@vibesdotdev/account 0.0.0-stage → 1.0.0-rc.2

package/dist/billing/usage/record-marketplace-tool-royalty.js

@@ -0,0 +1,152 @@
+/**
+ * Record a marketplace-tool royalty against the account billing subject.
+ *
+ * Mirrors `./record-generation-usage.ts`'s cross-service emitter shape:
+ * the caller (e.g. `apps/ai-web`, where a tool actually executes and the
+ * `tools` row — `marketplaceListed` / `creditRate` / `createdById` — is
+ * already in hand) POSTs to `apps/account-web`'s billing API rather than
+ * writing to the ledger directly (ai-web and account-web are separate
+ * deployed workers with separate D1 bindings).
+ *
+ * Unlike `recordGenerationUsage` (which deducts from the CALLING user's
+ * own balance), this is a two-sided ledger operation: charge the buyer
+ * `creditRate` credits AND credit the tool's creator their royalty share,
+ * in one request. The receiver (`payMarketplaceToolRoyalty` in
+ * account-web) does both writes and is the single place that enforces
+ * "no self-credit when buyer === creator" and "no royalty on a failed
+ * buyer charge".
+ *
+ * Design constraints (same rationale as `recordGenerationUsage`):
+ * - MUST NOT fail the calling tool execution. A billing hiccup cannot
+ *   fail a tool run that already succeeded. Always resolves, never
+ *   rejects; failures log structured context.
+ * - MUST be time-bounded (5s hard cap) so a wedged account service can't
+ *   stall the response to the caller.
+ * - MUST send the buyer `userId` in the JSON body. The live caller authenticates
+ *   as the tools service (`Authorization: Bearer` + `x-vibes-service-token`);
+ *   account-web charges `body.userId` on that bearer path. The creator id also
+ *   travels in the payload (ai-web already resolved it from its own `tools` table).
+ * - The returned promise MUST be kept alive past the response in a
+ *   Cloudflare Worker (see `meterMarketplaceToolRoyalty` /
+ *   `ctx.waitUntil`) — a floated promise gets cancelled on isolate
+ *   teardown and the royalty silently never lands.
+ */
+import { getLogger } from '@vibesdotdev/logging';
+import { CaughtFailureSchema, settle, settleNow, valueFreeFailure } from '@vibesdotdev/kernel';
+import { deliveryFailure, keepAlive } from "./delivery.js";
+import { buildMarketplaceToolRoyaltyOperationKey } from "../rating/marketplace-royalty.js";
+function log(runtime) {
+    return getLogger('account', runtime).child({ context: 'record-marketplace-tool-royalty' });
+}
+const ROYALTY_RECORD_TIMEOUT_MS = 5000;
+/**
+ * POST the royalty event to account-web. Returns the in-flight promise
+ * (never rejects — failures log at `error` and resolve to void).
+ *
+ * Callers that only care about "fire and forget, keep the isolate alive"
+ * should use `meterMarketplaceToolRoyalty(runtime, platform, input)` below.
+ */
+export function recordMarketplaceToolRoyalty(runtime, input) {
+    if (!input.accountOrigin) {
+        log(runtime).debug('recordMarketplaceToolRoyalty: accountOrigin missing; skipping', {
+            toolId: input.toolId
+        });
+        return Promise.resolve();
+    }
+    const accountOrigin = input.accountOrigin;
+    // No-op guards mirrored client-side purely to avoid a pointless network
+    // round-trip; the receiver re-checks all of these authoritatively (never
+    // trust a client-computed "skip" for a money decision).
+    if (!input.marketplaceListed || !input.creditRate || input.creditRate <= 0) {
+        log(runtime).debug('recordMarketplaceToolRoyalty: not a billable listed-tool use; skipping', {
+            toolId: input.toolId,
+            marketplaceListed: input.marketplaceListed,
+            creditRate: input.creditRate
+        });
+        return Promise.resolve();
+    }
+    if (!input.creatorUserId) {
+        log(runtime).debug('recordMarketplaceToolRoyalty: tool has no creator on record; skipping', {
+            toolId: input.toolId
+        });
+        return Promise.resolve();
+    }
+    if (!input.serviceToken) {
+        // error, not debug: an unconfigured VIBES_INTERNAL_SERVICE_TOKEN means
+        // every royalty is silently lost — that must be loud in logs.
