feat: share the spend ledger and error-body parsing

[agentx402-bot]

Extracts the two things both service SDKs had duplicated — and had already drifted on — into the platform SDK that owns the types they depend on.

Why here

Core defined SpendCapError while the logic that throws it lived in both clients (5 throw sites each). A 2026-07-31 cross-repo audit found two holes of the same shape, each being "one client has the guard, the other doesn't":

• one checked its cumulative cap against a counter incremented only after the paid round-trip, so concurrent ops all passed the same stale check and all signed — measured, three in-flight reads authorized $0.012 against a $0.005 cap;
• the other accepted a malformed cap without failing closed.

They stayed divergent partly because the same function had a different name in each repo (assertCapOption vs assertFiniteUsd), so grepping one never finds the other. The error-body parser drifted again during that remediation: hardening landed in one client and not the sibling.

What

• SpendLedger — per-call and cumulative bounds, with the synchronous reservation that makes the cumulative one hold under concurrency, plus an idempotent release. Caps validated at construction.
• assertFiniteUsd — a malformed cap fails closed. The dangerous case is NaN: usd > NaN is false, so an unchecked NaN cap doesn't merely fail to bind, it silently disables the comparison while still reading as configured.
• parseErrorBody — type-checks every field of an untrusted response body. JSON.parse returns any and a cast asserts nothing at runtime; a non-string code silently breaks every e.code === "…" comparison callers dispatch on. Only the parsing is shared — each SDK still constructs its own error class, since that identity is what callers instanceof.

All additive. No existing export changes.

A bug found while extracting

Writing the tests surfaced a latent defect that exists in both clients today: cumulative spend is accumulated USD floats, so $0.005 settled plus a $0.004 op is 0.009000000000000001, and a bare <= refuses a spend landing exactly on a $0.009 cap. SpendLedger absorbs that with a sub-atomic slack — one atomic USDC, the same magnitude and reasoning the SDKs already apply to a quoted price — so it cannot admit a spend anyone could actually be charged. Three regression tests pin it, including that ten times the slack is still refused.

Adoption

Nothing consumes this yet. The clients can only adopt after a core release, so this ships first and the two client PRs follow — deliberately, so the extraction can be reviewed on its own rather than tangled with two migrations.

Gate: biome ci clean, tsc --noEmit clean, 144 tests passing.