@omnicross/contracts 0.1.5 → 0.1.7

package/dist/account-tokens-types.d.cts

@@ -12,13 +12,13 @@ import { OpenCodeGoTokenConfig } from './subscription-types.cjs';
 /**
  * Upstream proxy descriptor (upstream-proxy). Routes an outbound upstream call
  * through an http/https or socks5 proxy. Two interchangeable shapes:
- *  - `{ url }`      — a full proxy URL, e.g. `http://user:pass@host:1080` or
+ *  - `{ url }`      a full proxy URL, e.g. `http://user:pass@host:1080` or
  *                     `socks5://host:1080` (userinfo carries basic-auth).
- *  - structured     — an explicit `{ type, host, port, username?, password? }`.
+ *  - structured     an explicit `{ type, host, port, username, password }`.
  *
  * `username`/`password` are SECRETS: encrypted at rest via the same envelope as
  * other credentials, masked in every sanitized/admin view, and never logged
- * (logs carry at most `host:port`). Additive everywhere it appears — absent ⇒ a
+ * (logs carry at most `host:port`). Additive everywhere it appears absent a
  * direct (non-proxied) call, byte-identical to before proxy support.
  */
 type ProxyConfig = {
@@ -35,9 +35,9 @@ type ProxyConfig = {
  * The frozen fingerprint headers a real Claude Code client sent for this account,
  * captured + replayed so relayed traffic presents a stable identity across
  * restarts. NON-secret metadata: it holds ONLY whitelisted fingerprint headers
- * (`x-stainless-*` / user-agent / anthropic-beta / x-app / CC headers) — NEVER
+ * (`x-stainless-*` / user-agent / anthropic-beta / x-app / CC headers) NEVER
  * `authorization` / `x-api-key` / `cookie` (excluded at capture AND at
- * store-normalize). Additive + OPTIONAL — an existing `tokens.json` without it
+ * store-normalize). Additive + OPTIONAL an existing `tokens.json` without it
  * parses unchanged (the account re-captures from a real client). Because it is
  * non-secret it lives on the entry OUTSIDE the encrypted `tokens` block and is
  * not walked by the secrets encryptor.
@@ -65,17 +65,13 @@ type SubscriptionLevel = 'Free' | 'Pro' | 'Max';
  */
 type TokenStatus = 'unconfigured' | 'authorized' | 'configured' | 'expired' | 'error';
 /**
- * Machine-readable credential-sync warning code (external-cli-sync).
+ * Machine-readable managed-account credential warning code.
  *
- * - `external-divergent`: the external CLI's native credential file (e.g.
- *   `~/.claude/.credentials.json`) holds a DIFFERENT, fresher credential than
- *   the stored account — the stored refresh token may have been rotated out.
- * - `external-not-rotated`: a refresh failed and the external file holds the
- *   SAME dead credential — a genuine revocation, re-login is required.
- * - `duplicate-token`: two accounts of one provider share the same credential —
- *   refreshing one will invalidate the other (single-use refresh tokens).
+ * `duplicate-token` means two managed accounts of one provider share the same
+ * credential. Native CLI credential files are not compared by normal account
+ * listing or refresh paths.
