@omnicross/core 0.1.2 → 0.1.4

package/dist/outbound-api.js

@@ -1,79 +1,206 @@
 import {
+  ConcurrencyQueueFullError,
+  ConcurrencyWaitCancelledError,
+  ConcurrencyWaitTimeoutError,
+  DEFAULT_ACCOUNT_PROBE,
+  DEFAULT_CONCURRENCY_QUEUE,
+  DEFAULT_FINGERPRINT,
   DEFAULT_OUTBOUND_PORT,
+  DEFAULT_USER_MESSAGE_QUEUE,
+  KeySpendTracker,
+  KeyedMutex,
   OUTBOUND_API_SERVER_CONFIG_KEY,
+  OutboundApiConfigError,
   OutboundApiServer,
+  OutboundConcurrencyGate,
   OutboundRateLimiter,
+  SerialQueueTimeoutError,
+  UserMessageSerialQueue,
   __resetOutboundApiServerForTests,
+  checkKeyQuota,
+  computeKeyExpiry,
+  computeVoucherGrant,
   createNamedKey,
   defaultServerConfig,
-  detectRequestRole,
-  endpointToIngressFormat,
   formatUrls,
+  generateVoucherCode,
   getOutboundApiServer,
+  handleVoucherRedeem,
   hashKey,
+  hashVoucherCode,
+  isConcurrencyRejection,
+  isRedeemRequest,
+  isSerialQueueTimeout,
+  isUserMessageRequest,
   loadServerConfig,
   mergeServerConfig,
+  newVoucherId,
+  normalizeAccountProbe,
+  normalizeAudit,
+  normalizeBilling,
+  normalizeFingerprint,
+  normalizePrefixTargets,
+  normalizeProxyConfig,
+  normalizeProxySegment,
+  normalizeQueueSegments,
   normalizeServerConfig,
+  normalizeVoucher,
+  normalizeWebhookDestination,
+  normalizeWebhookSegment,
+  randomBase62,
   saveServerConfig,
-  verifyPresentedKey
-} from "./chunk-2FEVTJWG.js";
-import "./chunk-QOCNX236.js";
+  startOfLocalDay,
+  startOfLocalWeek,
+  toVoucherInfo,
+  verifyKey,
+  verifyPresentedKey,
+  voucherCodePrefix
+} from "./chunk-QYTT6GE3.js";
 import "./chunk-VVEHS2LI.js";
 import "./chunk-46RLHI7D.js";
-import "./chunk-G2UTNSGU.js";
-import "./chunk-MZNPGW5Q.js";
 import "./chunk-DK4A7DLE.js";
-import "./chunk-O466Y272.js";
-import "./chunk-C7PSERMH.js";
-import "./chunk-5HTVET6E.js";
-import "./chunk-Z7LUNECE.js";
+import "./chunk-VPBAUQ2M.js";
 import "./chunk-ZJZAOKI7.js";
 import "./chunk-FTQ7IQUC.js";
+import "./chunk-C7PSERMH.js";
+import "./chunk-TIER4SUC.js";
+import "./chunk-Z7LUNECE.js";
 import "./chunk-7VU7V2E4.js";
 import "./chunk-ZLX3KGXX.js";
-import "./chunk-MNYKI4CI.js";
+import "./chunk-BPKCU575.js";
+import "./chunk-G2UTNSGU.js";
+import "./chunk-MZNPGW5Q.js";
+import "./chunk-XTEI64OU.js";
+import "./chunk-XX6NQJMA.js";
+import "./chunk-IAXWICZU.js";
+import "./chunk-OE6TDIWW.js";
 import "./chunk-DRWHTIIZ.js";
-import "./chunk-JO5NLTLY.js";
-import "./chunk-PXUJF5HS.js";
+import "./chunk-IK3KE3AU.js";
+import "./chunk-ZY6KU6P3.js";
 import "./chunk-JWC6APFQ.js";
 import "./chunk-5ERIZW3D.js";
-import "./chunk-74TMJA7Z.js";
+import "./chunk-5ENKBSWO.js";
+import "./chunk-HRRYG2AX.js";
 import "./chunk-AVYJ4YBN.js";
-import "./chunk-H5JUT3KV.js";
+import {
+  beginBillingCapture
+} from "./chunk-WLYIIEAF.js";
+import "./chunk-TKJMZBAH.js";
+import "./chunk-3QFXFCHG.js";
 import {
   SUBSCRIPTION_PROVIDER_IDS,
+  classifyModelPrefix,
