@omnicross/core 0.1.2 → 0.1.4

package/dist/chunk-VQY5W4YW.cjs

@@ -0,0 +1,311 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } var _class;// src/pipeline/SubscriptionAccountHealth.ts
+var OVERLOAD_TTL_MS = 10 * 6e4;
+var OVERLOAD_ENABLED_DEFAULT = true;
+var AUTH_ERROR_TTL_MS = 30 * 6e4;
+var SERVER_ERROR_TTL_MS = 5 * 6e4;
+var BAN_BODY_MARKERS = [
+  "this organization has been disabled",
+  "oauth authentication is currently not allowed"
+];
+function readHeader(headers, name) {
+  if (typeof headers.get === "function") {
+    return headers.get(name);
+  }
+  const rec = headers;
+  return _nullishCoalesce(_nullishCoalesce(rec[name], () => ( rec[name.toLowerCase()])), () => ( null));
+}
+function parseIntHeader(value) {
+  if (value == null) return null;
+  const n = Number.parseInt(value.trim(), 10);
+  return Number.isFinite(n) ? n : null;
+}
+function resolveResetSeconds(providerId, headers) {
+  const unified = parseIntHeader(readHeader(headers, "anthropic-ratelimit-unified-reset"));
+  if (providerId === "claude") {
+    return { resetHeaderSeconds: unified, retryAfterSeconds: null };
+  }
+  const providerReset = _nullishCoalesce(parseIntHeader(readHeader(headers, "x-ratelimit-reset")), () => ( parseIntHeader(readHeader(headers, "ratelimit-reset"))));
+  const retryAfter = parseIntHeader(readHeader(headers, "retry-after"));
+  return {
+    resetHeaderSeconds: _nullishCoalesce(unified, () => ( providerReset)),
+    retryAfterSeconds: retryAfter
+  };
+}
+function isBanBody(bodyText) {
+  if (!bodyText) return false;
+  const lower = bodyText.toLowerCase();
+  return BAN_BODY_MARKERS.some((marker) => lower.includes(marker));
+}
+function isRecordEmpty(record) {
+  return record.rateLimitEndAt === void 0 && record.overloadUntil === void 0 && record.tempUnavailableUntil === void 0 && !record.blocked;
+}
+var KEY_SEP = "\0";
+var SubscriptionAccountHealth = (_class = class {
+  __init() {this.records = /* @__PURE__ */ new Map()}
+  __init2() {this.listeners = /* @__PURE__ */ new Set()}
+  __init3() {this.anomalyListeners = /* @__PURE__ */ new Set()}
+  
+  
+  
+  
+  
+  constructor(opts = {}) {;_class.prototype.__init.call(this);_class.prototype.__init2.call(this);_class.prototype.__init3.call(this);
+    this.now = _nullishCoalesce(opts.now, () => ( Date.now));
+    this.overloadEnabled = _nullishCoalesce(opts.overloadEnabled, () => ( OVERLOAD_ENABLED_DEFAULT));
+    this.overloadTtlMs = _nullishCoalesce(opts.overloadTtlMs, () => ( OVERLOAD_TTL_MS));
+    this.authErrorTtlMs = _nullishCoalesce(opts.authErrorTtlMs, () => ( AUTH_ERROR_TTL_MS));
+    this.serverErrorTtlMs = _nullishCoalesce(opts.serverErrorTtlMs, () => ( SERVER_ERROR_TTL_MS));
+  }
+  /**
+   * Re-apply cooldown config to the LIVE shared instance (subscription-account-
+   * health, LEAD OQ1). `buildDaemon` is synchronous so it cannot await the
+   * persisted server config; the async `start.ts` path loads it and applies the
+   * `accountHealth` segment here — every strategy/relay/sweeper that already
+   * captured this instance picks the new values up. Only defined fields override.
+   */
+  configure(opts) {
+    if (opts.overloadEnabled !== void 0) this.overloadEnabled = opts.overloadEnabled;
+    if (opts.overloadTtlMs !== void 0) this.overloadTtlMs = opts.overloadTtlMs;
+    if (opts.authErrorTtlMs !== void 0) this.authErrorTtlMs = opts.authErrorTtlMs;
+    if (opts.serverErrorTtlMs !== void 0) this.serverErrorTtlMs = opts.serverErrorTtlMs;
+  }
+  /**
+   * Whether an account may be scheduled RIGHT NOW. `blocked` → false; any timer
