@omnicross/core 0.1.2 → 0.1.4

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 Sayo
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 Sayo
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/NOTICE

@@ -1,57 +1,57 @@
-@omnicross/core — THIRD-PARTY NOTICES
-======================================
-
-This package contains code adapted from, and depends on, the following
-third-party works. Their respective licenses apply to those portions.
-
---------------------------------------------------------------------------------
-1. musistudio/llms  (MIT License)
---------------------------------------------------------------------------------
-
-The transformer subsystem (`src/transformer/`) — the unified-IR request/response
-transformer chain (`TransformerService`, `TransformerChainExecutor`, and the
-built-in transformers) — is adapted from the `musistudio/llms` project, the
-upstream of the transformer intermediate representation.
-
-    Copyright (c) 2025 musistudio
-    https://github.com/musistudio/llms
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy
-    of this software and associated documentation files (the "Software"), to deal
-    in the Software without restriction, including without limitation the rights
-    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-    copies of the Software, and to permit persons to whom the Software is
-    furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice shall be included in
-    all copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-    SOFTWARE.
-
---------------------------------------------------------------------------------
-2. @mozilla/readability  (Apache License 2.0)
---------------------------------------------------------------------------------
-
-The built-in web-fetch tool (`src/completion/builtin-web-fetch.ts`) uses
-`@mozilla/readability` to extract readable article content from fetched HTML.
-
-    Copyright Mozilla Foundation and contributors
-    https://github.com/mozilla/readability
-
-    Licensed under the Apache License, Version 2.0 (the "License"); you may not
-    use this file except in compliance with the License. You may obtain a copy of
-    the License at
-
-        http://www.apache.org/licenses/LICENSE-2.0
-
-    Unless required by applicable law or agreed to in writing, software
-    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-    License for the specific language governing permissions and limitations under
-    the License.
+@omnicross/core — THIRD-PARTY NOTICES
+======================================
+
+This package contains code adapted from, and depends on, the following
+third-party works. Their respective licenses apply to those portions.
+
+--------------------------------------------------------------------------------
+1. musistudio/llms  (MIT License)
+--------------------------------------------------------------------------------
+
+The transformer subsystem (`src/transformer/`) — the unified-IR request/response
+transformer chain (`TransformerService`, `TransformerChainExecutor`, and the
+built-in transformers) — is adapted from the `musistudio/llms` project, the
+upstream of the transformer intermediate representation.
+
+    Copyright (c) 2025 musistudio
+    https://github.com/musistudio/llms
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in
+    all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+
+--------------------------------------------------------------------------------
+2. @mozilla/readability  (Apache License 2.0)
+--------------------------------------------------------------------------------
+
+The built-in web-fetch tool (`src/completion/builtin-web-fetch.ts`) uses
+`@mozilla/readability` to extract readable article content from fetched HTML.
+
+    Copyright Mozilla Foundation and contributors
+    https://github.com/mozilla/readability
+
+    Licensed under the Apache License, Version 2.0 (the "License"); you may not
+    use this file except in compliance with the License. You may obtain a copy of
+    the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+    License for the specific language governing permissions and limitations under
+    the License.

package/README.md

@@ -1,15 +1,15 @@
-# @omnicross/core
-
-The omnicross LLM serving core — provider dispatch, the completion pipeline, the transformer chain, the outbound API server, and the resident provider proxy. Embed it in any Node project, or run it via [`@omnicross/daemon`](https://www.npmjs.com/package/@omnicross/daemon).
-
-Part of the [omnicross](https://github.com/Dumoedss/omnicross) monorepo — see the root README for the full overview.
-
-```bash
-npm install @omnicross/core @omnicross/contracts
-```
-
-## License
-
-[MIT](LICENSE) 
-
-This package adapts third-party work under its own license — see the `NOTICE` file.
+# @omnicross/core
+
+The omnicross LLM serving core — provider dispatch, the completion pipeline, the transformer chain, the outbound API server, and the resident provider proxy. Embed it in any Node project, or run it via [`@omnicross/daemon`](https://www.npmjs.com/package/@omnicross/daemon).
+
+Part of the [omnicross](https://github.com/Dumoedss/omnicross) monorepo — see the root README for the full overview.
+
+```bash
+npm install @omnicross/core @omnicross/contracts
+```
+
+## License
+
+[MIT](LICENSE) 
+
+This package adapts third-party work under its own license — see the `NOTICE` file.

