@tumbaland/backend-core 1.25.0 → 1.27.0

package/dist/entitlements/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/entitlements/client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAsHvC;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAoB1E;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE1D;AAED,qFAAqF;AACrF,wBAAgB,sBAAsB,IAAI,IAAI,CAG7C"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/entitlements/client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAuIvC;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAoB1E;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE1D;AAED,qFAAqF;AACrF,wBAAgB,sBAAsB,IAAI,IAAI,CAG7C"}

package/dist/entitlements/client.js

@@ -58,8 +58,24 @@ function fallbackEntitlements(email) {
         stale: true
     };
 }
+/**
+ * Prefers the container-network address over the public hostname.
+ *
+ * `PAYMENT_API_URL` cannot simply be pointed inward: payment-front's entrypoint
+ * templates that same variable into the `config.json` the *browser* downloads,
+ * so a Docker-internal value there breaks the subscription and checkout pages.
+ * One variable, two consumers with incompatible needs — this is the server-side
+ * half of it.
+ *
+ * Falling back keeps local dev (where only `PAYMENT_API_URL` is set) and any
+ * un-migrated deployment working; it just takes the long way round, out through
+ * the proxy and back, carrying the internal token across the public edge.
+ */
+function internalPaymentUrl() {
+    return process.env.PAYMENT_INTERNAL_URL || process.env.PAYMENT_API_URL;
+}
 async function fetchEntitlements(email) {
-    const baseUrl = process.env.PAYMENT_API_URL;
+    const baseUrl = internalPaymentUrl();
     const token = process.env.INTERNAL_SERVICE_TOKEN;
     const serviceId = process.env.SERVICE_NAME || 'unknown-service';
     if (!baseUrl || !token) {

package/dist/entitlements/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/entitlements/client.ts"],"names":[],"mappings":";;;;;AA8HA,0CAoBC;AAOD,wDAEC;AAGD,wDAGC;AAjKD,+DAAuC;AACvC,+CAA8E;AAG9E;;;;;;;;;;GAUG;AACH,MAAM,YAAY,GAAG,MAAM,CAAC;AAE5B,iFAAiF;AACjF,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAOjC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;AAE5C;;;;GAIG;AACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAiC,CAAC;AAE1D,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,KAAmB;IAClD,IAAI,KAAK,CAAC,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACpC,yEAAyE;QACzE,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,IAAI;YAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO;QACL,KAAK;QACL,QAAQ,EAAE,2BAAa;QACvB,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,IAAA,2BAAa,EAAC,2BAAa,CAAC;QACpC,KAAK,EAAE,IAAI;KACZ,CAAC;AACJ,CAAC;AAUD,KAAK,UAAU,iBAAiB,CAAC,KAAa;IAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACjD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,iBAAiB,CAAC;IAEhE,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;QACvB,gBAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE;YAChD,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC;YAClC,gBAAgB,EAAE,OAAO,CAAC,KAAK,CAAC;SACjC,CAAC,CAAC;QACH,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,gCAAgC,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE;YAClG,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,KAAK;gBACzB,cAAc,EAAE,SAAS;aAC1B;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAChD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,gBAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9E,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,2BAAa,CAAC;QAChD,OAAO;YACL,KAAK;YACL,QAAQ;YACR,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;YAC3B,yEAAyE;YACzE,oEAAoE;YACpE,MAAM,EAAE,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;YAC9C,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gBAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAG,GAAa,EAAE,OAAO,EAAE,CAAC,CAAC;QACtF,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE5B,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IAEjE,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC;SACnC,IAAI,CAAC,KAAK,CAAC,EAAE;QACZ,IAAI,CAAC,KAAK,CAAC,KAAK;YAAE,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;SACD,OAAO,CAAC,GAAG,EAAE;QACZ,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEL,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,KAAa;IAClD,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,qFAAqF;AACrF,SAAgB,sBAAsB;IACpC,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/entitlements/client.ts"],"names":[],"mappings":";;;;;AA+IA,0CAoBC;AAOD,wDAEC;AAGD,wDAGC;AAlLD,+DAAuC;AACvC,+CAA8E;AAG9E;;;;;;;;;;GAUG;AACH,MAAM,YAAY,GAAG,MAAM,CAAC;AAE5B,iFAAiF;AACjF,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAOjC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;AAE5C;;;;GAIG;AACH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAiC,CAAC;AAE1D,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,KAAmB;IAClD,IAAI,KAAK,CAAC,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACpC,yEAAyE;QACzE,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,IAAI;YAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO;QACL,KAAK;QACL,QAAQ,EAAE,2BAAa;QACvB,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,IAAA,2BAAa,EAAC,2BAAa,CAAC;QACpC,KAAK,EAAE,IAAI;KACZ,CAAC;AACJ,CAAC;AAUD;;;;;;;;;;;;GAYG;AACH,SAAS,kBAAkB;IACzB,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;AACzE,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,KAAa;IAC5C,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACjD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,iBAAiB,CAAC;IAEhE,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;QACvB,gBAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE;YAChD,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC;YAClC,gBAAgB,EAAE,OAAO,CAAC,KAAK,CAAC;SACjC,CAAC,CAAC;QACH,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,gCAAgC,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE;YAClG,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,KAAK;gBACzB,cAAc,EAAE,SAAS;aAC1B;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAChD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,gBAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9E,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,2BAAa,CAAC;QAChD,OAAO;YACL,KAAK;YACL,QAAQ;YACR,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;YAC3B,yEAAyE;YACzE,oEAAoE;YACpE,MAAM,EAAE,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;YAC9C,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gBAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAG,GAAa,EAAE,OAAO,EAAE,CAAC,CAAC;QACtF,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE5B,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IAEjE,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC;SACnC,IAAI,CAAC,KAAK,CAAC,EAAE;QACZ,IAAI,CAAC,KAAK,CAAC,KAAK;YAAE,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;SACD,OAAO,CAAC,GAAG,EAAE;QACZ,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEL,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,KAAa;IAClD,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,qFAAqF;AACrF,SAAgB,sBAAsB;IACpC,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC"}

