@trazum/core 1.65.0 → 1.66.0

package/dist/position.d.ts

@@ -0,0 +1,74 @@
+/**
+ * The measured side of the limits policy: what a usage log says each scope
+ * has already spent.
+ *
+ * `judgeLimits` judges; this measures. The split is the product's oldest
+ * rule — the judging function must be pure and instant, so whatever reads
+ * and prices records happens once, here, and the doors keep the result.
+ *
+ * **Absence is `null`, never zero.** A log with no clock cannot say what
+ * today has cost; a log that records no sessions cannot say what a session
+ * has spent. Both come back `null`, and `judgeLimits` turns a `null` into
+ * `cannot-tell` rather than an approval. The one deliberate asymmetry: a log
+ * that *does* record sessions and has never seen this one answers `0` — the
+ * history of a conversation that has not started is complete and empty,
+ * which is a measurement, not an absence.
+ *
+ * **Session keys never leave this module.** The index groups by them — that
+ * is the whole job — but the map lives in door memory, `positionAt` returns
+ * only dollar figures, and nothing here is serialised. The guarantee the
+ * usage module states (a session key is somebody's conversation and is never
+ * printed) holds through this door too.
+ */
+import type { UsageRecord } from './usage.js';
+import type { PricingCatalogue } from './pricing.js';
+import type { MeasuredPosition } from './judgement.js';
+/**
+ * Everything a door needs to answer `positionAt` in constant time, built
+ * once from the log it was pointed at.
+ */
+export interface MeasuredIndex {
+    /** Spend inside the current UTC day. Null when no record carries a clock. */
+    dayUsd: number | null;
+    /** The UTC day the figure covers. Null exactly when `dayUsd` is. */
+    dayWindow: {
+        fromMs: number;
+        toMs: number;
+    } | null;
+    /** Whether any record carried a label / a session at all. */
+    labelsSeen: boolean;
+    sessionsSeen: boolean;
+    /** Priced spend per label. Keys are labels, which do print. */
+    labels: ReadonlyMap<string, number>;
+    /** Priced spend per session. Keys are session identifiers — never printed. */
+    sessions: ReadonlyMap<string, number>;
+    /** Whether the log held any records at all. */
+    any: boolean;
+    /** Records whose model the catalogue cannot price — money nobody can see. */
+    unpriced: number;
+}
+/**
+ * Prices and groups a parsed usage log, once.
+ *
+ * An unpriced record contributes nothing to any figure and is **counted**
+ * instead of dropped silently: a door that reports "measured $3" over a log
+ * with a thousand unpriced records is wrong by an amount nobody can see, in
+ * the flattering direction, and `unpriced` is how the door says so.
+ */
+export declare function indexUsage(records: readonly UsageRecord[], options: {
+    catalogue: PricingCatalogue;
+    on?: Date;
+}): MeasuredIndex;
+/**
+ * The measured position for one proposed call, from an index built once.
+ *
+ * A scope the log cannot see is `null`; a scope it can see and has nothing
+ * recorded for is `0`. The difference is the difference between "unknown"
+ * and "a conversation that has not started yet", and collapsing them is how
+ * a dead log approves a live spend.
+ */
+export declare function positionAt(index: MeasuredIndex, call: {
+    label?: string;
+    session?: string;
+}): MeasuredPosition;
+//# sourceMappingURL=position.d.ts.map

package/dist/position.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"position.d.ts","sourceRoot":"","sources":["../src/position.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAIvD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,6EAA6E;IAC7E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,oEAAoE;IACpE,SAAS,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACnD,6DAA6D;IAC7D,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,+DAA+D;IAC/D,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,8EAA8E;IAC9E,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,+CAA+C;IAC/C,GAAG,EAAE,OAAO,CAAC;IACb,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,SAAS,WAAW,EAAE,EAC/B,OAAO,EAAE;IAAE,SAAS,EAAE,gBAAgB,CAAC;IAAC,EAAE,CAAC,EAAE,IAAI,CAAA;CAAE,GAClD,aAAa,CAsCf;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,aAAa,EACpB,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GACzC,gBAAgB,CAWlB"}

