@phala/pay-server 0.13.3 → 0.13.5

package/README.md

@@ -103,6 +103,8 @@ Retries cover network/timeouts, 429, 500/502/503/504, and only `409 idempotency_
 bounded exponential jitter and Retry-After as a minimum. A delay that exceeds the remaining budget
 returns the last error immediately. Replayed errors, DELETE, cancellation and redirects do not
 retry. Redirects are refused. `close()` aborts outstanding requests without closing injected fetch.
+An unsaved `503 unavailable` from authentication admission uses this same retry policy and
+retains the original POST body and idempotency key.
 
 Set `upgradeTolerance: true` on the client or per call for backend work that can wait through a
 CVM upgrade. A maintenance 503, gateway 502/503/504 (even a non-JSON body), or network/attempt

package/dist/generated/openapi.d.ts

@@ -631,10 +631,21 @@ export interface paths {
          *     `deposit.refunded` is sent; otherwise it is `failed` with a `failure_reason`. Repeating the same
          *     transaction returns the refund. From here on the refund cannot be canceled: it is `failed`
          *     only when its transaction is proven not to pay it.
-         *     Each environment has a configured attached-pending refund limit (production 2, staging 1),
-         *     and permits one new attachment per
-         *     rolling 24 hours across all accounts and modes. Repeating the same attachment consumes no
-         *     quota. A limit refusal preserves the reservation; contact the operator before another payout.
+         *     Environment-wide attached-pending and rolling 24-hour limits apply across accounts and modes.
+         *     An additional per-account concurrency cap (`max_attached_pending_refunds_per_account`,
+         *     default 1) also spans both modes. Repeating an
+         *     attachment consumes no quota. A refusal preserves the reservation; contact the operator.
+         *     To resolve a replaced attachment, repeat its original `transaction_hash` with optional
+         *     `replacement_transaction_hash`. One candidate is stored at a time, with at most eight recovery
+         *     passes on the same A/C backoff. Before exhaustion or 24 hours, identical re-POSTs are
+         *     idempotent no-ops. After both, an explicit re-POST renews that candidate (or supplies another)
+         *     at most once per 24 hours per attachment; never automatically. Only identical
+         *     finalized replacement receipts on both providers and the original's verified sender and
+         *     nonce prove `transaction_dropped`; missing receipts and account nonce changes never suffice.
+         *     If providers have forgotten the original, supply `original_signed_transaction` alongside
+         *     the candidate. Its hash must equal `transaction_hash`; local signature recovery supplies the
+         *     original sender/nonce only when they were not already captured from both providers. Raw
+         *     bytes are not stored and this fallback makes no RPC calls.
          */
         readonly post: operations["mark_refund_paid"];
         readonly delete?: never;
@@ -2756,6 +2767,14 @@ export interface components {
          *     }
          */
         readonly MarkRefundPaidRequest: {
+            /**
+             * @description Optional 0x-prefixed EIP-2718 signed original transaction, with a replacement candidate.
+             *     Its keccak256 must equal transaction_hash and its signature must recover a sender. When
+             *     the original's sender/nonce were not captured from both providers before eviction, these
+             *     locally verified fields allow replacement proof with no additional RPC. Raw bytes are not
+             *     stored. Legacy, EIP-2930, EIP-1559, EIP-4844 and EIP-7702 envelopes are supported.
+             */
+            readonly original_signed_transaction?: string | null;
             /**
              * Format: int64
              * @description Position of the `Transfer` log that pays the refund among the logs of the transaction's
@@ -2763,6 +2782,15 @@ export interface components {
              *     is re-included in another block; any matching log when absent.
              */
             readonly receipt_log_index?: number | null;
+            /**
+             * @description Optional replacement candidate for the original transaction_hash. The original remains
+             *     reserved until both providers finalize this distinct transaction and prove the same
+             *     sender and nonce as the original. Nonce changes or missing receipts alone prove nothing.
+             *     At most eight automatic recovery passes per epoch. Before exhaustion or 24 hours,
+             *     identical re-POSTs are idempotent no-ops. After both, an explicit re-POST renews the same
+             *     candidate (or supplies another), at most once per 24 hours per attachment; never automatic.
+             */
+            readonly replacement_transaction_hash?: string | null;
             /** @description Hash of the transaction that pays the refund from the treasury of the deposit's address. */
             readonly transaction_hash: string;
         };
@@ -3379,8 +3407,9 @@ export interface components {
             /**
              * @description Why the refund failed: `transaction_failed`, `transfer_not_found`, `sender_mismatch`,
              *     `destination_mismatch`, `amount_mismatch`, or `transfer_already_used`.
-             *     Historical refunds may retain `transaction_dropped` or `transaction_not_found`; missing
-             *     transactions now remain pending with their reservation and alert after 24 hours.
+             *     `transaction_dropped` requires a distinct replacement finalized on both providers with
+             *     the original transaction's dual-verified sender and nonce. Historical refunds may retain
+             *     `transaction_not_found`; missing transactions remain pending and alert after 24 hours.
              *     New values may be added.
              */
             readonly failure_reason?: string | null;