release: 0.4.0 — breakdown and expiring_soon

[agentx402-bot]

Cuts @agentx402-ai/core 0.4.0. Publishing happens via the GitHub Release → OIDC trusted-publishing path once this lands and v0.4.0 is tagged.

What ships

Two optional UsageBlock fields the platform already emits on the wire, added in #10 and unreleased until now. Both additive — no existing export changes, and a 0.3.0 consumer keeps working against a service that sends them.

Releasing them is what makes them usable: a client cannot read a field its own types do not declare. AgentRAG emits both today, so until this lands every consumer has to widen the type by hand.

• breakdown — composite-op itemization for responses whose charge has more than one leg (an AgentRAG ask that also ingested pages). The top-level price_usd remains the primary verb's price on the taken path, so a request's total is price_usd plus the sum of breakdown[].price_usd — these are not alternatives, and adding them is not double-counting. Absent on single-leg ops rather than an empty array, so breakdown?.length is never 0.
• expiring_soon — literal true when the collection named by the response is inside the final 24 hours of its lifetime, omitted otherwise. Never false, so presence is the only correct test.

Also fixed

package-lock.json carried 0.2.0 while package.json was at 0.3.0 — a drift introduced at the 0.3.0 release and unnoticed since. Both now move together.

Verification

npm ci --ignore-scripts exit 0 (the publish workflow runs exactly this, so a lock/package mismatch would have failed the release), biome ci clean across 19 files, npm run build exit 0, 147 tests passing.

The publish workflow's own guard — tag must equal package.json version — simulated locally: tag v0.4.0 vs v0.4.0, match.