@omnicross/core 0.1.5 → 0.1.7

package/dist/pipeline/AccountAllowanceScheduling.d.cts

@@ -0,0 +1,91 @@
+import { SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
+import { a as AllowanceSchedulingConfig } from '../types-gjJ5lJ5n.cjs';
+import { AccountAllowanceStore } from './AccountAllowanceStore.cjs';
+import '@omnicross/contracts/account-tokens-types';
+import '@omnicross/contracts/audit-types';
+import '@omnicross/contracts/billing-types';
+import '@omnicross/contracts/health-logging-types';
+import '@omnicross/contracts/voucher-types';
+import '@omnicross/contracts/webhook-types';
+import '../logger-4GvQNzhE.cjs';
+import '../ports/provider-config-source.cjs';
+import '@omnicross/contracts/llm-config';
+import '../transformer/types.cjs';
+import '../transformer/TransformerService.cjs';
+import '../ProviderProxy-CnMQYN59.cjs';
+import '../provider-proxy/types.cjs';
+import 'node:http';
+import '@omnicross/contracts/completion-types';
+import '@omnicross/contracts/usage-stats-types';
+import '@omnicross/contracts/usage-types';
+import '../completion/ApiKeyPoolService.cjs';
+import './AuthSource.cjs';
+import './BoundAccountSelectionError.cjs';
+import './SubscriptionAuthSource.cjs';
+import './SubscriptionAuthStrategy.cjs';
+import '../ports/web-search-backend.cjs';
+import '@omnicross/contracts/websearch-types';
+import '../keyPolicy-zdWTu3CQ.cjs';
+import '@omnicross/contracts/account-allowance-types';
+
+/**
+ * Default-off allowance-aware scheduling policy.
+ *
+ * This layer consumes only normalized, secret-free snapshots. Missing, stale,
+ * unsupported, or reset-expired data is deliberately ignored so telemetry can
+ * never strand an account by accident.
+ */
+
+type AllowanceSchedulingAction = 'normal' | 'demote' | 'pause' | 'ignore';
+interface AllowanceSchedulingDecision {
+    providerId: SubscriptionProviderId;
+    accountId: string;
+    action: AllowanceSchedulingAction;
+    reason: 'policy-disabled' | 'provider-unsupported' | 'snapshot-missing' | 'snapshot-not-fresh' | 'below-threshold' | 'demote-threshold' | 'pause-threshold';
+    basePriority: number;
+    effectivePriority: number;
+    schedulable: boolean;
+    usedPercent?: number;
+    observedAt?: string;
+    resumeAt?: string;
+    decidedAt: string;
+}
+/**
+ * Safe, structured signal emitted only when an enabled allowance policy paused
+ * every otherwise eligible account. Request ingress maps it to HTTP 429 instead
+ * of disguising a local scheduling decision as an upstream 5xx.
+ */
+declare class AccountAllowanceExhaustedError extends Error {
+    readonly providerId: SubscriptionProviderId;
+    readonly resumeAt?: string | undefined;
+    readonly code = "account_allowance_exhausted";
+    readonly status = 429;
+    constructor(providerId: SubscriptionProviderId, resumeAt?: string | undefined);
+}
+/** Structural guard survives package/bundle boundaries and never inspects secrets. */
+declare function isAccountAllowanceExhaustedError(error: unknown): error is AccountAllowanceExhaustedError;
+declare class AccountAllowanceScheduling {
+    private readonly store;
+    private readonly now;
+    private config;
+    private readonly history;
+    private readonly lastRecorded;
+    constructor(store?: AccountAllowanceStore, now?: () => number);
+    configure(config: AllowanceSchedulingConfig | undefined): void;
+    getConfig(): AllowanceSchedulingConfig;
+    evaluate(providerId: SubscriptionProviderId, accountId: string, basePriority: number, now?: number): AllowanceSchedulingDecision;
+    /**
+     * Project the current policy result without recording an applied decision.
+     * Admin/read-model callers use this so polling an account list never creates
+     * synthetic demotion/pause history entries.
+     */
+    preview(providerId: SubscriptionProviderId, accountId: string, basePriority: number, now?: number): AllowanceSchedulingDecision;
+    private decide;
+    getHistory(): AllowanceSchedulingDecision[];
+    clearHistory(): void;
+    private recordApplied;
+}
+declare function getSharedAccountAllowanceScheduling(): AccountAllowanceScheduling;
+declare function __resetSharedAccountAllowanceSchedulingForTests(): void;
+
+export { AccountAllowanceExhaustedError, AccountAllowanceScheduling, type AllowanceSchedulingAction, type AllowanceSchedulingDecision, __resetSharedAccountAllowanceSchedulingForTests, getSharedAccountAllowanceScheduling, isAccountAllowanceExhaustedError };

