mppx 0.11.0 → 0.13.1

package/dist/tempo/session/server/CredentialVerification.js

@@ -1,5 +1,5 @@
 import { isAddress, isAddressEqual, zeroAddress, } from 'viem';
-import { AmountExceedsDepositError, ChannelClosedError, ChannelNotFoundError, InsufficientBalanceError, InvalidSignatureError, VerificationFailedError, } from '../../../Errors.js';
+import { AmountExceedsDepositError, ChannelClosedError, ChannelNotFoundError, DeltaTooSmallError, InsufficientBalanceError, InvalidSignatureError, VerificationFailedError, } from '../../../Errors.js';
 import * as Chain from '../precompile/Chain.js';
 import { readChannelClosedReceiptFields } from '../precompile/Chain.js';
 import * as Channel from '../precompile/Channel.js';
@@ -7,7 +7,7 @@ import { createSessionReceipt, uint96, } from '../precompile/Protocol.js';
 import * as Voucher from '../precompile/Voucher.js';
 import * as ChannelStore from './ChannelStore.js';
 import { getChallengePaymentFields } from './RequestState.js';
-import { assertSettlementSender, getClientAccount } from './Settlement.js';
+import { assertSettlementSender, getClientAccount, maybeSettleScheduled, } from './Settlement.js';
 /** Returns the effective voucher signer for a TIP-1034 descriptor. */
 export function authorizedSigner(descriptor) {
     return isAddressEqual(descriptor.authorizedSigner, zeroAddress)
@@ -233,6 +233,7 @@ export function requireSessionCredentialPayload(payload) {
                 descriptor: readDescriptor(candidate.descriptor),
                 cumulativeAmount: readRawAmount(candidate.cumulativeAmount, 'cumulativeAmount'),
                 signature: readHex(candidate.signature, 'signature'),
+                closeSignature: readHex(candidate.closeSignature, 'closeSignature'),
             };
     }
 }
@@ -375,6 +376,8 @@ async function validateVoucherCredential(parameters, payload) {
         escrow,
         lastOnChainVerified,
     });
+    if (parameters.allowPendingClose && channelState.closeRequestedAt !== 0)
+        return;
     await ChannelStore.validateVoucher({
         channel,
         channelState,
@@ -384,10 +387,12 @@ async function validateVoucherCredential(parameters, payload) {
     });
 }
 async function resolveVoucherChannelState(parameters) {
-    const { channel, channelId, channelStateTtl, client, escrow, lastOnChainVerified } = parameters;
-    const isStale = Date.now() - (lastOnChainVerified.get(channelId) ?? 0) > channelStateTtl;
-    const state = isStale ? await Chain.getChannelState(client, channelId, escrow) : undefined;
-    if (state)
+    const { channel, channelId, channelStateTtl, client, escrow, forceRefresh, lastOnChainVerified } = parameters;
+    const shouldRefresh = forceRefresh || Date.now() - (lastOnChainVerified.get(channelId) ?? 0) > channelStateTtl;
+    const state = shouldRefresh ? await Chain.getChannelState(client, channelId, escrow) : undefined;
+    if (state?.closeRequestedAt)
+        lastOnChainVerified.delete(channelId);
+    else if (state)
         lastOnChainVerified.set(channelId, Date.now());
     return {
         deposit: state?.deposit ?? uint96(channel.deposit),
@@ -410,6 +415,9 @@ async function validateCloseCredential(parameters, payload) {
         escrow,
         store,
     });
+    const closeAuthorized = Voucher.verifyCloseAuthorization(escrow, chainId, { channelId, cumulativeAmount, signature: payload.closeSignature }, [channel.payer, channel.authorizedSigner]);
+    if (!closeAuthorized)
+        throw new InvalidSignatureError({ reason: 'invalid close authorization signature' });
     if (channel.finalized)
         throw new ChannelClosedError({ reason: 'channel is already finalized' });
     const state = await Chain.getChannelState(client, channelId, escrow);