+  detectModelKind,
+  detectRequestRole,
   endpointSupportsSubscription,
+  endpointToIngressFormat,
+  isKindMappedEndpoint,
   isSubscriptionProviderId,
-  resolveRoute
-} from "./chunk-3MEACFK3.js";
+  modelKindsForEndpoint,
+  parseModelRef,
+  pickModelRefFromList,
+  resolvePrefixTarget,
+  resolveRoute,
+  validateEndpointModelConfig,
+  validateServerModelConfig
+} from "./chunk-UHGVBFU3.js";
 import "./chunk-AQ5TNQB7.js";
+import {
+  ENDPOINT_MODEL_KINDS
+} from "./chunk-XEKD23J5.js";
+import "./chunk-H5JUT3KV.js";
+import {
+  beginAuditCapture
+} from "./chunk-7Y47UCF2.js";
+import {
+  AUDIT_REDACTED,
+  redactAuditText
+} from "./chunk-K5NM7VAH.js";
+import "./chunk-WNY4WMRF.js";
+import "./chunk-OZFM4X3S.js";
 import "./chunk-5ZQBEOMD.js";
 import "./chunk-Z7Y2NPHY.js";
 import "./chunk-S4WBV25P.js";
+import "./chunk-XK5CIRMQ.js";
 import "./chunk-CDHS2QDC.js";
-import "./chunk-745DV5FL.js";
-import "./chunk-E3WHL7CO.js";
+import "./chunk-Y7FO65VT.js";
 import "./chunk-FMOBD2OQ.js";
+import "./chunk-HUZZZ3JL.js";
 export {
+  AUDIT_REDACTED,
+  ConcurrencyQueueFullError,
+  ConcurrencyWaitCancelledError,
+  ConcurrencyWaitTimeoutError,
+  DEFAULT_ACCOUNT_PROBE,
+  DEFAULT_CONCURRENCY_QUEUE,
+  DEFAULT_FINGERPRINT,
   DEFAULT_OUTBOUND_PORT,
+  DEFAULT_USER_MESSAGE_QUEUE,
+  ENDPOINT_MODEL_KINDS,
+  KeySpendTracker,
+  KeyedMutex,
   OUTBOUND_API_SERVER_CONFIG_KEY,
+  OutboundApiConfigError,
   OutboundApiServer,
+  OutboundConcurrencyGate,
   OutboundRateLimiter,
   SUBSCRIPTION_PROVIDER_IDS,
+  SerialQueueTimeoutError,
+  UserMessageSerialQueue,
   __resetOutboundApiServerForTests,
+  beginAuditCapture,
+  beginBillingCapture,
+  checkKeyQuota,
+  classifyModelPrefix,
+  computeKeyExpiry,
+  computeVoucherGrant,
   createNamedKey,
   defaultServerConfig,
+  detectModelKind,
   detectRequestRole,
   endpointSupportsSubscription,
   endpointToIngressFormat,
   formatUrls,
+  generateVoucherCode,
   getOutboundApiServer,
+  handleVoucherRedeem,
   hashKey,
+  hashVoucherCode,
+  isConcurrencyRejection,
+  isKindMappedEndpoint,
+  isRedeemRequest,
+  isSerialQueueTimeout,
   isSubscriptionProviderId,
+  isUserMessageRequest,
   loadServerConfig,
   mergeServerConfig,
+  modelKindsForEndpoint,
+  newVoucherId,
+  normalizeAccountProbe,
+  normalizeAudit,
+  normalizeBilling,
+  normalizeFingerprint,
+  normalizePrefixTargets,
+  normalizeProxyConfig,
+  normalizeProxySegment,
+  normalizeQueueSegments,
   normalizeServerConfig,
+  normalizeVoucher,
+  normalizeWebhookDestination,
+  normalizeWebhookSegment,
+  parseModelRef,
+  pickModelRefFromList,
+  randomBase62,
+  redactAuditText,
+  resolvePrefixTarget,
   resolveRoute,
   saveServerConfig,
-  verifyPresentedKey
+  startOfLocalDay,
+  startOfLocalWeek,
+  toVoucherInfo,
+  validateEndpointModelConfig,
+  validateServerModelConfig,
+  verifyKey,
+  verifyPresentedKey,
+  voucherCodePrefix
 };

