@omnicross/core 0.1.6 → 0.1.8

package/dist/outbound-api.d.ts

@@ -1,6 +1,6 @@
 import { VoucherConfig } from '@omnicross/contracts/voucher-types';
-import { c as EndpointRoutingConfig, G as GatewayBinding, U as UserMessageQueueConfig, b as ConcurrencyQueueConfig, n as OutboundApiDeps, r as OutboundApiServerStatus, t as OutboundFormatUrls, A as AccountProbeConfig, a as AllowanceSchedulingConfig, F as FingerprintConfig, q as OutboundApiServerConfig, m as ModelPrefixTargets, x as OutboundProxyConfig, s as OutboundEndpoint, R as RequestRole, Q as ModelRef, k as KindMappedEndpoint, l as ModelKind, O as OutboundKeyDb, o as OutboundApiKeyCreated } from './types-hsoKrVQS.js';
-export { C as ChatDispatchMode, E as ENDPOINT_MODEL_KINDS, d as GatewayBindingFallback, e as GatewayBindingKeyScope, f as GatewayBindingModelMode, g as GatewayBindingTarget, h as GatewayModelMapping, K as KeySpendReader, i as KeySpendSeeder, j as KeySpendTracker, M as MessagesModelKind, p as OutboundApiKeyInfo, u as OutboundKeyActivationMode, v as OutboundKeyDbRow, w as OutboundKeyPolicy, y as ResponsesModelKind, V as VoucherCreateInput, z as VoucherDb, B as computeVoucherGrant, D as generateVoucherCode, H as hashVoucherCode, I as newVoucherId, J as startOfLocalDay, L as startOfLocalWeek, N as toVoucherInfo, P as voucherCodePrefix } from './types-hsoKrVQS.js';
+import { c as EndpointRoutingConfig, G as GatewayBinding, U as UserMessageQueueConfig, b as ConcurrencyQueueConfig, n as OutboundApiDeps, r as OutboundApiServerStatus, t as OutboundFormatUrls, A as AccountProbeConfig, a as AllowanceSchedulingConfig, F as FingerprintConfig, q as OutboundApiServerConfig, m as ModelPrefixTargets, x as OutboundProxyConfig, s as OutboundEndpoint, R as RequestRole, Q as ModelRef, k as KindMappedEndpoint, l as ModelKind, O as OutboundKeyDb, o as OutboundApiKeyCreated } from './types-BB8pxk_3.js';
+export { C as ChatDispatchMode, E as ENDPOINT_MODEL_KINDS, d as GatewayBindingFallback, e as GatewayBindingKeyScope, f as GatewayBindingModelMode, g as GatewayBindingTarget, h as GatewayModelMapping, K as KeySpendReader, i as KeySpendSeeder, j as KeySpendTracker, M as MessagesModelKind, p as OutboundApiKeyInfo, u as OutboundKeyActivationMode, v as OutboundKeyDbRow, w as OutboundKeyPolicy, y as ResponsesModelKind, V as VoucherCreateInput, z as VoucherDb, B as computeVoucherGrant, D as generateVoucherCode, H as hashVoucherCode, I as newVoucherId, J as startOfLocalDay, L as startOfLocalWeek, N as toVoucherInfo, P as voucherCodePrefix } from './types-BB8pxk_3.js';
 import { ProxyConfig } from '@omnicross/contracts/account-tokens-types';
 import { AuditConfig } from '@omnicross/contracts/audit-types';
 import { BillingConfig } from '@omnicross/contracts/billing-types';
@@ -12,7 +12,7 @@ import { K as KeyCostLimits, M as ModelRestriction } from './keyPolicy-zdWTu3CQ.
 export { a as KeyExpiryInput, b as KeyExpiryResult, c as KeySpend, Q as QuotaDecision, d as checkKeyQuota, e as computeKeyExpiry } from './keyPolicy-zdWTu3CQ.js';
 import http from 'node:http';
 import { IngressFormat } from './provider-proxy/types.js';
-export { S as SUBSCRIPTION_PROVIDER_IDS, e as endpointSupportsSubscription, i as isSubscriptionProviderId, p as parseModelRef, a as pickModelRefFromList, r as resolveRoute } from './routeResolver-CHTv_Bs5.js';
+export { S as SUBSCRIPTION_PROVIDER_IDS, e as endpointSupportsSubscription, i as isSubscriptionProviderId, p as parseModelRef, a as pickModelRefFromList, r as resolveRoute } from './routeResolver-C0mkkZaM.js';
 export { BoundAccountFallbackPolicy, BoundAccountSelectionError, BoundAccountSelectionFailureReason, boundAccountSelectionMessage, isBoundAccountSelectionError } from './pipeline/BoundAccountSelectionError.js';
 import '@omnicross/contracts/health-logging-types';
 import './logger-4GvQNzhE.js';
@@ -20,8 +20,9 @@ import './ports/provider-config-source.js';
 import '@omnicross/contracts/llm-config';
 import './transformer/types.js';
 import './transformer/TransformerService.js';
-import './ProviderProxy-C-xqrkKi.js';
+import './ProviderProxy--ROec6VI.js';
 import '@omnicross/contracts/completion-types';
+import '@omnicross/contracts/usage-stats-types';
 import '@omnicross/contracts/subscription-types';
 import '@omnicross/contracts/usage-types';
 import './completion/ApiKeyPoolService.js';
@@ -195,8 +196,9 @@ declare function normalizeAccountProbe(raw: Partial<OutboundApiServerConfig> | u
  * Fill + range-CLAMP the request-audit segment to the frozen defaults
  * (request-audit-log, design D2). Lenient like the other segment normalizers:
  * `enabled`/`captureBodies`/`trustForwardedFor` coerce to booleans (default
- * false), `maxBodyBytes` clamps to `[256, 1_048_576]`, `retentionDays` clamps to
- * `[1, 365]`. Default (all-off) ⇒ no capture ⇒ zero regression.
+ * false). `maxBodyBytes:-1` means unlimited; other finite values clamp to
+ * `[0, 1_048_576]`. `retentionDays` clamps to `[1, 365]`. Default (all-off) ⇒
+ * no capture ⇒ zero regression.
  */
 declare function normalizeAudit(raw: Partial<OutboundApiServerConfig> | undefined | null): AuditConfig;
 /**