+   * still in the future → false. Expired timers are lazily deleted on read (CRS
+   * lazy-clear parity) so an elapsed cooldown restores the account WITHOUT a
+   * timer — but the recovery SIGNAL is the sweeper's job (`sweepRecoveries`), so
+   * this read never emits (correctness is independent of the tick).
+   */
+  isSchedulable(providerId, accountId, now = this.now()) {
+    const key = this.key(providerId, accountId);
+    const record = this.records.get(key);
+    if (!record) return true;
+    if (record.blocked) return false;
+    const active = this.clearExpired(record, now);
+    if (!active && isRecordEmpty(record)) this.records.delete(key);
+    return !active;
+  }
+  /**
+   * The single marking entry point (design D3). Faithful to CRS status semantics:
+   *  - 429 + authoritative reset → `rateLimitEndAt`; a non-claude 429 may use
+   *    `retryAfterSeconds`; a bare 429 (no resolvable reset) is NOT marked;
+   *  - 529 → `overloadUntil` (gated by `overloadEnabled`);
+   *  - 403-ban body → `blocked` (permanent); plain 403 → transient;
+   *  - final-401 → transient; 5xx / thrown(null) → transient;
+   *  - non-429 4xx → NEUTRAL (never marked);
+   *  - 2xx → clear rate-limit + transient state (keep `blocked`).
+   */
+  recordUpstreamOutcome(providerId, accountId, input) {
+    const now = _nullishCoalesce(input.now, () => ( this.now()));
+    const key = this.key(providerId, accountId);
+    const preExisting = this.records.get(key);
+    const record = _nullishCoalesce(preExisting, () => ( {}));
+    const status = input.status;
+    const wasUnhealthyBefore = preExisting ? this.isUnhealthyAt(preExisting, now) : false;
+    let anomalyState;
+    let recovered = false;
+    if (status === null) {
+      record.tempUnavailableUntil = now + this.serverErrorTtlMs;
+    } else if (status >= 200 && status < 300) {
+      const wasUnhealthy = record.rateLimitEndAt !== void 0 || record.overloadUntil !== void 0 || record.tempUnavailableUntil !== void 0;
+      delete record.rateLimitEndAt;
+      delete record.overloadUntil;
+      delete record.tempUnavailableUntil;
+      recovered = wasUnhealthy && !record.blocked;
+    } else if (status === 429) {
+      if (input.resetHeaderSeconds != null) {
+        record.rateLimitEndAt = input.resetHeaderSeconds * 1e3;
+        anomalyState = "rate_limited";
+      } else if (input.retryAfterSeconds != null) {
+        record.rateLimitEndAt = now + input.retryAfterSeconds * 1e3;
+        anomalyState = "rate_limited";
+      }
+    } else if (status === 529) {
+      if (this.overloadEnabled) {
+        record.overloadUntil = now + this.overloadTtlMs;
+        anomalyState = "overloaded";
+      }
+    } else if (status === 403) {
+      if (isBanBody(input.bodyText)) {
+        record.blocked = true;
+        anomalyState = "blocked";
+      } else {
+        record.tempUnavailableUntil = now + this.authErrorTtlMs;
+        anomalyState = "unauthorized";
+      }
+    } else if (status === 401) {
+      record.tempUnavailableUntil = now + this.authErrorTtlMs;
+      anomalyState = "unauthorized";
+    } else if (status >= 500) {
+      record.tempUnavailableUntil = now + this.serverErrorTtlMs;
+    }
+    if (isRecordEmpty(record)) this.records.delete(key);
+    else this.records.set(key, record);
+    if (recovered) this.emit({ providerId, accountId, at: now, kind: "rateLimitRecovery" });
+    if (anomalyState && !wasUnhealthyBefore) {
+      this.emitAnomaly({ providerId, accountId, at: now, state: anomalyState });
+    }
+  }