package/dist/position.js

@@ -0,0 +1,93 @@
+/**
+ * The measured side of the limits policy: what a usage log says each scope
+ * has already spent.
+ *
+ * `judgeLimits` judges; this measures. The split is the product's oldest
+ * rule — the judging function must be pure and instant, so whatever reads
+ * and prices records happens once, here, and the doors keep the result.
+ *
+ * **Absence is `null`, never zero.** A log with no clock cannot say what
+ * today has cost; a log that records no sessions cannot say what a session
+ * has spent. Both come back `null`, and `judgeLimits` turns a `null` into
+ * `cannot-tell` rather than an approval. The one deliberate asymmetry: a log
+ * that *does* record sessions and has never seen this one answers `0` — the
+ * history of a conversation that has not started is complete and empty,
+ * which is a measurement, not an absence.
+ *
+ * **Session keys never leave this module.** The index groups by them — that
+ * is the whole job — but the map lives in door memory, `positionAt` returns
+ * only dollar figures, and nothing here is serialised. The guarantee the
+ * usage module states (a session key is somebody's conversation and is never
+ * printed) holds through this door too.
+ */
+import { costOf } from './session-cost.js';
+const DAY_MS = 24 * 60 * 60 * 1000;
+/**
+ * Prices and groups a parsed usage log, once.
+ *
+ * An unpriced record contributes nothing to any figure and is **counted**
+ * instead of dropped silently: a door that reports "measured $3" over a log
+ * with a thousand unpriced records is wrong by an amount nobody can see, in
+ * the flattering direction, and `unpriced` is how the door says so.
+ */
+export function indexUsage(records, options) {
+    const { catalogue, on = new Date() } = options;
+    const dayFromMs = Math.floor(on.getTime() / DAY_MS) * DAY_MS;
+    const dayToMs = dayFromMs + DAY_MS;
+    const labels = new Map();
+    const sessions = new Map();
+    let labelsSeen = false;
+    let sessionsSeen = false;
+    let clocksSeen = false;
+    let dayUsd = 0;
+    let unpriced = 0;
+    for (const record of records) {
+        if (record.label !== null)
+            labelsSeen = true;
+        if (record.session !== null)
+            sessionsSeen = true;
+        if (record.ts !== null)
+            clocksSeen = true;
+        const usd = costOf(record, catalogue, on);
+        if (usd === null) {
+            unpriced += 1;
+            continue;
+        }
+        if (record.label !== null)
+            labels.set(record.label, (labels.get(record.label) ?? 0) + usd);
+        if (record.session !== null)
+            sessions.set(record.session, (sessions.get(record.session) ?? 0) + usd);
+        if (record.ts !== null && record.ts >= dayFromMs && record.ts < dayToMs)
+            dayUsd += usd;
+    }
+    return {
+        dayUsd: clocksSeen ? dayUsd : null,
+        dayWindow: clocksSeen ? { fromMs: dayFromMs, toMs: dayToMs } : null,
+        labelsSeen,
+        sessionsSeen,
+        labels,
+        sessions,
+        any: records.length > 0,
+        unpriced,
+    };
+}
+/**
+ * The measured position for one proposed call, from an index built once.
+ *
+ * A scope the log cannot see is `null`; a scope it can see and has nothing
+ * recorded for is `0`. The difference is the difference between "unknown"
+ * and "a conversation that has not started yet", and collapsing them is how
+ * a dead log approves a live spend.
+ */
+export function positionAt(index, call) {
+    if (!index.any) {
+        return { dayUsd: null, sessionUsd: null, labelUsd: null };
+    }
+    return {
+        dayUsd: index.dayUsd,
+        dayWindow: index.dayWindow,
+        sessionUsd: call.session !== undefined && index.sessionsSeen ? (index.sessions.get(call.session) ?? 0) : null,
+        labelUsd: call.label !== undefined && index.labelsSeen ? (index.labels.get(call.label) ?? 0) : null,
+    };
+}
+//# sourceMappingURL=position.js.map

