@omnicross/core 0.1.6 → 0.1.7

package/dist/{chunk-4VLRHHFE.cjs → chunk-OXHNSZ53.cjs}

@@ -1,4 +1,8 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; } var _class;// src/transformer/transformers/AnthropicToolHandling.ts
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; } var _class;
+
+var _chunk5RSZYQJHcjs = require('./chunk-5RSZYQJH.cjs');
+
+// src/transformer/transformers/AnthropicToolHandling.ts
 function isServerSideTool(tool) {
   const type = String(tool.type || "");
   return type.startsWith("web_search_") || type.startsWith("code_execution_") || type.startsWith("text_editor_") || type.startsWith("memory_") || type.startsWith("web_fetch_") || type.startsWith("search_tool_");
@@ -261,11 +265,9 @@ ${formatted}`);
       message,
       finish_reason: stopReasonMapping[anthropicResponse.stop_reason] || "stop"
     }],
-    usage: usage ? {
-      prompt_tokens: usage.input_tokens || 0,
-      completion_tokens: usage.output_tokens || 0,
-      total_tokens: (usage.input_tokens || 0) + (usage.output_tokens || 0)
-    } : void 0
+    // Preserve prompt-cache counts (cache-read → prompt_tokens_details.cached_tokens,
+    // cache-creation folded into prompt_tokens) instead of dropping them.
+    usage: _chunk5RSZYQJHcjs.anthropicUsageToChatUsage.call(void 0, usage)
   };
 }
 function convertOpenAIResponseToAnthropic(openaiResponse) {
@@ -619,11 +621,7 @@ ${formatted}` },
                   }]
                 };
                 if (event.usage) {
-                  chunk.usage = {
-                    prompt_tokens: event.usage.input_tokens || 0,
-                    completion_tokens: event.usage.output_tokens || 0,
-                    total_tokens: (event.usage.input_tokens || 0) + (event.usage.output_tokens || 0)
-                  };
+                  chunk.usage = _chunk5RSZYQJHcjs.anthropicUsageToChatUsage.call(void 0, event.usage);
                 }
                 safeEnqueue(`data: ${JSON.stringify(chunk)}
 

package/dist/{chunk-6CL5HTPQ.js → chunk-PEGTIPB3.js}

@@ -1,3 +1,7 @@
+import {
+  anthropicUsageToChatUsage
+} from "./chunk-FU7EAR73.js";
+
 // src/transformer/transformers/AnthropicToolHandling.ts
 function isServerSideTool(tool) {
   const type = String(tool.type || "");
@@ -261,11 +265,9 @@ ${formatted}`);
       message,
       finish_reason: stopReasonMapping[anthropicResponse.stop_reason] || "stop"
     }],
-    usage: usage ? {
-      prompt_tokens: usage.input_tokens || 0,
-      completion_tokens: usage.output_tokens || 0,
-      total_tokens: (usage.input_tokens || 0) + (usage.output_tokens || 0)
-    } : void 0
+    // Preserve prompt-cache counts (cache-read → prompt_tokens_details.cached_tokens,
+    // cache-creation folded into prompt_tokens) instead of dropping them.
+    usage: anthropicUsageToChatUsage(usage)
   };
 }
 function convertOpenAIResponseToAnthropic(openaiResponse) {
@@ -619,11 +621,7 @@ ${formatted}` },
                   }]
                 };
                 if (event.usage) {
-                  chunk.usage = {
-                    prompt_tokens: event.usage.input_tokens || 0,
-                    completion_tokens: event.usage.output_tokens || 0,
-                    total_tokens: (event.usage.input_tokens || 0) + (event.usage.output_tokens || 0)
-                  };
+                  chunk.usage = anthropicUsageToChatUsage(event.usage);
                 }
                 safeEnqueue(`data: ${JSON.stringify(chunk)}
 

