@omnicross/core 0.1.4 → 0.1.6

package/dist/outbound-api.js

@@ -3,6 +3,7 @@ import {
   ConcurrencyWaitCancelledError,
   ConcurrencyWaitTimeoutError,
   DEFAULT_ACCOUNT_PROBE,
+  DEFAULT_ALLOWANCE_SCHEDULING,
   DEFAULT_CONCURRENCY_QUEUE,
   DEFAULT_FINGERPRINT,
   DEFAULT_OUTBOUND_PORT,
@@ -10,19 +11,22 @@ import {
   KeySpendTracker,
   KeyedMutex,
   OUTBOUND_API_SERVER_CONFIG_KEY,
-  OutboundApiConfigError,
   OutboundApiServer,
   OutboundConcurrencyGate,
   OutboundRateLimiter,
   SerialQueueTimeoutError,
   UserMessageSerialQueue,
   __resetOutboundApiServerForTests,
+  candidateBackgroundModelIds,
+  candidateGatewayBindings,
   checkKeyQuota,
   computeKeyExpiry,
   computeVoucherGrant,
+  createIntegrationKey,
   createNamedKey,
   defaultServerConfig,
   formatUrls,
+  gatewayBindingToEndpointConfig,
   generateVoucherCode,
   getOutboundApiServer,
   handleVoucherRedeem,
@@ -32,13 +36,16 @@ import {
   isRedeemRequest,
   isSerialQueueTimeout,
   isUserMessageRequest,
+  legacyEndpointsToBindings,
   loadServerConfig,
   mergeServerConfig,
   newVoucherId,
   normalizeAccountProbe,
+  normalizeAllowanceScheduling,
   normalizeAudit,
   normalizeBilling,
   normalizeFingerprint,
+  normalizeGatewayBindings,
   normalizePrefixTargets,
   normalizeProxyConfig,
   normalizeProxySegment,
@@ -48,6 +55,7 @@ import {
   normalizeWebhookDestination,
   normalizeWebhookSegment,
   randomBase62,
+  resolveGatewayBinding,
   saveServerConfig,
   startOfLocalDay,
   startOfLocalWeek,
@@ -55,33 +63,38 @@ import {
   verifyKey,
   verifyPresentedKey,
   voucherCodePrefix
-} from "./chunk-QYTT6GE3.js";
+} from "./chunk-UDCC7EMR.js";
+import "./chunk-WB6PH56J.js";
 import "./chunk-VVEHS2LI.js";
 import "./chunk-46RLHI7D.js";
+import "./chunk-WNKWAEUR.js";
+import "./chunk-MZNPGW5Q.js";
 import "./chunk-DK4A7DLE.js";
-import "./chunk-VPBAUQ2M.js";
-import "./chunk-ZJZAOKI7.js";
-import "./chunk-FTQ7IQUC.js";
-import "./chunk-C7PSERMH.js";
-import "./chunk-TIER4SUC.js";
-import "./chunk-Z7LUNECE.js";
+import "./chunk-VRFBB5DB.js";
+import "./chunk-LVUCAWMK.js";
+import "./chunk-OEWZUX4G.js";
+import "./chunk-LB6EBS6Y.js";
+import "./chunk-6CL5HTPQ.js";
 import "./chunk-7VU7V2E4.js";
-import "./chunk-ZLX3KGXX.js";
+import "./chunk-UX7VWA46.js";
 import "./chunk-BPKCU575.js";
-import "./chunk-G2UTNSGU.js";
-import "./chunk-MZNPGW5Q.js";
+import "./chunk-DRWHTIIZ.js";
 import "./chunk-XTEI64OU.js";
 import "./chunk-XX6NQJMA.js";
-import "./chunk-IAXWICZU.js";
+import "./chunk-5ERIZW3D.js";
+import "./chunk-YJVHCHQX.js";
+import "./chunk-23S5OPIO.js";
+import "./chunk-AVYJ4YBN.js";
 import "./chunk-OE6TDIWW.js";
-import "./chunk-DRWHTIIZ.js";
-import "./chunk-IK3KE3AU.js";
+import "./chunk-OPRS4IQZ.js";
+import {
+  BoundAccountSelectionError,
+  boundAccountSelectionMessage,
+  isBoundAccountSelectionError
+} from "./chunk-2JYRIADS.js";
+import "./chunk-DE2SRBFZ.js";
 import "./chunk-ZY6KU6P3.js";
 import "./chunk-JWC6APFQ.js";
-import "./chunk-5ERIZW3D.js";
-import "./chunk-5ENKBSWO.js";
-import "./chunk-HRRYG2AX.js";
-import "./chunk-AVYJ4YBN.js";
 import {
