@tangle-network/agent-eval 0.215.1 → 0.216.1

package/dist/{cost-ledger-D2FnJPBF.js → cost-ledger-BP8V4kUQ.js}

@@ -1,835 +1,882 @@
-import { s as ValidationError } from "./errors-Dngq5h35.js";
+import { s as ValidationError } from "./errors-DVZiqS7K.js";
 import { a as resolveModelPricing, i as isModelPriced, n as estimateCost } from "./metrics-BKaPBtIG.js";
 import { z } from "zod";
-//#region src/cost-ledger.ts
-var CostCeilingReachedError = class extends ValidationError {
-	constructor(ceilingUsd, committedUsd, requestedUsd, phase, actor) {
-		super(`CostLedger: reserving ${requestedUsd} for '${actor}' during '${phase}' would exceed ceiling ${ceilingUsd} with ${committedUsd} already committed`);
+//#region src/cost-ledger/validation.ts
+/** Validate cost and usage primitives without admitting work or consulting pricing. */
+function toError(value) {
+	return value instanceof Error ? value : new Error(String(value));
+}
+function validationMessage(cause) {
+	return cause instanceof z.ZodError ? z.prettifyError(cause) : toError(cause).message;
+}
+function assertUsage(usage) {
+	assertTokenCount(usage.inputTokens, "inputTokens");
+	assertTokenCount(usage.outputTokens, "outputTokens");
+	if (usage.reasoningTokens !== void 0) {
+		assertTokenCount(usage.reasoningTokens, "reasoningTokens");
+		if (usage.reasoningTokens > usage.outputTokens) throw new ValidationError("CostLedger: reasoningTokens must not exceed outputTokens");
 	}
+	if (usage.cachedTokens !== void 0) assertTokenCount(usage.cachedTokens, "cachedTokens");
+	if (usage.cacheWriteTokens !== void 0) assertTokenCount(usage.cacheWriteTokens, "cacheWriteTokens");
+}
+function assertTokenCount(value, name) {
+	if (typeof value !== "number" || !Number.isInteger(value) || value < 0) throw new ValidationError(`CostLedger: ${name} must be a non-negative integer, got ${String(value)}`);
+}
+function assertNonNegative(value, name) {
+	if (typeof value !== "number" || !Number.isFinite(value) || value < 0) throw new ValidationError(`CostLedger: ${name} must be a non-negative finite number, got ${String(value)}`);
+}
+function assertTimeout(value, name) {
+	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0 || value > 2147483647) throw new ValidationError(`CostLedger: ${name} must be a non-negative safe integer no greater than 2147483647, got ${String(value)}`);
+}
+function assertString(value, name) {
+	if (typeof value !== "string" || value.trim().length === 0) throw new ValidationError(`CostLedger: ${name} must be a non-empty string`);
+}
+//#endregion
+//#region src/cost-ledger/pricing.ts
+/** Model-price lookup and caller-supplied token pricing, including receipt snapshots. */
+/** Return the canonical pricing-table key, or null when the model is unpriced. */
+function modelPriceKey(model) {
+	return isModelPriced(model) ? model : null;
+}
+function costForUsage(model, usage) {
+	assertUsage(usage);
+	if (!resolveModelPricing(model)) return {
+		costUsd: 0,
+		costUnknown: true
+	};
+	return {
+		costUsd: estimateCost(usage.inputTokens + (usage.cachedTokens ?? 0) + (usage.cacheWriteTokens ?? 0), usage.outputTokens, model),
+		costUnknown: false
+	};
+}
+/** Price token counts with caller-supplied per-million rates. */
+function costForTokenPricing(pricing, usage) {
+	assertTokenCount(usage.inputTokens, "usage.inputTokens");
+	assertTokenCount(usage.outputTokens, "usage.outputTokens");
+	if (usage.cachedTokens !== void 0) assertTokenCount(usage.cachedTokens, "usage.cachedTokens");
+	if (usage.cacheWriteTokens !== void 0) assertTokenCount(usage.cacheWriteTokens, "usage.cacheWriteTokens");
+	assertNonNegative(pricing.inputUsdPerMillion, "pricing.inputUsdPerMillion");
+	if (pricing.cachedInputUsdPerMillion !== void 0) assertNonNegative(pricing.cachedInputUsdPerMillion, "pricing.cachedInputUsdPerMillion");
+	if (pricing.cacheWriteUsdPerMillion !== void 0) assertNonNegative(pricing.cacheWriteUsdPerMillion, "pricing.cacheWriteUsdPerMillion");
+	assertNonNegative(pricing.outputUsdPerMillion, "pricing.outputUsdPerMillion");
+	const cachedInputRate = pricing.cachedInputUsdPerMillion ?? pricing.inputUsdPerMillion;
+	const cacheWriteRate = pricing.cacheWriteUsdPerMillion ?? pricing.inputUsdPerMillion;
+	return usage.inputTokens / 1e6 * pricing.inputUsdPerMillion + (usage.cachedTokens ?? 0) / 1e6 * cachedInputRate + (usage.cacheWriteTokens ?? 0) / 1e6 * cacheWriteRate + usage.outputTokens / 1e6 * pricing.outputUsdPerMillion;
+}
+function costFromPricing(usage, pricing) {
+	const cachedInputRate = pricing.cachedInputUsdPerThousand ?? pricing.inputUsdPerThousand;
+	const cacheWriteRate = pricing.cacheWriteUsdPerThousand ?? pricing.inputUsdPerThousand;
+	return usage.inputTokens / 1e3 * pricing.inputUsdPerThousand + (usage.cachedTokens ?? 0) / 1e3 * cachedInputRate + (usage.cacheWriteTokens ?? 0) / 1e3 * cacheWriteRate + usage.outputTokens / 1e3 * pricing.outputUsdPerThousand;
+}
+function pricingSnapshot(pricing) {
+	costForTokenPricing(pricing, {
+		inputTokens: 0,
+		outputTokens: 0
+	});
+	return {
+		inputUsdPerThousand: pricing.inputUsdPerMillion / 1e3,
+		...pricing.cachedInputUsdPerMillion === void 0 ? {} : { cachedInputUsdPerThousand: pricing.cachedInputUsdPerMillion / 1e3 },
+		...pricing.cacheWriteUsdPerMillion === void 0 ? {} : { cacheWriteUsdPerThousand: pricing.cacheWriteUsdPerMillion / 1e3 },
+		outputUsdPerThousand: pricing.outputUsdPerMillion / 1e3
+	};
+}
+//#endregion
+//#region src/cost-ledger/receipts.ts
+/** Create, validate, filter, and detach the receipts stored by a cost ledger. */
+const NonEmptyString = z.string().refine((value) => value.trim().length > 0, "must be non-empty");
+const TokenCount = z.number().int().nonnegative().finite();
+const NonNegative = z.number().nonnegative().finite();
+const Tags = z.record(NonEmptyString, z.string());
+const CostPricingSchema = z.strictObject({
+	inputUsdPerThousand: NonNegative,
+	cachedInputUsdPerThousand: NonNegative.optional(),
+	cacheWriteUsdPerThousand: NonNegative.optional(),
+	outputUsdPerThousand: NonNegative
+});
+const CostCallBaseShape = {
+	callId: NonEmptyString,
+	channel: NonEmptyString,
+	phase: NonEmptyString,
+	actor: NonEmptyString,
+	model: NonEmptyString,
+	maximumCostUsd: NonNegative.optional(),
+	tags: Tags.optional(),
+	timestamp: NonNegative
 };
-var CostAccountingIncompleteError = class extends ValidationError {};
-var CostReservationExceededError = class extends ValidationError {
-	constructor(actor, actualUsd, maximumUsd) {
-		super(`CostLedger: '${actor}' charged ${actualUsd}, exceeding its enforced maximum ${maximumUsd}`);
-	}
+const PendingCostCallSchema = z.strictObject({
+	status: z.literal("pending"),
+	...CostCallBaseShape
+});
+const CostReceiptBaseShape = {
+	status: z.literal("settled"),
+	...CostCallBaseShape,
+	inputTokens: TokenCount,
+	outputTokens: TokenCount,
+	cachedTokens: TokenCount.optional(),
+	costUsd: NonNegative,
+	costUnknown: z.boolean(),
+	usageUnknown: z.boolean().default(false),
+	pricing: CostPricingSchema.optional(),
+	actualCostUsd: NonNegative.optional(),
+	estimatedCostUsd: NonNegative.optional(),
+	error: NonEmptyString.optional()
 };
-var CostCallConflictError = class extends ValidationError {
-	callId;
-	receipt;
-	constructor(message, options = {}) {
-		super(message, options.cause === void 0 ? void 0 : { cause: options.cause });
-		this.callId = options.callId;
-		this.receipt = options.receipt ? cloneReceipt(options.receipt) : void 0;
+const CostReceiptSchema = z.strictObject({
+	...CostReceiptBaseShape,
+	reasoningTokens: TokenCount.optional(),
+	cacheWriteTokens: TokenCount.optional()
+}).superRefine((receipt, ctx) => validateCostReceipt(receipt, ctx));
+function validateCostReceipt(receipt, ctx) {
+	if (receipt.reasoningTokens !== void 0 && receipt.reasoningTokens > receipt.outputTokens) ctx.addIssue({
+		code: "custom",
+		message: "reasoningTokens must not exceed outputTokens"
+	});
+	if (receipt.actualCostUsd !== void 0 && receipt.estimatedCostUsd !== void 0) ctx.addIssue({
+		code: "custom",
+		message: "actual and external estimated costs cannot both be present"
+	});
+	if (receipt.actualCostUsd !== void 0) {
+		if (receipt.costUnknown || receipt.costUsd !== receipt.actualCostUsd) ctx.addIssue({
+			code: "custom",
+			message: "actual cost must be known and equal costUsd"
+		});
+		if (receipt.pricing !== void 0) ctx.addIssue({
+			code: "custom",
+			message: "actual cost must not include estimated pricing"
+		});
+		return;
 	}
-};
-var CostLedgerPersistenceError = class extends ValidationError {
-	callId;
-	receipt;
-	constructor(cause, callId, receipt) {
-		super(`CostLedger: failed to persist${callId ? ` call '${callId}'` : ""}: ${toError(cause).message}`, { cause });
-		this.callId = callId;
-		this.receipt = receipt ? cloneReceipt(receipt) : void 0;
+	if (receipt.estimatedCostUsd !== void 0) {
+		if (receipt.costUnknown || receipt.costUsd !== receipt.estimatedCostUsd) ctx.addIssue({
+			code: "custom",
+			message: "external estimate must be known and equal costUsd"
+		});
+		if (receipt.pricing !== void 0) ctx.addIssue({
+			code: "custom",
+			message: "external estimate must not include token pricing"
+		});
+		return;
 	}
-};
-var CostReceiptCaptureError = class extends ValidationError {
-	callId;
-	receipt;
-	receiptError;
-	constructor(callId, cause, receiptError, receipt) {
-		super(`CostLedger: could not capture the provider receipt for call '${callId}'`, { cause });
-		this.callId = callId;