@@ -513,18 +521,26 @@ async function handleOpenCredential(parameters) {
     const { descriptor, state } = result;
     assertSameDescriptor(descriptor, payload.descriptor);
     validateChannelState(state, request.amount);
-    const updated = await store.updateChannel(channelId, (current) => ChannelStore.openChannelState({
-        authorizedSigner: authorizedSigner(descriptor),
-        chainId,
-        channelId,
-        current,
-        descriptor,
-        escrow,
-        expiringNonceHash: result.expiringNonceHash,
-        cumulativeAmount,
-        signature: payload.signature,
-        state,
-    }));
+    const updated = await store.updateChannel(channelId, (current) => {
+        if (parameters.requireVoucherAdvance &&
+            current !== null &&
+            cumulativeAmount <= current.highestVoucherAmount)
+            throw new DeltaTooSmallError({
+                reason: 'voucher does not add new funds for this request',
+            });
+        return ChannelStore.openChannelState({
+            authorizedSigner: authorizedSigner(descriptor),
+            chainId,
+            channelId,
+            current,
+            descriptor,
+            escrow,
+            expiringNonceHash: result.expiringNonceHash,
+            cumulativeAmount,
+            signature: payload.signature,
+            state,
+        });
+    });
     if (!updated)
         throw new VerificationFailedError({ reason: 'failed to create channel' });
     return createSessionReceipt({
@@ -603,21 +619,39 @@ async function handleVoucherCredential(parameters) {
         channelStateTtl,
         client,
         escrow,
+        forceRefresh: true,
         lastOnChainVerified,
     });
     if (channelState.closeRequestedAt !== 0) {
-        await store.updateChannel(channelId, (current) => current
+        const closing = await store.updateChannel(channelId, (current) => current
             ? {
                 ...current,
+                settledOnChain: channelState.settled > current.settledOnChain
+                    ? channelState.settled
+                    : current.settledOnChain,
                 closeRequestedAt: BigInt(channelState.closeRequestedAt) > current.closeRequestedAt
                     ? BigInt(channelState.closeRequestedAt)
                     : current.closeRequestedAt,
             }
             : current);
+        if (closing && !closing.finalized && channelState.deposit > 0n)
+            await maybeSettleScheduled({
+                account: parameters.account,
+                channel: closing,
+                client,
+                feePayer: parameters.feePayer,
+                feePayerPolicy: parameters.feePayerPolicy,
+                feeToken: parameters.feeToken,
+                onSessionSettlement: parameters.onSessionSettlement,
+                schedule: {},
+                store,
+            });
+        throw new ChannelClosedError({ reason: 'channel has a pending close request' });
     }
     return ChannelStore.verifyAndAcceptVoucher({
         store,
         minVoucherDelta,
+        requireAdvance: parameters.requireVoucherAdvance,
         challenge,
         channel,
         voucher,
@@ -640,6 +674,9 @@ async function handleCloseCredential(parameters) {
         escrow,
         store,
     });
+    const closeAuthorized = Voucher.verifyCloseAuthorization(escrow, chainId, { channelId, cumulativeAmount, signature: payload.closeSignature }, [channel.payer, channel.authorizedSigner]);
+    if (!closeAuthorized)
+        throw new InvalidSignatureError({ reason: 'invalid close authorization signature' });
     if (channel.finalized)
         throw new ChannelClosedError({ reason: 'channel is already finalized' });
     const state = await Chain.getChannelState(client, channelId, escrow);

