@tokenfactory/acc-runner 0.40.11 → 0.40.13

package/dist/capacity/resume-controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resume-controller.js","sourceRoot":"","sources":["../../src/capacity/resume-controller.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAE,iBAAiB,EAAsB,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EACL,cAAc,GAGf,MAAM,oBAAoB,CAAC;AAE5B,MAAM,wBAAwB,GAAG,MAAM,CAAC,CAAC,kBAAkB;AAC3D,MAAM,4BAA4B,GAAG,MAAM,CAAC,CAAC,2BAA2B;AAExE,MAAM,aAAa,GAAe;IAChC,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC;IACxC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAkC,CAAC;CACpE,CAAC;AAgDF;;;;;GAKG;AACH,MAAM,OAAO,gBAAgB;IAqBE;IApBZ,GAAG,CAAe;IAClB,KAAK,CAAa;IAClB,cAAc,CAAS;IACvB,kBAAkB,CAAS;IAEpC,OAAO,GAAG,KAAK,CAAC;IAChB,OAAO,GAAG,KAAK,CAAC;IAChB,IAAI,GAAiB,QAAQ,CAAC;IACtC,kFAAkF;IAC1E,gBAAgB,GAAkB,IAAI,CAAC;IAC/C,2CAA2C;IACnC,kBAAkB,GAAkB,IAAI,CAAC;IACjD,+CAA+C;IAC9B,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC5D,sEAAsE;IAC9D,gBAAgB,GAAkB,IAAI,CAAC;IACvC,UAAU,GAAY,IAAI,CAAC;IACnC,8DAA8D;IACtD,IAAI,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEhD,YAA6B,IAA0B;QAA1B,SAAI,GAAJ,IAAI,CAAsB;QACrD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC;QACzC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAAC,CAAC;QACnF,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,kBAAkB,IAAI,4BAA4B,CAAC,CAAC;IACjG,CAAC;IAED,oBAAoB;IACpB,WAAW;QACT,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,mEAAmE;IACnE,SAAS,CAAC,UAAkB;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;IAC9C,CAAC;IAED,sDAAsD;IACtD,KAAK,CAAC,UAAyB;QAC7B,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC;QACnC,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,KAAwE;QACrF,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,IAAI,CAAC,OAAO,CAAC,GAAG,CACd,KAAK,CAAC,UAAU,EAChB,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE;YAC5D,IAAI,EAAE,SAAS;YACf,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,IAAI,EAAE,EAAE;SACT,CAAC,CACH,CAAC;QACF,oDAAoD;QACpD,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,gBAAgB,CAAC;YAAE,OAAO;QACpF,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,qEAAqE;YACrE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;IAClG,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,UAAyB;QACtC,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1C,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,6DAA6D;IAC7D,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,UAAU,EAAE,CAAC;IACpB,CAAC;IAED,gEAAgE;IAChE,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,IAAI,CAAC;IAClB,CAAC;IAEO,OAAO,CAAC,EAAuB;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC3C,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CACf,iDAAkD,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1F,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IACtF,CAAC;IAEO,UAAU;QAChB,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YAC7B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACvC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACzB,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO;QACnD,4EAA4E;QAC5E,sDAAsD;QACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,gDAAgD;IACxC,KAAK,CAAC,QAAQ,CAAC,OAAoC;QACzD,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QAEzB,IAAI,MAAM,GAAmB,IAAI,CAAC;QAClC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClD,0EAA0E;YAC1E,kDAAkD;YAClD,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,KAAK,IAAI,IAAI,IAAI,CAAC,kBAAkB,KAAK,IAAI,CAAC,gBAAgB,CAAC;YACtG,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACvC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CACf,0CAA2C,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CACnF,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO;QAC3B,CAAC;QAED,MAAM,QAAQ,GAAG,cAAc,CAAC;YAC9B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE;YACjB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM;YACN,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;SAC5C,CAAC,CAAC;QAEH,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YACxB,KAAK,MAAM;gBACT,OAAO;YACT,KAAK,OAAO;gBACV,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CACf,kCAAkC,QAAQ,CAAC,OAAO,+BAA+B,CAClF,CAAC;gBACF,OAAO;YACT,KAAK,QAAQ;gBACX,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAChE,OAAO;YACT,KAAK,OAAO;gBACV,MAAM,IAAI,CAAC,UAAU,CACnB,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,SAAS,EAClB,0BAA0B,EAC1B,OAAO,CACR,CAAC;gBACF,OAAO;QACX,CAAC;IACH,CAAC;IAED,2DAA2D;IACnD,KAAK,CAAC,UAAU,CACtB,OAAe,EACf,SAAwB,EACxB,MAAkC,EAClC,OAAoC;QAEpC,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,iDAAiD;QACjD,IAAI,CAAC,OAAO,CAAC,GAAG,CACd,OAAO,EACP,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE;YACnD,IAAI,EAAE,SAAS;YACf,SAAS;YACT,IAAI,EAAE,EAAE;SACT,CAAC,CACH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;QACrB,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC;QAChC,wEAAwE;QACxE,yEAAyE;QACzE,IAAI,MAAM,KAAK,0BAA0B;YAAE,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAC;QACtE,IAAI,CAAC,OAAO,EAAE,CAAC;QAEf,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAC7B,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACvD,IAAI,IAAI,CAAC,IAAI,CAAC,eAAe;YAAE,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAEjE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CACf,gCAAgC,MAAM,QAAQ,OAAO,EAAE;YACrD,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CACzF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,QAAQ,CACpB,MAAoB,EACpB,OAAe,EACf,OAAoC;QAEpC,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;QACrB,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC;QAChC,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAC;QAC3B,0EAA0E;QAC1E,qEAAqE;QACrE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,UAAU,EAAE,CAAC;QAElB,gFAAgF;QAChF,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACnC,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAE7D,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,iCAAiC,MAAM,QAAQ,OAAO,EAAE,CAAC,CAAC;IAC9E,CAAC;CACF"}

