@vibesdotdev/account 1.0.0-rc.4 → 1.0.0-rc.9

package/dist/billing/usage/record-sandbox-uptime.js

@@ -18,11 +18,15 @@
  * Design constraints (same as record-generation-usage.ts)
  * - MUST NOT fail the heartbeat path. Always returns void; swallows
  *   errors with structured log.
- * - MUST be time-bounded. 500ms hard cap via AbortController.
+ * - MUST be time-bounded. 500ms hard cap via AbortController, body
+ *   read included.
+ * - A delivered record that could not be paid for is NOT success: the
+ *   caller's `onOutcome` receives `shortfall` with the uncollected
+ *   cost-basis USD.
  */
 import { getLogger } from '@vibesdotdev/logging';
 import { settle } from '@vibesdotdev/kernel';
-import { deliveryFailure, deliveryFailureMessage, notifyJournal } from "./delivery.js";
+import { deliveryFailureMessage, notifyJournal, readUsageRecordDelivery, usageRecordSettlement } from "./delivery.js";
 function log(runtime) {
     return getLogger('account', runtime).child({ context: 'record-sandbox-uptime' });
 }
@@ -41,6 +45,7 @@ export function recordSandboxUptime(runtime, input) {
         // observe it. If the env stays bad, this dead-letters after
         // MAX_ATTEMPTS rather than sitting at `pending` indefinitely.
         void notifyJournal(log(runtime), 'recordSandboxUptime', () => input.journal?.onFailure?.({ reason: 'skip', message }));
+        void notifyJournal(log(runtime), 'recordSandboxUptime', () => input.onOutcome?.({ delivery: 'skipped', message }));
         return;
     }
     if (!input.accountOrigin) {
@@ -50,6 +55,7 @@ export function recordSandboxUptime(runtime, input) {
             reason: input.reason
         });
         void notifyJournal(log(runtime), 'recordSandboxUptime', () => input.journal?.onFailure?.({ reason: 'skip', message }));
+        void notifyJournal(log(runtime), 'recordSandboxUptime', () => input.onOutcome?.({ delivery: 'skipped', message }));
         return;
     }
     const accountOrigin = input.accountOrigin;
@@ -60,6 +66,7 @@ export function recordSandboxUptime(runtime, input) {
             reason: input.reason
         });
         void notifyJournal(log(runtime), 'recordSandboxUptime', () => input.journal?.onFailure?.({ reason: 'skip', message }));
+        void notifyJournal(log(runtime), 'recordSandboxUptime', () => input.onOutcome?.({ delivery: 'skipped', message }));
         return;
     }
     const serviceHeaders = {
@@ -100,12 +107,23 @@ export function recordSandboxUptime(runtime, input) {
         headers,
         body: JSON.stringify(fetchBody),
         signal
-    }), { timeoutMs: USAGE_RECORD_TIMEOUT_MS, reason: 'account sandbox uptime usage record' })).then(async (delivered) => {
-        const failure = deliveryFailure(delivered);
-        if (!failure) {
+    }).then(readUsageRecordDelivery), { timeoutMs: USAGE_RECORD_TIMEOUT_MS, reason: 'account sandbox uptime usage record' })).then(async (settled) => {
+        const settlement = usageRecordSettlement(settled);
+        if (settlement.delivered) {
+            // Delivered, so the journal row is done even when the charge was
+            // not collected: re-sending would write the usage row twice.
             await notifyJournal(log(runtime), 'recordSandboxUptime', input.journal?.onSuccess);
+            const { outcome } = settlement;
+            if (outcome.status !== 'charged') {
+                log(runtime).warn('recordSandboxUptime: usage delivered but not charged in full', {
+                    hostId: input.hostId,
+                    outcome
+                });
+            }
+            await notifyJournal(log(runtime), 'recordSandboxUptime', () => input.onOutcome?.({ delivery: 'delivered', outcome }));
             return;
         }
+        const { failure } = settlement;
         if (failure.reason === 'http') {
             log(runtime).warn('recordSandboxUptime: non-2xx from account', { hostId: input.hostId, status: failure.status });
         }
@@ -117,6 +135,7 @@ export function recordSandboxUptime(runtime, input) {
         }
         const message = deliveryFailureMessage(failure, USAGE_RECORD_TIMEOUT_MS);
         await notifyJournal(log(runtime), 'recordSandboxUptime', () => input.journal?.onFailure?.({ reason: failure.reason, message }));
+        await notifyJournal(log(runtime), 'recordSandboxUptime', () => input.onOutcome?.({ delivery: 'failed', failure }));
     });
 }
 //# sourceMappingURL=record-sandbox-uptime.js.map