   beginBillingCapture
 } from "./chunk-WLYIIEAF.js";
@@ -101,9 +114,8 @@ import {
   pickModelRefFromList,
   resolvePrefixTarget,
   resolveRoute,
-  validateEndpointModelConfig,
-  validateServerModelConfig
-} from "./chunk-UHGVBFU3.js";
+  validateEndpointModelConfig
+} from "./chunk-EBLFCNPY.js";
 import "./chunk-AQ5TNQB7.js";
 import {
   ENDPOINT_MODEL_KINDS
@@ -111,27 +123,31 @@ import {
 import "./chunk-H5JUT3KV.js";
 import {
   beginAuditCapture
-} from "./chunk-7Y47UCF2.js";
+} from "./chunk-IFXJ2BG7.js";
 import {
   AUDIT_REDACTED,
   redactAuditText
 } from "./chunk-K5NM7VAH.js";
 import "./chunk-WNY4WMRF.js";
 import "./chunk-OZFM4X3S.js";
-import "./chunk-5ZQBEOMD.js";
-import "./chunk-Z7Y2NPHY.js";
-import "./chunk-S4WBV25P.js";
-import "./chunk-XK5CIRMQ.js";
+import "./chunk-AT7B7SOZ.js";
+import "./chunk-N5T4M4GU.js";
+import "./chunk-TOVPMMHM.js";
+import "./chunk-SIZQQD6T.js";
+import "./chunk-SYQF7OIR.js";
+import "./chunk-MKF46GNZ.js";
 import "./chunk-CDHS2QDC.js";
 import "./chunk-Y7FO65VT.js";
 import "./chunk-FMOBD2OQ.js";
 import "./chunk-HUZZZ3JL.js";
 export {
   AUDIT_REDACTED,
+  BoundAccountSelectionError,
   ConcurrencyQueueFullError,
   ConcurrencyWaitCancelledError,
   ConcurrencyWaitTimeoutError,
   DEFAULT_ACCOUNT_PROBE,
+  DEFAULT_ALLOWANCE_SCHEDULING,
   DEFAULT_CONCURRENCY_QUEUE,
   DEFAULT_FINGERPRINT,
   DEFAULT_OUTBOUND_PORT,
@@ -140,7 +156,6 @@ export {
   KeySpendTracker,
   KeyedMutex,
   OUTBOUND_API_SERVER_CONFIG_KEY,
-  OutboundApiConfigError,
   OutboundApiServer,
   OutboundConcurrencyGate,
   OutboundRateLimiter,
@@ -150,10 +165,14 @@ export {
   __resetOutboundApiServerForTests,
   beginAuditCapture,
   beginBillingCapture,
+  boundAccountSelectionMessage,
+  candidateBackgroundModelIds,
+  candidateGatewayBindings,
   checkKeyQuota,
   classifyModelPrefix,
   computeKeyExpiry,
   computeVoucherGrant,
+  createIntegrationKey,
   createNamedKey,
   defaultServerConfig,
   detectModelKind,
@@ -161,25 +180,30 @@ export {
   endpointSupportsSubscription,
   endpointToIngressFormat,
   formatUrls,
+  gatewayBindingToEndpointConfig,
   generateVoucherCode,
   getOutboundApiServer,
   handleVoucherRedeem,
   hashKey,
   hashVoucherCode,
+  isBoundAccountSelectionError,
   isConcurrencyRejection,
   isKindMappedEndpoint,
   isRedeemRequest,
   isSerialQueueTimeout,
   isSubscriptionProviderId,
   isUserMessageRequest,
+  legacyEndpointsToBindings,
   loadServerConfig,
   mergeServerConfig,
   modelKindsForEndpoint,
   newVoucherId,
   normalizeAccountProbe,
+  normalizeAllowanceScheduling,
   normalizeAudit,
   normalizeBilling,
   normalizeFingerprint,
+  normalizeGatewayBindings,
   normalizePrefixTargets,
   normalizeProxyConfig,
   normalizeProxySegment,
@@ -192,6 +216,7 @@ export {
   pickModelRefFromList,
   randomBase62,
   redactAuditText,
+  resolveGatewayBinding,
   resolvePrefixTarget,
   resolveRoute,
   saveServerConfig,
@@ -199,7 +224,6 @@ export {
   startOfLocalWeek,
   toVoucherInfo,
   validateEndpointModelConfig,
-  validateServerModelConfig,
   verifyKey,
   verifyPresentedKey,
   voucherCodePrefix

