@bymax-one/nest-ai-tokens 1.0.2 → 1.0.4

package/CHANGELOG.md

@@ -8,6 +8,57 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) and
 
 ## [Unreleased]
 
+## [1.0.4] - 2026-08-10
+
+Remediation of a local audit's settlement findings (merged in #65). No API changed.
+
+### Fixed
+
+- **Negative usage can no longer credit the wallet or budget.** `clampUsageCounts` floors every
+  token count — and the provider-reported cost (`providerReportedCostNanoUsd`) — at zero before the
+  signed settlement leg. A normalizer that computes a field by subtraction (OpenRouter's
+  `prompt - cached`), or a provider that reports a negative `usage.cost`, would otherwise credit
+  back more than was reserved and drive budget consumption negative.
+- **Streaming captures are clamped like non-stream captures.** `finalizeCaptureUsage` now routes
+  the `StreamUsageCollector` final through `normalizeCaptureUsage`, so a provider-final stream
+  carrying negative counts or cost no longer bypasses the floor and reaches settlement raw.
+
+### Documentation
+
+- `RecordInput.occurredAt` documents its trust model: it is a deliberate backfill feature, honoured
+  as given because `record()`'s input is trusted host input, and a host that forwards a value an
+  untrusted end user controls must validate it first — a back-dated timestamp selects a historical
+  price and an earlier budget window.
+
+## [1.0.3] - 2026-08-06
+
+### Fixed
+
+- **Every suppression reason was dropped from the mutation report.** All 249 `// Stryker
+  disable` directives in the source wrote their justification after `--`. Stryker reads a
+  directive with one regular expression, `/^\s?Stryker (disable|restore)(?: (next-line))?
+  ([a-zA-Z, ]+)(?::(.+)?)?/`, whose mutator list accepts letters, commas and spaces only
+  and which captures the reason exclusively after a colon. A `-` therefore closed the
+  mutator list and left the reason unmatched, so each directive still silenced its mutant
+  but the report recorded Stryker's fallback text, `Ignored using a comment`. The README
+  claimed the opposite — that every suppression carries its reason — and documented the
+  broken separator as the convention. The directives now use `<Mutator>: <reason>`, which
+  is the grammar the parser accepts, and the reasons reach the report.
+
+### Added
+
+- `check:mutants` gate (`scripts/check-mutation-directives.mjs`) — validates every
+  `// Stryker` comment against the parser's own regular expression, rejecting a reason
+  written after `--`, a reason wrapped onto a second comment line (the report keeps only
+  the first fragment), and a mutator name Stryker does not know, which would silence
+  nothing at all. Wired into CI and `prepublishOnly`. Stryker warns about the last case,
+  but only during a mutation run, which on this repo happens post-merge.
+
+### Changed
+
+- No runtime behaviour changed. `dist/` differs only in the text of those comments; the
+  server bundle moved from 38,096 to 38,145 B brotli, well inside its 40,000 B budget.
+
 ## [1.0.2] - 2026-08-05
 
 ### Fixed
@@ -164,4 +215,6 @@ have regressed from. They are kept because the reasoning is worth having.
 [1.0.0]: https://github.com/bymaxone/nest-ai-tokens/releases/tag/v1.0.0
 [1.0.1]: https://github.com/bymaxone/nest-ai-tokens/compare/v1.0.0...v1.0.1
 [1.0.2]: https://github.com/bymaxone/nest-ai-tokens/compare/v1.0.1...v1.0.2
-[Unreleased]: https://github.com/bymaxone/nest-ai-tokens/compare/v1.0.2...HEAD
+[1.0.4]: https://github.com/bymaxone/nest-ai-tokens/compare/v1.0.3...v1.0.4
+[1.0.3]: https://github.com/bymaxone/nest-ai-tokens/compare/v1.0.2...v1.0.3
+[Unreleased]: https://github.com/bymaxone/nest-ai-tokens/compare/v1.0.4...HEAD

package/README.md

@@ -742,9 +742,11 @@ tests pass".
   system does, `check:runtime` loads every subpath from the packed tarball in ESM and
   CommonJS, and `check:published` compiles this README's snippets against `dist/`
 - ✅ **Every suppression carries its reason** — no coverage directives anywhere; each
-  `// Stryker disable` in the production source states, after `--`, why the mutant it
-  silences is unobservable from a unit test (an internal error context, a provider id
-  reached only through integration)
+  `// Stryker disable` in the production source states, after the `:` Stryker reads it
+  from, why the mutant it silences is unobservable from a unit test (an internal error
+  context, a provider id reached only through integration). `check:mutants` proves the
+  reasons parse, so they reach the mutation report instead of being replaced by
+  Stryker's `Ignored using a comment` fallback
 
 ```bash
 pnpm test          # unit tests

package/dist/prisma/index.cjs

@@ -276,7 +276,7 @@ function computePayloadHash(record) {
 // src/server/utils/hash-chain.ts
 function chainHash(prevHash, record) {
   return deriveIdempotencyKey({
-    // Stryker disable next-line StringLiteral -- empty-string fallback for null prevHash; tests only verify hash determinism and inequality, not the specific hash value for a genesis block
+    // Stryker disable next-line StringLiteral: empty-string fallback for null prevHash; tests only verify hash determinism and inequality, not the specific hash value for a genesis block
     prevHash: prevHash ?? "",
     id: record.id,
     content: computePayloadHash(record)

package/dist/prisma/index.mjs

@@ -274,7 +274,7 @@ function computePayloadHash(record) {
 // src/server/utils/hash-chain.ts
 function chainHash(prevHash, record) {
   return deriveIdempotencyKey({
-    // Stryker disable next-line StringLiteral -- empty-string fallback for null prevHash; tests only verify hash determinism and inequality, not the specific hash value for a genesis block
+    // Stryker disable next-line StringLiteral: empty-string fallback for null prevHash; tests only verify hash determinism and inequality, not the specific hash value for a genesis block
     prevHash: prevHash ?? "",
     id: record.id,
     content: computePayloadHash(record)

package/dist/server/index.cjs

@@ -362,9 +362,9 @@ function normalizeMistralUsage(raw) {
     provider: "mistral",
     model: str(response.model) ?? "",
     operation: "chat",
-    // Stryker disable next-line StringLiteral -- provider and field names in error messages are internal diagnostics
+    // Stryker disable next-line StringLiteral: provider and field names in error messages are internal diagnostics
     inputTokens: requireNum(usage.prompt_tokens, "mistral", "usage.prompt_tokens"),
-    // Stryker disable next-line StringLiteral -- provider and field names in error messages are internal diagnostics
+    // Stryker disable next-line StringLiteral: provider and field names in error messages are internal diagnostics
     outputTokens: requireNum(usage.completion_tokens, "mistral", "usage.completion_tokens"),
     raw: usage
   });
@@ -808,7 +808,7 @@ function validatePricing(options) {
   if (cacheTtlMs === void 0) return;
   if (!Number.isInteger(cacheTtlMs) || cacheTtlMs <= 0) {
     throw invalidConfig(
-      // Stryker disable next-line StringLiteral -- error reason template is internal diagnostics
+      // Stryker disable next-line StringLiteral: error reason template is internal diagnostics
       `pricing.cacheTtlMs must be a positive integer number of milliseconds, received ${String(cacheTtlMs)}`
     );
   }
@@ -1128,7 +1128,7 @@ exports.BudgetGuard = class BudgetGuard {
     this.reflector = reflector;
     if (options.scopeResolver === void 0) {
       throw new AiTokensException("AI_TOKENS_INVALID_CONFIG", void 0, {
-        // Stryker disable next-line StringLiteral -- error reason text is internal diagnostics
+        // Stryker disable next-line StringLiteral: error reason text is internal diagnostics
         reason: "BudgetGuard requires options.scopeResolver to resolve the caller scope"
       });
     }
@@ -1359,7 +1359,7 @@ function computePayloadHash(record) {
 // src/server/utils/hash-chain.ts
 function chainHash(prevHash, record) {
   return deriveIdempotencyKey({
-    // Stryker disable next-line StringLiteral -- empty-string fallback for null prevHash; tests only verify hash determinism and inequality, not the specific hash value for a genesis block
+    // Stryker disable next-line StringLiteral: empty-string fallback for null prevHash; tests only verify hash determinism and inequality, not the specific hash value for a genesis block
     prevHash: prevHash ?? "",
     id: record.id,
     content: computePayloadHash(record)
@@ -1560,7 +1560,7 @@ exports.LedgerService = class LedgerService {
     const original = await this.store.findById(recordId);
     if (original?.status !== "posted") {
       throw new AiTokensException("AI_TOKENS_IDEMPOTENCY_CONFLICT", void 0, {
-        // Stryker disable next-line StringLiteral -- error reason text is internal diagnostics
+        // Stryker disable next-line StringLiteral: error reason text is internal diagnostics
         reason: original === null ? "record not found" : `cannot reverse a ${original.status} record`,
         recordId,
         requestedReason: reason
@@ -1581,7 +1581,7 @@ exports.LedgerService = class LedgerService {
   assertLegalTransition(from2, to, patch) {
     if (!isLegalLedgerTransition(from2, to)) {
       throw new AiTokensException("AI_TOKENS_IDEMPOTENCY_CONFLICT", void 0, {
-        // Stryker disable next-line StringLiteral -- error reason template is internal diagnostics
+        // Stryker disable next-line StringLiteral: error reason template is internal diagnostics
         reason: `illegal transition ${from2} \u2192 ${to}`
       });
     }
@@ -1589,7 +1589,7 @@ exports.LedgerService = class LedgerService {
     for (const key of Object.keys(patch)) {
       if (!isLegalTransitionPatchKey(from2, to, key)) {
         throw new AiTokensException("AI_TOKENS_IDEMPOTENCY_CONFLICT", void 0, {
-          // Stryker disable next-line StringLiteral -- error reason template is internal diagnostics
+          // Stryker disable next-line StringLiteral: error reason template is internal diagnostics
           reason: `${from2} \u2192 ${to} may not patch "${key}"`
         });
       }
@@ -1608,13 +1608,13 @@ function buildCompensatingRecord(original) {
   return {
     tenantId: original.tenantId,
     scope: original.scope,
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { beneficiary: undefined } is equivalent to {} because downstream consumers check !== undefined
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { beneficiary: undefined } is equivalent to {} because downstream consumers check !== undefined
     ...original.beneficiary !== void 0 ? { beneficiary: original.beneficiary } : {},