package/dist/capacity/resume-policy.d.ts

@@ -0,0 +1,101 @@
+/**
+ * AS-3 (RESUME): the PURE pause-until decision core.
+ *
+ * Replaces the fixed pause-until-reset timer (watch.ts's single `setTimeout`
+ * keyed to the capped account's stated reset) with
+ *
+ *     pause-until ( current account's reset elapsed
+ *                   OR the logged-in account CHANGED
+ *                   OR a cheap probe ping says we can serve )
+ *
+ * plus the operator's symmetric requirement: swapping to a DIFFERENT account
+ * that is itself still-capped in memory RE-PAUSES from memory (no request
+ * burned) rather than resuming into an account that will just 429 again.
+ *
+ * Flap protection (reuse of the CC-3A pattern — api/_lib/capacity/
+ * identity-capacity.ts `cooldownMinDwellMs: 60_000`): an account-change
+ * adoption (resume or re-pause) is DEBOUNCED — a second account-change within
+ * `adoptionDebounceMs` of the last adoption is DEFERRED, so a keychain that
+ * flaps A→B→A→B faster than the debounce collapses to a single adoption instead
+ * of thrashing resume/pause. The capacity-window hysteresis (never reopen a
+ * capped window on a null-reset guess) lives in the fold (account-window.ts).
+ *
+ * PURE by construction: no clock, no timer, no I/O — every input is passed in,
+ * so the whole decision surface is exercised with a fake clock in unit tests.
+ */
+import { type AccountWindow } from "./account-window.js";
+/** Whether the runner is currently claiming (`active`) or capacity-paused (`paused`). */
+export type CapacityMode = "active" | "paused";
+/** Inputs for one resume/re-pause decision. */
+export interface ResumeEvalInput {
+    /** Current runner mode. */
+    mode: CapacityMode;
+    /** Wall-clock now (epoch ms) from the injected clock. */
+    nowMs: number;
+    /**
+     * The account the probe currently observes (its `synthetic_account`), or
+     * `null` when the probe cannot introspect one this tick.
+     */
+    observedAccountKey: string | null;
+    /**
+     * The account the current state is anchored to: the capped account while
+     * paused, or the last-known serving account while active. `null` before the
+     * first observation.
+     */
+    anchorAccountKey: string | null;
+    /** Per-account remembered capacity windows (keyed on `synthetic_account`). */
+    windows: ReadonlyMap<string, AccountWindow>;
+    /**
+     * Result of a cheap probe ping for the observed account THIS tick:
+     *   true  = the account can serve now (resume),
+     *   false = still capped,
+     *   null  = not probed / can't tell.
+     * Only consulted while paused on the same account.
+     */
+    pingOk: boolean | null;
+    /**
+     * Epoch ms of the last account-change adoption (resume or re-pause), or
+     * `null` if none yet — the initial cap-pause is NOT an adoption, so the first
+     * swap after a pause is never debounced.
+     */
+    lastAdoptionAtMs: number | null;
+    /** Minimum gap between account-change adoptions (flap protection). */
+    adoptionDebounceMs: number;
+}
+/** Why a resume fired. */
+export type ResumeReason = "reset" | "account-change" | "ping-ok";
+/** The decision the controller acts on. */
+export type ResumeDecision = 
+/** Stay in the current mode. */
+{
+    action: "stay";
+}
+/** Leave the pause and resume claiming, on `account`. */
+ | {
+    action: "resume";
+    reason: ResumeReason;
+    account: string;
+}
+/** Re-pause: the observed account is a KNOWN still-capped account (from memory). */
+ | {
+    action: "pause";
+    reason: "returning-capped-account";
+    account: string;
+    resetAtMs: number | null;
+}
+/** An account change is held back by the adoption debounce; retry after the hold. */
+ | {
+    action: "defer";
+    reason: "adoption-debounce";
+    account: string;
+};
+/**
+ * Decide the next action. Pure — the controller supplies every input and
+ * executes the returned action (arming timers, calling seams). Ordering:
+ *   1. account swap (highest signal) — debounced, then resume-or-re-pause by
+ *      the new account's remembered window;
+ *   2. same account while paused — reset elapsed, else a positive ping;
+ *   3. otherwise stay.
+ */
+export declare function evaluateResume(input: ResumeEvalInput): ResumeDecision;
+//# sourceMappingURL=resume-policy.d.ts.map