package/dist/pipeline/AuthSource.d.cts

@@ -34,6 +34,30 @@ interface AuthApplyHints {
     upstreamUrl: string;
     /** Resolved model id for the request. */
     model: string;
+    /**
+     * OPTIONAL stable per-conversation session key (subscription-account-scheduling,
+     * D5) — mapped through to the subscription strategy's sticky account affinity.
+     * BYO auth sources ignore it.
+     */
+    sessionKey?: string;
+    /**
+     * OPTIONAL per-request selection callback (subscription-account-health, D5;
+     * subscription-account-model-map, D3). A subscription strategy invokes it with
+     * the EFFECTIVE account id it resolved (the selected non-active id, or the active
+     * id on the null/≤1 path) so the relay can mark that account's health against the
+     * upstream outcome. The OPTIONAL 3rd `remappedModel` carries the selected
+     * account's ACTUAL upstream model when its `supportedModels` object remaps the
+     * request model — the relay rewrites the outbound `body.model` to it on the
+     * pass-through / same-format path (absent ⇒ forward verbatim). Fresh per request
+     * (no cross-request race). BYO auth sources ignore it.
+     */
+    reportSelection?: (accountId: string, isActive: boolean, remappedModel?: string) => void;
+    /**
+     * OPTIONAL preferred subscription account id (provider/subscription duality).
+     * When set and schedulable the account picker resolves it directly; absent or
+     * unschedulable ⇒ pool auto-schedule. BYO auth sources ignore it.
+     */
+    preferredAccountId?: string;
 }
 /**
  * Result of {@link AuthSource.onResult}.
@@ -74,8 +98,12 @@ interface AuthSource {
      * Called when the upstream returns 401. Return `true` to ask the caller to
      * retry once with freshly-applied headers; `false` to surface the 401.
      * Optional — sources without a refresh notion omit it.
+     *
+     * The OPTIONAL `sessionKey` (subscription-account-scheduling, D7) lets a
+     * subscription source refresh the account the request was actually served by;
+     * BYO sources ignore it.
      */
-    onUnauthorized?(): Promise<boolean>;
+    onUnauthorized?(sessionKey?: string): Promise<boolean>;
     /**
      * Resolve the upstream URL the request should target, when the credential
      * dictates it (e.g. a subscription profile's per-model endpoint). Returns

package/dist/pipeline/AuthSource.d.ts

@@ -34,6 +34,30 @@ interface AuthApplyHints {
     upstreamUrl: string;
     /** Resolved model id for the request. */
     model: string;
+    /**
+     * OPTIONAL stable per-conversation session key (subscription-account-scheduling,
+     * D5) — mapped through to the subscription strategy's sticky account affinity.
+     * BYO auth sources ignore it.
+     */
+    sessionKey?: string;
+    /**
+     * OPTIONAL per-request selection callback (subscription-account-health, D5;
+     * subscription-account-model-map, D3). A subscription strategy invokes it with
+     * the EFFECTIVE account id it resolved (the selected non-active id, or the active
+     * id on the null/≤1 path) so the relay can mark that account's health against the
+     * upstream outcome. The OPTIONAL 3rd `remappedModel` carries the selected
+     * account's ACTUAL upstream model when its `supportedModels` object remaps the
+     * request model — the relay rewrites the outbound `body.model` to it on the
+     * pass-through / same-format path (absent ⇒ forward verbatim). Fresh per request
+     * (no cross-request race). BYO auth sources ignore it.
+     */
+    reportSelection?: (accountId: string, isActive: boolean, remappedModel?: string) => void;
+    /**
+     * OPTIONAL preferred subscription account id (provider/subscription duality).
+     * When set and schedulable the account picker resolves it directly; absent or
+     * unschedulable ⇒ pool auto-schedule. BYO auth sources ignore it.
+     */
+    preferredAccountId?: string;
 }
 /**
  * Result of {@link AuthSource.onResult}.
@@ -74,8 +98,12 @@ interface AuthSource {
      * Called when the upstream returns 401. Return `true` to ask the caller to
      * retry once with freshly-applied headers; `false` to surface the 401.
      * Optional — sources without a refresh notion omit it.
+     *
+     * The OPTIONAL `sessionKey` (subscription-account-scheduling, D7) lets a
+     * subscription source refresh the account the request was actually served by;
+     * BYO sources ignore it.
      */
-    onUnauthorized?(): Promise<boolean>;
+    onUnauthorized?(sessionKey?: string): Promise<boolean>;
     /**
      * Resolve the upstream URL the request should target, when the credential
      * dictates it (e.g. a subscription profile's per-model endpoint). Returns

