@subvalue/cli 0.1.3 → 0.1.4

package/dist/packages/cli/src/server.js

@@ -1,76 +1,320 @@
 import http from 'node:http';
 import fs from 'node:fs';
 import path from 'node:path';
-import {randomBytes,timingSafeEqual} from 'node:crypto';
-                                                     
-import {scan,                 } from '../../core/src/scanner.js';
-import {dateRange,summarize} from '../../core/src/summary.js';
-import {demoData} from '../../core/src/demo.js';
-                                                      
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+                                                       
+import { scan,                   } from '../../core/src/scanner.js';
+import { dateRange, summarize } from '../../core/src/summary.js';
+import { demoData } from '../../core/src/demo.js';
+import {
+  defaultSettings,
+                   
+                
+                   
+} from '../../core/src/types.js';
                                                          
                                                        
-import {safeDirectory} from '../../core/src/security.js';
-import {subscriptionPlan} from '../../core/src/subscriptions.js';
-const mime                      ={'.html':'text/html; charset=utf-8','.js':'text/javascript; charset=utf-8','.css':'text/css; charset=utf-8','.svg':'image/svg+xml','.woff2':'font/woff2','.txt':'text/plain; charset=utf-8'};
-export function validateSettings(value    )         {
-  if(!value||value.currency!=='USD'||typeof value.onboarded!=='boolean')throw new Error('Invalid settings');
-  const s         ={onboarded:value.onboarded,currency:'USD',billing:{}                       ,include:{}                       };
-  if(value.receiptTheme!==undefined){if(!['dark','light'].includes(value.receiptTheme))throw new Error('Invalid receipt theme');s.receiptTheme=value.receiptTheme;}
-  for(const provider of ['codex','claude']         ){const b=value.billing?.[provider];if(!b||!['UNKNOWN','SUBSCRIPTION','API','MIXED'].includes(b.mode)||typeof value.include?.[provider]!=='boolean')throw new Error('Invalid billing settings');if(b.monthly!==null&&(typeof b.monthly!=='number'||!Number.isFinite(b.monthly)||b.monthly<0||b.monthly>1000000))throw new Error('Invalid subscription amount');
-    const plan=b.planId==null?undefined:subscriptionPlan(provider,b.planId);if(b.planId!=null&&!plan)throw new Error('Invalid subscription plan');
-    if(b.mode==='SUBSCRIPTION'&&plan&&(b.monthly===null||Math.abs(b.monthly-plan.monthly)>.005))throw new Error('Subscription amount does not match the selected plan');
-    s.billing[provider]={mode:b.mode,monthly:b.mode==='SUBSCRIPTION'?(plan?.monthly??b.monthly):null};if(b.mode==='SUBSCRIPTION'&&b.planId!==undefined)s.billing[provider].planId=plan?.id??null;s.include[provider]=value.include[provider];}return s;
+import { isRecord } from '../../core/src/metadata.js';
+import { safeDirectory } from '../../core/src/security.js';
+import { subscriptionPlan } from '../../core/src/subscriptions.js';
+const mime                         = {
+  '.html': 'text/html; charset=utf-8',
+  '.js': 'text/javascript; charset=utf-8',
+  '.css': 'text/css; charset=utf-8',
+  '.svg': 'image/svg+xml',
+  '.woff2': 'font/woff2',
+  '.txt': 'text/plain; charset=utf-8',
+};
+const billingModes = ['UNKNOWN', 'SUBSCRIPTION', 'API', 'MIXED']         ;
+const isBillingMode = (value         )                       =>
+  billingModes.some((mode) => mode === value);
+
+export function validateSettings(value         )           {
+  if (!isRecord(value) || value.currency !== 'USD' || typeof value.onboarded !== 'boolean')
+    throw new Error('Invalid settings');
+  if (!isRecord(value.billing) || !isRecord(value.include))
+    throw new Error('Invalid billing settings');
+  const settings = defaultSettings();
+  settings.onboarded = value.onboarded;
+  if (value.receiptTheme !== undefined) {
+    if (value.receiptTheme !== 'dark' && value.receiptTheme !== 'light')
+      throw new Error('Invalid receipt theme');
+    settings.receiptTheme = value.receiptTheme;
+  }
+  for (const provider of ['codex', 'claude']         ) {
+    const billing = value.billing[provider];
+    const included = value.include[provider];
+    if (!isRecord(billing) || !isBillingMode(billing.mode) || typeof included !== 'boolean')
+      throw new Error('Invalid billing settings');
+    const monthly = billing.monthly;
+    if (
+      monthly !== null &&
