@omnicross/core 0.1.2 → 0.1.3

package/dist/pipeline/SubscriptionAccountHealth.d.ts

@@ -0,0 +1,235 @@
+/**
+ * SubscriptionAccountHealth — the in-memory account health state machine
+ * (subscription-account-health, design D1/D2/D3/D6).
+ *
+ * Shaped like the existing per-model `CircuitBreaker` (`opencodego/CircuitBreaker`):
+ * an in-memory `Map`, an injectable `now` clock, and NO external deps / NO
+ * persistence. It is keyed by an opaque `providerId + '\0' + accountId` string —
+ * core never learns "account" semantics, exactly as the breaker keys by opaque
+ * `modelId`. It is hosted in `@omnicross/core` because all three consumers reach
+ * it in the allowed dependency direction:
+ *   - the subscriptions strategies COMPUTE `schedulable` (`isSchedulable`) + mark
+ *     a final-401;
+ *   - the core `/v1/messages` relay MARKS 429/529/403/5xx from the upstream
+ *     response (`recordUpstreamOutcome`);
+ *   - the daemon `AccountHealthSweeper` drives proactive recovery
+ *     (`sweepRecoveries` + `onRecovered`).
+ *
+ * It carries NO secrets — only statuses + epoch-ms timers — so the secret-free
+ * discipline is untouched. Health is IN-MEMORY (cleared on restart): the worst
+ * case after a restart is one request hitting a still-cooling account and getting
+ * the upstream's authoritative 429 (which re-marks it). Nothing is written to
+ * `tokens.json`.
+ *
+ * @module pipeline/SubscriptionAccountHealth
+ */
+/** Default 529 overload cooldown (LEAD OQ1: ON by default, bounded 10 min). */
+declare const OVERLOAD_TTL_MS: number;
+/** 529 overload cooldown enabled by default (LEAD OQ1). */
+declare const OVERLOAD_ENABLED_DEFAULT = true;
+/** Transient cooldown for a final-401 / plain-403 (CRS auth_error 1800s). */
+declare const AUTH_ERROR_TTL_MS: number;
+/** Transient cooldown for a 5xx / thrown network failure (CRS server_error 300s). */
+declare const SERVER_ERROR_TTL_MS: number;
+/** Per-account health record (all timers are epoch ms). Absent fields ⇒ healthy. */
+interface HealthRecord {
+    /** From a 429 authoritative reset header — rate-limited until this instant. */
+    rateLimitEndAt?: number;
+    /** From a 529 overload — in overload cooldown until this instant. */
+    overloadUntil?: number;
+    /** From a final-401 / plain-403 / 5xx / thrown — transient cooldown until this. */
+    tempUnavailableUntil?: number;
+    /** From a 403-ban — permanent, self-heal never clears it. */
+    blocked?: boolean;
+}
+/** The coarse health state surfaced to the admin accounts view (secret-free). */
+type AccountHealthState = 'healthy' | 'rate_limited' | 'overloaded' | 'transient' | 'blocked';
+/** Admin-facing status projection for one account. */
+interface AccountHealthStatus {
+    state: AccountHealthState;
+    /** Epoch ms the current cooldown elapses (absent for healthy / blocked). */
+    cooldownUntil?: number;
+}
+/**
+ * The recovery signal emitted when an account transitions unhealthy → schedulable.
+ * FROZEN here (subscription-account-health OQ3) as the stable seam #5 (webhooks)
+ * and #8 (health-cron) CONSUME — they must not re-derive health.
+ */
+interface AccountRecoveryEvent {
+    /** Opaque provider id ('claude' | 'codex' | 'gemini' | 'opencodego'). */
+    providerId: string;
+    /** The recovered account id. */
+    accountId: string;
+    /** Epoch ms of the recovery observation. */
+    at: number;
+    /** Discriminator so consumers can widen this to an anomaly union later. */
+    kind: 'rateLimitRecovery';
+}
+/** A recovery listener (fire-and-forget; the emitter never awaits it). */
+type AccountRecoveryListener = (event: AccountRecoveryEvent) => void;
+/** The coarse anomaly state an account transitioned into (secret-free). */
+type AccountAnomalyState = 'blocked' | 'unauthorized' | 'rate_limited' | 'overloaded';
+/**
+ * The anomaly signal emitted when a HEALTHY account transitions to unhealthy —
+ * the additive union #5 (webhooks) consumes, which this tracker's frozen `kind`
+ * discriminator (on {@link AccountRecoveryEvent}) explicitly anticipated. ADDITIVE:
+ * it fires ONLY on the healthy→unhealthy EDGE (de-duped) and changes NOTHING about
+ * the existing marking / recovery behavior. A #8 probe failure flows through the
+ * same `recordUpstreamOutcome` path, so anomaly covers it for free.
+ */
+interface AccountAnomalyEvent {
+    /** Opaque provider id ('claude' | 'codex' | 'gemini' | 'opencodego'). */
+    providerId: string;
