@usagekit/core 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,2 @@
+usagekit
+Copyright 2026 Michal.

package/dist/contracts.d.ts

@@ -0,0 +1,499 @@
+export type ValidationFailure = {
+    outcome: "invalid";
+    field: string;
+    reason: string;
+};
+/** Exact USD units: 1 unit = 1/10000 cent. */
+export type Money = {
+    units: bigint;
+    currency: "USD";
+};
+/** Amount = value * 10^-scale. Scale is a nonnegative integer. */
+export type Quantity = {
+    value: bigint;
+    scale: number;
+    unit: string;
+};
+export type AccessCredential = {
+    /** Host-defined kind, for example "api_key" | "personal_token" | "oauth_client" | "session". */
+    kind: string;
+    /** Stable identifier of that credential in the host. Never the secret. */
+    id: string;
+};
+/**
+ * Two separate identities: accessCredential authenticates the caller to the host and
+ * remains stable across provider rotation. providerCredentialVersion identifies the
+ * provider connection's secret version at dispatch, never the caller.
+ */
+export type Scope = {
+    namespace: string;
+    /** Budget owner: user, team, or the platform's own principal. */
+    principal: string;
+    /** Initiating identity when it differs from the owner: a member, a guest session, a worker. */
+    actor?: string;
+    group?: string;
+    connection: string;
+    /** Who called the host application. Used for per-token budgets and attribution. */
+    accessCredential?: AccessCredential;
+    /** Which provider secret version was used. Rotation identity, not caller identity. */
+    providerCredentialVersion?: string;
+};
+export type FundingSource = "byok" | "platform";
+export type Surface = "app" | "programmatic";
+export type Source = "app" | "worker" | "api" | "sdk" | "cli" | "mcp" | "proxy";
+/** Timestamps are UTC ISO strings. Resolved reservation epochs remain immutable. */
+export type BudgetWindow = {
+    kind: "calendar_month";
+    timezone: "UTC";
+} | {
+    kind: "provider_cycle";
+    cycleId: string;
+    startsAt: string;
+    endsAt: string;
+} | {
+    kind: "rolling";
+    days: number;
+} | {
+    kind: "since_reset";
+    epoch: string;
+    startsAt: string;
+};
+/**
+ * Each variant names one constraint in a namespace.
+ * A platform_pool bounds spend shared by many principals and applies to operations
+ * naming that pool in ReserveInput. It is not the platform principal's own budget.
+ * A wallet is not a budget: the host ledger owns balances, holds and charges,
+ * coordinated through the host credit bridge. A wallet-level monthly cap may still
+ * be a principal Budget because the cap is a constraint, not a balance.
+ */
+export type BudgetScope = {
+    kind: "principal";
+    namespace: string;
+    principal: string;
+} | {
+    kind: "group";
+    namespace: string;
+    group: string;
+} | {
+    kind: "connection";
+    namespace: string;
+    connection: string;
+} | {
+    kind: "access_credential";
+    namespace: string;
+    accessCredential: AccessCredential;
+} | {
+    kind: "platform_pool";
+    namespace: string;
+    poolId: string;
+};
+export type Budget = {
+    id: string;
+    version: number;
+    scope: BudgetScope;
+    surface: Surface | "any";
+    unit: string;
+    limit: Quantity | null;
+    window: BudgetWindow;
+    onExceed: "block" | "warn";
+};
+export type LifecycleState = "reserved" | "dispatch_intended" | "pending" | "settled" | "released";
+export type Certainty = "measured" | "estimated" | "unknown";
+export type Measurement = {
+    unit: string;
+    quantity: Quantity;
+    certainty: "measured" | "estimated";
+} | {
+    unit: string;
+    quantity: null;
+    certainty: "unknown";
+};
+export type Cost = {
+    certainty: "measured" | "estimated";
+    money: Money;
+} | {
+    certainty: "unknown";
+    money: null;
+};
+/**
+ * Receipt certainty is derived from its measurements and cost, never stored separately.
+ * Corrections append a receipt whose supersedes ID names an existing receipt.
+ * Effective evidence is the latest receipt not superseded by another receipt.
+ * Superseded receipts remain in the operation's history.
+ */
+export type Receipt = {
+    id: string;
+    supersedes?: string;
+    measurements: readonly Measurement[];
+    cost: Cost;
+    providerRequestId?: string;
+    providerPriceVersion?: string;
+    evidenceRef?: string;
+    occurredAt: string;
+    recordedAt: string;
+    cached: boolean;
+    failed: boolean;
+};
+/**
+ * Store selects all applying budgets atomically inside reserve; Meter's pre-resolution
+ * is advisory and never sufficient for admission.