+      (typeof monthly !== 'number' || !Number.isFinite(monthly) || monthly < 0 || monthly > 1000000)
+    )
+      throw new Error('Invalid subscription amount');
+    const planId = billing.planId;
+    if (planId != null && typeof planId !== 'string') throw new Error('Invalid subscription plan');
+    const plan = planId == null ? undefined : subscriptionPlan(provider, planId);
+    if (planId != null && !plan) throw new Error('Invalid subscription plan');
+    if (
+      billing.mode === 'SUBSCRIPTION' &&
+      plan &&
+      (monthly === null || Math.abs(monthly - plan.monthly) > 0.005)
+    )
+      throw new Error('Subscription amount does not match the selected plan');
+    settings.billing[provider] = {
+      mode: billing.mode,
+      monthly: billing.mode === 'SUBSCRIPTION' ? (plan?.monthly ?? monthly) : null,
+    };
+    if (billing.mode === 'SUBSCRIPTION' && planId !== undefined)
+      settings.billing[provider].planId = plan?.id ?? null;
+    settings.include[provider] = included;
+  }
+  return settings;
 }
-export async function startServer(options                                                                             ){
-  const secret=randomBytes(32).toString('hex');const demo=options.demo?demoData():null;let demoSettings=demo?.settings;let scanning=false;let progress                  =null;let sessionOrigin='';
-  let revision='',history                   =null;const summaries=new Map                ();
-  const invalidate=()=>{revision='';history=null;summaries.clear();};
-  const server=http.createServer(async(req,res)=>{
-    const headers={'Cache-Control':'no-store','X-Content-Type-Options':'nosniff','Referrer-Policy':'no-referrer','Cross-Origin-Resource-Policy':'same-origin','X-Frame-Options':'DENY','Content-Security-Policy':"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' blob: data:; connect-src 'self'; font-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'"};
-    const json=(status       ,data        )=>{res.writeHead(status,{...headers,'Content-Type':'application/json'});res.end(JSON.stringify(data));};
-    const expectedHost=new URL(sessionOrigin).host;
-    if(req.headers.host!==expectedHost){json(403,{error:'Host denied'});return;}
-    if(req.headers.origin&&req.headers.origin!==sessionOrigin){json(403,{error:'Origin denied'});return;}
-    if(req.headers['sec-fetch-site']==='cross-site'){json(403,{error:'Cross-site access denied'});return;}
-    const url=new URL(req.url??'/',sessionOrigin);
-    try{
-      if(url.pathname.startsWith('/api/')){
+export async function startServer(options   
+                
+               
+                          
+                 
+                
+ ) {
+  const secret = randomBytes(32).toString('hex');
+  const demo = options.demo ? demoData() : null;
+  let demoSettings = demo?.settings;
+  let scanning = false;
+  let progress                      = null;
+  let sessionOrigin = '';
+  let scanCompletion                       = null;
+  let revision = '',
+    history                       = null;
+  const summaries = new Map                 ();
+  const invalidate = () => {
+    revision = '';
+    history = null;
+    summaries.clear();
+  };
+  const server = http.createServer(async (req, res) => {
+    const headers = {
+      'Cache-Control': 'no-store',
+      'X-Content-Type-Options': 'nosniff',
+      'Referrer-Policy': 'no-referrer',
+      'Cross-Origin-Resource-Policy': 'same-origin',
+      'X-Frame-Options': 'DENY',
+      'Content-Security-Policy':
+        "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' blob: data:; connect-src 'self'; font-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'",
+    };
+    const json = (status        , data         ) => {
+      res.writeHead(status, { ...headers, 'Content-Type': 'application/json' });
+      res.end(JSON.stringify(data));
+    };
+    const expectedHost = new URL(sessionOrigin).host;
+    if (req.headers.host !== expectedHost) {
+      json(403, { error: 'Host denied' });
+      return;
+    }
+    if (req.headers.origin && req.headers.origin !== sessionOrigin) {
+      json(403, { error: 'Origin denied' });
+      return;
+    }
+    if (req.headers['sec-fetch-site'] === 'cross-site') {
+      json(403, { error: 'Cross-site access denied' });
+      return;
+    }
+    const url = new URL(req.url ?? '/', sessionOrigin);
+    try {
+      if (url.pathname.startsWith('/api/')) {
         // The bootstrap is same-origin only. Mutations require its per-launch token.
