger {
     const page = after ? out.filter((d) => compareStaleDrawKey(d, after) > 0) : out;
     return Promise.resolve(page.slice(0, args.limit));
   }
-  /** Settled draws' native value for the credit an x402 channel funded (internal-review). */
+  /** Settled draws' native value for the credit an x402 channel funded. */
   earnedNativeForX402Channel(channelId) {
     for (const credit of this.credits.values()) {
       if (credit.x402ChannelId !== channelId) continue;
@@ -757,7 +757,6 @@ var MemoryCreditLedger = class _MemoryCreditLedger {
       [...this.x402Losses.values()].sort((a, b) => b.observedAt - a.observedAt || a.creditId.localeCompare(b.creditId)).slice(0, args?.limit ?? 50)
     );
   }
-  // ── Drains (internal-review) — semantics mirror the Postgres ledger ─────────
   async requestDrain(args) {
     const wedged = await this.blockingRefundForCredit(
       args.creditId,
@@ -1046,7 +1045,6 @@ var MemoryCreditLedger = class _MemoryCreditLedger {
       if (drain) drain.receipts.push(args.receipt);
     });
   }
-  // ── Internals ─────────────────────────────────────────────────────────
   requireDrain(creditId, drainId) {
     const credit = this.credits.get(creditId);
     const drain = credit?.drains.get(drainId);

package/dist/{chunk-SSSZUVWM.js → chunk-QP53RWAD.js}

@@ -139,7 +139,6 @@ var PostgresJobStore = class {
   async init() {
     await withSdkInitLock(this.pool, () => this.createTables());
   }
-  /** The boot DDL itself — always runs under {@link withSdkInitLock} (internal-review). */
   async createTables() {
     await this.pool.query(`
       CREATE TABLE IF NOT EXISTS jobs (
@@ -156,10 +155,10 @@ var PostgresJobStore = class {
         payment_mint                TEXT,
         received_proofs             JSONB NOT NULL DEFAULT '[]',
         pending_payment_msats       BIGINT,
-        -- Keeps its mpp spelling past internal-review's rail rename (internal-review): it
+        -- Keeps its mpp spelling past rail rename: it
         -- holds mppx challenge ids \u2014 objects of the MPP envelope the Tempo rail
         -- rides, not the rail key \u2014 and it is server-internal anti-replay state
-        -- (internal-review) that never reaches a caller.
+        -- that never reaches a caller.
         pending_mpp_challenge_ids   JSONB,
         pending_x402_nonce          TEXT,
         pending_x402_amount_usdc_micro TEXT,
@@ -168,6 +167,12 @@ var PostgresJobStore = class {
         created_at                  BIGINT NOT NULL,
         last_activity_at            BIGINT NOT NULL
       );
+      ALTER TABLE jobs ADD COLUMN IF NOT EXISTS timing_known BOOLEAN NOT NULL DEFAULT false;
+      ALTER TABLE jobs ADD COLUMN IF NOT EXISTS terminal_at_ms BIGINT;
+      ALTER TABLE jobs ADD COLUMN IF NOT EXISTS caller_wait_ms BIGINT NOT NULL DEFAULT 0;
+      ALTER TABLE jobs ADD COLUMN IF NOT EXISTS awaiting_input_at_ms BIGINT;
+      ALTER TABLE jobs ADD COLUMN IF NOT EXISTS ended_by TEXT;
+      ALTER TABLE jobs ADD COLUMN IF NOT EXISTS terminal_report_enqueued BOOLEAN NOT NULL DEFAULT false;
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS pending_mpp_challenge_ids JSONB;
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS pending_x402_nonce TEXT;
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS pending_x402_amount_usdc_micro TEXT;
@@ -178,7 +183,7 @@ var PostgresJobStore = class {
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS native_amount DOUBLE PRECISION;
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS native_asset TEXT;
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS cashu_flow TEXT;
-      -- internal-review: what the job cost the BUILDER to serve, declared by the
+      -- what the job cost the BUILDER to serve, declared by the
       -- handler through ctx.cost(). NULL is "unreported", deliberately
       -- distinguishable from a declared zero.
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS cost_amount_micro BIGINT;
@@ -195,7 +200,7 @@ var PostgresJobStore = class {
       -- It powers StreamableJobStore cross-machine seq allocation; isolate
       -- DVMs are single-machine and use basic JobStore only.