package/dist/capacity/resume-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resume-policy.d.ts","sourceRoot":"","sources":["../../src/capacity/resume-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAiB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAExE,yFAAyF;AACzF,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE/C,+CAA+C;AAC/C,MAAM,WAAW,eAAe;IAC9B,2BAA2B;IAC3B,IAAI,EAAE,YAAY,CAAC;IACnB,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC;;;;OAIG;IACH,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,8EAA8E;IAC9E,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC5C;;;;;;OAMG;IACH,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB;;;;OAIG;IACH,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,sEAAsE;IACtE,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,0BAA0B;AAC1B,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,gBAAgB,GAAG,SAAS,CAAC;AAElE,2CAA2C;AAC3C,MAAM,MAAM,cAAc;AACxB,gCAAgC;AAC9B;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE;AACpB,yDAAyD;GACvD;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC7D,oFAAoF;GAClF;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,0BAA0B,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE;AACpG,qFAAqF;GACnF;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAOtE;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,eAAe,GAAG,cAAc,CA4CrE"}

package/dist/capacity/resume-policy.js

@@ -0,0 +1,80 @@
+/**
+ * AS-3 (RESUME): the PURE pause-until decision core.
+ *
+ * Replaces the fixed pause-until-reset timer (watch.ts's single `setTimeout`
+ * keyed to the capped account's stated reset) with
+ *
+ *     pause-until ( current account's reset elapsed
+ *                   OR the logged-in account CHANGED
+ *                   OR a cheap probe ping says we can serve )
+ *
+ * plus the operator's symmetric requirement: swapping to a DIFFERENT account
+ * that is itself still-capped in memory RE-PAUSES from memory (no request
+ * burned) rather than resuming into an account that will just 429 again.
+ *
+ * Flap protection (reuse of the CC-3A pattern — api/_lib/capacity/
+ * identity-capacity.ts `cooldownMinDwellMs: 60_000`): an account-change
+ * adoption (resume or re-pause) is DEBOUNCED — a second account-change within
+ * `adoptionDebounceMs` of the last adoption is DEFERRED, so a keychain that
+ * flaps A→B→A→B faster than the debounce collapses to a single adoption instead
+ * of thrashing resume/pause. The capacity-window hysteresis (never reopen a
+ * capped window on a null-reset guess) lives in the fold (account-window.ts).
+ *
+ * PURE by construction: no clock, no timer, no I/O — every input is passed in,
+ * so the whole decision surface is exercised with a fake clock in unit tests.
+ */
+import { isStillCapped } from "./account-window.js";
+/** True when the observed account differs from the anchor (a login swap). */
+function accountSwapped(input) {
+    return input.observedAccountKey !== null && input.observedAccountKey !== input.anchorAccountKey;
+}
+/**
+ * Decide the next action. Pure — the controller supplies every input and
+ * executes the returned action (arming timers, calling seams). Ordering:
+ *   1. account swap (highest signal) — debounced, then resume-or-re-pause by
+ *      the new account's remembered window;
+ *   2. same account while paused — reset elapsed, else a positive ping;
+ *   3. otherwise stay.
+ */
+export function evaluateResume(input) {
+    if (accountSwapped(input)) {
+        const account = input.observedAccountKey;
+        // Flap protection: coalesce rapid account-change adoptions.
+        if (input.lastAdoptionAtMs !== null &&
+            input.nowMs - input.lastAdoptionAtMs < input.adoptionDebounceMs) {
+            return { action: "defer", reason: "adoption-debounce", account };
+        }
+        const window = input.windows.get(account) ?? null;
+        if (isStillCapped(window, input.nowMs)) {
+            // Swapped to a known still-capped account → re-pause from memory.
+            if (input.mode === "paused" && input.anchorAccountKey === account) {
+                return { action: "stay" };
+            }
+            return {
+                action: "pause",
+                reason: "returning-capped-account",
+                account,
+                resetAtMs: window ? window.resetAtMs : null,
+            };
+        }
+        // Fresh / unknown account → its quota is available; resume when paused.
+        if (input.mode === "paused") {
+            return { action: "resume", reason: "account-change", account };
+        }
+        return { action: "stay" };
+    }
+    if (input.mode === "paused") {
+        const key = input.observedAccountKey ?? input.anchorAccountKey;
+        const window = key ? input.windows.get(key) ?? null : null;
+        // Reset elapsed on the capped account's known window.
+        if (window && window.state === "capped" && window.resetAtMs !== null && input.nowMs >= window.resetAtMs) {
+            return { action: "resume", reason: "reset", account: key };
+        }
+        // Cheap probe ping says the window reopened early.
+        if (input.pingOk === true && key !== null) {
+            return { action: "resume", reason: "ping-ok", account: key };
+        }
+    }
+    return { action: "stay" };
+}
+//# sourceMappingURL=resume-policy.js.map