-        if(url.pathname==='/api/bootstrap'&&req.method==='GET'){json(200,{token:secret,settings:demoSettings??options.store .settings(),sources:demo?.statuses??options.store .statuses(),demo:!!demo,lastScan:options.store?.get('lastScan')??null,scanning,progress});return;}
-        if(url.pathname==='/api/summary'&&req.method==='GET'){
-          if(scanning){json(503,{error:'Scan in progress'});return;}
-          const range=dateRange(url.searchParams.get('period')??'30d',new Date(),url.searchParams.get('from')??undefined,url.searchParams.get('to')??undefined,url.searchParams.get('month')??undefined,url.searchParams.get('anchor')??undefined);
+        if (url.pathname === '/api/bootstrap' && req.method === 'GET') {
+          json(200, {
+            token: secret,
+            settings: demoSettings ?? options.store .settings(),
+            sources: demo?.statuses ?? options.store .statuses(),
+            demo: !!demo,
+            lastScan: options.store?.get        ('lastScan') ?? null,
+            scanning,
+            progress,
+          }                            );
+          return;
+        }
+        if (url.pathname === '/api/summary' && req.method === 'GET') {
+          if (scanning) {
+            json(503, { error: 'Scan in progress' });
+            return;
+          }
+          const range = dateRange(
+            url.searchParams.get('period') ?? '30d',
+            new Date(),
+            url.searchParams.get('from') ?? undefined,
+            url.searchParams.get('to') ?? undefined,
+            url.searchParams.get('month') ?? undefined,
+            url.searchParams.get('anchor') ?? undefined,
+          );
           // History bounds use all normalized metadata, never original transcripts.
-          const currentRevision=demo?'demo':options.store .revision();if(currentRevision!==revision){invalidate();revision=currentRevision;}
-          const key=JSON.stringify(range);let result=summaries.get(key);
-          if(!result){history??=demo?.records??options.store .records();result=summarize(history,demo?.statuses??options.store .statuses(),demoSettings??options.store .settings(),range,demo?.catalog,!!demo);if(summaries.size>=16)summaries.delete(summaries.keys().next().value );summaries.set(key,result);}
-          json(200,result);return;
+          const currentRevision = demo ? 'demo' : options.store .revision();
+          if (currentRevision !== revision) {
+            invalidate();
+            revision = currentRevision;
+          }
+          const key = JSON.stringify(range);
+          let result = summaries.get(key);
+          if (!result) {
+            history ??= demo?.records ?? options.store .records();
+            result = summarize(
+              history,
+              demo?.statuses ?? options.store .statuses(),
+              demoSettings ?? options.store .settings(),
+              range,
+              demo?.catalog,
+              !!demo,
+            );
+            if (summaries.size >= 16) summaries.delete(summaries.keys().next().value );
+            summaries.set(key, result);
+          }
+          json(200, result);
+          return;
+        }
+        const given = req.headers['x-subvalue-token'];
+        if (
+          typeof given !== 'string' ||
+          given.length !== secret.length ||
+          !timingSafeEqual(Buffer.from(given), Buffer.from(secret))
+        ) {
+          json(403, { error: 'Session token required' });
+          return;
         }
-        const given=req.headers['x-subvalue-token'];if(typeof given!=='string'||given.length!==secret.length||!timingSafeEqual(Buffer.from(given),Buffer.from(secret))){json(403,{error:'Session token required'});return;}
-        if(url.pathname==='/api/settings'&&req.method==='POST'){
-          let body='';for await(const chunk of req){body+=chunk;if(body.length>16384){json(413,{error:'Request too large'});return;}}
-          const settings=validateSettings(JSON.parse(body));if(demo)demoSettings=settings;else options.store .saveSettings(settings);invalidate();json(200,{saved:true});return;
+        if (url.pathname === '/api/settings' && req.method === 'POST') {
+          let body = '';
+          for await (const chunk of req) {
+            body += chunk;
+            if (body.length > 16384) {
+              json(413, { error: 'Request too large' });
+              return;
+            }
+          }
+          const settings = validateSettings(JSON.parse(body));
+          // A rescan holds a transaction on this connection while streaming files.
