@omnicross/subscriptions 0.1.0 → 0.1.3

package/dist/index.cjs

@@ -1,68 +1,281 @@
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } async function _asyncNullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return await rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; } var _class; var _class2; var _class3; var _class4; var _class5; var _class6; var _class7; var _class8; var _class9;
+
+
+
+var _chunkTPW5Q25Ycjs = require('./chunk-TPW5Q25Y.cjs');
+
+// src/scheduler/SubscriptionAccountSelector.ts
+var SESSION_AFFINITY_TTL_MS = 36e5;
+var LAST_USED_PERSIST_THROTTLE_MS = 6e4;
+var DEFAULT_ACCOUNT_PRIORITY = 50;
+function scopedKey(providerId, tail) {
+  return `${providerId}\0${tail}`;
+}
+function parseIso(iso) {
+  if (!iso) return 0;
+  const ms = Date.parse(iso);
+  return Number.isNaN(ms) ? 0 : ms;
+}
+var SubscriptionAccountSelector = (_class = class {constructor() { _class.prototype.__init.call(this);_class.prototype.__init2.call(this);_class.prototype.__init3.call(this); }
+  /** `providerId\0accountId → live lastUsedAt ms` (authoritative tie-break). */
+  __init() {this.lastUsedOverlay = /* @__PURE__ */ new Map()}
+  /** `providerId\0sessionKey → { accountId, expiresAt }`. */
+  __init2() {this.affinity = /* @__PURE__ */ new Map()}
+  /** `providerId\0accountId → last durable-persist ms` (throttle state). */
+  __init3() {this.lastPersist = /* @__PURE__ */ new Map()}
+  /**
+   * Choose the account to serve this request, or `null` when there are ≤ 1
+   * schedulable accounts (the zero-regression signal — caller uses the active
+   * account). Updates the live `lastUsedAt` overlay for the chosen account and,
+   * when a `sessionKey` is given, records/extends the affinity mapping.
+   */
+  select(input) {
+    const now = _nullishCoalesce(input.now, () => ( Date.now()));
+    const schedulable = input.accounts.filter((a) => a.schedulable !== false);
+    if (schedulable.length <= 1) return null;
+    if (input.sessionKey) {
+      const aKey = scopedKey(input.providerId, input.sessionKey);
+      const hit = this.affinity.get(aKey);
+      if (hit && hit.expiresAt > now && schedulable.some((a) => a.id === hit.accountId)) {
+        hit.expiresAt = now + SESSION_AFFINITY_TTL_MS;
+        this.markUsed(input.providerId, hit.accountId, now);
+        return { accountId: hit.accountId, isActive: hit.accountId === input.activeAccountId };
+      }
+    }
+    const chosen = this.pickOrdered(input.providerId, schedulable);
+    this.markUsed(input.providerId, chosen.id, now);
+    if (input.sessionKey) {
+      this.affinity.set(scopedKey(input.providerId, input.sessionKey), {
+        accountId: chosen.id,
+        expiresAt: now + SESSION_AFFINITY_TTL_MS
+      });
+    }
+    return { accountId: chosen.id, isActive: chosen.id === input.activeAccountId };
   }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+  /**
+   * Drop every session-affinity mapping bound to this account (subscription-account-
+   * health, task 4.1). Called when a selected account's by-id token turns out
+   * null/invalid or an affinity-bound account becomes unhealthy, so the next
+   * selection for those sessions picks a fresh account instead of re-sticking to
+   * the bad one. O(affinity entries) — the map is tiny (one entry per live
+   * conversation).
+   */
+  evictAffinity(providerId, accountId) {
+    const prefix = `${providerId} `;
+    for (const [key, entry] of this.affinity) {
+      if (entry.accountId === accountId && key.startsWith(prefix)) {
+        this.affinity.delete(key);
+      }
+    }
+  }
+  /**
+   * Whether a best-effort `lastUsedAt` durable persist is DUE for this account
+   * (≥ `LAST_USED_PERSIST_THROTTLE_MS` since the last one). Records the persist
+   * time when it returns `true`, so the strategy calls `touchAccountLastUsed`
+   * sparingly and the request hot path does not rewrite the store every request.
+   */
+  duePersist(providerId, accountId, now = Date.now()) {
+    const key = scopedKey(providerId, accountId);
+    const last = _nullishCoalesce(this.lastPersist.get(key), () => ( 0));
+    if (now - last < LAST_USED_PERSIST_THROTTLE_MS) return false;
+    this.lastPersist.set(key, now);
+    return true;
+  }
+  /** Sort by `priority` asc → effective `lastUsedAt` asc → `createdAt` asc → `[0]`. */
+  pickOrdered(providerId, accounts) {
+    const ranked = accounts.map((account) => ({
+      account,
+      priority: _nullishCoalesce(account.priority, () => ( DEFAULT_ACCOUNT_PRIORITY)),
+      lastUsed: this.effectiveLastUsed(providerId, account),
+      created: parseIso(account.createdAt)
+    }));
+    ranked.sort(
+      (x, y) => x.priority - y.priority || x.lastUsed - y.lastUsed || x.created - y.created
+    );
+    return ranked[0].account;
+  }
+  /** The live tie-break value: the in-memory overlay when set, else the persisted
+   *  `lastUsedAt` (0 when absent). */
+  effectiveLastUsed(providerId, account) {
+    const overlay = this.lastUsedOverlay.get(scopedKey(providerId, account.id));
+    return _nullishCoalesce(overlay, () => ( parseIso(account.lastUsedAt)));
+  }
+  markUsed(providerId, accountId, now) {
+    this.lastUsedOverlay.set(scopedKey(providerId, accountId), now);
+  }
+}, _class);
+
+// src/SubscriptionAccountService.ts
+var _SubscriptionAccountHealth = require('@omnicross/core/pipeline/SubscriptionAccountHealth');
+
+// src/scheduler/accountModelMap.ts
+function canonicalModelId(value) {
+  const idx = value.indexOf(",");
+  const bare = idx >= 0 ? value.slice(idx + 1) : value;
+  return bare.trim().toLowerCase();
+}
+function accountSupportsModel(supportedModels, model) {
+  if (!supportedModels) return true;
+  const target = canonicalModelId(model);
+  if (Array.isArray(supportedModels)) {
+    return supportedModels.some((m) => canonicalModelId(m) === target);
+  }
+  return Object.keys(supportedModels).some((k) => canonicalModelId(k) === target);
+}
+function remapForAccount(supportedModels, model) {
+  if (!supportedModels || Array.isArray(supportedModels)) return model;
+  const target = canonicalModelId(model);
+  for (const [key, actual] of Object.entries(supportedModels)) {
+    if (canonicalModelId(key) === target) return actual;
+  }
+  return model;
+}
+function remapReportForAccount(supportedModels, model) {
+  if (!model) return void 0;
+  const remapped = remapForAccount(supportedModels, model);
+  return remapped === model ? void 0 : remapped;
+}
 
