@nehorai/credits 2.0.0 → 2.2.0

package/dist/repository/index.d.cts

@@ -1,6 +1,6 @@
-import { I as ICreditRepository, b as AddCreditsV2Input, a as AddCreditsOutcome, l as ReservationTransitionOptions, C as CommitOutcome, R as ReleaseOutcome, m as ReserveCreditsV2Input, n as ReserveOutcome, g as CreditBalanceUpdate, o as TierUpdateInput, d as CreateReservationInput, i as ExpireReservationV2Options, E as ExpireOutcome, A as AddCreditsAtomicOptions, e as CreateTransactionInput, f as CreateUsageLogInput, U as UsageLogQuery, c as CreateJournalEntryInput, J as JournalEntryQuery } from '../types-C8hZMe8a.cjs';
-export { h as CreditRepositoryFactory, j as ICreditRepositoryCreditsV2, k as ICreditRepositoryV2, s as reservationJournalKey, t as supportsCreditsV2, u as supportsIdempotentCredit, v as toClientUserCredits } from '../types-C8hZMe8a.cjs';
-import { c as PortableUserCredits, S as SubscriptionTier, a as PortableReservation, R as ReservationStatus, P as PortableTransaction, d as PortableUsageLog, f as PortableJournalEntry, M as MonthlyResetResult, e as SubscriptionExpiryResult } from '../types-DJ8yqaVr.cjs';
+import { I as ICreditRepository, b as AddCreditsV2Input, a as AddCreditsOutcome, m as ReservationTransitionOptions, C as CommitOutcome, R as ReleaseOutcome, n as ReserveCreditsV2Input, o as ReserveOutcome, g as CreditBalanceUpdate, h as CreditPolicyOptions, p as TierUpdateInput, d as CreateReservationInput, j as ExpireReservationV2Options, E as ExpireOutcome, A as AddCreditsAtomicOptions, e as CreateTransactionInput, f as CreateUsageLogInput, U as UsageLogQuery, c as CreateJournalEntryInput, J as JournalEntryQuery } from '../types-XSjNXO5l.cjs';
+export { i as CreditRepositoryFactory, k as ICreditRepositoryCreditsV2, l as ICreditRepositoryV2, t as reservationJournalKey, u as supportsCreditsV2, v as supportsIdempotentCredit, w as toClientUserCredits } from '../types-XSjNXO5l.cjs';
+import { c as PortableUserCredits, S as SubscriptionTier, a as PortableReservation, R as ReservationStatus, P as PortableTransaction, d as PortableUsageLog, f as PortableJournalEntry, M as MonthlyResetResult, e as SubscriptionExpiryResult } from '../types-MaViK5tD.cjs';
 
 /**
  * One reservation flow for both repository generations.
@@ -62,6 +62,7 @@ declare function addCreditsThroughRepository(repository: ICreditRepository, inpu
  * These are pure functions with no server-only dependencies,
  * making them safe to use in any repository implementation.
  */
+
 /**
  * Generate a unique ID
  * Uses timestamp + random string for uniqueness
@@ -77,6 +78,27 @@ declare function toDate(value: Date | string | unknown): Date;
  * Used for calculating monthly reset dates
  */
 declare function getNextMonthlyReset(from?: Date): Date;
+/** Result of validating a balance update. */
+interface BalanceValidationResult {
+    valid: boolean;
+    errors: string[];
+}
+/**
+ * Whether an update leaves a valid account: no negative field, and `reserved` covered
+ * by `balance + bonusCredits`, which is the floor outstanding holds put under the
+ * balance. An increment is applied on top of the absolute value when a call names both.
+ *
+ * An update is a delta the caller asked for, so one that cannot be honoured is refused,
+ * as a deduct is. Only tier writes and resets stop at the floor: they state a target.
+ *
+ * A negative balance increment is a charge, so it draws only on the balance above
+ * `expiredHoldBacking`: those credits are expired and leave when their hold closes, so
+ * charging them would hand the charge back. An absolute balance replaces the field and
+ * the marks with it, so only an increment on the stored balance meets this limit.
+ */
+declare function validateBalanceUpdate(current: Pick<PortableUserCredits, "balance" | "bonusCredits" | "reserved" | "expiredHoldBacking">, updates: CreditBalanceUpdate): BalanceValidationResult;
+/** Refuse an update {@link validateBalanceUpdate} finds invalid. */
+declare function assertValidBalanceUpdate(current: Pick<PortableUserCredits, "balance" | "bonusCredits" | "reserved" | "expiredHoldBacking">, updates: CreditBalanceUpdate): void;
 
