@omnicross/core 0.1.6 → 0.1.7

package/dist/pipeline/ServerOverloadCounter.d.cts

@@ -0,0 +1,77 @@
+import { AccountRouteEndpoint } from './AccountRouteActivity.cjs';
+
+/**
+ * ServerOverloadCounter — a bounded, metadata-only tally of Codex server-
+ * overload events (`response.failed` with `error.code` `server_is_overloaded` /
+ * `slow_down`) per provider+account+endpoint.
+ *
+ * WHY a dedicated store (not derived from {@link AccountRouteActivity}): those
+ * 200-status overloads are invisible at the route-activity HTTP-status layer, and
+ * the route-activity ring (300 rows) can be pushed out by normal traffic before
+ * an operator notices. This counter ACCUMULATES across the ring and keeps a
+ * bounded recent-timestamp ring for a trend sparkline, so "how often is account X
+ * being overloaded, and is it worsening" stays answerable.
+ *
+ * Overload is account-INDEPENDENT server capacity (retrying on another account is
+ * pointless), so — unlike {@link SubscriptionAccountHealth} — this store only
+ * OBSERVES; it never gates scheduling. It carries no secrets, only counts + epoch
+ * timestamps. In-memory (cleared on restart), same as the other pipeline stores.
+ *
+ * Shaped like `SubscriptionAccountHealth`: an in-memory `Map`, an injectable
+ * `now` clock, no external deps, opaque `providerId\0accountId\0endpoint` keys.
+ *
+ * @module pipeline/ServerOverloadCounter
+ */
+
+/** Bounded recent-event ring per entry — the sparkline's data source. */
+declare const OVERLOAD_RECENT_LIMIT = 64;
+/**
+ * Entries with no event in this window are pruned on read, so the map cannot
+ * grow unbounded across a long-lived process with many transient accounts.
+ */
+declare const OVERLOAD_ENTRY_TTL_MS: number;
+interface OverloadRecordInput {
+    providerId: string;
+    accountId: string;
+    endpoint: AccountRouteEndpoint;
+    /** Epoch-ms of the event. Omit to use the clock default. */
+    now?: number;
+}
+interface OverloadCounterEntry {
+    providerId: string;
+    accountId: string;
+    endpoint: AccountRouteEndpoint;
+    /** Lifetime count of overload events for this key (since first observed). */
+    count: number;
+    firstTs: number;
+    lastTs: number;
+    /** Most-recent-first epoch-ms events, capped at {@link OVERLOAD_RECENT_LIMIT}. */
+    recent: number[];
+}
+interface OverloadCounterQuery {
+    providerId?: string;
+    accountId?: string;
+}
+declare class ServerOverloadCounterStore {
+    private readonly entries;
+    /**
+     * Record one overload event. Creates the entry on first sight, then bumps
+     * `count`, `lastTs`, and prepends the event to the bounded `recent` ring.
+     */
+    recordOverload(input: OverloadRecordInput, now?: number): OverloadCounterEntry;
+    /**
+     * Snapshot all (optionally filtered) entries, pruning stale ones first. Returns
+     * copies — callers (admin API → JSON) never see the live mutable entries.
+     */
+    list(query?: OverloadCounterQuery, now?: number): OverloadCounterEntry[];
+    clear(): void;
+}
+declare function getSharedOverloadCounter(): ServerOverloadCounterStore;
+/**
+ * TEST SEAM — swap the singleton (e.g. with a fresh instance). Mirrors the
+ * `setShared…`/`__reset…ForTests` discipline of the sibling pipeline stores.
+ */
+declare function setSharedOverloadCounter(instance: ServerOverloadCounterStore): void;
+declare function __resetSharedOverloadCounterForTests(): void;
+
+export { OVERLOAD_ENTRY_TTL_MS, OVERLOAD_RECENT_LIMIT, type OverloadCounterEntry, type OverloadCounterQuery, type OverloadRecordInput, ServerOverloadCounterStore, __resetSharedOverloadCounterForTests, getSharedOverloadCounter, setSharedOverloadCounter };

