@paydlux/agent 0.1.13 → 0.1.15

package/dist/desk.d.ts

@@ -11,7 +11,7 @@ export type DeskRecord = {
     uri: string;
     price: string;
     body: string;
-    status: "pending" | "awaiting_phone" | "approved" | "denied" | "settled" | "failed";
+    status: "pending" | "awaiting_phone" | "approved" | "denied" | "settled" | "failed" | "expired";
     content?: string;
     tx?: string;
     reason?: string;
@@ -80,6 +80,21 @@ export declare class ApprovalDesk {
     private server?;
     cfg: DeskConfig;
     constructor(cfg: DeskConfig);
+    /**
+     * A request the human never answered is not waiting forever.
+     *
+     * The transaction the phone signs carries Stellar time bounds, so past
+     * `expiresAt` the ledger rejects it no matter who signs it. Until this sweep
+     * existed such a request stayed `awaiting_phone` for good: it showed in the
+     * queue as approvable, held its price against the daily budget so later
+     * payments were refused for a money that could never move, and the buyer's
+     * retry kept reusing the dead handle instead of parking a fresh one. Three
+     * wrong behaviours from one missing transition, which is why the transition
+     * lives here rather than in the page that draws the word "expired".
+     *
+     * Called from every read path, so no caller can observe a stale state.
+     */
+    private sweepExpired;
     enqueue(uri: string, price: string, body: string, content: string, key?: string): string;
     /** Every record carrying this key, newest first. */
     allByKey(key: string): DeskRecord[];

package/dist/desk.js

@@ -159,7 +159,45 @@ export class ApprovalDesk {
     server;
     cfg;
     constructor(cfg) { this.cfg = cfg; }
+    /**
+     * A request the human never answered is not waiting forever.
+     *
+     * The transaction the phone signs carries Stellar time bounds, so past
+     * `expiresAt` the ledger rejects it no matter who signs it. Until this sweep
+     * existed such a request stayed `awaiting_phone` for good: it showed in the
+     * queue as approvable, held its price against the daily budget so later
+     * payments were refused for a money that could never move, and the buyer's
+     * retry kept reusing the dead handle instead of parking a fresh one. Three
+     * wrong behaviours from one missing transition, which is why the transition
+     * lives here rather than in the page that draws the word "expired".
+     *
+     * Called from every read path, so no caller can observe a stale state.
+     */
+    sweepExpired() {
+        const now = Date.now();
+        // A request nobody has even opened yet gets the same window as one the
+        // phone is holding: the seller said how long a human has to decide, and a
+        // parked request past that window is not going to be answered. Leaving it
+        // `pending` forever means the buyer's retry keeps reusing a handle that
+        // will never move, instead of parking a fresh one a human will actually see.
+        const decideWindow = (this.cfg.decideWithinSeconds ?? 1800) * 1000;
+        for (const r of this.records.values()) {
+            let deadline = null;
+            if (r.status === "pending") {
+                deadline = r.at + decideWindow;
+            }
+            else if (r.status === "awaiting_phone" || r.status === "approved") {
+                deadline = r.challenge?.summary.expiresAt ? Number(r.challenge.summary.expiresAt) * 1000 : null;
+            }
+            if (deadline === null || deadline > now)
+                continue;
+            r.status = "expired";
+            r.reason = `nobody approved it before the deadline (${new Date(deadline).toISOString()})`;
+            console.log(`[desk] ${r.id} expired: the deadline passed with no approval`);
+        }
+    }
     enqueue(uri, price, body, content, key) {
+        this.sweepExpired();
         // Re-use an existing request for the same buyer + body + price. A buyer who
         // retries after a human approved must get their content, not a second
         // payment waiting in the queue. Settled records are NOT reused here — the
@@ -176,6 +214,7 @@ export class ApprovalDesk {
     }
     /** Every record carrying this key, newest first. */
     allByKey(key) {
+        this.sweepExpired();
         if (!key)
             return [];
         return [...this.records.values()].filter((r) => r.key === key).sort((a, b) => b.at - a.at);
@@ -183,8 +222,8 @@ export class ApprovalDesk {
     findByKey(key) {
         return this.allByKey(key)[0] ?? null;
     }
-    get(id) { return this.records.get(id) ?? null; }
-    list() { return [...this.records.values()]; }
+    get(id) { this.sweepExpired(); return this.records.get(id) ?? null; }
+    list() { this.sweepExpired(); return [...this.records.values()]; }
     /**
      * The human clicked Approve.
      *
@@ -240,6 +279,7 @@ export class ApprovalDesk {
         });
     }
     async approve(id) {
+        this.sweepExpired();
         const rec = this.records.get(id);
         if (!rec)
             throw new Error("unknown handle " + id);
@@ -307,6 +347,7 @@ export class ApprovalDesk {
      * ledger rejects it if the signature is not over this exact transaction.
      */
     async complete(id, signedXdr) {
+        this.sweepExpired();
         const rec = this.records.get(id);
         if (!rec)
             throw new Error("unknown handle " + id);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paydlux/agent",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "description": "Payments for AI agents that a human approves. Spending mandates enforced on the Stellar ledger: 2-of-2 vault, pre-authorised transaction envelopes, HTTP 402, USDC.",
   "type": "module",
   "main": "./dist/index.js",