package/dist/outbound-api.js

@@ -63,29 +63,33 @@ import {
   verifyKey,
   verifyPresentedKey,
   voucherCodePrefix
-} from "./chunk-UDCC7EMR.js";
-import "./chunk-WB6PH56J.js";
+} from "./chunk-QYC54PMG.js";
 import "./chunk-VVEHS2LI.js";
 import "./chunk-46RLHI7D.js";
-import "./chunk-WNKWAEUR.js";
-import "./chunk-MZNPGW5Q.js";
-import "./chunk-DK4A7DLE.js";
-import "./chunk-VRFBB5DB.js";
+import "./chunk-MYYR3HZL.js";
+import "./chunk-PEGTIPB3.js";
 import "./chunk-LVUCAWMK.js";
-import "./chunk-OEWZUX4G.js";
+import "./chunk-32O35CIF.js";
+import "./chunk-FU7EAR73.js";
 import "./chunk-LB6EBS6Y.js";
-import "./chunk-6CL5HTPQ.js";
 import "./chunk-7VU7V2E4.js";
-import "./chunk-UX7VWA46.js";
-import "./chunk-BPKCU575.js";
-import "./chunk-DRWHTIIZ.js";
+import "./chunk-FXR6N3SR.js";
+import "./chunk-UAPBLNN2.js";
+import "./chunk-WNKWAEUR.js";
+import "./chunk-MZNPGW5Q.js";
+import "./chunk-DK4A7DLE.js";
+import "./chunk-XXFYLL7R.js";
 import "./chunk-XTEI64OU.js";
 import "./chunk-XX6NQJMA.js";
+import "./chunk-GFIZ6LQI.js";
+import "./chunk-OE6TDIWW.js";
+import "./chunk-DRWHTIIZ.js";
+import "./chunk-JWC6APFQ.js";
 import "./chunk-5ERIZW3D.js";
-import "./chunk-YJVHCHQX.js";
+import "./chunk-PO3XB56Z.js";
+import "./chunk-N7OOJI5V.js";
 import "./chunk-23S5OPIO.js";
 import "./chunk-AVYJ4YBN.js";
-import "./chunk-OE6TDIWW.js";
 import "./chunk-OPRS4IQZ.js";
 import {
   BoundAccountSelectionError,
@@ -94,7 +98,6 @@ import {
 } from "./chunk-2JYRIADS.js";
 import "./chunk-DE2SRBFZ.js";
 import "./chunk-ZY6KU6P3.js";
-import "./chunk-JWC6APFQ.js";
 import {
   beginBillingCapture
 } from "./chunk-WLYIIEAF.js";
@@ -123,19 +126,20 @@ import {
 import "./chunk-H5JUT3KV.js";
 import {
   beginAuditCapture
-} from "./chunk-IFXJ2BG7.js";
+} from "./chunk-7C7DET6S.js";
 import {
   AUDIT_REDACTED,
   redactAuditText
 } from "./chunk-K5NM7VAH.js";
 import "./chunk-WNY4WMRF.js";
 import "./chunk-OZFM4X3S.js";
-import "./chunk-AT7B7SOZ.js";
+import "./chunk-5NJLQ6T6.js";
 import "./chunk-N5T4M4GU.js";
 import "./chunk-TOVPMMHM.js";
-import "./chunk-SIZQQD6T.js";
-import "./chunk-SYQF7OIR.js";
+import "./chunk-RJ5ZGNI3.js";
+import "./chunk-3WD4HTR2.js";
 import "./chunk-MKF46GNZ.js";
+import "./chunk-GL6XM527.js";
 import "./chunk-CDHS2QDC.js";
 import "./chunk-Y7FO65VT.js";
 import "./chunk-FMOBD2OQ.js";

