@omnicross/core 0.1.1 → 0.1.3

package/dist/chunk-5ENKBSWO.js

@@ -0,0 +1,311 @@
+// src/pipeline/SubscriptionAccountHealth.ts
+var OVERLOAD_TTL_MS = 10 * 6e4;
+var OVERLOAD_ENABLED_DEFAULT = true;
+var AUTH_ERROR_TTL_MS = 30 * 6e4;
+var SERVER_ERROR_TTL_MS = 5 * 6e4;
+var BAN_BODY_MARKERS = [
+  "this organization has been disabled",
+  "oauth authentication is currently not allowed"
+];
+function readHeader(headers, name) {
+  if (typeof headers.get === "function") {
+    return headers.get(name);
+  }
+  const rec = headers;
+  return rec[name] ?? rec[name.toLowerCase()] ?? null;
+}
+function parseIntHeader(value) {
+  if (value == null) return null;
+  const n = Number.parseInt(value.trim(), 10);
+  return Number.isFinite(n) ? n : null;
+}
+function resolveResetSeconds(providerId, headers) {
+  const unified = parseIntHeader(readHeader(headers, "anthropic-ratelimit-unified-reset"));
+  if (providerId === "claude") {
+    return { resetHeaderSeconds: unified, retryAfterSeconds: null };
+  }
+  const providerReset = parseIntHeader(readHeader(headers, "x-ratelimit-reset")) ?? parseIntHeader(readHeader(headers, "ratelimit-reset"));
+  const retryAfter = parseIntHeader(readHeader(headers, "retry-after"));
+  return {
+    resetHeaderSeconds: unified ?? providerReset,
+    retryAfterSeconds: retryAfter
+  };
+}
+function isBanBody(bodyText) {
+  if (!bodyText) return false;
+  const lower = bodyText.toLowerCase();
+  return BAN_BODY_MARKERS.some((marker) => lower.includes(marker));
+}
+function isRecordEmpty(record) {
+  return record.rateLimitEndAt === void 0 && record.overloadUntil === void 0 && record.tempUnavailableUntil === void 0 && !record.blocked;
+}
+var KEY_SEP = "\0";
+var SubscriptionAccountHealth = class {
+  records = /* @__PURE__ */ new Map();
+  listeners = /* @__PURE__ */ new Set();
+  anomalyListeners = /* @__PURE__ */ new Set();
+  now;
+  overloadEnabled;
+  overloadTtlMs;
+  authErrorTtlMs;
+  serverErrorTtlMs;
+  constructor(opts = {}) {
+    this.now = opts.now ?? Date.now;
+    this.overloadEnabled = opts.overloadEnabled ?? OVERLOAD_ENABLED_DEFAULT;
+    this.overloadTtlMs = opts.overloadTtlMs ?? OVERLOAD_TTL_MS;
+    this.authErrorTtlMs = opts.authErrorTtlMs ?? AUTH_ERROR_TTL_MS;
+    this.serverErrorTtlMs = opts.serverErrorTtlMs ?? SERVER_ERROR_TTL_MS;
+  }
+  /**
+   * Re-apply cooldown config to the LIVE shared instance (subscription-account-
+   * health, LEAD OQ1). `buildDaemon` is synchronous so it cannot await the
+   * persisted server config; the async `start.ts` path loads it and applies the
+   * `accountHealth` segment here — every strategy/relay/sweeper that already
+   * captured this instance picks the new values up. Only defined fields override.
+   */
+  configure(opts) {
+    if (opts.overloadEnabled !== void 0) this.overloadEnabled = opts.overloadEnabled;
+    if (opts.overloadTtlMs !== void 0) this.overloadTtlMs = opts.overloadTtlMs;
+    if (opts.authErrorTtlMs !== void 0) this.authErrorTtlMs = opts.authErrorTtlMs;
+    if (opts.serverErrorTtlMs !== void 0) this.serverErrorTtlMs = opts.serverErrorTtlMs;
+  }
+  /**
+   * Whether an account may be scheduled RIGHT NOW. `blocked` → false; any timer
+   * still in the future → false. Expired timers are lazily deleted on read (CRS
+   * lazy-clear parity) so an elapsed cooldown restores the account WITHOUT a
+   * timer — but the recovery SIGNAL is the sweeper's job (`sweepRecoveries`), so
+   * this read never emits (correctness is independent of the tick).
