@indigoai-us/hq-cli 5.345.92 → 5.345.93

package/dist/lib/capacity/ledger.js

@@ -0,0 +1,1441 @@
+/**
+ * Personal capacity ledger under ~/.hq/capacity/.
+ *
+ * Daily files events-YYYY-MM-DD.jsonl are the append-only event log (one
+ * O_APPEND write under 4 KB). rebuildNow() replays those files, plus a
+ * legacy events.jsonl if a fixture dropped one, into now.json. The now.json
+ * rewrite holds a TTL lock reclaimed after 30 seconds.
+ *
+ * Root is HQ_CAPACITY_ROOT, or an explicit option, so tests never touch the
+ * real home directory. No network, child process, or provider call.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { CLI_VERSION } from "../../cli-version.js";
+import { parsePidLock } from "../mesh/live/daemon/pid-lock.js";
+export const CAPACITY_DIRNAME = "capacity";
+export const CAPACITY_LOCK_TTL_MS = 30_000;
+export const CAPACITY_LOCK_NAME = "now.lock";
+export const NOW_FILE_NAME = "now.json";
+export const COLLECTOR_FILE_NAME = "collector.json";
+export const LEGACY_EVENTS_NAME = "events.jsonl";
+export const MAX_APPEND_BYTES = 4096;
+export const EVENT_RETENTION_DAYS = 14;
+export const BURN_WINDOW_MS = 6 * 60 * 60 * 1000;
+export const DIR_MODE = 0o700;
+export const FILE_MODE = 0o600;
+/** US-001 redaction shapes: Claude OAuth, and Codex / Grok bearer JWTs. */
+export const PROVIDER_TOKEN_LEAK = /sk-ant-|Bearer\s+\S+|eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/i;
+const ISO_UTC = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$/;
+const DATED_EVENTS = /^events-(\d{4})-(\d{2})-(\d{2})\.jsonl$/;
+const DATED_ADVISORIES = /^advisories-(\d{4})-(\d{2})-(\d{2})\.jsonl$/;
+const ORPHAN_NOW_TMP = /^\.now\..+\.tmp$/;
+const SEEN_READINGS_FILE = ".seen-readings.json";
+const REBUILD_CHECKPOINT_FILE = ".rebuild-checkpoint.json";
+export const READING_SOURCES = [
+    "statusline",
+    "oauth-usage",
+    "codex-jsonl",
+    "codex-app-server",
+    "grok-billing",
+    "refusal",
+];
+export const LIMIT_KINDS = [
+    "session",
+    "weekly_all",
+    "weekly_scoped",
+    "credits",
+    "prepaid",
+    "on_demand",
+    "unknown",
+];
+export const CONFIDENCE_VALUES = ["observed", "fetched", "inferred", "unknown"];
+export const CAPACITY_STATES = ["ok", "warn", "exhausted", "unknown", "reset-pending"];
+const STATE_RANK = {
+    ok: 0,
+    "reset-pending": 1,
+    warn: 2,
+    exhausted: 3,
+    unknown: 4,
+};
+export class LedgerMissing extends Error {
+    code = "LEDGER_MISSING";
+    constructor() {
+        super("run hq capacity enable");
+        this.name = "LedgerMissing";
+    }
+}
+export class LedgerCorrupt extends Error {
+    code = "LEDGER_CORRUPT";
+    constructor() {
+        super("ledger corrupt, rebuilding");
+        this.name = "LedgerCorrupt";
+    }
+}
+export class LedgerBusy extends Error {
+    code = "LEDGER_BUSY";
+    constructor() {
+        super("capacity ledger lock held");
+        this.name = "LedgerBusy";
+    }
+}
+export class LedgerRejected extends Error {
+    code = "LEDGER_REJECTED";
+    constructor(message) {
+        super(message);
+        this.name = "LedgerRejected";
+    }
+}
+const limitSchema = {
+    type: "object",
+    additionalProperties: false,
+    required: ["limitId", "kind", "scope", "usedPercent", "windowMinutes", "resetsAt", "balance", "planType"],
+    properties: {
+        limitId: { type: "string", minLength: 1 },
+        kind: { type: "string", enum: [...LIMIT_KINDS] },
+        scope: { type: ["string", "null"] },
+        usedPercent: { type: ["number", "null"] },
+        windowMinutes: { type: ["number", "null"] },
+        resetsAt: { type: ["string", "null"] },
+        balance: { type: ["string", "number", "null"] },
+        planType: { type: ["string", "null"] },
+        hasCredits: { type: ["boolean", "null"] },
+        unlimited: { type: ["boolean", "null"] },
+        allowancePercentOfWeekly: { type: ["number", "null"] },
+    },
+};
+export const readingJsonSchema = {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
+    $id: "hq-capacity-reading.v1",
+    type: "object",
+    additionalProperties: false,
+    required: [
+        "readingId",
+        "observedAt",
+        "provider",
+        "accountId",
+        "source",
+        "cliVersion",
+        "limit",
+        "confidence",
+        "parserVersion",
+    ],
+    properties: {
+        readingId: { type: "string", minLength: 1 },
+        observedAt: { type: "string", pattern: ISO_UTC.source },
+        provider: { type: "string", minLength: 1 },
+        accountId: { type: "string", minLength: 1 },
+        source: { type: "string", enum: [...READING_SOURCES] },
+        cliVersion: { type: "string", minLength: 1 },
+        limit: limitSchema,
+        confidence: { type: "string", enum: [...CONFIDENCE_VALUES] },
+        parserVersion: { type: "string", minLength: 1 },
+        error: { type: "string" },
+        rateLimitReachedType: { type: ["string", "null"] },
+        spendControlReached: { type: ["boolean", "null"] },
+        accountLabel: { type: "string", minLength: 1 },
+        accountLabels: { type: "array", items: { type: "string", minLength: 1 } },
+        organization: { type: ["string", "null"] },
+        accountHome: { type: "string" },
+    },
+};
+export const nowViewJsonSchema = {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
+    $id: "hq-capacity-now-view.v1",
+    type: "object",
+    additionalProperties: false,
+    required: ["machineId", "hqCliVersion", "generatedAt", "providers"],
+    properties: {
+        machineId: { type: "string", minLength: 1 },
+        hqCliVersion: { type: "string", minLength: 1 },
+        generatedAt: { type: "string" },
+        providers: {
+            type: "array",
+            items: {
+                type: "object",
+                additionalProperties: false,
+                required: ["provider", "state", "lastError", "limits"],
+                properties: {
+                    provider: { type: "string" },
+                    state: { type: "string", enum: [...CAPACITY_STATES] },
+                    lastError: { type: ["string", "null"] },
+                    limits: { type: "array" },
+                    ordinaryUsageAllowed: { type: ["boolean", "null"] },