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS next_seq INTEGER NOT NULL DEFAULT 1;
-      -- internal-review: the rail formerly written as 'mpp' is 'tempo'. A live job's
+      -- the rail formerly written as 'mpp' is 'tempo'. A live job's
       -- mid-job payment compares this against the incoming rail, and the
       -- receipt reports it.
       UPDATE jobs SET payment_rail = 'tempo' WHERE payment_rail = 'mpp';
@@ -205,41 +210,41 @@ var PostgresJobStore = class {
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS request_fingerprint TEXT;
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS requester_pubkey TEXT;
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS request_id TEXT;
-      -- internal-review: the route accepted by the live auth gate. Kept outside the
+      -- the route accepted by the live auth gate. Kept outside the
       -- caller-controlled envelope so reactivation cannot derive its expected
       -- route from the proof it is meant to check.
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS auth_request_path TEXT;
-      -- internal-review: the signed receipt, written once at terminal by saveReceipt,
+      -- the signed receipt, written once at terminal by saveReceipt,
       -- plus the per-DVM terminal counter value this job holds. Neither is in
       -- save's column list \u2014 a stale snapshot must not be able to clear a
       -- receipt or re-allocate a sequence number.
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS receipt JSONB;
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS receipt_seq BIGINT;
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS redacted_at BIGINT;
-      -- internal-review: credit-ledger linkage. Written at submission alongside the
+      -- credit-ledger linkage. Written at submission alongside the
       -- payment fields; the terminal funnel settles/releases the draw and the
       -- receipt countersigns the ReceiptCredit block from it.
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS credit_id TEXT;
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS draw_id TEXT;
-      -- internal-review: the original signed funding artifact and the snapshot served
+      -- the original signed funding artifact and the snapshot served
       -- with a fund-and-draw response. INSERT-only for replay stability.
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS funding_receipt JSONB;
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS funding_credit JSONB;
-      -- internal-review: the outstanding mid-job ask, denominated in fiat micro at the
+      -- the outstanding mid-job ask, denominated in fiat micro at the
       -- instant it was emitted. The top-up's ledger leg funds and grows the
       -- draw in this figure, so it must not move with the BTC/USD rate between
       -- the ask and the payment (and the paying machine is often not the one
       -- that asked, so it has to be durable rather than handler-local).
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS pending_payment_fiat_micro BIGINT;
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS pending_payment_fiat_currency TEXT;
-      -- internal-review: the same figure accumulated over the job's whole life, which
+      -- the same figure accumulated over the job's whole life, which
       -- is what caps mid-job draw growth. It has to be its own column rather
       -- than a read of the one above: Tx C decrements the outstanding figure as
       -- payments land, and a cap that shrank with it would let a duplicate
       -- payment buy the same ask twice.
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS asked_topup_micro BIGINT;
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS asked_topup_currency TEXT;
-      -- internal-review: why the ceiling above is absent, on the jobs where it is. The
+      -- why the ceiling above is absent, on the jobs where it is. The
       -- durable half of the -1 sentinel \u2014 an uncapped job has to be findable by
       -- query, not by grepping a log line off a machine that may be long gone.
       ALTER TABLE jobs ADD COLUMN IF NOT EXISTS topup_cap_unenforced_reason TEXT;
@@ -262,7 +267,7 @@ var PostgresJobStore = class {
         ON jobs (dvm_id, id)
         WHERE cost_revision IS NOT NULL
           AND status IN ('completed', 'failed', 'cancelled');
-      -- internal-review: the idempotent-replay lookup. payment_tx_hash carries the
+      -- the idempotent-replay lookup. payment_tx_hash carries the
       -- caller's X-Cashu-Request-Id on the accumulator path, so a retried paid
       -- submit finds the job its payment already created.
       CREATE INDEX IF NOT EXISTS idx_jobs_payment_tx_hash ON jobs (payment_tx_hash);
@@ -294,7 +299,7 @@ var PostgresJobStore = class {
       );
       ALTER TABLE job_messages ADD COLUMN IF NOT EXISTS status TEXT NOT NULL DEFAULT 'verified';
 
-      -- internal-review: per-DVM monotonic receipt counter. Single row by
+      -- per-DVM monotonic receipt counter. Single row by
       -- construction (the CHECK pins the key), and per-DVM by construction
       -- too \u2014 the SDK runs one database per DVM (see postgres-kv-store.ts).
