taximeter 0.1.2 → 0.2.1

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Taximeter
 
+## 0.2.1
+
+### Patch Changes
+
+- Announce legacy ledger migration and save a standalone, WAL-aware schema-1 backup before upgrading. Abort the upgrade if the backup fails, retain completed backups for rollback, and document recovery using a separate database path. Extend the reproducible ledger benchmark to cover larger histories and task/agent partition counts.
+
+## 0.2.0
+
+### Minor Changes
+
+- Default to rejecting parsed payments for unknown assets. Set `policy.unknownAsset` to `allow` to opt in and configure exact contract-address budgets for custom tokens.
+
+  Replace full ledger replay during payment gating with transactional, rebuildable payment projections and exact timestamp-indexed budget sums. Preserve append-only source records, retry and settlement semantics, and precise rolling-window boundaries. Existing databases migrate to schema version 2 when opened; older 0.1.x clients cannot reopen the migrated schema.
+
 ## 0.1.2
 
 ### Patch Changes

package/README.md

@@ -51,7 +51,7 @@ Open a terminal in this source checkout, with Node 20+ and npm installed.
 You should now see:
 
 ```text
-Taximeter 0.1.2
+Taximeter 0.2.1
 Proxy: http://127.0.0.1:8402
 Dashboard: http://127.0.0.1:8403
 Point an HTTP-proxy-aware agent at http://127.0.0.1:8402.
@@ -116,6 +116,8 @@ their amount before forwarding the payment replay.
 Policy evaluation and reservation share one SQLite transaction, so concurrent
 payments cannot all consume the same remaining capacity.
 Append-only payment, outcome, and diagnostic records derive every total with BigInt.
+Payment checks use an incrementally maintained index of exact budget sums, avoiding
+a replay of all prior payments. The index can be rebuilt from the original log.
 The local dashboard polls that ledger every second and exports the same counted amounts.
 
 An initial 402 challenge is an offer, not spend. Reported settlement counts as
@@ -138,6 +140,22 @@ as text to prevent a spreadsheet application from rounding them.
 
 ## Configuration
 
+When upgrading from 0.1.x, upgrade all writers together. Opening an existing
+ledger prints `Migrating ledger…`, saves a standalone schema-1 backup beside it
+at `<database>.backup-v1-<unique suffix>/ledger.db`, and prints the backup path
+before building the budget index. The backup includes committed WAL records;
+if it cannot be completed, the upgrade stops. Large ledgers take longer on this
+first open. Fresh databases and already-upgraded ledgers do not create backups.
+
+The source log is preserved, but older 0.1.x clients cannot reopen the upgraded
+database. To roll back, stop all CLI and SDK writers, copy the saved `ledger.db`
+to a **new database path**, and start 0.1.x with `--db` pointing there. Keep the
+upgraded database: the backup does not contain payments made after migration.
+Backups are retained until you remove them; a `ledger.partial.db` file means the
+backup did not finish and must not be used for rollback. Progress goes to stderr,
+so JSON report/export output stays machine-readable. Parsed unknown assets now
+require an explicit opt-in as described below.
+
 No file is required. Start from [the example](taximeter.config.example.json) when
 needed. Precedence, highest first: flags, environment, explicit `--config` file,
 `taximeter.config.json` in the working directory, `~/.taximeter/config.json`, defaults.
@@ -158,6 +176,7 @@ invalid values are rejected with Zod.
 | `policy.allowPayTo` | `[]` | Empty allows all recipients; otherwise exact case-insensitive addresses. |
 | `policy.maxSinglePayment` | `"1000000"` | One USDC per authorization by default; `null` disables the cap. |
 | `policy.maxSingleAsset` | `USDC` | Asset to which the single-payment cap applies. |
+| `policy.unknownAsset` | `"deny"` | `deny` blocks parsed payments whose network and contract are absent from the offline asset registry; `allow` opts in to those assets. |
 | `ports.proxy` | `8402` | Loopback HTTP listener; `0` selects an available port. |
 | `ports.dashboard` | `8403` | Loopback dashboard listener; `0` selects an available port. |
 | `db` | `~/.taximeter/ledger.db` | SQLite path; relative paths resolve against the working directory. |
@@ -168,9 +187,16 @@ All commands accept `--db` and `--config`. Start also accepts `--proxy-port`,
 `TAXIMETER_PORT`, and `TAXIMETER_DASHBOARD_PORT`.
 
 Missing task/agent labels share an **Unattributed** bucket. Supply `Taximeter-Task`
-and `Taximeter-Agent` headers, or SDK options. The local USDC registry recognizes
-Base and Base Sepolia; other contracts remain separate atomic-unit balances with
-unknown decimals. Default USDC budgets do not cap unknown assets.
+and `Taximeter-Agent` headers, or SDK options. The offline asset registry recognizes
+USDC by its network and contract on Base and Base Sepolia. Parsed payments for
+other assets are denied by default with `unknown_asset`; supplied symbols or
+decimal metadata cannot make a token known. Unsupported or unparseable payment
+formats still pass through with a diagnostic.
+
+Custom-token budgets require `policy.unknownAsset: "allow"`. This opts in to parsed
+unknown assets, which remain separate atomic-unit balances with unknown decimals.
+Configure budgets using the exact contract address and, when needed, its network.
+Default USDC budgets do not cap these assets; only matching budgets and caps apply.
 
 A denied replay receives HTTP 402 before it reaches the upstream. For a cap of
 140 atomic units already fully consumed, the response is:
@@ -185,9 +211,10 @@ A denied replay receives HTTP 402 before it reaches the upstream. For a cap of
 }
 ```
 
-Reasons are `host_denied`, `host_not_allowed`, `recipient_not_allowed`,
+Reasons are `host_denied`, `host_not_allowed`, `recipient_not_allowed`, `unknown_asset`,
 `max_single_payment`, `per_task_budget`, `per_agent_budget`, and `global_budget`.
-Host/recipient denials have `budget: null` and `remaining: null`.
+Host, recipient, and unknown-asset denials have `budget: null`, `spent: "0"`, and
+`remaining: null`.
 
 ## What this is not
 

package/SECURITY.md

@@ -7,7 +7,7 @@ on-chain settlement.
 
 ## Supported version
 
-Security fixes currently target the `0.1.0` release line. No older release line
+Security fixes currently target the `0.2.x` release line. No older release line
 is maintained. This policy describes support; it is not a claim that the package
 has already been published or independently audited.
 
@@ -32,6 +32,9 @@ against a hostile agent or another process running as the same user.
 - Unsupported or malformed payment forms pass through with a diagnostic.
   Supported parsing is narrower than the full x402 protocol; see
   [protocol notes](https://github.com/Ding808/taximeter/blob/main/SPEC-NOTES.md).
+- Parsed payments outside the offline asset registry are denied by default.
+  Setting `policy.unknownAsset` to `allow` permits them; only matching contract
+  budgets and caps then apply. Metadata supplied with a payment does not make its asset trusted.
 - HTTPS CONNECT tunnels encrypted bytes without metering their payments.
   Taximeter does not install a certificate authority or intercept TLS.
 - The SDK must wrap the transport inside the payment wrapper. Redirects and