package/dist/pipeline/AccountAllowanceScheduling.cjs

@@ -0,0 +1,15 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+
+
+var _chunk6QQG7YG3cjs = require('../chunk-6QQG7YG3.cjs');
+require('../chunk-HVBBDBS3.cjs');
+
+
+
+
+
+
+exports.AccountAllowanceExhaustedError = _chunk6QQG7YG3cjs.AccountAllowanceExhaustedError; exports.AccountAllowanceScheduling = _chunk6QQG7YG3cjs.AccountAllowanceScheduling; exports.__resetSharedAccountAllowanceSchedulingForTests = _chunk6QQG7YG3cjs.__resetSharedAccountAllowanceSchedulingForTests; exports.getSharedAccountAllowanceScheduling = _chunk6QQG7YG3cjs.getSharedAccountAllowanceScheduling; exports.isAccountAllowanceExhaustedError = _chunk6QQG7YG3cjs.isAccountAllowanceExhaustedError;

package/dist/pipeline/AccountAllowanceScheduling.d.cts

@@ -0,0 +1,90 @@
+import { SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
+import { a as AllowanceSchedulingConfig } from '../types-H3wGZSOo.cjs';
+import { AccountAllowanceStore } from './AccountAllowanceStore.cjs';
+import '@omnicross/contracts/account-tokens-types';
+import '@omnicross/contracts/audit-types';
+import '@omnicross/contracts/billing-types';
+import '@omnicross/contracts/health-logging-types';
+import '@omnicross/contracts/voucher-types';
+import '@omnicross/contracts/webhook-types';
+import '../logger-4GvQNzhE.cjs';
+import '../ports/provider-config-source.cjs';
+import '@omnicross/contracts/llm-config';
+import '../transformer/types.cjs';
+import '../transformer/TransformerService.cjs';
+import '../ProviderProxy-CnMQYN59.cjs';
+import '../provider-proxy/types.cjs';
+import 'node:http';
+import '@omnicross/contracts/completion-types';
+import '@omnicross/contracts/usage-types';
+import '../completion/ApiKeyPoolService.cjs';
+import './AuthSource.cjs';
+import './BoundAccountSelectionError.cjs';
+import './SubscriptionAuthSource.cjs';
+import './SubscriptionAuthStrategy.cjs';
+import '../ports/web-search-backend.cjs';
+import '@omnicross/contracts/websearch-types';
+import '../keyPolicy-zdWTu3CQ.cjs';
+import '@omnicross/contracts/account-allowance-types';
+
+/**
+ * Default-off allowance-aware scheduling policy.
+ *
+ * This layer consumes only normalized, secret-free snapshots. Missing, stale,
+ * unsupported, or reset-expired data is deliberately ignored so telemetry can
+ * never strand an account by accident.
+ */
+
+type AllowanceSchedulingAction = 'normal' | 'demote' | 'pause' | 'ignore';
+interface AllowanceSchedulingDecision {
+    providerId: SubscriptionProviderId;
+    accountId: string;
+    action: AllowanceSchedulingAction;
+    reason: 'policy-disabled' | 'provider-unsupported' | 'snapshot-missing' | 'snapshot-not-fresh' | 'below-threshold' | 'demote-threshold' | 'pause-threshold';
+    basePriority: number;
+    effectivePriority: number;
+    schedulable: boolean;
+    usedPercent?: number;
+    observedAt?: string;
+    resumeAt?: string;
+    decidedAt: string;
+}
+/**
+ * Safe, structured signal emitted only when an enabled allowance policy paused
+ * every otherwise eligible account. Request ingress maps it to HTTP 429 instead
+ * of disguising a local scheduling decision as an upstream 5xx.
+ */
+declare class AccountAllowanceExhaustedError extends Error {
+    readonly providerId: SubscriptionProviderId;
+    readonly resumeAt?: string | undefined;
+    readonly code = "account_allowance_exhausted";
+    readonly status = 429;
+    constructor(providerId: SubscriptionProviderId, resumeAt?: string | undefined);
+}
+/** Structural guard survives package/bundle boundaries and never inspects secrets. */
+declare function isAccountAllowanceExhaustedError(error: unknown): error is AccountAllowanceExhaustedError;
+declare class AccountAllowanceScheduling {
+    private readonly store;
+    private readonly now;
+    private config;
+    private readonly history;
+    private readonly lastRecorded;
+    constructor(store?: AccountAllowanceStore, now?: () => number);
+    configure(config: AllowanceSchedulingConfig | undefined): void;
+    getConfig(): AllowanceSchedulingConfig;
+    evaluate(providerId: SubscriptionProviderId, accountId: string, basePriority: number, now?: number): AllowanceSchedulingDecision;
+    /**
+     * Project the current policy result without recording an applied decision.
+     * Admin/read-model callers use this so polling an account list never creates
+     * synthetic demotion/pause history entries.
+     */
+    preview(providerId: SubscriptionProviderId, accountId: string, basePriority: number, now?: number): AllowanceSchedulingDecision;
+    private decide;
+    getHistory(): AllowanceSchedulingDecision[];
+    clearHistory(): void;
+    private recordApplied;
+}
+declare function getSharedAccountAllowanceScheduling(): AccountAllowanceScheduling;
+declare function __resetSharedAccountAllowanceSchedulingForTests(): void;
+
+export { AccountAllowanceExhaustedError, AccountAllowanceScheduling, type AllowanceSchedulingAction, type AllowanceSchedulingDecision, __resetSharedAccountAllowanceSchedulingForTests, getSharedAccountAllowanceScheduling, isAccountAllowanceExhaustedError };