+        log(runtime).error('recordMarketplaceToolRoyalty: service token unavailable; account-web would reject', {
+            toolId: input.toolId
+        });
+        return Promise.resolve();
+    }
+    const serviceToken = input.serviceToken;
+    if (!input.userId) {
+        log(runtime).error('recordMarketplaceToolRoyalty: buyer userId missing; account-web would reject', {
+            toolId: input.toolId
+        });
+        return Promise.resolve();
+    }
+    const operationKey = settleNow(() => buildMarketplaceToolRoyaltyOperationKey(input.runId, input.listingId));
+    if (!operationKey.ok) {
+        log(runtime).error('recordMarketplaceToolRoyalty: missing idempotency identity; skipping', {
+            toolId: input.toolId,
+            error: valueFreeFailure(CaughtFailureSchema.parse(operationKey.cause))
+        });
+        return Promise.resolve();
+    }
+    const authorization = input.authorization?.trim();
+    const serviceHeaders = {
+        'Content-Type': 'application/json',
+        Accept: 'application/json',
+        Origin: input.callerOrigin,
+        'x-vibes-service-token': serviceToken
+    };
+    const headers = authorization ? { ...serviceHeaders, Authorization: authorization } : serviceHeaders;
+    return settle(() => runtime.lifecycle.wait((signal) => fetch(`${accountOrigin.replace(/\/$/, '')}/api/account/billing/credits/marketplace-royalty`, {
+        method: 'POST',
+        headers,
+        body: JSON.stringify({
+            runId: input.runId,
+            listingId: input.listingId,
+            toolId: input.toolId,
+            toolName: input.toolName ?? null,
+            marketplaceListed: input.marketplaceListed,
+            creditRate: input.creditRate,
+            creatorUserId: input.creatorUserId,
+            userId: input.userId
+        }),
+        signal
+    }), { timeoutMs: ROYALTY_RECORD_TIMEOUT_MS, reason: 'account marketplace tool royalty record' })).then((delivered) => {
+        const failure = deliveryFailure(delivered);
+        if (!failure)
+            return;
+        if (failure.reason === 'http') {
+            log(runtime).error('recordMarketplaceToolRoyalty: rejected', { toolId: input.toolId, status: failure.status });
+        }
+        else if (failure.reason === 'timeout') {
+            log(runtime).error('recordMarketplaceToolRoyalty: timed out', {
+                toolId: input.toolId,
+                timeoutMs: ROYALTY_RECORD_TIMEOUT_MS,
+                accountOrigin: input.accountOrigin
+            });
+        }
+        else {
+            log(runtime).error('recordMarketplaceToolRoyalty: failed', {
+                error: failure.error,
+                toolId: input.toolId,
+                accountOrigin: input.accountOrigin
+            });
+        }
+    });
+}
+/**
+ * Record the royalty from inside a request handler, keeping the HTTP call
+ * alive past the response via `ctx.waitUntil` (same pattern and same "0
+ * usage_records" failure mode as `meterGenerationUsage` — see that
+ * function's docstring for why the bound-vs-unbound `waitUntil` call
+ * matters).
+ */
+export function meterMarketplaceToolRoyalty(runtime, platform, input) {
+    keepAlive(log(runtime), 'meterMarketplaceToolRoyalty', platform, recordMarketplaceToolRoyalty(runtime, input));
+}
+//# sourceMappingURL=record-marketplace-tool-royalty.js.map

package/dist/billing/usage/record-marketplace-tool-royalty.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-marketplace-tool-royalty.js","sourceRoot":"","sources":["../../../src/billing/usage/record-marketplace-tool-royalty.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAmB,MAAM,qBAAqB,CAAC;AAChH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,uCAAuC,EAAE,MAAM,kCAAkC,CAAC;AAE3F,SAAS,GAAG,CAAC,OAAmB;IAC/B,OAAO,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAiDvC;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC3C,OAAmB,EACnB,KAAwC;IAExC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QAC1B,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,+DAA+D,EAAE;YACnF,MAAM,EAAE,KAAK,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1B,CAAC;IACD,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IAE1C,wEAAwE;IACxE,yEAAyE;IACzE,wDAAwD;IACxD,IAAI,CAAC,KAAK,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,wEAAwE,EAAE;YAC5F,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,UAAU,EAAE,KAAK,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1B,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QAC1B,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,uEAAuE,EAAE;YAC3F,MAAM,EAAE,KAAK,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1B,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACzB,uEAAuE;QACvE,8DAA8D;QAC9D,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,mFAAmF,EAAE;YACvG,MAAM,EAAE,KAAK,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1B,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACnB,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,8EAA8E,EAAE;YAClG,MAAM,EAAE,KAAK,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1B,CAAC;IACD,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,uCAAuC,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5G,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACtB,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,sEAAsE,EAAE;YAC1F,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;SACtE,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1B,CAAC;IACD,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IAClD,MAAM,cAAc,GAAG;QACtB,cAAc,EAAE,kBAAkB;QAClC,MAAM,EAAE,kBAAkB;QAC1B,MAAM,EAAE,KAAK,CAAC,YAAY;QAC1B,uBAAuB,EAAE,YAAY;KACJ,CAAC;IACnC,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;IAErG,OAAO,MAAM,CAAC,GAAG,EAAE,CAClB,OAAO,CAAC,SAAS,CAAC,IAAI,CACrB,CAAC,MAAM,EAAE,EAAE,CACV,KAAK,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,kDAAkD,EAAE;QAC5F,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;YAChC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,MAAM,EAAE,KAAK,CAAC,MAAM;SACpB,CAAC;QACF,MAAM;KACN,CAAC,EACH,EAAE,SAAS,EAAE,yBAAyB,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAC3F,CACD,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QACpB,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC/B,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,wCAAwC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAChH,CAAC;aAAM,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACzC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,yCAAyC,EAAE;gBAC7D,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,yBAAyB;gBACpC,aAAa,EAAE,KAAK,CAAC,aAAa;aAClC,CAAC,CAAC;QACJ,CAAC;aAAM,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,sCAAsC,EAAE;gBAC1D,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,aAAa,EAAE,KAAK,CAAC,aAAa;aAClC,CAAC,CAAC;QACJ,CAAC;IACF,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAC1C,OAAmB,EACnB,QAAkB,EAClB,KAAwC;IAExC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,6BAA6B,EAAE,QAAQ,EAAE,4BAA4B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAChH,CAAC"}

package/dist/billing/usage/record-platform-resource.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Generic platform-resource usage emitter.
