@omnicross/core 0.1.5 → 0.1.7

package/dist/{chunk-PG7PS2NN.cjs → chunk-RJUONLUQ.cjs}

@@ -2,7 +2,14 @@
 
 
 
-var _chunk3Z5BQZFMcjs = require('./chunk-3Z5BQZFM.cjs');
+
+var _chunk235MXAGXcjs = require('./chunk-235MXAGX.cjs');
+
+
+var _chunkHVBBDBS3cjs = require('./chunk-HVBBDBS3.cjs');
+
+
+var _chunkNKVZ6Z3Ycjs = require('./chunk-NKVZ6Z3Y.cjs');
 
 // src/pipeline/upstreamFetch.ts
 var _undici = require('undici');
@@ -102,23 +109,63 @@ function resolveUpstreamDispatcher(ctx) {
 function fetchUpstream(url, init, ctx) {
   const dispatcher = resolveUpstreamDispatcher({ ..._nullishCoalesce(ctx, () => ( {})), url });
   const doFetch = dispatcher ? () => fetch(url, { ...init, dispatcher }) : () => fetch(url, init);
-  const tracePath = _chunk3Z5BQZFMcjs.getUpstreamTracePath.call(void 0, );
-  if (!tracePath || !_optionalChain([ctx, 'optionalAccess', _3 => _3.providerId])) return doFetch();
+  const doFetchWithAllowanceTap = () => doFetch().then((response) => {
+    if (_optionalChain([ctx, 'optionalAccess', _3 => _3.providerId]) === "codex" && ctx.accountId) {
+      try {
+        _chunkHVBBDBS3cjs.getSharedAccountAllowanceStore.call(void 0, ).recordCodexHeaders(ctx.accountId, response.headers);
+      } catch (e4) {
+      }
+    }
+    return response;
+  });
+  const activity = _optionalChain([ctx, 'optionalAccess', _4 => _4.routeActivity]);
+  const activityStartedAt = activity && _optionalChain([ctx, 'optionalAccess', _5 => _5.providerId]) && ctx.accountId ? Date.now() : 0;
+  const recordActivity = (status) => {
+    if (!activity || !_optionalChain([ctx, 'optionalAccess', _6 => _6.providerId]) || !ctx.accountId) return;
+    const record = _chunkNKVZ6Z3Ycjs.getSharedAccountRouteActivity.call(void 0, ).record({
+      providerId: ctx.providerId,
+      accountId: ctx.accountId,
+      endpoint: activity.endpoint,
+      sessionKey: activity.sessionKey,
+      sessionSource: activity.sessionSource,
+      model: activity.model,
+      status,
+      durationMs: Math.max(0, Date.now() - activityStartedAt),
+      ts: activityStartedAt
+    });
+    try {
+      _optionalChain([activity, 'access', _7 => _7.onRecorded, 'optionalCall', _8 => _8(record)]);
+    } catch (e5) {
+    }
+  };
+  const doFetchWithActivity = () => doFetchWithAllowanceTap().then(
+    (response) => {
+      recordActivity(response.status);
+      return response;
+    },
+    (error) => {
+      recordActivity(0);
+      throw error;
+    }
+  );
+  const tracePath = _chunk235MXAGXcjs.getUpstreamTracePath.call(void 0, );
+  if (!tracePath || !_optionalChain([ctx, 'optionalAccess', _9 => _9.providerId])) return doFetchWithActivity();
   const startedAt = Date.now();
   const method = typeof init.method === "string" ? init.method : "GET";
-  const requestHeaders = _chunk3Z5BQZFMcjs.redactHeaders.call(void 0, 
+  const requestHeaders = _chunk235MXAGXcjs.redactHeaders.call(void 0, 
     init.headers
   );
-  const requestBody = typeof init.body === "string" ? init.body : null;
+  const redactBodies = ctx.redactBodies === true;
+  const requestBody = redactBodies ? _chunk235MXAGXcjs.REDACTED_BODY : typeof init.body === "string" ? init.body : null;
   const providerId = ctx.providerId;
   const accountId = ctx.accountId;
-  return doFetch().then((res) => {
+  return doFetchWithActivity().then((res) => {
     const clone = res.clone();
     const status = res.status;
     const statusText = res.statusText;
-    const responseHeaders = _chunk3Z5BQZFMcjs.redactHeaders.call(void 0, res.headers);
+    const responseHeaders = _chunk235MXAGXcjs.redactHeaders.call(void 0, res.headers);
     void clone.text().then((body) => {
-      _chunk3Z5BQZFMcjs.writeUpstreamTrace.call(void 0, {
+      _chunk235MXAGXcjs.writeUpstreamTrace.call(void 0, {
         ts: startedAt,
         durationMs: Date.now() - startedAt,
         providerId,
@@ -130,7 +177,9 @@ function fetchUpstream(url, init, ctx) {
         status,
         statusText,
         responseHeaders,
-        responseBody: body,
+        // The byte count stays REAL even when redacted — it is a useful
+        // diagnostic and reveals nothing about the token itself.
+        responseBody: redactBodies ? _chunk235MXAGXcjs.REDACTED_BODY : body,
         responseBytes: Buffer.byteLength(body, "utf8")
       });
     }).catch(() => {
@@ -138,7 +187,7 @@ function fetchUpstream(url, init, ctx) {
     return res;
   }).catch((err) => {
     const msg = err instanceof Error ? err.message : String(err);
-    _chunk3Z5BQZFMcjs.writeUpstreamTrace.call(void 0, {
+    _chunk235MXAGXcjs.writeUpstreamTrace.call(void 0, {
       ts: startedAt,
       durationMs: Date.now() - startedAt,
       providerId,

