instar 1.3.782 → 1.3.783

package/dist/core/MeteredSpendGate.d.ts

@@ -0,0 +1,119 @@
+/**
+ * MeteredSpendGate — the O(1), never-cached, FAIL-CLOSED money gate of the
+ * Routing Control Room (docs/specs/routing-control-room-spend-alerts.md,
+ * Increment B, Layer 3).
+ *
+ * Before a metered call: read committed FRESH from the MeteredSpendLedger, read
+ * the door's CANONICAL VALIDATED price (never the observed cache, never the
+ * overlay), compute the worst-case reserve at BASE price (no subsidy/credit),
+ * and refuse when `committed + estCost > cap` (strict `>`). FAIL CLOSED on
+ * EVERY uncertainty — that is the entire safety posture:
+ *   not-live · frozen · no-cap-slice · lease-liveness-unconfirmed ·
+ *   unbounded-reservation · unknown-price · implausible-price ·
+ *   stale-price-fail-closed · invalid-cap · cap-exceeded · ledger-error
+ *
+ * Authority shape (signal-vs-authority): deterministic ARITHMETIC authority at
+ * the metered admission point only. A refusal is a swap-tail ADVANCE for the
+ * router (the chain falls to a free door) — never a chain kill (LF-A2).
+ *
+ * Structural exclusions (unit-tested):
+ *  - reads NO `feature_metrics`, NO provider-report store, NO observed price
+ *    cache, NO subsidy/credit input — only the ledger, the canonical manifest
+ *    meta/points, and the PIN caps store.
+ *
+ * Wiring status (FD-11, honest): the metered dispatch that CALLS this gate is
+ * out-of-scope in-flight S4 work; the gate is fully unit-testable against a
+ * stub dispatch, and go-live remains refused until the FD-11 release-gate
+ * preconditions are met. Nothing in Increment B routes real money.
+ */
+import type { MeteredSpendLedger } from './MeteredSpendLedger.js';
+import type { RoutingPriceAuthority } from './routingPriceAuthority.js';
+import type { RoutingSpendCapsStore } from './RoutingSpendCapsStore.js';
+/**
+ * Per-provider price plausibility floors, USD per MILLION tokens — CODE-DEFINED
+ * constants, deliberately not config (A-M5/S-F1: a Bearer-writable surface must
+ * never influence a gate-consumed price value). A canonical point BELOW its
+ * provider's floor is treated as a typo → `implausible-price` → fail closed.
+ */
+export declare const PROVIDER_PRICE_FLOORS_PER_MTOK: Readonly<Record<string, {
+    inPerMtok: number;
+    outPerMtok: number;
+}>>;
+/** How stale the metered-lease self-confirmation may be before the holder self-fences (N-2). MUST stay strictly shorter than the mesh-death threshold. */
+export declare const LEASE_LIVENESS_WINDOW_MS = 60000;
+export type MoneyGateRefusalReason = 'not-live' | 'frozen' | 'no-cap-slice' | 'lease-liveness-unconfirmed' | 'unbounded-reservation' | 'unknown-price' | 'implausible-price' | 'stale-price-fail-closed' | 'invalid-cap' | 'cap-exceeded' | 'ledger-error';
+/** A cap/uncertainty refusal — the router treats it as a swap-tail ADVANCE, never a chain kill. */
+export declare class MoneyGateRefusal extends Error {
+    reason: MoneyGateRefusalReason;
+    detail: string;
+    keyRef?: string | undefined;
+    door?: string | undefined;
+    constructor(reason: MoneyGateRefusalReason, detail: string, keyRef?: string | undefined, door?: string | undefined);
+}
+export interface AdmitRequest {
+    door: string;
+    modelId: string;
+    /** Prompt tokens (estimated or counted). Cached tokens reserve as FULL input (FD-19) — no cached discount at reserve time. */
+    inputTokens: number;
+    /** REQUIRED bounded output ceiling — the metered request MUST set max_tokens (A2-4). */
+    maxOutputTokens: number | undefined;
+}
+export interface AdmitResult {
+    reserveId: string;
+    keyRef: string;
+    reserveUsd: number;
+    /** The booking price actually used (canonical base or conservative-max under stale policy). */
+    bookedInPerMtok: number;
+    bookedOutPerMtok: number;
+    committedLifetimeUsd: number;
+    committedDayUsd: number;
+}
+export interface MeteredSpendGateOptions {
+    ledger: MeteredSpendLedger;
+    prices: RoutingPriceAuthority;
+    capsStore: RoutingSpendCapsStore;
+    /** This machine's id — compared against the go-live designation (FD-13). */
+    machineId: string;
+    /**
+     * POSITIVE re-confirmation of this machine's metered-lease designation against
+     * the pool: ms since the last successful confirmation, or null when never/failed.