package/dist/chunk-PO3XB56Z.js

@@ -0,0 +1,79 @@
+// src/pipeline/ServerOverloadCounter.ts
+var OVERLOAD_RECENT_LIMIT = 64;
+var OVERLOAD_ENTRY_TTL_MS = 24 * 60 * 6e4;
+function entryKey(providerId, accountId, endpoint) {
+  return `${providerId}\0${accountId}\0${endpoint}`;
+}
+var ServerOverloadCounterStore = class {
+  entries = /* @__PURE__ */ new Map();
+  /**
+   * Record one overload event. Creates the entry on first sight, then bumps
+   * `count`, `lastTs`, and prepends the event to the bounded `recent` ring.
+   */
+  recordOverload(input, now = Date.now()) {
+    const key = entryKey(input.providerId, input.accountId, input.endpoint);
+    const existing = this.entries.get(key);
+    if (existing) {
+      existing.count += 1;
+      existing.lastTs = now;
+      existing.recent.unshift(now);
+      if (existing.recent.length > OVERLOAD_RECENT_LIMIT) {
+        existing.recent.length = OVERLOAD_RECENT_LIMIT;
+      }
+      return { ...existing, recent: [...existing.recent] };
+    }
+    const entry = {
+      providerId: input.providerId,
+      accountId: input.accountId,
+      endpoint: input.endpoint,
+      count: 1,
+      firstTs: now,
+      lastTs: now,
+      recent: [now]
+    };
+    this.entries.set(key, entry);
+    return { ...entry, recent: [...entry.recent] };
+  }
+  /**
+   * Snapshot all (optionally filtered) entries, pruning stale ones first. Returns
+   * copies — callers (admin API → JSON) never see the live mutable entries.
+   */
+  list(query = {}, now = Date.now()) {
+    const providerId = query.providerId?.trim();
+    const accountId = query.accountId?.trim();
+    const out = [];
+    for (const [key, entry] of this.entries) {
+      if (now - entry.lastTs > OVERLOAD_ENTRY_TTL_MS) {
+        this.entries.delete(key);
+        continue;
+      }
+      if (providerId && entry.providerId !== providerId) continue;
+      if (accountId && entry.accountId !== accountId) continue;
+      out.push({ ...entry, recent: [...entry.recent] });
+    }
+    return out;
+  }
+  clear() {
+    this.entries.clear();
+  }
+};
+var sharedStore = null;
+function getSharedOverloadCounter() {
+  if (!sharedStore) sharedStore = new ServerOverloadCounterStore();
+  return sharedStore;
+}
+function setSharedOverloadCounter(instance) {
+  sharedStore = instance;
+}
+function __resetSharedOverloadCounterForTests() {
+  sharedStore = null;
+}
+
+export {
+  OVERLOAD_RECENT_LIMIT,
+  OVERLOAD_ENTRY_TTL_MS,
+  ServerOverloadCounterStore,
+  getSharedOverloadCounter,
+  setSharedOverloadCounter,
+  __resetSharedOverloadCounterForTests
+};

package/dist/{chunk-SIZQQD6T.js → chunk-RJ5ZGNI3.js}

@@ -1,11 +1,15 @@
 import {
+  REDACTED_BODY,
   getUpstreamTracePath,
   redactHeaders,
   writeUpstreamTrace
-} from "./chunk-SYQF7OIR.js";
+} from "./chunk-3WD4HTR2.js";
 import {
   getSharedAccountAllowanceStore
 } from "./chunk-MKF46GNZ.js";
+import {
+  getSharedAccountRouteActivity
+} from "./chunk-GL6XM527.js";
 
