@antseed/cli 0.1.144 → 0.1.145

package/dist/proxy/peer-attribution.test.js

@@ -0,0 +1,140 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { PeerAttributionTracker, CORROBORATION_WINDOW_MS, CORRELATION_WINDOW_MS, HEARTBEAT_MS, SUSPEND_JUMP_MS, } from './peer-attribution.js';
+const A = 'a'.repeat(40);
+const B = 'b'.repeat(40);
+const C = 'c'.repeat(40);
+const D = 'd'.repeat(40);
+function fail(tracker, peerId, now) {
+    return tracker.classify({ peerId, reasonEscalates: true, fault: 'unknown', now });
+}
+test('a failure never escalates without a prior success anywhere', () => {
+    const tracker = new PeerAttributionTracker();
+    const { verdict } = fail(tracker, A, 1_000_000);
+    assert.deepEqual(verdict, { escalate: false, suppressedBy: 'no-corroborating-success' });
+});
+test('a recent success on another peer lets the failure escalate', () => {
+    const tracker = new PeerAttributionTracker();
+    tracker.recordSuccess(B, 1_000_000);
+    const { verdict } = fail(tracker, A, 1_001_000);
+    assert.deepEqual(verdict, { escalate: true });
+});
+test('a success on the failing peer itself does not vouch for the buyer', () => {
+    const tracker = new PeerAttributionTracker();
+    tracker.recordSuccess(A, 1_000_000);
+    const { verdict } = fail(tracker, A, 1_001_000);
+    assert.deepEqual(verdict, { escalate: false, suppressedBy: 'no-corroborating-success' });
+});
+test('a success older than the corroboration window stops vouching', () => {
+    const tracker = new PeerAttributionTracker();
+    tracker.recordSuccess(B, 1_000_000);
+    const { verdict } = fail(tracker, A, 1_000_000 + CORROBORATION_WINDOW_MS + 1);
+    assert.deepEqual(verdict, { escalate: false, suppressedBy: 'no-corroborating-success' });
+});
+test('three distinct peers failing together blames the buyer and rolls them back', () => {
+    const tracker = new PeerAttributionTracker();
+    tracker.recordSuccess(D, 1_000_000);
+    assert.deepEqual(fail(tracker, A, 1_000_100).verdict, { escalate: true });
+    assert.deepEqual(fail(tracker, B, 1_000_200).verdict, { escalate: true });
+    const third = fail(tracker, C, 1_000_300);
+    assert.deepEqual(third.verdict, { escalate: false, suppressedBy: 'correlated-failure' });
+    assert.deepEqual([...third.rollbackPeerIds].sort(), [A, B, C].sort());
+});
+test('repeated failures on a single peer do not trip correlation suppression', () => {
+    const tracker = new PeerAttributionTracker();
+    tracker.recordSuccess(D, 1_000_000);
+    for (let i = 1; i <= 5; i += 1) {
+        const { verdict } = fail(tracker, A, 1_000_000 + i * 1_000);
+        assert.deepEqual(verdict, { escalate: true }, `failure ${i} should still escalate`);
+    }
+});
+test('failures spread beyond the correlation window are not correlated', () => {
+    const tracker = new PeerAttributionTracker();
+    tracker.recordSuccess(D, 1_000_000);
+    // Three distinct peers, but far enough apart that they are three separate
+    // incidents rather than one buyer-side outage. Each is judged on its own.
+    const spacing = CORRELATION_WINDOW_MS + 1_000;
+    assert.deepEqual(fail(tracker, A, 1_000_100).verdict, { escalate: true });
+    assert.deepEqual(fail(tracker, B, 1_000_100 + spacing).verdict, { escalate: true });
+    assert.deepEqual(fail(tracker, C, 1_000_100 + spacing * 2).verdict, { escalate: true });
+});
+test('suppression persists for the window after a correlation trip', () => {
+    const tracker = new PeerAttributionTracker();
+    tracker.recordSuccess(D, 1_000_000);
+    fail(tracker, A, 1_000_100);
+    fail(tracker, B, 1_000_200);
+    fail(tracker, C, 1_000_300);
+    const later = fail(tracker, A, 1_000_400);
+    assert.deepEqual(later.verdict, { escalate: false, suppressedBy: 'correlated-failure' });
+});
+test('a buyer-attributed fault never escalates, even with corroboration', () => {
+    const tracker = new PeerAttributionTracker();
+    tracker.recordSuccess(B, 1_000_000);
+    const { verdict } = tracker.classify({
+        peerId: A, reasonEscalates: true, fault: 'buyer', now: 1_001_000,
+    });
+    assert.deepEqual(verdict, { escalate: false, suppressedBy: 'buyer-fault' });
+});
+test('a non-escalating reason is recorded but never cools a peer down', () => {
+    const tracker = new PeerAttributionTracker();
+    tracker.recordSuccess(B, 1_000_000);
+    const { verdict } = tracker.classify({
+        peerId: A, reasonEscalates: false, fault: 'peer', now: 1_001_000,
+    });
+    assert.deepEqual(verdict, { escalate: false, suppressedBy: 'non-escalating-reason' });
+});
+test('a wall-clock jump reads as suspend, quarantines, and rolls back the storm', () => {
+    const tracker = new PeerAttributionTracker();
+    tracker.recordSuccess(D, 1_000_000);
+    assert.equal(tracker.onHeartbeat(1_000_000), null);
+    // Two peers fail as the machine goes down; the jump is noticed on the next tick.