package/dist/capacity/resume-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resume-policy.js","sourceRoot":"","sources":["../../src/capacity/resume-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,aAAa,EAAsB,MAAM,qBAAqB,CAAC;AAwDxE,6EAA6E;AAC7E,SAAS,cAAc,CAAC,KAAsB;IAC5C,OAAO,KAAK,CAAC,kBAAkB,KAAK,IAAI,IAAI,KAAK,CAAC,kBAAkB,KAAK,KAAK,CAAC,gBAAgB,CAAC;AAClG,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,KAAsB;IACnD,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,kBAA4B,CAAC;QACnD,4DAA4D;QAC5D,IACE,KAAK,CAAC,gBAAgB,KAAK,IAAI;YAC/B,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,gBAAgB,GAAG,KAAK,CAAC,kBAAkB,EAC/D,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC;QACnE,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;QAClD,IAAI,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,kEAAkE;YAClE,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,gBAAgB,KAAK,OAAO,EAAE,CAAC;gBAClE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YAC5B,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,OAAO;gBACf,MAAM,EAAE,0BAA0B;gBAClC,OAAO;gBACP,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;aAC5C,CAAC;QACJ,CAAC;QACD,wEAAwE;QACxE,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,kBAAkB,IAAI,KAAK,CAAC,gBAAgB,CAAC;QAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3D,sDAAsD;QACtD,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACxG,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAG,GAAc,EAAE,CAAC;QACzE,CAAC;QACD,mDAAmD;QACnD,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAC1C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC"}

package/dist/engines/account-identity.d.ts

@@ -0,0 +1,54 @@
+import type { EngineAccountIdentity, EngineAuthMode, EnginePlanHint } from "./types.js";
+/**
+ * Derive the stable synthetic account id.
+ *   - With an email: `acct:<lowercased-trimmed-email>` — the SAME login on two
+ *     hosts/channels collapses to one id, which is exactly the convergence the
+ *     broadcaster wants.
+ *   - Without an email: `host:<hostname>/<engineId>/<channel>` — stable for a
+ *     given runner install + channel, distinct across hosts, and never null.
+ */
+export declare function syntheticAccountId(args: {
+    engineId: string;
+    channel: EngineAuthMode;
+    email?: string | null;
+    hostname?: string;
+}): string;
+/**
+ * Build the HONEST "unknown-account" identity an adapter reports when it cannot
+ * introspect a real account (codex/gemini today, or claude-code in api-key mode
+ * where a bare key carries no email). Never fabricates an email or a plan.
+ */
+export declare function unknownAccountIdentity(args: {
+    engineId: string;
+    channel: EngineAuthMode;
+    planHint?: EnginePlanHint;
+    detail: string;
+    hostname?: string;
+}): EngineAccountIdentity;
+/**
+ * Build a RESOLVED account identity from an introspected email (+ optional
+ * plan). The synthetic id is email-derived so it converges across hosts.
+ */
+export declare function resolvedAccountIdentity(args: {
+    engineId: string;
+    channel: EngineAuthMode;
+    email: string;
+    planHint?: EnginePlanHint;
+    detail: string;
+}): EngineAccountIdentity;
+/**
+ * The identity used for change detection / broadcast keying. Two probes name the
+ * same account iff their `synthetic_account` matches (email-derived when known,
+ * host-derived otherwise) — so a login swap on one host, an email that appears
+ * where there was none, or a channel flip are all detected, while a plain
+ * cadence refresh that resolves the same account is a no-op.
+ */
+export declare function accountKey(identity: EngineAccountIdentity): string;
+/**
+ * True when `next` names a different account than `prev` (or there was no prior
+ * account). The broadcaster audits on `true` and last-writer-wins-skips on
+ * `false`. A plan_hint-only change (same account, upgraded plan) also counts as
+ * a change worth re-broadcasting so downstream cap logic sees the new plan.
+ */
+export declare function accountChanged(prev: EngineAccountIdentity | null, next: EngineAccountIdentity): boolean;
+//# sourceMappingURL=account-identity.d.ts.map

package/dist/engines/account-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-identity.d.ts","sourceRoot":"","sources":["../../src/engines/account-identity.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACV,qBAAqB,EACrB,cAAc,EACd,cAAc,EACf,MAAM,YAAY,CAAC;AAEpB;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,cAAc,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,CAKT;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,cAAc,CAAC;IACxB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,qBAAqB,CAYxB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,cAAc,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,qBAAqB,CAaxB;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,qBAAqB,GAAG,MAAM,CAElE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,qBAAqB,GAAG,IAAI,EAClC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAGT"}