 // src/pipeline/upstreamFetch.ts
 import { Agent, buildConnector, ProxyAgent } from "undici";
@@ -114,17 +118,48 @@ function fetchUpstream(url, init, ctx) {
     }
     return response;
   });
+  const activity = ctx?.routeActivity;
+  const activityStartedAt = activity && ctx?.providerId && ctx.accountId ? Date.now() : 0;
+  const recordActivity = (status) => {
+    if (!activity || !ctx?.providerId || !ctx.accountId) return;
+    const record = getSharedAccountRouteActivity().record({
+      providerId: ctx.providerId,
+      accountId: ctx.accountId,
+      endpoint: activity.endpoint,
+      sessionKey: activity.sessionKey,
+      sessionSource: activity.sessionSource,
+      model: activity.model,
+      status,
+      durationMs: Math.max(0, Date.now() - activityStartedAt),
+      ts: activityStartedAt
+    });
+    try {
+      activity.onRecorded?.(record);
+    } catch {
+    }
+  };
+  const doFetchWithActivity = () => doFetchWithAllowanceTap().then(
+    (response) => {
+      recordActivity(response.status);
+      return response;
+    },
+    (error) => {
+      recordActivity(0);
+      throw error;
+    }
+  );
   const tracePath = getUpstreamTracePath();
-  if (!tracePath || !ctx?.providerId) return doFetchWithAllowanceTap();
+  if (!tracePath || !ctx?.providerId) return doFetchWithActivity();
   const startedAt = Date.now();
   const method = typeof init.method === "string" ? init.method : "GET";
   const requestHeaders = redactHeaders(
     init.headers
   );
-  const requestBody = typeof init.body === "string" ? init.body : null;
+  const redactBodies = ctx.redactBodies === true;
+  const requestBody = redactBodies ? REDACTED_BODY : typeof init.body === "string" ? init.body : null;
   const providerId = ctx.providerId;
   const accountId = ctx.accountId;
-  return doFetchWithAllowanceTap().then((res) => {
+  return doFetchWithActivity().then((res) => {
     const clone = res.clone();
     const status = res.status;
     const statusText = res.statusText;
@@ -142,7 +177,9 @@ function fetchUpstream(url, init, ctx) {
         status,
         statusText,
         responseHeaders,
-        responseBody: body,
+        // The byte count stays REAL even when redacted — it is a useful
+        // diagnostic and reveals nothing about the token itself.
+        responseBody: redactBodies ? REDACTED_BODY : body,
         responseBytes: Buffer.byteLength(body, "utf8")
       });
     }).catch(() => {

package/dist/{chunk-KCVJWJST.cjs → chunk-RJUONLUQ.cjs}

@@ -2,11 +2,15 @@
 
 
 
-var _chunk3Z5BQZFMcjs = require('./chunk-3Z5BQZFM.cjs');
+
+var _chunk235MXAGXcjs = require('./chunk-235MXAGX.cjs');
 
 
 var _chunkHVBBDBS3cjs = require('./chunk-HVBBDBS3.cjs');
 