+    fail(tracker, A, 1_000_100);
+    fail(tracker, B, 1_000_200);
+    const wake = 1_000_200 + HEARTBEAT_MS + SUSPEND_JUMP_MS + 1_000;
+    const result = tracker.onHeartbeat(wake);
+    assert.ok(result, 'expected the clock jump to be detected');
+    assert.deepEqual([...result.rollbackPeerIds].sort(), [A, B].sort());
+    const afterWake = fail(tracker, C, wake + 100);
+    assert.deepEqual(afterWake.verdict, { escalate: false, suppressedBy: 'suspend-detected' });
+});
+test('a normal heartbeat cadence is not mistaken for suspend', () => {
+    const tracker = new PeerAttributionTracker();
+    assert.equal(tracker.onHeartbeat(1_000_000), null);
+    assert.equal(tracker.onHeartbeat(1_000_000 + HEARTBEAT_MS), null);
+    assert.equal(tracker.onHeartbeat(1_000_000 + HEARTBEAT_MS * 2 + 500), null);
+});
+test('isBuyerHealthy tracks corroboration and suppression', () => {
+    const tracker = new PeerAttributionTracker();
+    assert.equal(tracker.isBuyerHealthy(1_000_000), false);
+    tracker.recordSuccess(B, 1_000_000);
+    assert.equal(tracker.isBuyerHealthy(1_000_100), true);
+    assert.equal(tracker.isBuyerHealthy(1_000_000 + CORROBORATION_WINDOW_MS + 1), false);
+    fail(tracker, A, 1_000_100);
+    fail(tracker, B, 1_000_200);
+    fail(tracker, C, 1_000_300);
+    assert.equal(tracker.isBuyerHealthy(1_000_400), false);
+});
+test('snapshot reports the active suppression window and clears once it lapses', () => {
+    const tracker = new PeerAttributionTracker();
+    tracker.recordSuccess(D, 1_000_000);
+    fail(tracker, A, 1_000_100);
+    fail(tracker, B, 1_000_200);
+    fail(tracker, C, 1_000_300);
+    const during = tracker.snapshot(1_000_400);
+    assert.ok(during.suppressedUntil > 1_000_400);
+    assert.equal(during.lastSuppressedBy, 'correlated-failure');
+    assert.equal(during.lastAnySuccessAt, 1_000_000);
+    const after = tracker.snapshot(1_000_300 + 120_000);
+    assert.equal(after.suppressedUntil, 0);
+});
+test('a backwards clock jump does not strand failures in the correlation buffer', () => {
+    const tracker = new PeerAttributionTracker();
+    tracker.recordSuccess(D, 2_000_000);
+    fail(tracker, A, 2_000_100);
+    fail(tracker, B, 2_000_200);
+    // Clock steps backwards past the earlier marks; they must be discarded, so
+    // this third distinct peer does not trip correlation on stale data.
+    const { verdict } = fail(tracker, C, 1_000_000);
+    assert.notEqual(verdict.escalate === false ? verdict.suppressedBy : null, 'correlated-failure');
+});
+//# sourceMappingURL=peer-attribution.test.js.map

package/dist/proxy/peer-attribution.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"peer-attribution.test.js","sourceRoot":"","sources":["../../src/proxy/peer-attribution.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAA;AACvC,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,YAAY,EACZ,eAAe,GAChB,MAAM,uBAAuB,CAAA;AAE9B,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AACxB,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AACxB,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AACxB,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAExB,SAAS,IAAI,CAAC,OAA+B,EAAE,MAAc,EAAE,GAAW;IACxE,OAAO,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAA;AACnF,CAAC;AAED,IAAI,CAAC,4DAA4D,EAAE,GAAG,EAAE;IACtE,MAAM,OAAO,GAAG,IAAI,sBAAsB,EAAE,CAAA;IAC5C,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;IAC/C,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,0BAA0B,EAAE,CAAC,CAAA;AAC1F,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,4DAA4D,EAAE,GAAG,EAAE;IACtE,MAAM,OAAO,GAAG,IAAI,sBAAsB,EAAE,CAAA;IAC5C,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IACnC,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;IAC/C,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;AAC/C,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,mEAAmE,EAAE,GAAG,EAAE;IAC7E,MAAM,OAAO,GAAG,IAAI,sBAAsB,EAAE,CAAA;IAC5C,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IACnC,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;IAC/C,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,0BAA0B,EAAE,CAAC,CAAA;AAC1F,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,8DAA8D,EAAE,GAAG,EAAE;IACxE,MAAM,OAAO,GAAG,IAAI,sBAAsB,EAAE,CAAA;IAC5C,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IACnC,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,GAAG,uBAAuB,GAAG,CAAC,CAAC,CAAA;IAC7E,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,0BAA0B,EAAE,CAAC,CAAA;AAC1F,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,4EAA4E,EAAE,GAAG,EAAE;IACtF,MAAM,OAAO,GAAG,IAAI,sBAAsB,EAAE,CAAA;IAC5C,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IAEnC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IACzE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IAEzE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;IACzC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAA;IACxF,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;AACvE,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,wEAAwE,EAAE,GAAG,EAAE;IAClF,MAAM,OAAO,GAAG,IAAI,sBAAsB,EAAE,CAAA;IAC5C,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IAEnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,GAAG,CAAC,GAAG,KAAK,CAAC,CAAA;QAC3D,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,WAAW,CAAC,wBAAwB,CAAC,CAAA;IACrF,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,kEAAkE,EAAE,GAAG,EAAE;IAC5E,MAAM,OAAO,GAAG,IAAI,sBAAsB,EAAE,CAAA;IAC5C,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IAEnC,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,OAAO,GAAG,qBAAqB,GAAG,KAAK,CAAA;IAC7C,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IACzE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IACnF,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;AACzF,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,8DAA8D,EAAE,GAAG,EAAE;IACxE,MAAM,OAAO,GAAG,IAAI,sBAAsB,EAAE,CAAA;IAC5C,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IACnC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;IAC3B,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;IAC3B,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;IAE3B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;IACzC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAA;AAC1F,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,mEAAmE,EAAE,GAAG,EAAE;IAC7E,MAAM,OAAO,GAAG,IAAI,sBAAsB,EAAE,CAAA;IAC5C,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IACnC,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;QACnC,MAAM,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS;KACjE,CAAC,CAAA;IACF,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,CAAA;AAC7E,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,iEAAiE,EAAE,GAAG,EAAE;IAC3E,MAAM,OAAO,GAAG,IAAI,sBAAsB,EAAE,CAAA;IAC5C,