@plasius/economy 0.3.1 → 0.4.0

package/dist/index.js

@@ -1546,1117 +1546,3100 @@ function selectSourceLots(lots, requestedAmount, context) {
   );
 }
 
-// src/operations.ts
-function assertDistinctAdjustmentApproval(request) {
+// src/module-allowances.ts
+var MODULE_ALLOWANCE_PURPOSE = "junior-coder-module-entitlement";
+function assertWholePositive2(amount, label) {
+  const parsed = parseTokenSubunits(amount);
+  economyAssert(parsed > 0n, "INVALID_AMOUNT", `${label} must be positive`);
   economyAssert(
-    request.schemaVersion === ECONOMY_CONTRACT_VERSION,
+    isWholeTokenAmount(parsed),
+    "AMOUNT_NOT_WHOLE_TOKEN",
+    `${label} must contain whole Tokens`
+  );
+  return parsed;
+}
+function assertPositiveSlices(slices, expectedAmount, label) {
+  economyAssert(slices.length > 0, "INVALID_CONTRACT", `${label} are required`);
+  const lotIds = /* @__PURE__ */ new Set();
+  for (const slice of slices) {
+    assertEconomyIdentifier(slice.lotId, "lotId");
+    economyAssert(
+      !lotIds.has(slice.lotId),
+      "DUPLICATE_IDENTIFIER",
+      `${label} must not repeat a lot`
+    );
+    lotIds.add(slice.lotId);
+    economyAssert(
+      parseTokenSubunits(slice.amount) > 0n,
+      "INVALID_AMOUNT",
+      `${label} amounts must be positive`
+    );
+  }
+  economyAssert(
+    sumTokenSubunits(slices.map((slice) => slice.amount)) === expectedAmount,
     "INVALID_CONTRACT",
-    "Unsupported adjustment contract version"
+    `${label} must sum to the operation amount`
   );
-  assertEconomyIdentifier(request.adjustmentId, "adjustmentId");
-  assertEconomyIdentifier(request.walletId, "walletId");
-  assertEconomyIdentifier(request.initiatedByAccountId, "initiatedByAccountId");
+}
+function sumSlicesByLot(slices) {
+  const totals = /* @__PURE__ */ new Map();
+  for (const slice of slices) {
+    assertEconomyIdentifier(slice.lotId, "lotId");
+    const amount = parseTokenSubunits(slice.amount);
+    economyAssert(amount > 0n, "INVALID_AMOUNT", "Lot slices must be positive");
+    totals.set(slice.lotId, (totals.get(slice.lotId) ?? 0n) + amount);
+  }
+  return totals;
+}
+function assertSha256Reference(value, label) {
   economyAssert(
-    parseTokenSubunits(request.amount) !== 0n,
-    "INVALID_AMOUNT",
-    "Adjustment amount cannot be zero"
+    typeof value === "string" && /^sha256:[a-f0-9]{64}$/u.test(value),
+    "INVALID_CONTRACT",
+    `${label} must be a canonical SHA-256 reference`
   );
+}
+function assertUpdatedAt(current, occurredAt, label) {
   economyAssert(
-    request.reason.trim().length > 0 && request.reason.length <= 512,
+    parseIsoTimestamp(occurredAt) >= parseIsoTimestamp(current),
+    "INVALID_TIME_WINDOW",
+    `${label} cannot precede the current state`
+  );
+}
+function assertModuleAllowance(allowance) {
+  economyAssert(
+    allowance.schemaVersion === ECONOMY_CONTRACT_VERSION && allowance.purpose === MODULE_ALLOWANCE_PURPOSE,
     "INVALID_CONTRACT",
-    "Adjustment reason is required and must be bounded"
+    "Unsupported Module Allowance contract"
   );
-  assertEconomyIdentifier(request.ticketReference, "ticketReference");
-  const initiatedAt = parseIsoTimestamp(request.initiatedAt);
+  assertEconomyIdentifier(allowance.allowanceId, "allowanceId");
+  assertEconomyIdentifier(allowance.householdId, "householdId");
+  assertEconomyIdentifier(allowance.hostWalletId, "hostWalletId");
+  assertEconomyIdentifier(allowance.allowanceWalletId, "allowanceWalletId");
+  assertEconomyIdentifier(allowance.childAccountId, "childAccountId");
   economyAssert(
-    request.approvedByAccountId !== void 0 && request.approvedByAccountId !== request.initiatedByAccountId,
+    allowance.hostWalletId !== allowance.allowanceWalletId,
     "INVALID_CONTRACT",
-    "Adjustment approval requires a distinct authorized operator"
+    "Host and Module Allowance wallets must be distinct"
   );
-  assertEconomyIdentifier(request.approvedByAccountId, "approvedByAccountId");
   economyAssert(
-    request.approvedAt !== void 0 && parseIsoTimestamp(request.approvedAt) >= initiatedAt,
+    allowance.status === "active" || allowance.status === "closed",
+    "INVALID_CONTRACT",
+    "Module Allowance status is unsupported"
+  );
+  const createdAt = parseIsoTimestamp(allowance.createdAt);
+  const updatedAt = parseIsoTimestamp(allowance.updatedAt);
+  economyAssert(
+    updatedAt >= createdAt,
     "INVALID_TIME_WINDOW",
-    "Adjustment approval time must follow initiation"
+    "Module Allowance update cannot precede creation"
   );
   economyAssert(
-    request.status === "approved" || request.status === "executed",
+    Number.isSafeInteger(allowance.version) && allowance.version >= 1,
     "INVALID_CONTRACT",
-    "Only approved adjustments satisfy dual-control approval"
+    "Module Allowance version must be a positive safe integer"
   );
-  if (request.resultingTransactionId !== void 0) {
-    assertEconomyIdentifier(
-      request.resultingTransactionId,
-      "resultingTransactionId"
-    );
-  }
-}
-
-// src/ports/persistence.ts
-function assertScopedPersistedIdempotencyResult(result) {
+  const allocated = parseTokenSubunits(allowance.allocatedAmount);
+  const available = parseTokenSubunits(allowance.availableAmount);
+  const held = parseTokenSubunits(allowance.heldAmount);
+  const spent = parseTokenSubunits(allowance.spentAmount);
+  const reclaimed = parseTokenSubunits(allowance.reclaimedAmount);
   economyAssert(
-    result.schemaVersion === ECONOMY_CONTRACT_VERSION,
-    "INVALID_CONTRACT",
-    "Unsupported scoped idempotency-result contract version"
+    allocated > 0n && [allocated, available, held, spent, reclaimed].every(
+      (amount) => amount >= 0n && isWholeTokenAmount(amount)
+    ),
+    "AMOUNT_NOT_WHOLE_TOKEN",
+    "Module Allowance amounts must be non-negative whole Tokens"
   );
-  assertEconomyIdentifier(result.commandId, "commandId");
-  assertEconomyIdentifier(result.transactionId, "transactionId");
   economyAssert(
-    /^sha256:[a-f0-9]{64}$/u.test(result.responseHash),
+    allocated === available + held + spent + reclaimed,
     "INVALID_CONTRACT",
-    "Idempotency response hash must be a canonical SHA-256 reference"
+    "Module Allowance buckets must equal its lifetime allocation"
   );
-  parseIsoTimestamp(result.recordedAt);
-}
-var ECONOMY_COMMAND_TYPES = /* @__PURE__ */ new Set([
-  "credit-purchase",
-  "credit-subscription",
-  "credit-reward",
-  "credit-event",
-  "credit-competition",
-  "allocate",
-  "boost",
-  "reclaim",
-  "spend",
-  "hold",
-  "release-hold",
-  "refund",
-  "chargeback",
-  "reverse",
-  "adjust"
-]);
-function assertEconomyIdempotencyScope(scope) {
   economyAssert(
-    scope.schemaVersion === ECONOMY_CONTRACT_VERSION && ECONOMY_COMMAND_TYPES.has(scope.commandType),
+    allowance.status !== "closed" || available === 0n && held === 0n,
     "INVALID_CONTRACT",
-    "Unsupported economy idempotency scope"
+    "A closed Module Allowance cannot retain available or held value"
   );
-  assertEconomyIdentifier(scope.idempotencyKey, "idempotencyKey");
-  assertEconomyIdentifier(scope.actorAccountId, "actorAccountId");
-  assertEconomyIdentifier(scope.subjectAccountId, "subjectAccountId");
-}
-function assertEconomyCommandEnvelope(envelope) {
+  const fundedByLot = sumSlicesByLot(allowance.fundingSlices);
+  const reclaimedByLot = sumSlicesByLot(allowance.reclaimedSlices);
   economyAssert(
-    envelope.schemaVersion === ECONOMY_CONTRACT_VERSION,
+    sumTokenSubunits(allowance.fundingSlices.map((slice) => slice.amount)) === allocated,
     "INVALID_CONTRACT",
-    "Unsupported economy-command-envelope contract version"
+    "Module Allowance funding provenance must equal allocated value"
   );
-  assertEconomyIdentifier(envelope.commandId, "commandId");
   economyAssert(
-    ECONOMY_COMMAND_TYPES.has(envelope.commandType),
+    sumTokenSubunits(allowance.reclaimedSlices.map((slice) => slice.amount)) === reclaimed,
     "INVALID_CONTRACT",
-    "Economy command has an unsupported type"
+    "Module Allowance reclaim provenance must equal reclaimed value"
   );
-  assertEconomyIdentifier(envelope.idempotencyKey, "idempotencyKey");
-  assertEconomyIdentifier(envelope.actorAccountId, "actorAccountId");
-  assertEconomyIdentifier(envelope.subjectAccountId, "subjectAccountId");
-  if (envelope.relationshipId !== void 0) {
-    assertEconomyIdentifier(envelope.relationshipId, "relationshipId");
-  }
-  if (envelope.authorizationVersion !== void 0) {
+  for (const [lotId, amount] of reclaimedByLot) {
     economyAssert(
-      Number.isSafeInteger(envelope.authorizationVersion) && envelope.authorizationVersion >= 1,
-      "INVALID_CONTRACT",
-      "Command authorization version must be a positive safe integer"
+      amount <= (fundedByLot.get(lotId) ?? 0n),
+      "SOURCE_LOT_RESTRICTED",
+      "Reclaimed provenance cannot exceed Module Allowance funding"
     );
   }
+}
+function createModuleAllowance(input) {
+  const amount = assertWholePositive2(input.amount, "Module Allowance amount");
+  assertPositiveSlices(input.fundingSlices, amount, "Funding slices");
+  const allowance = {
+    schemaVersion: ECONOMY_CONTRACT_VERSION,
+    purpose: MODULE_ALLOWANCE_PURPOSE,
+    allowanceId: input.allowanceId,
+    householdId: input.householdId,
+    hostWalletId: input.hostWalletId,
+    allowanceWalletId: input.allowanceWalletId,
+    childAccountId: input.childAccountId,
+    status: "active",
+    allocatedAmount: input.amount,
+    availableAmount: input.amount,
+    heldAmount: serializeTokenSubunits(0n),
+    spentAmount: serializeTokenSubunits(0n),
+    reclaimedAmount: serializeTokenSubunits(0n),
+    fundingSlices: input.fundingSlices,
+    reclaimedSlices: [],
+    version: 1,
+    createdAt: input.occurredAt,
+    updatedAt: input.occurredAt
+  };
+  assertModuleAllowance(allowance);
+  return allowance;
+}
+function fundModuleAllowance(allowance, input) {
+  assertModuleAllowance(allowance);
   economyAssert(
-    envelope.relationshipId === void 0 === (envelope.authorizationVersion === void 0),
+    allowance.status === "active" && allowance.version === input.expectedVersion,
     "INVALID_CONTRACT",
-    "Relationship identity and authorization version must be supplied together"
+    "Module Allowance is closed or its optimistic version is stale"
   );
+  assertUpdatedAt(allowance.updatedAt, input.occurredAt, "Funding time");
+  const amount = assertWholePositive2(input.amount, "Module Allowance funding");
+  assertPositiveSlices(input.fundingSlices, amount, "Funding slices");
+  const next = {
+    ...allowance,
+    allocatedAmount: serializeTokenSubunits(
+      parseTokenSubunits(allowance.allocatedAmount) + amount
+    ),
+    availableAmount: serializeTokenSubunits(
+      parseTokenSubunits(allowance.availableAmount) + amount
+    ),
+    fundingSlices: [...allowance.fundingSlices, ...input.fundingSlices],
+    version: allowance.version + 1,
+    updatedAt: input.occurredAt
+  };
+  assertModuleAllowance(next);
+  return next;
+}
+function reclaimModuleAllowance(allowance, input) {
+  assertModuleAllowance(allowance);
   economyAssert(
-    /^sha256:[a-f0-9]{64}$/u.test(envelope.payloadHash),
+    allowance.status === "active" && allowance.version === input.expectedVersion,
     "INVALID_CONTRACT",
-    "Command payload hash must be a canonical SHA-256 reference"
+    "Module Allowance is closed or its optimistic version is stale"
   );
-  parseIsoTimestamp(envelope.acceptedAt);
-  assertEconomyIdentifier(envelope.acceptedRegion, "acceptedRegion");
-  assertEconomyIdentifier(
-    envelope.writerFencingToken,
-    "writerFencingToken"
+  assertUpdatedAt(allowance.updatedAt, input.occurredAt, "Reclaim time");
+  const amount = assertWholePositive2(input.amount, "Module Allowance reclaim");
+  economyAssert(
+    amount <= parseTokenSubunits(allowance.availableAmount),
+    "INSUFFICIENT_BALANCE",
+    "Cannot reclaim held, spent, or unavailable Module Allowance value"
+  );
+  assertPositiveSlices(input.sourceSlices, amount, "Reclaim slices");
+  const fundedLotIds = new Set(
+    allowance.fundingSlices.map((slice) => slice.lotId)
+  );
+  economyAssert(
+    input.sourceSlices.every((slice) => fundedLotIds.has(slice.lotId)),
+    "SOURCE_LOT_RESTRICTED",
+    "Reclaim slices must originate from the Module Allowance"
   );
+  const next = {
+    ...allowance,
+    availableAmount: serializeTokenSubunits(
+      parseTokenSubunits(allowance.availableAmount) - amount
+    ),
+    reclaimedAmount: serializeTokenSubunits(
+      parseTokenSubunits(allowance.reclaimedAmount) + amount
+    ),
+    reclaimedSlices: [...allowance.reclaimedSlices, ...input.sourceSlices],
+    version: allowance.version + 1,
+    updatedAt: input.occurredAt
+  };
+  assertModuleAllowance(next);
+  return next;
 }
-function assertEconomyCommandWorkflowEvent(event) {
+function closeModuleAllowance(allowance, input) {
+  assertModuleAllowance(allowance);
   economyAssert(
-    event.schemaVersion === ECONOMY_CONTRACT_VERSION,
+    allowance.status === "active" && allowance.version === input.expectedVersion,
     "INVALID_CONTRACT",
-    "Unsupported command-workflow-event contract version"
+    "Module Allowance is closed or its optimistic version is stale"
   );
-  assertEconomyIdentifier(event.workflowEventId, "workflowEventId");
-  assertEconomyIdentifier(event.commandId, "commandId");
+  assertUpdatedAt(allowance.updatedAt, input.occurredAt, "Closure time");
   economyAssert(
-    ["accepted", "processing", "failed", "completed"].includes(event.state),
+    parseTokenSubunits(allowance.availableAmount) === 0n && parseTokenSubunits(allowance.heldAmount) === 0n,
     "INVALID_CONTRACT",
-    "Command workflow has an unsupported state"
+    "Available value must be reclaimed and holds resolved before closure"
   );
+  const next = {
+    ...allowance,
+    status: "closed",
+    version: allowance.version + 1,
+    updatedAt: input.occurredAt
+  };
+  assertModuleAllowance(next);
+  return next;
+}
+function assertModuleSpendQuote(quote) {
   economyAssert(
-    event.state === "failed" === (event.failureCode !== void 0),
+    quote.schemaVersion === ECONOMY_CONTRACT_VERSION,
     "INVALID_CONTRACT",
-    "Only failed command workflows require a failure code"
+    "Unsupported module-spend quote contract version"
+  );
+  assertEconomyIdentifier(quote.quoteId, "quoteId");
+  assertEconomyIdentifier(quote.allowanceId, "allowanceId");
+  assertEconomyIdentifier(quote.householdId, "householdId");
+  assertEconomyIdentifier(quote.guardianAccountId, "guardianAccountId");
+  assertEconomyIdentifier(quote.childAccountId, "childAccountId");
+  assertEconomyIdentifier(quote.moduleVersionId, "moduleVersionId");
+  assertEconomyIdentifier(quote.catalogVersion, "catalogVersion");
+  assertEconomyIdentifier(
+    quote.requirementsManifestVersion,
+    "requirementsManifestVersion"
+  );
+  assertSha256Reference(
+    quote.requirementsManifestHash,
+    "Requirements manifest hash"
+  );
+  assertWholePositive2(quote.amount, "Module price");
+  const acknowledgedAt = parseIsoTimestamp(quote.requirementsAcknowledgedAt);
+  const issuedAt = parseIsoTimestamp(quote.issuedAt);
+  const expiresAt = parseIsoTimestamp(quote.expiresAt);
+  economyAssert(
+    acknowledgedAt <= issuedAt && expiresAt > issuedAt,
+    "INVALID_TIME_WINDOW",
+    "Requirements must be acknowledged before a bounded quote is issued"
   );
-  if (event.failureCode !== void 0) {
-    assertEconomyIdentifier(event.failureCode, "failureCode");
-  }
-  parseIsoTimestamp(event.occurredAt);
 }
-
-// src/wallets.ts
-function assertWalletOwnerReference(owner) {
+function createModuleSpendQuote(input) {
+  const quote = {
+    schemaVersion: ECONOMY_CONTRACT_VERSION,
+    ...input
+  };
+  assertModuleSpendQuote(quote);
+  return quote;
+}
+function assertModuleSpendHold(hold) {
   economyAssert(
-    ["account", "household", "system"].includes(owner.ownerType),
+    hold.schemaVersion === ECONOMY_CONTRACT_VERSION,
     "INVALID_CONTRACT",
-    "Wallet owner reference has an unsupported type"
+    "Unsupported module-spend hold contract version"
+  );
+  assertEconomyIdentifier(hold.holdId, "holdId");
+  assertEconomyIdentifier(hold.quoteId, "quoteId");
+  assertEconomyIdentifier(hold.allowanceId, "allowanceId");
+  assertEconomyIdentifier(hold.householdId, "householdId");
+  assertEconomyIdentifier(hold.guardianAccountId, "guardianAccountId");
+  assertEconomyIdentifier(hold.childAccountId, "childAccountId");
+  assertEconomyIdentifier(hold.moduleVersionId, "moduleVersionId");
+  assertEconomyIdentifier(
+    hold.requirementsManifestVersion,
+    "requirementsManifestVersion"
   );
-  if (owner.ownerType === "system") {
+  assertSha256Reference(
+    hold.requirementsManifestHash,
+    "Requirements manifest hash"
+  );
+  assertEconomyIdentifier(hold.holdIdempotencyKey, "holdIdempotencyKey");
+  const amount = assertWholePositive2(hold.amount, "Module hold amount");
+  assertPositiveSlices(hold.sourceSlices, amount, "Hold source slices");
+  economyAssert(
+    ["held", "settled", "released"].includes(hold.status),
+    "INVALID_CONTRACT",
+    "Module hold status is unsupported"
+  );
+  economyAssert(
+    Number.isSafeInteger(hold.version) && hold.version >= 1,
+    "INVALID_CONTRACT",
+    "Module hold version must be a positive safe integer"
+  );
+  const createdAt = parseIsoTimestamp(hold.createdAt);
+  const expiresAt = parseIsoTimestamp(hold.expiresAt);
+  const updatedAt = parseIsoTimestamp(hold.updatedAt);
+  economyAssert(
+    expiresAt > createdAt && updatedAt >= createdAt,
+    "INVALID_TIME_WINDOW",
+    "Module hold requires a bounded lifetime and ordered updates"
+  );
+  if (hold.status === "held") {
     economyAssert(
-      owner.ownerId === "system",
+      hold.entitlementId === void 0 && hold.settlementTransactionId === void 0 && hold.releaseTransactionId === void 0 && hold.settlementIdempotencyKey === void 0 && hold.releaseIdempotencyKey === void 0,
       "INVALID_CONTRACT",
-      "System wallet lookups must use the system owner"
+      "An unsettled hold cannot claim an entitlement or final transaction"
+    );
+  } else if (hold.status === "settled") {
+    economyAssert(
+      hold.entitlementId !== void 0 && hold.settlementTransactionId !== void 0 && hold.settlementIdempotencyKey !== void 0 && hold.releaseTransactionId === void 0 && hold.releaseIdempotencyKey === void 0,
+      "INVALID_CONTRACT",
+      "A settled hold requires entitlement and transaction evidence"
+    );
+    assertEconomyIdentifier(hold.entitlementId, "entitlementId");
+    assertEconomyIdentifier(
+      hold.settlementTransactionId,
+      "settlementTransactionId"