package/dist/pipeline/AccountAllowanceScheduling.d.ts

@@ -0,0 +1,91 @@
+import { SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
+import { a as AllowanceSchedulingConfig } from '../types-CqZD77rS.js';
+import { AccountAllowanceStore } from './AccountAllowanceStore.js';
+import '@omnicross/contracts/account-tokens-types';
+import '@omnicross/contracts/audit-types';
+import '@omnicross/contracts/billing-types';
+import '@omnicross/contracts/health-logging-types';
+import '@omnicross/contracts/voucher-types';
+import '@omnicross/contracts/webhook-types';
+import '../logger-4GvQNzhE.js';
+import '../ports/provider-config-source.js';
+import '@omnicross/contracts/llm-config';
+import '../transformer/types.js';
+import '../transformer/TransformerService.js';
+import '../ProviderProxy-C-xqrkKi.js';
+import '../provider-proxy/types.js';
+import 'node:http';
+import '@omnicross/contracts/completion-types';
+import '@omnicross/contracts/usage-stats-types';
+import '@omnicross/contracts/usage-types';
+import '../completion/ApiKeyPoolService.js';
+import './AuthSource.js';
+import './BoundAccountSelectionError.js';
+import './SubscriptionAuthSource.js';
+import './SubscriptionAuthStrategy.js';
+import '../ports/web-search-backend.js';
+import '@omnicross/contracts/websearch-types';
+import '../keyPolicy-zdWTu3CQ.js';
+import '@omnicross/contracts/account-allowance-types';
+
+/**
+ * Default-off allowance-aware scheduling policy.
+ *
+ * This layer consumes only normalized, secret-free snapshots. Missing, stale,
+ * unsupported, or reset-expired data is deliberately ignored so telemetry can
+ * never strand an account by accident.
+ */
+
+type AllowanceSchedulingAction = 'normal' | 'demote' | 'pause' | 'ignore';
+interface AllowanceSchedulingDecision {
+    providerId: SubscriptionProviderId;
+    accountId: string;
+    action: AllowanceSchedulingAction;
+    reason: 'policy-disabled' | 'provider-unsupported' | 'snapshot-missing' | 'snapshot-not-fresh' | 'below-threshold' | 'demote-threshold' | 'pause-threshold';
+    basePriority: number;
+    effectivePriority: number;
+    schedulable: boolean;
+    usedPercent?: number;
+    observedAt?: string;
+    resumeAt?: string;
+    decidedAt: string;
+}
+/**
+ * Safe, structured signal emitted only when an enabled allowance policy paused
+ * every otherwise eligible account. Request ingress maps it to HTTP 429 instead
+ * of disguising a local scheduling decision as an upstream 5xx.
+ */
+declare class AccountAllowanceExhaustedError extends Error {
+    readonly providerId: SubscriptionProviderId;
+    readonly resumeAt?: string | undefined;
+    readonly code = "account_allowance_exhausted";
+    readonly status = 429;
+    constructor(providerId: SubscriptionProviderId, resumeAt?: string | undefined);
+}
+/** Structural guard survives package/bundle boundaries and never inspects secrets. */
+declare function isAccountAllowanceExhaustedError(error: unknown): error is AccountAllowanceExhaustedError;
+declare class AccountAllowanceScheduling {
+    private readonly store;
+    private readonly now;
+    private config;
+    private readonly history;
+    private readonly lastRecorded;
+    constructor(store?: AccountAllowanceStore, now?: () => number);
+    configure(config: AllowanceSchedulingConfig | undefined): void;
+    getConfig(): AllowanceSchedulingConfig;
+    evaluate(providerId: SubscriptionProviderId, accountId: string, basePriority: number, now?: number): AllowanceSchedulingDecision;
+    /**
+     * Project the current policy result without recording an applied decision.
+     * Admin/read-model callers use this so polling an account list never creates
+     * synthetic demotion/pause history entries.
+     */
+    preview(providerId: SubscriptionProviderId, accountId: string, basePriority: number, now?: number): AllowanceSchedulingDecision;
+    private decide;
+    getHistory(): AllowanceSchedulingDecision[];
+    clearHistory(): void;
+    private recordApplied;
+}
+declare function getSharedAccountAllowanceScheduling(): AccountAllowanceScheduling;
+declare function __resetSharedAccountAllowanceSchedulingForTests(): void;
+
+export { AccountAllowanceExhaustedError, AccountAllowanceScheduling, type AllowanceSchedulingAction, type AllowanceSchedulingDecision, __resetSharedAccountAllowanceSchedulingForTests, getSharedAccountAllowanceScheduling, isAccountAllowanceExhaustedError };

