@volter/twin-calcom 0.1.0

package/dist/client/calcom-mirror.css

@@ -0,0 +1,29 @@
+:root {
+  --bg: #0f1115;
+  --panel: #171a21;
+  --line: #262b35;
+  --text: #e6e9ef;
+  --muted: #9aa4b2;
+  --accent: #292929;
+  --ok: #2fae66;
+  --warn: #d9a334;
+  --bad: #d24b4b;
+}
+* { box-sizing: border-box; }
+body { margin: 0; font-family: -apple-system, system-ui, sans-serif; background: var(--bg); color: var(--text); }
+.app { display: grid; grid-template-columns: 200px 1fr; grid-template-rows: 52px 1fr; min-height: 100vh; }
+.topbar { grid-column: 1 / 3; display: flex; align-items: center; padding: 0 16px; border-bottom: 1px solid var(--line); background: var(--panel); }
+.brand { font-weight: 700; }
+.sidebar { border-right: 1px solid var(--line); padding: 12px 8px; background: var(--panel); }
+.nav-item { display: block; width: 100%; text-align: left; background: none; border: none; color: var(--muted); padding: 8px 10px; border-radius: 6px; cursor: pointer; font-size: 14px; }
+.nav-item.active, .nav-item:hover { background: var(--accent); color: var(--text); }
+.content { padding: 20px; overflow: auto; }
+table { width: 100%; border-collapse: collapse; }
+th { text-align: left; color: var(--muted); font-size: 12px; text-transform: uppercase; padding: 8px 10px; border-bottom: 1px solid var(--line); }
+td { padding: 10px; border-bottom: 1px solid var(--line); font-size: 14px; }
+.cell-title { font-weight: 600; }
+.pill { padding: 2px 8px; border-radius: 999px; font-size: 12px; }
+.pill-ok { background: rgba(47,174,102,0.18); color: var(--ok); }
+.pill-warn { background: rgba(217,163,52,0.18); color: var(--warn); }
+.pill-bad { background: rgba(210,75,75,0.18); color: var(--bad); }
+.empty { color: var(--muted); padding: 24px; }

package/dist/client/calcom-mirror.d.ts

@@ -0,0 +1,13 @@
+import { type CalcomRow } from '../src/calcom-mirror-ui.js';
+/** The bookings table — one `list-row` landmark per booking, carrying its uid. */
+export declare function BookingsList({ rows }: {
+    rows: CalcomRow[];
+}): import("react").JSX.Element;
+/** Booking detail — one `list-row` per attendee/host, plus a reschedule-history line. */
+export declare function BookingDetail({ rows }: {
+    rows: CalcomRow[];
+}): import("react").JSX.Element;
+/** Event types table — one `list-row` per event type. */
+export declare function EventTypesList({ rows }: {
+    rows: CalcomRow[];
+}): import("react").JSX.Element;