package/dist/pipeline/ServerOverloadCounter.d.ts

@@ -0,0 +1,77 @@
+import { AccountRouteEndpoint } from './AccountRouteActivity.js';
+
+/**
+ * ServerOverloadCounter — a bounded, metadata-only tally of Codex server-
+ * overload events (`response.failed` with `error.code` `server_is_overloaded` /
+ * `slow_down`) per provider+account+endpoint.
+ *
+ * WHY a dedicated store (not derived from {@link AccountRouteActivity}): those
+ * 200-status overloads are invisible at the route-activity HTTP-status layer, and
+ * the route-activity ring (300 rows) can be pushed out by normal traffic before
+ * an operator notices. This counter ACCUMULATES across the ring and keeps a
+ * bounded recent-timestamp ring for a trend sparkline, so "how often is account X
+ * being overloaded, and is it worsening" stays answerable.
+ *
+ * Overload is account-INDEPENDENT server capacity (retrying on another account is
+ * pointless), so — unlike {@link SubscriptionAccountHealth} — this store only
+ * OBSERVES; it never gates scheduling. It carries no secrets, only counts + epoch
+ * timestamps. In-memory (cleared on restart), same as the other pipeline stores.
+ *
+ * Shaped like `SubscriptionAccountHealth`: an in-memory `Map`, an injectable
+ * `now` clock, no external deps, opaque `providerId\0accountId\0endpoint` keys.
+ *
+ * @module pipeline/ServerOverloadCounter
+ */
+
+/** Bounded recent-event ring per entry — the sparkline's data source. */
+declare const OVERLOAD_RECENT_LIMIT = 64;
+/**
+ * Entries with no event in this window are pruned on read, so the map cannot
+ * grow unbounded across a long-lived process with many transient accounts.
+ */
+declare const OVERLOAD_ENTRY_TTL_MS: number;
+interface OverloadRecordInput {
+    providerId: string;
+    accountId: string;
+    endpoint: AccountRouteEndpoint;
+    /** Epoch-ms of the event. Omit to use the clock default. */
+    now?: number;
+}
+interface OverloadCounterEntry {
+    providerId: string;
+    accountId: string;
+    endpoint: AccountRouteEndpoint;
+    /** Lifetime count of overload events for this key (since first observed). */
+    count: number;
+    firstTs: number;
+    lastTs: number;
+    /** Most-recent-first epoch-ms events, capped at {@link OVERLOAD_RECENT_LIMIT}. */
+    recent: number[];
+}
+interface OverloadCounterQuery {
+    providerId?: string;
+    accountId?: string;
+}
+declare class ServerOverloadCounterStore {
+    private readonly entries;
+    /**
+     * Record one overload event. Creates the entry on first sight, then bumps
+     * `count`, `lastTs`, and prepends the event to the bounded `recent` ring.
+     */
+    recordOverload(input: OverloadRecordInput, now?: number): OverloadCounterEntry;
+    /**
+     * Snapshot all (optionally filtered) entries, pruning stale ones first. Returns
+     * copies — callers (admin API → JSON) never see the live mutable entries.
+     */
+    list(query?: OverloadCounterQuery, now?: number): OverloadCounterEntry[];
+    clear(): void;
+}
+declare function getSharedOverloadCounter(): ServerOverloadCounterStore;
+/**
+ * TEST SEAM — swap the singleton (e.g. with a fresh instance). Mirrors the
+ * `setShared…`/`__reset…ForTests` discipline of the sibling pipeline stores.
+ */
+declare function setSharedOverloadCounter(instance: ServerOverloadCounterStore): void;
+declare function __resetSharedOverloadCounterForTests(): void;
+
+export { OVERLOAD_ENTRY_TTL_MS, OVERLOAD_RECENT_LIMIT, type OverloadCounterEntry, type OverloadCounterQuery, type OverloadRecordInput, ServerOverloadCounterStore, __resetSharedOverloadCounterForTests, getSharedOverloadCounter, setSharedOverloadCounter };

package/dist/pipeline/ServerOverloadCounter.js

@@ -0,0 +1,16 @@
+import {
+  OVERLOAD_ENTRY_TTL_MS,
+  OVERLOAD_RECENT_LIMIT,
+  ServerOverloadCounterStore,
+  __resetSharedOverloadCounterForTests,
+  getSharedOverloadCounter,
+  setSharedOverloadCounter
+} from "../chunk-PO3XB56Z.js";
+export {
+  OVERLOAD_ENTRY_TTL_MS,
+  OVERLOAD_RECENT_LIMIT,
+  ServerOverloadCounterStore,
+  __resetSharedOverloadCounterForTests,
+  getSharedOverloadCounter,
+  setSharedOverloadCounter
+};

package/dist/pipeline/SubscriptionAccountHealth.cjs

@@ -9,8 +9,8 @@
 
 
 
-var _chunkYK57NMIFcjs = require('../chunk-YK57NMIF.cjs');
 
+var _chunkYWL7YZWScjs = require('../chunk-YWL7YZWS.cjs');
 
 
 
@@ -21,4 +21,6 @@ var _chunkYK57NMIFcjs = require('../chunk-YK57NMIF.cjs');
 
 
 
