@farthershore/backend 0.20.0 → 0.21.0

package/dist/types/adapters/express.d.ts

@@ -1,6 +1,6 @@
 import type { FartherShore } from "../core/runtime.js";
 import type { FartherShoreRequestContext } from "../core/verifyRequest.js";
-import type { ConsumerPrincipal } from "../core/verifyContext.js";
+import type { ConsumerPrincipal, FartherShoreSignedContext } from "../core/verifyContext.js";
 /** Minimal Express-shaped types so we don't hard-depend on @types/express. */
 export type ExpressRequestLike = {
     method: string;
@@ -18,6 +18,13 @@ export type ExpressResponseLike = {
     status(code: number): ExpressResponseLike;
     json(body: unknown): unknown;
     setHeader(name: string, value: string): void;
+    /**
+     * Node's `ServerResponse.headersSent`. This is what makes the reporting verb's
+     * transport choice AUTOMATIC: while it is false the measurement rides signed
+     * response headers (no network call); once the response is on the wire
+     * `ctx.report()` transparently switches to the post-stream channel.
+     */
+    headersSent?: boolean;
 };
 export type ExpressNext = (err?: unknown) => void;
 export type ExpressMiddleware = (req: ExpressRequestLike, res: ExpressResponseLike, next: ExpressNext) => void;
@@ -69,14 +76,27 @@ export type MiddlewareOptions = {
  */
 export type VerifiedPrincipalContext = FartherShoreRequestContext & {
     principal: ConsumerPrincipal;
+    signedContext: FartherShoreSignedContext;
 };
 /**
  * A route handler that runs only with a GUARANTEED verified PRINCIPAL. The first
- * argument is the {@link VerifiedPrincipalContext} — read `ctx.principal` (and
- * narrow with `requireMember`/`requireService`) without any optional-chaining.
+ * argument is the {@link VerifiedPrincipalContext} — read `ctx.principal` and
+ * `ctx.signedContext` (and narrow with `requireMember`/`requireService`)
+ * without any optional-chaining.
  * See {@link createExpressHandler}.
  */
 export type VerifiedExpressHandler<Req extends ExpressRequestLike = ExpressRequestLike, Res extends ExpressResponseLike = ExpressResponseLike> = (ctx: VerifiedPrincipalContext, req: Req, res: Res, next: ExpressNext) => void | Promise<void>;
+/** Options for the `fs.handler(options, cb)` overload. */
+export type HandlerOptions = {
+    /**
+     * Permission key the verified principal must hold (unified grammar:
+     * `*` / `<subject>:*` / exact — custom strings work). Checked with the
+     * FAIL-CLOSED carrier gate (`requirePermission`): an ABSENT permission set
+     * denies. On failure the wrapper responds `403 { error: "permission_denied" }`
+     * before the callback runs.
+     */
+    permission?: string;
+};
 /**
  * Build the Express middleware. Captures raw body bytes, calls verifyRequest,
  * and fail-closes on any error.
@@ -106,3 +126,12 @@ export declare function createExpressMiddleware(fs: FartherShore, options?: Midd
  * non-optional guarantee AND Express compatibility.
  */
 export declare function createExpressHandler<Req extends ExpressRequestLike = ExpressRequestLike, Res extends ExpressResponseLike = ExpressResponseLike>(handler: VerifiedExpressHandler<Req, Res>): ExpressMiddleware;
+/**
+ * Options-first overload: `fs.handler({ permission: "widgets:write" }, cb)`
+ * asserts the verified principal holds `permission` (via the fail-closed
+ * carrier gate — an absent permission set DENIES) BEFORE the callback runs,
+ * responding `403 permission_denied` otherwise. The key is checked with the
+ * unified grammar (`*` / `<subject>:*` / exact); derive route-shaped keys with
+ * `routePermission(subject, method)`.