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IACnC,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;QACnC,MAAM,EAAE,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS;KACjE,CAAC,CAAA;IACF,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,uBAAuB,EAAE,CAAC,CAAA;AACvF,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,2EAA2E,EAAE,GAAG,EAAE;IACrF,MAAM,OAAO,GAAG,IAAI,sBAAsB,EAAE,CAAA;IAC5C,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IACnC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAA;IAElD,iFAAiF;IACjF,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;IAC3B,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;IAE3B,MAAM,IAAI,GAAG,SAAS,GAAG,YAAY,GAAG,eAAe,GAAG,KAAK,CAAA;IAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;IACxC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,wCAAwC,CAAC,CAAA;IAC3D,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IAEnE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,GAAG,GAAG,CAAC,CAAA;IAC9C,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,CAAC,CAAA;AAC5F,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,wDAAwD,EAAE,GAAG,EAAE;IAClE,MAAM,OAAO,GAAG,IAAI,sBAAsB,EAAE,CAAA;IAC5C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAA;IAClD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,GAAG,YAAY,CAAC,EAAE,IAAI,CAAC,CAAA;IACjE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,GAAG,YAAY,GAAG,CAAC,GAAG,GAAG,CAAC,EAAE,IAAI,CAAC,CAAA;AAC7E,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,qDAAqD,EAAE,GAAG,EAAE;IAC/D,MAAM,OAAO,GAAG,IAAI,sBAAsB,EAAE,CAAA;IAC5C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAA;IAEtD,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IACnC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAA;IACrD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,GAAG,uBAAuB,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IAEpF,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;IAC3B,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;IAC3B,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;IAC3B,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAA;AACxD,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,0EAA0E,EAAE,GAAG,EAAE;IACpF,MAAM,OAAO,GAAG,IAAI,sBAAsB,EAAE,CAAA;IAC5C,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IACnC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;IAC3B,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;IAC3B,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;IAE3B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IAC1C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,eAAe,GAAG,SAAS,CAAC,CAAA;IAC7C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,CAAA;IAC3D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAA;IAEhD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,GAAG,OAAO,CAAC,CAAA;IACnD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAA;AACxC,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,2EAA2E,EAAE,GAAG,EAAE;IACrF,MAAM,OAAO,GAAG,IAAI,sBAAsB,EAAE,CAAA;IAC5C,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IACnC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;IAC3B,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;IAE3B,2EAA2E;IAC3E,oEAAoE;IACpE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;IAC/C,MAAM,CAAC,QAAQ,CACb,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EACxD,oBAAoB,CACrB,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/proxy/peer-health.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Per-peer failure bookkeeping and cooldown state for the buyer proxy.
+ *
+ * A peer that stops responding should stop being picked, but only temporarily:
+ * peers go offline for legitimate reasons, so there is no permanent auto-ban.
+ * Whether a failure is even allowed to escalate is decided separately, by
+ * `peer-attribution.ts` — this module owns the state machine, not the blame.
+ *
+ * Cooldown is always advisory. The proxy still dispatches to a cooling-down
+ * peer when a request names it, so a pinned conversation keeps working and no
+ * amount of cooldown can deadlock routing.
+ */
+/** Failures older than this start a fresh streak rather than compounding. */
+export declare const PEER_HEALTH_WINDOW_MS: number;
+/** Concurrent requests failing together count as one episode, not several. */
+export declare const PEER_HEALTH_COALESCE_MS = 1000;
+/** Ceiling on any single cooldown, and the sanity bound for persisted values. */
+export declare const PEER_HEALTH_MAX_COOLDOWN_MS: number;
+/** How long an idle entry is kept before it is forgotten entirely. */
+export declare const PEER_HEALTH_RETENTION_MS: number;
+/** Upper bound on tracked peers, newest failures retained. */
+export declare const PEER_HEALTH_MAX_ENTRIES = 512;
+export type PeerFailureReason = 
+/** Transport threw, timed out, or the connection died mid-request. */
+'request-failed'
+/** Seller answered 500/502/503/504. */
+ | 'seller-5xx'
+/** Seller answered 408. */
+ | 'seller-timeout'
+/** Seller answered 429 — capacity pressure, not death. Never escalates. */
+ | 'seller-busy'
+/** Our own wallet, deposits, config or state machine. Never escalates. */
+ | 'buyer-local';
+/** Whether a reason is even a candidate for cooling a peer down. */
+export declare function reasonEscalates(reason: PeerFailureReason): boolean;
+export type PeerHealthEntry = {
+    failureStreak: number;
+    windowStartedAt: number;
+    /** Start of the current coalesced failure episode. */
+    episodeStartedAt: number;
+    lastFailureAt: number;
+    lastReason: PeerFailureReason;
+    /** 0 when the peer is not cooling down. */
+    cooldownUntil: number;
+    /** 0 when the peer has never answered us. */
+    lastSuccessAt: number;
+};
+export declare function computeCooldownMs(failureStreak: number): number;
+/**
+ * Fold a failure into a peer's health.
+ *
+ * `escalate` comes from the attribution gates: when false the failure is still
+ * recorded for diagnostics and UI, but the streak and cooldown stay put.
+ */
+export declare function recordPeerFailureEntry(previous: PeerHealthEntry | undefined, reason: PeerFailureReason, now: number, escalate: boolean): PeerHealthEntry;
+/**
+ * Any response from a peer is proof of life, so a success wipes the streak and
+ * releases the cooldown. `lastSuccessAt` is kept for diagnostics.
+ */
+export declare function clearPeerHealthEntry(previous: PeerHealthEntry | undefined, now: number): PeerHealthEntry;
+export declare function isCoolingDown(entry: PeerHealthEntry | undefined, now: number): boolean;
+/** Drop stale entries and cap the map, keeping the most recently active peers. */
+export declare function prunePeerHealth(entries: Map<string, PeerHealthEntry>, now: number): Map<string, PeerHealthEntry>;
+/**
+ * Parse the `peerHealth` map out of a buyer.state.json blob.