package/dist/tempo/session/server/MeteredStream.d.ts

@@ -8,8 +8,9 @@ export type SessionController = {
      * Reserve voucher coverage for the next emitted chunk.
      *
      * The reservation blocks until sufficient voucher headroom exists, but the
-     * charge is only committed once a chunk is actually emitted. If the stream
-     * ends or aborts before that emission, the reservation is dropped.
+     * charge is committed when a chunk is emitted or when the generator finishes
+     * successfully. A reservation is only dropped when the stream aborts or the
+     * generator fails before the charge can be committed.
      *
      * Pass an explicit raw-unit `amount` for request-aware or otherwise dynamic
      * pricing. When omitted, the session challenge's configured tick cost is

package/dist/tempo/session/server/MeteredStream.js

@@ -1,46 +1,102 @@
-import { commitReservedCharges, reserveChargeOrWait } from './Transports.js';
+import { commitReservedCharges, releaseReservedCharges, renewReservedCharges, reserveChargeOrWait, streamReservationLeaseMs, } from './Transports.js';
 /** Applies voucher reservation and spend commits to an async session stream. */
 export async function* meterIterable(options) {
     let prepaidUnits = options.prepaidUnits ?? 0;
-    let reservedAmount = 0n;
-    let reservedUnits = 0;
+    const controller = new AbortController();
+    const signal = controller.signal;
+    const reservation = {
+        store: options.store,
+        channelId: options.channelId,
+        reservationId: globalThis.crypto.randomUUID(),
+    };
+    let pending = false;
+    let cancelled = false;
+    const onAbort = () => {
+        if (signal.aborted)
+            return;
+        cancelled = true;
+        controller.abort(options.signal?.reason);
+    };
+    options.signal?.addEventListener('abort', onAbort, { once: true });
+    if (options.signal?.aborted)
+        onAbort();
+    const renewal = setInterval(() => {
+        if (pending)
+            void renewReservedCharges(reservation).catch((error) => controller.abort(error));
+    }, streamReservationLeaseMs / 3);
+    renewal.unref?.();
+    const releaseOnAbort = () => {
+        clearInterval(renewal);
+        void releaseReservedCharges(reservation).catch(() => { });
+    };
+    signal.addEventListener('abort', releaseOnAbort, { once: true });
+    if (signal.aborted)
+        releaseOnAbort();
     const charge = async (amount) => {
+        signal.throwIfAborted();
         if (amount === undefined && prepaidUnits > 0) {
             prepaidUnits -= 1;
             return;
         }
-        const resolvedAmount = amount ?? options.tickCost;
+        if ((amount ?? options.tickCost) === 0n)
+            return;
         await reserveChargeOrWait({
-            store: options.store,
-            channelId: options.channelId,
-            amount: resolvedAmount,
-            reservedAmount,
+            ...reservation,
+            requireExisting: pending,
+            amount: amount ?? options.tickCost,
             emit: options.emitNeedVoucher,
             formatNeedVoucher: options.formatNeedVoucher,
             pollIntervalMs: options.pollIntervalMs,
-            signal: options.signal,
+            signal,
         });
-        reservedAmount += resolvedAmount;
-        reservedUnits += 1;
+        pending = true;
+        signal.throwIfAborted();
     };
-    const signal = options.signal ?? new AbortController().signal;
-    const iterable = typeof options.generate === 'function' ? options.generate({ charge, signal }) : options.generate;
-    for await (const value of iterable) {
-        if (options.signal?.aborted)
-            break;
-        if (typeof options.generate !== 'function')
-            await charge();
-        const channel = await commitReservedCharges({
-            store: options.store,
-            channelId: options.channelId,
-            amount: reservedAmount,
-            units: reservedUnits,
-        });
-        reservedAmount = 0n;
-        reservedUnits = 0;
-        if (channel)
-            await options.onChargeCommitted?.(channel);
-        yield value;
+    const commit = async () => {
+        signal.throwIfAborted();
+        if (!pending)
+            return;
+        const channel = await commitReservedCharges(reservation);
+        if (!channel)
+            throw new Error('stream reservation was lost');
+        pending = false;
+        await options.onChargeCommitted?.(channel);
+    };
+    try {
+        const manual = typeof options.generate === 'function';
+        const iterable = typeof options.generate === 'function'
+            ? options.generate({ charge, signal })
+            : options.generate;
+        const iterator = iterable[Symbol.asyncIterator]();
+        try {
+            while (!signal.aborted) {
+                const { done, value } = await iterator.next();
+                if (signal.aborted)
+                    break;
+                if (done) {
+                    if (manual)
+                        await commit();
+                    break;
+                }
+                if (!manual)
+                    await charge();
+                await commit();
+                yield value;
+            }
+            if (!cancelled)
+                signal.throwIfAborted();
+        }
+        finally {
+            clearInterval(renewal);
+            await releaseReservedCharges(reservation);
+            await iterator.return?.();
+        }
+    }
+    finally {
+        clearInterval(renewal);
+        options.signal?.removeEventListener('abort', onAbort);
+        signal.removeEventListener('abort', releaseOnAbort);
+        await releaseReservedCharges(reservation);
     }
 }
 //# sourceMappingURL=MeteredStream.js.map

