@omnicross/core 0.1.5 → 0.1.6

package/dist/pipeline/AccountAllowanceScheduling.d.ts

@@ -0,0 +1,90 @@
+import { SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
+import { a as AllowanceSchedulingConfig } from '../types-hsoKrVQS.js';
+import { AccountAllowanceStore } from './AccountAllowanceStore.js';
+import '@omnicross/contracts/account-tokens-types';
+import '@omnicross/contracts/audit-types';
+import '@omnicross/contracts/billing-types';
+import '@omnicross/contracts/health-logging-types';
+import '@omnicross/contracts/voucher-types';
+import '@omnicross/contracts/webhook-types';
+import '../logger-4GvQNzhE.js';
+import '../ports/provider-config-source.js';
+import '@omnicross/contracts/llm-config';
+import '../transformer/types.js';
+import '../transformer/TransformerService.js';
+import '../ProviderProxy-C-xqrkKi.js';
+import '../provider-proxy/types.js';
+import 'node:http';
+import '@omnicross/contracts/completion-types';
+import '@omnicross/contracts/usage-types';
+import '../completion/ApiKeyPoolService.js';
+import './AuthSource.js';
+import './BoundAccountSelectionError.js';
+import './SubscriptionAuthSource.js';
+import './SubscriptionAuthStrategy.js';
+import '../ports/web-search-backend.js';
+import '@omnicross/contracts/websearch-types';
+import '../keyPolicy-zdWTu3CQ.js';
+import '@omnicross/contracts/account-allowance-types';
+
+/**
+ * Default-off allowance-aware scheduling policy.
+ *
+ * This layer consumes only normalized, secret-free snapshots. Missing, stale,
+ * unsupported, or reset-expired data is deliberately ignored so telemetry can
+ * never strand an account by accident.
+ */
+
+type AllowanceSchedulingAction = 'normal' | 'demote' | 'pause' | 'ignore';
+interface AllowanceSchedulingDecision {
+    providerId: SubscriptionProviderId;
+    accountId: string;
+    action: AllowanceSchedulingAction;
+    reason: 'policy-disabled' | 'provider-unsupported' | 'snapshot-missing' | 'snapshot-not-fresh' | 'below-threshold' | 'demote-threshold' | 'pause-threshold';
+    basePriority: number;
+    effectivePriority: number;
+    schedulable: boolean;
+    usedPercent?: number;
+    observedAt?: string;
+    resumeAt?: string;
+    decidedAt: string;
+}
+/**
+ * Safe, structured signal emitted only when an enabled allowance policy paused
+ * every otherwise eligible account. Request ingress maps it to HTTP 429 instead
+ * of disguising a local scheduling decision as an upstream 5xx.
+ */
+declare class AccountAllowanceExhaustedError extends Error {
+    readonly providerId: SubscriptionProviderId;
+    readonly resumeAt?: string | undefined;
+    readonly code = "account_allowance_exhausted";
+    readonly status = 429;
+    constructor(providerId: SubscriptionProviderId, resumeAt?: string | undefined);
+}
+/** Structural guard survives package/bundle boundaries and never inspects secrets. */
+declare function isAccountAllowanceExhaustedError(error: unknown): error is AccountAllowanceExhaustedError;
+declare class AccountAllowanceScheduling {
+    private readonly store;
+    private readonly now;
+    private config;
+    private readonly history;
+    private readonly lastRecorded;
+    constructor(store?: AccountAllowanceStore, now?: () => number);
+    configure(config: AllowanceSchedulingConfig | undefined): void;
+    getConfig(): AllowanceSchedulingConfig;
+    evaluate(providerId: SubscriptionProviderId, accountId: string, basePriority: number, now?: number): AllowanceSchedulingDecision;
+    /**
+     * Project the current policy result without recording an applied decision.
+     * Admin/read-model callers use this so polling an account list never creates
+     * synthetic demotion/pause history entries.
+     */
+    preview(providerId: SubscriptionProviderId, accountId: string, basePriority: number, now?: number): AllowanceSchedulingDecision;
+    private decide;
+    getHistory(): AllowanceSchedulingDecision[];
+    clearHistory(): void;
+    private recordApplied;
+}
+declare function getSharedAccountAllowanceScheduling(): AccountAllowanceScheduling;
+declare function __resetSharedAccountAllowanceSchedulingForTests(): void;
+
+export { AccountAllowanceExhaustedError, AccountAllowanceScheduling, type AllowanceSchedulingAction, type AllowanceSchedulingDecision, __resetSharedAccountAllowanceSchedulingForTests, getSharedAccountAllowanceScheduling, isAccountAllowanceExhaustedError };