  */
-type SyncWarningCode = 'external-divergent' | 'external-not-rotated' | 'duplicate-token';
+type SyncWarningCode = 'duplicate-token';
 /**
  * Claude token configuration
  */
@@ -91,8 +87,8 @@ type ClaudeTokenConfig = {
     setupTokenExpiresAt?: string;
     lastRefreshedAt?: string;
     errorMessage?: string;
-    /** Persisted credential-sync warning (external-cli-sync); cleared on a
-     *  successful refresh / import. */
+    /** Managed-account credential warning; duplicate-token may be projected on
+     *  account listing. */
     syncWarning?: SyncWarningCode;
 };
 /**
@@ -110,8 +106,8 @@ type CodexTokenConfig = {
     organizationId?: string;
     lastRefreshedAt?: string;
     errorMessage?: string;
-    /** Persisted credential-sync warning (external-cli-sync); cleared on a
-     *  successful refresh / import. */
+    /** Managed-account credential warning; duplicate-token may be projected on
+     *  account listing. */
     syncWarning?: SyncWarningCode;
 };
 /**
@@ -137,47 +133,53 @@ type GeminiTokenConfig = {
 type SubscriptionAccountEntry<TConfig> = {
     /** Stable, generated id (`crypto.randomUUID()`). */
     id: string;
-    /** User-supplied label; default "账号 N" / "Account N". */
+    /** User-supplied label; default "N" / "Account N". */
     label?: string;
+    /** Whether the scheduler may select this account. Absent on legacy rows means true. */
+    enabled?: boolean;
+    /** Operator-defined account-pool group. Absent rows are presented in their provider group. */
+    group?: string;
+    /** Searchable operator metadata. Tags are non-secret and normalized on write. */
+    tags?: string[];
     /** ISO creation timestamp. */
     createdAt?: string;
     /**
      * Scheduling precedence in the account pool (subscription-account-scheduling).
-     * Lower = higher precedence; default `50` when absent (CRS `parseInt(x,10) || 50`
-     * parity). OPTIONAL — an existing `tokens.json` without it parses unchanged and
+     * Lower = higher precedence; default `50` when absent. OPTIONAL: an existing
+     * `tokens.json` without it parses unchanged and
      * every account defaults to 50.
      */
     priority?: number;
     /**
      * ISO timestamp of the last time this account was selected to serve a request
      * (subscription-account-scheduling LRU tie-break input). OPTIONAL, best-effort
-     * throttled persist — the selector's in-memory overlay is the authoritative live
+     * throttled persist the selector's in-memory overlay is the authoritative live
      * value; an account without it sorts as least-recently-used (timestamp `0`).
      */
     lastUsedAt?: string;
     /**
      * Per-account upstream proxy override (upstream-proxy). When set, this
      * account's relay + OAuth-refresh traffic is routed through this proxy,
-     * WINNING over the per-provider and global proxy layers. OPTIONAL — an
-     * existing `tokens.json` without it parses unchanged (no proxy → direct). Its
+     * WINNING over the per-provider and global proxy layers. OPTIONAL an
+     * existing `tokens.json` without it parses unchanged (no proxy direct). Its
      * `password` is a secret: encrypted at rest by the tokens `SecretBox` walker
      * and masked in the sanitized view.
      */
     proxy?: ProxyConfig;
     /**
-     * Per-account model support + logical→actual remap (subscription-account-model-map).
-     * CRS dual-format, OPTIONAL — an existing `tokens.json` without it parses
+     * Per-account model support + logicaltual remap (subscription-account-model-map).
+     * Supports both allow-list and logical-to-actual mapping formats. OPTIONAL: an existing `tokens.json` without it parses
      * unchanged (the account supports every model and never remaps, byte-identical
      * to before this change):
-     *  - **array** `["a","b"]` — an ALLOW-LIST: the account supports ONLY these
-     *    logical models (skip-only, no remap). In a ≥2-account pool the account is
+     *  - **array** `["a","b"]` an ALLOW-LIST: the account supports ONLY these
+     *    logical models (skip-only, no remap). In a -account pool the account is
      *    routed AROUND for any other model.
-     *  - **object** `{ "a": "X", "b": "Y" }` — the keys are the same allow-list AND
+     *  - **object** `{ "a": "X", "b": "Y" }` the keys are the same allow-list AND
      *    each value is the account's ACTUAL upstream model, so a selected account
      *    remaps the logical model to its actual model on the outbound request.
      *
-     * Model-support filtering only applies when the provider has ≥2 accounts (the
-     * same gate as account health) — a sole account is never model-gated
+     * Model-support filtering only applies when the provider has  accounts (the
+     * same gate as account health) a sole account is never model-gated
      * (never-strand; the upstream stays authoritative). A sole account that must
      * serve a logical model AS a different actual model uses the OBJECT map (remap),
      * not skip.
