@bymax-one/nest-ai-tokens 1.1.0 → 1.1.2

package/CHANGELOG.md

@@ -6,6 +6,76 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) and
 
 ---
 
+## [Unreleased]
+
+## [1.1.2] - 2026-10-30
+
+### Fixed
+
+- **`PricingService.resolveRate` no longer serves one request's price to another.** The
+  resolution cache key joined provider, model, baseModel, operation, tier and time bucket
+  with `|`, which can also appear inside a model id. Two different requests could spell the
+  same key — `model: 'b|c'` with no `baseModel` against `model: 'b'` with `baseModel: 'c|'` —
+  and the second received the first's rate from the cache. The key is now a JSON array of
+  the fields, so no value can move the boundary between them. (#117)
+
+  **Apply:** no action required. Requests whose model names contain `|` now resolve their
+  own price instead of a colliding entry's.
+
+### Security
+
+- Advisories on transitive **dev** packages are cleared through `pnpm-workspace.yaml`
+  overrides: body-parser, multer, qs and zod (#115). deepmerge GHSA-gcqx-w48m-w2h4 has no
+  patched release and is reached only through `jest-config`, so it is ignored in
+  `osv-scanner.toml` until 2027-01-27. None of these reach a consumer install: the package
+  has no runtime dependencies.
+
+### Documentation
+
+- `SECURITY.md`: only the latest minor line (1.1.x) receives security fixes; 1.0.x is
+  unsupported and consumers should upgrade.
+
+## [1.1.1] - 2026-10-23
+
+### Fixed
+
+- **A failed expired-hold scan no longer crashes the process.** `HoldReaper` read the
+  expired holds outside any `try`, and its interval callback discarded the promise
+  `sweep()` returned. A database error during that read — a failover or a dropped
+  connection — became an unhandled rejection, which terminates Node in every process that
+  loads the module. The scan is now guarded: a failure is logged once under the stable key
+  `ai_tokens.hold_reaper.scan_failed` with the error's `name`, `message` and string/number
+  `code` only, and the sweep ends; the next tick retries. Every timer-driven sweep also
+  carries a `catch` (logged as `ai_tokens.hold_reaper.sweep_failed`), so no rejection from
+  `sweep()` can escape the interval. Per-hold isolation, the multi-replica claim, `unref()`
+  and shutdown are unchanged. (#108)
+
+  **Apply to a derived backend:** a consumer that wrapped its store's `findExpiredHolds`
+  in a local guard (catching the error and returning `[]`) to survive this can drop that
+  guard once it runs 1.1.1. The reaper now absorbs and logs the failure itself.
+
+### Security
+
+- Advisories on transitive **dev** packages are cleared through `pnpm-workspace.yaml`
+  overrides: handlebars, proxy-addr, multer, undici, @grpc/grpc-js, fast-uri, js-yaml and
+  brace-expansion (#109); fast-uri and qs (#87); browserslist and mysql2 (#85);
+  deepmerge-ts (#80). osv-scanner reports no issues on the lockfile. None of these reach a
+  consumer install: the package has no runtime dependencies.
+
+### Changed
+
+- The budget counter-key construction moved to its own module, and its injectivity is
+  now asserted in tests: the keys are built from a caller-supplied `budgetId` and a
+  caller-chosen timestamp, and the specs fail if a field is reordered or a delimiter
+  changes. `COUNTER_DIMENSIONS` is the single runtime list the dimension type derives
+  from. No exported type or value changed. (#91)
+- Dev dependencies and CI actions updated (#79, #83, #111, and the pinned-action bumps). The
+  mutation gate now runs every spec rather than only Jest's related tests, which had silently
+  dropped specs reaching the code through helpers under `test/` (#112).
+- Published artifact: every `.d.ts` is byte-identical to 1.1.0, and so are the `shared`,
+  `prisma`, `redis` and `prices` bundles. Only the `server` bundle changed, from 38,204 to
+  38,417 B brotli, inside its 40,000 B budget.
+
 ## [1.1.0] - 2026-08-11
 
 ### Changed
@@ -21,7 +91,7 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) and
 
 ## [1.0.4] - 2026-08-10
 
-Remediation of a local audit's settlement findings (merged in #65). No API changed.
+Remediation of a local audit's settlement findings (merged in #65). No API changes.
 