package/dist/client/calcom-mirror.js

@@ -0,0 +1,61 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+// Cal.com mirror — React/TSX dashboard client. Renders the twin's bookings + event types
+// by fetching the twin's OWN v2 REST API on the same origin (/v2/bookings, /v2/event-types).
+// API↔UI parity: the screen shows real twin state, not a hardcoded shell.
+import { createRoot } from 'react-dom/client';
+import { useEffect, useState } from 'react';
+import { attendeeLabel, bookingTone, formatWindow } from "../src/calcom-mirror-ui.js";
+// WHERE THIS MIRROR LIVES. Served at a vendor root the base is '' (fetches are root-relative, as
+// before); served under a path prefix with a <base> tag every read and write resolves inside that
+// prefix instead of escaping it.
+const WIRE_BASE = typeof document === 'undefined' || document.querySelector('base[href]') === null ? '' : new URL('.', document.baseURI).pathname.replace(/\/$/, '');
+// Map a tone to a STATIC literal class name (a template-literal class is erased by the
+// minifier, so `pill-${tone}` would vanish from the bundle — assert these instead).
+const PILL_CLASS = { ok: 'pill pill-ok', warn: 'pill pill-warn', bad: 'pill pill-bad', '': 'pill' };
+const SECTIONS = [
+    { key: 'bookings', label: 'Bookings', path: '/v2/bookings' },
+    { key: 'event-types', label: 'Event Types', path: '/v2/event-types' },
+];
+// Unwrap the v2 envelope ({ status, data }) to its data array.
+async function fetchData(path) {
+    const res = await fetch(`${WIRE_BASE}${path}`);
+    const body = (await res.json());
+    return Array.isArray(body.data) ? body.data : [];
+}
+/** The bookings table — one `list-row` landmark per booking, carrying its uid. */
+export function BookingsList({ rows }) {
+    if (rows.length === 0)
+        return _jsx("div", { className: "empty", children: "No bookings yet." });
+    return (_jsxs("table", { className: "bookings-table", children: [_jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { children: "Title" }), _jsx("th", { children: "When" }), _jsx("th", { children: "Attendee" }), _jsx("th", { children: "Status" })] }) }), _jsx("tbody", { children: rows.map((b) => (_jsxs("tr", { className: "list-row", "data-uid": b.uid, children: [_jsx("td", { className: "cell-title", children: b.title }), _jsx("td", { className: "cell-when", children: formatWindow(b.start, b.end) }), _jsx("td", { className: "cell-attendee", children: attendeeLabel(b.attendees) }), _jsx("td", { children: _jsx("span", { className: PILL_CLASS[bookingTone(b.status)], children: b.status }) })] }, b.uid))) })] }));
+}
+/** Booking detail — one `list-row` per attendee/host, plus a reschedule-history line. */
+export function BookingDetail({ rows }) {
+    const b = rows[0];
+    if (!b)
+        return _jsx("div", { className: "empty", children: "No booking." });
+    const attendees = Array.isArray(b.attendees) ? b.attendees : [];
+    const hosts = Array.isArray(b.hosts) ? b.hosts : [];
+    const people = [
+        ...hosts.map((h) => ({ role: 'host', name: h.name, email: h.email ?? '', id: `host-${h.id ?? h.name}` })),
+        ...attendees.map((a) => ({ role: 'attendee', name: a.name, email: a.email, id: `att-${a.email}` })),
+    ];
+    return (_jsxs("section", { className: "booking-detail", "data-uid": b.uid, children: [_jsx("h2", { className: "detail-title", children: b.title }), _jsx("div", { className: "detail-when", children: formatWindow(b.start, b.end) }), _jsx("div", { children: _jsx("span", { className: PILL_CLASS[bookingTone(b.status)], children: b.status }) }), _jsx("table", { className: "people-table", children: _jsx("tbody", { children: people.map((p) => (_jsxs("tr", { className: "list-row", "data-pid": p.id, children: [_jsx("td", { className: "cell-role", children: p.role }), _jsx("td", { className: "cell-name", children: String(p.name ?? '') }), _jsx("td", { className: "cell-email", children: String(p.email ?? '') })] }, p.id))) }) }), b.fromReschedule ? _jsxs("div", { className: "reschedule-history", children: ["rescheduled from ", String(b.fromReschedule)] }) : null] }));
+}
+/** Event types table — one `list-row` per event type. */
+export function EventTypesList({ rows }) {
+    if (rows.length === 0)
+        return _jsx("div", { className: "empty", children: "No event types yet." });
+    return (_jsxs("table", { className: "evt-table", children: [_jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { children: "Title" }), _jsx("th", { children: "Slug" }), _jsx("th", { children: "Length" })] }) }), _jsx("tbody", { children: rows.map((e) => (_jsxs("tr", { className: "list-row", "data-id": e.id, children: [_jsx("td", { className: "cell-title", children: e.title }), _jsx("td", { children: e.slug }), _jsxs("td", { children: [e.lengthInMinutes, " min"] })] }, e.id))) })] }));
+}
+function App() {
+    const [section, setSection] = useState('bookings');
+    const [rows, setRows] = useState([]);
+    useEffect(() => {
+        const sec = SECTIONS.find((s) => s.key === section);
+        fetchData(sec.path).then(setRows).catch(() => setRows([]));
+    }, [section]);
+    return (_jsxs("div", { className: "app", children: [_jsx("header", { className: "topbar", children: _jsx("span", { className: "brand", children: "Cal.com twin" }) }), _jsx("nav", { className: "sidebar", children: SECTIONS.map((s) => (_jsx("button", { className: `nav-item${s.key === section ? ' active' : ''}`, onClick: () => setSection(s.key), children: s.label }, s.key))) }), _jsx("main", { className: "content", children: section === 'bookings' ? _jsx(BookingsList, { rows: rows }) : _jsx(EventTypesList, { rows: rows }) })] }));
+}
+const el = typeof document !== 'undefined' ? document.getElementById('root') : null;
+if (el)
+    createRoot(el).render(_jsx(App, {}));