       -- Allocated with the same UPDATE \u2026 RETURNING trick as jobs.next_seq so
@@ -313,7 +318,7 @@ var PostgresJobStore = class {
     return rowToRecord(rows[0]);
   }
   /**
-   * internal-review. Indexed by `idx_jobs_payment_tx_hash`. `paymentTxHash` is unique
+   * Indexed by `idx_jobs_payment_tx_hash`. `paymentTxHash` is unique
    * per settlement in practice — the accumulator's
    * `UNIQUE(dvm_id, request_id, proof_secret)` is what makes a second job under
    * the same request id impossible — but order by `created_at` so a
@@ -443,6 +448,7 @@ var PostgresJobStore = class {
     }
   }
   async saveRecord(record, dvmId) {
+    const now = Date.now();
     const { rowCount } = await this.pool.query(
       `INSERT INTO jobs (
         id, tags, capability, input, params, requester_id, status, summary,
@@ -454,15 +460,22 @@ var PostgresJobStore = class {
         last_activity_at, next_seq, requester_token_hash, requester_token,
         request_fingerprint, requester_pubkey, request_id, credit_id, draw_id,
         pending_payment_fiat_micro, pending_payment_fiat_currency, auth_request_path,
-        funding_receipt, funding_credit, dvm_id
-      ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24,$25,$26,$27,$28,$29,$30,$31,$32,$33,$34,$35,$36,$37,$38,$39,$40,$41,$42,$43,$44,$45)
+        funding_receipt, funding_credit, dvm_id, terminal_at_ms, caller_wait_ms, awaiting_input_at_ms, ended_by, timing_known
+      ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24,$25,$26,$27,$28,$29,$30,$31,$32,$33,$34,$35,$36,$37,$38,$39,$40,$41,$42,$43,$44,$45,$46,$47,$48,$49,$51)
       ON CONFLICT (id) DO UPDATE SET
+        terminal_at_ms = COALESCE(jobs.terminal_at_ms, EXCLUDED.terminal_at_ms),
+        ended_by = CASE WHEN jobs.status IN ('completed', 'failed', 'cancelled') THEN jobs.ended_by ELSE EXCLUDED.ended_by END,
+        caller_wait_ms = CASE WHEN jobs.status IN ('completed', 'failed', 'cancelled') THEN jobs.caller_wait_ms
+          ELSE jobs.caller_wait_ms + CASE WHEN jobs.status = 'awaiting-input' AND EXCLUDED.status <> 'awaiting-input'
+            THEN GREATEST(0, $50 - COALESCE(jobs.awaiting_input_at_ms, jobs.last_activity_at)) ELSE 0 END END,
+        awaiting_input_at_ms = CASE WHEN EXCLUDED.status = 'awaiting-input'
+          THEN COALESCE(jobs.awaiting_input_at_ms, $50) ELSE NULL END,
         status = EXCLUDED.status,
         summary = EXCLUDED.summary,
         messages = EXCLUDED.messages,
         -- GREATEST keeps seq monotonic: a stale snapshot from a machine
         -- whose in-memory job.seq is behind the DB high-water mark must
-        -- not regress jobs.seq. See internal-review review feedback.
+        -- not regress jobs.seq.
         seq = GREATEST(jobs.seq, EXCLUDED.seq),
         payment_mint = EXCLUDED.payment_mint,
         payment_rail = EXCLUDED.payment_rail,
@@ -502,7 +515,7 @@ var PostgresJobStore = class {
         step_cache = EXCLUDED.step_cache,
         state = EXCLUDED.state,
         last_activity_at = EXCLUDED.last_activity_at
-      -- internal-review: terminal is terminal. On a multi-machine DVM a DELETE can
+      -- terminal is terminal. On a multi-machine DVM a DELETE can
       -- land on a machine that isn't running the handler, which cancels the
       -- job in the store only; the handler's machine never learns of it and
       -- would otherwise persist completed over the cancelled row. Once a row is
@@ -547,7 +560,7 @@ var PostgresJobStore = class {
         record.lastActivityAt,
         Math.max(record.seq + 1, 1),
         record.requesterTokenHash ?? null,
-        // internal-review: submission-time provenance. Like requester_token_hash,
+        // submission-time provenance. Like requester_token_hash,
         // these are INSERT-only — the ON CONFLICT branch above never touches
         // them, so a later snapshot save can't rewrite what the caller must
         // reproduce to recover the job.