package/dist/position.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"position.js","sourceRoot":"","sources":["../src/position.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAK3C,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAwBnC;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CACxB,OAA+B,EAC/B,OAAmD;IAEnD,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,CAAC;IAC7D,MAAM,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IAEnC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI;YAAE,UAAU,GAAG,IAAI,CAAC;QAC7C,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;YAAE,YAAY,GAAG,IAAI,CAAC;QACjD,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI;YAAE,UAAU,GAAG,IAAI,CAAC;QAE1C,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,QAAQ,IAAI,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QAC3F,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;YAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QACrG,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,IAAI,MAAM,CAAC,EAAE,IAAI,SAAS,IAAI,MAAM,CAAC,EAAE,GAAG,OAAO;YAAE,MAAM,IAAI,GAAG,CAAC;IACzF,CAAC;IAED,OAAO;QACL,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QAClC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;QACnE,UAAU;QACV,YAAY;QACZ,MAAM;QACN,QAAQ;QACR,GAAG,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC;QACvB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CACxB,KAAoB,EACpB,IAA0C;IAE1C,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EACR,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;QACnG,QAAQ,EAAE,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;KACpG,CAAC;AACJ,CAAC"}

package/dist/session-cost.d.ts

@@ -64,6 +64,8 @@ export interface SessionCostTracker {
     add(record: UsageRecord): void;
     finish(): SessionCostShape[];
 }
+/** Every billed dollar of one call, at its own model's rates. */
+export declare function costOf(record: UsageRecord, catalogue: PricingCatalogue, on: Date): number | null;
 export declare function createSessionCostTracker(options: SessionCostOptions): SessionCostTracker;
 /** The same measurement over a list, for a caller holding one already. */
 export declare function sessionCostShapes(records: readonly UsageRecord[], options: SessionCostOptions): SessionCostShape[];

package/dist/session-cost.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-cost.d.ts","sourceRoot":"","sources":["../src/session-cost.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,EAAE,CAAC,EAAE,IAAI,CAAC;IACV;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/B,MAAM,IAAI,gBAAgB,EAAE,CAAC;CAC9B;AAgCD,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,kBAAkB,GAAG,kBAAkB,CAwDxF;AAED,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,SAAS,WAAW,EAAE,EAC/B,OAAO,EAAE,kBAAkB,GAC1B,gBAAgB,EAAE,CAIpB"}
+{"version":3,"file":"session-cost.d.ts","sourceRoot":"","sources":["../src/session-cost.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,EAAE,CAAC,EAAE,IAAI,CAAC;IACV;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/B,MAAM,IAAI,gBAAgB,EAAE,CAAC;CAC9B;AAED,iEAAiE;AACjE,wBAAgB,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,gBAAgB,EAAE,EAAE,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAahG;AAgBD,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,kBAAkB,GAAG,kBAAkB,CAwDxF;AAED,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,SAAS,WAAW,EAAE,EAC/B,OAAO,EAAE,kBAAkB,GAC1B,gBAAgB,EAAE,CAIpB"}

package/dist/session-cost.js

@@ -1,7 +1,7 @@
 import { effectivePricing, multipliersFor } from './pricing.js';
 import { UNLABELLED } from './usage.js';
 /** Every billed dollar of one call, at its own model's rates. */
-function costOf(record, catalogue, on) {
+export function costOf(record, catalogue, on) {
     const model = catalogue.byId.get(record.model);
     if (!model)
         return null;