+                    rateLimitResetCredits: { type: ["object", "null"] },
+                    accounts: { type: "array" },
+                },
+            },
+        },
+    },
+};
+export function capacityRoot(env = process.env, home = os.homedir()) {
+    const override = env.HQ_CAPACITY_ROOT?.trim();
+    if (override)
+        return override;
+    return path.join(home, ".hq", CAPACITY_DIRNAME);
+}
+const SIGNED_OUT_PREFIX = "signed out:";
+const EXPIRED_PREFIX = "expired:";
+/** Ledger text written before expired and signed-out were different states. */
+const LEGACY_EXPIRED_REASON = "signed out: token expired";
+/** Shown for a credential that exists and is past expiry. Never a login. */
+export const EXPIRED_REASON = "expired: refreshes the next time Claude Code is used with this account";
+export function isExpiredReason(reason) {
+    if (!reason)
+        return false;
+    return reason === LEGACY_EXPIRED_REASON
+        || reason === "unavailable: token_expired"
+        || reason.startsWith(EXPIRED_PREFIX);
+}
+export function isAccountFailureReason(reason) {
+    return reason.startsWith(SIGNED_OUT_PREFIX) || reason.startsWith(EXPIRED_PREFIX);
+}
+/** Exact command for an account that has no usable credential. */
+export function capacityLoginCommand(provider, label) {
+    const safe = /^[A-Za-z0-9._-]+$/.test(label) ? label : `'${label.replace(/'/g, `'\\''`)}'`;
+    return `hq capacity login ${provider} --account ${safe}`;
+}
+/** Open the vendor CLI so it can refresh its own token. Does not refresh anything. */
+export function claudeOpenCommand(home, userHome = os.homedir()) {
+    const fallback = path.resolve(userHome, ".claude");
+    const resolved = home ? path.resolve(home) : fallback;
+    if (resolved === fallback)
+        return "claude";
+    const quoted = /^[A-Za-z0-9._@%+:,/~-]+$/.test(resolved)
+        ? resolved
+        : `'${resolved.replace(/'/g, `'\\''`)}'`;
+    return `CLAUDE_CONFIG_DIR=${quoted} claude`;
+}
+export function redactProviderTokens(text) {
+    return text.replace(/sk-ant-\S+|Bearer\s+\S+|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)?/gi, "[REDACTED]");
+}
+export function ledgerSentryPayload(error) {
+    const err = error instanceof Error ? error : new Error("capacity ledger error");
+    return {
+        name: err.name || "Error",
+        message: redactProviderTokens(err.message),
+    };
+}
+function assertNoProviderToken(text) {
+    if (PROVIDER_TOKEN_LEAK.test(text)) {
+        throw new LedgerRejected("reading refused: provider token shape");
+    }
+}
+export function appendReading(input, options) {
+    return appendReadings([input], [], null, options);
+}
+/**
+ * Write every reading, parser failure, and optional provider meta, then
+ * rebuild now.json once. appendReading stays the single-reading path.
+ */
+export function appendReadings(readings, failures = [], meta = null, options) {
+    const ctx = resolve(options);
+    const known = knownReadingIds(ctx.root);
+    const fresh = readings.filter((reading) => !known.has(reading.readingId));
+    if (fresh.length === 0 && failures.length === 0 && !meta) {
+        try {
+            return readNow({ ...options, root: ctx.root });
+        }
+        catch (err) {
+            if (!(err instanceof LedgerMissing))
+                throw err;
+        }
+    }
+    const events = [];
+    for (const reading of fresh)
+        events.push(validateReading(reading));
+    for (const failure of failures)
+        events.push(validateParserFailure(failure));
+    if (meta)
+        events.push(validateProviderMeta(meta));
+    for (const event of events)
+        writeEventLine(event, { ...options, root: ctx.root });
+    rememberReadingIds(ctx.root, fresh.map((reading) => reading.readingId));
+    return rebuildNow({ ...options, root: ctx.root });
+}
+export function appendParserFailure(input, options) {
+    const event = validateParserFailure(input);
+    writeEventLine(event, options);
+    return rebuildNow(options);
+}
+export function appendProviderMeta(input, options) {
+    const event = validateProviderMeta(input);
+    writeEventLine(event, options);
+    return rebuildNow(options);
+}
+export function readNow(options) {
+    const root = resolve(options).root;
+    const dest = path.join(root, NOW_FILE_NAME);
+    if (!fs.existsSync(dest))
+        throw new LedgerMissing();
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(dest, "utf8"));
+    }
+    catch {
+        throw new LedgerCorrupt();
+    }
+    if (!isNowView(parsed))
+        throw new LedgerCorrupt();
+    return parsed;
+}
+export function readLedgerEvents(options) {
+    const root = resolve(options).root;
+    if (!fs.existsSync(root))
+        throw new LedgerMissing();
+    return readEvents(root);
+}
+export function readCollectorMark(options) {
+    const dest = path.join(resolve(options).root, COLLECTOR_FILE_NAME);
+    if (!fs.existsSync(dest))
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(dest, "utf8"));
+    }
+    catch {
+        return null;
+    }
+    if (!parsed || typeof parsed !== "object")
+        return null;
+    const mark = parsed;
+    if (typeof mark.enabled !== "boolean" || typeof mark.updatedAt !== "string")
+        return null;
+    return { enabled: mark.enabled, updatedAt: mark.updatedAt };
+}
+export function setCollectorEnabled(enabled, options) {
+    const ctx = resolve(options);
+    const mark = { enabled, updatedAt: ctx.now.toISOString() };
+    if (!enabled && !fs.existsSync(ctx.root))
+        return mark;
+    ensureDir(ctx.root);
+    const dest = path.join(ctx.root, COLLECTOR_FILE_NAME);
+    fs.writeFileSync(dest, `${JSON.stringify(mark, null, 2)}\n`, { mode: FILE_MODE });
+    fs.chmodSync(dest, FILE_MODE);
+    return mark;
+}
+export function rebuildNow(options) {
+    const ctx = resolve(options);
+    ensureDir(ctx.root);
+    acquireNowLock(ctx.root, ctx);
+    try {
+        deleteExpiredEvents(ctx.root, ctx.now, ctx.lockTtlSec * 1000);
+        const events = eventsForRebuild(ctx.root, ctx.nowMs);
+        const view = materialize(events, ctx);
+        writeNow(ctx.root, view, ctx.pid);
+        return view;
+    }
+    finally {