+ *
+ * Records cloud-infrastructure usage that doesn't fit the AI generation
+ * shape (`record-generation-usage`) or the sandbox uptime shape
+ * (`record-sandbox-uptime`). Covers:
+ *   - storage GB-month (periodic sweep over user uploads)
+ *   - bandwidth GB-egress (R2 / CF logs sweep)
+ *   - code-execution seconds (per execution worker tick)
+ *   - request-priced cloud calls (web-crawl pages, etc.)
+ *
+ * Targets the internal-service endpoint `/api/billing/usage/record-internal`
+ * (same as sandbox uptime). Caller authenticates with the
+ * `VIBES_INTERNAL_SERVICE_TOKEN` and supplies either
+ * `X-Vibes-User-Id` header context or an explicit `organizationId`.
+ *
+ * Design constraints:
+ *   - MUST NOT fail the parent flow. Fire-and-forget, time-bounded.
+ *   - Returns `void`; failures log structured context.
+ *   - Honors the same journal callback contract as
+ *     `record-sandbox-uptime` so app-local audit tables stay consistent.
+ */
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import { type BillingEventMetadata } from './delivery.ts';
+import type { CostBasis } from '../rating/schemas/cost-basis.ts';
+import type { HardwarePath, MeasuredUnits } from '../rating/schemas/rated-usage.ts';
+/** The metadata this emitter's input accepts: JSON values, undefined entries dropped. */
+export type { BillingEventMetadata };
+export type PlatformResourceReason = 'sweep' | 'tick' | 'completion' | 'manual' | 'reconcile';
+export interface RecordPlatformResourceInput {
+    /** Origin of the account app. Omit to skip metering. */
+    accountOrigin: string | null | undefined;
+    /** `VIBES_INTERNAL_SERVICE_TOKEN`. Omit to skip metering. */
+    internalServiceToken: string | null | undefined;
+    /**
+     * Billing subject — same resolution rules as
+     * `record-sandbox-uptime`. Either user, org, or both.
+     */
+    billingUserId?: string | null;
+    organizationId?: string | null;
+    /**
+     * Feature slug for tier/quota mapping (e.g.
+     * `'storage-monthly-gb'`, `'bandwidth-egress-gb'`,
+     * `'code-execution-seconds'`, `'web-crawl-pages-monthly'`).
+     */
+    featureSlug: string;
+    /**
+     * Logical surface for analytics + ledger metadata
+     * (`'platform.storage'`, `'platform.bandwidth'`,
+     * `'platform.sandbox'`, etc.).
+     */
+    surface: string;
+    /** Stable resource identifier (bucket id, host id, job id, etc.). */
+    resourceId: string;
+    /** Measured per-unit quantities (e.g. `{ gb_month: 5.2 }`). */
+    measuredUnits: MeasuredUnits;
+    /**
+     * Cost basis for the rated charge. Caller resolves this from the
+     * resource type's known rate (e.g. CF R2 storage at $0.015/GB-month
+     * → `{ units: 'gb_month', usdPerUnit: 0.015, source: 'published',
+     * confidence: 'high', effectiveAt }`). When omitted, the rating
+     * engine applies the safety heuristic.
+     */
+    costBasis?: CostBasis[];
+    /**
+     * Hardware path. Defaults to `'cloud'`. Set to `'consumer'` when
+     * the resource is user-hosted; the rating engine short-circuits
+     * those events to zero credits.
+     */
+    hardware?: HardwarePath;
+    /** Why this emission fired. */
+    reason: PlatformResourceReason;
+    /** Caller-provided extras merged into metadata. */
+    metadata?: BillingEventMetadata;
+    /** Optional audit-row callbacks. Same shape as record-sandbox-uptime. */
+    journal?: {
+        onSuccess?: () => Promise<void> | void;
+        onFailure?: (info: {
+            reason: 'http' | 'timeout' | 'error' | 'skip';
+            message: string;
+        }) => Promise<void> | void;
+    };
+}
+/**
+ * Fire-and-forget rated emission. Skipped silently when the inputs
+ * indicate the call should not be billed (zero-quantity, missing
+ * config, missing subject).