package/dist/client/calcom-mirror.tsx

@@ -0,0 +1,125 @@
+// Cal.com mirror — React/TSX dashboard client. Renders the twin's bookings + event types
+// by fetching the twin's OWN v2 REST API on the same origin (/v2/bookings, /v2/event-types).
+// API↔UI parity: the screen shows real twin state, not a hardcoded shell.
+import { createRoot } from 'react-dom/client';
+import { useEffect, useState } from 'react';
+import { attendeeLabel, bookingTone, formatWindow, type CalcomRow, type PillTone } from '../src/calcom-mirror-ui.ts';
+
+// WHERE THIS MIRROR LIVES. Served at a vendor root the base is '' (fetches are root-relative, as
+// before); served under a path prefix with a <base> tag every read and write resolves inside that
+// prefix instead of escaping it.
+const WIRE_BASE = typeof document === 'undefined' || document.querySelector('base[href]') === null ? '' : new URL('.', document.baseURI).pathname.replace(/\/$/, '');
+
+// Map a tone to a STATIC literal class name (a template-literal class is erased by the
+// minifier, so `pill-${tone}` would vanish from the bundle — assert these instead).
+const PILL_CLASS: Record<PillTone, string> = { ok: 'pill pill-ok', warn: 'pill pill-warn', bad: 'pill pill-bad', '': 'pill' };
+
+const SECTIONS = [
+  { key: 'bookings', label: 'Bookings', path: '/v2/bookings' },
+  { key: 'event-types', label: 'Event Types', path: '/v2/event-types' },
+] as const;
+type SectionKey = (typeof SECTIONS)[number]['key'];
+
+// Unwrap the v2 envelope ({ status, data }) to its data array.
+async function fetchData(path: string): Promise<CalcomRow[]> {
+  const res = await fetch(`${WIRE_BASE}${path}`);
+  const body = (await res.json()) as { data?: unknown };
+  return Array.isArray(body.data) ? (body.data as CalcomRow[]) : [];
+}
+
+/** The bookings table — one `list-row` landmark per booking, carrying its uid. */
+export function BookingsList({ rows }: { rows: CalcomRow[] }) {
+  if (rows.length === 0) return <div className="empty">No bookings yet.</div>;
+  return (
+    <table className="bookings-table">
+      <thead>
+        <tr><th>Title</th><th>When</th><th>Attendee</th><th>Status</th></tr>
+      </thead>
+      <tbody>
+        {rows.map((b) => (
+          <tr className="list-row" data-uid={b.uid} key={b.uid}>
+            <td className="cell-title">{b.title}</td>
+            <td className="cell-when">{formatWindow(b.start, b.end)}</td>
+            <td className="cell-attendee">{attendeeLabel(b.attendees)}</td>
+            <td><span className={PILL_CLASS[bookingTone(b.status)]}>{b.status}</span></td>
+          </tr>
+        ))}
+      </tbody>
+    </table>
+  );
+}
+
+/** Booking detail — one `list-row` per attendee/host, plus a reschedule-history line. */
+export function BookingDetail({ rows }: { rows: CalcomRow[] }) {
+  const b = rows[0];
+  if (!b) return <div className="empty">No booking.</div>;
