agl 40.4.0 → 40.5.1

package/ts/classes.inferencespend.ts

@@ -0,0 +1,870 @@
+import * as plugins from './plugins.js';
+
+type TSpendAnswer = plugins.authswitchAuthority.IAuthSwitchSpendAnswer;
+type TUsageSnapshot = plugins.authswitchAuthority.IAuthSwitchUsageSnapshot;
+
+const hex64 = /^[a-f0-9]{64}$/;
+/** A service tier as a spend answer names it (`IAuthSwitchSpendAnswer.serviceTier`). */
+const serviceTierPattern = /^[a-z][a-z0-9_-]{0,63}$/;
+
+const isRecord = (valueArg: unknown): valueArg is Record<string, unknown> =>
+  typeof valueArg === 'object' && valueArg !== null && !Array.isArray(valueArg);
+
+/** The record's entry for a name the record itself holds, never one inherited from `Object.prototype`. */
+const own = <T>(recordArg: Readonly<Record<string, T>> | undefined, keyArg: string): T | undefined =>
+  recordArg !== undefined && Object.prototype.hasOwnProperty.call(recordArg, keyArg) ? recordArg[keyArg] : undefined;
+
+/** An error in one line, as the proxy's journal states it: its class and its own words, which carry no credential. */
+const oneLine = (errorArg: unknown): string =>
+  (errorArg instanceof Error ? `${errorArg.name}: ${errorArg.message}` : String(errorArg)).replace(/\s+/gu, ' ');
+
+/** An account as the journal names it: the first 12 hex characters of the SHA-256 digest of its id. */
+const accountDigest = (accountIdArg: string): string =>
+  plugins.crypto.createHash('sha256').update(accountIdArg).digest('hex').slice(0, 12);
+
+// Pricing ---------------------------------------------------------------------------------------------------------
+
+/**
+ * The tool types of the Messages API whose calls the caller runs itself, so a request carrying them costs tokens only:
+ * a tool the caller defines (no `type`, or `custom`) and Anthropic's client tools and client toolsets, as Anthropic's
+ * tool reference lists them (https://platform.claude.com/docs/en/agents-and-tools/tool-use/tool-reference, read
+ * 2026-10-22). Every other type is a tool Anthropic runs, a server tool, priced by its exact type
+ * (`getAnthropicServerToolPrice`) or not at all. Claude Code 2.1.306 declares its own tools, its tool search included,
+ * as `custom` ones; its WebSearch runs in a request of its own with `web_search_20250305`, and `advisor_20260301` comes
+ * only with an `advisorModel` setting.
+ */
+const anthropicClientToolTypes: ReadonlySet<string> = new Set(['custom', 'memory_20250818', 'bash_20250124',
+  'text_editor_20250728', 'text_editor_20250124', 'computer_toolset_20260801', 'computer_20251124', 'computer_20250124',
+  'browser_toolset_20260801']);
+
+/**
+ * The `type` of every server tool a Messages request declares: each tool whose type is neither absent nor one of the
+ * client tools (`anthropicClientToolTypes`); a type that is no string is named as it reads.
+ */
+export const inferenceAnthropicServerToolTypes = (bodyArg: Record<string, unknown>): string[] =>
+  (Array.isArray(bodyArg.tools) ? bodyArg.tools : []).flatMap((toolArg): string[] => {
+    const type = isRecord(toolArg) ? toolArg.type : undefined;
+    if (type === undefined || type === null || (typeof type === 'string' && anthropicClientToolTypes.has(type))) return [];
+    return [typeof type === 'string' ? type : JSON.stringify(type)];
+  });
+
+/**
+ * The price of a request's answers: the model's, with the call fees of the server tools the request declares
+ * (`getAnthropicRequestPrice`); `undefined` when the model or one of the tools has no price.
+ */
+const anthropicRequestPrice = (modelArg: string, serverToolTypesArg: readonly string[]): plugins.flexModels.IModelPrice | undefined => {
+  const price = plugins.anthropicProvider.getAnthropicModelPrice(modelArg);
+  return price && plugins.anthropicProvider.getAnthropicRequestPrice(price, serverToolTypesArg);
+};
+
+/**
+ * What of an Anthropic Messages request the proxy's price table (flexharness `getAnthropicModelPrice`,
+ * `getAnthropicRequestPrice`, `getAnthropicServerToolPrice`) cannot price, in words, or `undefined` when all of it can
+ * be: the model; a service tier other than `auto` and `standard_only`, the two a request may name
+ * (https://platform.claude.com/docs/en/api/service-tiers, read 2026-10-22), as the proxy sends a key with a spend limit
+ * on the standard tier only; a speed the model has no price for (`speed: "fast"` is Fast mode); an `inference_geo` the
+ * model has no surcharge for; a server tool whose exact type has no price, Anthropic's MCP connector included. A key
+ * with a monthly spend limit takes no such request, since its answer could not be priced (Decision Q4). The answer is
+ * still priced by the model that answered and what its usage states, never by this.