package/dist/entitlements/index.d.ts

@@ -1,11 +1,12 @@
 export { UNLIMITED, FALLBACK_PLAN, STAFF_PLAN, applyLimits, METER_KEYS, FEATURE_KEYS, METER_DEFINITIONS, FEATURE_DEFINITIONS, DEFAULT_PLAN_LIMITS, ENTITLEMENT_CATALOG, resolveLimits, normalizeLimits, meterPeriod, isMeterKey, isFeatureKey, fitsWithin } from './definitions';
 export type { MeterKey, FeatureKey, MeterPeriod, MeterDefinition, FeatureDefinition, PlanLimits, PartialPlanLimits } from './definitions';
-export type { Entitlements, EntitlementsMode } from './types';
-export { getEntitlementsMode, resetEntitlementsModeWarning } from './mode';
+export type { Entitlements } from './types';
 export { UsageMeter, currentPeriod } from './UsageMeter';
 export type { IUsageMeter } from './UsageMeter';
 export { getUsage, getUsageSnapshot, checkQuota, consumeQuota, releaseQuota, setUsage } from './usage';
 export type { QuotaRequest } from './usage';
+export { reconcileUsageMeters, runUsageReconciliation, RECONCILED_METERS } from './reconcile';
+export type { ReconcileOptions, ReconcileReport, MeterChange, OrphanedMeter } from './reconcile';
 export { getEntitlements, invalidateEntitlements, clearEntitlementsCache } from './client';
 export { loadEntitlements, requireEntitlement, requireQuota, retentionFloor } from './middleware';
 export type { EntitlementOptions, QuotaOptions, SubjectResolver } from './middleware';

package/dist/entitlements/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/entitlements/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,aAAa,EACb,UAAU,EACV,WAAW,EACX,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,EACb,eAAe,EACf,WAAW,EACX,UAAU,EACV,YAAY,EACZ,UAAU,EACX,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,QAAQ,EACR,UAAU,EACV,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,UAAU,EACV,iBAAiB,EAClB,MAAM,eAAe,CAAC;AAEvB,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,4BAA4B,EAAE,MAAM,QAAQ,CAAC;AAE3E,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACzD,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACvG,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAE3F,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAClG,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/entitlements/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,aAAa,EACb,UAAU,EACV,WAAW,EACX,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,EACb,eAAe,EACf,WAAW,EACX,UAAU,EACV,YAAY,EACZ,UAAU,EACX,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,QAAQ,EACR,UAAU,EACV,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,UAAU,EACV,iBAAiB,EAClB,MAAM,eAAe,CAAC;AAEvB,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACzD,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACvG,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC9F,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjG,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAE3F,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAClG,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC"}

package/dist/entitlements/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.retentionFloor = exports.requireQuota = exports.requireEntitlement = exports.loadEntitlements = exports.clearEntitlementsCache = exports.invalidateEntitlements = exports.getEntitlements = exports.setUsage = exports.releaseQuota = exports.consumeQuota = exports.checkQuota = exports.getUsageSnapshot = exports.getUsage = exports.currentPeriod = exports.UsageMeter = exports.resetEntitlementsModeWarning = exports.getEntitlementsMode = exports.fitsWithin = exports.isFeatureKey = exports.isMeterKey = exports.meterPeriod = exports.normalizeLimits = exports.resolveLimits = exports.ENTITLEMENT_CATALOG = exports.DEFAULT_PLAN_LIMITS = exports.FEATURE_DEFINITIONS = exports.METER_DEFINITIONS = exports.FEATURE_KEYS = exports.METER_KEYS = exports.applyLimits = exports.STAFF_PLAN = exports.FALLBACK_PLAN = exports.UNLIMITED = void 0;
+exports.retentionFloor = exports.requireQuota = exports.requireEntitlement = exports.loadEntitlements = exports.clearEntitlementsCache = exports.invalidateEntitlements = exports.getEntitlements = exports.RECONCILED_METERS = exports.runUsageReconciliation = exports.reconcileUsageMeters = exports.setUsage = exports.releaseQuota = exports.consumeQuota = exports.checkQuota = exports.getUsageSnapshot = exports.getUsage = exports.currentPeriod = exports.UsageMeter = exports.fitsWithin = exports.isFeatureKey = exports.isMeterKey = exports.meterPeriod = exports.normalizeLimits = exports.resolveLimits = exports.ENTITLEMENT_CATALOG = exports.DEFAULT_PLAN_LIMITS = exports.FEATURE_DEFINITIONS = exports.METER_DEFINITIONS = exports.FEATURE_KEYS = exports.METER_KEYS = exports.applyLimits = exports.STAFF_PLAN = exports.FALLBACK_PLAN = exports.UNLIMITED = void 0;
 var definitions_1 = require("./definitions");
 Object.defineProperty(exports, "UNLIMITED", { enumerable: true, get: function () { return definitions_1.UNLIMITED; } });
 Object.defineProperty(exports, "FALLBACK_PLAN", { enumerable: true, get: function () { return definitions_1.FALLBACK_PLAN; } });
@@ -18,9 +18,6 @@ Object.defineProperty(exports, "meterPeriod", { enumerable: true, get: function
 Object.defineProperty(exports, "isMeterKey", { enumerable: true, get: function () { return definitions_1.isMeterKey; } });
 Object.defineProperty(exports, "isFeatureKey", { enumerable: true, get: function () { return definitions_1.isFeatureKey; } });
 Object.defineProperty(exports, "fitsWithin", { enumerable: true, get: function () { return definitions_1.fitsWithin; } });
-var mode_1 = require("./mode");
-Object.defineProperty(exports, "getEntitlementsMode", { enumerable: true, get: function () { return mode_1.getEntitlementsMode; } });
-Object.defineProperty(exports, "resetEntitlementsModeWarning", { enumerable: true, get: function () { return mode_1.resetEntitlementsModeWarning; } });
 var UsageMeter_1 = require("./UsageMeter");
 Object.defineProperty(exports, "UsageMeter", { enumerable: true, get: function () { return UsageMeter_1.UsageMeter; } });
 Object.defineProperty(exports, "currentPeriod", { enumerable: true, get: function () { return UsageMeter_1.currentPeriod; } });
@@ -31,6 +28,10 @@ Object.defineProperty(exports, "checkQuota", { enumerable: true, get: function (
 Object.defineProperty(exports, "consumeQuota", { enumerable: true, get: function () { return usage_1.consumeQuota; } });
 Object.defineProperty(exports, "releaseQuota", { enumerable: true, get: function () { return usage_1.releaseQuota; } });
 Object.defineProperty(exports, "setUsage", { enumerable: true, get: function () { return usage_1.setUsage; } });
+var reconcile_1 = require("./reconcile");
+Object.defineProperty(exports, "reconcileUsageMeters", { enumerable: true, get: function () { return reconcile_1.reconcileUsageMeters; } });
+Object.defineProperty(exports, "runUsageReconciliation", { enumerable: true, get: function () { return reconcile_1.runUsageReconciliation; } });
+Object.defineProperty(exports, "RECONCILED_METERS", { enumerable: true, get: function () { return reconcile_1.RECONCILED_METERS; } });
 var client_1 = require("./client");
 Object.defineProperty(exports, "getEntitlements", { enumerable: true, get: function () { return client_1.getEntitlements; } });
 Object.defineProperty(exports, "invalidateEntitlements", { enumerable: true, get: function () { return client_1.invalidateEntitlements; } });

