@omnicross/core 0.1.4 → 0.1.6

package/dist/pipeline/AuthSource.d.ts

@@ -1,3 +1,5 @@
+import { BoundAccountFallbackPolicy } from './BoundAccountSelectionError.js';
+
 /**
  * AuthSource — unified outbound-authentication strategy for the provider
  * request pipeline.
@@ -54,10 +56,17 @@ interface AuthApplyHints {
     reportSelection?: (accountId: string, isActive: boolean, remappedModel?: string) => void;
     /**
      * OPTIONAL preferred subscription account id (provider/subscription duality).
-     * When set and schedulable the account picker resolves it directly; absent or
-     * unschedulable ⇒ pool auto-schedule. BYO auth sources ignore it.
+     * When set, strict is the default; only the explicit `'pool'` policy permits
+     * pool fallback. BYO auth sources ignore both binding hints.
      */
     preferredAccountId?: string;
+    /** Optional account group selected by a resource-level gateway binding. */
+    preferredAccountGroup?: string;
+    /**
+     * Binding behavior. `'pool'` is an explicit opt-in; any other value used
+     * with a preferred account is treated as strict by the selector.
+     */
+    boundAccountFallbackPolicy?: BoundAccountFallbackPolicy;
 }
 /**
  * Result of {@link AuthSource.onResult}.

package/dist/pipeline/BoundAccountSelectionError.cjs

@@ -0,0 +1,10 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+var _chunk25GXJCEZcjs = require('../chunk-25GXJCEZ.cjs');
+
+
+
+
+exports.BoundAccountSelectionError = _chunk25GXJCEZcjs.BoundAccountSelectionError; exports.boundAccountSelectionMessage = _chunk25GXJCEZcjs.boundAccountSelectionMessage; exports.isBoundAccountSelectionError = _chunk25GXJCEZcjs.isBoundAccountSelectionError;

package/dist/pipeline/BoundAccountSelectionError.d.cts

@@ -0,0 +1,28 @@
+/**
+ * Secret-free failure contract for a strict outbound subscription-account
+ * binding. The selector throws this value only when an endpoint explicitly (or
+ * by the migrated default) requires its bound account to serve the request.
+ */
+/** Persisted policy for an endpoint that binds a subscription account. */
+type BoundAccountFallbackPolicy = 'strict' | 'pool';
+/** Bounded reasons a strict bound account can refuse a request. */
+type BoundAccountSelectionFailureReason = 'unavailable' | 'not-found' | 'disabled' | 'unhealthy' | 'model-incompatible' | 'allowance-paused' | 'empty-token';
+/** Return the fixed public message for a validated failure reason. */
+declare function boundAccountSelectionMessage(reason: BoundAccountSelectionFailureReason): string;
+/**
+ * Stable, non-secret error thrown by strict account selection. Account ids and
+ * token material are intentionally absent from both the message and the wire
+ * projection; the reason is a small fixed vocabulary.
+ */
+declare class BoundAccountSelectionError extends Error {
+    readonly providerId: string;
+    readonly reason: BoundAccountSelectionFailureReason;
+    readonly resumeAt?: string | undefined;
+    readonly code: "bound_account_unavailable";
+    readonly status: 429 | 503;
+    constructor(providerId: string, reason: BoundAccountSelectionFailureReason, resumeAt?: string | undefined);
+}
+/** Structural guard that survives package/bundle boundaries. */
+declare function isBoundAccountSelectionError(error: unknown): error is BoundAccountSelectionError;
+
+export { type BoundAccountFallbackPolicy, BoundAccountSelectionError, type BoundAccountSelectionFailureReason, boundAccountSelectionMessage, isBoundAccountSelectionError };

package/dist/pipeline/BoundAccountSelectionError.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Secret-free failure contract for a strict outbound subscription-account
+ * binding. The selector throws this value only when an endpoint explicitly (or
+ * by the migrated default) requires its bound account to serve the request.
+ */
+/** Persisted policy for an endpoint that binds a subscription account. */
+type BoundAccountFallbackPolicy = 'strict' | 'pool';
+/** Bounded reasons a strict bound account can refuse a request. */
+type BoundAccountSelectionFailureReason = 'unavailable' | 'not-found' | 'disabled' | 'unhealthy' | 'model-incompatible' | 'allowance-paused' | 'empty-token';
+/** Return the fixed public message for a validated failure reason. */
+declare function boundAccountSelectionMessage(reason: BoundAccountSelectionFailureReason): string;
+/**
+ * Stable, non-secret error thrown by strict account selection. Account ids and
+ * token material are intentionally absent from both the message and the wire
+ * projection; the reason is a small fixed vocabulary.
+ */
+declare class BoundAccountSelectionError extends Error {
+    readonly providerId: string;
+    readonly reason: BoundAccountSelectionFailureReason;
+    readonly resumeAt?: string | undefined;
+    readonly code: "bound_account_unavailable";
+    readonly status: 429 | 503;
+    constructor(providerId: string, reason: BoundAccountSelectionFailureReason, resumeAt?: string | undefined);
+}
+/** Structural guard that survives package/bundle boundaries. */
+declare function isBoundAccountSelectionError(error: unknown): error is BoundAccountSelectionError;
+
+export { type BoundAccountFallbackPolicy, BoundAccountSelectionError, type BoundAccountSelectionFailureReason, boundAccountSelectionMessage, isBoundAccountSelectionError };