package/dist/pipeline/AccountAllowanceScheduling.js

@@ -0,0 +1,15 @@
+import {
+  AccountAllowanceExhaustedError,
+  AccountAllowanceScheduling,
+  __resetSharedAccountAllowanceSchedulingForTests,
+  getSharedAccountAllowanceScheduling,
+  isAccountAllowanceExhaustedError
+} from "../chunk-OPRS4IQZ.js";
+import "../chunk-MKF46GNZ.js";
+export {
+  AccountAllowanceExhaustedError,
+  AccountAllowanceScheduling,
+  __resetSharedAccountAllowanceSchedulingForTests,
+  getSharedAccountAllowanceScheduling,
+  isAccountAllowanceExhaustedError
+};

package/dist/pipeline/AccountAllowanceStore.cjs

@@ -0,0 +1,20 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+
+
+
+
+
+var _chunkHVBBDBS3cjs = require('../chunk-HVBBDBS3.cjs');
+
+
+
+
+
+
+
+
+
+exports.AccountAllowanceStore = _chunkHVBBDBS3cjs.AccountAllowanceStore; exports.DEFAULT_ALLOWANCE_MAX_SNAPSHOTS = _chunkHVBBDBS3cjs.DEFAULT_ALLOWANCE_MAX_SNAPSHOTS; exports.DEFAULT_CODEX_ALLOWANCE_FRESH_MS = _chunkHVBBDBS3cjs.DEFAULT_CODEX_ALLOWANCE_FRESH_MS; exports.__resetSharedAccountAllowanceStoreForTests = _chunkHVBBDBS3cjs.__resetSharedAccountAllowanceStoreForTests; exports.getSharedAccountAllowanceStore = _chunkHVBBDBS3cjs.getSharedAccountAllowanceStore; exports.normalizeAccountAllowanceSnapshot = _chunkHVBBDBS3cjs.normalizeAccountAllowanceSnapshot; exports.parseCodexAllowanceHeaders = _chunkHVBBDBS3cjs.parseCodexAllowanceHeaders; exports.setSharedAccountAllowanceStore = _chunkHVBBDBS3cjs.setSharedAccountAllowanceStore;