+          // Save independently after it ends, so a later rollback cannot erase
+          // settings that the browser has already been told were persisted.
+          while (scanCompletion) await scanCompletion;
+          if (demo) demoSettings = settings;
+          else options.store .saveSettings(settings);
+          invalidate();
+          json(200, { saved: true });
+          return;
         }
-        if(url.pathname==='/api/rescan'&&req.method==='POST'){
-          if(demo){json(200,{scanning:false});return;}if(scanning){json(409,{error:'Scan already running'});return;}scanning=true;json(202,{scanning:true});
-          void scan(options.store ,{home:options.home,onProgress:p=>{progress=p;}}).catch(()=>{progress=null;}).finally(()=>{invalidate();scanning=false;});return;
+        if (url.pathname === '/api/rescan' && req.method === 'POST') {
+          if (demo) {
+            json(200, { scanning: false });
+            return;
+          }
+          if (scanning) {
+            json(409, { error: 'Scan already running' });
+            return;
+          }
+          scanning = true;
+          json(202, { scanning: true });
+          scanCompletion = scan(options.store , {
+            home: options.home,
+            onProgress: (p) => {
+              progress = p;
+            },
+          })
+            .then(() => {})
+            .catch(() => {
+              progress = null;
+            })
+            .finally(() => {
+              invalidate();
+              scanning = false;
+              scanCompletion = null;
+            });
+          return;
         }
-        json(404,{error:'Not found'});return;
+        json(404, { error: 'Not found' });
+        return;
+      }
+      if (req.method !== 'GET' && req.method !== 'HEAD') {
+        json(405, { error: 'Method not allowed' });
+        return;
+      }
+      const name =
+        url.pathname === '/' || ['/overview', '/receipt', '/settings'].includes(url.pathname)
+          ? 'index.html'
+          : url.pathname === '/landing'
+            ? 'landing.html'
+            : url.pathname.slice(1);
+      if (!/^[a-zA-Z0-9_./-]+$/.test(name) || name.includes('..') || !mime[path.extname(name)]) {
+        json(404, { error: 'Not found' });
+        return;
+      }
+      const base = path.resolve(options.publicDirectory),
+        target = path.resolve(base, name);
+      if (
+        !target.startsWith(base + path.sep) ||
+        !safeDirectory(path.dirname(target)) ||
+        !fs.existsSync(target)
+      ) {
+        json(404, { error: 'Not found' });
+        return;
+      }
+      const before = fs.lstatSync(target);
+      if (
+        !before.isFile() ||
+        before.isSymbolicLink() ||
+        !fs.realpathSync(target).startsWith(fs.realpathSync(base) + path.sep)
+      ) {
+        json(404, { error: 'Not found' });
+        return;
+      }
+      if (req.method === 'HEAD') {
+        res.writeHead(200, { ...headers, 'Content-Type': mime[path.extname(target)] });
+        res.end();
+        return;
+      }
+      const fd = fs.openSync(target, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0)),
+        after = fs.fstatSync(fd);
+      if (before.ino !== after.ino || before.dev !== after.dev) {
+        fs.closeSync(fd);
+        json(404, { error: 'Not found' });
+        return;
       }
-      if(req.method!=='GET'&&req.method!=='HEAD'){json(405,{error:'Method not allowed'});return;}
-      const name=url.pathname==='/'||['/overview','/receipt','/settings'].includes(url.pathname)?'index.html':url.pathname==='/landing'?'landing.html':url.pathname.slice(1);
-      if(!/^[a-zA-Z0-9_./-]+$/.test(name)||name.includes('..')||!mime[path.extname(name)]){json(404,{error:'Not found'});return;}