-// src/index.ts
-var src_exports = {};
-__export(src_exports, {
-  SubscriptionAccountService: () => SubscriptionAccountService,
-  SubscriptionDispatcher: () => SubscriptionDispatcher,
-  SubscriptionProviderRegistry: () => SubscriptionProviderRegistry,
-  claudeOAuth: () => claude_exports,
-  codexOAuth: () => codex_exports,
-  geminiOAuth: () => gemini_exports,
-  getSubscriptionAccountService: () => getSubscriptionAccountService,
-  getSubscriptionProviderRegistry: () => getSubscriptionProviderRegistry,
-  setSubscriptionAccountService: () => setSubscriptionAccountService,
-  setSubscriptionProviderRegistry: () => setSubscriptionProviderRegistry
-});
-module.exports = __toCommonJS(src_exports);
+// src/scheduler/accountSelection.ts
+var ACCOUNTS_KEY = {
+  claude: "claudeAccounts",
+  codex: "codexAccounts",
+  gemini: "geminiAccounts",
+  opencodego: "opencodegoAccounts"
+};
+var ACTIVE_KEY = {
+  claude: "activeClaudeAccountId",
+  codex: "activeCodexAccountId",
+  gemini: "activeGeminiAccountId",
+  opencodego: "activeOpencodegoAccountId"
+};
+function gateSchedulable(accounts, providerId, health, now, resolvedModel, supportedModelsById) {
+  if (!health && !resolvedModel || accounts.length < 2) return accounts;
+  return accounts.map((a) => {
+    const healthOk = health ? health.isSchedulable(providerId, a.id, now) : true;
+    const modelOk = resolvedModel ? accountSupportsModel(supportedModelsById.get(a.id), resolvedModel) : true;
+    return { ...a, schedulable: healthOk && modelOk };
+  });
+}
+function isPoolGated(accounts, health, resolvedModel) {
+  return (health !== void 0 || resolvedModel !== void 0) && accounts.length >= 2;
+}
+function readSchedulableAccounts(config, providerId) {
+  const raw = _nullishCoalesce(config[ACCOUNTS_KEY[providerId]], () => ( []));
+  const accounts = raw.map((a) => ({
+    id: a.id,
+    priority: a.priority,
+    lastUsedAt: a.lastUsedAt,
+    createdAt: a.createdAt
+  }));
+  const supportedModelsById = new Map(
+    raw.map((a) => [a.id, a.supportedModels])
+  );
+  const activeAccountId = config[ACTIVE_KEY[providerId]];
+  return { accounts, activeAccountId, supportedModelsById };
+}
+function pickByIdTarget(selector, gated, providerId, activeAccountId, sessionKey, now, healthGated) {
+  const selection = selector.select({ providerId, accounts: gated, activeAccountId, sessionKey, now });
+  if (selection && !selection.isActive) return selection.accountId;
+  if (selection === null && healthGated) {
+    const schedulable = gated.filter((a) => a.schedulable !== false);
+    if (schedulable.length === 1 && schedulable[0].id !== activeAccountId) return schedulable[0].id;
+  }
+  return void 0;
+}
+async function resolveSelectedToken(selector, tokens, providerId, sessionKey, activeGetter, ctx) {
+  const health = _optionalChain([ctx, 'optionalAccess', _ => _.health]);
+  const report = _optionalChain([ctx, 'optionalAccess', _2 => _2.reportSelection]);
+  const now = _optionalChain([ctx, 'optionalAccess', _3 => _3.now]);
+  const resolvedModel = _optionalChain([ctx, 'optionalAccess', _4 => _4.resolvedModel]);
+  if (selector && tokens.getAccessTokenForAccount) {
+    const config = await tokens.getFullConfig();
+    const { accounts, activeAccountId, supportedModelsById } = readSchedulableAccounts(config, providerId);
+    const gated = gateSchedulable(accounts, providerId, health, now, resolvedModel, supportedModelsById);
+    const poolGated = isPoolGated(accounts, health, resolvedModel);
+    const remapFor = (id) => remapReportForAccount(supportedModelsById.get(id), resolvedModel);
+    const targetId = pickByIdTarget(selector, gated, providerId, activeAccountId, sessionKey, now, poolGated);
+    if (targetId !== void 0) {
+      const byId = await tokens.getAccessTokenForAccount(providerId, targetId);
+      if (byId) {
+        maybeTouchLastUsed(selector, tokens, providerId, targetId);
+        _optionalChain([report, 'optionalCall', _5 => _5(targetId, false, remapFor(targetId))]);
+        return byId;
+      }
+      selector.evictAffinity(providerId, targetId);
+      _optionalChain([health, 'optionalAccess', _6 => _6.recordUpstreamOutcome, 'call', _7 => _7(providerId, targetId, { status: 401, now })]);
+      const remaining = gated.filter((a) => a.id !== targetId);
+      const retryId = pickByIdTarget(selector, remaining, providerId, activeAccountId, sessionKey, now, poolGated);
+      if (retryId !== void 0) {
+        const retryToken = await tokens.getAccessTokenForAccount(providerId, retryId);
+        if (retryToken) {
+          maybeTouchLastUsed(selector, tokens, providerId, retryId);
+          _optionalChain([report, 'optionalCall', _8 => _8(retryId, false, remapFor(retryId))]);
+          return retryToken;
+        }
+      }
+    }
+    if (activeAccountId) _optionalChain([report, 'optionalCall', _9 => _9(activeAccountId, true, remapFor(activeAccountId))]);
+    return activeGetter();
+  }
+  return activeGetter();
+}
+function maybeTouchLastUsed(selector, tokens, providerId, accountId) {
+  if (!tokens.touchAccountLastUsed) return;
+  if (!selector.duePersist(providerId, accountId)) return;
+  void tokens.touchAccountLastUsed(providerId, accountId, (/* @__PURE__ */ new Date()).toISOString()).catch(() => {
+  });
+}
+async function refreshSelectedAccount(selector, tokens, mutex, providerId, sessionKey) {
+  if (!sessionKey || !selector || !tokens.refreshAccountToken) return null;
+  const config = await tokens.getFullConfig();
+  const { accounts, activeAccountId } = readSchedulableAccounts(config, providerId);
+  const selection = selector.select({ providerId, accounts, activeAccountId, sessionKey });
+  if (!selection || selection.isActive) return null;
+  const accountId = selection.accountId;
+  return mutex.run(`${providerId}:${accountId}`, async () => {
+    try {
+      return await _asyncNullishCoalesce(await tokens.refreshAccountToken(providerId, accountId), async () => ( false));
+    } catch (err) {
+      console.warn(`[accountSelection] ${providerId}:${accountId} by-id refresh failed:`, err);
+      return false;
+    }
+  });
+}
 
 // src/auth/OAuthBearerAuthStrategy.ts
 var REFRESH_LEAD_MS = 5 * 6e4;
-var OAuthBearerAuthStrategy = class {
-  constructor(providerId, tokens, mutex) {
+var OAuthBearerAuthStrategy = (_class2 = class {
+  constructor(providerId, tokens, mutex, selector, health) {;_class2.prototype.__init4.call(this);
     this.tokens = tokens;
     this.mutex = mutex;
+    this.selector = selector;
+    this.health = health;
     this.providerId = providerId;
   }
-  tokens;
-  mutex;
-  kind = "oauth-bearer";
-  providerId;
-  async applyHeaders(headers, _hints) {
-    const token = await this.resolveAccessToken();
+  
+  
+  
+  
+  __init4() {this.kind = "oauth-bearer"}
+  
+  async applyHeaders(headers, hints) {
+    const token = await resolveSelectedToken(
+      this.selector,
+      this.tokens,
+      this.providerId,
+      _optionalChain([hints, 'optionalAccess', _10 => _10.sessionKey]),
+      () => this.resolveAccessToken(),
+      { health: this.health, reportSelection: _optionalChain([hints, 'optionalAccess', _11 => _11.reportSelection]), resolvedModel: _optionalChain([hints, 'optionalAccess', _12 => _12.resolvedModel]) }
+    );
     if (!token) {
       return;
     }
     headers["Authorization"] = `Bearer ${token}`;
   }
-  async onUnauthorized() {
+  async onUnauthorized(sessionKey) {
+    const byId = await refreshSelectedAccount(this.selector, this.tokens, this.mutex, this.providerId, sessionKey);
+    if (byId !== null) return byId;
     return this.mutex.run(`${this.providerId}:refresh`, async () => {
       try {
         return this.providerId === "codex" ? await this.tokens.refreshCodexToken() : await this.tokens.refreshGeminiToken();
@@ -75,7 +288,7 @@ var OAuthBearerAuthStrategy = class {
   async describeStatus() {
     const config = await this.tokens.getFullConfig();
     const entry = this.providerId === "codex" ? config.codex : config.gemini;
-    if (!entry?.accessToken) {
+    if (!_optionalChain([entry, 'optionalAccess', _13 => _13.accessToken])) {
       return { providerId: this.providerId, ok: false, reason: "missing-credential" };
     }
     if (entry.status === "expired") {
@@ -92,7 +305,7 @@ var OAuthBearerAuthStrategy = class {
   async resolveAccessToken() {
     const config = await this.tokens.getFullConfig();
     const entry = this.providerId === "codex" ? config.codex : config.gemini;
-    if (!entry?.accessToken) return null;
+    if (!_optionalChain([entry, 'optionalAccess', _14 => _14.accessToken])) return null;
     const expiresAtMs = entry.expiresAt ? new Date(entry.expiresAt).getTime() : 0;
     const expiringSoon = expiresAtMs > 0 && Date.now() >= expiresAtMs - REFRESH_LEAD_MS;
     if (expiringSoon && entry.refreshToken) {
@@ -102,29 +315,42 @@ var OAuthBearerAuthStrategy = class {
       if (!refreshed) return null;
       const fresh = await this.tokens.getFullConfig();
       const freshEntry = this.providerId === "codex" ? fresh.codex : fresh.gemini;
-      return freshEntry?.accessToken ?? null;
+      return _nullishCoalesce(_optionalChain([freshEntry, 'optionalAccess', _15 => _15.accessToken]), () => ( null));
     }
     if (entry.status === "expired") return null;
     return entry.accessToken;
   }
-};
+}, _class2);
 
 // src/auth/PassThroughAuthStrategy.ts
-var PassThroughAuthStrategy = class {
-  constructor(tokens, mutex) {
+var PassThroughAuthStrategy = (_class3 = class {
+  constructor(tokens, mutex, selector, health) {;_class3.prototype.__init5.call(this);_class3.prototype.__init6.call(this);
     this.tokens = tokens;
     this.mutex = mutex;
-  }
-  tokens;
-  mutex;
-  kind = "pass-through";
-  providerId = "claude";
-  async applyHeaders(headers, _hints) {
-    const token = await this.tokens.getValidClaudeAccessToken();
+    this.selector = selector;
+    this.health = health;
+  }
+  
+  
+  
+  
+  __init5() {this.kind = "pass-through"}
+  __init6() {this.providerId = "claude"}
+  async applyHeaders(headers, hints) {
+    const token = await resolveSelectedToken(
+      this.selector,
+      this.tokens,
+      "claude",
+      _optionalChain([hints, 'optionalAccess', _16 => _16.sessionKey]),
+      () => this.tokens.getValidClaudeAccessToken(),
+      { health: this.health, reportSelection: _optionalChain([hints, 'optionalAccess', _17 => _17.reportSelection]), resolvedModel: _optionalChain([hints, 'optionalAccess', _18 => _18.resolvedModel]) }
+    );
     if (!token) return;
     headers["Authorization"] = `Bearer ${token}`;
   }
-  async onUnauthorized() {
+  async onUnauthorized(sessionKey) {
+    const byId = await refreshSelectedAccount(this.selector, this.tokens, this.mutex, "claude", sessionKey);
+    if (byId !== null) return byId;
     return this.mutex.run("claude:refresh", async () => {
       try {
         return await this.tokens.refreshClaudeToken();
@@ -137,7 +363,7 @@ var PassThroughAuthStrategy = class {
   async describeStatus() {
     const config = await this.tokens.getFullConfig();
     const claude = config.claude;
-    if (!claude?.accessToken) {
+    if (!_optionalChain([claude, 'optionalAccess', _19 => _19.accessToken])) {
       return { providerId: "claude", ok: false, reason: "missing-credential" };
     }
     if (claude.status === "expired") {
@@ -150,11 +376,11 @@ var PassThroughAuthStrategy = class {
     }
     return { providerId: "claude", ok: true, expiresAt: claude.expiresAt };
   }
-};
+}, _class3);
 
