@cortexkit/opencode-openai-auth 1.0.3 → 1.0.5

package/src/tui-compiled/runtime/shared/0332701351b3eeec-format.js

@@ -1,7 +1,7 @@
 // The one quota wording every surface shows: the command menu's dialogs on
 // OpenCode and Pi, the terminal auth menu, and the plugins' sidebars. Each of
-// them calls `formatQuota` (or `quotaTextParts` for one line per window), so
-// the wording cannot drift between plugins or between a dialog and a sidebar.
+// them calls `formatQuota`, `quotaTextParts`, or `quotaWindowParts`, so the
+// wording cannot drift between plugins or between a dialog and a sidebar.
 //
 // The rules: a window is named by its length (`5h`, `7d`), or, for a window
 // that binds only one model family, by the label the plugin stored it under.
@@ -55,17 +55,20 @@ export function quotaWindowName(limit) {
         return limit.label;
     return lengthName(limit.windowMinutes);
 }
+function clampPercent(remaining) {
+    return Math.min(100, Math.max(0, remaining));
+}
 function percentLeft(remaining) {
-    return `${Math.round(Math.min(100, Math.max(0, remaining)))}% left`;
+    return `${Math.round(clampPercent(remaining))}% left`;
 }
-function resetText(resetsAt, now) {
-    if (resetsAt === undefined)
-        return '';
-    const at = Date.parse(resetsAt);
-    // A reset already passed says nothing about the future; leave it out.
-    if (!Number.isFinite(at) || at <= now)
-        return '';
-    return `, resets ${shortSpan(at - now)}`;
+function resetDetails(resetsAt, checkedAt, now) {
+    const at = resetsAt === undefined ? Number.NaN : Date.parse(resetsAt);
+    return {
+        ...(Number.isFinite(at) && at > now
+            ? { resetIn: shortSpan(at - now) }
+            : {}),
+        resetSinceReading: Number.isFinite(at) && at > checkedAt && at <= now,
+    };
 }
 /** Shortest window first, so `5h` reads before `7d`; unknown lengths last. */
 function displayOrder(left, right) {
@@ -85,42 +88,70 @@ function displayOrder(left, right) {
     return left.label < right.label ? -1 : left.label > right.label ? 1 : 0;
 }
 /**
- * The pieces of a quota text, in order: one per reported window
- * (`5h 58% left, resets 2h`), then the credit budget when there is one, then
- * `checked 3h ago` when the oldest piece shown is stale. Empty when nothing
- * was reported; `formatQuota` turns that into a sentence. A caller printing
- * one line per window (the terminal auth menu) uses these directly.
+ * Structured quota wording for layouts that need one row per window. The
+ * windows use the same filtering and order as `quotaTextParts`; future resets
+ * and the optional age keep the shared formatter's wording.
  */
-export function quotaTextParts(quota, options) {
+export function quotaWindowParts(quota, options) {
     if (!quota)
-        return [];
+        return { windows: [] };
     const { now } = options;
-    const full = (options.form ?? 'full') === 'full';
-    const parts = [];
-    const times = [];
     const readings = quota.limits
         .filter((limit) => limit.kind === 'reading' && limit.remainingPercent !== undefined)
         .sort(displayOrder);
-    for (const limit of readings) {
-        times.push(limit.checkedAt);
-        parts.push(`${quotaWindowName(limit)} ${percentLeft(limit.remainingPercent ?? 0)}${full ? resetText(limit.resetsAt, now) : ''}`);
-    }
+    const windows = readings.map((limit) => {
+        const remainingPercent = clampPercent(limit.remainingPercent ?? 0);
+        return {
+            kind: 'window',
+            name: quotaWindowName(limit),
+            figure: percentLeft(limit.remainingPercent ?? 0),
+            remainingPercent,
+            checkedAt: limit.checkedAt,
+            ...resetDetails(limit.resetsAt, limit.checkedAt, now),
+        };
+    });
     const budget = quota.budget;
     if (budget) {
-        times.push(budget.checkedAt);
+        const remainingPercent = budget.remainingPercent;
         const figure = budget.reached
             ? 'credits spent'
-            : budget.remainingPercent !== undefined
-                ? `credits ${percentLeft(budget.remainingPercent)}`
+            : remainingPercent !== undefined
+                ? `credits ${percentLeft(remainingPercent)}`
                 : 'credits available';
-        parts.push(`${figure}${full ? resetText(budget.resetsAt, now) : ''}`);
+        windows.push({
+            kind: 'budget',
+            name: 'credits',
+            figure,
+            ...(remainingPercent === undefined
+                ? {}
+                : { remainingPercent: clampPercent(remainingPercent) }),
+            checkedAt: budget.checkedAt,
+            ...resetDetails(budget.resetsAt, budget.checkedAt, now),
+        });
     }
-    if (times.length > 0) {
-        const age = now - Math.min(...times);
-        if (age > (options.staleAfterMs ?? QUOTA_STALE_AFTER_MS))
-            parts.push(`checked ${shortSpan(age)} ago`);
+    if (windows.length > 0) {
+        const age = now - Math.min(...windows.map((part) => part.checkedAt));
+        if (age > (options.staleAfterMs ?? QUOTA_STALE_AFTER_MS)) {
+            return { windows, age: `checked ${shortSpan(age)} ago` };
+        }
     }
-    return parts;
+    return { windows };
+}
+/**
+ * The pieces of a quota text, in order: one per reported window
+ * (`5h 58% left, resets 2h`), then the credit budget when there is one, then
+ * `checked 3h ago` when the oldest piece shown is stale. Empty when nothing
+ * was reported; `formatQuota` turns that into a sentence. A caller printing
+ * one line per window (the terminal auth menu) uses these directly.
+ */
+export function quotaTextParts(quota, options) {
+    const parts = quotaWindowParts(quota, options);
+    const full = (options.form ?? 'full') === 'full';
+    const text = parts.windows.map((part) => {
+        const reset = full && part.resetIn ? `, resets ${part.resetIn}` : '';
+        return `${part.kind === 'budget' ? '' : `${part.name} `}${part.figure}${reset}`;
+    });
+    return parts.age === undefined ? text : [...text, parts.age];
 }
 /**
  * A row's quota as one line: `5h 58% left · 7d 90% left` in the compact