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { requestedBy: undefined } is equivalent to {}
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { requestedBy: undefined } is equivalent to {}
     ...original.requestedBy !== void 0 ? { requestedBy: original.requestedBy } : {},
     provider: original.provider,
     model: original.model,
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { requestedModel: undefined } is equivalent to {}
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { requestedModel: undefined } is equivalent to {}
     ...original.requestedModel !== void 0 ? { requestedModel: original.requestedModel } : {},
     operation: original.operation,
     serviceTier: original.serviceTier,
@@ -1630,7 +1630,7 @@ function buildCompensatingRecord(original) {
     audioOutTokens: -original.audioOutTokens,
     imageInTokens: -original.imageInTokens,
     imageOutTokens: -original.imageOutTokens,
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { extraUnits: undefined } is equivalent to {} because consumers check !== undefined
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { extraUnits: undefined } is equivalent to {} because consumers check !== undefined
     ...original.extraUnits !== void 0 ? { extraUnits: negateUnits(original.extraUnits) } : {},
     priceVersionId: original.priceVersionId,
     rawCostNanoUsd: -original.rawCostNanoUsd,
@@ -1641,12 +1641,12 @@ function buildCompensatingRecord(original) {
     priceMissing: original.priceMissing,
     status: "posted",
     reversesRecordId: original.id,
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { correlationId: undefined } is equivalent to {}
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { correlationId: undefined } is equivalent to {}
     ...original.correlationId !== void 0 ? { correlationId: original.correlationId } : {},
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { requestId: undefined } is equivalent to {}
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { requestId: undefined } is equivalent to {}
     ...original.requestId !== void 0 ? { requestId: original.requestId } : {},
     isSystemCost: original.isSystemCost,
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { systemCostCategory: undefined } is equivalent to {}
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { systemCostCategory: undefined } is equivalent to {}
     ...original.systemCostCategory !== void 0 ? { systemCostCategory: original.systemCostCategory } : {},
     enforced: original.enforced,
     occurredAt: original.occurredAt
@@ -1683,7 +1683,7 @@ var MarkupResolver = class {
       return await policy.resolve(context);
     } catch {
       throw new AiTokensException("AI_TOKENS_INVALID_CONFIG", void 0, {
-        // Stryker disable next-line StringLiteral -- error reason text is internal diagnostics
+        // Stryker disable next-line StringLiteral: error reason text is internal diagnostics
         reason: "markup policy failed to resolve a multiplier"
       });
     }
@@ -1694,7 +1694,7 @@ var MarkupResolver = class {
       return resolveMultiplier4dp(raw);
     } catch {
       throw new AiTokensException("AI_TOKENS_INVALID_CONFIG", void 0, {
-        // Stryker disable next-line StringLiteral -- error reason text is internal diagnostics
+        // Stryker disable next-line StringLiteral: error reason text is internal diagnostics
         reason: "markup policy returned an invalid multiplier",
         value: raw
       });
@@ -2126,6 +2126,19 @@ function tokenCountsOf(usage) {
 function sumTokenCounts(counts) {
   return TOKEN_FIELDS.reduce((total, field) => total + counts[field], 0);
 }
+function clampUsageCounts(usage) {
+  const counts = tokenCountsOf(usage);
+  const clamped = zeroTokenCounts();
+  for (const field of TOKEN_FIELDS) {
+    clamped[field] = counts[field] < 0 ? 0 : counts[field];
+  }
+  const result = { ...usage, ...clamped };
+  const cost = usage.providerReportedCostNanoUsd;
+  if (cost !== void 0 && cost < 0n) {
+    return { ...result, providerReportedCostNanoUsd: 0n };
+  }
+  return result;
+}
 function isNormalizedUsage(usage) {
   if (typeof usage !== "object" || usage === null) return false;
   const candidate = usage;
@@ -2163,7 +2176,7 @@ async function resolveHoldEstimate(pricing, context, estimate, at) {
       operation: estimate.operation,
       serviceTier: tier,
       at,
-      // Stryker disable next-line ConditionalExpression -- CE true: spreading { baseModel: undefined } is equivalent to {} because resolveRate reads input.baseModel (undefined either way) — same cache key and same `baseModel !== undefined` resolution branch
+      // Stryker disable next-line ConditionalExpression: CE true: spreading { baseModel: undefined } is equivalent to {} because resolveRate reads input.baseModel (undefined either way) — same cache key and same `baseModel !== undefined` resolution branch
       ...context.baseModel !== void 0 ? { baseModel: context.baseModel } : {}
     });
     const rawEstimateNanoUsd = rate === null ? 0n : computeCostNanoUsd(usage, rate).totalNanoUsd;
@@ -2187,7 +2200,7 @@ async function resolveHoldEstimate(pricing, context, estimate, at) {
 async function resolveTokenEstimate(pricing, context, tokens, serviceTier, at) {
   if (context.preset === void 0) {
     throw new AiTokensException("AI_TOKENS_INVALID_CONFIG", void 0, {
-      // Stryker disable next-line StringLiteral -- error reason text is internal diagnostics
+      // Stryker disable next-line StringLiteral: error reason text is internal diagnostics
       reason: "a { tokens } hold estimate requires context.preset to identify the provider"
     });
   }
@@ -2202,17 +2215,17 @@ async function resolveTokenEstimate(pricing, context, tokens, serviceTier, at) {
   return { provider, model, operation: "chat", serviceTier, rawEstimateNanoUsd, estimatedTokens: tokens, tokenCounts };
 }
 function normalizeCaptureUsage(usage, normalizer) {
-  if (isNormalizedUsage(usage)) return usage;
+  if (isNormalizedUsage(usage)) return clampUsageCounts(usage);
   if (normalizer !== void 0) {
     try {
-      return normalizer(usage);
+      return clampUsageCounts(normalizer(usage));
     } catch (error) {
       if (error instanceof AiTokensException) throw error;
       throw new AiTokensException("AI_TOKENS_USAGE_MALFORMED", void 0, { reason: "the normalizer could not read the usage token fields" });
     }
   }
   throw new AiTokensException("AI_TOKENS_USAGE_MALFORMED", void 0, {
-    // Stryker disable next-line StringLiteral -- error reason text is internal diagnostics
+    // Stryker disable next-line StringLiteral: error reason text is internal diagnostics
     reason: "capture requires an already-normalized usage or a preset normalizer"
   });
 }
@@ -2241,7 +2254,7 @@ function buildAppendInput(args) {
     audioOutTokens: normalized.audioOutTokens,
     imageInTokens: normalized.imageInTokens,
     imageOutTokens: normalized.imageOutTokens,
-    // Stryker disable next-line ConditionalExpression,EqualityOperator -- CE/EQ: when ratedUnits is empty, spreading { extraUnits: {} } vs omitting the key; downstream consumers check record.extraUnits !== undefined (absent vs present {}); unit tests don't use server tool use, so ratedUnits={} always → no observable difference
+    // Stryker disable next-line ConditionalExpression,EqualityOperator: CE/EQ: when ratedUnits is empty, spreading { extraUnits: {} } vs omitting the key; downstream consumers check record.extraUnits !== undefined (absent vs present {}); unit tests don't use server tool use, so ratedUnits={} always → no observable difference
     ...Object.keys(ratedUnits).length > 0 ? { extraUnits: ratedUnits } : {},
     priceVersionId: rating.priceVersionId,
     rawCostNanoUsd: rating.rawCostNanoUsd,
@@ -2252,7 +2265,7 @@ function buildAppendInput(args) {
     priceMissing: rating.priceMissing,
     status: "posted",
     isSystemCost: context.isSystemCost ?? false,
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { systemCostCategory: undefined } is equivalent to {} because JS property access treats absent and undefined the same
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { systemCostCategory: undefined } is equivalent to {} because JS property access treats absent and undefined the same
     ...context.systemCostCategory !== void 0 ? { systemCostCategory: context.systemCostCategory } : {},
     enforced,
     occurredAt
@@ -2262,19 +2275,19 @@ function baseColumns(usage, context, serviceTier) {
   return {
     tenantId: context.tenantId,
     scope: context.scope,
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { beneficiary: undefined } is equivalent to {} for property access and truthiness-based filters
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { beneficiary: undefined } is equivalent to {} for property access and truthiness-based filters
     ...context.beneficiary !== void 0 ? { beneficiary: context.beneficiary } : {},
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { requestedBy: undefined } is equivalent to {}
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { requestedBy: undefined } is equivalent to {}
     ...context.requestedBy !== void 0 ? { requestedBy: context.requestedBy } : {},
     provider: usage.provider,
     model: usage.model,
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { requestedModel: undefined } is equivalent to {} for downstream consumers
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { requestedModel: undefined } is equivalent to {} for downstream consumers
     ...context.baseModel !== void 0 ? { requestedModel: context.baseModel } : {},
     operation: usage.operation,
     serviceTier,
     feature: context.feature,
     tags: context.tags ?? [],
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { correlationId: undefined } is equivalent to {} because it's only read via record.correlationId
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { correlationId: undefined } is equivalent to {} because it's only read via record.correlationId
     ...context.correlationId !== void 0 ? { correlationId: context.correlationId } : {}
   };
 }
@@ -2336,7 +2349,7 @@ exports.MeteringService = class MeteringService {
     const enforcing = context.enforce === true;
     if (enforcing && this.wallets === void 0 && this.budgets === void 0) {
       throw new AiTokensException("AI_TOKENS_INVALID_CONFIG", void 0, {
-        // Stryker disable next-line StringLiteral -- error reason text is internal diagnostics
+        // Stryker disable next-line StringLiteral: error reason text is internal diagnostics
         reason: "enforce requires the wallets or budgets feature to be enabled"
       });
     }
@@ -2391,7 +2404,7 @@ exports.MeteringService = class MeteringService {