package/dist/billing/usage/record-sandbox-uptime.js.map

@@ -1 +1 @@
-{"version":3,"file":"record-sandbox-uptime.js","sourceRoot":"","sources":["../../../src/billing/usage/record-sandbox-uptime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAmB,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EACN,eAAe,EACf,sBAAsB,EACtB,aAAa,EAEb,MAAM,eAAe,CAAC;AAOvB,SAAS,GAAG,CAAC,OAAmB;IAC/B,OAAO,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AA+D9B,MAAM,UAAU,mBAAmB,CAAC,OAAmB,EAAE,KAA+B;IACvF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC;QAAE,OAAO;IAClE,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,2CAA2C,CAAC;QAC5D,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,iCAAiC,GAAG,OAAO,GAAG,GAAG,EAAE;YACrE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,6DAA6D;QAC7D,4DAA4D;QAC5D,8DAA8D;QAC9D,KAAK,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAC5D,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CACvD,CAAC;QACF,OAAO;IACR,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,8BAA8B,CAAC;QAC/C,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,iCAAiC,GAAG,OAAO,GAAG,GAAG,EAAE;YACrE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,KAAK,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAC5D,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CACvD,CAAC;QACF,OAAO;IACR,CAAC;IACD,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,qCAAqC,CAAC;QACtD,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,iCAAiC,GAAG,OAAO,GAAG,GAAG,EAAE;YACrE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,KAAK,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAC5D,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CACvD,CAAC;QACF,OAAO;IACR,CAAC;IAED,MAAM,cAAc,GAAG;QACtB,cAAc,EAAE,kBAAkB;QAClC,MAAM,EAAE,kBAAkB;QAC1B,aAAa,EAAE,UAAU,KAAK,CAAC,oBAAoB,EAAE;KACpB,CAAC;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa;QAClC,CAAC,CAAC,EAAE,GAAG,cAAc,EAAE,iBAAiB,EAAE,KAAK,CAAC,aAAa,EAAE;QAC/D,CAAC,CAAC,cAAc,CAAC;IAElB,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,GAAG,kBAAkB,CAAC;IAC1D,MAAM,iBAAiB,GAAiB,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC;IAClE,MAAM,SAAS,GAAG;QACjB,WAAW,EAAE,wBAAwB;QACrC,8DAA8D;QAC9D,gEAAgE;QAChE,2DAA2D;QAC3D,6DAA6D;QAC7D,gEAAgE;QAChE,gEAAgE;QAChE,0BAA0B;QAC1B,aAAa,EAAE,EAAE,cAAc,EAAE,cAAc,EAAE;QACjD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,iBAAiB;QAC3B,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;QAC5C,QAAQ,EAAE;YACT,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;YAClD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,kBAAkB;YAC3B,UAAU,EAAE,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,MAAM;YACnD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,KAAK,CAAC,QAAQ;SACjB;KACD,CAAC;IAEF,KAAK,MAAM,CAAC,GAAG,EAAE,CAChB,OAAO,CAAC,SAAS,CAAC,IAAI,CACrB,CAAC,MAAM,EAAE,EAAE,CACV,KAAK,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,oCAAoC,EAAE;QAC9E,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;QAC/B,MAAM;KACN,CAAC,EACH,EAAE,SAAS,EAAE,uBAAuB,EAAE,MAAM,EAAE,qCAAqC,EAAE,CACrF,CACD,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;QAC1B,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACnF,OAAO;QACR,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC/B,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,2CAA2C,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAClH,CAAC;aAAM,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACzC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnH,CAAC;aAAM,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACxG,CAAC;QACD,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;QACzE,MAAM,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAC7D,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAC/D,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"record-sandbox-uptime.js","sourceRoot":"","sources":["../../../src/billing/usage/record-sandbox-uptime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAmB,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EACN,sBAAsB,EACtB,aAAa,EACb,uBAAuB,EACvB,qBAAqB,EAIrB,MAAM,eAAe,CAAC;AAUvB,SAAS,GAAG,CAAC,OAAmB;IAC/B,OAAO,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAsE9B,MAAM,UAAU,mBAAmB,CAAC,OAAmB,EAAE,KAA+B;IACvF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC;QAAE,OAAO;IAClE,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,2CAA2C,CAAC;QAC5D,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,iCAAiC,GAAG,OAAO,GAAG,GAAG,EAAE;YACrE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,6DAA6D;QAC7D,4DAA4D;QAC5D,8DAA8D;QAC9D,KAAK,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAC5D,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CACvD,CAAC;QACF,KAAK,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAC5D,KAAK,CAAC,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CACnD,CAAC;QACF,OAAO;IACR,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,8BAA8B,CAAC;QAC/C,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,iCAAiC,GAAG,OAAO,GAAG,GAAG,EAAE;YACrE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,KAAK,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAC5D,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CACvD,CAAC;QACF,KAAK,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAC5D,KAAK,CAAC,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CACnD,CAAC;QACF,OAAO;IACR,CAAC;IACD,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,qCAAqC,CAAC;QACtD,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,iCAAiC,GAAG,OAAO,GAAG,GAAG,EAAE;YACrE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,KAAK,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAC5D,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CACvD,CAAC;QACF,KAAK,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAC5D,KAAK,CAAC,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CACnD,CAAC;QACF,OAAO;IACR,CAAC;IAED,MAAM,cAAc,GAAG;QACtB,cAAc,EAAE,kBAAkB;QAClC,MAAM,EAAE,kBAAkB;QAC1B,aAAa,EAAE,UAAU,KAAK,CAAC,oBAAoB,EAAE;KACpB,CAAC;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa;QAClC,CAAC,CAAC,EAAE,GAAG,cAAc,EAAE,iBAAiB,EAAE,KAAK,CAAC,aAAa,EAAE;QAC/D,CAAC,CAAC,cAAc,CAAC;IAElB,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,GAAG,kBAAkB,CAAC;IAC1D,MAAM,iBAAiB,GAAiB,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC;IAClE,MAAM,SAAS,GAAG;QACjB,WAAW,EAAE,wBAAwB;QACrC,8DAA8D;QAC9D,gEAAgE;QAChE,2DAA2D;QAC3D,6DAA6D;QAC7D,gEAAgE;QAChE,gEAAgE;QAChE,0BAA0B;QAC1B,aAAa,EAAE,EAAE,cAAc,EAAE,cAAc,EAAE;QACjD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,iBAAiB;QAC3B,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;QAC5C,QAAQ,EAAE;YACT,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;YAClD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,kBAAkB;YAC3B,UAAU,EAAE,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,MAAM;YACnD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,KAAK,CAAC,QAAQ;SACjB;KACD,CAAC;IAEF,KAAK,MAAM,CAAC,GAAG,EAAE,CAChB,OAAO,CAAC,SAAS,CAAC,IAAI,CACrB,CAAC,MAAM,EAAE,EAAE,CACV,KAAK,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,oCAAoC,EAAE;QAC9E,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;QAC/B,MAAM;KACN,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,EACjC,EAAE,SAAS,EAAE,uBAAuB,EAAE,MAAM,EAAE,qCAAqC,EAAE,CACrF,CACD,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACxB,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YAC1B,iEAAiE;YACjE,6DAA6D;YAC7D,MAAM,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACnF,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC;YAC/B,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAClC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,8DAA8D,EAAE;oBACjF,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,OAAO;iBACP,CAAC,CAAC;YACJ,CAAC;YACD,MAAM,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAC7D,KAAK,CAAC,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CACrD,CAAC;YACF,OAAO;QACR,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC;QAC/B,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC/B,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,2CAA2C,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAClH,CAAC;aAAM,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACzC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnH,CAAC;aAAM,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACxG,CAAC;QACD,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;QACzE,MAAM,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAC7D,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAC/D,CAAC;QACF,MAAM,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAC7D,KAAK,CAAC,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAClD,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/cli/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/cli/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAYH,eAAO,MAAM,gBAAgB,6CA+B3B,CAAC;AAEH,eAAe,gBAAgB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/cli/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAaH,eAAO,MAAM,gBAAgB,6CAgC3B,CAAC;AAEH,eAAe,gBAAgB,CAAC"}