package/dist/pipeline/AccountAllowanceScheduling.d.cts

@@ -1,5 +1,5 @@
 import { SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
-import { a as AllowanceSchedulingConfig } from '../types-H3wGZSOo.cjs';
+import { a as AllowanceSchedulingConfig } from '../types-C2MwkLah.cjs';
 import { AccountAllowanceStore } from './AccountAllowanceStore.cjs';
 import '@omnicross/contracts/account-tokens-types';
 import '@omnicross/contracts/audit-types';
@@ -12,10 +12,11 @@ import '../ports/provider-config-source.cjs';
 import '@omnicross/contracts/llm-config';
 import '../transformer/types.cjs';
 import '../transformer/TransformerService.cjs';
-import '../ProviderProxy-CnMQYN59.cjs';
+import '../ProviderProxy-QdwNV6l1.cjs';
 import '../provider-proxy/types.cjs';
 import 'node:http';
 import '@omnicross/contracts/completion-types';
+import '@omnicross/contracts/usage-stats-types';
 import '@omnicross/contracts/usage-types';
 import '../completion/ApiKeyPoolService.cjs';
 import './AuthSource.cjs';

package/dist/pipeline/AccountAllowanceScheduling.d.ts

@@ -1,5 +1,5 @@
 import { SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
-import { a as AllowanceSchedulingConfig } from '../types-hsoKrVQS.js';
+import { a as AllowanceSchedulingConfig } from '../types-BB8pxk_3.js';
 import { AccountAllowanceStore } from './AccountAllowanceStore.js';
 import '@omnicross/contracts/account-tokens-types';
 import '@omnicross/contracts/audit-types';
@@ -12,10 +12,11 @@ import '../ports/provider-config-source.js';
 import '@omnicross/contracts/llm-config';
 import '../transformer/types.js';
 import '../transformer/TransformerService.js';
-import '../ProviderProxy-C-xqrkKi.js';
+import '../ProviderProxy--ROec6VI.js';
 import '../provider-proxy/types.js';
 import 'node:http';
 import '@omnicross/contracts/completion-types';
+import '@omnicross/contracts/usage-stats-types';
 import '@omnicross/contracts/usage-types';
 import '../completion/ApiKeyPoolService.js';
 import './AuthSource.js';

package/dist/pipeline/AccountRouteActivity.cjs

@@ -0,0 +1,10 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+var _chunkNKVZ6Z3Ycjs = require('../chunk-NKVZ6Z3Y.cjs');
+
+
+
+
+exports.ACCOUNT_ROUTE_ACTIVITY_LIMIT = _chunkNKVZ6Z3Ycjs.ACCOUNT_ROUTE_ACTIVITY_LIMIT; exports.AccountRouteActivityStore = _chunkNKVZ6Z3Ycjs.AccountRouteActivityStore; exports.getSharedAccountRouteActivity = _chunkNKVZ6Z3Ycjs.getSharedAccountRouteActivity;