+  const attendees = Array.isArray(b.attendees) ? b.attendees : [];
+  const hosts = Array.isArray(b.hosts) ? b.hosts : [];
+  const people = [
+    ...hosts.map((h: Record<string, unknown>) => ({ role: 'host', name: h.name, email: (h as { email?: string }).email ?? '', id: `host-${h.id ?? h.name}` })),
+    ...attendees.map((a: Record<string, unknown>) => ({ role: 'attendee', name: a.name, email: a.email, id: `att-${a.email}` })),
+  ];
+  return (
+    <section className="booking-detail" data-uid={b.uid}>
+      <h2 className="detail-title">{b.title}</h2>
+      <div className="detail-when">{formatWindow(b.start, b.end)}</div>
+      <div><span className={PILL_CLASS[bookingTone(b.status)]}>{b.status}</span></div>
+      <table className="people-table">
+        <tbody>
+          {people.map((p) => (
+            <tr className="list-row" data-pid={p.id} key={p.id}>
+              <td className="cell-role">{p.role}</td>
+              <td className="cell-name">{String(p.name ?? '')}</td>
+              <td className="cell-email">{String(p.email ?? '')}</td>
+            </tr>
+          ))}
+        </tbody>
+      </table>
+      {b.fromReschedule ? <div className="reschedule-history">rescheduled from {String(b.fromReschedule)}</div> : null}
+    </section>
+  );
+}
+
+/** Event types table — one `list-row` per event type. */
+export function EventTypesList({ rows }: { rows: CalcomRow[] }) {
+  if (rows.length === 0) return <div className="empty">No event types yet.</div>;
+  return (
+    <table className="evt-table">
+      <thead><tr><th>Title</th><th>Slug</th><th>Length</th></tr></thead>
+      <tbody>
+        {rows.map((e) => (
+          <tr className="list-row" data-id={e.id} key={e.id}>
+            <td className="cell-title">{e.title}</td>
+            <td>{e.slug}</td>
+            <td>{e.lengthInMinutes} min</td>
+          </tr>
+        ))}
+      </tbody>
+    </table>
+  );
+}
+
+function App() {
+  const [section, setSection] = useState<SectionKey>('bookings');
+  const [rows, setRows] = useState<CalcomRow[]>([]);
+  useEffect(() => {
+    const sec = SECTIONS.find((s) => s.key === section)!;
+    fetchData(sec.path).then(setRows).catch(() => setRows([]));
+  }, [section]);
+  return (
+    <div className="app">
+      <header className="topbar"><span className="brand">Cal.com twin</span></header>
+      <nav className="sidebar">
+        {SECTIONS.map((s) => (
+          <button key={s.key} className={`nav-item${s.key === section ? ' active' : ''}`} onClick={() => setSection(s.key)}>{s.label}</button>
+        ))}
+      </nav>
+      <main className="content">
+        {section === 'bookings' ? <BookingsList rows={rows} /> : <EventTypesList rows={rows} />}
+      </main>
+    </div>
+  );
+}
+
+const el = typeof document !== 'undefined' ? document.getElementById('root') : null;
+if (el) createRoot(el).render(<App />);