 // src/auth/RefreshMutex.ts
-var RefreshMutex = class {
-  inflight = /* @__PURE__ */ new Map();
+var RefreshMutex = (_class4 = class {constructor() { _class4.prototype.__init7.call(this); }
+  __init7() {this.inflight = /* @__PURE__ */ new Map()}
   /**
    * Run `task()` exclusively for `key`. If another caller is already running
    * for the same key, this call awaits the existing promise instead of
@@ -173,34 +399,45 @@ var RefreshMutex = class {
     this.inflight.set(key, promise);
     return promise;
   }
-};
+}, _class4);
 
 // src/auth/StaticBearerAuthStrategy.ts
 var ANTHROPIC_SHAPE_PATH = "/v1/messages";
-var StaticBearerAuthStrategy = class {
-  constructor(tokens) {
+var StaticBearerAuthStrategy = (_class5 = class {
+  constructor(tokens, selector, health) {;_class5.prototype.__init8.call(this);_class5.prototype.__init9.call(this);
     this.tokens = tokens;
-  }
-  tokens;
-  kind = "static-bearer";
-  providerId = "opencodego";
+    this.selector = selector;
+    this.health = health;
+  }
+  
+  
+  
+  __init8() {this.kind = "static-bearer"}
+  __init9() {this.providerId = "opencodego"}
   async applyHeaders(headers, hints) {
-    const key = await this.tokens.getValidOpenCodeGoApiKey();
+    const key = await resolveSelectedToken(
+      this.selector,
+      this.tokens,
+      "opencodego",
+      _optionalChain([hints, 'optionalAccess', _20 => _20.sessionKey]),
+      () => this.tokens.getValidOpenCodeGoApiKey(),
+      { health: this.health, reportSelection: _optionalChain([hints, 'optionalAccess', _21 => _21.reportSelection]), resolvedModel: _optionalChain([hints, 'optionalAccess', _22 => _22.resolvedModel]) }
+    );
     if (!key) {
       return;
     }
     headers["Authorization"] = `Bearer ${key}`;
-    if (hints?.upstreamUrl?.includes(ANTHROPIC_SHAPE_PATH)) {
+    if (_optionalChain([hints, 'optionalAccess', _23 => _23.upstreamUrl, 'optionalAccess', _24 => _24.includes, 'call', _25 => _25(ANTHROPIC_SHAPE_PATH)])) {
       headers["x-api-key"] = key;
     }
   }
-  async onUnauthorized() {
+  async onUnauthorized(_sessionKey) {
     return false;
   }
   async describeStatus() {
     const config = await this.tokens.getFullConfig();
     const oc = config.opencodego;
-    if (!oc?.apiKey) {
+    if (!_optionalChain([oc, 'optionalAccess', _26 => _26.apiKey])) {
       return { providerId: "opencodego", ok: false, reason: "missing-credential" };
     }
     if (oc.status === "error") {
@@ -208,7 +445,7 @@ var StaticBearerAuthStrategy = class {
     }
     return { providerId: "opencodego", ok: true };
   }
-};
+}, _class5);
 
 // src/SubscriptionAccountService.ts
 var DISPLAY_NAMES = {
@@ -217,20 +454,24 @@ var DISPLAY_NAMES = {
   gemini: "Gemini (Google OAuth)",
   opencodego: "OpenCodeGo (Bearer key)"
 };
-var SubscriptionAccountService = class {
-  mutex = new RefreshMutex();
-  strategies;
-  constructor(tokens) {
+var SubscriptionAccountService = (_class6 = class {
+  __init10() {this.mutex = new RefreshMutex()}
+  /** ONE account-pool scheduler (subscription-account-scheduling) shared by all
+   *  four strategies so they share the affinity map + the `lastUsedAt` overlay. */
+  __init11() {this.selector = new SubscriptionAccountSelector()}
+  
+  constructor(tokens) {;_class6.prototype.__init10.call(this);_class6.prototype.__init11.call(this);
+    const health = _SubscriptionAccountHealth.getSharedAccountHealth.call(void 0, );
     this.strategies = /* @__PURE__ */ new Map([
-      ["claude", new PassThroughAuthStrategy(tokens, this.mutex)],
-      ["codex", new OAuthBearerAuthStrategy("codex", tokens, this.mutex)],
-      ["gemini", new OAuthBearerAuthStrategy("gemini", tokens, this.mutex)],
-      ["opencodego", new StaticBearerAuthStrategy(tokens)]
+      ["claude", new PassThroughAuthStrategy(tokens, this.mutex, this.selector, health)],
+      ["codex", new OAuthBearerAuthStrategy("codex", tokens, this.mutex, this.selector, health)],
+      ["gemini", new OAuthBearerAuthStrategy("gemini", tokens, this.mutex, this.selector, health)],
+      ["opencodego", new StaticBearerAuthStrategy(tokens, this.selector, health)]
     ]);
   }
   /** Returns the strategy bound to a subscription provider, or `null` for unknown ids. */
   getStrategy(providerId) {
-    return this.strategies.get(providerId) ?? null;
+    return _nullishCoalesce(this.strategies.get(providerId), () => ( null));
   }
   /** Diagnostic for the `subscription:status` IPC. */
   async getStatus(providerId) {
@@ -253,7 +494,7 @@ var SubscriptionAccountService = class {
     }
     return entries;
   }
-};
+}, _class6);
 var _moduleSingleton = null;
 function setSubscriptionAccountService(svc) {
   _moduleSingleton = svc;
@@ -262,48 +503,32 @@ function getSubscriptionAccountService() {
   return _moduleSingleton;
 }
 
-// ../core/src/outbound-api/subscriptionRegistryPort.ts
-var _registry = null;
-function setSubscriptionRegistryForOutbound(registry) {
-  _registry = registry;
-}
+// src/SubscriptionProviderRegistry.ts
 
-// ../core/src/transformer/transformers/GeminiCodeAssistTransformer.ts
-var DEFAULT_CODE_ASSIST_ENDPOINT = "https://cloudcode-pa.googleapis.com";
-var DEFAULT_CODE_ASSIST_API_VERSION = "v1internal";
-function resolveCodeAssistEndpoint() {
-  return (process.env.CODE_ASSIST_ENDPOINT || DEFAULT_CODE_ASSIST_ENDPOINT).replace(/\/+$/, "");
-}
-function resolveCodeAssistApiVersion() {
-  return process.env.CODE_ASSIST_API_VERSION || DEFAULT_CODE_ASSIST_API_VERSION;
-}
-function buildCodeAssistUrl(stream) {
-  const base = resolveCodeAssistEndpoint();
-  const version = resolveCodeAssistApiVersion();
-  const method = stream ? "streamGenerateContent?alt=sse" : "generateContent";
-  return `${base}/${version}:${method}`;
-}
+
+var _subscriptionRegistryPort = require('@omnicross/core/outbound-api/subscriptionRegistryPort');
+var _GeminiCodeAssistTransformer = require('@omnicross/core/transformer/transformers/GeminiCodeAssistTransformer');
 
 // src/opencodego/CircuitBreaker.ts
-var CircuitBreaker = class {
-  state = "closed";
+var CircuitBreaker = (_class7 = class {
+  __init12() {this.state = "closed"}
   /** CONSECUTIVE failures while closed (reset by any closed success). */
-  failureCount = 0;
+  __init13() {this.failureCount = 0}
   /** Successes accumulated in the current half-open probe window. */
-  successCount = 0;
+  __init14() {this.successCount = 0}
   /** Test calls admitted in the current half-open window (cap = halfOpenMaxCalls). */
-  halfOpenCalls = 0;
+  __init15() {this.halfOpenCalls = 0}
   /** `now()` at the last recorded failure — drives the open→half-open elapsed check. */
-  lastFailureTime = 0;
-  threshold;
-  openMs;
-  halfOpenMaxCalls;
-  now;
-  constructor(opts = {}) {
-    this.threshold = opts.threshold ?? 3;
-    this.openMs = opts.openMs ?? 3e4;
-    this.halfOpenMaxCalls = opts.halfOpenMaxCalls ?? 3;
-    this.now = opts.now ?? Date.now;
+  __init16() {this.lastFailureTime = 0}
+  
+  
+  
+  
+  constructor(opts = {}) {;_class7.prototype.__init12.call(this);_class7.prototype.__init13.call(this);_class7.prototype.__init14.call(this);_class7.prototype.__init15.call(this);_class7.prototype.__init16.call(this);
+    this.threshold = _nullishCoalesce(opts.threshold, () => ( 3));
+    this.openMs = _nullishCoalesce(opts.openMs, () => ( 3e4));
+    this.halfOpenMaxCalls = _nullishCoalesce(opts.halfOpenMaxCalls, () => ( 3));
+    this.now = _nullishCoalesce(opts.now, () => ( Date.now));
   }
   /** Current state (diagnostics / tests). */
   getState() {
@@ -382,13 +607,13 @@ var CircuitBreaker = class {
       this.state = "open";
     }
   }
-};
-var CircuitBreakerRegistry = class {
-  constructor(options = {}) {
+}, _class7);
+var CircuitBreakerRegistry = (_class8 = class {
+  constructor(options = {}) {;_class8.prototype.__init17.call(this);
     this.options = options;
   }
-  options;
-  breakers = /* @__PURE__ */ new Map();
+  
+  __init17() {this.breakers = /* @__PURE__ */ new Map()}
   /** Get (or lazily create) the breaker for a model id. */
   get(modelId) {
     let breaker = this.breakers.get(modelId);
@@ -410,7 +635,7 @@ var CircuitBreakerRegistry = class {
   recordFailure(modelId) {
     this.get(modelId).recordFailure();
   }
-};
+}, _class8);
 