package/dist/auth/GeminiCodeAssistProjectResolver.cjs

@@ -4,6 +4,9 @@
 var _chunkRSJ3TWJQcjs = require('../chunk-RSJ3TWJQ.cjs');
 require('../chunk-YGXJGRFI.cjs');
 
+
+var _chunkOCEUVQHWcjs = require('../chunk-OCEUVQHW.cjs');
+
 // src/auth/GeminiCodeAssistProjectResolver.ts
 var FREE_TIER_ID = "free-tier";
 var LEGACY_TIER_ID = "legacy-tier";
@@ -20,7 +23,9 @@ var GeminiCodeAssistHandshakeError = class extends Error {
   
 };
 var GeminiCodeAssistProjectResolver = (_class = class {
-  constructor(fetchImpl = (url, init) => fetch(url, init)) {;_class.prototype.__init.call(this);_class.prototype.__init2.call(this);
+  // upstream-proxy: the Code Assist handshake is upstream egress → honor the
+  // gemini proxy by default (still injectable for tests).
+  constructor(fetchImpl = (url, init) => _chunkOCEUVQHWcjs.fetchUpstream.call(void 0, url, init, { providerId: "gemini" })) {;_class.prototype.__init.call(this);_class.prototype.__init2.call(this);
     this.fetchImpl = fetchImpl;
   }
   

package/dist/auth/GeminiCodeAssistProjectResolver.js

@@ -3,6 +3,9 @@ import {
   resolveCodeAssistEndpoint
 } from "../chunk-Z7Y2NPHY.js";
 import "../chunk-S4WBV25P.js";
+import {
+  fetchUpstream
+} from "../chunk-XK5CIRMQ.js";
 
 // src/auth/GeminiCodeAssistProjectResolver.ts
 var FREE_TIER_ID = "free-tier";
@@ -20,7 +23,9 @@ var GeminiCodeAssistHandshakeError = class extends Error {
   code;
 };
 var GeminiCodeAssistProjectResolver = class {
-  constructor(fetchImpl = (url, init) => fetch(url, init)) {
+  // upstream-proxy: the Code Assist handshake is upstream egress → honor the
+  // gemini proxy by default (still injectable for tests).
+  constructor(fetchImpl = (url, init) => fetchUpstream(url, init, { providerId: "gemini" })) {
     this.fetchImpl = fetchImpl;
   }
   fetchImpl;

package/dist/chunk-3QFXFCHG.js

@@ -0,0 +1,33 @@
+// src/outbound-api/quotaWarn.ts
+var WEBHOOK_QUOTA_WARN_RATIO = 0.8;
+function computeQuotaWarnings(limits, spend, ratio = WEBHOOK_QUOTA_WARN_RATIO) {
+  const out = [];
+  const consider = (scope, limit, spent, windowStart) => {
+    if (limit == null || limit <= 0) return;
+    if (spent >= limit) return;
+    if (spent >= ratio * limit) out.push({ scope, limitUsd: limit, spentUsd: spent, windowStart });
+  };
+  consider("daily", limits.dailyUsd, spend.dailyUsd, spend.dailyWindowStart);
+  consider("weekly", limits.weeklyUsd, spend.weeklyUsd, spend.weeklyWindowStart);
+  consider("total", limits.totalUsd, spend.totalUsd, 0);
+  return out;
+}
+var WARN_GUARD_MAX = 1e4;
+var warned = /* @__PURE__ */ new Set();
+function markQuotaWarnedOnce(keyId, scope, windowStart) {
+  const key = `${keyId}\0${scope}\0${windowStart}`;
+  if (warned.has(key)) return false;
+  if (warned.size >= WARN_GUARD_MAX) warned.clear();
+  warned.add(key);
+  return true;
+}
+function __resetQuotaWarnGuardForTests() {
+  warned.clear();
+}
+
+export {
+  WEBHOOK_QUOTA_WARN_RATIO,
+  computeQuotaWarnings,
+  markQuotaWarnedOnce,
+  __resetQuotaWarnGuardForTests
+};