+    );
+    assertEconomyIdentifier(
+      hold.settlementIdempotencyKey,
+      "settlementIdempotencyKey"
     );
   } else {
-    assertEconomyIdentifier(owner.ownerId, "ownerId");
     economyAssert(
-      owner.ownerId !== "system",
+      hold.entitlementId === void 0 && hold.settlementTransactionId === void 0 && hold.settlementIdempotencyKey === void 0 && hold.releaseTransactionId !== void 0 && hold.releaseIdempotencyKey !== void 0,
       "INVALID_CONTRACT",
-      "Account and household wallets cannot use the system owner"
+      "A released hold requires release evidence only"
     );
+    assertEconomyIdentifier(hold.releaseTransactionId, "releaseTransactionId");
+    assertEconomyIdentifier(hold.releaseIdempotencyKey, "releaseIdempotencyKey");
   }
 }
-function assertWallet(wallet) {
+function assertAllowanceMatchesQuote(allowance, quote) {
   economyAssert(
-    wallet.schemaVersion === ECONOMY_CONTRACT_VERSION,
+    allowance.status === "active" && allowance.allowanceId === quote.allowanceId && allowance.householdId === quote.householdId && allowance.childAccountId === quote.childAccountId,
     "INVALID_CONTRACT",
-    "Unsupported wallet contract version"
+    "Module quote does not belong to this active child allowance"
   );
-  assertEconomyIdentifier(wallet.walletId, "walletId");
-  assertEconomyIdentifier(wallet.accountId, "accountId");
+}
+function assertAllowanceMatchesHold(allowance, hold) {
   economyAssert(
-    [
-      "household-treasury",
-      "personal",
-      "gameplay-allocation",
-      "hold",
-      "purchase-clearing",
-      "provider-clearing",
-      "system"
-    ].includes(wallet.kind),
+    allowance.status === "active" && allowance.allowanceId === hold.allowanceId && allowance.householdId === hold.householdId && allowance.childAccountId === hold.childAccountId,
     "INVALID_CONTRACT",
-    "Wallet has an unsupported kind"
+    "Module hold does not belong to this active child allowance"
   );
+}
+function createModuleSpendHold(allowance, quote, input) {
+  assertModuleAllowance(allowance);
+  assertModuleSpendQuote(quote);
+  assertAllowanceMatchesQuote(allowance, quote);
   economyAssert(
-    ["account", "household", "system"].includes(wallet.ownerType),
+    allowance.version === input.expectedAllowanceVersion,
     "INVALID_CONTRACT",
-    "Wallet has an unsupported owner type"
+    "Module Allowance optimistic version is stale"
   );
+  const occurredAt = parseIsoTimestamp(input.occurredAt);
   economyAssert(
-    ["active", "restricted", "closed"].includes(wallet.status),
-    "INVALID_CONTRACT",
-    "Wallet has an unsupported status"
+    occurredAt >= parseIsoTimestamp(allowance.updatedAt) && occurredAt >= parseIsoTimestamp(quote.issuedAt) && occurredAt < parseIsoTimestamp(quote.expiresAt),
+    "INVALID_TIME_WINDOW",
+    "Module quote is not valid at hold time"
   );
-  if (wallet.ownerType === "system") {
-    economyAssert(
-      wallet.ownerId === "system",
-      "INVALID_CONTRACT",
-      "System wallets must be owned by the system"
-    );
-  } else {
-    assertEconomyIdentifier(wallet.ownerId, "ownerId");
-  }
-  if (wallet.householdId !== void 0) {
-    assertEconomyIdentifier(wallet.householdId, "householdId");
-  }
-  if (wallet.ownerType === "household") {
-    economyAssert(
-      wallet.householdId === wallet.ownerId,
-      "INVALID_CONTRACT",
-      "Household wallets must identify the same household owner"
-    );
-  }
-  if (wallet.kind === "household-treasury") {
-    economyAssert(
-      wallet.ownerType === "household" && wallet.householdId !== void 0,
-      "INVALID_CONTRACT",
-      "Household treasuries must be owned by their household"
-    );
-  }
-  if (wallet.kind === "personal" || wallet.kind === "gameplay-allocation") {
-    economyAssert(
-      wallet.ownerType === "account",
-      "INVALID_CONTRACT",
-      "Personal and gameplay-allocation wallets must be account-owned"
-    );
-  }
-  if (wallet.kind === "gameplay-allocation") {
-    economyAssert(
-      wallet.householdId !== void 0,
-      "INVALID_CONTRACT",
-      "Gameplay-allocation wallets must retain household provenance"
-    );
-  }
-  if (wallet.kind === "purchase-clearing" || wallet.kind === "provider-clearing" || wallet.kind === "system") {
-    economyAssert(
-      wallet.ownerType === "system" && wallet.householdId === void 0,
-      "INVALID_CONTRACT",
-      "Clearing and system wallets must be system-owned"
-    );
-  }
+  const amount = parseTokenSubunits(quote.amount);
   economyAssert(
-    Number.isSafeInteger(wallet.version) && wallet.version >= 1,
+    amount <= parseTokenSubunits(allowance.availableAmount),
+    "INSUFFICIENT_BALANCE",
+    "Module Allowance has insufficient available value"
+  );
+  assertEconomyIdentifier(input.holdId, "holdId");
+  assertEconomyIdentifier(input.idempotencyKey, "idempotencyKey");
+  assertPositiveSlices(input.sourceSlices, amount, "Hold source slices");
+  const fundedLotIds = new Set(
+    allowance.fundingSlices.map((slice) => slice.lotId)
+  );
+  economyAssert(
+    input.sourceSlices.every((slice) => fundedLotIds.has(slice.lotId)),
+    "SOURCE_LOT_RESTRICTED",
+    "Hold slices must originate from the Module Allowance"
+  );
+  const nextAllowance = {
+    ...allowance,
+    availableAmount: serializeTokenSubunits(
+      parseTokenSubunits(allowance.availableAmount) - amount
+    ),
+    heldAmount: serializeTokenSubunits(
+      parseTokenSubunits(allowance.heldAmount) + amount
+    ),
+    version: allowance.version + 1,
+    updatedAt: input.occurredAt
+  };
+  const hold = {
+    schemaVersion: ECONOMY_CONTRACT_VERSION,
+    holdId: input.holdId,
+    quoteId: quote.quoteId,
+    allowanceId: quote.allowanceId,
+    householdId: quote.householdId,
+    guardianAccountId: quote.guardianAccountId,
+    childAccountId: quote.childAccountId,
+    moduleVersionId: quote.moduleVersionId,
+    amount: quote.amount,
+    requirementsManifestVersion: quote.requirementsManifestVersion,
+    requirementsManifestHash: quote.requirementsManifestHash,
+    sourceSlices: input.sourceSlices,
+    status: "held",
+    holdIdempotencyKey: input.idempotencyKey,
+    version: 1,
+    createdAt: input.occurredAt,
+    expiresAt: quote.expiresAt,
+    updatedAt: input.occurredAt
+  };
+  assertModuleAllowance(nextAllowance);
+  assertModuleSpendHold(hold);
+  return { allowance: nextAllowance, hold };
+}
+function settleModuleSpendHold(allowance, hold, input) {
+  assertModuleAllowance(allowance);
+  assertModuleSpendHold(hold);
+  assertAllowanceMatchesHold(allowance, hold);
+  economyAssert(
+    hold.status === "held" && allowance.version === input.expectedAllowanceVersion && hold.version === input.expectedHoldVersion,
     "INVALID_CONTRACT",
-    "Wallet version must be a positive safe integer"
+    "Module hold is final or an optimistic version is stale"
   );
-  const createdAt = parseIsoTimestamp(wallet.createdAt);
-  if (wallet.closedAt !== void 0) {
-    economyAssert(
-      parseIsoTimestamp(wallet.closedAt) >= createdAt && wallet.status === "closed",
-      "INVALID_TIME_WINDOW",
-      "Only closed wallets may have a valid closure time"
-    );
-  } else {
-    economyAssert(
-      wallet.status !== "closed",
-      "INVALID_CONTRACT",
-      "Closed wallets require a closure time"
-    );
-  }
+  assertEconomyIdentifier(input.entitlementId, "entitlementId");
+  assertEconomyIdentifier(
+    input.settlementTransactionId,
+    "settlementTransactionId"
+  );
+  assertEconomyIdentifier(input.idempotencyKey, "idempotencyKey");
+  const occurredAt = parseIsoTimestamp(input.occurredAt);
+  economyAssert(
+    occurredAt >= parseIsoTimestamp(allowance.updatedAt) && occurredAt >= parseIsoTimestamp(hold.updatedAt) && occurredAt < parseIsoTimestamp(hold.expiresAt),
+    "INVALID_TIME_WINDOW",
+    "Module hold cannot settle outside its valid lifetime"
+  );
+  const amount = parseTokenSubunits(hold.amount);
+  economyAssert(
+    amount <= parseTokenSubunits(allowance.heldAmount),
+    "INSUFFICIENT_BALANCE",
+    "Module Allowance does not contain the quoted held value"
+  );
+  const nextAllowance = {
+    ...allowance,
+    heldAmount: serializeTokenSubunits(
+      parseTokenSubunits(allowance.heldAmount) - amount
+    ),
+    spentAmount: serializeTokenSubunits(
+      parseTokenSubunits(allowance.spentAmount) + amount
+    ),
+    version: allowance.version + 1,
+    updatedAt: input.occurredAt
+  };
+  const nextHold = {
+    ...hold,
+    status: "settled",
+    settlementIdempotencyKey: input.idempotencyKey,
+    entitlementId: input.entitlementId,
+    settlementTransactionId: input.settlementTransactionId,
+    version: hold.version + 1,
+    updatedAt: input.occurredAt
+  };
+  assertModuleAllowance(nextAllowance);
+  assertModuleSpendHold(nextHold);
+  return { allowance: nextAllowance, hold: nextHold };
 }
-function assertWalletBalanceSummary(summary) {
+function releaseModuleSpendHold(allowance, hold, input) {
+  assertModuleAllowance(allowance);
+  assertModuleSpendHold(hold);
+  assertAllowanceMatchesHold(allowance, hold);
   economyAssert(
-    summary.schemaVersion === ECONOMY_CONTRACT_VERSION,
+    hold.status === "held" && allowance.version === input.expectedAllowanceVersion && hold.version === input.expectedHoldVersion,
     "INVALID_CONTRACT",
-    "Unsupported wallet summary contract version"
+    "Module hold is final or an optimistic version is stale"
   );
-  assertEconomyIdentifier(summary.walletId, "walletId");
-  for (const amount of [
-    summary.available,
-    summary.reserved,
-    summary.held,
-    summary.rewardProgress
-  ]) {
-    economyAssert(
-      parseTokenSubunits(amount) >= 0n,
-      "INVALID_AMOUNT",
-      "Wallet summary categories cannot be negative"
-    );
-  }
+  assertEconomyIdentifier(input.releaseTransactionId, "releaseTransactionId");
+  assertEconomyIdentifier(input.idempotencyKey, "idempotencyKey");
+  const occurredAt = parseIsoTimestamp(input.occurredAt);
   economyAssert(
-    Number.isSafeInteger(summary.version) && summary.version >= 1,
+    occurredAt >= parseIsoTimestamp(allowance.updatedAt) && occurredAt >= parseIsoTimestamp(hold.updatedAt),
+    "INVALID_TIME_WINDOW",
+    "Module hold release cannot precede its current state"
+  );
+  const amount = parseTokenSubunits(hold.amount);
+  economyAssert(
+    amount <= parseTokenSubunits(allowance.heldAmount),
+    "INSUFFICIENT_BALANCE",
+    "Module Allowance does not contain the quoted held value"
+  );
+  const nextAllowance = {
+    ...allowance,
+    availableAmount: serializeTokenSubunits(
+      parseTokenSubunits(allowance.availableAmount) + amount
+    ),
+    heldAmount: serializeTokenSubunits(
+      parseTokenSubunits(allowance.heldAmount) - amount
+    ),
+    version: allowance.version + 1,
+    updatedAt: input.occurredAt
+  };
+  const nextHold = {
+    ...hold,
+    status: "released",
+    releaseIdempotencyKey: input.idempotencyKey,
+    releaseTransactionId: input.releaseTransactionId,
+    version: hold.version + 1,
+    updatedAt: input.occurredAt
+  };
+  assertModuleAllowance(nextAllowance);
+  assertModuleSpendHold(nextHold);
+  return { allowance: nextAllowance, hold: nextHold };
+}
+function assertModulePurchaseReceipt(receipt) {
+  economyAssert(
+    receipt.schemaVersion === ECONOMY_CONTRACT_VERSION,
     "INVALID_CONTRACT",
-    "Wallet summary version must be a positive safe integer"
+    "Unsupported module-purchase receipt contract version"
+  );
+  assertEconomyIdentifier(receipt.receiptId, "receiptId");
+  assertEconomyIdentifier(receipt.quoteId, "quoteId");
+  assertEconomyIdentifier(receipt.holdId, "holdId");
+  assertEconomyIdentifier(receipt.allowanceId, "allowanceId");
+  assertEconomyIdentifier(receipt.householdId, "householdId");
+  assertEconomyIdentifier(receipt.guardianAccountId, "guardianAccountId");
+  assertEconomyIdentifier(receipt.childAccountId, "childAccountId");
+  assertEconomyIdentifier(receipt.moduleVersionId, "moduleVersionId");
+  assertEconomyIdentifier(receipt.entitlementId, "entitlementId");
+  assertEconomyIdentifier(
+    receipt.requirementsManifestVersion,
+    "requirementsManifestVersion"
   );
-  parseIsoTimestamp(summary.asOf);
+  assertSha256Reference(
+    receipt.requirementsManifestHash,
+    "Requirements manifest hash"
+  );
+  assertEconomyIdentifier(
+    receipt.settlementTransactionId,
+    "settlementTransactionId"
+  );
+  assertWholePositive2(receipt.amount, "Receipt amount");
+  parseIsoTimestamp(receipt.issuedAt);
 }
-function assertWalletLifetimeTotals(totals) {
+function createModulePurchaseReceipt(quote, hold, input) {
+  assertModuleSpendQuote(quote);
+  assertModuleSpendHold(hold);
   economyAssert(
-    totals.schemaVersion === ECONOMY_CONTRACT_VERSION,
+    hold.status === "settled" && hold.quoteId === quote.quoteId && hold.allowanceId === quote.allowanceId && hold.householdId === quote.householdId && hold.guardianAccountId === quote.guardianAccountId && hold.childAccountId === quote.childAccountId && hold.moduleVersionId === quote.moduleVersionId && hold.amount === quote.amount && hold.requirementsManifestVersion === quote.requirementsManifestVersion && hold.requirementsManifestHash === quote.requirementsManifestHash,
     "INVALID_CONTRACT",
-    "Unsupported wallet lifetime-total contract version"
+    "Receipt quote and settled hold evidence do not match"
   );
-  for (const amount of [
-    totals.bought,
-    totals.earned,
-    totals.allocated,
-    totals.reclaimed,
-    totals.spent,
-    totals.reversed
-  ]) {
-    economyAssert(
-      parseTokenSubunits(amount) >= 0n,
-      "INVALID_AMOUNT",
-      "Wallet lifetime totals cannot be negative"
-    );
-  }
+  economyAssert(
+    parseIsoTimestamp(input.issuedAt) >= parseIsoTimestamp(hold.updatedAt),
+    "INVALID_TIME_WINDOW",
+    "Receipt cannot precede settlement"
+  );
+  const receipt = {
+    schemaVersion: ECONOMY_CONTRACT_VERSION,
+    receiptId: input.receiptId,
+    quoteId: quote.quoteId,
+    holdId: hold.holdId,
+    allowanceId: quote.allowanceId,
+    householdId: quote.householdId,
+    guardianAccountId: quote.guardianAccountId,
+    childAccountId: quote.childAccountId,
+    moduleVersionId: quote.moduleVersionId,
+    entitlementId: hold.entitlementId,
+    amount: quote.amount,
+    requirementsManifestVersion: quote.requirementsManifestVersion,
+    requirementsManifestHash: quote.requirementsManifestHash,
+    settlementTransactionId: hold.settlementTransactionId,
+    issuedAt: input.issuedAt
+  };
+  assertModulePurchaseReceipt(receipt);
+  return receipt;
 }
-
-// src/projection.ts
-function assertWalletBalanceProjection(projection) {
+function assertModulePurchaseReconciliationObservation(observation) {
   economyAssert(
-    projection.schemaVersion === ECONOMY_CONTRACT_VERSION,
+    observation.schemaVersion === ECONOMY_CONTRACT_VERSION,
     "INVALID_CONTRACT",
-    "Unsupported wallet-balance-projection contract version"
+    "Unsupported module-purchase reconciliation contract version"
   );
-  assertEconomyIdentifier(projection.walletId, "walletId");
-  for (const amount of [
-    projection.spendable,
-    projection.reserved,
-    projection.held
-  ]) {
-    economyAssert(
-      parseTokenSubunits(amount) >= 0n,
-      "NEGATIVE_PROJECTION",
-      "Wallet projection buckets cannot be negative"
-    );
-  }
+  assertEconomyIdentifier(observation.quoteId, "quoteId");
+  assertEconomyIdentifier(observation.holdId, "holdId");
+  assertEconomyIdentifier(observation.childAccountId, "childAccountId");
+  assertEconomyIdentifier(observation.moduleVersionId, "moduleVersionId");
   economyAssert(
-    Number.isSafeInteger(projection.version) && projection.version >= 1,
+    ["missing", "held", "settled", "released"].includes(
+      observation.financialState
+    ),
     "INVALID_CONTRACT",
-    "Wallet projection version must be a positive safe integer"
+    "Reconciliation financial state is unsupported"
   );
-  if (projection.lastTransactionId !== void 0) {
-    assertEconomyIdentifier(
-      projection.lastTransactionId,
-      "lastTransactionId"
+  economyAssert(
+    ["missing", "pending", "active", "cancelled"].includes(
+      observation.entitlementState
+    ),
+    "INVALID_CONTRACT",
+    "Reconciliation entitlement state is unsupported"
+  );
+  economyAssert(
+    typeof observation.receiptPresent === "boolean",
+    "INVALID_CONTRACT",
+    "Receipt presence must be Boolean"
+  );
+  parseIsoTimestamp(observation.observedAt);
+}
+function reconciliationResult(action, reasonCode, blocking = false, consistent = false) {
+  return {
+    schemaVersion: ECONOMY_CONTRACT_VERSION,
+    action,
+    blocking,
+    consistent,
+    reasonCode
+  };
+}
+function reconcileModulePurchase(observation) {
+  assertModulePurchaseReconciliationObservation(observation);
+  const { financialState, entitlementState, receiptPresent } = observation;
+  if (receiptPresent && !(financialState === "settled" && entitlementState === "active")) {
+    return reconciliationResult(
+      "manual-review",
+      "receipt-conflicts-with-authoritative-state",
+      true
     );
   }
-  parseIsoTimestamp(projection.asOf);
+  if (financialState === "settled" && entitlementState === "active") {
+    return receiptPresent ? reconciliationResult("none", "purchase-consistent", false, true) : reconciliationResult("issue-receipt", "settled-active-receipt-missing");
+  }
+  if (financialState === "held" && entitlementState === "pending") {
+    return reconciliationResult("resume-settlement", "held-pending");
+  }
+  if (financialState === "held" && (entitlementState === "missing" || entitlementState === "cancelled")) {
+    return reconciliationResult("release-hold", "held-without-usable-entitlement");
+  }
+  if (financialState === "settled" && entitlementState === "pending") {
+    return reconciliationResult("activate-entitlement", "settled-pending");
+  }
+  if ((financialState === "missing" || financialState === "released") && entitlementState === "pending") {
+    return reconciliationResult(
+      "cancel-pending-entitlement",
+      "pending-without-settlement-path"
+    );
+  }
+  if ((financialState === "missing" || financialState === "released") && (entitlementState === "missing" || entitlementState === "cancelled")) {
+    return reconciliationResult("none", "no-active-purchase", false, true);
+  }
+  return reconciliationResult(
+    "manual-review",
+    financialState === "settled" ? "settled-debit-without-entitlement" : "active-entitlement-without-settled-debit",
+    true
+  );
 }
-function assertWalletBalanceDelta(delta) {
+
+// src/operations.ts
+function assertDistinctAdjustmentApproval(request) {
