@omnicross/core 0.1.2 → 0.1.4

package/dist/pipeline/billingEmit.d.cts

@@ -0,0 +1,49 @@
+import { BillingEvent, BillingConfig } from '@omnicross/contracts/billing-types';
+
+/**
+ * billingEmit — the module-slot sink + capture-gate port for `@omnicross/core`
+ * (billing-event-stream, design D4/D7).
+ *
+ * The outbound server's post-response billing hook calls {@link publishBillingEvent}
+ * with an assembled {@link BillingEvent}. The concrete `BillingPublisher` (the
+ * durable-first jsonl ledger + built-in POST) lives in the DAEMON and registers
+ * itself as the sink at bootstrap via {@link setBillingSink}. Core imports NOTHING
+ * from the daemon — exactly the `setWebhookSink` / `setAuditSink` precedent.
+ *
+ * A SECOND slot holds the active {@link BillingConfig} ({@link setBillingCaptureConfig}
+ * / {@link getBillingCaptureConfig}). The capture hook reads it to GATE assembly:
+ * absent/`enabled:false` ⇒ the hook does nothing (not even event assembly), so
+ * billing-disabled is byte-identical zero regression. The daemon sets BOTH slots
+ * together (config + sink) when billing is enabled and clears BOTH when disabled.
+ *
+ * HARD CONTRACT (design D7 / risk "a billing POST blocking the request path"):
+ * {@link publishBillingEvent} NEVER throws and NEVER awaits — it hands the event
+ * to the sink (which durably appends + enqueues delivery and returns immediately)
+ * and swallows any sink error, so a slow/failing/throwing publisher can never
+ * affect the relay path. Absent a sink it is a pure no-op.
+ *
+ * @module @omnicross/core/pipeline/billingEmit
+ */
+
+/** The sink the daemon registers; it MUST durably-append-and-return (never block/throw). */
+type BillingSink = (event: BillingEvent) => void;
+/** Install (or clear, with `null`) the billing sink. Idempotent; last write wins. */
+declare function setBillingSink(fn: BillingSink | null): void;
+/**
+ * Install (or clear, with `null`) the active billing config. `null` (or an
+ * `enabled:false` config) disables the capture entirely — the hook does no work.
+ */
+declare function setBillingCaptureConfig(config: BillingConfig | null): void;
+/** The active billing config, or `null` when billing is disabled/unset. */
+declare function getBillingCaptureConfig(): BillingConfig | null;
+/**
+ * Publish one billing event to the registered sink. A no-op when no sink is set
+ * (zero regression). NEVER throws (a misbehaving sink is swallowed) and NEVER
+ * awaits (the sink durably appends + enqueues delivery, then returns) — so no
+ * relay path is ever delayed.
+ */
+declare function publishBillingEvent(event: BillingEvent): void;
+/** TEST SEAM — clear both slots so a suite starts from the no-billing baseline. */
+declare function __resetBillingSinkForTests(): void;
+
+export { type BillingSink, __resetBillingSinkForTests, getBillingCaptureConfig, publishBillingEvent, setBillingCaptureConfig, setBillingSink };

