ccpool-server 0.0.1

package/dist/index.js

@@ -0,0 +1,1838 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { serve } from "@hono/node-server";
+
+// src/app.ts
+import { Hono } from "hono";
+
+// ../../packages/core/dist/types.js
+var CAP_KINDS = ["five_hour", "seven_day", "seven_day_opus"];
+var UNKNOWN_USER = "unknown";
+var NAME_DISALLOWED = /[^A-Za-z0-9-]/;
+var MAX_NAME_LENGTH = 32;
+function isValidName(name) {
+  if (name.length === 0 || name.length > MAX_NAME_LENGTH)
+    return false;
+  if (NAME_DISALLOWED.test(name))
+    return false;
+  return name.toLowerCase() !== UNKNOWN_USER;
+}
+
+// ../../packages/core/dist/storage/storage.js
+var SCHEMA_VERSION = 1;
+var DEFAULT_GROUP_ID = "default";
+function isEmptyBatch(b) {
+  return b.samples.length === 0 && b.resets.length === 0 && b.messages.length === 0 && b.markers.length === 0;
+}
+
+// ../../packages/core/dist/registry/registry.js
+var RegistryConflictError = class extends Error {
+  kind;
+  constructor(kind) {
+    super(kind === "group-exists" ? "a group for this account already exists" : "member name is taken");
+    this.kind = kind;
+    this.name = "RegistryConflictError";
+  }
+};
+
+// ../../packages/core/dist/state/shares.js
+var HOUR = 60 * 60 * 1e3;
+var CAP_WINDOW_MS = {
+  five_hour: 5 * HOUR,
+  seven_day: 7 * 24 * HOUR,
+  seven_day_opus: 7 * 24 * HOUR
+};
+function tokenWeight(m) {
+  return Math.max(0, m.cacheCreationTokens + m.cacheReadTokens + m.outputTokens);
+}
+function isOpus(model) {
+  return !!model && model.toLowerCase().includes("opus");
+}
+function attributeShares(samples, messages, now = Date.now(), resets = [], markers = []) {
+  const msgs = messages.map((m) => ({ t: Date.parse(m.timestamp), user: m.user, model: m.model, w: tokenWeight(m) })).filter((m) => Number.isFinite(m.t)).sort((a, b) => a.t - b.t);
+  const mks = markers.map((m) => ({ t: Date.parse(m.at), user: m.user, model: m.model, w: Math.max(1, m.weight) })).filter((m) => Number.isFinite(m.t)).sort((a, b) => a.t - b.t);
+  const out = [];
+  for (const cap of CAP_KINDS) {
+    const capSamples = samples.filter((s) => s.cap === cap).map((s) => ({ t: Date.parse(s.capturedAt), pct: s.pct })).filter((s) => Number.isFinite(s.t)).sort((a, b) => a.t - b.t);
+    if (capSamples.length === 0)
+      continue;
+    const resetTimes = resets.filter((r) => r.cap === cap).map((r) => Date.parse(r.at)).filter((t) => Number.isFinite(t) && t <= now);
+    out.push(...attributeCap(cap, capSamples, msgs, mks, now, resetTimes));
+  }
+  return out;
+}
+function attributeCap(cap, capSamples, msgs, markers, now, resetTimes) {
+  const cutoff = now - CAP_WINDOW_MS[cap];
+  let start = 0;
+  for (let i = 1; i < capSamples.length; i++) {
+    if (capSamples[i].t < cutoff)
+      start = i;
+  }
+  const lastReset = resetTimes.length ? Math.max(...resetTimes) : -Infinity;
+  if (lastReset > -Infinity) {
+    let firstAfter = capSamples.length - 1;
+    for (let i = 0; i < capSamples.length; i++) {
+      if (capSamples[i].t >= lastReset) {
+        firstAfter = i;
+        break;
+      }
+    }
+    start = Math.max(start, firstAfter);
+  }
+  const win = capSamples.slice(start);
+  const opusOnly = cap === "seven_day_opus";
+  const attributed = /* @__PURE__ */ new Map();
+  attributed.set(UNKNOWN_USER, win[0].pct);
+  let mi = 0;
+  let ki = 0;
+  while (mi < msgs.length && msgs[mi].t <= win[0].t)
+    mi++;
+  while (ki < markers.length && markers[ki].t <= win[0].t)
+    ki++;
+  let envMax = win[0].pct;
+  for (let i = 1; i < win.length; i++) {
+    const cur = win[i];
+    const weights = /* @__PURE__ */ new Map();
+    let total = 0;
+    while (mi < msgs.length && msgs[mi].t <= cur.t) {
+      const m = msgs[mi];
+      mi++;
+      if (opusOnly && !isOpus(m.model))
+        continue;
+      weights.set(m.user, (weights.get(m.user) ?? 0) + m.w);
+      total += m.w;
+    }
+    const markerWeights = /* @__PURE__ */ new Map();
+    let markerTotal = 0;
+    while (ki < markers.length && markers[ki].t <= cur.t) {
+      const m = markers[ki];
+      ki++;
+      if (opusOnly && !isOpus(m.model))
+        continue;
+      markerWeights.set(m.user, (markerWeights.get(m.user) ?? 0) + m.w);
+      markerTotal += m.w;
+    }
+    const newMax = cur.pct > envMax ? cur.pct : envMax;
+    const delta = newMax - envMax;
+    envMax = newMax;
+    if (delta <= 0)
+      continue;
+    if (total > 0) {
+      for (const [u, w] of weights) {
+        attributed.set(u, (attributed.get(u) ?? 0) + delta * w / total);
+      }
+    } else if (markerTotal > 0) {
+      for (const [u, w] of markerWeights) {
+        attributed.set(u, (attributed.get(u) ?? 0) + delta * w / markerTotal);
+      }
+    } else {
+      attributed.set(UNKNOWN_USER, (attributed.get(UNKNOWN_USER) ?? 0) + delta);
+    }
+  }
+  const target = win[win.length - 1].pct;
+  let nonUnknown = 0;
+  for (const [u, p] of attributed)
+    if (u !== UNKNOWN_USER)
+      nonUnknown += p;
+  const rows = [];
+  if (nonUnknown > target && nonUnknown > 0) {
+    const scale = target / nonUnknown;
+    for (const [u, p] of attributed) {
+      if (u !== UNKNOWN_USER)
+        rows.push({ user: u, cap, pct: p * scale });
+    }
+    rows.push({ user: UNKNOWN_USER, cap, pct: 0 });
+  } else {
+    for (const [u, p] of attributed) {
+      if (u !== UNKNOWN_USER)
+        rows.push({ user: u, cap, pct: p });
+    }
+    rows.push({ user: UNKNOWN_USER, cap, pct: Math.max(0, target - nonUnknown) });
+  }
+  return rows;
+}
+
+// ../../packages/core/dist/state/members.js
+var ACTIVE_WINDOW_MS = 10 * 60 * 1e3;
+function summarizeMembers(messages) {
+  const acc = /* @__PURE__ */ new Map();
+  for (const m of messages) {
+    const tokens = m.inputTokens + m.outputTokens + m.cacheCreationTokens + m.cacheReadTokens;
+    const t = Date.parse(m.timestamp);
+    const cur = acc.get(m.user) ?? { tokens: 0, last: 0 };
+    cur.tokens += tokens;
+    if (Number.isFinite(t) && t > cur.last)
+      cur.last = t;
+    acc.set(m.user, cur);
+  }
+  return [...acc].map(([user, v]) => ({
+    user,
+    tokens: v.tokens,
+    lastActivityAt: v.last > 0 ? new Date(v.last).toISOString() : null
+  }));
+}
+
+// ../../packages/core/dist/state/view.js
+var RETENTION_MS = CAP_WINDOW_MS.seven_day + 24 * 36e5;
+function viewCacheKey(changeToken, now) {
+  return `${changeToken}.${Math.floor(now / 6e4)}`;
+}
+function assembleSharedView(rows, now = Date.now()) {
+  const allSamples = [...rows.samplesSince];
+  const seen = new Set(rows.samplesSince.map((s) => `${s.cap}:${s.capturedAt}`));
+  for (const s of rows.latest) {
+    const key = `${s.cap}:${s.capturedAt}`;
+    if (!seen.has(key)) {
+      allSamples.push(s);
+      seen.add(key);
+    }
+  }
+  return {
+    generatedAt: new Date(now).toISOString(),
+    samples: rows.latest,
+    shares: attributeShares(allSamples, rows.messagesSince, now, rows.resetsSince, rows.markersSince),
+    members: summarizeMembers(rows.messagesSince),
+    users: rows.users
+  };
+}
+async function computeSharedView(storage, now = Date.now()) {
+  const since = new Date(now - CAP_WINDOW_MS.seven_day).toISOString();
+  const [latest, samplesSince, messagesSince, resetsSince, users] = await Promise.all([
+    storage.getLatestSamples(),
+    storage.getUsageSamplesSince(since),
+    storage.getMessageUsageSince(since),
+    storage.getResetsSince(since),
+    storage.getUsers()
+  ]);
+  let markersSince = [];
+  try {
+    markersSince = await storage.getUsageMarkersSince(since);
+  } catch {
+  }
+  return assembleSharedView({ latest, samplesSince, messagesSince, resetsSince, markersSince, users }, now);
+}
+
+// ../../packages/core/dist/backend/sink.js
+var AccountConflictError = class extends Error {
+  boundAccountId;
+  constructor(boundAccountId) {
+    super(`account mismatch: the ledger is bound to a different Claude account` + (boundAccountId ? ` (${boundAccountId})` : ""));
+    this.boundAccountId = boundAccountId;
+    this.name = "AccountConflictError";
+  }
+};
+
+// ../../packages/core/dist/remote/api.js
+var MIN_PASSWORD_LENGTH = 8;
+
+// ../../packages/core/dist/backend/storage.js
+var DEFAULT_PRUNE_INTERVAL_MS = 6 * 36e5;
+var DEFAULT_GRACE_MS = 30 * 6e4;
+var DEFAULT_FINALIZE_INTERVAL_MS = 6e4;
+var EnvelopeFilter = class {
+  envMax = /* @__PURE__ */ new Map();