package/dist/engines/account-identity.js

@@ -0,0 +1,93 @@
+/**
+ * AS-1 (ACCOUNT-PROBE): shared, side-effect-free helpers for the engine
+ * `accountIdentity()` surface (types.ts). Two concerns live here so every
+ * adapter (claude-code / codex / gemini) spells them identically:
+ *
+ *   1. Synthetic-account derivation — a STABLE id an engine reports so the
+ *      identity broadcaster always has a concrete participant to converge on,
+ *      even when the real account email is unintrospectable. Email-derived when
+ *      an email resolves (same login → same id across hosts); host+engine+channel
+ *      derived otherwise (an unknown-account runner is still stable + distinct
+ *      rather than a flapping null).
+ *   2. Change detection / audit — `accountChanged()` compares the last-broadcast
+ *      identity against a freshly-probed one so the last-writer-wins broadcaster
+ *      can decide whether an emit is a no-op refresh or a real login swap worth
+ *      auditing (the ajay→gaurav evidence that motivated the task).
+ *
+ * PURE by construction (the one impurity — hostname — is passed in), so the
+ * cadence + parsing logic is unit-testable without touching `os` or a clock.
+ */
+import os from "node:os";
+/**
+ * Derive the stable synthetic account id.
+ *   - With an email: `acct:<lowercased-trimmed-email>` — the SAME login on two
+ *     hosts/channels collapses to one id, which is exactly the convergence the
+ *     broadcaster wants.
+ *   - Without an email: `host:<hostname>/<engineId>/<channel>` — stable for a
+ *     given runner install + channel, distinct across hosts, and never null.
+ */
+export function syntheticAccountId(args) {
+    const email = (args.email ?? "").trim().toLowerCase();
+    if (email)
+        return `acct:${email}`;
+    const host = (args.hostname ?? os.hostname() ?? "").trim() || "unknown-host";
+    return `host:${host}/${args.engineId}/${args.channel}`;
+}
+/**
+ * Build the HONEST "unknown-account" identity an adapter reports when it cannot
+ * introspect a real account (codex/gemini today, or claude-code in api-key mode
+ * where a bare key carries no email). Never fabricates an email or a plan.
+ */
+export function unknownAccountIdentity(args) {
+    return {
+        account_email: null,
+        plan_hint: args.planHint ?? "unknown",
+        channel: args.channel,
+        synthetic_account: syntheticAccountId({
+            engineId: args.engineId,
+            channel: args.channel,
+            hostname: args.hostname,
+        }),
+        detail: args.detail,
+    };
+}
+/**
+ * Build a RESOLVED account identity from an introspected email (+ optional
+ * plan). The synthetic id is email-derived so it converges across hosts.
+ */
+export function resolvedAccountIdentity(args) {
+    const email = args.email.trim();
+    return {
+        account_email: email,
+        plan_hint: args.planHint ?? "unknown",
+        channel: args.channel,
+        synthetic_account: syntheticAccountId({
+            engineId: args.engineId,
+            channel: args.channel,
+            email,
+        }),
+        detail: args.detail,
+    };
+}
+/**
+ * The identity used for change detection / broadcast keying. Two probes name the
+ * same account iff their `synthetic_account` matches (email-derived when known,
+ * host-derived otherwise) — so a login swap on one host, an email that appears
+ * where there was none, or a channel flip are all detected, while a plain
+ * cadence refresh that resolves the same account is a no-op.
+ */
+export function accountKey(identity) {
+    return identity.synthetic_account;
+}
+/**
+ * True when `next` names a different account than `prev` (or there was no prior
+ * account). The broadcaster audits on `true` and last-writer-wins-skips on
+ * `false`. A plan_hint-only change (same account, upgraded plan) also counts as
+ * a change worth re-broadcasting so downstream cap logic sees the new plan.
+ */
+export function accountChanged(prev, next) {
+    if (!prev)
+        return true;
+    return accountKey(prev) !== accountKey(next) || prev.plan_hint !== next.plan_hint;
+}
+//# sourceMappingURL=account-identity.js.map

package/dist/engines/account-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-identity.js","sourceRoot":"","sources":["../../src/engines/account-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AAOzB;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAKlC;IACC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtD,IAAI,KAAK;QAAE,OAAO,QAAQ,KAAK,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,cAAc,CAAC;IAC7E,OAAO,QAAQ,IAAI,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAMtC;IACC,OAAO;QACL,aAAa,EAAE,IAAI;QACnB,SAAS,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS;QACrC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,iBAAiB,EAAE,kBAAkB,CAAC;YACpC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;QACF,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAMvC;IACC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,OAAO;QACL,aAAa,EAAE,KAAK;QACpB,SAAS,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS;QACrC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,iBAAiB,EAAE,kBAAkB,CAAC;YACpC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK;SACN,CAAC;QACF,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,QAA+B;IACxD,OAAO,QAAQ,CAAC,iBAAiB,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAkC,EAClC,IAA2B;IAE3B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC;AACpF,CAAC"}