package/dist/{chunk-BPKCU575.js → chunk-SOO562NM.js}

@@ -78,7 +78,9 @@ var UsageRecorder = class {
       costSavedByCacheUsd,
       rawUsage: input.rawUsage != null ? safeStringify(input.rawUsage) : null,
       runId: input.runId ?? null,
-      eventId: input.eventId ?? null
+      eventId: input.eventId ?? null,
+      ...input.cacheKeySource !== void 0 ? { cacheKeySource: input.cacheKeySource } : {},
+      ...input.cacheKeyInjected !== void 0 ? { cacheKeyInjected: input.cacheKeyInjected } : {}
     };
     try {
       return await this.store.insert(row);

package/dist/{chunk-6QZGDLL4.js → chunk-TOVPMMHM.js}

@@ -792,6 +792,9 @@ function buildRequestBody(request) {
     }
   });
   const generationConfig = {};
+  if (request.max_tokens !== void 0) {
+    generationConfig.maxOutputTokens = request.max_tokens;
+  }
   if (request.reasoning?.effort && request.reasoning.effort !== "none") {
     generationConfig.thinkingConfig = {
       includeThoughts: true
@@ -843,7 +846,8 @@ function transformRequestOut(request) {
   const contents = request.contents;
   const tools = request.tools;
   const model = request.model;
-  const maxTokens = request.max_tokens;
+  const generationConfig = request.generationConfig;
+  const maxTokens = generationConfig?.maxOutputTokens ?? request.max_tokens;
   const temperature = request.temperature;
   const stream = request.stream;
   const toolChoice = request.tool_choice;

package/dist/{chunk-K52THW2C.cjs → chunk-V4TXMEJS.cjs}

@@ -3,7 +3,7 @@
 
 
 
-var _chunkJWVTXXPXcjs = require('./chunk-JWVTXXPX.cjs');
+var _chunkKBM2W6UYcjs = require('./chunk-KBM2W6UY.cjs');
 
