@omnicross/subscriptions 0.1.0 → 0.1.3

package/dist/index.js

@@ -1,29 +1,281 @@
-var __defProp = Object.defineProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
+import {
+  claude_exports,
+  codex_exports,
+  gemini_exports
+} from "./chunk-IXGHVMZB.js";
+
+// src/scheduler/SubscriptionAccountSelector.ts
+var SESSION_AFFINITY_TTL_MS = 36e5;
+var LAST_USED_PERSIST_THROTTLE_MS = 6e4;
+var DEFAULT_ACCOUNT_PRIORITY = 50;
+function scopedKey(providerId, tail) {
+  return `${providerId}\0${tail}`;
+}
+function parseIso(iso) {
+  if (!iso) return 0;
+  const ms = Date.parse(iso);
+  return Number.isNaN(ms) ? 0 : ms;
+}
+var SubscriptionAccountSelector = class {
+  /** `providerId\0accountId → live lastUsedAt ms` (authoritative tie-break). */
+  lastUsedOverlay = /* @__PURE__ */ new Map();
+  /** `providerId\0sessionKey → { accountId, expiresAt }`. */
+  affinity = /* @__PURE__ */ new Map();
+  /** `providerId\0accountId → last durable-persist ms` (throttle state). */
+  lastPersist = /* @__PURE__ */ new Map();
+  /**
+   * Choose the account to serve this request, or `null` when there are ≤ 1
+   * schedulable accounts (the zero-regression signal — caller uses the active
+   * account). Updates the live `lastUsedAt` overlay for the chosen account and,
+   * when a `sessionKey` is given, records/extends the affinity mapping.
+   */
+  select(input) {
+    const now = input.now ?? Date.now();
+    const schedulable = input.accounts.filter((a) => a.schedulable !== false);
+    if (schedulable.length <= 1) return null;
+    if (input.sessionKey) {
+      const aKey = scopedKey(input.providerId, input.sessionKey);
+      const hit = this.affinity.get(aKey);
+      if (hit && hit.expiresAt > now && schedulable.some((a) => a.id === hit.accountId)) {
+        hit.expiresAt = now + SESSION_AFFINITY_TTL_MS;
+        this.markUsed(input.providerId, hit.accountId, now);
+        return { accountId: hit.accountId, isActive: hit.accountId === input.activeAccountId };
+      }
+    }
+    const chosen = this.pickOrdered(input.providerId, schedulable);
+    this.markUsed(input.providerId, chosen.id, now);
+    if (input.sessionKey) {
+      this.affinity.set(scopedKey(input.providerId, input.sessionKey), {
+        accountId: chosen.id,
+        expiresAt: now + SESSION_AFFINITY_TTL_MS
+      });
+    }
+    return { accountId: chosen.id, isActive: chosen.id === input.activeAccountId };
+  }
+  /**
+   * Drop every session-affinity mapping bound to this account (subscription-account-
+   * health, task 4.1). Called when a selected account's by-id token turns out
+   * null/invalid or an affinity-bound account becomes unhealthy, so the next
+   * selection for those sessions picks a fresh account instead of re-sticking to
+   * the bad one. O(affinity entries) — the map is tiny (one entry per live
+   * conversation).
+   */
+  evictAffinity(providerId, accountId) {
+    const prefix = `${providerId} `;
+    for (const [key, entry] of this.affinity) {
+      if (entry.accountId === accountId && key.startsWith(prefix)) {
+        this.affinity.delete(key);
+      }
+    }
+  }
+  /**
+   * Whether a best-effort `lastUsedAt` durable persist is DUE for this account
+   * (≥ `LAST_USED_PERSIST_THROTTLE_MS` since the last one). Records the persist
+   * time when it returns `true`, so the strategy calls `touchAccountLastUsed`
+   * sparingly and the request hot path does not rewrite the store every request.
+   */
+  duePersist(providerId, accountId, now = Date.now()) {
+    const key = scopedKey(providerId, accountId);
+    const last = this.lastPersist.get(key) ?? 0;
+    if (now - last < LAST_USED_PERSIST_THROTTLE_MS) return false;
+    this.lastPersist.set(key, now);
+    return true;
+  }
+  /** Sort by `priority` asc → effective `lastUsedAt` asc → `createdAt` asc → `[0]`. */
+  pickOrdered(providerId, accounts) {
+    const ranked = accounts.map((account) => ({
+      account,
+      priority: account.priority ?? DEFAULT_ACCOUNT_PRIORITY,
+      lastUsed: this.effectiveLastUsed(providerId, account),
+      created: parseIso(account.createdAt)
+    }));
+    ranked.sort(
+      (x, y) => x.priority - y.priority || x.lastUsed - y.lastUsed || x.created - y.created
+    );
+    return ranked[0].account;
+  }
+  /** The live tie-break value: the in-memory overlay when set, else the persisted
+   *  `lastUsedAt` (0 when absent). */
+  effectiveLastUsed(providerId, account) {
+    const overlay = this.lastUsedOverlay.get(scopedKey(providerId, account.id));
+    return overlay ?? parseIso(account.lastUsedAt);
+  }
+  markUsed(providerId, accountId, now) {
+    this.lastUsedOverlay.set(scopedKey(providerId, accountId), now);
+  }
+};
+
+// src/SubscriptionAccountService.ts
+import { getSharedAccountHealth } from "@omnicross/core/pipeline/SubscriptionAccountHealth";
+
+// src/scheduler/accountModelMap.ts
+function canonicalModelId(value) {
+  const idx = value.indexOf(",");
+  const bare = idx >= 0 ? value.slice(idx + 1) : value;
+  return bare.trim().toLowerCase();
+}
+function accountSupportsModel(supportedModels, model) {
+  if (!supportedModels) return true;
+  const target = canonicalModelId(model);
+  if (Array.isArray(supportedModels)) {
+    return supportedModels.some((m) => canonicalModelId(m) === target);
+  }
+  return Object.keys(supportedModels).some((k) => canonicalModelId(k) === target);
+}
+function remapForAccount(supportedModels, model) {
+  if (!supportedModels || Array.isArray(supportedModels)) return model;
+  const target = canonicalModelId(model);
+  for (const [key, actual] of Object.entries(supportedModels)) {
+    if (canonicalModelId(key) === target) return actual;
+  }
+  return model;
+}
+function remapReportForAccount(supportedModels, model) {
+  if (!model) return void 0;
+  const remapped = remapForAccount(supportedModels, model);
+  return remapped === model ? void 0 : remapped;
+}
+
+// src/scheduler/accountSelection.ts
+var ACCOUNTS_KEY = {
+  claude: "claudeAccounts",