package/dist/cli/plugin.js

@@ -16,6 +16,7 @@
  */
 import { createRuntimePlugin, loader } from '@vibesdotdev/kernel';
 import accountApiClientPlugin from '@vibesdotdev/account/api-client-plugin';
+import accountOrgPlugin from "../org/account-org.plugin.js";
 import accountGroup from "./account-group.descriptor.js";
 import whoamiCommandDescriptor from "./commands/whoami.command.descriptor.js";
 import orgsCommandDescriptor from "./commands/orgs.command.descriptor.js";
@@ -47,6 +48,7 @@ export const accountCliPlugin = createRuntimePlugin({
     // impl resolves them via `getVibesClient`.
     onRegister: async (runtime) => {
         await runtime.registerPlugin(accountApiClientPlugin);
+        await runtime.registerPlugin(accountOrgPlugin);
     }
 });
 export default accountCliPlugin;

package/dist/cli/plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/cli/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,sBAAsB,MAAM,wCAAwC,CAAC;AAE5E,OAAO,YAAY,MAAM,+BAA+B,CAAC;AACzD,OAAO,uBAAuB,MAAM,yCAAyC,CAAC;AAC9E,OAAO,qBAAqB,MAAM,uCAAuC,CAAC;AAC1E,OAAO,uBAAuB,MAAM,0CAA0C,CAAC;AAE/E,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,aAAa,EAAW,CAAC;AAErD,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;IACnD,EAAE,EAAE,0BAA0B;IAC9B,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EACV,mGAAmG;IACpG,oEAAoE;IACpE,0EAA0E;IAC1E,wEAAwE;IACxE,yEAAyE;IACzE,iEAAiE;IACjE,YAAY,EAAE,CAAC,KAAK,CAAC;IAErB,WAAW,EAAE;QACZ,YAAY;QACZ,uBAAuB;QACvB,qBAAqB;QACrB,uBAAuB;KACvB;IAED,OAAO,EAAE;QACR,MAAM,CAAC,gBAAgB,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,mCAAmC,CAAC,CAAC;QACxF,MAAM,CAAC,cAAc,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC;QACpF,MAAM,CAAC,iBAAiB,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,oCAAoC,CAAC,CAAC;KAC1F;IAED,uEAAuE;IACvE,4EAA4E;IAC5E,2CAA2C;IAC3C,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7B,MAAM,OAAO,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;IACtD,CAAC;CACD,CAAC,CAAC;AAEH,eAAe,gBAAgB,CAAC"}
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/cli/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,sBAAsB,MAAM,wCAAwC,CAAC;AAC5E,OAAO,gBAAgB,MAAM,8BAA8B,CAAC;AAE5D,OAAO,YAAY,MAAM,+BAA+B,CAAC;AACzD,OAAO,uBAAuB,MAAM,yCAAyC,CAAC;AAC9E,OAAO,qBAAqB,MAAM,uCAAuC,CAAC;AAC1E,OAAO,uBAAuB,MAAM,0CAA0C,CAAC;AAE/E,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,aAAa,EAAW,CAAC;AAErD,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;IACnD,EAAE,EAAE,0BAA0B;IAC9B,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EACV,mGAAmG;IACpG,oEAAoE;IACpE,0EAA0E;IAC1E,wEAAwE;IACxE,yEAAyE;IACzE,iEAAiE;IACjE,YAAY,EAAE,CAAC,KAAK,CAAC;IAErB,WAAW,EAAE;QACZ,YAAY;QACZ,uBAAuB;QACvB,qBAAqB;QACrB,uBAAuB;KACvB;IAED,OAAO,EAAE;QACR,MAAM,CAAC,gBAAgB,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,mCAAmC,CAAC,CAAC;QACxF,MAAM,CAAC,cAAc,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC;QACpF,MAAM,CAAC,iBAAiB,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,oCAAoC,CAAC,CAAC;KAC1F;IAED,uEAAuE;IACvE,4EAA4E;IAC5E,2CAA2C;IAC3C,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7B,MAAM,OAAO,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;QACrD,MAAM,OAAO,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC;IAChD,CAAC;CACD,CAAC,CAAC;AAEH,eAAe,gBAAgB,CAAC"}