package/dist/pipeline/AccountAllowanceStore.d.cts

@@ -0,0 +1,77 @@
+import { AccountAllowanceSnapshot } from '@omnicross/contracts/account-allowance-types';
+import { SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
+
+/**
+ * Secret-free upstream account allowance snapshots.
+ *
+ * Claude actively populates this store from the daemon. Codex is observed at the
+ * core egress seam so the response headers are attributed to the exact account id
+ * selected for that request. Only normalized numbers are retained; raw headers
+ * and credentials never enter the store. A host may inject a small persistence
+ * port; core deliberately does not know where that host stores the snapshot.
+ */
+
+declare const DEFAULT_CODEX_ALLOWANCE_FRESH_MS: number;
+declare const DEFAULT_ALLOWANCE_MAX_SNAPSHOTS = 256;
+type AllowanceHeadersLike = Headers | Record<string, string | string[] | number | null | undefined>;
+interface CodexAllowanceWindowObservation {
+    usedPercent?: number;
+    resetAfterSeconds?: number;
+    windowMinutes?: number;
+}
+interface CodexAllowanceObservation {
+    primary?: CodexAllowanceWindowObservation;
+    secondary?: CodexAllowanceWindowObservation;
+    primaryOverSecondaryLimitPercent?: number;
+}
+/** Host-owned persistence seam for normalized allowance snapshots. */
+interface AccountAllowancePersistence {
+    /** Return the decoded file payload, or any value for the store to validate. */
+    load(): unknown;
+    /** Replace the durable snapshot with this already-normalized bounded list. */
+    save(snapshots: readonly AccountAllowanceSnapshot[]): void;
+}
+/**
+ * Pick and normalize only the public DTO fields. This is used for both live
+ * writes and restart loads, so a structurally-cast object can never smuggle raw
+ * headers, response bodies, or token fields into the cache.
+ */
+declare function normalizeAccountAllowanceSnapshot(value: unknown): AccountAllowanceSnapshot | null;
+/** Parse only the documented numeric Codex allowance headers. */
+declare function parseCodexAllowanceHeaders(headers: AllowanceHeadersLike): CodexAllowanceObservation | null;
+/** In-memory allowance projection shared by serving/admin with optional host persistence. */
+declare class AccountAllowanceStore {
+    private readonly now;
+    private readonly codexFreshMs;
+    private readonly persistence?;
+    private readonly snapshots;
+    private readonly maxSnapshots;
+    constructor(now?: () => number, codexFreshMs?: number, persistence?: AccountAllowancePersistence | undefined, maxSnapshots?: number);
+    set(snapshot: AccountAllowanceSnapshot): void;
+    delete(providerId: SubscriptionProviderId, accountId: string): void;
+    /** Remove rows that no longer correspond to a configured account. */
+    pruneToKnownAccounts(accounts: Iterable<{
+        providerId: SubscriptionProviderId;
+        accountId: string;
+    }>): number;
+    get(providerId: SubscriptionProviderId, accountId: string, now?: number): AccountAllowanceSnapshot | null;
+    list(filter?: {
+        providerId?: SubscriptionProviderId;
+        accountId?: string;
+    }, now?: number): AccountAllowanceSnapshot[];
+    /**
+     * Merge one real Codex upstream response into the selected account's snapshot.
+     * A response with no recognized headers is a strict no-op, and a partial header
+     * set preserves previous values while marking untouched windows stale.
+     */
+    recordCodexHeaders(accountId: string, headers: AllowanceHeadersLike, observedMs?: number): AccountAllowanceSnapshot | null;
+    clear(): void;
+    private loadPersisted;
+    private persist;
+}
+declare function getSharedAccountAllowanceStore(): AccountAllowanceStore;
+declare function setSharedAccountAllowanceStore(store: AccountAllowanceStore): void;
+/** Test/daemon teardown seam. */
+declare function __resetSharedAccountAllowanceStoreForTests(): void;
+
+export { type AccountAllowancePersistence, AccountAllowanceStore, type AllowanceHeadersLike, type CodexAllowanceObservation, type CodexAllowanceWindowObservation, DEFAULT_ALLOWANCE_MAX_SNAPSHOTS, DEFAULT_CODEX_ALLOWANCE_FRESH_MS, __resetSharedAccountAllowanceStoreForTests, getSharedAccountAllowanceStore, normalizeAccountAllowanceSnapshot, parseCodexAllowanceHeaders, setSharedAccountAllowanceStore };