+
+var _chunkNKVZ6Z3Ycjs = require('./chunk-NKVZ6Z3Y.cjs');
+
 // src/pipeline/upstreamFetch.ts
 var _undici = require('undici');
 var _socks = require('socks');
@@ -114,23 +118,54 @@ function fetchUpstream(url, init, ctx) {
     }
     return response;
   });
-  const tracePath = _chunk3Z5BQZFMcjs.getUpstreamTracePath.call(void 0, );
-  if (!tracePath || !_optionalChain([ctx, 'optionalAccess', _4 => _4.providerId])) return doFetchWithAllowanceTap();
+  const activity = _optionalChain([ctx, 'optionalAccess', _4 => _4.routeActivity]);
+  const activityStartedAt = activity && _optionalChain([ctx, 'optionalAccess', _5 => _5.providerId]) && ctx.accountId ? Date.now() : 0;
+  const recordActivity = (status) => {
+    if (!activity || !_optionalChain([ctx, 'optionalAccess', _6 => _6.providerId]) || !ctx.accountId) return;
+    const record = _chunkNKVZ6Z3Ycjs.getSharedAccountRouteActivity.call(void 0, ).record({
+      providerId: ctx.providerId,
+      accountId: ctx.accountId,
+      endpoint: activity.endpoint,
+      sessionKey: activity.sessionKey,
+      sessionSource: activity.sessionSource,
+      model: activity.model,
+      status,
+      durationMs: Math.max(0, Date.now() - activityStartedAt),
+      ts: activityStartedAt
+    });
+    try {
+      _optionalChain([activity, 'access', _7 => _7.onRecorded, 'optionalCall', _8 => _8(record)]);
+    } catch (e5) {
+    }
+  };
+  const doFetchWithActivity = () => doFetchWithAllowanceTap().then(
+    (response) => {
+      recordActivity(response.status);
+      return response;
+    },
+    (error) => {
+      recordActivity(0);
+      throw error;
+    }
+  );
+  const tracePath = _chunk235MXAGXcjs.getUpstreamTracePath.call(void 0, );
+  if (!tracePath || !_optionalChain([ctx, 'optionalAccess', _9 => _9.providerId])) return doFetchWithActivity();
   const startedAt = Date.now();
   const method = typeof init.method === "string" ? init.method : "GET";
-  const requestHeaders = _chunk3Z5BQZFMcjs.redactHeaders.call(void 0, 
+  const requestHeaders = _chunk235MXAGXcjs.redactHeaders.call(void 0, 
     init.headers
   );
-  const requestBody = typeof init.body === "string" ? init.body : null;
+  const redactBodies = ctx.redactBodies === true;
+  const requestBody = redactBodies ? _chunk235MXAGXcjs.REDACTED_BODY : typeof init.body === "string" ? init.body : null;
   const providerId = ctx.providerId;
   const accountId = ctx.accountId;
-  return doFetchWithAllowanceTap().then((res) => {
+  return doFetchWithActivity().then((res) => {
     const clone = res.clone();
     const status = res.status;
     const statusText = res.statusText;
-    const responseHeaders = _chunk3Z5BQZFMcjs.redactHeaders.call(void 0, res.headers);
+    const responseHeaders = _chunk235MXAGXcjs.redactHeaders.call(void 0, res.headers);
     void clone.text().then((body) => {
-      _chunk3Z5BQZFMcjs.writeUpstreamTrace.call(void 0, {
+      _chunk235MXAGXcjs.writeUpstreamTrace.call(void 0, {
         ts: startedAt,
         durationMs: Date.now() - startedAt,
         providerId,
@@ -142,7 +177,9 @@ function fetchUpstream(url, init, ctx) {
         status,
         statusText,
         responseHeaders,
-        responseBody: body,
+        // The byte count stays REAL even when redacted — it is a useful
+        // diagnostic and reveals nothing about the token itself.
+        responseBody: redactBodies ? _chunk235MXAGXcjs.REDACTED_BODY : body,
         responseBytes: Buffer.byteLength(body, "utf8")
       });
     }).catch(() => {
@@ -150,7 +187,7 @@ function fetchUpstream(url, init, ctx) {
     return res;
   }).catch((err) => {
     const msg = err instanceof Error ? err.message : String(err);
-    _chunk3Z5BQZFMcjs.writeUpstreamTrace.call(void 0, {
+    _chunk235MXAGXcjs.writeUpstreamTrace.call(void 0, {
       ts: startedAt,
       durationMs: Date.now() - startedAt,
       providerId,

package/dist/{chunk-BPKCU575.js → chunk-SOO562NM.js}

@@ -78,7 +78,9 @@ var UsageRecorder = class {
       costSavedByCacheUsd,
       rawUsage: input.rawUsage != null ? safeStringify(input.rawUsage) : null,
       runId: input.runId ?? null,
-      eventId: input.eventId ?? null
+      eventId: input.eventId ?? null,
+      ...input.cacheKeySource !== void 0 ? { cacheKeySource: input.cacheKeySource } : {},
+      ...input.cacheKeyInjected !== void 0 ? { cacheKeyInjected: input.cacheKeyInjected } : {}
     };
     try {
       return await this.store.insert(row);

package/dist/{chunk-UNWKG6EI.cjs → chunk-XPIOJQS2.cjs}

@@ -11,6 +11,29 @@ var _chunkXSVNC2UDcjs = require('./chunk-XSVNC2UD.cjs');
 