package/dist/org/account-org.plugin.d.ts

@@ -1,11 +1,10 @@
 /**
  * Account Org Plugin
  *
- * Registers request-scoped account context kinds (`orgId`, `userId`) with
- * the runtime. Apps populate the AsyncLocalStorage scope via
- * `runWithRequestContext(...)` in their hooks.server.ts; the runtime then
- * surfaces the values as `context.orgId` / `context.userId` in any
- * KindContext (notably `integration/provider`).
+ * Registers account context kinds (`orgId`, `userId`) with the runtime.
+ * Apps supply request values through `runWithRequestContext(...)`. The org
+ * context also uses the kernel invocation actor and, on an authenticated
+ * single-user interactive host, the user's stored organization selection.
  */
 export declare const accountOrgPlugin: import("@vibesdotdev/kernel").RuntimePlugin;
 export default accountOrgPlugin;

package/dist/org/account-org.plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-org.plugin.d.ts","sourceRoot":"","sources":["../../src/org/account-org.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,eAAO,MAAM,gBAAgB,6CAU3B,CAAC;AAEH,eAAe,gBAAgB,CAAC"}
+{"version":3,"file":"account-org.plugin.d.ts","sourceRoot":"","sources":["../../src/org/account-org.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,eAAO,MAAM,gBAAgB,6CAU3B,CAAC;AAEH,eAAe,gBAAgB,CAAC"}

package/dist/org/account-org.plugin.js

@@ -1,11 +1,10 @@
 /**
  * Account Org Plugin
  *
- * Registers request-scoped account context kinds (`orgId`, `userId`) with
- * the runtime. Apps populate the AsyncLocalStorage scope via
- * `runWithRequestContext(...)` in their hooks.server.ts; the runtime then
- * surfaces the values as `context.orgId` / `context.userId` in any
- * KindContext (notably `integration/provider`).
+ * Registers account context kinds (`orgId`, `userId`) with the runtime.
+ * Apps supply request values through `runWithRequestContext(...)`. The org
+ * context also uses the kernel invocation actor and, on an authenticated
+ * single-user interactive host, the user's stored organization selection.
  */
 import { createRuntimePlugin } from '@vibesdotdev/kernel';
 import { loader } from '@vibesdotdev/kernel/factory';
@@ -14,7 +13,7 @@ import userIdContextDescriptor from "./userId.context.descriptor.js";
 export const accountOrgPlugin = createRuntimePlugin({
     id: 'account-org',
     name: 'Account Org Context',
-    description: 'Request-scoped orgId and userId context kinds, backed by AsyncLocalStorage. Apps wrap their request lifecycle in `runWithRequestContext({ orgId, userId }, () => resolve(event))` to populate the scope.',
+    description: 'Account orgId and userId contexts for request scopes, invocation actors, and signed-in interactive hosts.',
     descriptors: [orgIdContextDescriptor, userIdContextDescriptor],
     loaders: [
         loader('orgId', { kind: 'context' }, () => import("./orgId.context.impl.js")),

package/dist/org/account-org.plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"account-org.plugin.js","sourceRoot":"","sources":["../../src/org/account-org.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,sBAAsB,MAAM,+BAA+B,CAAC;AACnE,OAAO,uBAAuB,MAAM,gCAAgC,CAAC;AAErE,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;IACnD,EAAE,EAAE,aAAa;IACjB,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EACV,0MAA0M;IAC3M,WAAW,EAAE,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;IAC9D,OAAO,EAAE;QACR,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAC7E,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC;KAC/E;CACD,CAAC,CAAC;AAEH,eAAe,gBAAgB,CAAC"}
+{"version":3,"file":"account-org.plugin.js","sourceRoot":"","sources":["../../src/org/account-org.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AACrD,OAAO,sBAAsB,MAAM,+BAA+B,CAAC;AACnE,OAAO,uBAAuB,MAAM,gCAAgC,CAAC;AAErE,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;IACnD,EAAE,EAAE,aAAa;IACjB,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EACV,2GAA2G;IAC5G,WAAW,EAAE,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;IAC9D,OAAO,EAAE;QACR,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAC7E,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC;KAC/E;CACD,CAAC,CAAC;AAEH,eAAe,gBAAgB,CAAC"}

package/dist/org/orgId.context.descriptor.d.ts

@@ -7,9 +7,8 @@
  * uniformly via `runtime.context('orgId')` or as `context.orgId` inside a
  * KindContext.
  *
- * Implementation is in `./orgId.context.impl.ts` and reads from the
- * AsyncLocalStorage scope established by `runWithRequestContext(...)` in
- * each app's hooks.server.ts.
+ * The implementation reads the Account request scope, then the kernel actor;
+ * a signed-in interactive host can use the organization selected by its user.
  */
 declare const _default: {
     id: string;