 // src/transformer/transformers/GeminiTransformer.ts
 var GeminiTransformer = (_class = class {
@@ -44,7 +44,7 @@ var GeminiTransformer = (_class = class {
    * Also builds the correct URL for the Gemini API
    */
   async transformRequestIn(request, provider, _context) {
-    const body = _chunkJWVTXXPXcjs.buildRequestBody.call(void 0, request);
+    const body = _chunkKBM2W6UYcjs.buildRequestBody.call(void 0, request);
     const action = request.stream ? "streamGenerateContent?alt=sse" : "generateContent";
     const url = new URL(`./${request.model}:${action}`, provider.baseUrl);
     const headers = {};
@@ -65,20 +65,20 @@ var GeminiTransformer = (_class = class {
    * (For requests coming into the Gemini endpoint)
    */
   async transformRequestOut(request, _context) {
-    return _chunkJWVTXXPXcjs.transformRequestOut.call(void 0, request);
+    return _chunkKBM2W6UYcjs.transformRequestOut.call(void 0, request);
   }
   /**
    * Transform Gemini response to OpenAI-compatible format
    */
   async transformResponseOut(response, _context) {
-    return _chunkJWVTXXPXcjs.transformResponseOut.call(void 0, response, this.name, this.logger);
+    return _chunkKBM2W6UYcjs.transformResponseOut.call(void 0, response, this.name, this.logger);
   }
   /**
    * Transform OpenAI-compatible response back to Gemini format
    * (For endpoint mode — returning Gemini-format responses to the client)
    */
   async transformResponseIn(response, _context) {
-    return _chunkJWVTXXPXcjs.transformResponseIn.call(void 0, response, this.logger);
+    return _chunkKBM2W6UYcjs.transformResponseIn.call(void 0, response, this.logger);
   }
 }, _class.__initStatic(), _class);
 

package/dist/{chunk-G2UTNSGU.js → chunk-WNKWAEUR.js}

@@ -134,7 +134,13 @@ var TransformerChainExecutor = class {
     const { endpointTransformer } = options;
     const context = {
       logger: this.logger,
-      providerName: provider.name
+      providerName: provider.name,
+      // The unified REQUEST this response answers. Response encoders need it to
+      // restore request-scoped protocol state that the chat wire cannot carry —
+      // e.g. which codex tools were declared `custom` (see
+      // `UnifiedChatRequestMeta.codexTools`), which decides whether a tool call
+      // is encoded back as a `function_call` or a `custom_tool_call` item.
+      req: request
     };
     let finalResponse = response;
     const bypass = this.shouldBypassTransformers(chain, endpointTransformer, request);

package/dist/{chunk-UNWKG6EI.cjs → chunk-XPIOJQS2.cjs}

@@ -11,6 +11,29 @@ var _chunkXSVNC2UDcjs = require('./chunk-XSVNC2UD.cjs');
 
 // src/outbound-api/auditCapture.ts
 var _crypto = require('crypto');
+function completeUtf8PrefixLength(buf) {
+  if (buf.length === 0) return 0;
+  let leadIndex = buf.length - 1;
+  while (leadIndex >= 0 && (buf[leadIndex] & 192) === 128) leadIndex -= 1;
+  if (leadIndex < 0) return 0;
+  const lead = buf[leadIndex];
+  let expectedLength = 1;
+  if ((lead & 224) === 192) expectedLength = 2;
+  else if ((lead & 240) === 224) expectedLength = 3;
+  else if ((lead & 248) === 240) expectedLength = 4;
+  return buf.length - leadIndex < expectedLength ? leadIndex : buf.length;
+}
+function truncateToBytes(text, maxBytes) {
+  if (maxBytes < 0) return text;
+  const buf = Buffer.from(text, "utf8");
+  if (buf.length <= maxBytes) return text;
+  const head = buf.subarray(0, maxBytes);
+  return head.subarray(0, completeUtf8PrefixLength(head)).toString("utf8");
+}
+function decodeCapturedBody(body, truncated) {
+  if (!truncated) return body.toString("utf8");
+  return body.subarray(0, completeUtf8PrefixLength(body)).toString("utf8");
+}
 function resolveClientIp(req, trustForwardedFor) {
   if (trustForwardedFor) {
     const xff = req.headers["x-forwarded-for"];
@@ -25,18 +48,39 @@ function resolveClientIp(req, trustForwardedFor) {
 function beginAuditCapture(req, res, now) {
   const config = _chunkAEOZIDEBcjs.getAuditCaptureConfig.call(void 0, );
   if (!config) return null;
-  let rawRequestBody;
+  let requestBody;
   const responseChunks = [];
+  let responseBytes = 0;
+  let responseTruncated = false;
   let finished = false;
   const ctx = {
     setRequestBody(raw) {
-      if (config.captureBodies) rawRequestBody = raw;
+      if (config.captureBodies) {
+        requestBody = truncateToBytes(_chunkFCR77GYMcjs.redactAuditText.call(void 0, raw), config.maxBodyBytes);
+      }
     }
   };
   if (config.captureBodies) {
     installResponseCapture(res, {
       push(chunk) {
+        if (config.maxBodyBytes < 0) {
+          responseChunks.push(chunk);
+          responseBytes += chunk.length;
+          return;
+        }
+        const remaining = config.maxBodyBytes - responseBytes;
+        if (remaining <= 0) {
+          responseTruncated = true;
+          return;
+        }
+        if (chunk.length > remaining) {
+          responseChunks.push(chunk.subarray(0, remaining));
+          responseBytes += remaining;
+          responseTruncated = true;
+          return;
+        }
         responseChunks.push(chunk);
+        responseBytes += chunk.length;
       }
     });
   }
@@ -69,12 +113,13 @@ function beginAuditCapture(req, res, now) {
       }
       if (ctx.error) record.error = _chunkFCR77GYMcjs.redactAuditText.call(void 0, ctx.error);
       if (config.captureBodies) {
-        if (rawRequestBody != null && rawRequestBody.length > 0) {
-          record.requestBody = _chunkFCR77GYMcjs.redactAuditText.call(void 0, rawRequestBody);
+        if (requestBody != null && requestBody.length > 0) {
+          record.requestBody = requestBody;
         }
         if (responseChunks.length > 0) {
-          const body = Buffer.concat(responseChunks).toString("utf8");
-          record.responseBody = _chunkFCR77GYMcjs.redactAuditText.call(void 0, body);
+          const captured = Buffer.concat(responseChunks, responseBytes);
+          const body = decodeCapturedBody(captured, responseTruncated);
+          record.responseBody = truncateToBytes(_chunkFCR77GYMcjs.redactAuditText.call(void 0, body), config.maxBodyBytes);
         }
       }
       _chunkAEOZIDEBcjs.recordAudit.call(void 0, record);