-exports.ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT = _chunkYK57NMIFcjs.ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT; exports.AUTH_ERROR_TTL_MS = _chunkYK57NMIFcjs.AUTH_ERROR_TTL_MS; exports.OVERLOAD_ENABLED_DEFAULT = _chunkYK57NMIFcjs.OVERLOAD_ENABLED_DEFAULT; exports.OVERLOAD_TTL_MS = _chunkYK57NMIFcjs.OVERLOAD_TTL_MS; exports.SERVER_ERROR_TTL_MS = _chunkYK57NMIFcjs.SERVER_ERROR_TTL_MS; exports.SubscriptionAccountHealth = _chunkYK57NMIFcjs.SubscriptionAccountHealth; exports.__resetSharedAccountHealthForTests = _chunkYK57NMIFcjs.__resetSharedAccountHealthForTests; exports.getSharedAccountHealth = _chunkYK57NMIFcjs.getSharedAccountHealth; exports.resolveResetSeconds = _chunkYK57NMIFcjs.resolveResetSeconds; exports.setSharedAccountHealth = _chunkYK57NMIFcjs.setSharedAccountHealth;
+
+
+exports.ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT = _chunkYWL7YZWScjs.ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT; exports.AUTH_ERROR_TTL_MS = _chunkYWL7YZWScjs.AUTH_ERROR_TTL_MS; exports.MAX_QUOTA_COOLDOWN_MS = _chunkYWL7YZWScjs.MAX_QUOTA_COOLDOWN_MS; exports.OVERLOAD_ENABLED_DEFAULT = _chunkYWL7YZWScjs.OVERLOAD_ENABLED_DEFAULT; exports.OVERLOAD_TTL_MS = _chunkYWL7YZWScjs.OVERLOAD_TTL_MS; exports.SERVER_ERROR_TTL_MS = _chunkYWL7YZWScjs.SERVER_ERROR_TTL_MS; exports.SubscriptionAccountHealth = _chunkYWL7YZWScjs.SubscriptionAccountHealth; exports.__resetSharedAccountHealthForTests = _chunkYWL7YZWScjs.__resetSharedAccountHealthForTests; exports.getSharedAccountHealth = _chunkYWL7YZWScjs.getSharedAccountHealth; exports.resolveResetSeconds = _chunkYWL7YZWScjs.resolveResetSeconds; exports.setSharedAccountHealth = _chunkYWL7YZWScjs.setSharedAccountHealth;

package/dist/pipeline/SubscriptionAccountHealth.d.cts

@@ -31,6 +31,12 @@ declare const OVERLOAD_ENABLED_DEFAULT = true;
 declare const AUTH_ERROR_TTL_MS: number;
 /** Transient cooldown for a 5xx response or network failure. */
 declare const SERVER_ERROR_TTL_MS: number;
+/**
+ * Hard cap on a quota-exhaustion cooldown (the weekly usage window is ~1 week).
+ * A parsed/supplied deadline farther than this into the future is clamped, so a
+ * bogus parse can never strand an account indefinitely.
+ */
+declare const MAX_QUOTA_COOLDOWN_MS: number;
 /** Per-account health record (all timers are epoch ms). Absent fields ⇒ healthy. */
 interface HealthRecord {
     /** From a 429 authoritative reset header — rate-limited until this instant. */
@@ -39,11 +45,20 @@ interface HealthRecord {
     overloadUntil?: number;
     /** From a final-401 / plain-403 / 5xx / thrown — transient cooldown until this. */
     tempUnavailableUntil?: number;
+    /**
+     * From a detected quota/usage-limit error (e.g. Codex weekly window exhausted).
+     * Intentionally NOT cleared by a 2xx: while the account's credits/window are
+     * exhausted, in-flight sessions on the SAME account keep returning 2xx (Codex
+     * does not kill them mid-session), which would otherwise immediately heal a
+     * transient/rate-limit mark and re-strand every NEW session onto this account.
+     * Self-heals only when the deadline elapses.
+     */
+    quotaExhaustedUntil?: number;
     /** From a 403-ban — permanent, self-heal never clears it. */
     blocked?: boolean;
 }
 /** The coarse health state surfaced to the admin accounts view (secret-free). */
-type AccountHealthState = 'healthy' | 'rate_limited' | 'overloaded' | 'transient' | 'blocked';
+type AccountHealthState = 'healthy' | 'rate_limited' | 'overloaded' | 'transient' | 'quota_exhausted' | 'blocked';
 /** Admin-facing status projection for one account. */
 interface AccountHealthStatus {
     state: AccountHealthState;
@@ -68,7 +83,7 @@ interface AccountRecoveryEvent {
 /** A recovery listener (fire-and-forget; the emitter never awaits it). */
 type AccountRecoveryListener = (event: AccountRecoveryEvent) => void;
 /** The coarse anomaly state an account transitioned into (secret-free). */
-type AccountAnomalyState = 'blocked' | 'unauthorized' | 'rate_limited' | 'overloaded';
+type AccountAnomalyState = 'blocked' | 'unauthorized' | 'rate_limited' | 'overloaded' | 'quota_exhausted';
 /**
  * The anomaly signal emitted when a HEALTHY account transitions to unhealthy —
  * the additive union #5 (webhooks) consumes, which this tracker's frozen `kind`
@@ -192,6 +207,20 @@ declare class SubscriptionAccountHealth {
      *  - 2xx → clear rate-limit + transient state (keep `blocked`).
      */
     recordUpstreamOutcome(providerId: string, accountId: string, input: RecordUpstreamOutcomeInput): void;
+    /**
+     * Mark an account quota/usage-exhausted until `untilEpochMs` (the Codex weekly
+     * usage-limit wall). Unlike the status-driven timers set by
+     * {@link recordUpstreamOutcome}, this mark is NOT cleared by a 2xx: in-flight
+     * sessions on the same account keep succeeding after the window is exhausted,
+     * so a traffic-driven clear would re-strand every NEW session onto this
+     * account. It excludes the account from NEW-session selection until the
+     * deadline elapses (existing sessions are unaffected — they already hold their
+     * token). Self-heals lazily on read and via {@link sweepRecoveries}.
+     * `untilEpochMs` is clamped to {@link MAX_QUOTA_COOLDOWN_MS}; an already-elapsed
+     * deadline is a no-op. Emits a `quota_exhausted` anomaly on the healthy→
+     * unhealthy edge.
+     */
+    markQuotaExhausted(providerId: string, accountId: string, untilEpochMs: number, now?: number): void;
     /** Whether a record is unhealthy at `now`: blocked, or any timer still future. */
     private isUnhealthyAt;
     /**
@@ -260,4 +289,4 @@ declare function setSharedAccountHealth(instance: SubscriptionAccountHealth): vo
 /** Reset the shared singleton (tests / teardown only). */
 declare function __resetSharedAccountHealthForTests(): void;
 