package/dist/chunk-4IH4EL7M.cjs

@@ -0,0 +1,9 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});// src/outbound-api/types.ts
+var ENDPOINT_MODEL_KINDS = {
+  messages: ["fable", "opus", "sonnet", "haiku"],
+  responses: ["codex", "mini"]
+};
+
+
+
+exports.ENDPOINT_MODEL_KINDS = ENDPOINT_MODEL_KINDS;

package/dist/chunk-4YINUUKQ.cjs

@@ -0,0 +1,33 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});// src/outbound-api/quotaWarn.ts
+var WEBHOOK_QUOTA_WARN_RATIO = 0.8;
+function computeQuotaWarnings(limits, spend, ratio = WEBHOOK_QUOTA_WARN_RATIO) {
+  const out = [];
+  const consider = (scope, limit, spent, windowStart) => {
+    if (limit == null || limit <= 0) return;
+    if (spent >= limit) return;
+    if (spent >= ratio * limit) out.push({ scope, limitUsd: limit, spentUsd: spent, windowStart });
+  };
+  consider("daily", limits.dailyUsd, spend.dailyUsd, spend.dailyWindowStart);
+  consider("weekly", limits.weeklyUsd, spend.weeklyUsd, spend.weeklyWindowStart);
+  consider("total", limits.totalUsd, spend.totalUsd, 0);
+  return out;
+}
+var WARN_GUARD_MAX = 1e4;
+var warned = /* @__PURE__ */ new Set();
+function markQuotaWarnedOnce(keyId, scope, windowStart) {
+  const key = `${keyId}\0${scope}\0${windowStart}`;
+  if (warned.has(key)) return false;
+  if (warned.size >= WARN_GUARD_MAX) warned.clear();
+  warned.add(key);
+  return true;
+}
+function __resetQuotaWarnGuardForTests() {
+  warned.clear();
+}
+
+
+
+
+
+
+exports.WEBHOOK_QUOTA_WARN_RATIO = WEBHOOK_QUOTA_WARN_RATIO; exports.computeQuotaWarnings = computeQuotaWarnings; exports.markQuotaWarnedOnce = markQuotaWarnedOnce; exports.__resetQuotaWarnGuardForTests = __resetQuotaWarnGuardForTests;