-      const base=path.resolve(options.publicDirectory),target=path.resolve(base,name);
-      if(!target.startsWith(base+path.sep)||!safeDirectory(path.dirname(target))||!fs.existsSync(target)){json(404,{error:'Not found'});return;}
-      const before=fs.lstatSync(target);if(!before.isFile()||before.isSymbolicLink()||!fs.realpathSync(target).startsWith(fs.realpathSync(base)+path.sep)){json(404,{error:'Not found'});return;}
-      if(req.method==='HEAD'){res.writeHead(200,{...headers,'Content-Type':mime[path.extname(target)]});res.end();return;}
-      const fd=fs.openSync(target,fs.constants.O_RDONLY|(fs.constants.O_NOFOLLOW??0)),after=fs.fstatSync(fd);
-      if(before.ino!==after.ino||before.dev!==after.dev){fs.closeSync(fd);json(404,{error:'Not found'});return;}
-      res.writeHead(200,{...headers,'Content-Type':mime[path.extname(target)]});
-      const stream=fs.createReadStream(target,{fd,autoClose:true});stream.on('error',()=>res.destroy());res.once('close',()=>stream.destroy());stream.pipe(res);
-    }catch{json(400,{error:'Unable to complete request'});}
+      res.writeHead(200, { ...headers, 'Content-Type': mime[path.extname(target)] });
+      const stream = fs.createReadStream(target, { fd, autoClose: true });
+      stream.on('error', () => res.destroy());
+      res.once('close', () => stream.destroy());
+      stream.pipe(res);
+    } catch {
+      json(400, { error: 'Unable to complete request' });
+    }
   });
-  const listen=(port       )=>new Promise      ((resolve,reject)=>{const error=(e      )=>reject(e);server.once('error',error);server.listen(port,'127.0.0.1',()=>{server.removeListener('error',error);const address=server.address();if(!address||typeof address==='string')return reject(new Error('No listening address'));sessionOrigin=`http://127.0.0.1:${address.port}`;resolve();});});
-  try{await listen(options.port);}catch(e){if(options.port===0||!['EADDRINUSE','EACCES'].includes((e                         ).code??''))throw e;await listen(0);}
-  return {server,url:sessionOrigin,close:()=>new Promise      ((resolve,reject)=>server.close(e=>e?reject(e):resolve()))};
+  const listen = (port        ) =>
+    new Promise      ((resolve, reject) => {
+      const error = (e       ) => reject(e);
+      server.once('error', error);
+      server.listen(port, '127.0.0.1', () => {
+        server.removeListener('error', error);
+        const address = server.address();
+        if (!address || typeof address === 'string')
+          return reject(new Error('No listening address'));
+        sessionOrigin = `http://127.0.0.1:${address.port}`;
+        resolve();
+      });
+    });
+  try {
+    await listen(options.port);
+  } catch (e) {
+    if (
+      options.port === 0 ||
+      !['EADDRINUSE', 'EACCES'].includes((e                         ).code ?? '')
+    )
+      throw e;
+    await listen(0);
+  }
+  return {
+    server,
+    url: sessionOrigin,
+    close: () =>
+      new Promise      ((resolve, reject) => server.close((e) => (e ? reject(e) : resolve()))),
+  };
 }

package/dist/packages/core/src/calendar.js

@@ -1,24 +1,47 @@
 /** Count whole local calendar months; rolling presets are never subscription comparisons. */
-export function fullCalendarMonths(range                                                                      )            {
-  if(range.preset==='7d'||range.preset==='30d')return null;
+export function fullCalendarMonths(range   
+               
+                
+                  
+                                 
+ )                {
+  if (range.preset === '7d' || range.preset === '30d') return null;
   // Browser timezone overrides must not change the server's calendar selection.