package/dist/chunk-XXFYLL7R.js

@@ -0,0 +1,63 @@
+// src/provider-proxy/identity/headerMerge.ts
+function fillMissingHeaders(headers, source) {
+  const present = new Set(Object.keys(headers).map((k) => k.toLowerCase()));
+  for (const [key, value] of Object.entries(source)) {
+    const lower = key.toLowerCase();
+    if (present.has(lower)) continue;
+    headers[lower] = value;
+    present.add(lower);
+  }
+}
+function flattenHeaderValue(raw) {
+  if (raw === void 0) return void 0;
+  const value = Array.isArray(raw) ? raw.filter((v) => typeof v === "string").join(", ") : raw;
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+var NEVER_FORWARD_HEADERS = /* @__PURE__ */ new Set([
+  "authorization",
+  "x-api-key",
+  "cookie",
+  "proxy-authorization",
+  "host",
+  "connection",
+  "content-length",
+  "content-type",
+  "accept-encoding"
+]);
+
+// src/provider-proxy/identity/codexCliHeaders.ts
+var DEFAULT_CODEX_CLI_HEADERS = Object.freeze({
+  originator: "codex_cli_rs",
+  "user-agent": "codex_cli_rs/0.144.5",
+  version: "0.144.5"
+});
+var CODEX_FORWARD_ALLOWLIST = /* @__PURE__ */ new Set([
+  "version",
+  "openai-beta",
+  "session_id",
+  "originator",
+  "user-agent"
+]);
+function extractCodexClientHeaders(reqHeaders) {
+  const out = {};
+  for (const [rawKey, rawVal] of Object.entries(reqHeaders)) {
+    const key = rawKey.toLowerCase();
+    if (NEVER_FORWARD_HEADERS.has(key)) continue;
+    if (!CODEX_FORWARD_ALLOWLIST.has(key)) continue;
+    const value = flattenHeaderValue(rawVal);
+    if (value !== void 0) out[key] = value;
+  }
+  return out;
+}
+function codexAcceptHeader(isStream) {
+  return isStream ? "text/event-stream" : "application/json";
+}
+
+export {
+  fillMissingHeaders,
+  flattenHeaderValue,
+  NEVER_FORWARD_HEADERS,
+  DEFAULT_CODEX_CLI_HEADERS,
+  extractCodexClientHeaders,
+  codexAcceptHeader
+};

package/dist/{chunk-KFI44N2R.cjs → chunk-YNJNTCSQ.cjs}

@@ -2,6 +2,12 @@
 
 var _chunkSVNDB62Dcjs = require('./chunk-SVNDB62D.cjs');
 