@@ -555,23 +568,29 @@ var PostgresJobStore = class {
         record.requestFingerprint ?? null,
         record.requesterPubkey ?? null,
         record.requestId ?? null,
-        // internal-review: ledger linkage — INSERT-only for the same reason.
+        // ledger linkage — INSERT-only for the same reason.
         record.creditId ?? null,
         record.drawId ?? null,
-        // internal-review: the pinned mid-job ask. INSERT-only, exactly like its
+        // the pinned mid-job ask. INSERT-only, exactly like its
         // companion `pending_payment_msats` — both are owned by the
         // transactional paths (`appendOutgoing` sets them, `verifyAndCredit`
         // clears them), so a stale snapshot must not be able to reset one
         // while the other stands.
         record.pendingPaymentFiatMicro ?? null,
         record.pendingPaymentFiatCurrency ?? null,
-        // internal-review: submission provenance, INSERT-only with the fingerprint
+        // submission provenance, INSERT-only with the fingerprint
         // and caller identity above. Snapshot saves cannot rewrite the route
         // whose live gate accepted this proof.
         record.authRequestPath ?? null,
         record.fundingReceipt ? JSON.stringify(record.fundingReceipt) : null,
         record.fundingCredit ? JSON.stringify(record.fundingCredit) : null,
-        dvmId ?? null
+        dvmId ?? null,
+        isTerminalStatus(record.status) ? now : null,
+        record.callerWaitMs ?? 0,
+        record.status === "awaiting-input" ? record.awaitingInputAtMs ?? now : null,
+        isTerminalStatus(record.status) && record.status !== "completed" ? record.endedBy ?? "provider" : null,
+        now,
+        record.timingKnown ?? true
       ]
     );
     if (rowCount === 0) {
@@ -588,6 +607,21 @@ var PostgresJobStore = class {
       await this.pool.query("DELETE FROM job_messages WHERE job_id = $1", [record.id]).catch(() => void 0);
     }
   }
+  /** Advance only after the reporter durably enqueued or deduplicated the event. */
+  async markTerminalReported(jobId) {
+    await this.pool.query("UPDATE jobs SET terminal_report_enqueued = true WHERE id = $1", [jobId]);
+  }
+  /** Bounded crash recovery for terminal events not yet queued. */
+  async listUnreportedTerminalReports(dvmId, capabilities, afterJobId) {
+    const { rows } = await this.pool.query(
+      `SELECT * FROM jobs WHERE dvm_id = $1 AND terminal_report_enqueued = false AND terminal_at_ms IS NOT NULL AND timing_known = true
+       AND status IN ('completed', 'failed', 'cancelled')
+       AND ($2::text[] IS NULL OR capability = ANY($2))
+       AND ($3::text IS NULL OR id > $3) ORDER BY id LIMIT 100`,
+      [dvmId, capabilities, afterJobId ?? null]
+    );
+    return rows.map(rowToRecord);
+  }
   /**
    * Read terminal zero-revenue jobs whose latest declared-cost revision has
    * not yet reached the durable reporter outbox.