 ### Fixed
 
@@ -226,6 +296,8 @@ have regressed from. They are kept because the reasoning is worth having.
 [1.0.1]: https://github.com/bymaxone/nest-ai-tokens/compare/v1.0.0...v1.0.1
 [1.0.2]: https://github.com/bymaxone/nest-ai-tokens/compare/v1.0.1...v1.0.2
 [1.1.0]: https://github.com/bymaxone/nest-ai-tokens/compare/v1.0.4...v1.1.0
+[1.1.2]: https://github.com/bymaxone/nest-ai-tokens/compare/v1.1.1...v1.1.2
+[1.1.1]: https://github.com/bymaxone/nest-ai-tokens/compare/v1.1.0...v1.1.1
 [1.0.4]: https://github.com/bymaxone/nest-ai-tokens/compare/v1.0.3...v1.0.4
 [1.0.3]: https://github.com/bymaxone/nest-ai-tokens/compare/v1.0.2...v1.0.3
-[Unreleased]: https://github.com/bymaxone/nest-ai-tokens/compare/v1.0.4...HEAD
+[Unreleased]: https://github.com/bymaxone/nest-ai-tokens/compare/v1.1.2...HEAD

package/dist/server/index.cjs

@@ -1224,7 +1224,7 @@ exports.PricingService = class PricingService {
     const serviceTier = input.serviceTier ?? "standard";
     const operation = input.operation === "responses" ? "chat" : input.operation;
     const bucket = Math.floor(input.at.getTime() / this.options.pricing.cacheTtlMs);
-    const cacheKey = `${input.provider}|${input.model}|${input.baseModel ?? ""}|${operation}|${serviceTier}|${String(bucket)}`;
+    const cacheKey = JSON.stringify([input.provider, input.model, input.baseModel, operation, serviceTier, bucket]);
     let resolved;
     const cached = this.cache.get(cacheKey);
     if (cached !== void 0 && this.now() < cached.expiresAt) {
@@ -2775,10 +2775,10 @@ exports.WalletService = class WalletService {
   options;
   events;
   /**
-   * The current balance, excluding not-yet-effective and expired grants (§9.2).
-   * Reads the materialized balance; expiry is applied lazily on debit, so a grant
-   * that lapses purely with the passage of time is reflected at the next debit or
-   * `reconcile` (the documented §9.3 lazy-materialization trade-off).
+   * The current balance (§9.2). Reads the materialized balance; expiry is applied
+   * lazily on debit, so a grant that lapses purely with the passage of time is still
+   * counted until the next debit or `reconcile` (the documented §9.3
+   * lazy-materialization trade-off).
    *
    * @param ref The wallet owner (a `'tenant' | 'team' | 'user'`, never `'key'`).
    * @returns The nano-USD balance and its presentation credits.
@@ -2965,7 +2965,7 @@ exports.WalletService = class WalletService {
    * `ai_tokens.audit`.
    *
    * @param ref The wallet owner.
-   * @returns The reconciled wallet.
+   * @returns The reconciled nano-USD balance and its presentation credits.
    */
   async reconcile(ref) {
     this.assertOwner(ref);
@@ -3036,6 +3036,36 @@ function isWalletMissing(error) {
   return error.isWalletMissing === true;
 }
 