+  codex: "codexAccounts",
+  gemini: "geminiAccounts",
+  opencodego: "opencodegoAccounts"
 };
+var ACTIVE_KEY = {
+  claude: "activeClaudeAccountId",
+  codex: "activeCodexAccountId",
+  gemini: "activeGeminiAccountId",
+  opencodego: "activeOpencodegoAccountId"
+};
+function gateSchedulable(accounts, providerId, health, now, resolvedModel, supportedModelsById) {
+  if (!health && !resolvedModel || accounts.length < 2) return accounts;
+  return accounts.map((a) => {
+    const healthOk = health ? health.isSchedulable(providerId, a.id, now) : true;
+    const modelOk = resolvedModel ? accountSupportsModel(supportedModelsById.get(a.id), resolvedModel) : true;
+    return { ...a, schedulable: healthOk && modelOk };
+  });
+}
+function isPoolGated(accounts, health, resolvedModel) {
+  return (health !== void 0 || resolvedModel !== void 0) && accounts.length >= 2;
+}
+function readSchedulableAccounts(config, providerId) {
+  const raw = config[ACCOUNTS_KEY[providerId]] ?? [];
+  const accounts = raw.map((a) => ({
+    id: a.id,
+    priority: a.priority,
+    lastUsedAt: a.lastUsedAt,
+    createdAt: a.createdAt
+  }));
+  const supportedModelsById = new Map(
+    raw.map((a) => [a.id, a.supportedModels])
+  );
+  const activeAccountId = config[ACTIVE_KEY[providerId]];
+  return { accounts, activeAccountId, supportedModelsById };
+}
+function pickByIdTarget(selector, gated, providerId, activeAccountId, sessionKey, now, healthGated) {
+  const selection = selector.select({ providerId, accounts: gated, activeAccountId, sessionKey, now });
+  if (selection && !selection.isActive) return selection.accountId;
+  if (selection === null && healthGated) {
+    const schedulable = gated.filter((a) => a.schedulable !== false);
+    if (schedulable.length === 1 && schedulable[0].id !== activeAccountId) return schedulable[0].id;
+  }
+  return void 0;
+}
+async function resolveSelectedToken(selector, tokens, providerId, sessionKey, activeGetter, ctx) {
+  const health = ctx?.health;
+  const report = ctx?.reportSelection;
+  const now = ctx?.now;
+  const resolvedModel = ctx?.resolvedModel;
+  if (selector && tokens.getAccessTokenForAccount) {
+    const config = await tokens.getFullConfig();
+    const { accounts, activeAccountId, supportedModelsById } = readSchedulableAccounts(config, providerId);
+    const gated = gateSchedulable(accounts, providerId, health, now, resolvedModel, supportedModelsById);
+    const poolGated = isPoolGated(accounts, health, resolvedModel);
+    const remapFor = (id) => remapReportForAccount(supportedModelsById.get(id), resolvedModel);
+    const targetId = pickByIdTarget(selector, gated, providerId, activeAccountId, sessionKey, now, poolGated);
+    if (targetId !== void 0) {
+      const byId = await tokens.getAccessTokenForAccount(providerId, targetId);
+      if (byId) {
+        maybeTouchLastUsed(selector, tokens, providerId, targetId);
+        report?.(targetId, false, remapFor(targetId));
+        return byId;
+      }
+      selector.evictAffinity(providerId, targetId);
+      health?.recordUpstreamOutcome(providerId, targetId, { status: 401, now });
+      const remaining = gated.filter((a) => a.id !== targetId);
+      const retryId = pickByIdTarget(selector, remaining, providerId, activeAccountId, sessionKey, now, poolGated);
+      if (retryId !== void 0) {
+        const retryToken = await tokens.getAccessTokenForAccount(providerId, retryId);
+        if (retryToken) {
+          maybeTouchLastUsed(selector, tokens, providerId, retryId);
+          report?.(retryId, false, remapFor(retryId));
+          return retryToken;
+        }
+      }
+    }
+    if (activeAccountId) report?.(activeAccountId, true, remapFor(activeAccountId));
+    return activeGetter();
+  }
+  return activeGetter();
+}
+function maybeTouchLastUsed(selector, tokens, providerId, accountId) {
+  if (!tokens.touchAccountLastUsed) return;
+  if (!selector.duePersist(providerId, accountId)) return;
+  void tokens.touchAccountLastUsed(providerId, accountId, (/* @__PURE__ */ new Date()).toISOString()).catch(() => {
+  });
+}
+async function refreshSelectedAccount(selector, tokens, mutex, providerId, sessionKey) {
+  if (!sessionKey || !selector || !tokens.refreshAccountToken) return null;
+  const config = await tokens.getFullConfig();
+  const { accounts, activeAccountId } = readSchedulableAccounts(config, providerId);
+  const selection = selector.select({ providerId, accounts, activeAccountId, sessionKey });
+  if (!selection || selection.isActive) return null;
+  const accountId = selection.accountId;
+  return mutex.run(`${providerId}:${accountId}`, async () => {
+    try {
+      return await tokens.refreshAccountToken(providerId, accountId) ?? false;
+    } catch (err) {
+      console.warn(`[accountSelection] ${providerId}:${accountId} by-id refresh failed:`, err);
+      return false;
+    }
+  });
+}
 
 // src/auth/OAuthBearerAuthStrategy.ts
 var REFRESH_LEAD_MS = 5 * 6e4;
 var OAuthBearerAuthStrategy = class {
-  constructor(providerId, tokens, mutex) {
+  constructor(providerId, tokens, mutex, selector, health) {
     this.tokens = tokens;
     this.mutex = mutex;
+    this.selector = selector;
+    this.health = health;
     this.providerId = providerId;
   }
   tokens;
   mutex;
+  selector;
+  health;
   kind = "oauth-bearer";
   providerId;
-  async applyHeaders(headers, _hints) {
-    const token = await this.resolveAccessToken();
+  async applyHeaders(headers, hints) {
+    const token = await resolveSelectedToken(
+      this.selector,
+      this.tokens,
+      this.providerId,
+      hints?.sessionKey,
+      () => this.resolveAccessToken(),
+      { health: this.health, reportSelection: hints?.reportSelection, resolvedModel: hints?.resolvedModel }
+    );
     if (!token) {
       return;
     }
     headers["Authorization"] = `Bearer ${token}`;
   }
-  async onUnauthorized() {
+  async onUnauthorized(sessionKey) {
+    const byId = await refreshSelectedAccount(this.selector, this.tokens, this.mutex, this.providerId, sessionKey);