+  /** Whether a record is unhealthy at `now`: blocked, or any timer still future. */
+  isUnhealthyAt(record, now) {
+    if (record.blocked) return true;
+    if (record.rateLimitEndAt !== void 0 && now < record.rateLimitEndAt) return true;
+    if (record.overloadUntil !== void 0 && now < record.overloadUntil) return true;
+    if (record.tempUnavailableUntil !== void 0 && now < record.tempUnavailableUntil) return true;
+    return false;
+  }
+  /**
+   * Clear ONLY the auth/transient unavailability mark (`tempUnavailableUntil`) —
+   * the narrow healing a background PROBE is allowed to do (subscription-account-
+   * probe #8, review M1). A probe 2xx from the lightweight `GET /v1/models` attests
+   * the TOKEN works (so a final-401 / plain-403 / 5xx transient may be healed), but
+   * it does NOT prove the traffic endpoint's rate-limit / overload has recovered —
+   * so it MUST NOT touch `rateLimitEndAt` / `overloadUntil` (those clear only on the
+   * upstream's authoritative reset, or a REAL-traffic 2xx). `blocked` (a ban) is
+   * never cleared here. Distinct from `recordUpstreamOutcome`'s 2xx path, which is
+   * UNCHANGED and still clears rate + transient together because it IS traffic.
+   * Returns whether a transient mark was actually cleared. Does NOT emit a recovery
+   * signal (a probe is internal maintenance; the account is schedulable-on-read).
+   */
+  clearTransientMark(providerId, accountId) {
+    const key = this.key(providerId, accountId);
+    const record = this.records.get(key);
+    if (!record || record.tempUnavailableUntil === void 0) return false;
+    delete record.tempUnavailableUntil;
+    if (isRecordEmpty(record)) this.records.delete(key);
+    else this.records.set(key, record);
+    return true;
+  }
+  /**
+   * Proactively surface accounts that transitioned unhealthy → schedulable since
+   * the last sweep (design D6). Clears their expired timers, emits a recovery
+   * signal for each through `onRecovered`, and returns the list. A `blocked`
+   * account never recovers here. Correctness does NOT depend on this running —
+   * `isSchedulable` already restores an elapsed cooldown lazily; this adds the
+   * proactive signal (#5/#8) + lets the daemon nudge a token refresh.
+   */
+  sweepRecoveries(now = this.now()) {
+    const recovered = [];
+    for (const [key, record] of this.records) {
+      if (record.blocked) continue;
+      const hadTimer = record.rateLimitEndAt !== void 0 || record.overloadUntil !== void 0 || record.tempUnavailableUntil !== void 0;
+      const active = this.clearExpired(record, now);
+      if (hadTimer && !active && isRecordEmpty(record)) {
+        const [pid, aid] = this.parseKey(key);
+        recovered.push({ providerId: pid, accountId: aid, at: now, kind: "rateLimitRecovery" });
+        this.records.delete(key);
+      }
+    }
+    for (const event of recovered) this.emit(event);
+    return recovered;
+  }
+  /** Admin-facing coarse status + cooldown-until for one account (secret-free). */
+  getStatus(providerId, accountId, now = this.now()) {
+    const record = this.records.get(this.key(providerId, accountId));
+    if (!record) return { state: "healthy" };
+    if (record.blocked) return { state: "blocked" };
+    if (record.rateLimitEndAt !== void 0 && now < record.rateLimitEndAt) {
+      return { state: "rate_limited", cooldownUntil: record.rateLimitEndAt };
+    }
+    if (record.overloadUntil !== void 0 && now < record.overloadUntil) {
+      return { state: "overloaded", cooldownUntil: record.overloadUntil };
+    }