package/dist/pipeline/AccountAllowanceScheduling.d.ts

@@ -0,0 +1,90 @@
+import { SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
+import { a as AllowanceSchedulingConfig } from '../types-hsoKrVQS.js';
+import { AccountAllowanceStore } from './AccountAllowanceStore.js';
+import '@omnicross/contracts/account-tokens-types';
+import '@omnicross/contracts/audit-types';
+import '@omnicross/contracts/billing-types';
+import '@omnicross/contracts/health-logging-types';
+import '@omnicross/contracts/voucher-types';
+import '@omnicross/contracts/webhook-types';
+import '../logger-4GvQNzhE.js';
+import '../ports/provider-config-source.js';
+import '@omnicross/contracts/llm-config';
+import '../transformer/types.js';
+import '../transformer/TransformerService.js';
+import '../ProviderProxy-C-xqrkKi.js';
+import '../provider-proxy/types.js';
+import 'node:http';
+import '@omnicross/contracts/completion-types';
+import '@omnicross/contracts/usage-types';
+import '../completion/ApiKeyPoolService.js';
+import './AuthSource.js';
+import './BoundAccountSelectionError.js';
+import './SubscriptionAuthSource.js';
+import './SubscriptionAuthStrategy.js';
+import '../ports/web-search-backend.js';
+import '@omnicross/contracts/websearch-types';
+import '../keyPolicy-zdWTu3CQ.js';
+import '@omnicross/contracts/account-allowance-types';
+
+/**
+ * Default-off allowance-aware scheduling policy.
+ *
+ * This layer consumes only normalized, secret-free snapshots. Missing, stale,
+ * unsupported, or reset-expired data is deliberately ignored so telemetry can
+ * never strand an account by accident.
+ */
+
+type AllowanceSchedulingAction = 'normal' | 'demote' | 'pause' | 'ignore';
+interface AllowanceSchedulingDecision {
+    providerId: SubscriptionProviderId;
+    accountId: string;
+    action: AllowanceSchedulingAction;
+    reason: 'policy-disabled' | 'provider-unsupported' | 'snapshot-missing' | 'snapshot-not-fresh' | 'below-threshold' | 'demote-threshold' | 'pause-threshold';
+    basePriority: number;
+    effectivePriority: number;
+    schedulable: boolean;
+    usedPercent?: number;
+    observedAt?: string;
+    resumeAt?: string;
+    decidedAt: string;
+}
+/**
+ * Safe, structured signal emitted only when an enabled allowance policy paused
+ * every otherwise eligible account. Request ingress maps it to HTTP 429 instead
+ * of disguising a local scheduling decision as an upstream 5xx.
+ */
+declare class AccountAllowanceExhaustedError extends Error {
+    readonly providerId: SubscriptionProviderId;
+    readonly resumeAt?: string | undefined;
+    readonly code = "account_allowance_exhausted";
+    readonly status = 429;
+    constructor(providerId: SubscriptionProviderId, resumeAt?: string | undefined);
+}
+/** Structural guard survives package/bundle boundaries and never inspects secrets. */
+declare function isAccountAllowanceExhaustedError(error: unknown): error is AccountAllowanceExhaustedError;
+declare class AccountAllowanceScheduling {
+    private readonly store;
+    private readonly now;
+    private config;
+    private readonly history;
+    private readonly lastRecorded;
+    constructor(store?: AccountAllowanceStore, now?: () => number);
+    configure(config: AllowanceSchedulingConfig | undefined): void;
+    getConfig(): AllowanceSchedulingConfig;
+    evaluate(providerId: SubscriptionProviderId, accountId: string, basePriority: number, now?: number): AllowanceSchedulingDecision;
+    /**
+     * Project the current policy result without recording an applied decision.
+     * Admin/read-model callers use this so polling an account list never creates
+     * synthetic demotion/pause history entries.
+     */
+    preview(providerId: SubscriptionProviderId, accountId: string, basePriority: number, now?: number): AllowanceSchedulingDecision;
+    private decide;
+    getHistory(): AllowanceSchedulingDecision[];
+    clearHistory(): void;
+    private recordApplied;
+}
+declare function getSharedAccountAllowanceScheduling(): AccountAllowanceScheduling;
+declare function __resetSharedAccountAllowanceSchedulingForTests(): void;
+
+export { AccountAllowanceExhaustedError, AccountAllowanceScheduling, type AllowanceSchedulingAction, type AllowanceSchedulingDecision, __resetSharedAccountAllowanceSchedulingForTests, getSharedAccountAllowanceScheduling, isAccountAllowanceExhaustedError };

package/dist/pipeline/AccountAllowanceScheduling.js

@@ -0,0 +1,15 @@
+import {
+  AccountAllowanceExhaustedError,
+  AccountAllowanceScheduling,
+  __resetSharedAccountAllowanceSchedulingForTests,
+  getSharedAccountAllowanceScheduling,
+  isAccountAllowanceExhaustedError
+} from "../chunk-OPRS4IQZ.js";
+import "../chunk-MKF46GNZ.js";
+export {
+  AccountAllowanceExhaustedError,
+  AccountAllowanceScheduling,
+  __resetSharedAccountAllowanceSchedulingForTests,
+  getSharedAccountAllowanceScheduling,
+  isAccountAllowanceExhaustedError
+};