+ */
+export const inferenceAnthropicUnpricedRequest = (bodyArg: Record<string, unknown>): string | undefined => {
+  const model = typeof bodyArg.model === 'string' ? bodyArg.model : '';
+  const price = plugins.anthropicProvider.getAnthropicModelPrice(model);
+  if (!price) return `the model ${model}, which AGL's price table does not list`;
+  const tier = bodyArg.service_tier;
+  if (tier !== undefined && tier !== null && tier !== 'auto' && tier !== 'standard_only') {
+    return `the service tier ${JSON.stringify(tier)}, of which only "auto" and "standard_only" go to a key with a spend limit`;
+  }
+  const speed = bodyArg.speed;
+  const service = speed === undefined || speed === null || speed === 'standard' ? 'standard' : speed === 'fast' ? 'fast' : undefined;
+  if (service === undefined || own(price.services, service) === undefined) {
+    return `the speed ${JSON.stringify(speed)} of ${model}, which AGL's price table does not price`;
+  }
+  const geo = bodyArg.inference_geo;
+  if (geo !== undefined && geo !== null && geo !== 'global'
+    && (typeof geo !== 'string' || own(price.surcharges, `inference_geo:${geo}`) === undefined)) {
+    return `inference_geo ${JSON.stringify(geo)} on ${model}, which AGL's price table does not price`;
+  }
+  if (Array.isArray(bodyArg.mcp_servers) && bodyArg.mcp_servers.length > 0) {
+    return 'the MCP connector (mcp_servers), whose calls AGL\'s price table does not price';
+  }
+  const serverTools = inferenceAnthropicServerToolTypes(bodyArg);
+  let requestPrice: plugins.flexModels.IModelPrice | undefined;
+  try {
+    requestPrice = plugins.anthropicProvider.getAnthropicRequestPrice(price, serverTools);
+  } catch {
+    return `the server tools ${serverTools.map((typeArg) => JSON.stringify(typeArg)).join(', ')}, whose fees AGL's price `
+      + 'table states twice';
+  }
+  if (requestPrice) return undefined;
+  const unpricedTool = serverTools.find((typeArg) => plugins.anthropicProvider.getAnthropicServerToolPrice(typeArg) === undefined);
+  return `the server tool ${JSON.stringify(unpricedTool)}, whose calls AGL's price table does not price`;
+};
+
+/**
+ * The bytes a request goes to an Anthropic API key with a spend limit as: the body the price check read
+ * (`inferenceAnthropicUnpricedRequest`), encoded again with `service_tier: "standard_only"`, so it is served on the
+ * standard tier the price table prices and never on Priority Tier, which has no published price (lane A ruling 6), and
+ * Anthropic receives exactly what was checked -- also when the client named `standard_only` itself.
+ */
+export const inferenceAnthropicCheckedBytes = (bodyArg: Record<string, unknown>): Uint8Array<ArrayBuffer> =>
+  new TextEncoder().encode(JSON.stringify({ ...bodyArg, service_tier: 'standard_only' }));
+
+/** What a relayed answer stated about its usage, as the gateway's usage tap read it while the answer passed. */
+export interface IInferenceAnsweredUsage {
+  /** The model that answered, as the answer named it; absent when it named none the tap could read. */
+  model?: string;
+  /**
+   * The answer's usage object as the provider sent it -- a stream's merged from `message_start` and the `message_delta`s
+   * after it -- absent when the answer stated none.