+    if (record.tempUnavailableUntil !== void 0 && now < record.tempUnavailableUntil) {
+      return { state: "transient", cooldownUntil: record.tempUnavailableUntil };
+    }
+    return { state: "healthy" };
+  }
+  /**
+   * Register a recovery listener (the OQ3 seam #5 webhooks + #8 health-cron
+   * consume). Returns an unsubscribe function. Two edges fire it:
+   *  - TRAFFIC-DRIVEN: a `recordUpstreamOutcome` 2xx that clears an unhealthy
+   *    account (guaranteed — the sweep would miss it, as the 2xx deletes the
+   *    record first); and
+   *  - PURE-IDLE: `sweepRecoveries` when an idle account's cooldown elapsed with
+   *    no traffic (best-effort, on the 60s tick).
+   * A lazy `isSchedulable` read that heals an account does NOT emit (a request is
+   * already using it) — so consumers never double-count a recovery.
+   */
+  onRecovered(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  emit(event) {
+    for (const listener of this.listeners) {
+      try {
+        listener(event);
+      } catch (e) {
+      }
+    }
+  }
+  /**
+   * Register an anomaly listener (the ADDITIVE seam #5 webhooks consumes; the
+   * frozen `kind` discriminator on {@link AccountRecoveryEvent} anticipated it).
+   * Fires ONLY on the healthy→unhealthy EDGE inside `recordUpstreamOutcome`
+   * (de-duped: an already-unhealthy account escalating does NOT re-fire). Returns
+   * an unsubscribe function. Existing marking/recovery behavior is UNCHANGED.
+   */
+  onAnomaly(listener) {
+    this.anomalyListeners.add(listener);
+    return () => this.anomalyListeners.delete(listener);
+  }
+  emitAnomaly(event) {
+    for (const listener of this.anomalyListeners) {
+      try {
+        listener(event);
+      } catch (e2) {
+      }
+    }
+  }
+  /**
+   * Delete every EXPIRED timer field on the record in place; return whether any
+   * timer is STILL active (in the future). `blocked` is not a timer and is left
+   * untouched here (only an explicit reset / restart clears a ban).
+   */
+  clearExpired(record, now) {
+    let active = false;
+    if (record.rateLimitEndAt !== void 0) {
+      if (now >= record.rateLimitEndAt) delete record.rateLimitEndAt;
+      else active = true;
+    }
+    if (record.overloadUntil !== void 0) {
+      if (now >= record.overloadUntil) delete record.overloadUntil;
+      else active = true;
+    }
+    if (record.tempUnavailableUntil !== void 0) {
+      if (now >= record.tempUnavailableUntil) delete record.tempUnavailableUntil;
+      else active = true;
+    }
+    return active;
+  }
+  key(providerId, accountId) {
+    return `${providerId}${KEY_SEP}${accountId}`;
+  }
+  parseKey(key) {
+    const idx = key.indexOf(KEY_SEP);
+    return [key.slice(0, idx), key.slice(idx + 1)];
+  }
+}, _class);
+var _shared = null;
+function getSharedAccountHealth() {
+  if (!_shared) _shared = new SubscriptionAccountHealth();
+  return _shared;
+}
+function setSharedAccountHealth(instance) {
+  _shared = instance;
+}
+function __resetSharedAccountHealthForTests() {
+  _shared = null;
+}
+
+
+
+
+
+
+
+
+
+
+
+exports.OVERLOAD_TTL_MS = OVERLOAD_TTL_MS; exports.OVERLOAD_ENABLED_DEFAULT = OVERLOAD_ENABLED_DEFAULT; exports.AUTH_ERROR_TTL_MS = AUTH_ERROR_TTL_MS; exports.SERVER_ERROR_TTL_MS = SERVER_ERROR_TTL_MS; exports.resolveResetSeconds = resolveResetSeconds; exports.SubscriptionAccountHealth = SubscriptionAccountHealth; exports.getSharedAccountHealth = getSharedAccountHealth; exports.setSharedAccountHealth = setSharedAccountHealth; exports.__resetSharedAccountHealthForTests = __resetSharedAccountHealthForTests;