package/src/tui-compiled/runtime/shared/053cc17b5419261e-codec.js

@@ -1,4 +1,4 @@
-import { isQuotaMap } from "./905bffc0220f43d0-map.js";
+import { decodeQuotaMap, isQuotaMap } from "./905bffc0220f43d0-map.js";
 import { mergeQuotaObservation } from "./4f36d333d081d040-merge.js";
 /**
  * The quota codec the account-pool store (the `/store` subpath) takes when it
@@ -8,5 +8,6 @@ import { mergeQuotaObservation } from "./4f36d333d081d040-merge.js";
  */
 export const quotaCodec = Object.freeze({
     validate: isQuotaMap,
+    decode: decodeQuotaMap,
     merge: mergeQuotaObservation,
 });

package/src/tui-compiled/runtime/shared/0766d78c6f481f18-watcher.js

@@ -2,8 +2,13 @@ import { readFileSync, realpathSync, statSync, watch, } from "node:fs";
 import { readFile, stat } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
 import { clearTimeout, setTimeout } from "node:timers";
+import { PrivateFileError, readPrivateText, windowsPrivateFiles, } from "./375d9cca2def037d-private-files.js";
 function canonicalPath(file) {
     const path = resolve(file);
+    // Leave reparse points in the path for private-files' ancestor walk to reject;
+    // realpath would follow them before the security backend saw the original path.
+    if (windowsPrivateFiles)
+        return path;
     try {
         return realpathSync(path);
     }
@@ -34,7 +39,9 @@ export function watchTuiPreferences(file, onChange, options = {}) {
     if (shared)
         return shared.subscribe(onChange);
     const name = basename(path);
-    const read = options.fs?.readFile ?? ((file) => readFile(file, 'utf8'));
+    const read = windowsPrivateFiles
+        ? (file) => readPrivateText(file)
+        : (options.fs?.readFile ?? ((file) => readFile(file, 'utf8')));
     const probe = options.fs?.stat ?? stat;
     let timer = null;
     let pollTimer = null;
@@ -43,14 +50,15 @@ export function watchTuiPreferences(file, onChange, options = {}) {
     // Seed synchronously so an immediate write cannot be absorbed as the baseline.
     // The metadata is recorded only together with contents that were read, as in
     // the probe below: if the first read fails, the probe keeps trying.
-    try {
-        const metadata = identity((options.fs?.statSync ?? statSync)(path));
-        lastSeen = (options.fs?.readFileSync ?? ((file) => readFileSync(file, 'utf8')))(path);
-        lastMetadata = metadata;
-    }
-    catch {
-        // Missing or unreadable files are picked up by the probe later.
-    }
+    if (!windowsPrivateFiles)
+        try {
+            const metadata = identity((options.fs?.statSync ?? statSync)(path));
+            lastSeen = (options.fs?.readFileSync ?? ((file) => readFileSync(file, 'utf8')))(path);
+            lastMetadata = metadata;
+        }
+        catch {
+            // Missing or unreadable files are picked up by the probe later.
+        }
     let disposed = false;
     const subscribers = new Set();
     let checking = Promise.resolve();
@@ -68,7 +76,15 @@ export function watchTuiPreferences(file, onChange, options = {}) {
                 lastMetadata = null;
                 return;
             }
-            const text = await read(path).catch(() => null);
+            const text = await read(path).catch((error) => {
+                if (error instanceof PrivateFileError && error.code !== 'ENOENT') {
+                    if (options.onError)
+                        options.onError(error);
+                    else
+                        process.emitWarning(error.message, error.name);
+                }
+                return null;
+            });
             if (disposed)
                 return;
             // Record the metadata only once its contents were read. A failed read