-		this.receipt = receipt ? cloneReceipt(receipt) : void 0;
-		this.receiptError = toError(receiptError);
+	if (receipt.costUnknown) {
+		if (receipt.costUsd !== 0) ctx.addIssue({
+			code: "custom",
+			message: "unknown cost must have costUsd 0"
+		});
+		if (receipt.pricing !== void 0) ctx.addIssue({
+			code: "custom",
+			message: "unknown cost must not include estimated pricing"
+		});
+		return;
 	}
-};
-/** Run-wide paid-call admission, durable call state, receipts, and summaries. */
-var CostLedger = class {
-	records = /* @__PURE__ */ new Map();
-	activeCallIds = /* @__PURE__ */ new Set();
-	lateCallIds = /* @__PURE__ */ new Set();
-	idleWaiters = /* @__PURE__ */ new Set();
-	completedTasks = 0;
-	revision = "memory";
-	costLimitPersisted = false;
-	costCeilingUsd;
-	persistence;
-	constructor(input) {
-		const options = typeof input === "number" ? { costCeilingUsd: input } : input ?? {};
-		this.persistence = options.persistence;
-		if (options.costCeilingUsd !== void 0) assertNonNegative(options.costCeilingUsd, "costCeilingUsd");
-		let persistedCostCeilingUsd;
-		if (this.persistence) {
-			let stored;
-			try {
-				stored = this.persistence.read();
-			} catch (cause) {
-				throw new CostLedgerPersistenceError(cause);
-			}
-			assertString(stored.revision, "persistence revision");
-			this.revision = stored.revision;
-			const restored = parseEvents(stored.events);
-			for (const record of restored.records) this.records.set(record.callId, record);
-			this.completedTasks = restored.completedTasks;
-			persistedCostCeilingUsd = restored.costCeilingUsd;
-		}
-		if (options.costCeilingUsd !== void 0 && persistedCostCeilingUsd !== void 0 && options.costCeilingUsd !== persistedCostCeilingUsd) throw new ValidationError(`CostLedger: requested cost ceiling ${options.costCeilingUsd} does not match persisted ceiling ${persistedCostCeilingUsd}`);
-		this.costCeilingUsd = persistedCostCeilingUsd ?? options.costCeilingUsd;
-		this.costLimitPersisted = !this.persistence || this.costCeilingUsd === void 0 || persistedCostCeilingUsd !== void 0;
-		if (this.costCeilingUsd !== void 0 && [...this.records.values()].some((record) => record.status === "pending" && record.maximumCostUsd === void 0)) throw new ValidationError("CostLedger: capped event log contains an unbounded pending call");
-		if (options.receipts?.length) {
-			const imported = options.receipts.map((receipt, index) => parseImportedReceipt(receipt, `imported receipt ${index + 1}`));
-			this.ensureCostLimitPersisted();
-			for (const receipt of imported) this.appendRecord(receipt);
-		}
+	if (receipt.usageUnknown) ctx.addIssue({
+		code: "custom",
+		message: "known estimated cost requires known usage"
+	});
+	if (!receipt.pricing) {
+		ctx.addIssue({
+			code: "custom",
+			message: "known estimated cost requires a pricing snapshot"
+		});
+		return;
 	}
-	async runPaidCall(input) {
-		let callId;
-		let pending;
-		try {
-			callId = resolveCallId(input.callId);
-			validateAttribution(input);
-			if (input.signal?.aborted) return {
-				succeeded: false,
-				callId,
-				error: abortError(input.signal)
-			};
-			this.ensureCostLimitPersisted(callId);
-			const maximumCostUsd = this.resolveMaximum(input.maximumCharge);
-			const existing = this.records.get(callId);
-			if (existing) return {
-				succeeded: false,
-				callId,
-				error: new CostCallConflictError(existing.status === "pending" ? `CostLedger: callId '${callId}' is unresolved and must be reconciled before retry` : `CostLedger: callId '${callId}' already exists`, { callId })
-			};
-			if (!pending) {
-				while (true) {
-					if (this.records.has(callId)) return {
-						succeeded: false,
-						callId,
-						error: new CostCallConflictError(`CostLedger: callId '${callId}' already exists`)
-					};
-					const admission = this.admissionState();
-					if (admission.unresolvedCalls > 0) return {
-						succeeded: false,
-						callId,
-						error: new CostAccountingIncompleteError(`CostLedger: ${admission.unresolvedCalls} unresolved call(s) must be reconciled before new paid work`)
-					};
-					if (this.costCeilingUsd === void 0) break;
-					if (admission.budgetBreached) return {
-						succeeded: false,
-						callId,
-						error: new CostAccountingIncompleteError(`CostLedger: a settled call exceeded its enforced maximum; refusing paid call '${input.actor}' during '${input.phase}'`)
-					};
-					const { committedCostUsd } = admission;
-					if (committedCostUsd + maximumCostUsd > this.costCeilingUsd) return {
-						succeeded: false,
-						callId,
-						error: new CostCeilingReachedError(this.costCeilingUsd, committedCostUsd, maximumCostUsd, input.phase, input.actor)
-					};
-					if (committedCostUsd + admission.reservedCostUsd + maximumCostUsd <= this.costCeilingUsd) break;
-					await this.waitForReservationRelease(input.signal);
-				}
-				pending = {
-					status: "pending",
-					callId,
-					channel: input.channel,
-					phase: input.phase,
-					actor: input.actor,
-					model: pendingModel(input),
-					...maximumCostUsd === void 0 ? {} : { maximumCostUsd },
-					...input.tags ? { tags: { ...input.tags } } : {},
-					timestamp: Date.now()
-				};
-				this.appendRecord(pending);
-				this.activeCallIds.add(callId);
-			}
-		} catch (error) {
-			return {
-				succeeded: false,
-				...callId ? { callId } : {},
-				error: toError(error)
-			};
-		}
-		try {
-			return await this.execute(input, pending);
-		} catch (error) {
-			return {
-				succeeded: false,
-				callId: pending.callId,
-				error: toError(error)
-			};
-		} finally {
-			if (!this.lateCallIds.has(pending.callId)) this.releaseActiveCall(pending.callId);
-		}
-	}
-	/** Wait until every call started by this ledger has produced a durable outcome. */
-	async waitForIdle(options = {}) {
-		const hasActiveMatch = () => [...this.activeCallIds].some((callId) => {
-			const record = this.records.get(callId);
-			return record !== void 0 && matches(record, options.filter);
-		});
-		if (!hasActiveMatch()) return true;
-		const timeoutMs = options.timeoutMs ?? 5e3;
-		assertTimeout(timeoutMs, "waitForIdle.timeoutMs");
-		return new Promise((resolve) => {
-			let timer;
-			const finish = (settled) => {
-				this.idleWaiters.delete(onIdle);
-				if (timer !== void 0) clearTimeout(timer);
-				resolve(settled);
-			};
-			const onIdle = () => {
-				if (!hasActiveMatch()) finish(true);
-			};
-			this.idleWaiters.add(onIdle);
-			timer = setTimeout(() => finish(false), timeoutMs);
-			onIdle();
-		});
+	const expected = costFromPricing(receipt, receipt.pricing);
+	if (!costAmountsMatch(receipt.costUsd, expected)) ctx.addIssue({
+		code: "custom",
+		message: `estimated cost ${receipt.costUsd} does not match pricing snapshot ${expected}`
+	});
+}
+function costAmountsMatch(left, right) {
+	const scale = Math.max(1, Math.abs(left), Math.abs(right));
+	return Math.abs(left - right) <= Number.EPSILON * scale * 8;
+}
+function buildReceipt(pending, observed, failed = false, error) {
+	assertUsage(observed);
+	assertString(observed.model, "receipt.model");
+	if ([
+		observed.actualCostUsd,
+		observed.estimatedCostUsd,
+		observed.customTokenPricing
+	].filter((value) => value !== void 0).length > 1) throw new ValidationError("CostLedger: a receipt can have only one of actualCostUsd, estimatedCostUsd, or customTokenPricing");
+	const customPricingSnapshot = observed.customTokenPricing === void 0 ? void 0 : pricingSnapshot(observed.customTokenPricing);
+	const estimated = customPricingSnapshot ? {
+		costUsd: costFromPricing(observed, customPricingSnapshot),
+		costUnknown: false
+	} : costForUsage(observed.model, observed);
+	const hasActual = observed.actualCostUsd !== void 0;
+	const hasExternalEstimate = observed.estimatedCostUsd !== void 0;
+	if (hasActual && observed.costUnknown === true) throw new ValidationError("CostLedger: a receipt cannot have both actualCostUsd and costUnknown=true");
+	if (hasActual) assertNonNegative(observed.actualCostUsd, "actualCostUsd");
+	if (hasExternalEstimate) assertNonNegative(observed.estimatedCostUsd, "estimatedCostUsd");
+	if (hasExternalEstimate && observed.costUnknown === true) throw new ValidationError("CostLedger: a receipt cannot have both estimatedCostUsd and costUnknown=true");
+	const usageUnknown = observed.usageUnknown === true;
+	const costUnknown = observed.costUnknown === true || !hasActual && !hasExternalEstimate && (usageUnknown || estimated.costUnknown);
+	const resolvedModelPricing = !customPricingSnapshot && !hasActual && !hasExternalEstimate && !costUnknown ? resolveModelPricing(observed.model) : null;
+	const receiptPricing = !hasActual && !hasExternalEstimate && !costUnknown ? customPricingSnapshot ?? (resolvedModelPricing ? {
+		inputUsdPerThousand: resolvedModelPricing.input,
+		outputUsdPerThousand: resolvedModelPricing.output
+	} : void 0) : void 0;
+	return parseReceipt({
+		status: "settled",
+		callId: pending.callId,
+		channel: pending.channel,
+		phase: pending.phase,
+		actor: pending.actor,
+		model: observed.model,
+		inputTokens: observed.inputTokens,
+		outputTokens: observed.outputTokens,
+		...observed.reasoningTokens === void 0 ? {} : { reasoningTokens: observed.reasoningTokens },
+		...observed.cachedTokens === void 0 ? {} : { cachedTokens: observed.cachedTokens },
+		...observed.cacheWriteTokens === void 0 ? {} : { cacheWriteTokens: observed.cacheWriteTokens },