 // src/outbound-api/auditCapture.ts
 var _crypto = require('crypto');
+function completeUtf8PrefixLength(buf) {
+  if (buf.length === 0) return 0;
+  let leadIndex = buf.length - 1;
+  while (leadIndex >= 0 && (buf[leadIndex] & 192) === 128) leadIndex -= 1;
+  if (leadIndex < 0) return 0;
+  const lead = buf[leadIndex];
+  let expectedLength = 1;
+  if ((lead & 224) === 192) expectedLength = 2;
+  else if ((lead & 240) === 224) expectedLength = 3;
+  else if ((lead & 248) === 240) expectedLength = 4;
+  return buf.length - leadIndex < expectedLength ? leadIndex : buf.length;
+}
+function truncateToBytes(text, maxBytes) {
+  if (maxBytes < 0) return text;
+  const buf = Buffer.from(text, "utf8");
+  if (buf.length <= maxBytes) return text;
+  const head = buf.subarray(0, maxBytes);
+  return head.subarray(0, completeUtf8PrefixLength(head)).toString("utf8");
+}
+function decodeCapturedBody(body, truncated) {
+  if (!truncated) return body.toString("utf8");
+  return body.subarray(0, completeUtf8PrefixLength(body)).toString("utf8");
+}
 function resolveClientIp(req, trustForwardedFor) {
   if (trustForwardedFor) {
     const xff = req.headers["x-forwarded-for"];
@@ -25,18 +48,39 @@ function resolveClientIp(req, trustForwardedFor) {
 function beginAuditCapture(req, res, now) {
   const config = _chunkAEOZIDEBcjs.getAuditCaptureConfig.call(void 0, );
   if (!config) return null;
-  let rawRequestBody;
+  let requestBody;
   const responseChunks = [];
+  let responseBytes = 0;
+  let responseTruncated = false;
   let finished = false;
   const ctx = {
     setRequestBody(raw) {
-      if (config.captureBodies) rawRequestBody = raw;
+      if (config.captureBodies) {
+        requestBody = truncateToBytes(_chunkFCR77GYMcjs.redactAuditText.call(void 0, raw), config.maxBodyBytes);
+      }
     }
   };
   if (config.captureBodies) {
     installResponseCapture(res, {
       push(chunk) {
+        if (config.maxBodyBytes < 0) {
+          responseChunks.push(chunk);
+          responseBytes += chunk.length;
+          return;
+        }
+        const remaining = config.maxBodyBytes - responseBytes;
+        if (remaining <= 0) {
+          responseTruncated = true;
+          return;
+        }
+        if (chunk.length > remaining) {
+          responseChunks.push(chunk.subarray(0, remaining));
+          responseBytes += remaining;
+          responseTruncated = true;
+          return;
+        }
         responseChunks.push(chunk);
+        responseBytes += chunk.length;
       }
     });
   }
@@ -69,12 +113,13 @@ function beginAuditCapture(req, res, now) {
       }
       if (ctx.error) record.error = _chunkFCR77GYMcjs.redactAuditText.call(void 0, ctx.error);
       if (config.captureBodies) {
-        if (rawRequestBody != null && rawRequestBody.length > 0) {
-          record.requestBody = _chunkFCR77GYMcjs.redactAuditText.call(void 0, rawRequestBody);
+        if (requestBody != null && requestBody.length > 0) {
+          record.requestBody = requestBody;
         }
         if (responseChunks.length > 0) {
-          const body = Buffer.concat(responseChunks).toString("utf8");
-          record.responseBody = _chunkFCR77GYMcjs.redactAuditText.call(void 0, body);
+          const captured = Buffer.concat(responseChunks, responseBytes);
+          const body = decodeCapturedBody(captured, responseTruncated);
+          record.responseBody = truncateToBytes(_chunkFCR77GYMcjs.redactAuditText.call(void 0, body), config.maxBodyBytes);
         }
       }
       _chunkAEOZIDEBcjs.recordAudit.call(void 0, record);

package/dist/chunk-XXFYLL7R.js

@@ -0,0 +1,63 @@
+// src/provider-proxy/identity/headerMerge.ts
+function fillMissingHeaders(headers, source) {
+  const present = new Set(Object.keys(headers).map((k) => k.toLowerCase()));
+  for (const [key, value] of Object.entries(source)) {
+    const lower = key.toLowerCase();
+    if (present.has(lower)) continue;
+    headers[lower] = value;
+    present.add(lower);
+  }
+}
+function flattenHeaderValue(raw) {
+  if (raw === void 0) return void 0;
+  const value = Array.isArray(raw) ? raw.filter((v) => typeof v === "string").join(", ") : raw;
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+var NEVER_FORWARD_HEADERS = /* @__PURE__ */ new Set([
+  "authorization",
+  "x-api-key",
+  "cookie",
+  "proxy-authorization",
+  "host",
+  "connection",
+  "content-length",
+  "content-type",
+  "accept-encoding"
+]);
+
+// src/provider-proxy/identity/codexCliHeaders.ts
+var DEFAULT_CODEX_CLI_HEADERS = Object.freeze({
+  originator: "codex_cli_rs",
+  "user-agent": "codex_cli_rs/0.144.5",
+  version: "0.144.5"
+});
+var CODEX_FORWARD_ALLOWLIST = /* @__PURE__ */ new Set([
+  "version",
+  "openai-beta",
+  "session_id",
+  "originator",
+  "user-agent"
+]);
+function extractCodexClientHeaders(reqHeaders) {
+  const out = {};
+  for (const [rawKey, rawVal] of Object.entries(reqHeaders)) {
+    const key = rawKey.toLowerCase();
+    if (NEVER_FORWARD_HEADERS.has(key)) continue;
+    if (!CODEX_FORWARD_ALLOWLIST.has(key)) continue;
+    const value = flattenHeaderValue(rawVal);
+    if (value !== void 0) out[key] = value;
+  }
+  return out;
+}
+function codexAcceptHeader(isStream) {
+  return isStream ? "text/event-stream" : "application/json";
+}
+
+export {
+  fillMissingHeaders,
+  flattenHeaderValue,
+  NEVER_FORWARD_HEADERS,
+  DEFAULT_CODEX_CLI_HEADERS,
+  extractCodexClientHeaders,
+  codexAcceptHeader
+};