+     * A single-machine agent trivially self-confirms (return 0).
+     */
+    leaseConfirmedAgoMs: () => number | null;
+    now?: () => number;
+}
+export declare class MeteredSpendGate {
+    private readonly d;
+    private readonly now;
+    constructor(opts: MeteredSpendGateOptions);
+    /**
+     * Admit-or-refuse a metered call, booking the worst-case reserve on admit.
+     * Every uncertainty throws MoneyGateRefusal (fail closed).
+     */
+    admit(req: AdmitRequest): Promise<AdmitResult>;
+    /**
+     * The gate-eligible price for a (door, model): the CANONICAL as-of point,
+     * validated + plausibility-floored; under a stale SLA the door's staleMode
+     * applies (default book-conservative-max — spend continues, never under-books).
+     */
+    private gatePrice;
+    private plausible;
+    /**
+     * Settle helpers for the (future) metered dispatch seam: ALL no-charge outcomes
+     * force-settle $0 (A-B2) unless tokens were demonstrably returned; a 200 books
+     * actual from the per-door BILLED-token mapping (erring HIGH), or worst-case
+     * when the billed basis cannot be confirmed.
+     */
+    settleActual(keyRef: string, reserveId: string, actualUsd: number): Promise<void>;
+    settleNoCharge(keyRef: string, reserveId: string): Promise<void>;
+}
+/**
+ * Per-door BILLED-token mapping (Layer 3): which response fields mean "billed
+ * output" for each metered door — Gemini bills thinking tokens as output
+ * (candidatesTokenCount can EXCLUDE them); OpenRouter/Groq bill
+ * completion_tokens. A response whose billed basis cannot be confirmed from the
+ * mapping settles at the WORST-CASE estimate, never a lower unverified field.
+ * Named + exported so the metered dispatch seam and the tests share ONE truth.
+ */
+export declare function billedOutputTokens(door: string, usage: Record<string, unknown> | undefined): number | null;
+//# sourceMappingURL=MeteredSpendGate.d.ts.map

package/dist/core/MeteredSpendGate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MeteredSpendGate.d.ts","sourceRoot":"","sources":["../../src/core/MeteredSpendGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAiB,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,qBAAqB,EAAqB,MAAM,4BAA4B,CAAC;AAC3F,OAAO,KAAK,EAAE,qBAAqB,EAAiB,MAAM,4BAA4B,CAAC;AAEvF;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAI9G,CAAC;AAEF,0JAA0J;AAC1J,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C,MAAM,MAAM,sBAAsB,GAC9B,UAAU,GACV,QAAQ,GACR,cAAc,GACd,4BAA4B,GAC5B,uBAAuB,GACvB,eAAe,GACf,mBAAmB,GACnB,yBAAyB,GACzB,aAAa,GACb,cAAc,GACd,cAAc,CAAC;AAEnB,mGAAmG;AACnG,qBAAa,gBAAiB,SAAQ,KAAK;IAEhC,MAAM,EAAE,sBAAsB;IAC9B,MAAM,EAAE,MAAM;IACd,MAAM,CAAC,EAAE,MAAM;IACf,IAAI,CAAC,EAAE,MAAM;gBAHb,MAAM,EAAE,sBAAsB,EAC9B,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,IAAI,CAAC,EAAE,MAAM,YAAA;CAKvB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,8HAA8H;IAC9H,WAAW,EAAE,MAAM,CAAC;IACpB,wFAAwF;IACxF,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,+FAA+F;IAC/F,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,SAAS,EAAE,qBAAqB,CAAC;IACjC,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,mBAAmB,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAA0B;IAC5C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,IAAI,EAAE,uBAAuB;IAKzC;;;OAGG;IACG,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;IA6EpD;;;;OAIG;IACH,OAAO,CAAC,SAAS;IAyBjB,OAAO,CAAC,SAAS;IAYjB;;;;;OAKG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjF,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGvE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAyB1G"}

package/dist/core/MeteredSpendGate.js

@@ -0,0 +1,228 @@
+/**
+ * MeteredSpendGate — the O(1), never-cached, FAIL-CLOSED money gate of the
+ * Routing Control Room (docs/specs/routing-control-room-spend-alerts.md,
+ * Increment B, Layer 3).
+ *
+ * Before a metered call: read committed FRESH from the MeteredSpendLedger, read
+ * the door's CANONICAL VALIDATED price (never the observed cache, never the
+ * overlay), compute the worst-case reserve at BASE price (no subsidy/credit),
+ * and refuse when `committed + estCost > cap` (strict `>`). FAIL CLOSED on
+ * EVERY uncertainty — that is the entire safety posture:
+ *   not-live · frozen · no-cap-slice · lease-liveness-unconfirmed ·
+ *   unbounded-reservation · unknown-price · implausible-price ·
+ *   stale-price-fail-closed · invalid-cap · cap-exceeded · ledger-error
+ *
+ * Authority shape (signal-vs-authority): deterministic ARITHMETIC authority at
+ * the metered admission point only. A refusal is a swap-tail ADVANCE for the
+ * router (the chain falls to a free door) — never a chain kill (LF-A2).