package/dist/pipeline/billingEmit.d.ts

@@ -0,0 +1,49 @@
+import { BillingEvent, BillingConfig } from '@omnicross/contracts/billing-types';
+
+/**
+ * billingEmit — the module-slot sink + capture-gate port for `@omnicross/core`
+ * (billing-event-stream, design D4/D7).
+ *
+ * The outbound server's post-response billing hook calls {@link publishBillingEvent}
+ * with an assembled {@link BillingEvent}. The concrete `BillingPublisher` (the
+ * durable-first jsonl ledger + built-in POST) lives in the DAEMON and registers
+ * itself as the sink at bootstrap via {@link setBillingSink}. Core imports NOTHING
+ * from the daemon — exactly the `setWebhookSink` / `setAuditSink` precedent.
+ *
+ * A SECOND slot holds the active {@link BillingConfig} ({@link setBillingCaptureConfig}
+ * / {@link getBillingCaptureConfig}). The capture hook reads it to GATE assembly:
+ * absent/`enabled:false` ⇒ the hook does nothing (not even event assembly), so
+ * billing-disabled is byte-identical zero regression. The daemon sets BOTH slots
+ * together (config + sink) when billing is enabled and clears BOTH when disabled.
+ *
+ * HARD CONTRACT (design D7 / risk "a billing POST blocking the request path"):
+ * {@link publishBillingEvent} NEVER throws and NEVER awaits — it hands the event
+ * to the sink (which durably appends + enqueues delivery and returns immediately)
+ * and swallows any sink error, so a slow/failing/throwing publisher can never
+ * affect the relay path. Absent a sink it is a pure no-op.
+ *
+ * @module @omnicross/core/pipeline/billingEmit
+ */
+
+/** The sink the daemon registers; it MUST durably-append-and-return (never block/throw). */
+type BillingSink = (event: BillingEvent) => void;
+/** Install (or clear, with `null`) the billing sink. Idempotent; last write wins. */
+declare function setBillingSink(fn: BillingSink | null): void;
+/**
+ * Install (or clear, with `null`) the active billing config. `null` (or an
+ * `enabled:false` config) disables the capture entirely — the hook does no work.
+ */
+declare function setBillingCaptureConfig(config: BillingConfig | null): void;
+/** The active billing config, or `null` when billing is disabled/unset. */
+declare function getBillingCaptureConfig(): BillingConfig | null;
+/**
+ * Publish one billing event to the registered sink. A no-op when no sink is set
+ * (zero regression). NEVER throws (a misbehaving sink is swallowed) and NEVER
+ * awaits (the sink durably appends + enqueues delivery, then returns) — so no
+ * relay path is ever delayed.
+ */
+declare function publishBillingEvent(event: BillingEvent): void;
+/** TEST SEAM — clear both slots so a suite starts from the no-billing baseline. */
+declare function __resetBillingSinkForTests(): void;
+
+export { type BillingSink, __resetBillingSinkForTests, getBillingCaptureConfig, publishBillingEvent, setBillingCaptureConfig, setBillingSink };

package/dist/pipeline/billingEmit.js

@@ -0,0 +1,14 @@
+import {
+  __resetBillingSinkForTests,
+  getBillingCaptureConfig,
+  publishBillingEvent,
+  setBillingCaptureConfig,
+  setBillingSink
+} from "../chunk-TKJMZBAH.js";
+export {
+  __resetBillingSinkForTests,
+  getBillingCaptureConfig,
+  publishBillingEvent,
+  setBillingCaptureConfig,
+  setBillingSink
+};

package/dist/pipeline/executeProviderCall.cjs

@@ -1,6 +1,6 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
-var _chunkKUU2RNG6cjs = require('../chunk-KUU2RNG6.cjs');
+var _chunkHYN75H6Gcjs = require('../chunk-HYN75H6G.cjs');
 
 
-exports.executeProviderCall = _chunkKUU2RNG6cjs.executeProviderCall;
+exports.executeProviderCall = _chunkHYN75H6Gcjs.executeProviderCall;

package/dist/pipeline/executeProviderCall.js

@@ -1,6 +1,6 @@
 import {
   executeProviderCall
-} from "../chunk-JO5NLTLY.js";
+} from "../chunk-IK3KE3AU.js";
 export {
   executeProviderCall
 };

package/dist/pipeline/upstreamFetch.cjs

@@ -0,0 +1,14 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+
+
+var _chunkOCEUVQHWcjs = require('../chunk-OCEUVQHW.cjs');
+
+
+
+
+
+
+exports.__resetUpstreamProxyForTests = _chunkOCEUVQHWcjs.__resetUpstreamProxyForTests; exports.bumpUpstreamProxyGeneration = _chunkOCEUVQHWcjs.bumpUpstreamProxyGeneration; exports.fetchUpstream = _chunkOCEUVQHWcjs.fetchUpstream; exports.resolveUpstreamDispatcher = _chunkOCEUVQHWcjs.resolveUpstreamDispatcher; exports.setUpstreamProxyResolver = _chunkOCEUVQHWcjs.setUpstreamProxyResolver;