package/dist/pipeline/LlmConfigProviderAuth.cjs

@@ -1,8 +1,8 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
-var _chunkLKZJEL6Ecjs = require('../chunk-LKZJEL6E.cjs');
+var _chunkQ27JY5RGcjs = require('../chunk-Q27JY5RG.cjs');
 require('../chunk-A2YMUCBT.cjs');
-require('../chunk-6VIXXLMX.cjs');
+require('../chunk-UNEFIWXI.cjs');
 
 
-exports.LlmConfigProviderAuth = _chunkLKZJEL6Ecjs.LlmConfigProviderAuth;
+exports.LlmConfigProviderAuth = _chunkQ27JY5RGcjs.LlmConfigProviderAuth;

package/dist/pipeline/LlmConfigProviderAuth.js

@@ -1,8 +1,8 @@
 import {
   LlmConfigProviderAuth
-} from "../chunk-PXUJF5HS.js";
+} from "../chunk-ZY6KU6P3.js";
 import "../chunk-H5JUT3KV.js";
-import "../chunk-E3WHL7CO.js";
+import "../chunk-HUZZZ3JL.js";
 export {
   LlmConfigProviderAuth
 };

package/dist/pipeline/SubscriptionAccountHealth.cjs

@@ -0,0 +1,22 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+
+
+
+
+
+
+var _chunkVQY5W4YWcjs = require('../chunk-VQY5W4YW.cjs');
+
+
+
+
+
+
+
+
+
+
+exports.AUTH_ERROR_TTL_MS = _chunkVQY5W4YWcjs.AUTH_ERROR_TTL_MS; exports.OVERLOAD_ENABLED_DEFAULT = _chunkVQY5W4YWcjs.OVERLOAD_ENABLED_DEFAULT; exports.OVERLOAD_TTL_MS = _chunkVQY5W4YWcjs.OVERLOAD_TTL_MS; exports.SERVER_ERROR_TTL_MS = _chunkVQY5W4YWcjs.SERVER_ERROR_TTL_MS; exports.SubscriptionAccountHealth = _chunkVQY5W4YWcjs.SubscriptionAccountHealth; exports.__resetSharedAccountHealthForTests = _chunkVQY5W4YWcjs.__resetSharedAccountHealthForTests; exports.getSharedAccountHealth = _chunkVQY5W4YWcjs.getSharedAccountHealth; exports.resolveResetSeconds = _chunkVQY5W4YWcjs.resolveResetSeconds; exports.setSharedAccountHealth = _chunkVQY5W4YWcjs.setSharedAccountHealth;