       model: input.model,
       operation: input.operation,
       serviceTier,
-      // Stryker disable next-line ConditionalExpression -- CE true: spreading { feature: undefined } is equivalent to {} because markup.resolve treats absent and undefined feature the same
+      // Stryker disable next-line ConditionalExpression: CE true: spreading { feature: undefined } is equivalent to {} because markup.resolve treats absent and undefined feature the same
       ...input.feature !== void 0 ? { feature: input.feature } : {}
     });
     return { rawCostNanoUsd, billedCostNanoUsd: markup.apply(rawCostNanoUsd) };
@@ -2593,7 +2606,7 @@ exports.MeteringService = class MeteringService {
           priceMissing: false,
           status: "pending",
           isSystemCost,
-          // Stryker disable next-line ConditionalExpression -- CE true: spreading { systemCostCategory: undefined } is equivalent to {}
+          // Stryker disable next-line ConditionalExpression: CE true: spreading { systemCostCategory: undefined } is equivalent to {}
           ...context.systemCostCategory !== void 0 ? { systemCostCategory: context.systemCostCategory } : {},
           enforced: !isSystemCost,
           occurredAt
@@ -2659,9 +2672,9 @@ exports.MeteringService = class MeteringService {
     if (usage instanceof StreamUsageCollector) {
       const finalized = await usage.finalize();
       if (usage.usedFallback && finalized.inputTokens === 0 && hold.estimatedTokens > 0) {
-        return { ...finalized, inputTokens: hold.estimatedTokens };
+        return normalizeCaptureUsage({ ...finalized, inputTokens: hold.estimatedTokens });
       }
-      return finalized;
+      return normalizeCaptureUsage(finalized);
     }
     return normalizeCaptureUsage(usage, preset2?.normalizer);
   }
@@ -2691,7 +2704,7 @@ exports.MeteringService = class MeteringService {
     if (normalizer !== void 0) return this.normalize(normalizer, input.usage);
     if (isNormalizedUsage(input.usage)) return input.usage;
     throw new AiTokensException("AI_TOKENS_UNKNOWN_PROVIDER", void 0, {
-      // Stryker disable next-line StringLiteral -- error reason text is internal diagnostics
+      // Stryker disable next-line StringLiteral: error reason text is internal diagnostics
       reason: "raw usage requires a preset or normalizer, or an already-normalized usage"
     });
   }
@@ -2794,7 +2807,7 @@ exports.WalletService = class WalletService {
       amountNanoUsd: input.amountNanoUsd,
       priority: input.priority ?? 0,
       effectiveAt: input.effectiveAt ?? /* @__PURE__ */ new Date(),
-      // Stryker disable next-line ConditionalExpression -- CE true: spreading { expiresAt: undefined } is equivalent to {} because InMemoryWalletStore and consumers check expiresAt !== undefined
+      // Stryker disable next-line ConditionalExpression: CE true: spreading { expiresAt: undefined } is equivalent to {} because InMemoryWalletStore and consumers check expiresAt !== undefined
       ...input.expiresAt !== void 0 ? { expiresAt: input.expiresAt } : {},
       idempotencyKey: input.idempotencyKey,
       reason: input.reason
@@ -2803,7 +2816,7 @@ exports.WalletService = class WalletService {
       walletId: entry.walletId,
       entryId: entry.id,
       amountNanoUsd: entry.amountNanoUsd,
-      // Stryker disable next-line ConditionalExpression -- CE true: spreading { expiresAt: undefined } is equivalent to {} because event consumers check expiresAt !== undefined
+      // Stryker disable next-line ConditionalExpression: CE true: spreading { expiresAt: undefined } is equivalent to {} because event consumers check expiresAt !== undefined
       ...entry.expiresAt !== void 0 ? { expiresAt: entry.expiresAt } : {}
     };
     await this.events.granted(ref, granted);
@@ -2834,16 +2847,16 @@ exports.WalletService = class WalletService {
       throw this.invalid("a debit without a usageRecordId must carry a reason");
     }
     const entry = {
-      // Stryker disable next-line StringLiteral -- placeholder walletId; the store's insert always assigns the real wallet id and never reads this sentinel, so any string here is equivalent
+      // Stryker disable next-line StringLiteral: placeholder walletId; the store's insert always assigns the real wallet id and never reads this sentinel, so any string here is equivalent
       walletId: "",
       type: "debit",
       amountNanoUsd: -input.amountNanoUsd,
       priority: 0,
       effectiveAt: /* @__PURE__ */ new Date(),
-      // Stryker disable next-line ConditionalExpression -- CE true: spreading { usageRecordId: undefined } is equivalent to {} because store and consumers check usageRecordId !== undefined
+      // Stryker disable next-line ConditionalExpression: CE true: spreading { usageRecordId: undefined } is equivalent to {} because store and consumers check usageRecordId !== undefined
       ...input.usageRecordId !== void 0 ? { usageRecordId: input.usageRecordId } : {},
       idempotencyKey: input.idempotencyKey,
-      // Stryker disable next-line ConditionalExpression -- CE true: spreading { reason: undefined } is equivalent to {} because store and consumers check reason !== undefined
+      // Stryker disable next-line ConditionalExpression: CE true: spreading { reason: undefined } is equivalent to {} because store and consumers check reason !== undefined
       ...input.reason !== void 0 ? { reason: input.reason } : {}
     };
     const debited = await this.conditionalDebit(ref, entry, input.amountNanoUsd);
@@ -2870,7 +2883,7 @@ exports.WalletService = class WalletService {
       amountNanoUsd: input.amountNanoUsd,
       priority: 0,
       effectiveAt: /* @__PURE__ */ new Date(),
-      // Stryker disable next-line ConditionalExpression,ObjectLiteral -- CE true / OL {}: spreading { usageRecordId: undefined } is equivalent to {} because store and consumers check usageRecordId !== undefined
+      // Stryker disable next-line ConditionalExpression,ObjectLiteral: CE true / OL {}: spreading { usageRecordId: undefined } is equivalent to {} because store and consumers check usageRecordId !== undefined
       ...input.usageRecordId !== void 0 ? { usageRecordId: input.usageRecordId } : {},
       idempotencyKey: input.idempotencyKey,
       reason: input.reason
@@ -2927,8 +2940,8 @@ exports.WalletService = class WalletService {
       amountNanoUsd: input.amountNanoUsd,
       priority: 0,
       effectiveAt: /* @__PURE__ */ new Date(),
-      // Stryker disable next-line ConditionalExpression -- CE true: spreading { usageRecordId: undefined } is equivalent to {} because store and consumers check usageRecordId !== undefined
-      // Stryker disable next-line ConditionalExpression -- CE true: spreading { usageRecordId: undefined } is equivalent to {} because store and consumers check usageRecordId !== undefined
+      // Stryker disable next-line ConditionalExpression: CE true: spreading { usageRecordId: undefined } is equivalent to {} because store and consumers check usageRecordId !== undefined
+      // Stryker disable next-line ConditionalExpression: CE true: spreading { usageRecordId: undefined } is equivalent to {} because store and consumers check usageRecordId !== undefined
       ...input.usageRecordId !== void 0 ? { usageRecordId: input.usageRecordId } : {},
       idempotencyKey: input.idempotencyKey,
       reason: input.reason
@@ -3560,11 +3573,11 @@ function featureMatches3(features, feature) {
 }
 function limitsOf(budget) {
   return {
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { nanoUsd: undefined } is equivalent to {} because all consumers check limits.nanoUsd !== undefined
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { nanoUsd: undefined } is equivalent to {} because all consumers check limits.nanoUsd !== undefined
     ...budget.limitNanoUsd !== void 0 ? { nanoUsd: budget.limitNanoUsd } : {},
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { tokens: undefined } is equivalent to {} because all consumers check limits.tokens !== undefined
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { tokens: undefined } is equivalent to {} because all consumers check limits.tokens !== undefined
     ...budget.limitTokens !== void 0 ? { tokens: budget.limitTokens } : {},
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { count: undefined } is equivalent to {} because all consumers check limits.count !== undefined
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { count: undefined } is equivalent to {} because all consumers check limits.count !== undefined
     ...budget.limitCount !== void 0 ? { count: budget.limitCount } : {}
   };
 }
@@ -3604,11 +3617,11 @@ function ratio(spent, limit) {
 }
 function limitSnapshot(limits) {
   return {
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { nanoUsd: undefined } is equivalent to {} for event consumers who check field !== undefined
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { nanoUsd: undefined } is equivalent to {} for event consumers who check field !== undefined
     ...limits.nanoUsd !== void 0 ? { nanoUsd: limits.nanoUsd } : {},
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { tokens: undefined } is equivalent to {} for event consumers who check field !== undefined
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { tokens: undefined } is equivalent to {} for event consumers who check field !== undefined
     ...limits.tokens !== void 0 ? { tokens: limits.tokens } : {},
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { count: undefined } is equivalent to {} for event consumers who check field !== undefined
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { count: undefined } is equivalent to {} for event consumers who check field !== undefined
     ...limits.count !== void 0 ? { count: limits.count } : {}
   };
 }
@@ -3617,11 +3630,11 @@ function spendSnapshot(spend) {
 }
 function remainingSnapshot(limits, spend) {
   return {
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { nanoUsd: undefined } is equivalent to {} for event consumers who check field !== undefined
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { nanoUsd: undefined } is equivalent to {} for event consumers who check field !== undefined
     ...limits.nanoUsd !== void 0 ? { nanoUsd: max0(limits.nanoUsd - spend.spentNanoUsd) } : {},
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { tokens: undefined } is equivalent to {} for event consumers who check field !== undefined
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { tokens: undefined } is equivalent to {} for event consumers who check field !== undefined
     ...limits.tokens !== void 0 ? { tokens: Math.max(0, limits.tokens - spend.spentTokens) } : {},