+		costUsd: costUnknown ? 0 : hasActual ? observed.actualCostUsd : hasExternalEstimate ? observed.estimatedCostUsd : estimated.costUsd,
+		costUnknown,
+		usageUnknown,
+		...receiptPricing ? { pricing: receiptPricing } : {},
+		...hasActual ? { actualCostUsd: observed.actualCostUsd } : {},
+		...hasExternalEstimate ? { estimatedCostUsd: observed.estimatedCostUsd } : {},
+		...pending.maximumCostUsd === void 0 ? {} : { maximumCostUsd: pending.maximumCostUsd },
+		...failed ? { error: error ?? "paid-call-failed" } : {},
+		...pending.tags ? { tags: { ...pending.tags } } : {},
+		timestamp: pending.timestamp
+	}, "provider receipt");
+}
+function parseReceipt(value, path) {
+	try {
+		return CostReceiptSchema.parse(value);
+	} catch (cause) {
+		throw new ValidationError(`CostLedger: invalid ${path}: ${validationMessage(cause)}`, { cause });
 	}
-	/** Settle a call left pending by a crashed process after reconciling with the provider. */
-	reconcile(callId, observed, options = {}) {
-		const pending = this.records.get(callId);
-		if (pending?.status !== "pending") throw new CostCallConflictError(`CostLedger: no pending call '${callId}'`);
-		if (this.activeCallIds.has(callId)) throw new CostCallConflictError(`CostLedger: call '${callId}' is still active`);
-		this.ensureCostLimitPersisted(callId);
-		return this.commitReceipt(pending, observed, options.failed === true || options.error !== void 0, options.error);
+}
+function parseImportedReceipt(value, path) {
+	if (typeof value !== "object" || value === null) return parseReceipt(value, path);
+	const candidate = { ...value };
+	if (candidate.status === "settled" && candidate.actualCostUsd === void 0 && candidate.estimatedCostUsd === void 0 && candidate.costUnknown === false && candidate.pricing === void 0 && typeof candidate.model === "string") {
+		const pricing = resolveModelPricing(candidate.model);
+		if (pricing) candidate.pricing = {
+			inputUsdPerThousand: pricing.input,
+			outputUsdPerThousand: pricing.output
+		};
 	}
-	list(filter) {
-		return [...this.records.values()].filter((record) => record.status === "settled").filter((receipt) => matches(receipt, filter)).map(cloneReceipt);
+	return parseReceipt(candidate, path);
+}
+function validateAttribution(input) {
+	assertString(input.channel, "channel");
+	assertString(input.phase, "phase");
+	assertString(input.actor, "actor");
+	if (input.model !== void 0) assertString(input.model, "model");
+	if (input.tags !== void 0) {
+		const parsed = Tags.safeParse(input.tags);
+		if (!parsed.success) throw new ValidationError(`CostLedger: invalid tags: ${parsed.error.message}`);
 	}
-	/** Read pending calls without exposing mutable ledger state. */
-	listPending(filter) {
-		return [...this.records.values()].filter((record) => record.status === "pending").filter((record) => matches(record, filter)).map((record) => ({
-			...clonePendingCall(record),
-			state: this.lateCallIds.has(record.callId) ? "late" : this.activeCallIds.has(record.callId) ? "active" : "interrupted"
-		}));
+}
+function matches(record, filter) {
+	if (!filter) return true;
+	if (filter.channel !== void 0 && record.channel !== filter.channel) return false;
+	if (filter.phase !== void 0 && record.phase !== filter.phase) return false;
+	return Object.entries(filter.tags ?? {}).every(([key, value]) => record.tags?.[key] === value);
+}
+function cloneRecord(record) {
+	if (record.status === "settled") return cloneReceipt(record);
+	return clonePendingCall(record);
+}
+function clonePendingCall(record) {
+	const { tags, ...rest } = record;
+	return {
+		...rest,
+		...tags ? { tags: { ...tags } } : {}
+	};
+}
+function cloneReceipt(receipt) {
+	const { pricing, tags, ...rest } = receipt;
+	return {
+		...rest,
+		...tags ? { tags: { ...tags } } : {},
+		...pricing ? { pricing: { ...pricing } } : {}
+	};
+}
+//#endregion
+//#region src/cost-ledger/errors.ts
+/** Typed cost-accounting failures retain detached receipt evidence. */
+var CostCeilingReachedError = class extends ValidationError {
+	constructor(ceilingUsd, committedUsd, requestedUsd, phase, actor) {
+		super(`CostLedger: reserving ${requestedUsd} for '${actor}' during '${phase}' would exceed ceiling ${ceilingUsd} with ${committedUsd} already committed`);
 	}
-	summary(filter) {
-		const records = [...this.records.values()].filter((record) => matches(record, filter));
-		const pending = records.filter((record) => record.status === "pending");
-		const receipts = records.filter((record) => record.status === "settled");
-		const byChannel = /* @__PURE__ */ new Map();
-		const unpriced = /* @__PURE__ */ new Set();
-		const incompleteReasons = pending.map((record) => `call '${record.callId}' for '${record.actor}' is pending`);
-		let inputTokens = 0;
-		let outputTokens = 0;
-		let reasoningTokens = 0;
-		let cachedTokens = 0;
-		let cacheWriteTokens = 0;
-		let totalCostUsd = 0;
-		for (const receipt of receipts) {
-			inputTokens += receipt.inputTokens;
-			outputTokens += receipt.outputTokens;
-			reasoningTokens += receipt.reasoningTokens ?? 0;
-			cachedTokens += receipt.cachedTokens ?? 0;
-			cacheWriteTokens += receipt.cacheWriteTokens ?? 0;
-			totalCostUsd += receipt.costUsd;
-			if (receipt.costUnknown) {
-				unpriced.add(receipt.model);
-				incompleteReasons.push(receipt.error ?? `cost unknown for '${receipt.actor}' using '${receipt.model}'`);
-			}
-			if (receipt.usageUnknown) incompleteReasons.push(`token usage unknown for '${receipt.actor}' using '${receipt.model}'`);
-			if (receipt.maximumCostUsd !== void 0 && receipt.costUsd > receipt.maximumCostUsd) incompleteReasons.push(`'${receipt.actor}' charged ${receipt.costUsd}, exceeding its enforced maximum ${receipt.maximumCostUsd}`);
-			const rollup = byChannel.get(receipt.channel) ?? emptyRollup(receipt.channel);
-			rollup.calls += 1;
-			rollup.inputTokens += receipt.inputTokens;
-			rollup.outputTokens += receipt.outputTokens;
-			rollup.reasoningTokens = (rollup.reasoningTokens ?? 0) + (receipt.reasoningTokens ?? 0);
-			rollup.cachedTokens += receipt.cachedTokens ?? 0;
-			rollup.cacheWriteTokens = (rollup.cacheWriteTokens ?? 0) + (receipt.cacheWriteTokens ?? 0);
-			rollup.costUsd += receipt.costUsd;
-			if (receipt.costUnknown) rollup.unpricedCalls += 1;
-			if (receipt.usageUnknown) rollup.unknownUsageCalls += 1;
-			byChannel.set(receipt.channel, rollup);
-		}
-		return {
-			totalCalls: receipts.length,
-			pendingCalls: pending.length,
-			unresolvedCalls: pending.filter((record) => !this.activeCallIds.has(record.callId) || this.lateCallIds.has(record.callId)).length,
-			reservedCostUsd: pending.reduce((sum, record) => sum + (record.maximumCostUsd ?? 0), 0),
-			inputTokens,
-			outputTokens,
-			reasoningTokens,
-			cachedTokens,
-			cacheWriteTokens,
-			totalCostUsd,
-			costProvenance: pending.length > 0 || receipts.some((receipt) => receipt.costUnknown) ? {
-				kind: "uncaptured",
-				usd: null
-			} : receipts.every((receipt) => receipt.actualCostUsd !== void 0) ? {
-				kind: "observed",
-				usd: totalCostUsd
-			} : {
-				kind: "estimated",
-				usd: totalCostUsd
-			},
-			byChannel: [...byChannel.values()].sort((a, b) => a.channel.localeCompare(b.channel)),
-			unpricedModels: [...unpriced].sort(),
-			fullyPriced: unpriced.size === 0,
-			usageComplete: pending.length === 0 && receipts.every((receipt) => !receipt.usageUnknown),
-			accountingComplete: incompleteReasons.length === 0,
-			incompleteReasons: [...new Set(incompleteReasons)]
-		};
+};
+var CostAccountingIncompleteError = class extends ValidationError {};
+var CostReservationExceededError = class extends ValidationError {
+	constructor(actor, actualUsd, maximumUsd) {
+		super(`CostLedger: '${actor}' charged ${actualUsd}, exceeding its enforced maximum ${maximumUsd}`);
 	}
-	markCompleted(count = 1) {
-		if (!Number.isInteger(count) || count < 0) throw new ValidationError(`CostLedger.markCompleted: count must be a non-negative integer, got ${count}`);
-		if (count === 0) return;
-		this.ensureCostLimitPersisted();
-		this.appendEvent({
-			version: 1,
-			completedTasks: count
-		});
-		this.completedTasks += count;
+};
+var CostCallConflictError = class extends ValidationError {
+	callId;
+	receipt;
+	constructor(message, options = {}) {
+		super(message, options.cause === void 0 ? void 0 : { cause: options.cause });
+		this.callId = options.callId;
+		this.receipt = options.receipt ? cloneReceipt(options.receipt) : void 0;
 	}
-	costPerCompletedTask() {
-		return this.completedTasks === 0 ? null : this.summary().totalCostUsd / this.completedTasks;
+};
+var CostLedgerPersistenceError = class extends ValidationError {
+	callId;
+	receipt;
+	constructor(cause, callId, receipt) {
+		super(`CostLedger: failed to persist${callId ? ` call '${callId}'` : ""}: ${toError(cause).message}`, { cause });
+		this.callId = callId;
+		this.receipt = receipt ? cloneReceipt(receipt) : void 0;
 	}
-	async execute(input, pending) {
-		const signal = input.signal ?? new AbortController().signal;
-		if (signal.aborted) return this.commitOutcome(pending, abortError(signal), {
-			model: pending.model,
-			inputTokens: 0,
-			outputTokens: 0,
-			actualCostUsd: 0
-		});
-		const operation = Promise.resolve().then(() => input.execute(signal, pending.callId));
-		const settled = await settle(operation, signal);
-		if (settled.kind === "aborted") {
-			this.lateCallIds.add(pending.callId);
-			this.captureLateOutcome(input, pending, operation);
-			return paidFailure(pending.callId, abortError(signal));