+ *
+ * Structural exclusions (unit-tested):
+ *  - reads NO `feature_metrics`, NO provider-report store, NO observed price
+ *    cache, NO subsidy/credit input — only the ledger, the canonical manifest
+ *    meta/points, and the PIN caps store.
+ *
+ * Wiring status (FD-11, honest): the metered dispatch that CALLS this gate is
+ * out-of-scope in-flight S4 work; the gate is fully unit-testable against a
+ * stub dispatch, and go-live remains refused until the FD-11 release-gate
+ * preconditions are met. Nothing in Increment B routes real money.
+ */
+import { CapExceededError } from './MeteredSpendLedger.js';
+/**
+ * Per-provider price plausibility floors, USD per MILLION tokens — CODE-DEFINED
+ * constants, deliberately not config (A-M5/S-F1: a Bearer-writable surface must
+ * never influence a gate-consumed price value). A canonical point BELOW its
+ * provider's floor is treated as a typo → `implausible-price` → fail closed.
+ */
+export const PROVIDER_PRICE_FLOORS_PER_MTOK = {
+    google: { inPerMtok: 0.01, outPerMtok: 0.01 },
+    openrouter: { inPerMtok: 0.01, outPerMtok: 0.01 },
+    groq: { inPerMtok: 0.01, outPerMtok: 0.01 },
+};
+/** How stale the metered-lease self-confirmation may be before the holder self-fences (N-2). MUST stay strictly shorter than the mesh-death threshold. */
+export const LEASE_LIVENESS_WINDOW_MS = 60_000;
+/** A cap/uncertainty refusal — the router treats it as a swap-tail ADVANCE, never a chain kill. */
+export class MoneyGateRefusal extends Error {
+    reason;
+    detail;
+    keyRef;
+    door;
+    constructor(reason, detail, keyRef, door) {
+        super(`money gate refused (${reason}): ${detail}`);
+        this.reason = reason;
+        this.detail = detail;
+        this.keyRef = keyRef;
+        this.door = door;
+        this.name = 'MoneyGateRefusal';
+    }
+}
+export class MeteredSpendGate {
+    d;
+    now;
+    constructor(opts) {
+        this.d = opts;
+        this.now = opts.now ?? (() => Date.now());
+    }
+    /**
+     * Admit-or-refuse a metered call, booking the worst-case reserve on admit.
+     * Every uncertainty throws MoneyGateRefusal (fail closed).
+     */
+    async admit(req) {
+        // 1) Go-live: deny-by-default (not-live), key resolution, designation + freeze.
+        let caps;
+        try {
+            caps = this.d.capsStore.read();
+        }
+        catch (err) {
+            throw new MoneyGateRefusal('invalid-cap', `caps store unreadable: ${String(err)}`, undefined, req.door);
+        }
+        const goLive = caps.goLive[req.door];
+        if (!goLive || !goLive.enabled) {
+            throw new MoneyGateRefusal('not-live', `door '${req.door}' has no live go-live record (deny-by-default)`, undefined, req.door);
+        }
+        const keyRef = goLive.keyRef;
+        if (goLive.designatedMachineId !== this.d.machineId) {
+            throw new MoneyGateRefusal('no-cap-slice', `this machine holds no cap authority for '${req.door}' (designated: ${goLive.designatedMachineId})`, keyRef, req.door);
+        }
+        // 2) Self-fence: positive lease re-confirmation within the bounded window (N-2).
+        const confirmedAgo = this.d.leaseConfirmedAgoMs();
+        if (confirmedAgo === null || confirmedAgo > LEASE_LIVENESS_WINDOW_MS) {
+            throw new MoneyGateRefusal('lease-liveness-unconfirmed', `metered-lease designation not positively re-confirmed within ${LEASE_LIVENESS_WINDOW_MS}ms (ago: ${confirmedAgo ?? 'never'})`, keyRef, req.door);
+        }
+        // 3) Freeze + cap validity.
+        const keyCaps = caps.caps[keyRef];
+        if (keyCaps?.frozen) {
+            throw new MoneyGateRefusal('frozen', `key '${keyRef}' is frozen${keyCaps.frozenBy ? ` (by ${keyCaps.frozenBy})` : ''}`, keyRef, req.door);
+        }
+        const lifetimeCap = keyCaps?.lifetimeCapUsd;
+        const dailyCap = keyCaps?.dailyCapUsd;
+        if (typeof lifetimeCap !== 'number' || !Number.isFinite(lifetimeCap) || lifetimeCap <= 0 ||
+            typeof dailyCap !== 'number' || !Number.isFinite(dailyCap) || dailyCap <= 0) {
+            throw new MoneyGateRefusal('invalid-cap', `key '${keyRef}' has no valid positive caps (a cap of 0/absent admits nothing)`, keyRef, req.door);
+        }
+        // 4) Bounded reservation (A2-4).