+    if (byId !== null) return byId;
     return this.mutex.run(`${this.providerId}:refresh`, async () => {
       try {
         return this.providerId === "codex" ? await this.tokens.refreshCodexToken() : await this.tokens.refreshGeminiToken();
@@ -72,20 +324,33 @@ var OAuthBearerAuthStrategy = class {
 
 // src/auth/PassThroughAuthStrategy.ts
 var PassThroughAuthStrategy = class {
-  constructor(tokens, mutex) {
+  constructor(tokens, mutex, selector, health) {
     this.tokens = tokens;
     this.mutex = mutex;
+    this.selector = selector;
+    this.health = health;
   }
   tokens;
   mutex;
+  selector;
+  health;
   kind = "pass-through";
   providerId = "claude";
-  async applyHeaders(headers, _hints) {
-    const token = await this.tokens.getValidClaudeAccessToken();
+  async applyHeaders(headers, hints) {
+    const token = await resolveSelectedToken(
+      this.selector,
+      this.tokens,
+      "claude",
+      hints?.sessionKey,
+      () => this.tokens.getValidClaudeAccessToken(),
+      { health: this.health, reportSelection: hints?.reportSelection, resolvedModel: hints?.resolvedModel }
+    );
     if (!token) return;
     headers["Authorization"] = `Bearer ${token}`;
   }
-  async onUnauthorized() {
+  async onUnauthorized(sessionKey) {
+    const byId = await refreshSelectedAccount(this.selector, this.tokens, this.mutex, "claude", sessionKey);
+    if (byId !== null) return byId;
     return this.mutex.run("claude:refresh", async () => {
       try {
         return await this.tokens.refreshClaudeToken();
@@ -139,14 +404,25 @@ var RefreshMutex = class {
 // src/auth/StaticBearerAuthStrategy.ts
 var ANTHROPIC_SHAPE_PATH = "/v1/messages";
 var StaticBearerAuthStrategy = class {
-  constructor(tokens) {
+  constructor(tokens, selector, health) {
     this.tokens = tokens;
+    this.selector = selector;
+    this.health = health;
   }
   tokens;
+  selector;
+  health;
   kind = "static-bearer";
   providerId = "opencodego";
   async applyHeaders(headers, hints) {
-    const key = await this.tokens.getValidOpenCodeGoApiKey();
+    const key = await resolveSelectedToken(
+      this.selector,
+      this.tokens,
+      "opencodego",
+      hints?.sessionKey,
+      () => this.tokens.getValidOpenCodeGoApiKey(),
+      { health: this.health, reportSelection: hints?.reportSelection, resolvedModel: hints?.resolvedModel }
+    );
     if (!key) {
       return;
     }
@@ -155,7 +431,7 @@ var StaticBearerAuthStrategy = class {
       headers["x-api-key"] = key;
     }
   }
-  async onUnauthorized() {
+  async onUnauthorized(_sessionKey) {
     return false;
   }
   async describeStatus() {
@@ -180,13 +456,17 @@ var DISPLAY_NAMES = {
 };
 var SubscriptionAccountService = class {
   mutex = new RefreshMutex();
+  /** ONE account-pool scheduler (subscription-account-scheduling) shared by all
+   *  four strategies so they share the affinity map + the `lastUsedAt` overlay. */
+  selector = new SubscriptionAccountSelector();
   strategies;
   constructor(tokens) {
+    const health = getSharedAccountHealth();
     this.strategies = /* @__PURE__ */ new Map([
-      ["claude", new PassThroughAuthStrategy(tokens, this.mutex)],
-      ["codex", new OAuthBearerAuthStrategy("codex", tokens, this.mutex)],
-      ["gemini", new OAuthBearerAuthStrategy("gemini", tokens, this.mutex)],
-      ["opencodego", new StaticBearerAuthStrategy(tokens)]
+      ["claude", new PassThroughAuthStrategy(tokens, this.mutex, this.selector, health)],
+      ["codex", new OAuthBearerAuthStrategy("codex", tokens, this.mutex, this.selector, health)],
+      ["gemini", new OAuthBearerAuthStrategy("gemini", tokens, this.mutex, this.selector, health)],
+      ["opencodego", new StaticBearerAuthStrategy(tokens, this.selector, health)]
     ]);
   }
   /** Returns the strategy bound to a subscription provider, or `null` for unknown ids. */
@@ -223,27 +503,11 @@ function getSubscriptionAccountService() {
   return _moduleSingleton;
 }
 
-// ../core/src/outbound-api/subscriptionRegistryPort.ts
-var _registry = null;
-function setSubscriptionRegistryForOutbound(registry) {
-  _registry = registry;
-}
-
-// ../core/src/transformer/transformers/GeminiCodeAssistTransformer.ts
-var DEFAULT_CODE_ASSIST_ENDPOINT = "https://cloudcode-pa.googleapis.com";
-var DEFAULT_CODE_ASSIST_API_VERSION = "v1internal";
-function resolveCodeAssistEndpoint() {
-  return (process.env.CODE_ASSIST_ENDPOINT || DEFAULT_CODE_ASSIST_ENDPOINT).replace(/\/+$/, "");
-}
-function resolveCodeAssistApiVersion() {
-  return process.env.CODE_ASSIST_API_VERSION || DEFAULT_CODE_ASSIST_API_VERSION;
-}
-function buildCodeAssistUrl(stream) {
-  const base = resolveCodeAssistEndpoint();
-  const version = resolveCodeAssistApiVersion();
-  const method = stream ? "streamGenerateContent?alt=sse" : "generateContent";
-  return `${base}/${version}:${method}`;
-}
+// src/SubscriptionProviderRegistry.ts
+import {
+  setSubscriptionRegistryForOutbound
+} from "@omnicross/core/outbound-api/subscriptionRegistryPort";
+import { buildCodeAssistUrl } from "@omnicross/core/transformer/transformers/GeminiCodeAssistTransformer";
 
 // src/opencodego/CircuitBreaker.ts
 var CircuitBreaker = class {
@@ -844,106 +1108,14 @@ function getSubscriptionProviderRegistry() {
   return _moduleSingleton2;
 }
 
-// ../core/src/ports/gemini-code-assist-resolver.ts
-var resolver = null;
-function getGeminiCodeAssistResolver() {
-  return resolver;
-}
-
-// ../core/src/provider-proxy/matchText.ts
-var MATCH_TEXT_PER_MESSAGE_CAP = 8192;
-var MATCH_TEXT_RECENT_MESSAGES = 6;
-function flattenMatchText(value) {
-  if (typeof value === "string") return value;
-  if (Array.isArray(value)) {
-    const parts = [];
-    for (const item of value) {
-      const text = flattenMatchText(item);
-      if (text) parts.push(text);
-    }
-    return parts.join("\n");
-  }
-  if (value && typeof value === "object") {
-    const obj = value;