package/dist/pipeline/AccountAllowanceScheduling.js

@@ -0,0 +1,15 @@
+import {
+  AccountAllowanceExhaustedError,
+  AccountAllowanceScheduling,
+  __resetSharedAccountAllowanceSchedulingForTests,
+  getSharedAccountAllowanceScheduling,
+  isAccountAllowanceExhaustedError
+} from "../chunk-OPRS4IQZ.js";
+import "../chunk-MKF46GNZ.js";
+export {
+  AccountAllowanceExhaustedError,
+  AccountAllowanceScheduling,
+  __resetSharedAccountAllowanceSchedulingForTests,
+  getSharedAccountAllowanceScheduling,
+  isAccountAllowanceExhaustedError
+};

package/dist/pipeline/AccountAllowanceStore.cjs

@@ -0,0 +1,20 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+
+
+
+
+
+var _chunkHVBBDBS3cjs = require('../chunk-HVBBDBS3.cjs');
+
+
+
+
+
+
+
+
+
+exports.AccountAllowanceStore = _chunkHVBBDBS3cjs.AccountAllowanceStore; exports.DEFAULT_ALLOWANCE_MAX_SNAPSHOTS = _chunkHVBBDBS3cjs.DEFAULT_ALLOWANCE_MAX_SNAPSHOTS; exports.DEFAULT_CODEX_ALLOWANCE_FRESH_MS = _chunkHVBBDBS3cjs.DEFAULT_CODEX_ALLOWANCE_FRESH_MS; exports.__resetSharedAccountAllowanceStoreForTests = _chunkHVBBDBS3cjs.__resetSharedAccountAllowanceStoreForTests; exports.getSharedAccountAllowanceStore = _chunkHVBBDBS3cjs.getSharedAccountAllowanceStore; exports.normalizeAccountAllowanceSnapshot = _chunkHVBBDBS3cjs.normalizeAccountAllowanceSnapshot; exports.parseCodexAllowanceHeaders = _chunkHVBBDBS3cjs.parseCodexAllowanceHeaders; exports.setSharedAccountAllowanceStore = _chunkHVBBDBS3cjs.setSharedAccountAllowanceStore;