+        if (req.maxOutputTokens === undefined || !Number.isFinite(req.maxOutputTokens) || req.maxOutputTokens <= 0 ||
+            !Number.isFinite(req.inputTokens) || req.inputTokens < 0) {
+            throw new MoneyGateRefusal('unbounded-reservation', 'metered call without a bounded max_tokens output ceiling (or invalid input estimate) is refused', keyRef, req.door);
+        }
+        // 5) Canonical VALIDATED price only (never observed, never overlay), stale policy applied.
+        const { inPerMtok, outPerMtok } = this.gatePrice(req.door, req.modelId, keyRef);
+        // 6) Worst-case reserve at BASE price; cached tokens as FULL input (FD-19).
+        const reserveUsd = (req.inputTokens / 1e6) * inPerMtok + (req.maxOutputTokens / 1e6) * outPerMtok;
+        // 7+8) ATOMIC check-and-reserve: the strict-> cap comparison runs INSIDE the
+        // ledger's per-key booking critical section (never outside it — the only
+        // ordering under which two CONCURRENT reservations are guaranteed to see
+        // each other; the two-concurrent-reserves unit test pins this). The read is
+        // O(1) and fresh (high-water-checked) at the moment of booking.
+        let handle;
+        try {
+            handle = await this.d.ledger.reserve({
+                keyRef,
+                door: req.door,
+                modelId: req.modelId,
+                reserveUsd,
+                leaseEpoch: caps.leaseEpoch,
+                admitOnlyUnderCaps: { lifetimeCapUsd: lifetimeCap, dailyCapUsd: dailyCap },
+            });
+        }
+        catch (err) {
+            if (err instanceof CapExceededError) {
+                throw new MoneyGateRefusal('cap-exceeded', err.message, keyRef, req.door);
+            }
+            throw new MoneyGateRefusal('ledger-error', `reserve booking failed: ${String(err)}`, keyRef, req.door);
+        }
+        return {
+            reserveId: handle.reserveId,
+            keyRef,
+            reserveUsd,
+            bookedInPerMtok: inPerMtok,
+            bookedOutPerMtok: outPerMtok,
+            committedLifetimeUsd: handle.committedLifetimeUsd,
+            committedDayUsd: handle.committedDayUsd,
+        };
+    }
+    /**
+     * The gate-eligible price for a (door, model): the CANONICAL as-of point,
+     * validated + plausibility-floored; under a stale SLA the door's staleMode
+     * applies (default book-conservative-max — spend continues, never under-books).
+     */
+    gatePrice(door, modelId, keyRef) {
+        const res = this.d.prices.resolve(door, modelId, this.now());
+        // Canonical ONLY: an observed point is structurally not gate-eligible (S2-2).
+        if (res.priceBasis !== 'canonical' || !res.point) {
+            throw new MoneyGateRefusal('unknown-price', `no canonical price point for (${door}, ${modelId})`, keyRef, door);
+        }
+        const meta = this.d.prices.doorMetaFor(door);
+        if (res.priceStale) {
+            const mode = meta?.staleMode ?? 'book-conservative-max';
+            if (mode === 'fail-closed') {
+                throw new MoneyGateRefusal('stale-price-fail-closed', `canonical price for '${door}' is older than its freshness SLA and staleMode is fail-closed`, keyRef, door);
+            }
+            const cm = meta?.conservativeMax;
+            if (!cm || !this.plausible(door, cm.inPerMtok, cm.outPerMtok)) {
+                throw new MoneyGateRefusal('unknown-price', `stale price for '${door}' and no plausible conservativeMax to book against`, keyRef, door);
+            }
+            return { inPerMtok: cm.inPerMtok, outPerMtok: cm.outPerMtok };
+        }
+        const pt = res.point;
+        if (!this.plausible(door, pt.inPerMtok, pt.outPerMtok)) {
+            throw new MoneyGateRefusal('implausible-price', `canonical price for (${door}, ${modelId}) is below the code-defined provider floor — likely a typo`, keyRef, door);
+        }
+        return { inPerMtok: pt.inPerMtok, outPerMtok: pt.outPerMtok };
+    }
+    plausible(door, inPerMtok, outPerMtok) {
+        const provider = door.split('-')[0]; // gemini-api → gemini … door naming is provider-prefixed
+        const floor = PROVIDER_PRICE_FLOORS_PER_MTOK[provider] ??
+            PROVIDER_PRICE_FLOORS_PER_MTOK[{ gemini: 'google' }[provider] ?? ''] ??