+ *
+ * Cooldown survives a restart — a peer that died ten seconds before we exited is
+ * still dead — but is never extended or resurrected by one: anything expired,
+ * impossibly far in the future, or stamped after `now` is discarded.
+ */
+export declare function parsePersistedPeerHealth(parsed: unknown, now?: number): Map<string, PeerHealthEntry>;
+export declare function serializePeerHealth(entries: Map<string, PeerHealthEntry>): Record<string, PeerHealthEntry>;
+//# sourceMappingURL=peer-health.d.ts.map

package/dist/proxy/peer-health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"peer-health.d.ts","sourceRoot":"","sources":["../../src/proxy/peer-health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAUH,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,QAAa,CAAA;AAC/C,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB,OAAQ,CAAA;AAC5C,iFAAiF;AACjF,eAAO,MAAM,2BAA2B,QAAa,CAAA;AACrD,sEAAsE;AACtE,eAAO,MAAM,wBAAwB,QAAmB,CAAA;AACxD,8DAA8D;AAC9D,eAAO,MAAM,uBAAuB,MAAM,CAAA;AAE1C,MAAM,MAAM,iBAAiB;AAC3B,sEAAsE;AACpE,gBAAgB;AAClB,uCAAuC;GACrC,YAAY;AACd,2BAA2B;GACzB,gBAAgB;AAClB,2EAA2E;GACzE,aAAa;AACf,0EAA0E;GACxE,aAAa,CAAA;AAMjB,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAElE;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,aAAa,EAAE,MAAM,CAAA;IACrB,eAAe,EAAE,MAAM,CAAA;IACvB,sDAAsD;IACtD,gBAAgB,EAAE,MAAM,CAAA;IACxB,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,iBAAiB,CAAA;IAC7B,2CAA2C;IAC3C,aAAa,EAAE,MAAM,CAAA;IACrB,6CAA6C;IAC7C,aAAa,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAI/D;AAcD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,eAAe,GAAG,SAAS,EACrC,MAAM,EAAE,iBAAiB,EACzB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,OAAO,GAChB,eAAe,CA+BjB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,eAAe,GAAG,SAAS,EACrC,GAAG,EAAE,MAAM,GACV,eAAe,CASjB;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAItF;AAUD,kFAAkF;AAClF,wBAAgB,eAAe,CAC7B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,EACrC,GAAG,EAAE,MAAM,GACV,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAS9B;AAMD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,OAAO,EACf,GAAG,GAAE,MAAmB,GACvB,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CA+C9B;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,GACpC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAEjC"}

package/dist/proxy/peer-health.js

@@ -0,0 +1,182 @@
+/**
+ * Per-peer failure bookkeeping and cooldown state for the buyer proxy.
+ *
+ * A peer that stops responding should stop being picked, but only temporarily:
+ * peers go offline for legitimate reasons, so there is no permanent auto-ban.
+ * Whether a failure is even allowed to escalate is decided separately, by
+ * `peer-attribution.ts` — this module owns the state machine, not the blame.
+ *
+ * Cooldown is always advisory. The proxy still dispatches to a cooling-down
+ * peer when a request names it, so a pinned conversation keeps working and no
+ * amount of cooldown can deadlock routing.
+ */
+// The escalation curve is defined once in
+// `packages/router-core/src/peer-metrics.ts` (`computeFailureCooldownMs`).
+// These constants mirror it; router-core is not a dependency of the CLI and a
+// six-line curve does not justify making it one. Keep the two in step.
+const MAX_FAILURES = 3;
+const BASE_COOLDOWN_MS = 30_000;
+const MAX_DOUBLINGS = 4;
+/** Failures older than this start a fresh streak rather than compounding. */
+export const PEER_HEALTH_WINDOW_MS = 5 * 60_000;
+/** Concurrent requests failing together count as one episode, not several. */
+export const PEER_HEALTH_COALESCE_MS = 1_000;
+/** Ceiling on any single cooldown, and the sanity bound for persisted values. */
+export const PEER_HEALTH_MAX_COOLDOWN_MS = 8 * 60_000;
+/** How long an idle entry is kept before it is forgotten entirely. */
+export const PEER_HEALTH_RETENTION_MS = 24 * 60 * 60_000;
+/** Upper bound on tracked peers, newest failures retained. */
+export const PEER_HEALTH_MAX_ENTRIES = 512;
+const FAILURE_REASONS = [
+    'request-failed', 'seller-5xx', 'seller-timeout', 'seller-busy', 'buyer-local',
+];
+/** Whether a reason is even a candidate for cooling a peer down. */
+export function reasonEscalates(reason) {
+    return reason === 'request-failed' || reason === 'seller-5xx' || reason === 'seller-timeout';
+}
+export function computeCooldownMs(failureStreak) {
+    if (!Number.isFinite(failureStreak) || failureStreak < MAX_FAILURES)
+        return 0;
+    const penaltyPower = Math.min(MAX_DOUBLINGS, Math.trunc(failureStreak) - MAX_FAILURES);
+    return Math.min(BASE_COOLDOWN_MS * (2 ** penaltyPower), PEER_HEALTH_MAX_COOLDOWN_MS);
+}
+function emptyEntry() {
+    return {
+        failureStreak: 0,
+        windowStartedAt: 0,
+        episodeStartedAt: 0,
+        lastFailureAt: 0,
+        lastReason: 'request-failed',
+        cooldownUntil: 0,
+        lastSuccessAt: 0,
+    };
+}
+/**
+ * Fold a failure into a peer's health.
+ *
+ * `escalate` comes from the attribution gates: when false the failure is still
+ * recorded for diagnostics and UI, but the streak and cooldown stay put.
+ */
+export function recordPeerFailureEntry(previous, reason, now, escalate) {
+    const prev = previous ?? emptyEntry();
+    if (!escalate) {
+        return { ...prev, lastFailureAt: now, lastReason: reason };
+    }
+    // Two requests to the same dead peer failing together are one episode; without
+    // this they would skip a doubling step each time concurrency rises.