package/dist/pipeline/AccountAllowanceStore.d.cts

@@ -0,0 +1,77 @@
+import { AccountAllowanceSnapshot } from '@omnicross/contracts/account-allowance-types';
+import { SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
+
+/**
+ * Secret-free upstream account allowance snapshots.
+ *
+ * Claude actively populates this store from the daemon. Codex is observed at the
+ * core egress seam so the response headers are attributed to the exact account id
+ * selected for that request. Only normalized numbers are retained; raw headers
+ * and credentials never enter the store. A host may inject a small persistence
+ * port; core deliberately does not know where that host stores the snapshot.
+ */
+
+declare const DEFAULT_CODEX_ALLOWANCE_FRESH_MS: number;
+declare const DEFAULT_ALLOWANCE_MAX_SNAPSHOTS = 256;
+type AllowanceHeadersLike = Headers | Record<string, string | string[] | number | null | undefined>;
+interface CodexAllowanceWindowObservation {
+    usedPercent?: number;
+    resetAfterSeconds?: number;
+    windowMinutes?: number;
+}
+interface CodexAllowanceObservation {
+    primary?: CodexAllowanceWindowObservation;
+    secondary?: CodexAllowanceWindowObservation;
+    primaryOverSecondaryLimitPercent?: number;
+}
+/** Host-owned persistence seam for normalized allowance snapshots. */
+interface AccountAllowancePersistence {
+    /** Return the decoded file payload, or any value for the store to validate. */
+    load(): unknown;
+    /** Replace the durable snapshot with this already-normalized bounded list. */
+    save(snapshots: readonly AccountAllowanceSnapshot[]): void;
+}
+/**
+ * Pick and normalize only the public DTO fields. This is used for both live
+ * writes and restart loads, so a structurally-cast object can never smuggle raw
+ * headers, response bodies, or token fields into the cache.
+ */
+declare function normalizeAccountAllowanceSnapshot(value: unknown): AccountAllowanceSnapshot | null;
+/** Parse only the documented numeric Codex allowance headers. */
+declare function parseCodexAllowanceHeaders(headers: AllowanceHeadersLike): CodexAllowanceObservation | null;
+/** In-memory allowance projection shared by serving/admin with optional host persistence. */
+declare class AccountAllowanceStore {
+    private readonly now;
+    private readonly codexFreshMs;
+    private readonly persistence?;
+    private readonly snapshots;
+    private readonly maxSnapshots;
+    constructor(now?: () => number, codexFreshMs?: number, persistence?: AccountAllowancePersistence | undefined, maxSnapshots?: number);
+    set(snapshot: AccountAllowanceSnapshot): void;
+    delete(providerId: SubscriptionProviderId, accountId: string): void;
+    /** Remove rows that no longer correspond to a configured account. */
+    pruneToKnownAccounts(accounts: Iterable<{
+        providerId: SubscriptionProviderId;
+        accountId: string;
+    }>): number;
+    get(providerId: SubscriptionProviderId, accountId: string, now?: number): AccountAllowanceSnapshot | null;
+    list(filter?: {
+        providerId?: SubscriptionProviderId;
+        accountId?: string;
+    }, now?: number): AccountAllowanceSnapshot[];
+    /**
+     * Merge one real Codex upstream response into the selected account's snapshot.
+     * A response with no recognized headers is a strict no-op, and a partial header
+     * set preserves previous values while marking untouched windows stale.
+     */
+    recordCodexHeaders(accountId: string, headers: AllowanceHeadersLike, observedMs?: number): AccountAllowanceSnapshot | null;
+    clear(): void;
+    private loadPersisted;
+    private persist;
+}
+declare function getSharedAccountAllowanceStore(): AccountAllowanceStore;
+declare function setSharedAccountAllowanceStore(store: AccountAllowanceStore): void;
+/** Test/daemon teardown seam. */
+declare function __resetSharedAccountAllowanceStoreForTests(): void;
+
+export { type AccountAllowancePersistence, AccountAllowanceStore, type AllowanceHeadersLike, type CodexAllowanceObservation, type CodexAllowanceWindowObservation, DEFAULT_ALLOWANCE_MAX_SNAPSHOTS, DEFAULT_CODEX_ALLOWANCE_FRESH_MS, __resetSharedAccountAllowanceStoreForTests, getSharedAccountAllowanceStore, normalizeAccountAllowanceSnapshot, parseCodexAllowanceHeaders, setSharedAccountAllowanceStore };