+        releaseNowLock(ctx.root, ctx);
+    }
+}
+function resolve(options = {}) {
+    const env = options.env ?? process.env;
+    const now = options.now ? options.now() : new Date();
+    const nowMs = now.getTime();
+    const ttlMs = options.lockTtlMs ?? lockTtlFromEnv(env);
+    const machineId = options.machineId ?? os.hostname();
+    const hqCliVersion = options.hqCliVersion ?? CLI_VERSION;
+    assertNoProviderToken(`${machineId}\n${hqCliVersion}`);
+    return {
+        root: options.root ?? capacityRoot(env, options.home),
+        now,
+        nowMs,
+        nowSec: Math.floor(nowMs / 1000),
+        machineId,
+        hqCliVersion,
+        pid: options.pid ?? process.pid,
+        lockTtlSec: Math.max(1, Math.ceil(ttlMs / 1000)),
+    };
+}
+function lockTtlFromEnv(env) {
+    const raw = env.HQ_CAPACITY_LOCK_TTL_MS?.trim();
+    if (!raw)
+        return CAPACITY_LOCK_TTL_MS;
+    const parsed = Number(raw);
+    if (!Number.isFinite(parsed) || parsed < 1000)
+        return CAPACITY_LOCK_TTL_MS;
+    return parsed;
+}
+function ensureDir(dir) {
+    fs.mkdirSync(dir, { recursive: true, mode: DIR_MODE });
+    fs.chmodSync(dir, DIR_MODE);
+}
+function eventsFileName(observedAt) {
+    return `events-${observedAt.slice(0, 10)}.jsonl`;
+}
+function writeEventLine(event, options) {
+    const line = JSON.stringify(event);
+    assertNoProviderToken(line);
+    const payload = Buffer.from(`${line}\n`, "utf8");
+    if (payload.length >= MAX_APPEND_BYTES) {
+        throw new LedgerRejected("reading exceeds 4 KB");
+    }
+    const ctx = resolve(options);
+    ensureDir(ctx.root);
+    const file = path.join(ctx.root, eventsFileName(event.observedAt));
+    const fd = fs.openSync(file, fs.constants.O_APPEND | fs.constants.O_CREAT | fs.constants.O_WRONLY, FILE_MODE);
+    try {
+        const written = fs.writeSync(fd, payload);
+        if (written !== payload.length) {
+            throw new Error("capacity ledger append was truncated");
+        }
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    fs.chmodSync(file, FILE_MODE);
+}
+function wallClockSec() {
+    return Math.floor(Date.now() / 1000);
+}
+function acquireNowLock(dir, ctx) {
+    const lockPath = path.join(dir, CAPACITY_LOCK_NAME);
+    const ts = wallClockSec();
+    ctx.lockTs = ts;
+    const body = `pid=${ctx.pid}\nts=${ts}\n`;
+    for (let attempt = 0; attempt < 3; attempt += 1) {
+        try {
+            fs.writeFileSync(lockPath, body, { flag: "wx", mode: FILE_MODE });
+            fs.chmodSync(lockPath, FILE_MODE);
+            return;
+        }
+        catch (err) {
+            const code = err.code;
+            if (code !== "EEXIST")
+                throw err;
+            if (!reclaimStaleLock(lockPath, ctx))
+                throw new LedgerBusy();
+        }
+    }
+    throw new LedgerBusy();
+}
+/**
+ * Rename the lock aside, then re-check its age. A fresh or unparseable lock
+ * with a fresh mtime is renamed back and stays held. Only a stale claim is
+ * removed. ENOENT means another reclaimer already took it.
+ */
+function reclaimStaleLock(lockPath, ctx) {
+    let stat;
+    try {
+        stat = fs.statSync(lockPath);
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ENOENT")
+            return true;
+        throw err;
+    }
+    if (lockAgeSec(readLock(lockPath), stat) < ctx.lockTtlSec)
+        return false;
+    const claim = `${lockPath}.${ctx.pid}.${Date.now()}.reclaim`;
+    try {
+        fs.renameSync(lockPath, claim);
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ENOENT")
+            return true;
+        throw err;
+    }
+    let claimStat;
+    try {
+        claimStat = fs.statSync(claim);
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ENOENT")
+            return true;
+        throw err;
+    }
+    if (lockAgeSec(readLock(claim), claimStat) < ctx.lockTtlSec) {
+        try {
+            fs.renameSync(claim, lockPath);
+        }
+        catch (err) {
+            const code = err.code;
+            if (code !== "ENOENT")
+                throw err;
+        }
+        return false;
+    }
+    try {
+        fs.unlinkSync(claim);
+    }
+    catch (err) {
+        const code = err.code;
+        if (code !== "ENOENT")
+            throw err;
+    }
+    return true;
+}
+function lockAgeSec(record, stat) {
+    const now = wallClockSec();
+    if (record)
+        return now - record.ts;
+    return now - Math.floor(stat.mtimeMs / 1000);
+}
+function releaseNowLock(dir, ctx) {
+    const lockPath = path.join(dir, CAPACITY_LOCK_NAME);
+    const record = readLock(lockPath);
+    if (!record || record.pid !== ctx.pid || record.ts !== ctx.lockTs)
+        return;
+    try {
+        fs.unlinkSync(lockPath);
+    }
+    catch (err) {
+        const code = err.code;
+        if (code !== "ENOENT")
+            throw err;
+    }
+}
+function readLock(lockPath) {
+    if (!fs.existsSync(lockPath))
+        return null;
+    try {
+        return parsePidLock(fs.readFileSync(lockPath, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+function deleteExpiredEvents(dir, now, lockTtlMs = CAPACITY_LOCK_TTL_MS) {
+    const today = Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate());
+    const cutoff = today - EVENT_RETENTION_DAYS * 24 * 60 * 60 * 1000;
+    const wallNow = Date.now();
+    for (const name of fs.readdirSync(dir)) {
+        const full = path.join(dir, name);
+        const advisory = DATED_ADVISORIES.exec(name);
+        if (advisory) {
+            const fileDay = Date.UTC(Number(advisory[1]), Number(advisory[2]) - 1, Number(advisory[3]));
+            if (fileDay < cutoff)
+                unlinkIfExists(full);
+            continue;
+        }
+        if (ORPHAN_NOW_TMP.test(name) || name.endsWith(".reclaim")) {
+            let mtimeMs;
+            try {
+                mtimeMs = fs.statSync(full).mtimeMs;
+            }
+            catch {
+                continue;
+            }
+            if (wallNow - mtimeMs > lockTtlMs)
+                unlinkIfExists(full);
+            continue;
+        }
+        // now.json is written via a unique `.now.<pid>.<n>.tmp`. Retention runs
+        // on every rebuild and must not unlink that in-flight temp.