   economyAssert(
-    delta.schemaVersion === ECONOMY_CONTRACT_VERSION,
+    request.schemaVersion === ECONOMY_CONTRACT_VERSION,
     "INVALID_CONTRACT",
-    "Unsupported wallet-balance-delta contract version"
+    "Unsupported adjustment contract version"
   );
-  assertEconomyIdentifier(delta.walletId, "walletId");
-  const values = [
-    parseTokenSubunits(delta.spendableDelta),
-    parseTokenSubunits(delta.reservedDelta),
-    parseTokenSubunits(delta.heldDelta)
-  ];
+  assertEconomyIdentifier(request.adjustmentId, "adjustmentId");
+  assertEconomyIdentifier(request.walletId, "walletId");
+  assertEconomyIdentifier(request.initiatedByAccountId, "initiatedByAccountId");
   economyAssert(
-    values.some((value) => value !== 0n),
+    parseTokenSubunits(request.amount) !== 0n,
     "INVALID_AMOUNT",
-    "Wallet balance delta must change at least one bucket"
+    "Adjustment amount cannot be zero"
   );
-}
-function assertWalletBalanceDeltaBatch(transactionId, deltas) {
-  assertEconomyIdentifier(transactionId, "transactionId");
   economyAssert(
-    deltas.length > 0,
+    request.reason.trim().length > 0 && request.reason.length <= 512,
     "INVALID_CONTRACT",
-    "An economic transaction must update at least one wallet projection"
+    "Adjustment reason is required and must be bounded"
   );
-  const walletIds = /* @__PURE__ */ new Set();
-  for (const delta of deltas) {
-    assertWalletBalanceDelta(delta);
-    economyAssert(
-      !walletIds.has(delta.walletId),
-      "DUPLICATE_IDENTIFIER",
-      "A balance-delta batch must update each wallet once"
-    );
-    walletIds.add(delta.walletId);
-  }
-}
-function applyWalletBalanceDelta(projection, delta, transactionId, asOf) {
-  assertWalletBalanceProjection(projection);
-  assertWalletBalanceDelta(delta);
-  assertEconomyIdentifier(transactionId, "transactionId");
+  assertEconomyIdentifier(request.ticketReference, "ticketReference");
+  const initiatedAt = parseIsoTimestamp(request.initiatedAt);
   economyAssert(
-    projection.walletId === delta.walletId,
+    request.approvedByAccountId !== void 0 && request.approvedByAccountId !== request.initiatedByAccountId,
     "INVALID_CONTRACT",
-    "Wallet balance delta must target its projection wallet"
+    "Adjustment approval requires a distinct authorized operator"
   );
+  assertEconomyIdentifier(request.approvedByAccountId, "approvedByAccountId");
   economyAssert(
-    parseIsoTimestamp(asOf) >= parseIsoTimestamp(projection.asOf),
+    request.approvedAt !== void 0 && parseIsoTimestamp(request.approvedAt) >= initiatedAt,
     "INVALID_TIME_WINDOW",
-    "Wallet balance update cannot precede its projection"
+    "Adjustment approval time must follow initiation"
   );
-  const next = {
-    ...projection,
-    spendable: serializeTokenSubunits(
-      parseTokenSubunits(projection.spendable) + parseTokenSubunits(delta.spendableDelta)
-    ),
-    reserved: serializeTokenSubunits(
-      parseTokenSubunits(projection.reserved) + parseTokenSubunits(delta.reservedDelta)
-    ),
-    held: serializeTokenSubunits(
-      parseTokenSubunits(projection.held) + parseTokenSubunits(delta.heldDelta)
-    ),
-    version: projection.version + 1,
-    lastTransactionId: transactionId,
-    asOf
-  };
-  assertWalletBalanceProjection(next);
-  return next;
+  economyAssert(
+    request.status === "approved" || request.status === "executed",
+    "INVALID_CONTRACT",
+    "Only approved adjustments satisfy dual-control approval"
+  );
+  if (request.resultingTransactionId !== void 0) {
+    assertEconomyIdentifier(
+      request.resultingTransactionId,
+      "resultingTransactionId"
+    );
+  }
 }
-function createWalletBalanceSummary(projection) {
-  assertWalletBalanceProjection(projection);
-  const spendable = parseTokenSubunits(projection.spendable);
-  const rewardProgress = spendable % 1000n;
-  const summary = {
-    schemaVersion: ECONOMY_CONTRACT_VERSION,
-    walletId: projection.walletId,
-    available: serializeTokenSubunits(spendable - rewardProgress),
-    reserved: projection.reserved,
-    held: projection.held,
-    rewardProgress: serializeTokenSubunits(rewardProgress),
-    version: projection.version,
-    asOf: projection.asOf
+
+// src/paid-lots.ts
+var ZERO_ARITHMETIC = Object.freeze({
+  retainedDelta: serializeTokenSubunits(0n),
+  heldDelta: serializeTokenSubunits(0n),
+  reversedDelta: serializeTokenSubunits(0n),
+  refundedDelta: serializeTokenSubunits(0n),
+  chargebackDelta: serializeTokenSubunits(0n),
+  oneTimeReversalDelta: serializeTokenSubunits(0n)
+});
+var EVENT_TYPES = [
+  "refund",
+  "dispute-hold",
+  "dispute-won",
+  "dispute-lost",
+  "chargeback",
+  "reversal"
+];
+var EVENT_PRECEDENCE = {
+  "dispute-hold": 0,
+  "dispute-won": 1,
+  "dispute-lost": 1,
+  refund: 2,
+  chargeback: 3,
+  reversal: 4
+};
+function assertPaidLotPurchaseProvenance(provenance) {
+  economyAssert(
+    provenance.schemaVersion === ECONOMY_CONTRACT_VERSION,
+    "INVALID_CONTRACT",
+    "Unsupported paid-lot provenance contract version"
+  );
+  assertEconomyIdentifier(provenance.purchaseId, "purchaseId");
+  assertEconomyIdentifier(provenance.catalogVersion, "catalogVersion");
+  parseIsoTimestamp(provenance.purchasedAt);
+}
+function assertPaidLotLifecycleEvent(event) {
+  economyAssert(
+    event.schemaVersion === ECONOMY_CONTRACT_VERSION,
+    "INVALID_CONTRACT",
+    "Unsupported paid-lot lifecycle event contract version"
+  );
+  assertEconomyIdentifier(event.eventId, "eventId");
+  assertEconomyIdentifier(event.lotId, "lotId");
+  economyAssert(
+    EVENT_TYPES.includes(event.eventType),
+    "INVALID_CONTRACT",
+    "Paid-lot lifecycle event type is unsupported"
+  );
+  economyAssert(
+    parseTokenSubunits(event.amount) > 0n,
+    "INVALID_AMOUNT",
+    "Paid-lot lifecycle event amount must be positive"
+  );
+  parseIsoTimestamp(event.occurredAt);
+}
+function sameEvent(left, right) {
+  return left.schemaVersion === right.schemaVersion && left.eventId === right.eventId && left.lotId === right.lotId && left.eventType === right.eventType && left.amount === right.amount && left.occurredAt === right.occurredAt;
+}
+function compareEvents(left, right) {
+  const timeDifference = parseIsoTimestamp(left.occurredAt) - parseIsoTimestamp(right.occurredAt);
+  if (timeDifference !== 0) {
+    return timeDifference;
+  }
+  const precedenceDifference = EVENT_PRECEDENCE[left.eventType] - EVENT_PRECEDENCE[right.eventType];
+  return precedenceDifference === 0 ? compareUnicodeCodeUnits(left.eventId, right.eventId) : precedenceDifference;
+}
+function deriveStatus(retained, held, reversed, chargeback) {
+  if (held > 0n) {
+    return "disputed";
+  }
+  if (chargeback > 0n) {
+    return "chargeback-lost";
+  }
+  if (retained === 0n) {
+    return "fully-reversed";
+  }
+  return reversed > 0n ? "partially-reversed" : "clear";
+}
+function immutableFactsFromLifecycle(lifecycle) {
+  return {
+    schemaVersion: lifecycle.schemaVersion,
+    lotId: lifecycle.lotId,
+    payerAccountId: lifecycle.payerAccountId,
+    receivingHouseholdId: lifecycle.receivingHouseholdId,
+    purchaseId: lifecycle.purchaseId,
+    catalogVersion: lifecycle.catalogVersion,
+    purchasedAt: lifecycle.purchasedAt,
+    settledAt: lifecycle.settledAt,
+    creditedAt: lifecycle.creditedAt,
+    originalAmount: lifecycle.originalAmount
   };
-  assertDeterministicWalletBalanceSummary(summary);
-  return summary;
 }
-function assertDeterministicWalletBalanceSummary(summary) {
-  assertWalletBalanceSummary(summary);
+function assertImmutableFacts(facts) {
   economyAssert(
-    parseTokenSubunits(summary.available) % 1000n === 0n && parseTokenSubunits(summary.rewardProgress) < 1000n,
+    facts.schemaVersion === ECONOMY_CONTRACT_VERSION,
     "INVALID_CONTRACT",
-    "Per-wallet availability must be whole Tokens with sub-Token progress below one Token"
+    "Unsupported paid-lot lifecycle contract version"
+  );
+  assertEconomyIdentifier(facts.lotId, "lotId");
+  assertEconomyIdentifier(facts.payerAccountId, "payerAccountId");
+  assertEconomyIdentifier(
+    facts.receivingHouseholdId,
+    "receivingHouseholdId"
+  );
+  assertEconomyIdentifier(facts.purchaseId, "purchaseId");
+  assertEconomyIdentifier(facts.catalogVersion, "catalogVersion");
+  const purchasedAt = parseIsoTimestamp(facts.purchasedAt);
+  const settledAt = parseIsoTimestamp(facts.settledAt);
+  const creditedAt = parseIsoTimestamp(facts.creditedAt);
+  economyAssert(
+    purchasedAt <= settledAt && settledAt <= creditedAt,
+    "INVALID_TIME_WINDOW",
+    "Paid-lot timestamps must follow purchase, settlement, then credit order"
+  );
+  economyAssert(
+    parseTokenSubunits(facts.originalAmount) > 0n,
+    "INVALID_AMOUNT",
+    "Paid-lot original amount must be positive"
   );
 }
-function deriveWalletBalanceDeltas(transaction, bindings) {
-  assertEconomicJournalTransaction(transaction);
-  const byAccount = /* @__PURE__ */ new Map();
-  for (const binding of bindings) {
-    assertEconomyIdentifier(binding.accountId, "accountId");
-    assertEconomyIdentifier(binding.walletId, "walletId");
+function projectPaidLot(facts, receipts) {
+  assertImmutableFacts(facts);
+  const eventIds = /* @__PURE__ */ new Set();
+  let reversalReceipts = 0;
+  for (const receipt of receipts) {
     economyAssert(
-      ["spendable", "reserved", "held"].includes(binding.bucket),
+      receipt.schemaVersion === ECONOMY_CONTRACT_VERSION,
       "INVALID_CONTRACT",
-      "Wallet account binding has an unsupported bucket"
+      "Unsupported paid-lot receipt contract version"
     );
+    assertPaidLotLifecycleEvent(receipt.event);
     economyAssert(
-      !byAccount.has(binding.accountId),
+      receipt.event.lotId === facts.lotId && !eventIds.has(receipt.event.eventId),
       "DUPLICATE_IDENTIFIER",
-      "A ledger account may bind to only one wallet bucket"
+      "Paid-lot receipts must be unique and belong to the lifecycle lot"
     );
-    byAccount.set(binding.accountId, binding);
-  }
-  const byWallet = /* @__PURE__ */ new Map();
-  for (const posting of transaction.postings) {
-    if (posting.walletId === void 0) {
-      continue;
+    eventIds.add(receipt.event.eventId);
+    if (receipt.event.eventType === "reversal") {
+      reversalReceipts += 1;
     }
-    const binding = byAccount.get(posting.accountId);
+  }
+  economyAssert(
+    reversalReceipts <= 1,
+    "REVERSAL_ALREADY_EXISTS",
+    "Paid-lot lifecycle permits only one distinct reversal event"
+  );
+  let retained = parseTokenSubunits(facts.originalAmount);
+  let held = 0n;
+  let reversed = 0n;
+  let refunded = 0n;
+  let chargeback = 0n;
+  let oneTimeReversal = 0n;
+  const effectiveEventIds = [];
+  for (const receipt of [...receipts].sort(
+    (left, right) => compareEvents(left.event, right.event)
+  )) {
+    const event = receipt.event;
     economyAssert(
-      binding !== void 0 && binding.walletId === posting.walletId,
-      "INVALID_CONTRACT",
-      "Every wallet-linked posting must match an authoritative account binding"
+      parseIsoTimestamp(event.occurredAt) >= parseIsoTimestamp(facts.creditedAt),
+      "INVALID_TIME_WINDOW",
+      "Paid-lot lifecycle event cannot precede credit"
     );
-    const values = byWallet.get(binding.walletId) ?? [0n, 0n, 0n];
-    const amount = parseTokenSubunits(posting.amount);
-    if (binding.bucket === "spendable") {
-      values[0] += amount;
-    } else if (binding.bucket === "reserved") {
-      values[1] += amount;
+    const amount = parseTokenSubunits(event.amount);
+    if (event.eventType === "dispute-hold") {
+      economyAssert(
+        amount <= retained - held,
+        "INSUFFICIENT_ELIGIBLE_LOTS",
+        "Dispute hold exceeds unheld retained paid-lot basis"
+      );
+      held += amount;
+    } else if (event.eventType === "dispute-won") {
+      economyAssert(
+        amount <= held,
+        "INVALID_AMOUNT",
+        "Dispute-win release exceeds held paid-lot basis"
+      );
+      held -= amount;
+    } else if (event.eventType === "dispute-lost") {
+      economyAssert(
+        amount <= held,
+        "INVALID_AMOUNT",
+        "Dispute-loss amount exceeds held paid-lot basis"
+      );
+      held -= amount;
+      retained -= amount;
+      reversed += amount;
+      chargeback += amount;
     } else {
-      values[2] += amount;
+      economyAssert(
+        amount <= retained - held,
+        "INSUFFICIENT_ELIGIBLE_LOTS",
+        "Paid-lot reversal exceeds unheld retained basis"
+      );
+      if (event.eventType === "reversal") {
+        oneTimeReversal += amount;
+      } else if (event.eventType === "refund") {
+        refunded += amount;
+      } else {
+        chargeback += amount;
+      }
+      retained -= amount;
+      reversed += amount;
     }
-    byWallet.set(binding.walletId, values);
+    effectiveEventIds.push(event.eventId);
   }
-  const deltas = [...byWallet.entries()].map(([walletId, values]) => ({
+  return {
+    retained,
+    held,
+    reversed,
+    refunded,
+    chargeback,
+    oneTimeReversal,
+    status: deriveStatus(retained, held, reversed, chargeback),
+    effectiveEventIds
+  };
+}
+function projectionMatchesLifecycle(projection, lifecycle) {
+  return serializeTokenSubunits(projection.retained) === lifecycle.retainedAmount && serializeTokenSubunits(projection.held) === lifecycle.heldAmount && serializeTokenSubunits(projection.reversed) === lifecycle.reversedAmount && serializeTokenSubunits(projection.refunded) === lifecycle.refundedAmount && serializeTokenSubunits(projection.chargeback) === lifecycle.chargebackAmount && serializeTokenSubunits(projection.oneTimeReversal) === lifecycle.oneTimeReversalAmount && projection.status === lifecycle.status && projection.effectiveEventIds.length === lifecycle.effectiveEventIds.length && projection.effectiveEventIds.every(
+    (eventId, index) => eventId === lifecycle.effectiveEventIds[index]
+  );
+}
+function assertPaidLotLifecycle(lifecycle) {
+  economyAssert(
+    Number.isSafeInteger(lifecycle.version) && lifecycle.version === lifecycle.receipts.length + 1,
+    "INVALID_CONTRACT",
+    "Paid-lot lifecycle version must match its receipt count"
+  );
+  const projection = projectPaidLot(
+    immutableFactsFromLifecycle(lifecycle),
+    lifecycle.receipts
+  );
+  economyAssert(
+    projectionMatchesLifecycle(projection, lifecycle),
+    "INVALID_CONTRACT",
+    "Paid-lot lifecycle does not match its immutable event rebuild"
+  );
+}
+function createPaidLotLifecycle(lot, provenance) {
+  assertSourceLot(lot);
+  assertPaidLotPurchaseProvenance(provenance);
+  economyAssert(
+    lot.payerAccountId !== void 0 && lot.householdId !== void 0,
+    "INVALID_CONTRACT",
+    "Paid-lot lifecycle requires payer and receiving-household provenance"
+  );
+  economyAssert(
+    lot.refundState === "none" && parseTokenSubunits(lot.heldAmount) === 0n && parseTokenSubunits(lot.reversedAmount) === 0n,
+    "INVALID_CONTRACT",
+    "Paid-lot lifecycle must be created before any refund or dispute movement"
+  );
+  economyAssert(
+    parseIsoTimestamp(provenance.purchasedAt) <= parseIsoTimestamp(lot.settledAt),
+    "INVALID_TIME_WINDOW",
+    "Paid purchase time cannot follow settlement"
+  );
+  const facts = {
     schemaVersion: ECONOMY_CONTRACT_VERSION,
-    walletId,
-    spendableDelta: serializeTokenSubunits(values[0]),
-    reservedDelta: serializeTokenSubunits(values[1]),
-    heldDelta: serializeTokenSubunits(values[2])
-  })).filter(
-    (delta) => delta.spendableDelta !== "0" || delta.reservedDelta !== "0" || delta.heldDelta !== "0"
-  ).sort((left, right) => left.walletId.localeCompare(right.walletId));
-  assertWalletBalanceDeltaBatch(transaction.transactionId, deltas);
-  return deltas;
+    lotId: lot.lotId,
+    payerAccountId: lot.payerAccountId,
+    receivingHouseholdId: lot.householdId,
+    purchaseId: provenance.purchaseId,
+    catalogVersion: provenance.catalogVersion,
+    purchasedAt: provenance.purchasedAt,
+    settledAt: lot.settledAt,
+    creditedAt: lot.creditedAt,
+    originalAmount: lot.originalAmount
+  };
+  const projection = projectPaidLot(facts, []);
+  const lifecycle = {
+    ...facts,
+    retainedAmount: serializeTokenSubunits(projection.retained),
+    heldAmount: serializeTokenSubunits(projection.held),
+    reversedAmount: serializeTokenSubunits(projection.reversed),
+    refundedAmount: serializeTokenSubunits(projection.refunded),
+    chargebackAmount: serializeTokenSubunits(projection.chargeback),
+    oneTimeReversalAmount: serializeTokenSubunits(
+      projection.oneTimeReversal
+    ),
+    status: projection.status,
+    version: 1,
+    receipts: [],
+    effectiveEventIds: []
+  };
+  assertPaidLotLifecycle(lifecycle);
+  return lifecycle;
 }
-var EARNED_ACTIVITY_TYPES = /* @__PURE__ */ new Set([
-  "rewarded-ad",
-  "offerwall",
-  "event",
-  "competition"
-]);
-function deriveWalletLifetimeDeltas(transaction) {
-  assertEconomicJournalTransaction(transaction);
-  if (transaction.status !== "settled") {
-    return [];
+function applyPaidLotLifecycleEvent(lifecycle, event, expectedVersion) {
+  assertPaidLotLifecycle(lifecycle);
+  assertPaidLotLifecycleEvent(event);
+  economyAssert(
+    event.lotId === lifecycle.lotId,
+    "INVALID_CONTRACT",
+    "Paid-lot event belongs to another source lot"
+  );
+  const replay = lifecycle.receipts.find(
+    (receipt) => receipt.event.eventId === event.eventId
+  );
+  if (replay !== void 0) {
+    economyAssert(
+      sameEvent(replay.event, event),
+      "DUPLICATE_IDENTIFIER",
+      "Paid-lot event ID was reused with different facts"
+    );
+    return {
+      lifecycle,
+      applied: false,
+      stateChanged: false,
+      arithmetic: ZERO_ARITHMETIC
+    };
   }
-  const netByWallet = /* @__PURE__ */ new Map();
-  for (const posting of transaction.postings) {
-    if (posting.walletId !== void 0) {
-      netByWallet.set(
-        posting.walletId,
-        (netByWallet.get(posting.walletId) ?? 0n) + parseTokenSubunits(posting.amount)
+  economyAssert(
+    expectedVersion === lifecycle.version,
+    "INVALID_CONTRACT",
+    "Paid-lot lifecycle event has a stale expected version"
+  );
+  const receipts = [
+    ...lifecycle.receipts,
+    { schemaVersion: ECONOMY_CONTRACT_VERSION, event }
+  ];
+  const projection = projectPaidLot(
+    immutableFactsFromLifecycle(lifecycle),
+    receipts
+  );
+  const before = {
+    retained: parseTokenSubunits(lifecycle.retainedAmount),
+    held: parseTokenSubunits(lifecycle.heldAmount),
+    reversed: parseTokenSubunits(lifecycle.reversedAmount),
+    refunded: parseTokenSubunits(lifecycle.refundedAmount),