-export { ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT, AUTH_ERROR_TTL_MS, type AccountAnomalyEvent, type AccountAnomalyListener, type AccountAnomalyState, type AccountHealthDiagnostic, type AccountHealthDiagnosticFilter, type AccountHealthState, type AccountHealthStatus, type AccountRecoveryEvent, type AccountRecoveryListener, type HeadersLike, type HealthRecord, OVERLOAD_ENABLED_DEFAULT, OVERLOAD_TTL_MS, type RecordUpstreamOutcomeInput, SERVER_ERROR_TTL_MS, SubscriptionAccountHealth, type SubscriptionAccountHealthOptions, __resetSharedAccountHealthForTests, getSharedAccountHealth, resolveResetSeconds, setSharedAccountHealth };
+export { ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT, AUTH_ERROR_TTL_MS, type AccountAnomalyEvent, type AccountAnomalyListener, type AccountAnomalyState, type AccountHealthDiagnostic, type AccountHealthDiagnosticFilter, type AccountHealthState, type AccountHealthStatus, type AccountRecoveryEvent, type AccountRecoveryListener, type HeadersLike, type HealthRecord, MAX_QUOTA_COOLDOWN_MS, OVERLOAD_ENABLED_DEFAULT, OVERLOAD_TTL_MS, type RecordUpstreamOutcomeInput, SERVER_ERROR_TTL_MS, SubscriptionAccountHealth, type SubscriptionAccountHealthOptions, __resetSharedAccountHealthForTests, getSharedAccountHealth, resolveResetSeconds, setSharedAccountHealth };

package/dist/pipeline/SubscriptionAccountHealth.d.ts

@@ -31,6 +31,12 @@ declare const OVERLOAD_ENABLED_DEFAULT = true;
 declare const AUTH_ERROR_TTL_MS: number;
 /** Transient cooldown for a 5xx response or network failure. */
 declare const SERVER_ERROR_TTL_MS: number;
+/**
+ * Hard cap on a quota-exhaustion cooldown (the weekly usage window is ~1 week).
+ * A parsed/supplied deadline farther than this into the future is clamped, so a
+ * bogus parse can never strand an account indefinitely.
+ */
+declare const MAX_QUOTA_COOLDOWN_MS: number;
 /** Per-account health record (all timers are epoch ms). Absent fields ⇒ healthy. */
 interface HealthRecord {
     /** From a 429 authoritative reset header — rate-limited until this instant. */
@@ -39,11 +45,20 @@ interface HealthRecord {
     overloadUntil?: number;
     /** From a final-401 / plain-403 / 5xx / thrown — transient cooldown until this. */
     tempUnavailableUntil?: number;
+    /**
+     * From a detected quota/usage-limit error (e.g. Codex weekly window exhausted).
+     * Intentionally NOT cleared by a 2xx: while the account's credits/window are
+     * exhausted, in-flight sessions on the SAME account keep returning 2xx (Codex
+     * does not kill them mid-session), which would otherwise immediately heal a
+     * transient/rate-limit mark and re-strand every NEW session onto this account.
+     * Self-heals only when the deadline elapses.
+     */
+    quotaExhaustedUntil?: number;
     /** From a 403-ban — permanent, self-heal never clears it. */
     blocked?: boolean;
 }
 /** The coarse health state surfaced to the admin accounts view (secret-free). */
-type AccountHealthState = 'healthy' | 'rate_limited' | 'overloaded' | 'transient' | 'blocked';
+type AccountHealthState = 'healthy' | 'rate_limited' | 'overloaded' | 'transient' | 'quota_exhausted' | 'blocked';
 /** Admin-facing status projection for one account. */
 interface AccountHealthStatus {
     state: AccountHealthState;
@@ -68,7 +83,7 @@ interface AccountRecoveryEvent {
 /** A recovery listener (fire-and-forget; the emitter never awaits it). */
 type AccountRecoveryListener = (event: AccountRecoveryEvent) => void;
 /** The coarse anomaly state an account transitioned into (secret-free). */
-type AccountAnomalyState = 'blocked' | 'unauthorized' | 'rate_limited' | 'overloaded';
+type AccountAnomalyState = 'blocked' | 'unauthorized' | 'rate_limited' | 'overloaded' | 'quota_exhausted';
 /**
  * The anomaly signal emitted when a HEALTHY account transitions to unhealthy —
  * the additive union #5 (webhooks) consumes, which this tracker's frozen `kind`
@@ -192,6 +207,20 @@ declare class SubscriptionAccountHealth {
      *  - 2xx → clear rate-limit + transient state (keep `blocked`).
      */
     recordUpstreamOutcome(providerId: string, accountId: string, input: RecordUpstreamOutcomeInput): void;
+    /**
+     * Mark an account quota/usage-exhausted until `untilEpochMs` (the Codex weekly
+     * usage-limit wall). Unlike the status-driven timers set by
+     * {@link recordUpstreamOutcome}, this mark is NOT cleared by a 2xx: in-flight
+     * sessions on the same account keep succeeding after the window is exhausted,
+     * so a traffic-driven clear would re-strand every NEW session onto this
+     * account. It excludes the account from NEW-session selection until the
+     * deadline elapses (existing sessions are unaffected — they already hold their
+     * token). Self-heals lazily on read and via {@link sweepRecoveries}.
+     * `untilEpochMs` is clamped to {@link MAX_QUOTA_COOLDOWN_MS}; an already-elapsed
+     * deadline is a no-op. Emits a `quota_exhausted` anomaly on the healthy→
+     * unhealthy edge.
+     */
+    markQuotaExhausted(providerId: string, accountId: string, untilEpochMs: number, now?: number): void;
     /** Whether a record is unhealthy at `now`: blocked, or any timer still future. */
     private isUnhealthyAt;
     /**
@@ -260,4 +289,4 @@ declare function setSharedAccountHealth(instance: SubscriptionAccountHealth): vo
 /** Reset the shared singleton (tests / teardown only). */
 declare function __resetSharedAccountHealthForTests(): void;
 