package/dist/engines/account-probe.d.ts

@@ -0,0 +1,124 @@
+/**
+ * AS-1 (ACCOUNT-PROBE): the account-probe CADENCE scheduler.
+ *
+ * Extends the engine credential probe with a WHO-am-I probe fired on four
+ * triggers so a mid-flight login swap can never go undetected (operator
+ * evidence: swapping the keychain login ajay→gaurav went undetected while the
+ * runner sat paused on the old account's reset timer):
+ *
+ *   1. startup       — one probe the moment the scheduler starts.
+ *   2. pause-tick    — every ~60s WHILE the runner is capacity-paused (the exact
+ *                      window the ajay→gaurav swap slipped through: a paused
+ *                      runner otherwise only re-probed on the 5-min heartbeat).
+ *   3. heartbeat     — every ~5min while healthy (unpaused).
+ *   4. auth-failure  — immediately after any 401/403-class engine failure
+ *                      (debounced so a burst of 401s is a single probe).
+ *
+ * Each probe result is handed to `emit` with a MONOTONIC sequence + wall-clock
+ * stamp so the identity broadcaster resolves concurrent writers last-writer-wins,
+ * and a `changed` flag so a real login swap is audited while a plain cadence
+ * refresh of the same account is a cheap no-op.
+ *
+ * FULLY injectable (probe / emit / clock / timer) so the four-trigger cadence is
+ * exercised with a fake clock — no real binary, no wall-clock sleep, no network.
+ * Wiring this scheduler onto the companion's identity broadcaster is a follow-up
+ * (companion.ts is outside this track's file scope); this module is the engine
+ * primitive that follow-up drives.
+ */
+import type { EngineAccountIdentity } from "./types.js";
+/** Which cadence trigger fired a given probe. */
+export type AccountProbeTrigger = "startup" | "pause-tick" | "heartbeat" | "auth-failure";
+/** One account-probe broadcast handed to the identity broadcaster. */
+export interface AccountProbeBroadcast {
+    /** The probed account identity. */
+    identity: EngineAccountIdentity;
+    /** Which cadence trigger produced this probe. */
+    trigger: AccountProbeTrigger;
+    /**
+     * True when this probe named a DIFFERENT account (or plan) than the last
+     * broadcast — the audit signal a login swap fires on. False on a plain
+     * same-account cadence refresh.
+     */
+    changed: boolean;
+    /** Monotonic 1-based sequence for last-writer-wins resolution on the topic. */
+    seq: number;
+    /** Wall-clock ms of the probe (from the injected clock). */
+    at: number;
+}
+/** Timer seam so the cadence is drivable by a fake clock in tests. */
+export interface ProbeTimer {
+    /** Schedule `fn` after `ms`; returns an opaque handle. */
+    setTimer(fn: () => void, ms: number): unknown;
+    /** Cancel a scheduled handle. */
+    clearTimer(handle: unknown): void;
+}
+export interface AccountProbeSchedulerDeps {
+    /** Probe the engine account. Should itself degrade to an honest `"unknown"` identity rather than throw. */
+    probe: () => Promise<EngineAccountIdentity>;
+    /** Emit a probed identity on the identity broadcaster (last-writer-wins keyed on `seq`). */
+    emit: (broadcast: AccountProbeBroadcast) => void | Promise<void>;
+    /** Healthy heartbeat cadence (ms). Default 5min. */
+    heartbeatMs?: number;
+    /** While-paused probe cadence (ms). Default 60s. */
+    pauseTickMs?: number;
+    /** Min gap between auth-failure probes (ms) so a 401 burst is one probe. Default 1s. */
+    authFailureDebounceMs?: number;
+    /** Clock (test seam). Default `Date.now`. */
+    now?: () => number;
+    /** Timer seam (test seam). Default `setTimeout`/`clearTimeout`. */
+    timer?: ProbeTimer;
+    /** Best-effort audit/log sink for detected swaps + probe errors. */
+    onLog?: (line: string) => void;
+}
+/**
+ * Drives the four-trigger account-probe cadence. Probes are SERIALIZED onto one
+ * chain so sequence numbers are strictly monotonic and two triggers never race
+ * to emit an out-of-order identity. Call `start()` to fire the startup probe and
+ * arm the recurring timer, `setPaused()` on capacity transitions, and
+ * `onAuthFailure()` from the engine failure path.
+ */
+export declare class AccountProbeScheduler {
+    private readonly deps;
+    private readonly heartbeatMs;
+    private readonly pauseTickMs;
+    private readonly authFailureDebounceMs;
+    private readonly now;
+    private readonly timer;
+    private started;
+    private stopped;
+    private paused;
+    private recurringHandle;
+    private seq;
+    private last;
+    private lastAuthFailureAt;
+    /** Serial probe chain: every probe awaits the prior one so `seq` stays ordered. */
+    private tail;
+    constructor(deps: AccountProbeSchedulerDeps);
+    /** The last identity broadcast (null before the first probe). */
+    lastIdentity(): EngineAccountIdentity | null;
+    /** Fire the startup probe and arm the recurring cadence timer. Idempotent. */
+    start(): void;
+    /**
+     * Note a capacity pause/resume transition. Re-arms the recurring timer to the
+     * matching cadence (~60s paused, ~5min healthy). A no-op when the state is
+     * unchanged, so repeated pause ticks don't reset the timer out from under
+     * themselves.
+     */
+    setPaused(paused: boolean): void;
+    /**
+     * Probe immediately after a 401/403-class engine failure — the single most
+     * likely moment the underlying login just changed. Debounced so a burst of
+     * auth failures collapses to one probe.
+     */
+    onAuthFailure(): void;
+    /** Cancel the recurring timer; in-flight probes still settle. */
+    stop(): void;
+    /** Resolve once every queued probe has settled (test seam). */
+    settle(): Promise<void>;
+    private armRecurring;
+    private onRecurringFire;
+    /** Chain a probe onto the serial tail so sequence order is guaranteed. */
+    private enqueue;
+    private runProbe;
+}
+//# sourceMappingURL=account-probe.d.ts.map