+ * Match namespace and the bound: principal, group, connection, accessCredential by
+ * kind and id, or poolId listed in platformPools. Match surface or "any".
+ * Each applicable budget's unit must appear in estimate. A missing bounded unit is
+ * a Meter validation error, not permission to bypass the bound. Store re-checks this
+ * against current budgets. Units without budgets are recorded without a bound.
+ * Use the current budget version at reservation time; snapshot its resolved epoch
+ * and version into budgetEpochs. Check every applying budget in one atomic command.
+ * Return the first exceeded bound in deterministic host-policy order; default:
+ * platform_pool, principal, group, connection, access_credential.
+ * A guest session is actor, not budget owner. The platform or a dedicated guest
+ * principal owns the operation; its pool and host-enforced session limit both apply.
+ */
+export type ReserveInput = {
+    /** Durable dispatch identity. Reuse with different semantics is a conflict. */
+    operationId: string;
+    /** Undispatched lifetime, 1..86400000 ms; defaults to five minutes. Replay never extends it.
+     * Queued hosts must take dispatch intent at enqueue and carry the lease, or cover queue delay with this lifetime.
+     */
+    reservationTtlMs?: number;
+    scope: Scope;
+    fundingSource: FundingSource;
+    /** Platform pools this operation draws from, when the provider key is platform-funded. */
+    platformPools?: readonly string[];
+    costOwner: string;
+    creditAccountRef?: string;
+    customerPriceVersion?: string;
+    surface: Surface;
+    source: Source;
+    provider: string;
+    operation: string;
+    estimate: readonly Quantity[];
+    correlationId?: string;
+    parentOperationId?: string;
+};
+/** Expiry fences dispatch. Explicit release or expiry maintenance changes state; reads never mutate. */
+export type Operation = ReserveInput & {
+    reservationExpiresAt: string;
+    state: LifecycleState;
+    version: number;
+    createdAt: string;
+    updatedAt: string;
+    budgetEpochs: readonly {
+        budgetId: string;
+        budgetVersion: number;
+        epoch: string;
+        startsAt: string;
+        endsAt: string | null;
+    }[];
+    /** Append-only, oldest first. Corrections never remove historical receipts. */
+    receipts: readonly Receipt[];
+    /** Dispatch or recovery lease. Expired leases remain visible until replaced. */
+    lease: Lease | null;
+};
+/**
+ * Identical operationId and semantic fields return replayed: true in any lifecycle state.
+ * A replay never authorizes dispatch. Different semantic fields return semantic_mismatch.
+ * Budget denial returns AllowanceExceeded data, not an expected-outcome exception.
+ */
+export type ReserveResult = ValidationFailure | {
+    outcome: "invalid";
+    reason: "missing_estimate_unit";
+    unit: string;
+    operation: null;
+} | {
+    outcome: "reserved";
+    replayed: false;
+    operation: Operation;
+    warnings: readonly AllowanceExceeded[];
+} | {
+    outcome: "reserved";
+    replayed: true;
+    operation: Operation;
+    warnings: readonly AllowanceExceeded[];
+} | {
+    outcome: "exceeded";
+    exceeded: AllowanceExceeded;
+    operation: null;
+} | {
+    outcome: "conflict";
+    reason: "semantic_mismatch";
+    operation: Operation;
+};
+export type OperationRef = Pick<Scope, "namespace" | "principal"> & {
+    operationId: string;
+};
+export type OperationCommand = OperationRef & {
+    /** Replay key for this mutation; checked before optimistic version validation. */
+    commandId: string;
+    expectedVersion: number;
+};
+/**
+ * An active dispatch lease permits the first upstream call and settlement by its holder.
+ * Renew for long calls. Expiry changes no operation state and never permits redispatch.
+ * Each recovery claim issues a new leaseId and fences the previous holder out.
+ * Implementations bind the caller to the authenticated holder, not a caller-supplied assertion.
+ */
+export type Lease = {
+    leaseId: string;
+    holder: string;
+    expiresAt: string;
+};
+/**
+ * Only the first intent returns granted: true. Replaying its commandId returns
+ * already_dispatched, as does another commandId on an already intended operation.
+ * Neither replay nor lease expiry grants another upstream call.
+ */
+export type DispatchGrant = ValidationFailure | {
+    granted: true;
+    operation: Operation;
+    lease: Lease;
+} | {
+    granted: false;
+    operation: Operation | null;
+    reason: "already_dispatched" | "version_conflict" | "not_reserved" | "released" | "reservation_expired";
+};
+export type DispatchIntentInput = OperationCommand & {