package/dist/org/orgId.context.descriptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orgId.context.descriptor.d.ts","sourceRoot":"","sources":["../../src/org/orgId.context.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAIH,wBAGG"}
+{"version":3,"file":"orgId.context.descriptor.d.ts","sourceRoot":"","sources":["../../src/org/orgId.context.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAIH,wBAGG"}

package/dist/org/orgId.context.descriptor.js

@@ -7,9 +7,8 @@
  * uniformly via `runtime.context('orgId')` or as `context.orgId` inside a
  * KindContext.
  *
- * Implementation is in `./orgId.context.impl.ts` and reads from the
- * AsyncLocalStorage scope established by `runWithRequestContext(...)` in
- * each app's hooks.server.ts.
+ * The implementation reads the Account request scope, then the kernel actor;
+ * a signed-in interactive host can use the organization selected by its user.
  */
 import { createContextDescriptor } from '@vibesdotdev/kernel/factory/context';
 export default createContextDescriptor({

package/dist/org/orgId.context.descriptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"orgId.context.descriptor.js","sourceRoot":"","sources":["../../src/org/orgId.context.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAE9E,eAAe,uBAAuB,CAAC;IACtC,EAAE,EAAE,OAAO;IACX,WAAW,EAAE,uDAAuD;CACpE,CAAC,CAAC"}
+{"version":3,"file":"orgId.context.descriptor.js","sourceRoot":"","sources":["../../src/org/orgId.context.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAE9E,eAAe,uBAAuB,CAAC;IACtC,EAAE,EAAE,OAAO;IACX,WAAW,EAAE,uDAAuD;CACpE,CAAC,CAAC"}

package/dist/org/orgId.context.impl.d.ts

@@ -1,11 +1,10 @@
 /**
- * orgId Context Implementation
+ * Active organization for the current invocation.
  *
- * Returns the current request scope's `orgId` on the resolving runtime (or
- * undefined when no scope is active, e.g. CLI / worker / test boot, or the host
- * declares no request values). The runtime calls `provide(runtime)` each time
- * the context is resolved, so per-request changes are picked up automatically
- * without cache invalidation.
+ * A request's explicit Account scope wins, including its personal scope. A
+ * queued invocation carries its actor through the kernel. On a single-user
+ * interactive host, the signed-in account's stored selection supplies the
+ * organization when the invocation has not named one.
  */
 import type { RuntimeRef } from '@vibesdotdev/kernel';
 declare const _default: {

package/dist/org/orgId.context.impl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orgId.context.impl.d.ts","sourceRoot":"","sources":["../../src/org/orgId.context.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;;uBAIlC,UAAU,KAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;;AAD5D,wBAEE"}
+{"version":3,"file":"orgId.context.impl.d.ts","sourceRoot":"","sources":["../../src/org/orgId.context.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;;uBAW5B,UAAU,KAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;;AADlE,wBAsBE"}

package/dist/org/orgId.context.impl.js

@@ -1,14 +1,40 @@
 /**
- * orgId Context Implementation
+ * Active organization for the current invocation.
  *
- * Returns the current request scope's `orgId` on the resolving runtime (or
- * undefined when no scope is active, e.g. CLI / worker / test boot, or the host
- * declares no request values). The runtime calls `provide(runtime)` each time
- * the context is resolved, so per-request changes are picked up automatically
- * without cache invalidation.
+ * A request's explicit Account scope wins, including its personal scope. A
+ * queued invocation carries its actor through the kernel. On a single-user
+ * interactive host, the signed-in account's stored selection supplies the
+ * organization when the invocation has not named one.
  */
-import { getCurrentOrgId } from "./request-context.js";
+import * as z from 'zod/v4';
+import { loadConfigForScope } from '@vibesdotdev/config/services/config';
+import { getCurrentRequestContext } from "./request-context.js";
+const IdentitySchema = z.object({
+    isAuthenticated: z.literal(true),
+    userId: z.string().trim().min(1)
+});
+const OrganizationIdSchema = z.string().trim().min(1);
 export default {
-    provide: (runtime) => getCurrentOrgId(runtime)
+    provide: async (runtime) => {
+        const request = await getCurrentRequestContext(runtime);
+        if (request)
+            return request.orgId;
+        const actor = runtime.scope.actor;
+        const capabilities = runtime.scope.capabilities;
+        const isInteractiveConsumer = Boolean(capabilities?.interactiveSession && !capabilities.sharedHost && !capabilities.requestPrincipals);
+        const isVerifiedConsumerActor = runtime.scope.hardware === 'consumer' && Boolean(actor?.userId);
+        if (!isInteractiveConsumer && !isVerifiedConsumerActor)
+            return actor?.orgId;
+        if (!runtime.hasContext('auth/identity'))
+            return actor?.orgId;
+        const identity = IdentitySchema.safeParse(await runtime.context('auth/identity'));
+        if (!identity.success || (actor?.userId && actor.userId !== identity.data.userId))
+            return undefined;
+        if (actor?.orgId)
+            return actor.orgId;
+        const config = await loadConfigForScope('global', runtime);
+        const organization = OrganizationIdSchema.safeParse(config.activeOrgId);
+        return organization.success ? organization.data : undefined;
+    }
 };
 //# sourceMappingURL=orgId.context.impl.js.map