 // src/opencodego/defaults.ts
 var DEFAULT_OPENCODEGO_LONG_CONTEXT_THRESHOLD = 8e4;
@@ -545,7 +770,7 @@ function classifyZenShape(modelId) {
   return "chat";
 }
 function resolveOpenCodeGoShape(entry) {
-  const half = entry.provider ?? "go";
+  const half = _nullishCoalesce(entry.provider, () => ( "go"));
   if (half === "zen") return classifyZenShape(entry.modelId);
   const normalized = entry.modelId.toLowerCase();
   if (GO_ANTHROPIC_SHAPE_PREFIXES.some((p) => normalized.startsWith(p))) {
@@ -555,12 +780,12 @@ function resolveOpenCodeGoShape(entry) {
 }
 function resolveOpenCodeGoHalf(modelId, config) {
   if (!config) return "go";
-  for (const entry of Object.values(config.modelMap ?? {})) {
-    if (entry?.modelId === modelId) return entry.provider ?? "go";
+  for (const entry of Object.values(_nullishCoalesce(config.modelMap, () => ( {})))) {
+    if (_optionalChain([entry, 'optionalAccess', _27 => _27.modelId]) === modelId) return _nullishCoalesce(entry.provider, () => ( "go"));
   }
-  for (const list of Object.values(config.fallbacks ?? {})) {
-    for (const entry of list ?? []) {
-      if (entry?.modelId === modelId) return entry.provider ?? "go";
+  for (const list of Object.values(_nullishCoalesce(config.fallbacks, () => ( {})))) {
+    for (const entry of _nullishCoalesce(list, () => ( []))) {
+      if (_optionalChain([entry, 'optionalAccess', _28 => _28.modelId]) === modelId) return _nullishCoalesce(entry.provider, () => ( "go"));
     }
   }
   return "go";
@@ -660,11 +885,11 @@ function hasBackgroundPattern(loweredSlices) {
   return containsAny(loweredSlices, BACKGROUND_KEYWORDS);
 }
 function resolveOpenCodeGoScenario(summary, config) {
-  const longContextThreshold = config?.modelMap?.long_context?.contextThreshold ?? DEFAULT_OPENCODEGO_LONG_CONTEXT_THRESHOLD;
+  const longContextThreshold = _nullishCoalesce(_optionalChain([config, 'optionalAccess', _29 => _29.modelMap, 'optionalAccess', _30 => _30.long_context, 'optionalAccess', _31 => _31.contextThreshold]), () => ( DEFAULT_OPENCODEGO_LONG_CONTEXT_THRESHOLD));
   if (summary.estimatedInputTokens >= longContextThreshold) {
     return "long_context";
   }
-  const rawSlices = summary.matchText ?? [];
+  const rawSlices = _nullishCoalesce(summary.matchText, () => ( []));
   const loweredSlices = toLowerSlices(summary.matchText);
   if (hasComplexPattern(loweredSlices)) return "complex";
   if (hasThinkingPattern(loweredSlices, rawSlices)) return "think";
@@ -692,8 +917,8 @@ function resolveOpenCodeGoTarget(modelId, config) {
   const shape = resolveOpenCodeGoShape({ provider: half, modelId });
   return { half, shape };
 }
-var SubscriptionProviderRegistry = class {
-  constructor(accounts, tokens) {
+var SubscriptionProviderRegistry = (_class9 = class {
+  constructor(accounts, tokens) {;_class9.prototype.__init18.call(this);
     this.accounts = accounts;
     this.tokens = tokens;
     const claude = this.accounts.getStrategy("claude");
@@ -765,7 +990,7 @@ var SubscriptionProviderRegistry = class {
           // (resolved once per account via `GeminiCodeAssistProjectResolver`).
           // `resolveUpstreamUrl` ignores the model (Code Assist has no per-model
           // path); the URL is the version-segment colon-method endpoint.
-          resolveUpstreamUrl: (_model) => buildCodeAssistUrl(false),
+          resolveUpstreamUrl: (_model) => _GeminiCodeAssistTransformer.buildCodeAssistUrl.call(void 0, false),
           providerTransformerNames: ["gemini-code-assist"],
           modelTransformerNames: []
         }
@@ -790,7 +1015,7 @@ var SubscriptionProviderRegistry = class {
           resolveUpstreamUrl: (model, config) => {
             const oc = config;
             const { half, shape } = resolveOpenCodeGoTarget(model, oc);
-            const override = half === "zen" ? oc?.zenBaseUrl : oc?.baseUrl;
+            const override = half === "zen" ? _optionalChain([oc, 'optionalAccess', _32 => _32.zenBaseUrl]) : _optionalChain([oc, 'optionalAccess', _33 => _33.baseUrl]);
             return buildOpenCodeGoUrl(half, shape, override);
           },
           // zen seam (Decision 3): vary the provider transformer chain by resolved
@@ -808,7 +1033,7 @@ var SubscriptionProviderRegistry = class {
           modelTransformerNames: [],
           modelMapper: (sdkModel, summary, config) => {
             const scenario = resolveOpenCodeGoScenario(summary, config);
-            const entry = config?.modelMap?.[scenario] ?? config?.modelMap?.default ?? DEFAULT_OPENCODEGO_MODEL_MAP[scenario] ?? DEFAULT_OPENCODEGO_MODEL_MAP.default;
+            const entry = _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_optionalChain([config, 'optionalAccess', _34 => _34.modelMap, 'optionalAccess', _35 => _35[scenario]]), () => ( _optionalChain([config, 'optionalAccess', _36 => _36.modelMap, 'optionalAccess', _37 => _37.default]))), () => ( DEFAULT_OPENCODEGO_MODEL_MAP[scenario])), () => ( DEFAULT_OPENCODEGO_MODEL_MAP.default));
             if (!entry) {
               return { resolvedModel: sdkModel, scenario };
             }
@@ -827,7 +1052,7 @@ var SubscriptionProviderRegistry = class {
           // wedge permanently in half-open). When NO circuit is open this returns
           // the same first non-attempted entry as the prior `!attempted` filter.
           nextFallback: (scenario, attempted, config) => {
-            const list = config?.fallbacks?.[scenario] ?? DEFAULT_OPENCODEGO_FALLBACKS[scenario] ?? [];
+            const list = _nullishCoalesce(_nullishCoalesce(_optionalChain([config, 'optionalAccess', _38 => _38.fallbacks, 'optionalAccess', _39 => _39[scenario]]), () => ( DEFAULT_OPENCODEGO_FALLBACKS[scenario])), () => ( []));
             for (const entry of list) {
               if (attempted.includes(entry.modelId)) continue;
               if (this.breaker.allowRequest(entry.modelId)) return entry;
@@ -846,9 +1071,9 @@ var SubscriptionProviderRegistry = class {
       ]
     ]);
   }
-  accounts;
-  tokens;
-  profiles;
+  
+  
+  
   /**
    * Per-model circuit breaker for opencodego routing (D5). ONE registry-owned
    * process singleton, built here and captured by the opencodego profile's
@@ -858,12 +1083,12 @@ var SubscriptionProviderRegistry = class {
    * exactly the reference's long-lived `FallbackHandler`. Constructed with the
    * default reference thresholds (3 / 30s / 3) and the default `Date.now` clock.
    */
-  breaker = new CircuitBreakerRegistry();
+  __init18() {this.breaker = new CircuitBreakerRegistry()}
   /** Returns the dispatch profile for a known subscription provider, or
    *  `null` for unknown ids (callers must treat null as "fall back to the
    *  legacy LLM provider DB lookup"). */
   getProfile(providerId) {
-    return this.profiles.get(providerId) ?? null;
+    return _nullishCoalesce(this.profiles.get(providerId), () => ( null));
   }
   /** Read the currently-stored OpenCodeGo config so the proxy can pick up
    *  user overrides (modelMap / fallbacks / baseUrl). Wraps the injected
@@ -873,116 +1098,24 @@ var SubscriptionProviderRegistry = class {
     const full = await this.tokens.getFullConfig();
     return full.opencodego;
   }
-};
+}, _class9);
 var _moduleSingleton2 = null;
 function setSubscriptionProviderRegistry(svc) {
   _moduleSingleton2 = svc;
-  setSubscriptionRegistryForOutbound(svc ?? null);
+  _subscriptionRegistryPort.setSubscriptionRegistryForOutbound.call(void 0, _nullishCoalesce(svc, () => ( null)));
 }
 function getSubscriptionProviderRegistry() {
   return _moduleSingleton2;
 }
 
-// ../core/src/ports/gemini-code-assist-resolver.ts
-var resolver = null;
-function getGeminiCodeAssistResolver() {
-  return resolver;
-}
+// src/SubscriptionDispatcher.ts
+var _geminicodeassistresolver = require('@omnicross/core/ports/gemini-code-assist-resolver');
+
 