+  winStart = /* @__PURE__ */ new Map();
+  /** Seed from the stored envelope tops so a reopened sink doesn't re-emit points. */
+  seed(latest) {
+    for (const s of latest)
+      this.envMax.set(s.cap, s.pct);
+  }
+  /** A copy of `batch` whose `samples` are only the envelope-raising ones. */
+  filter(batch) {
+    for (const r of batch.resets) {
+      const cur = this.winStart.get(r.cap);
+      if (cur === void 0 || r.at > cur) {
+        this.winStart.set(r.cap, r.at);
+        this.envMax.set(r.cap, -Infinity);
+      }
+    }
+    const kept = [];
+    for (const s of [...batch.samples].sort((a, b) => a.capturedAt.localeCompare(b.capturedAt))) {
+      const ws = this.winStart.get(s.cap);
+      if (ws !== void 0 && s.capturedAt < ws)
+        continue;
+      const max = this.envMax.get(s.cap) ?? -Infinity;
+      if (s.pct > max) {
+        this.envMax.set(s.cap, s.pct);
+        kept.push(s);
+      }
+    }
+    return { ...batch, samples: kept };
+  }
+};
+var StorageIngestSink = class {
+  storage;
+  boundAccountId = null;
+  /** False until bootstrap read the binding — we never enforce blind. */
+  bindingKnown = false;
+  lastPruneMs;
+  retentionMs;
+  pruneIntervalMs;
+  graceMs;
+  finalizeIntervalMs;
+  lastFinalizeMs = 0;
+  /** `${cap} ${windowStart}` of windows already frozen — skip recompute. */
+  frozen = /* @__PURE__ */ new Set();
+  now;
+  window;
+  envelope = new EnvelopeFilter();
+  constructor(storage, opts = {}) {
+    this.storage = storage;
+    this.retentionMs = opts.retentionMs ?? RETENTION_MS;
+    this.pruneIntervalMs = opts.pruneIntervalMs ?? DEFAULT_PRUNE_INTERVAL_MS;
+    this.graceMs = opts.graceMs ?? DEFAULT_GRACE_MS;
+    this.finalizeIntervalMs = opts.finalizeIntervalMs ?? DEFAULT_FINALIZE_INTERVAL_MS;
+    this.now = opts.now ?? Date.now;
+    this.window = opts.window;
+    this.lastPruneMs = this.now();
+  }
+  /**
+   * Heal the schema to the version this build understands (an update must never
+   * require a manual re-init), then report the binding + reset-detection seed.
+   * Throws when the DB is unreachable — callers decide how to degrade.
+   */
+  async bootstrap() {
+    const info = await this.storage.inspect();
+    if (info.kind !== "ccpool") {
+      throw new Error(`not a ccpool database (${info.kind}) \u2014 run \`ccpool init\``);
+    }
+    if (info.schemaVersion < SCHEMA_VERSION) {
+      await this.storage.migrate(SCHEMA_VERSION);
+    }
+    this.boundAccountId = info.accountId;
+    this.bindingKnown = true;
+    const latest = await this.storage.getLatestSamples();
+    this.envelope.seed(latest);
+    return { accountId: info.accountId, samples: latest };
+  }
+  async ingest(batch, meta) {
+    if (this.bindingKnown && this.boundAccountId !== null && meta.accountId !== null && meta.accountId !== this.boundAccountId) {
+      throw new AccountConflictError(this.boundAccountId);
+    }
+    const reduced = this.envelope.filter(batch);
+    if (!isEmptyBatch(reduced)) {
+      await this.storage.recordBatch(reduced);
+      this.window?.append(reduced);
+    }
+    const now = this.now();
+    await this.maybeFinalize(now);
+    if (now - this.lastPruneMs >= this.pruneIntervalMs) {
+      this.lastPruneMs = now;
+      const before = new Date(now - this.retentionMs).toISOString();
+      await this.storage.prune(before);
+      this.window?.applyPrune(before);
+    }
+  }
+  /**
+   * Freeze any window whose closing reset is now past the grace period into an
+   * immutable {@link HistoryWindow} + shares (ADR-0002/0008). Throttled (grace is 30
+   * min). A window spans two consecutive resets of the cap (the first opens at the
+   * earliest retained sample); shares come from the same `attributeShares` the live
+   * view uses. `recordHistoryWindow` is idempotent and `frozen` skips recompute.
+   */
+  async maybeFinalize(now) {
+    if (now - this.lastFinalizeMs < this.finalizeIntervalMs)
+      return;
+    this.lastFinalizeMs = now;
+    const since = new Date(now - this.retentionMs).toISOString();
+    const resets = await this.storage.getResetsSince(since);
+    if (resets.length === 0)
+      return;
+    const capResets = /* @__PURE__ */ new Map();
+    for (const r of resets) {
+      const t = Date.parse(r.at);
+      if (!Number.isFinite(t))
+        continue;
+      const arr = capResets.get(r.cap);
+      if (arr)
+        arr.push(t);
+      else
+        capResets.set(r.cap, [t]);
+    }
+    let samples = null;
+    let messages = null;
+    let markers = null;
+    for (const [cap, times] of capResets) {
+      times.sort((a, b) => a - b);
+      for (let i = 0; i < times.length; i++) {
+        const endMs = times[i];
+        if (endMs + this.graceMs > now)
+          continue;
+        if (samples === null) {
+          [samples, messages, markers] = await Promise.all([
+            this.storage.getUsageSamplesSince(since),
+            this.storage.getMessageUsageSince(since),
+            this.storage.getUsageMarkersSince(since).catch(() => [])
+          ]);
+        }
+        const capSamples = samples.filter((s) => s.cap === cap);
+        const startMs = i > 0 ? times[i - 1] : Math.min(...capSamples.map((s) => Date.parse(s.capturedAt)).filter(Number.isFinite));
+        if (!Number.isFinite(startMs) || startMs >= endMs)
+          continue;
+        const windowStart = new Date(startMs).toISOString();
+        const key = `${cap} ${windowStart}`;
+        if (this.frozen.has(key))
+          continue;
+        const windowEnd = new Date(endMs).toISOString();
+        const inWin = (iso) => {
+          const t = Date.parse(iso);
+          return t >= startMs && t < endMs;
+        };
+        const winSamples = capSamples.filter((s) => inWin(s.capturedAt));
+        if (winSamples.length === 0) {
+          this.frozen.add(key);
+          continue;
+        }
+        const winMsgs = messages.filter((m) => inWin(m.timestamp));
+        const winMarkers = markers.filter((m) => inWin(m.at));
+        const openingReset = [{ cap, at: windowStart, previousPct: 0 }];
+        const shares = attributeShares(winSamples, winMsgs, endMs, openingReset, winMarkers).filter((sh) => sh.cap === cap);
+        const overall = Math.max(...winSamples.map((s) => s.pct));
+        const historyShares = shares.map((sh) => ({
+          cap,
+          windowStart,
+          user: sh.user,
+          pct: sh.pct
+        }));
+        await this.storage.recordHistoryWindow({ cap, windowStart, windowEnd, overall, closedAt: new Date(now).toISOString() }, historyShares);
+        this.frozen.add(key);
+      }
+    }
+  }
+  async close() {
+    await this.storage.close();
+  }
+};
+var StorageViewSource = class {
+  storage;
+  cache = null;
+  window;
+  constructor(storage, opts = {}) {
+    this.storage = storage;
+    this.window = opts.window;
+  }
+  /** The key the current view was computed under (the server's ETag). */
+  async currentKey(now = Date.now()) {
+    return viewCacheKey(await this.storage.getChangeToken(), now);
+  }
+  async history(query) {
+    const limit = query.limit ?? 100;
+    const windows = await this.storage.getHistoryWindows(query.cap, {
+      before: query.before,
+      limit
+    });
+    const view = await Promise.all(windows.map(async (w) => ({
+      cap: w.cap,
+      windowStart: w.windowStart,
+      windowEnd: w.windowEnd,
+      overall: w.overall,
+      shares: (await this.storage.getHistoryShares(query.cap, w.windowStart)).map((s) => ({
+        user: s.user,
+        pct: s.pct
+      }))
+    })));
+    const nextBefore = windows.length === limit && windows.length > 0 ? windows[windows.length - 1].windowStart : null;
+    return { windows: view, nextBefore };
+  }
+  async fetchView(now = Date.now()) {
+    const key = await this.currentKey(now);
+    if (this.cache?.key === key)
+      return this.cache.view;
+    const view = this.window ? assembleSharedView({ ...await this.window.rows(now), users: await this.storage.getUsers() }, now) : await computeSharedView(this.storage, now);
+    this.cache = { key, view };
+    return view;
+  }
+  async close() {
+    await this.storage.close();
+  }
+};
+
+// ../../packages/core/dist/backend/window.js
+var LedgerWindow = class {
+  storage;
+  // Keyed by the DB's natural keys (cap/timestamps never contain ``).