package/dist/pipeline/upstreamFetch.d.cts

@@ -0,0 +1,83 @@
+import { ProxyConfig } from '@omnicross/contracts/account-tokens-types';
+import { Dispatcher } from 'undici';
+
+/**
+ * upstreamFetch — the single proxy-aware egress seam for `@omnicross/core`
+ * (upstream-proxy).
+ *
+ * Every outbound UPSTREAM call (relay ingress `fetchFn` closures, the OAuth
+ * token-refresh `FetchLike`, the Gemini Code Assist handshake) routes through
+ * {@link fetchUpstream}. When a proxy resolves for the call it attaches an
+ * undici {@link Dispatcher} (`ProxyAgent` for http/https, an `Agent` with a
+ * socks5 connector for socks5); ABSENT any proxy it is a BARE `fetch` — the
+ * dispatcher option is never set, so behavior is byte-identical to the
+ * pre-change code (the zero-regression guarantee).
+ *
+ * Core stays config/account-agnostic: it only knows opaque `providerId` /
+ * `accountId` strings + a {@link ProxyConfig} descriptor. The daemon injects the
+ * layered lookup via {@link setUpstreamProxyResolver} — the same module-slot
+ * pattern as `setSubscriptionRegistryForOutbound`. Core never imports config or
+ * account material.
+ *
+ * Dispatchers are CACHED by resolved-proxy identity (one instance reused, not
+ * per-request, so keep-alive holds and sockets don't leak). A config change bumps
+ * a generation via {@link bumpUpstreamProxyGeneration} (also called by
+ * `setUpstreamProxyResolver`) which disposes the old dispatchers and rebuilds on
+ * next use.
+ *
+ * FROZEN SEAM: `#7` (client fingerprint) attaches per-account TLS/agent behavior
+ * at this SAME dispatcher point — do not fork a second egress path.
+ *
+ * @module @omnicross/core/pipeline/upstreamFetch
+ */
+
+/** The opaque call context the resolver maps to a proxy (precedence input). */
+interface UpstreamProxyContext {
+    /** The subscription provider id (`claude`/`codex`/`gemini`/`opencodego`) or `'byo'`. */
+    providerId?: string;
+    /** The selected pooled account id (per-account override input). */
+    accountId?: string;
+    /**
+     * The target upstream URL. Injected by {@link fetchUpstream} so the resolver can
+     * apply host-based bypass (loopback / `NO_PROXY`). Callers of the ingress helpers
+     * do NOT set this — it is filled from the fetch `url`.
+     */
+    url?: string;
+}
+/**
+ * The layered proxy lookup the daemon injects. Applies precedence
+ * account > provider > global > env and returns the WINNING `ProxyConfig`, or
+ * `undefined` for a direct (non-proxied) call.
+ */
+type UpstreamProxyResolver = (ctx: UpstreamProxyContext) => ProxyConfig | undefined;
+/**
+ * Inject (or clear, with `null`) the layered proxy resolver. Idempotent — last
+ * write wins. Bumps the dispatcher generation so a resolver swap (or a config
+ * edit that re-registers) rebuilds dispatchers from the new lookup and disposes
+ * the old ones.
+ */
+declare function setUpstreamProxyResolver(fn: UpstreamProxyResolver | null): void;
+/**
+ * Invalidate every cached dispatcher (config change / admin edit). Old
+ * dispatchers are `close()`d best-effort so in-flight sockets drain; new calls
+ * rebuild from the current resolver output.
+ */
+declare function bumpUpstreamProxyGeneration(): void;
+/**
+ * Resolve the dispatcher for one call. Returns `undefined` (⇒ bare fetch) when
+ * no resolver is registered, the resolver returns undefined, or the descriptor
+ * is malformed. A resolver throw is swallowed → direct call (egress never breaks
+ * on a proxy-lookup error).
+ */
+declare function resolveUpstreamDispatcher(ctx: UpstreamProxyContext): Dispatcher | undefined;
+/**
+ * Proxy-aware `fetch`. Attaches the resolved undici dispatcher ONLY when a proxy
+ * applies; otherwise it is a BARE `fetch(url, init)` — byte-identical to the
+ * pre-change egress (zero-regression). The `dispatcher` option is undici-specific
+ * (Node's global fetch IS undici); the cast threads it without a DOM-lib type.
+ */
+declare function fetchUpstream(url: string, init: RequestInit, ctx?: UpstreamProxyContext): Promise<Response>;
+/** TEST SEAM — clear the resolver + cache so a suite starts from the direct-fetch baseline. */
+declare function __resetUpstreamProxyForTests(): void;
+
+export { type UpstreamProxyContext, type UpstreamProxyResolver, __resetUpstreamProxyForTests, bumpUpstreamProxyGeneration, fetchUpstream, resolveUpstreamDispatcher, setUpstreamProxyResolver };