package/dist/chunk-5ENKBSWO.js

@@ -0,0 +1,311 @@
+// src/pipeline/SubscriptionAccountHealth.ts
+var OVERLOAD_TTL_MS = 10 * 6e4;
+var OVERLOAD_ENABLED_DEFAULT = true;
+var AUTH_ERROR_TTL_MS = 30 * 6e4;
+var SERVER_ERROR_TTL_MS = 5 * 6e4;
+var BAN_BODY_MARKERS = [
+  "this organization has been disabled",
+  "oauth authentication is currently not allowed"
+];
+function readHeader(headers, name) {
+  if (typeof headers.get === "function") {
+    return headers.get(name);
+  }
+  const rec = headers;
+  return rec[name] ?? rec[name.toLowerCase()] ?? null;
+}
+function parseIntHeader(value) {
+  if (value == null) return null;
+  const n = Number.parseInt(value.trim(), 10);
+  return Number.isFinite(n) ? n : null;
+}
+function resolveResetSeconds(providerId, headers) {
+  const unified = parseIntHeader(readHeader(headers, "anthropic-ratelimit-unified-reset"));
+  if (providerId === "claude") {
+    return { resetHeaderSeconds: unified, retryAfterSeconds: null };
+  }
+  const providerReset = parseIntHeader(readHeader(headers, "x-ratelimit-reset")) ?? parseIntHeader(readHeader(headers, "ratelimit-reset"));
+  const retryAfter = parseIntHeader(readHeader(headers, "retry-after"));
+  return {
+    resetHeaderSeconds: unified ?? providerReset,
+    retryAfterSeconds: retryAfter
+  };
+}
+function isBanBody(bodyText) {
+  if (!bodyText) return false;
+  const lower = bodyText.toLowerCase();
+  return BAN_BODY_MARKERS.some((marker) => lower.includes(marker));
+}
+function isRecordEmpty(record) {
+  return record.rateLimitEndAt === void 0 && record.overloadUntil === void 0 && record.tempUnavailableUntil === void 0 && !record.blocked;
+}
+var KEY_SEP = "\0";
+var SubscriptionAccountHealth = class {
+  records = /* @__PURE__ */ new Map();
+  listeners = /* @__PURE__ */ new Set();
+  anomalyListeners = /* @__PURE__ */ new Set();
+  now;
+  overloadEnabled;
+  overloadTtlMs;
+  authErrorTtlMs;
+  serverErrorTtlMs;
+  constructor(opts = {}) {
+    this.now = opts.now ?? Date.now;
+    this.overloadEnabled = opts.overloadEnabled ?? OVERLOAD_ENABLED_DEFAULT;
+    this.overloadTtlMs = opts.overloadTtlMs ?? OVERLOAD_TTL_MS;
+    this.authErrorTtlMs = opts.authErrorTtlMs ?? AUTH_ERROR_TTL_MS;
+    this.serverErrorTtlMs = opts.serverErrorTtlMs ?? SERVER_ERROR_TTL_MS;
+  }
+  /**
+   * Re-apply cooldown config to the LIVE shared instance (subscription-account-
+   * health, LEAD OQ1). `buildDaemon` is synchronous so it cannot await the
+   * persisted server config; the async `start.ts` path loads it and applies the
+   * `accountHealth` segment here — every strategy/relay/sweeper that already
+   * captured this instance picks the new values up. Only defined fields override.
+   */
+  configure(opts) {
+    if (opts.overloadEnabled !== void 0) this.overloadEnabled = opts.overloadEnabled;
+    if (opts.overloadTtlMs !== void 0) this.overloadTtlMs = opts.overloadTtlMs;
+    if (opts.authErrorTtlMs !== void 0) this.authErrorTtlMs = opts.authErrorTtlMs;
+    if (opts.serverErrorTtlMs !== void 0) this.serverErrorTtlMs = opts.serverErrorTtlMs;
+  }
+  /**
+   * Whether an account may be scheduled RIGHT NOW. `blocked` → false; any timer
+   * still in the future → false. Expired timers are lazily deleted on read (CRS
+   * lazy-clear parity) so an elapsed cooldown restores the account WITHOUT a
+   * timer — but the recovery SIGNAL is the sweeper's job (`sweepRecoveries`), so
+   * this read never emits (correctness is independent of the tick).
+   */
+  isSchedulable(providerId, accountId, now = this.now()) {
+    const key = this.key(providerId, accountId);
+    const record = this.records.get(key);
+    if (!record) return true;
+    if (record.blocked) return false;
+    const active = this.clearExpired(record, now);
+    if (!active && isRecordEmpty(record)) this.records.delete(key);
+    return !active;
+  }
+  /**
+   * The single marking entry point (design D3). Faithful to CRS status semantics:
+   *  - 429 + authoritative reset → `rateLimitEndAt`; a non-claude 429 may use
+   *    `retryAfterSeconds`; a bare 429 (no resolvable reset) is NOT marked;
+   *  - 529 → `overloadUntil` (gated by `overloadEnabled`);
+   *  - 403-ban body → `blocked` (permanent); plain 403 → transient;
+   *  - final-401 → transient; 5xx / thrown(null) → transient;
+   *  - non-429 4xx → NEUTRAL (never marked);
+   *  - 2xx → clear rate-limit + transient state (keep `blocked`).
+   */
+  recordUpstreamOutcome(providerId, accountId, input) {
+    const now = input.now ?? this.now();