package/dist/org/orgId.context.impl.js.map

@@ -1 +1 @@
-{"version":3,"file":"orgId.context.impl.js","sourceRoot":"","sources":["../../src/org/orgId.context.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,eAAe;IACd,OAAO,EAAE,CAAC,OAAmB,EAA+B,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC;CACvF,CAAC"}
+{"version":3,"file":"orgId.context.impl.js","sourceRoot":"","sources":["../../src/org/orgId.context.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAEtD,eAAe;IACd,OAAO,EAAE,KAAK,EAAE,OAAmB,EAA+B,EAAE;QACnE,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC,KAAK,CAAC;QAElC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QAClC,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;QAChD,MAAM,qBAAqB,GAAG,OAAO,CACpC,YAAY,EAAE,kBAAkB,IAAI,CAAC,YAAY,CAAC,UAAU,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAC/F,CAAC;QACF,MAAM,uBAAuB,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,UAAU,IAAI,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAChG,IAAI,CAAC,qBAAqB,IAAI,CAAC,uBAAuB;YAAE,OAAO,KAAK,EAAE,KAAK,CAAC;QAC5E,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,OAAO,KAAK,EAAE,KAAK,CAAC;QAE9D,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QACpG,IAAI,KAAK,EAAE,KAAK;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC;QAErC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC3D,MAAM,YAAY,GAAG,oBAAoB,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACxE,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,CAAC;CACD,CAAC"}

package/dist/plugin/billing-overage.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Billing overage policy subplugin — registers the `billing.overage`
+ * config/manifest, the declared defaults every overage resolution reads.
+ * The manifest waits for `config/manifest` to be registered, so a host
+ * without the config plugin composes this without failing.
+ */
+declare const defaultExport: import("@vibesdotdev/kernel").RuntimePlugin;
+export default defaultExport;
+//# sourceMappingURL=billing-overage.d.ts.map

package/dist/plugin/billing-overage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing-overage.d.ts","sourceRoot":"","sources":["../../src/plugin/billing-overage.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AAEH,QAAA,MAAM,aAAa,6CAKjB,CAAC;AAEH,eAAe,aAAa,CAAC"}

package/dist/plugin/billing-overage.js

@@ -0,0 +1,17 @@
+import { createRuntimePlugin } from '@vibesdotdev/kernel';
+import overagePolicyManifest from "../billing/overage/overage-policy.config.descriptor.js";
+/**
+ * Billing overage policy subplugin — registers the `billing.overage`
+ * config/manifest, the declared defaults every overage resolution reads.
+ * The manifest waits for `config/manifest` to be registered, so a host
+ * without the config plugin composes this without failing.
+ */
+// Hoisted const: tsc rewriteRelativeImportExtensions does not rewrite `.ts` specifiers inside `export default <expr>` (TS 6.0.3).
+const defaultExport = createRuntimePlugin({
+    id: 'account-billing-overage',
+    name: 'Account Billing Overage Policy',
+    description: 'Declares the billing.overage policy defaults.',
+    descriptors: [overagePolicyManifest]
+});
+export default defaultExport;
+//# sourceMappingURL=billing-overage.js.map

package/dist/plugin/billing-overage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing-overage.js","sourceRoot":"","sources":["../../src/plugin/billing-overage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,qBAAqB,MAAM,wDAAwD,CAAC;AAE3F;;;;;GAKG;AACH,kIAAkI;AAClI,MAAM,aAAa,GAAG,mBAAmB,CAAC;IACzC,EAAE,EAAE,yBAAyB;IAC7B,IAAI,EAAE,gCAAgC;IACtC,WAAW,EAAE,+CAA+C;IAC5D,WAAW,EAAE,CAAC,qBAAqB,CAAC;CACpC,CAAC,CAAC;AAEH,eAAe,aAAa,CAAC"}

package/dist/plugin/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/plugin/index.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,cAAc,+CAO1B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/plugin/index.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,cAAc,+CAS1B,CAAC"}

package/dist/plugin/index.js

@@ -2,14 +2,18 @@ import accountSupportPlugin from "./support.js";
 import accountClientPlugin from "./client.js";
 import accountApiClientPlugin from "./api-client.js";
 import accountBillingHooksPlugin from "./billing-hooks.js";
+import accountBillingOveragePlugin from "./billing-overage.js";
 import accountWorkersUsagePlugin from "./workers-usage.js";
 import accountSettingsStoragePlugin from "./settings-storage.js";
+import accountOrgPlugin from "../org/account-org.plugin.js";
 export const accountPlugins = [
     accountSupportPlugin,
     accountClientPlugin,
     accountApiClientPlugin,
     accountBillingHooksPlugin,
+    accountBillingOveragePlugin,
     accountWorkersUsagePlugin,
-    accountSettingsStoragePlugin
+    accountSettingsStoragePlugin,
+    accountOrgPlugin
 ];
 //# sourceMappingURL=index.js.map