-export { ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT, AUTH_ERROR_TTL_MS, type AccountAnomalyEvent, type AccountAnomalyListener, type AccountAnomalyState, type AccountHealthDiagnostic, type AccountHealthDiagnosticFilter, type AccountHealthState, type AccountHealthStatus, type AccountRecoveryEvent, type AccountRecoveryListener, type HeadersLike, type HealthRecord, OVERLOAD_ENABLED_DEFAULT, OVERLOAD_TTL_MS, type RecordUpstreamOutcomeInput, SERVER_ERROR_TTL_MS, SubscriptionAccountHealth, type SubscriptionAccountHealthOptions, __resetSharedAccountHealthForTests, getSharedAccountHealth, resolveResetSeconds, setSharedAccountHealth };
+export { ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT, AUTH_ERROR_TTL_MS, type AccountAnomalyEvent, type AccountAnomalyListener, type AccountAnomalyState, type AccountHealthDiagnostic, type AccountHealthDiagnosticFilter, type AccountHealthState, type AccountHealthStatus, type AccountRecoveryEvent, type AccountRecoveryListener, type HeadersLike, type HealthRecord, MAX_QUOTA_COOLDOWN_MS, OVERLOAD_ENABLED_DEFAULT, OVERLOAD_TTL_MS, type RecordUpstreamOutcomeInput, SERVER_ERROR_TTL_MS, SubscriptionAccountHealth, type SubscriptionAccountHealthOptions, __resetSharedAccountHealthForTests, getSharedAccountHealth, resolveResetSeconds, setSharedAccountHealth };

package/dist/pipeline/SubscriptionAccountHealth.js

@@ -1,6 +1,7 @@
 import {
   ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT,
   AUTH_ERROR_TTL_MS,
+  MAX_QUOTA_COOLDOWN_MS,
   OVERLOAD_ENABLED_DEFAULT,
   OVERLOAD_TTL_MS,
   SERVER_ERROR_TTL_MS,
@@ -9,10 +10,11 @@ import {
   getSharedAccountHealth,
   resolveResetSeconds,
   setSharedAccountHealth
-} from "../chunk-YJVHCHQX.js";
+} from "../chunk-N7OOJI5V.js";
 export {
   ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT,
   AUTH_ERROR_TTL_MS,
+  MAX_QUOTA_COOLDOWN_MS,
   OVERLOAD_ENABLED_DEFAULT,
   OVERLOAD_TTL_MS,
   SERVER_ERROR_TTL_MS,

package/dist/pipeline/upstreamFetch.cjs

@@ -4,13 +4,14 @@
 
 
 
-var _chunkKCVJWJSTcjs = require('../chunk-KCVJWJST.cjs');
-require('../chunk-3Z5BQZFM.cjs');
+var _chunkRJUONLUQcjs = require('../chunk-RJUONLUQ.cjs');
+require('../chunk-235MXAGX.cjs');
 require('../chunk-HVBBDBS3.cjs');
+require('../chunk-NKVZ6Z3Y.cjs');
 
 
 
 
 