package/src/tui-compiled/runtime/shared/375d9cca2def037d-private-files.js

@@ -0,0 +1,302 @@
+import { randomUUID } from "node:crypto";
+import { lstat, readFile, rename, unlink } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+export const windowsPrivateFiles = process.platform === 'win32';
+const migrationNotices = new Set();
+function ioCode(detail) {
+    // Native errors retain their Win32 code. Only demonstrated absence/exclusive
+    // collisions are normalized; access/sharing failures never become lost races.
+    if (detail?.reason === 'io-error') {
+        if (detail.win32Code === 2 || detail.win32Code === 3)
+            return 'ENOENT';
+        if (detail.win32Code === 80 || detail.win32Code === 183)
+            return 'EEXIST';
+    }
+    return detail?.code ?? 'ERR_PRIVATE_FILE';
+}
+// Production loads this package only on Windows; POSIX keeps its own directory policy.
+let backend;
+/** Tests inject a backend here; production always imports the private-files package. */
+export function setPrivateFilesBackendForTest(api) {
+    backend = api ? Promise.resolve(api) : undefined;
+}
+function loadBackend() {
+    backend ??= import("@cortexkit/private-files");
+    return backend;
+}
+export class PrivateFileError extends Error {
+    path;
+    stage;
+    code;
+    win32Code;
+    reason;
+    published = false;
+    durabilityConfirmed = false;
+    fileDurable = false;
+    attempts = 0;
+    elapsedMs = 0;
+    orphanPath;
+    constructor(path, stage, cause) {
+        const detail = cause;
+        super(`Private file refused at ${stage}: ${path} (${detail?.reason ?? detail?.code ?? 'io-error'}). Use a safe parent directory. Repair only a named secret file in safe ancestry whose owner the published policy trusts, without changing its owner or any existing directory. Previously exposed credentials may need rotation. Windows requires the private-files native prebuild and an ACL-persisting local filesystem such as NTFS.`, { cause });
+        this.path = path;
+        this.stage = stage;
+        this.name = 'PrivateFileError';
+        this.code = ioCode(detail);
+        this.win32Code = detail?.win32Code;
+        this.reason = detail?.reason;
+    }
+}
+export async function privateOperation(path, stage, operation) {
+    try {
+        return await operation();
+    }
+    catch (cause) {
+        if (cause instanceof PrivateFileError)
+            throw cause;
+        throw new PrivateFileError(path, stage, cause);
+    }
+}
+// Tests inject metadata into safe-parent checks, including checks deep inside
+// callers that take no policy options. Production never sets this.
+let safeParentOptionsForTest;
+/** Tests only: policy options used by safe-parent checks that pass none. */
+export function setSafeParentOptionsForTest(options) {
+    safeParentOptionsForTest = options;
+}
+/** Existing containing directories use the shared entry-integrity policy, not secret-file permissions. */
+export async function verifySafeDirectory(path, options) {
+    path = resolve(path);
+    options ??= safeParentOptionsForTest;
+    await privateOperation(path, 'safe-parent', async () => {
+        const result = await (await loadBackend()).verifySafeParent(path, options);
+        if (result.ok === false) {
+            // Preserve an absent parent's ENOENT so callers can create it privately.
+            if (result.reason === 'io-error' || result.reason === 'wrong-kind')
+                await lstat(path);
+            throw new PrivateFileError(result.level ?? result.path, 'safe-parent', {
+                ...result,
+                code: 'ERR_PRIVATE_FILES_SECURITY',
+            });
+        }
+    });
+}
+/** Repair only the specific owned secret file supplied by a caller, never an existing directory tree. */
+export async function verifyPrivate(path, kind, migrate = false) {
+    path = resolve(path);
+    if (kind === 'directory')
+        return verifySafeDirectory(path);
+    await privateOperation(path, 'verify', async () => {
+        const api = await loadBackend();
+        const result = await api.verifyOwnerOnly(path);