+   */
+  usage?: Record<string, unknown>;
+  /** The answer arrived whole: a JSON body read to its end, or a stream through `message_stop`. */
+  complete: boolean;
+}
+
+/** One answer's spend as the outbox keeps it, and why it could not be priced when it could not. */
+export interface IInferenceSpendRecord {
+  answer: TSpendAnswer;
+  /** Why the answer could not be priced (`answer.microUsd` is then null). */
+  unpriced?: string;
+}
+
+/**
+ * The spend of an answer an Anthropic API key served, priced once by the model that answered and the usage it stated
+ * (`readAnthropicMessagesUsage`, `priceModelCall`), never by the requested model, with the call fees of the server tools
+ * the request declared (`serverToolTypesArg`, `getAnthropicRequestPrice`). An answer whose model has no price, whose usage
+ * cannot be read completely or priced -- a tier, a cache lifetime, a server tool or a region the price lacks -- counts
+ * as one that could not be priced (`microUsd: null`), which holds a key with a spend limit until its month ends. A stream
+ * cut before it stated any usage records nothing: the client received no token of it; one cut later is priced on the
+ * usage it stated by then. `requestedModelArg` names the answer when it named no model.
+ */
+export const inferenceAnthropicSpend = (answeredArg: IInferenceAnsweredUsage, requestedModelArg: string,
+  nowArg: number, serverToolTypesArg: readonly string[] = []): IInferenceSpendRecord | undefined => {
+  if (!answeredArg.usage && !answeredArg.complete) return undefined;
+  const model = [answeredArg.model, requestedModelArg].find((modelArg) => plugins.authswitchUsageTokens.isAuthSwitchModelId(modelArg));
+  if (model === undefined) throw new Error('A relayed answer names no model a spend report takes.');
+  const reportedTier = answeredArg.usage?.service_tier;
+  const answer = { answerId: plugins.crypto.randomUUID(), endedAt: new Date(nowArg).toISOString(), model,
+    serviceTier: typeof reportedTier === 'string' && serviceTierPattern.test(reportedTier) ? reportedTier : null };
+  const unpriced = (reasonArg: string): IInferenceSpendRecord =>
+    ({ answer: { ...answer, microUsd: null, priceSource: null }, unpriced: reasonArg });
+  if (!answeredArg.usage) return unpriced('the answer stated no usage');
+  let usage: plugins.flexModels.IModelPricedUsage;
+  try {
+    usage = plugins.anthropicProvider.readAnthropicMessagesUsage(answeredArg.usage);
+  } catch (errorArg) {
+    if (errorArg instanceof plugins.flexModels.ModelUsageReadError) return unpriced(errorArg.message);
+    throw errorArg;
+  }
+  if (!plugins.anthropicProvider.getAnthropicModelPrice(model)) return unpriced(`AGL's price table does not list the model ${model}`);
+  let price: plugins.flexModels.IModelPrice | undefined;
+  try {
+    price = anthropicRequestPrice(model, serverToolTypesArg);
+  } catch (errorArg) {
+    return unpriced(`AGL's price table disagrees with itself: ${oneLine(errorArg)}`);
+  }
+  if (!price) return unpriced(`AGL's price table has no price for a server tool the request declared (${serverToolTypesArg.join(', ')})`);
+  const cost = plugins.flexModels.priceModelCall(price, usage);
+  if (!cost.priced) return unpriced(`AGL's price table could not price it (${cost.reason}, service ${usage.service})`);
+  if (cost.microUsd > plugins.authswitchAuthority.authSwitchSpendAnswerMaxMicroUsd) {
+    return unpriced(`its price of ${cost.microUsd} micro-dollars is beyond what one answer can cost`);
+  }
+  return { answer: { ...answer, microUsd: cost.microUsd, priceSource: price.source.checkedAt } };
+};
+
+/**
+ * The tool types of the Responses API whose calls the caller runs itself, so a request declaring them costs tokens only,
+ * as OpenAI's Responses reference lists its tools (https://developers.openai.com/api/reference/resources/responses/methods/create
+ * and https://developers.openai.com/api/docs/guides/tools, read 2026-10-22): a function (`function`), a custom tool
+ * (`custom`), the local shell (`local_shell`), apply patch (`apply_patch`) and computer use (`computer`,
+ * `computer_use_preview`), whose calls the caller executes and answers. Two types are client tools in one mode only:
+ * `shell` with `environment.type: "local"` -- in a container OpenAI runs it
+ * (https://developers.openai.com/api/docs/guides/tools-shell) -- and `tool_search` with `execution: "client"`, whose
+ * search the caller runs and answers with a `tool_search_output` item; hosted, OpenAI runs it
+ * (https://developers.openai.com/api/docs/guides/tools-tool-search, read 2026-10-23). A `namespace` groups function and
+ * custom tools, each judged on its own. Every other type is a tool OpenAI runs, a server tool, priced only by the fee of
+ * its exact type (`IModelPrice.toolCallFees`: `web_search`, `file_search`), so `web_search_preview` and a dated
+ * `web_search_2025_08_26` have no price. Codex 0.163 sends `function`, `custom`, `tool_search` (`execution: "client"`)
+ * and `web_search` (`test/e2e/e2e.proxyspendcodex.node.ts`).