+// src/server/services/budget.keys.ts
+var COUNTER_GRACE_SECONDS = 3600;
+var TOTAL_WINDOW_TTL_SECONDS = 60 * 60 * 24 * 400;
+function windowKey(budgetId, windowStart) {
+  return `${budgetId}|${windowStart.toISOString()}`;
+}
+function counterKey(budgetId, windowStart, dimension) {
+  return `ai_tokens:budget:${budgetId}:${windowStart.toISOString()}:${dimension}`;
+}
+function counterTtlSeconds(windowStart, windowEnd) {
+  if (windowEnd === null) return TOTAL_WINDOW_TTL_SECONDS;
+  return Math.ceil((windowEnd.getTime() - windowStart.getTime()) / 1e3) + COUNTER_GRACE_SECONDS;
+}
+function dimensionSpends(spend) {
+  return { cost: spend.spentNanoUsd, tokens: BigInt(spend.spentTokens), count: BigInt(spend.spentCount) };
+}
+function counterDimensions(delta, limits) {
+  const dimensions = [];
+  if (limits.nanoUsd !== void 0 && delta.nanoUsd !== 0n) {
+    dimensions.push({ name: "cost", amount: delta.nanoUsd, limit: limits.nanoUsd });
+  }
+  if (limits.tokens !== void 0 && delta.tokens !== 0) {
+    dimensions.push({ name: "tokens", amount: BigInt(delta.tokens), limit: BigInt(limits.tokens) });
+  }
+  if (limits.count !== void 0 && delta.count !== 0) {
+    dimensions.push({ name: "count", amount: BigInt(delta.count), limit: BigInt(limits.count) });
+  }
+  return dimensions;
+}
+
 // src/server/services/budget-predicate.ts
 function recordConsumesBudget(record, budget, windowStart, windowEnd) {
   if (!record.enforced) return false;
@@ -3119,8 +3149,6 @@ var NOOP_BUDGET_HOOKS = {
   projectedExceeded: () => void 0,
   audit: () => void 0
 };
-var COUNTER_GRACE_SECONDS = 3600;
-var TOTAL_WINDOW_TTL_SECONDS = 60 * 60 * 24 * 400;
 var UNBOUNDED_COUNTER_LIMIT = 9223372036854775807n;
 exports.BudgetService = class BudgetService {
   /**
@@ -3654,32 +3682,6 @@ function buildStatus(budget, windowStart, resetsAt, spend) {
     usedFraction: usedFraction(spend, limits)
   };
 }
-function windowKey(budgetId, windowStart) {
-  return `${budgetId}|${windowStart.toISOString()}`;
-}
-function counterKey(budgetId, windowStart, dimension) {
-  return `ai_tokens:budget:${budgetId}:${windowStart.toISOString()}:${dimension}`;
-}
-function counterTtlSeconds(windowStart, windowEnd) {
-  if (windowEnd === null) return TOTAL_WINDOW_TTL_SECONDS;
-  return Math.ceil((windowEnd.getTime() - windowStart.getTime()) / 1e3) + COUNTER_GRACE_SECONDS;
-}
-function dimensionSpends(spend) {
-  return { cost: spend.spentNanoUsd, tokens: BigInt(spend.spentTokens), count: BigInt(spend.spentCount) };
-}
-function counterDimensions(delta, limits) {
-  const dimensions = [];
-  if (limits.nanoUsd !== void 0 && delta.nanoUsd !== 0n) {
-    dimensions.push({ name: "cost", amount: delta.nanoUsd, limit: limits.nanoUsd });
-  }
-  if (limits.tokens !== void 0 && delta.tokens !== 0) {
-    dimensions.push({ name: "tokens", amount: BigInt(delta.tokens), limit: BigInt(limits.tokens) });
-  }
-  if (limits.count !== void 0 && delta.count !== 0) {
-    dimensions.push({ name: "count", amount: BigInt(delta.count), limit: BigInt(limits.count) });
-  }
-  return dimensions;
-}
 function max0(value) {
   return value < 0n ? 0n : value;
 }
@@ -4078,6 +4080,14 @@ function writeHeader(response, name, value) {
 }
 var REAP_BATCH_SIZE = 100;
 var MS_PER_SECOND = 1e3;
+var SCAN_FAILED_LOG_KEY = "ai_tokens.hold_reaper.scan_failed";
+var SWEEP_FAILED_LOG_KEY = "ai_tokens.hold_reaper.sweep_failed";
+function describeError(error) {
+  if (!(error instanceof Error)) return "non-Error rejection";
+  const { code } = error;
+  const suffix = typeof code === "string" || typeof code === "number" ? ` code=${String(code)}` : "";
+  return `name=${error.name} message=${JSON.stringify(error.message)}${suffix}`;
+}
 var HoldReaper = class {
   /**
    * @param ledger The ledger service (expired-hold scan + atomic void claim).
@@ -4100,7 +4110,11 @@ var HoldReaper = class {
   /** Start the periodic sweep on module boot (interval `unref()`'d so it never blocks exit). */
   onApplicationBootstrap() {
     const intervalMs = this.options.holds.reaperIntervalSeconds * MS_PER_SECOND;
-    this.timer = setInterval(() => void this.sweep(), intervalMs);
+    this.timer = setInterval(() => {
+      void this.sweep().catch((error) => {
+        this.logger.warn(`${SWEEP_FAILED_LOG_KEY} ${describeError(error)}`);
+      });
+    }, intervalMs);
     this.timer.unref();
   }
   /** Stop the sweep on shutdown (no open handles left for Jest). */
@@ -4112,12 +4126,19 @@ var HoldReaper = class {
    * Reclaim one batch of expired pending holds. For each: win the atomic
    * `pending → released` claim (a `null` result means another replica won — skip),
    * then run the shared restoration + `hold.released` emission. A failure on one
-   * hold is logged and never aborts the batch (deterministic, idempotent, safe to
-   * run repeatedly).
+   * hold is logged and never aborts the batch; a failure of the expired-hold scan
+   * itself is logged and ends this sweep without throwing (deterministic, idempotent,
+   * safe to run repeatedly).
    */
   async sweep() {
     const cutoff = new Date(this.now().getTime() - this.options.holds.ttlSeconds * MS_PER_SECOND);
-    const expired = await this.ledger.findExpiredHolds(cutoff, REAP_BATCH_SIZE);
+    let expired;
+    try {
+      expired = await this.ledger.findExpiredHolds(cutoff, REAP_BATCH_SIZE);
+    } catch (error) {
+      this.logger.warn(`${SCAN_FAILED_LOG_KEY} ${describeError(error)}`);
+      return;
+    }
     for (const record of expired) {
       try {
         const claimed = await this.ledger.transition(record.id, "pending", "released");