 /**
  * In-Memory Credit Repository Implementation
@@ -92,6 +114,8 @@ declare function getNextMonthlyReset(from?: Date): Date;
 
 declare class InMemoryCreditRepository implements ICreditRepository {
     private readonly store;
+    private readonly options;
+    constructor(options?: CreditPolicyOptions);
     /**
      * A copy, never the live record.
      *
@@ -192,7 +216,11 @@ declare class InMemoryCreditRepository implements ICreditRepository {
         creditsReleased: number;
         errors: string[];
     }>;
-    atomicMonthlyReset(userId: string, tier: SubscriptionTier, expectedResetAt: Date | string): Promise<MonthlyResetResult>;
+    /**
+     * @param _tier - Not trusted. The caller read it earlier and the account may
+     *   have changed tier since, so the reset uses the tier stored on the account.
+     */
+    atomicMonthlyReset(userId: string, _tier: SubscriptionTier, expectedResetAt: Date | string): Promise<MonthlyResetResult>;
     checkAndHandleSubscriptionExpiry(userId: string, gracePeriodDays?: number): Promise<SubscriptionExpiryResult>;
     /**
      * Clear all data (useful for testing)
@@ -221,6 +249,6 @@ declare class InMemoryCreditRepository implements ICreditRepository {
  * Create a new in-memory repository instance
  * Each call creates a fresh, isolated instance
  */
-declare function createInMemoryCreditRepository(): InMemoryCreditRepository;
+declare function createInMemoryCreditRepository(options?: CreditPolicyOptions): InMemoryCreditRepository;
 
-export { AddCreditsAtomicOptions, AddCreditsV2Input, CreateJournalEntryInput, CreateReservationInput, CreateTransactionInput, CreateUsageLogInput, CreditBalanceUpdate, ExpireReservationV2Options, ICreditRepository, InMemoryCreditRepository, JournalEntryQuery, ReservationTransitionOptions, ReserveCreditsV2Input, TierUpdateInput, UsageLogQuery, addCreditsThroughRepository, commitThroughRepository, createInMemoryCreditRepository, generateId, getNextMonthlyReset, releaseThroughRepository, reserveThroughRepository, toDate };
+export { AddCreditsAtomicOptions, AddCreditsV2Input, type BalanceValidationResult, CreateJournalEntryInput, CreateReservationInput, CreateTransactionInput, CreateUsageLogInput, CreditBalanceUpdate, ExpireReservationV2Options, ICreditRepository, InMemoryCreditRepository, JournalEntryQuery, ReservationTransitionOptions, ReserveCreditsV2Input, TierUpdateInput, UsageLogQuery, addCreditsThroughRepository, assertValidBalanceUpdate, commitThroughRepository, createInMemoryCreditRepository, generateId, getNextMonthlyReset, releaseThroughRepository, reserveThroughRepository, toDate, validateBalanceUpdate };

package/dist/repository/index.d.ts

@@ -1,6 +1,6 @@
-import { I as ICreditRepository, b as AddCreditsV2Input, a as AddCreditsOutcome, l as ReservationTransitionOptions, C as CommitOutcome, R as ReleaseOutcome, m as ReserveCreditsV2Input, n as ReserveOutcome, g as CreditBalanceUpdate, o as TierUpdateInput, d as CreateReservationInput, i as ExpireReservationV2Options, E as ExpireOutcome, A as AddCreditsAtomicOptions, e as CreateTransactionInput, f as CreateUsageLogInput, U as UsageLogQuery, c as CreateJournalEntryInput, J as JournalEntryQuery } from '../types-BmG5Omzj.js';
-export { h as CreditRepositoryFactory, j as ICreditRepositoryCreditsV2, k as ICreditRepositoryV2, s as reservationJournalKey, t as supportsCreditsV2, u as supportsIdempotentCredit, v as toClientUserCredits } from '../types-BmG5Omzj.js';
-import { c as PortableUserCredits, S as SubscriptionTier, a as PortableReservation, R as ReservationStatus, P as PortableTransaction, d as PortableUsageLog, f as PortableJournalEntry, M as MonthlyResetResult, e as SubscriptionExpiryResult } from '../types-DJ8yqaVr.js';
+import { I as ICreditRepository, b as AddCreditsV2Input, a as AddCreditsOutcome, m as ReservationTransitionOptions, C as CommitOutcome, R as ReleaseOutcome, n as ReserveCreditsV2Input, o as ReserveOutcome, g as CreditBalanceUpdate, h as CreditPolicyOptions, p as TierUpdateInput, d as CreateReservationInput, j as ExpireReservationV2Options, E as ExpireOutcome, A as AddCreditsAtomicOptions, e as CreateTransactionInput, f as CreateUsageLogInput, U as UsageLogQuery, c as CreateJournalEntryInput, J as JournalEntryQuery } from '../types-3c-IAwZI.js';
+export { i as CreditRepositoryFactory, k as ICreditRepositoryCreditsV2, l as ICreditRepositoryV2, t as reservationJournalKey, u as supportsCreditsV2, v as supportsIdempotentCredit, w as toClientUserCredits } from '../types-3c-IAwZI.js';
+import { c as PortableUserCredits, S as SubscriptionTier, a as PortableReservation, R as ReservationStatus, P as PortableTransaction, d as PortableUsageLog, f as PortableJournalEntry, M as MonthlyResetResult, e as SubscriptionExpiryResult } from '../types-MaViK5tD.js';
 