+ */
+export declare function createExpressHandler<Req extends ExpressRequestLike = ExpressRequestLike, Res extends ExpressResponseLike = ExpressResponseLike>(options: HandlerOptions, handler: VerifiedExpressHandler<Req, Res>): ExpressMiddleware;

package/dist/types/core/permissions.d.ts

@@ -13,21 +13,33 @@ export declare class FartherShorePermissionError extends Error {
     constructor(requiredPermission: string, message?: string);
 }
 /**
- * Pure grant check — a FAITHFUL COPY of the canonical `permissionGrants` in
- * `@farthershore/contracts` (`rbac.ts`). Over a DEFINED array: a `"*"` entry
- * grants everything, otherwise the key must be an exact member. Its
- * `undefined → true` codomain is the PRIMITIVE's contract (kept byte-identical
- * to contracts for parity); it is NOT the SDK's carrier policy. Under FAR-723
- * the carrier gate {@link hasPermission} DENIES an absent permission set before
- * this primitive is consulted, so absence never grants at the boundary.
+ * HTTP verbs that classify as `:read`. Everything else — including the
+ * route-catalog wildcard `*` — classifies as `:write`.
  *
- * The published SDK surface must stay contracts-free, so it can't import the
- * canonical primitive. A TEST-ONLY parity guard (`permissions-parity.test.ts`,
- * which CAN import contracts as a devDependency) asserts this copy agrees with
- * the canonical primitive across a shared golden vector table, so the copy
- * can't silently drift.
+ * FAITHFUL COPY of the canonical `READ_METHODS` in the permissions kernel
+ * (`@farthershore/authz/grammar/route`, re-exported by
+ * `@farthershore/contracts/rbac`); the published bundle is contracts-free, so
+ * `permissions-parity.test.ts` asserts agreement and the full corpus replay
+ * lives in packages/authz/test-node/sdk-copy-parity.test.ts.
  */
-export declare function permissionGrants(permissions: readonly string[] | undefined, key: string): boolean;
+export declare const READ_METHODS: ReadonlySet<string>;
+/**
+ * Derive the permission string a credential must hold to call a route:
+ * `<subject>:read` for safe verbs (GET / HEAD / OPTIONS, any casing),
+ * `<subject>:write` for every other method INCLUDING the route-catalog
+ * wildcard `*`. Use it to build in-handler permission keys from the same
+ * grammar the edge `permission` constraint enforces — never re-spell the
+ * `:read`/`:write` suffix locally.
+ *
+ * FAITHFUL COPY of the canonical `routePermission` in the permissions kernel
+ * (`@farthershore/authz/grammar/route`, re-exported by
+ * `@farthershore/contracts/rbac`); parity asserted as for {@link READ_METHODS}.
+ *
+ * @param subject the matched route's permission subject (used verbatim)
+ * @param method the REQUEST method (case-insensitive) or a route-catalog
+ *   method entry (`*` → `:write`)
+ */
+export declare function routePermission(subject: string, method: string): string;
 /**
  * Whether the granted `permissions` satisfy the required `key` under the
  * unified grammar: `"*"` (global), `"<subject>:*"` (subject wildcard), or the

package/dist/types/core/post-stream-usage.d.ts

@@ -5,10 +5,23 @@ export type ReportUsageInput = {
     meters: Record<string, number>;
     creditUnitsConsumed?: Record<string, number>;
     measureContext?: Record<string, unknown>;
-};
-export type RequestScopedReportUsageInput = Omit<ReportUsageInput, "requestId" | "subscriptionId"> & {
-    requestId?: string;
-    subscriptionId?: string;
+    /** Schema version of {@link measurements}; currently `1`. */
+    measurementsVersion?: number;
+    /**
+     * The measurement lane (`{ meter, values, dims }`) — the authoritative rating
+     * input `ctx.report()` emits. Additive over `meters`, which remains the flat
+     * projection core's existing settlement path reads.
+     */
+    measurements?: {
+        meter: string;
+        values: Record<string, number>;
+        dims?: Record<string, string>;
+    }[];
+    /** Proposed rate input for a `backendQuoted` pricing rule (core clamps it). */
+    quote?: {
+        currency: string;
+        amountNanos: string;
+    };
 };
 export type ReportUsageResult = {
     ok: true;
@@ -45,5 +58,7 @@ export declare class PostStreamUsageClient {
     private readonly maxRetryDelayMs;
     constructor(options: PostStreamUsageClientOptions);
     reportUsage(input: ReportUsageInput): Promise<ReportUsageResult>;
+    /** Enforce the token's meter scope + per-event bounds on the measurement lane. */
+    private validateMeasurements;
     private retryDelayForAttempt;
 }

package/dist/types/core/report.d.ts

@@ -0,0 +1,133 @@
+import { type ResponseMeteringUsagePayload } from "../response-metering.js";
+/** Observed measurement values, keyed by measure key. */
+export type MeasurementValues = Record<string, number>;
+/** Catalog selectors the measurement was produced under, keyed by dimension. */
+export type MeasurementDimensions = Record<string, string>;
+/**
+ * The validated, transmitted quote — a PROPOSED rate input, never a charge.
