@omnicross/core 0.1.2 → 0.1.3

package/dist/chunk-4IH4EL7M.cjs

@@ -0,0 +1,9 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});// src/outbound-api/types.ts
+var ENDPOINT_MODEL_KINDS = {
+  messages: ["fable", "opus", "sonnet", "haiku"],
+  responses: ["codex", "mini"]
+};
+
+
+
+exports.ENDPOINT_MODEL_KINDS = ENDPOINT_MODEL_KINDS;

package/dist/chunk-5ENKBSWO.js

@@ -0,0 +1,311 @@
+// src/pipeline/SubscriptionAccountHealth.ts
+var OVERLOAD_TTL_MS = 10 * 6e4;
+var OVERLOAD_ENABLED_DEFAULT = true;
+var AUTH_ERROR_TTL_MS = 30 * 6e4;
+var SERVER_ERROR_TTL_MS = 5 * 6e4;
+var BAN_BODY_MARKERS = [
+  "this organization has been disabled",
+  "oauth authentication is currently not allowed"
+];
+function readHeader(headers, name) {
+  if (typeof headers.get === "function") {
+    return headers.get(name);
+  }
+  const rec = headers;
+  return rec[name] ?? rec[name.toLowerCase()] ?? null;
+}
+function parseIntHeader(value) {
+  if (value == null) return null;
+  const n = Number.parseInt(value.trim(), 10);
+  return Number.isFinite(n) ? n : null;
+}
+function resolveResetSeconds(providerId, headers) {
+  const unified = parseIntHeader(readHeader(headers, "anthropic-ratelimit-unified-reset"));
+  if (providerId === "claude") {
+    return { resetHeaderSeconds: unified, retryAfterSeconds: null };
+  }
+  const providerReset = parseIntHeader(readHeader(headers, "x-ratelimit-reset")) ?? parseIntHeader(readHeader(headers, "ratelimit-reset"));
+  const retryAfter = parseIntHeader(readHeader(headers, "retry-after"));
+  return {
+    resetHeaderSeconds: unified ?? providerReset,
+    retryAfterSeconds: retryAfter
+  };
+}
+function isBanBody(bodyText) {
+  if (!bodyText) return false;
+  const lower = bodyText.toLowerCase();
+  return BAN_BODY_MARKERS.some((marker) => lower.includes(marker));
+}
+function isRecordEmpty(record) {
+  return record.rateLimitEndAt === void 0 && record.overloadUntil === void 0 && record.tempUnavailableUntil === void 0 && !record.blocked;
+}
+var KEY_SEP = "\0";
+var SubscriptionAccountHealth = class {
+  records = /* @__PURE__ */ new Map();
+  listeners = /* @__PURE__ */ new Set();
+  anomalyListeners = /* @__PURE__ */ new Set();
+  now;
+  overloadEnabled;
+  overloadTtlMs;
+  authErrorTtlMs;
+  serverErrorTtlMs;
+  constructor(opts = {}) {
+    this.now = opts.now ?? Date.now;
+    this.overloadEnabled = opts.overloadEnabled ?? OVERLOAD_ENABLED_DEFAULT;
+    this.overloadTtlMs = opts.overloadTtlMs ?? OVERLOAD_TTL_MS;
+    this.authErrorTtlMs = opts.authErrorTtlMs ?? AUTH_ERROR_TTL_MS;
+    this.serverErrorTtlMs = opts.serverErrorTtlMs ?? SERVER_ERROR_TTL_MS;
+  }
+  /**
+   * Re-apply cooldown config to the LIVE shared instance (subscription-account-
+   * health, LEAD OQ1). `buildDaemon` is synchronous so it cannot await the
+   * persisted server config; the async `start.ts` path loads it and applies the
+   * `accountHealth` segment here — every strategy/relay/sweeper that already
+   * captured this instance picks the new values up. Only defined fields override.
+   */
+  configure(opts) {
+    if (opts.overloadEnabled !== void 0) this.overloadEnabled = opts.overloadEnabled;
+    if (opts.overloadTtlMs !== void 0) this.overloadTtlMs = opts.overloadTtlMs;
+    if (opts.authErrorTtlMs !== void 0) this.authErrorTtlMs = opts.authErrorTtlMs;
+    if (opts.serverErrorTtlMs !== void 0) this.serverErrorTtlMs = opts.serverErrorTtlMs;
+  }
+  /**
+   * Whether an account may be scheduled RIGHT NOW. `blocked` → false; any timer
