@openrig/cli 0.6.11 → 0.6.12

package/daemon/dist/domain/provider/subscription-moves.js

@@ -0,0 +1,140 @@
+// The record of each subscription move an agent makes or attempts: which Codex home and seats moved,
+// from which subscription to which, why, on which readings, and how each seat came out. The agent decides and moves
+// (`rig auth switch`, then `rig seat restart --keep-conversation`, then a `--verify` check after a real turn); this
+// only keeps what it reports, in the daemon's append-only event log, for the agent and the observatory to read. It
+// holds labels and references, never credentials, and decides nothing. Its routes are off unless
+// provider.subscription_moves is on.
+import { randomBytes } from "node:crypto";
+export const SUBSCRIPTION_MOVE_EVENT = "subscription.move_recorded";
+// Move events carry no node, so `node_id IS NULL` lets both reads use idx_events_node_type_seq (node_id, type, seq)
+// instead of scanning the whole event log, which on a long-lived daemon holds millions of rows.
+export const SUBSCRIPTION_MOVE_LIST_SQL = "SELECT seq, payload, created_at FROM events WHERE node_id IS NULL AND type = ? ORDER BY seq DESC";
+export const SUBSCRIPTION_MOVE_SHOW_SQL = "SELECT seq, payload, created_at FROM events WHERE node_id IS NULL AND type = ? AND json_extract(payload, '$.move.id') = ? ORDER BY seq DESC LIMIT 1";
+const SEAT_RESULTS = new Set(["moved", "unconfirmed", "unknown"]);
+export class SubscriptionMoveInputError extends Error {
+}
+const text = (value, field, optional = false) => {
+    if (value === undefined && optional)
+        return undefined;
+    if (typeof value !== "string" || value.trim() === "")
+        throw new SubscriptionMoveInputError(`${field} must be a non-empty string`);
+    return value;
+};
+const list = (value, field, optional = false) => {
+    if (value === undefined && optional)
+        return [];
+    if (!Array.isArray(value))
+        throw new SubscriptionMoveInputError(`${field} must be a list`);
+    return value;
+};
+const object = (value, field) => {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        throw new SubscriptionMoveInputError(`${field} must be an object`);
+    return value;
+};
+/** An ISO 8601 date-time with an explicit timezone, on a real calendar date (no Feb 30): a reading's age depends on it. */
+function isIsoTimestamp(value) {
+    const match = /^(\d{4})-(\d{2})-(\d{2})T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2})$/.exec(value);
+    if (!match || Number.isNaN(Date.parse(value)))
+        return false;
+    const [year, month, day] = [Number(match[1]), Number(match[2]), Number(match[3])];
+    const calendar = new Date(Date.UTC(year, month - 1, day));
+    return calendar.getUTCFullYear() === year && calendar.getUTCMonth() === month - 1 && calendar.getUTCDate() === day;
+}
+/** The shape check for a reported move. It refuses only malformed input; it never judges the move. */
+export function parseSubscriptionMove(raw) {
+    const body = object(raw, "the move");
+    const seats = list(body["seats"], "seats").map((entry, i) => {
+        const seat = object(entry, `seats[${i}]`);
+        const result = seat["result"];
+        if (typeof result !== "string" || !SEAT_RESULTS.has(result)) {
+            throw new SubscriptionMoveInputError(`seats[${i}].result must be moved, unconfirmed or unknown`);
+        }
+        // What the result rests on is part of the record: a move's evidence, or what a lesser result is missing.