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { count: undefined } is equivalent to {} for event consumers who check field !== undefined
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { count: undefined } is equivalent to {} for event consumers who check field !== undefined
     ...limits.count !== void 0 ? { count: Math.max(0, limits.count - spend.spentCount) } : {}
   };
 }
@@ -3629,7 +3642,7 @@ function buildStatus(budget, windowStart, resetsAt, spend) {
   const limits = limitsOf(budget);
   return {
     budgetId: budget.id,
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { features: undefined } is equivalent to {} because status consumers check features !== undefined
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { features: undefined } is equivalent to {} because status consumers check features !== undefined
     ...budget.features !== void 0 ? { features: budget.features } : {},
     window: budget.window,
     windowStart,
@@ -3796,29 +3809,29 @@ exports.UsageReportService = __decorateClass([
 function toLedgerFilter(filter, limit) {
   return {
     tenantId: filter.tenantId,
-    // Stryker disable next-line ConditionalExpression -- spreading { scope: undefined } is equivalent to {} because InMemoryLedgerStore uses truthiness; the 'false' variant is covered by the scope isolation test
+    // Stryker disable next-line ConditionalExpression: spreading { scope: undefined } is equivalent to {} because InMemoryLedgerStore uses truthiness; the 'false' variant is covered by the scope isolation test
     ...filter.scope !== void 0 ? { scope: filter.scope } : {},
-    // Stryker disable next-line ConditionalExpression -- spreading { beneficiary: undefined } is equivalent to {} for the same reason
+    // Stryker disable next-line ConditionalExpression: spreading { beneficiary: undefined } is equivalent to {} for the same reason
     ...filter.beneficiary !== void 0 ? { beneficiary: filter.beneficiary } : {},
-    // Stryker disable next-line ConditionalExpression -- spreading { feature: undefined } does not change the !== undefined check in matches()
+    // Stryker disable next-line ConditionalExpression: spreading { feature: undefined } does not change the !== undefined check in matches()
     ...filter.feature !== void 0 ? { feature: filter.feature } : {},
-    // Stryker disable next-line ConditionalExpression -- spreading { features: undefined } does not change the truthiness check in matches()
+    // Stryker disable next-line ConditionalExpression: spreading { features: undefined } does not change the truthiness check in matches()
     ...filter.features !== void 0 ? { features: filter.features } : {},
-    // Stryker disable next-line ConditionalExpression -- spreading { provider: undefined } does not change the !== undefined check in matches()
+    // Stryker disable next-line ConditionalExpression: spreading { provider: undefined } does not change the !== undefined check in matches()
     ...filter.provider !== void 0 ? { provider: filter.provider } : {},
-    // Stryker disable next-line ConditionalExpression -- spreading { model: undefined } does not change the !== undefined check in matches()
+    // Stryker disable next-line ConditionalExpression: spreading { model: undefined } does not change the !== undefined check in matches()
     ...filter.model !== void 0 ? { model: filter.model } : {},
-    // Stryker disable next-line ConditionalExpression -- spreading { operation: undefined } does not change the !== undefined check in matches()
+    // Stryker disable next-line ConditionalExpression: spreading { operation: undefined } does not change the !== undefined check in matches()
     ...filter.operation !== void 0 ? { operation: filter.operation } : {},
-    // Stryker disable next-line ConditionalExpression -- spreading { serviceTier: undefined } does not change the !== undefined check in matches()
+    // Stryker disable next-line ConditionalExpression: spreading { serviceTier: undefined } does not change the !== undefined check in matches()
     ...filter.serviceTier !== void 0 ? { serviceTier: filter.serviceTier } : {},
-    // Stryker disable next-line ConditionalExpression -- spreading { tags: undefined } does not change the truthiness check in matches()
+    // Stryker disable next-line ConditionalExpression: spreading { tags: undefined } does not change the truthiness check in matches()
     ...filter.tags !== void 0 ? { tags: filter.tags } : {},
-    // Stryker disable next-line ConditionalExpression -- spreading { isSystemCost: undefined } does not change the !== undefined check in matches()
+    // Stryker disable next-line ConditionalExpression: spreading { isSystemCost: undefined } does not change the !== undefined check in matches()
     ...filter.isSystemCost !== void 0 ? { isSystemCost: filter.isSystemCost } : {},
-    // Stryker disable next-line ConditionalExpression -- spreading { systemCostCategory: undefined } does not change the !== undefined check in matches()
+    // Stryker disable next-line ConditionalExpression: spreading { systemCostCategory: undefined } does not change the !== undefined check in matches()
     ...filter.systemCostCategory !== void 0 ? { systemCostCategory: filter.systemCostCategory } : {},
-    // Stryker disable next-line ConditionalExpression -- spreading { enforcedOnly: undefined } does not change the === true check in matches()
+    // Stryker disable next-line ConditionalExpression: spreading { enforcedOnly: undefined } does not change the === true check in matches()
     ...filter.enforcedOnly !== void 0 ? { enforcedOnly: filter.enforcedOnly } : {},
     status: filter.status ?? [...BALANCE_STATUSES2],
     from: filter.from,
@@ -4004,9 +4017,9 @@ exports.MeteringInterceptor = class MeteringInterceptor {
     const context = await this.resolveContext(executionContext, config, enrichment);
     return this.metering.record({
       usage,
-      // Stryker disable next-line ConditionalExpression -- CE true: spreading { preset: undefined } is equivalent to {} because MeteringService checks preset !== undefined
+      // Stryker disable next-line ConditionalExpression: CE true: spreading { preset: undefined } is equivalent to {} because MeteringService checks preset !== undefined
       ...config.preset !== void 0 ? { preset: config.preset } : {},
-      // Stryker disable next-line ConditionalExpression -- CE true: spreading { tags: undefined } is equivalent to {} because MeteringService checks tags !== undefined
+      // Stryker disable next-line ConditionalExpression: CE true: spreading { tags: undefined } is equivalent to {} because MeteringService checks tags !== undefined
       context: { ...context, enforce: true, isSystemCost: config.isSystemCost ?? false, ...config.tags !== void 0 ? { tags: config.tags } : {} }
     });
   }
@@ -4334,24 +4347,24 @@ function preset(provider, normalizer, ratingMode) {
   return { provider, normalizer, ratingMode };
 }
 var providerPresets = {
-  // Stryker disable next-line StringLiteral -- provider ID; only observable via integration tests that exercise the full preset→MeteringService→UsageRecord path
+  // Stryker disable next-line StringLiteral: provider ID; only observable via integration tests that exercise the full preset→MeteringService→UsageRecord path
   openaiChat: preset("openai", normalizeOpenAiChatUsage, "rate-table"),
-  // Stryker disable next-line StringLiteral -- provider ID; only observable via integration tests
+  // Stryker disable next-line StringLiteral: provider ID; only observable via integration tests
   openaiResponses: preset("openai", normalizeOpenAiResponsesUsage, "rate-table"),
-  // Stryker disable next-line StringLiteral -- provider ID; only observable via integration tests
+  // Stryker disable next-line StringLiteral: provider ID; only observable via integration tests
   azureOpenai: preset("azure-openai", normalizeOpenAiChatUsage, "rate-table"),
-  // Stryker disable next-line StringLiteral -- provider ID; only observable via integration tests
+  // Stryker disable next-line StringLiteral: provider ID; only observable via integration tests
   anthropic: preset("anthropic", normalizeAnthropicUsage, "rate-table"),
-  // Stryker disable next-line StringLiteral -- provider ID; only observable via integration tests
+  // Stryker disable next-line StringLiteral: provider ID; only observable via integration tests
   gemini: preset("gemini", normalizeGeminiUsage, "rate-table"),
-  // Stryker disable next-line StringLiteral -- provider ID; only observable via integration tests
+  // Stryker disable next-line StringLiteral: provider ID; only observable via integration tests
   vertex: preset("vertex", normalizeGeminiUsage, "rate-table"),
-  // Stryker disable next-line StringLiteral -- provider ID; only observable via integration tests
+  // Stryker disable next-line StringLiteral: provider ID; only observable via integration tests
   bedrock: preset("bedrock", normalizeBedrockConverseUsage, "rate-table"),
-  // Stryker disable next-line StringLiteral -- provider ID; only observable via integration tests
+  // Stryker disable next-line StringLiteral: provider ID; only observable via integration tests
   mistral: preset("mistral", normalizeMistralUsage, "rate-table"),
   vercelAiSdk: preset("openai", normalizeVercelAiSdkUsage, "rate-table"),
-  // Stryker disable next-line StringLiteral -- provider ID and rating mode; only observable via integration tests
+  // Stryker disable next-line StringLiteral: provider ID and rating mode; only observable via integration tests
   openrouter: preset("openrouter", normalizeOpenRouterUsage, "provider-reported"),
   /** A custom OpenAI-compatible provider (DeepSeek, xAI, Groq, …). */
   openaiCompatible: (id) => preset(id, normalizeOpenAiCompatibleUsage, "rate-table")

package/dist/server/index.d.cts

@@ -2553,7 +2553,14 @@ interface RecordInput {
     normalizer?: UsageNormalizer;
     /** The per-call metering context (trusted input from the host's auth layer). */
     context: MeteringContext;
-    /** When the call happened; defaults to now (backfills pass the original time). */
+    /**
+     * When the call happened; defaults to now. Backfills deliberately pass the original time so a
+     * usage record imported late still lands in the price version and budget window in effect when
+     * it actually occurred. Because that timestamp selects both, it is honoured as given — it is
+     * trusted host input, like the rest of {@link MeteringContext}. A host that forwards a value an
+     * untrusted end user controls must validate it first, since a back-dated `occurredAt` would pick
+     * a historical price and an earlier budget window.