+    const key = this.key(providerId, accountId);
+    const preExisting = this.records.get(key);
+    const record = preExisting ?? {};
+    const status = input.status;
+    const wasUnhealthyBefore = preExisting ? this.isUnhealthyAt(preExisting, now) : false;
+    let anomalyState;
+    let recovered = false;
+    if (status === null) {
+      record.tempUnavailableUntil = now + this.serverErrorTtlMs;
+    } else if (status >= 200 && status < 300) {
+      const wasUnhealthy = record.rateLimitEndAt !== void 0 || record.overloadUntil !== void 0 || record.tempUnavailableUntil !== void 0;
+      delete record.rateLimitEndAt;
+      delete record.overloadUntil;
+      delete record.tempUnavailableUntil;
+      recovered = wasUnhealthy && !record.blocked;
+    } else if (status === 429) {
+      if (input.resetHeaderSeconds != null) {
+        record.rateLimitEndAt = input.resetHeaderSeconds * 1e3;
+        anomalyState = "rate_limited";
+      } else if (input.retryAfterSeconds != null) {
+        record.rateLimitEndAt = now + input.retryAfterSeconds * 1e3;
+        anomalyState = "rate_limited";
+      }
+    } else if (status === 529) {
+      if (this.overloadEnabled) {
+        record.overloadUntil = now + this.overloadTtlMs;
+        anomalyState = "overloaded";
+      }
+    } else if (status === 403) {
+      if (isBanBody(input.bodyText)) {
+        record.blocked = true;
+        anomalyState = "blocked";
+      } else {
+        record.tempUnavailableUntil = now + this.authErrorTtlMs;
+        anomalyState = "unauthorized";
+      }
+    } else if (status === 401) {
+      record.tempUnavailableUntil = now + this.authErrorTtlMs;
+      anomalyState = "unauthorized";
+    } else if (status >= 500) {
+      record.tempUnavailableUntil = now + this.serverErrorTtlMs;
+    }
+    if (isRecordEmpty(record)) this.records.delete(key);
+    else this.records.set(key, record);
+    if (recovered) this.emit({ providerId, accountId, at: now, kind: "rateLimitRecovery" });
+    if (anomalyState && !wasUnhealthyBefore) {
+      this.emitAnomaly({ providerId, accountId, at: now, state: anomalyState });
+    }
+  }
+  /** Whether a record is unhealthy at `now`: blocked, or any timer still future. */
+  isUnhealthyAt(record, now) {
+    if (record.blocked) return true;
+    if (record.rateLimitEndAt !== void 0 && now < record.rateLimitEndAt) return true;
+    if (record.overloadUntil !== void 0 && now < record.overloadUntil) return true;
+    if (record.tempUnavailableUntil !== void 0 && now < record.tempUnavailableUntil) return true;
+    return false;
+  }
+  /**
+   * Clear ONLY the auth/transient unavailability mark (`tempUnavailableUntil`) —
+   * the narrow healing a background PROBE is allowed to do (subscription-account-
+   * probe #8, review M1). A probe 2xx from the lightweight `GET /v1/models` attests
+   * the TOKEN works (so a final-401 / plain-403 / 5xx transient may be healed), but
+   * it does NOT prove the traffic endpoint's rate-limit / overload has recovered —
+   * so it MUST NOT touch `rateLimitEndAt` / `overloadUntil` (those clear only on the
+   * upstream's authoritative reset, or a REAL-traffic 2xx). `blocked` (a ban) is
+   * never cleared here. Distinct from `recordUpstreamOutcome`'s 2xx path, which is
+   * UNCHANGED and still clears rate + transient together because it IS traffic.
+   * Returns whether a transient mark was actually cleared. Does NOT emit a recovery
+   * signal (a probe is internal maintenance; the account is schedulable-on-read).
+   */
+  clearTransientMark(providerId, accountId) {
+    const key = this.key(providerId, accountId);
+    const record = this.records.get(key);
+    if (!record || record.tempUnavailableUntil === void 0) return false;
+    delete record.tempUnavailableUntil;
+    if (isRecordEmpty(record)) this.records.delete(key);
+    else this.records.set(key, record);
+    return true;
+  }
+  /**
+   * Proactively surface accounts that transitioned unhealthy → schedulable since
+   * the last sweep (design D6). Clears their expired timers, emits a recovery
+   * signal for each through `onRecovered`, and returns the list. A `blocked`
+   * account never recovers here. Correctness does NOT depend on this running —
+   * `isSchedulable` already restores an elapsed cooldown lazily; this adds the
+   * proactive signal (#5/#8) + lets the daemon nudge a token refresh.
+   */
+  sweepRecoveries(now = this.now()) {
+    const recovered = [];
+    for (const [key, record] of this.records) {