@@ -186,7 +188,7 @@ type SubscriptionAccountEntry<TConfig> = {
     /**
      * Persisted per-account client fingerprint identity (subscription-client-
      * fingerprint #7, P2). OPTIONAL, additive, NON-secret metadata (kept OUTSIDE the
-     * encrypted `tokens` block) — an existing `tokens.json` without it parses
+     * encrypted `tokens` block) an existing `tokens.json` without it parses
      * unchanged. Written through by the daemon on a first-seen freeze / TTL refresh;
      * seeded back into the in-memory identity store at boot so a claude account's
      * replayed identity survives restart.
@@ -220,7 +222,7 @@ type AccountTokensConfig = {
 };
 /**
  * Secret-free view of a per-account/global/provider proxy (upstream-proxy). The
- * password is NEVER carried — only a `hasPassword` presence flag plus a
+ * password is NEVER carried only a `hasPassword` presence flag plus a
  * display-safe `host:port` endpoint (userinfo stripped). Rendered in the admin
  * accounts view.
  */
@@ -241,6 +243,12 @@ type SanitizedProxyConfig = {
 type SubscriptionAccountSanitized = {
     id: string;
     label?: string;
+    /** Explicit scheduling switch. Legacy rows are projected as enabled. */
+    enabled: boolean;
+    /** Effective group (provider id when the persisted group is absent). */
+    group: string;
+    /** Searchable non-secret operator tags. */
+    tags: string[];
     status: TokenStatus;
     authMethod?: string;
     subscriptionLevel?: string;
@@ -249,60 +257,69 @@ type SubscriptionAccountSanitized = {
     isSetupToken?: boolean;
     hasAccessToken: boolean;
     isActive: boolean;
+    /** Derived current eligibility after operator, live-health, and allowance gates. */
+    schedulable: boolean;
+    /** Read-only allowance policy projection. Absent on older daemons. */
+    allowanceAction?: 'normal' | 'demote' | 'pause' | 'ignore';
+    /** Priority after the allowance policy's optional demotion penalty. */
+    allowanceEffectivePriority?: number;
+    /** Highest fresh allowance-window consumption used for this decision. */
+    allowanceUsedPercent?: number;
+    /** Known reset/deadline associated with the allowance decision. */
+    allowanceResumeAt?: string;
+    /** Redacted and bounded credential diagnostic, when the provider recorded one. */
+    errorMessage?: string;
     /**
-     * Scheduling precedence (subscription-account-scheduling) — editable in the
-     * admin accounts view so an operator can order a pool. Absent ⇒ default 50.
+     * Scheduling precedence (subscription-account-scheduling) editable in the
+     * admin accounts view so an operator can order a pool. Absent default 50.
      */
     priority?: number;
     /**
      * ISO timestamp of the last scheduler selection (display-only in the admin
-     * accounts view). Absent ⇒ never selected (or the best-effort persist has not
+     * accounts view). Absent never selected (or the best-effort persist has not
      * yet flushed).
      */
     lastUsedAt?: string;
     /**
-     * Credential-sync warning for this account (external-cli-sync). Carries the
-     * persisted code when one was recorded by a failed refresh, plus the
-     * list-time computed codes (`external-divergent` / `duplicate-token`).
+     * Managed-account credential warning. The daemon retains duplicate-token
+     * warnings without consulting native CLI credential files.
      */
     syncWarning?: SyncWarningCode;
     /**
-     * Live scheduling-health state (subscription-account-health) — in-memory, never
-     * persisted. Absent / `'healthy'` ⇒ eligible; the rest mean the account is
+     * Live scheduling-health state (subscription-account-health) in-memory, never
+     * persisted. Absent / `'healthy'` eligible; the rest mean the account is
      * currently excluded from the pool (multi-account) or would surface the
      * upstream's error (single-account). Secret-free.
      */
-    health?: 'healthy' | 'rate_limited' | 'overloaded' | 'transient' | 'blocked';
+    health?: 'healthy' | 'rate_limited' | 'overloaded' | 'transient' | 'quota_exhausted' | 'blocked';
     /**
      * ISO instant the current health cooldown elapses (absent for healthy /
-     * permanently-blocked). Lets the admin view render "rate-limited until …".