package/dist/session-cost.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-cost.js","sourceRoot":"","sources":["../src/session-cost.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAwExC,iEAAiE;AACjE,SAAS,MAAM,CAAC,MAAmB,EAAE,SAA2B,EAAE,EAAQ;IACxE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,gBAAgB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,IAAY,EAAU,EAAE,CAAC,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC;IAClF,OAAO,CACL,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC;QAC3D,GAAG,CAAC,MAAM,CAAC,kBAAkB,EAAE,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,kBAAkB,EAAE,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,aAAa,CAAC,CACxC,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,MAAgB,EAAU,EAAE;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAE,GAAG,MAAM,CAAC,GAAG,CAAE,CAAC,GAAG,CAAC,CAAC;AACxF,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,GAAG,GAAG,CAAC,MAAgB,EAAU,EAAE,CACvC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;AAE5E,MAAM,UAAU,wBAAwB,CAAC,OAA2B;IAClE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,IAAI,EAAE,EAAE,WAAW,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC;IAChE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuD,CAAC;IAE9E,MAAM,GAAG,GAAG,CAAC,MAAmB,EAAQ,EAAE;QACxC,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC3C,iEAAiE;QACjE,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO;QAE1B,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,KAAK,IAAI,UAAU,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;QAClE,IAAI,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,IAAI,IAAI,CAAC;YACrB,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,GAAuB,EAAE;QACtC,MAAM,GAAG,GAAuB,EAAE,CAAC;QAEnC,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC;YAC1C,IAAI,QAAQ,CAAC,IAAI,GAAG,WAAW;gBAAE,SAAS;YAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,CAAC,KAAK;gBAAE,SAAS;YAErB,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7E,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/E,GAAG,CAAC,IAAI,CAAC;gBACP,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;gBAC/B,KAAK,EAAE,OAAO;gBACd,SAAS,EAAE,KAAK,CAAC,WAAW;gBAC5B,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC3C,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC9C,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC;gBACxB,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC;gBAClB,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE;gBAChC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC;aAC3B,CAAC,CAAC;QACL,CAAC;QAED,0DAA0D;QAC1D,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACvF,CAAC,CAAC;IAEF,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACzB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,iBAAiB,CAC/B,OAA+B,EAC/B,OAA2B;IAE3B,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClD,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,OAAO,CAAC,MAAM,EAAE,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"session-cost.js","sourceRoot":"","sources":["../src/session-cost.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAwExC,iEAAiE;AACjE,MAAM,UAAU,MAAM,CAAC,MAAmB,EAAE,SAA2B,EAAE,EAAQ;IAC/E,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,gBAAgB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,IAAY,EAAU,EAAE,CAAC,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC;IAClF,OAAO,CACL,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC;QAC3D,GAAG,CAAC,MAAM,CAAC,kBAAkB,EAAE,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,kBAAkB,EAAE,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,aAAa,CAAC,CACxC,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,MAAgB,EAAU,EAAE;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAE,GAAG,MAAM,CAAC,GAAG,CAAE,CAAC,GAAG,CAAC,CAAC;AACxF,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,GAAG,GAAG,CAAC,MAAgB,EAAU,EAAE,CACvC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;AAE5E,MAAM,UAAU,wBAAwB,CAAC,OAA2B;IAClE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,IAAI,EAAE,EAAE,WAAW,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC;IAChE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuD,CAAC;IAE9E,MAAM,GAAG,GAAG,CAAC,MAAmB,EAAQ,EAAE;QACxC,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC3C,iEAAiE;QACjE,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO;QAE1B,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,KAAK,IAAI,UAAU,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;QAClE,IAAI,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,IAAI,IAAI,CAAC;YACrB,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,GAAuB,EAAE;QACtC,MAAM,GAAG,GAAuB,EAAE,CAAC;QAEnC,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC;YAC1C,IAAI,QAAQ,CAAC,IAAI,GAAG,WAAW;gBAAE,SAAS;YAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,CAAC,KAAK;gBAAE,SAAS;YAErB,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7E,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/E,GAAG,CAAC,IAAI,CAAC;gBACP,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;gBAC/B,KAAK,EAAE,OAAO;gBACd,SAAS,EAAE,KAAK,CAAC,WAAW;gBAC5B,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC3C,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC9C,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC;gBACxB,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC;gBAClB,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE;gBAChC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC;aAC3B,CAAC,CAAC;QACL,CAAC;QAED,0DAA0D;QAC1D,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACvF,CAAC,CAAC;IAEF,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACzB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,iBAAiB,CAC/B,OAA+B,EAC/B,OAA2B;IAE3B,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClD,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,OAAO,CAAC,MAAM,EAAE,CAAC;AAC1B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trazum/core",
-  "version": "1.65.0",
+  "version": "1.66.0",
   "description": "Trazum core: priced advisories for LLM prompts (caching, model tier, batching, schemas), plus deterministic trimming, token counting and pricing.",
   "license": "MIT",
   "author": "David Mu\u00f1oz Rey",

package/src/config-schema.ts

@@ -137,6 +137,34 @@ export interface SpendConfig {
   substitute?: Record<string, { to: string; reason: string }>;
 }
 