package/dist/src/calcom-budget.d.ts

@@ -0,0 +1,52 @@
+import { RateBudget, type RateBudgetDeclaration, type RateBudgetOptions, type RateBudgetReservation, type RateBudgetSnapshot } from '@volter/world-core';
+/** Rolling window, in ms. Spend older than this is pruned. */
+export declare const CALCOM_BUDGET_WINDOW_MS = 60000;
+/**
+ * Weighted units allowed inside one window. 60/60s = 60 calls a minute at the default weight —
+ * half Cal.com's documented 120 requests/minute per API key.
+ */
+export declare const CALCOM_BUDGET_CEILING = 60;
+/** Seconds. A `Retry-After` above this means the key is throttled hard — fail loudly, don't sleep. */
+export declare const CALCOM_BUDGET_MAX_RETRY_AFTER_S = 300;
+/** Per-call cost, keyed by `"<METHOD> <path>"`. See the header for what is documented vs. judged. */
+export declare const CALCOM_CALL_WEIGHTS: {
+    /** `POST /bookings` — sends e-mail, writes real calendars, fires webhooks. Human blast radius. */
+    readonly book: 3;
+    /** `GET /slots` — availability computed across every connected calendar. The expensive read. */
+    readonly slots: 2;
+    /** Everything else: booking/event-type reads, updates, cancellations, schedules, me. */
+    readonly other: 1;
+};
+/** THE PACK'S DECLARATION — pure data, the only Cal.com-specific thing in the whole budget. */
+export declare const CALCOM_RATE_BUDGET: RateBudgetDeclaration;
+/**
+ * Price one call. The key is `"<METHOD> <path>"` (the v2 path as the connector states it, without
+ * the `/v2` prefix the live executor adds) with the query string split off, so a rule can price by
+ * method without the kernel knowing anything about Cal.com. An unclassified endpoint still costs
+ * `defaultWeight` — nothing is ever free.
+ */
+export declare function calcomCallWeight(method: string, path: string): number;
+/** Where Cal.com's ledger lives. Token-keyed and cwd-independent by default (the limit is per API
+ *  key, so a cwd-scoped ledger would hand the same key a fresh allowance in every checkout,
+ *  worktree and CI matrix leg); pass `root` to opt into world-scoped accounting. */
+export declare function calcomBudgetPath(opts?: {
+    root?: string;
+    token?: string;
+} | string): string;
+/** Construction options for Cal.com's budget. The vendor is fixed; everything else may only TIGHTEN. */
+export type CalcomBudgetOptions = Omit<RateBudgetOptions, 'vendor'>;
+/**
+ * Cal.com's budget — the shared kernel guard bound to this vendor's declaration. A real subclass,
+ * not an alias, so `budget instanceof CalcomBudget` in `liveCalcomExecute` means "a budget that
+ * accounts against CAL.COM's ledger under CAL.COM's ceiling": another vendor's `RateBudget` (with
+ * its own, possibly larger, ceiling) is NOT assignable there.
+ */
+export declare class CalcomBudget extends RateBudget {
+    constructor(opts?: CalcomBudgetOptions);
+}
+/** The typed refusal. One error class shared with every other vendor's budget; `err.vendor` says
+ *  which one refused, and `err.kind` says why. */
+export { RateBudgetError as CalcomBudgetError } from '@volter/world-core';
+export type { RateBudgetErrorKind as CalcomBudgetErrorKind } from '@volter/world-core';
+export type CalcomBudgetReservation = RateBudgetReservation;
+export type CalcomBudgetSnapshot = RateBudgetSnapshot;