-  if(range.calendarMonths!==undefined)return Number.isInteger(range.calendarMonths)&&range.calendarMonths >0&&range.calendarMonths <=1200?range.calendarMonths:null;
-  const start=new Date(range.from),end=new Date(range.until);
-  const boundary=(date     )=>Number.isFinite(+date)&&date.getDate()===1&&date.getHours()===0&&date.getMinutes()===0&&date.getSeconds()===0&&date.getMilliseconds()===0;
-  if(!boundary(start)||!boundary(end))return null;
-  const months=(end.getFullYear()-start.getFullYear())*12+end.getMonth()-start.getMonth();
-  return months>0&&months<=1200?months:null;
+  if (range.calendarMonths !== undefined)
+    return Number.isInteger(range.calendarMonths) &&
+      range.calendarMonths  > 0 &&
+      range.calendarMonths  <= 1200
+      ? range.calendarMonths
+      : null;
+  const start = new Date(range.from),
+    end = new Date(range.until);
+  const boundary = (date      ) =>
+    Number.isFinite(+date) &&
+    date.getDate() === 1 &&
+    date.getHours() === 0 &&
+    date.getMinutes() === 0 &&
+    date.getSeconds() === 0 &&
+    date.getMilliseconds() === 0;
+  if (!boundary(start) || !boundary(end)) return null;
+  const months = (end.getFullYear() - start.getFullYear()) * 12 + end.getMonth() - start.getMonth();
+  return months > 0 && months <= 1200 ? months : null;
 }
 /** Civil-date movement uses UTC arithmetic so DST never drops or repeats a day. */
-export function shiftCalendarDays(day       ,days       )            {
-  if(!/^\d{4}-\d{2}-\d{2}$/.test(day)||!Number.isInteger(days)||Math.abs(days)>36600)return null;
-  const date=new Date(day+'T12:00:00.000Z');
-  if(!Number.isFinite(+date)||date.toISOString().slice(0,10)!==day)return null;
-  date.setUTCDate(date.getUTCDate()+days);
-  const result=date.toISOString().slice(0,10);return /^\d{4}-\d{2}-\d{2}$/.test(result)?result:null;
+export function shiftCalendarDays(day        , days        )                {
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(day) || !Number.isInteger(days) || Math.abs(days) > 36600)
+    return null;
+  const date = new Date(day + 'T12:00:00.000Z');
+  if (!Number.isFinite(+date) || date.toISOString().slice(0, 10) !== day) return null;
+  date.setUTCDate(date.getUTCDate() + days);
+  const result = date.toISOString().slice(0, 10);
+  return /^\d{4}-\d{2}-\d{2}$/.test(result) ? result : null;
 }
-export function shiftCalendarMonth(month       ,months       )            {
-  if(!/^(?:19|20|21)\d{2}-(?:0[1-9]|1[0-2])$/.test(month)||!Number.isInteger(months))return null;
-  const ordinal=Number(month.slice(0,4))*12+Number(month.slice(5))-1+months,year=Math.floor(ordinal/12);
-  return year>=1900&&year<=2199?`${year}-${String(ordinal%12+1).padStart(2,'0')}`:null;
+export function shiftCalendarMonth(month        , months        )                {
+  if (!/^(?:19|20|21)\d{2}-(?:0[1-9]|1[0-2])$/.test(month) || !Number.isInteger(months))
+    return null;
+  const ordinal = Number(month.slice(0, 4)) * 12 + Number(month.slice(5)) - 1 + months,
+    year = Math.floor(ordinal / 12);
+  return year >= 1900 && year <= 2199
+    ? `${year}-${String((ordinal % 12) + 1).padStart(2, '0')}`
+    : null;
 }

package/dist/packages/core/src/coverage.js

@@ -0,0 +1,12 @@
+/** Reserve 100% for fully priced usage; missing coverage never becomes zero. */
+export function formatPricingCoverage(coverage               )         {
+  if (coverage === null || !Number.isFinite(coverage) || coverage < 0 || coverage > 1) {
+    return 'Unknown';
+  }
+  if (coverage === 1) return '100%';
+  if (coverage === 0) return '0%';
+  const percent = Math.round(coverage * 100);
+  if (percent === 100) return '<100%';
+  if (percent === 0) return '<1%';
+  return `${percent}%`;
+}