@@ -733,16 +767,19 @@ var PostgresJobStore = class {
     if (rows.length === 0) return void 0;
     return rows[0].receipt;
   }
-  // ── Tx A / Tx B / Tx C (internal-review) ────────────────────────────────────
   async appendOutgoing(jobId, message, opts) {
     const client = await this.pool.connect();
     try {
       await client.query("BEGIN");
       const { rows } = await client.query(
-        `UPDATE jobs SET next_seq = next_seq + 1, last_activity_at = $2
+        `UPDATE jobs SET next_seq = next_seq + 1, last_activity_at = $2,
+           awaiting_input_at_ms = CASE WHEN $3::boolean AND status NOT IN ('completed', 'failed', 'cancelled')
+             THEN COALESCE(awaiting_input_at_ms, $2) ELSE awaiting_input_at_ms END,
+           status = CASE WHEN $3::boolean AND status NOT IN ('completed', 'failed', 'cancelled')
+             THEN 'awaiting-input' ELSE status END
            WHERE id = $1 AND redacted_at IS NULL
            RETURNING (next_seq - 1) AS seq`,
-        [jobId, Date.now()]
+        [jobId, Date.now(), opts?.awaitingInput ?? false]
       );
       if (rows.length === 0) {
         await client.query("ROLLBACK");
@@ -761,7 +798,7 @@ var PostgresJobStore = class {
              pending_mpp_challenge_ids = $3,
              pending_x402_nonce = $4,
              pending_x402_amount_usdc_micro = $5,
-             -- internal-review: accumulate the fiat ask alongside the msat one when the
+             -- accumulate the fiat ask alongside the msat one when the
              -- currency matches what's already outstanding, replace when it
              -- doesn't. A NULL micro clears both \u2014 an ask that couldn't be
              -- priced in fiat must not leave a stale figure the top-up would
@@ -773,7 +810,7 @@ var PostgresJobStore = class {
                ELSE $6
              END,
              pending_payment_fiat_currency = CASE WHEN $6::bigint IS NULL THEN NULL ELSE $7 END,
-             -- internal-review: the cumulative ask total, the ceiling on this job's
+             -- the cumulative ask total, the ceiling on this job's
              -- draw growth. Same accumulate rule as above, minus the reset \u2014
              -- it is monotonic by definition. Mirrors accumulateAskedTopUp
              -- in job-store.ts; edit the two together. -1 is the sticky "can't
@@ -786,12 +823,12 @@ var PostgresJobStore = class {
                WHEN asked_topup_currency IS NOT DISTINCT FROM $7 THEN asked_topup_micro + $6
                ELSE -1
              END,
-             -- First-write-wins, and internal-review made that load-bearing: this is
+             -- First-write-wins because this is
              -- the job's own ask denomination, read back by ctx.requestPayment
              -- so every later ask pins in it. The ELSE -1 arm above is the
              -- backstop for a row an older build wrote, not a live path.
              asked_topup_currency = COALESCE(asked_topup_currency, $7),
-             -- internal-review: the sticky reason the ceiling is gone, mirroring the
+             -- the sticky reason the ceiling is gone, mirroring the
              -- sentinel's own stickiness through COALESCE. NULL arms mean "no
              -- new poison" \u2014 an already-poisoned row keeps its first reason.
              topup_cap_unenforced_reason = COALESCE(topup_cap_unenforced_reason, CASE
@@ -901,7 +938,7 @@ var PostgresJobStore = class {
                WHEN $3::boolean THEN NULL
                ELSE GREATEST(0, COALESCE(pending_payment_msats, 0) - $2)
              END,
-             -- internal-review: the pinned fiat ask dies with the msat ask it denominates.
+             -- the pinned fiat ask dies with the msat ask it denominates.
              -- Cleared outright rather than decremented: a partially-paid ask keeps
              -- its original fiat envelope so the remainder still funds at the rate
              -- the caller was quoted.