package/dist/pipeline/AccountRouteActivity.d.cts

@@ -0,0 +1,61 @@
+/**
+ * Bounded, metadata-only history of subscription account routing decisions.
+ *
+ * Records are created at the shared upstream fetch seam, after authentication has
+ * reported the account that will actually serve the request. The store is
+ * intentionally process-local: it is useful for live operator diagnostics without
+ * turning session/account affinity into a durable tracking database.
+ */
+declare const ACCOUNT_ROUTE_ACTIVITY_LIMIT = 300;
+type AccountRouteEndpoint = 'responses' | 'messages';
+type AccountRouteSessionSource = 'session-header' | 'thread-header' | 'body-session-id' | 'body-thread-id' | 'prompt-cache-key' | 'content-fingerprint' | 'api-key-fallback' | 'none';
+type AccountRouteAffinity = 'new' | 'sticky' | 'switched' | 'untracked';
+interface AccountRouteActivityInput {
+    providerId: string;
+    accountId: string;
+    endpoint: AccountRouteEndpoint;
+    sessionKey?: string;
+    sessionSource: AccountRouteSessionSource;
+    model: string;
+    status: number;
+    durationMs: number;
+    ts?: number;
+    /**
+     * Post-hoc error observed AFTER the upstream status was recorded — e.g. a
+     * `200` whose SSE body carries a `response.failed` server-overload event.
+     * Never known at `record()` time; set later via {@link amend}. Absent on
+     * healthy responses.
+     */
+    streamError?: string;
+}
+interface AccountRouteActivityRecord extends AccountRouteActivityInput {
+    id: string;
+    ts: number;
+    affinity: AccountRouteAffinity;
+    previousAccountId?: string;
+}
+interface AccountRouteActivityQuery {
+    providerId?: string;
+    accountId?: string;
+    sessionKey?: string;
+    limit?: number;
+}
+declare class AccountRouteActivityStore {
+    private readonly records;
+    private sequence;
+    record(input: AccountRouteActivityInput): AccountRouteActivityRecord;
+    list(query?: AccountRouteActivityQuery): AccountRouteActivityRecord[];
+    clear(): void;
+    /**
+     * Backfill a field on an already-recorded entry. Used to annotate a record
+     * AFTER the upstream body streams — e.g. a `200` whose SSE body carries a
+     * `response.failed` overload event is only detectable mid-relay, long after
+     * `record()` stamped the 200 status. `patch` is intentionally narrow: only
+     * post-hoc-observable fields belong here, never the routing-decision fields.
+     * No-op when the id has already aged out of the bounded ring.
+     */
+    amend(id: string, patch: Partial<Pick<AccountRouteActivityRecord, 'streamError'>>): void;
+}
+declare function getSharedAccountRouteActivity(): AccountRouteActivityStore;
+
+export { ACCOUNT_ROUTE_ACTIVITY_LIMIT, type AccountRouteActivityInput, type AccountRouteActivityQuery, type AccountRouteActivityRecord, AccountRouteActivityStore, type AccountRouteAffinity, type AccountRouteEndpoint, type AccountRouteSessionSource, getSharedAccountRouteActivity };

package/dist/pipeline/AccountRouteActivity.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Bounded, metadata-only history of subscription account routing decisions.
+ *
+ * Records are created at the shared upstream fetch seam, after authentication has
+ * reported the account that will actually serve the request. The store is
+ * intentionally process-local: it is useful for live operator diagnostics without
+ * turning session/account affinity into a durable tracking database.
+ */
+declare const ACCOUNT_ROUTE_ACTIVITY_LIMIT = 300;
+type AccountRouteEndpoint = 'responses' | 'messages';
+type AccountRouteSessionSource = 'session-header' | 'thread-header' | 'body-session-id' | 'body-thread-id' | 'prompt-cache-key' | 'content-fingerprint' | 'api-key-fallback' | 'none';
+type AccountRouteAffinity = 'new' | 'sticky' | 'switched' | 'untracked';
+interface AccountRouteActivityInput {
+    providerId: string;
+    accountId: string;
+    endpoint: AccountRouteEndpoint;
+    sessionKey?: string;
+    sessionSource: AccountRouteSessionSource;
+    model: string;
+    status: number;
+    durationMs: number;
+    ts?: number;
+    /**
+     * Post-hoc error observed AFTER the upstream status was recorded — e.g. a
+     * `200` whose SSE body carries a `response.failed` server-overload event.
+     * Never known at `record()` time; set later via {@link amend}. Absent on
+     * healthy responses.
+     */
+    streamError?: string;
+}
+interface AccountRouteActivityRecord extends AccountRouteActivityInput {
+    id: string;
+    ts: number;
+    affinity: AccountRouteAffinity;
+    previousAccountId?: string;
+}
+interface AccountRouteActivityQuery {
+    providerId?: string;
+    accountId?: string;
+    sessionKey?: string;
+    limit?: number;
+}
+declare class AccountRouteActivityStore {
+    private readonly records;
+    private sequence;
+    record(input: AccountRouteActivityInput): AccountRouteActivityRecord;
+    list(query?: AccountRouteActivityQuery): AccountRouteActivityRecord[];
+    clear(): void;
+    /**
+     * Backfill a field on an already-recorded entry. Used to annotate a record
+     * AFTER the upstream body streams — e.g. a `200` whose SSE body carries a
+     * `response.failed` overload event is only detectable mid-relay, long after
+     * `record()` stamped the 200 status. `patch` is intentionally narrow: only
+     * post-hoc-observable fields belong here, never the routing-decision fields.
+     * No-op when the id has already aged out of the bounded ring.
+     */
+    amend(id: string, patch: Partial<Pick<AccountRouteActivityRecord, 'streamError'>>): void;
+}
+declare function getSharedAccountRouteActivity(): AccountRouteActivityStore;
+
+export { ACCOUNT_ROUTE_ACTIVITY_LIMIT, type AccountRouteActivityInput, type AccountRouteActivityQuery, type AccountRouteActivityRecord, AccountRouteActivityStore, type AccountRouteAffinity, type AccountRouteEndpoint, type AccountRouteSessionSource, getSharedAccountRouteActivity };