+   */
+  isSchedulable(providerId, accountId, now = this.now()) {
+    const key = this.key(providerId, accountId);
+    const record = this.records.get(key);
+    if (!record) return true;
+    if (record.blocked) return false;
+    const active = this.clearExpired(record, now);
+    if (!active && isRecordEmpty(record)) this.records.delete(key);
+    return !active;
+  }
+  /**
+   * The single marking entry point (design D3). Faithful to CRS status semantics:
+   *  - 429 + authoritative reset → `rateLimitEndAt`; a non-claude 429 may use
+   *    `retryAfterSeconds`; a bare 429 (no resolvable reset) is NOT marked;
+   *  - 529 → `overloadUntil` (gated by `overloadEnabled`);
+   *  - 403-ban body → `blocked` (permanent); plain 403 → transient;
+   *  - final-401 → transient; 5xx / thrown(null) → transient;
+   *  - non-429 4xx → NEUTRAL (never marked);
+   *  - 2xx → clear rate-limit + transient state (keep `blocked`).
+   */
+  recordUpstreamOutcome(providerId, accountId, input) {
+    const now = input.now ?? this.now();
+    const key = this.key(providerId, accountId);
+    const preExisting = this.records.get(key);
+    const record = preExisting ?? {};
+    const status = input.status;
+    const wasUnhealthyBefore = preExisting ? this.isUnhealthyAt(preExisting, now) : false;
+    let anomalyState;
+    let recovered = false;
+    if (status === null) {
+      record.tempUnavailableUntil = now + this.serverErrorTtlMs;
+    } else if (status >= 200 && status < 300) {
+      const wasUnhealthy = record.rateLimitEndAt !== void 0 || record.overloadUntil !== void 0 || record.tempUnavailableUntil !== void 0;
+      delete record.rateLimitEndAt;
+      delete record.overloadUntil;
+      delete record.tempUnavailableUntil;
+      recovered = wasUnhealthy && !record.blocked;
+    } else if (status === 429) {
+      if (input.resetHeaderSeconds != null) {
+        record.rateLimitEndAt = input.resetHeaderSeconds * 1e3;
+        anomalyState = "rate_limited";
+      } else if (input.retryAfterSeconds != null) {
+        record.rateLimitEndAt = now + input.retryAfterSeconds * 1e3;
+        anomalyState = "rate_limited";
+      }
+    } else if (status === 529) {
+      if (this.overloadEnabled) {
+        record.overloadUntil = now + this.overloadTtlMs;
+        anomalyState = "overloaded";
+      }
+    } else if (status === 403) {
+      if (isBanBody(input.bodyText)) {
+        record.blocked = true;
+        anomalyState = "blocked";
+      } else {
+        record.tempUnavailableUntil = now + this.authErrorTtlMs;
+        anomalyState = "unauthorized";
+      }
+    } else if (status === 401) {
+      record.tempUnavailableUntil = now + this.authErrorTtlMs;
+      anomalyState = "unauthorized";
+    } else if (status >= 500) {
+      record.tempUnavailableUntil = now + this.serverErrorTtlMs;
+    }
+    if (isRecordEmpty(record)) this.records.delete(key);
+    else this.records.set(key, record);
+    if (recovered) this.emit({ providerId, accountId, at: now, kind: "rateLimitRecovery" });
+    if (anomalyState && !wasUnhealthyBefore) {
+      this.emitAnomaly({ providerId, accountId, at: now, state: anomalyState });
+    }
+  }
+  /** Whether a record is unhealthy at `now`: blocked, or any timer still future. */
+  isUnhealthyAt(record, now) {
+    if (record.blocked) return true;
+    if (record.rateLimitEndAt !== void 0 && now < record.rateLimitEndAt) return true;
+    if (record.overloadUntil !== void 0 && now < record.overloadUntil) return true;
+    if (record.tempUnavailableUntil !== void 0 && now < record.tempUnavailableUntil) return true;
+    return false;
+  }
+  /**
+   * Clear ONLY the auth/transient unavailability mark (`tempUnavailableUntil`) —
+   * the narrow healing a background PROBE is allowed to do (subscription-account-
+   * probe #8, review M1). A probe 2xx from the lightweight `GET /v1/models` attests
+   * the TOKEN works (so a final-401 / plain-403 / 5xx transient may be healed), but
+   * it does NOT prove the traffic endpoint's rate-limit / overload has recovered —
+   * so it MUST NOT touch `rateLimitEndAt` / `overloadUntil` (those clear only on the
+   * upstream's authoritative reset, or a REAL-traffic 2xx). `blocked` (a ban) is
+   * never cleared here. Distinct from `recordUpstreamOutcome`'s 2xx path, which is
+   * UNCHANGED and still clears rate + transient together because it IS traffic.