 /**
  * One reservation flow for both repository generations.
@@ -62,6 +62,7 @@ declare function addCreditsThroughRepository(repository: ICreditRepository, inpu
  * These are pure functions with no server-only dependencies,
  * making them safe to use in any repository implementation.
  */
+
 /**
  * Generate a unique ID
  * Uses timestamp + random string for uniqueness
@@ -77,6 +78,27 @@ declare function toDate(value: Date | string | unknown): Date;
  * Used for calculating monthly reset dates
  */
 declare function getNextMonthlyReset(from?: Date): Date;
+/** Result of validating a balance update. */
+interface BalanceValidationResult {
+    valid: boolean;
+    errors: string[];
+}
+/**
+ * Whether an update leaves a valid account: no negative field, and `reserved` covered
+ * by `balance + bonusCredits`, which is the floor outstanding holds put under the
+ * balance. An increment is applied on top of the absolute value when a call names both.
+ *
+ * An update is a delta the caller asked for, so one that cannot be honoured is refused,
+ * as a deduct is. Only tier writes and resets stop at the floor: they state a target.
+ *
+ * A negative balance increment is a charge, so it draws only on the balance above
+ * `expiredHoldBacking`: those credits are expired and leave when their hold closes, so
+ * charging them would hand the charge back. An absolute balance replaces the field and
+ * the marks with it, so only an increment on the stored balance meets this limit.
+ */
+declare function validateBalanceUpdate(current: Pick<PortableUserCredits, "balance" | "bonusCredits" | "reserved" | "expiredHoldBacking">, updates: CreditBalanceUpdate): BalanceValidationResult;
+/** Refuse an update {@link validateBalanceUpdate} finds invalid. */
+declare function assertValidBalanceUpdate(current: Pick<PortableUserCredits, "balance" | "bonusCredits" | "reserved" | "expiredHoldBacking">, updates: CreditBalanceUpdate): void;
 
 /**
  * In-Memory Credit Repository Implementation
@@ -92,6 +114,8 @@ declare function getNextMonthlyReset(from?: Date): Date;
 
 declare class InMemoryCreditRepository implements ICreditRepository {
     private readonly store;
+    private readonly options;
+    constructor(options?: CreditPolicyOptions);
     /**
      * A copy, never the live record.
      *
@@ -192,7 +216,11 @@ declare class InMemoryCreditRepository implements ICreditRepository {
         creditsReleased: number;
         errors: string[];
     }>;
-    atomicMonthlyReset(userId: string, tier: SubscriptionTier, expectedResetAt: Date | string): Promise<MonthlyResetResult>;
+    /**
+     * @param _tier - Not trusted. The caller read it earlier and the account may
+     *   have changed tier since, so the reset uses the tier stored on the account.
+     */
+    atomicMonthlyReset(userId: string, _tier: SubscriptionTier, expectedResetAt: Date | string): Promise<MonthlyResetResult>;
     checkAndHandleSubscriptionExpiry(userId: string, gracePeriodDays?: number): Promise<SubscriptionExpiryResult>;
     /**
      * Clear all data (useful for testing)
@@ -221,6 +249,6 @@ declare class InMemoryCreditRepository implements ICreditRepository {
  * Create a new in-memory repository instance
  * Each call creates a fresh, isolated instance
  */
-declare function createInMemoryCreditRepository(): InMemoryCreditRepository;
+declare function createInMemoryCreditRepository(options?: CreditPolicyOptions): InMemoryCreditRepository;
 
