Generative-Media Gateway

Calling one AI provider's API is a one-liner any coding agent will write for you. Pricing that call BEFORE you spend on it, debiting a shared prepaid balance so two concurrent requests cannot overdraw it, refusing a request that violates your own content policy, and proving afterward who spent what -- across 17 vendors with 17 different pricing shapes (per-character TTS, per-minute dubbing, per-second video, flat-per-generation audio) -- is not a one-liner. It is the part every AI-wrapper product eventually builds badly, under deadline, after its first double-spend incident.

WHAT SHIPS: an atomic prepaid ledger (a single conditional UPDATE makes concurrent double-spend structurally impossible -- proven under real load: 20 threads racing a $10 balance against ten $1 reservations on a real on-disk SQLite file, exactly ten succeed, balance lands at exactly $0); a pre-submit content-policy gate (blocklist, asset provenance, real-person consent, rights-window coverage) that runs before any debit; a 17-vendor provider catalog with a price basis per model, every vendor disabled by default until you enable it in config; per-tenant rate limiting; signed outbound webhooks with the matching inbound verifier; an append-only audit log; a five-minute kill-switch playbook; per-tenant statements and a margin report; a runnable aiohttp reference server wiring it all together; and three real HTTP clients (Black Forest Labs, Ideogram, BytePlus) as templates for going live. Core is stdlib + SQLite; aiohttp only for the reference server.

EVERY ADAPTER SHIPS IN NULL MODE -- deterministic fixtures, zero network calls, zero credentials read -- until you wire a real client into the constructor seam, so nothing here can spend real provider money by accident. Nothing in this package is legal advice: prices were recorded from public pricing pages at a point in time and drift, and whether a vendor's terms permit your use case is a question only you can answer for your entity and tier. The catalog says exactly that, per vendor, and nothing more.

VERIFIED: 35 checks in the end-to-end smoke suite (real aiohttp test server, real SQLite, no mocks), measured by running it from the shipped bytes.

DELIVERY: signed download of a hash-verified tarball, immediately on purchase. Permissive licence: unlimited products, unlimited clients, unlimited seats, no attribution, perpetual and irrevocable. One restriction, do not republish the source as source.