package/dist/entitlements/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/entitlements/index.ts"],"names":[],"mappings":";;;AAAA,6CAiBuB;AAhBrB,wGAAA,SAAS,OAAA;AACT,4GAAA,aAAa,OAAA;AACb,yGAAA,UAAU,OAAA;AACV,0GAAA,WAAW,OAAA;AACX,yGAAA,UAAU,OAAA;AACV,2GAAA,YAAY,OAAA;AACZ,gHAAA,iBAAiB,OAAA;AACjB,kHAAA,mBAAmB,OAAA;AACnB,kHAAA,mBAAmB,OAAA;AACnB,kHAAA,mBAAmB,OAAA;AACnB,4GAAA,aAAa,OAAA;AACb,8GAAA,eAAe,OAAA;AACf,0GAAA,WAAW,OAAA;AACX,yGAAA,UAAU,OAAA;AACV,2GAAA,YAAY,OAAA;AACZ,yGAAA,UAAU,OAAA;AAaZ,+BAA2E;AAAlE,2GAAA,mBAAmB,OAAA;AAAE,oHAAA,4BAA4B,OAAA;AAE1D,2CAAyD;AAAhD,wGAAA,UAAU,OAAA;AAAE,2GAAA,aAAa,OAAA;AAElC,iCAAuG;AAA9F,iGAAA,QAAQ,OAAA;AAAE,yGAAA,gBAAgB,OAAA;AAAE,mGAAA,UAAU,OAAA;AAAE,qGAAA,YAAY,OAAA;AAAE,qGAAA,YAAY,OAAA;AAAE,iGAAA,QAAQ,OAAA;AAGrF,mCAA2F;AAAlF,yGAAA,eAAe,OAAA;AAAE,gHAAA,sBAAsB,OAAA;AAAE,gHAAA,sBAAsB,OAAA;AAExE,2CAAkG;AAAzF,8GAAA,gBAAgB,OAAA;AAAE,gHAAA,kBAAkB,OAAA;AAAE,0GAAA,YAAY,OAAA;AAAE,4GAAA,cAAc,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/entitlements/index.ts"],"names":[],"mappings":";;;AAAA,6CAiBuB;AAhBrB,wGAAA,SAAS,OAAA;AACT,4GAAA,aAAa,OAAA;AACb,yGAAA,UAAU,OAAA;AACV,0GAAA,WAAW,OAAA;AACX,yGAAA,UAAU,OAAA;AACV,2GAAA,YAAY,OAAA;AACZ,gHAAA,iBAAiB,OAAA;AACjB,kHAAA,mBAAmB,OAAA;AACnB,kHAAA,mBAAmB,OAAA;AACnB,kHAAA,mBAAmB,OAAA;AACnB,4GAAA,aAAa,OAAA;AACb,8GAAA,eAAe,OAAA;AACf,0GAAA,WAAW,OAAA;AACX,yGAAA,UAAU,OAAA;AACV,2GAAA,YAAY,OAAA;AACZ,yGAAA,UAAU,OAAA;AAcZ,2CAAyD;AAAhD,wGAAA,UAAU,OAAA;AAAE,2GAAA,aAAa,OAAA;AAElC,iCAAuG;AAA9F,iGAAA,QAAQ,OAAA;AAAE,yGAAA,gBAAgB,OAAA;AAAE,mGAAA,UAAU,OAAA;AAAE,qGAAA,YAAY,OAAA;AAAE,qGAAA,YAAY,OAAA;AAAE,iGAAA,QAAQ,OAAA;AAGrF,yCAA8F;AAArF,iHAAA,oBAAoB,OAAA;AAAE,mHAAA,sBAAsB,OAAA;AAAE,8GAAA,iBAAiB,OAAA;AAGxE,mCAA2F;AAAlF,yGAAA,eAAe,OAAA;AAAE,gHAAA,sBAAsB,OAAA;AAAE,gHAAA,sBAAsB,OAAA;AAExE,2CAAkG;AAAzF,8GAAA,gBAAgB,OAAA;AAAE,gHAAA,kBAAkB,OAAA;AAAE,0GAAA,YAAY,OAAA;AAAE,4GAAA,cAAc,OAAA"}