+        if (name.startsWith(".now.") || name.endsWith(".tmp"))
+            continue;
+        const match = DATED_EVENTS.exec(name);
+        if (!match)
+            continue;
+        const fileDay = Date.UTC(Number(match[1]), Number(match[2]) - 1, Number(match[3]));
+        if (fileDay < cutoff)
+            unlinkIfExists(full);
+    }
+}
+function unlinkIfExists(file) {
+    try {
+        fs.unlinkSync(file);
+    }
+    catch (err) {
+        const code = err.code;
+        if (code !== "ENOENT")
+            throw err;
+    }
+}
+function knownReadingIds(root) {
+    const seenPath = path.join(root, SEEN_READINGS_FILE);
+    if (fs.existsSync(seenPath)) {
+        const parsed = readJsonFile(seenPath);
+        const ids = parsed && typeof parsed === "object" && Array.isArray(parsed.ids)
+            ? parsed.ids.filter((id) => typeof id === "string")
+            : [];
+        return new Set(ids);
+    }
+    const ids = new Set();
+    const checkpoint = loadCheckpoint(root);
+    if (!checkpoint)
+        return ids;
+    for (const event of checkpoint.events) {
+        if (isReadingShape(event))
+            ids.add(event.readingId);
+    }
+    return ids;
+}
+function rememberReadingIds(root, ids) {
+    if (ids.length === 0)
+        return;
+    const known = knownReadingIds(root);
+    for (const id of ids)
+        known.add(id);
+    atomicWriteText(root, SEEN_READINGS_FILE, `${JSON.stringify({ ids: [...known] })}\n`);
+}
+function eventsForRebuild(dir, nowMs) {
+    const names = eventFileNames(dir);
+    const statSizes = new Map();
+    for (const name of names)
+        statSizes.set(name, fs.statSync(path.join(dir, name)).size);
+    const checkpoint = loadCheckpoint(dir);
+    const incremental = checkpoint !== null && checkpointUsable(checkpoint, names, statSizes);
+    const events = incremental && checkpoint ? checkpoint.events.slice() : [];
+    const files = {};
+    for (const name of names) {
+        const prev = incremental && checkpoint ? checkpoint.files[name]?.size ?? 0 : 0;
+        const slice = readCompleteSuffix(path.join(dir, name), prev);
+        events.push(...slice.events);
+        files[name] = { size: slice.end };
+    }
+    const reduced = reduceEvents(events, nowMs);
+    atomicWriteText(dir, REBUILD_CHECKPOINT_FILE, `${JSON.stringify({ files, events: reduced })}\n`);
+    return reduced;
+}
+function eventFileNames(dir) {
+    if (!fs.existsSync(dir))
+        return [];
+    const names = fs.readdirSync(dir);
+    const files = [];
+    if (names.includes(LEGACY_EVENTS_NAME))
+        files.push(LEGACY_EVENTS_NAME);
+    for (const name of names.filter((item) => DATED_EVENTS.test(item)).sort())
+        files.push(name);
+    return files;
+}
+function checkpointUsable(checkpoint, names, statSizes) {
+    for (const name of Object.keys(checkpoint.files)) {
+        if (!names.includes(name))
+            return false;
+        if ((statSizes.get(name) ?? 0) < checkpoint.files[name].size)
+            return false;
+    }
+    return true;
+}
+/** Read only complete lines appended after `from`. A trailing partial line stays uncommitted. */
+function readCompleteSuffix(filePath, from) {
+    const size = fs.statSync(filePath).size;
+    if (size <= from)
+        return { events: [], end: from };
+    const fd = fs.openSync(filePath, "r");
+    try {
+        const len = size - from;
+        const buf = Buffer.alloc(len);
+        const n = fs.readSync(fd, buf, 0, len, from);
+        const text = buf.subarray(0, n).toString("utf8");
+        const lastNl = text.lastIndexOf("\n");
+        if (lastNl < 0)
+            return { events: [], end: from };
+        const events = [];
+        for (const line of text.slice(0, lastNl).split("\n")) {
+            const event = parseStoredLine(line);
+            if (event)
+                events.push(event);
+        }
+        return { events, end: from + Buffer.byteLength(text.slice(0, lastNl + 1), "utf8") };
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+function reduceEvents(events, nowMs) {
+    const windowStart = nowMs - BURN_WINDOW_MS;
+    const latestReading = new Map();
+    const inWindow = [];
+    const latestFailure = new Map();
+    const latestMeta = new Map();
+    for (const event of events) {
+        const at = Date.parse(event.observedAt);
+        if (Number.isNaN(at))
+            continue;
+        if (isProviderMeta(event)) {
+            const prev = latestMeta.get(event.provider);
+            if (!prev || at >= Date.parse(prev.observedAt))
+                latestMeta.set(event.provider, event);
+            continue;
+        }
+        if (isParserFailure(event)) {
+            const key = `${event.provider}\0${event.accountId ?? ""}`;
+            const prev = latestFailure.get(key);
+            if (!prev || at >= Date.parse(prev.observedAt))
+                latestFailure.set(key, event);
+            continue;
+        }
+        const key = `${event.provider}\0${event.accountId}\0${event.limit.limitId}`;
+        const prev = latestReading.get(key);
+        if (!prev || at >= Date.parse(prev.observedAt))
+            latestReading.set(key, event);
+        if (at >= windowStart && at <= nowMs)
+            inWindow.push(event);
+    }
+    const kept = new Set();
+    for (const event of inWindow)
+        kept.add(event);
+    for (const event of latestReading.values())
+        kept.add(event);
+    for (const event of latestFailure.values())
+        kept.add(event);
+    for (const event of latestMeta.values())
+        kept.add(event);
+    return [...kept].sort((a, b) => Date.parse(a.observedAt) - Date.parse(b.observedAt));
+}
+function loadCheckpoint(dir) {
+    const parsed = readJsonFile(path.join(dir, REBUILD_CHECKPOINT_FILE));
+    if (!parsed || typeof parsed !== "object")
+        return null;
+    const body = parsed;
+    if (!body.files || typeof body.files !== "object" || Array.isArray(body.files) || !Array.isArray(body.events)) {
+        return null;
+    }
+    const files = {};
+    for (const [name, value] of Object.entries(body.files)) {
+        if (!value || typeof value !== "object")
+            return null;
+        const size = value.size;
+        if (typeof size !== "number" || !Number.isFinite(size) || size < 0)
+            return null;
+        files[name] = { size };
+    }
+    const events = [];
+    for (const item of body.events) {
+        const event = parseStoredLine(JSON.stringify(item));
+        if (!event)
+            return null;
+        events.push(event);
+    }
+    return { files, events };
+}
+function readJsonFile(file) {
+    try {