-// ../core/src/provider-proxy/matchText.ts
-var MATCH_TEXT_PER_MESSAGE_CAP = 8192;
-var MATCH_TEXT_RECENT_MESSAGES = 6;
-function flattenMatchText(value) {
-  if (typeof value === "string") return value;
-  if (Array.isArray(value)) {
-    const parts = [];
-    for (const item of value) {
-      const text = flattenMatchText(item);
-      if (text) parts.push(text);
-    }
-    return parts.join("\n");
-  }
-  if (value && typeof value === "object") {
-    const obj = value;
-    if (obj.type === "tool_result" && obj.content !== void 0) {
-      return flattenMatchText(obj.content);
-    }
-    if (typeof obj.text === "string") return obj.text;
-  }
-  return "";
-}
-function collectMatchText(anthropicBody) {
-  const messages = Array.isArray(anthropicBody.messages) ? anthropicBody.messages : [];
-  const slices = [];
-  const sys = flattenMatchText(anthropicBody.system).trim();
-  if (sys) slices.push(sys.slice(0, MATCH_TEXT_PER_MESSAGE_CAP));
-  const recent = [];
-  for (let i = messages.length - 1; i >= 0 && recent.length < MATCH_TEXT_RECENT_MESSAGES; i--) {
-    const message = messages[i];
-    if (!message || typeof message !== "object") continue;
-    const role = message.role;
-    if (role !== "user" && role !== "system") continue;
-    const text = flattenMatchText(message.content).trim();
-    if (text) recent.push(text.slice(0, MATCH_TEXT_PER_MESSAGE_CAP));
-  }
-  for (let i = recent.length - 1; i >= 0; i--) slices.push(recent[i]);
-  return slices;
-}
 
-// ../core/src/serializeError.ts
-function serializeError(err) {
-  if (err == null) return "Unknown error (null)";
-  if (err instanceof Error) {
-    let msg = err.message || err.name || "Error";
-    if (err.cause) {
-      msg += ` [cause: ${serializeError(err.cause)}]`;
-    }
-    const anyErr = err;
-    if (anyErr.status != null) msg += ` (status: ${anyErr.status})`;
-    else if (anyErr.code != null) msg += ` (code: ${anyErr.code})`;
-    return msg;
-  }
-  if (typeof err === "string") return err || "Empty error string";
-  if (typeof err !== "object") return String(err);
-  const obj = err;
-  if (typeof obj.message === "string" && obj.message) {
-    let msg = obj.message;
-    if (obj.status != null) msg += ` (status: ${obj.status})`;
-    else if (obj.code != null) msg += ` (code: ${obj.code})`;
-    if (typeof obj.type === "string") msg += ` [type: ${obj.type}]`;
-    return msg;
-  }
-  if (typeof obj.error === "string" && obj.error) {
-    return obj.error;
-  }
-  if (obj.error && typeof obj.error === "object") {
-    const inner = obj.error;
-    if (typeof inner.message === "string" && inner.message) {
-      let msg = inner.message;
-      if (typeof inner.type === "string") msg += ` [type: ${inner.type}]`;
-      return msg;
-    }
-  }
-  try {
-    const json = JSON.stringify(err, getCircularReplacer(), 2);
-    if (json && json.length > 1e3) {
-      return json.slice(0, 1e3) + "... (truncated)";
-    }
-    return json || "Unserializable error";
-  } catch {
-    return `Unserializable error: ${Object.prototype.toString.call(err)}`;
-  }
-}
-function getCircularReplacer() {
-  const seen = /* @__PURE__ */ new WeakSet();
-  return (_key, value) => {
-    if (typeof value === "object" && value !== null) {
-      if (seen.has(value)) return "[Circular]";
-      seen.add(value);
-    }
-    return value;
-  };
-}
+
+var _matchText = require('@omnicross/core/provider-proxy/matchText');
+var _serializeError = require('@omnicross/core/serializeError');
 