package/dist/chunk-WLYIIEAF.js

@@ -0,0 +1,50 @@
+import {
+  getBillingCaptureConfig,
+  publishBillingEvent
+} from "./chunk-TKJMZBAH.js";
+import {
+  readAuditUsage
+} from "./chunk-OZFM4X3S.js";
+
+// src/outbound-api/billingCapture.ts
+import { randomUUID } from "crypto";
+var defaultDefer = (fn) => {
+  setTimeout(fn, 0);
+};
+function beginBillingCapture(_req, res, now, defer = defaultDefer) {
+  if (!getBillingCaptureConfig()) return null;
+  const ctx = {};
+  let finished = false;
+  const finalize = () => {
+    if (finished) return;
+    finished = true;
+    const status = res.statusCode;
+    defer(() => {
+      try {
+        const usage = readAuditUsage(res);
+        if (!usage) return;
+        const event = {
+          id: randomUUID(),
+          ts: now,
+          model: ctx.model ?? usage.model ?? "",
+          authMode: ctx.authMode ?? "byo",
+          inputTokens: usage.inputTokens ?? 0,
+          outputTokens: usage.outputTokens ?? 0,
+          costUsd: usage.costUsd ?? 0,
+          status
+        };
+        if (ctx.keyId != null) event.keyId = ctx.keyId;
+        const provider = ctx.provider ?? usage.provider;
+        if (provider) event.provider = provider;
+        publishBillingEvent(event);
+      } catch {
+      }
+    });
+  };
+  res.once("close", finalize);
+  return ctx;
+}
+
+export {
+  beginBillingCapture
+};