package/dist/{chunk-YK57NMIF.cjs → chunk-YWL7YZWS.cjs}

@@ -3,6 +3,7 @@ var OVERLOAD_TTL_MS = 10 * 6e4;
 var OVERLOAD_ENABLED_DEFAULT = true;
 var AUTH_ERROR_TTL_MS = 30 * 6e4;
 var SERVER_ERROR_TTL_MS = 5 * 6e4;
+var MAX_QUOTA_COOLDOWN_MS = 7 * 24 * 60 * 6e4;
 var BAN_BODY_MARKERS = [
   "this organization has been disabled",
   "oauth authentication is currently not allowed"
@@ -38,7 +39,7 @@ function isBanBody(bodyText) {
   return BAN_BODY_MARKERS.some((marker) => lower.includes(marker));
 }
 function isRecordEmpty(record) {
-  return record.rateLimitEndAt === void 0 && record.overloadUntil === void 0 && record.tempUnavailableUntil === void 0 && !record.blocked;
+  return record.rateLimitEndAt === void 0 && record.overloadUntil === void 0 && record.tempUnavailableUntil === void 0 && record.quotaExhaustedUntil === void 0 && !record.blocked;
 }
 var KEY_SEP = "\0";
 var SubscriptionAccountHealth = (_class = class {
@@ -159,12 +160,47 @@ var SubscriptionAccountHealth = (_class = class {
       this.emitAnomaly(anomaly);
     }
   }
+  /**
+   * Mark an account quota/usage-exhausted until `untilEpochMs` (the Codex weekly
+   * usage-limit wall). Unlike the status-driven timers set by
+   * {@link recordUpstreamOutcome}, this mark is NOT cleared by a 2xx: in-flight
+   * sessions on the same account keep succeeding after the window is exhausted,
+   * so a traffic-driven clear would re-strand every NEW session onto this
+   * account. It excludes the account from NEW-session selection until the
+   * deadline elapses (existing sessions are unaffected — they already hold their
+   * token). Self-heals lazily on read and via {@link sweepRecoveries}.
+   * `untilEpochMs` is clamped to {@link MAX_QUOTA_COOLDOWN_MS}; an already-elapsed
+   * deadline is a no-op. Emits a `quota_exhausted` anomaly on the healthy→
+   * unhealthy edge.
+   */
+  markQuotaExhausted(providerId, accountId, untilEpochMs, now = this.now()) {
+    if (!Number.isFinite(untilEpochMs)) return;
+    const clamped = Math.min(untilEpochMs, now + MAX_QUOTA_COOLDOWN_MS);
+    if (clamped <= now) return;
+    const key = this.key(providerId, accountId);
+    const preExisting = this.records.get(key);
+    const record = _nullishCoalesce(preExisting, () => ( {}));
+    const wasUnhealthyBefore = preExisting ? this.isUnhealthyAt(preExisting, now) : false;
+    record.quotaExhaustedUntil = clamped;
+    this.records.set(key, record);
+    if (!wasUnhealthyBefore) {
+      const anomaly = {
+        providerId,
+        accountId,
+        at: now,
+        state: "quota_exhausted"
+      };
+      this.recordDiagnostic({ kind: "health-anomaly", ...anomaly });
+      this.emitAnomaly(anomaly);
+    }
+  }
   /** Whether a record is unhealthy at `now`: blocked, or any timer still future. */
   isUnhealthyAt(record, now) {
     if (record.blocked) return true;
     if (record.rateLimitEndAt !== void 0 && now < record.rateLimitEndAt) return true;
     if (record.overloadUntil !== void 0 && now < record.overloadUntil) return true;
     if (record.tempUnavailableUntil !== void 0 && now < record.tempUnavailableUntil) return true;
+    if (record.quotaExhaustedUntil !== void 0 && now < record.quotaExhaustedUntil) return true;
     return false;
   }
   /**
@@ -201,7 +237,7 @@ var SubscriptionAccountHealth = (_class = class {
     const recovered = [];
     for (const [key, record] of this.records) {
       if (record.blocked) continue;
-      const hadTimer = record.rateLimitEndAt !== void 0 || record.overloadUntil !== void 0 || record.tempUnavailableUntil !== void 0;
+      const hadTimer = record.rateLimitEndAt !== void 0 || record.overloadUntil !== void 0 || record.tempUnavailableUntil !== void 0 || record.quotaExhaustedUntil !== void 0;
       const active = this.clearExpired(record, now);
       if (hadTimer && !active && isRecordEmpty(record)) {
         const [pid, aid] = this.parseKey(key);
@@ -225,6 +261,9 @@ var SubscriptionAccountHealth = (_class = class {
     const record = this.records.get(this.key(providerId, accountId));
     if (!record) return { state: "healthy" };
     if (record.blocked) return { state: "blocked" };
+    if (record.quotaExhaustedUntil !== void 0 && now < record.quotaExhaustedUntil) {
+      return { state: "quota_exhausted", cooldownUntil: record.quotaExhaustedUntil };
+    }
     if (record.rateLimitEndAt !== void 0 && now < record.rateLimitEndAt) {
       return { state: "rate_limited", cooldownUntil: record.rateLimitEndAt };
     }
@@ -311,6 +350,10 @@ var SubscriptionAccountHealth = (_class = class {
       if (now >= record.tempUnavailableUntil) delete record.tempUnavailableUntil;
       else active = true;
     }
+    if (record.quotaExhaustedUntil !== void 0) {
+      if (now >= record.quotaExhaustedUntil) delete record.quotaExhaustedUntil;
+      else active = true;
+    }
     return active;
   }
   key(providerId, accountId) {
@@ -344,4 +387,5 @@ function __resetSharedAccountHealthForTests() {
 