package/dist/engines/account-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-probe.d.ts","sourceRoot":"","sources":["../../src/engines/account-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAGxD,iDAAiD;AACjD,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,YAAY,GAAG,WAAW,GAAG,cAAc,CAAC;AAE1F,sEAAsE;AACtE,MAAM,WAAW,qBAAqB;IACpC,mCAAmC;IACnC,QAAQ,EAAE,qBAAqB,CAAC;IAChC,iDAAiD;IACjD,OAAO,EAAE,mBAAmB,CAAC;IAC7B;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,4DAA4D;IAC5D,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,sEAAsE;AACtE,MAAM,WAAW,UAAU;IACzB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9C,iCAAiC;IACjC,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;CACnC;AAOD,MAAM,WAAW,yBAAyB;IACxC,2GAA2G;IAC3G,KAAK,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC5C,4FAA4F;IAC5F,IAAI,EAAE,CAAC,SAAS,EAAE,qBAAqB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wFAAwF;IACxF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,6CAA6C;IAC7C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,mEAAmE;IACnE,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,oEAAoE;IACpE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED;;;;;;GAMG;AACH,qBAAa,qBAAqB;IAiBpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAhBjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAS;IAC/C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IAEnC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,eAAe,CAAiB;IACxC,OAAO,CAAC,GAAG,CAAK;IAChB,OAAO,CAAC,IAAI,CAAsC;IAClD,OAAO,CAAC,iBAAiB,CAA4B;IACrD,mFAAmF;IACnF,OAAO,CAAC,IAAI,CAAoC;gBAEnB,IAAI,EAAE,yBAAyB;IAQ5D,iEAAiE;IACjE,YAAY,IAAI,qBAAqB,GAAG,IAAI;IAI5C,8EAA8E;IAC9E,KAAK,IAAI,IAAI;IAOb;;;;;OAKG;IACH,SAAS,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IAMhC;;;;OAIG;IACH,aAAa,IAAI,IAAI;IAQrB,iEAAiE;IACjE,IAAI,IAAI,IAAI;IAQZ,+DAA+D;IACzD,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7B,OAAO,CAAC,YAAY;IAUpB,OAAO,CAAC,eAAe;IAQvB,0EAA0E;IAC1E,OAAO,CAAC,OAAO;YAID,QAAQ;CA2BvB"}