package/dist/tempo/session/server/RequestState.d.ts

@@ -18,6 +18,10 @@ export type ResolveSessionSnapshotParameters = {
     channelId: Hex | undefined;
     /** Payment fields the reusable channel must match before it is advertised. */
     expected?: SessionSnapshotPaymentFields | undefined;
+    /** Minimum raw-unit increase required when the next voucher must advance. */
+    minimumVoucherAdvance?: bigint | undefined;
+    /** Whether the next voucher must advance beyond the accepted cumulative amount. */
+    requireVoucherAdvance?: boolean | undefined;
     /** Server channel store. */
     store: ChannelStore.ChannelStore;
 };
@@ -149,12 +153,14 @@ export type ResolveSessionPaymentRequestParameters = {
     decimals: number;
     defaultFeePayer?: viem_Account | undefined;
     getClient: ResolveRequestChainIdParameters['getClient'];
+    minVoucherDelta?: string | undefined;
     parameterChainId?: number | undefined;
     parameterEscrowContract?: Address | undefined;
     parameterFeePayer?: ParameterFeePayer;
     request: SessionPaymentRequestInput;
     resolveChannelId?: ResolveSessionChannelId | undefined;
     source?: string | undefined;
+    sseEnabled?: boolean | undefined;
     store: ChannelStore.ChannelStore;
 };
 /** Inputs used to resolve shared context for credential verification. */

package/dist/tempo/session/server/RequestState.js

@@ -47,7 +47,7 @@ export async function resolveSessionChannelId(parameters) {
 }
 /** Builds server bootstrap hints for a reusable precompile session channel. */
 export async function resolveSessionSnapshot(parameters) {
-    const { amount, channelId, expected, store } = parameters;
+    const { amount, channelId, expected, minimumVoucherAdvance = 0n, requireVoucherAdvance = false, store, } = parameters;
     if (!channelId)
         return undefined;
     const channel = await store.getChannel(ChannelStore.normalizeChannelId(channelId));
@@ -63,7 +63,11 @@ export async function resolveSessionSnapshot(parameters) {
         return undefined;
     if (expected && !matchesSnapshotPaymentFields(channel, expected))
         return undefined;
-    const requiredCumulative = channel.spent + amount;
+    const spendBoundary = channel.spent + amount;
+    const advanceBoundary = requireVoucherAdvance
+        ? channel.highestVoucherAmount + (minimumVoucherAdvance > 0n ? minimumVoucherAdvance : 1n)
+        : 0n;
+    const requiredCumulative = spendBoundary > advanceBoundary ? spendBoundary : advanceBoundary;
     return {
         acceptedCumulative: channel.highestVoucherAmount.toString(),
         chainId: channel.chainId,
@@ -158,7 +162,7 @@ export async function resolveRequestChainId(parameters) {
 }
 /** Resolves request-time TIP-1034 details and server bootstrap hints for a challenge. */
 export async function resolveSessionPaymentRequest(parameters) {
-    const { capturedRequest, credential, decimals, defaultFeePayer, getClient, parameterChainId, parameterEscrowContract, parameterFeePayer, request, resolveChannelId, source, store, } = parameters;
+    const { capturedRequest, credential, decimals, defaultFeePayer, getClient, minVoucherDelta, parameterChainId, parameterEscrowContract, parameterFeePayer, request, resolveChannelId, source, sseEnabled, store, } = parameters;
     const chainId = await resolveRequestChainId({
         getClient,
         parameterChainId,
@@ -172,6 +176,7 @@ export async function resolveSessionPaymentRequest(parameters) {
     const escrowContract = resolveRequestEscrowContract(request.escrowContract, parameterEscrowContract);
     const operator = resolveRequestOperator(request.operator);
     const requestAmount = parseUnits(request.amount, decimals);
+    const isContentRequest = capturedRequest ? isSessionContentRequest(capturedRequest) : false;
     const channelId = await resolveSessionChannelId({
         capturedRequest,
         credential,
@@ -181,7 +186,7 @@ export async function resolveSessionPaymentRequest(parameters) {
         store,
     });
     const sessionSnapshot = await resolveSessionSnapshot({
-        amount: capturedRequest && !isSessionContentRequest(capturedRequest) ? 0n : requestAmount,
+        amount: capturedRequest && !isContentRequest ? 0n : requestAmount,
         channelId,
         expected: {
             chainId,
@@ -189,6 +194,8 @@ export async function resolveSessionPaymentRequest(parameters) {
             escrowContract,
             recipient: readChallengeAddress(request.recipient, 'recipient'),
         },
+        minimumVoucherAdvance: parseUnits(minVoucherDelta ?? '0', decimals),
+        requireVoucherAdvance: Boolean(capturedRequest) && !sseEnabled && isContentRequest,
         store,
     });
     const { operator: _operator, ...requestWithoutOperator } = request;