+     */
     occurredAt?: Date;
     /**
      * The ONLY path prompt/completion text enters the library (spec §14.2): masked +

package/dist/server/index.d.ts

@@ -2553,7 +2553,14 @@ interface RecordInput {
     normalizer?: UsageNormalizer;
     /** The per-call metering context (trusted input from the host's auth layer). */
     context: MeteringContext;
-    /** When the call happened; defaults to now (backfills pass the original time). */
+    /**
+     * When the call happened; defaults to now. Backfills deliberately pass the original time so a
+     * usage record imported late still lands in the price version and budget window in effect when
+     * it actually occurred. Because that timestamp selects both, it is honoured as given — it is
+     * trusted host input, like the rest of {@link MeteringContext}. A host that forwards a value an
+     * untrusted end user controls must validate it first, since a back-dated `occurredAt` would pick
+     * a historical price and an earlier budget window.
+     */
     occurredAt?: Date;
     /**
      * The ONLY path prompt/completion text enters the library (spec §14.2): masked +

package/dist/server/index.mjs

@@ -360,9 +360,9 @@ function normalizeMistralUsage(raw) {
     provider: "mistral",
     model: str(response.model) ?? "",
     operation: "chat",
-    // Stryker disable next-line StringLiteral -- provider and field names in error messages are internal diagnostics
+    // Stryker disable next-line StringLiteral: provider and field names in error messages are internal diagnostics
     inputTokens: requireNum(usage.prompt_tokens, "mistral", "usage.prompt_tokens"),
-    // Stryker disable next-line StringLiteral -- provider and field names in error messages are internal diagnostics
+    // Stryker disable next-line StringLiteral: provider and field names in error messages are internal diagnostics
     outputTokens: requireNum(usage.completion_tokens, "mistral", "usage.completion_tokens"),
     raw: usage
   });
@@ -806,7 +806,7 @@ function validatePricing(options) {
   if (cacheTtlMs === void 0) return;
   if (!Number.isInteger(cacheTtlMs) || cacheTtlMs <= 0) {
     throw invalidConfig(
-      // Stryker disable next-line StringLiteral -- error reason template is internal diagnostics
+      // Stryker disable next-line StringLiteral: error reason template is internal diagnostics
       `pricing.cacheTtlMs must be a positive integer number of milliseconds, received ${String(cacheTtlMs)}`
     );
   }
@@ -1126,7 +1126,7 @@ var BudgetGuard = class {
     this.reflector = reflector;
     if (options.scopeResolver === void 0) {
       throw new AiTokensException("AI_TOKENS_INVALID_CONFIG", void 0, {
-        // Stryker disable next-line StringLiteral -- error reason text is internal diagnostics
+        // Stryker disable next-line StringLiteral: error reason text is internal diagnostics
         reason: "BudgetGuard requires options.scopeResolver to resolve the caller scope"
       });
     }
@@ -1357,7 +1357,7 @@ function computePayloadHash(record) {
 // src/server/utils/hash-chain.ts
 function chainHash(prevHash, record) {
   return deriveIdempotencyKey({
-    // Stryker disable next-line StringLiteral -- empty-string fallback for null prevHash; tests only verify hash determinism and inequality, not the specific hash value for a genesis block
+    // Stryker disable next-line StringLiteral: empty-string fallback for null prevHash; tests only verify hash determinism and inequality, not the specific hash value for a genesis block
     prevHash: prevHash ?? "",
     id: record.id,
     content: computePayloadHash(record)
@@ -1558,7 +1558,7 @@ var LedgerService = class {
     const original = await this.store.findById(recordId);
     if (original?.status !== "posted") {
       throw new AiTokensException("AI_TOKENS_IDEMPOTENCY_CONFLICT", void 0, {
-        // Stryker disable next-line StringLiteral -- error reason text is internal diagnostics
+        // Stryker disable next-line StringLiteral: error reason text is internal diagnostics
         reason: original === null ? "record not found" : `cannot reverse a ${original.status} record`,
         recordId,
         requestedReason: reason
@@ -1579,7 +1579,7 @@ var LedgerService = class {
   assertLegalTransition(from2, to, patch) {
     if (!isLegalLedgerTransition(from2, to)) {
       throw new AiTokensException("AI_TOKENS_IDEMPOTENCY_CONFLICT", void 0, {
-        // Stryker disable next-line StringLiteral -- error reason template is internal diagnostics
+        // Stryker disable next-line StringLiteral: error reason template is internal diagnostics
         reason: `illegal transition ${from2} \u2192 ${to}`
       });
     }
@@ -1587,7 +1587,7 @@ var LedgerService = class {
     for (const key of Object.keys(patch)) {
       if (!isLegalTransitionPatchKey(from2, to, key)) {
         throw new AiTokensException("AI_TOKENS_IDEMPOTENCY_CONFLICT", void 0, {
-          // Stryker disable next-line StringLiteral -- error reason template is internal diagnostics
+          // Stryker disable next-line StringLiteral: error reason template is internal diagnostics
           reason: `${from2} \u2192 ${to} may not patch "${key}"`
         });
       }
@@ -1606,13 +1606,13 @@ function buildCompensatingRecord(original) {
   return {
     tenantId: original.tenantId,
     scope: original.scope,
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { beneficiary: undefined } is equivalent to {} because downstream consumers check !== undefined
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { beneficiary: undefined } is equivalent to {} because downstream consumers check !== undefined
     ...original.beneficiary !== void 0 ? { beneficiary: original.beneficiary } : {},
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { requestedBy: undefined } is equivalent to {}
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { requestedBy: undefined } is equivalent to {}
     ...original.requestedBy !== void 0 ? { requestedBy: original.requestedBy } : {},
     provider: original.provider,
     model: original.model,
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { requestedModel: undefined } is equivalent to {}
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { requestedModel: undefined } is equivalent to {}
     ...original.requestedModel !== void 0 ? { requestedModel: original.requestedModel } : {},
     operation: original.operation,
     serviceTier: original.serviceTier,
@@ -1628,7 +1628,7 @@ function buildCompensatingRecord(original) {
     audioOutTokens: -original.audioOutTokens,
     imageInTokens: -original.imageInTokens,
     imageOutTokens: -original.imageOutTokens,
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { extraUnits: undefined } is equivalent to {} because consumers check !== undefined
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { extraUnits: undefined } is equivalent to {} because consumers check !== undefined
     ...original.extraUnits !== void 0 ? { extraUnits: negateUnits(original.extraUnits) } : {},
     priceVersionId: original.priceVersionId,
     rawCostNanoUsd: -original.rawCostNanoUsd,
@@ -1639,12 +1639,12 @@ function buildCompensatingRecord(original) {
     priceMissing: original.priceMissing,
     status: "posted",
     reversesRecordId: original.id,
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { correlationId: undefined } is equivalent to {}
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { correlationId: undefined } is equivalent to {}
     ...original.correlationId !== void 0 ? { correlationId: original.correlationId } : {},
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { requestId: undefined } is equivalent to {}
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { requestId: undefined } is equivalent to {}
     ...original.requestId !== void 0 ? { requestId: original.requestId } : {},
     isSystemCost: original.isSystemCost,
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { systemCostCategory: undefined } is equivalent to {}
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { systemCostCategory: undefined } is equivalent to {}
     ...original.systemCostCategory !== void 0 ? { systemCostCategory: original.systemCostCategory } : {},
     enforced: original.enforced,
     occurredAt: original.occurredAt
@@ -1681,7 +1681,7 @@ var MarkupResolver = class {
       return await policy.resolve(context);
     } catch {
       throw new AiTokensException("AI_TOKENS_INVALID_CONFIG", void 0, {
-        // Stryker disable next-line StringLiteral -- error reason text is internal diagnostics
+        // Stryker disable next-line StringLiteral: error reason text is internal diagnostics
         reason: "markup policy failed to resolve a multiplier"
       });
     }
@@ -1692,7 +1692,7 @@ var MarkupResolver = class {
       return resolveMultiplier4dp(raw);
     } catch {
       throw new AiTokensException("AI_TOKENS_INVALID_CONFIG", void 0, {
-        // Stryker disable next-line StringLiteral -- error reason text is internal diagnostics
+        // Stryker disable next-line StringLiteral: error reason text is internal diagnostics
         reason: "markup policy returned an invalid multiplier",
         value: raw
       });
@@ -2124,6 +2124,19 @@ function tokenCountsOf(usage) {
 function sumTokenCounts(counts) {
   return TOKEN_FIELDS.reduce((total, field) => total + counts[field], 0);
 }
+function clampUsageCounts(usage) {
+  const counts = tokenCountsOf(usage);
+  const clamped = zeroTokenCounts();
+  for (const field of TOKEN_FIELDS) {
+    clamped[field] = counts[field] < 0 ? 0 : counts[field];
+  }
+  const result = { ...usage, ...clamped };
+  const cost = usage.providerReportedCostNanoUsd;
+  if (cost !== void 0 && cost < 0n) {
+    return { ...result, providerReportedCostNanoUsd: 0n };
+  }
+  return result;
+}
 function isNormalizedUsage(usage) {
   if (typeof usage !== "object" || usage === null) return false;
   const candidate = usage;
@@ -2161,7 +2174,7 @@ async function resolveHoldEstimate(pricing, context, estimate, at) {
