@paydlux/agent 0.1.12 → 0.1.14

package/dist/cli.js

@@ -612,8 +612,12 @@ const HELP = `paydlux — get paid by AI agents, with a human in the loop.
 
   paydlux setup [--mainnet] [--token USDC] [--fund-seed S…]
       create a vault. testnet by default (free, no wallet needed).
-  paydlux sell  [--price 1] [--route /api/data] [--split] [--tls] [--preauth]
+  paydlux sell  [--price 1] [--route /api/data] [--max N] [--daily N]
+                [--split] [--tls] [--preauth]
       start the gateway and the approval desk.
+      --max / --daily are your spending mandate: no single payment above --max,
+      and nothing past --daily in a day. The desk refuses at the approve button,
+      so a runaway agent cannot drain the vault even if you approve in error.
   paydlux status
       balances, signers, live mandates, ledger rent.
   paydlux approver [--forget]

package/dist/desk.d.ts

@@ -11,7 +11,7 @@ export type DeskRecord = {
     uri: string;
     price: string;
     body: string;
-    status: "pending" | "awaiting_phone" | "approved" | "denied" | "settled" | "failed";
+    status: "pending" | "awaiting_phone" | "approved" | "denied" | "settled" | "failed" | "expired";
     content?: string;
     tx?: string;
     reason?: string;
@@ -80,6 +80,21 @@ export declare class ApprovalDesk {
     private server?;
     cfg: DeskConfig;
     constructor(cfg: DeskConfig);
+    /**
+     * A request the human never answered is not waiting forever.
+     *
+     * The transaction the phone signs carries Stellar time bounds, so past
+     * `expiresAt` the ledger rejects it no matter who signs it. Until this sweep
+     * existed such a request stayed `awaiting_phone` for good: it showed in the
+     * queue as approvable, held its price against the daily budget so later
+     * payments were refused for a money that could never move, and the buyer's
+     * retry kept reusing the dead handle instead of parking a fresh one. Three
+     * wrong behaviours from one missing transition, which is why the transition
+     * lives here rather than in the page that draws the word "expired".
+     *
+     * Called from every read path, so no caller can observe a stale state.
+     */
+    private sweepExpired;
     enqueue(uri: string, price: string, body: string, content: string, key?: string): string;
     /** Every record carrying this key, newest first. */
     allByKey(key: string): DeskRecord[];

package/dist/desk.js

@@ -159,7 +159,35 @@ export class ApprovalDesk {
     server;
     cfg;
     constructor(cfg) { this.cfg = cfg; }
+    /**
+     * A request the human never answered is not waiting forever.
+     *
+     * The transaction the phone signs carries Stellar time bounds, so past
+     * `expiresAt` the ledger rejects it no matter who signs it. Until this sweep
+     * existed such a request stayed `awaiting_phone` for good: it showed in the
+     * queue as approvable, held its price against the daily budget so later
+     * payments were refused for a money that could never move, and the buyer's
+     * retry kept reusing the dead handle instead of parking a fresh one. Three
+     * wrong behaviours from one missing transition, which is why the transition
+     * lives here rather than in the page that draws the word "expired".
+     *
+     * Called from every read path, so no caller can observe a stale state.
+     */
+    sweepExpired() {
+        const now = Date.now();
+        for (const r of this.records.values()) {
+            if (r.status !== "awaiting_phone" && r.status !== "approved")
+                continue;
+            const exp = r.challenge?.summary.expiresAt;
+            if (!exp || Number(exp) * 1000 > now)
+                continue;
+            r.status = "expired";
+            r.reason = `nobody approved it before the deadline (${new Date(Number(exp) * 1000).toISOString()})`;
+            console.log(`[desk] ${r.id} expired: the deadline passed with no approval`);
+        }
+    }
     enqueue(uri, price, body, content, key) {
+        this.sweepExpired();
         // Re-use an existing request for the same buyer + body + price. A buyer who
         // retries after a human approved must get their content, not a second
         // payment waiting in the queue. Settled records are NOT reused here — the
@@ -176,6 +204,7 @@ export class ApprovalDesk {
     }
     /** Every record carrying this key, newest first. */
     allByKey(key) {
+        this.sweepExpired();
         if (!key)
             return [];
         return [...this.records.values()].filter((r) => r.key === key).sort((a, b) => b.at - a.at);
@@ -183,8 +212,8 @@ export class ApprovalDesk {
     findByKey(key) {
         return this.allByKey(key)[0] ?? null;
     }
-    get(id) { return this.records.get(id) ?? null; }
-    list() { return [...this.records.values()]; }
+    get(id) { this.sweepExpired(); return this.records.get(id) ?? null; }
+    list() { this.sweepExpired(); return [...this.records.values()]; }
     /**
      * The human clicked Approve.
      *
@@ -240,6 +269,7 @@ export class ApprovalDesk {
         });
     }
     async approve(id) {
+        this.sweepExpired();
         const rec = this.records.get(id);
         if (!rec)
             throw new Error("unknown handle " + id);
@@ -307,6 +337,7 @@ export class ApprovalDesk {
      * ledger rejects it if the signature is not over this exact transaction.
      */
     async complete(id, signedXdr) {
+        this.sweepExpired();
         const rec = this.records.get(id);
         if (!rec)
             throw new Error("unknown handle " + id);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paydlux/agent",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "Payments for AI agents that a human approves. Spending mandates enforced on the Stellar ledger: 2-of-2 vault, pre-authorised transaction envelopes, HTTP 402, USDC.",
   "type": "module",
   "main": "./dist/index.js",