+/**
+ * The enforcement policy: USD ceilings judged at call time, at whichever door
+ * the call arrives — the gateway's 402, `serve`'s cost answer, `spend_guard`
+ * over MCP.
+ *
+ * A separate block from `spend`, and the separation is the point. `spend`
+ * gates *reports*: it is read after the fact, over a log or a store, and a
+ * crossing fails a check. This is read *before a call is made*, to refuse it.
+ * Same units, different moments — and the 1.62 arc's lesson is that two
+ * surfaces reading "the same" value from different slices of config is how
+ * they come to disagree about how much is left. One block, stated once,
+ * enforced identically at every door.
+ *
+ * Every ceiling is a **positive** dollar amount. `spend` accepts zero because
+ * a zero report-budget is a gate somebody can waive on the record; a zero
+ * enforcement ceiling is a door that refuses everything, which is an outage
+ * dressed as a policy — if the intent is "stop all calls", turning the door
+ * off is the honest spelling.
+ */
+export interface LimitsConfig {
+  /** Ceiling per UTC calendar day, in dollars, measured across the store. */
+  dayUsd?: number;
+  /** Ceiling per session — the unit an agent product actually blows up in. */
+  sessionUsd?: number;
+  /** Per-label ceilings, each judged against that label's own measured spend. */
+  byLabel?: Record<string, number>;
+}
+
 export interface TrazumConfig {
   level?: RuleLevel;
   locale?: Locale;
@@ -182,6 +210,7 @@ export interface TrazumConfig {
    */
   sources?: Record<string, string[]>;
   spend?: SpendConfig;
+  limits?: LimitsConfig;
   /**
    * Findings as policy: a gate failure the team has looked at and decided to
    * live with, on the record, for a bounded time.
@@ -298,6 +327,7 @@ export const CONFIG_KEYS = [
   'budgets',
   'labels',
   'spend',
+  'limits',
   'sources',
   'store',
   'waive',
@@ -315,6 +345,8 @@ export const CONFIG_BASELINE_KEYS = ['path', 'maxGrowthTokens', 'maxGrowthPct']
 
 export const CONFIG_SPEND_KEYS = ['maxUsd', 'monthlyUsd', 'maxDayUsd', 'maxSessionUsd', 'maxCacheLossUsd', 'byLabel', 'bySource', 'substitute'] as const;
 
+export const CONFIG_LIMITS_KEYS = ['dayUsd', 'sessionUsd', 'byLabel'] as const;
+
 export const CONFIG_WAIVE_KEYS = ['gate', 'reason', 'until'] as const;
 
 export const CONFIG_STORE_KEYS = ['keepDays'] as const;
@@ -590,6 +622,53 @@ function parseSpend(raw: unknown, source: string): SpendConfig {
   return spend;
 }
 