+        return JSON.parse(fs.readFileSync(file, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+function atomicWriteText(dir, name, body) {
+    ensureDir(dir);
+    const dest = path.join(dir, name);
+    const tmp = path.join(dir, `.${name}.${process.pid}.${Date.now()}.tmp`);
+    fs.writeFileSync(tmp, body, { mode: FILE_MODE });
+    try {
+        fs.renameSync(tmp, dest);
+    }
+    catch (err) {
+        unlinkIfExists(tmp);
+        throw err;
+    }
+    fs.chmodSync(dest, FILE_MODE);
+}
+function readEvents(dir) {
+    const names = fs.readdirSync(dir);
+    const files = [];
+    if (names.includes(LEGACY_EVENTS_NAME))
+        files.push(LEGACY_EVENTS_NAME);
+    for (const name of names.filter((item) => DATED_EVENTS.test(item)).sort())
+        files.push(name);
+    const events = [];
+    for (const name of files) {
+        const text = fs.readFileSync(path.join(dir, name), "utf8");
+        for (const line of text.split("\n")) {
+            const event = parseStoredLine(line);
+            if (event)
+                events.push(event);
+        }
+    }
+    events.sort((a, b) => Date.parse(a.observedAt) - Date.parse(b.observedAt));
+    return events;
+}
+function parseStoredLine(line) {
+    const trimmed = line.trim();
+    if (!trimmed)
+        return null;
+    if (PROVIDER_TOKEN_LEAK.test(trimmed))
+        return null;
+    try {
+        const value = JSON.parse(trimmed);
+        if (isParserFailure(value))
+            return validateParserFailure(value);
+        if (isProviderMeta(value))
+            return validateProviderMeta(value);
+        if (isReadingShape(value))
+            return validateReading(value);
+        return null;
+    }
+    catch (err) {
+        if (err instanceof LedgerRejected)
+            return null;
+        return null;
+    }
+}
+function materialize(events, ctx) {
+    const providers = new Map();
+    const bucketFor = (provider) => {
+        let bucket = providers.get(provider);
+        if (!bucket) {
+            bucket = { limits: new Map(), latestReadingAt: Number.NEGATIVE_INFINITY, failure: null, meta: null };
+            providers.set(provider, bucket);
+        }
+        return bucket;
+    };
+    for (const event of events) {
+        const at = Date.parse(event.observedAt);
+        if (Number.isNaN(at))
+            continue;
+        if (isProviderMeta(event)) {
+            const bucket = bucketFor(event.provider);
+            bucket.meta = {
+                ordinaryUsageAllowed: event.ordinaryUsageAllowed,
+                rateLimitResetCredits: event.rateLimitResetCredits,
+            };
+            continue;
+        }
+        if (isParserFailure(event)) {
+            const bucket = bucketFor(event.provider);
+            // An account-scoped failure must not mark the whole provider unknown.
+            if (!isAccountScopedFailure(event))
+                bucket.failure = { at, error: event.error };
+            continue;
+        }
+        const bucket = bucketFor(event.provider);
+        if (bucket.failure && at >= bucket.failure.at)
+            bucket.failure = null;
+        const key = `${event.accountId}\0${event.limit.limitId}`;
+        let limit = bucket.limits.get(key);
+        if (!limit) {
+            limit = { reading: event, history: [] };
+            bucket.limits.set(key, limit);
+        }
+        else if (at >= Date.parse(limit.reading.observedAt)) {
+            // Greatest observedAt wins, independent of append / file order.
+            limit.reading = event;
+        }
+        if (event.limit.usedPercent !== null && Number.isFinite(event.limit.usedPercent)) {
+            limit.history.push({ at, used: event.limit.usedPercent });
+        }
+        if (at > bucket.latestReadingAt)
+            bucket.latestReadingAt = at;
+    }
+    const viewProviders = [...providers.entries()]
+        .sort((a, b) => a[0].localeCompare(b[0]))
+        .map(([provider, bucket]) => {
+        const limits = [...bucket.limits.values()]
+            .sort((a, b) => {
+            const account = a.reading.accountId.localeCompare(b.reading.accountId);
+            if (account !== 0)
+                return account;
+            return a.reading.limit.limitId.localeCompare(b.reading.limit.limitId);
+        })
+            .map((limit) => toNowLimit(limit, ctx.nowMs));
+        const failed = bucket.failure !== null && bucket.failure.at >= bucket.latestReadingAt;
+        let state = "ok";
+        for (const limit of limits) {
+            if (STATE_RANK[limit.state] > STATE_RANK[state])
+                state = limit.state;
+        }
+        if (failed)
+            state = "unknown";
+        if (limits.length === 0 && failed)
+            state = "unknown";
+        const unknownLimit = limits.find((limit) => limit.state === "unknown" && limit.lastError);
+        const lastError = failed
+            ? bucket.failure?.error ?? null
+            : unknownLimit?.lastError ?? null;
+        const entry = { provider, state, lastError, limits };
+        if (bucket.meta) {
+            entry.ordinaryUsageAllowed = bucket.meta.ordinaryUsageAllowed;
+            entry.rateLimitResetCredits = bucket.meta.rateLimitResetCredits;
+        }
+        const unscopedFailure = bucket.failure !== null && bucket.failure.at >= bucket.latestReadingAt;
+        attachAccounts(entry, events, unscopedFailure);
+        return entry;
+    });
+    return {
+        machineId: ctx.machineId,
+        hqCliVersion: ctx.hqCliVersion,
+        generatedAt: ctx.now.toISOString(),
+        providers: viewProviders,
+    };
+}
+function isAccountScopedFailure(event) {
+    return Boolean(event.accountId)
+        && (Boolean(event.accountLabel) || isAccountFailureReason(event.error) || isExpiredReason(event.error));
+}
+function eventAnnotated(event) {
+    if ("event" in event && event.event === "provider_meta")
+        return false;
+    if ("event" in event && event.event === "parser_failure") {
+        return Boolean(event.accountLabel) || isAccountFailureReason(event.error) || isExpiredReason(event.error);
+    }
+    const reading = event;
+    return Boolean(reading.accountLabel) || Boolean(reading.accountLabels && reading.accountLabels.length > 0);
+}
+function attachAccounts(provider, events, unscopedFailure) {
+    const relevant = events.filter((event) => event.provider === provider.provider && eventAnnotated(event));
+    if (relevant.length === 0)
+        return;
+    const accounts = clusterAccounts(provider, relevant);
+    if (accounts.length === 0)
+        return;
+    provider.accounts = accounts;
+    if (unscopedFailure)
+        return;
+    const live = accounts.filter((account) => account.authState !== "expired" && account.authState !== "signed_out" && !account.signedOut);