package/dist/pipeline/BoundAccountSelectionError.js

@@ -0,0 +1,10 @@
+import {
+  BoundAccountSelectionError,
+  boundAccountSelectionMessage,
+  isBoundAccountSelectionError
+} from "../chunk-2JYRIADS.js";
+export {
+  BoundAccountSelectionError,
+  boundAccountSelectionMessage,
+  isBoundAccountSelectionError
+};

package/dist/pipeline/LlmConfigProviderAuth.d.cts

@@ -2,6 +2,7 @@ import { LLMProvider } from '@omnicross/contracts/llm-config';
 import { ApiKeyPoolService } from '../completion/ApiKeyPoolService.cjs';
 import { AuthSource, AuthApplyHints, AuthResultOutcome } from './AuthSource.cjs';
 import '../logger-4GvQNzhE.cjs';
+import './BoundAccountSelectionError.cjs';
 
 /**
  * LlmConfigProviderAuth — `AuthSource` for LLM-config provider rows.

package/dist/pipeline/LlmConfigProviderAuth.d.ts

@@ -2,6 +2,7 @@ import { LLMProvider } from '@omnicross/contracts/llm-config';
 import { ApiKeyPoolService } from '../completion/ApiKeyPoolService.js';
 import { AuthSource, AuthApplyHints, AuthResultOutcome } from './AuthSource.js';
 import '../logger-4GvQNzhE.js';
+import './BoundAccountSelectionError.js';
 
 /**
  * LlmConfigProviderAuth — `AuthSource` for LLM-config provider rows.

package/dist/pipeline/SubscriptionAccountHealth.cjs

@@ -8,8 +8,8 @@
 
 
 
-var _chunkVQY5W4YWcjs = require('../chunk-VQY5W4YW.cjs');
 
+var _chunkYK57NMIFcjs = require('../chunk-YK57NMIF.cjs');
 
 
 
@@ -19,4 +19,6 @@ var _chunkVQY5W4YWcjs = require('../chunk-VQY5W4YW.cjs');
 
 
 
-exports.AUTH_ERROR_TTL_MS = _chunkVQY5W4YWcjs.AUTH_ERROR_TTL_MS; exports.OVERLOAD_ENABLED_DEFAULT = _chunkVQY5W4YWcjs.OVERLOAD_ENABLED_DEFAULT; exports.OVERLOAD_TTL_MS = _chunkVQY5W4YWcjs.OVERLOAD_TTL_MS; exports.SERVER_ERROR_TTL_MS = _chunkVQY5W4YWcjs.SERVER_ERROR_TTL_MS; exports.SubscriptionAccountHealth = _chunkVQY5W4YWcjs.SubscriptionAccountHealth; exports.__resetSharedAccountHealthForTests = _chunkVQY5W4YWcjs.__resetSharedAccountHealthForTests; exports.getSharedAccountHealth = _chunkVQY5W4YWcjs.getSharedAccountHealth; exports.resolveResetSeconds = _chunkVQY5W4YWcjs.resolveResetSeconds; exports.setSharedAccountHealth = _chunkVQY5W4YWcjs.setSharedAccountHealth;
+
+
+exports.ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT = _chunkYK57NMIFcjs.ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT; exports.AUTH_ERROR_TTL_MS = _chunkYK57NMIFcjs.AUTH_ERROR_TTL_MS; exports.OVERLOAD_ENABLED_DEFAULT = _chunkYK57NMIFcjs.OVERLOAD_ENABLED_DEFAULT; exports.OVERLOAD_TTL_MS = _chunkYK57NMIFcjs.OVERLOAD_TTL_MS; exports.SERVER_ERROR_TTL_MS = _chunkYK57NMIFcjs.SERVER_ERROR_TTL_MS; exports.SubscriptionAccountHealth = _chunkYK57NMIFcjs.SubscriptionAccountHealth; exports.__resetSharedAccountHealthForTests = _chunkYK57NMIFcjs.__resetSharedAccountHealthForTests; exports.getSharedAccountHealth = _chunkYK57NMIFcjs.getSharedAccountHealth; exports.resolveResetSeconds = _chunkYK57NMIFcjs.resolveResetSeconds; exports.setSharedAccountHealth = _chunkYK57NMIFcjs.setSharedAccountHealth;