+   * still in the future → false. Expired timers are lazily deleted on read (CRS
+   * lazy-clear parity) so an elapsed cooldown restores the account WITHOUT a
+   * timer — but the recovery SIGNAL is the sweeper's job (`sweepRecoveries`), so
+   * this read never emits (correctness is independent of the tick).
+   */
+  isSchedulable(providerId, accountId, now = this.now()) {
+    const key = this.key(providerId, accountId);
+    const record = this.records.get(key);
+    if (!record) return true;
+    if (record.blocked) return false;
+    const active = this.clearExpired(record, now);
+    if (!active && isRecordEmpty(record)) this.records.delete(key);
+    return !active;
+  }
+  /**
+   * The single marking entry point (design D3). Faithful to CRS status semantics:
+   *  - 429 + authoritative reset → `rateLimitEndAt`; a non-claude 429 may use
+   *    `retryAfterSeconds`; a bare 429 (no resolvable reset) is NOT marked;
+   *  - 529 → `overloadUntil` (gated by `overloadEnabled`);
+   *  - 403-ban body → `blocked` (permanent); plain 403 → transient;
+   *  - final-401 → transient; 5xx / thrown(null) → transient;
+   *  - non-429 4xx → NEUTRAL (never marked);
+   *  - 2xx → clear rate-limit + transient state (keep `blocked`).
+   */
+  recordUpstreamOutcome(providerId, accountId, input) {
+    const now = input.now ?? this.now();
+    const key = this.key(providerId, accountId);
+    const preExisting = this.records.get(key);
+    const record = preExisting ?? {};
+    const status = input.status;
+    const wasUnhealthyBefore = preExisting ? this.isUnhealthyAt(preExisting, now) : false;
+    let anomalyState;
+    let recovered = false;
+    if (status === null) {
+      record.tempUnavailableUntil = now + this.serverErrorTtlMs;
+    } else if (status >= 200 && status < 300) {
+      const wasUnhealthy = record.rateLimitEndAt !== void 0 || record.overloadUntil !== void 0 || record.tempUnavailableUntil !== void 0;
+      delete record.rateLimitEndAt;
+      delete record.overloadUntil;
+      delete record.tempUnavailableUntil;
+      recovered = wasUnhealthy && !record.blocked;
+    } else if (status === 429) {
+      if (input.resetHeaderSeconds != null) {
+        record.rateLimitEndAt = input.resetHeaderSeconds * 1e3;
+        anomalyState = "rate_limited";
+      } else if (input.retryAfterSeconds != null) {
+        record.rateLimitEndAt = now + input.retryAfterSeconds * 1e3;
+        anomalyState = "rate_limited";
+      }
+    } else if (status === 529) {
+      if (this.overloadEnabled) {
+        record.overloadUntil = now + this.overloadTtlMs;
+        anomalyState = "overloaded";
+      }
+    } else if (status === 403) {
+      if (isBanBody(input.bodyText)) {
+        record.blocked = true;
+        anomalyState = "blocked";
+      } else {
+        record.tempUnavailableUntil = now + this.authErrorTtlMs;
+        anomalyState = "unauthorized";
+      }
+    } else if (status === 401) {
+      record.tempUnavailableUntil = now + this.authErrorTtlMs;
+      anomalyState = "unauthorized";
+    } else if (status >= 500) {
+      record.tempUnavailableUntil = now + this.serverErrorTtlMs;
+    }
+    if (isRecordEmpty(record)) this.records.delete(key);
+    else this.records.set(key, record);
+    if (recovered) this.emit({ providerId, accountId, at: now, kind: "rateLimitRecovery" });
+    if (anomalyState && !wasUnhealthyBefore) {