package/dist/engines/account-probe.js

@@ -0,0 +1,134 @@
+import { accountChanged } from "./account-identity.js";
+const DEFAULT_TIMER = {
+    setTimer: (fn, ms) => setTimeout(fn, ms),
+    clearTimer: (h) => clearTimeout(h),
+};
+/**
+ * Drives the four-trigger account-probe cadence. Probes are SERIALIZED onto one
+ * chain so sequence numbers are strictly monotonic and two triggers never race
+ * to emit an out-of-order identity. Call `start()` to fire the startup probe and
+ * arm the recurring timer, `setPaused()` on capacity transitions, and
+ * `onAuthFailure()` from the engine failure path.
+ */
+export class AccountProbeScheduler {
+    deps;
+    heartbeatMs;
+    pauseTickMs;
+    authFailureDebounceMs;
+    now;
+    timer;
+    started = false;
+    stopped = false;
+    paused = false;
+    recurringHandle = null;
+    seq = 0;
+    last = null;
+    lastAuthFailureAt = Number.NEGATIVE_INFINITY;
+    /** Serial probe chain: every probe awaits the prior one so `seq` stays ordered. */
+    tail = Promise.resolve();
+    constructor(deps) {
+        this.deps = deps;
+        this.heartbeatMs = Math.max(1, deps.heartbeatMs ?? 5 * 60_000);
+        this.pauseTickMs = Math.max(1, deps.pauseTickMs ?? 60_000);
+        this.authFailureDebounceMs = Math.max(0, deps.authFailureDebounceMs ?? 1_000);
+        this.now = deps.now ?? Date.now;
+        this.timer = deps.timer ?? DEFAULT_TIMER;
+    }
+    /** The last identity broadcast (null before the first probe). */
+    lastIdentity() {
+        return this.last;
+    }
+    /** Fire the startup probe and arm the recurring cadence timer. Idempotent. */
+    start() {
+        if (this.started || this.stopped)
+            return;
+        this.started = true;
+        this.enqueue("startup");
+        this.armRecurring();
+    }
+    /**
+     * Note a capacity pause/resume transition. Re-arms the recurring timer to the
+     * matching cadence (~60s paused, ~5min healthy). A no-op when the state is
+     * unchanged, so repeated pause ticks don't reset the timer out from under
+     * themselves.
+     */
+    setPaused(paused) {
+        if (this.stopped || paused === this.paused)
+            return;
+        this.paused = paused;
+        if (this.started)
+            this.armRecurring();
+    }
+    /**
+     * Probe immediately after a 401/403-class engine failure — the single most
+     * likely moment the underlying login just changed. Debounced so a burst of
+     * auth failures collapses to one probe.
+     */
+    onAuthFailure() {
+        if (this.stopped || !this.started)
+            return;
+        const t = this.now();
+        if (t - this.lastAuthFailureAt < this.authFailureDebounceMs)
+            return;
+        this.lastAuthFailureAt = t;
+        this.enqueue("auth-failure");
+    }
+    /** Cancel the recurring timer; in-flight probes still settle. */
+    stop() {
+        this.stopped = true;
+        if (this.recurringHandle !== null) {
+            this.timer.clearTimer(this.recurringHandle);
+            this.recurringHandle = null;
+        }
+    }
+    /** Resolve once every queued probe has settled (test seam). */
+    async settle() {
+        await this.tail;
+    }
+    armRecurring() {
+        if (this.recurringHandle !== null) {
+            this.timer.clearTimer(this.recurringHandle);
+            this.recurringHandle = null;
+        }
+        if (this.stopped)
+            return;
+        const ms = this.paused ? this.pauseTickMs : this.heartbeatMs;
+        this.recurringHandle = this.timer.setTimer(() => this.onRecurringFire(), ms);
+    }
+    onRecurringFire() {
+        if (this.stopped)
+            return;
+        // Re-arm BEFORE the async probe so the cadence is decoupled from probe
+        // latency and stays deterministic under a fake clock.
+        this.armRecurring();
+        this.enqueue(this.paused ? "pause-tick" : "heartbeat");
+    }
+    /** Chain a probe onto the serial tail so sequence order is guaranteed. */
+    enqueue(trigger) {
+        this.tail = this.tail.then(() => this.runProbe(trigger));
+    }
+    async runProbe(trigger) {
+        let identity;
+        try {
+            identity = await this.deps.probe();
+        }
+        catch (err) {
+            this.deps.onLog?.(`[acc-runner] account probe (${trigger}) failed: ${err?.message ?? String(err)}`);
+            return;
+        }
+        const changed = accountChanged(this.last, identity);
+        const seq = ++this.seq;
+        const at = this.now();
+        if (changed && this.last) {
+            this.deps.onLog?.(`[acc-runner] account swap detected (${trigger}): ${this.last.synthetic_account} → ${identity.synthetic_account}`);
+        }
+        try {
+            await this.deps.emit({ identity, trigger, changed, seq, at });
+        }
+        catch (err) {
+            this.deps.onLog?.(`[acc-runner] account identity emit failed (${trigger}): ${err?.message ?? String(err)}`);
+        }
+        this.last = identity;
+    }
+}
+//# sourceMappingURL=account-probe.js.map

package/dist/engines/account-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-probe.js","sourceRoot":"","sources":["../../src/engines/account-probe.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AA+BvD,MAAM,aAAa,GAAe;IAChC,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC;IACxC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAkC,CAAC;CACpE,CAAC;AAqBF;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IAiBH;IAhBZ,WAAW,CAAS;IACpB,WAAW,CAAS;IACpB,qBAAqB,CAAS;IAC9B,GAAG,CAAe;IAClB,KAAK,CAAa;IAE3B,OAAO,GAAG,KAAK,CAAC;IAChB,OAAO,GAAG,KAAK,CAAC;IAChB,MAAM,GAAG,KAAK,CAAC;IACf,eAAe,GAAY,IAAI,CAAC;IAChC,GAAG,GAAG,CAAC,CAAC;IACR,IAAI,GAAiC,IAAI,CAAC;IAC1C,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACrD,mFAAmF;IAC3E,IAAI,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEhD,YAA6B,IAA+B;QAA/B,SAAI,GAAJ,IAAI,CAA2B;QAC1D,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,qBAAqB,IAAI,KAAK,CAAC,CAAC;QAC9E,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC;IAC3C,CAAC;IAED,iEAAiE;IACjE,YAAY;QACV,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,8EAA8E;IAC9E,KAAK;QACH,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxB,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,MAAe;QACvB,IAAI,IAAI,CAAC,OAAO,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO;QACnD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,YAAY,EAAE,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACH,aAAa;QACX,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,GAAG,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,qBAAqB;YAAE,OAAO;QACpE,IAAI,CAAC,iBAAiB,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/B,CAAC;IAED,iEAAiE;IACjE,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC5C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,IAAI,CAAC;IAClB,CAAC;IAEO,YAAY;QAClB,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC5C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;QACD,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QAC7D,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/E,CAAC;IAEO,eAAe;QACrB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,uEAAuE;QACvE,sDAAsD;QACtD,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACzD,CAAC;IAED,0EAA0E;IAClE,OAAO,CAAC,OAA4B;QAC1C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,OAA4B;QACjD,IAAI,QAA+B,CAAC;QACpC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CACf,+BAA+B,OAAO,aAAc,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAC5F,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;QACvB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,IAAI,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CACf,uCAAuC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,MAAM,QAAQ,CAAC,iBAAiB,EAAE,CAClH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CACf,8CAA8C,OAAO,MAAO,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CACpG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;IACvB,CAAC;CACF"}