+        let repaired = false;
+        if (!result.ok) {
+            const { reason } = result.refusal;
+            // The result API intentionally omits native IO codes. Use the throwing
+            // API to preserve absence/collision details, never infer them from text.
+            if (reason === 'io-error')
+                await api.verifyPrivatePath(path, kind);
+            // DACL replacement repairs permissions only, never ownership or unsafe ancestry.
+            if (migrate &&
+                [
+                    api.EXTRA_ACE,
+                    api.NOT_PROTECTED,
+                    api.NULL_DACL,
+                    api.EMPTY_DACL,
+                ].includes(reason)) {
+                await verifySafeDirectory(dirname(path));
+                await api.securePrivatePath(path, kind);
+                repaired = true;
+            }
+            else {
+                throw Object.assign(new Error('Owner-only verification refused'), {
+                    reason,
+                    code: 'ERR_PRIVATE_FILES_SECURITY',
+                });
+            }
+        }
+        // Verify the expected object kind and its permissions by handle after repair.
+        await api.verifyPrivatePath(path, kind);
+        if (repaired && !migrationNotices.has(path)) {
+            migrationNotices.add(path);
+            process.emitWarning(`Private permissions tightened: ${path}. This object may have been readable before; rotate credentials if needed.`, 'PrivateFileMigration');
+        }
+    });
+}
+/** Create missing components privately; inspect existing ancestors without modifying them. */
+export async function ensurePrivateDirectory(path, _migrate = false, options) {
+    path = resolve(path);
+    await privateOperation(path, 'directory', async () => {
+        const api = await loadBackend();
+        try {
+            await lstat(path);
+            return await verifySafeDirectory(path, options);
+        }
+        catch (error) {
+            if (ioCode(error) !== 'ENOENT')
+                throw error;
+        }
+        const parent = dirname(path);
+        if (parent === path)
+            throw Object.assign(new Error('Missing root'), { code: 'ENOENT' });
+        await ensurePrivateDirectory(parent, false, options);
+        try {
+            await api.createOwnerOnly(path, { kind: 'dir' });
+        }
+        catch (error) {
+            if (ioCode(error) !== 'EEXIST')
+                throw error;
+        }
+        await verifySafeDirectory(path, options);
+    });
+}
+export async function readPrivateText(path, migrate = false) {
+    if (!windowsPrivateFiles)
+        return readFile(path, 'utf8');
+    return (await readPrivateBuffer(path, migrate)).toString('utf8');
+}
+export async function readPrivateBuffer(path, migrate = false) {
+    if (!windowsPrivateFiles)
+        return readFile(path);
+    path = resolve(path);
+    if (migrate) {
+        await verifySafeDirectory(dirname(path));
+        await verifyPrivate(path, 'file', true);
+    }
+    return privateOperation(path, 'read', async () => (await loadBackend()).readOwnerOnly(path));
+}
+export async function createPrivateBytes(path, bytes) {
+    await verifySafeDirectory(dirname(resolve(path)));
+    await privateOperation(path, 'create', async () => {
+        // The backend verifies the creation handle while empty, before consuming bytes.
+        await (await loadBackend()).createPrivateFile(resolve(path), bytes);
+    });
+}
+export async function createPrivateDirectoryExclusive(path) {
+    await verifySafeDirectory(dirname(resolve(path)));
+    await privateOperation(path, 'directory-create', async () => {
+        await (await loadBackend()).createOwnerOnly(resolve(path), { kind: 'dir' });
+    });
+}
+/** Retry Windows rename sharing/access errors within a budget; they never prove lease contention. */
+export async function replaceWindowsFile(from, to, options = {}) {
+    from = resolve(from);
+    to = resolve(to);
+    const now = options.now ?? (() => performance.now());
+    const start = now();