-    if (obj.type === "tool_result" && obj.content !== void 0) {
-      return flattenMatchText(obj.content);
-    }
-    if (typeof obj.text === "string") return obj.text;
-  }
-  return "";
-}
-function collectMatchText(anthropicBody) {
-  const messages = Array.isArray(anthropicBody.messages) ? anthropicBody.messages : [];
-  const slices = [];
-  const sys = flattenMatchText(anthropicBody.system).trim();
-  if (sys) slices.push(sys.slice(0, MATCH_TEXT_PER_MESSAGE_CAP));
-  const recent = [];
-  for (let i = messages.length - 1; i >= 0 && recent.length < MATCH_TEXT_RECENT_MESSAGES; i--) {
-    const message = messages[i];
-    if (!message || typeof message !== "object") continue;
-    const role = message.role;
-    if (role !== "user" && role !== "system") continue;
-    const text = flattenMatchText(message.content).trim();
-    if (text) recent.push(text.slice(0, MATCH_TEXT_PER_MESSAGE_CAP));
-  }
-  for (let i = recent.length - 1; i >= 0; i--) slices.push(recent[i]);
-  return slices;
-}
-
-// ../core/src/serializeError.ts
-function serializeError(err) {
-  if (err == null) return "Unknown error (null)";
-  if (err instanceof Error) {
-    let msg = err.message || err.name || "Error";
-    if (err.cause) {
-      msg += ` [cause: ${serializeError(err.cause)}]`;
-    }
-    const anyErr = err;
-    if (anyErr.status != null) msg += ` (status: ${anyErr.status})`;
-    else if (anyErr.code != null) msg += ` (code: ${anyErr.code})`;
-    return msg;
-  }
-  if (typeof err === "string") return err || "Empty error string";
-  if (typeof err !== "object") return String(err);
-  const obj = err;
-  if (typeof obj.message === "string" && obj.message) {
-    let msg = obj.message;
-    if (obj.status != null) msg += ` (status: ${obj.status})`;
-    else if (obj.code != null) msg += ` (code: ${obj.code})`;
-    if (typeof obj.type === "string") msg += ` [type: ${obj.type}]`;
-    return msg;
-  }
-  if (typeof obj.error === "string" && obj.error) {
-    return obj.error;
-  }
-  if (obj.error && typeof obj.error === "object") {
-    const inner = obj.error;
-    if (typeof inner.message === "string" && inner.message) {
-      let msg = inner.message;
-      if (typeof inner.type === "string") msg += ` [type: ${inner.type}]`;
-      return msg;
-    }
-  }
-  try {
-    const json = JSON.stringify(err, getCircularReplacer(), 2);
-    if (json && json.length > 1e3) {
-      return json.slice(0, 1e3) + "... (truncated)";
-    }
-    return json || "Unserializable error";
-  } catch {
-    return `Unserializable error: ${Object.prototype.toString.call(err)}`;
-  }
-}
-function getCircularReplacer() {
-  const seen = /* @__PURE__ */ new WeakSet();
-  return (_key, value) => {
-    if (typeof value === "object" && value !== null) {
-      if (seen.has(value)) return "[Circular]";
-      seen.add(value);
-    }
-    return value;
-  };
-}
+// src/SubscriptionDispatcher.ts
+import { getGeminiCodeAssistResolver } from "@omnicross/core/ports/gemini-code-assist-resolver";
+import {
+  getSharedAccountHealth as getSharedAccountHealth2,
+  resolveResetSeconds
+} from "@omnicross/core/pipeline/SubscriptionAccountHealth";
+import { collectMatchText, deriveSubscriptionSessionKey } from "@omnicross/core/provider-proxy/matchText";
+import { serializeError } from "@omnicross/core/serializeError";
 
 // src/opencodego/token-count.ts
 var cachedEncode = null;
@@ -970,6 +1142,7 @@ var SubscriptionDispatcher = class {
    * resolution and probe-detection.
    */
   async dispatch(req) {
+    const sessionKey = deriveSubscriptionSessionKey(req.anthropicBody);
     const ocConfig = this.profile.providerId === "opencodego" ? await this.getOpenCodeGoConfig() : void 0;
     let scenario = "default";
     let resolvedModel = req.fallbackModel;
@@ -988,40 +1161,52 @@ var SubscriptionDispatcher = class {
       provider: resolveOpenCodeGoHalf(resolvedModel, ocConfig),
       modelId: resolvedModel
     }) === "anthropic") {
-      await this.dispatchAnthropicShapeBypass(req, upstreamUrl, resolvedModel, scenario, ocConfig);
+      await this.dispatchAnthropicShapeBypass(req, upstreamUrl, resolvedModel, scenario, ocConfig, sessionKey);
       return;
     }
-    await this.dispatchTransformerChain(req, upstreamUrl, resolvedModel, scenario, ocConfig);
+    await this.dispatchTransformerChain(req, upstreamUrl, resolvedModel, scenario, ocConfig, sessionKey);
   }
   /** Bypass path for OpenCodeGo MiniMax models — forwards Anthropic body verbatim. */
-  async dispatchAnthropicShapeBypass(req, upstreamUrl, resolvedModel, scenario, ocConfig) {
+  async dispatchAnthropicShapeBypass(req, upstreamUrl, resolvedModel, scenario, ocConfig, sessionKey) {
     const gate = this.gatePrimaryModel(resolvedModel, scenario, ocConfig);
     const attempted = gate.attempted;
     let currentModel = gate.firstModel;
+    let usedAccountId;
+    const reportSelection = (accountId) => {
+      usedAccountId = accountId;
+    };
     while (attempted.length < MAX_FALLBACK_ATTEMPTS_LOCAL) {
       attempted.push(currentModel);
       req.anthropicBody.model = currentModel;
       const headers = { "content-type": "application/json" };
-      await this.applyHeadersWithRetry(headers, { upstreamUrl, resolvedModel: currentModel });
+      await this.applyHeadersWithRetry(headers, { upstreamUrl, resolvedModel: currentModel, sessionKey, reportSelection });
       console.info(
         `[AgentProxy:subscription] REQ#${req.reqId} | opencodego anthropic-shape -> ${upstreamUrl} model=${currentModel} attempt=${attempted.length}`
       );
       try {
         const upstream = await this.hooks.fetchWithRetry(upstreamUrl, headers, req.anthropicBody, currentModel);
         this.profile.recordModelOutcome?.(currentModel, true);
+        this.markHealth(usedAccountId, 200);
         await this.hooks.writeProxyResponse(req.res, upstream, req.isStream, req.reqId);
         return;
       } catch (err) {
-        const handled = await this.maybeRetryAfterError(err, headers, req, currentModel);