package/dist/pipeline/AccountAllowanceStore.d.ts

@@ -0,0 +1,77 @@
+import { AccountAllowanceSnapshot } from '@omnicross/contracts/account-allowance-types';
+import { SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
+
+/**
+ * Secret-free upstream account allowance snapshots.
+ *
+ * Claude actively populates this store from the daemon. Codex is observed at the
+ * core egress seam so the response headers are attributed to the exact account id
+ * selected for that request. Only normalized numbers are retained; raw headers
+ * and credentials never enter the store. A host may inject a small persistence
+ * port; core deliberately does not know where that host stores the snapshot.
+ */
+
+declare const DEFAULT_CODEX_ALLOWANCE_FRESH_MS: number;
+declare const DEFAULT_ALLOWANCE_MAX_SNAPSHOTS = 256;
+type AllowanceHeadersLike = Headers | Record<string, string | string[] | number | null | undefined>;
+interface CodexAllowanceWindowObservation {
+    usedPercent?: number;
+    resetAfterSeconds?: number;
+    windowMinutes?: number;
+}
+interface CodexAllowanceObservation {
+    primary?: CodexAllowanceWindowObservation;
+    secondary?: CodexAllowanceWindowObservation;
+    primaryOverSecondaryLimitPercent?: number;
+}
+/** Host-owned persistence seam for normalized allowance snapshots. */
+interface AccountAllowancePersistence {
+    /** Return the decoded file payload, or any value for the store to validate. */
+    load(): unknown;
+    /** Replace the durable snapshot with this already-normalized bounded list. */
+    save(snapshots: readonly AccountAllowanceSnapshot[]): void;
+}
+/**
+ * Pick and normalize only the public DTO fields. This is used for both live
+ * writes and restart loads, so a structurally-cast object can never smuggle raw
+ * headers, response bodies, or token fields into the cache.
+ */
+declare function normalizeAccountAllowanceSnapshot(value: unknown): AccountAllowanceSnapshot | null;
+/** Parse only the documented numeric Codex allowance headers. */
+declare function parseCodexAllowanceHeaders(headers: AllowanceHeadersLike): CodexAllowanceObservation | null;
+/** In-memory allowance projection shared by serving/admin with optional host persistence. */
+declare class AccountAllowanceStore {
+    private readonly now;
+    private readonly codexFreshMs;
+    private readonly persistence?;
+    private readonly snapshots;
+    private readonly maxSnapshots;
+    constructor(now?: () => number, codexFreshMs?: number, persistence?: AccountAllowancePersistence | undefined, maxSnapshots?: number);
+    set(snapshot: AccountAllowanceSnapshot): void;
+    delete(providerId: SubscriptionProviderId, accountId: string): void;
+    /** Remove rows that no longer correspond to a configured account. */
+    pruneToKnownAccounts(accounts: Iterable<{
+        providerId: SubscriptionProviderId;
+        accountId: string;
+    }>): number;
+    get(providerId: SubscriptionProviderId, accountId: string, now?: number): AccountAllowanceSnapshot | null;
+    list(filter?: {
+        providerId?: SubscriptionProviderId;
+        accountId?: string;
+    }, now?: number): AccountAllowanceSnapshot[];
+    /**
+     * Merge one real Codex upstream response into the selected account's snapshot.
+     * A response with no recognized headers is a strict no-op, and a partial header
+     * set preserves previous values while marking untouched windows stale.
+     */
+    recordCodexHeaders(accountId: string, headers: AllowanceHeadersLike, observedMs?: number): AccountAllowanceSnapshot | null;
+    clear(): void;
+    private loadPersisted;
+    private persist;
+}
+declare function getSharedAccountAllowanceStore(): AccountAllowanceStore;
+declare function setSharedAccountAllowanceStore(store: AccountAllowanceStore): void;
+/** Test/daemon teardown seam. */
+declare function __resetSharedAccountAllowanceStoreForTests(): void;
+
+export { type AccountAllowancePersistence, AccountAllowanceStore, type AllowanceHeadersLike, type CodexAllowanceObservation, type CodexAllowanceWindowObservation, DEFAULT_ALLOWANCE_MAX_SNAPSHOTS, DEFAULT_CODEX_ALLOWANCE_FRESH_MS, __resetSharedAccountAllowanceStoreForTests, getSharedAccountAllowanceStore, normalizeAccountAllowanceSnapshot, parseCodexAllowanceHeaders, setSharedAccountAllowanceStore };

package/dist/pipeline/AccountAllowanceStore.js

@@ -0,0 +1,20 @@
+import {
+  AccountAllowanceStore,
+  DEFAULT_ALLOWANCE_MAX_SNAPSHOTS,
+  DEFAULT_CODEX_ALLOWANCE_FRESH_MS,
+  __resetSharedAccountAllowanceStoreForTests,
+  getSharedAccountAllowanceStore,
+  normalizeAccountAllowanceSnapshot,
+  parseCodexAllowanceHeaders,
+  setSharedAccountAllowanceStore
+} from "../chunk-MKF46GNZ.js";
+export {
+  AccountAllowanceStore,
+  DEFAULT_ALLOWANCE_MAX_SNAPSHOTS,
+  DEFAULT_CODEX_ALLOWANCE_FRESH_MS,
+  __resetSharedAccountAllowanceStoreForTests,
+  getSharedAccountAllowanceStore,
+  normalizeAccountAllowanceSnapshot,
+  parseCodexAllowanceHeaders,
+  setSharedAccountAllowanceStore
+};