       operation: estimate.operation,
       serviceTier: tier,
       at,
-      // Stryker disable next-line ConditionalExpression -- CE true: spreading { baseModel: undefined } is equivalent to {} because resolveRate reads input.baseModel (undefined either way) — same cache key and same `baseModel !== undefined` resolution branch
+      // Stryker disable next-line ConditionalExpression: CE true: spreading { baseModel: undefined } is equivalent to {} because resolveRate reads input.baseModel (undefined either way) — same cache key and same `baseModel !== undefined` resolution branch
       ...context.baseModel !== void 0 ? { baseModel: context.baseModel } : {}
     });
     const rawEstimateNanoUsd = rate === null ? 0n : computeCostNanoUsd(usage, rate).totalNanoUsd;
@@ -2185,7 +2198,7 @@ async function resolveHoldEstimate(pricing, context, estimate, at) {
 async function resolveTokenEstimate(pricing, context, tokens, serviceTier, at) {
   if (context.preset === void 0) {
     throw new AiTokensException("AI_TOKENS_INVALID_CONFIG", void 0, {
-      // Stryker disable next-line StringLiteral -- error reason text is internal diagnostics
+      // Stryker disable next-line StringLiteral: error reason text is internal diagnostics
       reason: "a { tokens } hold estimate requires context.preset to identify the provider"
     });
   }
@@ -2200,17 +2213,17 @@ async function resolveTokenEstimate(pricing, context, tokens, serviceTier, at) {
   return { provider, model, operation: "chat", serviceTier, rawEstimateNanoUsd, estimatedTokens: tokens, tokenCounts };
 }
 function normalizeCaptureUsage(usage, normalizer) {
-  if (isNormalizedUsage(usage)) return usage;
+  if (isNormalizedUsage(usage)) return clampUsageCounts(usage);
   if (normalizer !== void 0) {
     try {
-      return normalizer(usage);
+      return clampUsageCounts(normalizer(usage));
     } catch (error) {
       if (error instanceof AiTokensException) throw error;
       throw new AiTokensException("AI_TOKENS_USAGE_MALFORMED", void 0, { reason: "the normalizer could not read the usage token fields" });
     }
   }
   throw new AiTokensException("AI_TOKENS_USAGE_MALFORMED", void 0, {
-    // Stryker disable next-line StringLiteral -- error reason text is internal diagnostics
+    // Stryker disable next-line StringLiteral: error reason text is internal diagnostics
     reason: "capture requires an already-normalized usage or a preset normalizer"
   });
 }
@@ -2239,7 +2252,7 @@ function buildAppendInput(args) {
     audioOutTokens: normalized.audioOutTokens,
     imageInTokens: normalized.imageInTokens,
     imageOutTokens: normalized.imageOutTokens,
-    // Stryker disable next-line ConditionalExpression,EqualityOperator -- CE/EQ: when ratedUnits is empty, spreading { extraUnits: {} } vs omitting the key; downstream consumers check record.extraUnits !== undefined (absent vs present {}); unit tests don't use server tool use, so ratedUnits={} always → no observable difference
+    // Stryker disable next-line ConditionalExpression,EqualityOperator: CE/EQ: when ratedUnits is empty, spreading { extraUnits: {} } vs omitting the key; downstream consumers check record.extraUnits !== undefined (absent vs present {}); unit tests don't use server tool use, so ratedUnits={} always → no observable difference
     ...Object.keys(ratedUnits).length > 0 ? { extraUnits: ratedUnits } : {},
     priceVersionId: rating.priceVersionId,
     rawCostNanoUsd: rating.rawCostNanoUsd,
@@ -2250,7 +2263,7 @@ function buildAppendInput(args) {
     priceMissing: rating.priceMissing,
     status: "posted",
     isSystemCost: context.isSystemCost ?? false,
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { systemCostCategory: undefined } is equivalent to {} because JS property access treats absent and undefined the same
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { systemCostCategory: undefined } is equivalent to {} because JS property access treats absent and undefined the same
     ...context.systemCostCategory !== void 0 ? { systemCostCategory: context.systemCostCategory } : {},
     enforced,
     occurredAt
@@ -2260,19 +2273,19 @@ function baseColumns(usage, context, serviceTier) {
   return {
     tenantId: context.tenantId,
     scope: context.scope,
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { beneficiary: undefined } is equivalent to {} for property access and truthiness-based filters
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { beneficiary: undefined } is equivalent to {} for property access and truthiness-based filters
     ...context.beneficiary !== void 0 ? { beneficiary: context.beneficiary } : {},
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { requestedBy: undefined } is equivalent to {}
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { requestedBy: undefined } is equivalent to {}
     ...context.requestedBy !== void 0 ? { requestedBy: context.requestedBy } : {},
     provider: usage.provider,
     model: usage.model,
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { requestedModel: undefined } is equivalent to {} for downstream consumers
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { requestedModel: undefined } is equivalent to {} for downstream consumers
     ...context.baseModel !== void 0 ? { requestedModel: context.baseModel } : {},
     operation: usage.operation,
     serviceTier,
     feature: context.feature,
     tags: context.tags ?? [],
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { correlationId: undefined } is equivalent to {} because it's only read via record.correlationId
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { correlationId: undefined } is equivalent to {} because it's only read via record.correlationId
     ...context.correlationId !== void 0 ? { correlationId: context.correlationId } : {}
   };
 }
@@ -2334,7 +2347,7 @@ var MeteringService = class {
     const enforcing = context.enforce === true;
     if (enforcing && this.wallets === void 0 && this.budgets === void 0) {
       throw new AiTokensException("AI_TOKENS_INVALID_CONFIG", void 0, {
-        // Stryker disable next-line StringLiteral -- error reason text is internal diagnostics
+        // Stryker disable next-line StringLiteral: error reason text is internal diagnostics
         reason: "enforce requires the wallets or budgets feature to be enabled"
       });
     }
@@ -2389,7 +2402,7 @@ var MeteringService = class {
       model: input.model,
       operation: input.operation,
       serviceTier,
-      // Stryker disable next-line ConditionalExpression -- CE true: spreading { feature: undefined } is equivalent to {} because markup.resolve treats absent and undefined feature the same
+      // Stryker disable next-line ConditionalExpression: CE true: spreading { feature: undefined } is equivalent to {} because markup.resolve treats absent and undefined feature the same
       ...input.feature !== void 0 ? { feature: input.feature } : {}
     });
     return { rawCostNanoUsd, billedCostNanoUsd: markup.apply(rawCostNanoUsd) };
@@ -2591,7 +2604,7 @@ var MeteringService = class {
           priceMissing: false,
           status: "pending",
           isSystemCost,
-          // Stryker disable next-line ConditionalExpression -- CE true: spreading { systemCostCategory: undefined } is equivalent to {}
+          // Stryker disable next-line ConditionalExpression: CE true: spreading { systemCostCategory: undefined } is equivalent to {}
           ...context.systemCostCategory !== void 0 ? { systemCostCategory: context.systemCostCategory } : {},
           enforced: !isSystemCost,
           occurredAt
@@ -2657,9 +2670,9 @@ var MeteringService = class {
     if (usage instanceof StreamUsageCollector) {
       const finalized = await usage.finalize();
       if (usage.usedFallback && finalized.inputTokens === 0 && hold.estimatedTokens > 0) {
-        return { ...finalized, inputTokens: hold.estimatedTokens };
+        return normalizeCaptureUsage({ ...finalized, inputTokens: hold.estimatedTokens });
       }
-      return finalized;
+      return normalizeCaptureUsage(finalized);
     }
     return normalizeCaptureUsage(usage, preset2?.normalizer);
   }
@@ -2689,7 +2702,7 @@ var MeteringService = class {
     if (normalizer !== void 0) return this.normalize(normalizer, input.usage);
     if (isNormalizedUsage(input.usage)) return input.usage;
     throw new AiTokensException("AI_TOKENS_UNKNOWN_PROVIDER", void 0, {
-      // Stryker disable next-line StringLiteral -- error reason text is internal diagnostics
+      // Stryker disable next-line StringLiteral: error reason text is internal diagnostics
       reason: "raw usage requires a preset or normalizer, or an already-normalized usage"
     });
   }
@@ -2792,7 +2805,7 @@ var WalletService = class {
       amountNanoUsd: input.amountNanoUsd,
       priority: input.priority ?? 0,
       effectiveAt: input.effectiveAt ?? /* @__PURE__ */ new Date(),
-      // Stryker disable next-line ConditionalExpression -- CE true: spreading { expiresAt: undefined } is equivalent to {} because InMemoryWalletStore and consumers check expiresAt !== undefined
+      // Stryker disable next-line ConditionalExpression: CE true: spreading { expiresAt: undefined } is equivalent to {} because InMemoryWalletStore and consumers check expiresAt !== undefined
       ...input.expiresAt !== void 0 ? { expiresAt: input.expiresAt } : {},
       idempotencyKey: input.idempotencyKey,
       reason: input.reason
@@ -2801,7 +2814,7 @@ var WalletService = class {
       walletId: entry.walletId,
       entryId: entry.id,
       amountNanoUsd: entry.amountNanoUsd,
-      // Stryker disable next-line ConditionalExpression -- CE true: spreading { expiresAt: undefined } is equivalent to {} because event consumers check expiresAt !== undefined
+      // Stryker disable next-line ConditionalExpression: CE true: spreading { expiresAt: undefined } is equivalent to {} because event consumers check expiresAt !== undefined
       ...entry.expiresAt !== void 0 ? { expiresAt: entry.expiresAt } : {}
     };