+ */
+export declare function recordPlatformResource(runtime: RuntimeRef, input: RecordPlatformResourceInput): void;
+//# sourceMappingURL=record-platform-resource.d.ts.map

package/dist/billing/usage/record-platform-resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-platform-resource.d.ts","sourceRoot":"","sources":["../../../src/billing/usage/record-platform-resource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAU,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAIN,KAAK,oBAAoB,EACzB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,KAAK,EACX,YAAY,EACZ,aAAa,EACb,MAAM,kCAAkC,CAAC;AAE1C,yFAAyF;AACzF,YAAY,EAAE,oBAAoB,EAAE,CAAC;AAQrC,MAAM,MAAM,sBAAsB,GAC/B,OAAO,GACP,MAAM,GACN,YAAY,GACZ,QAAQ,GACR,WAAW,CAAC;AAEf,MAAM,WAAW,2BAA2B;IAC3C,wDAAwD;IACxD,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACzC,6DAA6D;IAC7D,oBAAoB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAChD;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,aAAa,EAAE,aAAa,CAAC;IAC7B;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,+BAA+B;IAC/B,MAAM,EAAE,sBAAsB,CAAC;IAC/B,mDAAmD;IACnD,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC,yEAAyE;IACzE,OAAO,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACvC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE;YAClB,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,MAAM,CAAC;YAC9C,OAAO,EAAE,MAAM,CAAC;SAChB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;KAC3B,CAAC;CACF;AAUD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,2BAA2B,GAAG,IAAI,CAgGpG"}

package/dist/billing/usage/record-platform-resource.js

@@ -0,0 +1,125 @@
+/**
+ * Generic platform-resource usage emitter.
+ *
+ * Records cloud-infrastructure usage that doesn't fit the AI generation
+ * shape (`record-generation-usage`) or the sandbox uptime shape
+ * (`record-sandbox-uptime`). Covers:
+ *   - storage GB-month (periodic sweep over user uploads)
+ *   - bandwidth GB-egress (R2 / CF logs sweep)
+ *   - code-execution seconds (per execution worker tick)
+ *   - request-priced cloud calls (web-crawl pages, etc.)
+ *
+ * Targets the internal-service endpoint `/api/billing/usage/record-internal`
+ * (same as sandbox uptime). Caller authenticates with the
+ * `VIBES_INTERNAL_SERVICE_TOKEN` and supplies either
+ * `X-Vibes-User-Id` header context or an explicit `organizationId`.
+ *
+ * Design constraints:
+ *   - MUST NOT fail the parent flow. Fire-and-forget, time-bounded.
+ *   - Returns `void`; failures log structured context.
+ *   - Honors the same journal callback contract as
+ *     `record-sandbox-uptime` so app-local audit tables stay consistent.
+ */
+import { getLogger } from '@vibesdotdev/logging';
+import { settle } from '@vibesdotdev/kernel';
+import { deliveryFailure, deliveryFailureMessage, notifyJournal } from "./delivery.js";
+function log(runtime) {
+    return getLogger('account', runtime).child({ context: 'record-platform-resource' });
+}
+const USAGE_RECORD_TIMEOUT_MS = 500;
+function totalMeasured(units) {
+    let total = 0;
+    for (const value of Object.values(units)) {
+        if (value !== undefined && Number.isFinite(value) && value > 0)
+            total += value;
+    }
+    return total;
+}
+/**
+ * Fire-and-forget rated emission. Skipped silently when the inputs
+ * indicate the call should not be billed (zero-quantity, missing
+ * config, missing subject).
+ */
+export function recordPlatformResource(runtime, input) {
+    const total = totalMeasured(input.measuredUnits);
+    if (total <= 0)
+        return;
+    if (!input.billingUserId && !input.organizationId) {
+        const message = 'neither-billing-user-nor-organization-set';
+        log(runtime).debug('recordPlatformResource: skipping (' + message + ')', {
+            featureSlug: input.featureSlug,
+            resourceId: input.resourceId,
+            reason: input.reason
+        });
+        void notifyJournal(log(runtime), 'recordPlatformResource', () => input.journal?.onFailure?.({ reason: 'skip', message }));
+        return;
+    }
+    if (!input.accountOrigin) {
+        const message = 'accountOrigin-not-configured';
+        log(runtime).debug('recordPlatformResource: skipping (' + message + ')', {
+            featureSlug: input.featureSlug,
+            resourceId: input.resourceId,
+            reason: input.reason
+        });
+        void notifyJournal(log(runtime), 'recordPlatformResource', () => input.journal?.onFailure?.({ reason: 'skip', message }));
+        return;
+    }
+    const accountOrigin = input.accountOrigin;
+    if (!input.internalServiceToken) {
+        const message = 'internalServiceToken-not-configured';
+        log(runtime).debug('recordPlatformResource: skipping (' + message + ')', {
+            featureSlug: input.featureSlug,
+            resourceId: input.resourceId,
+            reason: input.reason
+        });
+        void notifyJournal(log(runtime), 'recordPlatformResource', () => input.journal?.onFailure?.({ reason: 'skip', message }));
+        return;
+    }
+    const effectiveHardware = input.hardware ?? 'cloud';
+    const serviceHeaders = {
+        'Content-Type': 'application/json',
+        Accept: 'application/json',
+        Authorization: `Bearer ${input.internalServiceToken}`
+    };
+    const headers = input.billingUserId
+        ? { ...serviceHeaders, 'X-Vibes-User-Id': input.billingUserId }
+        : serviceHeaders;
+    void settle(() => runtime.lifecycle.wait((signal) => fetch(`${accountOrigin.replace(/\/$/, '')}/api/billing/usage/record-internal`, {