+    /** The account id that became unhealthy. */
+    accountId: string;
+    /** Epoch ms of the transition. */
+    at: number;
+    /** The coarse state the account entered (mapped from the marking). */
+    state: AccountAnomalyState;
+}
+/** An anomaly listener (fire-and-forget; the emitter never awaits it). */
+type AccountAnomalyListener = (event: AccountAnomalyEvent) => void;
+/** The inputs one upstream attempt contributes to health marking (design D3). */
+interface RecordUpstreamOutcomeInput {
+    /** The final HTTP status, or `null` for a thrown / network failure. */
+    status: number | null;
+    /** Parsed authoritative reset (epoch SECONDS) — `anthropic-ratelimit-unified-reset`. */
+    resetHeaderSeconds?: number | null;
+    /** Parsed `retry-after` DELTA seconds (non-claude fallback, OQ2). */
+    retryAfterSeconds?: number | null;
+    /** Bounded response body text for the 403-ban sniff (only read on a 403). */
+    bodyText?: string;
+    /** Injectable clock (default the tracker's `now`). */
+    now?: number;
+}
+/** Constructor knobs (all default to the exported constants). */
+interface SubscriptionAccountHealthOptions {
+    /** Injectable clock (ms). Default `Date.now`. */
+    now?: () => number;
+    /** Whether a 529 places the account in overload cooldown (LEAD OQ1: ON). */
+    overloadEnabled?: boolean;
+    /** The 529 overload cooldown duration (ms). */
+    overloadTtlMs?: number;
+    /** The final-401 / plain-403 transient cooldown (ms). */
+    authErrorTtlMs?: number;
+    /** The 5xx / thrown transient cooldown (ms). */
+    serverErrorTtlMs?: number;
+}
+/** Minimal structural read over a `Headers` OR a plain header record. */
+type HeadersLike = {
+    get(name: string): string | null;
+} | Record<string, string | undefined>;
+/**
+ * Resolve the 429 cooldown drivers per provider (OQ2 seam) — a single pure
+ * function. claude is STRICT (only the authoritative
+ * `anthropic-ratelimit-unified-reset`, epoch seconds; a bare 429 stays unmarked);
+ * codex / gemini / opencodego additionally accept `retry-after` (delta seconds)
+ * and a provider-specific reset header as the cooldown driver.
+ */
+declare function resolveResetSeconds(providerId: string, headers: HeadersLike): {
+    resetHeaderSeconds: number | null;
+    retryAfterSeconds: number | null;
+};
+declare class SubscriptionAccountHealth {
+    private readonly records;
+    private readonly listeners;
+    private readonly anomalyListeners;
+    private readonly now;
+    private overloadEnabled;
+    private overloadTtlMs;
+    private authErrorTtlMs;
+    private serverErrorTtlMs;
+    constructor(opts?: SubscriptionAccountHealthOptions);
+    /**
+     * Re-apply cooldown config to the LIVE shared instance (subscription-account-
+     * health, LEAD OQ1). `buildDaemon` is synchronous so it cannot await the
+     * persisted server config; the async `start.ts` path loads it and applies the
+     * `accountHealth` segment here — every strategy/relay/sweeper that already
+     * captured this instance picks the new values up. Only defined fields override.
+     */
+    configure(opts: Pick<SubscriptionAccountHealthOptions, 'overloadEnabled' | 'overloadTtlMs' | 'authErrorTtlMs' | 'serverErrorTtlMs'>): void;
+    /**
+     * Whether an account may be scheduled RIGHT NOW. `blocked` → false; any timer
+     * still in the future → false. Expired timers are lazily deleted on read (CRS
+     * lazy-clear parity) so an elapsed cooldown restores the account WITHOUT a
+     * timer — but the recovery SIGNAL is the sweeper's job (`sweepRecoveries`), so
+     * this read never emits (correctness is independent of the tick).
+     */
+    isSchedulable(providerId: string, accountId: string, now?: number): boolean;
+    /**
+     * The single marking entry point (design D3). Faithful to CRS status semantics:
+     *  - 429 + authoritative reset → `rateLimitEndAt`; a non-claude 429 may use
+     *    `retryAfterSeconds`; a bare 429 (no resolvable reset) is NOT marked;
+     *  - 529 → `overloadUntil` (gated by `overloadEnabled`);
+     *  - 403-ban body → `blocked` (permanent); plain 403 → transient;
+     *  - final-401 → transient; 5xx / thrown(null) → transient;
+     *  - non-429 4xx → NEUTRAL (never marked);
+     *  - 2xx → clear rate-limit + transient state (keep `blocked`).
+     */
+    recordUpstreamOutcome(providerId: string, accountId: string, input: RecordUpstreamOutcomeInput): void;