package/dist/server/index.d.cts

@@ -2224,10 +2224,10 @@ declare class WalletService {
      */
     constructor(store: IWalletStore, options: WalletServiceOptions, events?: WalletEventHooks);
     /**
-     * The current balance, excluding not-yet-effective and expired grants (§9.2).
-     * Reads the materialized balance; expiry is applied lazily on debit, so a grant
-     * that lapses purely with the passage of time is reflected at the next debit or
-     * `reconcile` (the documented §9.3 lazy-materialization trade-off).
+     * The current balance (§9.2). Reads the materialized balance; expiry is applied
+     * lazily on debit, so a grant that lapses purely with the passage of time is still
+     * counted until the next debit or `reconcile` (the documented §9.3
+     * lazy-materialization trade-off).
      *
      * @param ref The wallet owner (a `'tenant' | 'team' | 'user'`, never `'key'`).
      * @returns The nano-USD balance and its presentation credits.
@@ -2306,7 +2306,7 @@ declare class WalletService {
      * `ai_tokens.audit`.
      *
      * @param ref The wallet owner.
-     * @returns The reconciled wallet.
+     * @returns The reconciled nano-USD balance and its presentation credits.
      */
     reconcile(ref: WalletRef): Promise<WalletBalance>;
     /** Append a non-debit entry, mapping a store idempotency/missing-wallet signal to the catalog. */
@@ -3119,7 +3119,7 @@ declare class MeteringInterceptor implements NestInterceptor {
  * @fileoverview The controller-level metering/enforcement decorators (spec §11.4).
  * `@Meter` marks a handler for the `MeteringInterceptor` and is metadata-only
  * here; `@RequireBudget` marks it for the `BudgetGuard`; `@AiFeature`
- * is a lightweight feature tag. Each stores its config under an exported symbol key
+ * is a lightweight feature tag. Each stores its config under an exported string key
  * that the guard/interceptor read via the NestJS `Reflector`. Feature precedence is
  * `@RequireBudget.feature` > `@Meter.feature` > `@AiFeature` (§11.4). These are pure
  * metadata; they never touch a wallet, budget, or the request.