 
-exports.__resetUpstreamProxyForTests = _chunkKCVJWJSTcjs.__resetUpstreamProxyForTests; exports.bumpUpstreamProxyGeneration = _chunkKCVJWJSTcjs.bumpUpstreamProxyGeneration; exports.fetchUpstream = _chunkKCVJWJSTcjs.fetchUpstream; exports.resolveUpstreamDispatcher = _chunkKCVJWJSTcjs.resolveUpstreamDispatcher; exports.setUpstreamProxyResolver = _chunkKCVJWJSTcjs.setUpstreamProxyResolver;
+exports.__resetUpstreamProxyForTests = _chunkRJUONLUQcjs.__resetUpstreamProxyForTests; exports.bumpUpstreamProxyGeneration = _chunkRJUONLUQcjs.bumpUpstreamProxyGeneration; exports.fetchUpstream = _chunkRJUONLUQcjs.fetchUpstream; exports.resolveUpstreamDispatcher = _chunkRJUONLUQcjs.resolveUpstreamDispatcher; exports.setUpstreamProxyResolver = _chunkRJUONLUQcjs.setUpstreamProxyResolver;

package/dist/pipeline/upstreamFetch.d.cts

@@ -1,5 +1,6 @@
 import { ProxyConfig } from '@omnicross/contracts/account-tokens-types';
 import { Dispatcher } from 'undici';
+import { AccountRouteEndpoint, AccountRouteSessionSource, AccountRouteActivityRecord } from './AccountRouteActivity.cjs';
 
 /**
  * upstreamFetch — the single proxy-aware egress seam for `@omnicross/core`
@@ -28,27 +29,55 @@ import { Dispatcher } from 'undici';
  * FROZEN SEAM: `#7` (client fingerprint) attaches per-account TLS/agent behavior
  * at this SAME dispatcher point — do not fork a second egress path.
  *
- * DEBUG TRACE: when the daemon installs an upstream-trace path (gated on the
- * audit `captureBodies` opt-in), relay calls (`ctx.providerId` set) clone the
- * response and append the FULL exchange (request + verbatim response incl. SSE)
- * to the trace file. Absent a path (the default) it is a pure no-op — zero
- * regression. See `upstreamTrace.ts`.
+ * DEBUG TRACE: when a diagnostic caller explicitly installs an upstream-trace
+ * path, relay calls (`ctx.providerId` set) clone the response and append the
+ * FULL exchange (request + verbatim response incl. SSE) to the trace file. The
+ * daemon audit runtime never installs this path, preventing duplicate body
+ * storage. Absent a path (the default) it is a pure no-op — zero regression.
  *
  * @module @omnicross/core/pipeline/upstreamFetch
  */
 
+interface AccountRouteActivityContext {
+    endpoint: AccountRouteEndpoint;
+    sessionKey?: string;
+    sessionSource: AccountRouteSessionSource;
+    model: string;
+    /**
+     * Invoked once with the freshly-recorded activity record. Lets a caller
+     * capture the record `id` so it can {@link AccountRouteActivityStore.amend}
+     * the SAME row later, once a post-hoc fact (e.g. an overload event buried in
+     * the 200 SSE body) becomes known during relay. Best-effort: never throws.
+     */
+    onRecorded?: (record: AccountRouteActivityRecord) => void;
+}
 /** The opaque call context the resolver maps to a proxy (precedence input). */
 interface UpstreamProxyContext {
     /** The subscription provider id (`claude`/`codex`/`gemini`/`opencodego`) or `'byo'`. */
     providerId?: string;
     /** The selected pooled account id (per-account override input). */
     accountId?: string;
+    /** Metadata-only live route activity. Never contains prompts, headers, or tokens. */
+    routeActivity?: AccountRouteActivityContext;
     /**
      * The target upstream URL. Injected by {@link fetchUpstream} so the resolver can
      * apply host-based bypass (loopback / `NO_PROXY`). Callers of the ingress helpers
      * do NOT set this — it is filled from the fetch `url`.
      */
     url?: string;
+    /**
+     * CREDENTIAL EXCHANGE — this call's request/response BODIES carry secrets (an
+     * authorization code + PKCE verifier out, an access/refresh token back), so the
+     * debug trace must record the exchange's METADATA only and replace both bodies
+     * with a placeholder.
+     *
+     * Set it on every OAuth token-endpoint call (interactive login + refresh).
+     * Those calls still need a `providerId` so the per-provider proxy layer applies
+     * and so a failure is traceable at all — but the trace captures bodies verbatim
+     * (that is its purpose for relay traffic), and a plaintext token must never
+     * reach the trace file. Purely a trace concern: the proxy resolver ignores it.
+     */
+    redactBodies?: boolean;
 }
 /**
  * The layered proxy lookup the daemon injects. Applies precedence
@@ -86,4 +115,4 @@ declare function fetchUpstream(url: string, init: RequestInit, ctx?: UpstreamPro
 /** TEST SEAM — clear the resolver + cache so a suite starts from the direct-fetch baseline. */
 declare function __resetUpstreamProxyForTests(): void;
 