+    /** Whether a record is unhealthy at `now`: blocked, or any timer still future. */
+    private isUnhealthyAt;
+    /**
+     * Clear ONLY the auth/transient unavailability mark (`tempUnavailableUntil`) —
+     * the narrow healing a background PROBE is allowed to do (subscription-account-
+     * probe #8, review M1). A probe 2xx from the lightweight `GET /v1/models` attests
+     * the TOKEN works (so a final-401 / plain-403 / 5xx transient may be healed), but
+     * it does NOT prove the traffic endpoint's rate-limit / overload has recovered —
+     * so it MUST NOT touch `rateLimitEndAt` / `overloadUntil` (those clear only on the
+     * upstream's authoritative reset, or a REAL-traffic 2xx). `blocked` (a ban) is
+     * never cleared here. Distinct from `recordUpstreamOutcome`'s 2xx path, which is
+     * UNCHANGED and still clears rate + transient together because it IS traffic.
+     * Returns whether a transient mark was actually cleared. Does NOT emit a recovery
+     * signal (a probe is internal maintenance; the account is schedulable-on-read).
+     */
+    clearTransientMark(providerId: string, accountId: string): boolean;
+    /**
+     * Proactively surface accounts that transitioned unhealthy → schedulable since
+     * the last sweep (design D6). Clears their expired timers, emits a recovery
+     * signal for each through `onRecovered`, and returns the list. A `blocked`
+     * account never recovers here. Correctness does NOT depend on this running —
+     * `isSchedulable` already restores an elapsed cooldown lazily; this adds the
+     * proactive signal (#5/#8) + lets the daemon nudge a token refresh.
+     */
+    sweepRecoveries(now?: number): AccountRecoveryEvent[];
+    /** Admin-facing coarse status + cooldown-until for one account (secret-free). */
+    getStatus(providerId: string, accountId: string, now?: number): AccountHealthStatus;
+    /**
+     * Register a recovery listener (the OQ3 seam #5 webhooks + #8 health-cron
+     * consume). Returns an unsubscribe function. Two edges fire it:
+     *  - TRAFFIC-DRIVEN: a `recordUpstreamOutcome` 2xx that clears an unhealthy
+     *    account (guaranteed — the sweep would miss it, as the 2xx deletes the
+     *    record first); and
+     *  - PURE-IDLE: `sweepRecoveries` when an idle account's cooldown elapsed with
+     *    no traffic (best-effort, on the 60s tick).
+     * A lazy `isSchedulable` read that heals an account does NOT emit (a request is
+     * already using it) — so consumers never double-count a recovery.
+     */
+    onRecovered(listener: AccountRecoveryListener): () => void;
+    private emit;
+    /**
+     * Register an anomaly listener (the ADDITIVE seam #5 webhooks consumes; the
+     * frozen `kind` discriminator on {@link AccountRecoveryEvent} anticipated it).
+     * Fires ONLY on the healthy→unhealthy EDGE inside `recordUpstreamOutcome`
+     * (de-duped: an already-unhealthy account escalating does NOT re-fire). Returns
+     * an unsubscribe function. Existing marking/recovery behavior is UNCHANGED.
+     */
+    onAnomaly(listener: AccountAnomalyListener): () => void;
+    private emitAnomaly;
+    /**
+     * Delete every EXPIRED timer field on the record in place; return whether any
+     * timer is STILL active (in the future). `blocked` is not a timer and is left
+     * untouched here (only an explicit reset / restart clears a ban).
+     */
+    private clearExpired;
+    private key;
+    private parseKey;
+}
+/** The shared tracker; lazily constructs a default-config instance on first use. */
+declare function getSharedAccountHealth(): SubscriptionAccountHealth;
+/** Install a config-tuned tracker at bootstrap (idempotent; last write wins). */
+declare function setSharedAccountHealth(instance: SubscriptionAccountHealth): void;
+/** Reset the shared singleton (tests / teardown only). */
+declare function __resetSharedAccountHealthForTests(): void;
+
+export { AUTH_ERROR_TTL_MS, type AccountAnomalyEvent, type AccountAnomalyListener, type AccountAnomalyState, type AccountHealthState, type AccountHealthStatus, type AccountRecoveryEvent, type AccountRecoveryListener, type HeadersLike, type HealthRecord, OVERLOAD_ENABLED_DEFAULT, OVERLOAD_TTL_MS, type RecordUpstreamOutcomeInput, SERVER_ERROR_TTL_MS, SubscriptionAccountHealth, type SubscriptionAccountHealthOptions, __resetSharedAccountHealthForTests, getSharedAccountHealth, resolveResetSeconds, setSharedAccountHealth };