package/dist/chunk-WNY4WMRF.js

@@ -0,0 +1,32 @@
+// src/pipeline/auditSink.ts
+var sink = null;
+var captureConfig = null;
+function setAuditSink(fn) {
+  sink = fn;
+}
+function setAuditCaptureConfig(config) {
+  captureConfig = config && config.enabled ? config : null;
+}
+function getAuditCaptureConfig() {
+  return captureConfig;
+}
+function recordAudit(record) {
+  const active = sink;
+  if (!active) return;
+  try {
+    active(record);
+  } catch {
+  }
+}
+function __resetAuditSinkForTests() {
+  sink = null;
+  captureConfig = null;
+}
+
+export {
+  setAuditSink,
+  setAuditCaptureConfig,
+  getAuditCaptureConfig,
+  recordAudit,
+  __resetAuditSinkForTests
+};

package/dist/chunk-XEKD23J5.js

@@ -0,0 +1,9 @@
+// src/outbound-api/types.ts
+var ENDPOINT_MODEL_KINDS = {
+  messages: ["fable", "opus", "sonnet", "haiku"],
+  responses: ["codex", "mini"]
+};
+
+export {
+  ENDPOINT_MODEL_KINDS
+};

package/dist/chunk-XK5CIRMQ.js

@@ -0,0 +1,112 @@
+// src/pipeline/upstreamFetch.ts
+import { Agent, buildConnector, ProxyAgent } from "undici";
+import { SocksClient } from "socks";
+var resolver = null;
+var generation = 0;
+var cache = /* @__PURE__ */ new Map();
+function setUpstreamProxyResolver(fn) {
+  resolver = fn;
+  bumpUpstreamProxyGeneration();
+}
+function bumpUpstreamProxyGeneration() {
+  generation += 1;
+  const old = cache;
+  cache = /* @__PURE__ */ new Map();
+  for (const dispatcher of old.values()) {
+    try {
+      void dispatcher.close?.();
+    } catch {
+    }
+  }
+}
+function normalizeProxy(cfg) {
+  if ("url" in cfg) {
+    let u;
+    try {
+      u = new URL(cfg.url);
+    } catch {
+      return void 0;
+    }
+    const proto = u.protocol.replace(/:$/, "").toLowerCase();
+    const kind2 = proto === "socks5" || proto === "socks" ? "socks5" : proto === "https" ? "https" : "http";
+    const port = u.port ? Number(u.port) : kind2 === "https" ? 443 : kind2 === "socks5" ? 1080 : 80;
+    if (!u.hostname || !Number.isFinite(port)) return void 0;
+    return {
+      kind: kind2,
+      host: u.hostname,
+      port,
+      username: u.username ? decodeURIComponent(u.username) : void 0,
+      password: u.password ? decodeURIComponent(u.password) : void 0
+    };
+  }
+  const kind = cfg.type === "socks5" ? "socks5" : cfg.type === "https" ? "https" : "http";
+  if (!cfg.host || !Number.isFinite(cfg.port)) return void 0;
+  return {
+    kind,
+    host: cfg.host,
+    port: cfg.port,
+    username: cfg.username || void 0,
+    password: cfg.password || void 0
+  };
+}
+function proxyKey(p) {
+  return `${p.kind}://${p.username ?? ""}:${p.password ?? ""}@${p.host}:${p.port}`;
+}
+function socksConnector(p) {
+  const base = buildConnector({});
+  return ((options, callback) => {
+    const destPort = Number(options.port) || (options.protocol === "https:" ? 443 : 80);
+    SocksClient.createConnection({
+      proxy: { host: p.host, port: p.port, type: 5, userId: p.username, password: p.password },
+      command: "connect",
+      destination: { host: options.hostname, port: destPort }
+    }).then(({ socket }) => {
+      base({ ...options, httpSocket: socket }, callback);
+    }).catch((err) => callback(err, null));
+  });
+}
+function buildDispatcher(p) {
+  if (p.kind === "socks5") {
+    return new Agent({ connect: socksConnector(p) });
+  }
+  const auth = p.username != null ? `${encodeURIComponent(p.username)}:${encodeURIComponent(p.password ?? "")}@` : "";
+  const uri = `${p.kind}://${auth}${p.host}:${p.port}`;
+  return new ProxyAgent({ uri });
+}
+function resolveUpstreamDispatcher(ctx) {
+  const active = resolver;
+  if (!active) return void 0;
+  let cfg;
+  try {
+    cfg = active(ctx);
+  } catch {
+    return void 0;
+  }
+  if (!cfg) return void 0;
+  const norm = normalizeProxy(cfg);
+  if (!norm) return void 0;
+  const key = `${generation}\0${proxyKey(norm)}`;
+  let dispatcher = cache.get(key);
+  if (!dispatcher) {
+    dispatcher = buildDispatcher(norm);
+    cache.set(key, dispatcher);
+  }
+  return dispatcher;
+}
+function fetchUpstream(url, init, ctx) {
+  const dispatcher = resolveUpstreamDispatcher({ ...ctx ?? {}, url });
+  if (!dispatcher) return fetch(url, init);
+  return fetch(url, { ...init, dispatcher });
+}
+function __resetUpstreamProxyForTests() {
+  resolver = null;
+  bumpUpstreamProxyGeneration();
+}
+
+export {
+  setUpstreamProxyResolver,
+  bumpUpstreamProxyGeneration,
+  resolveUpstreamDispatcher,
+  fetchUpstream,
+  __resetUpstreamProxyForTests
+};