package/dist/src/calcom-budget.js

@@ -0,0 +1,145 @@
+// Cal.com's CLIENT-SIDE RATE BUDGET — the pack's DECLARATION (the numbers) plus the thin typed
+// bindings `liveCalcomExecute` uses. The MECHANISM — the durable token-keyed ledger, the rolling
+// window, reserve-under-lock, the `Retry-After`/429 cooldown, fail-CLOSED on a corrupt ledger —
+// lives ONCE in the vendor-agnostic kernel (`@volter/world-core` → `rateBudget.ts`). Read that module's
+// header for the full rationale AND for the honest list of what the guard does not guarantee (an
+// injected clock or ledger path still defeats it — it guards carelessness, not malice).
+//
+// ── WHY THIS EXISTS ─────────────────────────────────────────────────────────────────────────
+// A real ~4.5-DAY vendor lockout (Figma, 2026-07-25) happened because raw API calls were made
+// outside the pack's connector — no cache, no batching, no ceiling. Discipline only binds the code
+// that follows it; a BUDGET binds the code that does not.
+//
+// ── HOW THE CEILING WAS CHOSEN ──────────────────────────────────────────────────────────────
+// Cal.com DOES publish a scalar limit, so this models the real thing rather than guessing. From
+// https://cal.com/docs/api-reference/v2/introduction (read 2026-07-26): API-key authentication is
+// limited to 120 requests per minute (raisable on request); the same 120/minute is the default for
+// unauthenticated traffic.
+//
+// The `X-RateLimit-Limit` / `-Remaining` / `-Reset` response headers this guard reads are NOT on that
+// page — they are the conventional spelling, matched structurally by the kernel, and are read IF
+// PRESENT and never assumed. (§9 corrected an earlier line here that attributed them to the cited
+// page, 2026-07-26. Do not turn an observation into a citation.)
+//
+// The ceiling is 60 weighted units per 60s — 60 calls a minute at the default weight, HALF the
+// documented 120/minute, so the 60-second AVERAGE stays under the vendor's own even before any
+// weighting. It is more permissive than the kernel's undeclared fallback (30 calls/min) precisely
+// because 120/min is documented; without that number it would not be.
+//
+// It bounds the average; it does NOT pace (the kernel refuses, it never sleeps — see its header).
+// Cal.com's window is also a minute, so the shapes line up well here, but an intra-second burst can
+// still reach the vendor first; the backstop for that is the cooldown armed from the 429 /
+// `X-RateLimit-Remaining: 0`.
+//
+// ── HOW THE WEIGHTS WERE CHOSEN (and what is a judgement call) ───────────────────────────────
+// Cal.com counts REQUESTS, so weight 1 is the faithful price and that is what reads get. Two
+// deliberate exceptions, both judgement calls rather than published costs:
+//   • `POST /bookings` costs 3. A booking is not a database row — it sends invitation e-mail,
+//     writes to the organiser's and attendees' real connected calendars, and fires webhooks. A
+//     runaway create loop is the failure mode with a HUMAN blast radius, not just a throttle.
+//   • `GET /slots` costs 2. Availability is computed across every connected calendar for a date
+//     range, so it is the expensive read, and it is the one a naive UI polls in a loop.
+import { declareRateBudget, rateBudgetPath, rateBudgetWeight, RateBudget, } from '@volter/world-core';
+const VENDOR = 'calcom';
+/** Rolling window, in ms. Spend older than this is pruned. */
+export const CALCOM_BUDGET_WINDOW_MS = 60_000;
+/**
+ * Weighted units allowed inside one window. 60/60s = 60 calls a minute at the default weight —
+ * half Cal.com's documented 120 requests/minute per API key.
+ */
+export const CALCOM_BUDGET_CEILING = 60;
+/** Seconds. A `Retry-After` above this means the key is throttled hard — fail loudly, don't sleep. */
+export const CALCOM_BUDGET_MAX_RETRY_AFTER_S = 300;
+/** Per-call cost, keyed by `"<METHOD> <path>"`. See the header for what is documented vs. judged. */
+export const CALCOM_CALL_WEIGHTS = {
+    /** `POST /bookings` — sends e-mail, writes real calendars, fires webhooks. Human blast radius. */
+    book: 3,
+    /** `GET /slots` — availability computed across every connected calendar. The expensive read. */
+    slots: 2,
+    /** Everything else: booking/event-type reads, updates, cancellations, schedules, me. */
+    other: 1,
+};
+/** THE PACK'S DECLARATION — pure data, the only Cal.com-specific thing in the whole budget. */
+export const CALCOM_RATE_BUDGET = {
+    windowMs: CALCOM_BUDGET_WINDOW_MS,
+    ceiling: CALCOM_BUDGET_CEILING,
+    defaultWeight: CALCOM_CALL_WEIGHTS.other,
+    maxRetryAfterSeconds: CALCOM_BUDGET_MAX_RETRY_AFTER_S,
+    rules: [
+        { match: '^POST /bookings$', weight: CALCOM_CALL_WEIGHTS.book },
+        { match: '^GET /slots', weight: CALCOM_CALL_WEIGHTS.slots },
+    ],
+    reason: 'Cal.com documents 120 requests/minute per API key (cal.com/docs/api-reference/v2/introduction, ' +