+ */
+const openAiClientToolTypes: ReadonlySet<string> = new Set(['function', 'custom', 'local_shell', 'apply_patch', 'computer',
+  'computer_use_preview']);
+
+/**
+ * The `type` of every server tool a Responses request declares, in `tools` and in the tools its input adds
+ * (`additional_tools` and `tool_search_output` items), a namespace's own tools included: each tool that is no client
+ * tool (`openAiClientToolTypes`, a local `shell`); a type that is no string is named as it reads.
+ */
+export const inferenceOpenAiServerToolTypes = (bodyArg: Record<string, unknown>): string[] => {
+  const declared = (toolsArg: unknown): string[] => (Array.isArray(toolsArg) ? toolsArg : []).flatMap((toolArg): string[] => {
+    const tool: Record<string, unknown> = isRecord(toolArg) ? toolArg : {};
+    const type = tool.type;
+    if (type === 'namespace') return declared(tool.tools);
+    if ((typeof type === 'string' && openAiClientToolTypes.has(type))
+      || (type === 'shell' && isRecord(tool.environment) && tool.environment.type === 'local')
+      || (type === 'tool_search' && tool.execution === 'client')) return [];
+    return [typeof type === 'string' ? type : String(JSON.stringify(type))];
+  });
+  const added = (Array.isArray(bodyArg.input) ? bodyArg.input : []).flatMap((itemArg) => isRecord(itemArg)
+    && (itemArg.type === 'additional_tools' || itemArg.type === 'tool_search_output') ? declared(itemArg.tools) : []);
+  return [...declared(bodyArg.tools), ...added];
+};
+
+/**
+ * The service tier a Responses request goes to an OpenAI API key with a spend limit on: the one the client named when it
+ * named a tier the price table prices for the model, else Standard (`default`), never `auto`, which a project set to Fast
+ * serves at Fast prices (`readme` of flexharness-providers' OpenAI provider).
+ */
+const openAiCheckedTier = (bodyArg: Record<string, unknown>): string =>
+  typeof bodyArg.service_tier === 'string' && bodyArg.service_tier !== 'auto' ? bodyArg.service_tier : 'default';
+
+/**
+ * What of a Responses request the proxy's price table (flexharness `getOpenAiModelPrice`) cannot price, in words, or
+ * `undefined` when all of it can be: the model, by its exact id or a listed snapshot (a dated id the price lists not is
+ * unpriced); an explicit service tier the model has no price for (`auto` and none go out as `default`; `fast` names
+ * Fast mode; `scale` has no published price); a background response (`background: true`), whose answer never passes the
+ * proxy; a server tool whose exact type has no call fee (`inferenceOpenAiServerToolTypes`). An OpenAI API key with a
+ * monthly spend limit takes no such request (Decision Q4).
+ */
+export const inferenceOpenAiUnpricedRequest = (bodyArg: Record<string, unknown>): string | undefined => {
+  const model = typeof bodyArg.model === 'string' ? bodyArg.model : '';
+  const price = plugins.openAiProvider.getOpenAiModelPrice(model);
+  if (!price) return `the model ${model}, which AGL's price table does not list`;
+  const tier = bodyArg.service_tier;
+  if (tier !== undefined && tier !== null && tier !== 'auto'
+    && (typeof tier !== 'string' || own(price.services, tier) === undefined)) {
+    return `the service tier ${JSON.stringify(tier)} of ${model}, which AGL's price table does not price`;
+  }
+  if (bodyArg.background === true) {
+    return 'a background response (background: true), whose answer does not pass the proxy to be priced';
+  }
+  const unpricedTool = inferenceOpenAiServerToolTypes(bodyArg).find((typeArg) => own(price.toolCallFees, typeArg) === undefined);
+  return unpricedTool === undefined ? undefined
+    : `the server tool ${JSON.stringify(unpricedTool)}, whose calls AGL's price table does not price`;
+};
+
+/**
+ * The bytes a Responses request goes to an OpenAI API key with a spend limit as: the body the price check read
+ * (`inferenceOpenAiUnpricedRequest`), the model rewritten to `wireModelArg`, encoded again with the service tier it was
+ * checked for (`default` when the client named `auto` or none), so OpenAI serves it on a tier the price table prices.