package/dist/pipeline/AccountAllowanceStore.d.ts

@@ -0,0 +1,77 @@
+import { AccountAllowanceSnapshot } from '@omnicross/contracts/account-allowance-types';
+import { SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
+
+/**
+ * Secret-free upstream account allowance snapshots.
+ *
+ * Claude actively populates this store from the daemon. Codex is observed at the
+ * core egress seam so the response headers are attributed to the exact account id
+ * selected for that request. Only normalized numbers are retained; raw headers
+ * and credentials never enter the store. A host may inject a small persistence
+ * port; core deliberately does not know where that host stores the snapshot.
+ */
+
+declare const DEFAULT_CODEX_ALLOWANCE_FRESH_MS: number;
+declare const DEFAULT_ALLOWANCE_MAX_SNAPSHOTS = 256;
+type AllowanceHeadersLike = Headers | Record<string, string | string[] | number | null | undefined>;
+interface CodexAllowanceWindowObservation {
+    usedPercent?: number;
+    resetAfterSeconds?: number;
+    windowMinutes?: number;
+}
+interface CodexAllowanceObservation {
+    primary?: CodexAllowanceWindowObservation;
+    secondary?: CodexAllowanceWindowObservation;
+    primaryOverSecondaryLimitPercent?: number;
+}
+/** Host-owned persistence seam for normalized allowance snapshots. */
+interface AccountAllowancePersistence {
+    /** Return the decoded file payload, or any value for the store to validate. */
+    load(): unknown;
+    /** Replace the durable snapshot with this already-normalized bounded list. */
+    save(snapshots: readonly AccountAllowanceSnapshot[]): void;
+}
+/**
+ * Pick and normalize only the public DTO fields. This is used for both live
+ * writes and restart loads, so a structurally-cast object can never smuggle raw
+ * headers, response bodies, or token fields into the cache.
+ */
+declare function normalizeAccountAllowanceSnapshot(value: unknown): AccountAllowanceSnapshot | null;
+/** Parse only the documented numeric Codex allowance headers. */
+declare function parseCodexAllowanceHeaders(headers: AllowanceHeadersLike): CodexAllowanceObservation | null;
+/** In-memory allowance projection shared by serving/admin with optional host persistence. */
+declare class AccountAllowanceStore {
+    private readonly now;
+    private readonly codexFreshMs;
+    private readonly persistence?;
+    private readonly snapshots;
+    private readonly maxSnapshots;
+    constructor(now?: () => number, codexFreshMs?: number, persistence?: AccountAllowancePersistence | undefined, maxSnapshots?: number);
+    set(snapshot: AccountAllowanceSnapshot): void;
+    delete(providerId: SubscriptionProviderId, accountId: string): void;
+    /** Remove rows that no longer correspond to a configured account. */
+    pruneToKnownAccounts(accounts: Iterable<{
+        providerId: SubscriptionProviderId;
+        accountId: string;
+    }>): number;
+    get(providerId: SubscriptionProviderId, accountId: string, now?: number): AccountAllowanceSnapshot | null;
+    list(filter?: {
+        providerId?: SubscriptionProviderId;
+        accountId?: string;
+    }, now?: number): AccountAllowanceSnapshot[];
+    /**
+     * Merge one real Codex upstream response into the selected account's snapshot.
+     * A response with no recognized headers is a strict no-op, and a partial header
+     * set preserves previous values while marking untouched windows stale.
+     */
+    recordCodexHeaders(accountId: string, headers: AllowanceHeadersLike, observedMs?: number): AccountAllowanceSnapshot | null;
+    clear(): void;
+    private loadPersisted;
+    private persist;
+}
+declare function getSharedAccountAllowanceStore(): AccountAllowanceStore;
+declare function setSharedAccountAllowanceStore(store: AccountAllowanceStore): void;
+/** Test/daemon teardown seam. */
+declare function __resetSharedAccountAllowanceStoreForTests(): void;
+
+export { type AccountAllowancePersistence, AccountAllowanceStore, type AllowanceHeadersLike, type CodexAllowanceObservation, type CodexAllowanceWindowObservation, DEFAULT_ALLOWANCE_MAX_SNAPSHOTS, DEFAULT_CODEX_ALLOWANCE_FRESH_MS, __resetSharedAccountAllowanceStoreForTests, getSharedAccountAllowanceStore, normalizeAccountAllowanceSnapshot, parseCodexAllowanceHeaders, setSharedAccountAllowanceStore };

package/dist/pipeline/AccountAllowanceStore.js

@@ -0,0 +1,20 @@
+import {
+  AccountAllowanceStore,
+  DEFAULT_ALLOWANCE_MAX_SNAPSHOTS,
+  DEFAULT_CODEX_ALLOWANCE_FRESH_MS,
+  __resetSharedAccountAllowanceStoreForTests,
+  getSharedAccountAllowanceStore,
+  normalizeAccountAllowanceSnapshot,
+  parseCodexAllowanceHeaders,
+  setSharedAccountAllowanceStore
+} from "../chunk-MKF46GNZ.js";
+export {
+  AccountAllowanceStore,
+  DEFAULT_ALLOWANCE_MAX_SNAPSHOTS,
+  DEFAULT_CODEX_ALLOWANCE_FRESH_MS,
+  __resetSharedAccountAllowanceStoreForTests,
+  getSharedAccountAllowanceStore,
+  normalizeAccountAllowanceSnapshot,
+  parseCodexAllowanceHeaders,
+  setSharedAccountAllowanceStore
+};