package/dist/entitlements/middleware.d.ts

@@ -43,12 +43,23 @@ export interface QuotaOptions extends EntitlementOptions {
  */
 export declare function requireQuota(meter: MeterKey, options?: QuotaOptions): RequestHandler;
 /**
- * The oldest timestamp a user may read, or `null` for unlimited history.
+ * The oldest timestamp a caller may read, or `null` for unlimited history.
  *
- * Meant to be dropped straight into an aggregation `$match` — this is what
+ * Meant to be dropped straight into a `$match` or a `find` filter — this is what
  * gates the portfolio planner, since the planner runs entirely client-side and
  * any `<PaywallGate>` around it is bypassable from devtools. Truncating the
  * price history it depends on is not.
+ *
+ * **Several subjects resolve to the most generous floor.** Retention is not a
+ * counter, so unlike a quota it has no single payer: data held in a group is
+ * read by every member, and if it resolved to the *caller's* plan alone, a free
+ * member of a paid Family group would see ninety days of a household's history
+ * that the household paid to keep. Pass the caller together with the owners of
+ * the groups being read, and the group's plan lifts the floor for everyone in
+ * it — which is what "shared across a household" was sold as.
+ *
+ * An empty list resolves to the free plan's floor rather than to `null`: no
+ * identifiable subject must never mean unlimited history.
  */
-export declare function retentionFloor(email: string, now?: Date): Promise<Date | null>;
+export declare function retentionFloor(subject: string | readonly string[], now?: Date): Promise<Date | null>;
 //# sourceMappingURL=middleware.d.ts.map

package/dist/entitlements/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/entitlements/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAGlD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAa,MAAM,eAAe,CAAC;AAIhE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,uGAAuG;YACvG,YAAY,CAAC,EAAE,YAAY,CAAC;SAC7B;KACF;CACF;AAED;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;AAEjG,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,eAAe,CAAC;CAC3B;AAID;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,GAAE,eAAgC,GAAG,OAAO,CAAC,YAAY,CAAC,CASrH;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,GAAE,kBAAuB,GAAG,cAAc,CA+BxG;AAED,MAAM,WAAW,YAAa,SAAQ,kBAAkB;IACtD;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC;CAC9C;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,GAAE,YAAiB,GAAG,cAAc,CAoBxF;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAQhG"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/entitlements/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAGlD,OAAO,EAAiB,UAAU,EAAE,QAAQ,EAA4B,MAAM,eAAe,CAAC;AAG9F,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,uGAAuG;YACvG,YAAY,CAAC,EAAE,YAAY,CAAC;SAC7B;KACF;CACF;AAED;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;AAEjG,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,eAAe,CAAC;CAC3B;AAID;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,GAAE,eAAgC,GAAG,OAAO,CAAC,YAAY,CAAC,CASrH;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,GAAE,kBAAuB,GAAG,cAAc,CAyBxG;AAED,MAAM,WAAW,YAAa,SAAQ,kBAAkB;IACtD;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC;CAC9C;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,GAAE,YAAiB,GAAG,cAAc,CAkBxF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EACnC,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAiBtB"}

package/dist/entitlements/middleware.js

@@ -12,7 +12,6 @@ const HttpError_1 = require("../errors/HttpError");
 const definitions_1 = require("./definitions");
 const client_1 = require("./client");
 const usage_1 = require("./usage");
-const mode_1 = require("./mode");
 const defaultSubject = req => req.user?.email;
 /**
  * Resolves and caches entitlements on the request. Two checks on one route
@@ -35,23 +34,17 @@ async function loadEntitlements(req, resolve = defaultSubject) {
 function requireEntitlement(feature, options = {}) {
     return async (req, _res, next) => {
         try {
-            const mode = (0, mode_1.getEntitlementsMode)();
-            if (mode === 'off')
-                return next();
             const entitlements = await loadEntitlements(req, options.subject);
             if (entitlements.limits.features[feature])
                 return next();
-            if (mode === 'observe') {
-                logger_1.default.info('entitlement.would_block', {
-                    event: 'entitlement.would_block',
-                    feature,
-                    subjectId: entitlements.email,
-                    planCode: entitlements.planCode,
-                    route: req.originalUrl,
-                    stale: entitlements.stale === true
-                });
-                return next();
-            }
+            logger_1.default.info('entitlement.blocked', {
+                event: 'entitlement.blocked',
+                feature,
+                subjectId: entitlements.email,
+                planCode: entitlements.planCode,
+                route: req.originalUrl,
+                stale: entitlements.stale === true
+            });
             throw new HttpError_1.PaymentRequiredError(`Your plan does not include ${feature}`, {
                 code: 'FEATURE_NOT_IN_PLAN',
                 feature,
@@ -71,8 +64,6 @@ function requireEntitlement(feature, options = {}) {
 function requireQuota(meter, options = {}) {
     return async (req, _res, next) => {
         try {
-            if ((0, mode_1.getEntitlementsMode)() === 'off')
-                return next();
             const entitlements = await loadEntitlements(req, options.subject);
             const amount = typeof options.amount === 'function' ? options.amount(req) : (options.amount ?? 1);
             await (0, usage_1.checkQuota)({
@@ -90,20 +81,35 @@ function requireQuota(meter, options = {}) {
     };
 }
 /**
- * The oldest timestamp a user may read, or `null` for unlimited history.
+ * The oldest timestamp a caller may read, or `null` for unlimited history.
  *
- * Meant to be dropped straight into an aggregation `$match` — this is what
+ * Meant to be dropped straight into a `$match` or a `find` filter — this is what
  * gates the portfolio planner, since the planner runs entirely client-side and
  * any `<PaywallGate>` around it is bypassable from devtools. Truncating the
  * price history it depends on is not.
+ *
+ * **Several subjects resolve to the most generous floor.** Retention is not a
+ * counter, so unlike a quota it has no single payer: data held in a group is
+ * read by every member, and if it resolved to the *caller's* plan alone, a free
+ * member of a paid Family group would see ninety days of a household's history
+ * that the household paid to keep. Pass the caller together with the owners of
+ * the groups being read, and the group's plan lifts the floor for everyone in
+ * it — which is what "shared across a household" was sold as.
+ *
+ * An empty list resolves to the free plan's floor rather than to `null`: no
+ * identifiable subject must never mean unlimited history.
  */
-async function retentionFloor(email, now = new Date()) {
-    if ((0, mode_1.getEntitlementsMode)() !== 'enforce')
-        return null;
-    const { limits } = await (0, client_1.getEntitlements)(email);
-    const days = limits.retentionDays;
-    if (days === definitions_1.UNLIMITED || days < 0)
+async function retentionFloor(subject, now = new Date()) {
+    const emails = (Array.isArray(subject) ? subject : [subject]).filter(Boolean);
+    const floorFor = (days) => days === definitions_1.UNLIMITED || days < 0 ? null : new Date(now.getTime() - days * 24 * 60 * 60 * 1000);
+    if (emails.length === 0) {
+        return floorFor((0, definitions_1.resolveLimits)(definitions_1.FALLBACK_PLAN).retentionDays);
+    }
+    const floors = await Promise.all(emails.map(async (email) => floorFor((await (0, client_1.getEntitlements)(email)).limits.retentionDays)));
+    // `null` is unlimited, which beats every date; otherwise the earliest floor
+    // is the one that reaches furthest back.
+    if (floors.some(floor => floor === null))
         return null;
-    return new Date(now.getTime() - days * 24 * 60 * 60 * 1000);
+    return floors.reduce((a, b) => (a < b ? a : b));
 }
 //# sourceMappingURL=middleware.js.map