package/dist/pipeline/SubscriptionAccountHealth.js

@@ -0,0 +1,22 @@
+import {
+  AUTH_ERROR_TTL_MS,
+  OVERLOAD_ENABLED_DEFAULT,
+  OVERLOAD_TTL_MS,
+  SERVER_ERROR_TTL_MS,
+  SubscriptionAccountHealth,
+  __resetSharedAccountHealthForTests,
+  getSharedAccountHealth,
+  resolveResetSeconds,
+  setSharedAccountHealth
+} from "../chunk-5ENKBSWO.js";
+export {
+  AUTH_ERROR_TTL_MS,
+  OVERLOAD_ENABLED_DEFAULT,
+  OVERLOAD_TTL_MS,
+  SERVER_ERROR_TTL_MS,
+  SubscriptionAccountHealth,
+  __resetSharedAccountHealthForTests,
+  getSharedAccountHealth,
+  resolveResetSeconds,
+  setSharedAccountHealth
+};

package/dist/pipeline/SubscriptionAuthSource.cjs

@@ -1,9 +1,9 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
 
-var _chunkN3V2J5ZOcjs = require('../chunk-N3V2J5ZO.cjs');
+var _chunkY6OM7EV7cjs = require('../chunk-Y6OM7EV7.cjs');
 require('../chunk-SVNDB62D.cjs');
 
 
 
-exports.SubscriptionAuthSource = _chunkN3V2J5ZOcjs.SubscriptionAuthSource; exports.stripAuthHeaders = _chunkN3V2J5ZOcjs.stripAuthHeaders;
+exports.SubscriptionAuthSource = _chunkY6OM7EV7cjs.SubscriptionAuthSource; exports.stripAuthHeaders = _chunkY6OM7EV7cjs.stripAuthHeaders;

package/dist/pipeline/SubscriptionAuthSource.d.cts

@@ -156,8 +156,9 @@ declare class SubscriptionAuthSource implements AuthSource {
      * model }` at the boundary.
      */
     applyHeaders(headers: Record<string, string>, hints: AuthApplyHints): Promise<void>;
-    /** Delegate the 401-refresh decision to the bound strategy. */
-    onUnauthorized(): Promise<boolean>;
+    /** Delegate the 401-refresh decision to the bound strategy, threading the
+     *  session key so the account actually served is the one refreshed (D7). */
+    onUnauthorized(sessionKey?: string): Promise<boolean>;
     /** Resolve the upstream URL from the profile, when it provides one. */
     resolveUpstreamUrl(model: string): string | undefined;
 }

package/dist/pipeline/SubscriptionAuthSource.d.ts

@@ -156,8 +156,9 @@ declare class SubscriptionAuthSource implements AuthSource {
      * model }` at the boundary.
      */
     applyHeaders(headers: Record<string, string>, hints: AuthApplyHints): Promise<void>;
-    /** Delegate the 401-refresh decision to the bound strategy. */
-    onUnauthorized(): Promise<boolean>;
+    /** Delegate the 401-refresh decision to the bound strategy, threading the
+     *  session key so the account actually served is the one refreshed (D7). */
+    onUnauthorized(sessionKey?: string): Promise<boolean>;
     /** Resolve the upstream URL from the profile, when it provides one. */
     resolveUpstreamUrl(model: string): string | undefined;
 }

package/dist/pipeline/SubscriptionAuthSource.js

@@ -1,7 +1,7 @@
 import {
   SubscriptionAuthSource,
   stripAuthHeaders
-} from "../chunk-74TMJA7Z.js";
+} from "../chunk-N5QFKSDO.js";
 import "../chunk-AVYJ4YBN.js";
 export {
   SubscriptionAuthSource,