package/dist/pipeline/AuthSource.d.cts

@@ -1,3 +1,5 @@
+import { BoundAccountFallbackPolicy } from './BoundAccountSelectionError.cjs';
+
 /**
  * AuthSource — unified outbound-authentication strategy for the provider
  * request pipeline.
@@ -54,10 +56,17 @@ interface AuthApplyHints {
     reportSelection?: (accountId: string, isActive: boolean, remappedModel?: string) => void;
     /**
      * OPTIONAL preferred subscription account id (provider/subscription duality).
-     * When set and schedulable the account picker resolves it directly; absent or
-     * unschedulable ⇒ pool auto-schedule. BYO auth sources ignore it.
+     * When set, strict is the default; only the explicit `'pool'` policy permits
+     * pool fallback. BYO auth sources ignore both binding hints.
      */
     preferredAccountId?: string;
+    /** Optional account group selected by a resource-level gateway binding. */
+    preferredAccountGroup?: string;
+    /**
+     * Binding behavior. `'pool'` is an explicit opt-in; any other value used
+     * with a preferred account is treated as strict by the selector.
+     */
+    boundAccountFallbackPolicy?: BoundAccountFallbackPolicy;
 }
 /**
  * Result of {@link AuthSource.onResult}.

package/dist/pipeline/AuthSource.d.ts

@@ -1,3 +1,5 @@
+import { BoundAccountFallbackPolicy } from './BoundAccountSelectionError.js';
+
 /**
  * AuthSource — unified outbound-authentication strategy for the provider
  * request pipeline.
@@ -54,10 +56,17 @@ interface AuthApplyHints {
     reportSelection?: (accountId: string, isActive: boolean, remappedModel?: string) => void;
     /**
      * OPTIONAL preferred subscription account id (provider/subscription duality).
-     * When set and schedulable the account picker resolves it directly; absent or
-     * unschedulable ⇒ pool auto-schedule. BYO auth sources ignore it.
+     * When set, strict is the default; only the explicit `'pool'` policy permits
+     * pool fallback. BYO auth sources ignore both binding hints.
      */
     preferredAccountId?: string;
+    /** Optional account group selected by a resource-level gateway binding. */
+    preferredAccountGroup?: string;
+    /**
+     * Binding behavior. `'pool'` is an explicit opt-in; any other value used
+     * with a preferred account is treated as strict by the selector.
+     */
+    boundAccountFallbackPolicy?: BoundAccountFallbackPolicy;
 }
 /**
  * Result of {@link AuthSource.onResult}.

package/dist/pipeline/BoundAccountSelectionError.cjs

@@ -0,0 +1,10 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+var _chunk25GXJCEZcjs = require('../chunk-25GXJCEZ.cjs');
+
+
+
+
+exports.BoundAccountSelectionError = _chunk25GXJCEZcjs.BoundAccountSelectionError; exports.boundAccountSelectionMessage = _chunk25GXJCEZcjs.boundAccountSelectionMessage; exports.isBoundAccountSelectionError = _chunk25GXJCEZcjs.isBoundAccountSelectionError;

package/dist/pipeline/BoundAccountSelectionError.d.cts

@@ -0,0 +1,28 @@
+/**
+ * Secret-free failure contract for a strict outbound subscription-account
+ * binding. The selector throws this value only when an endpoint explicitly (or
+ * by the migrated default) requires its bound account to serve the request.
+ */
+/** Persisted policy for an endpoint that binds a subscription account. */
+type BoundAccountFallbackPolicy = 'strict' | 'pool';
+/** Bounded reasons a strict bound account can refuse a request. */
+type BoundAccountSelectionFailureReason = 'unavailable' | 'not-found' | 'disabled' | 'unhealthy' | 'model-incompatible' | 'allowance-paused' | 'empty-token';
+/** Return the fixed public message for a validated failure reason. */
+declare function boundAccountSelectionMessage(reason: BoundAccountSelectionFailureReason): string;
+/**
+ * Stable, non-secret error thrown by strict account selection. Account ids and
+ * token material are intentionally absent from both the message and the wire
+ * projection; the reason is a small fixed vocabulary.
+ */
+declare class BoundAccountSelectionError extends Error {
+    readonly providerId: string;
+    readonly reason: BoundAccountSelectionFailureReason;
+    readonly resumeAt?: string | undefined;
+    readonly code: "bound_account_unavailable";
+    readonly status: 429 | 503;
+    constructor(providerId: string, reason: BoundAccountSelectionFailureReason, resumeAt?: string | undefined);
+}
+/** Structural guard that survives package/bundle boundaries. */
+declare function isBoundAccountSelectionError(error: unknown): error is BoundAccountSelectionError;
+
+export { type BoundAccountFallbackPolicy, BoundAccountSelectionError, type BoundAccountSelectionFailureReason, boundAccountSelectionMessage, isBoundAccountSelectionError };