+    const deadline = Math.min(start + 500, options.deadline ?? Infinity);
+    const delays = [0, 10, 20, 40, 80, 100];
+    let original;
+    let attempts = 0;
+    for (const delay of delays) {
+        if (now() >= deadline)
+            break;
+        if (delay)
+            await (options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms))))(Math.min(delay, Math.max(0, deadline - now())));
+        if (now() >= deadline)
+            break;
+        await options.beforeRename?.();
+        if (now() >= deadline)
+            break;
+        attempts++;
+        try {
+            await (options.rename ?? rename)(from, to);
+            return { attempts, elapsedMs: now() - start };
+        }
+        catch (error) {
+            original ??= error;
+            const detail = error;
+            const candidate = detail.win32Code !== undefined
+                ? detail.win32Code === 32 || detail.win32Code === 33
+                : ['EBUSY', 'EPERM', 'EACCES'].includes(detail.code ?? '') &&
+                    !detail.reason;
+            if (!candidate)
+                break;
+        }
+    }
+    const error = new PrivateFileError(to, 'rename', original ??
+        Object.assign(new Error('Publication deadline expired'), {
+            code: 'ETIMEDOUT',
+        }));
+    error.attempts = attempts;
+    error.elapsedMs = now() - start;
+    throw error;
+}
+export async function writePrivateAtomic(path, bytes, options = {}) {
+    path = resolve(path);
+    await ensurePrivateDirectory(dirname(path));
+    try {
+        await verifyPrivate(path, 'file', true);
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    const stage = resolve(options.stagePath ?? `${path}.${randomUUID()}.tmp`);
+    if (dirname(stage) !== dirname(path))
+        throw new PrivateFileError(path, 'stage-directory', { code: 'EXDEV' });
+    let created = false;
+    let published = false;
+    let outcome = { attempts: 0, elapsedMs: 0 };
+    let stageName = 'stage-create';
+    const reportOutcome = (error) => {
+        try {
+            options.onOutcome?.({
+                path,
+                stage: error?.stage ?? 'published',
+                published,
+                fileDurable: published,
+                durabilityConfirmed: false,
+                attempts: error?.attempts ?? outcome.attempts,
+                elapsedMs: error?.elapsedMs ?? outcome.elapsedMs,
+                ...(error && { code: error.code, win32Code: error.win32Code }),
+            });
+        }
+        catch {
+            // Outcome observers cannot change whether publication succeeded.
+        }
+    };
+    try {
+        await createPrivateBytes(stage, bytes);
+        created = true;
+        stageName = 'before-rename';
+        outcome = await replaceWindowsFile(stage, path, options);
+        created = false;
+        published = true;
+        stageName = 'published-callback';
+        options.onRenamed?.();
+        stageName = 'published-verify';
+        await verifyPrivate(path, 'file');
+        // createPrivateFile flushes the file. Directory metadata durability has not
+        // been qualified on Windows, so never promise the POSIX directory fsync.
+        if (options.durable && options.durability !== 'file-only-on-windows')
+            throw new PrivateFileError(path, 'directory-sync-unsupported', {
+                code: 'ENOTSUP',
+            });
+        reportOutcome();
+    }
+    catch (cause) {
+        const error = cause instanceof PrivateFileError
+            ? cause
+            : new PrivateFileError(path, stageName, cause);
+        error.published = published;
+        error.fileDurable = published;
+        if (published)
+            Object.assign(error, outcome);
+        if (created) {
+            try {
+                await unlink(stage);
+            }
+            catch {
+                error.orphanPath = stage;
+            }
+            created = false;
+        }
+        reportOutcome(error);
+        throw error;
+    }
+    finally {
+        if (created)
+            await unlink(stage).catch(() => { });
+    }
+}