+    chargeback: parseTokenSubunits(lifecycle.chargebackAmount),
+    oneTimeReversal: parseTokenSubunits(lifecycle.oneTimeReversalAmount)
+  };
+  const next = {
+    ...lifecycle,
+    retainedAmount: serializeTokenSubunits(projection.retained),
+    heldAmount: serializeTokenSubunits(projection.held),
+    reversedAmount: serializeTokenSubunits(projection.reversed),
+    refundedAmount: serializeTokenSubunits(projection.refunded),
+    chargebackAmount: serializeTokenSubunits(projection.chargeback),
+    oneTimeReversalAmount: serializeTokenSubunits(
+      projection.oneTimeReversal
+    ),
+    status: projection.status,
+    version: lifecycle.version + 1,
+    receipts,
+    effectiveEventIds: projection.effectiveEventIds
+  };
+  assertPaidLotLifecycle(next);
+  const arithmetic = {
+    retainedDelta: serializeTokenSubunits(
+      projection.retained - before.retained
+    ),
+    heldDelta: serializeTokenSubunits(projection.held - before.held),
+    reversedDelta: serializeTokenSubunits(
+      projection.reversed - before.reversed
+    ),
+    refundedDelta: serializeTokenSubunits(
+      projection.refunded - before.refunded
+    ),
+    chargebackDelta: serializeTokenSubunits(
+      projection.chargeback - before.chargeback
+    ),
+    oneTimeReversalDelta: serializeTokenSubunits(
+      projection.oneTimeReversal - before.oneTimeReversal
+    )
+  };
+  return {
+    lifecycle: next,
+    applied: true,
+    stateChanged: Object.values(arithmetic).some((delta) => delta !== "0"),
+    arithmetic
+  };
+}
+function reducePaidLotLifecycleEvents(initial, events) {
+  assertPaidLotLifecycle(initial);
+  const unique = /* @__PURE__ */ new Map();
+  for (const event of events) {
+    assertPaidLotLifecycleEvent(event);
+    const existing = unique.get(event.eventId);
+    if (existing !== void 0) {
+      economyAssert(
+        sameEvent(existing, event),
+        "DUPLICATE_IDENTIFIER",
+        "Paid-lot event ID was reused with different facts"
       );
+    } else {
+      unique.set(event.eventId, event);
     }
   }
-  const deltas = [];
-  for (const [walletId, net] of [...netByWallet.entries()].sort(
-    ([left], [right]) => left.localeCompare(right)
-  )) {
-    let bucket;
-    let amount = 0n;
-    if (net > 0n && (transaction.activityType === "purchase" || transaction.activityType === "subscription")) {
-      bucket = "bought";
-      amount = net;
-    } else if (net > 0n && EARNED_ACTIVITY_TYPES.has(transaction.activityType)) {
-      bucket = "earned";
-      amount = net;
-    } else if (net < 0n && (transaction.activityType === "allocation" || transaction.activityType === "boost")) {
-      bucket = "allocated";
-      amount = -net;
-    } else if (net > 0n && transaction.activityType === "reclaim") {
-      bucket = "reclaimed";
-      amount = net;
-    } else if (net < 0n && transaction.activityType === "spend") {
-      bucket = "spent";
-      amount = -net;
-    } else if (net < 0n && (transaction.activityType === "refund" || transaction.activityType === "chargeback" || transaction.activityType === "reversal")) {
-      bucket = "reversed";
-      amount = -net;
-    }
-    if (bucket !== void 0) {
-      deltas.push({
-        schemaVersion: ECONOMY_CONTRACT_VERSION,
-        walletId,
-        bucket,
-        amount: serializeTokenSubunits(amount)
-      });
-    }
+  let lifecycle = initial;
+  for (const event of [...unique.values()].sort(compareEvents)) {
+    lifecycle = applyPaidLotLifecycleEvent(
+      lifecycle,
+      event,
+      lifecycle.version
+    ).lifecycle;
   }
-  return deltas;
+  return lifecycle;
 }
-function applyWalletLifetimeDeltas(current, walletId, deltas) {
-  assertWalletLifetimeTotals(current);
-  assertEconomyIdentifier(walletId, "walletId");
-  const next = {
-    bought: parseTokenSubunits(current.bought),
-    earned: parseTokenSubunits(current.earned),
-    allocated: parseTokenSubunits(current.allocated),
-    reclaimed: parseTokenSubunits(current.reclaimed),
-    spent: parseTokenSubunits(current.spent),
-    reversed: parseTokenSubunits(current.reversed)
+function createEarlyBackerRetentionFromPaidLot(lifecycle) {
+  assertPaidLotLifecycle(lifecycle);
+  return {
+    schemaVersion: ECONOMY_CONTRACT_VERSION,
+    lotId: lifecycle.lotId,
+    payerAccountId: lifecycle.payerAccountId,
+    receivingHouseholdId: lifecycle.receivingHouseholdId,
+    purchaseId: lifecycle.purchaseId,
+    catalogVersion: lifecycle.catalogVersion,
+    purchasedAt: lifecycle.purchasedAt,
+    settledAt: lifecycle.settledAt,
+    creditedAt: lifecycle.creditedAt,
+    retainedAmount: lifecycle.retainedAmount
   };
-  for (const delta of deltas) {
-    economyAssert(
-      delta.schemaVersion === ECONOMY_CONTRACT_VERSION && delta.walletId === walletId && [
-        "bought",
-        "earned",
-        "allocated",
-        "reclaimed",
-        "spent",
-        "reversed"
-      ].includes(delta.bucket),
+}
+
+// src/ports/persistence.ts
+function assertScopedPersistedIdempotencyResult(result) {
+  economyAssert(
+    result.schemaVersion === ECONOMY_CONTRACT_VERSION,
+    "INVALID_CONTRACT",
+    "Unsupported scoped idempotency-result contract version"
+  );
+  assertEconomyIdentifier(result.commandId, "commandId");
+  assertEconomyIdentifier(result.transactionId, "transactionId");
+  economyAssert(
+    /^sha256:[a-f0-9]{64}$/u.test(result.responseHash),
+    "INVALID_CONTRACT",
+    "Idempotency response hash must be a canonical SHA-256 reference"
+  );
+  parseIsoTimestamp(result.recordedAt);
+}
+var ECONOMY_COMMAND_TYPES = /* @__PURE__ */ new Set([
+  "credit-purchase",
+  "credit-subscription",
+  "credit-reward",
+  "credit-event",
+  "credit-competition",
+  "allocate",
+  "boost",
+  "reclaim",
+  "spend",
+  "hold",
+  "release-hold",
+  "refund",
+  "chargeback",
+  "reverse",
+  "adjust"
+]);
+function assertEconomyIdempotencyScope(scope) {
+  economyAssert(
+    scope.schemaVersion === ECONOMY_CONTRACT_VERSION && ECONOMY_COMMAND_TYPES.has(scope.commandType),
+    "INVALID_CONTRACT",
+    "Unsupported economy idempotency scope"
+  );
+  assertEconomyIdentifier(scope.idempotencyKey, "idempotencyKey");
+  assertEconomyIdentifier(scope.actorAccountId, "actorAccountId");
+  assertEconomyIdentifier(scope.subjectAccountId, "subjectAccountId");
+}
+function assertEconomyCommandEnvelope(envelope) {
+  economyAssert(
+    envelope.schemaVersion === ECONOMY_CONTRACT_VERSION,
+    "INVALID_CONTRACT",
+    "Unsupported economy-command-envelope contract version"
+  );
+  assertEconomyIdentifier(envelope.commandId, "commandId");
+  economyAssert(
+    ECONOMY_COMMAND_TYPES.has(envelope.commandType),
+    "INVALID_CONTRACT",
+    "Economy command has an unsupported type"
+  );
+  assertEconomyIdentifier(envelope.idempotencyKey, "idempotencyKey");
+  assertEconomyIdentifier(envelope.actorAccountId, "actorAccountId");
+  assertEconomyIdentifier(envelope.subjectAccountId, "subjectAccountId");
+  if (envelope.relationshipId !== void 0) {
+    assertEconomyIdentifier(envelope.relationshipId, "relationshipId");
+  }
+  if (envelope.authorizationVersion !== void 0) {
+    economyAssert(
+      Number.isSafeInteger(envelope.authorizationVersion) && envelope.authorizationVersion >= 1,
       "INVALID_CONTRACT",
-      "Lifetime delta must target the requested wallet and a known bucket"
+      "Command authorization version must be a positive safe integer"
     );
-    const amount = parseTokenSubunits(delta.amount);
+  }
+  economyAssert(
+    envelope.relationshipId === void 0 === (envelope.authorizationVersion === void 0),
+    "INVALID_CONTRACT",
+    "Relationship identity and authorization version must be supplied together"
+  );
+  economyAssert(
+    /^sha256:[a-f0-9]{64}$/u.test(envelope.payloadHash),
+    "INVALID_CONTRACT",
+    "Command payload hash must be a canonical SHA-256 reference"
+  );
+  parseIsoTimestamp(envelope.acceptedAt);
+  assertEconomyIdentifier(envelope.acceptedRegion, "acceptedRegion");
+  assertEconomyIdentifier(
+    envelope.writerFencingToken,
+    "writerFencingToken"
+  );
+}
+function assertEconomyCommandWorkflowEvent(event) {
+  economyAssert(
+    event.schemaVersion === ECONOMY_CONTRACT_VERSION,
+    "INVALID_CONTRACT",
+    "Unsupported command-workflow-event contract version"
+  );
+  assertEconomyIdentifier(event.workflowEventId, "workflowEventId");
+  assertEconomyIdentifier(event.commandId, "commandId");
+  economyAssert(
+    ["accepted", "processing", "failed", "completed"].includes(event.state),
+    "INVALID_CONTRACT",
+    "Command workflow has an unsupported state"
+  );
+  economyAssert(
+    event.state === "failed" === (event.failureCode !== void 0),
+    "INVALID_CONTRACT",
+    "Only failed command workflows require a failure code"
+  );
+  if (event.failureCode !== void 0) {
+    assertEconomyIdentifier(event.failureCode, "failureCode");
+  }
+  parseIsoTimestamp(event.occurredAt);
+}
+
+// src/wallets.ts
+function assertWalletOwnerReference(owner) {
+  economyAssert(
+    ["account", "household", "system"].includes(owner.ownerType),
+    "INVALID_CONTRACT",
+    "Wallet owner reference has an unsupported type"
+  );
+  if (owner.ownerType === "system") {
     economyAssert(
-      amount > 0n,
+      owner.ownerId === "system",
+      "INVALID_CONTRACT",
+      "System wallet lookups must use the system owner"
+    );
+  } else {
+    assertEconomyIdentifier(owner.ownerId, "ownerId");
+    economyAssert(
+      owner.ownerId !== "system",
+      "INVALID_CONTRACT",
+      "Account and household wallets cannot use the system owner"
+    );
+  }
+}
+function assertWallet(wallet) {
+  economyAssert(
+    wallet.schemaVersion === ECONOMY_CONTRACT_VERSION,
+    "INVALID_CONTRACT",
+    "Unsupported wallet contract version"
+  );
+  assertEconomyIdentifier(wallet.walletId, "walletId");
+  assertEconomyIdentifier(wallet.accountId, "accountId");
+  economyAssert(
+    [
+      "household-treasury",
+      "personal",
+      "gameplay-allocation",
+      "hold",
+      "purchase-clearing",
+      "provider-clearing",
+      "system"
+    ].includes(wallet.kind),
+    "INVALID_CONTRACT",
+    "Wallet has an unsupported kind"
+  );
+  economyAssert(
+    ["account", "household", "system"].includes(wallet.ownerType),
+    "INVALID_CONTRACT",
+    "Wallet has an unsupported owner type"
+  );
+  economyAssert(
+    ["active", "restricted", "closed"].includes(wallet.status),
+    "INVALID_CONTRACT",
+    "Wallet has an unsupported status"
+  );
+  if (wallet.ownerType === "system") {
+    economyAssert(
+      wallet.ownerId === "system",
+      "INVALID_CONTRACT",
+      "System wallets must be owned by the system"
+    );
+  } else {
+    assertEconomyIdentifier(wallet.ownerId, "ownerId");
+  }
+  if (wallet.householdId !== void 0) {
+    assertEconomyIdentifier(wallet.householdId, "householdId");
+  }
+  if (wallet.ownerType === "household") {
+    economyAssert(
+      wallet.householdId === wallet.ownerId,
+      "INVALID_CONTRACT",
+      "Household wallets must identify the same household owner"
+    );
+  }
+  if (wallet.kind === "household-treasury") {
+    economyAssert(
+      wallet.ownerType === "household" && wallet.householdId !== void 0,
+      "INVALID_CONTRACT",
+      "Household treasuries must be owned by their household"
+    );
+  }
+  if (wallet.kind === "personal" || wallet.kind === "gameplay-allocation") {
+    economyAssert(
+      wallet.ownerType === "account",
+      "INVALID_CONTRACT",
+      "Personal and gameplay-allocation wallets must be account-owned"
+    );
+  }
+  if (wallet.kind === "gameplay-allocation") {
+    economyAssert(
+      wallet.householdId !== void 0,
+      "INVALID_CONTRACT",
+      "Gameplay-allocation wallets must retain household provenance"
+    );
+  }
+  if (wallet.kind === "purchase-clearing" || wallet.kind === "provider-clearing" || wallet.kind === "system") {
+    economyAssert(
+      wallet.ownerType === "system" && wallet.householdId === void 0,
+      "INVALID_CONTRACT",
+      "Clearing and system wallets must be system-owned"
+    );
+  }
+  economyAssert(
+    Number.isSafeInteger(wallet.version) && wallet.version >= 1,
+    "INVALID_CONTRACT",
+    "Wallet version must be a positive safe integer"
+  );
+  const createdAt = parseIsoTimestamp(wallet.createdAt);
+  if (wallet.closedAt !== void 0) {
+    economyAssert(
+      parseIsoTimestamp(wallet.closedAt) >= createdAt && wallet.status === "closed",
+      "INVALID_TIME_WINDOW",
+      "Only closed wallets may have a valid closure time"
+    );
+  } else {
+    economyAssert(
+      wallet.status !== "closed",
+      "INVALID_CONTRACT",
+      "Closed wallets require a closure time"
+    );
+  }
+}
+function assertWalletBalanceSummary(summary) {
+  economyAssert(
+    summary.schemaVersion === ECONOMY_CONTRACT_VERSION,
+    "INVALID_CONTRACT",
+    "Unsupported wallet summary contract version"
+  );
+  assertEconomyIdentifier(summary.walletId, "walletId");
+  for (const amount of [
+    summary.available,
+    summary.reserved,
+    summary.held,
+    summary.rewardProgress
+  ]) {
+    economyAssert(
+      parseTokenSubunits(amount) >= 0n,
       "INVALID_AMOUNT",
-      "Lifetime deltas must be positive"
+      "Wallet summary categories cannot be negative"
+    );
+  }
+  economyAssert(
+    Number.isSafeInteger(summary.version) && summary.version >= 1,
+    "INVALID_CONTRACT",
+    "Wallet summary version must be a positive safe integer"
+  );
+  parseIsoTimestamp(summary.asOf);
+}
+function assertWalletLifetimeTotals(totals) {
+  economyAssert(
+    totals.schemaVersion === ECONOMY_CONTRACT_VERSION,
+    "INVALID_CONTRACT",
+    "Unsupported wallet lifetime-total contract version"
+  );
+  for (const amount of [
+    totals.bought,
+    totals.earned,
+    totals.allocated,
+    totals.reclaimed,
+    totals.spent,
+    totals.reversed
+  ]) {
+    economyAssert(
+      parseTokenSubunits(amount) >= 0n,
+      "INVALID_AMOUNT",
+      "Wallet lifetime totals cannot be negative"
+    );
+  }
+}
+
+// src/projection.ts
+function assertWalletBalanceProjection(projection) {
+  economyAssert(
+    projection.schemaVersion === ECONOMY_CONTRACT_VERSION,
+    "INVALID_CONTRACT",
+    "Unsupported wallet-balance-projection contract version"
+  );
+  assertEconomyIdentifier(projection.walletId, "walletId");
+  for (const amount of [
+    projection.spendable,
+    projection.reserved,
+    projection.held
+  ]) {
+    economyAssert(
+      parseTokenSubunits(amount) >= 0n,
+      "NEGATIVE_PROJECTION",
+      "Wallet projection buckets cannot be negative"
+    );
+  }
+  economyAssert(
+    Number.isSafeInteger(projection.version) && projection.version >= 1,
+    "INVALID_CONTRACT",
+    "Wallet projection version must be a positive safe integer"
+  );
+  if (projection.lastTransactionId !== void 0) {
+    assertEconomyIdentifier(
+      projection.lastTransactionId,
+      "lastTransactionId"
+    );
+  }
+  parseIsoTimestamp(projection.asOf);
+}
+function assertWalletBalanceDelta(delta) {
+  economyAssert(
+    delta.schemaVersion === ECONOMY_CONTRACT_VERSION,
+    "INVALID_CONTRACT",
+    "Unsupported wallet-balance-delta contract version"
+  );
+  assertEconomyIdentifier(delta.walletId, "walletId");
+  const values = [
+    parseTokenSubunits(delta.spendableDelta),
+    parseTokenSubunits(delta.reservedDelta),
+    parseTokenSubunits(delta.heldDelta)
+  ];
+  economyAssert(
+    values.some((value) => value !== 0n),
+    "INVALID_AMOUNT",
+    "Wallet balance delta must change at least one bucket"
+  );
+}
+function assertWalletBalanceDeltaBatch(transactionId, deltas) {
+  assertEconomyIdentifier(transactionId, "transactionId");
+  economyAssert(
+    deltas.length > 0,
+    "INVALID_CONTRACT",
+    "An economic transaction must update at least one wallet projection"
+  );
+  const walletIds = /* @__PURE__ */ new Set();
+  for (const delta of deltas) {
+    assertWalletBalanceDelta(delta);
+    economyAssert(
+      !walletIds.has(delta.walletId),
+      "DUPLICATE_IDENTIFIER",
+      "A balance-delta batch must update each wallet once"
+    );
+    walletIds.add(delta.walletId);
+  }
+}
+function applyWalletBalanceDelta(projection, delta, transactionId, asOf) {
+  assertWalletBalanceProjection(projection);
+  assertWalletBalanceDelta(delta);
+  assertEconomyIdentifier(transactionId, "transactionId");
+  economyAssert(
+    projection.walletId === delta.walletId,
+    "INVALID_CONTRACT",
+    "Wallet balance delta must target its projection wallet"
+  );
+  economyAssert(
+    parseIsoTimestamp(asOf) >= parseIsoTimestamp(projection.asOf),
+    "INVALID_TIME_WINDOW",
+    "Wallet balance update cannot precede its projection"
+  );
+  const next = {
+    ...projection,
+    spendable: serializeTokenSubunits(
+      parseTokenSubunits(projection.spendable) + parseTokenSubunits(delta.spendableDelta)
+    ),
+    reserved: serializeTokenSubunits(
+      parseTokenSubunits(projection.reserved) + parseTokenSubunits(delta.reservedDelta)
+    ),
+    held: serializeTokenSubunits(
+      parseTokenSubunits(projection.held) + parseTokenSubunits(delta.heldDelta)
+    ),
+    version: projection.version + 1,
+    lastTransactionId: transactionId,
+    asOf
+  };
+  assertWalletBalanceProjection(next);
+  return next;
+}
+function createWalletBalanceSummary(projection) {
+  assertWalletBalanceProjection(projection);
+  const spendable = parseTokenSubunits(projection.spendable);
+  const rewardProgress = spendable % 1000n;
+  const summary = {
+    schemaVersion: ECONOMY_CONTRACT_VERSION,
+    walletId: projection.walletId,
+    available: serializeTokenSubunits(spendable - rewardProgress),
+    reserved: projection.reserved,
+    held: projection.held,
+    rewardProgress: serializeTokenSubunits(rewardProgress),
+    version: projection.version,
+    asOf: projection.asOf
+  };
+  assertDeterministicWalletBalanceSummary(summary);
+  return summary;
+}
+function assertDeterministicWalletBalanceSummary(summary) {
+  assertWalletBalanceSummary(summary);
+  economyAssert(
+    parseTokenSubunits(summary.available) % 1000n === 0n && parseTokenSubunits(summary.rewardProgress) < 1000n,
+    "INVALID_CONTRACT",
+    "Per-wallet availability must be whole Tokens with sub-Token progress below one Token"
+  );
+}
+function deriveWalletBalanceDeltas(transaction, bindings) {
+  assertEconomicJournalTransaction(transaction);
+  const byAccount = /* @__PURE__ */ new Map();
+  for (const binding of bindings) {
+    assertEconomyIdentifier(binding.accountId, "accountId");
+    assertEconomyIdentifier(binding.walletId, "walletId");
+    economyAssert(
+      ["spendable", "reserved", "held"].includes(binding.bucket),
+      "INVALID_CONTRACT",