package/dist/tempo/session/server/Session.d.ts

@@ -59,6 +59,7 @@ export declare function session<const parameters extends session.Parameters>(p?:
             }, import("zod/v4/core").$strip>, import("zod/mini").ZodMiniObject<{
                 action: import("zod/mini").ZodMiniLiteral<"close">;
                 channelId: import("zod/mini").ZodMiniString<string>;
+                closeSignature: import("zod/mini").ZodMiniString<string>;
                 cumulativeAmount: import("zod/mini").ZodMiniString<string>;
                 descriptor: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniCustom<import("../precompile/Protocol.js").ChannelDescriptor, import("../precompile/Protocol.js").ChannelDescriptor>>;
                 signature: import("zod/mini").ZodMiniString<string>;
@@ -137,7 +138,7 @@ export declare namespace session {
     type FeePayerPolicy = Partial<FeePayer.Policy>;
     /** Parameters accepted by the TIP-1034 server session payment method. */
     type Parameters = {
-        /** TTL in milliseconds for cached on-chain channel state. After this duration, the server re-queries on-chain state during voucher handling to detect forced close requests. @default 5_000 */
+        /** TTL in milliseconds for cached on-chain channel state during non-mutating validation. Voucher acceptance always refreshes on-chain state. @default 5_000 */
         channelStateTtl?: number | undefined;
         /** Override the fee-sponsor policy used for sponsored open/topUp transactions and server-driven close transactions. */
         feePayerPolicy?: FeePayerPolicy | undefined;