+  samples = /* @__PURE__ */ new Map();
+  resets = /* @__PURE__ */ new Map();
+  messages = /* @__PURE__ */ new Map();
+  // by uuid
+  markers = /* @__PURE__ */ new Map();
+  // by id
+  state = "idle";
+  hydration = null;
+  /** Appends that raced an in-flight hydration, replayed after it commits. */
+  pending = [];
+  /** Bumped by invalidate() so a mid-flight hydration can't commit stale data. */
+  epoch = 0;
+  constructor(storage) {
+    this.storage = storage;
+  }
+  /** Sink calls this after `recordBatch` COMMITS (rows already member-stamped). */
+  append(batch) {
+    if (this.state === "idle")
+      return;
+    if (this.state === "hydrating") {
+      this.pending.push(batch);
+      return;
+    }
+    this.apply(batch);
+  }
+  /** Sink calls this after `storage.prune(before)` — the exact mirror of its DELETEs. */
+  applyPrune(before) {
+    if (this.state !== "ready") {
+      this.invalidate();
+      return;
+    }
+    for (const [k, s] of this.samples)
+      if (s.capturedAt < before)
+        this.samples.delete(k);
+    for (const [k, e] of this.resets)
+      if (e.at < before)
+        this.resets.delete(k);
+    for (const [k, m] of this.messages)
+      if (m.timestamp < before)
+        this.messages.delete(k);
+    for (const [k, m] of this.markers)
+      if (m.at < before)
+        this.markers.delete(k);
+  }
+  /** Safety hatch: drop everything -> idle (re-hydrate on the next read). */
+  invalidate() {
+    this.epoch++;
+    this.samples.clear();
+    this.resets.clear();
+    this.messages.clear();
+    this.markers.clear();
+    this.pending = [];
+    this.state = "idle";
+  }
+  /** Ensure hydrated, then a filtered, deterministically sorted snapshot. */
+  async rows(now) {
+    while (this.state !== "ready")
+      await this.ensureHydrating(now);
+    const since = new Date(now - CAP_WINDOW_MS.seven_day).toISOString();
+    const byCap = /* @__PURE__ */ new Map();
+    for (const s of this.samples.values()) {
+      const cur = byCap.get(s.cap);
+      if (!cur || s.capturedAt >= cur.capturedAt)
+        byCap.set(s.cap, s);
+    }
+    const latest = CAP_KINDS.map((c) => byCap.get(c)).filter((s) => !!s);
+    const samplesSince = [...this.samples.values()].filter((s) => s.capturedAt >= since).sort((a, b) => a.capturedAt.localeCompare(b.capturedAt) || a.cap.localeCompare(b.cap));
+    const resetsSince = [...this.resets.values()].filter((e) => e.at >= since).sort((a, b) => a.at.localeCompare(b.at) || a.cap.localeCompare(b.cap));
+    const messagesSince = [...this.messages.values()].filter((m) => m.timestamp >= since).sort((a, b) => a.timestamp.localeCompare(b.timestamp) || a.uuid.localeCompare(b.uuid));
+    const markersSince = [...this.markers.values()].filter((m) => m.at >= since).sort((a, b) => a.at.localeCompare(b.at) || a.id.localeCompare(b.id));
+    return { latest, samplesSince, messagesSince, resetsSince, markersSince };
+  }
+  ensureHydrating(now) {
+    if (this.state === "ready")
+      return Promise.resolve();
+    if (!this.hydration) {
+      this.state = "hydrating";
+      this.hydration = this.hydrate(now).finally(() => {
+        this.hydration = null;
+      });
+    }
+    return this.hydration;
+  }
+  async hydrate(now) {
+    const epoch = this.epoch;
+    try {
+      const since = new Date(now - CAP_WINDOW_MS.seven_day).toISOString();
+      const [latest, samples, messages, resets] = await Promise.all([
+        this.storage.getLatestSamples(),
+        this.storage.getUsageSamplesSince(since),
+        this.storage.getMessageUsageSince(since),
+        this.storage.getResetsSince(since)
+      ]);
+      let markers = [];
+      try {
+        markers = await this.storage.getUsageMarkersSince(since);
+      } catch {
+      }
+      if (this.epoch !== epoch)
+        return;
+      for (const s of [...samples, ...latest]) {
+        const k = `${s.cap}\0${s.capturedAt}`;
+        if (!this.samples.has(k))
+          this.samples.set(k, s);
+      }
+      for (const e of resets) {
+        const k = `${e.cap}\0${e.at}`;
+        if (!this.resets.has(k))
+          this.resets.set(k, e);
+      }
+      for (const m of messages)
+        if (!this.messages.has(m.uuid))
+          this.messages.set(m.uuid, m);
+      for (const m of markers)
+        if (!this.markers.has(m.id))
+          this.markers.set(m.id, m);
+      const buffered = this.pending;
+      this.pending = [];
+      for (const b of buffered)
+        this.apply(b);
+      this.state = "ready";
+    } catch (err2) {
+      if (this.epoch === epoch)
+        this.invalidate();
+      throw err2;
+    }
+  }
+  /** Insert-if-absent per natural key — the in-memory `ON CONFLICT DO NOTHING`. */
+  apply(batch) {
+    for (const s of batch.samples) {
+      const k = `${s.cap}\0${s.capturedAt}`;
+      if (!this.samples.has(k))
+        this.samples.set(k, s);
+    }
+    for (const e of batch.resets) {
+      const k = `${e.cap}\0${e.at}`;
+      if (!this.resets.has(k))
+        this.resets.set(k, e);
+    }
+    for (const m of batch.messages) {
+      if (!this.messages.has(m.uuid))
+        this.messages.set(m.uuid, m);
+    }
+    for (const m of batch.markers) {
+      if (!this.markers.has(m.id))
+        this.markers.set(m.id, m);
+    }
+  }
+};
+
+// ../../packages/core/dist/identity/paths.js
+import { homedir } from "os";
+import { join } from "path";
+
+// ../../packages/core/dist/identity/credentials.js
+import { createHash } from "crypto";
+import { readFile } from "fs/promises";
+import { join as join2 } from "path";
+import { execFile } from "child_process";
+import { promisify } from "util";
+var pExecFile = promisify(execFile);
+
+// ../../packages/core/dist/identity/resolver.js
+import { createHash as createHash2 } from "crypto";
+import { readFile as readFile2 } from "fs/promises";
+
+// ../../packages/core/dist/state/snapshot.js
+import { writeFile, rename, mkdir } from "fs/promises";
+import { dirname } from "path";
+
+// ../../packages/core/dist/jsonl/reader.js
+import { open, readdir, stat } from "fs/promises";
+import { join as join3 } from "path";
+
+// src/auth.ts
+import { createHash as createHash3, randomBytes, scrypt as scryptCb, timingSafeEqual } from "crypto";
+import { promisify as promisify2 } from "util";
+var scrypt = promisify2(scryptCb);
+var SCRYPT_N = 16384;
+var SCRYPT_R = 8;
+var SCRYPT_P = 1;
+var KEY_LEN = 32;
+var SALT_LEN = 16;
+var MAX_MEM = 128 * 1024 * 1024;
+async function hashPassword(password) {
+  const salt = randomBytes(SALT_LEN);
+  const hash = await scrypt(password, salt, KEY_LEN, {
+    N: SCRYPT_N,
+    r: SCRYPT_R,
+    p: SCRYPT_P,
+    maxmem: MAX_MEM
+  });
+  return [
+    "scrypt",
+    SCRYPT_N,
+    SCRYPT_R,
+    SCRYPT_P,
+    salt.toString("base64url"),
+    hash.toString("base64url")
+  ].join(":");
+}
+async function verifyPassword(password, stored) {
+  const parts = stored.split(":");
+  if (parts.length !== 6 || parts[0] !== "scrypt") return false;
+  const [, nStr, rStr, pStr, saltB64, hashB64] = parts;
+  const N = Number(nStr);
+  const r = Number(rStr);
+  const p = Number(pStr);
+  if (!Number.isInteger(N) || !Number.isInteger(r) || !Number.isInteger(p)) return false;
+  const salt = Buffer.from(saltB64, "base64url");
+  const expected = Buffer.from(hashB64, "base64url");
+  try {
+    const actual = await scrypt(password, salt, expected.length, { N, r, p, maxmem: MAX_MEM });
+    return actual.length === expected.length && timingSafeEqual(actual, expected);
+  } catch {
+    return false;
+  }
+}
+function mintToken() {
+  const token = "ccs_" + randomBytes(32).toString("base64url");
+  return { token, tokenHash: hashToken(token) };
+}
+function hashToken(token) {
+  return createHash3("sha256").update(token).digest("hex");
+}
+var FailureDamper = class {
+  constructor(freeAttempts = 5, baseBlockMs = 1e3, maxBlockMs = 15 * 6e4, now = Date.now, maxTracked = 1e5) {
+    this.freeAttempts = freeAttempts;
+    this.baseBlockMs = baseBlockMs;
+    this.maxBlockMs = maxBlockMs;
+    this.now = now;
+    this.maxTracked = maxTracked;
+  }
+  freeAttempts;
+  baseBlockMs;
+  maxBlockMs;
+  now;
+  maxTracked;
+  failures = /* @__PURE__ */ new Map();
+  /** True when this key must wait before another attempt. */
+  isBlocked(key) {
+    const e = this.failures.get(key);
+    return !!e && this.now() < e.blockedUntil;
+  }
+  recordFailure(key) {
+    const e = this.failures.get(key) ?? { count: 0, blockedUntil: 0 };
+    e.count += 1;
+    if (e.count > this.freeAttempts) {
+      const exp = Math.min(
+        this.maxBlockMs,