+        method: 'POST',
+        headers,
+        body: JSON.stringify({
+            featureSlug: input.featureSlug,
+            measuredUnits: input.measuredUnits,
+            costBasis: input.costBasis,
+            hardware: effectiveHardware,
+            organizationId: input.organizationId ?? null,
+            metadata: {
+                surface: input.surface,
+                resourceId: input.resourceId,
+                reason: input.reason,
+                hardware: effectiveHardware,
+                ...input.metadata
+            }
+        }),
+        signal
+    }), { timeoutMs: USAGE_RECORD_TIMEOUT_MS, reason: 'account platform resource usage record' })).then(async (delivered) => {
+        const failure = deliveryFailure(delivered);
+        if (!failure) {
+            await notifyJournal(log(runtime), 'recordPlatformResource', input.journal?.onSuccess);
+            return;
+        }
+        const context = { featureSlug: input.featureSlug, resourceId: input.resourceId };
+        if (failure.reason === 'http') {
+            log(runtime).warn('recordPlatformResource: non-2xx from account', { ...context, status: failure.status });
+        }
+        else if (failure.reason === 'timeout') {
+            log(runtime).warn('recordPlatformResource: timed out', { ...context, timeoutMs: USAGE_RECORD_TIMEOUT_MS });
+        }
+        else {
+            log(runtime).warn('recordPlatformResource: fetch failed', { ...context, error: failure.error });
+        }
+        const message = deliveryFailureMessage(failure, USAGE_RECORD_TIMEOUT_MS);
+        await notifyJournal(log(runtime), 'recordPlatformResource', () => input.journal?.onFailure?.({ reason: failure.reason, message }));
+    });
+}
+//# sourceMappingURL=record-platform-resource.js.map

package/dist/billing/usage/record-platform-resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-platform-resource.js","sourceRoot":"","sources":["../../../src/billing/usage/record-platform-resource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAmB,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EACN,eAAe,EACf,sBAAsB,EACtB,aAAa,EAEb,MAAM,eAAe,CAAC;AAUvB,SAAS,GAAG,CAAC,OAAmB;IAC/B,OAAO,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAgEpC,SAAS,aAAa,CAAC,KAAoB;IAC1C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;YAAE,KAAK,IAAI,KAAK,CAAC;IAChF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAmB,EAAE,KAAkC;IAC7F,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACjD,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO;IAEvB,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,2CAA2C,CAAC;QAC5D,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,oCAAoC,GAAG,OAAO,GAAG,GAAG,EAAE;YACxE,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,KAAK,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,wBAAwB,EAAE,GAAG,EAAE,CAC/D,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CACvD,CAAC;QACF,OAAO;IACR,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,8BAA8B,CAAC;QAC/C,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,oCAAoC,GAAG,OAAO,GAAG,GAAG,EAAE;YACxE,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,KAAK,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,wBAAwB,EAAE,GAAG,EAAE,CAC/D,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CACvD,CAAC;QACF,OAAO;IACR,CAAC;IACD,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,qCAAqC,CAAC;QACtD,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,oCAAoC,GAAG,OAAO,GAAG,GAAG,EAAE;YACxE,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,KAAK,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,wBAAwB,EAAE,GAAG,EAAE,CAC/D,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CACvD,CAAC;QACF,OAAO;IACR,CAAC;IAED,MAAM,iBAAiB,GAAiB,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC;IAElE,MAAM,cAAc,GAAG;QACtB,cAAc,EAAE,kBAAkB;QAClC,MAAM,EAAE,kBAAkB;QAC1B,aAAa,EAAE,UAAU,KAAK,CAAC,oBAAoB,EAAE;KACpB,CAAC;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa;QAClC,CAAC,CAAC,EAAE,GAAG,cAAc,EAAE,iBAAiB,EAAE,KAAK,CAAC,aAAa,EAAE;QAC/D,CAAC,CAAC,cAAc,CAAC;IAElB,KAAK,MAAM,CAAC,GAAG,EAAE,CAChB,OAAO,CAAC,SAAS,CAAC,IAAI,CACrB,CAAC,MAAM,EAAE,EAAE,CACV,KAAK,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,oCAAoC,EAAE;QAC9E,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,iBAAiB;YAC3B,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;YAC5C,QAAQ,EAAE;gBACT,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,iBAAiB;gBAC3B,GAAG,KAAK,CAAC,QAAQ;aACjB;SACD,CAAC;QACF,MAAM;KACN,CAAC,EACH,EAAE,SAAS,EAAE,uBAAuB,EAAE,MAAM,EAAE,wCAAwC,EAAE,CACxF,CACD,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;QAC1B,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,wBAAwB,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACtF,OAAO;QACR,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;QACjF,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC/B,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,8CAA8C,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3G,CAAC;aAAM,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACzC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC5G,CAAC;aAAM,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;QACzE,MAAM,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,wBAAwB,EAAE,GAAG,EAAE,CAChE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAC/D,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/billing/usage/record-sandbox-uptime.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Record sandbox uptime against the host's billing subject.