package/dist/pipeline/SubscriptionAccountHealth.d.cts

@@ -27,9 +27,9 @@
 declare const OVERLOAD_TTL_MS: number;
 /** 529 overload cooldown enabled by default (LEAD OQ1). */
 declare const OVERLOAD_ENABLED_DEFAULT = true;
-/** Transient cooldown for a final-401 / plain-403 (CRS auth_error 1800s). */
+/** Transient cooldown for a final 401 or non-ban 403 response. */
 declare const AUTH_ERROR_TTL_MS: number;
-/** Transient cooldown for a 5xx / thrown network failure (CRS server_error 300s). */
+/** Transient cooldown for a 5xx response or network failure. */
 declare const SERVER_ERROR_TTL_MS: number;
 /** Per-account health record (all timers are epoch ms). Absent fields ⇒ healthy. */
 interface HealthRecord {
@@ -89,6 +89,30 @@ interface AccountAnomalyEvent {
 }
 /** An anomaly listener (fire-and-forget; the emitter never awaits it). */
 type AccountAnomalyListener = (event: AccountAnomalyEvent) => void;
+/**
+ * Admin-readable projection of the existing health event stream. It is kept in
+ * the tracker itself so webhooks and diagnostics consume the same edge events;
+ * this is not a second marking/event mechanism. Only opaque ids, timestamps,
+ * and coarse states are retained.
+ */
+type AccountHealthDiagnostic = {
+    kind: 'health-anomaly';
+    providerId: string;
+    accountId: string;
+    at: number;
+    state: AccountAnomalyState;
+} | {
+    kind: 'health-recovery';
+    providerId: string;
+    accountId: string;
+    at: number;
+};
+interface AccountHealthDiagnosticFilter {
+    providerId?: string;
+    accountId?: string;
+    limit?: number;
+}
+declare const ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT = 200;
 /** The inputs one upstream attempt contributes to health marking (design D3). */
 interface RecordUpstreamOutcomeInput {
     /** The final HTTP status, or `null` for a thrown / network failure. */
@@ -134,6 +158,7 @@ declare class SubscriptionAccountHealth {
     private readonly records;
     private readonly listeners;
     private readonly anomalyListeners;
+    private readonly diagnostics;
     private readonly now;
     private overloadEnabled;
     private overloadTtlMs;
@@ -150,14 +175,14 @@ declare class SubscriptionAccountHealth {
     configure(opts: Pick<SubscriptionAccountHealthOptions, 'overloadEnabled' | 'overloadTtlMs' | 'authErrorTtlMs' | 'serverErrorTtlMs'>): void;
     /**
      * Whether an account may be scheduled RIGHT NOW. `blocked` → false; any timer
-     * still in the future → false. Expired timers are lazily deleted on read (CRS
-     * lazy-clear parity) so an elapsed cooldown restores the account WITHOUT a
+     * still in the future → false. Expired timers are lazily deleted on read so
+     * an elapsed cooldown restores the account WITHOUT a
      * timer — but the recovery SIGNAL is the sweeper's job (`sweepRecoveries`), so
      * this read never emits (correctness is independent of the tick).
      */
     isSchedulable(providerId: string, accountId: string, now?: number): boolean;
     /**
-     * The single marking entry point (design D3). Faithful to CRS status semantics:
+     * The single marking entry point (design D3):
      *  - 429 + authoritative reset → `rateLimitEndAt`; a non-claude 429 may use
      *    `retryAfterSeconds`; a bare 429 (no resolvable reset) is NOT marked;
      *  - 529 → `overloadUntil` (gated by `overloadEnabled`);
@@ -194,6 +219,8 @@ declare class SubscriptionAccountHealth {
     sweepRecoveries(now?: number): AccountRecoveryEvent[];
     /** Admin-facing coarse status + cooldown-until for one account (secret-free). */
     getStatus(providerId: string, accountId: string, now?: number): AccountHealthStatus;
+    /** Return newest-first, bounded, secret-free health edge diagnostics. */
+    getDiagnostics(filter?: AccountHealthDiagnosticFilter): AccountHealthDiagnostic[];
     /**
      * Register a recovery listener (the OQ3 seam #5 webhooks + #8 health-cron
      * consume). Returns an unsubscribe function. Two edges fire it:
@@ -216,6 +243,7 @@ declare class SubscriptionAccountHealth {
      */
     onAnomaly(listener: AccountAnomalyListener): () => void;
     private emitAnomaly;
+    private recordDiagnostic;
     /**
      * Delete every EXPIRED timer field on the record in place; return whether any
      * timer is STILL active (in the future). `blocked` is not a timer and is left
@@ -232,4 +260,4 @@ declare function setSharedAccountHealth(instance: SubscriptionAccountHealth): vo
 /** Reset the shared singleton (tests / teardown only). */
 declare function __resetSharedAccountHealthForTests(): void;
 