package/dist/pipeline/BoundAccountSelectionError.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Secret-free failure contract for a strict outbound subscription-account
+ * binding. The selector throws this value only when an endpoint explicitly (or
+ * by the migrated default) requires its bound account to serve the request.
+ */
+/** Persisted policy for an endpoint that binds a subscription account. */
+type BoundAccountFallbackPolicy = 'strict' | 'pool';
+/** Bounded reasons a strict bound account can refuse a request. */
+type BoundAccountSelectionFailureReason = 'unavailable' | 'not-found' | 'disabled' | 'unhealthy' | 'model-incompatible' | 'allowance-paused' | 'empty-token';
+/** Return the fixed public message for a validated failure reason. */
+declare function boundAccountSelectionMessage(reason: BoundAccountSelectionFailureReason): string;
+/**
+ * Stable, non-secret error thrown by strict account selection. Account ids and
+ * token material are intentionally absent from both the message and the wire
+ * projection; the reason is a small fixed vocabulary.
+ */
+declare class BoundAccountSelectionError extends Error {
+    readonly providerId: string;
+    readonly reason: BoundAccountSelectionFailureReason;
+    readonly resumeAt?: string | undefined;
+    readonly code: "bound_account_unavailable";
+    readonly status: 429 | 503;
+    constructor(providerId: string, reason: BoundAccountSelectionFailureReason, resumeAt?: string | undefined);
+}
+/** Structural guard that survives package/bundle boundaries. */
+declare function isBoundAccountSelectionError(error: unknown): error is BoundAccountSelectionError;
+
+export { type BoundAccountFallbackPolicy, BoundAccountSelectionError, type BoundAccountSelectionFailureReason, boundAccountSelectionMessage, isBoundAccountSelectionError };

package/dist/pipeline/BoundAccountSelectionError.js

@@ -0,0 +1,10 @@
+import {
+  BoundAccountSelectionError,
+  boundAccountSelectionMessage,
+  isBoundAccountSelectionError
+} from "../chunk-2JYRIADS.js";
+export {
+  BoundAccountSelectionError,
+  boundAccountSelectionMessage,
+  isBoundAccountSelectionError
+};

package/dist/pipeline/LlmConfigProviderAuth.d.cts

@@ -2,6 +2,7 @@ import { LLMProvider } from '@omnicross/contracts/llm-config';
 import { ApiKeyPoolService } from '../completion/ApiKeyPoolService.cjs';
 import { AuthSource, AuthApplyHints, AuthResultOutcome } from './AuthSource.cjs';
 import '../logger-4GvQNzhE.cjs';
+import './BoundAccountSelectionError.cjs';
 
 /**
  * LlmConfigProviderAuth — `AuthSource` for LLM-config provider rows.

package/dist/pipeline/LlmConfigProviderAuth.d.ts

@@ -2,6 +2,7 @@ import { LLMProvider } from '@omnicross/contracts/llm-config';
 import { ApiKeyPoolService } from '../completion/ApiKeyPoolService.js';
 import { AuthSource, AuthApplyHints, AuthResultOutcome } from './AuthSource.js';
 import '../logger-4GvQNzhE.js';
+import './BoundAccountSelectionError.js';
 
 /**
  * LlmConfigProviderAuth — `AuthSource` for LLM-config provider rows.

package/dist/pipeline/SubscriptionAccountHealth.cjs

@@ -8,8 +8,8 @@
 
 
 
-var _chunkVQY5W4YWcjs = require('../chunk-VQY5W4YW.cjs');
 
+var _chunkYK57NMIFcjs = require('../chunk-YK57NMIF.cjs');
 
 
 
@@ -19,4 +19,6 @@ var _chunkVQY5W4YWcjs = require('../chunk-VQY5W4YW.cjs');
 
 
 