+    /** Opaque worker identity used for fencing and diagnostics. */
+    holder: string;
+    leaseTtlMs: number;
+};
+/**
+ * No command journal or commandId. Renewal uses max(current expiry, now + TTL).
+ * Repeating at the same clock instant is idempotent; a later retry can extend expiry.
+ * It never shortens the lease, changes the operation version, or regrants dispatch.
+ */
+export type LeaseRenewalInput = OperationRef & {
+    leaseId: string;
+    leaseTtlMs: number;
+};
+/**
+ * Only the current holder may renew an active lease. Renewal after expiry fails.
+ * A rejected holder must stop work and hand over to recovery.
+ */
+export type LeaseRenewal = ValidationFailure | {
+    renewed: true;
+    lease: Lease;
+} | {
+    renewed: false;
+    reason: "expired" | "not_holder" | "not_active";
+};
+export type RecoveryClaimInput = OperationRef & {
+    holder: string;
+    leaseTtlMs: number;
+};
+/**
+ * Claim only dispatch_intended or pending operations with no active lease.
+ * Issue a new leaseId; the previous holder is fenced out.
+ * Recovery never redispatches. It resolves provider evidence or supported upstream
+ * idempotency evidence, then settles, corrects, or leaves pending uncertain exposure.
+ */
+export type RecoveryClaim = ValidationFailure | {
+    claimed: true;
+    operation: Operation;
+    lease: Lease;
+} | {
+    claimed: false;
+    operation: Operation | null;
+    reason: "lease_active" | "not_recoverable" | "not_found";
+};
+/**
+ * Lease authority requires an active dispatch lease held by the caller.
+ * Recovery authority requires the active lease issued by claimForRecovery.
+ * Late evidence requires host authorization and no active lease. Settle accepts pending
+ * only; correcting settled work requires replacesReceiptId and reason. Every new command
+ * checks expectedVersion. Identical successful replays return the recorded result.
+ * The store records source. This path needs no dispatch lease.
+ */
+export type Authority = {
+    kind: "lease";
+    leaseId: string;
+} | {
+    kind: "recovery";
+    leaseId: string;
+} | {
+    kind: "late_evidence";
+    source: string;
+};
+export type SettleInput = OperationCommand & {
+    authority: Authority;
+    receipt: Receipt;
+};
+/**
+ * Host-authorized cancellation needs reserved state and an atomic version check, not a lease.
+ * After dispatch intent, release always rejects with not_reserved.
+ */
+export type ReleaseInput = OperationCommand & {
+    reason: string;
+};
+/** Same authority rules as settle; append only, with an existing receipt as the target. */
+export type CorrectionInput = OperationCommand & {
+    authority: Authority;
+    receipt: Receipt;
+    replacesReceiptId: string;
+    reason: string;
+};
+/**
+ * Identical command replay returns the stored result with replayed: true.
+ * Reusing commandId with a different receipt returns receipt_conflict.
+ * Successful accounting may retain pending state when exposure remains unknown.
+ */
+export type SettleResult = ValidationFailure | {
+    outcome: "settled";
+    replayed: boolean;
+    operation: Operation;
+} | {
+    outcome: "rejected";
+    reason: "not_holder" | "lease_expired" | "version_conflict" | "invalid_state" | "receipt_conflict";
+    operation: Operation | null;
+};
+/** Identical successful command replay returns the stored result with replayed: true. */
+export type ReleaseResult = ValidationFailure | {
+    outcome: "released";
+    replayed: boolean;
+    operation: Operation;
+} | {
+    outcome: "rejected";
+    reason: "not_reserved" | "version_conflict";
+    operation: Operation | null;
+};
+/** Requested data scope only; this is not authorization. Pool reads follow AccessContext pool rules. */
+export type UsageScope = {
+    kind: "principal";
+    namespace: string;
+    principal: string;
+} | {
+    kind: "group";
+    namespace: string;
+    group: string;
+} | {
+    kind: "namespace";
+    namespace: string;
+} | {
+    kind: "platform_pool";
+    namespace: string;
+    poolId: string;
+};
+/**
+ * Built by the host from its verified session or token.
+ * HTTP builds this context from authentication, never the request body or query string.
+ * Namespace must match. Principal and group scopes require their corresponding
+ * readable list or "*". Connection and access-credential scopes require a readable
+ * owning principal or group: the host resolver supplies ownership to Meter for authorization.
+ * A pool scope requires readablePools membership, "*", or canManageBudgets.
+ */
+export type AccessContext = {
+    namespace: string;