-export { AddCreditsAtomicOptions, AddCreditsV2Input, CreateJournalEntryInput, CreateReservationInput, CreateTransactionInput, CreateUsageLogInput, CreditBalanceUpdate, ExpireReservationV2Options, ICreditRepository, InMemoryCreditRepository, JournalEntryQuery, ReservationTransitionOptions, ReserveCreditsV2Input, TierUpdateInput, UsageLogQuery, addCreditsThroughRepository, commitThroughRepository, createInMemoryCreditRepository, generateId, getNextMonthlyReset, releaseThroughRepository, reserveThroughRepository, toDate };
+export { AddCreditsAtomicOptions, AddCreditsV2Input, type BalanceValidationResult, CreateJournalEntryInput, CreateReservationInput, CreateTransactionInput, CreateUsageLogInput, CreditBalanceUpdate, ExpireReservationV2Options, ICreditRepository, InMemoryCreditRepository, JournalEntryQuery, ReservationTransitionOptions, ReserveCreditsV2Input, TierUpdateInput, UsageLogQuery, addCreditsThroughRepository, assertValidBalanceUpdate, commitThroughRepository, createInMemoryCreditRepository, generateId, getNextMonthlyReset, releaseThroughRepository, reserveThroughRepository, toDate, validateBalanceUpdate };