+     * permanently-blocked). Lets the admin view render "rate-limited until .
      */
     cooldownUntil?: string;
     /**
-     * Secret-free view of this account's proxy override (upstream-proxy). Absent ⇒
-     * no per-account proxy configured. The password is masked to a `hasPassword`
-     * flag — never returned.
+     * Secret-free view of this account's proxy override (upstream-proxy). Absent    * no per-account proxy configured. The password is masked to a `hasPassword`
+     * flag never returned.
      */
     proxy?: SanitizedProxyConfig;
     /**
-     * Per-account model support / logical→actual remap (subscription-account-model-map)
-     * — editable in the admin accounts view. Carried verbatim (secret-free — model
-     * ids are not token material): an array allow-list or an object logical→actual
-     * map. Absent ⇒ the account supports every model with no remap.
+     * Per-account model support / logicaltual remap (subscription-account-model-map)
+     * editable in the admin accounts view. Carried verbatim (secret-free model
+     * ids are not token material): an array allow-list or an object logicaltual
+     * map. Absent the account supports every model with no remap.
      */
     supportedModels?: string[] | Record<string, string>;
     /**
-     * COARSE client-fingerprint status (subscription-client-fingerprint #7, D7) —
-     * whether THIS account has a captured/frozen client identity in the in-memory
-     * store. Present only when fingerprint replay is ENABLED (else absent ⇒ the UI
-     * shows nothing). Secret-free by construction: it is a BOOLEAN only — the raw
+     * COARSE client-fingerprint status (subscription-client-fingerprint #7, D7)    * whether THIS account has a captured/frozen client identity in the in-memory
+     * store. Present only when fingerprint replay is ENABLED (else absent the UI
+     * shows nothing). Secret-free by construction: it is a BOOLEAN only the raw
      * captured headers are NEVER surfaced here (nor in any admin view).
      */
     identityCaptured?: boolean;
     /**
      * ISO instant this account's fingerprint identity was frozen / last TTL-refreshed
      * (subscription-client-fingerprint #7, D7). Present only alongside
-     * `identityCaptured === true`. Coarse timestamp only — never the headers.
+     * `identityCaptured === true`. Coarse timestamp only never the headers.
      */
     identityCapturedAt?: string;
 };

package/dist/account-tokens-types.d.ts

@@ -12,13 +12,13 @@ import { OpenCodeGoTokenConfig } from './subscription-types.js';
 /**
  * Upstream proxy descriptor (upstream-proxy). Routes an outbound upstream call
  * through an http/https or socks5 proxy. Two interchangeable shapes:
- *  - `{ url }`      — a full proxy URL, e.g. `http://user:pass@host:1080` or
+ *  - `{ url }`      a full proxy URL, e.g. `http://user:pass@host:1080` or
  *                     `socks5://host:1080` (userinfo carries basic-auth).
- *  - structured     — an explicit `{ type, host, port, username?, password? }`.
+ *  - structured     an explicit `{ type, host, port, username, password }`.
  *
  * `username`/`password` are SECRETS: encrypted at rest via the same envelope as
  * other credentials, masked in every sanitized/admin view, and never logged
- * (logs carry at most `host:port`). Additive everywhere it appears — absent ⇒ a
+ * (logs carry at most `host:port`). Additive everywhere it appears absent a
  * direct (non-proxied) call, byte-identical to before proxy support.