+        const handled = await this.maybeRetryAfterError(err, headers, req, currentModel, sessionKey);
         if (handled.retryOnce) {
-          const upstream = await this.hooks.fetchWithRetry(upstreamUrl, handled.headers, req.anthropicBody, currentModel);
-          this.profile.recordModelOutcome?.(currentModel, true);
-          await this.hooks.writeProxyResponse(req.res, upstream, req.isStream, req.reqId);
-          return;
+          try {
+            const upstream = await this.hooks.fetchWithRetry(upstreamUrl, handled.headers, req.anthropicBody, currentModel);
+            this.profile.recordModelOutcome?.(currentModel, true);
+            this.markHealth(usedAccountId, 200);
+            await this.hooks.writeProxyResponse(req.res, upstream, req.isStream, req.reqId);
+            return;
+          } catch (retryErr) {
+            this.markHealth(usedAccountId, errStatus(retryErr), retryErr);
+            throw retryErr;
+          }
         }
         if (caughtErrorBreakerOutcome(err) === "failure") {
           this.profile.recordModelOutcome?.(currentModel, false);
         }
+        this.markHealth(usedAccountId, errStatus(err), err);
         const next = this.profile.nextFallback?.(scenario, attempted, ocConfig);
         if (!next || attempted.length >= MAX_FALLBACK_ATTEMPTS_LOCAL) {
           throw err;
@@ -1035,7 +1220,7 @@ var SubscriptionDispatcher = class {
     }
   }
   /** Standard subscription transformer chain — Codex/Gemini/OpenCodeGo OpenAI-shape. */
-  async dispatchTransformerChain(req, upstreamUrl, resolvedModel, scenario, ocConfig) {
+  async dispatchTransformerChain(req, upstreamUrl, resolvedModel, scenario, ocConfig, sessionKey) {
     const providerNames = this.profile.resolveProviderTransformerNames?.(resolvedModel, ocConfig) ?? this.profile.providerTransformerNames;
     const providerTransformers = this.resolveTransformers(providerNames);
     const modelTransformers = this.resolveTransformers(this.profile.modelTransformerNames);
@@ -1052,6 +1237,10 @@ var SubscriptionDispatcher = class {
     const gate = this.gatePrimaryModel(resolvedModel, scenario, ocConfig);
     const attempted = gate.attempted;
     let currentModel = gate.firstModel;
+    let usedAccountId;
+    const reportSelection = (accountId) => {
+      usedAccountId = accountId;
+    };
     while (attempted.length < MAX_FALLBACK_ATTEMPTS_LOCAL) {
       attempted.push(currentModel);
       req.anthropicBody.model = currentModel;
@@ -1066,7 +1255,7 @@ var SubscriptionDispatcher = class {
         ...config.headers
       };
       stripAuthHeaders(headers);
-      await this.applyHeadersWithRetry(headers, { upstreamUrl, resolvedModel: currentModel });
+      await this.applyHeadersWithRetry(headers, { upstreamUrl, resolvedModel: currentModel, sessionKey, reportSelection });
       const fetchUrl = usesResponsesChain(providerNames) ? upstreamUrl : resolveConfigUrl(config.url) ?? upstreamUrl;
       console.info(
         `[AgentProxy:subscription] REQ#${req.reqId} | provider=${this.profile.providerId} -> ${fetchUrl} model=${currentModel} attempt=${attempted.length}`
@@ -1074,6 +1263,7 @@ var SubscriptionDispatcher = class {
       try {
         const upstream = await this.hooks.fetchWithRetry(fetchUrl, headers, requestBody, currentModel);
         this.profile.recordModelOutcome?.(currentModel, true);
+        this.markHealth(usedAccountId, 200);
         const finalResponse = await this.hooks.executor.executeResponseChain(
           requestBody,
           upstream,
@@ -1084,23 +1274,30 @@ var SubscriptionDispatcher = class {
         await this.hooks.writeProxyResponse(req.res, finalResponse, req.isStream, req.reqId);
         return;
       } catch (err) {
-        const handled = await this.maybeRetryAfterError(err, headers, req, currentModel);
+        const handled = await this.maybeRetryAfterError(err, headers, req, currentModel, sessionKey);
         if (handled.retryOnce) {
-          const upstream = await this.hooks.fetchWithRetry(fetchUrl, handled.headers, requestBody, currentModel);
-          this.profile.recordModelOutcome?.(currentModel, true);
-          const finalResponse = await this.hooks.executor.executeResponseChain(
-            requestBody,
-            upstream,
-            transformerProvider,
-            { providerTransformers, modelTransformers },
-            { endpointTransformer: this.hooks.endpointTransformer }
-          );
-          await this.hooks.writeProxyResponse(req.res, finalResponse, req.isStream, req.reqId);
-          return;
+          try {
+            const upstream = await this.hooks.fetchWithRetry(fetchUrl, handled.headers, requestBody, currentModel);
+            this.profile.recordModelOutcome?.(currentModel, true);
+            this.markHealth(usedAccountId, 200);
+            const finalResponse = await this.hooks.executor.executeResponseChain(
+              requestBody,
+              upstream,
+              transformerProvider,
+              { providerTransformers, modelTransformers },
+              { endpointTransformer: this.hooks.endpointTransformer }
+            );
+            await this.hooks.writeProxyResponse(req.res, finalResponse, req.isStream, req.reqId);
+            return;
+          } catch (retryErr) {
+            this.markHealth(usedAccountId, errStatus(retryErr), retryErr);
+            throw retryErr;
+          }
         }
         if (caughtErrorBreakerOutcome(err) === "failure") {
           this.profile.recordModelOutcome?.(currentModel, false);
         }
+        this.markHealth(usedAccountId, errStatus(err), err);
         const next = this.profile.nextFallback?.(scenario, attempted, ocConfig);
         if (!next || attempted.length >= MAX_FALLBACK_ATTEMPTS_LOCAL) {
           throw err;
@@ -1148,12 +1345,12 @@ var SubscriptionDispatcher = class {
    * Returns `{ retryOnce: true, headers }` when the strategy refreshed
    * successfully (caller should retry once); otherwise re-throws.