package/dist/repository/index.js

@@ -16,6 +16,8 @@ function toClientUserCredits(credits) {
     monthlyUsed: credits.monthlyUsed,
     monthlyResetAt: toISOString(credits.monthlyResetAt),
     subscriptionExpiresAt: credits.subscriptionExpiresAt ? toISOString(credits.subscriptionExpiresAt) : null,
+    ...credits.expiredHoldBacking !== void 0 ? { expiredHoldBacking: credits.expiredHoldBacking } : {},
+    ...credits.signupGrant !== void 0 ? { signupGrant: credits.signupGrant } : {},
     createdAt: toISOString(credits.createdAt),
     updatedAt: toISOString(credits.updatedAt)
   };
@@ -106,6 +108,83 @@ function backedBalanceFloor(reserved, bonusCredits) {
   assertRepresentableAmount(floor, "backedBalanceFloor", { reserved, bonusCredits });
   return floor;
 }
+function spendableBalance(balance, expiredHoldBacking = 0) {
+  return sumAmounts(balance, -Math.min(expiredHoldBacking, balance));
+}
+function planBalanceTarget(target, reserved, bonusCredits) {
+  const balance = Math.max(target, backedBalanceFloor(reserved, bonusCredits));
+  return { balance, expiredHoldBacking: sumAmounts(balance, -target) };
+}
+function planBalanceCap(balance, cap, reserved, bonusCredits, expiredHoldBacking = 0) {
+  const spendable = spendableBalance(balance, expiredHoldBacking);
+  const target = Math.min(spendable, cap);
+  const kept = Math.max(
+    sumAmounts(balance, -spendable),
+    sumAmounts(backedBalanceFloor(reserved, bonusCredits), -target)
+  );
+  const next = Math.min(balance, sumAmounts(target, kept));
+  return { balance: next, expiredHoldBacking: Math.max(0, sumAmounts(next, -target)) };
+}
+function settleExpiredHoldBacking(balance, expiredHoldBacking, holdBacking) {
+  const held = Math.min(expiredHoldBacking, balance);
+  const used = Math.min(held, holdBacking);
+  return { used, remaining: sumAmounts(held, -used) };
+}
+function planHoldCommit(balance, bonusCredits, expiredHoldBacking, holdBacking, amount) {
+  const backing = settleExpiredHoldBacking(balance, expiredHoldBacking, holdBacking);
+  const rest = sumAmounts(amount, -backing.used);
+  const fromSpendable = Math.min(spendableBalance(balance, expiredHoldBacking), rest);
+  const fromBonus = sumAmounts(rest, -fromSpendable);
+  return {
+    covered: fromBonus <= bonusCredits,
+    balance: sumAmounts(balance, -backing.used, -fromSpendable),
+    bonusCredits: sumAmounts(bonusCredits, -fromBonus),
+    expiredHoldBacking: backing.remaining
+  };
+}
+function attributeExpiredBacking(holds, total) {
+  const placed = holds.filter((hold) => hold.holdPlacedAt).sort(
+    (a, b) => a.holdPlacedAt === b.holdPlacedAt ? a.id < b.id ? -1 : 1 : a.holdPlacedAt < b.holdPlacedAt ? -1 : 1
+  );
+  const shares = /* @__PURE__ */ new Map();
+  let left = total;
+  for (const hold of placed) {
+    const kept = Math.min(hold.expiredBacking ?? 0, hold.amount, left);
+    shares.set(hold.id, kept);
+    left = sumAmounts(left, -kept);
+  }
+  for (const hold of placed) {
+    const share = shares.get(hold.id);
+    const added = Math.min(sumAmounts(hold.amount, -share), left);
+    shares.set(hold.id, sumAmounts(share, added));
+    left = sumAmounts(left, -added);
+  }
+  return shares;
+}
+function expiredHoldBackingPatch(next, stored = 0) {
+  return next > 0 || stored > 0 ? { expiredHoldBacking: next } : {};
+}
+function assertValidBalanceTarget(value, field, context) {
+  assertRepresentableAmount(value, field, context);
+  if (value < 0) {
+    throw new CreditError(
+      `${field} cannot be negative (got ${value})`,
+      CreditErrorCode.INVALID_AMOUNT,
+      { field, value, ...context }
+    );
+  }
+}
+function assertValidTierBalanceInput(input, context) {
+  if (input.balanceCap === void 0) return;
+  if (input.balance !== void 0) {
+    throw new CreditError(
+      "A tier update cannot set both balance and balanceCap",
+      CreditErrorCode.INVALID_AMOUNT,
+      { balance: input.balance, balanceCap: input.balanceCap, ...context }
+    );
+  }
+  assertValidBalanceTarget(input.balanceCap, "balanceCap", context);
+}
 function assertRepresentableTierAmount(value, field, context) {
   if (value === Number.POSITIVE_INFINITY) return;
   assertRepresentableAmount(value, field, context);
@@ -295,11 +374,13 @@ var creditSystemConfigSchema = z.object({
   /**
    * Operation costs in credits
    * Keys are operation type names (any non-empty string)
-   * Values are positive numbers representing credit cost
+   * Values are non-negative numbers representing credit cost. 0 marks a free
+   * operation: `withCredits` runs it without touching the ledger. Amounts that
+   * move credits stay strictly positive, so `reserveCredits` refuses a 0.
    */
   operationCosts: z.record(
     z.string().min(1),
-    z.number().positive()
+    z.number().nonnegative()
   ),
   /**
    * Display labels for operation types (English canonical labels).
@@ -321,9 +402,9 @@ var creditSystemConfigSchema = z.object({
    */
   reservationExpiryMs: z.number().positive().default(5 * 60 * 1e3),
   /**
-   * Default credits for new users (free tier)
+   * Default credits for new users (free tier). 0 means no signup grant.
    */
-  defaultFreeCredits: z.number().positive().default(25),
+  defaultFreeCredits: z.number().min(0).default(25),
   /**
    * Grace period in days after subscription expires before downgrade
    */
@@ -753,11 +834,36 @@ function toDate(value) {
   return /* @__PURE__ */ new Date();
 }
 function getNextMonthlyReset(from = /* @__PURE__ */ new Date()) {
-  const next = new Date(from);
-  next.setMonth(next.getMonth() + 1);
-  next.setDate(1);
-  next.setHours(0, 0, 0, 0);
-  return next;
+  return new Date(from.getFullYear(), from.getMonth() + 1, 1);
+}
+function validateBalanceUpdate(current, updates) {
+  const next = (base, absolute, increment) => sumAmounts(absolute ?? base, increment ?? 0);
+  const balance = next(current.balance, updates.balance, updates.balanceIncrement);
+  const bonusCredits = next(
+    current.bonusCredits ?? 0,
+    updates.bonusCredits,
+    updates.bonusCreditsIncrement
+  );
+  const reserved = next(current.reserved ?? 0, updates.reserved, updates.reservedIncrement);
+  const errors = [];
+  if (balance < 0) errors.push(`Balance cannot be negative: ${balance}`);
+  const marked = updates.balance === void 0 ? current.expiredHoldBacking ?? 0 : 0;
+  if ((updates.balanceIncrement ?? 0) < 0 && balance >= 0 && balance < marked) {
+    errors.push(`Balance (${balance}) cannot go below expired hold backing (${marked})`);
+  }
+  if (bonusCredits < 0) errors.push(`BonusCredits cannot be negative: ${bonusCredits}`);
+  if (reserved < 0) errors.push(`Reserved cannot be negative: ${reserved}`);
+  const covering = sumAmounts(balance, bonusCredits);
+  if (reserved > covering) {
+    errors.push(`Reserved (${reserved}) exceeds balance + bonusCredits (${covering})`);
+  }
+  return { valid: errors.length === 0, errors };
+}
+function assertValidBalanceUpdate(current, updates) {
+  const result = validateBalanceUpdate(current, updates);
+  if (!result.valid) {
+    throw new Error(`Invalid balance update: ${result.errors.join("; ")}`);
+  }
 }
 