  */
 type ProxyConfig = {
@@ -35,9 +35,9 @@ type ProxyConfig = {
  * The frozen fingerprint headers a real Claude Code client sent for this account,
  * captured + replayed so relayed traffic presents a stable identity across
  * restarts. NON-secret metadata: it holds ONLY whitelisted fingerprint headers
- * (`x-stainless-*` / user-agent / anthropic-beta / x-app / CC headers) — NEVER
+ * (`x-stainless-*` / user-agent / anthropic-beta / x-app / CC headers) NEVER
  * `authorization` / `x-api-key` / `cookie` (excluded at capture AND at
- * store-normalize). Additive + OPTIONAL — an existing `tokens.json` without it
+ * store-normalize). Additive + OPTIONAL an existing `tokens.json` without it
  * parses unchanged (the account re-captures from a real client). Because it is
  * non-secret it lives on the entry OUTSIDE the encrypted `tokens` block and is
  * not walked by the secrets encryptor.
@@ -65,17 +65,13 @@ type SubscriptionLevel = 'Free' | 'Pro' | 'Max';
  */
 type TokenStatus = 'unconfigured' | 'authorized' | 'configured' | 'expired' | 'error';
 /**
- * Machine-readable credential-sync warning code (external-cli-sync).
+ * Machine-readable managed-account credential warning code.
  *
- * - `external-divergent`: the external CLI's native credential file (e.g.
- *   `~/.claude/.credentials.json`) holds a DIFFERENT, fresher credential than
- *   the stored account — the stored refresh token may have been rotated out.
- * - `external-not-rotated`: a refresh failed and the external file holds the
- *   SAME dead credential — a genuine revocation, re-login is required.
- * - `duplicate-token`: two accounts of one provider share the same credential —
- *   refreshing one will invalidate the other (single-use refresh tokens).
+ * `duplicate-token` means two managed accounts of one provider share the same
+ * credential. Native CLI credential files are not compared by normal account
+ * listing or refresh paths.
  */
-type SyncWarningCode = 'external-divergent' | 'external-not-rotated' | 'duplicate-token';
+type SyncWarningCode = 'duplicate-token';
 /**
  * Claude token configuration
  */
@@ -91,8 +87,8 @@ type ClaudeTokenConfig = {
     setupTokenExpiresAt?: string;
     lastRefreshedAt?: string;
     errorMessage?: string;
-    /** Persisted credential-sync warning (external-cli-sync); cleared on a
-     *  successful refresh / import. */
+    /** Managed-account credential warning; duplicate-token may be projected on
+     *  account listing. */
     syncWarning?: SyncWarningCode;
 };
 /**
@@ -110,8 +106,8 @@ type CodexTokenConfig = {
     organizationId?: string;
     lastRefreshedAt?: string;
     errorMessage?: string;
-    /** Persisted credential-sync warning (external-cli-sync); cleared on a
-     *  successful refresh / import. */
+    /** Managed-account credential warning; duplicate-token may be projected on
+     *  account listing. */
     syncWarning?: SyncWarningCode;
 };
 /**
@@ -137,47 +133,53 @@ type GeminiTokenConfig = {
 type SubscriptionAccountEntry<TConfig> = {
     /** Stable, generated id (`crypto.randomUUID()`). */
     id: string;
-    /** User-supplied label; default "账号 N" / "Account N". */
+    /** User-supplied label; default "N" / "Account N". */
     label?: string;
+    /** Whether the scheduler may select this account. Absent on legacy rows means true. */
+    enabled?: boolean;
+    /** Operator-defined account-pool group. Absent rows are presented in their provider group. */
+    group?: string;
+    /** Searchable operator metadata. Tags are non-secret and normalized on write. */
+    tags?: string[];
     /** ISO creation timestamp. */
     createdAt?: string;
     /**
      * Scheduling precedence in the account pool (subscription-account-scheduling).
-     * Lower = higher precedence; default `50` when absent (CRS `parseInt(x,10) || 50`
-     * parity). OPTIONAL — an existing `tokens.json` without it parses unchanged and
+     * Lower = higher precedence; default `50` when absent. OPTIONAL: an existing
+     * `tokens.json` without it parses unchanged and
      * every account defaults to 50.
      */
     priority?: number;
     /**
      * ISO timestamp of the last time this account was selected to serve a request
      * (subscription-account-scheduling LRU tie-break input). OPTIONAL, best-effort
-     * throttled persist — the selector's in-memory overlay is the authoritative live
+     * throttled persist the selector's in-memory overlay is the authoritative live
      * value; an account without it sorts as least-recently-used (timestamp `0`).