 // src/opencodego/token-count.ts
 var cachedEncode = null;
@@ -1001,14 +1134,15 @@ var SubscriptionDispatcher = class {
     this.hooks = hooks;
     this.getOpenCodeGoConfig = getOpenCodeGoConfig;
   }
-  profile;
-  hooks;
-  getOpenCodeGoConfig;
+  
+  
+  
   /**
    * Entry point — called by the host proxy's request handler after model
    * resolution and probe-detection.
    */
   async dispatch(req) {
+    const sessionKey = _matchText.deriveSubscriptionSessionKey.call(void 0, req.anthropicBody);
     const ocConfig = this.profile.providerId === "opencodego" ? await this.getOpenCodeGoConfig() : void 0;
     let scenario = "default";
     let resolvedModel = req.fallbackModel;
@@ -1019,7 +1153,7 @@ var SubscriptionDispatcher = class {
       scenario = mapped.scenario;
       req.anthropicBody.model = resolvedModel;
     }
-    const upstreamUrl = this.profile.resolveUpstreamUrl?.(resolvedModel, ocConfig);
+    const upstreamUrl = _optionalChain([this, 'access', _40 => _40.profile, 'access', _41 => _41.resolveUpstreamUrl, 'optionalCall', _42 => _42(resolvedModel, ocConfig)]);
     if (!upstreamUrl) {
       throw new Error(`[SubscriptionDispatcher] profile=${this.profile.providerId} missing resolveUpstreamUrl`);
     }
@@ -1027,55 +1161,67 @@ var SubscriptionDispatcher = class {
       provider: resolveOpenCodeGoHalf(resolvedModel, ocConfig),
       modelId: resolvedModel
     }) === "anthropic") {
-      await this.dispatchAnthropicShapeBypass(req, upstreamUrl, resolvedModel, scenario, ocConfig);
+      await this.dispatchAnthropicShapeBypass(req, upstreamUrl, resolvedModel, scenario, ocConfig, sessionKey);
       return;
     }
-    await this.dispatchTransformerChain(req, upstreamUrl, resolvedModel, scenario, ocConfig);
+    await this.dispatchTransformerChain(req, upstreamUrl, resolvedModel, scenario, ocConfig, sessionKey);
   }
   /** Bypass path for OpenCodeGo MiniMax models — forwards Anthropic body verbatim. */
-  async dispatchAnthropicShapeBypass(req, upstreamUrl, resolvedModel, scenario, ocConfig) {
+  async dispatchAnthropicShapeBypass(req, upstreamUrl, resolvedModel, scenario, ocConfig, sessionKey) {
     const gate = this.gatePrimaryModel(resolvedModel, scenario, ocConfig);
     const attempted = gate.attempted;
     let currentModel = gate.firstModel;
+    let usedAccountId;
+    const reportSelection = (accountId) => {
+      usedAccountId = accountId;
+    };
     while (attempted.length < MAX_FALLBACK_ATTEMPTS_LOCAL) {
       attempted.push(currentModel);
       req.anthropicBody.model = currentModel;
       const headers = { "content-type": "application/json" };
-      await this.applyHeadersWithRetry(headers, { upstreamUrl, resolvedModel: currentModel });
+      await this.applyHeadersWithRetry(headers, { upstreamUrl, resolvedModel: currentModel, sessionKey, reportSelection });
       console.info(
         `[AgentProxy:subscription] REQ#${req.reqId} | opencodego anthropic-shape -> ${upstreamUrl} model=${currentModel} attempt=${attempted.length}`
       );
       try {
         const upstream = await this.hooks.fetchWithRetry(upstreamUrl, headers, req.anthropicBody, currentModel);
-        this.profile.recordModelOutcome?.(currentModel, true);
+        _optionalChain([this, 'access', _43 => _43.profile, 'access', _44 => _44.recordModelOutcome, 'optionalCall', _45 => _45(currentModel, true)]);
+        this.markHealth(usedAccountId, 200);
         await this.hooks.writeProxyResponse(req.res, upstream, req.isStream, req.reqId);
         return;
       } catch (err) {
-        const handled = await this.maybeRetryAfterError(err, headers, req, currentModel);
+        const handled = await this.maybeRetryAfterError(err, headers, req, currentModel, sessionKey);
         if (handled.retryOnce) {
-          const upstream = await this.hooks.fetchWithRetry(upstreamUrl, handled.headers, req.anthropicBody, currentModel);
-          this.profile.recordModelOutcome?.(currentModel, true);
-          await this.hooks.writeProxyResponse(req.res, upstream, req.isStream, req.reqId);
-          return;
+          try {
+            const upstream = await this.hooks.fetchWithRetry(upstreamUrl, handled.headers, req.anthropicBody, currentModel);
+            _optionalChain([this, 'access', _46 => _46.profile, 'access', _47 => _47.recordModelOutcome, 'optionalCall', _48 => _48(currentModel, true)]);
+            this.markHealth(usedAccountId, 200);
+            await this.hooks.writeProxyResponse(req.res, upstream, req.isStream, req.reqId);
+            return;
+          } catch (retryErr) {
+            this.markHealth(usedAccountId, errStatus(retryErr), retryErr);
+            throw retryErr;
+          }
         }
         if (caughtErrorBreakerOutcome(err) === "failure") {
-          this.profile.recordModelOutcome?.(currentModel, false);
+          _optionalChain([this, 'access', _49 => _49.profile, 'access', _50 => _50.recordModelOutcome, 'optionalCall', _51 => _51(currentModel, false)]);
         }
-        const next = this.profile.nextFallback?.(scenario, attempted, ocConfig);
+        this.markHealth(usedAccountId, errStatus(err), err);
+        const next = _optionalChain([this, 'access', _52 => _52.profile, 'access', _53 => _53.nextFallback, 'optionalCall', _54 => _54(scenario, attempted, ocConfig)]);
         if (!next || attempted.length >= MAX_FALLBACK_ATTEMPTS_LOCAL) {
           throw err;
         }
         console.warn(
           `[AgentProxy:subscription] REQ#${req.reqId} | opencodego fallback ${currentModel} -> ${next.modelId} after error:`,
-          serializeError(err)
+          _serializeError.serializeError.call(void 0, err)
         );
         currentModel = next.modelId;
       }
     }
   }
   /** Standard subscription transformer chain — Codex/Gemini/OpenCodeGo OpenAI-shape. */
-  async dispatchTransformerChain(req, upstreamUrl, resolvedModel, scenario, ocConfig) {
-    const providerNames = this.profile.resolveProviderTransformerNames?.(resolvedModel, ocConfig) ?? this.profile.providerTransformerNames;
+  async dispatchTransformerChain(req, upstreamUrl, resolvedModel, scenario, ocConfig, sessionKey) {
+    const providerNames = _nullishCoalesce(_optionalChain([this, 'access', _55 => _55.profile, 'access', _56 => _56.resolveProviderTransformerNames, 'optionalCall', _57 => _57(resolvedModel, ocConfig)]), () => ( this.profile.providerTransformerNames));
     const providerTransformers = this.resolveTransformers(providerNames);
     const modelTransformers = this.resolveTransformers(this.profile.modelTransformerNames);
     const transformerProvider = {
@@ -1091,6 +1237,10 @@ var SubscriptionDispatcher = class {
     const gate = this.gatePrimaryModel(resolvedModel, scenario, ocConfig);
     const attempted = gate.attempted;
     let currentModel = gate.firstModel;
+    let usedAccountId;
+    const reportSelection = (accountId) => {
+      usedAccountId = accountId;
+    };
     while (attempted.length < MAX_FALLBACK_ATTEMPTS_LOCAL) {
       attempted.push(currentModel);
       req.anthropicBody.model = currentModel;
@@ -1105,14 +1255,15 @@ var SubscriptionDispatcher = class {
         ...config.headers
       };
       stripAuthHeaders(headers);
-      await this.applyHeadersWithRetry(headers, { upstreamUrl, resolvedModel: currentModel });
-      const fetchUrl = usesResponsesChain(providerNames) ? upstreamUrl : resolveConfigUrl(config.url) ?? upstreamUrl;
+      await this.applyHeadersWithRetry(headers, { upstreamUrl, resolvedModel: currentModel, sessionKey, reportSelection });
+      const fetchUrl = usesResponsesChain(providerNames) ? upstreamUrl : _nullishCoalesce(resolveConfigUrl(config.url), () => ( upstreamUrl));
       console.info(
         `[AgentProxy:subscription] REQ#${req.reqId} | provider=${this.profile.providerId} -> ${fetchUrl} model=${currentModel} attempt=${attempted.length}`
       );
       try {
         const upstream = await this.hooks.fetchWithRetry(fetchUrl, headers, requestBody, currentModel);
-        this.profile.recordModelOutcome?.(currentModel, true);
+        _optionalChain([this, 'access', _58 => _58.profile, 'access', _59 => _59.recordModelOutcome, 'optionalCall', _60 => _60(currentModel, true)]);
+        this.markHealth(usedAccountId, 200);
         const finalResponse = await this.hooks.executor.executeResponseChain(
           requestBody,
           upstream,
@@ -1123,30 +1274,37 @@ var SubscriptionDispatcher = class {
         await this.hooks.writeProxyResponse(req.res, finalResponse, req.isStream, req.reqId);
         return;
       } catch (err) {
-        const handled = await this.maybeRetryAfterError(err, headers, req, currentModel);
+        const handled = await this.maybeRetryAfterError(err, headers, req, currentModel, sessionKey);
         if (handled.retryOnce) {
-          const upstream = await this.hooks.fetchWithRetry(fetchUrl, handled.headers, requestBody, currentModel);
-          this.profile.recordModelOutcome?.(currentModel, true);
-          const finalResponse = await this.hooks.executor.executeResponseChain(
-            requestBody,
-            upstream,
-            transformerProvider,
-            { providerTransformers, modelTransformers },
-            { endpointTransformer: this.hooks.endpointTransformer }
-          );
-          await this.hooks.writeProxyResponse(req.res, finalResponse, req.isStream, req.reqId);
-          return;
+          try {
+            const upstream = await this.hooks.fetchWithRetry(fetchUrl, handled.headers, requestBody, currentModel);
+            _optionalChain([this, 'access', _61 => _61.profile, 'access', _62 => _62.recordModelOutcome, 'optionalCall', _63 => _63(currentModel, true)]);
+            this.markHealth(usedAccountId, 200);
+            const finalResponse = await this.hooks.executor.executeResponseChain(
+              requestBody,
+              upstream,
+              transformerProvider,
+              { providerTransformers, modelTransformers },
+              { endpointTransformer: this.hooks.endpointTransformer }
+            );
+            await this.hooks.writeProxyResponse(req.res, finalResponse, req.isStream, req.reqId);
+            return;
+          } catch (retryErr) {
+            this.markHealth(usedAccountId, errStatus(retryErr), retryErr);
+            throw retryErr;
+          }
         }
         if (caughtErrorBreakerOutcome(err) === "failure") {
-          this.profile.recordModelOutcome?.(currentModel, false);
+          _optionalChain([this, 'access', _64 => _64.profile, 'access', _65 => _65.recordModelOutcome, 'optionalCall', _66 => _66(currentModel, false)]);
         }
-        const next = this.profile.nextFallback?.(scenario, attempted, ocConfig);
+        this.markHealth(usedAccountId, errStatus(err), err);
+        const next = _optionalChain([this, 'access', _67 => _67.profile, 'access', _68 => _68.nextFallback, 'optionalCall', _69 => _69(scenario, attempted, ocConfig)]);
         if (!next || attempted.length >= MAX_FALLBACK_ATTEMPTS_LOCAL) {
           throw err;
         }
         console.warn(
           `[AgentProxy:subscription] REQ#${req.reqId} | ${this.profile.providerId} fallback ${currentModel} -> ${next.modelId} after error:`,
-          serializeError(err)
+          _serializeError.serializeError.call(void 0, err)
         );
         currentModel = next.modelId;
       }
@@ -1170,7 +1328,7 @@ var SubscriptionDispatcher = class {
       return { firstModel: primaryModel, attempted: [] };
     }
     const skipped = [primaryModel];
-    const firstAdmitting = this.profile.nextFallback?.(scenario, skipped, ocConfig);
+    const firstAdmitting = _optionalChain([this, 'access', _70 => _70.profile, 'access', _71 => _71.nextFallback, 'optionalCall', _72 => _72(scenario, skipped, ocConfig)]);
     if (firstAdmitting) {
       console.warn(
         `[AgentProxy:subscription] opencodego primary ${primaryModel} circuit open -> first admitting fallback ${firstAdmitting.modelId}`
@@ -1187,12 +1345,12 @@ var SubscriptionDispatcher = class {
    * Returns `{ retryOnce: true, headers }` when the strategy refreshed
    * successfully (caller should retry once); otherwise re-throws.
    */
-  async maybeRetryAfterError(err, headers, req, resolvedModel) {
-    const status = err?.status ?? 0;
+  async maybeRetryAfterError(err, headers, req, resolvedModel, sessionKey) {
+    const status = _nullishCoalesce(_optionalChain([err, 'optionalAccess', _73 => _73.status]), () => ( 0));
     if (status !== 401) {
       return { retryOnce: false, headers };
     }
-    const refreshed = await this.profile.authStrategy.onUnauthorized();
+    const refreshed = await this.profile.authStrategy.onUnauthorized(sessionKey);
     if (!refreshed) {
       console.warn(
         `[AgentProxy:subscription] REQ#${req.reqId} | 401 not recoverable for provider=${this.profile.providerId}`
@@ -1201,16 +1359,38 @@ var SubscriptionDispatcher = class {
     }
     const fresh = { ...headers };
     stripAuthHeaders(fresh);
-    await this.applyHeadersWithRetry(fresh, { upstreamUrl: "", resolvedModel });
+    await this.applyHeadersWithRetry(fresh, { upstreamUrl: "", resolvedModel, sessionKey });
     return { retryOnce: true, headers: fresh };
   }
   async applyHeadersWithRetry(headers, hints) {
     try {
       await this.profile.authStrategy.applyHeaders(headers, hints);
     } catch (err) {
-      console.warn("[AgentProxy:subscription] authStrategy.applyHeaders threw:", serializeError(err));
+      console.warn("[AgentProxy:subscription] authStrategy.applyHeaders threw:", _serializeError.serializeError.call(void 0, err));
     }
   }
+  /**
+   * Mark the served account's health against ONE attempt's outcome
+   * (subscription-account-health, task 3.4). No-op when no account was reported
+   * (non-pooled / single-account) or on a session-cancel (status 0). On a caught
+   * error `err` is passed so the 429-reset / 403-ban drivers are read STRUCTURALLY
+   * from the error's upstream `headers` + `bodyText` (the `fetchWithRetry`
+   * contract) — so daemon-path 429 cooldown + ban blocking function for
+   * multi-account codex/gemini/opencodego pools; absent headers ⇒ a bare-429
+   * (unmarked, lazy re-probe). Success (2xx) clears; 401/5xx/thrown → transient.
+   */
+  markHealth(accountId, status, err) {
+    if (accountId === void 0 || status === 0) return;
+    const headers = err !== void 0 ? errHeaders(err) : void 0;
+    const reset = headers ? _SubscriptionAccountHealth.resolveResetSeconds.call(void 0, this.profile.providerId, headers) : { resetHeaderSeconds: null, retryAfterSeconds: null };
+    const bodyText = status === 403 && err !== void 0 ? errBodyText(err) : void 0;
+    _SubscriptionAccountHealth.getSharedAccountHealth.call(void 0, ).recordUpstreamOutcome(this.profile.providerId, accountId, {
+      status,
+      resetHeaderSeconds: reset.resetHeaderSeconds,
+      retryAfterSeconds: reset.retryAfterSeconds,
+      bodyText
+    });
+  }
   /**
    * Resolve the Code Assist project for the gemini subscription profile. Pulls
    * the Bearer the bound `AuthStrategy` would inject (so the strategy stays the
@@ -1222,12 +1402,12 @@ var SubscriptionDispatcher = class {
   async resolveGeminiProject() {
     const probe = {};
     await this.applyHeadersWithRetry(probe, { upstreamUrl: "", resolvedModel: "" });
-    const bearer = probe.Authorization ?? probe.authorization ?? "";
+    const bearer = _nullishCoalesce(_nullishCoalesce(probe.Authorization, () => ( probe.authorization)), () => ( ""));
     const accessToken = bearer.replace(/^Bearer\s+/i, "").trim();
     if (!accessToken) return void 0;
-    const resolver2 = getGeminiCodeAssistResolver();
-    if (!resolver2) return void 0;
-    return resolver2.resolveProject(accessToken);
+    const resolver = _geminicodeassistresolver.getGeminiCodeAssistResolver.call(void 0, );
+    if (!resolver) return void 0;
+    return resolver.resolveProject(accessToken);
   }
   resolveTransformers(names) {
     if (!names || names.length === 0) return [];
@@ -1253,7 +1433,7 @@ var SubscriptionDispatcher = class {
     } else if (Array.isArray(system)) {
       for (const block of system) {
         if (block && typeof block === "object" && "text" in block) {
-          totalChars += String(block.text ?? "").length;
+          totalChars += String(_nullishCoalesce(block.text, () => ( ""))).length;
         }
       }
     }
@@ -1282,13 +1462,29 @@ var SubscriptionDispatcher = class {
       // and the core `/v1/messages` path produce IDENTICAL `matchText` for the
       // same body — equivalence by construction. `@omnicross/subscriptions` →
       // `@omnicross/core` is the allowed direction; core imports nothing back.
-      matchText: collectMatchText(anthropicBody)
+      matchText: _matchText.collectMatchText.call(void 0, anthropicBody)
     };
   }
 };
 var MAX_FALLBACK_ATTEMPTS_LOCAL = 3;
+function errStatus(err) {
+  const status = _optionalChain([err, 'optionalAccess', _74 => _74.status]);
+  return typeof status === "number" ? status : null;
+}
+function errHeaders(err) {
+  const h = _optionalChain([err, 'optionalAccess', _75 => _75.headers]);
+  if (!h) return void 0;
+  if (typeof h.get === "function") return h;
+  if (typeof h === "object") return h;
+  return void 0;
+}
+function errBodyText(err) {
+  const e = err;
+  const raw = typeof _optionalChain([e, 'optionalAccess', _76 => _76.bodyText]) === "string" ? e.bodyText : typeof _optionalChain([e, 'optionalAccess', _77 => _77.body]) === "string" ? e.body : void 0;
+  return _optionalChain([raw, 'optionalAccess', _78 => _78.slice, 'call', _79 => _79(0, 2048)]);
+}
 function caughtErrorBreakerOutcome(err) {
-  const status = err?.status;
+  const status = _optionalChain([err, 'optionalAccess', _80 => _80.status]);
   if (typeof status !== "number") return "failure";
   if (status === 0) return "neutral";
   if (status >= 500 || status === 429) return "failure";
@@ -1312,368 +1508,18 @@ function stripAuthHeaders(headers) {
   delete headers["X-Goog-Api-Key"];
 }
 