package/dist/pipeline/SubscriptionAccountHealth.d.cts

@@ -0,0 +1,235 @@
+/**
+ * SubscriptionAccountHealth — the in-memory account health state machine
+ * (subscription-account-health, design D1/D2/D3/D6).
+ *
+ * Shaped like the existing per-model `CircuitBreaker` (`opencodego/CircuitBreaker`):
+ * an in-memory `Map`, an injectable `now` clock, and NO external deps / NO
+ * persistence. It is keyed by an opaque `providerId + '\0' + accountId` string —
+ * core never learns "account" semantics, exactly as the breaker keys by opaque
+ * `modelId`. It is hosted in `@omnicross/core` because all three consumers reach
+ * it in the allowed dependency direction:
+ *   - the subscriptions strategies COMPUTE `schedulable` (`isSchedulable`) + mark
+ *     a final-401;
+ *   - the core `/v1/messages` relay MARKS 429/529/403/5xx from the upstream
+ *     response (`recordUpstreamOutcome`);
+ *   - the daemon `AccountHealthSweeper` drives proactive recovery
+ *     (`sweepRecoveries` + `onRecovered`).
+ *
+ * It carries NO secrets — only statuses + epoch-ms timers — so the secret-free
+ * discipline is untouched. Health is IN-MEMORY (cleared on restart): the worst
+ * case after a restart is one request hitting a still-cooling account and getting
+ * the upstream's authoritative 429 (which re-marks it). Nothing is written to
+ * `tokens.json`.
+ *
+ * @module pipeline/SubscriptionAccountHealth
+ */
+/** Default 529 overload cooldown (LEAD OQ1: ON by default, bounded 10 min). */
+declare const OVERLOAD_TTL_MS: number;
+/** 529 overload cooldown enabled by default (LEAD OQ1). */
+declare const OVERLOAD_ENABLED_DEFAULT = true;
+/** Transient cooldown for a final-401 / plain-403 (CRS auth_error 1800s). */
+declare const AUTH_ERROR_TTL_MS: number;
+/** Transient cooldown for a 5xx / thrown network failure (CRS server_error 300s). */
+declare const SERVER_ERROR_TTL_MS: number;
+/** Per-account health record (all timers are epoch ms). Absent fields ⇒ healthy. */
+interface HealthRecord {
+    /** From a 429 authoritative reset header — rate-limited until this instant. */
+    rateLimitEndAt?: number;
+    /** From a 529 overload — in overload cooldown until this instant. */
+    overloadUntil?: number;
+    /** From a final-401 / plain-403 / 5xx / thrown — transient cooldown until this. */
+    tempUnavailableUntil?: number;
+    /** From a 403-ban — permanent, self-heal never clears it. */
+    blocked?: boolean;
+}
+/** The coarse health state surfaced to the admin accounts view (secret-free). */
+type AccountHealthState = 'healthy' | 'rate_limited' | 'overloaded' | 'transient' | 'blocked';
+/** Admin-facing status projection for one account. */
+interface AccountHealthStatus {
+    state: AccountHealthState;
+    /** Epoch ms the current cooldown elapses (absent for healthy / blocked). */
+    cooldownUntil?: number;
+}
+/**
+ * The recovery signal emitted when an account transitions unhealthy → schedulable.
+ * FROZEN here (subscription-account-health OQ3) as the stable seam #5 (webhooks)
+ * and #8 (health-cron) CONSUME — they must not re-derive health.
+ */
+interface AccountRecoveryEvent {
+    /** Opaque provider id ('claude' | 'codex' | 'gemini' | 'opencodego'). */
+    providerId: string;
+    /** The recovered account id. */
+    accountId: string;
+    /** Epoch ms of the recovery observation. */
+    at: number;
+    /** Discriminator so consumers can widen this to an anomaly union later. */
+    kind: 'rateLimitRecovery';
+}
+/** A recovery listener (fire-and-forget; the emitter never awaits it). */
+type AccountRecoveryListener = (event: AccountRecoveryEvent) => void;
+/** The coarse anomaly state an account transitioned into (secret-free). */
+type AccountAnomalyState = 'blocked' | 'unauthorized' | 'rate_limited' | 'overloaded';
+/**
+ * The anomaly signal emitted when a HEALTHY account transitions to unhealthy —
+ * the additive union #5 (webhooks) consumes, which this tracker's frozen `kind`
+ * discriminator (on {@link AccountRecoveryEvent}) explicitly anticipated. ADDITIVE:
+ * it fires ONLY on the healthy→unhealthy EDGE (de-duped) and changes NOTHING about
+ * the existing marking / recovery behavior. A #8 probe failure flows through the
+ * same `recordUpstreamOutcome` path, so anomaly covers it for free.
+ */
+interface AccountAnomalyEvent {
+    /** Opaque provider id ('claude' | 'codex' | 'gemini' | 'opencodego'). */
+    providerId: string;