      */
     lastUsedAt?: string;
     /**
      * Per-account upstream proxy override (upstream-proxy). When set, this
      * account's relay + OAuth-refresh traffic is routed through this proxy,
-     * WINNING over the per-provider and global proxy layers. OPTIONAL — an
-     * existing `tokens.json` without it parses unchanged (no proxy → direct). Its
+     * WINNING over the per-provider and global proxy layers. OPTIONAL an
+     * existing `tokens.json` without it parses unchanged (no proxy direct). Its
      * `password` is a secret: encrypted at rest by the tokens `SecretBox` walker
      * and masked in the sanitized view.
      */
     proxy?: ProxyConfig;
     /**
-     * Per-account model support + logical→actual remap (subscription-account-model-map).
-     * CRS dual-format, OPTIONAL — an existing `tokens.json` without it parses
+     * Per-account model support + logicaltual remap (subscription-account-model-map).
+     * Supports both allow-list and logical-to-actual mapping formats. OPTIONAL: an existing `tokens.json` without it parses
      * unchanged (the account supports every model and never remaps, byte-identical
      * to before this change):
-     *  - **array** `["a","b"]` — an ALLOW-LIST: the account supports ONLY these
-     *    logical models (skip-only, no remap). In a ≥2-account pool the account is
+     *  - **array** `["a","b"]` an ALLOW-LIST: the account supports ONLY these
+     *    logical models (skip-only, no remap). In a -account pool the account is
      *    routed AROUND for any other model.
-     *  - **object** `{ "a": "X", "b": "Y" }` — the keys are the same allow-list AND
+     *  - **object** `{ "a": "X", "b": "Y" }` the keys are the same allow-list AND
      *    each value is the account's ACTUAL upstream model, so a selected account
      *    remaps the logical model to its actual model on the outbound request.
      *
-     * Model-support filtering only applies when the provider has ≥2 accounts (the
-     * same gate as account health) — a sole account is never model-gated
+     * Model-support filtering only applies when the provider has  accounts (the
+     * same gate as account health) a sole account is never model-gated
      * (never-strand; the upstream stays authoritative). A sole account that must
      * serve a logical model AS a different actual model uses the OBJECT map (remap),
      * not skip.
@@ -186,7 +188,7 @@ type SubscriptionAccountEntry<TConfig> = {
     /**
      * Persisted per-account client fingerprint identity (subscription-client-
      * fingerprint #7, P2). OPTIONAL, additive, NON-secret metadata (kept OUTSIDE the
-     * encrypted `tokens` block) — an existing `tokens.json` without it parses
+     * encrypted `tokens` block) an existing `tokens.json` without it parses
      * unchanged. Written through by the daemon on a first-seen freeze / TTL refresh;
      * seeded back into the in-memory identity store at boot so a claude account's
      * replayed identity survives restart.
@@ -220,7 +222,7 @@ type AccountTokensConfig = {
 };
 /**
  * Secret-free view of a per-account/global/provider proxy (upstream-proxy). The
- * password is NEVER carried — only a `hasPassword` presence flag plus a
+ * password is NEVER carried only a `hasPassword` presence flag plus a
  * display-safe `host:port` endpoint (userinfo stripped). Rendered in the admin
  * accounts view.