+    if (live.length === 0) {
+        provider.state = "unknown";
+        provider.lastError = accounts.find((account) => account.reason)?.reason ?? provider.lastError;
+        return;
+    }
+    if (accounts.some((account) => account.signedOut || account.authState === "expired")) {
+        let state = "ok";
+        let anyLimit = false;
+        for (const account of live) {
+            for (const limit of account.limits) {
+                anyLimit = true;
+                if (STATE_RANK[limit.state] > STATE_RANK[state])
+                    state = limit.state;
+            }
+        }
+        provider.state = anyLimit ? state : "unknown";
+        if (provider.lastError?.startsWith(SIGNED_OUT_PREFIX))
+            provider.lastError = null;
+    }
+}
+function clusterAccounts(provider, events) {
+    const seeds = [];
+    for (const event of events) {
+        const at = Date.parse(event.observedAt);
+        if (Number.isNaN(at))
+            continue;
+        if ("event" in event && event.event === "parser_failure") {
+            if (!event.accountId)
+                continue;
+            seeds.push({
+                accountId: event.accountId,
+                labels: eventLabels(event),
+                home: event.accountHome ?? null,
+                organization: cleanOrganization(event.organization),
+                at,
+                problem: problemFor(event.error),
+            });
+            continue;
+        }
+        if ("event" in event)
+            continue;
+        const reading = event;
+        seeds.push({
+            accountId: reading.accountId,
+            labels: eventLabels(reading),
+            home: reading.accountHome ?? null,
+            organization: cleanOrganization(reading.organization),
+            at,
+            problem: null,
+        });
+    }
+    if (seeds.length === 0)
+        return [];
+    const parent = seeds.map((_, index) => index);
+    const find = (index) => {
+        let cursor = index;
+        while (parent[cursor] !== cursor)
+            cursor = parent[cursor] ?? cursor;
+        return cursor;
+    };
+    const union = (left, right) => {
+        const a = find(left);
+        const b = find(right);
+        if (a !== b)
+            parent[b] = a;
+    };
+    const byId = new Map();
+    const byLabel = new Map();
+    seeds.forEach((seed, index) => {
+        const seenId = byId.get(seed.accountId);
+        if (seenId === undefined)
+            byId.set(seed.accountId, index);
+        else
+            union(seenId, index);
+        for (const label of seed.labels) {
+            const seen = byLabel.get(label);
+            if (seen === undefined)
+                byLabel.set(label, index);
+            else
+                union(seen, index);
+        }
+    });
+    const groups = new Map();
+    seeds.forEach((_, index) => {
+        const root = find(index);
+        const list = groups.get(root) ?? [];
+        list.push(index);
+        groups.set(root, list);
+    });
+    const accounts = [];
+    for (const indexes of groups.values()) {
+        const members = indexes.map((index) => seeds[index]).filter((seed) => Boolean(seed));
+        const ids = [...new Set(members.map((seed) => seed.accountId))];
+        const labels = [];
+        const homes = [];
+        let organization = null;
+        let problem = null;
+        let latestReadingAt = Number.NEGATIVE_INFINITY;
+        let latestAt = Number.NEGATIVE_INFINITY;
+        for (const seed of members) {
+            for (const label of seed.labels) {
+                if (!labels.includes(label))
+                    labels.push(label);
+            }
+            if (seed.home && !homes.includes(seed.home))
+                homes.push(seed.home);
+            if (!organization || seed.at >= organization.at)
+                organization = { value: seed.organization, at: seed.at };
+            if (seed.problem && (!problem || seed.at >= problem.at)) {
+                problem = { ...seed.problem, at: seed.at };
+            }
+            if (!seed.problem && seed.at > latestReadingAt)
+                latestReadingAt = seed.at;
+            if (seed.at > latestAt)
+                latestAt = seed.at;
+        }
+        const ordered = orderLabels(labels);
+        const primary = ordered.find((label) => label !== "default") ?? ordered[0] ?? "default";
+        const limitedIds = ids.filter((id) => provider.limits.some((limit) => limit.accountId === id));
+        const accountId = limitedIds[0] ?? ids[0] ?? primary;
+        const limits = provider.limits.filter((limit) => ids.includes(limit.accountId));
+        const blocked = problem !== null && problem.at >= latestReadingAt;
+        const expired = blocked && problem?.kind === "expired";
+        const isSignedOut = blocked && problem?.kind === "signed_out";
+        let state = "unknown";
+        if (!blocked) {
+            state = "ok";
+            for (const limit of limits) {
+                if (STATE_RANK[limit.state] > STATE_RANK[state])
+                    state = limit.state;
+            }
+            if (limits.length === 0)
+                state = "unknown";
+        }
+        const authState = expired
+            ? "expired"
+            : isSignedOut
+                ? "signed_out"
+                : limits.length > 0
+                    ? "ok"
+                    : "unknown";
+        const home = homes[0] ?? null;
+        accounts.push({
+            accountId,
+            labels: ordered.length > 0 ? ordered : [primary],
+            organization: organization?.value ?? null,
+            homes,
+            state,
+            signedOut: isSignedOut,
+            authState,
+            observedAt: Number.isFinite(latestAt) ? new Date(latestAt).toISOString() : null,
+            reason: expired ? EXPIRED_REASON : isSignedOut ? problem?.reason ?? null : null,
+            fixCommand: expired
+                ? (provider.provider === "claude" ? claudeOpenCommand(home) : null)
+                : isSignedOut
+                    ? capacityLoginCommand(provider.provider, primary)
+                    : null,
+            limits,
+        });
+    }
+    accounts.sort((a, b) => (a.labels[0] ?? "").localeCompare(b.labels[0] ?? ""));
+    return accounts;
+}
+function problemFor(error) {
+    if (isExpiredReason(error))
+        return { kind: "expired", reason: EXPIRED_REASON };
+    if (error.startsWith(SIGNED_OUT_PREFIX) || error === "unavailable: auth" || error === "unavailable: missing_scope") {
+        return { kind: "signed_out", reason: error };
+    }