+    /** Principals the caller may read. "*" means the whole namespace. */
+    readablePrincipals: readonly string[] | "*";
+    readableGroups: readonly string[] | "*";
+    readablePools: readonly string[] | "*";
+    canReadBillingDetail: boolean;
+    canManageBudgets: boolean;
+};
+/** groupBy: "principal" is allowed only for group or namespace scope. */
+export type UsageQuery = {
+    scope: UsageScope;
+    from: string;
+    to: string;
+    connection?: string;
+    units: readonly string[];
+    groupBy: readonly ("principal" | "provider" | "operation" | "surface" | "source" | "connection" | "day" | "access_credential" | "platform_pool")[];
+    cursor?: string;
+    limit?: number;
+};
+export type UsageRow = {
+    dimensions: Readonly<Record<string, string>>;
+    measurements: readonly Measurement[];
+    cost: Cost;
+    fundingSource: FundingSource;
+    costOwner: string;
+    unknownOperations: bigint;
+};
+export type UsagePage = {
+    rows: readonly UsageRow[];
+    asOf: string;
+    watermark: string;
+    nextCursor?: string;
+};
+/** Budgets defined for exactly this scope, regardless of any operation. */
+export type DefinedBudgetsQuery = {
+    scope: BudgetScope;
+};
+/**
+ * All budgets that would apply to the operation's scope, surface, units and pools.
+ * Requires the operation's principal to be readable. Statuses for unreadable pools
+ * must redact budget.limit, used, reserved and remaining to null, with redacted: true.
+ * Listing does not reserve capacity or replace the atomic admission check.
+ */
+export type ApplicableBudgetsQuery = {
+    scope: Scope;
+    surface: Surface;
+    units: readonly string[];
+    platformPools?: readonly string[];
+};
+export type BudgetStatus = {
+    budget: Budget;
+    epoch: {
+        epoch: string;
+        startsAt: string;
+        endsAt: string | null;
+    };
+    used: Quantity | null;
+    reserved: Quantity | null;
+    remaining: Quantity | null;
+    /** Set when the caller may see that a bound applies but not its figures. */
+    redacted?: true;
+};
+/** A scope wider than AccessContext is forbidden; never silently widen or narrow it. */
+export type ReadResult<T> = ValidationFailure | {
+    outcome: "ok";
+    value: T;
+} | {
+    outcome: "forbidden";
+};
+/** Data-only budget denial. A P1 implementation may wrap it in a runtime error class. */
+export interface AllowanceExceeded {
+    readonly code: "allowance_exceeded";
+    readonly budget: Budget;
+    readonly used: Quantity;
+    readonly reserved: Quantity;
+    readonly resetsAt: string | null;
+}
+/** Trusted maintenance command. Host authorizes namespace-wide cleanup; no provider call or charge is undone. */
+export type ExpireReservationsInput = {
+    namespace: string;
+    limit?: number;
+};
+export type ExpireReservationsResult = ValidationFailure | {
+    outcome: "expired";
+    count: number;
+    hasMore: boolean;
+};
+/**
+ * One interface for embedded and remote implementations.
+ * All reads require verified server context and return forbidden for unauthorized scope.
+ * Meter validates inputs and resolves host policy; Store repeats all concurrent checks atomically.
+ * Embedded hosts must schedule expireReservations themselves; the local server does so every thirty seconds.
+ * Admission sweeps at most one default batch. Maintenance owns the remaining expired backlog.
+ */
+export interface Meter {
+    expireReservations(input: ExpireReservationsInput): Promise<ExpireReservationsResult>;
+    reserve(input: ReserveInput): Promise<ReserveResult>;
+    markDispatchIntent(input: DispatchIntentInput): Promise<DispatchGrant>;
+    renewLease(input: LeaseRenewalInput): Promise<LeaseRenewal>;
+    claimForRecovery(input: RecoveryClaimInput): Promise<RecoveryClaim>;
+    settle(input: SettleInput): Promise<SettleResult>;
+    correct(input: CorrectionInput): Promise<SettleResult>;
+    releaseUndispatched(input: ReleaseInput): Promise<ReleaseResult>;
+    getOperation(access: AccessContext, input: OperationRef): Promise<ReadResult<Operation | null>>;
+    usage(access: AccessContext, query: UsageQuery): Promise<ReadResult<UsagePage>>;
+    definedBudgets(access: AccessContext, query: DefinedBudgetsQuery): Promise<ReadResult<readonly Budget[]>>;
+    applicableBudgets(access: AccessContext, query: ApplicableBudgetsQuery): Promise<ReadResult<readonly BudgetStatus[]>>;
+}
+/** Trusted host admission policy; Store applies order in the atomic command. */
+export type AdmissionPolicy = {
+    budgetOrder: readonly BudgetScope["kind"][];
+};
+export type BudgetOwner = Extract<BudgetScope, {
+    kind: "principal" | "group";
+}>;