package/dist/pipeline/AccountRouteActivity.cjs

@@ -0,0 +1,10 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+var _chunkNKVZ6Z3Ycjs = require('../chunk-NKVZ6Z3Y.cjs');
+
+
+
+
+exports.ACCOUNT_ROUTE_ACTIVITY_LIMIT = _chunkNKVZ6Z3Ycjs.ACCOUNT_ROUTE_ACTIVITY_LIMIT; exports.AccountRouteActivityStore = _chunkNKVZ6Z3Ycjs.AccountRouteActivityStore; exports.getSharedAccountRouteActivity = _chunkNKVZ6Z3Ycjs.getSharedAccountRouteActivity;

package/dist/pipeline/AccountRouteActivity.d.cts

@@ -0,0 +1,61 @@
+/**
+ * Bounded, metadata-only history of subscription account routing decisions.
+ *
+ * Records are created at the shared upstream fetch seam, after authentication has
+ * reported the account that will actually serve the request. The store is
+ * intentionally process-local: it is useful for live operator diagnostics without
+ * turning session/account affinity into a durable tracking database.
+ */
+declare const ACCOUNT_ROUTE_ACTIVITY_LIMIT = 300;
+type AccountRouteEndpoint = 'responses' | 'messages';
+type AccountRouteSessionSource = 'session-header' | 'thread-header' | 'body-session-id' | 'body-thread-id' | 'prompt-cache-key' | 'content-fingerprint' | 'api-key-fallback' | 'none';
+type AccountRouteAffinity = 'new' | 'sticky' | 'switched' | 'untracked';
+interface AccountRouteActivityInput {
+    providerId: string;
+    accountId: string;
+    endpoint: AccountRouteEndpoint;
+    sessionKey?: string;
+    sessionSource: AccountRouteSessionSource;
+    model: string;
+    status: number;
+    durationMs: number;
+    ts?: number;
+    /**
+     * Post-hoc error observed AFTER the upstream status was recorded — e.g. a
+     * `200` whose SSE body carries a `response.failed` server-overload event.
+     * Never known at `record()` time; set later via {@link amend}. Absent on
+     * healthy responses.
+     */
+    streamError?: string;
+}
+interface AccountRouteActivityRecord extends AccountRouteActivityInput {
+    id: string;
+    ts: number;
+    affinity: AccountRouteAffinity;
+    previousAccountId?: string;
+}
+interface AccountRouteActivityQuery {
+    providerId?: string;
+    accountId?: string;
+    sessionKey?: string;
+    limit?: number;
+}
+declare class AccountRouteActivityStore {
+    private readonly records;
+    private sequence;
+    record(input: AccountRouteActivityInput): AccountRouteActivityRecord;
+    list(query?: AccountRouteActivityQuery): AccountRouteActivityRecord[];
+    clear(): void;
+    /**
+     * Backfill a field on an already-recorded entry. Used to annotate a record
+     * AFTER the upstream body streams — e.g. a `200` whose SSE body carries a
+     * `response.failed` overload event is only detectable mid-relay, long after
+     * `record()` stamped the 200 status. `patch` is intentionally narrow: only
+     * post-hoc-observable fields belong here, never the routing-decision fields.
+     * No-op when the id has already aged out of the bounded ring.
+     */
+    amend(id: string, patch: Partial<Pick<AccountRouteActivityRecord, 'streamError'>>): void;
+}
+declare function getSharedAccountRouteActivity(): AccountRouteActivityStore;
+
+export { ACCOUNT_ROUTE_ACTIVITY_LIMIT, type AccountRouteActivityInput, type AccountRouteActivityQuery, type AccountRouteActivityRecord, AccountRouteActivityStore, type AccountRouteAffinity, type AccountRouteEndpoint, type AccountRouteSessionSource, getSharedAccountRouteActivity };