package/dist/pipeline/AccountRouteActivity.js

@@ -0,0 +1,10 @@
+import {
+  ACCOUNT_ROUTE_ACTIVITY_LIMIT,
+  AccountRouteActivityStore,
+  getSharedAccountRouteActivity
+} from "../chunk-GL6XM527.js";
+export {
+  ACCOUNT_ROUTE_ACTIVITY_LIMIT,
+  AccountRouteActivityStore,
+  getSharedAccountRouteActivity
+};

package/dist/pipeline/ServerOverloadCounter.cjs

@@ -0,0 +1,16 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+
+
+
+var _chunkOTZC4TNHcjs = require('../chunk-OTZC4TNH.cjs');
+
+
+
+
+
+
+
+exports.OVERLOAD_ENTRY_TTL_MS = _chunkOTZC4TNHcjs.OVERLOAD_ENTRY_TTL_MS; exports.OVERLOAD_RECENT_LIMIT = _chunkOTZC4TNHcjs.OVERLOAD_RECENT_LIMIT; exports.ServerOverloadCounterStore = _chunkOTZC4TNHcjs.ServerOverloadCounterStore; exports.__resetSharedOverloadCounterForTests = _chunkOTZC4TNHcjs.__resetSharedOverloadCounterForTests; exports.getSharedOverloadCounter = _chunkOTZC4TNHcjs.getSharedOverloadCounter; exports.setSharedOverloadCounter = _chunkOTZC4TNHcjs.setSharedOverloadCounter;

package/dist/pipeline/ServerOverloadCounter.d.cts

@@ -0,0 +1,77 @@
+import { AccountRouteEndpoint } from './AccountRouteActivity.cjs';
+
+/**
+ * ServerOverloadCounter — a bounded, metadata-only tally of Codex server-
+ * overload events (`response.failed` with `error.code` `server_is_overloaded` /
+ * `slow_down`) per provider+account+endpoint.
+ *
+ * WHY a dedicated store (not derived from {@link AccountRouteActivity}): those
+ * 200-status overloads are invisible at the route-activity HTTP-status layer, and
+ * the route-activity ring (300 rows) can be pushed out by normal traffic before
+ * an operator notices. This counter ACCUMULATES across the ring and keeps a
+ * bounded recent-timestamp ring for a trend sparkline, so "how often is account X
+ * being overloaded, and is it worsening" stays answerable.
+ *
+ * Overload is account-INDEPENDENT server capacity (retrying on another account is
+ * pointless), so — unlike {@link SubscriptionAccountHealth} — this store only
+ * OBSERVES; it never gates scheduling. It carries no secrets, only counts + epoch
+ * timestamps. In-memory (cleared on restart), same as the other pipeline stores.
+ *
+ * Shaped like `SubscriptionAccountHealth`: an in-memory `Map`, an injectable
+ * `now` clock, no external deps, opaque `providerId\0accountId\0endpoint` keys.
+ *
+ * @module pipeline/ServerOverloadCounter
+ */
+
+/** Bounded recent-event ring per entry — the sparkline's data source. */
+declare const OVERLOAD_RECENT_LIMIT = 64;
+/**
+ * Entries with no event in this window are pruned on read, so the map cannot
+ * grow unbounded across a long-lived process with many transient accounts.
+ */
+declare const OVERLOAD_ENTRY_TTL_MS: number;
+interface OverloadRecordInput {
+    providerId: string;
+    accountId: string;
+    endpoint: AccountRouteEndpoint;
+    /** Epoch-ms of the event. Omit to use the clock default. */
+    now?: number;
+}
+interface OverloadCounterEntry {
+    providerId: string;
+    accountId: string;
+    endpoint: AccountRouteEndpoint;
+    /** Lifetime count of overload events for this key (since first observed). */
+    count: number;
+    firstTs: number;
+    lastTs: number;
+    /** Most-recent-first epoch-ms events, capped at {@link OVERLOAD_RECENT_LIMIT}. */
+    recent: number[];
+}
+interface OverloadCounterQuery {
+    providerId?: string;
+    accountId?: string;
+}
+declare class ServerOverloadCounterStore {
+    private readonly entries;
+    /**
+     * Record one overload event. Creates the entry on first sight, then bumps
+     * `count`, `lastTs`, and prepends the event to the bounded `recent` ring.
+     */
+    recordOverload(input: OverloadRecordInput, now?: number): OverloadCounterEntry;
+    /**
+     * Snapshot all (optionally filtered) entries, pruning stale ones first. Returns
+     * copies — callers (admin API → JSON) never see the live mutable entries.
+     */
+    list(query?: OverloadCounterQuery, now?: number): OverloadCounterEntry[];
+    clear(): void;
+}
+declare function getSharedOverloadCounter(): ServerOverloadCounterStore;
+/**
+ * TEST SEAM — swap the singleton (e.g. with a fresh instance). Mirrors the
+ * `setShared…`/`__reset…ForTests` discipline of the sibling pipeline stores.
+ */
+declare function setSharedOverloadCounter(instance: ServerOverloadCounterStore): void;
+declare function __resetSharedOverloadCounterForTests(): void;
+
+export { OVERLOAD_ENTRY_TTL_MS, OVERLOAD_RECENT_LIMIT, type OverloadCounterEntry, type OverloadCounterQuery, type OverloadRecordInput, ServerOverloadCounterStore, __resetSharedOverloadCounterForTests, getSharedOverloadCounter, setSharedOverloadCounter };