+      if (record.blocked) continue;
+      const hadTimer = record.rateLimitEndAt !== void 0 || record.overloadUntil !== void 0 || record.tempUnavailableUntil !== void 0;
+      const active = this.clearExpired(record, now);
+      if (hadTimer && !active && isRecordEmpty(record)) {
+        const [pid, aid] = this.parseKey(key);
+        recovered.push({ providerId: pid, accountId: aid, at: now, kind: "rateLimitRecovery" });
+        this.records.delete(key);
+      }
+    }
+    for (const event of recovered) this.emit(event);
+    return recovered;
+  }
+  /** Admin-facing coarse status + cooldown-until for one account (secret-free). */
+  getStatus(providerId, accountId, now = this.now()) {
+    const record = this.records.get(this.key(providerId, accountId));
+    if (!record) return { state: "healthy" };
+    if (record.blocked) return { state: "blocked" };
+    if (record.rateLimitEndAt !== void 0 && now < record.rateLimitEndAt) {
+      return { state: "rate_limited", cooldownUntil: record.rateLimitEndAt };
+    }
+    if (record.overloadUntil !== void 0 && now < record.overloadUntil) {
+      return { state: "overloaded", cooldownUntil: record.overloadUntil };
+    }
+    if (record.tempUnavailableUntil !== void 0 && now < record.tempUnavailableUntil) {
+      return { state: "transient", cooldownUntil: record.tempUnavailableUntil };
+    }
+    return { state: "healthy" };
+  }
+  /**
+   * Register a recovery listener (the OQ3 seam #5 webhooks + #8 health-cron
+   * consume). Returns an unsubscribe function. Two edges fire it:
+   *  - TRAFFIC-DRIVEN: a `recordUpstreamOutcome` 2xx that clears an unhealthy
+   *    account (guaranteed — the sweep would miss it, as the 2xx deletes the
+   *    record first); and
+   *  - PURE-IDLE: `sweepRecoveries` when an idle account's cooldown elapsed with
+   *    no traffic (best-effort, on the 60s tick).
+   * A lazy `isSchedulable` read that heals an account does NOT emit (a request is
+   * already using it) — so consumers never double-count a recovery.
+   */
+  onRecovered(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  emit(event) {
+    for (const listener of this.listeners) {
+      try {
+        listener(event);
+      } catch {
+      }
+    }
+  }
+  /**
+   * Register an anomaly listener (the ADDITIVE seam #5 webhooks consumes; the
+   * frozen `kind` discriminator on {@link AccountRecoveryEvent} anticipated it).
+   * Fires ONLY on the healthy→unhealthy EDGE inside `recordUpstreamOutcome`
+   * (de-duped: an already-unhealthy account escalating does NOT re-fire). Returns
+   * an unsubscribe function. Existing marking/recovery behavior is UNCHANGED.
+   */
+  onAnomaly(listener) {
+    this.anomalyListeners.add(listener);
+    return () => this.anomalyListeners.delete(listener);
+  }
+  emitAnomaly(event) {
+    for (const listener of this.anomalyListeners) {
+      try {
+        listener(event);
+      } catch {
+      }
+    }
+  }
+  /**
+   * Delete every EXPIRED timer field on the record in place; return whether any
+   * timer is STILL active (in the future). `blocked` is not a timer and is left
+   * untouched here (only an explicit reset / restart clears a ban).
+   */
+  clearExpired(record, now) {
+    let active = false;
+    if (record.rateLimitEndAt !== void 0) {
+      if (now >= record.rateLimitEndAt) delete record.rateLimitEndAt;
+      else active = true;
+    }
+    if (record.overloadUntil !== void 0) {
+      if (now >= record.overloadUntil) delete record.overloadUntil;
+      else active = true;
+    }
+    if (record.tempUnavailableUntil !== void 0) {
+      if (now >= record.tempUnavailableUntil) delete record.tempUnavailableUntil;
+      else active = true;
+    }
+    return active;
+  }
+  key(providerId, accountId) {
+    return `${providerId}${KEY_SEP}${accountId}`;
+  }
+  parseKey(key) {
+    const idx = key.indexOf(KEY_SEP);
+    return [key.slice(0, idx), key.slice(idx + 1)];
+  }
+};
+var _shared = null;
+function getSharedAccountHealth() {
+  if (!_shared) _shared = new SubscriptionAccountHealth();
+  return _shared;
+}
+function setSharedAccountHealth(instance) {
+  _shared = instance;
+}
+function __resetSharedAccountHealthForTests() {
+  _shared = null;
+}
+
+export {
+  OVERLOAD_TTL_MS,
+  OVERLOAD_ENABLED_DEFAULT,
+  AUTH_ERROR_TTL_MS,
+  SERVER_ERROR_TTL_MS,
+  resolveResetSeconds,
+  SubscriptionAccountHealth,
+  getSharedAccountHealth,
+  setSharedAccountHealth,
+  __resetSharedAccountHealthForTests
+};