package/dist/contracts.js

@@ -0,0 +1 @@
+export {};

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+export type { Money, Quantity, AccessCredential, Scope, FundingSource, Surface, Source, BudgetWindow, BudgetScope, Budget, LifecycleState, Certainty, Measurement, Cost, Receipt, ReserveInput, ReserveResult, Operation, OperationRef, OperationCommand, Lease, DispatchGrant, DispatchIntentInput, LeaseRenewalInput, LeaseRenewal, RecoveryClaimInput, RecoveryClaim, Authority, SettleInput, ReleaseInput, CorrectionInput, SettleResult, ReleaseResult, UsageScope, AccessContext, UsageQuery, UsageRow, UsagePage, DefinedBudgetsQuery, ApplicableBudgetsQuery, BudgetStatus, ReadResult, AllowanceExceeded, Meter, } from "./contracts.js";
+export { resolveWindow } from "./windows.js";
+export type { ResolvedWindow } from "./windows.js";
+export { fromDecimalString, toDecimalString, add as addMoney, sub as subtractMoney, compare as compareMoney, } from "./money.js";
+export { normalizeScale, add as addQuantity, compare as compareQuantity } from "./quantity.js";
+export type { ValidationFailure, AdmissionPolicy, BudgetOwner } from "./contracts.js";
+export { defaultBudgetOrder } from "./policy.js";
+export type { ExpireReservationsInput, ExpireReservationsResult } from "./contracts.js";
+export { decodeMeterJson } from "./wire.js";