package/dist/pipeline/upstreamFetch.d.ts

@@ -0,0 +1,83 @@
+import { ProxyConfig } from '@omnicross/contracts/account-tokens-types';
+import { Dispatcher } from 'undici';
+
+/**
+ * upstreamFetch — the single proxy-aware egress seam for `@omnicross/core`
+ * (upstream-proxy).
+ *
+ * Every outbound UPSTREAM call (relay ingress `fetchFn` closures, the OAuth
+ * token-refresh `FetchLike`, the Gemini Code Assist handshake) routes through
+ * {@link fetchUpstream}. When a proxy resolves for the call it attaches an
+ * undici {@link Dispatcher} (`ProxyAgent` for http/https, an `Agent` with a
+ * socks5 connector for socks5); ABSENT any proxy it is a BARE `fetch` — the
+ * dispatcher option is never set, so behavior is byte-identical to the
+ * pre-change code (the zero-regression guarantee).
+ *
+ * Core stays config/account-agnostic: it only knows opaque `providerId` /
+ * `accountId` strings + a {@link ProxyConfig} descriptor. The daemon injects the
+ * layered lookup via {@link setUpstreamProxyResolver} — the same module-slot
+ * pattern as `setSubscriptionRegistryForOutbound`. Core never imports config or
+ * account material.
+ *
+ * Dispatchers are CACHED by resolved-proxy identity (one instance reused, not
+ * per-request, so keep-alive holds and sockets don't leak). A config change bumps
+ * a generation via {@link bumpUpstreamProxyGeneration} (also called by
+ * `setUpstreamProxyResolver`) which disposes the old dispatchers and rebuilds on
+ * next use.
+ *
+ * FROZEN SEAM: `#7` (client fingerprint) attaches per-account TLS/agent behavior
+ * at this SAME dispatcher point — do not fork a second egress path.
+ *
+ * @module @omnicross/core/pipeline/upstreamFetch
+ */
+
+/** The opaque call context the resolver maps to a proxy (precedence input). */
+interface UpstreamProxyContext {
+    /** The subscription provider id (`claude`/`codex`/`gemini`/`opencodego`) or `'byo'`. */
+    providerId?: string;
+    /** The selected pooled account id (per-account override input). */
+    accountId?: string;
+    /**
+     * The target upstream URL. Injected by {@link fetchUpstream} so the resolver can
+     * apply host-based bypass (loopback / `NO_PROXY`). Callers of the ingress helpers
+     * do NOT set this — it is filled from the fetch `url`.
+     */
+    url?: string;
+}
+/**
+ * The layered proxy lookup the daemon injects. Applies precedence
+ * account > provider > global > env and returns the WINNING `ProxyConfig`, or
+ * `undefined` for a direct (non-proxied) call.
+ */
+type UpstreamProxyResolver = (ctx: UpstreamProxyContext) => ProxyConfig | undefined;
+/**
+ * Inject (or clear, with `null`) the layered proxy resolver. Idempotent — last
+ * write wins. Bumps the dispatcher generation so a resolver swap (or a config
+ * edit that re-registers) rebuilds dispatchers from the new lookup and disposes
+ * the old ones.
+ */
+declare function setUpstreamProxyResolver(fn: UpstreamProxyResolver | null): void;
+/**
+ * Invalidate every cached dispatcher (config change / admin edit). Old
+ * dispatchers are `close()`d best-effort so in-flight sockets drain; new calls
+ * rebuild from the current resolver output.
+ */
+declare function bumpUpstreamProxyGeneration(): void;
+/**
+ * Resolve the dispatcher for one call. Returns `undefined` (⇒ bare fetch) when
+ * no resolver is registered, the resolver returns undefined, or the descriptor
+ * is malformed. A resolver throw is swallowed → direct call (egress never breaks
+ * on a proxy-lookup error).
+ */
+declare function resolveUpstreamDispatcher(ctx: UpstreamProxyContext): Dispatcher | undefined;
+/**
+ * Proxy-aware `fetch`. Attaches the resolved undici dispatcher ONLY when a proxy
+ * applies; otherwise it is a BARE `fetch(url, init)` — byte-identical to the
+ * pre-change egress (zero-regression). The `dispatcher` option is undici-specific
+ * (Node's global fetch IS undici); the cast threads it without a DOM-lib type.
+ */
+declare function fetchUpstream(url: string, init: RequestInit, ctx?: UpstreamProxyContext): Promise<Response>;
+/** TEST SEAM — clear the resolver + cache so a suite starts from the direct-fetch baseline. */
+declare function __resetUpstreamProxyForTests(): void;
+
+export { type UpstreamProxyContext, type UpstreamProxyResolver, __resetUpstreamProxyForTests, bumpUpstreamProxyGeneration, fetchUpstream, resolveUpstreamDispatcher, setUpstreamProxyResolver };