package/dist/pipeline/AccountAllowanceStore.cjs

@@ -0,0 +1,20 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+
+
+
+
+
+var _chunkHVBBDBS3cjs = require('../chunk-HVBBDBS3.cjs');
+
+
+
+
+
+
+
+
+
+exports.AccountAllowanceStore = _chunkHVBBDBS3cjs.AccountAllowanceStore; exports.DEFAULT_ALLOWANCE_MAX_SNAPSHOTS = _chunkHVBBDBS3cjs.DEFAULT_ALLOWANCE_MAX_SNAPSHOTS; exports.DEFAULT_CODEX_ALLOWANCE_FRESH_MS = _chunkHVBBDBS3cjs.DEFAULT_CODEX_ALLOWANCE_FRESH_MS; exports.__resetSharedAccountAllowanceStoreForTests = _chunkHVBBDBS3cjs.__resetSharedAccountAllowanceStoreForTests; exports.getSharedAccountAllowanceStore = _chunkHVBBDBS3cjs.getSharedAccountAllowanceStore; exports.normalizeAccountAllowanceSnapshot = _chunkHVBBDBS3cjs.normalizeAccountAllowanceSnapshot; exports.parseCodexAllowanceHeaders = _chunkHVBBDBS3cjs.parseCodexAllowanceHeaders; exports.setSharedAccountAllowanceStore = _chunkHVBBDBS3cjs.setSharedAccountAllowanceStore;

package/dist/pipeline/AccountAllowanceStore.d.cts

@@ -0,0 +1,77 @@
+import { AccountAllowanceSnapshot } from '@omnicross/contracts/account-allowance-types';
+import { SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
+
+/**
+ * Secret-free upstream account allowance snapshots.
+ *
+ * Claude actively populates this store from the daemon. Codex is observed at the
+ * core egress seam so the response headers are attributed to the exact account id
+ * selected for that request. Only normalized numbers are retained; raw headers
+ * and credentials never enter the store. A host may inject a small persistence
+ * port; core deliberately does not know where that host stores the snapshot.
+ */
+
+declare const DEFAULT_CODEX_ALLOWANCE_FRESH_MS: number;
+declare const DEFAULT_ALLOWANCE_MAX_SNAPSHOTS = 256;
+type AllowanceHeadersLike = Headers | Record<string, string | string[] | number | null | undefined>;
+interface CodexAllowanceWindowObservation {
+    usedPercent?: number;
+    resetAfterSeconds?: number;
+    windowMinutes?: number;
+}
+interface CodexAllowanceObservation {
+    primary?: CodexAllowanceWindowObservation;
+    secondary?: CodexAllowanceWindowObservation;
+    primaryOverSecondaryLimitPercent?: number;
+}
+/** Host-owned persistence seam for normalized allowance snapshots. */
+interface AccountAllowancePersistence {
+    /** Return the decoded file payload, or any value for the store to validate. */
+    load(): unknown;
+    /** Replace the durable snapshot with this already-normalized bounded list. */
+    save(snapshots: readonly AccountAllowanceSnapshot[]): void;
+}
+/**
+ * Pick and normalize only the public DTO fields. This is used for both live