+    const episodeStartedAt = prev.episodeStartedAt;
+    if (episodeStartedAt > 0 && now - episodeStartedAt < PEER_HEALTH_COALESCE_MS && now >= prev.lastFailureAt) {
+        return { ...prev, lastFailureAt: now, lastReason: reason };
+    }
+    const windowLapsed = prev.lastFailureAt <= 0
+        || now - prev.lastFailureAt > PEER_HEALTH_WINDOW_MS
+        // Clock stepped backwards; the old window is meaningless.
+        || now < prev.lastFailureAt;
+    const failureStreak = windowLapsed ? 1 : prev.failureStreak + 1;
+    const cooldownMs = computeCooldownMs(failureStreak);
+    return {
+        failureStreak,
+        windowStartedAt: windowLapsed ? now : (prev.windowStartedAt || now),
+        episodeStartedAt: now,
+        lastFailureAt: now,
+        lastReason: reason,
+        cooldownUntil: cooldownMs > 0 ? now + cooldownMs : 0,
+        lastSuccessAt: prev.lastSuccessAt,
+    };
+}
+/**
+ * Any response from a peer is proof of life, so a success wipes the streak and
+ * releases the cooldown. `lastSuccessAt` is kept for diagnostics.
+ */
+export function clearPeerHealthEntry(previous, now) {
+    return {
+        ...(previous ?? emptyEntry()),
+        failureStreak: 0,
+        windowStartedAt: 0,
+        episodeStartedAt: 0,
+        cooldownUntil: 0,
+        lastSuccessAt: now,
+    };
+}
+export function isCoolingDown(entry, now) {
+    if (!entry || entry.cooldownUntil <= now)
+        return false;
+    // A corrupt or clock-skewed future value must not hold a peer hostage.
+    return entry.cooldownUntil - now <= PEER_HEALTH_MAX_COOLDOWN_MS;
+}
+/** Whether an entry still carries information worth persisting. */
+function isEntryMeaningful(entry, now) {
+    if (entry.cooldownUntil > now)
+        return true;
+    const lastActivity = Math.max(entry.lastFailureAt, entry.lastSuccessAt);
+    if (lastActivity <= 0)
+        return false;
+    return now - lastActivity < PEER_HEALTH_RETENTION_MS;
+}
+/** Drop stale entries and cap the map, keeping the most recently active peers. */
+export function prunePeerHealth(entries, now) {
+    const kept = [...entries.entries()].filter(([, entry]) => isEntryMeaningful(entry, now));
+    if (kept.length > PEER_HEALTH_MAX_ENTRIES) {
+        kept.sort((a, b) => Math.max(b[1].lastFailureAt, b[1].lastSuccessAt)
+            - Math.max(a[1].lastFailureAt, a[1].lastSuccessAt));
+        kept.length = PEER_HEALTH_MAX_ENTRIES;
+    }
+    return new Map(kept);
+}
+function finiteNonNegative(value) {
+    return typeof value === 'number' && Number.isFinite(value) && value >= 0 ? value : 0;
+}
+/**
+ * Parse the `peerHealth` map out of a buyer.state.json blob.
+ *
+ * Cooldown survives a restart — a peer that died ten seconds before we exited is
+ * still dead — but is never extended or resurrected by one: anything expired,
+ * impossibly far in the future, or stamped after `now` is discarded.
+ */
+export function parsePersistedPeerHealth(parsed, now = Date.now()) {
+    const result = new Map();
+    if (!parsed || typeof parsed !== 'object')
+        return result;
+    const raw = parsed.peerHealth;
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        return result;
+    for (const [rawPeerId, rawEntry] of Object.entries(raw)) {
+        const peerId = rawPeerId.toLowerCase();
+        if (!/^[0-9a-f]{40}$/.test(peerId))
+            continue;
+        if (!rawEntry || typeof rawEntry !== 'object' || Array.isArray(rawEntry))
+            continue;
+        const entry = rawEntry;
+        const lastFailureAt = finiteNonNegative(entry.lastFailureAt);
+        const lastSuccessAt = finiteNonNegative(entry.lastSuccessAt);
+        // Timestamps ahead of the clock mean the entry cannot be reasoned about.