+        const evidence = text(seat["evidence"], `seats[${i}].evidence`, result !== "moved");
+        const missing = text(seat["missing"], `seats[${i}].missing`, result === "moved");
+        return {
+            seat: text(seat["seat"], `seats[${i}].seat`),
+            result: result,
+            ...(missing !== undefined ? { missing } : {}),
+            ...(evidence !== undefined ? { evidence } : {}),
+        };
+    });
+    const readingList = list(body["readings"], "readings");
+    if (readingList.length === 0)
+        throw new SubscriptionMoveInputError("readings must name what the move acted on");
+    const readings = readingList.map((entry, i) => {
+        const reading = object(entry, `readings[${i}]`);
+        const observedAt = text(reading["observedAt"], `readings[${i}].observedAt`);
+        if (!isIsoTimestamp(observedAt)) {
+            throw new SubscriptionMoveInputError(`readings[${i}].observedAt must be an ISO 8601 time with a timezone, e.g. 2026-10-18T09:56:00Z`);
+        }
+        return { subject: text(reading["subject"], `readings[${i}].subject`), observedAt, summary: text(reading["summary"], `readings[${i}].summary`) };
+    });
+    const peers = list(body["peers"], "peers", true).map((entry, i) => {
+        const peer = object(entry, `peers[${i}]`);
+        return { seat: text(peer["seat"], `peers[${i}].seat`), note: text(peer["note"], `peers[${i}].note`) };
+    });
+    // A home switch can leave every seat as a peer (all mid-turn or running services): record that honestly.
+    if (seats.length === 0 && peers.length === 0)
+        throw new SubscriptionMoveInputError("seats or peers must name at least one seat");
+    const host = text(body["host"], "host", true);
+    const supersedes = text(body["supersedes"], "supersedes", true);
+    return {
+        home: text(body["home"], "home"),
+        ...(host ? { host } : {}),
+        from: text(body["from"], "from"),
+        to: text(body["to"], "to"),
+        reason: text(body["reason"], "reason"),
+        readings,
+        seats,
+        ...(peers.length ? { peers } : {}),
+        ...(supersedes ? { supersedes } : {}),
+    };
+}
+export class SubscriptionMoves {
+    eventBus;
+    constructor(eventBus) {
+        this.eventBus = eventBus;
+    }
+    record(input, recordedBy, recordedVia) {
+        const id = `move-${new Date().toISOString().replace(/\D/g, "").slice(0, 14)}-${randomBytes(4).toString("hex")}`;
+        const persisted = this.eventBus.emit({ type: SUBSCRIPTION_MOVE_EVENT, move: { id, recordedBy, recordedVia, ...input } });
+        return { id, recordedBy, recordedVia, ...input, recordedAt: persisted.createdAt, seq: persisted.seq };
+    }
+    /** Newest first. A seat filter matches a moved seat or a peer. */
+    list(filter = {}) {
+        // Iterate, newest first, and stop as soon as the filtered limit is met: no reading the whole history for one row.
+        const rows = this.eventBus.db.prepare(SUBSCRIPTION_MOVE_LIST_SQL)
+            .iterate(SUBSCRIPTION_MOVE_EVENT);
+        const records = [];
+        for (const row of rows) {
+            const record = toRecord(row);
+            if (!record)
+                continue;
+            if (filter.home && record.home !== filter.home)
+                continue;
+            if (filter.seat && !record.seats.some((s) => s.seat === filter.seat) && !(record.peers ?? []).some((p) => p.seat === filter.seat))
+                continue;
+            records.push(record);
+            if (records.length >= (filter.limit ?? 50))
+                break;
+        }
+        return records;
+    }
+    show(id) {
+        const row = this.eventBus.db.prepare(SUBSCRIPTION_MOVE_SHOW_SQL)
+            .get(SUBSCRIPTION_MOVE_EVENT, id);
+        return row ? toRecord(row) : null;
+    }
+}
+function toRecord(row) {
+    try {
+        const move = JSON.parse(row.payload).move;
+        return move ? { ...move, recordedAt: row.created_at, seq: row.seq } : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=subscription-moves.js.map

