taximeter 0.1.1 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Taximeter
 
+## 0.2.0
+
+### Minor Changes
+
+- Default to rejecting parsed payments for unknown assets. Set `policy.unknownAsset` to `allow` to opt in and configure exact contract-address budgets for custom tokens.
+
+  Replace full ledger replay during payment gating with transactional, rebuildable payment projections and exact timestamp-indexed budget sums. Preserve append-only source records, retry and settlement semantics, and precise rolling-window boundaries. Existing databases migrate to schema version 2 when opened; older 0.1.x clients cannot reopen the migrated schema.
+
+## 0.1.2
+
+### Patch Changes
+
+- Exclude development specifications, verification transcripts, design decisions, contribution files, and recording sources from the npm package. Keep the CLI, SDK, dashboard, usage documentation, demo image, license, security guidance, changelog, and example configuration. Link to repository-only documentation from packaged guides.
+
 ## 0.1.1
 
 ### Patch Changes

package/README.md

@@ -16,7 +16,8 @@ from source with the quickstart below. Requires Node 20 or newer.
 
 This local recording shows 20 payments passing and payment 21 being blocked at
 an exact total of 140 atomic units. It uses synthetic x402 envelopes and never
-moves money. [Record the demo](docs/RECORDING.md) with the included simulation.
+moves money. [Record the demo](https://github.com/Ding808/taximeter/blob/main/docs/RECORDING.md)
+with the simulation in the source checkout.
 
 ## Why
 
@@ -50,7 +51,7 @@ Open a terminal in this source checkout, with Node 20+ and npm installed.
 You should now see:
 
 ```text
-Taximeter 0.1.1
+Taximeter 0.2.0
 Proxy: http://127.0.0.1:8402
 Dashboard: http://127.0.0.1:8403
 Point an HTTP-proxy-aware agent at http://127.0.0.1:8402.
@@ -60,7 +61,7 @@ HTTPS CONNECT is unmetered; use --upstream or withMeter for HTTPS payments.
 Open [the local dashboard](http://127.0.0.1:8403). It explains how to connect an
 agent before the first payment arrives. Stop the process with Ctrl+C.
 The prebuilt npm package starts directly; installing it does not build the frontend.
-Dependency download time depends on the connection. See [measured verification](VERIFICATION.md).
+Dependency download time depends on the connection.
 
 Choose the connection mode your agent supports:
 
@@ -115,6 +116,8 @@ their amount before forwarding the payment replay.
 Policy evaluation and reservation share one SQLite transaction, so concurrent
 payments cannot all consume the same remaining capacity.
 Append-only payment, outcome, and diagnostic records derive every total with BigInt.
+Payment checks use an incrementally maintained index of exact budget sums, avoiding
+a replay of all prior payments. The index can be rebuilt from the original log.
 The local dashboard polls that ledger every second and exports the same counted amounts.
 
 An initial 402 challenge is an offer, not spend. Reported settlement counts as
@@ -126,7 +129,8 @@ Repeated EIP-3009 authorizations count once across retries, using network, contr
 payer, nonce, amount, recipient, and validity bounds. Conflicting authorization
 details receive separate reservations. Each unresolved forwarding attempt keeps
 capacity reserved; an old unconfirmed retry must reacquire capacity in the current
-window. [Protocol notes](SPEC-NOTES.md) explain these rules and the supported subset.
+window. [Protocol notes](https://github.com/Ding808/taximeter/blob/main/SPEC-NOTES.md)
+explain these rules and the supported subset.
 
 CSV `amount` is the counted contribution, including zero for blocked/known failed
 rows. `authorizedAmount` retains the original amount. Sum `amount` with BigInt
@@ -136,6 +140,11 @@ as text to prevent a spreadsheet application from rounding them.
 
 ## Configuration
 
+When upgrading from 0.1.x, upgrade all writers together. Opening an existing
+ledger builds the new budget index once and upgrades its schema; the source log
+is preserved. Older 0.1.x clients cannot reopen that migrated database. Parsed
+unknown assets now require an explicit opt-in as described below.
+
 No file is required. Start from [the example](taximeter.config.example.json) when
 needed. Precedence, highest first: flags, environment, explicit `--config` file,
 `taximeter.config.json` in the working directory, `~/.taximeter/config.json`, defaults.
@@ -156,6 +165,7 @@ invalid values are rejected with Zod.
 | `policy.allowPayTo` | `[]` | Empty allows all recipients; otherwise exact case-insensitive addresses. |
 | `policy.maxSinglePayment` | `"1000000"` | One USDC per authorization by default; `null` disables the cap. |
 | `policy.maxSingleAsset` | `USDC` | Asset to which the single-payment cap applies. |
+| `policy.unknownAsset` | `"deny"` | `deny` blocks parsed payments whose network and contract are absent from the offline asset registry; `allow` opts in to those assets. |
 | `ports.proxy` | `8402` | Loopback HTTP listener; `0` selects an available port. |
 | `ports.dashboard` | `8403` | Loopback dashboard listener; `0` selects an available port. |
 | `db` | `~/.taximeter/ledger.db` | SQLite path; relative paths resolve against the working directory. |
@@ -166,9 +176,16 @@ All commands accept `--db` and `--config`. Start also accepts `--proxy-port`,
 `TAXIMETER_PORT`, and `TAXIMETER_DASHBOARD_PORT`.
 
 Missing task/agent labels share an **Unattributed** bucket. Supply `Taximeter-Task`
-and `Taximeter-Agent` headers, or SDK options. The local USDC registry recognizes
-Base and Base Sepolia; other contracts remain separate atomic-unit balances with
-unknown decimals. Default USDC budgets do not cap unknown assets.
+and `Taximeter-Agent` headers, or SDK options. The offline asset registry recognizes
+USDC by its network and contract on Base and Base Sepolia. Parsed payments for
+other assets are denied by default with `unknown_asset`; supplied symbols or
+decimal metadata cannot make a token known. Unsupported or unparseable payment
+formats still pass through with a diagnostic.
+
+Custom-token budgets require `policy.unknownAsset: "allow"`. This opts in to parsed
+unknown assets, which remain separate atomic-unit balances with unknown decimals.
+Configure budgets using the exact contract address and, when needed, its network.
+Default USDC budgets do not cap these assets; only matching budgets and caps apply.
 
 A denied replay receives HTTP 402 before it reaches the upstream. For a cap of
 140 atomic units already fully consumed, the response is:
@@ -183,9 +200,10 @@ A denied replay receives HTTP 402 before it reaches the upstream. For a cap of
 }
 ```
 