-export { AUTH_ERROR_TTL_MS, type AccountAnomalyEvent, type AccountAnomalyListener, type AccountAnomalyState, type AccountHealthState, type AccountHealthStatus, type AccountRecoveryEvent, type AccountRecoveryListener, type HeadersLike, type HealthRecord, OVERLOAD_ENABLED_DEFAULT, OVERLOAD_TTL_MS, type RecordUpstreamOutcomeInput, SERVER_ERROR_TTL_MS, SubscriptionAccountHealth, type SubscriptionAccountHealthOptions, __resetSharedAccountHealthForTests, getSharedAccountHealth, resolveResetSeconds, setSharedAccountHealth };
+export { ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT, AUTH_ERROR_TTL_MS, type AccountAnomalyEvent, type AccountAnomalyListener, type AccountAnomalyState, type AccountHealthDiagnostic, type AccountHealthDiagnosticFilter, type AccountHealthState, type AccountHealthStatus, type AccountRecoveryEvent, type AccountRecoveryListener, type HeadersLike, type HealthRecord, OVERLOAD_ENABLED_DEFAULT, OVERLOAD_TTL_MS, type RecordUpstreamOutcomeInput, SERVER_ERROR_TTL_MS, SubscriptionAccountHealth, type SubscriptionAccountHealthOptions, __resetSharedAccountHealthForTests, getSharedAccountHealth, resolveResetSeconds, setSharedAccountHealth };

package/dist/pipeline/SubscriptionAccountHealth.d.ts

@@ -27,9 +27,9 @@
 declare const OVERLOAD_TTL_MS: number;
 /** 529 overload cooldown enabled by default (LEAD OQ1). */
 declare const OVERLOAD_ENABLED_DEFAULT = true;
-/** Transient cooldown for a final-401 / plain-403 (CRS auth_error 1800s). */
+/** Transient cooldown for a final 401 or non-ban 403 response. */
 declare const AUTH_ERROR_TTL_MS: number;
-/** Transient cooldown for a 5xx / thrown network failure (CRS server_error 300s). */
+/** Transient cooldown for a 5xx response or network failure. */
 declare const SERVER_ERROR_TTL_MS: number;
 /** Per-account health record (all timers are epoch ms). Absent fields ⇒ healthy. */
 interface HealthRecord {
@@ -89,6 +89,30 @@ interface AccountAnomalyEvent {
 }
 /** An anomaly listener (fire-and-forget; the emitter never awaits it). */
 type AccountAnomalyListener = (event: AccountAnomalyEvent) => void;
+/**
+ * Admin-readable projection of the existing health event stream. It is kept in
+ * the tracker itself so webhooks and diagnostics consume the same edge events;
+ * this is not a second marking/event mechanism. Only opaque ids, timestamps,
+ * and coarse states are retained.
+ */
+type AccountHealthDiagnostic = {
+    kind: 'health-anomaly';
+    providerId: string;
+    accountId: string;
+    at: number;
+    state: AccountAnomalyState;
+} | {
+    kind: 'health-recovery';
+    providerId: string;
+    accountId: string;
+    at: number;
+};
+interface AccountHealthDiagnosticFilter {
+    providerId?: string;
+    accountId?: string;
+    limit?: number;
+}
+declare const ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT = 200;
 /** The inputs one upstream attempt contributes to health marking (design D3). */
 interface RecordUpstreamOutcomeInput {
     /** The final HTTP status, or `null` for a thrown / network failure. */
@@ -134,6 +158,7 @@ declare class SubscriptionAccountHealth {
     private readonly records;
     private readonly listeners;
     private readonly anomalyListeners;
+    private readonly diagnostics;
     private readonly now;
     private overloadEnabled;
     private overloadTtlMs;
@@ -150,14 +175,14 @@ declare class SubscriptionAccountHealth {
     configure(opts: Pick<SubscriptionAccountHealthOptions, 'overloadEnabled' | 'overloadTtlMs' | 'authErrorTtlMs' | 'serverErrorTtlMs'>): void;
     /**
      * Whether an account may be scheduled RIGHT NOW. `blocked` → false; any timer
-     * still in the future → false. Expired timers are lazily deleted on read (CRS
-     * lazy-clear parity) so an elapsed cooldown restores the account WITHOUT a
+     * still in the future → false. Expired timers are lazily deleted on read so
+     * an elapsed cooldown restores the account WITHOUT a
      * timer — but the recovery SIGNAL is the sweeper's job (`sweepRecoveries`), so
      * this read never emits (correctness is independent of the tick).
      */
     isSchedulable(providerId: string, accountId: string, now?: number): boolean;
     /**
-     * The single marking entry point (design D3). Faithful to CRS status semantics:
+     * The single marking entry point (design D3):
      *  - 429 + authoritative reset → `rateLimitEndAt`; a non-claude 429 may use
      *    `retryAfterSeconds`; a bare 429 (no resolvable reset) is NOT marked;
      *  - 529 → `overloadUntil` (gated by `overloadEnabled`);
@@ -194,6 +219,8 @@ declare class SubscriptionAccountHealth {
     sweepRecoveries(now?: number): AccountRecoveryEvent[];
     /** Admin-facing coarse status + cooldown-until for one account (secret-free). */
     getStatus(providerId: string, accountId: string, now?: number): AccountHealthStatus;
+    /** Return newest-first, bounded, secret-free health edge diagnostics. */
+    getDiagnostics(filter?: AccountHealthDiagnosticFilter): AccountHealthDiagnostic[];
     /**
      * Register a recovery listener (the OQ3 seam #5 webhooks + #8 health-cron
      * consume). Returns an unsubscribe function. Two edges fire it:
@@ -216,6 +243,7 @@ declare class SubscriptionAccountHealth {
      */
     onAnomaly(listener: AccountAnomalyListener): () => void;
     private emitAnomaly;
+    private recordDiagnostic;
     /**
      * Delete every EXPIRED timer field on the record in place; return whether any
      * timer is STILL active (in the future). `blocked` is not a timer and is left
@@ -232,4 +260,4 @@ declare function setSharedAccountHealth(instance: SubscriptionAccountHealth): vo
 /** Reset the shared singleton (tests / teardown only). */
 declare function __resetSharedAccountHealthForTests(): void;
 