-// src/oauth/flows/claude.ts
-var claude_exports = {};
-__export(claude_exports, {
-  exchangeCodeForTokens: () => exchangeCodeForTokens,
-  exchangeSetupTokenCode: () => exchangeSetupTokenCode,
-  generateAuthParams: () => generateAuthParams,
-  generateSetupTokenParams: () => generateSetupTokenParams,
-  refreshAccessToken: () => refreshAccessToken
-});
-var import_node_crypto = __toESM(require("crypto"), 1);
 
-// src/oauth/fetchPort.ts
-function errorMessage(error, errorDescription) {
-  if (errorDescription) return errorDescription;
-  if (typeof error === "string") return error;
-  if (error && typeof error === "object") {
-    const e = error;
-    if (typeof e.message === "string" && e.message) return e.message;
-    if (typeof e.error_description === "string" && e.error_description) {
-      return e.error_description;
-    }
-    return JSON.stringify(error);
-  }
-  return String(error);
-}
-async function postForm(fetchImpl, url, params, parseErrorMessage) {
-  const response = await fetchImpl(url, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: params.toString()
-  });
-  const responseData = await response.text();
-  let data;
-  try {
-    data = JSON.parse(responseData);
-  } catch {
-    throw new Error(parseErrorMessage);
-  }
-  if (data.error) {
-    throw new Error(errorMessage(data.error, data.error_description));
-  }
-  return data;
-}
-async function postJson(fetchImpl, url, body, parseErrorMessage, extraHeaders = {}) {
-  const response = await fetchImpl(url, {
-    method: "POST",
-    headers: { "Content-Type": "application/json", ...extraHeaders },
-    body: JSON.stringify(body)
-  });
-  const responseData = await response.text();
-  let data;
-  try {
-    data = JSON.parse(responseData);
-  } catch {
-    throw new Error(parseErrorMessage);
-  }
-  if (data.error) {
-    throw new Error(errorMessage(data.error, data.error_description));
-  }
-  return data;
-}
 
-// src/oauth/flows/claude.ts
-var CLAUDE_TOKEN_HEADERS = {
-  "User-Agent": "claude-cli/1.0.56 (external, cli)",
-  Accept: "application/json, text/plain, */*",
-  "Accept-Language": "en-US,en;q=0.9",
-  Referer: "https://claude.ai/",
-  Origin: "https://claude.ai"
-};
-var CLAUDE_OAUTH_CONFIG = {
-  clientId: "9d1c250a-e61b-44d9-88ed-5944d1962f5e",
-  authorizationEndpoint: "https://claude.ai/oauth/authorize",
-  // The token endpoint stays on console.anthropic.com (still the live value —
-  // matches the official Claude Code CLI / claude-relay-service reference); only
-  // the OAuth callback moved to platform.claude.com (2026). The redirect_uri MUST
-  // match what the client is registered for AND match between authorize + token
-  // exchange. Scopes mirror the live Claude Code authorize URL.
-  tokenEndpoint: "https://console.anthropic.com/v1/oauth/token",
-  redirectUri: "https://platform.claude.com/oauth/code/callback",
-  scopes: [
-    "org:create_api_key",
-    "user:profile",
-    "user:inference",
-    "user:sessions:claude_code",
-    "user:mcp_servers",
-    "user:file_upload"
-  ]
-};
-var SETUP_TOKEN_CONFIG = {
-  scopes: ["user:inference"]
-  // Only inference permission, no API key creation
-};
-function generatePkce() {
-  const codeVerifier = import_node_crypto.default.randomBytes(32).toString("base64url");
-  const codeChallenge = import_node_crypto.default.createHash("sha256").update(codeVerifier).digest("base64url");
-  const state = import_node_crypto.default.randomBytes(16).toString("hex");
-  return { codeVerifier, codeChallenge, state };
-}
-function generateAuthParams() {
-  const { codeVerifier, codeChallenge, state } = generatePkce();
-  const params = new URLSearchParams({
-    code: "true",
-    client_id: CLAUDE_OAUTH_CONFIG.clientId,
-    response_type: "code",
-    redirect_uri: CLAUDE_OAUTH_CONFIG.redirectUri,
-    scope: CLAUDE_OAUTH_CONFIG.scopes.join(" "),
-    code_challenge: codeChallenge,
-    code_challenge_method: "S256",
-    state
-  });
-  const authUrl = `${CLAUDE_OAUTH_CONFIG.authorizationEndpoint}?${params.toString()}`;
-  return { authUrl, codeVerifier, state };
-}
-function generateSetupTokenParams() {
-  const { codeVerifier, codeChallenge, state } = generatePkce();
-  const params = new URLSearchParams({
-    code: "true",
-    client_id: CLAUDE_OAUTH_CONFIG.clientId,
-    response_type: "code",
-    redirect_uri: CLAUDE_OAUTH_CONFIG.redirectUri,
-    scope: SETUP_TOKEN_CONFIG.scopes.join(" "),
-    code_challenge: codeChallenge,
-    code_challenge_method: "S256",
-    state
-  });
-  const authUrl = `${CLAUDE_OAUTH_CONFIG.authorizationEndpoint}?${params.toString()}`;
-  return { authUrl, codeVerifier, state };
-}
-async function exchangeCodeForTokens(request, fetchImpl) {
-  const { authorizationCode, codeVerifier, state } = request;
-  const code = authorizationCode.split("#")[0]?.split("&")[0] ?? authorizationCode;
-  const data = await postJson(
-    fetchImpl,
-    CLAUDE_OAUTH_CONFIG.tokenEndpoint,
-    {
-      grant_type: "authorization_code",
-      client_id: CLAUDE_OAUTH_CONFIG.clientId,
-      code,
-      code_verifier: codeVerifier,
-      redirect_uri: CLAUDE_OAUTH_CONFIG.redirectUri,
-      state
-    },
-    "Failed to parse token response",
-    CLAUDE_TOKEN_HEADERS
-  );
-  return {
-    accessToken: data.access_token,
-    // The authorization_code grant always returns a refresh_token; the original
-    // helper read it from an untyped `data` and declared the field `string`.
-    refreshToken: data.refresh_token,
-    expiresIn: data.expires_in,
-    scopes: data.scope?.split(" ") || CLAUDE_OAUTH_CONFIG.scopes
-  };
-}
-async function exchangeSetupTokenCode(request, fetchImpl) {
-  const { authorizationCode, codeVerifier, state } = request;
-  const code = authorizationCode.split("#")[0]?.split("&")[0] ?? authorizationCode;
-  const data = await postJson(
-    fetchImpl,
-    CLAUDE_OAUTH_CONFIG.tokenEndpoint,
-    {
-      grant_type: "authorization_code",
-      client_id: CLAUDE_OAUTH_CONFIG.clientId,
-      code,
-      code_verifier: codeVerifier,
-      redirect_uri: CLAUDE_OAUTH_CONFIG.redirectUri,
-      state
-    },
-    "Failed to parse setup token response",
-    CLAUDE_TOKEN_HEADERS
-  );
-  return {
-    accessToken: data.access_token,
-    expiresIn: data.expires_in,
-    scopes: data.scope?.split(" ") || SETUP_TOKEN_CONFIG.scopes
-  };
-}
-async function refreshAccessToken(refreshToken, fetchImpl) {
-  const data = await postJson(
-    fetchImpl,
-    CLAUDE_OAUTH_CONFIG.tokenEndpoint,
-    {
-      grant_type: "refresh_token",
-      client_id: CLAUDE_OAUTH_CONFIG.clientId,
-      refresh_token: refreshToken
-    },
-    "Failed to parse refresh response",
-    CLAUDE_TOKEN_HEADERS
-  );
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token || refreshToken,
-    expiresIn: data.expires_in
-  };
-}
 