+ *
+ * Why a separate emitter
+ * ----------------------
+ * `record-generation-usage.ts` posts to the user-cookie endpoint, which
+ * derives the billing subject from the authenticated session. Sandbox
+ * uptime ticks come from the platform service on a cron / heartbeat
+ * path with NO user session cookie attached — the bill needs to land
+ * against the host's `ownerType` / `ownerId`, not whoever happens to be
+ * signed in.
+ *
+ * This emitter targets the internal-service endpoint at
+ * `/api/billing/usage/record-internal`, which authenticates via
+ * `VIBES_INTERNAL_SERVICE_TOKEN` + `X-Vibes-User-Id` header and accepts
+ * an explicit `organizationId` for org-owned hosts.
+ *
+ * Design constraints (same as record-generation-usage.ts)
+ * - MUST NOT fail the heartbeat path. Always returns void; swallows
+ *   errors with structured log.
+ * - MUST be time-bounded. 500ms hard cap via AbortController.
+ */
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import { type BillingEventMetadata } from './delivery.ts';
+import type { CostBasis } from '../rating/schemas/cost-basis.ts';
+import type { HardwarePath } from '../rating/schemas/rated-usage.ts';
+/** The metadata this emitter's input accepts: JSON values, undefined entries dropped. */
+export type { BillingEventMetadata };
+export interface RecordSandboxUptimeInput {
+    /** Origin of the account app. Omit to skip metering (dev without account). */
+    accountOrigin: string | null | undefined;
+    /**
+     * Internal-service bearer token (`VIBES_INTERNAL_SERVICE_TOKEN`).
+     * Omit to skip metering — the heartbeat path doesn't fail just because
+     * the platform happens to be running without the service token wired.
+     */
+    internalServiceToken: string | null | undefined;
+    /**
+     * Billing subject. EITHER `billingUserId` for user-owned hosts, OR
+     * `organizationId` for org-owned hosts (the internal endpoint then
+     * resolves the org's billing contact server-side). Setting both is
+     * also valid — the user is the credit-ledger anchor, the org enables
+     * org-first credit pool routing.
+     */
+    billingUserId?: string | null;
+    organizationId?: string | null;
+    /** Minutes of uptime since the last emission. Skipped if <= 0. */
+    minutes: number;
+    /** Stable identifiers stored in metadata for reconciliation. */
+    hostId: string;
+    sandboxResourceId?: string | null;
+    /** Why this emission fired — heartbeat tick, retirement final, manual, or reconciler retry. */
+    reason: 'heartbeat' | 'retire' | 'manual' | 'reconcile';
+    /**
+     * Hardware path. Defaults to `'cloud'` (vibes-managed sandbox).
+     * Set to `'consumer'` for user-hosted hosts where the platform
+     * only facilitates network relay and shouldn't bill compute.
+     * The receiver short-circuits `'consumer'` to zero credits via
+     * the rating engine.
+     */
+    hardware?: HardwarePath;
+    /**
+     * Cost basis for the underlying compute. When provided, the
+     * receiver routes through the rating engine and rates the charge
+     * with the supplied per-second / per-hour USD rate. For a typical
+     * cloud sandbox: one entry of `{ units: 'compute_second' or
+     * 'gpu_second', usdPerUnit }`. When omitted, the rating engine
+     * falls back to the safety heuristic floor.
+     */
+    costBasis?: CostBasis[];
+    /** Caller-provided extras merged into metadata. */
+    metadata?: BillingEventMetadata;
+    /**
+     * Optional journal callbacks. The platform's heartbeat / retire /
+     * reconciler paths write a `billing_emit_attempts` row BEFORE
+     * invoking this emitter (so the audit row exists even if the
+     * emitter itself crashes), then pass `onSuccess` / `onFailure`
+     * callbacks here to transition the row on the HTTP response.
+     * `onFailure` is also invoked for early-return skip paths
+     * (missing accountOrigin / internalServiceToken / both
+     * subjects) — the audit row would otherwise sit at `pending`
+     * forever with no reconciler retry.
+     */
+    journal?: {
+        onSuccess?: () => Promise<void> | void;
+        onFailure?: (info: {
+            reason: 'http' | 'timeout' | 'error' | 'skip';
+            message: string;
+        }) => Promise<void> | void;
+    };
+}
+export declare function recordSandboxUptime(runtime: RuntimeRef, input: RecordSandboxUptimeInput): void;
+//# sourceMappingURL=record-sandbox-uptime.d.ts.map

package/dist/billing/usage/record-sandbox-uptime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-sandbox-uptime.d.ts","sourceRoot":"","sources":["../../../src/billing/usage/record-sandbox-uptime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAU,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAIN,KAAK,oBAAoB,EACzB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAErE,yFAAyF;AACzF,YAAY,EAAE,oBAAoB,EAAE,CAAC;AASrC,MAAM,WAAW,wBAAwB;IACxC,8EAA8E;IAC9E,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACzC;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAChD;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,+FAA+F;IAC/F,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;IACxD;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;IACxB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACvC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE;YAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;KAC/G,CAAC;CACF;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,wBAAwB,GAAG,IAAI,CAwG9F"}

package/dist/billing/usage/record-sandbox-uptime.js

@@ -0,0 +1,122 @@
+/**
+ * Record sandbox uptime against the host's billing subject.