package/dist/entitlements/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/entitlements/middleware.ts"],"names":[],"mappings":";;;;;AAmCA,4CASC;AAMD,gDA+BC;AAgBD,oCAoBC;AAUD,wCAQC;AAtID,+DAAuC;AACvC,mDAA8E;AAC9E,+CAAgE;AAChE,qCAA2C;AAC3C,mCAAqC;AACrC,iCAA6C;AAuB7C,MAAM,cAAc,GAAoB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC;AAE/D;;;GAGG;AACI,KAAK,UAAU,gBAAgB,CAAC,GAAY,EAAE,UAA2B,cAAc;IAC5F,IAAI,GAAG,CAAC,YAAY;QAAE,OAAO,GAAG,CAAC,YAAY,CAAC;IAE9C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,6BAAiB,CAAC,yBAAyB,CAAC,CAAC;IAErE,MAAM,YAAY,GAAG,MAAM,IAAA,wBAAe,EAAC,OAAO,CAAC,CAAC;IACpD,GAAG,CAAC,YAAY,GAAG,YAAY,CAAC;IAChC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,OAAmB,EAAE,UAA8B,EAAE;IACtF,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAA,0BAAmB,GAAE,CAAC;YACnC,IAAI,IAAI,KAAK,KAAK;gBAAE,OAAO,IAAI,EAAE,CAAC;YAElC,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAClE,IAAI,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAC;YAEzD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,gBAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;oBACrC,KAAK,EAAE,yBAAyB;oBAChC,OAAO;oBACP,SAAS,EAAE,YAAY,CAAC,KAAK;oBAC7B,QAAQ,EAAE,YAAY,CAAC,QAAQ;oBAC/B,KAAK,EAAE,GAAG,CAAC,WAAW;oBACtB,KAAK,EAAE,YAAY,CAAC,KAAK,KAAK,IAAI;iBACnC,CAAC,CAAC;gBACH,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,MAAM,IAAI,gCAAoB,CAAC,8BAA8B,OAAO,EAAE,EAAE;gBACtE,IAAI,EAAE,qBAAqB;gBAC3B,OAAO;gBACP,QAAQ,EAAE,YAAY,CAAC,QAAQ;gBAC/B,SAAS,EAAE,YAAY,CAAC,SAAS;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAYD;;;GAGG;AACH,SAAgB,YAAY,CAAC,KAAe,EAAE,UAAwB,EAAE;IACtE,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QAC/B,IAAI,CAAC;YACH,IAAI,IAAA,0BAAmB,GAAE,KAAK,KAAK;gBAAE,OAAO,IAAI,EAAE,CAAC;YAEnD,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAClE,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;YAElG,MAAM,IAAA,kBAAU,EAAC;gBACf,SAAS,EAAE,YAAY,CAAC,KAAK;gBAC7B,KAAK;gBACL,MAAM;gBACN,YAAY;gBACZ,KAAK,EAAE,GAAG,CAAC,WAAW;aACvB,CAAC,CAAC;YACH,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,cAAc,CAAC,KAAa,EAAE,MAAY,IAAI,IAAI,EAAE;IACxE,IAAI,IAAA,0BAAmB,GAAE,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAErD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,wBAAe,EAAC,KAAK,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,CAAC;IAClC,IAAI,IAAI,KAAK,uBAAS,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhD,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/entitlements/middleware.ts"],"names":[],"mappings":";;;;;AAkCA,4CASC;AAMD,gDAyBC;AAgBD,oCAkBC;AAqBD,wCAoBC;AApJD,+DAAuC;AACvC,mDAA8E;AAC9E,+CAA8F;AAC9F,qCAA2C;AAC3C,mCAAqC;AAuBrC,MAAM,cAAc,GAAoB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC;AAE/D;;;GAGG;AACI,KAAK,UAAU,gBAAgB,CAAC,GAAY,EAAE,UAA2B,cAAc;IAC5F,IAAI,GAAG,CAAC,YAAY;QAAE,OAAO,GAAG,CAAC,YAAY,CAAC;IAE9C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,6BAAiB,CAAC,yBAAyB,CAAC,CAAC;IAErE,MAAM,YAAY,GAAG,MAAM,IAAA,wBAAe,EAAC,OAAO,CAAC,CAAC;IACpD,GAAG,CAAC,YAAY,GAAG,YAAY,CAAC;IAChC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,OAAmB,EAAE,UAA8B,EAAE;IACtF,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QAC/B,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAClE,IAAI,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAC;YAEzD,gBAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE;gBACjC,KAAK,EAAE,qBAAqB;gBAC5B,OAAO;gBACP,SAAS,EAAE,YAAY,CAAC,KAAK;gBAC7B,QAAQ,EAAE,YAAY,CAAC,QAAQ;gBAC/B,KAAK,EAAE,GAAG,CAAC,WAAW;gBACtB,KAAK,EAAE,YAAY,CAAC,KAAK,KAAK,IAAI;aACnC,CAAC,CAAC;YAEH,MAAM,IAAI,gCAAoB,CAAC,8BAA8B,OAAO,EAAE,EAAE;gBACtE,IAAI,EAAE,qBAAqB;gBAC3B,OAAO;gBACP,QAAQ,EAAE,YAAY,CAAC,QAAQ;gBAC/B,SAAS,EAAE,YAAY,CAAC,SAAS;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAYD;;;GAGG;AACH,SAAgB,YAAY,CAAC,KAAe,EAAE,UAAwB,EAAE;IACtE,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QAC/B,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAClE,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;YAElG,MAAM,IAAA,kBAAU,EAAC;gBACf,SAAS,EAAE,YAAY,CAAC,KAAK;gBAC7B,KAAK;gBACL,MAAM;gBACN,YAAY;gBACZ,KAAK,EAAE,GAAG,CAAC,WAAW;aACvB,CAAC,CAAC;YACH,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACI,KAAK,UAAU,cAAc,CAClC,OAAmC,EACnC,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxF,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAe,EAAE,CAC7C,IAAI,KAAK,uBAAS,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE/F,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,QAAQ,CAAC,IAAA,2BAAa,EAAC,2BAAa,CAAC,CAAC,aAAa,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAC,KAAK,EAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,MAAM,IAAA,wBAAe,EAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CACzF,CAAC;IAEF,4EAA4E;IAC5E,yCAAyC;IACzC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,OAAQ,MAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC"}