+        if (lastFailureAt > now || lastSuccessAt > now)
+            continue;
+        const rawStreak = finiteNonNegative(entry.failureStreak);
+        const failureStreak = Math.min(64, Math.trunc(rawStreak));
+        const lastReason = FAILURE_REASONS.includes(entry.lastReason)
+            ? entry.lastReason
+            : 'request-failed';
+        const rawCooldown = finiteNonNegative(entry.cooldownUntil);
+        const cooldownUntil = rawCooldown > now && rawCooldown - now <= PEER_HEALTH_MAX_COOLDOWN_MS
+            ? rawCooldown
+            : 0;
+        const candidate = {
+            failureStreak,
+            windowStartedAt: Math.min(finiteNonNegative(entry.windowStartedAt), now),
+            episodeStartedAt: Math.min(finiteNonNegative(entry.episodeStartedAt) || lastFailureAt, now),
+            lastFailureAt,
+            lastReason,
+            cooldownUntil,
+            lastSuccessAt,
+        };
+        if (!isEntryMeaningful(candidate, now))
+            continue;
+        result.set(peerId, candidate);
+    }
+    return prunePeerHealth(result, now);
+}
+export function serializePeerHealth(entries) {
+    return Object.fromEntries(entries);
+}
+//# sourceMappingURL=peer-health.js.map

package/dist/proxy/peer-health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"peer-health.js","sourceRoot":"","sources":["../../src/proxy/peer-health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,0CAA0C;AAC1C,2EAA2E;AAC3E,8EAA8E;AAC9E,uEAAuE;AACvE,MAAM,YAAY,GAAG,CAAC,CAAA;AACtB,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAC/B,MAAM,aAAa,GAAG,CAAC,CAAA;AAEvB,6EAA6E;AAC7E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,MAAM,CAAA;AAC/C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAA;AAC5C,iFAAiF;AACjF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,GAAG,MAAM,CAAA;AACrD,sEAAsE;AACtE,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;AACxD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAA;AAc1C,MAAM,eAAe,GAAiC;IACpD,gBAAgB,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa;CAC/E,CAAA;AAED,oEAAoE;AACpE,MAAM,UAAU,eAAe,CAAC,MAAyB;IACvD,OAAO,MAAM,KAAK,gBAAgB,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,gBAAgB,CAAA;AAC9F,CAAC;AAeD,MAAM,UAAU,iBAAiB,CAAC,aAAqB;IACrD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,YAAY;QAAE,OAAO,CAAC,CAAA;IAC7E,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,YAAY,CAAC,CAAA;IACtF,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,GAAG,CAAC,CAAC,IAAI,YAAY,CAAC,EAAE,2BAA2B,CAAC,CAAA;AACtF,CAAC;AAED,SAAS,UAAU;IACjB,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,eAAe,EAAE,CAAC;QAClB,gBAAgB,EAAE,CAAC;QACnB,aAAa,EAAE,CAAC;QAChB,UAAU,EAAE,gBAAgB;QAC5B,aAAa,EAAE,CAAC;QAChB,aAAa,EAAE,CAAC;KACjB,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAqC,EACrC,MAAyB,EACzB,GAAW,EACX,QAAiB;IAEjB,MAAM,IAAI,GAAG,QAAQ,IAAI,UAAU,EAAE,CAAA;IAErC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IAC5D,CAAC;IAED,+EAA+E;IAC/E,oEAAoE;IACpE,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAA;IAC9C,IAAI,gBAAgB,GAAG,CAAC,IAAI,GAAG,GAAG,gBAAgB,GAAG,uBAAuB,IAAI,GAAG,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1G,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IAC5D,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,IAAI,CAAC;WACvC,GAAG,GAAG,IAAI,CAAC,aAAa,GAAG,qBAAqB;QACnD,0DAA0D;WACvD,GAAG,GAAG,IAAI,CAAC,aAAa,CAAA;IAE7B,MAAM,aAAa,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAA;IAC/D,MAAM,UAAU,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAA;IAEnD,OAAO;QACL,aAAa;QACb,eAAe,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,IAAI,GAAG,CAAC;QACnE,gBAAgB,EAAE,GAAG;QACrB,aAAa,EAAE,GAAG;QAClB,UAAU,EAAE,MAAM;QAClB,aAAa,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QACpD,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAqC,EACrC,GAAW;IAEX,OAAO;QACL,GAAG,CAAC,QAAQ,IAAI,UAAU,EAAE,CAAC;QAC7B,aAAa,EAAE,CAAC;QAChB,eAAe,EAAE,CAAC;QAClB,gBAAgB,EAAE,CAAC;QACnB,aAAa,EAAE,CAAC;QAChB,aAAa,EAAE,GAAG;KACnB,CAAA;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAkC,EAAE,GAAW;IAC3E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,aAAa,IAAI,GAAG;QAAE,OAAO,KAAK,CAAA;IACtD,uEAAuE;IACvE,OAAO,KAAK,CAAC,aAAa,GAAG,GAAG,IAAI,2BAA2B,CAAA;AACjE,CAAC;AAED,mEAAmE;AACnE,SAAS,iBAAiB,CAAC,KAAsB,EAAE,GAAW;IAC5D,IAAI,KAAK,CAAC,aAAa,GAAG,GAAG;QAAE,OAAO,IAAI,CAAA;IAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,CAAA;IACvE,IAAI,YAAY,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IACnC,OAAO,GAAG,GAAG,YAAY,GAAG,wBAAwB,CAAA;AACtD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAC7B,OAAqC,EACrC,GAAW;IAEX,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAA;IACxF,IAAI,IAAI,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACjB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;cAC9C,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAA;QACrD,IAAI,CAAC,MAAM,GAAG,uBAAuB,CAAA;IACvC,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,CAAA;AACtB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;AACtF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAe,EACf,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAA;IACjD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAA;IAExD,MAAM,GAAG,GAAI,MAAmC,CAAC,UAAU,CAAA;IAC3D,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAA;IAExE,KAAK,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;QACnF,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,EAAE,CAAA;QACtC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,SAAQ;QAC5C,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,SAAQ;QAElF,MAAM,KAAK,GAAG,QAAmC,CAAA;QACjD,MAAM,aAAa,GAAG,iBAAiB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;QAC5D,MAAM,aAAa,GAAG,iBAAiB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