package/dist/pipeline/upstreamFetch.js

@@ -0,0 +1,14 @@
+import {
+  __resetUpstreamProxyForTests,
+  bumpUpstreamProxyGeneration,
+  fetchUpstream,
+  resolveUpstreamDispatcher,
+  setUpstreamProxyResolver
+} from "../chunk-XK5CIRMQ.js";
+export {
+  __resetUpstreamProxyForTests,
+  bumpUpstreamProxyGeneration,
+  fetchUpstream,
+  resolveUpstreamDispatcher,
+  setUpstreamProxyResolver
+};

package/dist/pipeline/webhookEmit.cjs

@@ -0,0 +1,10 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+var _chunkUIBD2YY5cjs = require('../chunk-UIBD2YY5.cjs');
+
+
+
+
+exports.__resetWebhookSinkForTests = _chunkUIBD2YY5cjs.__resetWebhookSinkForTests; exports.emitWebhookEvent = _chunkUIBD2YY5cjs.emitWebhookEvent; exports.setWebhookSink = _chunkUIBD2YY5cjs.setWebhookSink;

package/dist/pipeline/webhookEmit.d.cts

@@ -0,0 +1,36 @@
+import { WebhookEvent } from '@omnicross/contracts/webhook-types';
+
+/**
+ * webhookEmit — the module-slot emit port for `@omnicross/core`
+ * (webhook-notifications, design D2).
+ *
+ * Core SOURCES (the wire quota path in `outboundApiRouter`, the relay/dispatch
+ * error path) call {@link emitWebhookEvent}. The concrete `WebhookDispatcher`
+ * (config/secrets/HTTP/HMAC) lives in the DAEMON and registers itself as the
+ * sink at bootstrap via {@link setWebhookSink}. Core imports NOTHING from the
+ * daemon — exactly the `setSharedAccountHealth` / `setUpstreamProxyResolver`
+ * precedent.
+ *
+ * HARD CONTRACT (design D2 / risk "a webhook blocking the request path"):
+ * {@link emitWebhookEvent} NEVER throws and NEVER awaits. It hands the event to
+ * the sink (which enqueues and returns immediately) — a slow/failing/throwing
+ * sink can never affect the caller. Absent a sink it is a pure no-op, so a
+ * no-webhook-config daemon is byte-identical to before this change.
+ *
+ * @module @omnicross/core/pipeline/webhookEmit
+ */
+
+/** The sink the daemon registers; it MUST enqueue-and-return (never block). */
+type WebhookSink = (event: WebhookEvent) => void;
+/** Install (or clear, with `null`) the webhook sink. Idempotent; last write wins. */
+declare function setWebhookSink(fn: WebhookSink | null): void;
+/**
+ * Emit a webhook event to the registered sink. A no-op when no sink is set
+ * (zero regression). NEVER throws (a misbehaving sink is swallowed) and NEVER
+ * awaits (the sink enqueues + returns) — so no request path is ever delayed.
+ */
+declare function emitWebhookEvent(event: WebhookEvent): void;
+/** TEST SEAM — clear the sink so a suite starts from the no-sink baseline. */
+declare function __resetWebhookSinkForTests(): void;
+
+export { type WebhookSink, __resetWebhookSinkForTests, emitWebhookEvent, setWebhookSink };