package/daemon/dist/domain/provider/subscription-moves.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscription-moves.js","sourceRoot":"","sources":["../../../src/domain/provider/subscription-moves.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,oHAAoH;AACpH,oHAAoH;AACpH,mHAAmH;AACnH,iGAAiG;AACjG,qCAAqC;AAErC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,MAAM,CAAC,MAAM,uBAAuB,GAAG,4BAAqC,CAAC;AAE7E,oHAAoH;AACpH,gGAAgG;AAChG,MAAM,CAAC,MAAM,0BAA0B,GACrC,kGAAkG,CAAC;AACrG,MAAM,CAAC,MAAM,0BAA0B,GACrC,qJAAqJ,CAAC;AAIxJ,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;AAsDvF,MAAM,OAAO,0BAA2B,SAAQ,KAAK;CAAG;AAExD,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,KAAa,EAAE,QAAQ,GAAG,KAAK,EAAsB,EAAE;IACnF,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,0BAA0B,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IAClI,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AACF,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,KAAa,EAAE,QAAQ,GAAG,KAAK,EAAa,EAAE;IAC1E,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,0BAA0B,CAAC,GAAG,KAAK,iBAAiB,CAAC,CAAC;IAC3F,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AACF,MAAM,MAAM,GAAG,CAAC,KAAc,EAAE,KAAa,EAA2B,EAAE;IACxE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,0BAA0B,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAC5I,OAAO,KAAgC,CAAC;AAC1C,CAAC,CAAC;AAEF,2HAA2H;AAC3H,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,KAAK,GAAG,2EAA2E,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtG,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO,QAAQ,CAAC,cAAc,EAAE,KAAK,IAAI,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,KAAK,GAAG,CAAC,IAAI,QAAQ,CAAC,UAAU,EAAE,KAAK,GAAG,CAAC;AACrH,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,0BAA0B,CAAC,SAAS,CAAC,gDAAgD,CAAC,CAAC;QACnG,CAAC;QACD,yGAAyG;QACzG,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC;QACjF,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAE;YAC7C,MAAM,EAAE,MAAwB;YAChC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;IACvD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,0BAA0B,CAAC,2CAA2C,CAAC,CAAC;IAChH,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC,cAAc,CAAE,CAAC;QAC7E,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,0BAA0B,CAAC,YAAY,CAAC,kFAAkF,CAAC,CAAC;QACxI,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC,WAAW,CAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC,WAAW,CAAE,EAAE,CAAC;IACpJ,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAChE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAE,EAAE,CAAC;IAC1G,CAAC,CAAC,CAAC;IACH,yGAAyG;IACzG,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,0BAA0B,CAAC,4CAA4C,CAAC,CAAC;IACjI,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;IAChE,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAE;QACjC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAE;QACjC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAE;QAC3B,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAE;QACvC,QAAQ;QACR,KAAK;QACL,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,iBAAiB;IACC;IAA7B,YAA6B,QAAkB;QAAlB,aAAQ,GAAR,QAAQ,CAAU;IAAG,CAAC;IAEnD,MAAM,CAAC,KAA4B,EAAE,UAAkB,EAAE,WAAmB;QAC1E,MAAM,EAAE,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAChH,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;QACzH,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC;IACxG,CAAC;IAED,kEAAkE;IAClE,IAAI,CAAC,SAA2D,EAAE;QAChE,kHAAkH;QAClH,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC;aAC9D,OAAO,CAAC,uBAAuB,CAAmE,CAAC;QACtG,MAAM,OAAO,GAA6B,EAAE,CAAC;QAC7C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;gBAAE,SAAS;YACzD,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC5I,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;gBAAE,MAAM;QACpD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,CAAC,EAAU;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC;aAC7D,GAAG,CAAC,uBAAuB,EAAE,EAAE,CAAqE,CAAC;QACxG,OAAO,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,GAAyD;IACzE,IAAI,CAAC;QACH,MAAM,IAAI,GAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAA6C,CAAC,IAAI,CAAC;QACvF,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/daemon/dist/domain/provider/usage-across-hosts.d.ts

@@ -0,0 +1,162 @@
+import type { AggregatedPayload, PerHostStatus } from "../hosts/fanout-contract.js";
+import type { HostEntry, HostRegistryLoadResult } from "../hosts/hosts-registry-reader.js";
+import { type RemoteJsonResult } from "../hosts/remote-daemon-http.js";
+import type { FourBlockReadModel, ProviderKind, ProviderUsageAllowance, SeatConfiguredAccount } from "./provider-types.js";
+/** Reading a host's served model is an ordinary read: the same 5 s class as the read-through and the feed. */
+export declare const USAGE_HOSTS_READ_TIMEOUT_MS = 5000;
+export declare const USAGE_HOSTS_READ_CONCURRENCY = 4;
+/** The whole view answers within this, whatever the registry's size: hosts not heard from by then are listed as such,