package/dist/pipeline/SubscriptionAuthStrategy.d.cts

@@ -31,6 +31,24 @@ interface AuthApplyHints {
     upstreamUrl?: string;
     /** Resolved model id — same purpose as `upstreamUrl`. */
     resolvedModel?: string;
+    /**
+     * Stable per-conversation session key (subscription-account-scheduling, D5).
+     * When present it drives the account pool's sticky session affinity; absent ⇒
+     * pure priority/LRU selection (still correct — affinity only loses stickiness).
+     */
+    sessionKey?: string;
+    /**
+     * Per-request selection callback (subscription-account-health, D5;
+     * subscription-account-model-map, D3). The strategy invokes it with the
+     * EFFECTIVE account id it resolved so the relay can mark that account's health
+     * against the upstream outcome. The OPTIONAL 3rd `remappedModel` carries the
+     * selected account's ACTUAL upstream model when its `supportedModels` object
+     * remaps `resolvedModel` — the relay rewrites the outbound `body.model` to it on
+     * the pass-through / same-format path; absent ⇒ the body is forwarded verbatim.
+     * Absent callback ⇒ health simply isn't marked on that path (degrades to the
+     * pre-health behavior).
+     */
+    reportSelection?: (accountId: string, isActive: boolean, remappedModel?: string) => void;
 }
 interface AuthStrategy {
     /** Discriminator — also surfaced through `subscription:list` to renderers. */
@@ -52,8 +70,13 @@ interface AuthStrategy {
      *
      * Implementations SHOULD use a shared `RefreshMutex` to dedupe concurrent
      * refreshes so N parallel 401s collapse into one upstream refresh call.
+     *
+     * The OPTIONAL `sessionKey` (subscription-account-scheduling, D7) refreshes the
+     * account the request was ACTUALLY served by: when it resolves to a sticky
+     * non-active account the strategy refreshes THAT account by id; absent (or an
+     * active pick) ⇒ the active-account refresh, unchanged.
      */
-    onUnauthorized(): Promise<boolean>;
+    onUnauthorized(sessionKey?: string): Promise<boolean>;
     /** Diagnostic surface for the `subscription:status` IPC. */
     describeStatus(): Promise<SubscriptionStatusEntry>;
 }

package/dist/pipeline/SubscriptionAuthStrategy.d.ts

@@ -31,6 +31,24 @@ interface AuthApplyHints {
     upstreamUrl?: string;
     /** Resolved model id — same purpose as `upstreamUrl`. */
     resolvedModel?: string;
+    /**
+     * Stable per-conversation session key (subscription-account-scheduling, D5).
+     * When present it drives the account pool's sticky session affinity; absent ⇒
+     * pure priority/LRU selection (still correct — affinity only loses stickiness).
+     */
+    sessionKey?: string;
+    /**
+     * Per-request selection callback (subscription-account-health, D5;
+     * subscription-account-model-map, D3). The strategy invokes it with the
+     * EFFECTIVE account id it resolved so the relay can mark that account's health
+     * against the upstream outcome. The OPTIONAL 3rd `remappedModel` carries the
+     * selected account's ACTUAL upstream model when its `supportedModels` object
+     * remaps `resolvedModel` — the relay rewrites the outbound `body.model` to it on
+     * the pass-through / same-format path; absent ⇒ the body is forwarded verbatim.
+     * Absent callback ⇒ health simply isn't marked on that path (degrades to the
+     * pre-health behavior).
+     */
+    reportSelection?: (accountId: string, isActive: boolean, remappedModel?: string) => void;
 }
 interface AuthStrategy {
     /** Discriminator — also surfaced through `subscription:list` to renderers. */
@@ -52,8 +70,13 @@ interface AuthStrategy {
      *
      * Implementations SHOULD use a shared `RefreshMutex` to dedupe concurrent
      * refreshes so N parallel 401s collapse into one upstream refresh call.
+     *
+     * The OPTIONAL `sessionKey` (subscription-account-scheduling, D7) refreshes the
+     * account the request was ACTUALLY served by: when it resolves to a sticky
+     * non-active account the strategy refreshes THAT account by id; absent (or an
+     * active pick) ⇒ the active-account refresh, unchanged.
      */
-    onUnauthorized(): Promise<boolean>;
+    onUnauthorized(sessionKey?: string): Promise<boolean>;
     /** Diagnostic surface for the `subscription:status` IPC. */
     describeStatus(): Promise<SubscriptionStatusEntry>;
 }

package/dist/pipeline/auditSink.cjs

@@ -0,0 +1,14 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+
+
+var _chunkAEOZIDEBcjs = require('../chunk-AEOZIDEB.cjs');
+
+
+
+
+
+
+exports.__resetAuditSinkForTests = _chunkAEOZIDEBcjs.__resetAuditSinkForTests; exports.getAuditCaptureConfig = _chunkAEOZIDEBcjs.getAuditCaptureConfig; exports.recordAudit = _chunkAEOZIDEBcjs.recordAudit; exports.setAuditCaptureConfig = _chunkAEOZIDEBcjs.setAuditCaptureConfig; exports.setAuditSink = _chunkAEOZIDEBcjs.setAuditSink;