-export { AUTH_ERROR_TTL_MS, type AccountAnomalyEvent, type AccountAnomalyListener, type AccountAnomalyState, type AccountHealthState, type AccountHealthStatus, type AccountRecoveryEvent, type AccountRecoveryListener, type HeadersLike, type HealthRecord, OVERLOAD_ENABLED_DEFAULT, OVERLOAD_TTL_MS, type RecordUpstreamOutcomeInput, SERVER_ERROR_TTL_MS, SubscriptionAccountHealth, type SubscriptionAccountHealthOptions, __resetSharedAccountHealthForTests, getSharedAccountHealth, resolveResetSeconds, setSharedAccountHealth };
+export { ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT, AUTH_ERROR_TTL_MS, type AccountAnomalyEvent, type AccountAnomalyListener, type AccountAnomalyState, type AccountHealthDiagnostic, type AccountHealthDiagnosticFilter, type AccountHealthState, type AccountHealthStatus, type AccountRecoveryEvent, type AccountRecoveryListener, type HeadersLike, type HealthRecord, OVERLOAD_ENABLED_DEFAULT, OVERLOAD_TTL_MS, type RecordUpstreamOutcomeInput, SERVER_ERROR_TTL_MS, SubscriptionAccountHealth, type SubscriptionAccountHealthOptions, __resetSharedAccountHealthForTests, getSharedAccountHealth, resolveResetSeconds, setSharedAccountHealth };

package/dist/pipeline/SubscriptionAccountHealth.js

@@ -1,4 +1,5 @@
 import {
+  ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT,
   AUTH_ERROR_TTL_MS,
   OVERLOAD_ENABLED_DEFAULT,
   OVERLOAD_TTL_MS,
@@ -8,8 +9,9 @@ import {
   getSharedAccountHealth,
   resolveResetSeconds,
   setSharedAccountHealth
-} from "../chunk-5ENKBSWO.js";
+} from "../chunk-YJVHCHQX.js";
 export {
+  ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT,
   AUTH_ERROR_TTL_MS,
   OVERLOAD_ENABLED_DEFAULT,
   OVERLOAD_TTL_MS,

package/dist/pipeline/SubscriptionAuthSource.cjs

@@ -1,9 +1,12 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
 
-var _chunkKFI44N2Rcjs = require('../chunk-KFI44N2R.cjs');
+var _chunkYNJNTCSQcjs = require('../chunk-YNJNTCSQ.cjs');
 require('../chunk-SVNDB62D.cjs');
+require('../chunk-6QQG7YG3.cjs');
+require('../chunk-25GXJCEZ.cjs');
+require('../chunk-HVBBDBS3.cjs');
 
 
 