+ *  and the rest are served. One host takes at most 10 s (5 s status, then 5 s settings when it's off or older), so the
+ *  first four hosts always fit; a caller waiting 20 s has 5 s left for this host's own read and the transfer. */
+export declare const USAGE_HOSTS_VIEW_DEADLINE_MS = 15000;
+/** The largest answer read from a host (status, settings or refresh), stopped at the bound and never parsed. A status
+ *  answer with both providers and a few dozen seats is tens of kilobytes; 1 MiB leaves room for hundreds of seats. */
+export declare const USAGE_HOSTS_MAX_BYTES: number;
+/** The deepest nesting accepted in a host's answer. Today's deepest is about seven levels (a status answer's usage row,
+ *  window, disagreeing seat); past 32 the answer is malformed, and that host is unavailable. */
+export declare const USAGE_HOSTS_MAX_DEPTH = 32;
+/** What replaces any string from a host that contains the bearer configured for that host. */
+export declare const BEARER_REDACTED = "[redacted: contained this host's bearer]";
+/** A refresh leg waits for the host's own bounded native read plus stopping what it started (Codex 35 s + ~8 s;
+ *  Claude's auth status 10 s + ~3 s), with a margin for the network. Never the 5 s read class. */
+export declare const REMOTE_USAGE_REFRESH_DEADLINE_MS: Record<ProviderKind, number>;
+export type HostUsageCoverage = "served" | "off" | "older" | "unavailable";
+export interface UsageRefreshLeg {
+    hostId: string;
+    provider: ProviderKind;
+    at: string;
+    outcome: "ok" | "failed";
+    /** True when this request joined a leg already running, here or at the host. */
+    coalesced: boolean;
+    reason?: string;
+    detail?: string;
+}
+export interface UsageHostStatus extends PerHostStatus {
+    /** Whether this host serves usage windows, apart from whether it answered. */
+    usage: HostUsageCoverage;
+    usageReason?: string;
+    /** When this daemon read the host; null when it couldn't be read. */
+    readAt: string | null;
+    /** The last refresh leg this daemon ran to the host, per provider (kept in memory). */
+    lastRefresh?: Partial<Record<ProviderKind, UsageRefreshLeg>>;
+}
+export interface UsageObservation {
+    hostId: string;
+    readAt: string;
+    /** The host's own served row, verbatim. */
+    row: ProviderUsageAllowance;
+}
+/**
+ * Between the observations inside one group. single: one host observed it. same: several hosts observed one allowance
+ * (each observation kept; never summed). conflict: several hosts observed one allowance and disagree about a window's
+ * reset. unknown: the identity is unresolved, or one host's observation of an id can't be linked to other hosts'
+ * observations of it (the notes name them).
+ */
+export type UsageLinkage = "single" | "same" | "conflict" | "unknown";
+export interface UsageAllowanceGroup {
+    provider: ProviderKind;
+    /** The allowance identity key the hosts key their rows by; null when unresolved. */
+    key: string | null;
+    linkage: UsageLinkage;
+    observations: UsageObservation[];
+    notes: string[];
+}
+export interface UsageAcrossHosts extends AggregatedPayload<UsageAllowanceGroup> {
+    hosts: UsageHostStatus[];
+    /** Registry entries that name this daemon itself, so not read twice. */
+    skipped: Array<{
+        hostId: string;
+        reason: string;
+    }>;
+    registry: {
+        state: "read" | "absent" | "unreadable";
+        note?: string;
+    };
+    /** Each host's configured seat accounts, verbatim; never linked to an allowance. */
+    seatAccounts: Array<{
+        hostId: string;
+        seats: SeatConfiguredAccount[];
+    }>;
+    asOf: string;
+}
+/** The key a host keyed this row by (the same functions the hosts use); null when unresolved or never read. */
+export declare function allowanceKey(row: ProviderUsageAllowance): string | null;
+/**
+ * Which observations may be linked across hosts. Claude's key already includes the email. Codex's doesn't: within
+ * one host a single login is read, but across hosts the same account or workspace id can come with different login
+ * emails, and the source can't tell one allowance from a workspace whose members have their own limits. So across
+ * hosts a Codex observation links only under the same login email too; the rest stay apart as unknown linkage. A
+ * missing (or empty) email is no evidence of the same login, so an observation without one links to nothing on
+ * another host.