package/dist/pipeline/auditSink.d.cts

@@ -0,0 +1,48 @@
+import { AuditRecord, AuditConfig } from '@omnicross/contracts/audit-types';
+
+/**
+ * auditSink — the module-slot sink + capture-config port for `@omnicross/core`
+ * (request-audit-log, design D5).
+ *
+ * The outbound server's post-response capture hook calls {@link recordAudit}
+ * with an assembled {@link AuditRecord}. The concrete `AuditWriter` (the
+ * date-rotated jsonl store) lives in the DAEMON and registers itself as the sink
+ * at bootstrap via {@link setAuditSink}. Core imports NOTHING from the daemon —
+ * exactly the `setWebhookSink` / `setUpstreamProxyResolver` precedent.
+ *
+ * A SECOND slot holds the active {@link AuditConfig} ({@link setAuditCaptureConfig}
+ * / {@link getAuditCaptureConfig}). The capture hook reads it to GATE assembly:
+ * absent/`enabled:false` ⇒ the hook does nothing (not even record assembly), so
+ * audit-disabled is byte-identical zero regression. The daemon sets BOTH slots
+ * together (config + sink) when audit is enabled and clears BOTH when disabled.
+ *
+ * HARD CONTRACT (design D5 / risk "the audit write adding latency"):
+ * {@link recordAudit} NEVER throws and NEVER awaits — it hands the record to the
+ * sink (which enqueues and returns immediately) and swallows any sink error, so
+ * a slow/failing/throwing writer can never affect the relay path. Absent a sink
+ * it is a pure no-op.
+ *
+ * @module @omnicross/core/pipeline/auditSink
+ */
+
+/** The sink the daemon registers; it MUST enqueue-and-return (never block/throw). */
+type AuditSink = (record: AuditRecord) => void;
+/** Install (or clear, with `null`) the audit sink. Idempotent; last write wins. */
+declare function setAuditSink(fn: AuditSink | null): void;
+/**
+ * Install (or clear, with `null`) the active audit-capture config. `null` (or an
+ * `enabled:false` config) disables capture entirely — the hook does no work.
+ */
+declare function setAuditCaptureConfig(config: AuditConfig | null): void;
+/** The active capture config, or `null` when audit is disabled/unset. */
+declare function getAuditCaptureConfig(): AuditConfig | null;
+/**
+ * Hand one audit record to the registered sink. A no-op when no sink is set
+ * (zero regression). NEVER throws (a misbehaving sink is swallowed) and NEVER
+ * awaits (the sink enqueues + returns) — so no relay path is ever delayed.
+ */
+declare function recordAudit(record: AuditRecord): void;
+/** TEST SEAM — clear both slots so a suite starts from the no-audit baseline. */
+declare function __resetAuditSinkForTests(): void;
+
+export { type AuditSink, __resetAuditSinkForTests, getAuditCaptureConfig, recordAudit, setAuditCaptureConfig, setAuditSink };

package/dist/pipeline/auditSink.d.ts

@@ -0,0 +1,48 @@
+import { AuditRecord, AuditConfig } from '@omnicross/contracts/audit-types';
+
+/**
+ * auditSink — the module-slot sink + capture-config port for `@omnicross/core`
+ * (request-audit-log, design D5).
+ *
+ * The outbound server's post-response capture hook calls {@link recordAudit}
+ * with an assembled {@link AuditRecord}. The concrete `AuditWriter` (the
+ * date-rotated jsonl store) lives in the DAEMON and registers itself as the sink
+ * at bootstrap via {@link setAuditSink}. Core imports NOTHING from the daemon —
+ * exactly the `setWebhookSink` / `setUpstreamProxyResolver` precedent.
+ *
+ * A SECOND slot holds the active {@link AuditConfig} ({@link setAuditCaptureConfig}
+ * / {@link getAuditCaptureConfig}). The capture hook reads it to GATE assembly:
+ * absent/`enabled:false` ⇒ the hook does nothing (not even record assembly), so
+ * audit-disabled is byte-identical zero regression. The daemon sets BOTH slots
+ * together (config + sink) when audit is enabled and clears BOTH when disabled.
+ *
+ * HARD CONTRACT (design D5 / risk "the audit write adding latency"):
+ * {@link recordAudit} NEVER throws and NEVER awaits — it hands the record to the
+ * sink (which enqueues and returns immediately) and swallows any sink error, so
+ * a slow/failing/throwing writer can never affect the relay path. Absent a sink
+ * it is a pure no-op.
+ *
+ * @module @omnicross/core/pipeline/auditSink
+ */
+
+/** The sink the daemon registers; it MUST enqueue-and-return (never block/throw). */
+type AuditSink = (record: AuditRecord) => void;
+/** Install (or clear, with `null`) the audit sink. Idempotent; last write wins. */
+declare function setAuditSink(fn: AuditSink | null): void;
+/**
+ * Install (or clear, with `null`) the active audit-capture config. `null` (or an
+ * `enabled:false` config) disables capture entirely — the hook does no work.
+ */
+declare function setAuditCaptureConfig(config: AuditConfig | null): void;
+/** The active capture config, or `null` when audit is disabled/unset. */
+declare function getAuditCaptureConfig(): AuditConfig | null;
+/**
+ * Hand one audit record to the registered sink. A no-op when no sink is set
+ * (zero regression). NEVER throws (a misbehaving sink is swallowed) and NEVER
+ * awaits (the sink enqueues + returns) — so no relay path is ever delayed.
+ */
+declare function recordAudit(record: AuditRecord): void;
+/** TEST SEAM — clear both slots so a suite starts from the no-audit baseline. */
+declare function __resetAuditSinkForTests(): void;
+
+export { type AuditSink, __resetAuditSinkForTests, getAuditCaptureConfig, recordAudit, setAuditCaptureConfig, setAuditSink };