package/dist/server/index.d.ts

@@ -2224,10 +2224,10 @@ declare class WalletService {
      */
     constructor(store: IWalletStore, options: WalletServiceOptions, events?: WalletEventHooks);
     /**
-     * The current balance, excluding not-yet-effective and expired grants (§9.2).
-     * Reads the materialized balance; expiry is applied lazily on debit, so a grant
-     * that lapses purely with the passage of time is reflected at the next debit or
-     * `reconcile` (the documented §9.3 lazy-materialization trade-off).
+     * The current balance (§9.2). Reads the materialized balance; expiry is applied
+     * lazily on debit, so a grant that lapses purely with the passage of time is still
+     * counted until the next debit or `reconcile` (the documented §9.3
+     * lazy-materialization trade-off).
      *
      * @param ref The wallet owner (a `'tenant' | 'team' | 'user'`, never `'key'`).
      * @returns The nano-USD balance and its presentation credits.
@@ -2306,7 +2306,7 @@ declare class WalletService {
      * `ai_tokens.audit`.
      *
      * @param ref The wallet owner.
-     * @returns The reconciled wallet.
+     * @returns The reconciled nano-USD balance and its presentation credits.
      */
     reconcile(ref: WalletRef): Promise<WalletBalance>;
     /** Append a non-debit entry, mapping a store idempotency/missing-wallet signal to the catalog. */
@@ -3119,7 +3119,7 @@ declare class MeteringInterceptor implements NestInterceptor {
  * @fileoverview The controller-level metering/enforcement decorators (spec §11.4).
  * `@Meter` marks a handler for the `MeteringInterceptor` and is metadata-only
  * here; `@RequireBudget` marks it for the `BudgetGuard`; `@AiFeature`
- * is a lightweight feature tag. Each stores its config under an exported symbol key
+ * is a lightweight feature tag. Each stores its config under an exported string key
  * that the guard/interceptor read via the NestJS `Reflector`. Feature precedence is
  * `@RequireBudget.feature` > `@Meter.feature` > `@AiFeature` (§11.4). These are pure
  * metadata; they never touch a wallet, budget, or the request.

package/dist/server/index.mjs

@@ -1222,7 +1222,7 @@ var PricingService = class {
     const serviceTier = input.serviceTier ?? "standard";
     const operation = input.operation === "responses" ? "chat" : input.operation;
     const bucket = Math.floor(input.at.getTime() / this.options.pricing.cacheTtlMs);
-    const cacheKey = `${input.provider}|${input.model}|${input.baseModel ?? ""}|${operation}|${serviceTier}|${String(bucket)}`;
+    const cacheKey = JSON.stringify([input.provider, input.model, input.baseModel, operation, serviceTier, bucket]);
     let resolved;
     const cached = this.cache.get(cacheKey);
     if (cached !== void 0 && this.now() < cached.expiresAt) {
@@ -2773,10 +2773,10 @@ var WalletService = class {
   options;
   events;
   /**
-   * The current balance, excluding not-yet-effective and expired grants (§9.2).
-   * Reads the materialized balance; expiry is applied lazily on debit, so a grant
-   * that lapses purely with the passage of time is reflected at the next debit or
-   * `reconcile` (the documented §9.3 lazy-materialization trade-off).
+   * The current balance (§9.2). Reads the materialized balance; expiry is applied
+   * lazily on debit, so a grant that lapses purely with the passage of time is still
+   * counted until the next debit or `reconcile` (the documented §9.3
+   * lazy-materialization trade-off).
    *
    * @param ref The wallet owner (a `'tenant' | 'team' | 'user'`, never `'key'`).
    * @returns The nano-USD balance and its presentation credits.
@@ -2963,7 +2963,7 @@ var WalletService = class {
    * `ai_tokens.audit`.
    *
    * @param ref The wallet owner.
-   * @returns The reconciled wallet.
+   * @returns The reconciled nano-USD balance and its presentation credits.
    */
   async reconcile(ref) {
     this.assertOwner(ref);
@@ -3034,6 +3034,36 @@ function isWalletMissing(error) {
   return error.isWalletMissing === true;
 }
 