 // src/repository/memory/snapshot.ts
@@ -1038,6 +1144,22 @@ function assertTrustworthy(reservation, transition) {
   assertLockedAmount(reservation, transition);
   assertHoldPlaced(reservation, transition);
 }
+function openHolds(store, userId) {
+  return [...store.reservations.get(userId)?.values() ?? []].filter(
+    (reservation) => reservation.status === "reserved"
+  );
+}
+function writeExpiredHoldBacking(store, credits, next) {
+  const stored = credits.expiredHoldBacking;
+  if (next <= 0 && !stored) return;
+  const holds = openHolds(store, credits.userId);
+  const shares = attributeExpiredBacking(holds, next);
+  for (const hold of holds) {
+    const share = shares.get(hold.id) ?? 0;
+    if (share !== (hold.expiredBacking ?? 0)) hold.expiredBacking = share;
+  }
+  Object.assign(credits, expiredHoldBackingPatch(sumAmounts(...shares.values()), stored));
+}
 function getReservation(store, userId, reservationId) {
   return store.reservations.get(userId)?.get(reservationId);
 }
@@ -1135,16 +1257,22 @@ async function commitReservationV2(store, userId, reservationId, options) {
     const amount = reservation.amount;
     await yieldPoint(store);
     assertReservedCoversHold(credits, userId, reservationId, amount);
-    if (sumAmounts(credits.balance, credits.bonusCredits) < amount) {
+    const paid = planHoldCommit(
+      credits.balance,
+      credits.bonusCredits,
+      credits.expiredHoldBacking ?? 0,
+      reservation.expiredBacking ?? 0,
+      amount
+    );
+    if (!paid.covered) {
       throw new CreditError(
         `Insufficient credits to commit reservation ${reservationId}`,
         CreditErrorCode.INSUFFICIENT_CREDITS,
         { userId, reservationId, required: amount }
       );
     }
-    const fromBalance = Math.min(credits.balance, amount);
-    const nextBalance = sumAmounts(credits.balance, -fromBalance);
-    const nextBonusCredits = sumAmounts(credits.bonusCredits, -sumAmounts(amount, -fromBalance));
+    const nextBalance = paid.balance;
+    const nextBonusCredits = paid.bonusCredits;
     const balanceAfter = sumAmounts(nextBalance, nextBonusCredits);
     const journal = {
       userId,
@@ -1178,6 +1306,10 @@ async function commitReservationV2(store, userId, reservationId, options) {
     credits.bonusCredits = nextBonusCredits;
     credits.reserved = nextReserved;
     credits.monthlyUsed = nextMonthlyUsed;
+    Object.assign(
+      credits,
+      expiredHoldBackingPatch(paid.expiredHoldBacking, credits.expiredHoldBacking)
+    );
     credits.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
     const journalEntryId = commitTransitionJournal(store, journal, existingEntryId);
     return {
@@ -1257,19 +1389,26 @@ function finishUnspent(store, reservation, transition) {
     reservation.id,
     reservation.amount
   );
+  const backing = settleExpiredHoldBacking(
+    credits.balance,
+    credits.expiredHoldBacking ?? 0,
+    reservation.expiredBacking ?? 0
+  );
+  const nextBalance = sumAmounts(credits.balance, -backing.used);
   const journal = {
     userId: reservation.userId,
     operation: `${transition.transition}Reservation`,
     entryType: "credit",
     amount: 0,
-    balanceAfter: sumAmounts(credits.balance, credits.bonusCredits),
+    balanceAfter: sumAmounts(nextBalance, credits.bonusCredits),
     source: transition.source,
     reservationId: reservation.id,
     description: transition.options?.description ?? `${transition.verb} ${reservation.amount} reserved credits for ${getOperationLabel(reservation.operationType)}`,
     metadata: {
       ...transition.options?.metadata,
       operationType: reservation.operationType,
-      amount: reservation.amount
+      amount: reservation.amount,
+      ...backing.used > 0 ? { expiredCreditsRemoved: backing.used } : {}
     },
     idempotencyKey: reservationJournalKey(reservation.id, transition.transition)
   };
@@ -1282,6 +1421,8 @@ function finishUnspent(store, reservation, transition) {
   reservation.status = transition.status;
   reservation.completedAt = (/* @__PURE__ */ new Date()).toISOString();
   credits.reserved = nextReserved;
+  credits.balance = nextBalance;
+  Object.assign(credits, expiredHoldBackingPatch(backing.remaining, credits.expiredHoldBacking));
   credits.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
   return commitTransitionJournal(store, journal, existingEntryId);
 }
@@ -1292,6 +1433,10 @@ function isoOf(value) {
 }
 var InMemoryCreditRepository = class {
   store = new MemoryStore();
+  options;
+  constructor(options = {}) {
+    this.options = options;
+  }
   // ==================== User Credits ====================
   /**