-exports.SubscriptionAuthSource = _chunkKFI44N2Rcjs.SubscriptionAuthSource; exports.stripAuthHeaders = _chunkKFI44N2Rcjs.stripAuthHeaders;
+exports.SubscriptionAuthSource = _chunkYNJNTCSQcjs.SubscriptionAuthSource; exports.stripAuthHeaders = _chunkYNJNTCSQcjs.stripAuthHeaders;

package/dist/pipeline/SubscriptionAuthSource.d.cts

@@ -1,6 +1,7 @@
 import { OpenCodeGoTokenConfig, OpenCodeGoScenario, OpenCodeGoModelEntry } from '@omnicross/contracts/subscription-types';
 import { AuthSource, AuthApplyHints } from './AuthSource.cjs';
 import { AuthStrategy } from './SubscriptionAuthStrategy.cjs';
+import './BoundAccountSelectionError.cjs';
 
 /**
  * SubscriptionAuthSource — `AuthSource` wrapping a subscription `AuthStrategy`.

package/dist/pipeline/SubscriptionAuthSource.d.ts

@@ -1,6 +1,7 @@
 import { OpenCodeGoTokenConfig, OpenCodeGoScenario, OpenCodeGoModelEntry } from '@omnicross/contracts/subscription-types';
 import { AuthSource, AuthApplyHints } from './AuthSource.js';
 import { AuthStrategy } from './SubscriptionAuthStrategy.js';
+import './BoundAccountSelectionError.js';
 
 /**
  * SubscriptionAuthSource — `AuthSource` wrapping a subscription `AuthStrategy`.

package/dist/pipeline/SubscriptionAuthSource.js

@@ -1,8 +1,11 @@
 import {
   SubscriptionAuthSource,
   stripAuthHeaders
-} from "../chunk-HRRYG2AX.js";
+} from "../chunk-23S5OPIO.js";
 import "../chunk-AVYJ4YBN.js";
+import "../chunk-OPRS4IQZ.js";
+import "../chunk-2JYRIADS.js";
+import "../chunk-MKF46GNZ.js";
 export {
   SubscriptionAuthSource,
   stripAuthHeaders

package/dist/pipeline/SubscriptionAuthStrategy.d.cts

@@ -1,4 +1,5 @@
 import { SubscriptionProviderId, SubscriptionStatusEntry } from '@omnicross/contracts/subscription-types';
+import { BoundAccountFallbackPolicy } from './BoundAccountSelectionError.cjs';
 
 /**
  * SubscriptionAuthStrategy — the pluggable subscription-auth contract, defined
@@ -51,10 +52,14 @@ interface AuthApplyHints {
     reportSelection?: (accountId: string, isActive: boolean, remappedModel?: string) => void;
     /**
      * OPTIONAL preferred subscription account id (provider/subscription duality).
-     * When set and schedulable the account picker resolves it directly; absent or
-     * unschedulable ⇒ pool auto-schedule.
+     * When set, strict is the default; only the explicit `'pool'` policy permits
+     * pool fallback. Absent bindings keep pool auto-scheduling.
      */
     preferredAccountId?: string;
+    /** Optional account group selected by a resource-level gateway binding. */
+    preferredAccountGroup?: string;
+    /** `'pool'` is an explicit opt-in; strict is the default for bindings. */
+    boundAccountFallbackPolicy?: BoundAccountFallbackPolicy;
 }
 interface AuthStrategy {
     /** Discriminator — also surfaced through `subscription:list` to renderers. */
@@ -87,4 +92,4 @@ interface AuthStrategy {
     describeStatus(): Promise<SubscriptionStatusEntry>;
 }
 
-export type { AuthApplyHints, AuthStrategy };
+export { type AuthApplyHints, type AuthStrategy, BoundAccountFallbackPolicy };

package/dist/pipeline/SubscriptionAuthStrategy.d.ts

@@ -1,4 +1,5 @@
 import { SubscriptionProviderId, SubscriptionStatusEntry } from '@omnicross/contracts/subscription-types';
+import { BoundAccountFallbackPolicy } from './BoundAccountSelectionError.js';
 
 /**
  * SubscriptionAuthStrategy — the pluggable subscription-auth contract, defined
@@ -51,10 +52,14 @@ interface AuthApplyHints {
     reportSelection?: (accountId: string, isActive: boolean, remappedModel?: string) => void;
     /**
      * OPTIONAL preferred subscription account id (provider/subscription duality).
-     * When set and schedulable the account picker resolves it directly; absent or
-     * unschedulable ⇒ pool auto-schedule.
+     * When set, strict is the default; only the explicit `'pool'` policy permits
+     * pool fallback. Absent bindings keep pool auto-scheduling.
      */
     preferredAccountId?: string;
+    /** Optional account group selected by a resource-level gateway binding. */
+    preferredAccountGroup?: string;
+    /** `'pool'` is an explicit opt-in; strict is the default for bindings. */
+    boundAccountFallbackPolicy?: BoundAccountFallbackPolicy;
 }
 interface AuthStrategy {
     /** Discriminator — also surfaced through `subscription:list` to renderers. */
@@ -87,4 +92,4 @@ interface AuthStrategy {
     describeStatus(): Promise<SubscriptionStatusEntry>;
 }
 