package/dist/index.js

@@ -0,0 +1,5 @@
+export { resolveWindow } from "./windows.js";
+export { fromDecimalString, toDecimalString, add as addMoney, sub as subtractMoney, compare as compareMoney, } from "./money.js";
+export { normalizeScale, add as addQuantity, compare as compareQuantity } from "./quantity.js";
+export { defaultBudgetOrder } from "./policy.js";
+export { decodeMeterJson } from "./wire.js";

package/dist/money.d.ts

@@ -0,0 +1,8 @@
+import type { Money } from "./contracts.js";
+export declare function fromDecimalString(cents: string, options?: {
+    allowNegative?: boolean;
+}): Money;
+export declare function toDecimalString(m: Money): string;
+export declare const add: (a: Money, b: Money) => Money;
+export declare const sub: (a: Money, b: Money) => Money;
+export declare const compare: (a: Money, b: Money) => -1 | 0 | 1;

package/dist/money.js

@@ -0,0 +1,17 @@
+export function fromDecimalString(cents, options = {}) {
+    if (!/^-?\d+(\.\d{1,4})?$/.test(cents) || (!options.allowNegative && cents.startsWith("-")))
+        throw new Error("InvalidInput: cents");
+    const [whole, fraction = ""] = cents.replace("-", "").split(".");
+    return {
+        currency: "USD",
+        units: (BigInt(whole) * 10000n + BigInt(fraction.padEnd(4, "0"))) *
+            (cents.startsWith("-") ? -1n : 1n),
+    };
+}
+export function toDecimalString(m) {
+    const n = m.units < 0n ? -m.units : m.units;
+    return `${m.units < 0n ? "-" : ""}${n / 10000n}.${(n % 10000n).toString().padStart(4, "0")}`;
+}
+export const add = (a, b) => ({ currency: "USD", units: a.units + b.units });
+export const sub = (a, b) => ({ currency: "USD", units: a.units - b.units });
+export const compare = (a, b) => a.units < b.units ? -1 : a.units > b.units ? 1 : 0;

package/dist/policy.d.ts

@@ -0,0 +1,2 @@
+import type { BudgetScope } from "./contracts.js";
+export declare const defaultBudgetOrder: readonly BudgetScope["kind"][];

package/dist/policy.js

@@ -0,0 +1,7 @@
+export const defaultBudgetOrder = Object.freeze([
+    "platform_pool",
+    "principal",
+    "group",
+    "connection",
+    "access_credential",
+]);

package/dist/quantity.d.ts

@@ -0,0 +1,4 @@
+import type { Quantity } from "./contracts.js";
+export declare function normalizeScale(q: Quantity, scale: number): Quantity;
+export declare function add(a: Quantity, b: Quantity): Quantity;
+export declare function compare(a: Quantity, b: Quantity): -1 | 0 | 1;

package/dist/quantity.js

@@ -0,0 +1,19 @@
+export function normalizeScale(q, scale) {
+    if (!Number.isSafeInteger(scale) || scale < q.scale || scale > 18)
+        throw new Error("InvalidInput: scale");
+    return { ...q, scale, value: q.value * 10n ** BigInt(scale - q.scale) };
+}
+function pair(a, b) {
+    if (a.unit !== b.unit)
+        throw new Error("UnitMismatch");
+    const scale = Math.max(a.scale, b.scale);
+    return [normalizeScale(a, scale), normalizeScale(b, scale)];
+}
+export function add(a, b) {
+    const [x, y] = pair(a, b);
+    return { ...x, value: x.value + y.value };
+}
+export function compare(a, b) {
+    const [x, y] = pair(a, b);
+    return x.value < y.value ? -1 : x.value > y.value ? 1 : 0;
+}