+ * writes and restart loads, so a structurally-cast object can never smuggle raw
+ * headers, response bodies, or token fields into the cache.
+ */
+declare function normalizeAccountAllowanceSnapshot(value: unknown): AccountAllowanceSnapshot | null;
+/** Parse only the documented numeric Codex allowance headers. */
+declare function parseCodexAllowanceHeaders(headers: AllowanceHeadersLike): CodexAllowanceObservation | null;
+/** In-memory allowance projection shared by serving/admin with optional host persistence. */
+declare class AccountAllowanceStore {
+    private readonly now;
+    private readonly codexFreshMs;
+    private readonly persistence?;
+    private readonly snapshots;
+    private readonly maxSnapshots;
+    constructor(now?: () => number, codexFreshMs?: number, persistence?: AccountAllowancePersistence | undefined, maxSnapshots?: number);
+    set(snapshot: AccountAllowanceSnapshot): void;
+    delete(providerId: SubscriptionProviderId, accountId: string): void;
+    /** Remove rows that no longer correspond to a configured account. */
+    pruneToKnownAccounts(accounts: Iterable<{
+        providerId: SubscriptionProviderId;
+        accountId: string;
+    }>): number;
+    get(providerId: SubscriptionProviderId, accountId: string, now?: number): AccountAllowanceSnapshot | null;
+    list(filter?: {
+        providerId?: SubscriptionProviderId;
+        accountId?: string;
+    }, now?: number): AccountAllowanceSnapshot[];
+    /**
+     * Merge one real Codex upstream response into the selected account's snapshot.
+     * A response with no recognized headers is a strict no-op, and a partial header
+     * set preserves previous values while marking untouched windows stale.
+     */
+    recordCodexHeaders(accountId: string, headers: AllowanceHeadersLike, observedMs?: number): AccountAllowanceSnapshot | null;
+    clear(): void;
+    private loadPersisted;
+    private persist;
+}
+declare function getSharedAccountAllowanceStore(): AccountAllowanceStore;
+declare function setSharedAccountAllowanceStore(store: AccountAllowanceStore): void;
+/** Test/daemon teardown seam. */
+declare function __resetSharedAccountAllowanceStoreForTests(): void;
+
+export { type AccountAllowancePersistence, AccountAllowanceStore, type AllowanceHeadersLike, type CodexAllowanceObservation, type CodexAllowanceWindowObservation, DEFAULT_ALLOWANCE_MAX_SNAPSHOTS, DEFAULT_CODEX_ALLOWANCE_FRESH_MS, __resetSharedAccountAllowanceStoreForTests, getSharedAccountAllowanceStore, normalizeAccountAllowanceSnapshot, parseCodexAllowanceHeaders, setSharedAccountAllowanceStore };