    */
-  async maybeRetryAfterError(err, headers, req, resolvedModel) {
+  async maybeRetryAfterError(err, headers, req, resolvedModel, sessionKey) {
     const status = err?.status ?? 0;
     if (status !== 401) {
       return { retryOnce: false, headers };
     }
-    const refreshed = await this.profile.authStrategy.onUnauthorized();
+    const refreshed = await this.profile.authStrategy.onUnauthorized(sessionKey);
     if (!refreshed) {
       console.warn(
         `[AgentProxy:subscription] REQ#${req.reqId} | 401 not recoverable for provider=${this.profile.providerId}`
@@ -1162,7 +1359,7 @@ var SubscriptionDispatcher = class {
     }
     const fresh = { ...headers };
     stripAuthHeaders(fresh);
-    await this.applyHeadersWithRetry(fresh, { upstreamUrl: "", resolvedModel });
+    await this.applyHeadersWithRetry(fresh, { upstreamUrl: "", resolvedModel, sessionKey });
     return { retryOnce: true, headers: fresh };
   }
   async applyHeadersWithRetry(headers, hints) {
@@ -1172,6 +1369,28 @@ var SubscriptionDispatcher = class {
       console.warn("[AgentProxy:subscription] authStrategy.applyHeaders threw:", serializeError(err));
     }
   }
+  /**
+   * Mark the served account's health against ONE attempt's outcome
+   * (subscription-account-health, task 3.4). No-op when no account was reported
+   * (non-pooled / single-account) or on a session-cancel (status 0). On a caught
+   * error `err` is passed so the 429-reset / 403-ban drivers are read STRUCTURALLY
+   * from the error's upstream `headers` + `bodyText` (the `fetchWithRetry`
+   * contract) — so daemon-path 429 cooldown + ban blocking function for
+   * multi-account codex/gemini/opencodego pools; absent headers ⇒ a bare-429
+   * (unmarked, lazy re-probe). Success (2xx) clears; 401/5xx/thrown → transient.
+   */
+  markHealth(accountId, status, err) {
+    if (accountId === void 0 || status === 0) return;
+    const headers = err !== void 0 ? errHeaders(err) : void 0;
+    const reset = headers ? resolveResetSeconds(this.profile.providerId, headers) : { resetHeaderSeconds: null, retryAfterSeconds: null };
+    const bodyText = status === 403 && err !== void 0 ? errBodyText(err) : void 0;
+    getSharedAccountHealth2().recordUpstreamOutcome(this.profile.providerId, accountId, {
+      status,
+      resetHeaderSeconds: reset.resetHeaderSeconds,
+      retryAfterSeconds: reset.retryAfterSeconds,
+      bodyText
+    });
+  }
   /**
    * Resolve the Code Assist project for the gemini subscription profile. Pulls
    * the Bearer the bound `AuthStrategy` would inject (so the strategy stays the
@@ -1186,9 +1405,9 @@ var SubscriptionDispatcher = class {
     const bearer = probe.Authorization ?? probe.authorization ?? "";
     const accessToken = bearer.replace(/^Bearer\s+/i, "").trim();
     if (!accessToken) return void 0;
-    const resolver2 = getGeminiCodeAssistResolver();
-    if (!resolver2) return void 0;
-    return resolver2.resolveProject(accessToken);
+    const resolver = getGeminiCodeAssistResolver();
+    if (!resolver) return void 0;
+    return resolver.resolveProject(accessToken);
   }
   resolveTransformers(names) {
     if (!names || names.length === 0) return [];
@@ -1248,6 +1467,22 @@ var SubscriptionDispatcher = class {
   }
 };
 var MAX_FALLBACK_ATTEMPTS_LOCAL = 3;
+function errStatus(err) {
+  const status = err?.status;
+  return typeof status === "number" ? status : null;
+}
+function errHeaders(err) {
+  const h = err?.headers;
+  if (!h) return void 0;
+  if (typeof h.get === "function") return h;
+  if (typeof h === "object") return h;
+  return void 0;
+}
+function errBodyText(err) {
+  const e = err;
+  const raw = typeof e?.bodyText === "string" ? e.bodyText : typeof e?.body === "string" ? e.body : void 0;
+  return raw?.slice(0, 2048);
+}
 function caughtErrorBreakerOutcome(err) {
   const status = err?.status;
   if (typeof status !== "number") return "failure";
@@ -1272,360 +1507,11 @@ function stripAuthHeaders(headers) {
   delete headers["x-goog-api-key"];
   delete headers["X-Goog-Api-Key"];
 }
-
-// src/oauth/flows/claude.ts
-var claude_exports = {};
-__export(claude_exports, {
-  exchangeCodeForTokens: () => exchangeCodeForTokens,
-  exchangeSetupTokenCode: () => exchangeSetupTokenCode,
-  generateAuthParams: () => generateAuthParams,
-  generateSetupTokenParams: () => generateSetupTokenParams,
-  refreshAccessToken: () => refreshAccessToken
-});
-import crypto from "crypto";
-
-// src/oauth/fetchPort.ts
-function errorMessage(error, errorDescription) {
-  if (errorDescription) return errorDescription;
-  if (typeof error === "string") return error;
-  if (error && typeof error === "object") {
-    const e = error;
-    if (typeof e.message === "string" && e.message) return e.message;
-    if (typeof e.error_description === "string" && e.error_description) {
-      return e.error_description;
-    }
-    return JSON.stringify(error);
-  }
-  return String(error);
-}
-async function postForm(fetchImpl, url, params, parseErrorMessage) {
-  const response = await fetchImpl(url, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: params.toString()
-  });
-  const responseData = await response.text();
-  let data;
-  try {
-    data = JSON.parse(responseData);
-  } catch {
-    throw new Error(parseErrorMessage);
-  }
-  if (data.error) {
-    throw new Error(errorMessage(data.error, data.error_description));
-  }
-  return data;
-}
-async function postJson(fetchImpl, url, body, parseErrorMessage, extraHeaders = {}) {
-  const response = await fetchImpl(url, {
-    method: "POST",
-    headers: { "Content-Type": "application/json", ...extraHeaders },
-    body: JSON.stringify(body)
-  });
-  const responseData = await response.text();
-  let data;
-  try {
-    data = JSON.parse(responseData);
-  } catch {
-    throw new Error(parseErrorMessage);
-  }
-  if (data.error) {
-    throw new Error(errorMessage(data.error, data.error_description));
-  }
-  return data;
-}
-
-// src/oauth/flows/claude.ts
-var CLAUDE_TOKEN_HEADERS = {
-  "User-Agent": "claude-cli/1.0.56 (external, cli)",
-  Accept: "application/json, text/plain, */*",
-  "Accept-Language": "en-US,en;q=0.9",
-  Referer: "https://claude.ai/",
-  Origin: "https://claude.ai"
-};
-var CLAUDE_OAUTH_CONFIG = {
-  clientId: "9d1c250a-e61b-44d9-88ed-5944d1962f5e",
-  authorizationEndpoint: "https://claude.ai/oauth/authorize",
-  // The token endpoint stays on console.anthropic.com (still the live value —
-  // matches the official Claude Code CLI / claude-relay-service reference); only
-  // the OAuth callback moved to platform.claude.com (2026). The redirect_uri MUST
-  // match what the client is registered for AND match between authorize + token
-  // exchange. Scopes mirror the live Claude Code authorize URL.