-export { type UpstreamProxyContext, type UpstreamProxyResolver, __resetUpstreamProxyForTests, bumpUpstreamProxyGeneration, fetchUpstream, resolveUpstreamDispatcher, setUpstreamProxyResolver };
+export { type AccountRouteActivityContext, type UpstreamProxyContext, type UpstreamProxyResolver, __resetUpstreamProxyForTests, bumpUpstreamProxyGeneration, fetchUpstream, resolveUpstreamDispatcher, setUpstreamProxyResolver };

package/dist/pipeline/upstreamFetch.d.ts

@@ -1,5 +1,6 @@
 import { ProxyConfig } from '@omnicross/contracts/account-tokens-types';
 import { Dispatcher } from 'undici';
+import { AccountRouteEndpoint, AccountRouteSessionSource, AccountRouteActivityRecord } from './AccountRouteActivity.js';
 
 /**
  * upstreamFetch — the single proxy-aware egress seam for `@omnicross/core`
@@ -28,27 +29,55 @@ import { Dispatcher } from 'undici';
  * FROZEN SEAM: `#7` (client fingerprint) attaches per-account TLS/agent behavior
  * at this SAME dispatcher point — do not fork a second egress path.
  *
- * DEBUG TRACE: when the daemon installs an upstream-trace path (gated on the
- * audit `captureBodies` opt-in), relay calls (`ctx.providerId` set) clone the
- * response and append the FULL exchange (request + verbatim response incl. SSE)
- * to the trace file. Absent a path (the default) it is a pure no-op — zero
- * regression. See `upstreamTrace.ts`.
+ * DEBUG TRACE: when a diagnostic caller explicitly installs an upstream-trace
+ * path, relay calls (`ctx.providerId` set) clone the response and append the
+ * FULL exchange (request + verbatim response incl. SSE) to the trace file. The
+ * daemon audit runtime never installs this path, preventing duplicate body
+ * storage. Absent a path (the default) it is a pure no-op — zero regression.
  *
  * @module @omnicross/core/pipeline/upstreamFetch
  */
 
+interface AccountRouteActivityContext {
+    endpoint: AccountRouteEndpoint;
+    sessionKey?: string;
+    sessionSource: AccountRouteSessionSource;
+    model: string;
+    /**
+     * Invoked once with the freshly-recorded activity record. Lets a caller
+     * capture the record `id` so it can {@link AccountRouteActivityStore.amend}
+     * the SAME row later, once a post-hoc fact (e.g. an overload event buried in
+     * the 200 SSE body) becomes known during relay. Best-effort: never throws.
+     */
+    onRecorded?: (record: AccountRouteActivityRecord) => void;
+}
 /** The opaque call context the resolver maps to a proxy (precedence input). */
 interface UpstreamProxyContext {
     /** The subscription provider id (`claude`/`codex`/`gemini`/`opencodego`) or `'byo'`. */
     providerId?: string;
     /** The selected pooled account id (per-account override input). */
     accountId?: string;
+    /** Metadata-only live route activity. Never contains prompts, headers, or tokens. */
+    routeActivity?: AccountRouteActivityContext;
     /**
      * The target upstream URL. Injected by {@link fetchUpstream} so the resolver can
      * apply host-based bypass (loopback / `NO_PROXY`). Callers of the ingress helpers
      * do NOT set this — it is filled from the fetch `url`.
      */
     url?: string;
+    /**
+     * CREDENTIAL EXCHANGE — this call's request/response BODIES carry secrets (an
+     * authorization code + PKCE verifier out, an access/refresh token back), so the
+     * debug trace must record the exchange's METADATA only and replace both bodies
+     * with a placeholder.
+     *
+     * Set it on every OAuth token-endpoint call (interactive login + refresh).
+     * Those calls still need a `providerId` so the per-provider proxy layer applies
+     * and so a failure is traceable at all — but the trace captures bodies verbatim
+     * (that is its purpose for relay traffic), and a plaintext token must never
+     * reach the trace file. Purely a trace concern: the proxy resolver ignores it.
+     */
+    redactBodies?: boolean;
 }
 /**
  * The layered proxy lookup the daemon injects. Applies precedence
@@ -86,4 +115,4 @@ declare function fetchUpstream(url: string, init: RequestInit, ctx?: UpstreamPro
 /** TEST SEAM — clear the resolver + cache so a suite starts from the direct-fetch baseline. */
 declare function __resetUpstreamProxyForTests(): void;
 
-export { type UpstreamProxyContext, type UpstreamProxyResolver, __resetUpstreamProxyForTests, bumpUpstreamProxyGeneration, fetchUpstream, resolveUpstreamDispatcher, setUpstreamProxyResolver };
+export { type AccountRouteActivityContext, type UpstreamProxyContext, type UpstreamProxyResolver, __resetUpstreamProxyForTests, bumpUpstreamProxyGeneration, fetchUpstream, resolveUpstreamDispatcher, setUpstreamProxyResolver };

package/dist/pipeline/upstreamFetch.js

@@ -4,9 +4,10 @@ import {
   fetchUpstream,
   resolveUpstreamDispatcher,
   setUpstreamProxyResolver
-} from "../chunk-SIZQQD6T.js";
-import "../chunk-SYQF7OIR.js";
+} from "../chunk-RJ5ZGNI3.js";
+import "../chunk-3WD4HTR2.js";
 import "../chunk-MKF46GNZ.js";
+import "../chunk-GL6XM527.js";
 export {
   __resetUpstreamProxyForTests,
   bumpUpstreamProxyGeneration,

package/dist/pipeline/upstreamTrace.cjs

@@ -4,11 +4,13 @@
 
 
 