+      this.emitAnomaly({ providerId, accountId, at: now, state: anomalyState });
+    }
+  }
+  /** Whether a record is unhealthy at `now`: blocked, or any timer still future. */
+  isUnhealthyAt(record, now) {
+    if (record.blocked) return true;
+    if (record.rateLimitEndAt !== void 0 && now < record.rateLimitEndAt) return true;
+    if (record.overloadUntil !== void 0 && now < record.overloadUntil) return true;
+    if (record.tempUnavailableUntil !== void 0 && now < record.tempUnavailableUntil) return true;
+    return false;
+  }
+  /**
+   * Clear ONLY the auth/transient unavailability mark (`tempUnavailableUntil`) —
+   * the narrow healing a background PROBE is allowed to do (subscription-account-
+   * probe #8, review M1). A probe 2xx from the lightweight `GET /v1/models` attests
+   * the TOKEN works (so a final-401 / plain-403 / 5xx transient may be healed), but
+   * it does NOT prove the traffic endpoint's rate-limit / overload has recovered —
+   * so it MUST NOT touch `rateLimitEndAt` / `overloadUntil` (those clear only on the
+   * upstream's authoritative reset, or a REAL-traffic 2xx). `blocked` (a ban) is
+   * never cleared here. Distinct from `recordUpstreamOutcome`'s 2xx path, which is
+   * UNCHANGED and still clears rate + transient together because it IS traffic.
+   * Returns whether a transient mark was actually cleared. Does NOT emit a recovery
+   * signal (a probe is internal maintenance; the account is schedulable-on-read).
+   */
+  clearTransientMark(providerId, accountId) {
+    const key = this.key(providerId, accountId);
+    const record = this.records.get(key);
+    if (!record || record.tempUnavailableUntil === void 0) return false;
+    delete record.tempUnavailableUntil;
+    if (isRecordEmpty(record)) this.records.delete(key);
+    else this.records.set(key, record);
+    return true;
+  }
+  /**
+   * Proactively surface accounts that transitioned unhealthy → schedulable since
+   * the last sweep (design D6). Clears their expired timers, emits a recovery
+   * signal for each through `onRecovered`, and returns the list. A `blocked`
+   * account never recovers here. Correctness does NOT depend on this running —
+   * `isSchedulable` already restores an elapsed cooldown lazily; this adds the
+   * proactive signal (#5/#8) + lets the daemon nudge a token refresh.
+   */
+  sweepRecoveries(now = this.now()) {
+    const recovered = [];
+    for (const [key, record] of this.records) {
+      if (record.blocked) continue;
+      const hadTimer = record.rateLimitEndAt !== void 0 || record.overloadUntil !== void 0 || record.tempUnavailableUntil !== void 0;
+      const active = this.clearExpired(record, now);
+      if (hadTimer && !active && isRecordEmpty(record)) {
+        const [pid, aid] = this.parseKey(key);
+        recovered.push({ providerId: pid, accountId: aid, at: now, kind: "rateLimitRecovery" });
+        this.records.delete(key);
+      }
+    }
+    for (const event of recovered) this.emit(event);
+    return recovered;
+  }
+  /** Admin-facing coarse status + cooldown-until for one account (secret-free). */
+  getStatus(providerId, accountId, now = this.now()) {
+    const record = this.records.get(this.key(providerId, accountId));
+    if (!record) return { state: "healthy" };
+    if (record.blocked) return { state: "blocked" };
+    if (record.rateLimitEndAt !== void 0 && now < record.rateLimitEndAt) {
+      return { state: "rate_limited", cooldownUntil: record.rateLimitEndAt };