+   * Returns whether a transient mark was actually cleared. Does NOT emit a recovery
+   * signal (a probe is internal maintenance; the account is schedulable-on-read).
+   */
+  clearTransientMark(providerId, accountId) {
+    const key = this.key(providerId, accountId);
+    const record = this.records.get(key);
+    if (!record || record.tempUnavailableUntil === void 0) return false;
+    delete record.tempUnavailableUntil;
+    if (isRecordEmpty(record)) this.records.delete(key);
+    else this.records.set(key, record);
+    return true;
+  }
+  /**
+   * Proactively surface accounts that transitioned unhealthy → schedulable since
+   * the last sweep (design D6). Clears their expired timers, emits a recovery
+   * signal for each through `onRecovered`, and returns the list. A `blocked`
+   * account never recovers here. Correctness does NOT depend on this running —
+   * `isSchedulable` already restores an elapsed cooldown lazily; this adds the
+   * proactive signal (#5/#8) + lets the daemon nudge a token refresh.
+   */
+  sweepRecoveries(now = this.now()) {
+    const recovered = [];
+    for (const [key, record] of this.records) {
+      if (record.blocked) continue;
+      const hadTimer = record.rateLimitEndAt !== void 0 || record.overloadUntil !== void 0 || record.tempUnavailableUntil !== void 0;
+      const active = this.clearExpired(record, now);
+      if (hadTimer && !active && isRecordEmpty(record)) {
+        const [pid, aid] = this.parseKey(key);
+        recovered.push({ providerId: pid, accountId: aid, at: now, kind: "rateLimitRecovery" });
+        this.records.delete(key);
+      }
+    }
+    for (const event of recovered) this.emit(event);
+    return recovered;
+  }
+  /** Admin-facing coarse status + cooldown-until for one account (secret-free). */
+  getStatus(providerId, accountId, now = this.now()) {
+    const record = this.records.get(this.key(providerId, accountId));
+    if (!record) return { state: "healthy" };
+    if (record.blocked) return { state: "blocked" };
+    if (record.rateLimitEndAt !== void 0 && now < record.rateLimitEndAt) {
+      return { state: "rate_limited", cooldownUntil: record.rateLimitEndAt };
+    }
+    if (record.overloadUntil !== void 0 && now < record.overloadUntil) {
+      return { state: "overloaded", cooldownUntil: record.overloadUntil };
+    }
+    if (record.tempUnavailableUntil !== void 0 && now < record.tempUnavailableUntil) {
+      return { state: "transient", cooldownUntil: record.tempUnavailableUntil };
+    }
+    return { state: "healthy" };
+  }
+  /**
+   * Register a recovery listener (the OQ3 seam #5 webhooks + #8 health-cron
+   * consume). Returns an unsubscribe function. Two edges fire it:
+   *  - TRAFFIC-DRIVEN: a `recordUpstreamOutcome` 2xx that clears an unhealthy
+   *    account (guaranteed — the sweep would miss it, as the 2xx deletes the
+   *    record first); and
+   *  - PURE-IDLE: `sweepRecoveries` when an idle account's cooldown elapsed with
+   *    no traffic (best-effort, on the 60s tick).
+   * A lazy `isSchedulable` read that heals an account does NOT emit (a request is
+   * already using it) — so consumers never double-count a recovery.
+   */
+  onRecovered(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  emit(event) {
+    for (const listener of this.listeners) {
+      try {
+        listener(event);
+      } catch {
+      }
+    }
+  }
+  /**
+   * Register an anomaly listener (the ADDITIVE seam #5 webhooks consumes; the
+   * frozen `kind` discriminator on {@link AccountRecoveryEvent} anticipated it).