package/src/tui-compiled/runtime/shared/39c3cb05738fcf6d-projection.js

@@ -6,7 +6,7 @@
 // scope, orders the result the way the primitives expect, and carries each
 // entry's (scope, label) so a decision names the limit it judged rather than
 // the position it occupied.
-import { ALL_SCOPE, } from "./905bffc0220f43d0-map.js";
+import { ALL_SCOPE, readQuotaCounters, } from "./905bffc0220f43d0-map.js";
 function project(entry) {
     if (entry.kind === 'retired') {
         return {
@@ -94,11 +94,13 @@ export function projectQuota(map, scope = ALL_SCOPE) {
         ? Math.min(...stamped.map((limit) => limit.checkedAt))
         : undefined;
     const budget = map?.budget?.kind === 'reading' ? projectBudget(map.budget) : undefined;
+    const counters = readQuotaCounters(map?.counters);
     return {
         scope,
         limits,
         ...(checkedAt === undefined ? {} : { checkedAt }),
         ...(budget === undefined ? {} : { budget }),
+        ...(counters === undefined ? {} : { counters }),
     };
 }
 /**

package/src/tui-compiled/runtime/shared/43fc9e6b994519c7-refresh-lock.js

@@ -45,6 +45,11 @@ export async function acquirePoolLock(spec, defaults, env) {
             now: env.now,
             renew: options.renew,
             onContended: () => emit('contended'),
+            ...(env.onRenewalTimer
+                ? {
+                    onRenewalTimer: (event) => env.onRenewalTimer?.({ name: spec.name, path: spec.path }, event),
+                }
+                : {}),
             ...(options.renewIntervalMs !== undefined
                 ? { renewIntervalMs: options.renewIntervalMs }
                 : {}),

package/src/tui-compiled/runtime/shared/458b934e92490331-mutate.js

@@ -1,6 +1,6 @@
-import { readFile } from "node:fs/promises";
 import { setTimeout as snapshotDelay } from "node:timers/promises";
 import { AtomicSyncError, syncJsonFile, writeJsonAtomic, writeJsonAtomicTracked, } from "./7211cfec06a298bc-atomic-write.js";
+import { readPrivateText, windowsPrivateFiles } from "./375d9cca2def037d-private-files.js";
 import { LockContentionError, LockOwnershipError } from "./4825e03209d6ae3e-with-lock.js";
 import { PoolOperationError, } from "./04a6357627de5ed0-errors.js";
 import { callFailureHook } from "./9deae3c4da4fd63b-hooks.js";
@@ -10,7 +10,7 @@ import { CREDENTIAL_STAMP_KEY, classifyConfig, classifyState, ensureEntries, ent
 import { completeTornRows, loadRows } from "./fd45e82f2f9c0a0d-torn.js";
 async function readText(path) {
     try {
-        return await readFile(path, 'utf8');
+        return await readPrivateText(path, windowsPrivateFiles);
     }
     catch (error) {
         if (error.code === 'ENOENT')