+    }
+    if (record.overloadUntil !== void 0 && now < record.overloadUntil) {
+      return { state: "overloaded", cooldownUntil: record.overloadUntil };
+    }
+    if (record.tempUnavailableUntil !== void 0 && now < record.tempUnavailableUntil) {
+      return { state: "transient", cooldownUntil: record.tempUnavailableUntil };
+    }
+    return { state: "healthy" };
+  }
+  /**
+   * Register a recovery listener (the OQ3 seam #5 webhooks + #8 health-cron
+   * consume). Returns an unsubscribe function. Two edges fire it:
+   *  - TRAFFIC-DRIVEN: a `recordUpstreamOutcome` 2xx that clears an unhealthy
+   *    account (guaranteed — the sweep would miss it, as the 2xx deletes the
+   *    record first); and
+   *  - PURE-IDLE: `sweepRecoveries` when an idle account's cooldown elapsed with
+   *    no traffic (best-effort, on the 60s tick).
+   * A lazy `isSchedulable` read that heals an account does NOT emit (a request is
+   * already using it) — so consumers never double-count a recovery.
+   */
+  onRecovered(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  emit(event) {
+    for (const listener of this.listeners) {
+      try {
+        listener(event);
+      } catch {
+      }
+    }
+  }
+  /**
+   * Register an anomaly listener (the ADDITIVE seam #5 webhooks consumes; the
+   * frozen `kind` discriminator on {@link AccountRecoveryEvent} anticipated it).
+   * Fires ONLY on the healthy→unhealthy EDGE inside `recordUpstreamOutcome`
+   * (de-duped: an already-unhealthy account escalating does NOT re-fire). Returns
+   * an unsubscribe function. Existing marking/recovery behavior is UNCHANGED.
+   */
+  onAnomaly(listener) {
+    this.anomalyListeners.add(listener);
+    return () => this.anomalyListeners.delete(listener);
+  }
+  emitAnomaly(event) {
+    for (const listener of this.anomalyListeners) {
+      try {
+        listener(event);
+      } catch {
+      }
+    }
+  }
+  /**
+   * Delete every EXPIRED timer field on the record in place; return whether any
+   * timer is STILL active (in the future). `blocked` is not a timer and is left
+   * untouched here (only an explicit reset / restart clears a ban).
+   */
+  clearExpired(record, now) {
+    let active = false;
+    if (record.rateLimitEndAt !== void 0) {
+      if (now >= record.rateLimitEndAt) delete record.rateLimitEndAt;
+      else active = true;
+    }
+    if (record.overloadUntil !== void 0) {
+      if (now >= record.overloadUntil) delete record.overloadUntil;
+      else active = true;
+    }
+    if (record.tempUnavailableUntil !== void 0) {
+      if (now >= record.tempUnavailableUntil) delete record.tempUnavailableUntil;
+      else active = true;
+    }
+    return active;
+  }
+  key(providerId, accountId) {
+    return `${providerId}${KEY_SEP}${accountId}`;
+  }
+  parseKey(key) {
+    const idx = key.indexOf(KEY_SEP);
+    return [key.slice(0, idx), key.slice(idx + 1)];
+  }
+};
+var _shared = null;
+function getSharedAccountHealth() {
+  if (!_shared) _shared = new SubscriptionAccountHealth();
+  return _shared;
+}
+function setSharedAccountHealth(instance) {
+  _shared = instance;
+}
+function __resetSharedAccountHealthForTests() {
+  _shared = null;
+}
+
+export {
+  OVERLOAD_TTL_MS,
+  OVERLOAD_ENABLED_DEFAULT,
+  AUTH_ERROR_TTL_MS,
+  SERVER_ERROR_TTL_MS,
+  resolveResetSeconds,
+  SubscriptionAccountHealth,
+  getSharedAccountHealth,
+  setSharedAccountHealth,
+  __resetSharedAccountHealthForTests
+};