+    return null;
+}
+function eventLabels(event) {
+    const labels = [...(event.accountLabels ?? [])];
+    if (event.accountLabel && !labels.includes(event.accountLabel))
+        labels.unshift(event.accountLabel);
+    return labels.filter((label) => label.trim().length > 0);
+}
+function orderLabels(labels) {
+    const rest = labels.filter((label) => label !== "default");
+    return labels.includes("default") ? [...rest, "default"] : rest;
+}
+function cleanOrganization(value) {
+    if (typeof value !== "string")
+        return null;
+    const trimmed = value.trim();
+    if (!trimmed || trimmed.includes("@"))
+        return null;
+    return trimmed;
+}
+function copyAccountFields(target, source) {
+    if (source.accountLabel !== undefined)
+        target.accountLabel = source.accountLabel;
+    if (source.accountLabels !== undefined)
+        target.accountLabels = [...source.accountLabels];
+    if (source.organization !== undefined)
+        target.organization = cleanOrganization(source.organization);
+    if (source.accountHome !== undefined)
+        target.accountHome = source.accountHome;
+}
+function validAccountFields(value) {
+    if (value.accountLabel !== undefined && !nonEmpty(value.accountLabel))
+        return false;
+    if (value.accountLabels !== undefined) {
+        if (!Array.isArray(value.accountLabels) || !value.accountLabels.every((label) => nonEmpty(label)))
+            return false;
+    }
+    if (value.organization !== undefined && value.organization !== null && typeof value.organization !== "string") {
+        return false;
+    }
+    if (value.accountHome !== undefined && typeof value.accountHome !== "string")
+        return false;
+    return true;
+}
+function toNowLimit(bucket, nowMs) {
+    const reading = bucket.reading;
+    const derived = deriveLimit(reading, nowMs);
+    const burn = derived.state === "ok" || derived.state === "warn" || derived.state === "exhausted"
+        ? burnRate(bucket.history, nowMs)
+        : null;
+    const nowLimit = {
+        limitId: reading.limit.limitId,
+        accountId: reading.accountId,
+        kind: reading.limit.kind,
+        scope: reading.limit.scope,
+        usedPercent: derived.usedPercent,
+        windowMinutes: reading.limit.windowMinutes,
+        resetsAt: reading.limit.resetsAt,
+        secondsToReset: derived.secondsToReset,
+        burnRatePercentPerHour: burn,
+        balance: reading.limit.balance,
+        planType: reading.limit.planType,
+        state: derived.state,
+        source: reading.source,
+        confidence: reading.confidence,
+        observedAt: reading.observedAt,
+        readingId: reading.readingId,
+        cliVersion: reading.cliVersion,
+        parserVersion: reading.parserVersion,
+        lastError: derived.lastError,
+    };
+    if (reading.limit.hasCredits !== undefined)
+        nowLimit.hasCredits = reading.limit.hasCredits;
+    if (reading.limit.unlimited !== undefined)
+        nowLimit.unlimited = reading.limit.unlimited;
+    if (reading.limit.allowancePercentOfWeekly !== undefined) {
+        nowLimit.allowancePercentOfWeekly = reading.limit.allowancePercentOfWeekly;
+    }
+    if (reading.rateLimitReachedType !== undefined)
+        nowLimit.rateLimitReachedType = reading.rateLimitReachedType;
+    if (reading.spendControlReached !== undefined)
+        nowLimit.spendControlReached = reading.spendControlReached;
+    return nowLimit;
+}
+function deriveLimit(reading, nowMs) {
+    const resetsAtMs = reading.limit.resetsAt ? Date.parse(reading.limit.resetsAt) : Number.NaN;
+    const seconds = secondsUntil(reading.limit.resetsAt, nowMs);
+    if (reading.confidence === "unknown") {
+        return {
+            state: "unknown",
+            usedPercent: null,
+            secondsToReset: seconds,
+            lastError: reading.error?.trim() ? reading.error : "confidence unknown",
+        };
+    }
+    // A passed reset beats both a refusal and a 100% reading. The newest
+    // observedAt wins in materialize, so a later fetched or observed percent
+    // below 100 replaces this refusal before the reset.
+    if (!Number.isNaN(resetsAtMs) && resetsAtMs < nowMs) {
+        return { state: "reset-pending", usedPercent: null, secondsToReset: null, lastError: null };
+    }
+    const percent = reading.limit.usedPercent;
+    if (reading.source === "refusal" || (percent !== null && percent >= 100)) {
+        return { state: "exhausted", usedPercent: percent, secondsToReset: seconds, lastError: null };
+    }
+    if (percent !== null && percent >= 80) {
+        return { state: "warn", usedPercent: percent, secondsToReset: seconds, lastError: null };
+    }
+    return { state: "ok", usedPercent: percent, secondsToReset: seconds, lastError: null };
+}
+function secondsUntil(resetsAt, nowMs) {
+    if (!resetsAt)
+        return null;
+    const at = Date.parse(resetsAt);
+    if (Number.isNaN(at) || at < nowMs)
+        return null;
+    return Math.floor((at - nowMs) / 1000);
+}
+function burnRate(history, nowMs) {
+    const windowStart = nowMs - BURN_WINDOW_MS;
+    const points = history.filter((point) => point.at >= windowStart && point.at <= nowMs);
+    if (points.length < 2)
+        return null;
+    const first = points[0];
+    const last = points[points.length - 1];
+    if (!first || !last)
+        return null;
+    const hours = (last.at - first.at) / 3_600_000;
+    if (hours <= 0)
+        return null;
+    const delta = last.used - first.used;
+    if (delta < 0)
+        return null;
+    return delta / hours;
+}
+let nowWriteSerial = 0;
+function writeNow(dir, view, pid) {
+    const body = `${JSON.stringify(view, null, 2)}\n`;
+    assertNoProviderToken(body);
+    const dest = path.join(dir, NOW_FILE_NAME);
+    // A fixed `.now.<pid>.tmp` disappeared before rename when rebuild ran in a
+    // tight loop in one process (ENOENT on rename). Each write gets its own name.
+    const tmp = path.join(dir, `.now.${pid}.${++nowWriteSerial}.${process.hrtime.bigint().toString(36)}.tmp`);
+    const fd = fs.openSync(tmp, fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY, FILE_MODE);
+    try {
+        const payload = Buffer.from(body, "utf8");
+        const written = fs.writeSync(fd, payload);
+        if (written !== payload.length)
+            throw new Error("capacity now.json temp write was truncated");
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    try {
+        fs.renameSync(tmp, dest);
+    }
+    catch (err) {
+        try {
+            fs.unlinkSync(tmp);
+        }
+        catch {
+            // Cleanup must not hide the rename failure. The lock is still released.