     await this.events.granted(ref, granted);
@@ -2832,16 +2845,16 @@ var WalletService = class {
       throw this.invalid("a debit without a usageRecordId must carry a reason");
     }
     const entry = {
-      // Stryker disable next-line StringLiteral -- placeholder walletId; the store's insert always assigns the real wallet id and never reads this sentinel, so any string here is equivalent
+      // Stryker disable next-line StringLiteral: placeholder walletId; the store's insert always assigns the real wallet id and never reads this sentinel, so any string here is equivalent
       walletId: "",
       type: "debit",
       amountNanoUsd: -input.amountNanoUsd,
       priority: 0,
       effectiveAt: /* @__PURE__ */ new Date(),
-      // Stryker disable next-line ConditionalExpression -- CE true: spreading { usageRecordId: undefined } is equivalent to {} because store and consumers check usageRecordId !== undefined
+      // Stryker disable next-line ConditionalExpression: CE true: spreading { usageRecordId: undefined } is equivalent to {} because store and consumers check usageRecordId !== undefined
       ...input.usageRecordId !== void 0 ? { usageRecordId: input.usageRecordId } : {},
       idempotencyKey: input.idempotencyKey,
-      // Stryker disable next-line ConditionalExpression -- CE true: spreading { reason: undefined } is equivalent to {} because store and consumers check reason !== undefined
+      // Stryker disable next-line ConditionalExpression: CE true: spreading { reason: undefined } is equivalent to {} because store and consumers check reason !== undefined
       ...input.reason !== void 0 ? { reason: input.reason } : {}
     };
     const debited = await this.conditionalDebit(ref, entry, input.amountNanoUsd);
@@ -2868,7 +2881,7 @@ var WalletService = class {
       amountNanoUsd: input.amountNanoUsd,
       priority: 0,
       effectiveAt: /* @__PURE__ */ new Date(),
-      // Stryker disable next-line ConditionalExpression,ObjectLiteral -- CE true / OL {}: spreading { usageRecordId: undefined } is equivalent to {} because store and consumers check usageRecordId !== undefined
+      // Stryker disable next-line ConditionalExpression,ObjectLiteral: CE true / OL {}: spreading { usageRecordId: undefined } is equivalent to {} because store and consumers check usageRecordId !== undefined
       ...input.usageRecordId !== void 0 ? { usageRecordId: input.usageRecordId } : {},
       idempotencyKey: input.idempotencyKey,
       reason: input.reason
@@ -2925,8 +2938,8 @@ var WalletService = class {
       amountNanoUsd: input.amountNanoUsd,
       priority: 0,
       effectiveAt: /* @__PURE__ */ new Date(),
-      // Stryker disable next-line ConditionalExpression -- CE true: spreading { usageRecordId: undefined } is equivalent to {} because store and consumers check usageRecordId !== undefined
-      // Stryker disable next-line ConditionalExpression -- CE true: spreading { usageRecordId: undefined } is equivalent to {} because store and consumers check usageRecordId !== undefined
+      // Stryker disable next-line ConditionalExpression: CE true: spreading { usageRecordId: undefined } is equivalent to {} because store and consumers check usageRecordId !== undefined
+      // Stryker disable next-line ConditionalExpression: CE true: spreading { usageRecordId: undefined } is equivalent to {} because store and consumers check usageRecordId !== undefined
       ...input.usageRecordId !== void 0 ? { usageRecordId: input.usageRecordId } : {},
       idempotencyKey: input.idempotencyKey,
       reason: input.reason
@@ -3558,11 +3571,11 @@ function featureMatches3(features, feature) {
 }
 function limitsOf(budget) {
   return {
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { nanoUsd: undefined } is equivalent to {} because all consumers check limits.nanoUsd !== undefined
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { nanoUsd: undefined } is equivalent to {} because all consumers check limits.nanoUsd !== undefined
     ...budget.limitNanoUsd !== void 0 ? { nanoUsd: budget.limitNanoUsd } : {},
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { tokens: undefined } is equivalent to {} because all consumers check limits.tokens !== undefined
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { tokens: undefined } is equivalent to {} because all consumers check limits.tokens !== undefined
     ...budget.limitTokens !== void 0 ? { tokens: budget.limitTokens } : {},
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { count: undefined } is equivalent to {} because all consumers check limits.count !== undefined
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { count: undefined } is equivalent to {} because all consumers check limits.count !== undefined
     ...budget.limitCount !== void 0 ? { count: budget.limitCount } : {}
   };
 }
@@ -3602,11 +3615,11 @@ function ratio(spent, limit) {
 }
 function limitSnapshot(limits) {
   return {
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { nanoUsd: undefined } is equivalent to {} for event consumers who check field !== undefined
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { nanoUsd: undefined } is equivalent to {} for event consumers who check field !== undefined
     ...limits.nanoUsd !== void 0 ? { nanoUsd: limits.nanoUsd } : {},
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { tokens: undefined } is equivalent to {} for event consumers who check field !== undefined
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { tokens: undefined } is equivalent to {} for event consumers who check field !== undefined
     ...limits.tokens !== void 0 ? { tokens: limits.tokens } : {},
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { count: undefined } is equivalent to {} for event consumers who check field !== undefined
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { count: undefined } is equivalent to {} for event consumers who check field !== undefined
     ...limits.count !== void 0 ? { count: limits.count } : {}
   };
 }
@@ -3615,11 +3628,11 @@ function spendSnapshot(spend) {
 }
 function remainingSnapshot(limits, spend) {
   return {
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { nanoUsd: undefined } is equivalent to {} for event consumers who check field !== undefined
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { nanoUsd: undefined } is equivalent to {} for event consumers who check field !== undefined
     ...limits.nanoUsd !== void 0 ? { nanoUsd: max0(limits.nanoUsd - spend.spentNanoUsd) } : {},
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { tokens: undefined } is equivalent to {} for event consumers who check field !== undefined
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { tokens: undefined } is equivalent to {} for event consumers who check field !== undefined
     ...limits.tokens !== void 0 ? { tokens: Math.max(0, limits.tokens - spend.spentTokens) } : {},
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { count: undefined } is equivalent to {} for event consumers who check field !== undefined
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { count: undefined } is equivalent to {} for event consumers who check field !== undefined
     ...limits.count !== void 0 ? { count: Math.max(0, limits.count - spend.spentCount) } : {}
   };
 }
@@ -3627,7 +3640,7 @@ function buildStatus(budget, windowStart, resetsAt, spend) {
   const limits = limitsOf(budget);
   return {
     budgetId: budget.id,
-    // Stryker disable next-line ConditionalExpression -- CE true: spreading { features: undefined } is equivalent to {} because status consumers check features !== undefined
+    // Stryker disable next-line ConditionalExpression: CE true: spreading { features: undefined } is equivalent to {} because status consumers check features !== undefined
     ...budget.features !== void 0 ? { features: budget.features } : {},
     window: budget.window,
     windowStart,
@@ -3794,29 +3807,29 @@ UsageReportService = __decorateClass([
 function toLedgerFilter(filter, limit) {
   return {
     tenantId: filter.tenantId,
-    // Stryker disable next-line ConditionalExpression -- spreading { scope: undefined } is equivalent to {} because InMemoryLedgerStore uses truthiness; the 'false' variant is covered by the scope isolation test
+    // Stryker disable next-line ConditionalExpression: spreading { scope: undefined } is equivalent to {} because InMemoryLedgerStore uses truthiness; the 'false' variant is covered by the scope isolation test
     ...filter.scope !== void 0 ? { scope: filter.scope } : {},
-    // Stryker disable next-line ConditionalExpression -- spreading { beneficiary: undefined } is equivalent to {} for the same reason
+    // Stryker disable next-line ConditionalExpression: spreading { beneficiary: undefined } is equivalent to {} for the same reason
     ...filter.beneficiary !== void 0 ? { beneficiary: filter.beneficiary } : {},
-    // Stryker disable next-line ConditionalExpression -- spreading { feature: undefined } does not change the !== undefined check in matches()
+    // Stryker disable next-line ConditionalExpression: spreading { feature: undefined } does not change the !== undefined check in matches()
     ...filter.feature !== void 0 ? { feature: filter.feature } : {},
-    // Stryker disable next-line ConditionalExpression -- spreading { features: undefined } does not change the truthiness check in matches()
+    // Stryker disable next-line ConditionalExpression: spreading { features: undefined } does not change the truthiness check in matches()
     ...filter.features !== void 0 ? { features: filter.features } : {},
-    // Stryker disable next-line ConditionalExpression -- spreading { provider: undefined } does not change the !== undefined check in matches()
+    // Stryker disable next-line ConditionalExpression: spreading { provider: undefined } does not change the !== undefined check in matches()
     ...filter.provider !== void 0 ? { provider: filter.provider } : {},
-    // Stryker disable next-line ConditionalExpression -- spreading { model: undefined } does not change the !== undefined check in matches()