+ * `amountNanos` is a decimal integer string of nanodollars **per unit of the
+ * entry's measure** (the platform's money unit is the nanodollar); core
+ * multiplies it by the measured quantity, clamps it into the pricing policy's
+ * declared per-unit `{min,max}`, and flags out-of-range proposals for dispute.
+ * Never send a total.
+ */
+export type QuoteProposal = {
+    currency: string;
+    amountNanos: string;
+};
+/**
+ * Authoring shape of {@link QuoteProposal}. `amountNanos` (nanodollars PER
+ * UNIT of the entry's measure) accepts a number, bigint, or decimal integer
+ * string; anything else is rejected.
+ */
+export type QuoteInput = {
+    currency: string;
+    amountNanos: number | bigint | string;
+};
+/** One measurement report. The complete argument surface of the verb. */
+export type ReportInput = {
+    /** Meter key as declared in the business release (plain string at the wire). */
+    meter: string;
+    /** Observed values keyed by measure key, e.g. `{ input_tokens: 1200 }`. */
+    values: MeasurementValues;
+    /** Catalog selectors, e.g. `{ model: "acme-4", cache_status: "hit" }`. */
+    dims?: MeasurementDimensions;
+    /**
+     * OPTIONAL money proposal for a `backendQuoted` pricing rule: a PER-UNIT
+     * rate in nanodollars (multiplied by the measured quantity — never a
+     * total). Opaque at the authoring boundary (a job result carries it through
+     * untyped); validated against {@link QuoteInput} here and transmitted as a
+     * {@link QuoteProposal}. Applies to every backend-quoted component of this
+     * report; ignored by rules that are not backend-quoted.
+     */
+    quote?: unknown;
+};
+/** Which channel actually carried the measurement. */
+export type ReportTransport = "in_band" | "post_stream";
+/**
+ * Delivery outcome. Validation faults THROW (a malformed report is a builder
+ * bug worth surfacing); delivery faults resolve `ok: false` so a metering
+ * hiccup never breaks the builder's endpoint. A served request may own only
+ * one post-stream callback identity, so later calls fail explicitly.
+ */
+export type ReportResult = {
+    ok: true;
+    transport: ReportTransport;
+} | {
+    ok: false;
+    transport: ReportTransport;
+    reason: string;
+};
+/** The wire shape of one validated measurement. */
+export type Measurement = {
+    meter: string;
+    values: MeasurementValues;
+    dims?: MeasurementDimensions;
+};
+/** Version of the `measurements` payload lane (additive over `rawDimsUnits`). */
+export declare const MEASUREMENTS_VERSION = 1;
+/** The transport seam a host adapter supplies for the in-band lane. */
+export type ResponseSink = {
+    /** True while headers can still be stamped onto the outgoing response. */
+    canStampHeaders(): boolean;
+    /** Stamp the signed metering headers onto the outgoing response. */
+    stampHeaders(headers: Record<string, string>): void;
+};
+/** Everything `report()` needs that only the runtime can provide. */
+export type ReportChannels = {
+    /** Sign the payload into `x-fs-metering*` headers (may resolve `{}`). */
+    computeHeaders(payload: ResponseMeteringUsagePayload): Promise<Record<string, string>>;
+    /** Deliver over the attested post-stream channel. */
+    postStream(input: {
+        measurements: Measurement[];
+        quote?: QuoteProposal;
+    }): Promise<{
+        ok: boolean;
+        reason?: string;
+    }>;
+    /** Method/path of the served request, for the in-band payload binding. */
+    request?: {
+        method: string;
+        path: string;
+    };
+    /** Host-supplied response seam; absent ⇒ the post-stream lane is used. */
+    responseSink?: ResponseSink;
+};
+/**
+ * `report()` accepts one measurement or an ARRAY of measurements. The array
+ * form is the sanctioned way to report several meters after the response is
+ * sent: one served request owns exactly ONE post-stream callback identity, so
+ * sequential awaited single reports after the first flush cannot be delivered
+ * — a batch rides the single callback atomically. All entries of a batch
+ * share one quote (at most one distinct quote may be supplied).