package/dist/windows.d.ts

@@ -0,0 +1,7 @@
+import type { BudgetWindow } from "./contracts.js";
+export type ResolvedWindow = {
+    epoch: string;
+    startsAt: string;
+    endsAt: string | null;
+};
+export declare function resolveWindow(window: BudgetWindow, now: Date): ResolvedWindow;

package/dist/windows.js

@@ -0,0 +1,24 @@
+export function resolveWindow(window, now) {
+    if (!Number.isFinite(now.getTime()))
+        throw new Error("InvalidInput: now");
+    if (window.kind === "rolling")
+        throw new Error("UnsupportedWindow: rollingWindows");
+    if (window.kind === "calendar_month") {
+        const year = now.getUTCFullYear(), month = now.getUTCMonth();
+        return {
+            epoch: now.toISOString().slice(0, 7),
+            startsAt: new Date(Date.UTC(year, month, 1)).toISOString(),
+            endsAt: new Date(Date.UTC(year, month + 1, 1)).toISOString(),
+        };
+    }
+    const starts = new Date(window.startsAt), ends = window.kind === "provider_cycle" ? new Date(window.endsAt) : null;
+    if (!Number.isFinite(starts.getTime()) || (ends && !Number.isFinite(ends.getTime())))
+        throw new Error("InvalidInput: window");
+    if (now < starts || (ends && now >= ends))
+        throw new Error("InactiveWindow");
+    return {
+        epoch: window.kind === "provider_cycle" ? window.cycleId : window.epoch,
+        startsAt: starts.toISOString(),
+        endsAt: ends?.toISOString() ?? null,
+    };
+}

package/dist/wire.d.ts

@@ -0,0 +1,4 @@
+/** Restore integers only in recognizable Meter DTOs. Generic metadata fields retain their strings.
+ * This performs conversion, not validation. HTTP validates strict wire schemas before calling it.
+ */
+export declare function decodeMeterJson(text: string): unknown;

package/dist/wire.js

@@ -0,0 +1,28 @@
+/** Restore integers only in recognizable Meter DTOs. Generic metadata fields retain their strings.
+ * This performs conversion, not validation. HTTP validates strict wire schemas before calling it.
+ */
+export function decodeMeterJson(text) {
+    const decimal = (v) => typeof v === "string" && /^-?\d+$/.test(v);
+    return JSON.parse(text, (_key, value) => {
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            return value;
+        const v = value, keys = Object.keys(v);
+        if (keys.length === 2 && v.currency === "USD" && decimal(v.units))
+            return { ...v, units: BigInt(v.units) };
+        if (keys.length === 3 &&
+            typeof v.unit === "string" &&
+            typeof v.scale === "number" &&
+            decimal(v.value))
+            return { ...v, value: BigInt(v.value) };
+        if (v.dimensions &&
+            typeof v.dimensions === "object" &&
+            Array.isArray(v.measurements) &&
+            v.cost &&
+            typeof v.cost === "object" &&
+            ["byok", "platform"].includes(String(v.fundingSource)) &&
+            typeof v.costOwner === "string" &&
+            decimal(v.unknownOperations))
+            return { ...v, unknownOperations: BigInt(v.unknownOperations) };
+        return value;
+    });
+}

package/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "@usagekit/core",
+  "version": "0.1.0",
+  "type": "module",
+  "license": "Apache-2.0",
+  "description": "Exact quantities, ownership and pure domain types.",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "!dist/**/*.tsbuildinfo",
+    "LICENSE",
+    "NOTICE"
+  ],
+  "scripts": {
+    "build": "tsc -b",
+    "typecheck": "tsc -b",
+    "prepublishOnly": "node ../../scripts/publish-guard.mjs",
+    "prepack": "node ../../scripts/package-license.mjs"
+  },
+  "sideEffects": false,
+  "publishConfig": {
+    "access": "restricted",
+    "registry": "https://registry.npmjs.org/"
+  }
+}