  */
@@ -241,6 +243,12 @@ type SanitizedProxyConfig = {
 type SubscriptionAccountSanitized = {
     id: string;
     label?: string;
+    /** Explicit scheduling switch. Legacy rows are projected as enabled. */
+    enabled: boolean;
+    /** Effective group (provider id when the persisted group is absent). */
+    group: string;
+    /** Searchable non-secret operator tags. */
+    tags: string[];
     status: TokenStatus;
     authMethod?: string;
     subscriptionLevel?: string;
@@ -249,60 +257,69 @@ type SubscriptionAccountSanitized = {
     isSetupToken?: boolean;
     hasAccessToken: boolean;
     isActive: boolean;
+    /** Derived current eligibility after operator, live-health, and allowance gates. */
+    schedulable: boolean;
+    /** Read-only allowance policy projection. Absent on older daemons. */
+    allowanceAction?: 'normal' | 'demote' | 'pause' | 'ignore';
+    /** Priority after the allowance policy's optional demotion penalty. */
+    allowanceEffectivePriority?: number;
+    /** Highest fresh allowance-window consumption used for this decision. */
+    allowanceUsedPercent?: number;
+    /** Known reset/deadline associated with the allowance decision. */
+    allowanceResumeAt?: string;
+    /** Redacted and bounded credential diagnostic, when the provider recorded one. */
+    errorMessage?: string;
     /**
-     * Scheduling precedence (subscription-account-scheduling) — editable in the
-     * admin accounts view so an operator can order a pool. Absent ⇒ default 50.
+     * Scheduling precedence (subscription-account-scheduling) editable in the
+     * admin accounts view so an operator can order a pool. Absent default 50.
      */
     priority?: number;
     /**
      * ISO timestamp of the last scheduler selection (display-only in the admin
-     * accounts view). Absent ⇒ never selected (or the best-effort persist has not
+     * accounts view). Absent never selected (or the best-effort persist has not
      * yet flushed).
      */
     lastUsedAt?: string;
     /**
-     * Credential-sync warning for this account (external-cli-sync). Carries the
-     * persisted code when one was recorded by a failed refresh, plus the
-     * list-time computed codes (`external-divergent` / `duplicate-token`).
+     * Managed-account credential warning. The daemon retains duplicate-token
+     * warnings without consulting native CLI credential files.
      */
     syncWarning?: SyncWarningCode;
     /**
-     * Live scheduling-health state (subscription-account-health) — in-memory, never
-     * persisted. Absent / `'healthy'` ⇒ eligible; the rest mean the account is
+     * Live scheduling-health state (subscription-account-health) in-memory, never
+     * persisted. Absent / `'healthy'` eligible; the rest mean the account is
      * currently excluded from the pool (multi-account) or would surface the
      * upstream's error (single-account). Secret-free.
      */
-    health?: 'healthy' | 'rate_limited' | 'overloaded' | 'transient' | 'blocked';
+    health?: 'healthy' | 'rate_limited' | 'overloaded' | 'transient' | 'quota_exhausted' | 'blocked';
     /**
      * ISO instant the current health cooldown elapses (absent for healthy /
-     * permanently-blocked). Lets the admin view render "rate-limited until …".
+     * permanently-blocked). Lets the admin view render "rate-limited until .
      */
     cooldownUntil?: string;
     /**
-     * Secret-free view of this account's proxy override (upstream-proxy). Absent ⇒
-     * no per-account proxy configured. The password is masked to a `hasPassword`
-     * flag — never returned.
+     * Secret-free view of this account's proxy override (upstream-proxy). Absent    * no per-account proxy configured. The password is masked to a `hasPassword`
+     * flag never returned.
      */
     proxy?: SanitizedProxyConfig;
     /**
-     * Per-account model support / logical→actual remap (subscription-account-model-map)
-     * — editable in the admin accounts view. Carried verbatim (secret-free — model
-     * ids are not token material): an array allow-list or an object logical→actual
-     * map. Absent ⇒ the account supports every model with no remap.
+     * Per-account model support / logicaltual remap (subscription-account-model-map)
+     * editable in the admin accounts view. Carried verbatim (secret-free model
+     * ids are not token material): an array allow-list or an object logicaltual
+     * map. Absent the account supports every model with no remap.
      */
     supportedModels?: string[] | Record<string, string>;
     /**
-     * COARSE client-fingerprint status (subscription-client-fingerprint #7, D7) —
-     * whether THIS account has a captured/frozen client identity in the in-memory
-     * store. Present only when fingerprint replay is ENABLED (else absent ⇒ the UI
-     * shows nothing). Secret-free by construction: it is a BOOLEAN only — the raw
+     * COARSE client-fingerprint status (subscription-client-fingerprint #7, D7)    * whether THIS account has a captured/frozen client identity in the in-memory
+     * store. Present only when fingerprint replay is ENABLED (else absent the UI
+     * shows nothing). Secret-free by construction: it is a BOOLEAN only the raw
      * captured headers are NEVER surfaced here (nor in any admin view).