+
+var _chunk6QQG7YG3cjs = require('./chunk-6QQG7YG3.cjs');
+
+
+var _chunk25GXJCEZcjs = require('./chunk-25GXJCEZ.cjs');
+
 // src/pipeline/SubscriptionAuthSource.ts
 function stripAuthHeaders(headers) {
   delete headers.authorization;
@@ -34,9 +40,12 @@ var SubscriptionAuthSource = class {
         resolvedModel: hints.model,
         sessionKey: hints.sessionKey,
         reportSelection: hints.reportSelection,
-        preferredAccountId: hints.preferredAccountId
+        preferredAccountId: hints.preferredAccountId,
+        preferredAccountGroup: hints.preferredAccountGroup,
+        boundAccountFallbackPolicy: hints.boundAccountFallbackPolicy
       });
     } catch (err) {
+      if (_chunk6QQG7YG3cjs.isAccountAllowanceExhaustedError.call(void 0, err) || _chunk25GXJCEZcjs.isBoundAccountSelectionError.call(void 0, err)) throw err;
       console.warn("[SubscriptionAuthSource] authStrategy.applyHeaders threw:", _chunkSVNDB62Dcjs.serializeError.call(void 0, err));
     }
   }

package/dist/{chunk-VQY5W4YW.cjs → chunk-YWL7YZWS.cjs}

@@ -3,10 +3,12 @@ var OVERLOAD_TTL_MS = 10 * 6e4;
 var OVERLOAD_ENABLED_DEFAULT = true;
 var AUTH_ERROR_TTL_MS = 30 * 6e4;
 var SERVER_ERROR_TTL_MS = 5 * 6e4;
+var MAX_QUOTA_COOLDOWN_MS = 7 * 24 * 60 * 6e4;
 var BAN_BODY_MARKERS = [
   "this organization has been disabled",
   "oauth authentication is currently not allowed"
 ];
+var ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT = 200;
 function readHeader(headers, name) {
   if (typeof headers.get === "function") {
     return headers.get(name);
@@ -37,19 +39,20 @@ function isBanBody(bodyText) {
   return BAN_BODY_MARKERS.some((marker) => lower.includes(marker));
 }
 function isRecordEmpty(record) {
-  return record.rateLimitEndAt === void 0 && record.overloadUntil === void 0 && record.tempUnavailableUntil === void 0 && !record.blocked;
+  return record.rateLimitEndAt === void 0 && record.overloadUntil === void 0 && record.tempUnavailableUntil === void 0 && record.quotaExhaustedUntil === void 0 && !record.blocked;
 }
 var KEY_SEP = "\0";
 var SubscriptionAccountHealth = (_class = class {
   __init() {this.records = /* @__PURE__ */ new Map()}
   __init2() {this.listeners = /* @__PURE__ */ new Set()}
   __init3() {this.anomalyListeners = /* @__PURE__ */ new Set()}
+  __init4() {this.diagnostics = []}
   
   
   
   
   