package/dist/entitlements/reconcile.d.ts

@@ -0,0 +1,74 @@
+import { MeterKey } from './definitions';
+/**
+ * Rebuild the cumulative usage meters from the data they describe.
+ *
+ * **Why this can exist at all:** every meter reconciled here is *derived*.
+ * `storageBytes` is the sum of photo sizes, `trackedTickers` the count of
+ * active symbols, `seats` the members of the groups a subject owns — in each
+ * case the underlying collection is the record and the counter is only a cache
+ * of it, kept hot because a quota check cannot afford the aggregation. So the
+ * counter can always be recomputed, and reconciliation is cache invalidation.
+ *
+ * `aiJobs` is deliberately absent, and its absence is the same rule read the
+ * other way: nothing records that a GPU job happened except the counter itself,
+ * so there is no truth to recompute it from. That is precisely why
+ * `consumeQuota` rolls its increment back on rejection rather than leaving it —
+ * a leaked increment on that meter is permanent, where here it is temporary.
+ *
+ * **On racing with live writes:** a `consumeQuota` landing between the
+ * aggregation and the write is lost. That is tolerable for exactly the reason
+ * above — the next run re-derives the same number from source and converges —
+ * so this is scheduled at a quiet hour rather than defended with a lock.
+ *
+ * Reads collections owned by other services through the raw driver rather than
+ * mongoose models. They are not this library's documents to model, every
+ * service shares one database, and going through the driver avoids registering
+ * a second model for a schema that already exists elsewhere.
+ */
+/** Meters whose value can be recomputed from source data. See the note above. */
+export declare const RECONCILED_METERS: readonly MeterKey[];
+export interface ReconcileOptions {
+    /** Write the corrections. Default false — the caller must opt in to mutating. */
+    apply?: boolean;
+    /** Restrict to a single subject, for a targeted repair. */
+    subject?: string;
+}
+export interface MeterChange {
+    subjectId: string;
+    meter: MeterKey;
+    /** `null` when no counter existed yet. */
+    from: number | null;
+    to: number;
+}
+export interface OrphanedMeter {
+    subjectId: string;
+    meter: string;
+    count: number;
+}
+export interface ReconcileReport {
+    applied: boolean;
+    scannedUsers: number;
+    /** Subjects with any attributable usage, before any `subject` filter. */
+    subjects: number;
+    expected: Record<string, Record<MeterKey, number>>;
+    changes: MeterChange[];
+    written: number;
+    orphanedMeters: OrphanedMeter[];
+    warnings: string[];
+}
+/**
+ * Recompute every derived meter and, with `apply`, write back the ones that
+ * disagree.
+ *
+ * Idempotent: it computes absolute values and writes only differences, so a
+ * second run in a row is a no-op.
+ */
+export declare function reconcileUsageMeters(options?: ReconcileOptions): Promise<ReconcileReport>;
+/**
+ * Run a reconciliation and log the outcome. The scheduled entry point.
+ *
+ * Never throws: this runs from a cron callback with no caller to catch it, and
+ * an unhandled rejection there takes the process down over a housekeeping job.
+ */
+export declare function runUsageReconciliation(): Promise<ReconcileReport | null>;
+//# sourceMappingURL=reconcile.d.ts.map

package/dist/entitlements/reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../../src/entitlements/reconcile.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGzC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,EAAE,SAAS,QAAQ,EAAgD,CAAC;AAElG,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,QAAQ,CAAC;IAChB,0CAA0C;IAC1C,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AA2LD;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC,CAkFnG;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAiC9E"}