package/dist/pipeline/webhookEmit.d.ts

@@ -0,0 +1,36 @@
+import { WebhookEvent } from '@omnicross/contracts/webhook-types';
+
+/**
+ * webhookEmit — the module-slot emit port for `@omnicross/core`
+ * (webhook-notifications, design D2).
+ *
+ * Core SOURCES (the wire quota path in `outboundApiRouter`, the relay/dispatch
+ * error path) call {@link emitWebhookEvent}. The concrete `WebhookDispatcher`
+ * (config/secrets/HTTP/HMAC) lives in the DAEMON and registers itself as the
+ * sink at bootstrap via {@link setWebhookSink}. Core imports NOTHING from the
+ * daemon — exactly the `setSharedAccountHealth` / `setUpstreamProxyResolver`
+ * precedent.
+ *
+ * HARD CONTRACT (design D2 / risk "a webhook blocking the request path"):
+ * {@link emitWebhookEvent} NEVER throws and NEVER awaits. It hands the event to
+ * the sink (which enqueues and returns immediately) — a slow/failing/throwing
+ * sink can never affect the caller. Absent a sink it is a pure no-op, so a
+ * no-webhook-config daemon is byte-identical to before this change.
+ *
+ * @module @omnicross/core/pipeline/webhookEmit
+ */
+
+/** The sink the daemon registers; it MUST enqueue-and-return (never block). */
+type WebhookSink = (event: WebhookEvent) => void;
+/** Install (or clear, with `null`) the webhook sink. Idempotent; last write wins. */
+declare function setWebhookSink(fn: WebhookSink | null): void;
+/**
+ * Emit a webhook event to the registered sink. A no-op when no sink is set
+ * (zero regression). NEVER throws (a misbehaving sink is swallowed) and NEVER
+ * awaits (the sink enqueues + returns) — so no request path is ever delayed.
+ */
+declare function emitWebhookEvent(event: WebhookEvent): void;
+/** TEST SEAM — clear the sink so a suite starts from the no-sink baseline. */
+declare function __resetWebhookSinkForTests(): void;
+
+export { type WebhookSink, __resetWebhookSinkForTests, emitWebhookEvent, setWebhookSink };

package/dist/pipeline/webhookEmit.js

@@ -0,0 +1,10 @@
+import {
+  __resetWebhookSinkForTests,
+  emitWebhookEvent,
+  setWebhookSink
+} from "../chunk-OE6TDIWW.js";
+export {
+  __resetWebhookSinkForTests,
+  emitWebhookEvent,
+  setWebhookSink
+};

package/dist/ports/usage-event-store.d.cts

@@ -1,4 +1,4 @@
-import { UsageEventInput, UsageDateRange, UsageTotals, ModelUsageRow, ApiKeyUsageRow, MessageUsageRow, SessionCacheStats } from '@omnicross/contracts/usage-stats-types';
+import { UsageEventInput, UsageDateRange, UsageTotals, ModelUsageRow, ApiKeyUsageRow, UsageTimeBucket, UsageTimeSeriesBucket, MessageUsageRow, SessionCacheStats } from '@omnicross/contracts/usage-stats-types';
 
 /**
  * `UsageEventStore` — core-owned port for usage-event persistence + aggregation.
@@ -20,6 +20,31 @@ interface UsageEventStore {
     getByModel(range: UsageDateRange): Promise<ModelUsageRow[]>;
     /** Per-API-key breakdown over a date range. */
     getByApiKey(range: UsageDateRange): Promise<ApiKeyUsageRow[]>;
+    /**
+     * ONE scan of a single key's events (`ts < endTs`, EXCLUSIVE) summing its
+     * `costUsd` into all three windows at once: `totalUsd` (whole history),
+     * `dailyUsd` (`ts >= dayStartTs`) and `weeklyUsd` (`ts >= weekStartTs`). Used by
+     * the outbound key-policy spend tracker to LAZILY seed a key on first use (once
+     * per newly-seen key, NOT per request — a single pass, not three). A key with
+     * no attributed events yields all zeros.
+     */
+    getSpendByKey(query: {
+        apiKeyId: string;
+        dayStartTs: number;
+        weekStartTs: number;
+        endTs: number;
+    }): Promise<{
+        totalUsd: number;
+        dailyUsd: number;
+        weeklyUsd: number;
+    }>;
+    /**
+     * Time-series aggregation over `range`, bucketed at `bucket` granularity using
+     * the store host's LOCAL-time boundaries. EVERY bucket in the range is
+     * returned (empty ones zero-filled), ascending by `bucketStartTs`; an empty
+     * range (`startTs >= endTs`) returns `[]`.
+     */
+    getTimeSeries(range: UsageDateRange, bucket: UsageTimeBucket): Promise<UsageTimeSeriesBucket[]>;
     /** Message-level rows for one session. */
     getMessagesForSession(sessionId: string): Promise<MessageUsageRow[]>;
     /** Cumulative cache hit/miss stats for one session. */

package/dist/ports/usage-event-store.d.ts

@@ -1,4 +1,4 @@
-import { UsageEventInput, UsageDateRange, UsageTotals, ModelUsageRow, ApiKeyUsageRow, MessageUsageRow, SessionCacheStats } from '@omnicross/contracts/usage-stats-types';
+import { UsageEventInput, UsageDateRange, UsageTotals, ModelUsageRow, ApiKeyUsageRow, UsageTimeBucket, UsageTimeSeriesBucket, MessageUsageRow, SessionCacheStats } from '@omnicross/contracts/usage-stats-types';
 