+ */
+export const inferenceOpenAiCheckedBytes = (bodyArg: Record<string, unknown>, wireModelArg: string): Uint8Array<ArrayBuffer> =>
+  new TextEncoder().encode(JSON.stringify({ ...bodyArg, model: wireModelArg, service_tier: openAiCheckedTier(bodyArg) }));
+
+/** What a relayed Responses answer stated for its price, as the gateway's usage tap read it while the answer passed. */
+export interface IInferenceResponsesAnswered {
+  /**
+   * How the answer ended: `answered`, its terminal event (`response.completed`, `response.incomplete`,
+   * `response.failed`) or its JSON body was read; `unreadable`, it arrived but was too large to read (over 8 MiB);
+   * `cut`, it ended before either arrived -- the client left, or the provider's stream ended or failed.
+   */
+  outcome: 'answered' | 'unreadable' | 'cut';
+  /** The response's `status` as stated (`completed`, `incomplete`, `failed`). */
+  status?: string;
+  /** The model that answered (`response.model`). */
+  model?: string;
+  /** The service tier that served it (`response.service_tier`), as stated. */
+  serviceTier?: unknown;
+  /** The response's `usage` object as sent; absent when it stated none. */
+  usage?: Record<string, unknown>;
+  /** The ids of the answer's `web_search_call` and `file_search_call` items, each once, whatever its action. */
+  webSearchCalls: ReadonlySet<string>;
+  fileSearchCalls: ReadonlySet<string>;
+  /** A web or file search call without an id, which cannot be counted once. */
+  unidentifiedCalls: boolean;
+}
+
+/**
+ * The spend of a Responses answer an OpenAI API key served, priced once by the model that answered, the tier that served
+ * it and the usage it stated (`readOpenAiResponsesUsage`, `priceModelCall`), with every `web_search_call` item one web
+ * search and every `file_search_call` item one file search, counted once per item id whatever its action -- so AGL's
+ * figure can exceed OpenAI's bill. A completed, incomplete or failed answer that states its usage is priced; one whose
+ * model, tier or usage the price table cannot price counts as one that could not be priced (`microUsd: null`), which
+ * holds a key with a spend limit until its month ends, and so does one that arrived too large to read, or a completed
+ * or incomplete one that states no usage. A failed answer that states none, and one cut before its terminal event,
+ * record nothing (`undefined`): no usage is estimated, and the caller says so in the journal.
+ */
+export const inferenceOpenAiSpend = (answeredArg: IInferenceResponsesAnswered, requestedModelArg: string,
+  nowArg: number): IInferenceSpendRecord | undefined => {
+  if (answeredArg.outcome === 'cut' || (answeredArg.outcome === 'answered' && !answeredArg.usage && answeredArg.status === 'failed')) {
+    return undefined;
+  }
+  const model = [answeredArg.model, requestedModelArg].find((modelArg) => plugins.authswitchUsageTokens.isAuthSwitchModelId(modelArg));
+  if (model === undefined) throw new Error('A relayed answer names no model a spend report takes.');
+  const tier = answeredArg.serviceTier;
+  const answer = { answerId: plugins.crypto.randomUUID(), endedAt: new Date(nowArg).toISOString(), model,
+    serviceTier: typeof tier === 'string' && serviceTierPattern.test(tier) ? tier : null };
+  const unpriced = (reasonArg: string): IInferenceSpendRecord =>
+    ({ answer: { ...answer, microUsd: null, priceSource: null }, unpriced: reasonArg });
+  if (answeredArg.outcome === 'unreadable') return unpriced('its final event was too large to read');
+  if (!answeredArg.usage) return unpriced('the answer stated no usage');
+  if (answeredArg.unidentifiedCalls) return unpriced('it holds a web or file search call without an id, which cannot be counted once');
+  let usage: plugins.flexModels.IModelPricedUsage;
+  try {
+    usage = plugins.openAiProvider.readOpenAiResponsesUsage(answeredArg.usage, tier);
+  } catch (errorArg) {
+    if (errorArg instanceof plugins.flexModels.ModelUsageReadError) return unpriced(errorArg.message);
+    throw errorArg;
+  }
+  const price = plugins.openAiProvider.getOpenAiModelPrice(model);
+  if (!price) return unpriced(`AGL's price table does not list the model ${model}`);
+  const toolCalls: Record<string, number> = {
+    ...(answeredArg.webSearchCalls.size ? { web_search: answeredArg.webSearchCalls.size } : {}),
+    ...(answeredArg.fileSearchCalls.size ? { file_search: answeredArg.fileSearchCalls.size } : {}),
+  };
+  const cost = plugins.flexModels.priceModelCall(price, { ...usage, toolCalls });
+  if (!cost.priced) return unpriced(`AGL's price table could not price it (${cost.reason}, service ${usage.service})`);
+  if (cost.microUsd > plugins.authswitchAuthority.authSwitchSpendAnswerMaxMicroUsd) {
+    return unpriced(`its price of ${cost.microUsd} micro-dollars is beyond what one answer can cost`);
+  }
+  return { answer: { ...answer, microUsd: cost.microUsd, priceSource: price.source.checkedAt } };
+};
+
+// The outbox -------------------------------------------------------------------------------------------------------
+
+/**
+ * One answer the proxy relayed on an API key, as its outbox keeps it until the accounts service acknowledged its cost:
+ * the spend report answer (`IAuthSwitchSpendAnswer`, its `answerId` as `id`) and the key's account. No prompt, answer
+ * content, token count or credential is part of it.