+ */
+export declare function crossHostLinkKey(row: ProviderUsageAllowance, key: string, hostId: string): string;
+export declare function groupUsageAcrossHosts(observations: UsageObservation[]): UsageAllowanceGroup[];
+export interface UsageHostsDeps {
+    loadRegistry: () => HostRegistryLoadResult;
+    selfHostId: string | null;
+    /** Narrow the remote hosts to these registry ids (this daemon is always included). */
+    only?: string[];
+    lastRefresh?: (hostId: string) => Partial<Record<ProviderKind, UsageRefreshLeg>> | undefined;
+    fetchImpl?: typeof fetch;
+    env?: Record<string, string | undefined>;
+    readFile?: (path: string) => string;
+    readTimeoutMs?: number;
+    viewDeadlineMs?: number;
+    concurrency?: number;
+    now?: () => string;
+}
+export type HostSelection = {
+    ok: true;
+    remotes: HostEntry[];
+    skipped: UsageAcrossHosts["skipped"];
+    registry: UsageAcrossHosts["registry"];
+} | {
+    ok: false;
+    error: string;
+};
+/** The registry hosts a call covers: every entry (ssh ones are reported, not read), minus this daemon itself. */
+export declare function selectUsageHosts(deps: Pick<UsageHostsDeps, "loadRegistry" | "selfHostId" | "only">): HostSelection;
+type Check = (v: unknown) => boolean;
+/** A served row with every field the grouping and the views read, typed as provider-types.ts says. */
+export declare function isUsageRow(v: unknown): v is ProviderUsageAllowance;
+/** A served seat account with every field the views read, typed as provider-types.ts says. */
+export declare const isSeat: Check;
+/**
+ * A host's answer with any string that contains the bearer configured for that host replaced, and any key that
+ * contains it dropped, so a host echoing it can't put it in the view, the CLI or the kept refresh record (the same
+ * rule as the Pi charge lookup's key echo). The bearer is resolved by the transport's own resolver and never logged.
+ */
+export declare function scrubBearer(value: unknown, bearer: string | undefined, depth?: number): unknown;
+/** A host's answer nested past USAGE_HOSTS_MAX_DEPTH. */
+export declare class AnswerTooDeep extends Error {
+    constructor();
+}
+/** The view across hosts. The caller has checked that this daemon serves usage windows (`local.usage` present). */
+export declare function readUsageAcrossHosts(local: FourBlockReadModel, selection: Extract<HostSelection, {
+    ok: true;
+}>, deps: UsageHostsDeps): Promise<UsageAcrossHosts>;
+type LegResult = Omit<UsageRefreshLeg, "hostId" | "provider" | "coalesced"> & {
+    coalesced?: boolean;
+};
+/** Maps a host's answer to its refresh route into a leg. The host keeps its own reading on its own failure. */
+export declare function remoteRefreshLeg(res: RemoteJsonResult, provider: ProviderKind, deadlineMs: number, at: string): LegResult;
+/**
+ * Refresh legs, one per (host, provider) at a time: a request that overlaps a running leg joins it. The last leg per
+ * host and provider is kept in memory (a daemon restart forgets it, as each host's own last refresh is forgotten).