+// src/server/services/budget.keys.ts
+var COUNTER_GRACE_SECONDS = 3600;
+var TOTAL_WINDOW_TTL_SECONDS = 60 * 60 * 24 * 400;
+function windowKey(budgetId, windowStart) {
+  return `${budgetId}|${windowStart.toISOString()}`;
+}
+function counterKey(budgetId, windowStart, dimension) {
+  return `ai_tokens:budget:${budgetId}:${windowStart.toISOString()}:${dimension}`;
+}
+function counterTtlSeconds(windowStart, windowEnd) {
+  if (windowEnd === null) return TOTAL_WINDOW_TTL_SECONDS;
+  return Math.ceil((windowEnd.getTime() - windowStart.getTime()) / 1e3) + COUNTER_GRACE_SECONDS;
+}
+function dimensionSpends(spend) {
+  return { cost: spend.spentNanoUsd, tokens: BigInt(spend.spentTokens), count: BigInt(spend.spentCount) };
+}
+function counterDimensions(delta, limits) {
+  const dimensions = [];
+  if (limits.nanoUsd !== void 0 && delta.nanoUsd !== 0n) {
+    dimensions.push({ name: "cost", amount: delta.nanoUsd, limit: limits.nanoUsd });
+  }
+  if (limits.tokens !== void 0 && delta.tokens !== 0) {
+    dimensions.push({ name: "tokens", amount: BigInt(delta.tokens), limit: BigInt(limits.tokens) });
+  }
+  if (limits.count !== void 0 && delta.count !== 0) {
+    dimensions.push({ name: "count", amount: BigInt(delta.count), limit: BigInt(limits.count) });
+  }
+  return dimensions;
+}
+
 // src/server/services/budget-predicate.ts
 function recordConsumesBudget(record, budget, windowStart, windowEnd) {
   if (!record.enforced) return false;
@@ -3117,8 +3147,6 @@ var NOOP_BUDGET_HOOKS = {
   projectedExceeded: () => void 0,
   audit: () => void 0
 };
-var COUNTER_GRACE_SECONDS = 3600;
-var TOTAL_WINDOW_TTL_SECONDS = 60 * 60 * 24 * 400;
 var UNBOUNDED_COUNTER_LIMIT = 9223372036854775807n;
 var BudgetService = class {
   /**
@@ -3652,32 +3680,6 @@ function buildStatus(budget, windowStart, resetsAt, spend) {
     usedFraction: usedFraction(spend, limits)
   };
 }
-function windowKey(budgetId, windowStart) {
-  return `${budgetId}|${windowStart.toISOString()}`;
-}
-function counterKey(budgetId, windowStart, dimension) {
-  return `ai_tokens:budget:${budgetId}:${windowStart.toISOString()}:${dimension}`;
-}
-function counterTtlSeconds(windowStart, windowEnd) {
-  if (windowEnd === null) return TOTAL_WINDOW_TTL_SECONDS;
-  return Math.ceil((windowEnd.getTime() - windowStart.getTime()) / 1e3) + COUNTER_GRACE_SECONDS;
-}
-function dimensionSpends(spend) {
-  return { cost: spend.spentNanoUsd, tokens: BigInt(spend.spentTokens), count: BigInt(spend.spentCount) };
-}
-function counterDimensions(delta, limits) {
-  const dimensions = [];
-  if (limits.nanoUsd !== void 0 && delta.nanoUsd !== 0n) {
-    dimensions.push({ name: "cost", amount: delta.nanoUsd, limit: limits.nanoUsd });
-  }
-  if (limits.tokens !== void 0 && delta.tokens !== 0) {
-    dimensions.push({ name: "tokens", amount: BigInt(delta.tokens), limit: BigInt(limits.tokens) });
-  }
-  if (limits.count !== void 0 && delta.count !== 0) {
-    dimensions.push({ name: "count", amount: BigInt(delta.count), limit: BigInt(limits.count) });