-		}
-		if (settled.kind === "error") {
-			let observed;
-			try {
-				observed = input.receiptFromError?.(settled.error);
-			} catch (receiptError) {
-				return this.captureFailure(pending, settled.error, receiptError);
-			}
-			return this.commitOutcome(pending, settled.error, observed ?? unknownReceipt(pending.model));
-		}
-		try {
-			const receipt = this.commitReceipt(pending, input.receipt(settled.value));
-			if (receipt.maximumCostUsd !== void 0 && receipt.costUsd > receipt.maximumCostUsd) return paidFailure(pending.callId, new CostReservationExceededError(pending.actor, receipt.costUsd, receipt.maximumCostUsd), receipt);
-			return {
-				succeeded: true,
-				callId: pending.callId,
-				value: settled.value,
-				receipt
-			};
-		} catch (receiptError) {
-			if (receiptError instanceof CostLedgerPersistenceError || receiptError instanceof CostCallConflictError) return paidFailure(pending.callId, receiptError);
-			return this.captureFailure(pending, receiptError, receiptError);
-		}
+};
+var CostReceiptCaptureError = class extends ValidationError {
+	callId;
+	receipt;
+	receiptError;
+	constructor(callId, cause, receiptError, receipt) {
+		super(`CostLedger: could not capture the provider receipt for call '${callId}'`, { cause });
+		this.callId = callId;
+		this.receipt = receipt ? cloneReceipt(receipt) : void 0;
+		this.receiptError = toError(receiptError);
 	}
-	captureLateOutcome(input, pending, operation) {
-		operation.then((value) => {
-			if (this.records.get(pending.callId)?.status !== "pending") return;
-			try {
-				this.commitReceipt(pending, input.receipt(value));
-			} catch {}
-		}, (cause) => {
-			if (this.records.get(pending.callId)?.status !== "pending") return;
-			const error = toError(cause);
-			try {
-				const observed = input.receiptFromError?.(error);
-				this.commitReceipt(pending, observed ?? unknownReceipt(pending.model), true);
-			} catch (receiptError) {
-				if (receiptError instanceof CostLedgerPersistenceError || receiptError instanceof CostCallConflictError) return;
-				this.captureFailure(pending, error, receiptError);
+};
+//#endregion
+//#region src/cost-ledger/journal.ts
+/** Parse the append-only journal and enforce immutable pending-to-settled transitions. */
+const CostLedgerEventSchema = z.union([
+	z.strictObject({
+		version: z.literal(1),
+		record: PendingCostCallSchema
+	}),
+	z.strictObject({
+		version: z.literal(2),
+		record: CostReceiptSchema
+	}),
+	z.strictObject({
+		version: z.literal(1),
+		completedTasks: TokenCount
+	}),
+	z.strictObject({
+		version: z.literal(1),
+		costCeilingUsd: NonNegative
+	})
+]);
+function parseEvents(serialized) {
+	const records = /* @__PURE__ */ new Map();
+	let completedTasks = 0;
+	let costCeilingUsd;
+	let lineNumber = 0;
+	try {
+		for (const line of completeJournalPrefix(serialized).split("\n")) {
+			if (!line.trim()) continue;
+			lineNumber += 1;
+			const event = CostLedgerEventSchema.parse(JSON.parse(line));
+			if ("record" in event) {
+				const record = event.record;
+				validateTransition(records, record);
+				records.set(record.callId, cloneRecord(record));
+			} else if ("completedTasks" in event) {
+				completedTasks += event.completedTasks;
+				if (!Number.isSafeInteger(completedTasks)) throw new ValidationError("CostLedger: completed task count exceeds safe integer range");
+			} else {
+				if (costCeilingUsd !== void 0) throw new ValidationError("CostLedger: duplicate persisted cost ceiling");
+				costCeilingUsd = event.costCeilingUsd;
 			}
-		}).finally(() => {
-			this.lateCallIds.delete(pending.callId);
-			this.releaseActiveCall(pending.callId);
-		});
-	}
-	releaseActiveCall(callId) {
-		this.activeCallIds.delete(callId);
-		for (const resolve of [...this.idleWaiters]) resolve();
-	}
-	async waitForReservationRelease(signal) {
-		if (signal?.aborted) throw abortError(signal);
-		await new Promise((resolve, reject) => {
-			let finished = false;
-			const finish = (error) => {
-				if (finished) return;
-				finished = true;
-				this.idleWaiters.delete(onRelease);
-				signal?.removeEventListener("abort", onAbort);
-				if (error) reject(error);
-				else resolve();
-			};
-			const onRelease = () => finish();
-			const onAbort = () => finish(abortError(signal));
-			this.idleWaiters.add(onRelease);
-			signal?.addEventListener("abort", onAbort, { once: true });
-			if (this.activeCallIds.size === 0) onRelease();
-		});
-	}
-	commitOutcome(pending, error, observed) {
-		try {
-			const receipt = this.commitReceipt(pending, observed, true);
-			return paidFailure(pending.callId, error, receipt);
-		} catch (receiptError) {
-			if (receiptError instanceof CostLedgerPersistenceError || receiptError instanceof CostCallConflictError) return paidFailure(pending.callId, receiptError);
-			return this.captureFailure(pending, error, receiptError);
-		}
-	}
-	captureFailure(pending, cause, receiptError) {
-		try {
-			const receipt = this.commitReceipt(pending, unknownReceipt(pending.model), true);
-			return paidFailure(pending.callId, new CostReceiptCaptureError(pending.callId, cause, receiptError, receipt), receipt);
-		} catch (error) {
-			const typed = error instanceof Error ? error : toError(error);
-			return paidFailure(pending.callId, typed);
-		}
-	}
-	commitReceipt(pending, observed, failed = false, error) {
-		const receipt = buildReceipt(pending, observed, failed, error);
-		if (this.records.get(pending.callId)?.status !== "pending") throw new CostCallConflictError(`CostLedger: call '${pending.callId}' is not pending`);
-		this.appendRecord(receipt);
-		return cloneReceipt(receipt);
-	}
-	resolveMaximum(maximum) {
-		if (!maximum) {
-			if (this.costCeilingUsd !== void 0) throw new CostAccountingIncompleteError("CostLedger: capped paid calls require a hard maximumCharge before execution");
-			return;
-		}
-		if ("externallyEnforcedMaximumUsd" in maximum) {
-			assertNonNegative(maximum.externallyEnforcedMaximumUsd, "maximumCharge.externallyEnforcedMaximumUsd");
-			return maximum.externallyEnforcedMaximumUsd;
-		}
-		if ("customTokenPricing" in maximum) return costForTokenPricing(maximum.customTokenPricing, maximum);
-		const priced = costForUsage(maximum.model, maximum);
-		if (priced.costUnknown) {
-			if (this.costCeilingUsd !== void 0) throw new CostAccountingIncompleteError(`CostLedger: cannot reserve unpriced model '${maximum.model}' in a capped run`);
-			return;
-		}
-		return priced.costUsd;
-	}
-	/** Compute admission totals in record order without building reporting rollups. */
-	admissionState() {
-		let unresolvedCalls = 0;
-		let reservedCostUsd = 0;
-		let committedCostUsd = 0;
-		let budgetBreached = false;
-		for (const record of this.records.values()) if (record.status === "pending") {
-			if (!this.activeCallIds.has(record.callId) || this.lateCallIds.has(record.callId)) unresolvedCalls += 1;
-			reservedCostUsd += record.maximumCostUsd ?? 0;
-		} else {
-			if (record.maximumCostUsd !== void 0 && record.costUsd > record.maximumCostUsd) budgetBreached = true;
-			committedCostUsd += record.costUnknown ? record.maximumCostUsd ?? record.costUsd : record.costUsd;
 		}
 		return {
-			unresolvedCalls,
-			reservedCostUsd,
-			committedCostUsd,
-			budgetBreached
-		};
-	}
-	appendRecord(record) {
-		const callId = record.callId;
-		const receipt = record.status === "settled" ? record : void 0;
-		validateTransition(this.records, record);
-		const event = record.status === "settled" ? {
-			version: 2,
-			record: cloneReceipt(record)
-		} : {
-			version: 1,
-			record: clonePendingCall(record)
+			records: [...records.values()],
+			completedTasks,
+			...costCeilingUsd === void 0 ? {} : { costCeilingUsd }
 		};
-		this.appendEvent(event, callId, receipt);
-		this.records.set(callId, cloneRecord(record));
+	} catch (cause) {
+		throw new ValidationError(`CostLedger: invalid persisted event ${lineNumber || 1}: ${validationMessage(cause)}`, { cause });
 	}
-	ensureCostLimitPersisted(callId) {
-		if (this.costLimitPersisted || this.costCeilingUsd === void 0) return;
-		this.appendEvent({
-			version: 1,
-			costCeilingUsd: this.costCeilingUsd
-		}, callId);
-		this.costLimitPersisted = true;
+}
+function completeJournalPrefix(serialized) {
+	if (!serialized || serialized.endsWith("\n")) return serialized;
+	const finalNewline = serialized.lastIndexOf("\n");
+	const tail = serialized.slice(finalNewline + 1);
+	try {
+		JSON.parse(tail);
+	} catch {
+		return finalNewline < 0 ? "" : serialized.slice(0, finalNewline + 1);
 	}
-	appendEvent(event, callId, receipt) {
-		try {
-			if (this.persistence) {
-				const nextRevision = this.persistence.append(this.revision, `${JSON.stringify(event)}\n`);
-				if (nextRevision === void 0) throw new CostCallConflictError(`CostLedger: persisted revision changed while writing call '${callId}'`, {
-					callId,
-					receipt
-				});
-				assertString(nextRevision, "persistence revision");
-				this.revision = nextRevision;
-			}
-		} catch (cause) {
-			if (cause instanceof CostCallConflictError) throw cause;
-			throw new CostLedgerPersistenceError(cause, callId, receipt);
+	throw new ValidationError("CostLedger: complete final persisted event is missing its newline terminator");
+}
+function validateTransition(records, record) {
+	const current = records.get(record.callId);
+	if (!current) return;
+	if (record.status === "pending" || current.status === "settled") throw new CostCallConflictError(`CostLedger: duplicate callId '${record.callId}'`);