+        'read 2026-07-26; the same 120/min is the unauthenticated default, and it is raisable on ' +
+        'request). That page documents no response headers; the X-RateLimit-* names the guard reads are ' +
+        'the conventional spelling, read if present and never assumed. 60 weighted units / 60s is 60 ' +
+        'calls a minute — HALF the documented 120, so the 60s average stays ' +
+        "under the vendor's own. It is deliberately more permissive than the kernel's undeclared " +
+        'fallback (30 calls/min) BECAUSE 120/min is documented; without that number it would not be. ' +
+        'POST /bookings costs 3 (it sends e-mail, writes real connected calendars and fires webhooks — ' +
+        'a human blast radius, not just a throttle) and GET /slots costs 2 (availability computed across ' +
+        'every connected calendar, and the endpoint a naive UI polls in a loop) — judgement calls, not ' +
+        'published costs. The window bounds the 60s AVERAGE and does not pace; the 429 / ' +
+        '`X-RateLimit-Remaining: 0` cooldown is the backstop for a sub-second burst.',
+};
+// Declared at module load, so merely importing this module (which `calcom-connector.ts` does) is
+// enough to arm the real ceiling. `RateBudget` reads its policy live precisely so this declaration
+// takes effect the moment it lands, and constructing through the subclass below (which imports this
+// module) is what makes the ordering a non-issue in practice.
+declareRateBudget(VENDOR, CALCOM_RATE_BUDGET);
+/**
+ * Price one call. The key is `"<METHOD> <path>"` (the v2 path as the connector states it, without
+ * the `/v2` prefix the live executor adds) with the query string split off, so a rule can price by
+ * method without the kernel knowing anything about Cal.com. An unclassified endpoint still costs
+ * `defaultWeight` — nothing is ever free.
+ */
+export function calcomCallWeight(method, path) {
+    const { bare, query } = splitQuery(path);
+    // UPPER-CASE the method: `fetch` normalizes a known lowercase method before sending, so
+    // `execute('post', …)` really does issue a POST and must be priced as one.
+    return rateBudgetWeight(VENDOR, `${String(method).toUpperCase()} ${bare}`, query);
+}
+/**
+ * `/v1/x?a=1` -> `{ bare: '/v1/x', query: { a: '1' } }`. Rules match the path; `whenQuery*` the query.
+ *
+ * NORMALIZED, because the anchored rules are otherwise trivially evaded (§9 finding, 2026-07-26):
+ * `fetch` upper-cases a known method before sending, so `execute('post', …)` issues a real WRITE
+ * that a `^POST ` rule would price as a read; and a trailing slash makes a path miss a `$` anchor
+ * while most routers treat it as the same endpoint. Both are input variations, not attacks, and
+ * either one silently voids the "expensive endpoints are priced up" claim the ceiling rests on.
+ */
+function splitQuery(path) {
+    const at = path.indexOf('?');
+    const query = {};
+    if (at !== -1)
+        for (const [k, v] of new URLSearchParams(path.slice(at + 1)))
+            query[k] = v;
+    const raw = at === -1 ? path : path.slice(0, at);
+    // Collapse a trailing slash, but never turn the root path into the empty string.
+    const bare = raw.length > 1 && raw.endsWith('/') ? raw.replace(/\/+$/, '') : raw;
+    return { bare, query };
+}
+/** Where Cal.com's ledger lives. Token-keyed and cwd-independent by default (the limit is per API
+ *  key, so a cwd-scoped ledger would hand the same key a fresh allowance in every checkout,
+ *  worktree and CI matrix leg); pass `root` to opt into world-scoped accounting. */
+export function calcomBudgetPath(opts = {}) {
+    const o = typeof opts === 'string' ? { root: opts } : opts;
+    // VENDOR spread LAST: a loosely-typed `{ vendor: 'other', … }` slipping through (TypeScript's
+    // excess-property check only catches object literals) must not redirect this pack's ledger to
+    // another vendor's file.
+    return rateBudgetPath({ ...o, vendor: VENDOR });
+}
+/**
+ * Cal.com's budget — the shared kernel guard bound to this vendor's declaration. A real subclass,
+ * not an alias, so `budget instanceof CalcomBudget` in `liveCalcomExecute` means "a budget that
+ * accounts against CAL.COM's ledger under CAL.COM's ceiling": another vendor's `RateBudget` (with
+ * its own, possibly larger, ceiling) is NOT assignable there.
+ */
+export class CalcomBudget extends RateBudget {
+    constructor(opts = {}) {
+        super({ ...opts, vendor: VENDOR });
+    }
+}
+/** The typed refusal. One error class shared with every other vendor's budget; `err.vendor` says
+ *  which one refused, and `err.kind` says why. */
+export { RateBudgetError as CalcomBudgetError } from '@volter/world-core';

package/dist/src/calcom-capabilities.d.ts

@@ -0,0 +1,3 @@
+import { type CapabilityReport, type CapabilitySpec } from '@volter/world-tooling';
+export declare const CALCOM_CAPABILITIES: CapabilitySpec[];
+export declare function calcomCapabilities(): Promise<CapabilityReport>;