package/dist/plugin/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/plugin/index.ts"],"names":[],"mappings":"AAAA,OAAO,oBAAoB,MAAM,cAAc,CAAC;AAChD,OAAO,mBAAmB,MAAM,aAAa,CAAC;AAC9C,OAAO,sBAAsB,MAAM,iBAAiB,CAAC;AACrD,OAAO,yBAAyB,MAAM,oBAAoB,CAAC;AAC3D,OAAO,yBAAyB,MAAM,oBAAoB,CAAC;AAC3D,OAAO,4BAA4B,MAAM,uBAAuB,CAAC;AAEjE,MAAM,CAAC,MAAM,cAAc,GAAG;IAC7B,oBAAoB;IACpB,mBAAmB;IACnB,sBAAsB;IACtB,yBAAyB;IACzB,yBAAyB;IACzB,4BAA4B;CAC5B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/plugin/index.ts"],"names":[],"mappings":"AAAA,OAAO,oBAAoB,MAAM,cAAc,CAAC;AAChD,OAAO,mBAAmB,MAAM,aAAa,CAAC;AAC9C,OAAO,sBAAsB,MAAM,iBAAiB,CAAC;AACrD,OAAO,yBAAyB,MAAM,oBAAoB,CAAC;AAC3D,OAAO,2BAA2B,MAAM,sBAAsB,CAAC;AAC/D,OAAO,yBAAyB,MAAM,oBAAoB,CAAC;AAC3D,OAAO,4BAA4B,MAAM,uBAAuB,CAAC;AACjE,OAAO,gBAAgB,MAAM,8BAA8B,CAAC;AAE5D,MAAM,CAAC,MAAM,cAAc,GAAG;IAC7B,oBAAoB;IACpB,mBAAmB;IACnB,sBAAsB;IACtB,yBAAyB;IACzB,2BAA2B;IAC3B,yBAAyB;IACzB,4BAA4B;IAC5B,gBAAgB;CAChB,CAAC"}

package/dist/system/account-system.config.descriptor.d.ts

@@ -1,11 +1,20 @@
 import * as z from 'zod/v4';
+/**
+ * The base case: a host that composes this plugin reads the canonical
+ * internal-service secret without also having to declare the reference in its
+ * workspace composition. A host that stores a different reference overrides it.
+ */
+export declare const CANONICAL_ACCOUNT_SYSTEM_ADMIN_CREDENTIAL: Readonly<{
+    source: "secret";
+    key: "VIBES_INTERNAL_SERVICE_TOKEN";
+}>;
 export declare const AccountSystemConfigSchema: z.ZodObject<{
-    adminCredential: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    adminCredential: z.ZodDefault<z.ZodDiscriminatedUnion<[z.ZodObject<{
         source: z.ZodLiteral<"secret">;
         key: z.ZodString;
         store: z.ZodOptional<z.ZodString>;
         operation: z.ZodOptional<z.ZodCustom<object, object>>;
-    }, z.core.$strict>], "source">;
+    }, z.core.$strict>], "source">>;
 }, z.core.$strict>;
 export type AccountSystemConfig = z.infer<typeof AccountSystemConfigSchema>;
 declare const _default: {
@@ -14,12 +23,12 @@ declare const _default: {
     name: string;
     namespace: string;
     schema: z.ZodObject<{
-        adminCredential: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        adminCredential: z.ZodDefault<z.ZodDiscriminatedUnion<[z.ZodObject<{
             source: z.ZodLiteral<"secret">;
             key: z.ZodString;
             store: z.ZodOptional<z.ZodString>;
             operation: z.ZodOptional<z.ZodCustom<object, object>>;
-        }, z.core.$strict>], "source">;
+        }, z.core.$strict>], "source">>;
     }, z.core.$strict>;
     scope: "global";
     tier: "system";
@@ -29,6 +38,10 @@ declare const _default: {
     customTables: false;
     version: number;
     internal: true;
+    credentials: {
+        field: string;
+        purpose: string;
+    }[];
 };
 export default _default;
 //# sourceMappingURL=account-system.config.descriptor.d.ts.map

package/dist/system/account-system.config.descriptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-system.config.descriptor.d.ts","sourceRoot":"","sources":["../../src/system/account-system.config.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAI5B,eAAO,MAAM,yBAAyB;;;;;;;kBAAiE,CAAC;AACxG,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;AAC5E,wBAMqC"}
+{"version":3,"file":"account-system.config.descriptor.d.ts","sourceRoot":"","sources":["../../src/system/account-system.config.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAI5B;;;;GAIG;AACH,eAAO,MAAM,yCAAyC;;;EAGpD,CAAC;AAEH,eAAO,MAAM,yBAAyB;;;;;;;kBAEpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;AAC5E,wBAOqC"}

package/dist/system/account-system.config.descriptor.js

@@ -1,11 +1,23 @@
 import * as z from 'zod/v4';
 import { CredentialReferenceSchema } from '@vibesdotdev/kernel/credentials';
-export const AccountSystemConfigSchema = z.strictObject({ adminCredential: CredentialReferenceSchema });
+/**
+ * The base case: a host that composes this plugin reads the canonical
+ * internal-service secret without also having to declare the reference in its
+ * workspace composition. A host that stores a different reference overrides it.
+ */
+export const CANONICAL_ACCOUNT_SYSTEM_ADMIN_CREDENTIAL = Object.freeze({
+    source: 'secret',
+    key: 'VIBES_INTERNAL_SERVICE_TOKEN'
+});
+export const AccountSystemConfigSchema = z.strictObject({
+    adminCredential: CredentialReferenceSchema.default(CANONICAL_ACCOUNT_SYSTEM_ADMIN_CREDENTIAL)
+});
 export default {
     id: 'account.system', kind: 'config/manifest', name: 'Account administration',
     namespace: 'account.system', schema: AccountSystemConfigSchema,
     scope: 'global', tier: 'system', storedLayer: 'none',
     allowedAdapters: ['storage.json', 'storage.localdb'], fields: {},
-    customTables: false, version: 1, internal: true
+    customTables: false, version: 1, internal: true,
+    credentials: [{ field: 'adminCredential', purpose: 'Authenticates system administration calls to the account admin API.' }]
 };
 //# sourceMappingURL=account-system.config.descriptor.js.map