+ */
+export type ReportFn = (input: ReportInput | readonly ReportInput[]) => Promise<ReportResult>;
+/**
+ * Build the bound `report()` verb for a verified context. The returned function
+ * validates, picks its own transport, and never asks the caller for identity.
+ */
+export declare function createReportFn(channels: ReportChannels): ReportFn;
+/**
+ * The `report()` stub attached to a context produced by the BARE
+ * `verifyRequest()` primitive (no runtime, therefore no metering channel). It
+ * throws an error that names the fix instead of pretending the measurement was
+ * delivered.
+ */
+export declare function unattachedReport(): ReportFn;
+/**
+ * Project a measurement into the flat `rawDimsUnits` lane the gateway's
+ * in-band settlement path consumes.
+ *
+ * PROJECTION RULE (P0-2): the projection keys the METER id, and its scalar is
+ * the sum of the measurement's measure values — the meter's structural
+ * quantity. The gateway masks `rawDimsUnits` by the matched route's declared
+ * METER ids (`maskCostMapByMeters`), so measure-keyed entries would be
+ * silently discarded at the edge (UNBILLED). Per-measure detail is NOT lost:
+ * the full `{ meter, values, dims }` measurement rides alongside in the
+ * versioned `measurements` lane, which is the authoritative rating input.
+ */
+export declare function rawDimsUnitsOf(measurement: Measurement): Record<string, number>;
+/** Validate one report input into its wire {@link Measurement}. */
+export declare function validateMeasurement(input: ReportInput): Measurement;
+/** Validate an opaque authored quote into its wire {@link QuoteProposal}. */
+export declare function validateQuote(quote: unknown): QuoteProposal;

package/dist/types/core/runtime.d.ts

@@ -1,7 +1,6 @@
 import { type RuntimeBootstrapResponse, type RuntimeHealthReport } from "../runtime-types.js";
 import type { ReconcileResult } from "../reflect/reconcile.js";
-import { type MeterOptions } from "./metering.js";
-import { type ReportUsageInput, type ReportUsageResult } from "./post-stream-usage.js";
+import { type ResponseSink } from "./report.js";
 import { type NonceStore } from "./nonceCache.js";
 import { type ReplayProtectionDiagnostic } from "./replay-protection.js";
 import { type SpawnFn } from "./tunnel.js";
@@ -22,10 +21,7 @@ export type FartherShoreTunnelOptions = {
 export type FartherShoreInitOptions = {
     /** Explicit runtime token. Defaults to process.env.FS_RUNTIME_TOKEN. */
     runtimeToken?: string;
-    /**
-     * Core base URL. Defaults to FS_CORE_URL / FARTHERSHORE_CORE_URL or
-     * https://core.farthershore.com.
-     */
+    /** Core base URL. Defaults to FS_CORE_URL or https://core.farthershore.com. */
     coreUrl?: string;
     /** Env map (tests). Defaults to process.env. */
     env?: Record<string, string | undefined>;
@@ -71,6 +67,15 @@ export type FartherShoreInitOptions = {
      */
     nonceStore?: NonceStore;
 };
+/**
+ * Host-adapter seams for `verifyRequest`. An adapter that owns the outgoing
+ * response (the Express middleware) supplies a {@link ResponseSink} so
+ * `ctx.report()` can choose the zero-network in-band header transport while the
+ * response is still open. Without one, reports take the post-stream channel.
+ */
+export type VerifyRequestHostOptions = {
+    responseSink?: ResponseSink;
+};
 export declare const SDK_VERSION: string;
 /**
  * The runtime instance. Lazily bootstraps; holds the JWKS client, nonce cache,
@@ -91,7 +96,6 @@ export declare class FartherShore {
     private readonly replayProtectionDiagnostic;
     private readonly shutdownManager;
     private jwks;
-    private meteringClient;
     private postStreamUsageClient;
     private tunnel;
     private bootstrapped;
@@ -119,7 +123,14 @@ export declare class FartherShore {
      * Framework-neutral verification primitive. Fail-closed: throws a typed
      * FartherShoreError on any verification failure. Returns the verified context.