@@ -1031,7 +1068,9 @@ var PostgresJobStore = class {
   }
   async claimForProcessing(jobId) {
     const { rowCount } = await this.pool.query(
-      "UPDATE jobs SET status='processing', last_activity_at=$2 WHERE id=$1 AND status='awaiting-input'",
+      `UPDATE jobs SET status='processing', last_activity_at=$2,
+       caller_wait_ms = caller_wait_ms + GREATEST(0, $2 - COALESCE(awaiting_input_at_ms, last_activity_at)),
+       awaiting_input_at_ms = NULL WHERE id=$1 AND status='awaiting-input'`,
       [jobId, Date.now()]
     );
     return rowCount === 1;
@@ -1060,7 +1099,6 @@ var PostgresJobStore = class {
       client.release();
     }
   }
-  // ── Streaming ─────────────────────────────────────────────────────────
   async subscribeMessages(jobId, afterSeq, onMessage) {
     const sub = { afterSeq, cb: onMessage };
     let subs = this.messageSubscribers.get(jobId);
@@ -1157,7 +1195,6 @@ var PostgresJobStore = class {
       }
     }).catch(() => void 0);
   }
-  // ── Internal ────────────────────────────────────────────────────────
   /**
    * Drive a non-terminal job to `terminalStatus` and append its final `cancel`
    * message in one transaction. Backs both `cancelStaleJob` (which passes an
@@ -1204,6 +1241,11 @@ var PostgresJobStore = class {
       );
       await client.query(
         `UPDATE jobs SET
+           ended_by = CASE WHEN $7::boolean OR status = 'awaiting-input' THEN 'caller' ELSE 'provider' END,
+           terminal_at_ms = $5,
+           caller_wait_ms = caller_wait_ms + CASE WHEN status = 'awaiting-input'
+             THEN GREATEST(0, $5 - COALESCE(awaiting_input_at_ms, last_activity_at)) ELSE 0 END,
+           awaiting_input_at_ms = NULL,
            status = $6,
            summary = COALESCE(summary, $2),
            messages = COALESCE(messages, '[]'::jsonb) || $3::jsonb,
@@ -1211,7 +1253,7 @@ var PostgresJobStore = class {
            next_seq = $4 + 1,
            last_activity_at = $5
          WHERE id = $1`,
-        [jobId, reason, JSON.stringify([cancelMsg]), nextSeq, now, terminalStatus]
+        [jobId, reason, JSON.stringify([cancelMsg]), nextSeq, now, terminalStatus, !staleOnly]
       );
       await client.query("SELECT pg_notify('job_messages', $1)", [jobId]);
       await client.query("COMMIT");
@@ -1236,7 +1278,7 @@ var PostgresJobStore = class {
     return rowToCounters(rows[0]);
   }
   /**
-   * The credit binding on the job row, read inside Tx C (internal-review). Used on the
+   * The credit binding on the job row, read inside Tx C. Used on the
    * paths that don't get it from a `RETURNING` — the `alreadyVerified` skip and
    * a non-payment inbound.
    */
@@ -1268,7 +1310,7 @@ function rowToRecord(row) {
   return {
     id: row.id,
     tags: row.tags,
-    // Pre-internal-review rows persisted before this migration shipped may carry NULL
+    // Earlier rows persisted before this migration shipped may carry NULL
     // here. Fall back to "" so reactivation lookups surface a clear
     // "unknown capability" error rather than crashing on a typed read.
     capability: row.capability ?? "",
@@ -1282,6 +1324,11 @@ function rowToRecord(row) {
     requestId: row.request_id ?? void 0,
     authRequestPath: row.auth_request_path ?? void 0,
     status: row.status,
+    timingKnown: row.timing_known === true,
+    endedBy: row.ended_by ?? void 0,
+    terminalAtMs: row.terminal_at_ms == null ? void 0 : Number(row.terminal_at_ms),
+    callerWaitMs: Number(row.caller_wait_ms ?? 0),
+    awaitingInputAtMs: row.awaiting_input_at_ms == null ? void 0 : Number(row.awaiting_input_at_ms),
     summary: row.summary,
     messages: row.messages,
     seq: row.seq,
@@ -1319,6 +1366,9 @@ function rowToRecord(row) {
     redactedAt: row.redacted_at == null ? void 0 : Number(row.redacted_at)
   };
 }
+function isTerminalStatus(status) {
+  return status === "completed" || status === "failed" || status === "cancelled";
+}
 
 export {
   PostgresJobStore

package/dist/{chunk-DMNLFNTW.js → chunk-QT4ONTST.js}

@@ -39,7 +39,7 @@ var PostgresProcessedPaymentStore = class {
   async init() {
     await withSdkInitLock(this.pool, () => this.createTables());
   }
-  /** The boot DDL itself — always runs under {@link withSdkInitLock} (internal-review). */
+  /** The boot DDL itself — always runs under {@link withSdkInitLock}. */
   async createTables() {
     await this.pool.query(`
       CREATE TABLE IF NOT EXISTS processed_payments (

package/dist/{chunk-RW5LP57K.js → chunk-SDK6KDJN.js}

@@ -17,7 +17,6 @@ var MemoryKVStore = class {
     this.data.set(key, { value, expiry });
     return Promise.resolve();
   }
-  /** Delete a key. */
   delete(key) {
     this.data.delete(key);
     return Promise.resolve();