package/dist/packages/core/src/demo.js

@@ -1,10 +1,62 @@
-import {baseRecord} from './metadata.js';
-import {catalog,            } from './pricing/index.js';
-import {defaultSettings,emptyDiagnostics,                                                } from './types.js';
-export function demoData(now=new Date())                                                                                  {
-  const records              =[];const monthDays=now.getDate();const weights=Array.from({length:monthDays},(_,i)=>[4,6,5,8,7,10,6,8,11,9][i%10]);const sum=weights.reduce((a,b)=>a+b,0);let assigned=0;
-  for(let i=0;i<monthDays;i++){const r=baseRecord('codex','fixture-only',`fixture-${i}`);const output=i===monthDays-1?20530000-assigned:Math.floor(20530000*weights[i]/sum);assigned+=output;r.timestamp=new Date(now.getFullYear(),now.getMonth(),i+1,12).toISOString();r.model_raw='gpt-5.3-codex';r.session_id='fixture-session';r.input_tokens=0;r.cached_input_tokens=0;r.cache_creation_tokens=0;r.output_tokens=output;r.reasoning_tokens=0;r.total_tokens=output;r.source_schema='DEMO/fixture';r.notes=['demo-fixture'];records.push(r);}
-  const settings=defaultSettings();settings.onboarded=true;settings.billing.codex={mode:'SUBSCRIPTION',monthly:200};
-  const statuses=(['codex','claude']         ).map(provider=>({provider,detected:true,files:provider==='codex'?1:0,scanned:0,cached:0,errors:0,skippedLinks:0,missingFiles:0,diagnostics:emptyDiagnostics()}));
-  const demoCatalog        ={...catalog,version:'DEMO — fixture prices',prices:catalog.prices.map(p=>({...p,effective_from:'2000-01-01T00:00:00.000Z'}))};return {records,settings,statuses,catalog:demoCatalog};
+import { baseRecord } from './metadata.js';
+import { catalog,              } from './pricing/index.js';
+import {
+  defaultSettings,
+  emptyDiagnostics,
+                
+                   
+                    
+} from './types.js';
+export function demoData(now = new Date())   
+                         
+                     
+                           
+                   
+  {
+  const records                = [];
+  const monthDays = now.getDate();
+  const weights = Array.from(
+    { length: monthDays },
+    (_, i) => [4, 6, 5, 8, 7, 10, 6, 8, 11, 9][i % 10],
+  );
+  const sum = weights.reduce((a, b) => a + b, 0);
+  let assigned = 0;
+  for (let i = 0; i < monthDays; i++) {
+    const r = baseRecord('codex', 'fixture-only', `fixture-${i}`);
+    const output =
+      i === monthDays - 1 ? 20530000 - assigned : Math.floor((20530000 * weights[i]) / sum);
+    assigned += output;
+    r.timestamp = new Date(now.getFullYear(), now.getMonth(), i + 1, 12).toISOString();
+    r.model_raw = 'gpt-5.3-codex';
+    r.session_id = 'fixture-session';
+    r.input_tokens = 0;
+    r.cached_input_tokens = 0;
+    r.cache_creation_tokens = 0;
+    r.output_tokens = output;
+    r.reasoning_tokens = 0;
+    r.total_tokens = output;
+    r.source_schema = 'DEMO/fixture';
+    r.notes = ['demo-fixture'];
+    records.push(r);
+  }
+  const settings = defaultSettings();
+  settings.onboarded = true;
+  settings.billing.codex = { mode: 'SUBSCRIPTION', monthly: 200 };
+  const statuses = (['codex', 'claude']         ).map((provider) => ({
+    provider,
+    detected: true,
+    files: provider === 'codex' ? 1 : 0,
+    scanned: 0,
+    cached: 0,
+    errors: 0,
+    skippedLinks: 0,
+    missingFiles: 0,
+    diagnostics: emptyDiagnostics(),
+  }));
+  const demoCatalog          = {
+    ...catalog,
+    version: 'DEMO — fixture prices',
+    prices: catalog.prices.map((p) => ({ ...p, effective_from: '2000-01-01T00:00:00.000Z' })),
+  };
+  return { records, settings, statuses, catalog: demoCatalog };
 }

package/dist/packages/core/src/metadata.js

@@ -1,14 +1,57 @@