package/dist/chunk-6RPZADX3.cjs

@@ -0,0 +1,92 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } }// src/provider-proxy/identity/fingerprintHeaders.ts
+var STAINLESS_PREFIX = "x-stainless-";
+var FINGERPRINT_HEADER_NAMES = /* @__PURE__ */ new Set([
+  "user-agent",
+  "anthropic-beta",
+  "anthropic-version",
+  "anthropic-dangerous-direct-browser-access",
+  "x-app"
+]);
+var EXCLUDED_HEADER_NAMES = /* @__PURE__ */ new Set([
+  "authorization",
+  "x-api-key",
+  "cookie",
+  "proxy-authorization",
+  "set-cookie"
+]);
+var PROTECTED_OUTBOUND = /* @__PURE__ */ new Set(["authorization", "content-type"]);
+function isStainless(name) {
+  return name.toLowerCase().startsWith(STAINLESS_PREFIX);
+}
+function extractFingerprintHeaders(reqHeaders) {
+  const out = {};
+  for (const [rawKey, rawVal] of Object.entries(reqHeaders)) {
+    if (rawVal === void 0) continue;
+    const key = rawKey.toLowerCase();
+    if (EXCLUDED_HEADER_NAMES.has(key)) continue;
+    const whitelisted = FINGERPRINT_HEADER_NAMES.has(key) || key.startsWith(STAINLESS_PREFIX);
+    if (!whitelisted) continue;
+    const value = Array.isArray(rawVal) ? rawVal.filter((v) => typeof v === "string").join(", ") : rawVal;
+    if (typeof value === "string" && value.length > 0) out[key] = value;
+  }
+  return out;
+}
+function captureCallerIdentity(store, reqHeaders) {
+  if (!store.isEnabled()) return void 0;
+  return extractFingerprintHeaders(reqHeaders);
+}
+function sanitizeFrozenHeaders(headers) {
+  const out = {};
+  for (const [k, v] of Object.entries(headers)) {
+    if (typeof v !== "string" || v.length === 0) continue;
+    const lower = k.toLowerCase();
+    if (EXCLUDED_HEADER_NAMES.has(lower) || PROTECTED_OUTBOUND.has(lower)) continue;
+    out[lower] = v;
+  }
+  return out;
+}
+function refreshNonStainless(frozen, incoming) {
+  const out = {};
+  for (const [k, v] of Object.entries(frozen)) {
+    if (isStainless(k)) out[k] = v;
+  }
+  const nonStainlessKeys = /* @__PURE__ */ new Set();
+  for (const k of Object.keys(frozen)) if (!isStainless(k)) nonStainlessKeys.add(k);
+  for (const k of Object.keys(incoming)) if (!isStainless(k)) nonStainlessKeys.add(k);
+  for (const k of nonStainlessKeys) {
+    const v = _nullishCoalesce(incoming[k], () => ( frozen[k]));
+    if (typeof v === "string" && v.length > 0) out[k] = v;
+  }
+  return out;
+}
+function mergeFrozenIdentity(headers, identity) {
+  const present = new Set(Object.keys(headers).map((k) => k.toLowerCase()));
+  for (const [k, v] of Object.entries(identity)) {
+    const lower = k.toLowerCase();
+    if (PROTECTED_OUTBOUND.has(lower)) continue;
+    if (present.has(lower)) continue;
+    headers[k] = v;
+  }
+}
+function applyFingerprint(store, headers, providerId, accountId, callerIdentity, now) {
+  if (!store.isEnabled() || !accountId) return;
+  if (callerIdentity) store.capture(providerId, accountId, callerIdentity, now);
+  const identity = store.replay(providerId, accountId);
+  if (identity) {
+    mergeFrozenIdentity(headers, identity);
+    return;
+  }
+  const ua = store.uaBaseline();
+  if (ua) mergeFrozenIdentity(headers, { "user-agent": ua });
+}
+
+
+
+
+
+
+
+
+
+
+exports.STAINLESS_PREFIX = STAINLESS_PREFIX; exports.isStainless = isStainless; exports.extractFingerprintHeaders = extractFingerprintHeaders; exports.captureCallerIdentity = captureCallerIdentity; exports.sanitizeFrozenHeaders = sanitizeFrozenHeaders; exports.refreshNonStainless = refreshNonStainless; exports.mergeFrozenIdentity = mergeFrozenIdentity; exports.applyFingerprint = applyFingerprint;