;QAE5D,yEAAyE;QACzE,IAAI,aAAa,GAAG,GAAG,IAAI,aAAa,GAAG,GAAG;YAAE,SAAQ;QAExD,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;QACxD,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA;QACzD,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,UAA+B,CAAC;YAChF,CAAC,CAAE,KAAK,CAAC,UAAgC;YACzC,CAAC,CAAC,gBAAgB,CAAA;QAEpB,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;QAC1D,MAAM,aAAa,GAAG,WAAW,GAAG,GAAG,IAAI,WAAW,GAAG,GAAG,IAAI,2BAA2B;YACzF,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,CAAC,CAAA;QAEL,MAAM,SAAS,GAAoB;YACjC,aAAa;YACb,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,GAAG,CAAC;YACxE,gBAAgB,EAAE,IAAI,CAAC,GAAG,CACxB,iBAAiB,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,aAAa,EAC1D,GAAG,CACJ;YACD,aAAa;YACb,UAAU;YACV,aAAa;YACb,aAAa;SACd,CAAA;QACD,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,GAAG,CAAC;YAAE,SAAQ;QAChD,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC/B,CAAC;IAED,OAAO,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;AACrC,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAAqC;IAErC,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;AACpC,CAAC"}

package/dist/proxy/peer-health.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=peer-health.test.d.ts.map

package/dist/proxy/peer-health.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"peer-health.test.d.ts","sourceRoot":"","sources":["../../src/proxy/peer-health.test.ts"],"names":[],"mappings":""}

package/dist/proxy/peer-health.test.js

@@ -0,0 +1,197 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { recordPeerFailureEntry, clearPeerHealthEntry, isCoolingDown, parsePersistedPeerHealth, prunePeerHealth, computeCooldownMs, reasonEscalates, PEER_HEALTH_WINDOW_MS, PEER_HEALTH_COALESCE_MS, PEER_HEALTH_MAX_COOLDOWN_MS, PEER_HEALTH_RETENTION_MS, PEER_HEALTH_MAX_ENTRIES, } from './peer-health.js';
+const NOW = 1_700_000_000_000;
+const A = 'a'.repeat(40);
+function escalatingFailures(count, startAt = NOW, stepMs = 2_000) {
+    let entry;
+    for (let i = 0; i < count; i += 1) {
+        entry = recordPeerFailureEntry(entry, 'request-failed', startAt + i * stepMs, true);
+    }
+    return entry;
+}
+test('reasonEscalates only admits reasons that indicate the peer is down', () => {
+    assert.equal(reasonEscalates('request-failed'), true);
+    assert.equal(reasonEscalates('seller-5xx'), true);
+    assert.equal(reasonEscalates('seller-timeout'), true);
+    assert.equal(reasonEscalates('seller-busy'), false);
+    assert.equal(reasonEscalates('buyer-local'), false);
+});
+test('computeCooldownMs matches the shared escalation curve and its ceiling', () => {
+    assert.equal(computeCooldownMs(2), 0);
+    assert.equal(computeCooldownMs(3), 30_000);
+    assert.equal(computeCooldownMs(4), 60_000);
+    assert.equal(computeCooldownMs(5), 120_000);
+    assert.equal(computeCooldownMs(7), 480_000);
+    assert.equal(computeCooldownMs(50), PEER_HEALTH_MAX_COOLDOWN_MS);
+});
+test('a peer cools down only on the third failure in the window', () => {
+    const after1 = recordPeerFailureEntry(undefined, 'request-failed', NOW, true);
+    assert.equal(after1.failureStreak, 1);
+    assert.equal(isCoolingDown(after1, NOW), false);
+    const after2 = recordPeerFailureEntry(after1, 'request-failed', NOW + 2_000, true);
+    assert.equal(isCoolingDown(after2, NOW + 2_000), false);
+    const after3 = recordPeerFailureEntry(after2, 'request-failed', NOW + 4_000, true);
+    assert.equal(after3.failureStreak, 3);
+    assert.equal(after3.cooldownUntil, NOW + 4_000 + 30_000);
+    assert.equal(isCoolingDown(after3, NOW + 4_000), true);
+});
+test('further failures double the cooldown', () => {
+    const after4 = escalatingFailures(4);
+    assert.equal(after4.cooldownUntil - after4.lastFailureAt, 60_000);
+    const after5 = escalatingFailures(5);
+    assert.equal(after5.cooldownUntil - after5.lastFailureAt, 120_000);
+});
+test('a non-escalating failure updates diagnostics but never the streak or cooldown', () => {
+    const escalated = escalatingFailures(2);
+    const suppressed = recordPeerFailureEntry(escalated, 'seller-busy', NOW + 10_000, false);
+    assert.equal(suppressed.failureStreak, escalated.failureStreak);
+    assert.equal(suppressed.cooldownUntil, escalated.cooldownUntil);
+    assert.equal(suppressed.lastReason, 'seller-busy');
+    assert.equal(suppressed.lastFailureAt, NOW + 10_000);
+});
+test('a diagnostic-only failure does not coalesce away the next escalating failure', () => {
+    const diagnostic = recordPeerFailureEntry(undefined, 'seller-busy', NOW, false);
+    const escalated = recordPeerFailureEntry(diagnostic, 'request-failed', NOW + 100, true);
+    assert.equal(escalated.failureStreak, 1);
+    assert.equal(escalated.episodeStartedAt, NOW + 100);
+});
+test('failures inside the coalesce window count as a single episode', () => {
+    let entry = recordPeerFailureEntry(undefined, 'request-failed', NOW, true);
+    entry = recordPeerFailureEntry(entry, 'request-failed', NOW + 100, true);
+    entry = recordPeerFailureEntry(entry, 'request-failed', NOW + 200, true);
+    assert.equal(entry.failureStreak, 1);
+    assert.equal(isCoolingDown(entry, NOW + 200), false);
+});
+test('the coalesce window is anchored to the episode start', () => {
+    let entry = recordPeerFailureEntry(undefined, 'request-failed', NOW, true);
+    entry = recordPeerFailureEntry(entry, 'request-failed', NOW + PEER_HEALTH_COALESCE_MS - 100, true);
+    entry = recordPeerFailureEntry(entry, 'request-failed', NOW + PEER_HEALTH_COALESCE_MS + 100, true);
+    assert.equal(entry.failureStreak, 2);
+    assert.equal(entry.episodeStartedAt, NOW + PEER_HEALTH_COALESCE_MS + 100);
+});