-  tokenEndpoint: "https://console.anthropic.com/v1/oauth/token",
-  redirectUri: "https://platform.claude.com/oauth/code/callback",
-  scopes: [
-    "org:create_api_key",
-    "user:profile",
-    "user:inference",
-    "user:sessions:claude_code",
-    "user:mcp_servers",
-    "user:file_upload"
-  ]
-};
-var SETUP_TOKEN_CONFIG = {
-  scopes: ["user:inference"]
-  // Only inference permission, no API key creation
-};
-function generatePkce() {
-  const codeVerifier = crypto.randomBytes(32).toString("base64url");
-  const codeChallenge = crypto.createHash("sha256").update(codeVerifier).digest("base64url");
-  const state = crypto.randomBytes(16).toString("hex");
-  return { codeVerifier, codeChallenge, state };
-}
-function generateAuthParams() {
-  const { codeVerifier, codeChallenge, state } = generatePkce();
-  const params = new URLSearchParams({
-    code: "true",
-    client_id: CLAUDE_OAUTH_CONFIG.clientId,
-    response_type: "code",
-    redirect_uri: CLAUDE_OAUTH_CONFIG.redirectUri,
-    scope: CLAUDE_OAUTH_CONFIG.scopes.join(" "),
-    code_challenge: codeChallenge,
-    code_challenge_method: "S256",
-    state
-  });
-  const authUrl = `${CLAUDE_OAUTH_CONFIG.authorizationEndpoint}?${params.toString()}`;
-  return { authUrl, codeVerifier, state };
-}
-function generateSetupTokenParams() {
-  const { codeVerifier, codeChallenge, state } = generatePkce();
-  const params = new URLSearchParams({
-    code: "true",
-    client_id: CLAUDE_OAUTH_CONFIG.clientId,
-    response_type: "code",
-    redirect_uri: CLAUDE_OAUTH_CONFIG.redirectUri,
-    scope: SETUP_TOKEN_CONFIG.scopes.join(" "),
-    code_challenge: codeChallenge,
-    code_challenge_method: "S256",
-    state
-  });
-  const authUrl = `${CLAUDE_OAUTH_CONFIG.authorizationEndpoint}?${params.toString()}`;
-  return { authUrl, codeVerifier, state };
-}
-async function exchangeCodeForTokens(request, fetchImpl) {
-  const { authorizationCode, codeVerifier, state } = request;
-  const code = authorizationCode.split("#")[0]?.split("&")[0] ?? authorizationCode;
-  const data = await postJson(
-    fetchImpl,
-    CLAUDE_OAUTH_CONFIG.tokenEndpoint,
-    {
-      grant_type: "authorization_code",
-      client_id: CLAUDE_OAUTH_CONFIG.clientId,
-      code,
-      code_verifier: codeVerifier,
-      redirect_uri: CLAUDE_OAUTH_CONFIG.redirectUri,
-      state
-    },
-    "Failed to parse token response",
-    CLAUDE_TOKEN_HEADERS
-  );
-  return {
-    accessToken: data.access_token,
-    // The authorization_code grant always returns a refresh_token; the original
-    // helper read it from an untyped `data` and declared the field `string`.
-    refreshToken: data.refresh_token,
-    expiresIn: data.expires_in,
-    scopes: data.scope?.split(" ") || CLAUDE_OAUTH_CONFIG.scopes
-  };
-}
-async function exchangeSetupTokenCode(request, fetchImpl) {
-  const { authorizationCode, codeVerifier, state } = request;
-  const code = authorizationCode.split("#")[0]?.split("&")[0] ?? authorizationCode;
-  const data = await postJson(
-    fetchImpl,
-    CLAUDE_OAUTH_CONFIG.tokenEndpoint,
-    {
-      grant_type: "authorization_code",
-      client_id: CLAUDE_OAUTH_CONFIG.clientId,
-      code,
-      code_verifier: codeVerifier,
-      redirect_uri: CLAUDE_OAUTH_CONFIG.redirectUri,
-      state
-    },
-    "Failed to parse setup token response",
-    CLAUDE_TOKEN_HEADERS
-  );
-  return {
-    accessToken: data.access_token,
-    expiresIn: data.expires_in,
-    scopes: data.scope?.split(" ") || SETUP_TOKEN_CONFIG.scopes
-  };
-}
-async function refreshAccessToken(refreshToken, fetchImpl) {
-  const data = await postJson(
-    fetchImpl,
-    CLAUDE_OAUTH_CONFIG.tokenEndpoint,
-    {
-      grant_type: "refresh_token",
-      client_id: CLAUDE_OAUTH_CONFIG.clientId,
-      refresh_token: refreshToken
-    },
-    "Failed to parse refresh response",
-    CLAUDE_TOKEN_HEADERS
-  );
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token || refreshToken,
-    expiresIn: data.expires_in
-  };
-}
-
-// src/oauth/flows/codex.ts
-var codex_exports = {};
-__export(codex_exports, {
-  exchangeCodeForTokens: () => exchangeCodeForTokens2,
-  generateAuthParams: () => generateAuthParams2,
-  refreshAccessToken: () => refreshAccessToken2
-});
-import crypto2 from "crypto";
-var CODEX_OAUTH_CONFIG = {
-  clientId: "app_EMoamEEZ73f0CkXaXp7hrann",
-  authorizationEndpoint: "https://auth.openai.com/oauth/authorize",
-  tokenEndpoint: "https://auth.openai.com/oauth/token",
-  redirectUri: "http://localhost:1455/auth/callback",
-  scopes: ["openid", "profile", "email", "offline_access"]
-};
-function generateAuthParams2() {
-  const codeVerifier = crypto2.randomBytes(64).toString("hex");
-  const codeChallenge = crypto2.createHash("sha256").update(codeVerifier).digest("base64url");
-  const state = crypto2.randomBytes(16).toString("hex");
-  const params = new URLSearchParams({
-    response_type: "code",
-    client_id: CODEX_OAUTH_CONFIG.clientId,
-    redirect_uri: CODEX_OAUTH_CONFIG.redirectUri,
-    scope: CODEX_OAUTH_CONFIG.scopes.join(" "),
-    code_challenge: codeChallenge,
-    code_challenge_method: "S256",
-    state
-  });
-  const authUrl = `${CODEX_OAUTH_CONFIG.authorizationEndpoint}?${params.toString()}`;
-  return { authUrl, codeVerifier, state };
-}
-async function exchangeCodeForTokens2(request, fetchImpl) {
-  const { authorizationCode, codeVerifier } = request;
-  const params = new URLSearchParams({
-    grant_type: "authorization_code",
-    client_id: CODEX_OAUTH_CONFIG.clientId,
-    code: authorizationCode,
-    code_verifier: codeVerifier,
-    redirect_uri: CODEX_OAUTH_CONFIG.redirectUri
-  });
-  const data = await postForm(
-    fetchImpl,
-    CODEX_OAUTH_CONFIG.tokenEndpoint,
-    params,
-    "Failed to parse token response"
-  );
-  return {
-    accessToken: data.access_token,
-    // authorization_code grant returns both; the original helper read them from
-    // an untyped `data` and declared the fields `string`.