+	if (!sameAttribution(current, record)) throw new ValidationError(`CostLedger: receipt attribution changed for call '${record.callId}'`);
+}
+function sameAttribution(before, after) {
+	return before.channel === after.channel && before.phase === after.phase && before.actor === after.actor && before.maximumCostUsd === after.maximumCostUsd && before.timestamp === after.timestamp && sameTags(before.tags, after.tags);
+}
+function sameTags(left, right) {
+	const leftEntries = Object.entries(left ?? {}).sort(([a], [b]) => a.localeCompare(b));
+	const rightEntries = Object.entries(right ?? {}).sort(([a], [b]) => a.localeCompare(b));
+	return JSON.stringify(leftEntries) === JSON.stringify(rightEntries);
+}
+//#endregion
+//#region src/cost-ledger/summary.ts
+function summarizeCostLedger(records, activeCallIds, lateCallIds) {
+	const pending = records.filter((record) => record.status === "pending");
+	const receipts = records.filter((record) => record.status === "settled");
+	const byChannel = /* @__PURE__ */ new Map();
+	const unpriced = /* @__PURE__ */ new Set();
+	const incompleteReasons = pending.map((record) => `call '${record.callId}' for '${record.actor}' is pending`);
+	let inputTokens = 0;
+	let outputTokens = 0;
+	let reasoningTokens = 0;
+	let cachedTokens = 0;
+	let cacheWriteTokens = 0;
+	let totalCostUsd = 0;
+	for (const receipt of receipts) {
+		inputTokens += receipt.inputTokens;
+		outputTokens += receipt.outputTokens;
+		reasoningTokens += receipt.reasoningTokens ?? 0;
+		cachedTokens += receipt.cachedTokens ?? 0;
+		cacheWriteTokens += receipt.cacheWriteTokens ?? 0;
+		totalCostUsd += receipt.costUsd;
+		if (receipt.costUnknown) {
+			unpriced.add(receipt.model);
+			incompleteReasons.push(receipt.error ?? `cost unknown for '${receipt.actor}' using '${receipt.model}'`);
 		}
+		if (receipt.usageUnknown) incompleteReasons.push(`token usage unknown for '${receipt.actor}' using '${receipt.model}'`);
+		if (receipt.maximumCostUsd !== void 0 && receipt.costUsd > receipt.maximumCostUsd) incompleteReasons.push(`'${receipt.actor}' charged ${receipt.costUsd}, exceeding its enforced maximum ${receipt.maximumCostUsd}`);
+		const rollup = byChannel.get(receipt.channel) ?? emptyRollup(receipt.channel);
+		rollup.calls += 1;
+		rollup.inputTokens += receipt.inputTokens;
+		rollup.outputTokens += receipt.outputTokens;
+		rollup.reasoningTokens = (rollup.reasoningTokens ?? 0) + (receipt.reasoningTokens ?? 0);
+		rollup.cachedTokens += receipt.cachedTokens ?? 0;
+		rollup.cacheWriteTokens = (rollup.cacheWriteTokens ?? 0) + (receipt.cacheWriteTokens ?? 0);
+		rollup.costUsd += receipt.costUsd;
+		if (receipt.costUnknown) rollup.unpricedCalls += 1;
+		if (receipt.usageUnknown) rollup.unknownUsageCalls += 1;
+		byChannel.set(receipt.channel, rollup);
 	}
-};
-/** Return the canonical pricing-table key, or null when the model is unpriced. */
-function modelPriceKey(model) {
-	return isModelPriced(model) ? model : null;
-}
-function costForUsage(model, usage) {
-	assertUsage(usage);
-	if (!resolveModelPricing(model)) return {
-		costUsd: 0,
-		costUnknown: true
-	};
 	return {
-		costUsd: estimateCost(usage.inputTokens + (usage.cachedTokens ?? 0) + (usage.cacheWriteTokens ?? 0), usage.outputTokens, model),
-		costUnknown: false
+		totalCalls: receipts.length,
+		pendingCalls: pending.length,
+		unresolvedCalls: pending.filter((record) => !activeCallIds.has(record.callId) || lateCallIds.has(record.callId)).length,
+		reservedCostUsd: pending.reduce((sum, record) => sum + (record.maximumCostUsd ?? 0), 0),
+		inputTokens,
+		outputTokens,
+		reasoningTokens,
+		cachedTokens,
+		cacheWriteTokens,
+		totalCostUsd,
+		costProvenance: pending.length > 0 || receipts.some((receipt) => receipt.costUnknown) ? {
+			kind: "uncaptured",
+			usd: null
+		} : receipts.every((receipt) => receipt.actualCostUsd !== void 0) ? {
+			kind: "observed",
+			usd: totalCostUsd
+		} : {
+			kind: "estimated",
+			usd: totalCostUsd
+		},
+		byChannel: [...byChannel.values()].sort((a, b) => a.channel.localeCompare(b.channel)),
+		unpricedModels: [...unpriced].sort(),
+		fullyPriced: unpriced.size === 0,
+		usageComplete: pending.length === 0 && receipts.every((receipt) => !receipt.usageUnknown),
+		accountingComplete: incompleteReasons.length === 0,
+		incompleteReasons: [...new Set(incompleteReasons)]
 	};
 }
-/** Price token counts with caller-supplied per-million rates. */
-function costForTokenPricing(pricing, usage) {
-	assertTokenCount(usage.inputTokens, "usage.inputTokens");
-	assertTokenCount(usage.outputTokens, "usage.outputTokens");
-	if (usage.cachedTokens !== void 0) assertTokenCount(usage.cachedTokens, "usage.cachedTokens");
-	if (usage.cacheWriteTokens !== void 0) assertTokenCount(usage.cacheWriteTokens, "usage.cacheWriteTokens");
-	assertNonNegative(pricing.inputUsdPerMillion, "pricing.inputUsdPerMillion");
-	if (pricing.cachedInputUsdPerMillion !== void 0) assertNonNegative(pricing.cachedInputUsdPerMillion, "pricing.cachedInputUsdPerMillion");
-	if (pricing.cacheWriteUsdPerMillion !== void 0) assertNonNegative(pricing.cacheWriteUsdPerMillion, "pricing.cacheWriteUsdPerMillion");
-	assertNonNegative(pricing.outputUsdPerMillion, "pricing.outputUsdPerMillion");
-	const cachedInputRate = pricing.cachedInputUsdPerMillion ?? pricing.inputUsdPerMillion;
-	const cacheWriteRate = pricing.cacheWriteUsdPerMillion ?? pricing.inputUsdPerMillion;
-	return usage.inputTokens / 1e6 * pricing.inputUsdPerMillion + (usage.cachedTokens ?? 0) / 1e6 * cachedInputRate + (usage.cacheWriteTokens ?? 0) / 1e6 * cacheWriteRate + usage.outputTokens / 1e6 * pricing.outputUsdPerMillion;
-}
-async function settle(promise, signal) {
-	return await new Promise((resolve) => {
-		let done = false;
-		const finish = (value) => {
-			if (done) return;
-			done = true;
-			signal.removeEventListener("abort", onAbort);
-			resolve(value);
-		};
-		const onAbort = () => finish({ kind: "aborted" });
-		signal.addEventListener("abort", onAbort, { once: true });
-		if (signal.aborted) onAbort();
-		promise.then((value) => finish({
-			kind: "value",
-			value
-		}), (error) => finish({
-			kind: "error",
-			error: toError(error)
-		}));
-	});
-}
-function buildReceipt(pending, observed, failed = false, error) {
-	assertUsage(observed);
-	assertString(observed.model, "receipt.model");
-	if ([
-		observed.actualCostUsd,
-		observed.estimatedCostUsd,
-		observed.customTokenPricing
-	].filter((value) => value !== void 0).length > 1) throw new ValidationError("CostLedger: a receipt can have only one of actualCostUsd, estimatedCostUsd, or customTokenPricing");
-	const customPricingSnapshot = observed.customTokenPricing === void 0 ? void 0 : pricingSnapshot(observed.customTokenPricing);
-	const estimated = customPricingSnapshot ? {
-		costUsd: costFromPricing(observed, customPricingSnapshot),
-		costUnknown: false
-	} : costForUsage(observed.model, observed);
-	const hasActual = observed.actualCostUsd !== void 0;
-	const hasExternalEstimate = observed.estimatedCostUsd !== void 0;
-	if (hasActual && observed.costUnknown === true) throw new ValidationError("CostLedger: a receipt cannot have both actualCostUsd and costUnknown=true");
-	if (hasActual) assertNonNegative(observed.actualCostUsd, "actualCostUsd");
-	if (hasExternalEstimate) assertNonNegative(observed.estimatedCostUsd, "estimatedCostUsd");
-	if (hasExternalEstimate && observed.costUnknown === true) throw new ValidationError("CostLedger: a receipt cannot have both estimatedCostUsd and costUnknown=true");
-	const usageUnknown = observed.usageUnknown === true;
-	const costUnknown = observed.costUnknown === true || !hasActual && !hasExternalEstimate && (usageUnknown || estimated.costUnknown);
-	const resolvedModelPricing = !customPricingSnapshot && !hasActual && !hasExternalEstimate && !costUnknown ? resolveModelPricing(observed.model) : null;
-	const receiptPricing = !hasActual && !hasExternalEstimate && !costUnknown ? customPricingSnapshot ?? (resolvedModelPricing ? {
-		inputUsdPerThousand: resolvedModelPricing.input,
-		outputUsdPerThousand: resolvedModelPricing.output
-	} : void 0) : void 0;
-	return parseReceipt({
-		status: "settled",
-		callId: pending.callId,
-		channel: pending.channel,
-		phase: pending.phase,
-		actor: pending.actor,
-		model: observed.model,
-		inputTokens: observed.inputTokens,
-		outputTokens: observed.outputTokens,
-		...observed.reasoningTokens === void 0 ? {} : { reasoningTokens: observed.reasoningTokens },
-		...observed.cachedTokens === void 0 ? {} : { cachedTokens: observed.cachedTokens },
-		...observed.cacheWriteTokens === void 0 ? {} : { cacheWriteTokens: observed.cacheWriteTokens },
-		costUsd: costUnknown ? 0 : hasActual ? observed.actualCostUsd : hasExternalEstimate ? observed.estimatedCostUsd : estimated.costUsd,
-		costUnknown,
-		usageUnknown,
-		...receiptPricing ? { pricing: receiptPricing } : {},
-		...hasActual ? { actualCostUsd: observed.actualCostUsd } : {},
-		...hasExternalEstimate ? { estimatedCostUsd: observed.estimatedCostUsd } : {},
-		...pending.maximumCostUsd === void 0 ? {} : { maximumCostUsd: pending.maximumCostUsd },
-		...failed ? { error: error ?? "paid-call-failed" } : {},
-		...pending.tags ? { tags: { ...pending.tags } } : {},
-		timestamp: pending.timestamp
-	}, "provider receipt");
+function emptyRollup(channel) {
+	return {
+		channel,
+		calls: 0,
+		inputTokens: 0,