package/dist/pipeline/AccountAllowanceStore.d.ts

@@ -0,0 +1,77 @@
+import { AccountAllowanceSnapshot } from '@omnicross/contracts/account-allowance-types';
+import { SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
+
+/**
+ * Secret-free upstream account allowance snapshots.
+ *
+ * Claude actively populates this store from the daemon. Codex is observed at the
+ * core egress seam so the response headers are attributed to the exact account id
+ * selected for that request. Only normalized numbers are retained; raw headers
+ * and credentials never enter the store. A host may inject a small persistence
+ * port; core deliberately does not know where that host stores the snapshot.
+ */
+
+declare const DEFAULT_CODEX_ALLOWANCE_FRESH_MS: number;
+declare const DEFAULT_ALLOWANCE_MAX_SNAPSHOTS = 256;
+type AllowanceHeadersLike = Headers | Record<string, string | string[] | number | null | undefined>;
+interface CodexAllowanceWindowObservation {
+    usedPercent?: number;
+    resetAfterSeconds?: number;
+    windowMinutes?: number;
+}
+interface CodexAllowanceObservation {
+    primary?: CodexAllowanceWindowObservation;
+    secondary?: CodexAllowanceWindowObservation;
+    primaryOverSecondaryLimitPercent?: number;
+}
+/** Host-owned persistence seam for normalized allowance snapshots. */
+interface AccountAllowancePersistence {
+    /** Return the decoded file payload, or any value for the store to validate. */
+    load(): unknown;
+    /** Replace the durable snapshot with this already-normalized bounded list. */
+    save(snapshots: readonly AccountAllowanceSnapshot[]): void;
+}
+/**
+ * Pick and normalize only the public DTO fields. This is used for both live
+ * writes and restart loads, so a structurally-cast object can never smuggle raw
+ * headers, response bodies, or token fields into the cache.
+ */
+declare function normalizeAccountAllowanceSnapshot(value: unknown): AccountAllowanceSnapshot | null;
+/** Parse only the documented numeric Codex allowance headers. */
+declare function parseCodexAllowanceHeaders(headers: AllowanceHeadersLike): CodexAllowanceObservation | null;
+/** In-memory allowance projection shared by serving/admin with optional host persistence. */
+declare class AccountAllowanceStore {
+    private readonly now;
+    private readonly codexFreshMs;
+    private readonly persistence?;
+    private readonly snapshots;
+    private readonly maxSnapshots;
+    constructor(now?: () => number, codexFreshMs?: number, persistence?: AccountAllowancePersistence | undefined, maxSnapshots?: number);
+    set(snapshot: AccountAllowanceSnapshot): void;
+    delete(providerId: SubscriptionProviderId, accountId: string): void;
+    /** Remove rows that no longer correspond to a configured account. */
+    pruneToKnownAccounts(accounts: Iterable<{
+        providerId: SubscriptionProviderId;
+        accountId: string;
+    }>): number;
+    get(providerId: SubscriptionProviderId, accountId: string, now?: number): AccountAllowanceSnapshot | null;
+    list(filter?: {
+        providerId?: SubscriptionProviderId;
+        accountId?: string;
+    }, now?: number): AccountAllowanceSnapshot[];
+    /**
+     * Merge one real Codex upstream response into the selected account's snapshot.
+     * A response with no recognized headers is a strict no-op, and a partial header
+     * set preserves previous values while marking untouched windows stale.
+     */
+    recordCodexHeaders(accountId: string, headers: AllowanceHeadersLike, observedMs?: number): AccountAllowanceSnapshot | null;
+    clear(): void;
+    private loadPersisted;
+    private persist;
+}
+declare function getSharedAccountAllowanceStore(): AccountAllowanceStore;
+declare function setSharedAccountAllowanceStore(store: AccountAllowanceStore): void;
+/** Test/daemon teardown seam. */
+declare function __resetSharedAccountAllowanceStoreForTests(): void;
+
+export { type AccountAllowancePersistence, AccountAllowanceStore, type AllowanceHeadersLike, type CodexAllowanceObservation, type CodexAllowanceWindowObservation, DEFAULT_ALLOWANCE_MAX_SNAPSHOTS, DEFAULT_CODEX_ALLOWANCE_FRESH_MS, __resetSharedAccountAllowanceStoreForTests, getSharedAccountAllowanceStore, normalizeAccountAllowanceSnapshot, parseCodexAllowanceHeaders, setSharedAccountAllowanceStore };