package/dist/pipeline/auditSink.js

@@ -0,0 +1,14 @@
+import {
+  __resetAuditSinkForTests,
+  getAuditCaptureConfig,
+  recordAudit,
+  setAuditCaptureConfig,
+  setAuditSink
+} from "../chunk-WNY4WMRF.js";
+export {
+  __resetAuditSinkForTests,
+  getAuditCaptureConfig,
+  recordAudit,
+  setAuditCaptureConfig,
+  setAuditSink
+};

package/dist/pipeline/billingEmit.cjs

@@ -0,0 +1,14 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+
+
+var _chunkL74VDN4Acjs = require('../chunk-L74VDN4A.cjs');
+
+
+
+
+
+
+exports.__resetBillingSinkForTests = _chunkL74VDN4Acjs.__resetBillingSinkForTests; exports.getBillingCaptureConfig = _chunkL74VDN4Acjs.getBillingCaptureConfig; exports.publishBillingEvent = _chunkL74VDN4Acjs.publishBillingEvent; exports.setBillingCaptureConfig = _chunkL74VDN4Acjs.setBillingCaptureConfig; exports.setBillingSink = _chunkL74VDN4Acjs.setBillingSink;

package/dist/pipeline/billingEmit.d.cts

@@ -0,0 +1,49 @@
+import { BillingEvent, BillingConfig } from '@omnicross/contracts/billing-types';
+
+/**
+ * billingEmit — the module-slot sink + capture-gate port for `@omnicross/core`
+ * (billing-event-stream, design D4/D7).
+ *
+ * The outbound server's post-response billing hook calls {@link publishBillingEvent}
+ * with an assembled {@link BillingEvent}. The concrete `BillingPublisher` (the
+ * durable-first jsonl ledger + built-in POST) lives in the DAEMON and registers
+ * itself as the sink at bootstrap via {@link setBillingSink}. Core imports NOTHING
+ * from the daemon — exactly the `setWebhookSink` / `setAuditSink` precedent.
+ *
+ * A SECOND slot holds the active {@link BillingConfig} ({@link setBillingCaptureConfig}
+ * / {@link getBillingCaptureConfig}). The capture hook reads it to GATE assembly:
+ * absent/`enabled:false` ⇒ the hook does nothing (not even event assembly), so
+ * billing-disabled is byte-identical zero regression. The daemon sets BOTH slots
+ * together (config + sink) when billing is enabled and clears BOTH when disabled.
+ *
+ * HARD CONTRACT (design D7 / risk "a billing POST blocking the request path"):
+ * {@link publishBillingEvent} NEVER throws and NEVER awaits — it hands the event
+ * to the sink (which durably appends + enqueues delivery and returns immediately)
+ * and swallows any sink error, so a slow/failing/throwing publisher can never
+ * affect the relay path. Absent a sink it is a pure no-op.
+ *
+ * @module @omnicross/core/pipeline/billingEmit
+ */
+
+/** The sink the daemon registers; it MUST durably-append-and-return (never block/throw). */
+type BillingSink = (event: BillingEvent) => void;
+/** Install (or clear, with `null`) the billing sink. Idempotent; last write wins. */
+declare function setBillingSink(fn: BillingSink | null): void;
+/**
+ * Install (or clear, with `null`) the active billing config. `null` (or an
+ * `enabled:false` config) disables the capture entirely — the hook does no work.
+ */
+declare function setBillingCaptureConfig(config: BillingConfig | null): void;
+/** The active billing config, or `null` when billing is disabled/unset. */
+declare function getBillingCaptureConfig(): BillingConfig | null;
+/**
+ * Publish one billing event to the registered sink. A no-op when no sink is set
+ * (zero regression). NEVER throws (a misbehaving sink is swallowed) and NEVER
+ * awaits (the sink durably appends + enqueues delivery, then returns) — so no
+ * relay path is ever delayed.
+ */
+declare function publishBillingEvent(event: BillingEvent): void;
+/** TEST SEAM — clear both slots so a suite starts from the no-billing baseline. */
+declare function __resetBillingSinkForTests(): void;
+
+export { type BillingSink, __resetBillingSinkForTests, getBillingCaptureConfig, publishBillingEvent, setBillingCaptureConfig, setBillingSink };