+		outputTokens: 0,
+		reasoningTokens: 0,
+		cachedTokens: 0,
+		cacheWriteTokens: 0,
+		costUsd: 0,
+		unpricedCalls: 0,
+		unknownUsageCalls: 0
+	};
 }
-const NonEmptyString = z.string().refine((value) => value.trim().length > 0, "must be non-empty");
-const TokenCount = z.number().int().nonnegative().finite();
-const NonNegative = z.number().nonnegative().finite();
-const Tags = z.record(NonEmptyString, z.string());
-const CostPricingSchema = z.strictObject({
-	inputUsdPerThousand: NonNegative,
-	cachedInputUsdPerThousand: NonNegative.optional(),
-	cacheWriteUsdPerThousand: NonNegative.optional(),
-	outputUsdPerThousand: NonNegative
-});
-const CostCallBaseShape = {
-	callId: NonEmptyString,
-	channel: NonEmptyString,
-	phase: NonEmptyString,
-	actor: NonEmptyString,
-	model: NonEmptyString,
-	maximumCostUsd: NonNegative.optional(),
-	tags: Tags.optional(),
-	timestamp: NonNegative
-};
-const PendingCostCallSchema = z.strictObject({
-	status: z.literal("pending"),
-	...CostCallBaseShape
-});
-const CostReceiptBaseShape = {
-	status: z.literal("settled"),
-	...CostCallBaseShape,
-	inputTokens: TokenCount,
-	outputTokens: TokenCount,
-	cachedTokens: TokenCount.optional(),
-	costUsd: NonNegative,
-	costUnknown: z.boolean(),
-	usageUnknown: z.boolean().default(false),
-	pricing: CostPricingSchema.optional(),
-	actualCostUsd: NonNegative.optional(),
-	estimatedCostUsd: NonNegative.optional(),
-	error: NonEmptyString.optional()
-};
-const CostReceiptSchema = z.strictObject({
-	...CostReceiptBaseShape,
-	reasoningTokens: TokenCount.optional(),
-	cacheWriteTokens: TokenCount.optional()
-}).superRefine((receipt, ctx) => validateCostReceipt(receipt, ctx));
-function validateCostReceipt(receipt, ctx) {
-	if (receipt.reasoningTokens !== void 0 && receipt.reasoningTokens > receipt.outputTokens) ctx.addIssue({
-		code: "custom",
-		message: "reasoningTokens must not exceed outputTokens"
-	});
-	if (receipt.actualCostUsd !== void 0 && receipt.estimatedCostUsd !== void 0) ctx.addIssue({
-		code: "custom",
-		message: "actual and external estimated costs cannot both be present"
-	});
-	if (receipt.actualCostUsd !== void 0) {
-		if (receipt.costUnknown || receipt.costUsd !== receipt.actualCostUsd) ctx.addIssue({
-			code: "custom",
-			message: "actual cost must be known and equal costUsd"
-		});
-		if (receipt.pricing !== void 0) ctx.addIssue({
-			code: "custom",
-			message: "actual cost must not include estimated pricing"
-		});
-		return;
+//#endregion
+//#region src/cost-ledger.ts
+/** Run-wide paid-call admission, durable call state, receipts, and summaries. */
+var CostLedger = class {
+	records = /* @__PURE__ */ new Map();
+	activeCallIds = /* @__PURE__ */ new Set();
+	lateCallIds = /* @__PURE__ */ new Set();
+	idleWaiters = /* @__PURE__ */ new Set();
+	completedTasks = 0;
+	revision = "memory";
+	costLimitPersisted = false;
+	costCeilingUsd;
+	persistence;
+	constructor(input) {
+		const options = typeof input === "number" ? { costCeilingUsd: input } : input ?? {};
+		this.persistence = options.persistence;
+		if (options.costCeilingUsd !== void 0) assertNonNegative(options.costCeilingUsd, "costCeilingUsd");
+		let persistedCostCeilingUsd;
+		if (this.persistence) {
+			let stored;
+			try {
+				stored = this.persistence.read();
+			} catch (cause) {
+				throw new CostLedgerPersistenceError(cause);
+			}
+			assertString(stored.revision, "persistence revision");
+			this.revision = stored.revision;
+			const restored = parseEvents(stored.events);
+			for (const record of restored.records) this.records.set(record.callId, record);
+			this.completedTasks = restored.completedTasks;
+			persistedCostCeilingUsd = restored.costCeilingUsd;
+		}
+		if (options.costCeilingUsd !== void 0 && persistedCostCeilingUsd !== void 0 && options.costCeilingUsd !== persistedCostCeilingUsd) throw new ValidationError(`CostLedger: requested cost ceiling ${options.costCeilingUsd} does not match persisted ceiling ${persistedCostCeilingUsd}`);
+		this.costCeilingUsd = persistedCostCeilingUsd ?? options.costCeilingUsd;
+		this.costLimitPersisted = !this.persistence || this.costCeilingUsd === void 0 || persistedCostCeilingUsd !== void 0;
+		if (this.costCeilingUsd !== void 0 && [...this.records.values()].some((record) => record.status === "pending" && record.maximumCostUsd === void 0)) throw new ValidationError("CostLedger: capped event log contains an unbounded pending call");
+		if (options.receipts?.length) {
+			const imported = options.receipts.map((receipt, index) => parseImportedReceipt(receipt, `imported receipt ${index + 1}`));
+			this.ensureCostLimitPersisted();
+			for (const receipt of imported) this.appendRecord(receipt);
+		}
+	}
+	async runPaidCall(input) {
+		let callId;
+		let pending;
+		try {
+			callId = resolveCallId(input.callId);
+			validateAttribution(input);
+			if (input.signal?.aborted) return {
+				succeeded: false,
+				callId,
+				error: abortError(input.signal)
+			};
+			this.ensureCostLimitPersisted(callId);
+			const maximumCostUsd = this.resolveMaximum(input.maximumCharge);
+			const existing = this.records.get(callId);
+			if (existing) return {
+				succeeded: false,
+				callId,
+				error: new CostCallConflictError(existing.status === "pending" ? `CostLedger: callId '${callId}' is unresolved and must be reconciled before retry` : `CostLedger: callId '${callId}' already exists`, { callId })
+			};
+			if (!pending) {
+				while (true) {
+					if (this.records.has(callId)) return {
+						succeeded: false,
+						callId,
+						error: new CostCallConflictError(`CostLedger: callId '${callId}' already exists`)
+					};
+					const admission = this.admissionState();
+					if (admission.unresolvedCalls > 0) return {
+						succeeded: false,
+						callId,
+						error: new CostAccountingIncompleteError(`CostLedger: ${admission.unresolvedCalls} unresolved call(s) must be reconciled before new paid work`)
+					};
+					if (this.costCeilingUsd === void 0) break;
+					if (admission.budgetBreached) return {
+						succeeded: false,
+						callId,
+						error: new CostAccountingIncompleteError(`CostLedger: a settled call exceeded its enforced maximum; refusing paid call '${input.actor}' during '${input.phase}'`)
+					};
+					const { committedCostUsd } = admission;
+					if (committedCostUsd + maximumCostUsd > this.costCeilingUsd) return {
+						succeeded: false,
+						callId,
+						error: new CostCeilingReachedError(this.costCeilingUsd, committedCostUsd, maximumCostUsd, input.phase, input.actor)
+					};
+					if (committedCostUsd + admission.reservedCostUsd + maximumCostUsd <= this.costCeilingUsd) break;
+					await this.waitForReservationRelease(input.signal);
+				}
+				pending = {
+					status: "pending",
+					callId,
+					channel: input.channel,
+					phase: input.phase,
+					actor: input.actor,
+					model: pendingModel(input),
+					...maximumCostUsd === void 0 ? {} : { maximumCostUsd },
+					...input.tags ? { tags: { ...input.tags } } : {},
+					timestamp: Date.now()
+				};
+				this.appendRecord(pending);
+				this.activeCallIds.add(callId);
+			}
+		} catch (error) {
+			return {
+				succeeded: false,
+				...callId ? { callId } : {},
+				error: toError(error)
+			};
+		}
+		try {
+			return await this.execute(input, pending);
+		} catch (error) {
+			return {
+				succeeded: false,
+				callId: pending.callId,
+				error: toError(error)
+			};
+		} finally {
+			if (!this.lateCallIds.has(pending.callId)) this.releaseActiveCall(pending.callId);
+		}
 	}
-	if (receipt.estimatedCostUsd !== void 0) {
-		if (receipt.costUnknown || receipt.costUsd !== receipt.estimatedCostUsd) ctx.addIssue({
-			code: "custom",
-			message: "external estimate must be known and equal costUsd"
+	/** Wait until every call started by this ledger has produced a durable outcome. */
+	async waitForIdle(options = {}) {
+		const hasActiveMatch = () => [...this.activeCallIds].some((callId) => {
+			const record = this.records.get(callId);
+			return record !== void 0 && matches(record, options.filter);
 		});
-		if (receipt.pricing !== void 0) ctx.addIssue({
-			code: "custom",
-			message: "external estimate must not include token pricing"
+		if (!hasActiveMatch()) return true;
+		const timeoutMs = options.timeoutMs ?? 5e3;
+		assertTimeout(timeoutMs, "waitForIdle.timeoutMs");
+		return new Promise((resolve) => {
+			let timer;
+			const finish = (settled) => {
+				this.idleWaiters.delete(onIdle);
+				if (timer !== void 0) clearTimeout(timer);
+				resolve(settled);
+			};
+			const onIdle = () => {
+				if (!hasActiveMatch()) finish(true);
+			};
+			this.idleWaiters.add(onIdle);
+			timer = setTimeout(() => finish(false), timeoutMs);
+			onIdle();
 		});
-		return;
 	}
-	if (receipt.costUnknown) {
-		if (receipt.costUsd !== 0) ctx.addIssue({
-			code: "custom",
-			message: "unknown cost must have costUsd 0"
-		});
-		if (receipt.pricing !== void 0) ctx.addIssue({
-			code: "custom",
-			message: "unknown cost must not include estimated pricing"
+	/** Settle a call left pending by a crashed process after reconciling with the provider. */
+	reconcile(callId, observed, options = {}) {
+		const pending = this.records.get(callId);
+		if (pending?.status !== "pending") throw new CostCallConflictError(`CostLedger: no pending call '${callId}'`);
+		if (this.activeCallIds.has(callId)) throw new CostCallConflictError(`CostLedger: call '${callId}' is still active`);
+		this.ensureCostLimitPersisted(callId);