package/dist/pipeline/ServerOverloadCounter.d.ts

@@ -0,0 +1,77 @@
+import { AccountRouteEndpoint } from './AccountRouteActivity.js';
+
+/**
+ * ServerOverloadCounter — a bounded, metadata-only tally of Codex server-
+ * overload events (`response.failed` with `error.code` `server_is_overloaded` /
+ * `slow_down`) per provider+account+endpoint.
+ *
+ * WHY a dedicated store (not derived from {@link AccountRouteActivity}): those
+ * 200-status overloads are invisible at the route-activity HTTP-status layer, and
+ * the route-activity ring (300 rows) can be pushed out by normal traffic before
+ * an operator notices. This counter ACCUMULATES across the ring and keeps a
+ * bounded recent-timestamp ring for a trend sparkline, so "how often is account X
+ * being overloaded, and is it worsening" stays answerable.
+ *
+ * Overload is account-INDEPENDENT server capacity (retrying on another account is
+ * pointless), so — unlike {@link SubscriptionAccountHealth} — this store only
+ * OBSERVES; it never gates scheduling. It carries no secrets, only counts + epoch
+ * timestamps. In-memory (cleared on restart), same as the other pipeline stores.
+ *
+ * Shaped like `SubscriptionAccountHealth`: an in-memory `Map`, an injectable
+ * `now` clock, no external deps, opaque `providerId\0accountId\0endpoint` keys.
+ *
+ * @module pipeline/ServerOverloadCounter
+ */
+
+/** Bounded recent-event ring per entry — the sparkline's data source. */
+declare const OVERLOAD_RECENT_LIMIT = 64;
+/**
+ * Entries with no event in this window are pruned on read, so the map cannot
+ * grow unbounded across a long-lived process with many transient accounts.
+ */
+declare const OVERLOAD_ENTRY_TTL_MS: number;
+interface OverloadRecordInput {
+    providerId: string;
+    accountId: string;
+    endpoint: AccountRouteEndpoint;
+    /** Epoch-ms of the event. Omit to use the clock default. */
+    now?: number;
+}
+interface OverloadCounterEntry {
+    providerId: string;
+    accountId: string;
+    endpoint: AccountRouteEndpoint;
+    /** Lifetime count of overload events for this key (since first observed). */
+    count: number;
+    firstTs: number;
+    lastTs: number;
+    /** Most-recent-first epoch-ms events, capped at {@link OVERLOAD_RECENT_LIMIT}. */
+    recent: number[];
+}
+interface OverloadCounterQuery {
+    providerId?: string;
+    accountId?: string;
+}
+declare class ServerOverloadCounterStore {
+    private readonly entries;
+    /**
+     * Record one overload event. Creates the entry on first sight, then bumps
+     * `count`, `lastTs`, and prepends the event to the bounded `recent` ring.
+     */
+    recordOverload(input: OverloadRecordInput, now?: number): OverloadCounterEntry;
+    /**
+     * Snapshot all (optionally filtered) entries, pruning stale ones first. Returns
+     * copies — callers (admin API → JSON) never see the live mutable entries.
+     */
+    list(query?: OverloadCounterQuery, now?: number): OverloadCounterEntry[];
+    clear(): void;
+}
+declare function getSharedOverloadCounter(): ServerOverloadCounterStore;
+/**
+ * TEST SEAM — swap the singleton (e.g. with a fresh instance). Mirrors the
+ * `setShared…`/`__reset…ForTests` discipline of the sibling pipeline stores.
+ */
+declare function setSharedOverloadCounter(instance: ServerOverloadCounterStore): void;
+declare function __resetSharedOverloadCounterForTests(): void;
+
+export { OVERLOAD_ENTRY_TTL_MS, OVERLOAD_RECENT_LIMIT, type OverloadCounterEntry, type OverloadCounterQuery, type OverloadRecordInput, ServerOverloadCounterStore, __resetSharedOverloadCounterForTests, getSharedOverloadCounter, setSharedOverloadCounter };

package/dist/pipeline/ServerOverloadCounter.js

@@ -0,0 +1,16 @@
+import {
+  OVERLOAD_ENTRY_TTL_MS,
+  OVERLOAD_RECENT_LIMIT,
+  ServerOverloadCounterStore,
+  __resetSharedOverloadCounterForTests,
+  getSharedOverloadCounter,
+  setSharedOverloadCounter
+} from "../chunk-PO3XB56Z.js";
+export {
+  OVERLOAD_ENTRY_TTL_MS,
+  OVERLOAD_RECENT_LIMIT,
+  ServerOverloadCounterStore,
+  __resetSharedOverloadCounterForTests,
+  getSharedOverloadCounter,
+  setSharedOverloadCounter
+};

package/dist/pipeline/SubscriptionAccountHealth.cjs

@@ -9,8 +9,8 @@
 
 
 