+        this.baseBlockMs * 2 ** (e.count - this.freeAttempts - 1)
+      );
+      e.blockedUntil = this.now() + exp;
+    }
+    this.failures.delete(key);
+    this.failures.set(key, e);
+    if (this.failures.size > this.maxTracked) {
+      const oldest = this.failures.keys().next().value;
+      if (oldest !== void 0) this.failures.delete(oldest);
+    }
+  }
+  recordSuccess(key) {
+    this.failures.delete(key);
+  }
+};
+
+// src/validate.ts
+var bad = (error) => ({ ok: false, error });
+function isRecord(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+var isStr = (v) => typeof v === "string";
+var isOptStr = (v) => v === null || typeof v === "string";
+var isNum = (v) => typeof v === "number" && Number.isFinite(v);
+var isCap = (v) => isStr(v) && CAP_KINDS.includes(v);
+function checkPassword(v, label) {
+  if (!isStr(v)) return `${label} is required`;
+  if (v.length < MIN_PASSWORD_LENGTH) {
+    return `${label} must be at least ${MIN_PASSWORD_LENGTH} characters`;
+  }
+  return null;
+}
+function checkMemberName(v) {
+  if (isStr(v) && v.length > MAX_NAME_LENGTH) {
+    return `memberName must be at most ${MAX_NAME_LENGTH} characters`;
+  }
+  if (!isStr(v) || !isValidName(v)) {
+    return "memberName must be letters, digits, and hyphens (and not 'unknown')";
+  }
+  return null;
+}
+function parseCreateGroup(body) {
+  if (!isRecord(body)) return bad("expected a JSON object");
+  if (!isStr(body.accountId) || body.accountId.length === 0) return bad("accountId is required");
+  const pw = checkPassword(body.groupPassword, "groupPassword");
+  if (pw) return bad(pw);
+  const name = checkMemberName(body.memberName);
+  if (name) return bad(name);
+  const mpw = checkPassword(body.memberPassword, "memberPassword");
+  if (mpw) return bad(mpw);
+  return {
+    ok: true,
+    value: {
+      accountId: body.accountId,
+      groupPassword: body.groupPassword,
+      memberName: body.memberName,
+      memberPassword: body.memberPassword
+    }
+  };
+}
+function parseJoinGroup(body) {
+  return parseCreateGroup(body);
+}
+function parseLogin(body) {
+  if (!isRecord(body)) return bad("expected a JSON object");
+  if (!isStr(body.accountId) || body.accountId.length === 0) return bad("accountId is required");
+  const name = checkMemberName(body.memberName);
+  if (name) return bad(name);
+  const mpw = checkPassword(body.memberPassword, "memberPassword");
+  if (mpw) return bad(mpw);
+  return {
+    ok: true,
+    value: {
+      accountId: body.accountId,
+      memberName: body.memberName,
+      memberPassword: body.memberPassword
+    }
+  };
+}
+function parseSample(v) {
+  if (!isRecord(v) || !isCap(v.cap) || !isNum(v.pct)) return null;
+  if (!isOptStr(v.resetsAt ?? null) || !isStr(v.capturedAt)) return null;
+  return {
+    cap: v.cap,
+    pct: v.pct,
+    resetsAt: v.resetsAt ?? null,
+    capturedAt: v.capturedAt
+  };
+}
+function parseReset(v) {
+  if (!isRecord(v) || !isCap(v.cap) || !isStr(v.at) || !isNum(v.previousPct)) return null;
+  return { cap: v.cap, at: v.at, previousPct: v.previousPct };
+}
+function parseMessage(v) {
+  if (!isRecord(v) || !isStr(v.uuid) || !isStr(v.timestamp)) return null;
+  if (!isOptStr(v.model ?? null)) return null;
+  if (!isNum(v.inputTokens) || !isNum(v.outputTokens) || !isNum(v.cacheCreationTokens) || !isNum(v.cacheReadTokens)) {
+    return null;
+  }
+  return {
+    uuid: v.uuid,
+    user: isStr(v.user) ? v.user : "",
+    // overwritten with the authed member anyway
+    timestamp: v.timestamp,
+    model: v.model ?? null,
+    inputTokens: v.inputTokens,
+    outputTokens: v.outputTokens,
+    cacheCreationTokens: v.cacheCreationTokens,
+    cacheReadTokens: v.cacheReadTokens
+  };
+}
+function parseMarker(v) {
+  if (!isRecord(v) || !isStr(v.id) || !isStr(v.at) || !isNum(v.weight)) return null;
+  if (!isOptStr(v.model ?? null)) return null;
+  return {
+    id: v.id,
+    user: isStr(v.user) ? v.user : "",
+    // overwritten with the authed member anyway
+    at: v.at,
+    model: v.model ?? null,
+    weight: v.weight
+  };
+}
+function parseArray(v, parse, label) {
+  if (v === void 0) return { ok: true, value: [] };
+  if (!Array.isArray(v)) return bad(`${label} must be an array`);
+  const out = [];
+  for (const item of v) {
+    const parsed = parse(item);
+    if (parsed === null) return bad(`${label} contains an invalid row`);
+    out.push(parsed);
+  }
+  return { ok: true, value: out };
+}
+function parseIngest(body) {
+  if (!isRecord(body)) return bad("expected a JSON object");
+  if (!isStr(body.at)) return bad("at (ISO timestamp) is required");
+  if (body.accountId !== null && !isStr(body.accountId)) {
+    return bad("accountId must be a string or null");
+  }
+  const samples = parseArray(body.samples, parseSample, "samples");
+  if (!samples.ok) return samples;
+  const resets = parseArray(body.resets, parseReset, "resets");
+  if (!resets.ok) return resets;
+  const messages = parseArray(body.messages, parseMessage, "messages");
+  if (!messages.ok) return messages;
+  const markers = parseArray(body.markers, parseMarker, "markers");
+  if (!markers.ok) return markers;
+  return {
+    ok: true,
+    value: {
+      at: body.at,
+      accountId: body.accountId ?? null,
+      samples: samples.value,
+      resets: resets.value,
+      messages: messages.value,
+      markers: markers.value
+    }
+  };
+}
+
+// src/app.ts
+var MAX_INGEST_BYTES = 1024 * 1024;
+var TOKEN_TOUCH_INTERVAL_MS = 6e4;
+var TOKEN_CACHE_TTL_MS = 6e4;
+var TOKEN_CACHE_MAX = 2e4;
+function err(c, status, code, error) {
+  return c.json({ error, code }, status);
+}
+async function readCappedText(req, max) {
+  const body = req.body;
+  if (!body) return "";
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let total = 0;
+  let out = "";
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > max) {
+      await reader.cancel().catch(() => {
+      });
+      return null;
+    }
+    out += decoder.decode(value, { stream: true });
+  }
+  return out + decoder.decode();
+}
+function makeApp(deps2) {
+  const { registry, tenants } = deps2;
+  const app2 = new Hono();
+  const damper = new FailureDamper();
+  const lastTouch = /* @__PURE__ */ new Map();
+  const tokenCache = /* @__PURE__ */ new Map();
+  const damperKey = (accountId) => accountId;
+  app2.get("/healthz", (c) => c.json({ ok: true }));
+  app2.use("/v1/ingest", bearer);
+  app2.use("/v1/bootstrap", bearer);
+  app2.use("/v1/view", bearer);
+  app2.use("/v1/history", bearer);
+  async function bearer(c, next) {
+    const header = c.req.header("authorization") ?? "";
+    const token = header.startsWith("Bearer ") ? header.slice("Bearer ".length) : null;
+    if (!token) return err(c, 401, "auth", "missing bearer token");
+    const tokenHash = hashToken(token);
+    const now = Date.now();
+    let hit = tokenCache.get(tokenHash);
+    if (hit && hit.exp <= now) {
+      tokenCache.delete(tokenHash);
+      hit = void 0;
+    }
+    if (!hit) {
+      const resolved = await registry.resolveToken(tokenHash);
+      if (!resolved) return err(c, 401, "auth", "unknown or revoked token");
+      hit = { member: resolved.member, group: resolved.group, exp: now + TOKEN_CACHE_TTL_MS };
+      if (tokenCache.size >= TOKEN_CACHE_MAX) {
+        const oldest = tokenCache.keys().next().value;
+        if (oldest !== void 0) tokenCache.delete(oldest);
+      }
+      tokenCache.set(tokenHash, hit);
+    }
+    if (now - (lastTouch.get(tokenHash) ?? 0) >= TOKEN_TOUCH_INTERVAL_MS) {
+      lastTouch.set(tokenHash, now);
+      await registry.touchToken(tokenHash).catch(() => {
+      });
+    }
+    c.set("member", hit.member);
+    c.set("group", hit.group);
+    await next();
+  }
+  app2.get("/v1/groups/lookup", async (c) => {
+    const accountId = c.req.query("accountId");
+    if (!accountId) return err(c, 400, "invalid", "accountId is required");
+    const group = await registry.getGroupByAccount(accountId);
+    if (!group) return c.json({ exists: false });
+    const memberName = c.req.query("memberName");
+    if (memberName) {
+      const member = await registry.getMember(group.id, memberName);
+      return c.json({ exists: true, memberExists: !!member });
+    }
+    return c.json({ exists: true });
+  });
+  app2.post("/v1/groups", async (c) => {
+    const parsed = parseCreateGroup(await c.req.json().catch(() => null));
+    if (!parsed.ok) return err(c, 400, "invalid", parsed.error);
+    const body = parsed.value;
+    if (damper.isBlocked(damperKey(body.accountId))) {