+      "Wallet account binding has an unsupported bucket"
+    );
+    economyAssert(
+      !byAccount.has(binding.accountId),
+      "DUPLICATE_IDENTIFIER",
+      "A ledger account may bind to only one wallet bucket"
+    );
+    byAccount.set(binding.accountId, binding);
+  }
+  const byWallet = /* @__PURE__ */ new Map();
+  for (const posting of transaction.postings) {
+    if (posting.walletId === void 0) {
+      continue;
+    }
+    const binding = byAccount.get(posting.accountId);
+    economyAssert(
+      binding !== void 0 && binding.walletId === posting.walletId,
+      "INVALID_CONTRACT",
+      "Every wallet-linked posting must match an authoritative account binding"
+    );
+    const values = byWallet.get(binding.walletId) ?? [0n, 0n, 0n];
+    const amount = parseTokenSubunits(posting.amount);
+    if (binding.bucket === "spendable") {
+      values[0] += amount;
+    } else if (binding.bucket === "reserved") {
+      values[1] += amount;
+    } else {
+      values[2] += amount;
+    }
+    byWallet.set(binding.walletId, values);
+  }
+  const deltas = [...byWallet.entries()].map(([walletId, values]) => ({
+    schemaVersion: ECONOMY_CONTRACT_VERSION,
+    walletId,
+    spendableDelta: serializeTokenSubunits(values[0]),
+    reservedDelta: serializeTokenSubunits(values[1]),
+    heldDelta: serializeTokenSubunits(values[2])
+  })).filter(
+    (delta) => delta.spendableDelta !== "0" || delta.reservedDelta !== "0" || delta.heldDelta !== "0"
+  ).sort((left, right) => left.walletId.localeCompare(right.walletId));
+  assertWalletBalanceDeltaBatch(transaction.transactionId, deltas);
+  return deltas;
+}
+var EARNED_ACTIVITY_TYPES = /* @__PURE__ */ new Set([
+  "rewarded-ad",
+  "offerwall",
+  "event",
+  "competition"
+]);
+function deriveWalletLifetimeDeltas(transaction) {
+  assertEconomicJournalTransaction(transaction);
+  if (transaction.status !== "settled") {
+    return [];
+  }
+  const netByWallet = /* @__PURE__ */ new Map();
+  for (const posting of transaction.postings) {
+    if (posting.walletId !== void 0) {
+      netByWallet.set(
+        posting.walletId,
+        (netByWallet.get(posting.walletId) ?? 0n) + parseTokenSubunits(posting.amount)
+      );
+    }
+  }
+  const deltas = [];
+  for (const [walletId, net] of [...netByWallet.entries()].sort(
+    ([left], [right]) => left.localeCompare(right)
+  )) {
+    let bucket;
+    let amount = 0n;
+    if (net > 0n && (transaction.activityType === "purchase" || transaction.activityType === "subscription")) {
+      bucket = "bought";
+      amount = net;
+    } else if (net > 0n && EARNED_ACTIVITY_TYPES.has(transaction.activityType)) {
+      bucket = "earned";
+      amount = net;
+    } else if (net < 0n && (transaction.activityType === "allocation" || transaction.activityType === "boost")) {
+      bucket = "allocated";
+      amount = -net;
+    } else if (net > 0n && transaction.activityType === "reclaim") {
+      bucket = "reclaimed";
+      amount = net;
+    } else if (net < 0n && transaction.activityType === "spend") {
+      bucket = "spent";
+      amount = -net;
+    } else if (net < 0n && (transaction.activityType === "refund" || transaction.activityType === "chargeback" || transaction.activityType === "reversal")) {
+      bucket = "reversed";
+      amount = -net;
+    }
+    if (bucket !== void 0) {
+      deltas.push({
+        schemaVersion: ECONOMY_CONTRACT_VERSION,
+        walletId,
+        bucket,
+        amount: serializeTokenSubunits(amount)
+      });
+    }
+  }
+  return deltas;
+}
+function applyWalletLifetimeDeltas(current, walletId, deltas) {
+  assertWalletLifetimeTotals(current);
+  assertEconomyIdentifier(walletId, "walletId");
+  const next = {
+    bought: parseTokenSubunits(current.bought),
+    earned: parseTokenSubunits(current.earned),
+    allocated: parseTokenSubunits(current.allocated),
+    reclaimed: parseTokenSubunits(current.reclaimed),
+    spent: parseTokenSubunits(current.spent),
+    reversed: parseTokenSubunits(current.reversed)
+  };
+  for (const delta of deltas) {
+    economyAssert(
+      delta.schemaVersion === ECONOMY_CONTRACT_VERSION && delta.walletId === walletId && [
+        "bought",
+        "earned",
+        "allocated",
+        "reclaimed",
+        "spent",
+        "reversed"
+      ].includes(delta.bucket),
+      "INVALID_CONTRACT",
+      "Lifetime delta must target the requested wallet and a known bucket"
+    );
+    const amount = parseTokenSubunits(delta.amount);
+    economyAssert(
+      amount > 0n,
+      "INVALID_AMOUNT",
+      "Lifetime deltas must be positive"
+    );
+    next[delta.bucket] += amount;
+  }
+  const totals = {
+    schemaVersion: ECONOMY_CONTRACT_VERSION,
+    bought: serializeTokenSubunits(next.bought),
+    earned: serializeTokenSubunits(next.earned),
+    allocated: serializeTokenSubunits(next.allocated),
+    reclaimed: serializeTokenSubunits(next.reclaimed),
+    spent: serializeTokenSubunits(next.spent),
+    reversed: serializeTokenSubunits(next.reversed)
+  };
+  assertWalletLifetimeTotals(totals);
+  return totals;
+}
+function applyTransactionToProjection(current, transaction) {
+  assertBalancedTransaction(transaction);
+  const next = { ...current };
+  for (const posting of transaction.postings) {
+    const prior = parseTokenSubunits(next[posting.accountId] ?? "0");
+    next[posting.accountId] = serializeTokenSubunits(
+      prior + parseTokenSubunits(posting.amount)
+    );
+  }
+  return next;
+}
+function rebuildBalanceProjection(transactions) {
+  let projection = {};
+  const transactionIds = /* @__PURE__ */ new Set();
+  const idempotencyKeys = /* @__PURE__ */ new Set();
+  const providerEvents = /* @__PURE__ */ new Set();
+  for (const transaction of transactions) {
+    economyAssert(
+      !transactionIds.has(transaction.transactionId),
+      "DUPLICATE_TRANSACTION",
+      "Transaction identifiers must be unique"
+    );
+    economyAssert(
+      !idempotencyKeys.has(transaction.idempotencyKey),
+      "DUPLICATE_TRANSACTION",
+      "Idempotency keys must be unique"
+    );
+    if (transaction.providerEventId !== void 0) {
+      economyAssert(
+        !providerEvents.has(transaction.providerEventId),
+        "DUPLICATE_TRANSACTION",
+        "Provider event identifiers must be unique"
+      );
+      providerEvents.add(transaction.providerEventId);
+    }
+    transactionIds.add(transaction.transactionId);
+    idempotencyKeys.add(transaction.idempotencyKey);
+    projection = applyTransactionToProjection(projection, transaction);
+  }
+  return projection;
+}
+function assertNonNegativeAccounts(projection, protectedAccountIds) {
+  for (const accountId of protectedAccountIds) {
+    economyAssert(
+      parseTokenSubunits(projection[accountId] ?? "0") >= 0n,
+      "NEGATIVE_PROJECTION",
+      "A protected economy account would become negative"
+    );
+  }
+}
+function createProjectionSnapshot(transactions, rebuiltAt) {
+  parseIsoTimestamp(rebuiltAt);
+  const last = transactions.at(-1);
+  return {
+    schemaVersion: ECONOMY_CONTRACT_VERSION,
+    balances: rebuildBalanceProjection(transactions),
+    ...last === void 0 ? {} : { lastTransactionId: last.transactionId },
+    rebuiltAt
+  };
+}
+
+// src/ports/query.ts
+var ACTIVITY_TYPES2 = /* @__PURE__ */ new Set([
+  "purchase",
+  "subscription",
+  "rewarded-ad",
+  "offerwall",
+  "allocation",
+  "boost",
+  "reclaim",
+  "spend",
+  "hold",
+  "refund",
+  "chargeback",
+  "adjustment",
+  "reversal",
+  "event",
+  "competition"
+]);
+var ACTIVITY_STATUSES2 = /* @__PURE__ */ new Set([
+  "pending",
+  "held",
+  "settled",
+  "reversed",
+  "failed"
+]);
+var ACTIVITY_SOURCES2 = /* @__PURE__ */ new Set([
+  "shopify",
+  "ayet",
+  "bitlabs",
+  "subscription",
+  "event",
+  "competition",
+  "adjustment"
+]);
+var PORTFOLIO_ROLES = /* @__PURE__ */ new Set([
+  "household-treasury",
+  "personal",
+  "gameplay-allocation",
+  "hold"
+]);
+function hasControlCharacters2(value) {
+  return [...value].some((character) => {
+    const code = character.charCodeAt(0);
+    return code <= 31 || code === 127;
+  });
+}
+function assertSafeDisplayString(value, label) {
+  economyAssert(
+    typeof value === "string" && value.trim().length > 0 && value.length <= 128 && !hasControlCharacters2(value),
+    "INVALID_CONTRACT",
+    `${label} must be bounded and safe for display`
+  );
+}
+function assertOpaqueCursor(value) {
+  economyAssert(
+    typeof value === "string" && value.length > 0 && value.length <= 512 && !hasControlCharacters2(value),
+    "INVALID_CONTRACT",
+    "Activity cursor must be a bounded opaque value"
+  );
+}
+function assertUniqueValues(values, allowed, label) {
+  const unique = new Set(values);
+  economyAssert(
+    values.length > 0 && values.length === unique.size && values.every((value) => allowed.has(value)),
+    "INVALID_CONTRACT",
+    `${label} must contain unique supported values`
+  );
+}
+function assertWalletPortfolioReadScope(scope) {
+  economyAssert(
+    scope.schemaVersion === ECONOMY_CONTRACT_VERSION,
+    "INVALID_CONTRACT",
+    "Unsupported wallet-portfolio scope contract version"
+  );
+  assertEconomyIdentifier(scope.portfolioId, "portfolioId");
+  assertEconomyIdentifier(scope.subjectAccountId, "subjectAccountId");
+  economyAssert(
+    scope.components.length > 0 && scope.components.length <= 100,
+    "INVALID_CONTRACT",
+    "Wallet portfolio must contain between one and 100 components"
+  );
+  const walletIds = /* @__PURE__ */ new Set();
+  for (const component of scope.components) {
+    assertEconomyIdentifier(component.walletId, "walletId");
+    economyAssert(
+      PORTFOLIO_ROLES.has(component.role),
+      "INVALID_CONTRACT",
+      "Wallet portfolio component has an unsupported role"
+    );
+    economyAssert(
+      !walletIds.has(component.walletId),
+      "DUPLICATE_IDENTIFIER",
+      "Wallet portfolio cannot repeat a wallet"
+    );
+    walletIds.add(component.walletId);
+    if (component.beneficiaryAccountId !== void 0) {
+      assertEconomyIdentifier(
+        component.beneficiaryAccountId,
+        "beneficiaryAccountId"
+      );
+    }
+    economyAssert(
+      component.role !== "gameplay-allocation" || component.beneficiaryAccountId !== void 0,
+      "INVALID_CONTRACT",
+      "Gameplay-allocation portfolio components require a beneficiary"
+    );
+  }
+}
+function assertWalletLifetimeSnapshot(snapshot) {
+  economyAssert(
+    snapshot.schemaVersion === ECONOMY_CONTRACT_VERSION,
+    "INVALID_CONTRACT",
+    "Unsupported wallet-lifetime-snapshot contract version"
+  );
+  assertEconomyIdentifier(snapshot.walletId, "walletId");
+  assertWalletLifetimeTotals(snapshot.totals);
+  economyAssert(
+    Number.isSafeInteger(snapshot.version) && snapshot.version >= 1,
+    "INVALID_CONTRACT",
+    "Wallet lifetime version must be a positive safe integer"
+  );
+  parseIsoTimestamp(snapshot.asOf);
+}
+function assertPortfolioComponentMatch(expected, actual) {
+  economyAssert(
+    expected.walletId === actual.walletId && expected.role === actual.role && expected.beneficiaryAccountId === actual.beneficiaryAccountId,
+    "INVALID_CONTRACT",
+    "Portfolio result component does not match its authorized read scope"
+  );
+}
+function createWalletPortfolioSummary(scope, components, asOf) {
+  assertWalletPortfolioReadScope(scope);
+  parseIsoTimestamp(asOf);
+  economyAssert(
+    components.length === scope.components.length,
+    "INVALID_CONTRACT",
+    "Portfolio balance must include every authorized component exactly once"
+  );
+  const byWallet = new Map(components.map((item) => [item.walletId, item]));
+  economyAssert(
+    byWallet.size === components.length,
+    "DUPLICATE_IDENTIFIER",
+    "Portfolio balance cannot repeat a wallet"
+  );
+  const ordered = scope.components.map((expected) => {
+    const actual = byWallet.get(expected.walletId);
+    economyAssert(
+      actual !== void 0,
+      "INVALID_CONTRACT",
+      "Portfolio balance is missing an authorized wallet"
+    );
+    assertPortfolioComponentMatch(expected, actual);
+    assertDeterministicWalletBalanceSummary(actual.summary);
+    economyAssert(
+      actual.summary.walletId === actual.walletId && actual.summary.asOf === asOf,
+      "INVALID_CONTRACT",
+      "Portfolio component summary must identify its wallet and shared snapshot time"
+    );
+    return actual;
+  });
+  const totals = {
+    available: serializeTokenSubunits(
+      ordered.reduce(
+        (sum, item) => sum + parseTokenSubunits(item.summary.available),
+        0n
+      )
+    ),
+    reserved: serializeTokenSubunits(
+      ordered.reduce(
+        (sum, item) => sum + parseTokenSubunits(item.summary.reserved),
+        0n
+      )
+    ),
+    held: serializeTokenSubunits(
+      ordered.reduce(
+        (sum, item) => sum + parseTokenSubunits(item.summary.held),
+        0n
+      )
+    ),
+    rewardProgress: serializeTokenSubunits(
+      ordered.reduce(
+        (sum, item) => sum + parseTokenSubunits(item.summary.rewardProgress),
+        0n
+      )
+    )
+  };
+  return {
+    schemaVersion: ECONOMY_CONTRACT_VERSION,
+    portfolioId: scope.portfolioId,
+    subjectAccountId: scope.subjectAccountId,
+    components: ordered,
+    totals,
+    asOf
+  };
+}
+function assertWalletPortfolioSummary(summary) {
+  const scope = {
+    schemaVersion: summary.schemaVersion,
+    portfolioId: summary.portfolioId,
+    subjectAccountId: summary.subjectAccountId,
+    components: summary.components.map(
+      ({ walletId, role, beneficiaryAccountId }) => ({
+        walletId,
+        role,
+        ...beneficiaryAccountId === void 0 ? {} : { beneficiaryAccountId }
+      })
+    )
+  };
+  const rebuilt = createWalletPortfolioSummary(
+    scope,
+    summary.components,
+    summary.asOf
+  );
+  for (const field of [
+    "available",
+    "reserved",
+    "held",
+    "rewardProgress"
+  ]) {
+    economyAssert(
+      summary.totals[field] === rebuilt.totals[field],
+      "INVALID_CONTRACT",
+      "Portfolio balance totals must equal their component column sums"
+    );
+  }
+}
+function createWalletPortfolioLifetime(scope, components, asOf) {
+  assertWalletPortfolioReadScope(scope);
+  parseIsoTimestamp(asOf);
+  economyAssert(
+    components.length === scope.components.length,
+    "INVALID_CONTRACT",
+    "Portfolio lifetime must include every authorized component exactly once"
+  );
+  const byWallet = new Map(components.map((item) => [item.walletId, item]));
+  economyAssert(
+    byWallet.size === components.length,
+    "DUPLICATE_IDENTIFIER",
+    "Portfolio lifetime cannot repeat a wallet"
+  );
+  const ordered = scope.components.map((expected) => {
+    const actual = byWallet.get(expected.walletId);
+    economyAssert(
+      actual !== void 0,
+      "INVALID_CONTRACT",
+      "Portfolio lifetime is missing an authorized wallet"
+    );
+    assertPortfolioComponentMatch(expected, actual);
+    assertWalletLifetimeSnapshot(actual.snapshot);
+    economyAssert(
+      actual.snapshot.walletId === actual.walletId && actual.snapshot.asOf === asOf,
+      "INVALID_CONTRACT",
+      "Portfolio lifetime component must identify its wallet and shared snapshot time"
     );
-    next[delta.bucket] += amount;
-  }
+    return actual;
+  });
+  const sumField = (field) => serializeTokenSubunits(
+    ordered.reduce(
+      (sum, item) => sum + parseTokenSubunits(item.snapshot.totals[field]),
+      0n
+    )
+  );
   const totals = {
     schemaVersion: ECONOMY_CONTRACT_VERSION,
-    bought: serializeTokenSubunits(next.bought),
-    earned: serializeTokenSubunits(next.earned),
-    allocated: serializeTokenSubunits(next.allocated),
-    reclaimed: serializeTokenSubunits(next.reclaimed),
-    spent: serializeTokenSubunits(next.spent),
-    reversed: serializeTokenSubunits(next.reversed)
+    bought: sumField("bought"),
+    earned: sumField("earned"),
+    allocated: sumField("allocated"),
+    reclaimed: sumField("reclaimed"),
+    spent: sumField("spent"),
+    reversed: sumField("reversed")
   };
   assertWalletLifetimeTotals(totals);
-  return totals;
+  return {
+    schemaVersion: ECONOMY_CONTRACT_VERSION,
+    portfolioId: scope.portfolioId,
+    subjectAccountId: scope.subjectAccountId,
+    components: ordered,
+    totals,
+    asOf
+  };
 }
-function applyTransactionToProjection(current, transaction) {
-  assertBalancedTransaction(transaction);
-  const next = { ...current };
-  for (const posting of transaction.postings) {
-    const prior = parseTokenSubunits(next[posting.accountId] ?? "0");
-    next[posting.accountId] = serializeTokenSubunits(
-      prior + parseTokenSubunits(posting.amount)
+function assertWalletPortfolioLifetime(lifetime) {
+  const scope = {
+    schemaVersion: lifetime.schemaVersion,
+    portfolioId: lifetime.portfolioId,
+    subjectAccountId: lifetime.subjectAccountId,
+    components: lifetime.components.map(
+      ({ walletId, role, beneficiaryAccountId }) => ({
+        walletId,
+        role,
+        ...beneficiaryAccountId === void 0 ? {} : { beneficiaryAccountId }
+      })
+    )
+  };
+  const rebuilt = createWalletPortfolioLifetime(
+    scope,
+    lifetime.components,
+    lifetime.asOf
+  );
+  for (const field of [
+    "bought",
+    "earned",
+    "allocated",
+    "reclaimed",
+    "spent",
+    "reversed"
+  ]) {
+    economyAssert(
+      lifetime.totals[field] === rebuilt.totals[field],
+      "INVALID_CONTRACT",
+      "Portfolio lifetime totals must equal their component column sums"
     );
   }
-  return next;
 }
-function rebuildBalanceProjection(transactions) {
-  let projection = {};
-  const transactionIds = /* @__PURE__ */ new Set();
-  const idempotencyKeys = /* @__PURE__ */ new Set();
-  const providerEvents = /* @__PURE__ */ new Set();
-  for (const transaction of transactions) {
+function assertWalletActivityEntry(entry) {
+  economyAssert(
+    entry.schemaVersion === ECONOMY_CONTRACT_VERSION,
+    "INVALID_CONTRACT",
+    "Unsupported wallet-activity contract version"
+  );
+  assertEconomyIdentifier(entry.activityId, "activityId");
+  assertEconomyIdentifier(entry.walletId, "walletId");
+  economyAssert(
+    ACTIVITY_TYPES2.has(entry.activityType) && ACTIVITY_STATUSES2.has(entry.status) && ACTIVITY_SOURCES2.has(entry.source),
+    "INVALID_CONTRACT",
+    "Wallet activity type, status, or source is unsupported"
+  );
+  parseIsoTimestamp(entry.occurredAt);
+  economyAssert(
+    parseTokenSubunits(entry.amount) !== 0n,
+    "INVALID_AMOUNT",
+    "Wallet activity amount cannot be zero"
+  );
+  if (entry.beneficiaryAccountId !== void 0) {
+    assertEconomyIdentifier(
+      entry.beneficiaryAccountId,
