feat: harden prepaid billing and commercial operations

2 files changed, 30 insertions, 0 deletions

diff --git a/internal/usage/observer.go b/internal/usage/observer.go
index cc8b52f..808781f 100644
--- a/internal/usage/observer.go
+++ b/internal/usage/observer.go
@@ -44,6 +44,17 @@ func (o *Observer) Usage() domain.Usage {
 	return o.usage
 }
 
+// Reported distinguishes a real zero-token usage object from a response that
+// omitted usage entirely. Billing must never infer this from token totals.
+func (o *Observer) Reported() bool {
+	if !o.stream {
+		o.parseJSON(o.buffer)
+	} else if len(o.line) > 0 {
+		o.parseSSELine(o.line)
+	}
+	return o.found
+}
+
 func (o *Observer) captureTail(p []byte) {
 	if len(p) >= maxCaptureBytes {
 		o.buffer = append(o.buffer[:0], p[len(p)-maxCaptureBytes:]...)
diff --git a/internal/usage/observer_test.go b/internal/usage/observer_test.go
index 8fcf408..3104acb 100644
--- a/internal/usage/observer_test.go
+++ b/internal/usage/observer_test.go
@@ -10,6 +10,9 @@ func TestObserverReadsOpenAIJSONUsage(t *testing.T) {
 	observer := NewObserver(domain.ProtocolOpenAI, false)
 	_, _ = observer.Write([]byte(`{"choices":[],"usage":{"prompt_tokens":11,"completion_tokens":7,"total_tokens":18}}`))
 	got := observer.Usage()
+	if !observer.Reported() {
+		t.Fatal("expected usage to be marked as reported")
+	}
 	if got.InputTokens != 11 || got.OutputTokens != 7 || got.TotalTokens != 18 {
 		t.Fatalf("unexpected usage: %+v", got)
 	}
@@ -20,7 +23,23 @@ func TestObserverCombinesAnthropicSSEUsage(t *testing.T) {
 	_, _ = observer.Write([]byte("event: message_start\ndata: {\"type\":\"message_start\",\"message\":{\"usage\":{\"input_tokens\":12,\"output_tokens\":1}}}\n\n"))
 	_, _ = observer.Write([]byte("event: message_delta\ndata: {\"type\":\"message_delta\",\"usage\":{\"output_tokens\":8}}\n\n"))
 	got := observer.Usage()
+	if !observer.Reported() {
+		t.Fatal("expected streaming usage to be marked as reported")
+	}
 	if got.InputTokens != 12 || got.OutputTokens != 8 || got.TotalTokens != 20 {
 		t.Fatalf("unexpected usage: %+v", got)
 	}
 }
+
+func TestObserverDistinguishesMissingUsageFromReportedZero(t *testing.T) {
+	missing := NewObserver(domain.ProtocolOpenAI, false)
+	_, _ = missing.Write([]byte(`{"choices":[]}`))
+	if missing.Reported() {
+		t.Fatal("response without usage must not be reported")
+	}
+	reported := NewObserver(domain.ProtocolOpenAI, false)
+	_, _ = reported.Write([]byte(`{"choices":[],"usage":{"prompt_tokens":0,"completion_tokens":0,"total_tokens":0}}`))
+	if !reported.Reported() {
+		t.Fatal("explicit zero usage must be distinguished from a missing usage object")
+	}
+}