+        }
+        throw err;
+    }
+    fs.chmodSync(dest, FILE_MODE);
+}
+function isNowView(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const view = value;
+    return typeof view.machineId === "string"
+        && view.machineId.length > 0
+        && typeof view.hqCliVersion === "string"
+        && typeof view.generatedAt === "string"
+        && Array.isArray(view.providers);
+}
+function validateReading(value) {
+    if (!isReadingShape(value))
+        throw new LedgerRejected("reading shape is invalid");
+    const limit = value.limit;
+    const usedPercent = value.confidence === "unknown" ? null : limit.usedPercent;
+    const reading = {
+        readingId: value.readingId,
+        observedAt: value.observedAt,
+        provider: value.provider,
+        accountId: value.accountId,
+        source: value.source,
+        cliVersion: value.cliVersion,
+        limit: {
+            limitId: limit.limitId,
+            kind: limit.kind,
+            scope: limit.scope,
+            usedPercent,
+            windowMinutes: limit.windowMinutes,
+            resetsAt: normalizeResetsAt(limit.resetsAt),
+            balance: limit.balance,
+            planType: limit.planType,
+        },
+        confidence: value.confidence,
+        parserVersion: value.parserVersion,
+    };
+    if (value.error !== undefined)
+        reading.error = value.error;
+    copyAccountFields(reading, value);
+    if (limit.hasCredits !== undefined)
+        reading.limit.hasCredits = limit.hasCredits;
+    if (limit.unlimited !== undefined)
+        reading.limit.unlimited = limit.unlimited;
+    if (limit.allowancePercentOfWeekly !== undefined) {
+        reading.limit.allowancePercentOfWeekly = limit.allowancePercentOfWeekly;
+    }
+    if (value.rateLimitReachedType !== undefined)
+        reading.rateLimitReachedType = value.rateLimitReachedType;
+    if (value.spendControlReached !== undefined)
+        reading.spendControlReached = value.spendControlReached;
+    return reading;
+}
+function validateProviderMeta(value) {
+    if (!isProviderMeta(value))
+        throw new LedgerRejected("provider_meta shape is invalid");
+    const event = {
+        event: "provider_meta",
+        observedAt: value.observedAt,
+        provider: value.provider,
+        source: value.source,
+        ordinaryUsageAllowed: value.ordinaryUsageAllowed,
+        rateLimitResetCredits: value.rateLimitResetCredits === null
+            ? null
+            : {
+                availableCount: value.rateLimitResetCredits.availableCount,
+                credits: value.rateLimitResetCredits.credits.map((row) => ({
+                    id: row.id,
+                    resetType: row.resetType,
+                    status: row.status,
+                    grantedAt: row.grantedAt,
+                    expiresAt: row.expiresAt,
+                    title: row.title === null ? null : redactProviderTokens(row.title),
+                    description: row.description === null ? null : redactProviderTokens(row.description),
+                })),
+            },
+    };
+    if (value.accountId !== undefined)
+        event.accountId = value.accountId;
+    if (value.cliVersion !== undefined)
+        event.cliVersion = value.cliVersion;
+    if (value.parserVersion !== undefined)
+        event.parserVersion = value.parserVersion;
+    return event;
+}
+function validateParserFailure(value) {
+    if (!isParserFailure(value))
+        throw new LedgerRejected("parser_failure shape is invalid");
+    const event = {
+        event: "parser_failure",
+        observedAt: value.observedAt,
+        provider: value.provider,
+        source: value.source,
+        error: value.error,
+    };
+    if (value.accountId !== undefined)
+        event.accountId = value.accountId;
+    if (value.cliVersion !== undefined)
+        event.cliVersion = value.cliVersion;
+    if (value.parserVersion !== undefined)
+        event.parserVersion = value.parserVersion;
+    if (value.limitId !== undefined)
+        event.limitId = value.limitId;
+    copyAccountFields(event, value);
+    return event;
+}
+function isReadingShape(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const reading = value;
+    if (reading.event === "parser_failure")
+        return false;
+    return nonEmpty(reading.readingId)
+        && isoUtc(reading.observedAt)
+        && nonEmpty(reading.provider)
+        && nonEmpty(reading.accountId)
+        && isEnum(reading.source, READING_SOURCES)
+        && nonEmpty(reading.cliVersion)
+        && isEnum(reading.confidence, CONFIDENCE_VALUES)
+        && nonEmpty(reading.parserVersion)
+        && (reading.error === undefined || typeof reading.error === "string")
+        && (reading.rateLimitReachedType === undefined
+            || reading.rateLimitReachedType === null
+            || typeof reading.rateLimitReachedType === "string")
+        && (reading.spendControlReached === undefined
+            || reading.spendControlReached === null
+            || typeof reading.spendControlReached === "boolean")
+        && validAccountFields(reading)
+        && isLimit(reading.limit);
+}
+function isLimit(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const limit = value;
+    return nonEmpty(limit.limitId)
+        && isEnum(limit.kind, LIMIT_KINDS)
+        && (limit.scope === null || typeof limit.scope === "string")
+        && (limit.usedPercent === null || finiteNumber(limit.usedPercent))
+        && (limit.windowMinutes === null || finiteNumber(limit.windowMinutes))
+        && (limit.resetsAt === null || typeof limit.resetsAt === "string" || finiteNumber(limit.resetsAt))
+        && (limit.balance === null || typeof limit.balance === "string" || finiteNumber(limit.balance))
+        && (limit.planType === null || typeof limit.planType === "string")
+        && (limit.hasCredits === undefined || limit.hasCredits === null || typeof limit.hasCredits === "boolean")
+        && (limit.unlimited === undefined || limit.unlimited === null || typeof limit.unlimited === "boolean")
+        && (limit.allowancePercentOfWeekly === undefined
+            || limit.allowancePercentOfWeekly === null
+            || finiteNumber(limit.allowancePercentOfWeekly));
+}
+function isProviderMeta(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const event = value;
+    return event.event === "provider_meta"
+        && isoUtc(event.observedAt)
+        && nonEmpty(event.provider)
+        && isEnum(event.source, READING_SOURCES)
+        && (event.ordinaryUsageAllowed === null || typeof event.ordinaryUsageAllowed === "boolean")
+        && isResetCredits(event.rateLimitResetCredits)
+        && (event.accountId === undefined || nonEmpty(event.accountId))
+        && (event.cliVersion === undefined || typeof event.cliVersion === "string")
+        && (event.parserVersion === undefined || typeof event.parserVersion === "string");
+}
+function isResetCredits(value) {
+    if (value === null)
+        return true;
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const credits = value;
+    if (!(credits.availableCount === null || finiteNumber(credits.availableCount)))
+        return false;
+    if (!Array.isArray(credits.credits))
+        return false;
+    return credits.credits.every((row) => {
+        if (!row || typeof row !== "object")
+            return false;
+        return nonEmpty(row.id)
+            && (row.resetType === null || typeof row.resetType === "string")
+            && (row.status === null || typeof row.status === "string")
+            && (row.grantedAt === null || finiteNumber(row.grantedAt))
+            && (row.expiresAt === null || finiteNumber(row.expiresAt))
+            && (row.title === null || typeof row.title === "string")
+            && (row.description === null || typeof row.description === "string");
+    });
+}
+function isParserFailure(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const event = value;
+    return event.event === "parser_failure"
+        && isoUtc(event.observedAt)
+        && nonEmpty(event.provider)
+        && isEnum(event.source, READING_SOURCES)
+        && nonEmpty(event.error)
+        && (event.accountId === undefined || nonEmpty(event.accountId))
+        && (event.cliVersion === undefined || typeof event.cliVersion === "string")
+        && (event.parserVersion === undefined || typeof event.parserVersion === "string")
+        && (event.limitId === undefined || nonEmpty(event.limitId))
+        && validAccountFields(event);
+}
+function normalizeResetsAt(value) {
+    if (value === null)
+        return null;
+    if (typeof value === "number") {
+        const ms = value < 1e12 ? value * 1000 : value;
+        return new Date(ms).toISOString();
+    }
+    if (!isoUtc(value))
+        throw new LedgerRejected("resetsAt must be UTC ISO-8601 or epoch seconds");
+    return value;
+}
+function nonEmpty(value) {
+    return typeof value === "string" && value.trim().length > 0;
+}
+function isoUtc(value) {
+    return typeof value === "string" && ISO_UTC.test(value) && !Number.isNaN(Date.parse(value));
+}
+function finiteNumber(value) {
+    return typeof value === "number" && Number.isFinite(value);
+}
+function isEnum(value, allowed) {
+    return typeof value === "string" && allowed.includes(value);
+}
+//# sourceMappingURL=ledger.js.map