package/dist/tempo/session/server/Session.js

@@ -26,7 +26,7 @@ import { broadcastCredentialPayload, validateCredentialPayload } from './Credent
 import { requireSessionCredentialPayload } from './CredentialVerification.js';
 import { resolveCredentialVerificationContext, resolveSessionChannelId, resolveSessionSnapshot, resolveSessionPaymentRequest, } from './RequestState.js';
 import { respondToSessionCredential } from './RequestState.js';
-import { applyVerifiedHttpAccounting, chargeSessionChannel, } from './Settlement.js';
+import { applyVerifiedHttpAccounting, chargeSessionChannel, shouldApplyVerifiedHttpAccounting, } from './Settlement.js';
 import { isSettlementDue, maybeSettleScheduled } from './Settlement.js';
 import { resolveSettlementSchedule, } from './Settlement.js';
 import * as Ws from './Ws.js';
@@ -243,7 +243,7 @@ export function session(p) {
             ...(typeof parameters.sse === 'object' ? parameters.sse : undefined),
         })
         : undefined;
-    const validateCredential = async ({ credential, request, }) => {
+    const validateCredential = async ({ credential, operation, request, }) => {
         const payload = requireSessionCredentialPayload(credential.payload);
         const context = await resolveCredentialVerificationContext({
             decimals,
@@ -254,6 +254,7 @@ export function session(p) {
         });
         const details = await validateCredentialPayload({
             account,
+            allowPendingClose: operation === 'broadcast',
             challenge: credential.challenge,
             channelStateTtl,
             chainId: context.chainId,
@@ -305,6 +306,11 @@ export function session(p) {
             minVoucherDelta: context.minVoucherDelta,
             onSessionSettlement,
             payload,
+            requireVoucherAdvance: shouldApplyVerifiedHttpAccounting({
+                capturedRequest: envelope?.capturedRequest,
+                payloadAction: payload.action,
+                sseEnabled: Boolean(parameters.sse),
+            }),
             store,
         });
         return applyVerifiedHttpAccounting({
@@ -372,11 +378,13 @@ export function session(p) {
                 decimals,
                 defaultFeePayer: feePayer,
                 getClient,
+                minVoucherDelta: parameters.minVoucherDelta,
                 parameterChainId: parameters.chainId,
                 parameterEscrowContract: parameters.escrowContract,
                 parameterFeePayer: configuredFeePayer,
                 request,
                 resolveChannelId: parameters.resolveChannelId,
+                sseEnabled: Boolean(parameters.sse),
                 store,
             });
             return {

package/dist/tempo/session/server/Settlement.d.ts

@@ -89,6 +89,7 @@ export type OnSessionSettlement = (context: SessionSettlementContext) => MaybePr
 /** Inputs used to mark a channel after automatic scheduled settlement succeeds. */
 export type MarkSettlementCompleteParameters = {
     channelId: ChannelStore.State['channelId'];
+    leaseOwner: string;
     settledAt?: string | undefined;
     store: ChannelStore.ChannelStore;
 };
@@ -106,6 +107,26 @@ export declare function resolveSettlementProgress(channel: ChannelStore.State):
 export declare function isSettlementDue(channel: ChannelStore.State, schedule: ResolvedSettlementSchedule | undefined): boolean;
 /** Records the channel spend/unit counters that a scheduled settlement captured. */
 export declare function markSettlementComplete(parameters: MarkSettlementCompleteParameters): Promise<void>;
+/** Atomically claims one due scheduled settlement across server workers. */
+export declare function claimScheduledSettlement(parameters: {
+    channelId: Hex;
+    leaseMs?: number | undefined;
+    schedule: ResolvedSettlementSchedule;
+    store: ChannelStore.ChannelStore;
+}): Promise<string | undefined>;
+/** Extends an owned scheduled settlement lease while its transaction is in flight. */
+export declare function renewScheduledSettlement(parameters: {
+    channelId: Hex;
+    leaseMs?: number | undefined;
+    leaseOwner: string;
+    store: ChannelStore.ChannelStore;
+}): Promise<void>;
+/** Releases a scheduled settlement claim after a failed attempt. */
+export declare function releaseScheduledSettlement(parameters: {
+    channelId: Hex;
+    leaseOwner: string;
+    store: ChannelStore.ChannelStore;
+}): Promise<void>;
 /** Callback used by post-verification accounting to deduct spend from a channel. */
 export type ChargeSessionChannel = (channelId: Hex, amount: bigint) => Promise<ChannelStore.State>;
 /** Callback used by post-verification accounting to run server-owned settlement policy. */
@@ -138,6 +159,8 @@ export type ApplyVerifiedHttpAccountingParameters = {
     /** Runs optional server settlement policy after a successful content charge. */
     settleCharged: SettleChargedSessionChannel;
 };
+/** Returns whether an accepted credential will authorize and charge an HTTP content response. */
+export declare function shouldApplyVerifiedHttpAccounting(parameters: Pick<ApplyVerifiedHttpAccountingParameters, 'capturedRequest' | 'payloadAction' | 'sseEnabled'>): boolean;
 /** Applies the default HTTP content charge after a session credential has been accepted. */
 export declare function applyVerifiedHttpAccounting(parameters: ApplyVerifiedHttpAccountingParameters): Promise<SessionReceipt>;
 /** Atomically deducts spend from a channel and maps store failures to typed session errors. */