+            { inPerMtok: 0.001, outPerMtok: 0.001 };
+        return (Number.isFinite(inPerMtok) && Number.isFinite(outPerMtok) &&
+            inPerMtok >= floor.inPerMtok && outPerMtok >= floor.outPerMtok);
+    }
+    /**
+     * Settle helpers for the (future) metered dispatch seam: ALL no-charge outcomes
+     * force-settle $0 (A-B2) unless tokens were demonstrably returned; a 200 books
+     * actual from the per-door BILLED-token mapping (erring HIGH), or worst-case
+     * when the billed basis cannot be confirmed.
+     */
+    async settleActual(keyRef, reserveId, actualUsd) {
+        await this.d.ledger.settle(keyRef, reserveId, actualUsd);
+    }
+    async settleNoCharge(keyRef, reserveId) {
+        await this.d.ledger.settle(keyRef, reserveId, 0);
+    }
+}
+/**
+ * Per-door BILLED-token mapping (Layer 3): which response fields mean "billed
+ * output" for each metered door — Gemini bills thinking tokens as output
+ * (candidatesTokenCount can EXCLUDE them); OpenRouter/Groq bill
+ * completion_tokens. A response whose billed basis cannot be confirmed from the
+ * mapping settles at the WORST-CASE estimate, never a lower unverified field.
+ * Named + exported so the metered dispatch seam and the tests share ONE truth.
+ */
+export function billedOutputTokens(door, usage) {
+    if (!usage || typeof usage !== 'object')
+        return null;
+    const n = (v) => (typeof v === 'number' && Number.isFinite(v) && v >= 0 ? v : null);
+    if (door === 'gemini-api') {
+        // Native path: candidatesTokenCount + thoughtsTokenCount. OpenAI-compat path:
+        // completion_tokens (+ reasoning tokens detail when present).
+        const candidates = n(usage['candidatesTokenCount']);
+        if (candidates !== null) {
+            const thoughts = n(usage['thoughtsTokenCount']) ?? 0;
+            return candidates + thoughts;
+        }
+        const completion = n(usage['completion_tokens']);
+        if (completion !== null) {
+            const details = usage['completion_tokens_details'];
+            const reasoning = n(details?.['reasoning_tokens']) ?? 0;
+            // completion_tokens on the compat path already includes reasoning on some
+            // shapes; take the MAX interpretation (erring HIGH, the safe direction).
+            return Math.max(completion, reasoning);
+        }
+        return null;
+    }
+    if (door === 'openrouter-api' || door === 'groq-api') {
+        return n(usage['completion_tokens']);
+    }
+    return null;
+}
+//# sourceMappingURL=MeteredSpendGate.js.map

package/dist/core/MeteredSpendGate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MeteredSpendGate.js","sourceRoot":"","sources":["../../src/core/MeteredSpendGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAK3D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAwE;IACjH,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;IAC7C,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;IACjD,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;CAC5C,CAAC;AAEF,0JAA0J;AAC1J,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAe/C,mGAAmG;AACnG,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAEhC;IACA;IACA;IACA;IAJT,YACS,MAA8B,EAC9B,MAAc,EACd,MAAe,EACf,IAAa;QAEpB,KAAK,CAAC,uBAAuB,MAAM,MAAM,MAAM,EAAE,CAAC,CAAC;QAL5C,WAAM,GAAN,MAAM,CAAwB;QAC9B,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAS;QACf,SAAI,GAAJ,IAAI,CAAS;QAGpB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAqCD,MAAM,OAAO,gBAAgB;IACV,CAAC,CAA0B;IAC3B,GAAG,CAAe;IAEnC,YAAY,IAA6B;QACvC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QACd,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CAAC,GAAiB;QAC3B,gFAAgF;QAChF,IAAI,IAAmB,CAAC;QACxB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CAAC,aAAa,EAAE,0BAA0B,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1G,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC/B,MAAM,IAAI,gBAAgB,CAAC,UAAU,EAAE,SAAS,GAAG,CAAC,IAAI,gDAAgD,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACjI,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,IAAI,MAAM,CAAC,mBAAmB,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YACpD,MAAM,IAAI,gBAAgB,CAAC,cAAc,EAAE,4CAA4C,GAAG,CAAC,IAAI,kBAAkB,MAAM,CAAC,mBAAmB,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACpK,CAAC;QACD,iFAAiF;QACjF,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC;QAClD,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,GAAG,wBAAwB,EAAE,CAAC;YACrE,MAAM,IAAI,gBAAgB,CAAC,4BAA4B,EAAE,gEAAgE,wBAAwB,YAAY,YAAY,IAAI,OAAO,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7M,CAAC;QACD,4BAA4B;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,MAAM,cAAc,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5I,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,EAAE,cAAc,CAAC;QAC5C,MAAM,QAAQ,GAAG,OAAO,EAAE,WAAW,CAAC;QACtC,IACE,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,CAAC;YACpF,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,EAC3E,CAAC;YACD,MAAM,IAAI,gBAAgB,CAAC,aAAa,EAAE,QAAQ,MAAM,iEAAiE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/I,CAAC;QACD,iCAAiC;QACjC,IACE,GAAG,CAAC,eAAe,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,eAAe,IAAI,CAAC;YACtG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,WAAW,GAAG,CAAC,EACxD,CAAC;YACD,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,EAAE,iGAAiG,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3K,CAAC;QACD,2FAA2F;QAC3F,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAChF,4EAA4E;QAC5E,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC,GAAG,SAAS,GAAG,CAAC,GAAG,CAAC,eAAe,GAAG,GAAG,CAAC,GAAG,UAAU,CAAC;QAClG,6EAA6E;QAC7E,yEAAyE;QACzE,yEAAyE;QACzE,4EAA4E;QAC5E,gEAAgE;QAChE,IAAI,MAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBACnC,MAAM;gBACN,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,UAAU;gBACV,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,kBAAkB,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE;aAC3E,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;gBACpC,MAAM,IAAI,gBAAgB,CAAC,cAAc,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,IAAI,gBAAgB,CAAC,cAAc,EAAE,2BAA2B,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACzG,CAAC;QACD,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM;YACN,UAAU;YACV,eAAe,EAAE,SAAS;YAC1B,gBAAgB,EAAE,UAAU;YAC5B,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;YACjD,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,SAAS,CAAC,IAAY,EAAE,OAAe,EAAE,MAAc;QAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7D,8EAA8E;QAC9E,IAAI,GAAG,CAAC,UAAU,KAAK,WAAW,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;YACjD,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,iCAAiC,IAAI,KAAK,OAAO,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAClH,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,IAAI,EAAE,SAAS,IAAI,uBAAuB,CAAC;YACxD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;gBAC3B,MAAM,IAAI,gBAAgB,CAAC,yBAAyB,EAAE,wBAAwB,IAAI,gEAAgE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YACpK,CAAC;YACD,MAAM,EAAE,GAAG,IAAI,EAAE,eAAe,CAAC;YACjC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,oBAAoB,IAAI,oDAAoD,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC1I,CAAC;YACD,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC;QAChE,CAAC;QACD,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,EAAE,wBAAwB,IAAI,KAAK,OAAO,4DAA4D,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACtK,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC;IAChE,CAAC;IAEO,SAAS,CAAC,IAAY,EAAE,SAAiB,EAAE,UAAkB;QACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,yDAAyD;QAC9F,MAAM,KAAK,GACT,8BAA8B,CAAC,QAAQ,CAAC;YACxC,8BAA8B,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACpE,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC1C,OAAO,CACL,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;YACzD,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,UAAU,IAAI,KAAK,CAAC,UAAU,CAC/D,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,SAAiB,EAAE,SAAiB;QACrE,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,SAAiB;QACpD,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,KAA0C;IACzF,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,CAAC,GAAG,CAAC,CAAU,EAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5G,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,8EAA8E;QAC9E,8DAA8D;QAC9D,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;QACpD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,CAAC;YACrD,OAAO,UAAU,GAAG,QAAQ,CAAC;QAC/B,CAAC;QACD,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;QACjD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,KAAK,CAAC,2BAA2B,CAAwC,CAAC;YAC1F,MAAM,SAAS,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC;YACxD,0EAA0E;YAC1E,yEAAyE;YACzE,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACrD,OAAO,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/core/MeteredSpendLedger.d.ts

@@ -0,0 +1,154 @@
+/**
+ * MeteredSpendLedger — Layer 3 of the Routing Control Room
+ * (docs/specs/routing-control-room-spend-alerts.md, Increment B).
+ *
+ * The AUTHORITATIVE money truth: an append-only, booking-priced ledger of every
+ * metered-door reservation/settlement, plus a maintained O(1) committed total the
+ * fail-closed gate reads. This ledger — NOT `feature_metrics`, NOT the Layer-1c
+ * provider-report store — is the ONLY rebuild source for committed spend
+ * (FD-3/FD-9): rebuilding from Layer 0 joined to current prices is FORBIDDEN at
+ * the gate (a downward `corrects` would re-open capped headroom).
+ *
+ * Write discipline (adopted from DriftSpendLedger, upgraded per spec C4-2):
+ *  - Rows are APPEND-ONLY JSONL, fsync'd, written FIRST; the totals file is a
+ *    regenerable CACHE of the fold, rewritten atomically (tmp+rename) SECOND.
+ *    A crash between the two leaves totals STALE-LOW by at most one booking; the
+ *    next gate read runs a cheap high-water check (file size) and re-folds.