-exports.AUTH_ERROR_TTL_MS = _chunkVQY5W4YWcjs.AUTH_ERROR_TTL_MS; exports.OVERLOAD_ENABLED_DEFAULT = _chunkVQY5W4YWcjs.OVERLOAD_ENABLED_DEFAULT; exports.OVERLOAD_TTL_MS = _chunkVQY5W4YWcjs.OVERLOAD_TTL_MS; exports.SERVER_ERROR_TTL_MS = _chunkVQY5W4YWcjs.SERVER_ERROR_TTL_MS; exports.SubscriptionAccountHealth = _chunkVQY5W4YWcjs.SubscriptionAccountHealth; exports.__resetSharedAccountHealthForTests = _chunkVQY5W4YWcjs.__resetSharedAccountHealthForTests; exports.getSharedAccountHealth = _chunkVQY5W4YWcjs.getSharedAccountHealth; exports.resolveResetSeconds = _chunkVQY5W4YWcjs.resolveResetSeconds; exports.setSharedAccountHealth = _chunkVQY5W4YWcjs.setSharedAccountHealth;
+
+
+exports.ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT = _chunkYK57NMIFcjs.ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT; exports.AUTH_ERROR_TTL_MS = _chunkYK57NMIFcjs.AUTH_ERROR_TTL_MS; exports.OVERLOAD_ENABLED_DEFAULT = _chunkYK57NMIFcjs.OVERLOAD_ENABLED_DEFAULT; exports.OVERLOAD_TTL_MS = _chunkYK57NMIFcjs.OVERLOAD_TTL_MS; exports.SERVER_ERROR_TTL_MS = _chunkYK57NMIFcjs.SERVER_ERROR_TTL_MS; exports.SubscriptionAccountHealth = _chunkYK57NMIFcjs.SubscriptionAccountHealth; exports.__resetSharedAccountHealthForTests = _chunkYK57NMIFcjs.__resetSharedAccountHealthForTests; exports.getSharedAccountHealth = _chunkYK57NMIFcjs.getSharedAccountHealth; exports.resolveResetSeconds = _chunkYK57NMIFcjs.resolveResetSeconds; exports.setSharedAccountHealth = _chunkYK57NMIFcjs.setSharedAccountHealth;