      */
-    verifyRequest(input: VerifyRequestInput): Promise<FartherShoreRequestContext>;
+    verifyRequest(input: VerifyRequestInput, options?: VerifyRequestHostOptions): Promise<FartherShoreRequestContext>;
+    /**
+     * Bind the ONE reporting verb to a verified context. Identity comes from the
+     * context (`signedContext.subscriptionId` + `requestId`) — never from the
+     * caller — so a handler cannot forget it, and a background job that is handed
+     * this context keeps reporting against the SAME served identity.
+     */
+    private buildReportFn;
     /** Whether verification is required (bootstrap × opt-out). */
     verificationRequired(): Promise<boolean>;
     /**
@@ -133,10 +144,12 @@ export declare class FartherShore {
      * (request verification stays fail-closed regardless — a different axis).
      */
     start(): Promise<void>;
-    /** Record metering usage (billing-only). */
-    meter(meter: string, qty: number, options?: MeterOptions): Promise<void>;
-    /** Best-effort attested post-stream usage callback. Never rejects. */
-    reportUsage(input: ReportUsageInput): Promise<ReportUsageResult>;
+    /**
+     * PRIVATE transport for the post-stream lane of `ctx.report()`. Never rejects
+     * — a metering hiccup must not break a builder's endpoint. This is machinery,
+     * not surface: the ONE public reporting verb is `ctx.report()`.
+     */
+    private reportPostStreamUsage;
     /**
      * How far replay protection actually reaches — `"shared"` (enforced across
      * every replica) or `"single-instance"` (this process only). Deployment

package/dist/types/core/verifyRequest.d.ts

@@ -1,4 +1,4 @@
-import type { ReportUsageResult, RequestScopedReportUsageInput } from "./post-stream-usage.js";
+import { type ReportFn } from "./report.js";
 import { type ConsumerPrincipal, type FartherShoreSignedContext } from "./verifyContext.js";
 import type { JwksClient } from "./jwks.js";
 import type { NonceStore } from "./nonceCache.js";
@@ -60,9 +60,27 @@ export type FartherShoreRequestContext = {
     signedContext?: FartherShoreSignedContext;
     /** Managed-RBAC role keys the acting subject holds (display/audit only). */
     roles?: string[];
-    /** Request-bound post-stream reporter, attached by the runtime facade. */
-    reportUsage?: (input: RequestScopedReportUsageInput) => Promise<ReportUsageResult>;
+    /**
+     * THE reporting verb. `report({ meter, values, dims?, quote? })` reports
+     * MEASUREMENTS against the served identity this context already carries —
+     * there is no subscription/release argument to forget. The SDK picks the
+     * transport (signed in-band headers before the response is sent, the attested
+     * post-stream channel after it, or from a background job), so the builder
+     * never chooses one.
+     *
+     * Attached by the runtime facade. A context produced by the BARE
+     * `verifyRequest()` primitive has no metering channel, so its `report()`
+     * throws an error naming the fix rather than dropping the measurement.
+     */
+    report: ReportFn;
 };
+/**
+ * The verified Farther Shore context — the identity + reporting handle a
+ * handler (or a background job the handler hands it to) works with. Alias of
+ * {@link FartherShoreRequestContext}: a background job is simply given the
+ * already-verified context, so there is no second context type to learn.