+ *  - Writes are FAIL-CLOSED and NON-SWALLOWING: a booking that cannot be durably
+ *    persisted throws, and the caller must refuse the metered call.
+ *  - Boot: fold all rows, REWRITE the totals cache from row truth (torn totals
+ *    rename / totals-without-append are always corrected; the append-first
+ *    ordering makes totals-without-append impossible, asserted in tests).
+ *  - A torn trailing append (partial last line) is the malformed-row-skip case.
+ *
+ * Reserve/settle lifecycle (A-B2/A2-1):
+ *  - reserve(): books the worst-case estimate (cached tokens as FULL input,
+ *    FD-19; output at the REQUIRED max-tokens ceiling). Outstanding reserves are
+ *    INSIDE the committed total (concurrent reservations see each other).
+ *  - settle(): idempotent terminal `reserved → settled`; books ACTUAL cost.
+ *    A settle after expiry books the actual cost as a fresh ABSOLUTE row
+ *    (expiry-aware settle) — the late-settle race can never under-count.
+ *  - expire(): the reserve-expiry sweep (takes the per-key mutex) expires only
+ *    reserves older than the TTL still in `reserved` state.
+ *  - First terminal transition wins; the loser is a no-op.
+ *
+ * Concurrency: metered calls funnel through the single server process, so the
+ * booking critical sections are guarded by an in-process async mutex per keyRef
+ * (held only for the booking, RELEASED during the LLM round-trip) plus a
+ * proper-lockfile advisory lock for defence against a second process.
+ */
+/** Default reserve TTL — pinned comfortably above the metered-call latency ceiling (spec: 15 min vs a 5-min call ceiling). */
+export declare const DEFAULT_RESERVE_TTL_MS: number;
+export type MeteredBookingKind = 'reserve' | 'settle' | 'expire';
+/** One append-only booking row. NEVER mutated; corrections are new rows. */
+export interface MeteredBookingRow {
+    ts: string;
+    keyRef: string;
+    door: string;
+    modelId: string;
+    kind: MeteredBookingKind;
+    /** The per-call id (=== meteredCallId) minted at reserve time. */
+    reserveId: string;
+    /** Reserve: worst-case estimate. Settle: ACTUAL booked cost. Expire: 0. */
+    costUsd: number;
+    /** The metered-lease epoch the booking was made under (A-B4). */
+    leaseEpoch: number;
+    /** Set on a settle that arrived after its reserve was expired (books absolute). */
+    lateAfterExpire?: boolean;
+}
+/** The maintained O(1) running totals (a regenerable cache of the fold). */
+export interface MeteredCommittedTotals {
+    keyRef: string;
+    committedLifetimeUsd: number;
+    committedDayUsd: number;
+    /** UTC day (YYYY-MM-DD) the day total belongs to; a new day resets it. */
+    dayEpoch: string;
+    updatedAt: string;
+}
+export interface ReserveRequest {
+    keyRef: string;
+    door: string;
+    modelId: string;
+    /** Worst-case reserve in USD (computed by the gate at canonical BASE price). */
+    reserveUsd: number;
+    leaseEpoch: number;
+    /**
+     * When set, the cap comparison happens ATOMICALLY inside the per-key booking
+     * critical section (`committed + reserve > cap` strict `>`, both caps) — the
+     * only ordering under which two concurrent reservations are guaranteed to see
+     * each other (spec Layer 3). Refusal throws CapExceededError; nothing books.
+     */
+    admitOnlyUnderCaps?: {
+        lifetimeCapUsd: number;
+        dailyCapUsd: number;
+    };
+}
+/** Thrown by reserve() when admitOnlyUnderCaps would be breached — nothing was booked. */
+export declare class CapExceededError extends Error {
+    capKind: 'lifetime' | 'daily';
+    committedUsd: number;
+    reserveUsd: number;
+    capUsd: number;
+    constructor(capKind: 'lifetime' | 'daily', committedUsd: number, reserveUsd: number, capUsd: number);
+}
+export interface ReserveHandle {
+    reserveId: string;
+    /** Committed lifetime total AFTER this reservation (outstanding reserves included). */
+    committedLifetimeUsd: number;
+    committedDayUsd: number;
+}
+export declare class MeteredLedgerWriteError extends Error {
+    cause?: unknown | undefined;
+    constructor(msg: string, cause?: unknown | undefined);
+}
+export interface MeteredSpendLedgerOptions {
+    /** The agent's `.instar/` dir; rows/totals live under `state/`, the lock under `local/`. */
+    stateDir: string;
+    reserveTtlMs?: number;
+    now?: () => number;
+}
+export declare class MeteredSpendLedger {
+    private readonly rowsPath;
+    private readonly totalsPath;
+    private readonly lockTarget;
+    private readonly ttlMs;
+    private readonly now;
+    /** In-memory fold state, authoritative in-process. Rebuilt on construction. */
+    private reserves;
+    private totals;
+    /** Byte length of the rows file as of our last append/fold (the high-water mark). */
+    private rowsBytes;
+    /** In-process per-key mutex tail. */
+    private mutexTail;
+    constructor(opts: MeteredSpendLedgerOptions);
+    /** O(1) committed totals for a key, day-rolled to NOW. High-water-checked against external appends. */
+    committed(keyRef: string): MeteredCommittedTotals;
+    /** Reserve worst-case cost. FAIL-CLOSED: any persistence failure throws. */
+    reserve(req: ReserveRequest): Promise<ReserveHandle>;
+    /**
+     * Terminal settle at ACTUAL cost. Idempotent: a second settle is a no-op.