package/dist/tempo/session/server/Settlement.js

@@ -46,8 +46,9 @@ export function resolveCredentialFeePayer(parameters) {
         return requestFeePayer;
     if (typeof feePayer === 'object')
         return feePayer;
-    return typeof feePayer === 'string' ? true : undefined;
+    return feePayer === true || typeof feePayer === 'string' ? true : undefined;
 }
+const scheduledSettlementLeaseMs = 5 * 60_000;
 /** Converts a public settlement schedule into raw-unit thresholds. */
 export function resolveSettlementSchedule(schedule, decimals) {
     if (!schedule)
@@ -93,6 +94,9 @@ export function isSettlementDue(channel, schedule) {
     const progress = resolveSettlementProgress(channel);
     if (!progress)
         return false;
+    // A detected force-close makes outstanding vouchers immediately due.
+    if (!channel.finalized && channel.closeRequestedAt > 0n)
+        return true;
     if (schedule.units !== undefined && progress.units >= schedule.units)
         return true;
     if (schedule.amount !== undefined && progress.amount >= schedule.amount)
@@ -103,26 +107,79 @@ export function isSettlementDue(channel, schedule) {
 }
 /** Records the channel spend/unit counters that a scheduled settlement captured. */
 export async function markSettlementComplete(parameters) {
-    const { channelId, store, settledAt = new Date().toISOString() } = parameters;
-    await store.updateChannel(channelId, (current) => current
-        ? {
-            ...current,
+    const { channelId, leaseOwner, store, settledAt = new Date().toISOString() } = parameters;
+    await store.updateChannel(channelId, (current) => {
+        if (!current)
+            return current;
+        if (current.scheduledSettlementLease?.owner !== leaseOwner)
+            return current;
+        const { scheduledSettlementLease: _, ...channel } = current;
+        return {
+            ...channel,
             lastSettlementAt: settledAt,
             lastSettlementSpent: current.spent,
             lastSettlementUnits: current.units,
-        }
-        : current);
+        };
+    });
 }
-/** Applies the default HTTP content charge after a session credential has been accepted. */
-export async function applyVerifiedHttpAccounting(parameters) {
-    const { capturedRequest, payloadAction, receipt, sseEnabled } = parameters;
+/** Atomically claims one due scheduled settlement across server workers. */
+export async function claimScheduledSettlement(parameters) {
+    const { channelId, leaseMs = scheduledSettlementLeaseMs, schedule, store } = parameters;
+    const now = Date.now();
+    const owner = globalThis.crypto.randomUUID();
+    let claimed = false;
+    await store.updateChannel(channelId, (current) => {
+        claimed = false;
+        if (!current || !isSettlementDue(current, schedule))
+            return current;
+        const lease = current.scheduledSettlementLease;
+        if (lease && lease.expiresAt > now)
+            return current;
+        claimed = true;
+        return {
+            ...current,
+            scheduledSettlementLease: { expiresAt: now + leaseMs, owner },
+        };
+    });
+    return claimed ? owner : undefined;
+}
+/** Extends an owned scheduled settlement lease while its transaction is in flight. */
+export async function renewScheduledSettlement(parameters) {
+    const { channelId, leaseMs = scheduledSettlementLeaseMs, leaseOwner, store } = parameters;
+    await store.updateChannel(channelId, (current) => {
+        if (!current || current.scheduledSettlementLease?.owner !== leaseOwner)
+            return current;
+        return {
+            ...current,
+            scheduledSettlementLease: { expiresAt: Date.now() + leaseMs, owner: leaseOwner },
+        };
+    });
+}
+/** Releases a scheduled settlement claim after a failed attempt. */
+export async function releaseScheduledSettlement(parameters) {
+    const { channelId, leaseOwner, store } = parameters;