+/**
+ * Validates the `limits` block.
+ *
+ * Every ceiling must be a **positive** finite number of dollars — stricter
+ * than `spend`, deliberately. A report-budget of zero is a gate somebody can
+ * waive on the record; an enforcement ceiling of zero refuses every call at
+ * that door, which is an outage dressed as a policy, so the error says what
+ * to write instead. Unknown keys are named rather than ignored, because a
+ * misspelled ceiling is a policy that is never enforced while CI stays green.
+ */
+function requirePositiveUsd(value: unknown, label: string, source: string): number {
+  if (typeof value !== 'number' || !Number.isFinite(value) || value <= 0) {
+    throw new ConfigError(
+      `"${label}" must be a positive number of dollars. A ceiling of 0 would refuse every call at this door — if that is the intent, turn the door off rather than writing an outage as a policy.`,
+      source,
+    );
+  }
+  return value;
+}
+
+export function parseLimits(raw: unknown, source: string): LimitsConfig {
+  if (!isPlainObject(raw)) throw new ConfigError('"limits" must be an object', source);
+  rejectUnknownKeys(raw, CONFIG_LIMITS_KEYS, source, 'limits.');
+
+  const limits: LimitsConfig = {};
+  if (raw.dayUsd !== undefined) {
+    limits.dayUsd = requirePositiveUsd(raw.dayUsd, 'limits.dayUsd', source);
+  }
+  if (raw.sessionUsd !== undefined) {
+    limits.sessionUsd = requirePositiveUsd(raw.sessionUsd, 'limits.sessionUsd', source);
+  }
+  if (raw.byLabel !== undefined) {
+    if (!isPlainObject(raw.byLabel)) {
+      throw new ConfigError('"limits.byLabel" must be an object', source);
+    }
+    const byLabel: Record<string, number> = {};
+    for (const [label, value] of Object.entries(raw.byLabel)) {
+      if (label.trim().length === 0) {
+        throw new ConfigError('"limits.byLabel" has an empty label', source);
+      }
+      byLabel[label] = requirePositiveUsd(value, `limits.byLabel["${label}"]`, source);
+    }
+    limits.byLabel = byLabel;
+  }
+  return limits;
+}
+
 /**
  * Validates the `sources` block: named services, each a non-empty list of
  * glob patterns. Patterns are not checked against a filesystem here — a
@@ -869,7 +948,7 @@ function parseStore(raw: unknown, source: string): { keepDays?: number } {
   return out;
 }
 
-function parseWaive(raw: unknown, source: string): WaiveEntry[] {
+export function parseWaive(raw: unknown, source: string): WaiveEntry[] {
   if (!Array.isArray(raw)) throw new ConfigError('"waive" must be an array', source);
   return raw.map((entry, index) => {
     const at = `waive[${index}]`;
@@ -882,10 +961,16 @@ function parseWaive(raw: unknown, source: string): WaiveEntry[] {
     }
     const known =
       (WAIVABLE_GATES as readonly string[]).includes(gate) ||
-      (gate.startsWith('byLabel:') && gate.length > 'byLabel:'.length);
+      (gate.startsWith('byLabel:') && gate.length > 'byLabel:'.length) ||
+      // The limits policy's ceilings, waivable since the 1.66 arc: silencing
+      // a limit leaves a record, and the doors carry the waiver in every
+      // judgement rather than refusing. The forms mirror the config keys.
+      gate === 'limits.dayUsd' ||
+      gate === 'limits.sessionUsd' ||
+      (gate.startsWith('limits.byLabel:') && gate.length > 'limits.byLabel:'.length);
     if (!known) {
       throw new ConfigError(
-        `"${at}.gate" names no gate: "${gate}". Waivable: ${WAIVABLE_GATES.join(', ')}, or byLabel:<label>.`,
+        `"${at}.gate" names no gate: "${gate}". Waivable: ${WAIVABLE_GATES.join(', ')}, byLabel:<label>, limits.dayUsd, limits.sessionUsd, or limits.byLabel:<label>.`,
         source,
       );
     }
@@ -1056,6 +1141,7 @@ export function parseConfig(raw: string, source = CONFIG_FILENAME): TrazumConfig
   if (document.budgets !== undefined) config.budgets = parseBudgets(document.budgets, source);
   if (document.labels !== undefined) config.labels = parseLabels(document.labels, source);
   if (document.spend !== undefined) config.spend = parseSpend(document.spend, source);
+  if (document.limits !== undefined) config.limits = parseLimits(document.limits, source);
   if (document.sources !== undefined) config.sources = parseSources(document.sources, source);
   if (document.store !== undefined) config.store = parseStore(document.store, source);
   if (document.waive !== undefined) config.waive = parseWaive(document.waive, source);

package/src/gateway.ts

@@ -51,6 +51,9 @@ import type { PlanAssumption } from './plan.js';
 import { effectivePricing, multipliersFor } from './pricing.js';
 import type { PricingCatalogue } from './pricing.js';
 import type { ModelPricing } from './types.js';
+import { judgeLimits, limitSentence, unjudgedSentence } from './judgement.js';
+import type { MeasuredPosition, PolicyJudgement } from './judgement.js';
+import type { LimitsConfig, WaiveEntry } from './config-schema.js';
 