-import {createHash} from 'node:crypto';
-                                                                   
-export const hash = (...parts           )         => createHash('sha256').update(JSON.stringify(parts)).digest('hex');
-export const token = (v         )                => typeof v === 'number' && Number.isSafeInteger(v) && v >= 0 ? v : null;
-export const identifier = (v         )                => typeof v === 'string' && /^[a-zA-Z0-9._:@/-]{1,160}$/.test(v) ? v : null;
-export const modelId = (v         )                => typeof v === 'string' && /^[a-zA-Z0-9._:-]{1,100}$/.test(v) ? v : null;
-export const timestamp = (v         )                => typeof v === 'string' && /^\d{4}-\d{2}-\d{2}T/.test(v) && Number.isFinite(Date.parse(v)) ? new Date(v).toISOString() : null;
+import { createHash } from 'node:crypto';
+                                                                     
+export const isObject = (value         )                                   =>
+  value !== null && typeof value === 'object';
+export const isRecord = (value         )                                   =>
+  isObject(value) && !Array.isArray(value);
+export const hash = (...parts           )         =>
+  createHash('sha256').update(JSON.stringify(parts)).digest('hex');
+export const token = (v         )                =>
+  typeof v === 'number' && Number.isSafeInteger(v) && v >= 0 ? v : null;
+export const identifier = (v         )                =>
+  typeof v === 'string' && /^[a-zA-Z0-9._:@/-]{1,160}$/.test(v) ? v : null;
+export const modelId = (v         )                =>
+  typeof v === 'string' && /^[a-zA-Z0-9._:-]{1,100}$/.test(v) ? v : null;
+export const timestamp = (v         )                =>
+  typeof v === 'string' && /^\d{4}-\d{2}-\d{2}T/.test(v) && Number.isFinite(Date.parse(v))
+    ? new Date(v).toISOString()
+    : null;
 export function baseRecord(provider          , ref        , event        )              {
-  return {id:hash(provider,event),provider,source_event_id:event,source_file_reference:ref,timestamp:null,session_id:null,request_id:null,thread_id:null,model_raw:null,model_canonical:null,billing_mode:'UNKNOWN',input_tokens:null,cached_input_tokens:null,cache_creation_tokens:null,cache_creation_5m_tokens:null,cache_creation_1h_tokens:null,output_tokens:null,reasoning_tokens:null,unallocated_total_tokens:null,total_tokens:null,project_identifier_hash:null,quality:'HIGH',source_schema:'unknown',notes:[],service_tier:null,speed:null,web_search_requests:null,web_fetch_requests:null};
+  return {
+    id: hash(provider, event),
+    provider,
+    source_event_id: event,
+    source_file_reference: ref,
+    timestamp: null,
+    session_id: null,
+    request_id: null,
+    thread_id: null,
+    model_raw: null,
+    model_canonical: null,
+    billing_mode: 'UNKNOWN',
+    input_tokens: null,
+    cached_input_tokens: null,
+    cache_creation_tokens: null,
+    cache_creation_5m_tokens: null,
+    cache_creation_1h_tokens: null,
+    output_tokens: null,
+    reasoning_tokens: null,
+    unallocated_total_tokens: null,
+    total_tokens: null,
+    project_identifier_hash: null,
+    quality: 'HIGH',
+    source_schema: 'unknown',
+    notes: [],
+    service_tier: null,
+    speed: null,
+    web_search_requests: null,
+    web_fetch_requests: null,
+  };
 }
 export function track(d             , r             )       {
   d.records++;
-  if(r.timestamp){d.first = !d.first || r.timestamp < d.first ? r.timestamp : d.first;d.last = !d.last || r.timestamp > d.last ? r.timestamp : d.last;}
+  if (r.timestamp) {
+    d.first = !d.first || r.timestamp < d.first ? r.timestamp : d.first;
+    d.last = !d.last || r.timestamp > d.last ? r.timestamp : d.last;
+  }
 }