-export type { AuthApplyHints, AuthStrategy };
+export { type AuthApplyHints, type AuthStrategy, BoundAccountFallbackPolicy };

package/dist/pipeline/executeProviderCall.cjs

@@ -1,6 +1,6 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
-var _chunkHYN75H6Gcjs = require('../chunk-HYN75H6G.cjs');
+var _chunkMUHWHQVMcjs = require('../chunk-MUHWHQVM.cjs');
 
 
-exports.executeProviderCall = _chunkHYN75H6Gcjs.executeProviderCall;
+exports.executeProviderCall = _chunkMUHWHQVMcjs.executeProviderCall;

package/dist/pipeline/executeProviderCall.d.cts

@@ -101,8 +101,9 @@ interface ProviderCallContext {
      */
     fetchFn: (url: string, headers: Record<string, string>, body: unknown) => Promise<Response>;
     /**
-     * When `true`, the core runs `executeResponseChain` on the fetched
-     * response and returns the TRANSFORMED response. When `false` (default),
+     * When `true`, the core runs `executeResponseChain` on a SUCCESSFUL fetched
+     * response and returns the TRANSFORMED response; a failed (`!response.ok`)
+     * response is returned raw so its status and error body survive. When `false` (default),
      * the core returns the RAW fetched response and the caller runs the
      * response chain itself — this preserves call sites that gate on
      * `response.ok` BEFORE the response chain (Adapter / Handler).
@@ -127,7 +128,11 @@ interface ProviderCallContext {
  * before, and so the wire-capture / logging hooks keep their inputs.
  */
 interface ProviderCallResult {
-    /** Transformed response (runResponseChain=true) or raw response (false). */
+    /**
+     * Transformed response (runResponseChain=true AND the upstream response was
+     * `ok`), otherwise the RAW fetched response — see the `.ok` gate in the
+     * implementation for why failures are never transformed.
+     */
     response: Response;
     /** Request-chain output body (pre-`prepareBody`). */
     requestBody: unknown;

package/dist/pipeline/executeProviderCall.d.ts

@@ -101,8 +101,9 @@ interface ProviderCallContext {
      */
     fetchFn: (url: string, headers: Record<string, string>, body: unknown) => Promise<Response>;
     /**
-     * When `true`, the core runs `executeResponseChain` on the fetched
-     * response and returns the TRANSFORMED response. When `false` (default),
+     * When `true`, the core runs `executeResponseChain` on a SUCCESSFUL fetched
+     * response and returns the TRANSFORMED response; a failed (`!response.ok`)
+     * response is returned raw so its status and error body survive. When `false` (default),
      * the core returns the RAW fetched response and the caller runs the
      * response chain itself — this preserves call sites that gate on
      * `response.ok` BEFORE the response chain (Adapter / Handler).
@@ -127,7 +128,11 @@ interface ProviderCallContext {
  * before, and so the wire-capture / logging hooks keep their inputs.
  */
 interface ProviderCallResult {
-    /** Transformed response (runResponseChain=true) or raw response (false). */
+    /**
+     * Transformed response (runResponseChain=true AND the upstream response was
+     * `ok`), otherwise the RAW fetched response — see the `.ok` gate in the
+     * implementation for why failures are never transformed.
+     */
     response: Response;
     /** Request-chain output body (pre-`prepareBody`). */
     requestBody: unknown;

package/dist/pipeline/executeProviderCall.js

@@ -1,6 +1,6 @@
 import {
   executeProviderCall
-} from "../chunk-IK3KE3AU.js";
+} from "../chunk-DE2SRBFZ.js";
 export {
   executeProviderCall
 };

package/dist/pipeline/resolveProviderChain.d.cts

@@ -13,9 +13,8 @@ import '../transformer/TransformerService.cjs';
  * block verbatim. This module extracts that single shared helper so the
  * logic lives in exactly one place.
  *
- * IMPORTANT: body mutations that are proxy-specific (ReasoningTransformer
- * auto-inject, thinkingLevel body-inject) are NOT part of this helper —
- * they remain at each call site as before.
+ * IMPORTANT: body mutations that are proxy-specific (thinkingLevel body-inject)
+ * are NOT part of this helper — they remain at each call site as before.
  *
  * @module pipeline/resolveProviderChain
  */

package/dist/pipeline/resolveProviderChain.d.ts

@@ -13,9 +13,8 @@ import '../transformer/TransformerService.js';
  * block verbatim. This module extracts that single shared helper so the
  * logic lives in exactly one place.
  *
- * IMPORTANT: body mutations that are proxy-specific (ReasoningTransformer
- * auto-inject, thinkingLevel body-inject) are NOT part of this helper —
- * they remain at each call site as before.
+ * IMPORTANT: body mutations that are proxy-specific (thinkingLevel body-inject)
+ * are NOT part of this helper — they remain at each call site as before.
  *
  * @module pipeline/resolveProviderChain
  */

package/dist/pipeline/resolveSubscriptionChain.d.cts

@@ -3,6 +3,7 @@ import { Transformer, ResolvedTransformerChain } from '../transformer/types.cjs'
 import { SubscriptionAuthProfile } from './SubscriptionAuthSource.cjs';
 import '@omnicross/contracts/subscription-types';
 import './AuthSource.cjs';
+import './BoundAccountSelectionError.cjs';
 import './SubscriptionAuthStrategy.cjs';
 