 /**
  * What the operator has decided happens when the gateway cannot judge.
@@ -80,6 +83,12 @@ export interface GatewayCall {
   maxOutputTokens: number | null;
   /** The workload, when the caller labelled it. */
   label: string | null;
+  /**
+   * The conversation, when the caller identified it — `metadata.trazum_session`,
+   * the same seam as the label. Used to judge the per-session ceiling and
+   * never recorded, printed, or forwarded anywhere by this module.
+   */
+  session: string | null;
 }
 
 /** Where the budget stands, as the gateway was told at the last refresh. */
@@ -97,10 +106,17 @@ export type RefuseReason =
   | 'budget-exhausted'
   /** This call would take it past, on an estimate of this call. */
   | 'call-would-cross'
+  /** A ceiling in the `limits` policy is over — the judgement names which. */
+  | 'limit-over'
   /** Cannot tell, and the operator chose fail-closed. */
   | 'cannot-tell-and-closed';
 
-export type CannotTellCause = 'no-budget' | 'nothing-measured' | 'model-unpriced';
+export type CannotTellCause =
+  | 'no-budget'
+  | 'nothing-measured'
+  | 'model-unpriced'
+  /** A ceiling in the `limits` policy could not be judged — see `policy`. */
+  | 'limit-unjudged';
 
 /** A cheaper way to make the same call, named on a refusal. */
 export interface GatewayAlternative {
@@ -124,6 +140,8 @@ export type GatewayDecision =
       estimatedUsd: number | null;
       /** Present when the gateway could not judge and the operator fails open. */
       unjudged: CannotTellCause | null;
+      /** The limits policy, judged for this call — same judge as every door. */
+      policy: PolicyJudgement;
     }
   | {
       kind: 'refuse';
@@ -137,6 +155,8 @@ export type GatewayDecision =
       /** A refusal never arrives bare. Dearest saving first; may be empty. */
       alternatives: GatewayAlternative[];
       because: string;
+      /** The limits policy, judged for this call — same judge as every door. */
+      policy: PolicyJudgement;
     }
   | {
       /**
@@ -154,6 +174,8 @@ export type GatewayDecision =
       configuredReason: string;
       estimatedUsd: number | null;
       markedInStore: true;
+      /** The limits policy, judged for this call — same judge as every door. */
+      policy: PolicyJudgement;
     };
 
 export interface GatewayPolicy {
@@ -172,6 +194,19 @@ export interface GatewayOptions {
   catalogue: PricingCatalogue;
   policy: GatewayPolicy;
   on?: Date;
+  /**
+   * The `limits` block and the measured position it is judged against —
+   * chapter three of the 1.66 arc. Both optional: a gateway with no limits
+   * config behaves exactly as before, and the judgement is `no-policy`.
+   *
+   * The judging is `judgeLimits`, verbatim — the same function `serve` and
+   * `spend_guard` call, which is the whole point: three doors, one judge,
+   * no door doing its own arithmetic.
+   */
+  limits?: LimitsConfig;
+  position?: MeasuredPosition;
+  /** The config's `waive` list — a silenced limit forwards, on the record. */
+  waivers?: readonly WaiveEntry[];
 }
 
 /** What this call costs at a model's rates, or null when it cannot be priced. */
@@ -258,6 +293,63 @@ export function gatewayDecision(
   const model = catalogue.byId.get(call.model);
   const estimatedUsd = priceCall(model, call, on);
 