+      return err(c, 429, "rate-limited", "too many attempts \u2014 wait a moment");
+    }
+    if (await registry.getGroupByAccount(body.accountId)) {
+      return err(c, 409, "conflict", "a group for this Claude account already exists \u2014 join it");
+    }
+    const { token, tokenHash } = mintToken();
+    try {
+      const { group, member } = await registry.createGroupWithMember({
+        accountId: body.accountId,
+        groupPasswordHash: await hashPassword(body.groupPassword),
+        memberName: body.memberName,
+        memberPasswordHash: await hashPassword(body.memberPassword),
+        tokenHash
+      });
+      return c.json({ token, groupId: group.id, memberName: member.name }, 201);
+    } catch (e) {
+      if (e instanceof RegistryConflictError) {
+        return err(c, 409, "conflict", "a group for this Claude account already exists \u2014 join it");
+      }
+      return err(c, 500, "invalid", `could not provision the group: ${e.message}`);
+    }
+  });
+  app2.post("/v1/groups/join", async (c) => {
+    const parsed = parseJoinGroup(await c.req.json().catch(() => null));
+    if (!parsed.ok) return err(c, 400, "invalid", parsed.error);
+    const body = parsed.value;
+    const key = damperKey(body.accountId);
+    if (damper.isBlocked(key)) {
+      return err(c, 429, "rate-limited", "too many attempts \u2014 wait a moment");
+    }
+    const group = await registry.getGroupByAccount(body.accountId);
+    if (!group) return err(c, 404, "not-found", "no group exists for this Claude account yet");
+    if (!await verifyPassword(body.groupPassword, group.passwordHash)) {
+      damper.recordFailure(key);
+      return err(c, 401, "auth", "wrong group password");
+    }
+    const { token, tokenHash } = mintToken();
+    let member = await registry.getMember(group.id, body.memberName);
+    if (member) {
+      if (!await verifyPassword(body.memberPassword, member.passwordHash)) {
+        damper.recordFailure(key);
+        return err(c, 401, "auth", `"${body.memberName}" exists and this isn't its password`);
+      }
+      await registry.insertToken(tokenHash, member.id);
+    } else {
+      try {
+        member = await registry.addMemberWithToken(
+          group.id,
+          body.memberName,
+          await hashPassword(body.memberPassword),
+          tokenHash
+        );
+      } catch (e) {
+        if (!(e instanceof RegistryConflictError)) throw e;
+        member = await registry.getMember(group.id, body.memberName);
+        if (!member || !await verifyPassword(body.memberPassword, member.passwordHash)) {
+          damper.recordFailure(key);
+          return err(c, 401, "auth", `"${body.memberName}" exists and this isn't its password`);
+        }
+        await registry.insertToken(tokenHash, member.id);
+      }
+    }
+    damper.recordSuccess(key);
+    return c.json({ token, groupId: group.id, memberName: member.name }, 200);
+  });
+  app2.post("/v1/login", async (c) => {
+    const parsed = parseLogin(await c.req.json().catch(() => null));
+    if (!parsed.ok) return err(c, 400, "invalid", parsed.error);
+    const body = parsed.value;
+    const key = damperKey(body.accountId);
+    if (damper.isBlocked(key)) {
+      return err(c, 429, "rate-limited", "too many attempts \u2014 wait a moment");
+    }
+    const group = await registry.getGroupByAccount(body.accountId);
+    if (!group) return err(c, 404, "not-found", "no group exists for this Claude account yet");
+    const member = await registry.getMember(group.id, body.memberName);
+    if (!member || !await verifyPassword(body.memberPassword, member.passwordHash)) {
+      damper.recordFailure(key);
+      return err(c, 401, "auth", "wrong member name or password");
+    }
+    damper.recordSuccess(key);
+    const { token, tokenHash } = mintToken();
+    await registry.insertToken(tokenHash, member.id);
+    return c.json({ token, groupId: group.id, memberName: member.name }, 200);
+  });
+  app2.post("/v1/ingest", async (c) => {
+    const raw = await readCappedText(c.req.raw, MAX_INGEST_BYTES);
+    if (raw === null) return err(c, 413, "invalid", "ingest body too large");
+    let json = null;
+    try {
+      json = JSON.parse(raw);
+    } catch {
+    }
+    const parsed = parseIngest(json);
+    if (!parsed.ok) return err(c, 400, "invalid", parsed.error);
+    const body = parsed.value;
+    const group = c.get("group");
+    const member = c.get("member");
+    if (body.accountId !== null && body.accountId !== group.accountId) {
+      return err(c, 409, "account-conflict", "this group is bound to a different Claude account");
+    }
+    const batch = {
+      samples: body.samples,
+      resets: body.resets,
+      messages: body.messages.map((m) => ({ ...m, user: member.name })),
+      markers: body.markers.map((m) => ({ ...m, user: member.name }))
+    };
+    try {
+      const tenant = await tenants.get(group);
+      await tenant.sink.ingest(batch, { at: body.at, accountId: body.accountId });
+    } catch (e) {
+      if (e instanceof AccountConflictError) {
+        return err(c, 409, "account-conflict", e.message);
+      }
+      return err(c, 500, "invalid", e.message);
+    }
+    return c.body(null, 204);
+  });
+  app2.get("/v1/bootstrap", async (c) => {
+    const group = c.get("group");
+    const tenant = await tenants.get(group);
+    const boot = await tenant.sink.bootstrap();
+    return c.json({ accountId: group.accountId, samples: boot.samples });
+  });
+  app2.get("/v1/view", async (c) => {
+    const group = c.get("group");
+    const tenant = await tenants.get(group);
+    const now = Date.now();
+    const etag = `"${await tenant.view.currentKey(now)}"`;
+    if (c.req.header("if-none-match") === etag) {
+      return c.body(null, 304, { ETag: etag });
+    }
+    const view = await tenant.view.fetchView(now);
+    return c.json(view, 200, { ETag: etag });
+  });
+  app2.get("/v1/history", async (c) => {
+    const capQ = c.req.query("cap") ?? "five_hour";
+    if (!CAP_KINDS.includes(capQ)) return err(c, 400, "invalid", "unknown cap");
+    const before = c.req.query("before") || void 0;
+    const limitRaw = Number(c.req.query("limit"));
+    const limit = Number.isFinite(limitRaw) && limitRaw > 0 ? Math.min(200, Math.floor(limitRaw)) : 50;
+    const tenant = await tenants.get(c.get("group"));
+    const page = await tenant.view.history({ cap: capQ, before, limit });
+    return c.json(page);
+  });
+  return app2;
+}
+
+// ../../packages/storage-libsql/dist/database.js
+import { createClient } from "@libsql/client";
+
+// ../../packages/storage-libsql/dist/ddl.js
+var LEDGER_DDL = [
+  `CREATE TABLE IF NOT EXISTS ccpool_meta (
+     group_id TEXT PRIMARY KEY,
+     app TEXT NOT NULL,
+     schemaVersion INTEGER NOT NULL,
+     projectId TEXT NOT NULL,
+     createdAt TEXT NOT NULL,
+     accountId TEXT,
+     writeSeq INTEGER NOT NULL DEFAULT 0
+   )`,
+  `CREATE TABLE IF NOT EXISTS users (
+     group_id TEXT NOT NULL,
+     name TEXT NOT NULL,
+     createdAt TEXT NOT NULL,
+     PRIMARY KEY (group_id, name)
+   )`,
+  `CREATE TABLE IF NOT EXISTS usage_samples (
+     group_id TEXT NOT NULL,
+     cap TEXT NOT NULL,
+     pct REAL NOT NULL,
+     resetsAt TEXT,
+     capturedAt TEXT NOT NULL
+   )`,
+  `CREATE UNIQUE INDEX IF NOT EXISTS idx_usage_samples_cap ON usage_samples (group_id, cap, capturedAt)`,
+  `CREATE TABLE IF NOT EXISTS message_usage (
+     group_id TEXT NOT NULL,
+     uuid TEXT NOT NULL,
+     user TEXT NOT NULL,
+     timestamp TEXT NOT NULL,
+     model TEXT,
+     inputTokens INTEGER NOT NULL,
+     outputTokens INTEGER NOT NULL,
+     cacheCreationTokens INTEGER NOT NULL,
+     cacheReadTokens INTEGER NOT NULL,
+     PRIMARY KEY (group_id, uuid)
+   )`,
+  `CREATE INDEX IF NOT EXISTS idx_message_usage_ts ON message_usage (group_id, timestamp)`,
+  `CREATE TABLE IF NOT EXISTS usage_markers (
+     group_id TEXT NOT NULL,
+     id TEXT NOT NULL,
+     user TEXT NOT NULL,
+     at TEXT NOT NULL,
+     model TEXT,
+     weight REAL NOT NULL,
+     PRIMARY KEY (group_id, id)
+   )`,
+  `CREATE INDEX IF NOT EXISTS idx_usage_markers_at ON usage_markers (group_id, at)`,
+  `CREATE TABLE IF NOT EXISTS reset_events (
+     group_id TEXT NOT NULL,
+     cap TEXT NOT NULL,
+     at TEXT NOT NULL,
+     previousPct REAL NOT NULL
+   )`,
+  `CREATE INDEX IF NOT EXISTS idx_reset_events_at ON reset_events (group_id, at)`,
+  `CREATE UNIQUE INDEX IF NOT EXISTS idx_reset_events_uniq ON reset_events (group_id, cap, at)`,
+  // Immutable history of completed cap cycles (ADR-0002/0005). Retained unbounded.