-  constructor(opts = {}) {;_class.prototype.__init.call(this);_class.prototype.__init2.call(this);_class.prototype.__init3.call(this);
+  constructor(opts = {}) {;_class.prototype.__init.call(this);_class.prototype.__init2.call(this);_class.prototype.__init3.call(this);_class.prototype.__init4.call(this);
     this.now = _nullishCoalesce(opts.now, () => ( Date.now));
     this.overloadEnabled = _nullishCoalesce(opts.overloadEnabled, () => ( OVERLOAD_ENABLED_DEFAULT));
     this.overloadTtlMs = _nullishCoalesce(opts.overloadTtlMs, () => ( OVERLOAD_TTL_MS));
@@ -71,8 +74,8 @@ var SubscriptionAccountHealth = (_class = class {
   }
   /**
    * Whether an account may be scheduled RIGHT NOW. `blocked` → false; any timer
-   * still in the future → false. Expired timers are lazily deleted on read (CRS
-   * lazy-clear parity) so an elapsed cooldown restores the account WITHOUT a
+   * still in the future → false. Expired timers are lazily deleted on read so
+   * an elapsed cooldown restores the account WITHOUT a
    * timer — but the recovery SIGNAL is the sweeper's job (`sweepRecoveries`), so
    * this read never emits (correctness is independent of the tick).
    */
@@ -86,7 +89,7 @@ var SubscriptionAccountHealth = (_class = class {
     return !active;
   }
   /**
-   * The single marking entry point (design D3). Faithful to CRS status semantics:
+   * The single marking entry point (design D3):
    *  - 429 + authoritative reset → `rateLimitEndAt`; a non-claude 429 may use
    *    `retryAfterSeconds`; a bare 429 (no resolvable reset) is NOT marked;
    *  - 529 → `overloadUntil` (gated by `overloadEnabled`);
@@ -141,9 +144,54 @@ var SubscriptionAccountHealth = (_class = class {
     }
     if (isRecordEmpty(record)) this.records.delete(key);
     else this.records.set(key, record);
-    if (recovered) this.emit({ providerId, accountId, at: now, kind: "rateLimitRecovery" });
+    if (recovered) {
+      const recovery = {
+        providerId,
+        accountId,
+        at: now,
+        kind: "rateLimitRecovery"
+      };
+      this.recordDiagnostic({ kind: "health-recovery", providerId, accountId, at: now });
+      this.emit(recovery);
+    }
     if (anomalyState && !wasUnhealthyBefore) {
-      this.emitAnomaly({ providerId, accountId, at: now, state: anomalyState });
+      const anomaly = { providerId, accountId, at: now, state: anomalyState };
+      this.recordDiagnostic({ kind: "health-anomaly", ...anomaly });
+      this.emitAnomaly(anomaly);
+    }
+  }
+  /**
+   * Mark an account quota/usage-exhausted until `untilEpochMs` (the Codex weekly
+   * usage-limit wall). Unlike the status-driven timers set by
+   * {@link recordUpstreamOutcome}, this mark is NOT cleared by a 2xx: in-flight
+   * sessions on the same account keep succeeding after the window is exhausted,
+   * so a traffic-driven clear would re-strand every NEW session onto this
+   * account. It excludes the account from NEW-session selection until the
+   * deadline elapses (existing sessions are unaffected — they already hold their
+   * token). Self-heals lazily on read and via {@link sweepRecoveries}.
+   * `untilEpochMs` is clamped to {@link MAX_QUOTA_COOLDOWN_MS}; an already-elapsed
+   * deadline is a no-op. Emits a `quota_exhausted` anomaly on the healthy→
+   * unhealthy edge.
+   */
+  markQuotaExhausted(providerId, accountId, untilEpochMs, now = this.now()) {
+    if (!Number.isFinite(untilEpochMs)) return;
+    const clamped = Math.min(untilEpochMs, now + MAX_QUOTA_COOLDOWN_MS);
+    if (clamped <= now) return;
+    const key = this.key(providerId, accountId);
+    const preExisting = this.records.get(key);
+    const record = _nullishCoalesce(preExisting, () => ( {}));
+    const wasUnhealthyBefore = preExisting ? this.isUnhealthyAt(preExisting, now) : false;
+    record.quotaExhaustedUntil = clamped;
+    this.records.set(key, record);
+    if (!wasUnhealthyBefore) {
+      const anomaly = {
+        providerId,
+        accountId,
+        at: now,
+        state: "quota_exhausted"
+      };
+      this.recordDiagnostic({ kind: "health-anomaly", ...anomaly });
+      this.emitAnomaly(anomaly);
     }
   }
   /** Whether a record is unhealthy at `now`: blocked, or any timer still future. */