-    refreshToken: data.refresh_token,
-    idToken: data.id_token,
-    expiresIn: data.expires_in
-  };
-}
-async function refreshAccessToken2(refreshToken, fetchImpl) {
-  const params = new URLSearchParams({
-    grant_type: "refresh_token",
-    client_id: CODEX_OAUTH_CONFIG.clientId,
-    refresh_token: refreshToken,
-    scope: "openid profile email"
-  });
-  const data = await postForm(
-    fetchImpl,
-    CODEX_OAUTH_CONFIG.tokenEndpoint,
-    params,
-    "Failed to parse refresh response"
-  );
-  return {
-    accessToken: data.access_token,
-    idToken: data.id_token,
-    refreshToken: data.refresh_token || refreshToken,
-    expiresIn: data.expires_in || 3600
-  };
-}
-
-// src/oauth/flows/gemini.ts
-var gemini_exports = {};
-__export(gemini_exports, {
-  exchangeCodeForTokens: () => exchangeCodeForTokens3,
-  generateAuthParams: () => generateAuthParams3,
-  refreshAccessToken: () => refreshAccessToken3
-});
-import crypto3 from "crypto";
-var GEMINI_OAUTH_CONFIG = {
-  clientId: "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com",
-  // The Gemini CLI's *public* installed-app OAuth client secret (mirrors the
-  // upstream CLI). Per Google's OAuth docs, native-app client secrets are not
-  // treated as confidential — not a leaked key.
-  clientSecret: "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",
-  // allowlist-secret
-  authorizationEndpoint: "https://accounts.google.com/o/oauth2/v2/auth",
-  tokenEndpoint: "https://oauth2.googleapis.com/token",
-  redirectUri: "urn:ietf:wg:oauth:2.0:oob",
-  scopes: ["https://www.googleapis.com/auth/cloud-platform"]
-};
-function generateAuthParams3() {
-  const codeVerifier = crypto3.randomBytes(32).toString("base64url");
-  const codeChallenge = crypto3.createHash("sha256").update(codeVerifier).digest("base64url");
-  const state = crypto3.randomBytes(16).toString("hex");
-  const params = new URLSearchParams({
-    client_id: GEMINI_OAUTH_CONFIG.clientId,
-    redirect_uri: GEMINI_OAUTH_CONFIG.redirectUri,
-    scope: GEMINI_OAUTH_CONFIG.scopes.join(" "),
-    response_type: "code",
-    code_challenge: codeChallenge,
-    code_challenge_method: "S256",
-    state,
-    access_type: "offline",
-    prompt: "consent"
-  });
-  const authUrl = `${GEMINI_OAUTH_CONFIG.authorizationEndpoint}?${params.toString()}`;
-  return { authUrl, codeVerifier, state };
-}
-async function exchangeCodeForTokens3(authorizationCode, codeVerifier, fetchImpl) {
-  const params = new URLSearchParams({
-    grant_type: "authorization_code",
-    client_id: GEMINI_OAUTH_CONFIG.clientId,
-    client_secret: GEMINI_OAUTH_CONFIG.clientSecret,
-    code: authorizationCode,
-    code_verifier: codeVerifier,
-    redirect_uri: GEMINI_OAUTH_CONFIG.redirectUri
-  });
-  const data = await postForm(
-    fetchImpl,
-    GEMINI_OAUTH_CONFIG.tokenEndpoint,
-    params,
-    "Failed to parse token response"
-  );
-  return {
-    accessToken: data.access_token,
-    // authorization_code grant returns a refresh_token; the original helper read
-    // it from an untyped `data` and declared the field `string`.
-    refreshToken: data.refresh_token,
-    expiresIn: data.expires_in
-  };
-}
-async function refreshAccessToken3(refreshToken, fetchImpl) {
-  const params = new URLSearchParams({
-    grant_type: "refresh_token",
-    client_id: GEMINI_OAUTH_CONFIG.clientId,
-    client_secret: GEMINI_OAUTH_CONFIG.clientSecret,
-    refresh_token: refreshToken
-  });
-  const data = await postForm(
-    fetchImpl,
-    GEMINI_OAUTH_CONFIG.tokenEndpoint,
-    params,
-    "Failed to parse refresh response"
-  );
-  return {
-    accessToken: data.access_token,
-    expiresIn: data.expires_in
-  };
-}
 export {
+  DEFAULT_ACCOUNT_PRIORITY,
+  LAST_USED_PERSIST_THROTTLE_MS,
+  SESSION_AFFINITY_TTL_MS,
+  SubscriptionAccountSelector,
   SubscriptionAccountService,
   SubscriptionDispatcher,
   SubscriptionProviderRegistry,