package/dist/system/account-system.config.descriptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"account-system.config.descriptor.js","sourceRoot":"","sources":["../../src/system/account-system.config.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAG5E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,eAAe,EAAE,yBAAyB,EAAE,CAAC,CAAC;AAExG,eAAe;IACd,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,wBAAwB;IAC7E,SAAS,EAAE,gBAAgB,EAAE,MAAM,EAAE,yBAAyB;IAC9D,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM;IACpD,eAAe,EAAE,CAAC,cAAc,EAAE,iBAAiB,CAAC,EAAE,MAAM,EAAE,EAAE;IAChE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI;CACZ,CAAC"}
+{"version":3,"file":"account-system.config.descriptor.js","sourceRoot":"","sources":["../../src/system/account-system.config.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAG5E;;;;GAIG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,MAAM,CAAC,MAAM,CAAC;IACtE,MAAM,EAAE,QAAiB;IACzB,GAAG,EAAE,8BAA8B;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,YAAY,CAAC;IACvD,eAAe,EAAE,yBAAyB,CAAC,OAAO,CAAC,yCAAyC,CAAC;CAC7F,CAAC,CAAC;AAEH,eAAe;IACd,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,wBAAwB;IAC7E,SAAS,EAAE,gBAAgB,EAAE,MAAM,EAAE,yBAAyB;IAC9D,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM;IACpD,eAAe,EAAE,CAAC,cAAc,EAAE,iBAAiB,CAAC,EAAE,MAAM,EAAE,EAAE;IAChE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI;IAC/C,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,qEAAqE,EAAE,CAAC;CACxF,CAAC"}

package/dist/system/config.d.ts

@@ -1,5 +1,10 @@
-import type { RuntimeRef } from '@vibesdotdev/kernel';
+import { type RuntimeRef } from '@vibesdotdev/kernel';
 export declare function resolveAccountSystemOrigin(runtime: RuntimeRef): Promise<string>;
-/** The host declares one reference; missing credentials and store failures stay typed. */
+/**
+ * The host declares one reference; missing credentials and store failures stay typed.
+ * Account exposes no kernel kind for this credential, so the caller reaches it by
+ * this function: a host that does not compose the `account.system` plugin is
+ * refused with a composition error naming the plugin and key, not a lookup miss.
+ */
 export declare function resolveAccountSystemAdminToken(runtime: RuntimeRef): Promise<string>;
 //# sourceMappingURL=config.d.ts.map

package/dist/system/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/system/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAKtD,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAE/E;AAED,0FAA0F;AAC1F,wBAAsB,8BAA8B,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAKzF"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/system/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAKvE,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAE/E;AAED;;;;;GAKG;AACH,wBAAsB,8BAA8B,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBzF"}

package/dist/system/config.js

@@ -1,10 +1,24 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
 import { ConfigManifest } from '@vibesdotdev/config/manifest/config-manifest';
 import { serviceOrigin } from '@vibesdotdev/infra-core/service';
 export function resolveAccountSystemOrigin(runtime) {
     return serviceOrigin(runtime, 'account', 'internal');
 }
-/** The host declares one reference; missing credentials and store failures stay typed. */
+/**
+ * The host declares one reference; missing credentials and store failures stay typed.
+ * Account exposes no kernel kind for this credential, so the caller reaches it by
+ * this function: a host that does not compose the `account.system` plugin is
+ * refused with a composition error naming the plugin and key, not a lookup miss.
+ */
 export async function resolveAccountSystemAdminToken(runtime) {
+    if (!ConfigManifest.isRegistered(runtime, 'account.system')) {
+        throw new CapabilityError("This host reads the account administration credential but does not compose the 'account.system' plugin.", 'UNAVAILABLE', {
+            reason: 'account-system-not-composed',
+            retryable: false,
+            details: { plugin: 'account.system', manifest: 'account.system', key: 'adminCredential' },
+            recoveryHint: "Select '@vibesdotdev/account/system/plugin' in this host's composition and set config['account.system'].adminCredential."
+        });
+    }
     const config = await ConfigManifest.forRuntime(runtime, 'account.system').load();
     const result = await runtime.resolveCredential(config.adminCredential);
     if (!result.ok)

package/dist/system/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/system/config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAGhE,MAAM,UAAU,0BAA0B,CAAC,OAAmB;IAC7D,OAAO,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;AACtD,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,OAAmB;IACvE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,CAAsB,OAAO,EAAE,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;IACtG,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,MAAM,CAAC,KAAK,CAAC;IACnC,OAAO,MAAM,CAAC,KAAK,CAAC;AACrB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/system/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAmB,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAGhE,MAAM,UAAU,0BAA0B,CAAC,OAAmB;IAC7D,OAAO,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,OAAmB;IACvE,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,OAAO,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,eAAe,CACxB,yGAAyG,EACzG,aAAa,EACb;YACC,MAAM,EAAE,6BAA6B;YACrC,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,iBAAiB,EAAE;YACzF,YAAY,EAAE,0HAA0H;SACxI,CACD,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,CAAsB,OAAO,EAAE,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;IACtG,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,MAAM,CAAC,KAAK,CAAC;IACnC,OAAO,MAAM,CAAC,KAAK,CAAC;AACrB,CAAC"}