+  `CREATE TABLE IF NOT EXISTS history_windows (
+     group_id TEXT NOT NULL,
+     cap TEXT NOT NULL,
+     windowStart TEXT NOT NULL,
+     windowEnd TEXT NOT NULL,
+     overall REAL NOT NULL,
+     closedAt TEXT NOT NULL,
+     PRIMARY KEY (group_id, cap, windowStart)
+   )`,
+  `CREATE TABLE IF NOT EXISTS history_shares (
+     group_id TEXT NOT NULL,
+     cap TEXT NOT NULL,
+     windowStart TEXT NOT NULL,
+     user TEXT NOT NULL,
+     pct REAL NOT NULL,
+     PRIMARY KEY (group_id, cap, windowStart, user)
+   )`
+];
+var REGISTRY_DDL = [
+  `CREATE TABLE IF NOT EXISTS groups (
+     id TEXT PRIMARY KEY,
+     accountId TEXT UNIQUE NOT NULL,
+     passwordHash TEXT NOT NULL,
+     createdAt TEXT NOT NULL
+   )`,
+  `CREATE TABLE IF NOT EXISTS members (
+     id TEXT PRIMARY KEY,
+     groupId TEXT NOT NULL REFERENCES groups(id) ON DELETE CASCADE,
+     name TEXT NOT NULL,
+     passwordHash TEXT NOT NULL,
+     createdAt TEXT NOT NULL,
+     UNIQUE (groupId, name)
+   )`,
+  `CREATE TABLE IF NOT EXISTS tokens (
+     tokenHash TEXT PRIMARY KEY,
+     memberId TEXT NOT NULL REFERENCES members(id) ON DELETE CASCADE,
+     createdAt TEXT NOT NULL,
+     lastUsedAt TEXT
+   )`,
+  `CREATE INDEX IF NOT EXISTS idx_tokens_member ON tokens (memberId)`
+];
+
+// ../../packages/storage-libsql/dist/registry.js
+import { randomUUID } from "crypto";
+function isConstraintViolation(err2) {
+  const code = err2?.code;
+  return typeof code === "string" && code.startsWith("SQLITE_CONSTRAINT");
+}
+var LibsqlRegistry = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async getGroupByAccount(accountId) {
+    const { rows } = await this.client.execute({
+      sql: `SELECT id, accountId, passwordHash, createdAt FROM groups WHERE accountId = ?`,
+      args: [accountId]
+    });
+    return rows[0] ? toGroup(rows[0]) : null;
+  }
+  async getMember(groupId, name) {
+    const { rows } = await this.client.execute({
+      sql: `SELECT id, groupId, name, passwordHash, createdAt
+            FROM members WHERE groupId = ? AND name = ?`,
+      args: [groupId, name]
+    });
+    return rows[0] ? toMember(rows[0]) : null;
+  }
+  async resolveToken(tokenHash) {
+    const { rows } = await this.client.execute({
+      sql: `SELECT m.id AS memberId, m.groupId AS memberGroupId, m.name AS name,
+                   m.passwordHash AS memberHash, m.createdAt AS memberCreatedAt,
+                   g.id AS gid, g.accountId AS accountId, g.passwordHash AS groupHash,
+                   g.createdAt AS groupCreatedAt
+            FROM tokens t
+            JOIN members m ON m.id = t.memberId
+            JOIN groups g ON g.id = m.groupId
+            WHERE t.tokenHash = ?`,
+      args: [tokenHash]
+    });
+    const r = rows[0];
+    if (!r)
+      return null;
+    return {
+      member: {
+        id: String(r.memberId),
+        groupId: String(r.memberGroupId),
+        name: String(r.name),
+        passwordHash: String(r.memberHash),
+        createdAt: String(r.memberCreatedAt)
+      },
+      group: {
+        id: String(r.gid),
+        accountId: String(r.accountId),
+        passwordHash: String(r.groupHash),
+        createdAt: String(r.groupCreatedAt)
+      }
+    };
+  }
+  async insertToken(tokenHash, memberId) {
+    await this.client.execute({
+      sql: `INSERT INTO tokens (tokenHash, memberId, createdAt) VALUES (?, ?, ?)`,
+      args: [tokenHash, memberId, (/* @__PURE__ */ new Date()).toISOString()]
+    });
+  }
+  async touchToken(tokenHash) {
+    await this.client.execute({
+      sql: `UPDATE tokens SET lastUsedAt = ? WHERE tokenHash = ?`,
+      args: [(/* @__PURE__ */ new Date()).toISOString(), tokenHash]
+    });
+  }
+  async createGroupWithMember(input) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const group = {
+      id: randomUUID(),
+      accountId: input.accountId,
+      passwordHash: input.groupPasswordHash,
+      createdAt: now
+    };
+    const member = {
+      id: randomUUID(),
+      groupId: group.id,
+      name: input.memberName,
+      passwordHash: input.memberPasswordHash,
+      createdAt: now
+    };
+    const stmts = [
+      // The UNIQUE(accountId) constraint is the create-race arbiter.
+      {
+        sql: `INSERT INTO groups (id, accountId, passwordHash, createdAt) VALUES (?, ?, ?, ?)`,
+        args: [group.id, group.accountId, group.passwordHash, group.createdAt]
+      },
+      // Provision the group's ledger in the same transaction. writeSeq starts
+      // at 1: the roster insert below is this ledger's first observable write.
+      {
+        sql: `INSERT INTO ccpool_meta (group_id, app, schemaVersion, projectId, createdAt, accountId, writeSeq)
+              VALUES (?, 'ccpool', ?, ?, ?, ?, 1)`,
+        args: [group.id, SCHEMA_VERSION, randomUUID(), now, input.accountId]
+      },
+      {
+        sql: `INSERT INTO users (group_id, name, createdAt) VALUES (?, ?, ?)`,
+        args: [group.id, member.name, now]
+      },
+      {
+        sql: `INSERT INTO members (id, groupId, name, passwordHash, createdAt) VALUES (?, ?, ?, ?, ?)`,
+        args: [member.id, member.groupId, member.name, member.passwordHash, member.createdAt]
+      },
+      {
+        sql: `INSERT INTO tokens (tokenHash, memberId, createdAt) VALUES (?, ?, ?)`,
+        args: [input.tokenHash, member.id, now]
+      }
+    ];
+    try {
+      await this.client.batch(stmts, "write");
+    } catch (err2) {
+      if (isConstraintViolation(err2))
+        throw new RegistryConflictError("group-exists");
+      throw err2;
+    }
+    return { group, member };
+  }
+  async addMemberWithToken(groupId, name, passwordHash, tokenHash) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const member = {
+      id: randomUUID(),
+      groupId,
+      name,
+      passwordHash,
+      createdAt: now
+    };
+    const stmts = [
+      // UNIQUE(groupId, name) is the same-name-race arbiter.
+      {
+        sql: `INSERT INTO members (id, groupId, name, passwordHash, createdAt) VALUES (?, ?, ?, ?, ?)`,
+        args: [member.id, member.groupId, member.name, member.passwordHash, member.createdAt]
+      },
+      {
+        sql: `INSERT INTO users (group_id, name, createdAt) VALUES (?, ?, ?)