 /**

package/dist/pipeline/resolveSubscriptionChain.d.ts

@@ -3,6 +3,7 @@ import { Transformer, ResolvedTransformerChain } from '../transformer/types.js';
 import { SubscriptionAuthProfile } from './SubscriptionAuthSource.js';
 import '@omnicross/contracts/subscription-types';
 import './AuthSource.js';
+import './BoundAccountSelectionError.js';
 import './SubscriptionAuthStrategy.js';
 
 /**

package/dist/pipeline/upstreamFetch.cjs

@@ -4,11 +4,13 @@
 
 
 
-var _chunkOCEUVQHWcjs = require('../chunk-OCEUVQHW.cjs');
+var _chunkKCVJWJSTcjs = require('../chunk-KCVJWJST.cjs');
+require('../chunk-3Z5BQZFM.cjs');
+require('../chunk-HVBBDBS3.cjs');
 
 
 
 
 
 
-exports.__resetUpstreamProxyForTests = _chunkOCEUVQHWcjs.__resetUpstreamProxyForTests; exports.bumpUpstreamProxyGeneration = _chunkOCEUVQHWcjs.bumpUpstreamProxyGeneration; exports.fetchUpstream = _chunkOCEUVQHWcjs.fetchUpstream; exports.resolveUpstreamDispatcher = _chunkOCEUVQHWcjs.resolveUpstreamDispatcher; exports.setUpstreamProxyResolver = _chunkOCEUVQHWcjs.setUpstreamProxyResolver;
+exports.__resetUpstreamProxyForTests = _chunkKCVJWJSTcjs.__resetUpstreamProxyForTests; exports.bumpUpstreamProxyGeneration = _chunkKCVJWJSTcjs.bumpUpstreamProxyGeneration; exports.fetchUpstream = _chunkKCVJWJSTcjs.fetchUpstream; exports.resolveUpstreamDispatcher = _chunkKCVJWJSTcjs.resolveUpstreamDispatcher; exports.setUpstreamProxyResolver = _chunkKCVJWJSTcjs.setUpstreamProxyResolver;

package/dist/pipeline/upstreamFetch.d.cts

@@ -28,6 +28,12 @@ import { Dispatcher } from 'undici';
  * FROZEN SEAM: `#7` (client fingerprint) attaches per-account TLS/agent behavior
  * at this SAME dispatcher point — do not fork a second egress path.
  *
+ * DEBUG TRACE: when the daemon installs an upstream-trace path (gated on the
+ * audit `captureBodies` opt-in), relay calls (`ctx.providerId` set) clone the
+ * response and append the FULL exchange (request + verbatim response incl. SSE)
+ * to the trace file. Absent a path (the default) it is a pure no-op — zero
+ * regression. See `upstreamTrace.ts`.
+ *
  * @module @omnicross/core/pipeline/upstreamFetch
  */
 

package/dist/pipeline/upstreamFetch.d.ts

@@ -28,6 +28,12 @@ import { Dispatcher } from 'undici';
  * FROZEN SEAM: `#7` (client fingerprint) attaches per-account TLS/agent behavior
  * at this SAME dispatcher point — do not fork a second egress path.
  *
+ * DEBUG TRACE: when the daemon installs an upstream-trace path (gated on the
+ * audit `captureBodies` opt-in), relay calls (`ctx.providerId` set) clone the
+ * response and append the FULL exchange (request + verbatim response incl. SSE)
+ * to the trace file. Absent a path (the default) it is a pure no-op — zero
+ * regression. See `upstreamTrace.ts`.
+ *
  * @module @omnicross/core/pipeline/upstreamFetch
  */
 

package/dist/pipeline/upstreamFetch.js

@@ -4,7 +4,9 @@ import {
   fetchUpstream,
   resolveUpstreamDispatcher,
   setUpstreamProxyResolver
-} from "../chunk-XK5CIRMQ.js";
+} from "../chunk-SIZQQD6T.js";
+import "../chunk-SYQF7OIR.js";
+import "../chunk-MKF46GNZ.js";
 export {
   __resetUpstreamProxyForTests,
   bumpUpstreamProxyGeneration,