+      "beneficiaryAccountId"
+    );
+  }
+  if (entry.maskedReference !== void 0) {
+    assertSafeDisplayString(entry.maskedReference, "Masked reference");
+  }
+  assertSafeDisplayString(entry.sourceLabel, "Source label");
+  economyAssert(
+    entry.entryKind === "economic" || entry.entryKind === "workflow",
+    "INVALID_CONTRACT",
+    "Wallet activity has an unsupported entry kind"
+  );
+  if (entry.entryKind === "economic") {
+    assertEconomyIdentifier(entry.transactionId, "transactionId");
+    economyAssert(
+      entry.status === "held" || entry.status === "settled" || entry.status === "reversed",
+      "INVALID_CONTRACT",
+      "Economic activity cannot use a workflow status"
+    );
+  } else {
+    assertEconomyIdentifier(entry.commandId, "commandId");
+    economyAssert(
+      entry.status === "pending" || entry.status === "failed",
+      "INVALID_CONTRACT",
+      "Workflow activity cannot use an economic status"
+    );
+  }
+}
+function assertWalletActivityPageRequest(request) {
+  economyAssert(
+    Number.isSafeInteger(request.limit) && request.limit >= 1 && request.limit <= 100,
+    "INVALID_CONTRACT",
+    "Activity page limit must be between one and 100"
+  );
+  if (request.cursor !== void 0) {
+    assertOpaqueCursor(request.cursor);
+  }
+  const filter = request.filter;
+  if (filter === void 0) {
+    return;
+  }
+  if (filter.activityTypes !== void 0) {
+    assertUniqueValues(filter.activityTypes, ACTIVITY_TYPES2, "Activity types");
+  }
+  if (filter.statuses !== void 0) {
+    assertUniqueValues(filter.statuses, ACTIVITY_STATUSES2, "Activity statuses");
+  }
+  if (filter.sources !== void 0) {
+    assertUniqueValues(filter.sources, ACTIVITY_SOURCES2, "Activity sources");
+  }
+  if (filter.beneficiaryAccountId !== void 0) {
+    assertEconomyIdentifier(
+      filter.beneficiaryAccountId,
+      "beneficiaryAccountId"
+    );
+  }
+  const from = filter.fromInclusive === void 0 ? void 0 : parseIsoTimestamp(filter.fromInclusive);
+  const to = filter.toExclusive === void 0 ? void 0 : parseIsoTimestamp(filter.toExclusive);
+  economyAssert(
+    from === void 0 || to === void 0 || from < to,
+    "INVALID_TIME_WINDOW",
+    "Activity filter start must precede its exclusive end"
+  );
+}
+function assertWalletActivityPage(page) {
+  economyAssert(
+    page.schemaVersion === ECONOMY_CONTRACT_VERSION && typeof page.hasMore === "boolean",
+    "INVALID_CONTRACT",
+    "Unsupported wallet-activity-page contract"
+  );
+  economyAssert(
+    page.hasMore === (page.nextCursor !== void 0),
+    "INVALID_CONTRACT",
+    "Activity page cursor must be present exactly when more rows exist"
+  );
+  economyAssert(
+    page.entries.length <= 100 && (!page.hasMore || page.entries.length > 0),
+    "INVALID_CONTRACT",
+    "Activity pages are bounded and cannot advertise more rows from an empty page"
+  );
+  if (page.nextCursor !== void 0) {
+    assertOpaqueCursor(page.nextCursor);
+  }
+  const activityIds = /* @__PURE__ */ new Set();
+  let previous;
+  for (const entry of page.entries) {
+    assertWalletActivityEntry(entry);
+    economyAssert(
+      !activityIds.has(entry.activityId),
+      "DUPLICATE_IDENTIFIER",
+      "Activity page cannot repeat an activity ID"
+    );
+    activityIds.add(entry.activityId);
+    if (previous !== void 0) {
+      const previousTime = parseIsoTimestamp(previous.occurredAt);
+      const currentTime = parseIsoTimestamp(entry.occurredAt);
+      economyAssert(
+        previousTime > currentTime || previousTime === currentTime && previous.activityId.localeCompare(entry.activityId) > 0,
+        "INVALID_CONTRACT",
+        "Activity page must use stable descending time and ID order"
+      );
+    }
+    previous = entry;
+  }
+}
+function assertWalletActivityPageForPortfolio(page, scope) {
+  assertWalletActivityPage(page);
+  assertWalletPortfolioReadScope(scope);
+  const walletIds = new Set(scope.components.map((item) => item.walletId));
+  economyAssert(
+    page.entries.every((entry) => walletIds.has(entry.walletId)),
+    "INVALID_CONTRACT",
+    "Portfolio activity contains a wallet outside its authorized read scope"
+  );
+}
+
+// src/purchase-caps.ts
+var MAX_SIGNED_BIGINT = 2n ** 63n - 1n;
+var CANONICAL_NON_NEGATIVE_INTEGER = /^(?:0|[1-9][0-9]*)$/u;
+function parseGbpMinorUnits(value) {
+  economyAssert(
+    typeof value === "string" && CANONICAL_NON_NEGATIVE_INTEGER.test(value),
+    "INVALID_AMOUNT",
+    "GBP minor units must be a canonical non-negative integer string"
+  );
+  try {
+    const amount = BigInt(value);
+    economyAssert(
+      amount <= MAX_SIGNED_BIGINT,
+      "AMOUNT_OUT_OF_RANGE",
+      "GBP minor units are outside the signed 64-bit range"
+    );
+    return amount;
+  } catch (error) {
+    if (error instanceof EconomyError) {
+      throw error;
+    }
+    throw new EconomyError("INVALID_AMOUNT", "GBP minor units are invalid");
+  }
+}
+function serializeGbpMinorUnits(amount) {
+  economyAssert(
+    amount >= 0n && amount <= MAX_SIGNED_BIGINT,
+    "AMOUNT_OUT_OF_RANGE",
+    "GBP minor units are outside the signed 64-bit range"
+  );
+  return amount.toString(10);
+}
+var RESERVATION_STATUSES = [
+  "reserved",
+  "settled",
+  "released",
+  "expired"
+];
+var TRANSITION_PRECEDENCE = {
+  settle: 0,
+  release: 1,
+  expire: 2
+};
+function assertPurchaseCapReservationTransition(transition) {
+  economyAssert(
+    transition.schemaVersion === ECONOMY_CONTRACT_VERSION,
+    "INVALID_CONTRACT",
+    "Unsupported purchase-cap transition contract version"
+  );
+  assertEconomyIdentifier(transition.transitionId, "transitionId");
+  assertEconomyIdentifier(transition.reservationId, "reservationId");
+  economyAssert(
+    ["settle", "release", "expire"].includes(transition.transitionType),
+    "INVALID_CONTRACT",
+    "Purchase-cap transition type is unsupported"
+  );
+  parseIsoTimestamp(transition.occurredAt);
+}
+function sameTransition(left, right) {
+  return left.schemaVersion === right.schemaVersion && left.transitionId === right.transitionId && left.reservationId === right.reservationId && left.transitionType === right.transitionType && left.occurredAt === right.occurredAt;
+}
+function compareTransitions(left, right) {
+  const timeDifference = parseIsoTimestamp(left.occurredAt) - parseIsoTimestamp(right.occurredAt);
+  if (timeDifference !== 0) {
+    return timeDifference;
+  }
+  const precedenceDifference = TRANSITION_PRECEDENCE[left.transitionType] - TRANSITION_PRECEDENCE[right.transitionType];
+  return precedenceDifference === 0 ? compareUnicodeCodeUnits(left.transitionId, right.transitionId) : precedenceDifference;
+}
+function assertBinding(binding) {
+  economyAssert(
+    binding.schemaVersion === ECONOMY_CONTRACT_VERSION,
+    "INVALID_CONTRACT",
+    "Unsupported purchase-cap reservation contract version"
+  );
+  assertEconomyIdentifier(binding.reservationId, "reservationId");
+  assertEconomyIdentifier(binding.payerAccountId, "payerAccountId");
+  assertEconomyIdentifier(binding.householdId, "householdId");
+  economyAssert(
+    parseGbpMinorUnits(binding.priceMinorUnits) > 0n,
+    "INVALID_AMOUNT",
+    "Purchase-cap reservation amount must be positive"
+  );
+  economyAssert(
+    parseIsoTimestamp(binding.expiresAt) > parseIsoTimestamp(binding.reservedAt),
+    "INVALID_TIME_WINDOW",
+    "Purchase-cap reservation expiry must follow its creation"
+  );
+}
+function bindingFromReservation(reservation) {
+  return {
+    schemaVersion: reservation.schemaVersion,
+    reservationId: reservation.reservationId,
+    payerAccountId: reservation.payerAccountId,
+    householdId: reservation.householdId,
+    priceMinorUnits: reservation.priceMinorUnits,
+    reservedAt: reservation.reservedAt,
+    expiresAt: reservation.expiresAt
+  };
+}
+function projectReservation(binding, receipts) {
+  assertBinding(binding);
+  const reservedAt = parseIsoTimestamp(binding.reservedAt);
+  const expiresAt = parseIsoTimestamp(binding.expiresAt);
+  const transitionIds = /* @__PURE__ */ new Set();
+  for (const receipt of receipts) {
     economyAssert(
-      !transactionIds.has(transaction.transactionId),
-      "DUPLICATE_TRANSACTION",
-      "Transaction identifiers must be unique"
+      receipt.schemaVersion === ECONOMY_CONTRACT_VERSION,
+      "INVALID_CONTRACT",
+      "Unsupported purchase-cap transition receipt version"
     );
+    assertPurchaseCapReservationTransition(receipt.transition);
     economyAssert(
-      !idempotencyKeys.has(transaction.idempotencyKey),
-      "DUPLICATE_TRANSACTION",
-      "Idempotency keys must be unique"
+      receipt.transition.reservationId === binding.reservationId && !transitionIds.has(receipt.transition.transitionId),
+      "DUPLICATE_IDENTIFIER",
+      "Purchase-cap receipts must be unique and belong to the reservation"
     );
-    if (transaction.providerEventId !== void 0) {
-      economyAssert(
-        !providerEvents.has(transaction.providerEventId),
-        "DUPLICATE_TRANSACTION",
-        "Provider event identifiers must be unique"
-      );
-      providerEvents.add(transaction.providerEventId);
-    }
-    transactionIds.add(transaction.transactionId);
-    idempotencyKeys.add(transaction.idempotencyKey);
-    projection = applyTransactionToProjection(projection, transaction);
+    transitionIds.add(receipt.transition.transitionId);
   }
-  return projection;
-}
-function assertNonNegativeAccounts(projection, protectedAccountIds) {
-  for (const accountId of protectedAccountIds) {
+  let status = "reserved";
+  let finalTransitionId;
+  let finalizedAt;
+  for (const receipt of [...receipts].sort(
+    (left, right) => compareTransitions(left.transition, right.transition)
+  )) {
+    const transition = receipt.transition;
+    const occurredAt = parseIsoTimestamp(transition.occurredAt);
     economyAssert(
-      parseTokenSubunits(projection[accountId] ?? "0") >= 0n,
-      "NEGATIVE_PROJECTION",
-      "A protected economy account would become negative"
+      occurredAt >= reservedAt,
+      "INVALID_TIME_WINDOW",
+      "Purchase-cap transition cannot precede reservation"
     );
+    if (transition.transitionType === "settle") {
+      economyAssert(
+        occurredAt < expiresAt,
+        "INVALID_TIME_WINDOW",
+        "Purchase-cap settlement must use payment time before expiry"
+      );
+    } else if (transition.transitionType === "release") {
+      economyAssert(
+        occurredAt < expiresAt,
+        "INVALID_TIME_WINDOW",
+        "Purchase-cap release must precede reservation expiry"
+      );
+    } else {
+      economyAssert(
+        occurredAt >= expiresAt,
+        "INVALID_TIME_WINDOW",
+        "Purchase-cap reservation cannot expire before its deadline"
+      );
+    }
+    if (status === "reserved") {
+      status = transition.transitionType === "settle" ? "settled" : transition.transitionType === "release" ? "released" : "expired";
+      finalTransitionId = transition.transitionId;
+      finalizedAt = transition.occurredAt;
+    }
   }
-}
-function createProjectionSnapshot(transactions, rebuiltAt) {
-  parseIsoTimestamp(rebuiltAt);
-  const last = transactions.at(-1);
   return {
-    schemaVersion: ECONOMY_CONTRACT_VERSION,
-    balances: rebuildBalanceProjection(transactions),
-    ...last === void 0 ? {} : { lastTransactionId: last.transactionId },
-    rebuiltAt
+    ...binding,
+    status,
+    ...finalTransitionId === void 0 ? {} : { finalTransitionId, finalizedAt },
+    transitionReceipts: receipts
   };
 }
-
-// src/ports/query.ts
-var ACTIVITY_TYPES2 = /* @__PURE__ */ new Set([
-  "purchase",
-  "subscription",
-  "rewarded-ad",
-  "offerwall",
-  "allocation",
-  "boost",
-  "reclaim",
-  "spend",
-  "hold",
-  "refund",
-  "chargeback",
-  "adjustment",
-  "reversal",
-  "event",
-  "competition"
-]);
-var ACTIVITY_STATUSES2 = /* @__PURE__ */ new Set([
-  "pending",
-  "held",
-  "settled",
-  "reversed",
-  "failed"
-]);
-var ACTIVITY_SOURCES2 = /* @__PURE__ */ new Set([
-  "shopify",
-  "ayet",
-  "bitlabs",
-  "subscription",
-  "event",
-  "competition",
-  "adjustment"
-]);
-var PORTFOLIO_ROLES = /* @__PURE__ */ new Set([
-  "household-treasury",
-  "personal",
-  "gameplay-allocation",
-  "hold"
-]);
-function hasControlCharacters2(value) {
-  return [...value].some((character) => {
-    const code = character.charCodeAt(0);
-    return code <= 31 || code === 127;
+function sameReservationFacts(left, right) {
+  return left.schemaVersion === right.schemaVersion && left.reservationId === right.reservationId && left.payerAccountId === right.payerAccountId && left.householdId === right.householdId && left.priceMinorUnits === right.priceMinorUnits && left.status === right.status && left.reservedAt === right.reservedAt && left.expiresAt === right.expiresAt && left.finalTransitionId === right.finalTransitionId && left.finalizedAt === right.finalizedAt && left.transitionReceipts.length === right.transitionReceipts.length && left.transitionReceipts.every((receipt, index) => {
+    const other = right.transitionReceipts[index];
+    return other !== void 0 && receipt.schemaVersion === other.schemaVersion && sameTransition(receipt.transition, other.transition);
   });
 }
-function assertSafeDisplayString(value, label) {
-  economyAssert(
-    typeof value === "string" && value.trim().length > 0 && value.length <= 128 && !hasControlCharacters2(value),
-    "INVALID_CONTRACT",
-    `${label} must be bounded and safe for display`
-  );
+function sameReservationBinding(reservation, proposed) {
+  return reservation.schemaVersion === proposed.schemaVersion && reservation.reservationId === proposed.reservationId && reservation.payerAccountId === proposed.payerAccountId && reservation.householdId === proposed.householdId && reservation.priceMinorUnits === proposed.priceMinorUnits && reservation.reservedAt === proposed.reservedAt && reservation.expiresAt === proposed.expiresAt;
 }
-function assertOpaqueCursor(value) {
+function assertPurchaseCapReservation(reservation) {
   economyAssert(
-    typeof value === "string" && value.length > 0 && value.length <= 512 && !hasControlCharacters2(value),
+    RESERVATION_STATUSES.includes(reservation.status),
     "INVALID_CONTRACT",
-    "Activity cursor must be a bounded opaque value"
+    "Purchase-cap reservation status is unsupported"
+  );
+  const projected = projectReservation(
+    bindingFromReservation(reservation),
+    reservation.transitionReceipts
   );
-}
-function assertUniqueValues(values, allowed, label) {
-  const unique = new Set(values);
   economyAssert(
-    values.length > 0 && values.length === unique.size && values.every((value) => allowed.has(value)),
+    sameReservationFacts(projected, reservation),
     "INVALID_CONTRACT",
-    `${label} must contain unique supported values`
+    "Purchase-cap reservation does not match its immutable event rebuild"
   );
 }
-function assertWalletPortfolioReadScope(scope) {
+function assertRollingPurchaseCapState(state) {
   economyAssert(
-    scope.schemaVersion === ECONOMY_CONTRACT_VERSION,
+    state.schemaVersion === ECONOMY_CONTRACT_VERSION,
     "INVALID_CONTRACT",
-    "Unsupported wallet-portfolio scope contract version"
+    "Unsupported rolling purchase-cap contract version"
   );
-  assertEconomyIdentifier(scope.portfolioId, "portfolioId");
-  assertEconomyIdentifier(scope.subjectAccountId, "subjectAccountId");
   economyAssert(
-    scope.components.length > 0 && scope.components.length <= 100,
+    state.scopeType === "payer" || state.scopeType === "household",
     "INVALID_CONTRACT",
-    "Wallet portfolio must contain between one and 100 components"
-  );
-  const walletIds = /* @__PURE__ */ new Set();
-  for (const component of scope.components) {
-    assertEconomyIdentifier(component.walletId, "walletId");
+    "Purchase-cap scope type is unsupported"
+  );
+  assertEconomyIdentifier(state.scopeId, "scopeId");
+  const reservationIds = /* @__PURE__ */ new Set();
+  const transitionIds = /* @__PURE__ */ new Set();
+  let receiptCount = 0;
+  for (const reservation of state.reservations) {
+    assertPurchaseCapReservation(reservation);
     economyAssert(
-      PORTFOLIO_ROLES.has(component.role),
-      "INVALID_CONTRACT",
-      "Wallet portfolio component has an unsupported role"
-    );
-    economyAssert(
-      !walletIds.has(component.walletId),
+      !reservationIds.has(reservation.reservationId),
       "DUPLICATE_IDENTIFIER",
-      "Wallet portfolio cannot repeat a wallet"
+      "Purchase-cap state cannot repeat a reservation"
     );
-    walletIds.add(component.walletId);
-    if (component.beneficiaryAccountId !== void 0) {
-      assertEconomyIdentifier(
-        component.beneficiaryAccountId,
-        "beneficiaryAccountId"
-      );
-    }
+    reservationIds.add(reservation.reservationId);
     economyAssert(
-      component.role !== "gameplay-allocation" || component.beneficiaryAccountId !== void 0,
+      state.scopeType === "payer" ? reservation.payerAccountId === state.scopeId : reservation.householdId === state.scopeId,
       "INVALID_CONTRACT",
-      "Gameplay-allocation portfolio components require a beneficiary"
+      "Purchase-cap reservation belongs to another aggregate scope"
     );
+    for (const receipt of reservation.transitionReceipts) {
+      economyAssert(
+        !transitionIds.has(receipt.transition.transitionId),
+        "DUPLICATE_IDENTIFIER",
+        "Purchase-cap state cannot repeat a transition ID"
+      );
+      transitionIds.add(receipt.transition.transitionId);
+      receiptCount += 1;
+    }
   }
-}
-function assertWalletLifetimeSnapshot(snapshot) {
-  economyAssert(
-    snapshot.schemaVersion === ECONOMY_CONTRACT_VERSION,
-    "INVALID_CONTRACT",
-    "Unsupported wallet-lifetime-snapshot contract version"
-  );
-  assertEconomyIdentifier(snapshot.walletId, "walletId");
-  assertWalletLifetimeTotals(snapshot.totals);
   economyAssert(
-    Number.isSafeInteger(snapshot.version) && snapshot.version >= 1,
+    Number.isSafeInteger(state.version) && state.version === 1 + state.reservations.length + receiptCount,
     "INVALID_CONTRACT",
-    "Wallet lifetime version must be a positive safe integer"
+    "Purchase-cap state version must match reservation and receipt counts"
   );
-  parseIsoTimestamp(snapshot.asOf);
 }
-function assertPortfolioComponentMatch(expected, actual) {
+function assertAggregatePair(payerState, householdState, payerAccountId, householdId) {
+  assertRollingPurchaseCapState(payerState);
+  assertRollingPurchaseCapState(householdState);
   economyAssert(
-    expected.walletId === actual.walletId && expected.role === actual.role && expected.beneficiaryAccountId === actual.beneficiaryAccountId,