-var _chunk3Z5BQZFMcjs = require('../chunk-3Z5BQZFM.cjs');
 
+var _chunk235MXAGXcjs = require('../chunk-235MXAGX.cjs');
 
 
 
 
 
-exports.__resetUpstreamTraceForTests = _chunk3Z5BQZFMcjs.__resetUpstreamTraceForTests; exports.getUpstreamTracePath = _chunk3Z5BQZFMcjs.getUpstreamTracePath; exports.redactHeaders = _chunk3Z5BQZFMcjs.redactHeaders; exports.setUpstreamTracePath = _chunk3Z5BQZFMcjs.setUpstreamTracePath; exports.writeUpstreamTrace = _chunk3Z5BQZFMcjs.writeUpstreamTrace;
+
+
+exports.REDACTED_BODY = _chunk235MXAGXcjs.REDACTED_BODY; exports.__resetUpstreamTraceForTests = _chunk235MXAGXcjs.__resetUpstreamTraceForTests; exports.getUpstreamTracePath = _chunk235MXAGXcjs.getUpstreamTracePath; exports.redactHeaders = _chunk235MXAGXcjs.redactHeaders; exports.setUpstreamTracePath = _chunk235MXAGXcjs.setUpstreamTracePath; exports.writeUpstreamTrace = _chunk235MXAGXcjs.writeUpstreamTrace;

package/dist/pipeline/upstreamTrace.d.cts

@@ -14,22 +14,36 @@
  * (a `text/event-stream` included — `clone().text()` tees the stream so the
  * relay keeps streaming the original while the clone is buffered for the
  * trace), and appends one {@link UpstreamTraceRecord} JSON line. Relay calls
- * carry an opaque `providerId`; OAuth-refresh / webhook sends do not, so they
- * are skipped (less noise). Tracing is fire-and-forget: a read/write failure
- * is swallowed so the egress path is never affected.
+ * carry an opaque `providerId`; webhook / billing sends do not, so they are
+ * skipped (less noise). OAuth token-endpoint calls (interactive login + refresh)
+ * DO carry one — a failed login must be diagnosable — but they set the ctx's
+ * `redactBodies`, so their bodies are replaced with {@link REDACTED_BODY}.
+ * Tracing is fire-and-forget: a read/write failure is swallowed so the egress
+ * path is never affected.
  *
- * The daemon installs the path via {@link setUpstreamTracePath} (gated on the
- * audit segment's `captureBodies`, hot-reloaded like the audit sink). Absent a
- * path the trace is a pure no-op — byte-identical zero regression.
+ * A diagnostic caller may explicitly install a path via
+ * {@link setUpstreamTracePath}. The daemon's audit runtime intentionally does
+ * not install one: audit bodies have a single persistence path. Absent an
+ * explicit path the trace is a pure no-op — byte-identical zero regression.
  *
  * Secret discipline: request/response AUTHORIZATION + api-key HEADER values are
  * masked (`***REDACTED***`) — they are OAuth bearer tokens, not the thing under
  * test, and a plaintext trace file must not hold them. Header KEYS stay visible
  * so presence is verifiable. The request/response BODIES are captured VERBATIM
- * (a prompt / a codex SSE stream) — that is the whole point.
+ * (a prompt / a codex SSE stream) — that is the whole point — EXCEPT on a
+ * credential exchange, where the body IS the secret (see {@link REDACTED_BODY}).
  *
  * @module @omnicross/core/pipeline/upstreamTrace
  */
+/**
+ * Placeholder written in place of a request/response body whose content is a
+ * CREDENTIAL rather than the thing under test — an OAuth token exchange or
+ * refresh (`fetchUpstream` ctx `redactBodies`). Those calls are still traced so a
+ * failed login/refresh is diagnosable (url, status, duration, byte count), but a
+ * plaintext authorization code / access token / refresh token must never land in
+ * this file.
+ */
+declare const REDACTED_BODY = "***REDACTED (credential exchange)***";
 /**
  * Install (or clear, with `null`/blank) the trace file path. Idempotent — last
  * write wins. The path is resolved by the daemon relative to the audit store.
@@ -82,4 +96,4 @@ declare function writeUpstreamTrace(record: UpstreamTraceRecord): Promise<void>;
 /** TEST SEAM — clear the trace path so a suite starts from the no-trace baseline. */
 declare function __resetUpstreamTraceForTests(): void;
 
-export { type UpstreamTraceRecord, __resetUpstreamTraceForTests, getUpstreamTracePath, redactHeaders, setUpstreamTracePath, writeUpstreamTrace };
+export { REDACTED_BODY, type UpstreamTraceRecord, __resetUpstreamTraceForTests, getUpstreamTracePath, redactHeaders, setUpstreamTracePath, writeUpstreamTrace };