-// src/oauth/flows/codex.ts
-var codex_exports = {};
-__export(codex_exports, {
-  exchangeCodeForTokens: () => exchangeCodeForTokens2,
-  generateAuthParams: () => generateAuthParams2,
-  refreshAccessToken: () => refreshAccessToken2
-});
-var import_node_crypto2 = __toESM(require("crypto"), 1);
-var CODEX_OAUTH_CONFIG = {
-  clientId: "app_EMoamEEZ73f0CkXaXp7hrann",
-  authorizationEndpoint: "https://auth.openai.com/oauth/authorize",
-  tokenEndpoint: "https://auth.openai.com/oauth/token",
-  redirectUri: "http://localhost:1455/auth/callback",
-  scopes: ["openid", "profile", "email", "offline_access"]
-};
-function generateAuthParams2() {
-  const codeVerifier = import_node_crypto2.default.randomBytes(64).toString("hex");
-  const codeChallenge = import_node_crypto2.default.createHash("sha256").update(codeVerifier).digest("base64url");
-  const state = import_node_crypto2.default.randomBytes(16).toString("hex");
-  const params = new URLSearchParams({
-    response_type: "code",
-    client_id: CODEX_OAUTH_CONFIG.clientId,
-    redirect_uri: CODEX_OAUTH_CONFIG.redirectUri,
-    scope: CODEX_OAUTH_CONFIG.scopes.join(" "),
-    code_challenge: codeChallenge,
-    code_challenge_method: "S256",
-    state
-  });
-  const authUrl = `${CODEX_OAUTH_CONFIG.authorizationEndpoint}?${params.toString()}`;
-  return { authUrl, codeVerifier, state };
-}
-async function exchangeCodeForTokens2(request, fetchImpl) {
-  const { authorizationCode, codeVerifier } = request;
-  const params = new URLSearchParams({
-    grant_type: "authorization_code",
-    client_id: CODEX_OAUTH_CONFIG.clientId,
-    code: authorizationCode,
-    code_verifier: codeVerifier,
-    redirect_uri: CODEX_OAUTH_CONFIG.redirectUri
-  });
-  const data = await postForm(
-    fetchImpl,
-    CODEX_OAUTH_CONFIG.tokenEndpoint,
-    params,
-    "Failed to parse token response"
-  );
-  return {
-    accessToken: data.access_token,
-    // authorization_code grant returns both; the original helper read them from
-    // an untyped `data` and declared the fields `string`.
-    refreshToken: data.refresh_token,
-    idToken: data.id_token,
-    expiresIn: data.expires_in
-  };
-}
-async function refreshAccessToken2(refreshToken, fetchImpl) {
-  const params = new URLSearchParams({
-    grant_type: "refresh_token",
-    client_id: CODEX_OAUTH_CONFIG.clientId,
-    refresh_token: refreshToken,
-    scope: "openid profile email"
-  });
-  const data = await postForm(
-    fetchImpl,
-    CODEX_OAUTH_CONFIG.tokenEndpoint,
-    params,
-    "Failed to parse refresh response"
-  );
-  return {
-    accessToken: data.access_token,
-    idToken: data.id_token,
-    refreshToken: data.refresh_token || refreshToken,
-    expiresIn: data.expires_in || 3600
-  };
-}
 
-// src/oauth/flows/gemini.ts
-var gemini_exports = {};
-__export(gemini_exports, {
-  exchangeCodeForTokens: () => exchangeCodeForTokens3,
-  generateAuthParams: () => generateAuthParams3,
-  refreshAccessToken: () => refreshAccessToken3
-});
-var import_node_crypto3 = __toESM(require("crypto"), 1);
-var GEMINI_OAUTH_CONFIG = {
-  clientId: "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com",
-  // The Gemini CLI's *public* installed-app OAuth client secret (mirrors the
-  // upstream CLI). Per Google's OAuth docs, native-app client secrets are not
-  // treated as confidential — not a leaked key.
-  clientSecret: "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",
-  // allowlist-secret
-  authorizationEndpoint: "https://accounts.google.com/o/oauth2/v2/auth",
-  tokenEndpoint: "https://oauth2.googleapis.com/token",
-  redirectUri: "urn:ietf:wg:oauth:2.0:oob",
-  scopes: ["https://www.googleapis.com/auth/cloud-platform"]
-};
-function generateAuthParams3() {
-  const codeVerifier = import_node_crypto3.default.randomBytes(32).toString("base64url");
-  const codeChallenge = import_node_crypto3.default.createHash("sha256").update(codeVerifier).digest("base64url");
-  const state = import_node_crypto3.default.randomBytes(16).toString("hex");
-  const params = new URLSearchParams({
-    client_id: GEMINI_OAUTH_CONFIG.clientId,
-    redirect_uri: GEMINI_OAUTH_CONFIG.redirectUri,
-    scope: GEMINI_OAUTH_CONFIG.scopes.join(" "),
-    response_type: "code",
-    code_challenge: codeChallenge,
-    code_challenge_method: "S256",
-    state,
-    access_type: "offline",
-    prompt: "consent"
-  });
-  const authUrl = `${GEMINI_OAUTH_CONFIG.authorizationEndpoint}?${params.toString()}`;
-  return { authUrl, codeVerifier, state };
-}
-async function exchangeCodeForTokens3(authorizationCode, codeVerifier, fetchImpl) {
-  const params = new URLSearchParams({
-    grant_type: "authorization_code",
-    client_id: GEMINI_OAUTH_CONFIG.clientId,
-    client_secret: GEMINI_OAUTH_CONFIG.clientSecret,
-    code: authorizationCode,
-    code_verifier: codeVerifier,
-    redirect_uri: GEMINI_OAUTH_CONFIG.redirectUri
-  });
-  const data = await postForm(
-    fetchImpl,
-    GEMINI_OAUTH_CONFIG.tokenEndpoint,
-    params,
-    "Failed to parse token response"
-  );
-  return {
-    accessToken: data.access_token,
-    // authorization_code grant returns a refresh_token; the original helper read
-    // it from an untyped `data` and declared the field `string`.
-    refreshToken: data.refresh_token,
-    expiresIn: data.expires_in
-  };
-}
-async function refreshAccessToken3(refreshToken, fetchImpl) {
-  const params = new URLSearchParams({
-    grant_type: "refresh_token",
-    client_id: GEMINI_OAUTH_CONFIG.clientId,
-    client_secret: GEMINI_OAUTH_CONFIG.clientSecret,
-    refresh_token: refreshToken
-  });
-  const data = await postForm(
-    fetchImpl,
-    GEMINI_OAUTH_CONFIG.tokenEndpoint,
-    params,
-    "Failed to parse refresh response"
-  );
-  return {
-    accessToken: data.access_token,
-    expiresIn: data.expires_in
-  };
-}
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  SubscriptionAccountService,
-  SubscriptionDispatcher,
-  SubscriptionProviderRegistry,
-  claudeOAuth,
-  codexOAuth,
-  geminiOAuth,
-  getSubscriptionAccountService,
-  getSubscriptionProviderRegistry,
-  setSubscriptionAccountService,
-  setSubscriptionProviderRegistry
-});
+
+
+
+
+
+
+
+
+
+
+exports.DEFAULT_ACCOUNT_PRIORITY = DEFAULT_ACCOUNT_PRIORITY; exports.LAST_USED_PERSIST_THROTTLE_MS = LAST_USED_PERSIST_THROTTLE_MS; exports.SESSION_AFFINITY_TTL_MS = SESSION_AFFINITY_TTL_MS; exports.SubscriptionAccountSelector = SubscriptionAccountSelector; exports.SubscriptionAccountService = SubscriptionAccountService; exports.SubscriptionDispatcher = SubscriptionDispatcher; exports.SubscriptionProviderRegistry = SubscriptionProviderRegistry; exports.claudeOAuth = _chunkTPW5Q25Ycjs.claude_exports; exports.codexOAuth = _chunkTPW5Q25Ycjs.codex_exports; exports.geminiOAuth = _chunkTPW5Q25Ycjs.gemini_exports; exports.getSubscriptionAccountService = getSubscriptionAccountService; exports.getSubscriptionProviderRegistry = getSubscriptionProviderRegistry; exports.setSubscriptionAccountService = setSubscriptionAccountService; exports.setSubscriptionProviderRegistry = setSubscriptionProviderRegistry;