+ */
+export type FartherShoreContext = FartherShoreRequestContext;
 export type VerifyRequestDeps = {
     jwks: JwksClient;
     nonceCache: NonceStore;

package/dist/types/generated/runtime-contract.d.ts

@@ -1,127 +1,3 @@
-export declare const RUNTIME_CONTRACT_VERSION: 1;
-export declare const RUNTIME_TOKEN_ENV: "FS_RUNTIME_TOKEN";
-export declare const RUNTIME_TOKEN_CONTRACT: {
-    readonly environmentVariable: "FS_RUNTIME_TOKEN";
-    readonly prefixes: {
-        readonly live: "fsrt_live_";
-        readonly test: "fsrt_test_";
-    };
-    readonly opaque: true;
-    readonly storage: "sha256-hash-only";
-    readonly lastFour: true;
-    readonly capabilities: readonly ["gateway_verification", "metering", "health", "tunnel"];
-};
-export declare const RUNTIME_BOOTSTRAP_CONTRACT: {
-    readonly method: "POST";
-    readonly path: "/v1/runtime/bootstrap";
-    readonly authorization: "Bearer fsrt_...";
-    readonly request: {
-        readonly instanceId: "string?";
-        readonly sdkVersion: "string?";
-        readonly sdkLanguage: "string?";
-    };
-    readonly response: {
-        readonly product: {
-            readonly id: "string";
-            readonly slug: "string";
-        };
-        readonly backend: {
-            readonly id: "string";
-            readonly slug: "string";
-            readonly name: "string";
-        };
-        readonly environment: {
-            readonly id: "string?";
-            readonly kind: "live | test";
-        };
-        readonly capabilities: "string[]";
-        readonly verification: {
-            readonly required: "boolean";
-            readonly jwksUrl: "string";
-            readonly clockSkewSeconds: "number";
-            readonly replayWindowSeconds: "number";
-            readonly headerNames: "object";
-        };
-        readonly metering: {
-            readonly enabled: "boolean";
-            readonly endpoint: "string";
-            readonly credential: "string";
-            readonly allowedMeters: "string[]";
-            readonly allowedRoutes: "string[]";
-            readonly perEventMax: "number";
-        };
-        readonly transport: {
-            readonly mode: "direct | tunnel";
-            readonly runner: "embedded | sidecar | null";
-            readonly originUrl: "string?";
-            readonly originHostname: "string?";
-            readonly localTarget: "string?";
-            readonly cloudflared: "object?";
-        };
-        readonly routes: "object[]";
-        readonly policyVersion: "string";
-        readonly refreshAfterSeconds: "number";
-    };
-};
-export declare const RUNTIME_SIGNING_CONTRACT: {
-    readonly algorithm: "Ed25519";
-    readonly encoding: "base64url";
-    readonly keyMaterial: "service-jwt-jwks";
-    readonly canonicalString: {
-        readonly description: "Byte-exact, language-neutral serialization of the signed claim set. Fields are emitted in the FIXED order below, one per line, each as `name:value`, joined by a single newline (\\n, U+000A). NO trailing newline. The serialization depends on neither JSON key ordering nor any Node.js Buffer/serialization detail — only UTF-8 byte encoding of the field values. Empty/absent values are emitted as the empty string after the colon. Go/Python/Java/Rust reproduce this identically.";
-        readonly fieldSeparator: "\n";
-        readonly keyValueSeparator: ":";
-        readonly trailingNewline: false;
-        readonly fieldEncoding: "utf-8";
-        readonly fields: readonly ["method", "path", "query", "body-hash", "request-id", "timestamp", "business-id", "backend-id", "route-id", "policy-version", "context-hash"];
-        readonly fieldRules: {
-            readonly method: "Uppercased HTTP method (e.g. GET, POST).";
-            readonly path: "Request path, percent-encoded as received, no host, no query string. Always begins with '/'.";
-            readonly query: "The request's query string bytes VERBATIM, after the caller has stripped the URL's single leading '?' delimiter. Use the RAW wire query exactly as received — NO sorting, NO filtering, NO re-stripping a leading '?', NO dropping empty pairs, NO re-encoding. The signature binds to the exact query bytes: any reorder, added/removed/relocated pair, or re-encoding changes the bytes and MUST fail verification. Every SDK verifier MUST read the raw wire query (never a re-parsed/re-serialized form, which could reorder or re-encode and would then fail legitimate requests). Any normalization (sorting by name or value, dropping/moving empty pairs, re-stripping '?') is FORBIDDEN — each collapses distinct wire queries under one signature. Empty string when there is no query.";
-            readonly "body-hash": "Lowercase hex SHA-256 of the RAW request body bytes. For an empty body, the SHA-256 of zero bytes (e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855). Streaming-exempt requests use the literal token 'STREAM'.";
-            readonly "request-id": "Opaque unique request id minted by the gateway (also the replay-cache nonce).";
-            readonly timestamp: "Integer Unix epoch seconds (UTC) at signing time, as a base-10 string with no padding.";
-            readonly "business-id": "Business id the request is routed to.";
-            readonly "backend-id": "Backend id the route binds to.";
-            readonly "route-id": "Resolved route id; empty string if the route is unresolved.";
-            readonly "policy-version": "Tenant artifact / policy version the gateway signed under.";
-            readonly "context-hash": "Lowercase hex SHA-256 of the presented X-Fs-Context JWT string (identity-context binding). For a request with no signed context, the SHA-256 of the empty string (e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855). Binds the identity context into the request signature so one verification covers both.";
-        };
-    };
-};
-/**
- * Ordered list of fields in the canonical signing string. The order here is
- * load-bearing and identical across all language SDKs.