+ *
+ * Why a separate emitter
+ * ----------------------
+ * `record-generation-usage.ts` posts to the user-cookie endpoint, which
+ * derives the billing subject from the authenticated session. Sandbox
+ * uptime ticks come from the platform service on a cron / heartbeat
+ * path with NO user session cookie attached — the bill needs to land
+ * against the host's `ownerType` / `ownerId`, not whoever happens to be
+ * signed in.
+ *
+ * This emitter targets the internal-service endpoint at
+ * `/api/billing/usage/record-internal`, which authenticates via
+ * `VIBES_INTERNAL_SERVICE_TOKEN` + `X-Vibes-User-Id` header and accepts
+ * an explicit `organizationId` for org-owned hosts.
+ *
+ * Design constraints (same as record-generation-usage.ts)
+ * - MUST NOT fail the heartbeat path. Always returns void; swallows
+ *   errors with structured log.
+ * - MUST be time-bounded. 500ms hard cap via AbortController.
+ */
+import { getLogger } from '@vibesdotdev/logging';
+import { settle } from '@vibesdotdev/kernel';
+import { deliveryFailure, deliveryFailureMessage, notifyJournal } from "./delivery.js";
+function log(runtime) {
+    return getLogger('account', runtime).child({ context: 'record-sandbox-uptime' });
+}
+const USAGE_RECORD_TIMEOUT_MS = 500;
+const SECONDS_PER_MINUTE = 60;
+export function recordSandboxUptime(runtime, input) {
+    if (!Number.isFinite(input.minutes) || input.minutes <= 0)
+        return;
+    if (!input.billingUserId && !input.organizationId) {
+        const message = 'neither-billing-user-nor-organization-set';
+        log(runtime).debug('recordSandboxUptime: skipping (' + message + ')', {
+            hostId: input.hostId,
+            reason: input.reason
+        });
+        // Transition the audit row to `failed` so the reconciler can
+        // observe it. If the env stays bad, this dead-letters after
+        // MAX_ATTEMPTS rather than sitting at `pending` indefinitely.
+        void notifyJournal(log(runtime), 'recordSandboxUptime', () => input.journal?.onFailure?.({ reason: 'skip', message }));
+        return;
+    }
+    if (!input.accountOrigin) {
+        const message = 'accountOrigin-not-configured';
+        log(runtime).debug('recordSandboxUptime: skipping (' + message + ')', {
+            hostId: input.hostId,
+            reason: input.reason
+        });
+        void notifyJournal(log(runtime), 'recordSandboxUptime', () => input.journal?.onFailure?.({ reason: 'skip', message }));
+        return;
+    }
+    const accountOrigin = input.accountOrigin;
+    if (!input.internalServiceToken) {
+        const message = 'internalServiceToken-not-configured';
+        log(runtime).debug('recordSandboxUptime: skipping (' + message + ')', {
+            hostId: input.hostId,
+            reason: input.reason
+        });
+        void notifyJournal(log(runtime), 'recordSandboxUptime', () => input.journal?.onFailure?.({ reason: 'skip', message }));
+        return;
+    }
+    const serviceHeaders = {
+        'Content-Type': 'application/json',
+        Accept: 'application/json',
+        Authorization: `Bearer ${input.internalServiceToken}`
+    };
+    const headers = input.billingUserId
+        ? { ...serviceHeaders, 'X-Vibes-User-Id': input.billingUserId }
+        : serviceHeaders;
+    const computeSeconds = input.minutes * SECONDS_PER_MINUTE;
+    const effectiveHardware = input.hardware ?? 'cloud';
+    const fetchBody = {
+        featureSlug: 'sandbox-uptime-minutes',
+        // `compute_second` matches the canonical CostBasisUnits enum.
+        // `gpu_second` is a separate enum value reserved for GPU-priced
+        // hosts; callers that know they're on a GPU sandbox should
+        // override `costBasis` with the per-GPU-second rate, but the
+        // unit key here stays `compute_second` for consistency with the
+        // host abstraction. (The pricing difference between CPU and GPU
+        // lives in `usdPerUnit`.)