+		return this.commitReceipt(pending, observed, options.failed === true || options.error !== void 0, options.error);
+	}
+	list(filter) {
+		return [...this.records.values()].filter((record) => record.status === "settled").filter((receipt) => matches(receipt, filter)).map(cloneReceipt);
+	}
+	/** Read pending calls without exposing mutable ledger state. */
+	listPending(filter) {
+		return [...this.records.values()].filter((record) => record.status === "pending").filter((record) => matches(record, filter)).map((record) => ({
+			...clonePendingCall(record),
+			state: this.lateCallIds.has(record.callId) ? "late" : this.activeCallIds.has(record.callId) ? "active" : "interrupted"
+		}));
+	}
+	summary(filter) {
+		return summarizeCostLedger([...this.records.values()].filter((record) => matches(record, filter)), this.activeCallIds, this.lateCallIds);
+	}
+	markCompleted(count = 1) {
+		if (!Number.isInteger(count) || count < 0) throw new ValidationError(`CostLedger.markCompleted: count must be a non-negative integer, got ${count}`);
+		if (count === 0) return;
+		this.ensureCostLimitPersisted();
+		this.appendEvent({
+			version: 1,
+			completedTasks: count
 		});
-		return;
+		this.completedTasks += count;
 	}
-	if (receipt.usageUnknown) ctx.addIssue({
-		code: "custom",
-		message: "known estimated cost requires known usage"
-	});
-	if (!receipt.pricing) {
-		ctx.addIssue({
-			code: "custom",
-			message: "known estimated cost requires a pricing snapshot"
+	costPerCompletedTask() {
+		return this.completedTasks === 0 ? null : this.summary().totalCostUsd / this.completedTasks;
+	}
+	async execute(input, pending) {
+		const signal = input.signal ?? new AbortController().signal;
+		if (signal.aborted) return this.commitOutcome(pending, abortError(signal), {
+			model: pending.model,
+			inputTokens: 0,
+			outputTokens: 0,
+			actualCostUsd: 0
 		});
-		return;
+		const operation = Promise.resolve().then(() => input.execute(signal, pending.callId));
+		const settled = await settle(operation, signal);
+		if (settled.kind === "aborted") {
+			this.lateCallIds.add(pending.callId);
+			this.captureLateOutcome(input, pending, operation);
+			return paidFailure(pending.callId, abortError(signal));
+		}
+		if (settled.kind === "error") {
+			let observed;
+			try {
+				observed = input.receiptFromError?.(settled.error);
+			} catch (receiptError) {
+				return this.captureFailure(pending, settled.error, receiptError);
+			}
+			return this.commitOutcome(pending, settled.error, observed ?? unknownReceipt(pending.model));
+		}
+		try {
+			const receipt = this.commitReceipt(pending, input.receipt(settled.value));
+			if (receipt.maximumCostUsd !== void 0 && receipt.costUsd > receipt.maximumCostUsd) return paidFailure(pending.callId, new CostReservationExceededError(pending.actor, receipt.costUsd, receipt.maximumCostUsd), receipt);
+			return {
+				succeeded: true,
+				callId: pending.callId,
+				value: settled.value,
+				receipt
+			};
+		} catch (receiptError) {
+			if (receiptError instanceof CostLedgerPersistenceError || receiptError instanceof CostCallConflictError) return paidFailure(pending.callId, receiptError);
+			return this.captureFailure(pending, receiptError, receiptError);
+		}
 	}
-	const expected = costFromPricing(receipt, receipt.pricing);
-	if (!costAmountsMatch(receipt.costUsd, expected)) ctx.addIssue({
-		code: "custom",
-		message: `estimated cost ${receipt.costUsd} does not match pricing snapshot ${expected}`
-	});
-}
-function costAmountsMatch(left, right) {
-	const scale = Math.max(1, Math.abs(left), Math.abs(right));
-	return Math.abs(left - right) <= Number.EPSILON * scale * 8;
-}
-const CostLedgerEventSchema = z.union([
-	z.strictObject({
-		version: z.literal(1),
-		record: PendingCostCallSchema
-	}),
-	z.strictObject({
-		version: z.literal(2),
-		record: CostReceiptSchema
-	}),
-	z.strictObject({
-		version: z.literal(1),
-		completedTasks: TokenCount
-	}),
-	z.strictObject({
-		version: z.literal(1),
-		costCeilingUsd: NonNegative
-	})
-]);
-function parseEvents(serialized) {
-	const records = /* @__PURE__ */ new Map();
-	let completedTasks = 0;
-	let costCeilingUsd;
-	let lineNumber = 0;
-	try {
-		for (const line of completeJournalPrefix(serialized).split("\n")) {
-			if (!line.trim()) continue;
-			lineNumber += 1;
-			const event = CostLedgerEventSchema.parse(JSON.parse(line));
-			if ("record" in event) {
-				const record = event.record;
-				validateTransition(records, record);
-				records.set(record.callId, cloneRecord(record));
-			} else if ("completedTasks" in event) {
-				completedTasks += event.completedTasks;
-				if (!Number.isSafeInteger(completedTasks)) throw new ValidationError("CostLedger: completed task count exceeds safe integer range");
-			} else {
-				if (costCeilingUsd !== void 0) throw new ValidationError("CostLedger: duplicate persisted cost ceiling");
-				costCeilingUsd = event.costCeilingUsd;
+	captureLateOutcome(input, pending, operation) {
+		operation.then((value) => {
+			if (this.records.get(pending.callId)?.status !== "pending") return;
+			try {
+				this.commitReceipt(pending, input.receipt(value));
+			} catch {}
+		}, (cause) => {
+			if (this.records.get(pending.callId)?.status !== "pending") return;
+			const error = toError(cause);
+			try {
+				const observed = input.receiptFromError?.(error);
+				this.commitReceipt(pending, observed ?? unknownReceipt(pending.model), true);
+			} catch (receiptError) {
+				if (receiptError instanceof CostLedgerPersistenceError || receiptError instanceof CostCallConflictError) return;
+				this.captureFailure(pending, error, receiptError);
 			}
+		}).finally(() => {
+			this.lateCallIds.delete(pending.callId);
+			this.releaseActiveCall(pending.callId);
+		});
+	}
+	releaseActiveCall(callId) {
+		this.activeCallIds.delete(callId);
+		for (const resolve of [...this.idleWaiters]) resolve();
+	}
+	async waitForReservationRelease(signal) {
+		if (signal?.aborted) throw abortError(signal);
+		await new Promise((resolve, reject) => {
+			let finished = false;
+			const finish = (error) => {
+				if (finished) return;
+				finished = true;
+				this.idleWaiters.delete(onRelease);
+				signal?.removeEventListener("abort", onAbort);
+				if (error) reject(error);
+				else resolve();
+			};
+			const onRelease = () => finish();
+			const onAbort = () => finish(abortError(signal));
+			this.idleWaiters.add(onRelease);
+			signal?.addEventListener("abort", onAbort, { once: true });
+			if (this.activeCallIds.size === 0) onRelease();
+		});
+	}
+	commitOutcome(pending, error, observed) {
+		try {
+			const receipt = this.commitReceipt(pending, observed, true);
+			return paidFailure(pending.callId, error, receipt);
+		} catch (receiptError) {
+			if (receiptError instanceof CostLedgerPersistenceError || receiptError instanceof CostCallConflictError) return paidFailure(pending.callId, receiptError);
+			return this.captureFailure(pending, error, receiptError);
 		}
-		return {
-			records: [...records.values()],
-			completedTasks,
-			...costCeilingUsd === void 0 ? {} : { costCeilingUsd }
-		};
-	} catch (cause) {
-		throw new ValidationError(`CostLedger: invalid persisted event ${lineNumber || 1}: ${validationMessage(cause)}`, { cause });
 	}
-}
-function completeJournalPrefix(serialized) {
-	if (!serialized || serialized.endsWith("\n")) return serialized;
-	const finalNewline = serialized.lastIndexOf("\n");
-	const tail = serialized.slice(finalNewline + 1);
-	try {
-		JSON.parse(tail);
-	} catch {
-		return finalNewline < 0 ? "" : serialized.slice(0, finalNewline + 1);
+	captureFailure(pending, cause, receiptError) {
+		try {
+			const receipt = this.commitReceipt(pending, unknownReceipt(pending.model), true);
+			return paidFailure(pending.callId, new CostReceiptCaptureError(pending.callId, cause, receiptError, receipt), receipt);
+		} catch (error) {
+			const typed = error instanceof Error ? error : toError(error);
+			return paidFailure(pending.callId, typed);
+		}
 	}
-	throw new ValidationError("CostLedger: complete final persisted event is missing its newline terminator");
-}
-function validateTransition(records, record) {
-	const current = records.get(record.callId);
-	if (!current) return;
-	if (record.status === "pending" || current.status === "settled") throw new CostCallConflictError(`CostLedger: duplicate callId '${record.callId}'`);
-	if (!sameAttribution(current, record)) throw new ValidationError(`CostLedger: receipt attribution changed for call '${record.callId}'`);
-}
-function sameAttribution(before, after) {
-	return before.channel === after.channel && before.phase === after.phase && before.actor === after.actor && before.maximumCostUsd === after.maximumCostUsd && before.timestamp === after.timestamp && sameTags(before.tags, after.tags);
-}
-function sameTags(left, right) {
-	const leftEntries = Object.entries(left ?? {}).sort(([a], [b]) => a.localeCompare(b));
-	const rightEntries = Object.entries(right ?? {}).sort(([a], [b]) => a.localeCompare(b));
-	return JSON.stringify(leftEntries) === JSON.stringify(rightEntries);
-}
-function parseReceipt(value, path) {
-	try {
-		return CostReceiptSchema.parse(value);
-	} catch (cause) {
-		throw new ValidationError(`CostLedger: invalid ${path}: ${validationMessage(cause)}`, { cause });
+	commitReceipt(pending, observed, failed = false, error) {
+		const receipt = buildReceipt(pending, observed, failed, error);