package/dist/chunk-AEOZIDEB.cjs

@@ -0,0 +1,32 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});// src/pipeline/auditSink.ts
+var sink = null;
+var captureConfig = null;
+function setAuditSink(fn) {
+  sink = fn;
+}
+function setAuditCaptureConfig(config) {
+  captureConfig = config && config.enabled ? config : null;
+}
+function getAuditCaptureConfig() {
+  return captureConfig;
+}
+function recordAudit(record) {
+  const active = sink;
+  if (!active) return;
+  try {
+    active(record);
+  } catch (e) {
+  }
+}
+function __resetAuditSinkForTests() {
+  sink = null;
+  captureConfig = null;
+}
+
+
+
+
+
+
+
+exports.setAuditSink = setAuditSink; exports.setAuditCaptureConfig = setAuditCaptureConfig; exports.getAuditCaptureConfig = getAuditCaptureConfig; exports.recordAudit = recordAudit; exports.__resetAuditSinkForTests = __resetAuditSinkForTests;

package/dist/chunk-BO4RFWBR.js

@@ -0,0 +1,89 @@
+// src/pipeline/upstreamFetch.ts
+import { Agent, buildConnector, ProxyAgent } from "undici";
+import { SocksClient } from "socks";
+var resolver = null;
+var generation = 0;
+var cache = /* @__PURE__ */ new Map();
+function normalizeProxy(cfg) {
+  if ("url" in cfg) {
+    let u;
+    try {
+      u = new URL(cfg.url);
+    } catch {
+      return void 0;
+    }
+    const proto = u.protocol.replace(/:$/, "").toLowerCase();
+    const kind2 = proto === "socks5" || proto === "socks" ? "socks5" : proto === "https" ? "https" : "http";
+    const port = u.port ? Number(u.port) : kind2 === "https" ? 443 : kind2 === "socks5" ? 1080 : 80;
+    if (!u.hostname || !Number.isFinite(port)) return void 0;
+    return {
+      kind: kind2,
+      host: u.hostname,
+      port,
+      username: u.username ? decodeURIComponent(u.username) : void 0,
+      password: u.password ? decodeURIComponent(u.password) : void 0
+    };
+  }
+  const kind = cfg.type === "socks5" ? "socks5" : cfg.type === "https" ? "https" : "http";
+  if (!cfg.host || !Number.isFinite(cfg.port)) return void 0;
+  return {
+    kind,
+    host: cfg.host,
+    port: cfg.port,
+    username: cfg.username || void 0,
+    password: cfg.password || void 0
+  };
+}
+function proxyKey(p) {
+  return `${p.kind}://${p.username ?? ""}:${p.password ?? ""}@${p.host}:${p.port}`;
+}
+function socksConnector(p) {
+  const base = buildConnector({});
+  return ((options, callback) => {
+    const destPort = Number(options.port) || (options.protocol === "https:" ? 443 : 80);
+    SocksClient.createConnection({
+      proxy: { host: p.host, port: p.port, type: 5, userId: p.username, password: p.password },
+      command: "connect",
+      destination: { host: options.hostname, port: destPort }
+    }).then(({ socket }) => {
+      base({ ...options, httpSocket: socket }, callback);
+    }).catch((err) => callback(err, null));
+  });
+}
+function buildDispatcher(p) {
+  if (p.kind === "socks5") {
+    return new Agent({ connect: socksConnector(p) });
+  }
+  const auth = p.username != null ? `${encodeURIComponent(p.username)}:${encodeURIComponent(p.password ?? "")}@` : "";
+  const uri = `${p.kind}://${auth}${p.host}:${p.port}`;
+  return new ProxyAgent({ uri });
+}
+function resolveUpstreamDispatcher(ctx) {
+  const active = resolver;
+  if (!active) return void 0;
+  let cfg;
+  try {
+    cfg = active(ctx);
+  } catch {
+    return void 0;
+  }
+  if (!cfg) return void 0;
+  const norm = normalizeProxy(cfg);
+  if (!norm) return void 0;
+  const key = `${generation}\0${proxyKey(norm)}`;
+  let dispatcher = cache.get(key);
+  if (!dispatcher) {
+    dispatcher = buildDispatcher(norm);
+    cache.set(key, dispatcher);
+  }
+  return dispatcher;
+}
+function fetchUpstream(url, init, ctx) {
+  const dispatcher = resolveUpstreamDispatcher({ ...ctx ?? {}, url });
+  if (!dispatcher) return fetch(url, init);
+  return fetch(url, { ...init, dispatcher });
+}
+
+export {
+  fetchUpstream
+};