+    payerState.scopeType === "payer" && payerState.scopeId === payerAccountId && householdState.scopeType === "household" && householdState.scopeId === householdId,
     "INVALID_CONTRACT",
-    "Portfolio result component does not match its authorized read scope"
+    "Purchase-cap aggregate pair does not match payer and household"
   );
 }
-function createWalletPortfolioSummary(scope, components, asOf) {
-  assertWalletPortfolioReadScope(scope);
-  parseIsoTimestamp(asOf);
+function findMirroredReservation(payerState, householdState, reservationId) {
+  const payerReservation = payerState.reservations.find(
+    (reservation) => reservation.reservationId === reservationId
+  );
+  const householdReservation = householdState.reservations.find(
+    (reservation) => reservation.reservationId === reservationId
+  );
   economyAssert(
-    components.length === scope.components.length,
+    payerReservation === void 0 === (householdReservation === void 0),
     "INVALID_CONTRACT",
-    "Portfolio balance must include every authorized component exactly once"
+    "Purchase-cap reservation must exist in both aggregate scopes atomically"
   );
-  const byWallet = new Map(components.map((item) => [item.walletId, item]));
+  if (payerReservation === void 0 || householdReservation === void 0) {
+    return void 0;
+  }
   economyAssert(
-    byWallet.size === components.length,
-    "DUPLICATE_IDENTIFIER",
-    "Portfolio balance cannot repeat a wallet"
+    sameReservationFacts(payerReservation, householdReservation),
+    "INVALID_CONTRACT",
+    "Payer and household purchase-cap reservations have diverged"
   );
-  const ordered = scope.components.map((expected) => {
-    const actual = byWallet.get(expected.walletId);
-    economyAssert(
-      actual !== void 0,
-      "INVALID_CONTRACT",
-      "Portfolio balance is missing an authorized wallet"
-    );
-    assertPortfolioComponentMatch(expected, actual);
-    assertDeterministicWalletBalanceSummary(actual.summary);
+  return payerReservation;
+}
+function windowStart(checkedAt, rollingDays) {
+  return checkedAt - rollingDays * 24 * 60 * 60 * 1e3;
+}
+function calculateRollingPurchaseCapUsage(state, checkedAt, policy) {
+  assertRollingPurchaseCapState(state);
+  assertPurchaseLimitPolicy(policy);
+  const checkedAtValue = parseIsoTimestamp(checkedAt);
+  const start = windowStart(checkedAtValue, policy.rollingDays);
+  let total = 0n;
+  for (const reservation of state.reservations) {
+    if (reservation.status === "reserved" && parseIsoTimestamp(reservation.reservedAt) <= checkedAtValue && checkedAtValue < parseIsoTimestamp(reservation.expiresAt)) {
+      total += parseGbpMinorUnits(reservation.priceMinorUnits);
+    } else if (reservation.status === "settled" && reservation.finalizedAt !== void 0) {
+      const settledAt = parseIsoTimestamp(reservation.finalizedAt);
+      if (settledAt >= start && settledAt <= checkedAtValue) {
+        total += parseGbpMinorUnits(reservation.priceMinorUnits);
+      }
+    }
     economyAssert(
-      actual.summary.walletId === actual.walletId && actual.summary.asOf === asOf,
-      "INVALID_CONTRACT",
-      "Portfolio component summary must identify its wallet and shared snapshot time"
+      total <= MAX_SIGNED_BIGINT,
+      "AMOUNT_OUT_OF_RANGE",
+      "Rolling purchase-cap usage exceeds signed 64-bit range"
     );
-    return actual;
-  });
-  const totals = {
-    available: serializeTokenSubunits(
-      ordered.reduce(
-        (sum, item) => sum + parseTokenSubunits(item.summary.available),
-        0n
-      )
-    ),
-    reserved: serializeTokenSubunits(
-      ordered.reduce(
-        (sum, item) => sum + parseTokenSubunits(item.summary.reserved),
-        0n
-      )
-    ),
-    held: serializeTokenSubunits(
-      ordered.reduce(
-        (sum, item) => sum + parseTokenSubunits(item.summary.held),
-        0n
-      )
-    ),
-    rewardProgress: serializeTokenSubunits(
-      ordered.reduce(
-        (sum, item) => sum + parseTokenSubunits(item.summary.rewardProgress),
-        0n
-      )
-    )
-  };
+  }
+  return serializeGbpMinorUnits(total);
+}
+function createRollingPurchaseCapState(scopeType, scopeId) {
+  economyAssert(
+    scopeType === "payer" || scopeType === "household",
+    "INVALID_CONTRACT",
+    "Purchase-cap scope type is unsupported"
+  );
+  assertEconomyIdentifier(scopeId, "scopeId");
   return {
     schemaVersion: ECONOMY_CONTRACT_VERSION,
-    portfolioId: scope.portfolioId,
-    subjectAccountId: scope.subjectAccountId,
-    components: ordered,
-    totals,
-    asOf
+    scopeType,
+    scopeId,
+    version: 1,
+    reservations: []
   };
 }
-function assertWalletPortfolioSummary(summary) {
-  const scope = {
-    schemaVersion: summary.schemaVersion,
-    portfolioId: summary.portfolioId,
-    subjectAccountId: summary.subjectAccountId,
-    components: summary.components.map(
-      ({ walletId, role, beneficiaryAccountId }) => ({
-        walletId,
-        role,
-        ...beneficiaryAccountId === void 0 ? {} : { beneficiaryAccountId }
-      })
+function sortedWithReservation(state, reservation) {
+  return [...state.reservations, reservation].sort(
+    (left, right) => compareUnicodeCodeUnits(left.reservationId, right.reservationId)
+  );
+}
+function resultWithUsage(payerState, householdState, reservation, applied, stateChanged, checkedAt, policy) {
+  return {
+    payerState,
+    householdState,
+    reservation,
+    applied,
+    stateChanged,
+    payerUsageMinorUnits: calculateRollingPurchaseCapUsage(
+      payerState,
+      checkedAt,
+      policy
+    ),
+    householdUsageMinorUnits: calculateRollingPurchaseCapUsage(
+      householdState,
+      checkedAt,
+      policy
     )
   };
-  const rebuilt = createWalletPortfolioSummary(
-    scope,
-    summary.components,
-    summary.asOf
+}
+function reserveRollingPurchaseCaps(payerState, householdState, command, policy) {
+  economyAssert(
+    command.schemaVersion === ECONOMY_CONTRACT_VERSION,
+    "INVALID_CONTRACT",
+    "Unsupported purchase-cap reservation command version"
   );
-  for (const field of [
-    "available",
-    "reserved",
-    "held",
-    "rewardProgress"
-  ]) {
+  const binding = {
+    schemaVersion: ECONOMY_CONTRACT_VERSION,
+    reservationId: command.reservationId,
+    payerAccountId: command.payerAccountId,
+    householdId: command.householdId,
+    priceMinorUnits: command.priceMinorUnits,
+    reservedAt: command.reservedAt,
+    expiresAt: command.expiresAt
+  };
+  assertBinding(binding);
+  assertAggregatePair(
+    payerState,
+    householdState,
+    command.payerAccountId,
+    command.householdId
+  );
+  assertPurchaseLimitPolicy(policy);
+  const proposed = projectReservation(binding, []);
+  const replay = findMirroredReservation(
+    payerState,
+    householdState,
+    command.reservationId
+  );
+  if (replay !== void 0) {
     economyAssert(
-      summary.totals[field] === rebuilt.totals[field],
-      "INVALID_CONTRACT",
-      "Portfolio balance totals must equal their component column sums"
+      sameReservationBinding(replay, proposed),
+      "DUPLICATE_IDENTIFIER",
+      "Purchase-cap reservation ID was reused with different facts"
+    );
+    return resultWithUsage(
+      payerState,
+      householdState,
+      replay,
+      false,
+      false,
+      replay.finalizedAt ?? command.reservedAt,
+      policy
     );
   }
-}
-function createWalletPortfolioLifetime(scope, components, asOf) {
-  assertWalletPortfolioReadScope(scope);
-  parseIsoTimestamp(asOf);
   economyAssert(
-    components.length === scope.components.length,
+    command.expectedPayerVersion === payerState.version && command.expectedHouseholdVersion === householdState.version,
     "INVALID_CONTRACT",
-    "Portfolio lifetime must include every authorized component exactly once"
+    "Purchase-cap reservation has a stale aggregate version"
   );
-  const byWallet = new Map(components.map((item) => [item.walletId, item]));
+  const amount = parseGbpMinorUnits(command.priceMinorUnits);
   economyAssert(
-    byWallet.size === components.length,
-    "DUPLICATE_IDENTIFIER",
-    "Portfolio lifetime cannot repeat a wallet"
+    amount <= parseGbpMinorUnits(policy.maxOrderPriceMinorUnits),
+    "INSUFFICIENT_BALANCE",
+    "Purchase amount exceeds the per-order ceiling"
   );
-  const ordered = scope.components.map((expected) => {
-    const actual = byWallet.get(expected.walletId);
-    economyAssert(
-      actual !== void 0,
-      "INVALID_CONTRACT",
-      "Portfolio lifetime is missing an authorized wallet"
-    );
-    assertPortfolioComponentMatch(expected, actual);
-    assertWalletLifetimeSnapshot(actual.snapshot);
-    economyAssert(
-      actual.snapshot.walletId === actual.walletId && actual.snapshot.asOf === asOf,
-      "INVALID_CONTRACT",
-      "Portfolio lifetime component must identify its wallet and shared snapshot time"
-    );
-    return actual;
-  });
-  const sumField = (field) => serializeTokenSubunits(
-    ordered.reduce(
-      (sum, item) => sum + parseTokenSubunits(item.snapshot.totals[field]),
-      0n
+  const payerUsage = parseGbpMinorUnits(
+    calculateRollingPurchaseCapUsage(payerState, command.reservedAt, policy)
+  );
+  const householdUsage = parseGbpMinorUnits(
+    calculateRollingPurchaseCapUsage(
+      householdState,
+      command.reservedAt,
+      policy
     )
   );
-  const totals = {
-    schemaVersion: ECONOMY_CONTRACT_VERSION,
-    bought: sumField("bought"),
-    earned: sumField("earned"),
-    allocated: sumField("allocated"),
-    reclaimed: sumField("reclaimed"),
-    spent: sumField("spent"),
-    reversed: sumField("reversed")
+  economyAssert(
+    payerUsage + amount <= parseGbpMinorUnits(policy.rollingPayerPriceMinorUnits),
+    "INSUFFICIENT_BALANCE",
+    "Purchase amount exceeds the rolling payer ceiling"
+  );
+  economyAssert(
+    householdUsage + amount <= parseGbpMinorUnits(policy.rollingHouseholdPriceMinorUnits),
+    "INSUFFICIENT_BALANCE",
+    "Purchase amount exceeds the rolling household ceiling"
+  );
+  const nextPayer = {
+    ...payerState,
+    version: payerState.version + 1,
+    reservations: sortedWithReservation(payerState, proposed)
   };
-  assertWalletLifetimeTotals(totals);
-  return {
-    schemaVersion: ECONOMY_CONTRACT_VERSION,
-    portfolioId: scope.portfolioId,
-    subjectAccountId: scope.subjectAccountId,
-    components: ordered,
-    totals,
-    asOf
+  const nextHousehold = {
+    ...householdState,
+    version: householdState.version + 1,
+    reservations: sortedWithReservation(householdState, proposed)
   };
+  return resultWithUsage(
+    nextPayer,
+    nextHousehold,
+    proposed,
+    true,
+    true,
+    command.reservedAt,
+    policy
+  );
 }
-function assertWalletPortfolioLifetime(lifetime) {
-  const scope = {
-    schemaVersion: lifetime.schemaVersion,
-    portfolioId: lifetime.portfolioId,
-    subjectAccountId: lifetime.subjectAccountId,
-    components: lifetime.components.map(
-      ({ walletId, role, beneficiaryAccountId }) => ({
-        walletId,
-        role,
-        ...beneficiaryAccountId === void 0 ? {} : { beneficiaryAccountId }
-      })
+function replaceReservation(state, replacement) {
+  return {
+    ...state,
+    version: state.version + 1,
+    reservations: state.reservations.map(
+      (reservation) => reservation.reservationId === replacement.reservationId ? replacement : reservation
     )
   };
-  const rebuilt = createWalletPortfolioLifetime(
-    scope,
-    lifetime.components,
-    lifetime.asOf
+}
+function findTransitionById(state, transitionId) {
+  for (const reservation of state.reservations) {
+    const receipt = reservation.transitionReceipts.find(
+      (candidate) => candidate.transition.transitionId === transitionId
+    );
+    if (receipt !== void 0) {
+      return { reservationId: reservation.reservationId, transition: receipt.transition };
+    }
+  }
+  return void 0;
+}
+function transitionRollingPurchaseCapReservation(payerState, householdState, transition, expectedPayerVersion, expectedHouseholdVersion, policy) {
+  assertPurchaseCapReservationTransition(transition);
+  assertRollingPurchaseCapState(payerState);
+  assertRollingPurchaseCapState(householdState);
+  const current = findMirroredReservation(
+    payerState,
+    householdState,
+    transition.reservationId
   );
-  for (const field of [
-    "bought",
-    "earned",
-    "allocated",
-    "reclaimed",
-    "spent",
-    "reversed"
-  ]) {
+  economyAssert(
+    current !== void 0,
+    "INVALID_CONTRACT",
+    "Purchase-cap reservation does not exist in both aggregate scopes"
+  );
+  assertAggregatePair(
+    payerState,
+    householdState,
+    current.payerAccountId,
+    current.householdId
+  );
+  assertPurchaseLimitPolicy(policy);
+  const payerExisting = findTransitionById(
+    payerState,
+    transition.transitionId
+  );
+  const householdExisting = findTransitionById(
+    householdState,
+    transition.transitionId
+  );
+  economyAssert(
+    payerExisting === void 0 === (householdExisting === void 0),
+    "INVALID_CONTRACT",
+    "Purchase-cap transition must exist in both scopes atomically"
+  );
+  if (payerExisting !== void 0 && householdExisting !== void 0) {
     economyAssert(
-      lifetime.totals[field] === rebuilt.totals[field],
-      "INVALID_CONTRACT",
-      "Portfolio lifetime totals must equal their component column sums"
+      payerExisting.reservationId === transition.reservationId && householdExisting.reservationId === transition.reservationId && sameTransition(payerExisting.transition, transition) && sameTransition(householdExisting.transition, transition),
+      "DUPLICATE_IDENTIFIER",
+      "Purchase-cap transition ID was reused with different facts"
+    );
+    return resultWithUsage(
+      payerState,
+      householdState,
+      current,
+      false,
+      false,
+      transition.occurredAt,
+      policy
     );
   }
+  economyAssert(
+    expectedPayerVersion === payerState.version && expectedHouseholdVersion === householdState.version,
+    "INVALID_CONTRACT",
+    "Purchase-cap transition has a stale aggregate version"
+  );
+  const replacement = projectReservation(bindingFromReservation(current), [
+    ...current.transitionReceipts,
+    { schemaVersion: ECONOMY_CONTRACT_VERSION, transition }
+  ]);
+  const stateChanged = replacement.status !== current.status || replacement.finalTransitionId !== current.finalTransitionId || replacement.finalizedAt !== current.finalizedAt;
+  const nextPayer = replaceReservation(payerState, replacement);
+  const nextHousehold = replaceReservation(householdState, replacement);
+  return resultWithUsage(
+    nextPayer,
+    nextHousehold,
+    replacement,
+    true,
+    stateChanged,
+    transition.occurredAt,
+    policy
+  );
 }
-function assertWalletActivityEntry(entry) {
+
+// src/purchase-intents.ts
+var TRANSITION_TYPES = [
+  "checkout-bound",
+  "payment-observed",
+  "credit-recorded",
+  "expire",
+  "cancel",
+  "dispute-opened",
+  "dispute-won",
+  "dispute-lost"
+];
+var TRANSITION_PRECEDENCE2 = {
+  "checkout-bound": 0,
+  "payment-observed": 1,
+  "credit-recorded": 2,
+  "dispute-opened": 3,
+  "dispute-won": 4,
+  "dispute-lost": 4,
+  cancel: 5,
+  expire: 6
+};
+function assertCheckoutHash(value) {
   economyAssert(
-    entry.schemaVersion === ECONOMY_CONTRACT_VERSION,
+    /^sha256:[a-f0-9]{64}$/u.test(value),
     "INVALID_CONTRACT",
-    "Unsupported wallet-activity contract version"
+    "Checkout references must be stored as sanitized SHA-256 hashes"
   );
-  assertEconomyIdentifier(entry.activityId, "activityId");
-  assertEconomyIdentifier(entry.walletId, "walletId");
+}
+function assertPurchaseIntentTransition(transition) {
   economyAssert(
-    ACTIVITY_TYPES2.has(entry.activityType) && ACTIVITY_STATUSES2.has(entry.status) && ACTIVITY_SOURCES2.has(entry.source),
+    transition.schemaVersion === ECONOMY_CONTRACT_VERSION,
     "INVALID_CONTRACT",
-    "Wallet activity type, status, or source is unsupported"
+    "Unsupported purchase-intent transition contract version"
   );
-  parseIsoTimestamp(entry.occurredAt);
+  assertEconomyIdentifier(transition.transitionId, "transitionId");
+  assertEconomyIdentifier(transition.intentId, "intentId");
   economyAssert(
-    parseTokenSubunits(entry.amount) !== 0n,
-    "INVALID_AMOUNT",
-    "Wallet activity amount cannot be zero"
+    TRANSITION_TYPES.includes(transition.transitionType),
+    "INVALID_CONTRACT",
+    "Purchase-intent transition type is unsupported"
   );
-  if (entry.beneficiaryAccountId !== void 0) {
-    assertEconomyIdentifier(
-      entry.beneficiaryAccountId,
-      "beneficiaryAccountId"
-    );
+  parseIsoTimestamp(transition.occurredAt);
+  if (transition.providerCheckoutReferenceHash !== void 0) {
+    assertCheckoutHash(transition.providerCheckoutReferenceHash);
   }
-  if (entry.maskedReference !== void 0) {
-    assertSafeDisplayString(entry.maskedReference, "Masked reference");
+  const requiresCheckoutHash = transition.transitionType === "checkout-bound" || transition.transitionType === "payment-observed";
+  economyAssert(
+    requiresCheckoutHash === (transition.providerCheckoutReferenceHash !== void 0),
+    "INVALID_CONTRACT",
+    "Only checkout and payment transitions must carry a checkout binding"
+  );
+}
+function sameTransition2(left, right) {
+  return left.schemaVersion === right.schemaVersion && left.transitionId === right.transitionId && left.intentId === right.intentId && left.transitionType === right.transitionType && left.occurredAt === right.occurredAt && left.providerCheckoutReferenceHash === right.providerCheckoutReferenceHash;
+}
+function sameIntent(left, right) {
+  return left.schemaVersion === right.schemaVersion && left.intentId === right.intentId && left.payerAccountId === right.payerAccountId && left.receivingHouseholdId === right.receivingHouseholdId && left.receivingWalletId === right.receivingWalletId && left.packId === right.packId && left.catalogVersion === right.catalogVersion && left.expectedCurrency === right.expectedCurrency && left.expectedPriceMinorUnits === right.expectedPriceMinorUnits && left.grantAmount === right.grantAmount && left.status === right.status && left.createdAt === right.createdAt && left.expiresAt === right.expiresAt && left.providerCheckoutReferenceHash === right.providerCheckoutReferenceHash;
+}
+function compareTransitions2(left, right) {
+  const timeDifference = parseIsoTimestamp(left.occurredAt) - parseIsoTimestamp(right.occurredAt);
+  if (timeDifference !== 0) {
+    return timeDifference;
   }