+test('a lapsed window starts a fresh streak instead of compounding', () => {
+    const twoFailures = escalatingFailures(2);
+    const muchLater = recordPeerFailureEntry(twoFailures, 'request-failed', twoFailures.lastFailureAt + PEER_HEALTH_WINDOW_MS + 1, true);
+    assert.equal(muchLater.failureStreak, 1);
+    assert.equal(muchLater.cooldownUntil, 0);
+});
+test('a backwards clock jump resets the window rather than compounding', () => {
+    const twoFailures = escalatingFailures(2);
+    const backwards = recordPeerFailureEntry(twoFailures, 'request-failed', NOW - 60_000, true);
+    assert.equal(backwards.failureStreak, 1);
+    assert.equal(backwards.cooldownUntil, 0);
+});
+test('a success clears the streak and releases the cooldown', () => {
+    const cooling = escalatingFailures(3);
+    assert.equal(isCoolingDown(cooling, cooling.lastFailureAt), true);
+    const recovered = clearPeerHealthEntry(cooling, cooling.lastFailureAt + 1_000);
+    assert.equal(recovered.failureStreak, 0);
+    assert.equal(recovered.cooldownUntil, 0);
+    assert.equal(recovered.lastSuccessAt, cooling.lastFailureAt + 1_000);
+    assert.equal(isCoolingDown(recovered, recovered.lastSuccessAt), false);
+});
+test('isCoolingDown rejects an impossibly distant cooldown', () => {
+    const entry = {
+        ...escalatingFailures(3),
+        cooldownUntil: NOW + PEER_HEALTH_MAX_COOLDOWN_MS * 10,
+    };
+    assert.equal(isCoolingDown(entry, NOW), false);
+});
+test('parsePersistedPeerHealth ignores junk input', () => {
+    assert.equal(parsePersistedPeerHealth(null, NOW).size, 0);
+    assert.equal(parsePersistedPeerHealth('nope', NOW).size, 0);
+    assert.equal(parsePersistedPeerHealth({}, NOW).size, 0);
+    assert.equal(parsePersistedPeerHealth({ peerHealth: [] }, NOW).size, 0);
+    assert.equal(parsePersistedPeerHealth({ peerHealth: 'x' }, NOW).size, 0);
+});
+test('parsePersistedPeerHealth rejects malformed peer ids and entries', () => {
+    const parsed = parsePersistedPeerHealth({
+        peerHealth: {
+            'not-a-peer-id': { lastFailureAt: NOW - 1_000, failureStreak: 3 },
+            [`0x${'a'.repeat(40)}`]: { lastFailureAt: NOW - 1_000, failureStreak: 3 },
+            [A]: 'not-an-object',
+        },
+    }, NOW);
+    assert.equal(parsed.size, 0);
+});
+test('parsePersistedPeerHealth restores a live cooldown unchanged', () => {
+    const cooldownUntil = NOW + 20_000;
+    const parsed = parsePersistedPeerHealth({
+        peerHealth: {
+            [A.toUpperCase()]: {
+                failureStreak: 3, windowStartedAt: NOW - 5_000, lastFailureAt: NOW - 1_000,
+                lastReason: 'seller-5xx', cooldownUntil, lastSuccessAt: 0,
+            },
+        },
+    }, NOW);
+    const entry = parsed.get(A);
+    assert.ok(entry);
+    assert.equal(entry.cooldownUntil, cooldownUntil);
+    assert.equal(entry.failureStreak, 3);
+    assert.equal(entry.lastReason, 'seller-5xx');
+});
+test('parsePersistedPeerHealth drops an expired or impossible cooldown', () => {
+    const expired = parsePersistedPeerHealth({
+        peerHealth: { [A]: { failureStreak: 3, lastFailureAt: NOW - 1_000, cooldownUntil: NOW - 1 } },
+    }, NOW);
+    assert.equal(expired.get(A)?.cooldownUntil, 0);
+    const absurd = parsePersistedPeerHealth({
+        peerHealth: {
+            [A]: {
+                failureStreak: 3,
+                lastFailureAt: NOW - 1_000,
+                cooldownUntil: NOW + PEER_HEALTH_MAX_COOLDOWN_MS * 100,
+            },
+        },
+    }, NOW);
+    assert.equal(absurd.get(A)?.cooldownUntil, 0);
+});
+test('parsePersistedPeerHealth discards entries stamped in the future', () => {
+    const parsed = parsePersistedPeerHealth({
+        peerHealth: { [A]: { failureStreak: 3, lastFailureAt: NOW + 60_000 } },
+    }, NOW);
+    assert.equal(parsed.size, 0);
+});
+test('parsePersistedPeerHealth coerces non-finite numbers and unknown reasons', () => {
+    const parsed = parsePersistedPeerHealth({
+        peerHealth: {
+            [A]: {
+                failureStreak: 'lots', windowStartedAt: Number.NaN, lastFailureAt: NOW - 1_000,
+                lastReason: 'made-up-reason', cooldownUntil: Number.POSITIVE_INFINITY,
+                lastSuccessAt: -5,
+            },
+        },
+    }, NOW);
+    const entry = parsed.get(A);
+    assert.ok(entry);
+    assert.equal(entry.failureStreak, 0);
+    assert.equal(entry.windowStartedAt, 0);
+    assert.equal(entry.lastReason, 'request-failed');
+    assert.equal(entry.cooldownUntil, 0);
+    assert.equal(entry.lastSuccessAt, 0);
+});
+test('parsePersistedPeerHealth forgets entries past the retention window', () => {
+    const parsed = parsePersistedPeerHealth({
+        peerHealth: { [A]: { failureStreak: 3, lastFailureAt: NOW - PEER_HEALTH_RETENTION_MS - 1 } },
+    }, NOW);
+    assert.equal(parsed.size, 0);
+});
+test('prunePeerHealth caps the map keeping the most recently active peers', () => {
+    const entries = new Map();
+    const total = PEER_HEALTH_MAX_ENTRIES + 10;
+    for (let i = 0; i < total; i += 1) {
+        const peerId = i.toString(16).padStart(40, '0');
+        entries.set(peerId, {
+            failureStreak: 1, windowStartedAt: 0, lastFailureAt: NOW - (total - i) * 1_000,
+            episodeStartedAt: NOW - (total - i) * 1_000,
+            lastReason: 'request-failed', cooldownUntil: 0, lastSuccessAt: 0,
+        });
+    }
+    const pruned = prunePeerHealth(entries, NOW);
+    assert.equal(pruned.size, PEER_HEALTH_MAX_ENTRIES);
+    // The freshest peer survives; the stalest is evicted.
+    assert.ok(pruned.has((total - 1).toString(16).padStart(40, '0')));
+    assert.equal(pruned.has((0).toString(16).padStart(40, '0')), false);
+});
+//# sourceMappingURL=peer-health.test.js.map