+              ON CONFLICT(group_id, name) DO NOTHING`,
+        args: [groupId, name, now]
+      },
+      {
+        sql: `UPDATE ccpool_meta SET writeSeq = writeSeq + 1 WHERE group_id = ?`,
+        args: [groupId]
+      },
+      {
+        sql: `INSERT INTO tokens (tokenHash, memberId, createdAt) VALUES (?, ?, ?)`,
+        args: [tokenHash, member.id, now]
+      }
+    ];
+    try {
+      await this.client.batch(stmts, "write");
+    } catch (err2) {
+      if (isConstraintViolation(err2))
+        throw new RegistryConflictError("member-exists");
+      throw err2;
+    }
+    return member;
+  }
+};
+function toGroup(r) {
+  return {
+    id: String(r.id),
+    accountId: String(r.accountId),
+    passwordHash: String(r.passwordHash),
+    createdAt: String(r.createdAt)
+  };
+}
+function toMember(r) {
+  return {
+    id: String(r.id),
+    groupId: String(r.groupId),
+    name: String(r.name),
+    passwordHash: String(r.passwordHash),
+    createdAt: String(r.createdAt)
+  };
+}
+
+// ../../packages/storage-libsql/dist/storage.js
+import { randomUUID as randomUUID2 } from "crypto";
+var LibsqlStorage = class {
+  client;
+  groupId;
+  constructor(client, groupId = DEFAULT_GROUP_ID) {
+    this.client = client;
+    this.groupId = groupId;
+  }
+  async inspect() {
+    const { rows } = await this.client.execute("SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' AND name NOT LIKE '_litestream%'");
+    const tables = new Set(rows.map((r) => String(r.name)));
+    if (!tables.has("ccpool_meta"))
+      return { kind: "empty" };
+    const meta = await this.client.execute({
+      sql: "SELECT * FROM ccpool_meta WHERE group_id = ? LIMIT 1",
+      args: [this.groupId]
+    });
+    const row = meta.rows[0];
+    if (!row)
+      return { kind: "empty" };
+    return {
+      kind: "ccpool",
+      schemaVersion: Number(row.schemaVersion ?? SCHEMA_VERSION),
+      accountId: row.accountId == null ? null : String(row.accountId)
+    };
+  }
+  async initializeSchema(accountId = null) {
+    await this.client.batch([
+      ...LEDGER_DDL,
+      {
+        sql: `INSERT INTO ccpool_meta (group_id, app, schemaVersion, projectId, createdAt, accountId, writeSeq)
+                VALUES (?, 'ccpool', ?, ?, ?, ?, 0)
+                ON CONFLICT(group_id) DO NOTHING`,
+        args: [this.groupId, SCHEMA_VERSION, randomUUID2(), (/* @__PURE__ */ new Date()).toISOString(), accountId]
+      }
+    ], "write");
+  }
+  async bindAccount(accountId) {
+    await this.client.execute({
+      sql: "UPDATE ccpool_meta SET accountId = ? WHERE group_id = ? AND accountId IS NULL",
+      args: [accountId, this.groupId]
+    });
+  }
+  async migrate(toVersion) {
+    await this.client.batch([
+      `CREATE UNIQUE INDEX IF NOT EXISTS idx_usage_samples_cap ON usage_samples (group_id, cap, capturedAt)`,
+      `CREATE UNIQUE INDEX IF NOT EXISTS idx_reset_events_uniq ON reset_events (group_id, cap, at)`,
+      // Additive: an older DB gains the history tables here (fresh DBs get them
+      // from LEDGER_DDL at init). Kept in sync with ddl.ts.
+      `CREATE TABLE IF NOT EXISTS history_windows (
+           group_id TEXT NOT NULL, cap TEXT NOT NULL, windowStart TEXT NOT NULL,
+           windowEnd TEXT NOT NULL, overall REAL NOT NULL, closedAt TEXT NOT NULL,
+           PRIMARY KEY (group_id, cap, windowStart))`,
+      `CREATE TABLE IF NOT EXISTS history_shares (
+           group_id TEXT NOT NULL, cap TEXT NOT NULL, windowStart TEXT NOT NULL,
+           user TEXT NOT NULL, pct REAL NOT NULL,
+           PRIMARY KEY (group_id, cap, windowStart, user))`,
+      {
+        sql: "UPDATE ccpool_meta SET schemaVersion = ? WHERE group_id = ?",
+        args: [toVersion, this.groupId]
+      }
+    ], "write");
+  }
+  /** No-op: the client belongs to the `LibsqlDatabase`; only it tears down. */
+  async close() {
+  }
+  async upsertUser(name) {
+    await this.client.batch([
+      {
+        sql: `INSERT INTO users (group_id, name, createdAt) VALUES (?, ?, ?)
+                ON CONFLICT(group_id, name) DO NOTHING`,
+        args: [this.groupId, name, (/* @__PURE__ */ new Date()).toISOString()]
+      },
+      this.bumpWriteSeq()
+    ], "write");
+  }
+  async getUsers() {
+    const { rows } = await this.client.execute({
+      sql: "SELECT name, createdAt FROM users WHERE group_id = ? ORDER BY name",
+      args: [this.groupId]
+    });
+    return rows.map((r) => ({ name: String(r.name), createdAt: String(r.createdAt) }));
+  }
+  async recordBatch(batch) {
+    if (isEmptyBatch(batch))
+      return;
+    const g = this.groupId;
+    const stmts = [];
+    for (const s of batch.samples) {
+      stmts.push({
+        sql: `INSERT INTO usage_samples (group_id, cap, pct, resetsAt, capturedAt) VALUES (?, ?, ?, ?, ?)
+              ON CONFLICT(group_id, cap, capturedAt) DO NOTHING`,
+        args: [g, s.cap, s.pct, s.resetsAt, s.capturedAt]
+      });
+    }
+    for (const e of batch.resets) {
+      stmts.push({
+        sql: `INSERT INTO reset_events (group_id, cap, at, previousPct) VALUES (?, ?, ?, ?)
+              ON CONFLICT(group_id, cap, at) DO NOTHING`,
+        args: [g, e.cap, e.at, e.previousPct]
+      });
+    }
+    for (const m of batch.messages) {
+      stmts.push({
+        sql: `INSERT INTO message_usage
+                (group_id, uuid, user, timestamp, model, inputTokens, outputTokens, cacheCreationTokens, cacheReadTokens)
+              VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+              ON CONFLICT(group_id, uuid) DO NOTHING`,
+        args: [
+          g,
+          m.uuid,
+          m.user,
+          m.timestamp,
+          m.model,
+          m.inputTokens,
+          m.outputTokens,
+          m.cacheCreationTokens,
+          m.cacheReadTokens
+        ]
+      });
+    }
+    for (const m of batch.markers) {
+      stmts.push({
+        sql: `INSERT INTO usage_markers (group_id, id, user, at, model, weight)
+              VALUES (?, ?, ?, ?, ?, ?)
+              ON CONFLICT(group_id, id) DO NOTHING`,
+        args: [g, m.id, m.user, m.at, m.model, m.weight]
+      });
+    }
+    stmts.push(this.bumpWriteSeq());
+    await this.client.batch(stmts, "write");
+  }
+  async prune(before) {
+    const g = this.groupId;
+    await this.client.batch([
+      {
+        sql: `DELETE FROM usage_samples WHERE group_id = ? AND capturedAt < ?`,
+        args: [g, before]
+      },
+      { sql: `DELETE FROM reset_events WHERE group_id = ? AND at < ?`, args: [g, before] },
+      {
+        sql: `DELETE FROM message_usage WHERE group_id = ? AND timestamp < ?`,
+        args: [g, before]
+      },
+      { sql: `DELETE FROM usage_markers WHERE group_id = ? AND at < ?`, args: [g, before] },
+      this.bumpWriteSeq()
+    ], "write");
+  }
+  async getChangeToken() {
+    try {
+      const { rows } = await this.client.execute({
+        sql: "SELECT writeSeq FROM ccpool_meta WHERE group_id = ? LIMIT 1",
+        args: [this.groupId]
+      });
+      return String(rows[0]?.writeSeq ?? 0);
+    } catch (err2) {
+      throw new Error("this database predates the current schema (no writeSeq) \u2014 re-run `ccpool init`", { cause: err2 });
+    }
+  }
+  async getLatestSamples() {
+    const { rows } = await this.client.execute({
+      sql: `SELECT cap, pct, resetsAt, capturedAt FROM usage_samples s
+            WHERE group_id = ?1
+              AND capturedAt = (SELECT MAX(capturedAt) FROM usage_samples
+                                WHERE cap = s.cap AND group_id = ?1)`,
+      args: [this.groupId]
+    });
+    const byCap = /* @__PURE__ */ new Map();
+    for (const r of rows) {
+      byCap.set(r.cap, {
+        cap: r.cap,
+        pct: Number(r.pct),
+        resetsAt: r.resetsAt == null ? null : String(r.resetsAt),
+        capturedAt: String(r.capturedAt)
+      });
+    }
+    return CAP_KINDS.map((c) => byCap.get(c)).filter((s) => !!s);
+  }
+  async getUsageSamplesSince(since) {
+    const { rows } = await this.client.execute({
+      sql: `SELECT cap, pct, resetsAt, capturedAt FROM usage_samples
+            WHERE group_id = ? AND capturedAt >= ? ORDER BY capturedAt ASC`,
+      args: [this.groupId, since]
+    });
+    return rows.map((r) => ({
+      cap: r.cap,
+      pct: Number(r.pct),
+      resetsAt: r.resetsAt == null ? null : String(r.resetsAt),
+      capturedAt: String(r.capturedAt)
+    }));
+  }
+  async getResetsSince(since) {
+    const { rows } = await this.client.execute({
+      sql: `SELECT cap, at, previousPct FROM reset_events
+            WHERE group_id = ? AND at >= ? ORDER BY at ASC`,
+      args: [this.groupId, since]
+    });
+    return rows.map((r) => ({
+      cap: r.cap,
+      at: String(r.at),
+      previousPct: Number(r.previousPct)
+    }));
+  }
+  async getMessageUsageSince(since) {
+    const { rows } = await this.client.execute({
+      sql: `SELECT uuid, user, timestamp, model, inputTokens, outputTokens,
+                   cacheCreationTokens, cacheReadTokens
+            FROM message_usage WHERE group_id = ? AND timestamp >= ?`,
+      args: [this.groupId, since]
+    });
+    return rows.map((r) => ({
+      uuid: String(r.uuid),
+      user: String(r.user),
+      timestamp: String(r.timestamp),
+      model: r.model == null ? null : String(r.model),
+      inputTokens: Number(r.inputTokens),
+      outputTokens: Number(r.outputTokens),
+      cacheCreationTokens: Number(r.cacheCreationTokens),
+      cacheReadTokens: Number(r.cacheReadTokens)
+    }));
+  }
+  async getUsageMarkersSince(since) {
+    const { rows } = await this.client.execute({
+      sql: `SELECT id, user, at, model, weight FROM usage_markers
+            WHERE group_id = ? AND at >= ?`,
+      args: [this.groupId, since]
+    });
+    return rows.map((r) => ({
+      id: String(r.id),
+      user: String(r.user),
+      at: String(r.at),
+      model: r.model == null ? null : String(r.model),
+      weight: Number(r.weight)
+    }));
+  }
+  async recordHistoryWindow(window, shares) {
+    const g = this.groupId;
+    const stmts = [
+      {
+        sql: `INSERT INTO history_windows (group_id, cap, windowStart, windowEnd, overall, closedAt)
+              VALUES (?, ?, ?, ?, ?, ?)