 
 
-exports.OVERLOAD_TTL_MS = OVERLOAD_TTL_MS; exports.OVERLOAD_ENABLED_DEFAULT = OVERLOAD_ENABLED_DEFAULT; exports.AUTH_ERROR_TTL_MS = AUTH_ERROR_TTL_MS; exports.SERVER_ERROR_TTL_MS = SERVER_ERROR_TTL_MS; exports.ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT = ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT; exports.resolveResetSeconds = resolveResetSeconds; exports.SubscriptionAccountHealth = SubscriptionAccountHealth; exports.getSharedAccountHealth = getSharedAccountHealth; exports.setSharedAccountHealth = setSharedAccountHealth; exports.__resetSharedAccountHealthForTests = __resetSharedAccountHealthForTests;
+
+exports.OVERLOAD_TTL_MS = OVERLOAD_TTL_MS; exports.OVERLOAD_ENABLED_DEFAULT = OVERLOAD_ENABLED_DEFAULT; exports.AUTH_ERROR_TTL_MS = AUTH_ERROR_TTL_MS; exports.SERVER_ERROR_TTL_MS = SERVER_ERROR_TTL_MS; exports.MAX_QUOTA_COOLDOWN_MS = MAX_QUOTA_COOLDOWN_MS; exports.ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT = ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT; exports.resolveResetSeconds = resolveResetSeconds; exports.SubscriptionAccountHealth = SubscriptionAccountHealth; exports.getSharedAccountHealth = getSharedAccountHealth; exports.setSharedAccountHealth = setSharedAccountHealth; exports.__resetSharedAccountHealthForTests = __resetSharedAccountHealthForTests;