package/dist/pipeline/AccountAllowanceStore.js

@@ -0,0 +1,20 @@
+import {
+  AccountAllowanceStore,
+  DEFAULT_ALLOWANCE_MAX_SNAPSHOTS,
+  DEFAULT_CODEX_ALLOWANCE_FRESH_MS,
+  __resetSharedAccountAllowanceStoreForTests,
+  getSharedAccountAllowanceStore,
+  normalizeAccountAllowanceSnapshot,
+  parseCodexAllowanceHeaders,
+  setSharedAccountAllowanceStore
+} from "../chunk-MKF46GNZ.js";
+export {
+  AccountAllowanceStore,
+  DEFAULT_ALLOWANCE_MAX_SNAPSHOTS,
+  DEFAULT_CODEX_ALLOWANCE_FRESH_MS,
+  __resetSharedAccountAllowanceStoreForTests,
+  getSharedAccountAllowanceStore,
+  normalizeAccountAllowanceSnapshot,
+  parseCodexAllowanceHeaders,
+  setSharedAccountAllowanceStore
+};

package/dist/pipeline/AuthSource.d.cts

@@ -1,3 +1,5 @@
+import { BoundAccountFallbackPolicy } from './BoundAccountSelectionError.cjs';
+
 /**
  * AuthSource — unified outbound-authentication strategy for the provider
  * request pipeline.
@@ -54,10 +56,17 @@ interface AuthApplyHints {
     reportSelection?: (accountId: string, isActive: boolean, remappedModel?: string) => void;
     /**
      * OPTIONAL preferred subscription account id (provider/subscription duality).
-     * When set and schedulable the account picker resolves it directly; absent or
-     * unschedulable ⇒ pool auto-schedule. BYO auth sources ignore it.
+     * When set, strict is the default; only the explicit `'pool'` policy permits
+     * pool fallback. BYO auth sources ignore both binding hints.
      */
     preferredAccountId?: string;
+    /** Optional account group selected by a resource-level gateway binding. */
+    preferredAccountGroup?: string;
+    /**
+     * Binding behavior. `'pool'` is an explicit opt-in; any other value used
+     * with a preferred account is treated as strict by the selector.
+     */
+    boundAccountFallbackPolicy?: BoundAccountFallbackPolicy;
 }
 /**
  * Result of {@link AuthSource.onResult}.