package/src/tui-compiled/runtime/shared/4825e03209d6ae3e-with-lock.js

@@ -26,6 +26,10 @@ export async function withLock(target, options, fn) {
             name: options.name,
             ttlMs: options.ttlMs,
             renew: options.renew ?? false,
+            ...(options.onStep ? { onStep: options.onStep } : {}),
+            ...(options.onRenewalTimer
+                ? { onRenewalTimer: options.onRenewalTimer }
+                : {}),
         });
         if (lock) {
             try {

package/src/tui-compiled/runtime/shared/4f36d333d081d040-merge.js

@@ -11,7 +11,7 @@
 // no entry gets an absence record. A pair outside the coverage is never
 // touched, so a header-shaped partial observation (which covers only what it
 // carries) cannot erase a family limit or the budget.
-import { ALL_SCOPE, entryTime, isQuotaMap, limitKey, } from "./905bffc0220f43d0-map.js";
+import { ALL_SCOPE, decodeQuotaMap, entryTime, isQuotaCounters, limitKey, } from "./905bffc0220f43d0-map.js";
 /** Thrown by `mergeQuotaObservation` when either argument is malformed. */
 export class QuotaCodecError extends TypeError {
     constructor(message) {
@@ -83,7 +83,8 @@ export function isQuotaObservation(value) {
     }
     if (!coverage.every(isObservedPair))
         return false;
-    return value.budget === undefined || isObservedBudget(value.budget);
+    return ((value.budget === undefined || isObservedBudget(value.budget)) &&
+        (value.counters === undefined || isQuotaCounters(value.counters)));
 }
 function compareEntries(left, right) {
     if (left.scope !== right.scope)
@@ -99,6 +100,16 @@ function mergeBudget(stored, observed, checkedAt) {
         return stored;
     return { ...observed, checkedAt };
 }
+function mergeCounters(stored, observed) {
+    const counters = new Map(Object.entries(stored ?? {}));
+    for (const [name, counter] of Object.entries(observed ?? {})) {
+        const existing = counters.get(name);
+        if (existing === undefined || counter.checkedAt >= existing.checkedAt) {
+            counters.set(name, counter);
+        }
+    }
+    return counters.size === 0 ? undefined : Object.fromEntries(counters);
+}
 /**
  * Applies `observation` to `stored` (undefined for a row with no map yet) and
  * returns the new map. Pure: neither argument is modified. Throws
@@ -106,13 +117,16 @@ function mergeBudget(stored, observed, checkedAt) {
  * write rather than persisting a map it could not read back.
  */
 export function mergeQuotaObservation(stored, observation) {
-    if (stored !== undefined && !isQuotaMap(stored)) {
+    // Decode the stored map the way reads do, so a malformed counter that reads
+    // already hide is dropped here too instead of refusing every later write.
+    const decoded = stored === undefined ? undefined : decodeQuotaMap(stored);
+    if (stored !== undefined && decoded === undefined) {
         throw new QuotaCodecError('stored quota map is malformed');
     }
     if (!isQuotaObservation(observation)) {
         throw new QuotaCodecError('quota observation is malformed');
     }
-    const base = stored ?? { limits: [] };
+    const base = decoded ?? { limits: [] };
     const at = observation.checkedAt;
     const entries = new Map();
     for (const entry of base.limits) {
@@ -152,11 +166,13 @@ export function mergeQuotaObservation(stored, observation) {
             : { scope, label: pair.label, kind: 'retired', retiredAt: at });
     }
     // Keys this module does not recognise are carried over untouched.
-    const { limits: _limits, budget: _budget, ...unknownKeys } = base;
+    const { limits: _limits, budget: _budget, counters: _counters, ...unknownKeys } = base;
     const budget = mergeBudget(base.budget, observation.budget, at);
+    const counters = mergeCounters(base.counters, observation.counters);
     return {
         ...unknownKeys,
         limits: [...entries.values()].sort(compareEntries),
         ...(budget === undefined ? {} : { budget }),
+        ...(counters === undefined ? {} : { counters }),
     };
 }