-  assertSafeDisplayString(entry.sourceLabel, "Source label");
+  const precedenceDifference = TRANSITION_PRECEDENCE2[left.transitionType] - TRANSITION_PRECEDENCE2[right.transitionType];
+  return precedenceDifference === 0 ? compareUnicodeCodeUnits(left.transitionId, right.transitionId) : precedenceDifference;
+}
+function assertMatchingCheckoutBinding(intent, checkoutHash) {
   economyAssert(
-    entry.entryKind === "economic" || entry.entryKind === "workflow",
+    intent.providerCheckoutReferenceHash === void 0 || intent.providerCheckoutReferenceHash === checkoutHash,
     "INVALID_CONTRACT",
-    "Wallet activity has an unsupported entry kind"
+    "Purchase-intent transition conflicts with its checkout binding"
   );
-  if (entry.entryKind === "economic") {
-    assertEconomyIdentifier(entry.transactionId, "transactionId");
+}
+function projectPurchaseIntent(initialIntent, transitions, pack) {
+  assertPurchaseIntentBinding(initialIntent, pack);
+  economyAssert(
+    initialIntent.status === "created" && initialIntent.providerCheckoutReferenceHash === void 0,
+    "INVALID_CONTRACT",
+    "Purchase-intent lifecycle requires immutable created intent facts"
+  );
+  const createdAt = parseIsoTimestamp(initialIntent.createdAt);
+  const expiresAt = parseIsoTimestamp(initialIntent.expiresAt);
+  let intent = initialIntent;
+  let disputeDisposition = "none";
+  let creditTransitionId;
+  const effectiveTransitionIds = [];
+  for (const transition of [...transitions].sort(compareTransitions2)) {
+    assertPurchaseIntentTransition(transition);
     economyAssert(
-      entry.status === "held" || entry.status === "settled" || entry.status === "reversed",
+      transition.intentId === initialIntent.intentId,
       "INVALID_CONTRACT",
-      "Economic activity cannot use a workflow status"
+      "Purchase-intent transition belongs to another intent"
     );
-  } else {
-    assertEconomyIdentifier(entry.commandId, "commandId");
+    const eventTime = parseIsoTimestamp(transition.occurredAt);
     economyAssert(
-      entry.status === "pending" || entry.status === "failed",
-      "INVALID_CONTRACT",
-      "Workflow activity cannot use an economic status"
+      eventTime >= createdAt,
+      "INVALID_TIME_WINDOW",
+      "Purchase-intent transition cannot precede intent creation"
     );
+    let effective = false;
+    if (transition.transitionType === "checkout-bound") {
+      const checkoutHash = transition.providerCheckoutReferenceHash;
+      assertMatchingCheckoutBinding(intent, checkoutHash);
+      if (intent.status === "created") {
+        economyAssert(
+          eventTime < expiresAt,
+          "INVALID_TIME_WINDOW",
+          "Checkout cannot be bound after purchase-intent expiry"
+        );
+        intent = {
+          ...intent,
+          status: "checkout-created",
+          providerCheckoutReferenceHash: checkoutHash
+        };
+        effective = true;
+      } else {
+        economyAssert(
+          !["expired", "cancelled"].includes(intent.status),
+          "INVALID_CONTRACT",
+          "A terminal purchase intent cannot bind a checkout"
+        );
+      }
+    } else if (transition.transitionType === "payment-observed") {
+      const checkoutHash = transition.providerCheckoutReferenceHash;
+      assertMatchingCheckoutBinding(intent, checkoutHash);
+      economyAssert(
+        eventTime < expiresAt,
+        "INVALID_TIME_WINDOW",
+        "Authoritative payment time must precede purchase-intent expiry"
+      );
+      if (intent.status === "created") {
+        intent = {
+          ...intent,
+          status: "paid-unreconciled",
+          providerCheckoutReferenceHash: checkoutHash
+        };
+        effective = true;
+      } else if (intent.status === "checkout-created") {
+        intent = { ...intent, status: "paid-unreconciled" };
+        effective = true;
+      } else {
+        economyAssert(
+          !["expired", "cancelled"].includes(intent.status),
+          "INVALID_CONTRACT",
+          "A terminal purchase intent cannot observe payment"
+        );
+      }
+    } else if (transition.transitionType === "credit-recorded") {
+      if (intent.status === "paid-unreconciled") {
+        intent = { ...intent, status: "credited" };
+        disputeDisposition = "none";
+        creditTransitionId = transition.transitionId;
+        effective = true;
+      } else {
+        economyAssert(
+          intent.status === "credited" || intent.status === "disputed",
+          "INVALID_CONTRACT",
+          "Purchase intent cannot be credited before authoritative payment"
+        );
+      }
+    } else if (transition.transitionType === "dispute-opened") {
+      if (intent.status === "credited" && disputeDisposition === "none") {
+        intent = { ...intent, status: "disputed" };
+        disputeDisposition = "open";
+        effective = true;
+      } else {
+        economyAssert(
+          intent.status === "disputed" && disputeDisposition === "open",
+          "INVALID_CONTRACT",
+          "Dispute can open only once after purchase credit"
+        );
+      }
+    } else if (transition.transitionType === "dispute-won") {
+      if (intent.status === "disputed" && disputeDisposition === "open") {
+        intent = { ...intent, status: "credited" };
+        disputeDisposition = "won";
+        effective = true;
+      } else {
+        economyAssert(
+          intent.status === "credited" && disputeDisposition === "won",
+          "INVALID_CONTRACT",
+          "Dispute-win transition requires one open dispute"
+        );
+      }
+    } else if (transition.transitionType === "dispute-lost") {
+      if (intent.status === "disputed" && disputeDisposition === "open") {
+        disputeDisposition = "lost";
+        effective = true;
+      } else {
+        economyAssert(
+          intent.status === "disputed" && disputeDisposition === "lost",
+          "INVALID_CONTRACT",
+          "Dispute-loss transition requires one open dispute"
+        );
+      }
+    } else if (transition.transitionType === "cancel") {
+      if (intent.status === "created" || intent.status === "checkout-created") {
+        intent = { ...intent, status: "cancelled" };
+        effective = true;
+      }
+    } else {
+      economyAssert(
+        eventTime >= expiresAt,
+        "INVALID_TIME_WINDOW",
+        "Expiry transition cannot precede purchase-intent expiry"
+      );
+      if (intent.status === "created" || intent.status === "checkout-created") {
+        intent = { ...intent, status: "expired" };
+        effective = true;
+      }
+    }
+    if (effective) {
+      effectiveTransitionIds.push(transition.transitionId);
+    }
   }
+  return {
+    intent,
+    disputeDisposition,
+    effectiveTransitionIds,
+    ...creditTransitionId === void 0 ? {} : { creditTransitionId }
+  };
 }
-function assertWalletActivityPageRequest(request) {
+function assertPurchaseIntentLifecycle(lifecycle, pack) {
   economyAssert(
-    Number.isSafeInteger(request.limit) && request.limit >= 1 && request.limit <= 100,
+    lifecycle.schemaVersion === ECONOMY_CONTRACT_VERSION,
     "INVALID_CONTRACT",
-    "Activity page limit must be between one and 100"
+    "Unsupported purchase-intent lifecycle contract version"
   );
-  if (request.cursor !== void 0) {
-    assertOpaqueCursor(request.cursor);
-  }
-  const filter = request.filter;
-  if (filter === void 0) {
-    return;
-  }
-  if (filter.activityTypes !== void 0) {
-    assertUniqueValues(filter.activityTypes, ACTIVITY_TYPES2, "Activity types");
-  }
-  if (filter.statuses !== void 0) {
-    assertUniqueValues(filter.statuses, ACTIVITY_STATUSES2, "Activity statuses");
-  }
-  if (filter.sources !== void 0) {
-    assertUniqueValues(filter.sources, ACTIVITY_SOURCES2, "Activity sources");
-  }
-  if (filter.beneficiaryAccountId !== void 0) {
-    assertEconomyIdentifier(
-      filter.beneficiaryAccountId,
-      "beneficiaryAccountId"
+  economyAssert(
+    Number.isSafeInteger(lifecycle.version) && lifecycle.version === lifecycle.receipts.length + 1,
+    "INVALID_CONTRACT",
+    "Purchase-intent lifecycle version must match its receipt count"
+  );
+  const transitionIds = /* @__PURE__ */ new Set();
+  for (const receipt of lifecycle.receipts) {
+    economyAssert(
+      receipt.schemaVersion === ECONOMY_CONTRACT_VERSION,
+      "INVALID_CONTRACT",
+      "Purchase-intent receipt is invalid"
+    );
+    assertPurchaseIntentTransition(receipt.transition);
+    economyAssert(
+      receipt.transition.intentId === lifecycle.initialIntent.intentId && !transitionIds.has(receipt.transition.transitionId),
+      "DUPLICATE_IDENTIFIER",
+      "Purchase-intent receipts must be unique and belong to the intent"
     );
+    transitionIds.add(receipt.transition.transitionId);
   }
-  const from = filter.fromInclusive === void 0 ? void 0 : parseIsoTimestamp(filter.fromInclusive);
-  const to = filter.toExclusive === void 0 ? void 0 : parseIsoTimestamp(filter.toExclusive);
-  economyAssert(
-    from === void 0 || to === void 0 || from < to,
-    "INVALID_TIME_WINDOW",
-    "Activity filter start must precede its exclusive end"
+  const projection = projectPurchaseIntent(
+    lifecycle.initialIntent,
+    lifecycle.receipts.map((receipt) => receipt.transition),
+    pack
   );
-}
-function assertWalletActivityPage(page) {
   economyAssert(
-    page.schemaVersion === ECONOMY_CONTRACT_VERSION && typeof page.hasMore === "boolean",
+    sameIntent(projection.intent, lifecycle.intent) && lifecycle.creditRecorded === (projection.intent.status === "credited" || projection.intent.status === "disputed") && lifecycle.disputeDisposition === projection.disputeDisposition && lifecycle.effectiveTransitionIds.length === projection.effectiveTransitionIds.length && lifecycle.effectiveTransitionIds.every(
+      (transitionId, index) => transitionId === projection.effectiveTransitionIds[index]
+    ),
     "INVALID_CONTRACT",
-    "Unsupported wallet-activity-page contract"
+    "Purchase-intent lifecycle does not match its immutable event rebuild"
   );
-  economyAssert(
-    page.hasMore === (page.nextCursor !== void 0),
-    "INVALID_CONTRACT",
-    "Activity page cursor must be present exactly when more rows exist"
+}
+function createPurchaseIntentLifecycle(initialIntent, pack) {
+  const projection = projectPurchaseIntent(initialIntent, [], pack);
+  return {
+    schemaVersion: ECONOMY_CONTRACT_VERSION,
+    initialIntent,
+    intent: projection.intent,
+    version: 1,
+    creditRecorded: false,
+    disputeDisposition: projection.disputeDisposition,
+    receipts: [],
+    effectiveTransitionIds: []
+  };
+}
+function sameProjection(lifecycle, projection) {
+  return sameIntent(lifecycle.intent, projection.intent) && lifecycle.disputeDisposition === projection.disputeDisposition && lifecycle.effectiveTransitionIds.length === projection.effectiveTransitionIds.length && lifecycle.effectiveTransitionIds.every(
+    (transitionId, index) => transitionId === projection.effectiveTransitionIds[index]
   );
+}
+function applyPurchaseIntentTransition(lifecycle, transition, expectedVersion, pack) {
+  assertPurchaseIntentLifecycle(lifecycle, pack);
+  assertPurchaseIntentTransition(transition);
   economyAssert(
-    page.entries.length <= 100 && (!page.hasMore || page.entries.length > 0),
+    transition.intentId === lifecycle.initialIntent.intentId,
     "INVALID_CONTRACT",
-    "Activity pages are bounded and cannot advertise more rows from an empty page"
+    "Purchase-intent transition belongs to another intent"
   );
-  if (page.nextCursor !== void 0) {
-    assertOpaqueCursor(page.nextCursor);
-  }
-  const activityIds = /* @__PURE__ */ new Set();
-  let previous;
-  for (const entry of page.entries) {
-    assertWalletActivityEntry(entry);
+  const replay = lifecycle.receipts.find(
+    (receipt) => receipt.transition.transitionId === transition.transitionId
+  );
+  if (replay !== void 0) {
     economyAssert(
-      !activityIds.has(entry.activityId),
+      sameTransition2(replay.transition, transition),
       "DUPLICATE_IDENTIFIER",
-      "Activity page cannot repeat an activity ID"
+      "Purchase-intent transition ID was reused with different facts"
     );
-    activityIds.add(entry.activityId);
-    if (previous !== void 0) {
-      const previousTime = parseIsoTimestamp(previous.occurredAt);
-      const currentTime = parseIsoTimestamp(entry.occurredAt);
+    return { lifecycle, recorded: false, stateChanged: false };
+  }
+  economyAssert(
+    expectedVersion === lifecycle.version,
+    "INVALID_CONTRACT",
+    "Purchase-intent transition has a stale expected version"
+  );
+  const receipts = [
+    ...lifecycle.receipts,
+    { schemaVersion: ECONOMY_CONTRACT_VERSION, transition }
+  ];
+  const projection = projectPurchaseIntent(
+    lifecycle.initialIntent,
+    receipts.map((receipt) => receipt.transition),
+    pack
+  );
+  const stateChanged = !sameProjection(lifecycle, projection);
+  const nextLifecycle = {
+    schemaVersion: ECONOMY_CONTRACT_VERSION,
+    initialIntent: lifecycle.initialIntent,
+    intent: projection.intent,
+    version: lifecycle.version + 1,
+    creditRecorded: projection.intent.status === "credited" || projection.intent.status === "disputed",
+    disputeDisposition: projection.disputeDisposition,
+    receipts,
+    effectiveTransitionIds: projection.effectiveTransitionIds
+  };
+  assertPurchaseIntentLifecycle(nextLifecycle, pack);
+  const producesCredit = projection.creditTransitionId === transition.transitionId && !lifecycle.creditRecorded && nextLifecycle.creditRecorded;
+  const creditInstruction = producesCredit ? {
+    schemaVersion: ECONOMY_CONTRACT_VERSION,
+    intentId: nextLifecycle.intent.intentId,
+    transitionId: transition.transitionId,
+    idempotencyKey: nextLifecycle.intent.intentId
+  } : void 0;
+  return {
+    lifecycle: nextLifecycle,
+    recorded: true,
+    stateChanged,
+    ...creditInstruction === void 0 ? {} : { creditInstruction }
+  };
+}
+function reducePurchaseIntentTransitions(initialIntent, transitions, pack) {
+  const unique = /* @__PURE__ */ new Map();
+  for (const transition of transitions) {
+    assertPurchaseIntentTransition(transition);
+    const existing = unique.get(transition.transitionId);
+    if (existing !== void 0) {
       economyAssert(
-        previousTime > currentTime || previousTime === currentTime && previous.activityId.localeCompare(entry.activityId) > 0,
-        "INVALID_CONTRACT",
-        "Activity page must use stable descending time and ID order"
+        sameTransition2(existing, transition),
+        "DUPLICATE_IDENTIFIER",
+        "Purchase-intent transition ID was reused with different facts"
       );
+    } else {
+      unique.set(transition.transitionId, transition);
+    }
+  }
+  let lifecycle = createPurchaseIntentLifecycle(initialIntent, pack);
+  const creditInstructions = [];
+  for (const transition of [...unique.values()].sort(compareTransitions2)) {
+    const result = applyPurchaseIntentTransition(
+      lifecycle,
+      transition,
+      lifecycle.version,
+      pack
+    );
+    lifecycle = result.lifecycle;
+    if (result.creditInstruction !== void 0) {
+      creditInstructions.push(result.creditInstruction);
     }
-    previous = entry;
   }
-}
-function assertWalletActivityPageForPortfolio(page, scope) {
-  assertWalletActivityPage(page);
-  assertWalletPortfolioReadScope(scope);
-  const walletIds = new Set(scope.components.map((item) => item.walletId));
   economyAssert(
-    page.entries.every((entry) => walletIds.has(entry.walletId)),
-    "INVALID_CONTRACT",
-    "Portfolio activity contains a wallet outside its authorized read scope"
+    creditInstructions.length <= 1,
+    "DUPLICATE_TRANSACTION",
+    "Purchase-intent reduction produced more than one credit"
   );
+  return { lifecycle, creditInstructions };
 }
 
 // src/recurrence.ts
@@ -2791,11 +4774,14 @@ export {
   EARLY_BACKER_SETTLEMENT_POLICY_V2,
   ECONOMY_CONTRACT_VERSION,
   EconomyError,
+  MODULE_ALLOWANCE_PURPOSE,
   PRE_UTILITY_BACKER_COHORT,
   TOKEN_SUBUNITS_MAX,
   TOKEN_SUBUNITS_MIN,
   TOKEN_SUBUNITS_PER_TOKEN,
   advanceJournalChainHead,
+  applyPaidLotLifecycleEvent,
+  applyPurchaseIntentTransition,
   applySourceLotMovement,
   applyTransactionToProjection,
   applyWalletBalanceDelta,
@@ -2813,13 +4799,26 @@ export {
   assertFxSnapshot,
   assertGameplayAllocation,
   assertJournalChainHead,
+  assertModuleAllowance,
+  assertModulePurchaseReceipt,
+  assertModulePurchaseReconciliationObservation,
+  assertModuleSpendHold,
+  assertModuleSpendQuote,
   assertNonNegativeAccounts,
   assertOpenPurchaseIntent,
+  assertPaidLotLifecycle,
+  assertPaidLotLifecycleEvent,
+  assertPaidLotPurchaseProvenance,
+  assertPurchaseCapReservation,
+  assertPurchaseCapReservationTransition,
   assertPurchaseIntentBinding,
+  assertPurchaseIntentLifecycle,
+  assertPurchaseIntentTransition,
   assertPurchaseLimitPolicy,
   assertReversalAvailable,
   assertRewardConversion,
   assertRewardRate,
+  assertRollingPurchaseCapState,
   assertScopedPersistedIdempotencyResult,
   assertSourceLot,
   assertSourceLotMovement,
@@ -2845,13 +4844,23 @@ export {
   assertWalletPortfolioSummary,
   availableSourceLotAmount,
   boostGameplayAllocation,
+  calculateRollingPurchaseCapUsage,
   canUseSourceLot,
   canonicalTransactionPayload,
+  closeModuleAllowance,
   convertRewardPayout,
+  createEarlyBackerRetentionFromPaidLot,
   createGameplayAllocation,
   createInitialSourceLotSnapshot,
+  createModuleAllowance,
+  createModulePurchaseReceipt,
+  createModuleSpendHold,
+  createModuleSpendQuote,
+  createPaidLotLifecycle,
   createProjectionSnapshot,
+  createPurchaseIntentLifecycle,
   createReversalTransaction,
+  createRollingPurchaseCapState,
   createWalletBalanceSummary,
   createWalletPortfolioLifetime,
   createWalletPortfolioSummary,
@@ -2860,18 +4869,29 @@ export {
   economyAssert,
   evaluateEarlyBacker,
   evaluateEarlyBackerBySettlementV2,
+  fundModuleAllowance,
   isWholeTokenAmount,
   mapBitLabsConversionState,
+  parseGbpMinorUnits,
   parseIsoTimestamp,
   parseTokenSubunits,
   rebuildBalanceProjection,
   reclaimGameplayAllocation,
+  reclaimModuleAllowance,
+  reconcileModulePurchase,
+  reducePaidLotLifecycleEvents,
+  reducePurchaseIntentTransitions,
+  releaseModuleSpendHold,
+  reserveRollingPurchaseCaps,
   selectSourceLots,
+  serializeGbpMinorUnits,
   serializeTokenSubunits,
+  settleModuleSpendHold,
   sortStringRecord,
   subunitsToWholeTokens,
   sumTokenSubunits,
   toEconomyErrorEnvelope,
+  transitionRollingPurchaseCapReservation,
   wholeTokensToSubunits
 };
 //# sourceMappingURL=index.js.map