+   * Fires ONLY on the healthy→unhealthy EDGE inside `recordUpstreamOutcome`
+   * (de-duped: an already-unhealthy account escalating does NOT re-fire). Returns
+   * an unsubscribe function. Existing marking/recovery behavior is UNCHANGED.
+   */
+  onAnomaly(listener) {
+    this.anomalyListeners.add(listener);
+    return () => this.anomalyListeners.delete(listener);
+  }
+  emitAnomaly(event) {
+    for (const listener of this.anomalyListeners) {
+      try {
+        listener(event);
+      } catch {
+      }
+    }
+  }
+  /**
+   * Delete every EXPIRED timer field on the record in place; return whether any
+   * timer is STILL active (in the future). `blocked` is not a timer and is left
+   * untouched here (only an explicit reset / restart clears a ban).
+   */
+  clearExpired(record, now) {
+    let active = false;
+    if (record.rateLimitEndAt !== void 0) {
+      if (now >= record.rateLimitEndAt) delete record.rateLimitEndAt;
+      else active = true;
+    }
+    if (record.overloadUntil !== void 0) {
+      if (now >= record.overloadUntil) delete record.overloadUntil;
+      else active = true;
+    }
+    if (record.tempUnavailableUntil !== void 0) {
+      if (now >= record.tempUnavailableUntil) delete record.tempUnavailableUntil;
+      else active = true;
+    }
+    return active;
+  }
+  key(providerId, accountId) {
+    return `${providerId}${KEY_SEP}${accountId}`;
+  }
+  parseKey(key) {
+    const idx = key.indexOf(KEY_SEP);
+    return [key.slice(0, idx), key.slice(idx + 1)];
+  }
+};
+var _shared = null;
+function getSharedAccountHealth() {
+  if (!_shared) _shared = new SubscriptionAccountHealth();
+  return _shared;
+}
+function setSharedAccountHealth(instance) {
+  _shared = instance;
+}
+function __resetSharedAccountHealthForTests() {
+  _shared = null;
+}
+
+export {
+  OVERLOAD_TTL_MS,
+  OVERLOAD_ENABLED_DEFAULT,
+  AUTH_ERROR_TTL_MS,
+  SERVER_ERROR_TTL_MS,
+  resolveResetSeconds,
+  SubscriptionAccountHealth,
+  getSharedAccountHealth,
+  setSharedAccountHealth,
+  __resetSharedAccountHealthForTests
+};

package/dist/chunk-5ERIZW3D.js

@@ -0,0 +1,44 @@
+// src/pipeline/resolveSubscriptionChain.ts
+function resolveOne(transformerService, name) {
+  const t = transformerService.getTransformer(name);
+  if (!t) return null;
+  return typeof t === "function" ? new t() : t;
+}
+function resolveSubscriptionChain(profile, transformerService, fallbackEndpoint, overrideNames) {
+  const providerNames = overrideNames ?? profile.providerTransformerNames ?? [];
+  const modelNames = profile.modelTransformerNames ?? [];
+  if (providerNames.length === 0) {
+    return { providerTransformers: [fallbackEndpoint], modelTransformers: [] };
+  }
+  if (!transformerService) {
+    throw new Error(
+      "[resolveSubscriptionChain] profile declares providerTransformerNames but no TransformerService is wired"
+    );
+  }
+  const providerTransformers = [];
+  for (const name of providerNames) {
+    const instance = resolveOne(transformerService, name);
+    if (!instance) {
+      console.warn(`[resolveSubscriptionChain] Transformer not registered: ${name}`);
+      continue;
+    }
+    providerTransformers.push(instance);
+  }
+  const modelTransformers = [];
+  for (const name of modelNames) {
+    const instance = resolveOne(transformerService, name);
+    if (!instance) {
+      console.warn(`[resolveSubscriptionChain] Model transformer not registered: ${name}`);
+      continue;
+    }
+    modelTransformers.push(instance);
+  }
+  if (providerTransformers.length === 0) {
+    return { providerTransformers: [fallbackEndpoint], modelTransformers };
+  }
+  return { providerTransformers, modelTransformers };
+}
+
+export {
+  resolveSubscriptionChain
+};