- */
-export declare const RUNTIME_CANONICAL_FIELDS: readonly ["method", "path", "query", "body-hash", "request-id", "timestamp", "business-id", "backend-id", "route-id", "policy-version", "context-hash"];
-export declare const RUNTIME_BODY_HASH_CONTRACT: {
-    readonly algorithm: "SHA-256";
-    readonly encoding: "hex-lower";
-    readonly source: "raw-request-bytes";
-    readonly emptyBodyHash: "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
-    readonly maxBodyBytes: 10485760;
-    readonly streamingExemptToken: "STREAM";
-    readonly streamingExemptContentTypes: readonly ["text/event-stream", "application/octet-stream", "multipart/form-data"];
-    readonly overMaxStatus: 413;
-};
-export declare const RUNTIME_HEADERS: {
-    readonly signature: "x-fs-signature";
-    readonly keyId: "x-fs-key-id";
-    readonly requestId: "x-fs-request-id";
-    readonly timestamp: "x-fs-timestamp";
-    readonly businessId: "x-fs-business-id";
-    readonly backendId: "x-fs-backend-id";
-    readonly routeId: "x-fs-route-id";
-    readonly policyVersion: "x-fs-policy-version";
-    readonly bodyHash: "x-fs-body-hash";
-};
-export declare const RUNTIME_REPLAY_CONTRACT: {
-    readonly windowSeconds: 300;
-    readonly clockSkewSeconds: 5;
-    readonly nonce: "x-fs-request-id";
-    readonly nonceCache: "bounded-lru";
-    readonly policy: "fail-closed";
-};
 export declare const RUNTIME_ERROR_CODES: {
     readonly missingSignature: "missing_signature";
     readonly malformedSignature: "malformed_signature";
@@ -143,40 +19,15 @@ export declare const RUNTIME_ERROR_CODES: {
     readonly surfaceNotAllowed: "surface_not_allowed";
 };
 export type RuntimeErrorCode = (typeof RUNTIME_ERROR_CODES)[keyof typeof RUNTIME_ERROR_CODES];
-export declare const RUNTIME_METERING_CONTRACT: {
-    readonly endpoint: "/v1/metering/events";
-    readonly method: "POST";
-    readonly credential: "reusable-bearer";
-    readonly event: {
-        readonly event_id: "string";
-        readonly business_id: "string";
-        readonly backend_id: "string";
-        readonly route_id: "string?";
-        readonly request_id: "string?";
-        readonly requestId: "string?";
-        readonly subscriptionId: "string";
-        readonly nonce: "string?";
-        readonly meter: "string";
-        readonly qty: "number";
-        readonly timestamp: "string";
-    };
-    readonly postStreamEvent: {
-        readonly requestId: "string";
-        readonly subscriptionId: "string?";
-        readonly nonce: "string";
-        readonly meters: "Record<string, number>";
-        readonly creditUnitsConsumed: "Record<string, number>?";
-        readonly measureContext: "Record<string, unknown>?";
-        readonly signature: "string";
-    };
-    readonly idempotencyKey: "event_id";
-    readonly delivery: "at-least-once";
-    readonly billingOnly: true;
-    readonly realtimeEnforced: false;
-    readonly postStreamBillingOnly: true;
-    readonly postStreamRealtimeEnforced: false;
-    readonly postStreamTrustModel: "HMAC-attested and bound to one served postStreamBilling gateway request. Core writes one billable UsageEvent using the served plan and time. The callback never mutates Durable Object enforcement windows.";
-    readonly trustModel: "upstream-reported values are NOT cryptographically attested; a buggy or compromised upstream can self-report arbitrary values for its OWN product only. Core enforces allowedMeters/allowedRoutes from the authoritative token record at ingest, applies a per-event sanity max (perEventMax), and raises an implausible-volume alert.";