package/dist/{chunk-MNYKI4CI.js → chunk-CWM2ZDU5.js}

@@ -1,3 +1,13 @@
+// src/pipeline/auditUsageStash.ts
+var stash = /* @__PURE__ */ new WeakMap();
+function stashAuditUsage(key, detail) {
+  const existing = stash.get(key);
+  stash.set(key, existing ? { ...existing, ...detail } : { ...detail });
+}
+function readAuditUsage(key) {
+  return stash.get(key);
+}
+
 // src/usage/usage-recorder.ts
 var UsageRecorder = class {
   constructor(store, pricing, logger, options = {}) {
@@ -5,11 +15,13 @@ var UsageRecorder = class {
     this.pricing = pricing;
     this.logger = logger;
     this.defer = options.defer ?? ((fn) => setTimeout(fn, 0));
+    this.onRecord = options.onRecord;
   }
   store;
   pricing;
   logger;
   defer;
+  onRecord;
   /**
    * Record one LLM request. Returns immediately — the actual store insert is
    * deferred so the caller's response path is unblocked.
@@ -17,6 +29,14 @@ var UsageRecorder = class {
    * Errors during the insert are logged but never thrown.
    */
   record(input) {
+    if (input.auditResponse) {
+      stashAuditUsage(input.auditResponse, {
+        inputTokens: input.usage.inputTokens,
+        outputTokens: input.usage.outputTokens,
+        model: input.model,
+        provider: input.providerId
+      });
+    }
     this.defer(() => {
       void this.recordAsync(input).catch((err) => {
         this.logger.warn("[UsageRecorder] failed to persist usage event", {
@@ -35,6 +55,18 @@ var UsageRecorder = class {
       input.model,
       input.usage
     );
+    if (input.auditResponse) {
+      try {
+        stashAuditUsage(input.auditResponse, { costUsd });
+      } catch {
+      }
+    }
+    if (this.onRecord && input.apiKeyId) {
+      try {
+        this.onRecord(input.apiKeyId, costUsd, Date.now());
+      } catch {
+      }
+    }
     const row = {
       messageId: input.messageId ?? null,
       parentMessageId: input.parentMessageId ?? null,
@@ -73,6 +105,9 @@ var UsageRecorder = class {
   getByApiKey(range) {
     return this.store.getByApiKey(range);
   }
+  getTimeSeries(range, bucket) {
+    return this.store.getTimeSeries(range, bucket);
+  }
   getMessagesForSession(sessionId) {
     return this.store.getMessagesForSession(sessionId);
   }
@@ -90,5 +125,6 @@ var safeStringify = (value) => {
 };
 
 export {
+  readAuditUsage,
   UsageRecorder
 };