package/dist/entitlements/reconcile.js

@@ -0,0 +1,297 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RECONCILED_METERS = void 0;
+exports.reconcileUsageMeters = reconcileUsageMeters;
+exports.runUsageReconciliation = runUsageReconciliation;
+const mongoose_1 = __importDefault(require("mongoose"));
+const logger_1 = __importDefault(require("../logging/logger"));
+const UsageMeter_1 = require("./UsageMeter");
+/**
+ * Rebuild the cumulative usage meters from the data they describe.
+ *
+ * **Why this can exist at all:** every meter reconciled here is *derived*.
+ * `storageBytes` is the sum of photo sizes, `trackedTickers` the count of
+ * active symbols, `seats` the members of the groups a subject owns — in each
+ * case the underlying collection is the record and the counter is only a cache
+ * of it, kept hot because a quota check cannot afford the aggregation. So the
+ * counter can always be recomputed, and reconciliation is cache invalidation.
+ *
+ * `aiJobs` is deliberately absent, and its absence is the same rule read the
+ * other way: nothing records that a GPU job happened except the counter itself,
+ * so there is no truth to recompute it from. That is precisely why
+ * `consumeQuota` rolls its increment back on rejection rather than leaving it —
+ * a leaked increment on that meter is permanent, where here it is temporary.
+ *
+ * **On racing with live writes:** a `consumeQuota` landing between the
+ * aggregation and the write is lost. That is tolerable for exactly the reason
+ * above — the next run re-derives the same number from source and converges —
+ * so this is scheduled at a quiet hour rather than defended with a lock.
+ *
+ * Reads collections owned by other services through the raw driver rather than
+ * mongoose models. They are not this library's documents to model, every
+ * service shares one database, and going through the driver avoids registering
+ * a second model for a schema that already exists elsewhere.
+ */
+/** Meters whose value can be recomputed from source data. See the note above. */
+exports.RECONCILED_METERS = ['storageBytes', 'trackedTickers', 'seats'];
+const normalizeEmail = (value) => typeof value === 'string' && value.trim() ? value.trim().toLowerCase() : undefined;
+/**
+ * Whoever currently holds the `owner` role — that is what group-service
+ * authorizes against, and `updateMemberRole` can move it while `createdBy`
+ * stays as first written. Several owners resolve to the lowest email so that a
+ * re-run bills the same person twice rather than two people once.
+ */
+function groupOwner(group, warnings) {
+    const owners = (group.members ?? [])
+        .filter(m => m.role === 'owner')
+        .map(m => normalizeEmail(m.email))
+        .filter((e) => Boolean(e))
+        .sort();
+    if (owners.length === 1)
+        return owners[0];
+    if (owners.length === 0) {
+        const fallback = normalizeEmail(group.createdBy);
+        warnings.push(`group ${group._id} ("${group.name}") has no member with role 'owner'; billing to createdBy=${fallback ?? 'MISSING'}`);
+        return fallback;
+    }
+    warnings.push(`group ${group._id} ("${group.name}") has ${owners.length} owners (${owners.join(', ')}); billing to ${owners[0]}`);
+    return owners[0];
+}
+async function computeExpected() {
+    const db = mongoose_1.default.connection.db;
+    if (!db)
+        throw new Error('Cannot reconcile usage meters: no active database connection');
+    const warnings = [];
+    // Album.userId / TrackedTicker.userId hold `req.user.id`, which is the
+    // auth-service User._id as a string, while a meter's subjectId is an email.
+    // Nothing personal can be attributed without coming back through this map.
+    const users = await db.collection('users').find({}, { projection: { email: 1 } }).toArray();
+    const userIdToEmail = new Map();
+    for (const user of users) {
+        const email = normalizeEmail(user.email);
+        if (email)
+            userIdToEmail.set(String(user._id), email);
+    }
+    const groups = (await db.collection('groups').find({}).toArray());
+    const groupsById = new Map();
+    for (const group of groups) {
+        groupsById.set(String(group._id), {
+            doc: group,
+            owner: groupOwner(group, warnings),
+            deleted: group.deletedAt !== null && group.deletedAt !== undefined
+        });
+    }
+    const expected = new Map();
+    const bucket = (email) => {
+        let existing = expected.get(email);
+        if (!existing) {
+            existing = { storageBytes: 0, trackedTickers: new Set(), seats: new Set() };
+            expected.set(email, existing);
+        }
+        return existing;
+    };
+    // Every known user gets a bucket, so a user whose real usage is zero can
+    // still correct a stale non-zero counter back down.
+    for (const email of userIdToEmail.values())
+        bucket(email);
+    /**
+     * Group rows bill to the group owner: Family sells a pooled allowance, and
+     * charging the uploader would spend their personal free tier on it instead.
+     */
+    const subjectFor = (row, label) => {
+        const groupId = row.groupId ? String(row.groupId) : undefined;
+        if (groupId) {
+            const group = groupsById.get(groupId);
+            if (group?.owner)
+                return group.owner;
+            // The group is gone but its rows are not. The uploader is the only
+            // identity left, and dropping the bytes would understate real storage.
+            const uploader = userIdToEmail.get(String(row.userId));
+            warnings.push(`${label} ${row._id} references missing group ${groupId}; billing to uploader=${uploader ?? 'UNATTRIBUTED'}`);
+            return uploader;
+        }
+        const owner = userIdToEmail.get(String(row.userId));
+        if (!owner)
+            warnings.push(`${label} ${row._id} has userId=${row.userId}, which matches no user; UNATTRIBUTED`);
+        return owner;
+    };
+    // --- storageBytes ---------------------------------------------------------
+    // Summed from the photos themselves rather than from the denormalized
+    // Album.totalSize: that counter is what a drifting $inc would have corrupted,
+    // so reconciling against it would re-import the drift instead of fixing it.
+    const photoTotals = await db
+        .collection('photos')
+        .aggregate([{ $group: { _id: '$albumId', totalSize: { $sum: '$size' }, photoCount: { $sum: 1 } } }], { allowDiskUse: true })
+        .toArray();
+    const sizeByAlbum = new Map(photoTotals.map(row => [String(row._id), row.totalSize || 0]));
+    const albums = (await db
+        .collection('albums')
+        .find({}, { projection: { userId: 1, groupId: 1, totalSize: 1, name: 1 } })
+        .toArray());
+    const albumIds = new Set(albums.map(a => String(a._id)));
+    for (const album of albums) {
+        const realSize = sizeByAlbum.get(String(album._id)) ?? 0;
+        if ((album.totalSize ?? 0) !== realSize) {
+            warnings.push(`album ${album._id} ("${album.name}") totalSize=${album.totalSize} but photos sum to ${realSize}; ` +