    * A copy, never the live record.
@@ -1308,7 +1453,8 @@ var InMemoryCreditRepository = class {
     return copyRecord(credits) ?? null;
   }
   async initializeUserCredits(userId, tier, initialBalance) {
-    return copyRecord(this.seedUser(userId, tier, initialBalance));
+    const existing = this.store.users.get(userId);
+    return copyRecord(existing ?? this.seedUser(userId, tier, initialBalance));
   }
   /**
    * The synchronous body of `initializeUserCredits`.
@@ -1359,8 +1505,11 @@ var InMemoryCreditRepository = class {
     if (!credits) {
       throw new Error(`User ${userId} not found`);
     }
+    assertValidBalanceUpdate(credits, updates);
     const next = { ...credits };
-    if (updates.balance !== void 0) next.balance = updates.balance;
+    if (updates.balance !== void 0) {
+      next.balance = updates.balance;
+    }
     if (updates.bonusCredits !== void 0) next.bonusCredits = updates.bonusCredits;
     if (updates.reserved !== void 0) next.reserved = updates.reserved;
     if (updates.tier !== void 0) next.tier = updates.tier;
@@ -1397,6 +1546,9 @@ var InMemoryCreditRepository = class {
       userId,
       operation: "updateUserCredits"
     });
+    if ((credits.expiredHoldBacking ?? 0) > 0 && updates.balance !== void 0) {
+      writeExpiredHoldBacking(this.store, next, 0);
+    }
     next.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
     this.store.users.set(userId, next);
   }
@@ -1405,17 +1557,28 @@ var InMemoryCreditRepository = class {
       { monthlyLimit: input.monthlyLimit, balance: input.balance, monthlyUsed: input.monthlyUsed },
       { userId, operation: "updateUserTier" }
     );
+    assertValidTierBalanceInput(input, { userId, operation: "updateUserTier" });
     const credits = this.store.users.get(userId);
     if (!credits) {
       throw new Error(`User ${userId} not found`);
     }
+    if (input.balanceCap !== void 0 && !isFreeTier(credits.tier)) {
+      const capped = planBalanceCap(
+        credits.balance,
+        input.balanceCap,
+        credits.reserved,
+        credits.bonusCredits,
+        credits.expiredHoldBacking
+      );
+      credits.balance = capped.balance;
+      writeExpiredHoldBacking(this.store, credits, capped.expiredHoldBacking);
+    }
     credits.tier = input.tier;
     credits.monthlyLimit = input.monthlyLimit;
     if (input.balance !== void 0) {
-      credits.balance = Math.max(
-        input.balance,
-        backedBalanceFloor(credits.reserved, credits.bonusCredits)
-      );
+      const planned = planBalanceTarget(input.balance, credits.reserved, credits.bonusCredits);
+      credits.balance = planned.balance;
+      writeExpiredHoldBacking(this.store, credits, planned.expiredHoldBacking);
     }
     if (input.monthlyUsed !== void 0) credits.monthlyUsed = input.monthlyUsed;
     if (input.subscriptionExpiresAt !== void 0) {
@@ -1636,13 +1799,17 @@ var InMemoryCreditRepository = class {
     if (!credits) {
       throw new Error(`User credits not found for userId: ${userId}`);
     }
-    const available = sumAmounts(credits.balance, credits.bonusCredits, -credits.reserved);
+    const spendable = spendableBalance(credits.balance, credits.expiredHoldBacking);
+    const available = Math.min(
+      sumAmounts(credits.balance, credits.bonusCredits, -credits.reserved),
+      sumAmounts(spendable, credits.bonusCredits)
+    );
     if (available < amount) {
       throw new Error(
         `Insufficient credits. Available: ${available}, requested: ${amount}`
       );
     }
-    const balanceDeduction = Math.min(credits.balance, amount);
+    const balanceDeduction = Math.min(spendable, amount);
     const bonusDeduction = sumAmounts(amount, -balanceDeduction);
     const previousBalance = sumAmounts(credits.balance, credits.bonusCredits);
     const nextBalance = sumAmounts(credits.balance, -balanceDeduction);
@@ -1879,7 +2046,11 @@ var InMemoryCreditRepository = class {
     return { expiredCount, creditsReleased, errors };
   }
   // ==================== Atomic Monthly Reset ====================
-  async atomicMonthlyReset(userId, tier, expectedResetAt) {
+  /**
+   * @param _tier - Not trusted. The caller read it earlier and the account may
+   *   have changed tier since, so the reset uses the tier stored on the account.
+   */
+  async atomicMonthlyReset(userId, _tier, expectedResetAt) {
     const credits = this.store.users.get(userId);
     if (!credits) {
       throw new Error(`User ${userId} not found`);
@@ -1889,17 +2060,41 @@ var InMemoryCreditRepository = class {
     if (currentResetAt !== expected) {
       return { wasReset: false, credits: { ...credits } };