 /**
  * `UsageEventStore` — core-owned port for usage-event persistence + aggregation.
@@ -20,6 +20,31 @@ interface UsageEventStore {
     getByModel(range: UsageDateRange): Promise<ModelUsageRow[]>;
     /** Per-API-key breakdown over a date range. */
     getByApiKey(range: UsageDateRange): Promise<ApiKeyUsageRow[]>;
+    /**
+     * ONE scan of a single key's events (`ts < endTs`, EXCLUSIVE) summing its
+     * `costUsd` into all three windows at once: `totalUsd` (whole history),
+     * `dailyUsd` (`ts >= dayStartTs`) and `weeklyUsd` (`ts >= weekStartTs`). Used by
+     * the outbound key-policy spend tracker to LAZILY seed a key on first use (once
+     * per newly-seen key, NOT per request — a single pass, not three). A key with
+     * no attributed events yields all zeros.
+     */
+    getSpendByKey(query: {
+        apiKeyId: string;
+        dayStartTs: number;
+        weekStartTs: number;
+        endTs: number;
+    }): Promise<{
+        totalUsd: number;
+        dailyUsd: number;
+        weeklyUsd: number;
+    }>;
+    /**
+     * Time-series aggregation over `range`, bucketed at `bucket` granularity using
+     * the store host's LOCAL-time boundaries. EVERY bucket in the range is
+     * returned (empty ones zero-filled), ascending by `bucketStartTs`; an empty
+     * range (`startTs >= endTs`) returns `[]`.
+     */
+    getTimeSeries(range: UsageDateRange, bucket: UsageTimeBucket): Promise<UsageTimeSeriesBucket[]>;
     /** Message-level rows for one session. */
     getMessagesForSession(sessionId: string): Promise<MessageUsageRow[]>;
     /** Cumulative cache hit/miss stats for one session. */

package/dist/ports.d.cts

@@ -5,7 +5,7 @@ export { ProviderConfigSource } from './ports/provider-config-source.cjs';
 export { UsageEventStore } from './ports/usage-event-store.cjs';
 export { WebSearchBackend } from './ports/web-search-backend.cjs';
 export { UsageRecorderImport as UsageSink } from './provider-proxy/types.cjs';
-export { OutboundKeyDb as OutboundCredentialStore } from './outbound-api/types.cjs';
+export { O as OutboundCredentialStore } from './types-B8Arpxn0.cjs';
 import '@omnicross/contracts/pricing-types';
 import '@omnicross/contracts/llm-config';
 import './transformer/types.cjs';
@@ -20,4 +20,11 @@ import './completion/ApiKeyPoolService.cjs';
 import './pipeline/AuthSource.cjs';
 import './pipeline/SubscriptionAuthSource.cjs';
 import './pipeline/SubscriptionAuthStrategy.cjs';
+import '@omnicross/contracts/account-tokens-types';
+import '@omnicross/contracts/audit-types';
+import '@omnicross/contracts/billing-types';
+import '@omnicross/contracts/health-logging-types';
+import '@omnicross/contracts/voucher-types';
+import '@omnicross/contracts/webhook-types';
 import './ProviderProxy-CnMQYN59.cjs';
+import './keyPolicy-Cp0FntZl.cjs';

package/dist/ports.d.ts

@@ -5,7 +5,7 @@ export { ProviderConfigSource } from './ports/provider-config-source.js';
 export { UsageEventStore } from './ports/usage-event-store.js';
 export { WebSearchBackend } from './ports/web-search-backend.js';
 export { UsageRecorderImport as UsageSink } from './provider-proxy/types.js';
-export { OutboundKeyDb as OutboundCredentialStore } from './outbound-api/types.js';
+export { O as OutboundCredentialStore } from './types-lgPYQuZS.js';
 import '@omnicross/contracts/pricing-types';
 import '@omnicross/contracts/llm-config';
 import './transformer/types.js';
@@ -20,4 +20,11 @@ import './completion/ApiKeyPoolService.js';
 import './pipeline/AuthSource.js';
 import './pipeline/SubscriptionAuthSource.js';
 import './pipeline/SubscriptionAuthStrategy.js';
+import '@omnicross/contracts/account-tokens-types';
+import '@omnicross/contracts/audit-types';
+import '@omnicross/contracts/billing-types';
+import '@omnicross/contracts/health-logging-types';
+import '@omnicross/contracts/voucher-types';
+import '@omnicross/contracts/webhook-types';
 import './ProviderProxy-C-xqrkKi.js';
+import './keyPolicy-Cp0FntZl.js';