+              ON CONFLICT(group_id, cap, windowStart) DO NOTHING`,
+        args: [
+          g,
+          window.cap,
+          window.windowStart,
+          window.windowEnd,
+          window.overall,
+          window.closedAt
+        ]
+      }
+    ];
+    for (const sh of shares) {
+      stmts.push({
+        sql: `INSERT INTO history_shares (group_id, cap, windowStart, user, pct)
+              VALUES (?, ?, ?, ?, ?)
+              ON CONFLICT(group_id, cap, windowStart, user) DO NOTHING`,
+        args: [g, sh.cap, sh.windowStart, sh.user, sh.pct]
+      });
+    }
+    stmts.push(this.bumpWriteSeq());
+    await this.client.batch(stmts, "write");
+  }
+  async getHistoryWindows(cap, opts = {}) {
+    const limit = opts.limit ?? 100;
+    const before = opts.before ?? null;
+    const { rows } = await this.client.execute({
+      sql: `SELECT cap, windowStart, windowEnd, overall, closedAt FROM history_windows
+            WHERE group_id = ?1 AND cap = ?2 AND (?3 IS NULL OR windowStart < ?3)
+            ORDER BY windowStart DESC LIMIT ?4`,
+      args: [this.groupId, cap, before, limit]
+    });
+    return rows.map((r) => ({
+      cap: r.cap,
+      windowStart: String(r.windowStart),
+      windowEnd: String(r.windowEnd),
+      overall: Number(r.overall),
+      closedAt: String(r.closedAt)
+    }));
+  }
+  async getHistoryShares(cap, windowStart) {
+    const { rows } = await this.client.execute({
+      sql: `SELECT cap, windowStart, user, pct FROM history_shares
+            WHERE group_id = ? AND cap = ? AND windowStart = ?`,
+      args: [this.groupId, cap, windowStart]
+    });
+    return rows.map((r) => ({
+      cap: r.cap,
+      windowStart: String(r.windowStart),
+      user: String(r.user),
+      pct: Number(r.pct)
+    }));
+  }
+  /** Every write batch ends with this so one tick bumps this group's token once. */
+  bumpWriteSeq() {
+    return {
+      sql: "UPDATE ccpool_meta SET writeSeq = writeSeq + 1 WHERE group_id = ?",
+      args: [this.groupId]
+    };
+  }
+};
+
+// ../../packages/storage-libsql/dist/url.js
+import { mkdirSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname2 } from "path";
+function normalizeUrl(url) {
+  if (url === ":memory:")
+    return url;
+  if (!url.includes("://") && !url.startsWith("file:")) {
+    url = "file:" + url;
+  }
+  if (url.startsWith("file:")) {
+    let path = url.slice("file:".length);
+    if (path.startsWith("//"))
+      path = path.slice(2);
+    if (path.startsWith("~"))
+      path = homedir2() + path.slice(1);
+    return "file:" + path;
+  }
+  return url;
+}
+function ensureFileDir(url) {
+  if (!url.startsWith("file:"))
+    return;
+  let path = url.slice("file:".length);
+  if (path.startsWith("//"))
+    path = path.slice(2);
+  if (path.length === 0 || path === ":memory:")
+    return;
+  const dir = dirname2(path);
+  if (dir && dir !== ".")
+    mkdirSync(dir, { recursive: true });
+}
+
+// ../../packages/storage-libsql/dist/database.js
+var LibsqlDatabase = class {
+  client;
+  registry;
+  constructor(url, opts = {}) {
+    const normalized = normalizeUrl(url);
+    ensureFileDir(normalized);
+    this.client = createClient(opts.authToken ? { url: normalized, authToken: opts.authToken } : { url: normalized });
+    this.registry = new LibsqlRegistry(this.client);
+  }
+  async init() {
+    await this.client.batch([...LEDGER_DDL, ...REGISTRY_DDL], "write");
+  }
+  forGroup(groupId) {
+    return new LibsqlStorage(this.client, groupId);
+  }
+  async close() {
+    this.client.close();
+  }
+};
+
+// src/tenants.ts
+var MAX_LIVE_TENANTS = 50;
+var TenantCache = class {
+  constructor(db) {
+    this.db = db;
+  }
+  db;
+  tenants = /* @__PURE__ */ new Map();
+  async get(group) {
+    const entry = this.open(group);
+    await this.ready(entry);
+    return entry.tenant;
+  }
+  /** Bootstrap (migrate) a tenant's ledger once per open; don't cache a failure. */
+  ready(entry) {
+    if (!entry.ready) {
+      entry.ready = entry.tenant.sink.bootstrap().then(
+        () => void 0,
+        (err2) => {
+          entry.ready = void 0;
+          throw err2;
+        }
+      );
+    }
+    return entry.ready;
+  }
+  /** Cached tenant (LRU refresh on access), composing over the shared Database. */
+  open(group) {
+    const hit = this.tenants.get(group.id);
+    if (hit) {
+      this.tenants.delete(group.id);
+      this.tenants.set(group.id, hit);
+      return hit;
+    }
+    const storage = this.db.forGroup(group.id);
+    const window = new LedgerWindow(storage);
+    const entry = {
+      tenant: {
+        sink: new StorageIngestSink(storage, { window }),
+        view: new StorageViewSource(storage, { window })
+      }
+    };
+    this.tenants.set(group.id, entry);
+    if (this.tenants.size > MAX_LIVE_TENANTS) {
+      const oldestId = this.tenants.keys().next().value;
+      this.tenants.delete(oldestId);
+    }
+    return entry;
+  }
+  async close() {
+    this.tenants.clear();
+  }
+};
+
+// src/backend.ts
+function resolveServerBackend(env = process.env) {
+  const url = env.DATABASE_URL?.trim();
+  if (!url) {
+    throw new Error("DATABASE_URL is required \u2014 a file: path or a libsql://\u2026 (Turso) URL");
+  }
+  return { url, authToken: env.CCPOOL_DB_AUTH_TOKEN?.trim() || void 0 };
+}
+function makeServerDeps(cfg) {
+  const db = new LibsqlDatabase(cfg.url, { authToken: cfg.authToken });
+  return { db, registry: db.registry, tenants: new TenantCache(db) };
+}
+
+// src/index.ts
+var backend;
+try {
+  backend = resolveServerBackend();
+} catch (err2) {
+  console.error(
+    `${err2.message}. For local dev, set DATABASE_URL=file:./ccpool-dev.db and run \`pnpm dev\`.`
+  );
+  process.exit(1);
+}
+var port = Number(process.env.PORT ?? 8787);
+var deps = makeServerDeps(backend);
+async function ensureDatabase() {
+  for (; ; ) {
+    try {
+      await deps.db.init();
+      return;
+    } catch {
+      console.warn(`waiting for the libSQL database at ${backend.url} (retrying in 3s)`);
+      await new Promise((r) => setTimeout(r, 3e3));
+    }
+  }
+}
+await ensureDatabase();
+var app = makeApp(deps);
+var server = serve({ fetch: app.fetch, port }, (info) => {
+  console.log(`ccpool server (libSQL) listening on :${info.port}`);
+});
+for (const sig of ["SIGINT", "SIGTERM"]) {
+  process.on(sig, () => {
+    console.log(`received ${sig}, shutting down`);
+    server.close(() => {
+      void Promise.all([deps.tenants.close(), deps.db.close()]).then(() => process.exit(0));
+    });
+  });
+}