+    await store.updateChannel(channelId, (current) => {
+        if (!current || current.scheduledSettlementLease?.owner !== leaseOwner)
+            return current;
+        const { scheduledSettlementLease: _, ...channel } = current;
+        return channel;
+    });
+}
+/** Returns whether an accepted credential will authorize and charge an HTTP content response. */
+export function shouldApplyVerifiedHttpAccounting(parameters) {
+    const { capturedRequest, payloadAction, sseEnabled } = parameters;
     if (!capturedRequest)
-        return receipt;
+        return false;
     if (payloadAction !== 'open' && payloadAction !== 'voucher')
-        return receipt;
+        return false;
     if (sseEnabled && capturedRequest.method === 'POST')
-        return receipt;
-    if (!isSessionContentRequest(capturedRequest))
+        return false;
+    return isSessionContentRequest(capturedRequest);
+}
+/** Applies the default HTTP content charge after a session credential has been accepted. */
+export async function applyVerifiedHttpAccounting(parameters) {
+    const { receipt, sseEnabled } = parameters;
+    if (!shouldApplyVerifiedHttpAccounting(parameters))
         return receipt;
     const requestAmount = parameters.getRequestAmount();
     const charged = await parameters.charge(receipt.channelId, requestAmount);
@@ -185,19 +242,42 @@ export function assertSettlementSender(parameters) {
 /** Applies automatic settlement when the server-owned schedule is due. */
 export async function maybeSettleScheduled(parameters) {
     const { channel, schedule, store } = parameters;
-    if (!isSettlementDue(channel, schedule))
+    if (!schedule || !isSettlementDue(channel, schedule))
         return undefined;
-    const txHash = await settle(store, parameters.client, channel.channelId, {
-        account: parameters.account,
-        ...(parameters.feePayer ? { feePayer: parameters.feePayer } : {}),
-        ...(parameters.feePayerPolicy ? { feePayerPolicy: parameters.feePayerPolicy } : {}),
-        ...(parameters.feeToken ? { feeToken: parameters.feeToken } : {}),
-        onSessionSettlement: parameters.onSessionSettlement
-            ? (ctx) => parameters.onSessionSettlement({ ...ctx, trigger: 'scheduled' })
-            : undefined,
+    const leaseOwner = await claimScheduledSettlement({
+        channelId: channel.channelId,
+        schedule,
+        store,
     });
-    await markSettlementComplete({ channelId: channel.channelId, store });
-    return txHash;
+    if (!leaseOwner)
+        return undefined;
+    const renewal = setInterval(() => {
+        void renewScheduledSettlement({
+            channelId: channel.channelId,
+            leaseOwner,
+            store,
+        }).catch(() => undefined);
+    }, scheduledSettlementLeaseMs / 2);
+    try {
+        const txHash = await settle(store, parameters.client, channel.channelId, {
+            account: parameters.account,
+            ...(parameters.feePayer ? { feePayer: parameters.feePayer } : {}),
+            ...(parameters.feePayerPolicy ? { feePayerPolicy: parameters.feePayerPolicy } : {}),
+            ...(parameters.feeToken ? { feeToken: parameters.feeToken } : {}),
+            onSessionSettlement: parameters.onSessionSettlement
+                ? (ctx) => parameters.onSessionSettlement({ ...ctx, trigger: 'scheduled' })
+                : undefined,
+        });
+        await markSettlementComplete({ channelId: channel.channelId, leaseOwner, store });
+        return txHash;
+    }
+    catch (error) {
+        await releaseScheduledSettlement({ channelId: channel.channelId, leaseOwner, store }).catch(() => undefined);
+        throw error;
+    }
+    finally {
+        clearInterval(renewal);
+    }
 }
 /** Settles the highest accepted voucher for a precompile-backed session channel. */
 export async function settle(store_, client, channelId_, options) {