package/dist/chunk-XSVNC2UD.cjs

@@ -0,0 +1,18 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});// src/pipeline/auditUsageStash.ts
+var stash = /* @__PURE__ */ new WeakMap();
+function stashAuditUsage(key, detail) {
+  const existing = stash.get(key);
+  stash.set(key, existing ? { ...existing, ...detail } : { ...detail });
+}
+function readAuditUsage(key) {
+  return stash.get(key);
+}
+function __clearAuditUsageForTests(key) {
+  stash.delete(key);
+}
+
+
+
+
+
+exports.stashAuditUsage = stashAuditUsage; exports.readAuditUsage = readAuditUsage; exports.__clearAuditUsageForTests = __clearAuditUsageForTests;

package/dist/chunk-XTEI64OU.js

@@ -0,0 +1,145 @@
+import {
+  refreshNonStainless,
+  sanitizeFrozenHeaders
+} from "./chunk-XX6NQJMA.js";
+
+// src/provider-proxy/identity/SubscriptionIdentityStore.ts
+var CC_HEADER_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
+var KEY_SEP = "\0";
+function normalizeUa(ua) {
+  if (typeof ua !== "string") return void 0;
+  const trimmed = ua.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+var SubscriptionIdentityStore = class {
+  identities = /* @__PURE__ */ new Map();
+  now;
+  enabled;
+  ua;
+  ccHeaderTtlMs;
+  persistence = null;
+  constructor(opts = {}) {
+    this.now = opts.now ?? Date.now;
+    this.enabled = opts.enabled ?? false;
+    this.ua = normalizeUa(opts.ua);
+    this.ccHeaderTtlMs = opts.ccHeaderTtlMs ?? CC_HEADER_TTL_MS;
+  }
+  /** Whether capture/replay is engaged (config flag). */
+  isEnabled() {
+    return this.enabled;
+  }
+  /** The operator UA baseline (piece 4), or undefined when unset. */
+  uaBaseline() {
+    return this.ua;
+  }
+  /**
+   * Re-apply config to the LIVE shared instance (bootstrap, mirroring the health
+   * tracker's `configure`). Only defined fields override; `ua: null` clears the
+   * baseline.
+   */
+  configure(opts) {
+    if (opts.enabled !== void 0) this.enabled = opts.enabled;
+    if (opts.ua !== void 0) this.ua = normalizeUa(opts.ua ?? void 0);
+  }
+  /** Install (or clear) the write-through persistence port (P2). */
+  setPersistence(port) {
+    this.persistence = port;
+  }
+  /**
+   * Boot seed (P2, D5): install a PERSISTED identity for an account, but NEVER
+   * over a live in-memory capture (a re-captured identity from this session wins).
+   * A no-op for an empty/absent identity. Does NOT write back through the port.
+   */
+  seed(providerId, accountId, identity) {
+    if (!accountId || !identity) return;
+    const headers = sanitizeFrozenHeaders(identity.headers ?? {});
+    if (Object.keys(headers).length === 0) return;
+    const key = this.key(providerId, accountId);
+    if (this.identities.has(key)) return;
+    this.identities.set(key, {
+      headers,
+      capturedAt: typeof identity.capturedAt === "number" ? identity.capturedAt : this.now()
+    });
+  }
+  /**
+   * Capture a real client's fingerprint headers for an account. First-seen ⇒
+   * FREEZE the whole (sanitized) bag. Already-frozen ⇒ within the TTL, no change
+   * (stable identity); past the TTL, refresh the NON-stainless headers from the
+   * new observation while keeping stainless frozen-stable (P2). An empty/absent
+   * account id or an empty sanitized bag is a no-op (so an account with no
+   * fingerprint headers never freezes an empty identity → the caller falls back
+   * to the UA baseline). Fires the persistence port on a freeze/refresh.
+   */
+  capture(providerId, accountId, incoming, now = this.now()) {
+    if (!accountId) return;
+    const clean = sanitizeFrozenHeaders(incoming);
+    if (Object.keys(clean).length === 0) return;
+    const key = this.key(providerId, accountId);
+    const existing = this.identities.get(key);
+    if (!existing) {
+      const frozen = { headers: clean, capturedAt: now };
+      this.identities.set(key, frozen);
+      this.emitPersist(providerId, accountId, frozen);
+      return;
+    }
+    if (now - existing.capturedAt < this.ccHeaderTtlMs) return;
+    const refreshed = {
+      headers: refreshNonStainless(existing.headers, clean),
+      capturedAt: now
+    };
+    this.identities.set(key, refreshed);
+    this.emitPersist(providerId, accountId, refreshed);
+  }
+  /**
+   * The frozen identity headers for an account, or `undefined` when none is
+   * frozen (or the frozen set is empty). Returns a COPY (the caller merges it into
+   * a mutable outbound header bag).
+   */
+  replay(providerId, accountId) {
+    if (!accountId) return void 0;
+    const frozen = this.identities.get(this.key(providerId, accountId));
+    if (!frozen || Object.keys(frozen.headers).length === 0) return void 0;
+    return { ...frozen.headers };
+  }
+  /** Whether an identity is frozen for an account (admin coarse status — D7). */
+  hasIdentity(providerId, accountId) {
+    const frozen = this.identities.get(this.key(providerId, accountId));
+    return !!frozen && Object.keys(frozen.headers).length > 0;
+  }
+  /** The freeze/refresh time for an account's identity (admin coarse status). */
+  capturedAt(providerId, accountId) {
+    return this.identities.get(this.key(providerId, accountId))?.capturedAt;
+  }
+  emitPersist(providerId, accountId, identity) {
+    if (!this.persistence) return;
+    try {
+      this.persistence.persist(providerId, accountId, {
+        headers: { ...identity.headers },
+        capturedAt: identity.capturedAt
+      });
+    } catch {
+    }
+  }
+  key(providerId, accountId) {
+    return `${providerId}${KEY_SEP}${accountId}`;
+  }
+};
+var _shared = null;
+function getSharedIdentityStore() {
+  if (!_shared) _shared = new SubscriptionIdentityStore();
+  return _shared;
+}
+function setSharedIdentityStore(instance) {
+  _shared = instance;
+}
+function __resetSharedIdentityStoreForTests() {
+  _shared = null;
+}
+
+export {
+  CC_HEADER_TTL_MS,
+  SubscriptionIdentityStore,
+  getSharedIdentityStore,
+  setSharedIdentityStore,
+  __resetSharedIdentityStoreForTests
+};