+     * A settle after expiry books the actual as a fresh ABSOLUTE row (late-settle).
+     */
+    settle(keyRef: string, reserveId: string, actualUsd: number): Promise<void>;
+    /** Reserve-expiry sweep (Layer 3 — takes the per-key mutex). Expires only TTL-stale `reserved` states. */
+    sweepExpired(): Promise<number>;
+    /** All totals (for the caps view). Day-rolled to now. */
+    allCommitted(): MeteredCommittedTotals[];
+    /** Apply one row to the in-memory fold. */
+    private applyRow;
+    /** Contribution of one reserve state to committed totals. */
+    private contribution;
+    private recomputeTotalsForKey;
+    /** Day-rolled view of a key's totals (a new UTC day resets the day figure). */
+    private currentTotals;
+    /** Full refold from row truth (the fold is canon; the totals file is a cache). */
+    private refoldFromRows;
+    /** Cheap external-append detection: rows-file byte length vs our high-water mark. */
+    private checkHighWater;
+    /** Append one row, fsync'd, under the advisory file lock. NON-SWALLOWING. */
+    private appendDurable;
+    /** Atomic (tmp+rename) rewrite of the totals cache. Best-effort — rows are canon. */
+    private rewriteTotalsCache;
+    private withKeyMutex;
+}
+//# sourceMappingURL=MeteredSpendLedger.d.ts.map

package/dist/core/MeteredSpendLedger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MeteredSpendLedger.d.ts","sourceRoot":"","sources":["../../src/core/MeteredSpendLedger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAaH,8HAA8H;AAC9H,eAAO,MAAM,sBAAsB,QAAiB,CAAC;AAErD,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEjE,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,kBAAkB,CAAC;IACzB,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,4EAA4E;AAC5E,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB,EAAE,MAAM,CAAC;IAC7B,eAAe,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAQD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CACtE;AAED,0FAA0F;AAC1F,qBAAa,gBAAiB,SAAQ,KAAK;IAEhC,OAAO,EAAE,UAAU,GAAG,OAAO;IAC7B,YAAY,EAAE,MAAM;IACpB,UAAU,EAAE,MAAM;IAClB,MAAM,EAAE,MAAM;gBAHd,OAAO,EAAE,UAAU,GAAG,OAAO,EAC7B,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM;CAKxB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,uFAAuF;IACvF,oBAAoB,EAAE,MAAM,CAAC;IAC7B,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAChB,KAAK,CAAC,EAAE,OAAO;gBAAnC,GAAG,EAAE,MAAM,EAAS,KAAK,CAAC,EAAE,OAAO,YAAA;CAIhD;AAsBD,MAAM,WAAW,yBAAyB;IACxC,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IAEnC,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAAmC;IACnD,OAAO,CAAC,MAAM,CAA6C;IAC3D,qFAAqF;IACrF,OAAO,CAAC,SAAS,CAAK;IACtB,qCAAqC;IACrC,OAAO,CAAC,SAAS,CAAoC;gBAEzC,IAAI,EAAE,yBAAyB;IAkB3C,uGAAuG;IACvG,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,sBAAsB;IAKjD,4EAA4E;IACtE,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAqC1D;;;OAGG;IACG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBjF,0GAA0G;IACpG,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAoCrC,yDAAyD;IACzD,YAAY,IAAI,sBAAsB,EAAE;IAUxC,2CAA2C;IAC3C,OAAO,CAAC,QAAQ;IA0ChB,6DAA6D;IAC7D,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,qBAAqB;IAmB7B,+EAA+E;IAC/E,OAAO,CAAC,aAAa;IAarB,kFAAkF;IAClF,OAAO,CAAC,cAAc;IAuCtB,qFAAqF;IACrF,OAAO,CAAC,cAAc;IAgBtB,6EAA6E;YAC/D,aAAa;IAoB3B,qFAAqF;IACrF,OAAO,CAAC,kBAAkB;IAe1B,OAAO,CAAC,YAAY;CAcrB"}