package/dist/pipeline/SubscriptionAccountHealth.d.cts

@@ -27,9 +27,9 @@
 declare const OVERLOAD_TTL_MS: number;
 /** 529 overload cooldown enabled by default (LEAD OQ1). */
 declare const OVERLOAD_ENABLED_DEFAULT = true;
-/** Transient cooldown for a final-401 / plain-403 (CRS auth_error 1800s). */
+/** Transient cooldown for a final 401 or non-ban 403 response. */
 declare const AUTH_ERROR_TTL_MS: number;
-/** Transient cooldown for a 5xx / thrown network failure (CRS server_error 300s). */
+/** Transient cooldown for a 5xx response or network failure. */
 declare const SERVER_ERROR_TTL_MS: number;
 /** Per-account health record (all timers are epoch ms). Absent fields ⇒ healthy. */
 interface HealthRecord {
@@ -89,6 +89,30 @@ interface AccountAnomalyEvent {
 }
 /** An anomaly listener (fire-and-forget; the emitter never awaits it). */
 type AccountAnomalyListener = (event: AccountAnomalyEvent) => void;
+/**
+ * Admin-readable projection of the existing health event stream. It is kept in
+ * the tracker itself so webhooks and diagnostics consume the same edge events;
+ * this is not a second marking/event mechanism. Only opaque ids, timestamps,
+ * and coarse states are retained.
+ */
+type AccountHealthDiagnostic = {
+    kind: 'health-anomaly';
+    providerId: string;
+    accountId: string;
+    at: number;
+    state: AccountAnomalyState;
+} | {
+    kind: 'health-recovery';
+    providerId: string;
+    accountId: string;
+    at: number;
+};
+interface AccountHealthDiagnosticFilter {
+    providerId?: string;
+    accountId?: string;
+    limit?: number;
+}
+declare const ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT = 200;
 /** The inputs one upstream attempt contributes to health marking (design D3). */
 interface RecordUpstreamOutcomeInput {
     /** The final HTTP status, or `null` for a thrown / network failure. */
@@ -134,6 +158,7 @@ declare class SubscriptionAccountHealth {
     private readonly records;
     private readonly listeners;
     private readonly anomalyListeners;
+    private readonly diagnostics;
     private readonly now;
     private overloadEnabled;
     private overloadTtlMs;
@@ -150,14 +175,14 @@ declare class SubscriptionAccountHealth {
     configure(opts: Pick<SubscriptionAccountHealthOptions, 'overloadEnabled' | 'overloadTtlMs' | 'authErrorTtlMs' | 'serverErrorTtlMs'>): void;
     /**
      * Whether an account may be scheduled RIGHT NOW. `blocked` → false; any timer
-     * still in the future → false. Expired timers are lazily deleted on read (CRS
-     * lazy-clear parity) so an elapsed cooldown restores the account WITHOUT a
+     * still in the future → false. Expired timers are lazily deleted on read so
+     * an elapsed cooldown restores the account WITHOUT a
      * timer — but the recovery SIGNAL is the sweeper's job (`sweepRecoveries`), so
      * this read never emits (correctness is independent of the tick).
      */
     isSchedulable(providerId: string, accountId: string, now?: number): boolean;
     /**
-     * The single marking entry point (design D3). Faithful to CRS status semantics:
+     * The single marking entry point (design D3):
      *  - 429 + authoritative reset → `rateLimitEndAt`; a non-claude 429 may use
      *    `retryAfterSeconds`; a bare 429 (no resolvable reset) is NOT marked;
      *  - 529 → `overloadUntil` (gated by `overloadEnabled`);
@@ -194,6 +219,8 @@ declare class SubscriptionAccountHealth {
     sweepRecoveries(now?: number): AccountRecoveryEvent[];
     /** Admin-facing coarse status + cooldown-until for one account (secret-free). */
     getStatus(providerId: string, accountId: string, now?: number): AccountHealthStatus;
+    /** Return newest-first, bounded, secret-free health edge diagnostics. */
+    getDiagnostics(filter?: AccountHealthDiagnosticFilter): AccountHealthDiagnostic[];
     /**
      * Register a recovery listener (the OQ3 seam #5 webhooks + #8 health-cron
      * consume). Returns an unsubscribe function. Two edges fire it:
@@ -216,6 +243,7 @@ declare class SubscriptionAccountHealth {
      */
     onAnomaly(listener: AccountAnomalyListener): () => void;
     private emitAnomaly;
+    private recordDiagnostic;
     /**
      * Delete every EXPIRED timer field on the record in place; return whether any
      * timer is STILL active (in the future). `blocked` is not a timer and is left
@@ -232,4 +260,4 @@ declare function setSharedAccountHealth(instance: SubscriptionAccountHealth): vo
 /** Reset the shared singleton (tests / teardown only). */
 declare function __resetSharedAccountHealthForTests(): void;
 
-export { AUTH_ERROR_TTL_MS, type AccountAnomalyEvent, type AccountAnomalyListener, type AccountAnomalyState, type AccountHealthState, type AccountHealthStatus, type AccountRecoveryEvent, type AccountRecoveryListener, type HeadersLike, type HealthRecord, OVERLOAD_ENABLED_DEFAULT, OVERLOAD_TTL_MS, type RecordUpstreamOutcomeInput, SERVER_ERROR_TTL_MS, SubscriptionAccountHealth, type SubscriptionAccountHealthOptions, __resetSharedAccountHealthForTests, getSharedAccountHealth, resolveResetSeconds, setSharedAccountHealth };
+export { ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT, AUTH_ERROR_TTL_MS, type AccountAnomalyEvent, type AccountAnomalyListener, type AccountAnomalyState, type AccountHealthDiagnostic, type AccountHealthDiagnosticFilter, type AccountHealthState, type AccountHealthStatus, type AccountRecoveryEvent, type AccountRecoveryListener, type HeadersLike, type HealthRecord, OVERLOAD_ENABLED_DEFAULT, OVERLOAD_TTL_MS, type RecordUpstreamOutcomeInput, SERVER_ERROR_TTL_MS, SubscriptionAccountHealth, type SubscriptionAccountHealthOptions, __resetSharedAccountHealthForTests, getSharedAccountHealth, resolveResetSeconds, setSharedAccountHealth };