+    /** The account id that became unhealthy. */
+    accountId: string;
+    /** Epoch ms of the transition. */
+    at: number;
+    /** The coarse state the account entered (mapped from the marking). */
+    state: AccountAnomalyState;
+}
+/** An anomaly listener (fire-and-forget; the emitter never awaits it). */
+type AccountAnomalyListener = (event: AccountAnomalyEvent) => void;
+/** The inputs one upstream attempt contributes to health marking (design D3). */
+interface RecordUpstreamOutcomeInput {
+    /** The final HTTP status, or `null` for a thrown / network failure. */
+    status: number | null;
+    /** Parsed authoritative reset (epoch SECONDS) — `anthropic-ratelimit-unified-reset`. */
+    resetHeaderSeconds?: number | null;
+    /** Parsed `retry-after` DELTA seconds (non-claude fallback, OQ2). */
+    retryAfterSeconds?: number | null;
+    /** Bounded response body text for the 403-ban sniff (only read on a 403). */
+    bodyText?: string;
+    /** Injectable clock (default the tracker's `now`). */
+    now?: number;
+}
+/** Constructor knobs (all default to the exported constants). */
+interface SubscriptionAccountHealthOptions {
+    /** Injectable clock (ms). Default `Date.now`. */
+    now?: () => number;
+    /** Whether a 529 places the account in overload cooldown (LEAD OQ1: ON). */
+    overloadEnabled?: boolean;
+    /** The 529 overload cooldown duration (ms). */
+    overloadTtlMs?: number;
+    /** The final-401 / plain-403 transient cooldown (ms). */
+    authErrorTtlMs?: number;
+    /** The 5xx / thrown transient cooldown (ms). */
+    serverErrorTtlMs?: number;
+}
+/** Minimal structural read over a `Headers` OR a plain header record. */
+type HeadersLike = {
+    get(name: string): string | null;
+} | Record<string, string | undefined>;
+/**
+ * Resolve the 429 cooldown drivers per provider (OQ2 seam) — a single pure
+ * function. claude is STRICT (only the authoritative
+ * `anthropic-ratelimit-unified-reset`, epoch seconds; a bare 429 stays unmarked);
+ * codex / gemini / opencodego additionally accept `retry-after` (delta seconds)
+ * and a provider-specific reset header as the cooldown driver.
+ */
+declare function resolveResetSeconds(providerId: string, headers: HeadersLike): {
+    resetHeaderSeconds: number | null;
+    retryAfterSeconds: number | null;
+};
+declare class SubscriptionAccountHealth {
+    private readonly records;
+    private readonly listeners;
+    private readonly anomalyListeners;
+    private readonly now;
+    private overloadEnabled;
+    private overloadTtlMs;
+    private authErrorTtlMs;
+    private serverErrorTtlMs;
+    constructor(opts?: SubscriptionAccountHealthOptions);
+    /**
+     * Re-apply cooldown config to the LIVE shared instance (subscription-account-
+     * health, LEAD OQ1). `buildDaemon` is synchronous so it cannot await the
+     * persisted server config; the async `start.ts` path loads it and applies the
+     * `accountHealth` segment here — every strategy/relay/sweeper that already
+     * captured this instance picks the new values up. Only defined fields override.
+     */
+    configure(opts: Pick<SubscriptionAccountHealthOptions, 'overloadEnabled' | 'overloadTtlMs' | 'authErrorTtlMs' | 'serverErrorTtlMs'>): void;
+    /**
+     * Whether an account may be scheduled RIGHT NOW. `blocked` → false; any timer
+     * still in the future → false. Expired timers are lazily deleted on read (CRS
+     * lazy-clear parity) so an elapsed cooldown restores the account WITHOUT a
+     * timer — but the recovery SIGNAL is the sweeper's job (`sweepRecoveries`), so
+     * this read never emits (correctness is independent of the tick).
+     */
+    isSchedulable(providerId: string, accountId: string, now?: number): boolean;
+    /**
+     * The single marking entry point (design D3). Faithful to CRS status semantics:
+     *  - 429 + authoritative reset → `rateLimitEndAt`; a non-claude 429 may use
+     *    `retryAfterSeconds`; a bare 429 (no resolvable reset) is NOT marked;
+     *  - 529 → `overloadUntil` (gated by `overloadEnabled`);
+     *  - 403-ban body → `blocked` (permanent); plain 403 → transient;
+     *  - final-401 → transient; 5xx / thrown(null) → transient;
+     *  - non-429 4xx → NEUTRAL (never marked);
+     *  - 2xx → clear rate-limit + transient state (keep `blocked`).
+     */
+    recordUpstreamOutcome(providerId: string, accountId: string, input: RecordUpstreamOutcomeInput): void;