-  }
-  return dimensions;
-}
 function max0(value) {
   return value < 0n ? 0n : value;
 }
@@ -4076,6 +4078,14 @@ function writeHeader(response, name, value) {
 }
 var REAP_BATCH_SIZE = 100;
 var MS_PER_SECOND = 1e3;
+var SCAN_FAILED_LOG_KEY = "ai_tokens.hold_reaper.scan_failed";
+var SWEEP_FAILED_LOG_KEY = "ai_tokens.hold_reaper.sweep_failed";
+function describeError(error) {
+  if (!(error instanceof Error)) return "non-Error rejection";
+  const { code } = error;
+  const suffix = typeof code === "string" || typeof code === "number" ? ` code=${String(code)}` : "";
+  return `name=${error.name} message=${JSON.stringify(error.message)}${suffix}`;
+}
 var HoldReaper = class {
   /**
    * @param ledger The ledger service (expired-hold scan + atomic void claim).
@@ -4098,7 +4108,11 @@ var HoldReaper = class {
   /** Start the periodic sweep on module boot (interval `unref()`'d so it never blocks exit). */
   onApplicationBootstrap() {
     const intervalMs = this.options.holds.reaperIntervalSeconds * MS_PER_SECOND;
-    this.timer = setInterval(() => void this.sweep(), intervalMs);
+    this.timer = setInterval(() => {
+      void this.sweep().catch((error) => {
+        this.logger.warn(`${SWEEP_FAILED_LOG_KEY} ${describeError(error)}`);
+      });
+    }, intervalMs);
     this.timer.unref();
   }
   /** Stop the sweep on shutdown (no open handles left for Jest). */
@@ -4110,12 +4124,19 @@ var HoldReaper = class {
    * Reclaim one batch of expired pending holds. For each: win the atomic
    * `pending → released` claim (a `null` result means another replica won — skip),
    * then run the shared restoration + `hold.released` emission. A failure on one
-   * hold is logged and never aborts the batch (deterministic, idempotent, safe to
-   * run repeatedly).
+   * hold is logged and never aborts the batch; a failure of the expired-hold scan
+   * itself is logged and ends this sweep without throwing (deterministic, idempotent,
+   * safe to run repeatedly).
    */
   async sweep() {
     const cutoff = new Date(this.now().getTime() - this.options.holds.ttlSeconds * MS_PER_SECOND);
-    const expired = await this.ledger.findExpiredHolds(cutoff, REAP_BATCH_SIZE);
+    let expired;
+    try {
+      expired = await this.ledger.findExpiredHolds(cutoff, REAP_BATCH_SIZE);
+    } catch (error) {
+      this.logger.warn(`${SCAN_FAILED_LOG_KEY} ${describeError(error)}`);
+      return;
+    }
     for (const record of expired) {
       try {
         const claimed = await this.ledger.transition(record.id, "pending", "released");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bymax-one/nest-ai-tokens",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "description": "AI token metering & usage-based billing for NestJS 11: provider usage normalizer (×9), versioned effective-dated pricing, immutable append-only ledger, prepaid wallets, multi-dimension budgets, and markup/margin. Zero runtime dependencies.",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",