package/dist/pipeline/AccountRouteActivity.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Bounded, metadata-only history of subscription account routing decisions.
+ *
+ * Records are created at the shared upstream fetch seam, after authentication has
+ * reported the account that will actually serve the request. The store is
+ * intentionally process-local: it is useful for live operator diagnostics without
+ * turning session/account affinity into a durable tracking database.
+ */
+declare const ACCOUNT_ROUTE_ACTIVITY_LIMIT = 300;
+type AccountRouteEndpoint = 'responses' | 'messages';
+type AccountRouteSessionSource = 'session-header' | 'thread-header' | 'body-session-id' | 'body-thread-id' | 'prompt-cache-key' | 'content-fingerprint' | 'api-key-fallback' | 'none';
+type AccountRouteAffinity = 'new' | 'sticky' | 'switched' | 'untracked';
+interface AccountRouteActivityInput {
+    providerId: string;
+    accountId: string;
+    endpoint: AccountRouteEndpoint;
+    sessionKey?: string;
+    sessionSource: AccountRouteSessionSource;
+    model: string;
+    status: number;
+    durationMs: number;
+    ts?: number;
+    /**
+     * Post-hoc error observed AFTER the upstream status was recorded — e.g. a
+     * `200` whose SSE body carries a `response.failed` server-overload event.
+     * Never known at `record()` time; set later via {@link amend}. Absent on
+     * healthy responses.
+     */
+    streamError?: string;
+}
+interface AccountRouteActivityRecord extends AccountRouteActivityInput {
+    id: string;
+    ts: number;
+    affinity: AccountRouteAffinity;
+    previousAccountId?: string;
+}
+interface AccountRouteActivityQuery {
+    providerId?: string;
+    accountId?: string;
+    sessionKey?: string;
+    limit?: number;
+}
+declare class AccountRouteActivityStore {
+    private readonly records;
+    private sequence;
+    record(input: AccountRouteActivityInput): AccountRouteActivityRecord;
+    list(query?: AccountRouteActivityQuery): AccountRouteActivityRecord[];
+    clear(): void;
+    /**
+     * Backfill a field on an already-recorded entry. Used to annotate a record
+     * AFTER the upstream body streams — e.g. a `200` whose SSE body carries a
+     * `response.failed` overload event is only detectable mid-relay, long after
+     * `record()` stamped the 200 status. `patch` is intentionally narrow: only
+     * post-hoc-observable fields belong here, never the routing-decision fields.
+     * No-op when the id has already aged out of the bounded ring.
+     */
+    amend(id: string, patch: Partial<Pick<AccountRouteActivityRecord, 'streamError'>>): void;
+}
+declare function getSharedAccountRouteActivity(): AccountRouteActivityStore;
+
+export { ACCOUNT_ROUTE_ACTIVITY_LIMIT, type AccountRouteActivityInput, type AccountRouteActivityQuery, type AccountRouteActivityRecord, AccountRouteActivityStore, type AccountRouteAffinity, type AccountRouteEndpoint, type AccountRouteSessionSource, getSharedAccountRouteActivity };

package/dist/pipeline/AccountRouteActivity.js

@@ -0,0 +1,10 @@
+import {
+  ACCOUNT_ROUTE_ACTIVITY_LIMIT,
+  AccountRouteActivityStore,
+  getSharedAccountRouteActivity
+} from "../chunk-GL6XM527.js";
+export {
+  ACCOUNT_ROUTE_ACTIVITY_LIMIT,
+  AccountRouteActivityStore,
+  getSharedAccountRouteActivity
+};

package/dist/pipeline/AuthSource.d.cts

@@ -1,3 +1,5 @@
+import { BoundAccountFallbackPolicy } from './BoundAccountSelectionError.cjs';
+
 /**
  * AuthSource — unified outbound-authentication strategy for the provider
  * request pipeline.
@@ -54,10 +56,17 @@ interface AuthApplyHints {
     reportSelection?: (accountId: string, isActive: boolean, remappedModel?: string) => void;
     /**
      * OPTIONAL preferred subscription account id (provider/subscription duality).
-     * When set and schedulable the account picker resolves it directly; absent or
-     * unschedulable ⇒ pool auto-schedule. BYO auth sources ignore it.
+     * When set, strict is the default; only the explicit `'pool'` policy permits
+     * pool fallback. BYO auth sources ignore both binding hints.
      */
     preferredAccountId?: string;
+    /** Optional account group selected by a resource-level gateway binding. */
+    preferredAccountGroup?: string;
+    /**
+     * Binding behavior. `'pool'` is an explicit opt-in; any other value used
+     * with a preferred account is treated as strict by the selector.
+     */
+    boundAccountFallbackPolicy?: BoundAccountFallbackPolicy;
 }
 /**
  * Result of {@link AuthSource.onResult}.