+export declare const RUNTIME_BODY_HASH_CONTRACT: {
+    readonly algorithm: "SHA-256";
+    readonly encoding: "hex-lower";
+    readonly source: "raw-request-bytes";
+    readonly emptyBodyHash: "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
+    readonly maxBodyBytes: 10485760;
+    readonly streamingExemptToken: "STREAM";
+    readonly streamingExemptContentTypes: readonly ["text/event-stream", "application/octet-stream", "multipart/form-data"];
+    readonly overMaxStatus: 413;
 };
 export declare const RUNTIME_RESPONSE_METERING_CONTRACT: {
     readonly headers: {
@@ -198,14 +49,18 @@ export declare const RUNTIME_RESPONSE_METERING_CONTRACT: {
     readonly payload: {
         readonly method: "string";
         readonly path: "string";
-        readonly rawDimsUnits: "Record<string, number>";
+        readonly rawDimsUnits: "Record<string, number>?";
         readonly measureContext: "Record<string, unknown>?";
         readonly creditUnitsConsumed: "Record<string, number>?";
+        readonly measurementsVersion: "1?";
+        readonly measurements: "Array<{ meter: string; values: Record<string, number>; dims?: Record<string, string> }>?";
+        readonly quote: "{ currency: string; amountNanos: string }?";
     };
     readonly errors: {
         readonly missingToken: "missing_token";
         readonly invalidMeterKey: "invalid_meter_key";
         readonly invalidMeterValue: "invalid_meter_value";
+        readonly invalidQuote: "invalid_quote";
     };
     readonly httpAdapter: {
         readonly input: "Request";
@@ -215,33 +70,3 @@ export declare const RUNTIME_RESPONSE_METERING_CONTRACT: {
         readonly gatewayStripsInternalHeaders: true;
     };
 };
-export declare const RUNTIME_HEALTH_CONTRACT: {
-    readonly endpoint: "/v1/runtime/health";
-    readonly method: "POST";
-    readonly request: {
-        readonly instanceId: "string?";
-        readonly status: "starting | ready | degraded | stopping";
-    };
-    readonly readinessStates: readonly ["UNKNOWN", "WAITING", "READY", "DEGRADED", "OFFLINE"];
-    readonly checks: readonly ["runtime_token_valid", "bootstrapped", "tunnel_running", "signed_request_2xx", "unsigned_request_401", "stale_signature_401", "wrong_route_401", "metering_observed"];
-    readonly report: {
-        readonly runtimeToken: "boolean";
-        readonly bootstrap: "boolean";
-        readonly tunnel: "string?";
-        readonly verification: "boolean";
-        readonly metering: "boolean";
-    };
-};
-export declare const RUNTIME_TRANSPORT_CONTRACT: {
-    readonly modes: {
-        readonly direct: "Gateway fetches the builder's public origin URL; the SDK middleware fail-closed-verifies every request via Ed25519 request signing. Provisions zero Cloudflare objects. Available on all tiers; also the dev path.";
-        readonly tunnel: "Farther Shore provisions a private outbound Cloudflare Tunnel; no inbound port. The Production-secure tier. Consumes Cloudflare tunnel/route slots.";
-    };
-    readonly runners: {
-        readonly embedded: "fs.start() supervises cloudflared as a child process (default DX).";
-        readonly sidecar: "Vanilla cloudflare/cloudflared container beside the app (production / non-Node).";
-    };
-    readonly channelTrust: readonly ["tunnel"];
-    readonly requestTrust: "x-fs-signature";
-    readonly invariant: "Channel trust (tunnel) and request trust (the X-FS-* signature) are distinct layers; both always apply. CF-Access-* headers are transport-layer only and are IGNORED by the SDK.";
-};