      */
     identityCaptured?: boolean;
     /**
      * ISO instant this account's fingerprint identity was frozen / last TTL-refreshed
      * (subscription-client-fingerprint #7, D7). Present only alongside
-     * `identityCaptured === true`. Coarse timestamp only — never the headers.
+     * `identityCaptured === true`. Coarse timestamp only never the headers.
      */
     identityCapturedAt?: string;
 };

package/dist/audit-types.cjs

@@ -26,7 +26,7 @@ module.exports = __toCommonJS(audit_types_exports);
 var DEFAULT_AUDIT_CONFIG = {
   enabled: false,
   captureBodies: false,
-  maxBodyBytes: 8192,
+  maxBodyBytes: -1,
   retentionDays: 7,
   trustForwardedFor: false
 };

package/dist/audit-types.d.cts

@@ -19,8 +19,9 @@
 /**
  * One per-request audit entry (design D1). The metadata fields are recorded
  * whenever audit is `enabled`; the two body snapshots are present ONLY when
- * `captureBodies` is ALSO on, and always after truncation + redaction. NO field
- * ever holds key material, an upstream token, or an Authorization/api-key header.
+ * `captureBodies` is ALSO on, and always after optional truncation + redaction.
+ * NO field ever holds key material, an upstream token, or an
+ * Authorization/api-key header.
  */
 interface AuditRecord {
     /** Unique record id (a generated request id — NOT any secret). */
@@ -54,14 +55,13 @@ interface AuditRecord {
     /** Sanitized error message (present only on a failed relay). */
     error?: string;
     /**
-     * Request body snapshot — present ONLY when `captureBodies`, truncated to the
-     * configured cap, and ALWAYS run through the secret-redaction pass first.
+     * Request body snapshot — present ONLY when `captureBodies`, optionally
+     * truncated to the configured cap, and ALWAYS run through secret redaction.
      */
     requestBody?: string;
     /**
-     * Response body snapshot — present ONLY when `captureBodies` AND the response
-     * was NON-streaming (a streaming response records metadata only), truncated +
-     * redacted like `requestBody`.
+     * Response body snapshot — present ONLY when `captureBodies`; streaming
+     * responses are included. Optionally truncated + redacted like `requestBody`.
      */
     responseBody?: string;
 }
@@ -74,9 +74,9 @@ interface AuditRecord {
 interface AuditConfig {
     /** Master switch; default FALSE (zero regression). */
     enabled: boolean;
-    /** Capture request/response bodies too (redacted+truncated); default FALSE. */
+    /** Capture request/response bodies too (redacted and optionally truncated); default FALSE. */
     captureBodies: boolean;
-    /** Per-body truncation cap in bytes; default 8192, clamped. */
+    /** Per-body truncation cap in bytes. `-1` disables truncation; default `-1`. */
     maxBodyBytes: number;
     /** TTL retention in days; default 7, clamped `[1, 365]`. */
     retentionDays: number;
@@ -94,5 +94,12 @@ declare const DEFAULT_AUDIT_CONFIG: AuditConfig;
 interface AuditQueryResult {
     records: AuditRecord[];
 }
+/** Metadata-only aggregate for an audit time window (body payloads are never returned). */
+interface AuditStats {
+    requestCount: number;
+    errorCount: number;
+    /** False when the store could not produce an exact aggregate. */
+    complete: boolean;
+}
 
-export { type AuditConfig, type AuditQueryResult, type AuditRecord, DEFAULT_AUDIT_CONFIG };
+export { type AuditConfig, type AuditQueryResult, type AuditRecord, type AuditStats, DEFAULT_AUDIT_CONFIG };