package/dist/pipeline/AuthSource.d.ts

@@ -1,3 +1,5 @@
+import { BoundAccountFallbackPolicy } from './BoundAccountSelectionError.js';
+
 /**
  * AuthSource — unified outbound-authentication strategy for the provider
  * request pipeline.
@@ -54,10 +56,17 @@ interface AuthApplyHints {
     reportSelection?: (accountId: string, isActive: boolean, remappedModel?: string) => void;
     /**
      * OPTIONAL preferred subscription account id (provider/subscription duality).
-     * When set and schedulable the account picker resolves it directly; absent or
-     * unschedulable ⇒ pool auto-schedule. BYO auth sources ignore it.
+     * When set, strict is the default; only the explicit `'pool'` policy permits
+     * pool fallback. BYO auth sources ignore both binding hints.
      */
     preferredAccountId?: string;
+    /** Optional account group selected by a resource-level gateway binding. */
+    preferredAccountGroup?: string;
+    /**
+     * Binding behavior. `'pool'` is an explicit opt-in; any other value used
+     * with a preferred account is treated as strict by the selector.
+     */
+    boundAccountFallbackPolicy?: BoundAccountFallbackPolicy;
 }
 /**
  * Result of {@link AuthSource.onResult}.

package/dist/pipeline/BoundAccountSelectionError.cjs

@@ -0,0 +1,10 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+var _chunk25GXJCEZcjs = require('../chunk-25GXJCEZ.cjs');
+
+
+
+
+exports.BoundAccountSelectionError = _chunk25GXJCEZcjs.BoundAccountSelectionError; exports.boundAccountSelectionMessage = _chunk25GXJCEZcjs.boundAccountSelectionMessage; exports.isBoundAccountSelectionError = _chunk25GXJCEZcjs.isBoundAccountSelectionError;

package/dist/pipeline/BoundAccountSelectionError.d.cts

@@ -0,0 +1,28 @@
+/**
+ * Secret-free failure contract for a strict outbound subscription-account
+ * binding. The selector throws this value only when an endpoint explicitly (or
+ * by the migrated default) requires its bound account to serve the request.
+ */
+/** Persisted policy for an endpoint that binds a subscription account. */
+type BoundAccountFallbackPolicy = 'strict' | 'pool';
+/** Bounded reasons a strict bound account can refuse a request. */
+type BoundAccountSelectionFailureReason = 'unavailable' | 'not-found' | 'disabled' | 'unhealthy' | 'model-incompatible' | 'allowance-paused' | 'empty-token';
+/** Return the fixed public message for a validated failure reason. */
+declare function boundAccountSelectionMessage(reason: BoundAccountSelectionFailureReason): string;
+/**
+ * Stable, non-secret error thrown by strict account selection. Account ids and
+ * token material are intentionally absent from both the message and the wire
+ * projection; the reason is a small fixed vocabulary.
+ */
+declare class BoundAccountSelectionError extends Error {
+    readonly providerId: string;
+    readonly reason: BoundAccountSelectionFailureReason;
+    readonly resumeAt?: string | undefined;
+    readonly code: "bound_account_unavailable";
+    readonly status: 429 | 503;
+    constructor(providerId: string, reason: BoundAccountSelectionFailureReason, resumeAt?: string | undefined);
+}
+/** Structural guard that survives package/bundle boundaries. */
+declare function isBoundAccountSelectionError(error: unknown): error is BoundAccountSelectionError;
+
+export { type BoundAccountFallbackPolicy, BoundAccountSelectionError, type BoundAccountSelectionFailureReason, boundAccountSelectionMessage, isBoundAccountSelectionError };