-var _chunkYK57NMIFcjs = require('../chunk-YK57NMIF.cjs');
 
+var _chunkYWL7YZWScjs = require('../chunk-YWL7YZWS.cjs');
 
 
 
@@ -21,4 +21,6 @@ var _chunkYK57NMIFcjs = require('../chunk-YK57NMIF.cjs');
 
 
 
-exports.ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT = _chunkYK57NMIFcjs.ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT; exports.AUTH_ERROR_TTL_MS = _chunkYK57NMIFcjs.AUTH_ERROR_TTL_MS; exports.OVERLOAD_ENABLED_DEFAULT = _chunkYK57NMIFcjs.OVERLOAD_ENABLED_DEFAULT; exports.OVERLOAD_TTL_MS = _chunkYK57NMIFcjs.OVERLOAD_TTL_MS; exports.SERVER_ERROR_TTL_MS = _chunkYK57NMIFcjs.SERVER_ERROR_TTL_MS; exports.SubscriptionAccountHealth = _chunkYK57NMIFcjs.SubscriptionAccountHealth; exports.__resetSharedAccountHealthForTests = _chunkYK57NMIFcjs.__resetSharedAccountHealthForTests; exports.getSharedAccountHealth = _chunkYK57NMIFcjs.getSharedAccountHealth; exports.resolveResetSeconds = _chunkYK57NMIFcjs.resolveResetSeconds; exports.setSharedAccountHealth = _chunkYK57NMIFcjs.setSharedAccountHealth;
+
+
+exports.ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT = _chunkYWL7YZWScjs.ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT; exports.AUTH_ERROR_TTL_MS = _chunkYWL7YZWScjs.AUTH_ERROR_TTL_MS; exports.MAX_QUOTA_COOLDOWN_MS = _chunkYWL7YZWScjs.MAX_QUOTA_COOLDOWN_MS; exports.OVERLOAD_ENABLED_DEFAULT = _chunkYWL7YZWScjs.OVERLOAD_ENABLED_DEFAULT; exports.OVERLOAD_TTL_MS = _chunkYWL7YZWScjs.OVERLOAD_TTL_MS; exports.SERVER_ERROR_TTL_MS = _chunkYWL7YZWScjs.SERVER_ERROR_TTL_MS; exports.SubscriptionAccountHealth = _chunkYWL7YZWScjs.SubscriptionAccountHealth; exports.__resetSharedAccountHealthForTests = _chunkYWL7YZWScjs.__resetSharedAccountHealthForTests; exports.getSharedAccountHealth = _chunkYWL7YZWScjs.getSharedAccountHealth; exports.resolveResetSeconds = _chunkYWL7YZWScjs.resolveResetSeconds; exports.setSharedAccountHealth = _chunkYWL7YZWScjs.setSharedAccountHealth;