+		if (this.records.get(pending.callId)?.status !== "pending") throw new CostCallConflictError(`CostLedger: call '${pending.callId}' is not pending`);
+		this.appendRecord(receipt);
+		return cloneReceipt(receipt);
 	}
-}
-function parseImportedReceipt(value, path) {
-	if (typeof value !== "object" || value === null) return parseReceipt(value, path);
-	const candidate = { ...value };
-	if (candidate.status === "settled" && candidate.actualCostUsd === void 0 && candidate.estimatedCostUsd === void 0 && candidate.costUnknown === false && candidate.pricing === void 0 && typeof candidate.model === "string") {
-		const pricing = resolveModelPricing(candidate.model);
-		if (pricing) candidate.pricing = {
-			inputUsdPerThousand: pricing.input,
-			outputUsdPerThousand: pricing.output
+	resolveMaximum(maximum) {
+		if (!maximum) {
+			if (this.costCeilingUsd !== void 0) throw new CostAccountingIncompleteError("CostLedger: capped paid calls require a hard maximumCharge before execution");
+			return;
+		}
+		if ("externallyEnforcedMaximumUsd" in maximum) {
+			assertNonNegative(maximum.externallyEnforcedMaximumUsd, "maximumCharge.externallyEnforcedMaximumUsd");
+			return maximum.externallyEnforcedMaximumUsd;
+		}
+		if ("customTokenPricing" in maximum) return costForTokenPricing(maximum.customTokenPricing, maximum);
+		const priced = costForUsage(maximum.model, maximum);
+		if (priced.costUnknown) {
+			if (this.costCeilingUsd !== void 0) throw new CostAccountingIncompleteError(`CostLedger: cannot reserve unpriced model '${maximum.model}' in a capped run`);
+			return;
+		}
+		return priced.costUsd;
+	}
+	/** Compute admission totals in record order without building reporting rollups. */
+	admissionState() {
+		let unresolvedCalls = 0;
+		let reservedCostUsd = 0;
+		let committedCostUsd = 0;
+		let budgetBreached = false;
+		for (const record of this.records.values()) if (record.status === "pending") {
+			if (!this.activeCallIds.has(record.callId) || this.lateCallIds.has(record.callId)) unresolvedCalls += 1;
+			reservedCostUsd += record.maximumCostUsd ?? 0;
+		} else {
+			if (record.maximumCostUsd !== void 0 && record.costUsd > record.maximumCostUsd) budgetBreached = true;
+			committedCostUsd += record.costUnknown ? record.maximumCostUsd ?? record.costUsd : record.costUsd;
+		}
+		return {
+			unresolvedCalls,
+			reservedCostUsd,
+			committedCostUsd,
+			budgetBreached
 		};
 	}
-	return parseReceipt(candidate, path);
-}
-function validateAttribution(input) {
-	assertString(input.channel, "channel");
-	assertString(input.phase, "phase");
-	assertString(input.actor, "actor");
-	if (input.model !== void 0) assertString(input.model, "model");
-	if (input.tags !== void 0) {
-		const parsed = Tags.safeParse(input.tags);
-		if (!parsed.success) throw new ValidationError(`CostLedger: invalid tags: ${parsed.error.message}`);
+	appendRecord(record) {
+		const callId = record.callId;
+		const receipt = record.status === "settled" ? record : void 0;
+		validateTransition(this.records, record);
+		const event = record.status === "settled" ? {
+			version: 2,
+			record: cloneReceipt(record)
+		} : {
+			version: 1,
+			record: clonePendingCall(record)
+		};
+		this.appendEvent(event, callId, receipt);
+		this.records.set(callId, cloneRecord(record));
 	}
-}
-function matches(record, filter) {
-	if (!filter) return true;
-	if (filter.channel !== void 0 && record.channel !== filter.channel) return false;
-	if (filter.phase !== void 0 && record.phase !== filter.phase) return false;
-	return Object.entries(filter.tags ?? {}).every(([key, value]) => record.tags?.[key] === value);
-}
-function cloneRecord(record) {
-	if (record.status === "settled") return cloneReceipt(record);
-	return clonePendingCall(record);
-}
-function clonePendingCall(record) {
-	const { tags, ...rest } = record;
-	return {
-		...rest,
-		...tags ? { tags: { ...tags } } : {}
-	};
-}
-function cloneReceipt(receipt) {
-	const { pricing, tags, ...rest } = receipt;
-	return {
-		...rest,
-		...tags ? { tags: { ...tags } } : {},
-		...pricing ? { pricing: { ...pricing } } : {}
-	};
-}
-function costFromPricing(usage, pricing) {
-	const cachedInputRate = pricing.cachedInputUsdPerThousand ?? pricing.inputUsdPerThousand;
-	const cacheWriteRate = pricing.cacheWriteUsdPerThousand ?? pricing.inputUsdPerThousand;
-	return usage.inputTokens / 1e3 * pricing.inputUsdPerThousand + (usage.cachedTokens ?? 0) / 1e3 * cachedInputRate + (usage.cacheWriteTokens ?? 0) / 1e3 * cacheWriteRate + usage.outputTokens / 1e3 * pricing.outputUsdPerThousand;
-}
-function pricingSnapshot(pricing) {
-	costForTokenPricing(pricing, {
-		inputTokens: 0,
-		outputTokens: 0
+	ensureCostLimitPersisted(callId) {
+		if (this.costLimitPersisted || this.costCeilingUsd === void 0) return;
+		this.appendEvent({
+			version: 1,
+			costCeilingUsd: this.costCeilingUsd
+		}, callId);
+		this.costLimitPersisted = true;
+	}
+	appendEvent(event, callId, receipt) {
+		try {
+			if (this.persistence) {
+				const nextRevision = this.persistence.append(this.revision, `${JSON.stringify(event)}\n`);
+				if (nextRevision === void 0) throw new CostCallConflictError(`CostLedger: persisted revision changed while writing call '${callId}'`, {
+					callId,
+					receipt
+				});
+				assertString(nextRevision, "persistence revision");
+				this.revision = nextRevision;
+			}
+		} catch (cause) {
+			if (cause instanceof CostCallConflictError) throw cause;
+			throw new CostLedgerPersistenceError(cause, callId, receipt);
+		}
+	}
+};
+async function settle(promise, signal) {
+	return await new Promise((resolve) => {
+		let done = false;
+		const finish = (value) => {
+			if (done) return;
+			done = true;
+			signal.removeEventListener("abort", onAbort);
+			resolve(value);
+		};
+		const onAbort = () => finish({ kind: "aborted" });
+		signal.addEventListener("abort", onAbort, { once: true });
+		if (signal.aborted) onAbort();
+		promise.then((value) => finish({
+			kind: "value",
+			value
+		}), (error) => finish({
+			kind: "error",
+			error: toError(error)
+		}));
 	});
-	return {
-		inputUsdPerThousand: pricing.inputUsdPerMillion / 1e3,
-		...pricing.cachedInputUsdPerMillion === void 0 ? {} : { cachedInputUsdPerThousand: pricing.cachedInputUsdPerMillion / 1e3 },
-		...pricing.cacheWriteUsdPerMillion === void 0 ? {} : { cacheWriteUsdPerThousand: pricing.cacheWriteUsdPerMillion / 1e3 },
-		outputUsdPerThousand: pricing.outputUsdPerMillion / 1e3
-	};
-}
-function emptyRollup(channel) {
-	return {
-		channel,
-		calls: 0,
-		inputTokens: 0,
-		outputTokens: 0,
-		reasoningTokens: 0,
-		cachedTokens: 0,
-		cacheWriteTokens: 0,
-		costUsd: 0,
-		unpricedCalls: 0,
-		unknownUsageCalls: 0
-	};
 }
 function pendingModel(input) {
 	if (input.model) return input.model;
@@ -860,9 +907,6 @@ function abortError(signal) {
 	error.name = "AbortError";
 	return error;
 }
-function toError(value) {
-	return value instanceof Error ? value : new Error(String(value));
-}
 function paidFailure(callId, error, receipt) {
 	return {
 		succeeded: false,
@@ -871,32 +915,7 @@ function paidFailure(callId, error, receipt) {
 		...receipt ? { receipt: cloneReceipt(receipt) } : {}
 	};
 }
-function validationMessage(cause) {
-	return cause instanceof z.ZodError ? z.prettifyError(cause) : toError(cause).message;
-}
-function assertUsage(usage) {
-	assertTokenCount(usage.inputTokens, "inputTokens");
-	assertTokenCount(usage.outputTokens, "outputTokens");
-	if (usage.reasoningTokens !== void 0) {
-		assertTokenCount(usage.reasoningTokens, "reasoningTokens");
-		if (usage.reasoningTokens > usage.outputTokens) throw new ValidationError("CostLedger: reasoningTokens must not exceed outputTokens");
-	}
-	if (usage.cachedTokens !== void 0) assertTokenCount(usage.cachedTokens, "cachedTokens");
-	if (usage.cacheWriteTokens !== void 0) assertTokenCount(usage.cacheWriteTokens, "cacheWriteTokens");
-}
-function assertTokenCount(value, name) {
-	if (typeof value !== "number" || !Number.isInteger(value) || value < 0) throw new ValidationError(`CostLedger: ${name} must be a non-negative integer, got ${String(value)}`);
-}
-function assertNonNegative(value, name) {
-	if (typeof value !== "number" || !Number.isFinite(value) || value < 0) throw new ValidationError(`CostLedger: ${name} must be a non-negative finite number, got ${String(value)}`);
-}
-function assertTimeout(value, name) {
-	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0 || value > 2147483647) throw new ValidationError(`CostLedger: ${name} must be a non-negative safe integer no greater than 2147483647, got ${String(value)}`);
-}
-function assertString(value, name) {
-	if (typeof value !== "string" || value.trim().length === 0) throw new ValidationError(`CostLedger: ${name} must be a non-empty string`);
-}
 //#endregion
-export { CostLedgerPersistenceError as a, costForTokenPricing as c, CostLedger as i, costForUsage as l, CostCallConflictError as n, CostReceiptCaptureError as o, CostCeilingReachedError as r, CostReservationExceededError as s, CostAccountingIncompleteError as t, modelPriceKey as u };
+export { CostLedgerPersistenceError as a, costForTokenPricing as c, CostCeilingReachedError as i, costForUsage as l, CostAccountingIncompleteError as n, CostReceiptCaptureError as o, CostCallConflictError as r, CostReservationExceededError as s, CostLedger as t, modelPriceKey as u };
 
-//# sourceMappingURL=cost-ledger-D2FnJPBF.js.map
+//# sourceMappingURL=cost-ledger-BP8V4kUQ.js.map