+  /**
+   * The limits policy, judged first and by the shared judge — never by
+   * arithmetic of this module's own. An `over` here refuses regardless of
+   * where the monthly budget stands: a session ceiling exists precisely for
+   * the call that is fine by the month and ruinous by the conversation.
+   */
+  const judged = judgeLimits(
+    options.limits,
+    options.position ?? { dayUsd: null, sessionUsd: null, labelUsd: null },
+    {
+      model: call.model,
+      inputTokens: call.inputTokens ?? undefined,
+      outputTokens: call.maxOutputTokens ?? undefined,
+      label: call.label ?? undefined,
+      session: call.session ?? undefined,
+    },
+    { catalogue, on, ...(options.waivers === undefined ? {} : { waivers: options.waivers }) },
+  );
+
+  if (judged.verdict === 'over') {
+    // The unwaived crossing — a waived `over` is present in the judgement
+    // and deliberately not the one a refusal is written about.
+    const over = judged.judgements.find((entry) => entry.verdict === 'over' && entry.waived === null)!;
+    /*
+      A configured substitution is deliberately NOT consulted here. The
+      operator wrote that rule for the budget; rerouting a call because a
+      *session* ceiling crossed would spend more money in the very unit that
+      is over, under a rule written about something else.
+    */
+    return {
+      kind: 'refuse',
+      reason: 'limit-over',
+      cause: null,
+      restsOn: over.restsOn,
+      standing,
+      estimatedUsd,
+      alternatives: model === undefined ? [] : alternativesFor(model, call, catalogue, on),
+      because: limitSentence(over),
+      policy: judged,
+    };
+  }
+
+  const limitUnjudged = judged.verdict === 'cannot-tell' && judged.reason !== 'no-policy';
+  if (limitUnjudged && policy.onCannotTell === 'fail-closed') {
+    return {
+      kind: 'refuse',
+      reason: 'cannot-tell-and-closed',
+      cause: 'limit-unjudged',
+      restsOn: null,
+      standing,
+      estimatedUsd,
+      alternatives: [],
+      because: `${unjudgedSentence(judged)} This gateway is configured to fail closed.`,
+      policy: judged,
+    };
+  }
+
   const cause = whyCannotTell(standing, estimatedUsd);
   if (cause !== null) {
     /**
@@ -267,7 +359,7 @@ export function gatewayDecision(
      * nothing to do with the caller's request.
      */
     if (policy.onCannotTell === 'fail-open') {
-      return { kind: 'forward', estimatedUsd, unjudged: cause };
+      return { kind: 'forward', estimatedUsd, unjudged: cause, policy: judged };
     }
     return {
       kind: 'refuse',
@@ -278,6 +370,7 @@ export function gatewayDecision(
       estimatedUsd,
       alternatives: [],
       because: becauseCannotTell(cause),
+      policy: judged,
     };
   }
 
@@ -285,13 +378,21 @@ export function gatewayDecision(
   // it — narrowed here rather than asserted, so a change to `whyCannotTell`
   // that stopped guaranteeing them fails the build instead of the request.
   if (standing === null || estimatedUsd === null || model === undefined) {
-    return { kind: 'forward', estimatedUsd, unjudged: 'no-budget' };
+    return {
+      kind: 'forward',
+      estimatedUsd,
+      unjudged: limitUnjudged ? 'limit-unjudged' : 'no-budget',
+      policy: judged,
+    };
   }
 
   const already = standing.consumedUsd > standing.limitUsd;
   const wouldCross = standing.consumedUsd + estimatedUsd > standing.limitUsd;
   if (!already && !wouldCross) {
-    return { kind: 'forward', estimatedUsd, unjudged: null };
+    // The monthly budget holds. A limits ceiling nobody could judge still
+    // rides along as `unjudged` under fail-open, so the forward says what it
+    // did not check rather than implying everything was.
+    return { kind: 'forward', estimatedUsd, unjudged: limitUnjudged ? 'limit-unjudged' : null, policy: judged };
   }
 
   const configured = policy.substitute?.[call.model];
@@ -303,6 +404,7 @@ export function gatewayDecision(
       configuredReason: configured.reason,
       estimatedUsd: priceCall(target, call, on),
       markedInStore: true,
+      policy: judged,
     };
   }
 
@@ -319,9 +421,11 @@ export function gatewayDecision(
     because: already
       ? 'The budget for this period is already spent, measured.'
       : 'This call would take the budget past its limit, on an estimate of this call.',
+    policy: judged,
   };
 }
 
+
 function becauseCannotTell(cause: CannotTellCause): string {
   return cause === 'no-budget'
     ? 'No budget is configured, so there is nothing to judge this against, and this gateway is configured to fail closed.'