+    // Stryker disable next-line ConditionalExpression: spreading { model: undefined } does not change the !== undefined check in matches()
     ...filter.model !== void 0 ? { model: filter.model } : {},
-    // Stryker disable next-line ConditionalExpression -- spreading { operation: undefined } does not change the !== undefined check in matches()
+    // Stryker disable next-line ConditionalExpression: spreading { operation: undefined } does not change the !== undefined check in matches()
     ...filter.operation !== void 0 ? { operation: filter.operation } : {},
-    // Stryker disable next-line ConditionalExpression -- spreading { serviceTier: undefined } does not change the !== undefined check in matches()
+    // Stryker disable next-line ConditionalExpression: spreading { serviceTier: undefined } does not change the !== undefined check in matches()
     ...filter.serviceTier !== void 0 ? { serviceTier: filter.serviceTier } : {},
-    // Stryker disable next-line ConditionalExpression -- spreading { tags: undefined } does not change the truthiness check in matches()
+    // Stryker disable next-line ConditionalExpression: spreading { tags: undefined } does not change the truthiness check in matches()
     ...filter.tags !== void 0 ? { tags: filter.tags } : {},
-    // Stryker disable next-line ConditionalExpression -- spreading { isSystemCost: undefined } does not change the !== undefined check in matches()
+    // Stryker disable next-line ConditionalExpression: spreading { isSystemCost: undefined } does not change the !== undefined check in matches()
     ...filter.isSystemCost !== void 0 ? { isSystemCost: filter.isSystemCost } : {},
-    // Stryker disable next-line ConditionalExpression -- spreading { systemCostCategory: undefined } does not change the !== undefined check in matches()
+    // Stryker disable next-line ConditionalExpression: spreading { systemCostCategory: undefined } does not change the !== undefined check in matches()
     ...filter.systemCostCategory !== void 0 ? { systemCostCategory: filter.systemCostCategory } : {},
-    // Stryker disable next-line ConditionalExpression -- spreading { enforcedOnly: undefined } does not change the === true check in matches()
+    // Stryker disable next-line ConditionalExpression: spreading { enforcedOnly: undefined } does not change the === true check in matches()
     ...filter.enforcedOnly !== void 0 ? { enforcedOnly: filter.enforcedOnly } : {},
     status: filter.status ?? [...BALANCE_STATUSES2],
     from: filter.from,
@@ -4002,9 +4015,9 @@ var MeteringInterceptor = class {
     const context = await this.resolveContext(executionContext, config, enrichment);
     return this.metering.record({
       usage,
-      // Stryker disable next-line ConditionalExpression -- CE true: spreading { preset: undefined } is equivalent to {} because MeteringService checks preset !== undefined
+      // Stryker disable next-line ConditionalExpression: CE true: spreading { preset: undefined } is equivalent to {} because MeteringService checks preset !== undefined
       ...config.preset !== void 0 ? { preset: config.preset } : {},
-      // Stryker disable next-line ConditionalExpression -- CE true: spreading { tags: undefined } is equivalent to {} because MeteringService checks tags !== undefined
+      // Stryker disable next-line ConditionalExpression: CE true: spreading { tags: undefined } is equivalent to {} because MeteringService checks tags !== undefined
       context: { ...context, enforce: true, isSystemCost: config.isSystemCost ?? false, ...config.tags !== void 0 ? { tags: config.tags } : {} }
     });
   }
@@ -4332,24 +4345,24 @@ function preset(provider, normalizer, ratingMode) {
   return { provider, normalizer, ratingMode };
 }
 var providerPresets = {
-  // Stryker disable next-line StringLiteral -- provider ID; only observable via integration tests that exercise the full preset→MeteringService→UsageRecord path
+  // Stryker disable next-line StringLiteral: provider ID; only observable via integration tests that exercise the full preset→MeteringService→UsageRecord path
   openaiChat: preset("openai", normalizeOpenAiChatUsage, "rate-table"),
-  // Stryker disable next-line StringLiteral -- provider ID; only observable via integration tests
+  // Stryker disable next-line StringLiteral: provider ID; only observable via integration tests
   openaiResponses: preset("openai", normalizeOpenAiResponsesUsage, "rate-table"),
-  // Stryker disable next-line StringLiteral -- provider ID; only observable via integration tests
+  // Stryker disable next-line StringLiteral: provider ID; only observable via integration tests
   azureOpenai: preset("azure-openai", normalizeOpenAiChatUsage, "rate-table"),
-  // Stryker disable next-line StringLiteral -- provider ID; only observable via integration tests
+  // Stryker disable next-line StringLiteral: provider ID; only observable via integration tests
   anthropic: preset("anthropic", normalizeAnthropicUsage, "rate-table"),
-  // Stryker disable next-line StringLiteral -- provider ID; only observable via integration tests
+  // Stryker disable next-line StringLiteral: provider ID; only observable via integration tests
   gemini: preset("gemini", normalizeGeminiUsage, "rate-table"),
-  // Stryker disable next-line StringLiteral -- provider ID; only observable via integration tests
+  // Stryker disable next-line StringLiteral: provider ID; only observable via integration tests
   vertex: preset("vertex", normalizeGeminiUsage, "rate-table"),
-  // Stryker disable next-line StringLiteral -- provider ID; only observable via integration tests
+  // Stryker disable next-line StringLiteral: provider ID; only observable via integration tests
   bedrock: preset("bedrock", normalizeBedrockConverseUsage, "rate-table"),
-  // Stryker disable next-line StringLiteral -- provider ID; only observable via integration tests
+  // Stryker disable next-line StringLiteral: provider ID; only observable via integration tests
   mistral: preset("mistral", normalizeMistralUsage, "rate-table"),
   vercelAiSdk: preset("openai", normalizeVercelAiSdkUsage, "rate-table"),
-  // Stryker disable next-line StringLiteral -- provider ID and rating mode; only observable via integration tests
+  // Stryker disable next-line StringLiteral: provider ID and rating mode; only observable via integration tests
   openrouter: preset("openrouter", normalizeOpenRouterUsage, "provider-reported"),
   /** A custom OpenAI-compatible provider (DeepSeek, xAI, Groq, …). */
   openaiCompatible: (id) => preset(id, normalizeOpenAiCompatibleUsage, "rate-table")

package/dist/shared/index.cjs

@@ -332,9 +332,9 @@ function normalizeMistralUsage(raw) {
     provider: "mistral",
     model: str(response.model) ?? "",
     operation: "chat",
-    // Stryker disable next-line StringLiteral -- provider and field names in error messages are internal diagnostics
+    // Stryker disable next-line StringLiteral: provider and field names in error messages are internal diagnostics
     inputTokens: requireNum(usage.prompt_tokens, "mistral", "usage.prompt_tokens"),
-    // Stryker disable next-line StringLiteral -- provider and field names in error messages are internal diagnostics
+    // Stryker disable next-line StringLiteral: provider and field names in error messages are internal diagnostics
     outputTokens: requireNum(usage.completion_tokens, "mistral", "usage.completion_tokens"),
     raw: usage
   });

package/dist/shared/index.mjs

@@ -330,9 +330,9 @@ function normalizeMistralUsage(raw) {
     provider: "mistral",
     model: str(response.model) ?? "",
     operation: "chat",
-    // Stryker disable next-line StringLiteral -- provider and field names in error messages are internal diagnostics
+    // Stryker disable next-line StringLiteral: provider and field names in error messages are internal diagnostics
     inputTokens: requireNum(usage.prompt_tokens, "mistral", "usage.prompt_tokens"),
-    // Stryker disable next-line StringLiteral -- provider and field names in error messages are internal diagnostics
+    // Stryker disable next-line StringLiteral: provider and field names in error messages are internal diagnostics
     outputTokens: requireNum(usage.completion_tokens, "mistral", "usage.completion_tokens"),
     raw: usage
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bymax-one/nest-ai-tokens",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "AI token metering & usage-based billing for NestJS 11: provider usage normalizer (×9), versioned effective-dated pricing, immutable append-only ledger, prepaid wallets, multi-dimension budgets, and markup/margin. Zero runtime dependencies.",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",
@@ -76,6 +76,7 @@
   "scripts": {
     "build": "pnpm clean && tsup",
     "check:exports": "attw --pack . --profile strict",
+    "check:mutants": "node scripts/check-mutation-directives.mjs",
     "check:published": "node scripts/check-published-surface.mjs",
     "check:runtime": "node scripts/check-consumer-runtime.mjs",
     "clean": "node -e \"const {rmSync}=require('node:fs');for(const d of ['dist','coverage'])rmSync(d,{recursive:true,force:true})\"",
@@ -84,10 +85,10 @@
     "lint": "eslint src",
     "lint:fix": "eslint src --fix",
     "mutation": "stryker run",
+    "mutation:full": "node -e \"require('node:fs').rmSync('reports/stryker-incremental.json',{force:true,recursive:true})\" && stryker run",
     "mutation:dry-run": "stryker run --dryRunOnly",
-    "mutation:incremental": "stryker run --incremental",
     "prepare": "prisma generate",
-    "prepublishOnly": "pnpm clean && pnpm typecheck && pnpm lint && pnpm test:cov:all && pnpm build && pnpm size && pnpm check:published",
+    "prepublishOnly": "pnpm clean && pnpm typecheck && pnpm lint && pnpm check:mutants && pnpm test:cov:all && pnpm build && pnpm size && pnpm check:published",
     "release": "npm publish --provenance --access public",
     "size": "node scripts/check-size.mjs",
     "test": "jest",