package/dist/pipeline/billingEmit.d.ts

@@ -0,0 +1,49 @@
+import { BillingEvent, BillingConfig } from '@omnicross/contracts/billing-types';
+
+/**
+ * billingEmit — the module-slot sink + capture-gate port for `@omnicross/core`
+ * (billing-event-stream, design D4/D7).
+ *
+ * The outbound server's post-response billing hook calls {@link publishBillingEvent}
+ * with an assembled {@link BillingEvent}. The concrete `BillingPublisher` (the
+ * durable-first jsonl ledger + built-in POST) lives in the DAEMON and registers
+ * itself as the sink at bootstrap via {@link setBillingSink}. Core imports NOTHING
+ * from the daemon — exactly the `setWebhookSink` / `setAuditSink` precedent.
+ *
+ * A SECOND slot holds the active {@link BillingConfig} ({@link setBillingCaptureConfig}
+ * / {@link getBillingCaptureConfig}). The capture hook reads it to GATE assembly:
+ * absent/`enabled:false` ⇒ the hook does nothing (not even event assembly), so
+ * billing-disabled is byte-identical zero regression. The daemon sets BOTH slots
+ * together (config + sink) when billing is enabled and clears BOTH when disabled.
+ *
+ * HARD CONTRACT (design D7 / risk "a billing POST blocking the request path"):
+ * {@link publishBillingEvent} NEVER throws and NEVER awaits — it hands the event
+ * to the sink (which durably appends + enqueues delivery and returns immediately)
+ * and swallows any sink error, so a slow/failing/throwing publisher can never
+ * affect the relay path. Absent a sink it is a pure no-op.
+ *
+ * @module @omnicross/core/pipeline/billingEmit
+ */
+
+/** The sink the daemon registers; it MUST durably-append-and-return (never block/throw). */
+type BillingSink = (event: BillingEvent) => void;
+/** Install (or clear, with `null`) the billing sink. Idempotent; last write wins. */
+declare function setBillingSink(fn: BillingSink | null): void;
+/**
+ * Install (or clear, with `null`) the active billing config. `null` (or an
+ * `enabled:false` config) disables the capture entirely — the hook does no work.
+ */
+declare function setBillingCaptureConfig(config: BillingConfig | null): void;
+/** The active billing config, or `null` when billing is disabled/unset. */
+declare function getBillingCaptureConfig(): BillingConfig | null;
+/**
+ * Publish one billing event to the registered sink. A no-op when no sink is set
+ * (zero regression). NEVER throws (a misbehaving sink is swallowed) and NEVER
+ * awaits (the sink durably appends + enqueues delivery, then returns) — so no
+ * relay path is ever delayed.
+ */
+declare function publishBillingEvent(event: BillingEvent): void;
+/** TEST SEAM — clear both slots so a suite starts from the no-billing baseline. */
+declare function __resetBillingSinkForTests(): void;
+
+export { type BillingSink, __resetBillingSinkForTests, getBillingCaptureConfig, publishBillingEvent, setBillingCaptureConfig, setBillingSink };

package/dist/pipeline/billingEmit.js

@@ -0,0 +1,14 @@
+import {
+  __resetBillingSinkForTests,
+  getBillingCaptureConfig,
+  publishBillingEvent,
+  setBillingCaptureConfig,
+  setBillingSink
+} from "../chunk-TKJMZBAH.js";
+export {
+  __resetBillingSinkForTests,
+  getBillingCaptureConfig,
+  publishBillingEvent,
+  setBillingCaptureConfig,
+  setBillingSink
+};