+        measuredUnits: { compute_second: computeSeconds },
+        costBasis: input.costBasis,
+        hardware: effectiveHardware,
+        organizationId: input.organizationId ?? null,
+        metadata: {
+            hostId: input.hostId,
+            sandboxResourceId: input.sandboxResourceId ?? null,
+            reason: input.reason,
+            surface: 'platform.sandbox',
+            resourceId: input.sandboxResourceId ?? input.hostId,
+            minutes: input.minutes,
+            ...input.metadata
+        }
+    };
+    void settle(() => runtime.lifecycle.wait((signal) => fetch(`${accountOrigin.replace(/\/$/, '')}/api/billing/usage/record-internal`, {
+        method: 'POST',
+        headers,
+        body: JSON.stringify(fetchBody),
+        signal
+    }), { timeoutMs: USAGE_RECORD_TIMEOUT_MS, reason: 'account sandbox uptime usage record' })).then(async (delivered) => {
+        const failure = deliveryFailure(delivered);
+        if (!failure) {
+            await notifyJournal(log(runtime), 'recordSandboxUptime', input.journal?.onSuccess);
+            return;
+        }
+        if (failure.reason === 'http') {
+            log(runtime).warn('recordSandboxUptime: non-2xx from account', { hostId: input.hostId, status: failure.status });
+        }
+        else if (failure.reason === 'timeout') {
+            log(runtime).warn('recordSandboxUptime: timed out', { hostId: input.hostId, timeoutMs: USAGE_RECORD_TIMEOUT_MS });
+        }
+        else {
+            log(runtime).warn('recordSandboxUptime: fetch failed', { hostId: input.hostId, error: failure.error });
+        }
+        const message = deliveryFailureMessage(failure, USAGE_RECORD_TIMEOUT_MS);
+        await notifyJournal(log(runtime), 'recordSandboxUptime', () => input.journal?.onFailure?.({ reason: failure.reason, message }));
+    });
+}
+//# sourceMappingURL=record-sandbox-uptime.js.map

package/dist/billing/usage/record-sandbox-uptime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-sandbox-uptime.js","sourceRoot":"","sources":["../../../src/billing/usage/record-sandbox-uptime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAmB,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EACN,eAAe,EACf,sBAAsB,EACtB,aAAa,EAEb,MAAM,eAAe,CAAC;AAOvB,SAAS,GAAG,CAAC,OAAmB;IAC/B,OAAO,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AA+D9B,MAAM,UAAU,mBAAmB,CAAC,OAAmB,EAAE,KAA+B;IACvF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC;QAAE,OAAO;IAClE,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,2CAA2C,CAAC;QAC5D,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,iCAAiC,GAAG,OAAO,GAAG,GAAG,EAAE;YACrE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,6DAA6D;QAC7D,4DAA4D;QAC5D,8DAA8D;QAC9D,KAAK,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAC5D,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CACvD,CAAC;QACF,OAAO;IACR,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,8BAA8B,CAAC;QAC/C,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,iCAAiC,GAAG,OAAO,GAAG,GAAG,EAAE;YACrE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,KAAK,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAC5D,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CACvD,CAAC;QACF,OAAO;IACR,CAAC;IACD,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,qCAAqC,CAAC;QACtD,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,iCAAiC,GAAG,OAAO,GAAG,GAAG,EAAE;YACrE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,KAAK,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAC5D,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CACvD,CAAC;QACF,OAAO;IACR,CAAC;IAED,MAAM,cAAc,GAAG;QACtB,cAAc,EAAE,kBAAkB;QAClC,MAAM,EAAE,kBAAkB;QAC1B,aAAa,EAAE,UAAU,KAAK,CAAC,oBAAoB,EAAE;KACpB,CAAC;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa;QAClC,CAAC,CAAC,EAAE,GAAG,cAAc,EAAE,iBAAiB,EAAE,KAAK,CAAC,aAAa,EAAE;QAC/D,CAAC,CAAC,cAAc,CAAC;IAElB,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,GAAG,kBAAkB,CAAC;IAC1D,MAAM,iBAAiB,GAAiB,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC;IAClE,MAAM,SAAS,GAAG;QACjB,WAAW,EAAE,wBAAwB;QACrC,8DAA8D;QAC9D,gEAAgE;QAChE,2DAA2D;QAC3D,6DAA6D;QAC7D,gEAAgE;QAChE,gEAAgE;QAChE,0BAA0B;QAC1B,aAAa,EAAE,EAAE,cAAc,EAAE,cAAc,EAAE;QACjD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,iBAAiB;QAC3B,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;QAC5C,QAAQ,EAAE;YACT,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;YAClD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,kBAAkB;YAC3B,UAAU,EAAE,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,MAAM;YACnD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,KAAK,CAAC,QAAQ;SACjB;KACD,CAAC;IAEF,KAAK,MAAM,CAAC,GAAG,EAAE,CAChB,OAAO,CAAC,SAAS,CAAC,IAAI,CACrB,CAAC,MAAM,EAAE,EAAE,CACV,KAAK,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,oCAAoC,EAAE;QAC9E,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;QAC/B,MAAM;KACN,CAAC,EACH,EAAE,SAAS,EAAE,uBAAuB,EAAE,MAAM,EAAE,qCAAqC,EAAE,CACrF,CACD,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;QAC1B,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACnF,OAAO;QACR,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC/B,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,2CAA2C,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAClH,CAAC;aAAM,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACzC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnH,CAAC;aAAM,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACxG,CAAC;QACD,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;QACzE,MAAM,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAC7D,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAC/D,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/billing/usage/wait-timeout.d.ts

@@ -0,0 +1,7 @@
+/**
+ * True when `err` is the rejection `runtime.lifecycle.wait` raises at its
+ * deadline (`wait-timeout`) or a fetch abort. Shared by the usage emitters so
+ * a timed-out billing call is reported as a timeout, not a generic failure.
+ */
+export declare function isWaitTimeout<Failure>(err: Failure): boolean;
+//# sourceMappingURL=wait-timeout.d.ts.map

package/dist/billing/usage/wait-timeout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wait-timeout.d.ts","sourceRoot":"","sources":["../../../src/billing/usage/wait-timeout.ts"],"names":[],"mappings":"AAWA;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAU5D"}