+                `metering the photo sum. The album counter is left alone — it is album-service's to maintain, ` +
+                `and silently rewriting another service's denormalized field would hide the bug rather than surface it.`);
+        }
+        const subject = subjectFor(album, 'album');
+        if (subject)
+            bucket(subject).storageBytes += realSize;
+    }
+    for (const row of photoTotals) {
+        if (!albumIds.has(String(row._id))) {
+            warnings.push(`${row.photoCount} photo(s) totalling ${row.totalSize} B reference missing album ${row._id}; UNATTRIBUTED`);
+        }
+    }
+    // --- trackedTickers -------------------------------------------------------
+    // Distinct symbols, not rows: the daily Alpha Vantage spend this limit
+    // recovers is one call per distinct active symbol, however many rows hold it.
+    const tickers = (await db
+        .collection('trackedtickers')
+        .find({ isActive: true }, { projection: { userId: 1, groupId: 1, ticker: 1 } })
+        .toArray());
+    for (const ticker of tickers) {
+        const subject = subjectFor(ticker, 'trackedTicker');
+        if (subject && ticker.ticker)
+            bucket(subject).trackedTickers.add(String(ticker.ticker).toUpperCase());
+    }
+    // --- seats ----------------------------------------------------------------
+    // Distinct people across every live group the subject owns. Soft-deleted
+    // groups are skipped: unlike storage and tickers they cost nothing and grant
+    // nobody access, so charging for them would charge for nothing.
+    for (const { doc, owner, deleted } of groupsById.values()) {
+        if (deleted || !owner)
+            continue;
+        const seats = bucket(owner).seats;
+        for (const member of doc.members ?? []) {
+            const email = normalizeEmail(member.email);
+            if (email)
+                seats.add(email);
+        }
+    }
+    return { expected, warnings, scannedUsers: users.length };
+}
+/**
+ * Recompute every derived meter and, with `apply`, write back the ones that
+ * disagree.
+ *
+ * Idempotent: it computes absolute values and writes only differences, so a
+ * second run in a row is a no-op.
+ */
+async function reconcileUsageMeters(options = {}) {
+    const { apply = false, subject: only } = options;
+    const onlySubject = normalizeEmail(only);
+    const { expected, warnings, scannedUsers } = await computeExpected();
+    const current = await UsageMeter_1.UsageMeter.find({ meter: { $in: exports.RECONCILED_METERS }, period: 'ALL' }).lean();
+    const currentByKey = new Map(current.map(doc => [`${normalizeEmail(doc.subjectId)}::${doc.meter}`, doc]));
+    const subjects = Array.from(expected.keys())
+        .filter(email => !onlySubject || email === onlySubject)
+        .sort();
+    const changes = [];
+    const ops = [];
+    for (const subjectId of subjects) {
+        const counts = expected.get(subjectId);
+        const resolved = {
+            storageBytes: counts.storageBytes,
+            trackedTickers: counts.trackedTickers.size,
+            seats: counts.seats.size
+        };
+        for (const meter of exports.RECONCILED_METERS) {
+            const to = resolved[meter];
+            const existing = currentByKey.get(`${subjectId}::${meter}`);
+            const from = existing ? existing.count : null;
+            if (from === to)
+                continue;
+            // Never create a row just to say zero — absence already reads as zero
+            // everywhere. An *existing* row must still be corrected down to zero, or
+            // a stale count outlives the data it was counting.
+            if (from === null && to === 0)
+                continue;
+            changes.push({ subjectId, meter, from, to });
+            ops.push({
+                updateOne: {
+                    filter: { subjectId, meter, period: (0, UsageMeter_1.currentPeriod)(meter) },
+                    update: {
+                        $set: { count: to, updatedAt: new Date() },
+                        $setOnInsert: { subjectId, meter, period: (0, UsageMeter_1.currentPeriod)(meter), createdAt: new Date() }
+                    },
+                    upsert: true
+                }
+            });
+        }
+    }
+    // Meters for subjects the scan no longer recognizes — a removed user, or a
+    // subjectId written before an ownership change. Reported, never deleted: a
+    // reconciliation that silently drops billing state is worse than the drift.
+    const orphanedMeters = current
+        .filter(doc => !expected.has(normalizeEmail(doc.subjectId) ?? ''))
+        .map(doc => ({ subjectId: doc.subjectId, meter: doc.meter, count: doc.count }));
+    let written = 0;
+    if (apply && ops.length > 0) {
+        const result = await UsageMeter_1.UsageMeter.bulkWrite(ops);
+        written = result.modifiedCount + result.upsertedCount;
+    }
+    const expectedRecord = {};
+    for (const subjectId of subjects) {
+        const counts = expected.get(subjectId);
+        expectedRecord[subjectId] = {
+            storageBytes: counts.storageBytes,
+            trackedTickers: counts.trackedTickers.size,
+            seats: counts.seats.size
+        };
+    }
+    return {
+        applied: apply,
+        scannedUsers,
+        subjects: expected.size,
+        expected: expectedRecord,
+        changes,
+        written,
+        orphanedMeters,
+        warnings
+    };
+}
+/**
+ * Run a reconciliation and log the outcome. The scheduled entry point.
+ *
+ * Never throws: this runs from a cron callback with no caller to catch it, and
+ * an unhandled rejection there takes the process down over a housekeeping job.
+ */
+async function runUsageReconciliation() {
+    const startedAt = Date.now();
+    try {
+        const report = await reconcileUsageMeters({ apply: true });
+        // A correction is drift that already happened — the counter had gone wrong
+        // and users were being metered against a wrong number until this ran.
+        // Logged at `warn` so a persistent leak in consumeQuota/releaseQuota is
+        // visible as a recurring signal rather than buried in an info line.
+        const level = report.changes.length > 0 ? 'warn' : 'info';
+        logger_1.default[level]('entitlement.reconciled', {
+            event: 'entitlement.reconciled',
+            subjects: report.subjects,
+            corrected: report.changes.length,
+            written: report.written,
+            orphaned: report.orphanedMeters.length,
+            warnings: report.warnings.length,
+            durationMs: Date.now() - startedAt,
+            changes: report.changes.slice(0, 20)
+        });
+        for (const warning of report.warnings.slice(0, 20)) {
+            logger_1.default.warn('entitlement.reconcile_warning', { event: 'entitlement.reconcile_warning', detail: warning });
+        }
+        return report;
+    }
+    catch (err) {
+        logger_1.default.error('Usage meter reconciliation failed', {
+            error: err?.message,
+            durationMs: Date.now() - startedAt
+        });
+        return null;
+    }
+}
+//# sourceMappingURL=reconcile.js.map