@@ -152,6 +200,7 @@ var SubscriptionAccountHealth = (_class = class {
     if (record.rateLimitEndAt !== void 0 && now < record.rateLimitEndAt) return true;
     if (record.overloadUntil !== void 0 && now < record.overloadUntil) return true;
     if (record.tempUnavailableUntil !== void 0 && now < record.tempUnavailableUntil) return true;
+    if (record.quotaExhaustedUntil !== void 0 && now < record.quotaExhaustedUntil) return true;
     return false;
   }
   /**
@@ -188,7 +237,7 @@ var SubscriptionAccountHealth = (_class = class {
     const recovered = [];
     for (const [key, record] of this.records) {
       if (record.blocked) continue;
-      const hadTimer = record.rateLimitEndAt !== void 0 || record.overloadUntil !== void 0 || record.tempUnavailableUntil !== void 0;
+      const hadTimer = record.rateLimitEndAt !== void 0 || record.overloadUntil !== void 0 || record.tempUnavailableUntil !== void 0 || record.quotaExhaustedUntil !== void 0;
       const active = this.clearExpired(record, now);
       if (hadTimer && !active && isRecordEmpty(record)) {
         const [pid, aid] = this.parseKey(key);
@@ -196,7 +245,15 @@ var SubscriptionAccountHealth = (_class = class {
         this.records.delete(key);
       }
     }
-    for (const event of recovered) this.emit(event);
+    for (const event of recovered) {
+      this.recordDiagnostic({
+        kind: "health-recovery",
+        providerId: event.providerId,
+        accountId: event.accountId,
+        at: event.at
+      });
+      this.emit(event);
+    }
     return recovered;
   }
   /** Admin-facing coarse status + cooldown-until for one account (secret-free). */
@@ -204,6 +261,9 @@ var SubscriptionAccountHealth = (_class = class {
     const record = this.records.get(this.key(providerId, accountId));
     if (!record) return { state: "healthy" };
     if (record.blocked) return { state: "blocked" };
+    if (record.quotaExhaustedUntil !== void 0 && now < record.quotaExhaustedUntil) {
+      return { state: "quota_exhausted", cooldownUntil: record.quotaExhaustedUntil };
+    }
     if (record.rateLimitEndAt !== void 0 && now < record.rateLimitEndAt) {
       return { state: "rate_limited", cooldownUntil: record.rateLimitEndAt };
     }
@@ -215,6 +275,14 @@ var SubscriptionAccountHealth = (_class = class {
     }
     return { state: "healthy" };
   }
+  /** Return newest-first, bounded, secret-free health edge diagnostics. */
+  getDiagnostics(filter = {}) {
+    const requested = typeof filter.limit === "number" && Number.isFinite(filter.limit) ? Math.trunc(filter.limit) : ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT;
+    const limit = Math.min(ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT, Math.max(1, requested));
+    return this.diagnostics.filter(
+      (event) => (!filter.providerId || event.providerId === filter.providerId) && (!filter.accountId || event.accountId === filter.accountId)
+    ).slice(-limit).reverse().map((event) => ({ ...event }));
+  }
   /**
    * Register a recovery listener (the OQ3 seam #5 webhooks + #8 health-cron
    * consume). Returns an unsubscribe function. Two edges fire it:
@@ -257,6 +325,12 @@ var SubscriptionAccountHealth = (_class = class {
       }
     }
   }
+  recordDiagnostic(event) {
+    this.diagnostics.push({ ...event });
+    if (this.diagnostics.length > ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT) {
+      this.diagnostics.splice(0, this.diagnostics.length - ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT);
+    }
+  }
   /**
    * Delete every EXPIRED timer field on the record in place; return whether any
    * timer is STILL active (in the future). `blocked` is not a timer and is left
@@ -276,6 +350,10 @@ var SubscriptionAccountHealth = (_class = class {
       if (now >= record.tempUnavailableUntil) delete record.tempUnavailableUntil;
       else active = true;
     }
+    if (record.quotaExhaustedUntil !== void 0) {
+      if (now >= record.quotaExhaustedUntil) delete record.quotaExhaustedUntil;
+      else active = true;
+    }
     return active;
   }
   key(providerId, accountId) {
@@ -308,4 +386,6 @@ function __resetSharedAccountHealthForTests() {
 