+ */
+export declare class UsageRefreshLegs {
+    private readonly opts;
+    private readonly inflight;
+    private readonly last;
+    constructor(opts?: {
+        deadlineMs?: Partial<Record<ProviderKind, number>>;
+        now?: () => string;
+    });
+    deadlineFor(provider: ProviderKind): number;
+    lastFor(hostId: string): Partial<Record<ProviderKind, UsageRefreshLeg>> | undefined;
+    run(hostId: string, provider: ProviderKind, start: () => Promise<LegResult>): Promise<UsageRefreshLeg>;
+    /** One leg to a registry host's own refresh route, bounded by the provider's refresh deadline. */
+    remote(host: HostEntry, provider: ProviderKind, deps: Pick<UsageHostsDeps, "fetchImpl" | "env" | "readFile">): Promise<UsageRefreshLeg>;
+}
+export {};
+//# sourceMappingURL=usage-across-hosts.d.ts.map

package/daemon/dist/domain/provider/usage-across-hosts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage-across-hosts.d.ts","sourceRoot":"","sources":["../../../src/domain/provider/usage-across-hosts.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEpF,OAAO,KAAK,EAAE,SAAS,EAAE,sBAAsB,EAAiB,MAAM,mCAAmC,CAAC;AAC1G,OAAO,EAAoC,KAAK,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAGzG,OAAO,KAAK,EAEV,kBAAkB,EAClB,YAAY,EACZ,sBAAsB,EACtB,qBAAqB,EAEtB,MAAM,qBAAqB,CAAC;AAG7B,8GAA8G;AAC9G,eAAO,MAAM,2BAA2B,OAAQ,CAAC;AACjD,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAE9C;;iHAEiH;AACjH,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD;sHACsH;AACtH,eAAO,MAAM,qBAAqB,QAAc,CAAC;AAEjD;gGACgG;AAChG,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC,8FAA8F;AAC9F,eAAO,MAAM,eAAe,6CAA6C,CAAC;AAE1E;kGACkG;AAClG,eAAO,MAAM,gCAAgC,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAqC,CAAC;AAEhH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,KAAK,GAAG,OAAO,GAAG,aAAa,CAAC;AAE3E,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,YAAY,CAAC;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,IAAI,GAAG,QAAQ,CAAC;IACzB,gFAAgF;IAChF,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACpD,8EAA8E;IAC9E,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qEAAqE;IACrE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,uFAAuF;IACvF,WAAW,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,GAAG,EAAE,sBAAsB,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;AAEtE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,YAAY,CAAC;IACvB,oFAAoF;IACpF,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,OAAO,EAAE,YAAY,CAAC;IACtB,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB,CAAC,mBAAmB,CAAC;IAC9E,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,wEAAwE;IACxE,OAAO,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnD,QAAQ,EAAE;QAAE,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,YAAY,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACrE,oFAAoF;IACpF,YAAY,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,qBAAqB,EAAE,CAAA;KAAE,CAAC,CAAC;IACxE,IAAI,EAAE,MAAM,CAAC;CACd;AAID,+GAA+G;AAC/G,wBAAgB,YAAY,CAAC,GAAG,EAAE,sBAAsB,GAAG,MAAM,GAAG,IAAI,CAKvE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,sBAAsB,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAIjG;AA4BD,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,gBAAgB,EAAE,GAAG,mBAAmB,EAAE,CA8C7F;AAID,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,sBAAsB,CAAC;IAC3C,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,sFAAsF;IACtF,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC,GAAG,SAAS,CAAC;IAC7F,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,SAAS,EAAE,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAA;CAAE,GAChH;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC,iHAAiH;AACjH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,cAAc,GAAG,YAAY,GAAG,MAAM,CAAC,GAAG,aAAa,CA4BlH;AAOD,KAAK,KAAK,GAAG,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC;AA8DrC,sGAAsG;AACtG,wBAAgB,UAAU,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,sBAAsB,CAIlE;AAOD,8FAA8F;AAC9F,eAAO,MAAM,MAAM,OAcjB,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,SAAI,GAAG,OAAO,CAW1F;AAED,yDAAyD;AACzD,qBAAa,aAAc,SAAQ,KAAK;;CAIvC;AA0ID,mHAAmH;AACnH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,kBAAkB,EACzB,SAAS,EAAE,OAAO,CAAC,aAAa,EAAE;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,CAAC,EAC/C,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,gBAAgB,CAAC,CAqD3B;AAID,KAAK,SAAS,GAAG,IAAI,CAAC,eAAe,EAAE,QAAQ,GAAG,UAAU,GAAG,WAAW,CAAC,GAAG;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtG,+GAA+G;AAC/G,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,SAAS,CAgCzH;AAED;;;GAGG;AACH,qBAAa,gBAAgB;IAIf,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+C;IACxE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqE;gBAE7D,IAAI,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;KAAO;IAElH,WAAW,CAAC,QAAQ,EAAE,YAAY,GAAG,MAAM;IAI3C,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC,GAAG,SAAS;IAI7E,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC;IA2B5G,kGAAkG;IAClG,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,GAAG,KAAK,GAAG,UAAU,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC;CAYxI"}