+    /** Whether a record is unhealthy at `now`: blocked, or any timer still future. */
+    private isUnhealthyAt;
+    /**
+     * Clear ONLY the auth/transient unavailability mark (`tempUnavailableUntil`) —
+     * the narrow healing a background PROBE is allowed to do (subscription-account-
+     * probe #8, review M1). A probe 2xx from the lightweight `GET /v1/models` attests
+     * the TOKEN works (so a final-401 / plain-403 / 5xx transient may be healed), but
+     * it does NOT prove the traffic endpoint's rate-limit / overload has recovered —
+     * so it MUST NOT touch `rateLimitEndAt` / `overloadUntil` (those clear only on the
+     * upstream's authoritative reset, or a REAL-traffic 2xx). `blocked` (a ban) is
+     * never cleared here. Distinct from `recordUpstreamOutcome`'s 2xx path, which is
+     * UNCHANGED and still clears rate + transient together because it IS traffic.
+     * Returns whether a transient mark was actually cleared. Does NOT emit a recovery
+     * signal (a probe is internal maintenance; the account is schedulable-on-read).
+     */
+    clearTransientMark(providerId: string, accountId: string): boolean;
+    /**
+     * Proactively surface accounts that transitioned unhealthy → schedulable since
+     * the last sweep (design D6). Clears their expired timers, emits a recovery
+     * signal for each through `onRecovered`, and returns the list. A `blocked`
+     * account never recovers here. Correctness does NOT depend on this running —
+     * `isSchedulable` already restores an elapsed cooldown lazily; this adds the
+     * proactive signal (#5/#8) + lets the daemon nudge a token refresh.
+     */
+    sweepRecoveries(now?: number): AccountRecoveryEvent[];
+    /** Admin-facing coarse status + cooldown-until for one account (secret-free). */
+    getStatus(providerId: string, accountId: string, now?: number): AccountHealthStatus;
+    /**
+     * Register a recovery listener (the OQ3 seam #5 webhooks + #8 health-cron
+     * consume). Returns an unsubscribe function. Two edges fire it:
+     *  - TRAFFIC-DRIVEN: a `recordUpstreamOutcome` 2xx that clears an unhealthy
+     *    account (guaranteed — the sweep would miss it, as the 2xx deletes the
+     *    record first); and
+     *  - PURE-IDLE: `sweepRecoveries` when an idle account's cooldown elapsed with
+     *    no traffic (best-effort, on the 60s tick).
+     * A lazy `isSchedulable` read that heals an account does NOT emit (a request is
+     * already using it) — so consumers never double-count a recovery.
+     */
+    onRecovered(listener: AccountRecoveryListener): () => void;
+    private emit;
+    /**
+     * Register an anomaly listener (the ADDITIVE seam #5 webhooks consumes; the
+     * frozen `kind` discriminator on {@link AccountRecoveryEvent} anticipated it).
+     * Fires ONLY on the healthy→unhealthy EDGE inside `recordUpstreamOutcome`
+     * (de-duped: an already-unhealthy account escalating does NOT re-fire). Returns
+     * an unsubscribe function. Existing marking/recovery behavior is UNCHANGED.
+     */
+    onAnomaly(listener: AccountAnomalyListener): () => void;
+    private emitAnomaly;
+    /**
+     * Delete every EXPIRED timer field on the record in place; return whether any
+     * timer is STILL active (in the future). `blocked` is not a timer and is left
+     * untouched here (only an explicit reset / restart clears a ban).
+     */
+    private clearExpired;
+    private key;
+    private parseKey;
+}
+/** The shared tracker; lazily constructs a default-config instance on first use. */
+declare function getSharedAccountHealth(): SubscriptionAccountHealth;
+/** Install a config-tuned tracker at bootstrap (idempotent; last write wins). */
+declare function setSharedAccountHealth(instance: SubscriptionAccountHealth): void;
+/** Reset the shared singleton (tests / teardown only). */
+declare function __resetSharedAccountHealthForTests(): void;
+
+export { AUTH_ERROR_TTL_MS, type AccountAnomalyEvent, type AccountAnomalyListener, type AccountAnomalyState, type AccountHealthState, type AccountHealthStatus, type AccountRecoveryEvent, type AccountRecoveryListener, type HeadersLike, type HealthRecord, OVERLOAD_ENABLED_DEFAULT, OVERLOAD_TTL_MS, type RecordUpstreamOutcomeInput, SERVER_ERROR_TTL_MS, SubscriptionAccountHealth, type SubscriptionAccountHealthOptions, __resetSharedAccountHealthForTests, getSharedAccountHealth, resolveResetSeconds, setSharedAccountHealth };