 
 
-exports.OVERLOAD_TTL_MS = OVERLOAD_TTL_MS; exports.OVERLOAD_ENABLED_DEFAULT = OVERLOAD_ENABLED_DEFAULT; exports.AUTH_ERROR_TTL_MS = AUTH_ERROR_TTL_MS; exports.SERVER_ERROR_TTL_MS = SERVER_ERROR_TTL_MS; exports.resolveResetSeconds = resolveResetSeconds; exports.SubscriptionAccountHealth = SubscriptionAccountHealth; exports.getSharedAccountHealth = getSharedAccountHealth; exports.setSharedAccountHealth = setSharedAccountHealth; exports.__resetSharedAccountHealthForTests = __resetSharedAccountHealthForTests;
+
+
+exports.OVERLOAD_TTL_MS = OVERLOAD_TTL_MS; exports.OVERLOAD_ENABLED_DEFAULT = OVERLOAD_ENABLED_DEFAULT; exports.AUTH_ERROR_TTL_MS = AUTH_ERROR_TTL_MS; exports.SERVER_ERROR_TTL_MS = SERVER_ERROR_TTL_MS; exports.MAX_QUOTA_COOLDOWN_MS = MAX_QUOTA_COOLDOWN_MS; exports.ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT = ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT; exports.resolveResetSeconds = resolveResetSeconds; exports.SubscriptionAccountHealth = SubscriptionAccountHealth; exports.getSharedAccountHealth = getSharedAccountHealth; exports.setSharedAccountHealth = setSharedAccountHealth; exports.__resetSharedAccountHealthForTests = __resetSharedAccountHealthForTests;

package/dist/completion/ApiKeyPoolService.cjs

@@ -80,6 +80,18 @@ var ApiKeyPoolService = (_class = class {
     });
     return this.resolveKey(selected.apiKey);
   }
+  /**
+   * Bind a session to one explicit provider key. Returns an empty string when
+   * the key is unknown, disabled, or cooling so the caller can apply its strict
+   * versus pool fallback policy without exposing key material.
+   */
+  async getKeyById(providerId, keyId, sessionId) {
+    const keys = await this.getAvailableKeys(providerId);
+    const selected = keys.find((key) => key.id === keyId);
+    if (!selected) return "";
+    if (sessionId) this.sessionBindings.set(sessionId, { keyId: selected.id, providerId });
+    return this.resolveKey(selected.apiKey);
+  }
   /**
    * Get a key without session affinity (for one-shot calls like testConnection).
    *

package/dist/completion/ApiKeyPoolService.d.cts

@@ -71,6 +71,12 @@ declare class ApiKeyPoolService {
      */
     getKeyIdForSession(providerId: string, sessionId: string): string | null;
     getKeyForSession(providerId: string, sessionId: string): Promise<string>;
+    /**
+     * Bind a session to one explicit provider key. Returns an empty string when
+     * the key is unknown, disabled, or cooling so the caller can apply its strict
+     * versus pool fallback policy without exposing key material.
+     */
+    getKeyById(providerId: string, keyId: string, sessionId?: string | null): Promise<string>;
     /**
      * Get a key without session affinity (for one-shot calls like testConnection).
      *

package/dist/completion/ApiKeyPoolService.d.ts

@@ -71,6 +71,12 @@ declare class ApiKeyPoolService {
      */
     getKeyIdForSession(providerId: string, sessionId: string): string | null;
     getKeyForSession(providerId: string, sessionId: string): Promise<string>;
+    /**
+     * Bind a session to one explicit provider key. Returns an empty string when
+     * the key is unknown, disabled, or cooling so the caller can apply its strict
+     * versus pool fallback policy without exposing key material.
+     */
+    getKeyById(providerId: string, keyId: string, sessionId?: string | null): Promise<string>;
     /**
      * Get a key without session affinity (for one-shot calls like testConnection).
      *

package/dist/completion/ApiKeyPoolService.js

@@ -80,6 +80,18 @@ var ApiKeyPoolService = class {
     });
     return this.resolveKey(selected.apiKey);
   }
+  /**
+   * Bind a session to one explicit provider key. Returns an empty string when
+   * the key is unknown, disabled, or cooling so the caller can apply its strict
+   * versus pool fallback policy without exposing key material.
+   */
+  async getKeyById(providerId, keyId, sessionId) {
+    const keys = await this.getAvailableKeys(providerId);
+    const selected = keys.find((key) => key.id === keyId);
+    if (!selected) return "";
+    if (sessionId) this.sessionBindings.set(sessionId, { keyId: selected.id, providerId });
+    return this.resolveKey(selected.apiKey);
+  }
   /**
    * Get a key without session affinity (for one-shot calls like testConnection).
    *