package/dist/provider-proxy/ProviderProxy.cjs

@@ -1,40 +1,53 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
 
-var _chunkSN3YWBX7cjs = require('../chunk-SN3YWBX7.cjs');
-require('../chunk-SPVWWUHX.cjs');
+var _chunkDKPXN34Vcjs = require('../chunk-DKPXN34V.cjs');
 require('../chunk-HQP3K7PU.cjs');
 require('../chunk-FZ46M34D.cjs');
-require('../chunk-46ZIFWYG.cjs');
-require('../chunk-GBHYAGX3.cjs');
 require('../chunk-3OPYJG76.cjs');
-require('../chunk-UYPEN5XE.cjs');
-require('../chunk-7YN22L2H.cjs');
-require('../chunk-2DCNB7DF.cjs');
-require('../chunk-C72S6TTV.cjs');
+require('../chunk-RGTR7CIO.cjs');
 require('../chunk-DWKQZ2SK.cjs');
 require('../chunk-4VAVYUZS.cjs');
+require('../chunk-7YN22L2H.cjs');
+require('../chunk-SU2GCLAC.cjs');
+require('../chunk-C72S6TTV.cjs');
 require('../chunk-EYZYXJTJ.cjs');
 require('../chunk-YMFAJFQT.cjs');
-require('../chunk-XBSYYZIY.cjs');
+require('../chunk-SNYBEXLB.cjs');
+require('../chunk-46ZIFWYG.cjs');
+require('../chunk-GBHYAGX3.cjs');
+require('../chunk-RPII3E6Z.cjs');
+require('../chunk-6RPZADX3.cjs');
+require('../chunk-QWBWGODS.cjs');
+require('../chunk-UIBD2YY5.cjs');
 require('../chunk-R3HK6R4B.cjs');
-require('../chunk-KUU2RNG6.cjs');
-require('../chunk-LKZJEL6E.cjs');
+require('../chunk-HYN75H6G.cjs');
+require('../chunk-Q27JY5RG.cjs');
 require('../chunk-QXD4MV2X.cjs');
 require('../chunk-NYUNU75A.cjs');
-require('../chunk-N3V2J5ZO.cjs');
+require('../chunk-VQY5W4YW.cjs');
+require('../chunk-KFI44N2R.cjs');
 require('../chunk-SVNDB62D.cjs');
-require('../chunk-A2YMUCBT.cjs');
-require('../chunk-G2FUJNA2.cjs');
+require('../chunk-APYG5QD7.cjs');
+require('../chunk-L74VDN4A.cjs');
+require('../chunk-4YINUUKQ.cjs');
+require('../chunk-VACWOIRE.cjs');
 require('../chunk-QBZJ7P2T.cjs');
+require('../chunk-4IH4EL7M.cjs');
+require('../chunk-A2YMUCBT.cjs');
+require('../chunk-E3UCVHLP.cjs');
+require('../chunk-FCR77GYM.cjs');
+require('../chunk-AEOZIDEB.cjs');
+require('../chunk-XSVNC2UD.cjs');
 require('../chunk-SUEGJ75D.cjs');
 require('../chunk-RSJ3TWJQ.cjs');
 require('../chunk-YGXJGRFI.cjs');
+require('../chunk-OCEUVQHW.cjs');
 require('../chunk-NZYN7C3P.cjs');
-require('../chunk-V5KPWNYX.cjs');
-require('../chunk-6VIXXLMX.cjs');
+require('../chunk-JMJBSACD.cjs');
 require('../chunk-GMMT7RVN.cjs');
+require('../chunk-UNEFIWXI.cjs');
 
 
 
-exports.ProviderProxy = _chunkSN3YWBX7cjs.ProviderProxy; exports.isLoopbackAddress = _chunkSN3YWBX7cjs.isLoopbackAddress;
+exports.ProviderProxy = _chunkDKPXN34Vcjs.ProviderProxy; exports.isLoopbackAddress = _chunkDKPXN34Vcjs.isLoopbackAddress;