package/dist/pipeline/SubscriptionAccountHealth.d.cts

@@ -31,6 +31,12 @@ declare const OVERLOAD_ENABLED_DEFAULT = true;
 declare const AUTH_ERROR_TTL_MS: number;
 /** Transient cooldown for a 5xx response or network failure. */
 declare const SERVER_ERROR_TTL_MS: number;
+/**
+ * Hard cap on a quota-exhaustion cooldown (the weekly usage window is ~1 week).
+ * A parsed/supplied deadline farther than this into the future is clamped, so a
+ * bogus parse can never strand an account indefinitely.
+ */
+declare const MAX_QUOTA_COOLDOWN_MS: number;
 /** Per-account health record (all timers are epoch ms). Absent fields ⇒ healthy. */
 interface HealthRecord {
     /** From a 429 authoritative reset header — rate-limited until this instant. */
@@ -39,11 +45,20 @@ interface HealthRecord {
     overloadUntil?: number;
     /** From a final-401 / plain-403 / 5xx / thrown — transient cooldown until this. */
     tempUnavailableUntil?: number;
+    /**
+     * From a detected quota/usage-limit error (e.g. Codex weekly window exhausted).
+     * Intentionally NOT cleared by a 2xx: while the account's credits/window are
+     * exhausted, in-flight sessions on the SAME account keep returning 2xx (Codex
+     * does not kill them mid-session), which would otherwise immediately heal a
+     * transient/rate-limit mark and re-strand every NEW session onto this account.
+     * Self-heals only when the deadline elapses.
+     */
+    quotaExhaustedUntil?: number;
     /** From a 403-ban — permanent, self-heal never clears it. */
     blocked?: boolean;
 }
 /** The coarse health state surfaced to the admin accounts view (secret-free). */
-type AccountHealthState = 'healthy' | 'rate_limited' | 'overloaded' | 'transient' | 'blocked';
+type AccountHealthState = 'healthy' | 'rate_limited' | 'overloaded' | 'transient' | 'quota_exhausted' | 'blocked';
 /** Admin-facing status projection for one account. */
 interface AccountHealthStatus {
     state: AccountHealthState;
@@ -68,7 +83,7 @@ interface AccountRecoveryEvent {
 /** A recovery listener (fire-and-forget; the emitter never awaits it). */
 type AccountRecoveryListener = (event: AccountRecoveryEvent) => void;
 /** The coarse anomaly state an account transitioned into (secret-free). */
-type AccountAnomalyState = 'blocked' | 'unauthorized' | 'rate_limited' | 'overloaded';
+type AccountAnomalyState = 'blocked' | 'unauthorized' | 'rate_limited' | 'overloaded' | 'quota_exhausted';
 /**
  * The anomaly signal emitted when a HEALTHY account transitions to unhealthy —
  * the additive union #5 (webhooks) consumes, which this tracker's frozen `kind`
@@ -192,6 +207,20 @@ declare class SubscriptionAccountHealth {
      *  - 2xx → clear rate-limit + transient state (keep `blocked`).
      */
     recordUpstreamOutcome(providerId: string, accountId: string, input: RecordUpstreamOutcomeInput): void;
+    /**
+     * Mark an account quota/usage-exhausted until `untilEpochMs` (the Codex weekly
+     * usage-limit wall). Unlike the status-driven timers set by
+     * {@link recordUpstreamOutcome}, this mark is NOT cleared by a 2xx: in-flight
+     * sessions on the same account keep succeeding after the window is exhausted,
+     * so a traffic-driven clear would re-strand every NEW session onto this
+     * account. It excludes the account from NEW-session selection until the
+     * deadline elapses (existing sessions are unaffected — they already hold their
+     * token). Self-heals lazily on read and via {@link sweepRecoveries}.
+     * `untilEpochMs` is clamped to {@link MAX_QUOTA_COOLDOWN_MS}; an already-elapsed
+     * deadline is a no-op. Emits a `quota_exhausted` anomaly on the healthy→
+     * unhealthy edge.
+     */
+    markQuotaExhausted(providerId: string, accountId: string, untilEpochMs: number, now?: number): void;
     /** Whether a record is unhealthy at `now`: blocked, or any timer still future. */
     private isUnhealthyAt;
     /**
@@ -260,4 +289,4 @@ declare function setSharedAccountHealth(instance: SubscriptionAccountHealth): vo
 /** Reset the shared singleton (tests / teardown only). */
 declare function __resetSharedAccountHealthForTests(): void;
 
-export { ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT, AUTH_ERROR_TTL_MS, type AccountAnomalyEvent, type AccountAnomalyListener, type AccountAnomalyState, type AccountHealthDiagnostic, type AccountHealthDiagnosticFilter, type AccountHealthState, type AccountHealthStatus, type AccountRecoveryEvent, type AccountRecoveryListener, type HeadersLike, type HealthRecord, OVERLOAD_ENABLED_DEFAULT, OVERLOAD_TTL_MS, type RecordUpstreamOutcomeInput, SERVER_ERROR_TTL_MS, SubscriptionAccountHealth, type SubscriptionAccountHealthOptions, __resetSharedAccountHealthForTests, getSharedAccountHealth, resolveResetSeconds, setSharedAccountHealth };
+export { ACCOUNT_HEALTH_DIAGNOSTIC_LIMIT, AUTH_ERROR_TTL_MS, type AccountAnomalyEvent, type AccountAnomalyListener, type AccountAnomalyState, type AccountHealthDiagnostic, type AccountHealthDiagnosticFilter, type AccountHealthState, type AccountHealthStatus, type AccountRecoveryEvent, type AccountRecoveryListener, type HeadersLike, type HealthRecord, MAX_QUOTA_COOLDOWN_MS, OVERLOAD_ENABLED_DEFAULT, OVERLOAD_TTL_MS, type RecordUpstreamOutcomeInput, SERVER_ERROR_TTL_MS, SubscriptionAccountHealth, type SubscriptionAccountHealthOptions, __resetSharedAccountHealthForTests, getSharedAccountHealth, resolveResetSeconds, setSharedAccountHealth };