     }
-    assertRepresentableTierAmount(getConfigMonthlyLimit(tier), "monthlyLimit", { userId, tier });
+    const tier = credits.tier;
+    const spendable = spendableBalance(credits.balance, credits.expiredHoldBacking);
+    const decision = this.options.resolveMonthlyReset?.({ tier, balance: spendable });
+    if (decision === null) {
+      return { wasReset: false, credits: { ...credits } };
+    }
+    if (decision) {
+      assertValidBalanceTarget(decision.balance, "resolveMonthlyReset balance", { userId, tier });
+      if (decision.monthlyLimit !== void 0) {
+        assertValidBalanceTarget(decision.monthlyLimit, "resolveMonthlyReset monthlyLimit", {
+          userId,
+          tier
+        });
+      }
+    } else {
+      assertRepresentableTierAmount(getConfigMonthlyLimit(tier), "monthlyLimit", { userId, tier });
+    }
     const nextReset = getNextMonthlyReset();
-    const target = monthlyResetBalance(tier);
-    const floor = backedBalanceFloor(credits.reserved, credits.bonusCredits);
     const previousBalance = credits.balance;
-    const newBalance = target.kind === "atLeast" ? Math.max(credits.balance, target.value, floor) : Math.max(target.value, floor);
+    let target;
+    if (decision) {
+      target = decision.balance;
+    } else {
+      const configured = monthlyResetBalance(tier);
+      target = configured.kind === "atLeast" ? Math.max(spendable, configured.value) : configured.value;
+    }
+    const planned = planBalanceTarget(target, credits.reserved, credits.bonusCredits);
+    const newBalance = planned.balance;
     const change = sumAmounts(newBalance, -previousBalance);
     const balanceAfter = sumAmounts(newBalance, credits.bonusCredits);
     assertRepresentableAmount(Math.abs(change), "journal amount", { userId });
     assertRepresentableAmount(balanceAfter, "journal balanceAfter", { userId });
     credits.balance = newBalance;
+    writeExpiredHoldBacking(this.store, credits, planned.expiredHoldBacking);
+    if (decision?.monthlyLimit !== void 0) credits.monthlyLimit = decision.monthlyLimit;
     credits.monthlyUsed = 0;
     credits.monthlyResetAt = nextReset.toISOString();
     credits.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -1953,23 +2148,34 @@ var InMemoryCreditRepository = class {
       };
     }
     const defaultTier = getDefaultTier();
-    const configured = getConfigMonthlyLimit(defaultTier);
-    assertRepresentableTierAmount(configured, "monthlyLimit", {
-      userId,
-      tier: defaultTier
-    });
-    const limit = storedMonthlyLimit(configured);
+    let limit;
+    if (this.options.getDowngradeBalanceCap) {
+      limit = this.options.getDowngradeBalanceCap();
+      assertValidBalanceTarget(limit, "getDowngradeBalanceCap", { userId, tier: defaultTier });
+    } else {
+      const configured = getConfigMonthlyLimit(defaultTier);
+      assertRepresentableTierAmount(configured, "monthlyLimit", {
+        userId,
+        tier: defaultTier
+      });
+      limit = storedMonthlyLimit(configured);
+    }
     const previousTier = credits.tier;
     const previousBalance = credits.balance;
-    const newBalance = Math.max(
-      Math.min(credits.balance, limit),
-      backedBalanceFloor(credits.reserved, credits.bonusCredits)
+    const planned = planBalanceCap(
+      credits.balance,
+      limit,
+      credits.reserved,
+      credits.bonusCredits,
+      credits.expiredHoldBacking
     );
+    const newBalance = planned.balance;
     const balanceAfter = sumAmounts(newBalance, credits.bonusCredits);
     assertRepresentableAmount(balanceAfter, "journal balanceAfter", { userId });
     credits.tier = defaultTier;
     credits.monthlyLimit = limit;
     credits.balance = newBalance;
+    writeExpiredHoldBacking(this.store, credits, planned.expiredHoldBacking);
     credits.subscriptionExpiresAt = null;
     credits.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
     this.store.users.set(userId, credits);
@@ -2027,12 +2233,13 @@ var InMemoryCreditRepository = class {
     return copyRecords(Array.from(userReservations.values()));
   }
 };
-function createInMemoryCreditRepository() {
-  return new InMemoryCreditRepository();
+function createInMemoryCreditRepository(options = {}) {
+  return new InMemoryCreditRepository(options);
 }
 export {
   InMemoryCreditRepository,
   addCreditsThroughRepository,
+  assertValidBalanceUpdate,
   commitThroughRepository,
   createInMemoryCreditRepository,
   generateId,
@@ -2043,6 +2250,7 @@ export {
   supportsCreditsV2,
   supportsIdempotentCredit,
   toClientUserCredits,
-  toDate
+  toDate,
+  validateBalanceUpdate
 };
 //# sourceMappingURL=index.js.map