-Reasons are `host_denied`, `host_not_allowed`, `recipient_not_allowed`,
+Reasons are `host_denied`, `host_not_allowed`, `recipient_not_allowed`, `unknown_asset`,
 `max_single_payment`, `per_task_budget`, `per_agent_budget`, and `global_budget`.
-Host/recipient denials have `budget: null` and `remaining: null`.
+Host, recipient, and unknown-asset denials have `budget: null`, `spent: "0"`, and
+`remaining: null`.
 
 ## What this is not
 
@@ -201,6 +219,6 @@ to report a problem.
 
 ## Contributing / license
 
-Read [CONTRIBUTING.md](CONTRIBUTING.md), [the decisions](DECISIONS.md), and
-[the specification](SPEC.md). Test and release evidence is in [VERIFICATION.md](VERIFICATION.md).
+See the [contribution guide](https://github.com/Ding808/taximeter/blob/main/CONTRIBUTING.md)
+for development instructions, design documents, and verification evidence.
 Licensed under [MIT](LICENSE).

package/SECURITY.md

@@ -7,7 +7,7 @@ on-chain settlement.
 
 ## Supported version
 
-Security fixes currently target the `0.1.0` release line. No older release line
+Security fixes currently target the `0.2.x` release line. No older release line
 is maintained. This policy describes support; it is not a claim that the package
 has already been published or independently audited.
 
@@ -31,7 +31,10 @@ against a hostile agent or another process running as the same user.
 
 - Unsupported or malformed payment forms pass through with a diagnostic.
   Supported parsing is narrower than the full x402 protocol; see
-  [SPEC-NOTES.md](SPEC-NOTES.md).
+  [protocol notes](https://github.com/Ding808/taximeter/blob/main/SPEC-NOTES.md).
+- Parsed payments outside the offline asset registry are denied by default.
+  Setting `policy.unknownAsset` to `allow` permits them; only matching contract
+  budgets and caps then apply. Metadata supplied with a payment does not make its asset trusted.
 - HTTPS CONNECT tunnels encrypted bytes without metering their payments.
   Taximeter does not install a certificate authority or intercept TLS.
 - The SDK must wrap the transport inside the payment wrapper. Redirects and