+ */
+export interface IInferenceSpendDocument {
+  /** The answer's id (`IAuthSwitchSpendAnswer.answerId`), a UUID. */
+  id: string;
+  /** The API key's account. */
+  accountId: string;
+  /**
+   * The key's login the answer was served on, which its report names, also once the key is removed; `null` when none
+   * could be named, so the answer waits, counted, until one can (`IInferenceSpendOutboxOptions.attribute`).
+   */
+  loginId: string | null;
+  endedAt: string;
+  model: string;
+  serviceTier: string | null;
+  microUsd: number | null;
+  priceSource: string | null;
+}
+
+const answerOf = (documentArg: IInferenceSpendDocument): TSpendAnswer => ({ answerId: documentArg.id,
+  endedAt: documentArg.endedAt, model: documentArg.model, serviceTier: documentArg.serviceTier,
+  microUsd: documentArg.microUsd, priceSource: documentArg.priceSource });
+
+const assertDocument: (valueArg: unknown) => asserts valueArg is IInferenceSpendDocument = (valueArg) => {
+  const value = valueArg as IInferenceSpendDocument | null;
+  if (!isRecord(value) || Object.keys(value).length !== 8 || typeof value.accountId !== 'string' || !hex64.test(value.accountId)
+    || (value.loginId !== null && (typeof value.loginId !== 'string' || !hex64.test(value.loginId)))
+    || !plugins.authswitchAuthority.isAuthSwitchSpendAnswer(answerOf(value))) {
+    throw new Error('Invalid inference spend answer.');
+  }
+};
+
+@plugins.nosqldb.managed({ collectionName: 'agl_inference_spend' })
+@plugins.nosqldb.exactPersistence({ assertDocument })
+export class InferenceSpendModel extends plugins.nosqldb.SmartDataDbDoc<InferenceSpendModel, IInferenceSpendDocument> {
+  declare static exact: plugins.nosqldb.TExact<InferenceSpendModel>;
+  @plugins.nosqldb.unI() public id!: string;
+  @plugins.nosqldb.svDb() public accountId!: string;
+  @plugins.nosqldb.svDb() public loginId!: string | null;
+  @plugins.nosqldb.svDb() public endedAt!: string;
+  @plugins.nosqldb.svDb() public model!: string;
+  @plugins.nosqldb.svDb() public serviceTier!: string | null;
+  @plugins.nosqldb.svDb() public microUsd!: number | null;
+  @plugins.nosqldb.svDb() public priceSource!: string | null;
+}
+
+/** An answer the outbox keeps, with its key's account and the login it was served on (`null`: none named yet). */
+export interface IInferenceSpendEntry {
+  accountId: string;
+  loginId: string | null;
+  answer: TSpendAnswer;
+}
+
+/** The outbox's durable side: the answers kept in the proxy's own database until acknowledged. */
+export interface IInferenceSpendStore {
+  /** Every answer kept. */
+  load(signalArg: AbortSignal): Promise<IInferenceSpendEntry[]>;
+  /** Keeps an answer; one kept already with the same content is kept. */
+  insert(entryArg: IInferenceSpendEntry, signalArg: AbortSignal): Promise<void>;
+  /** Forgets answers by id; one forgotten already is forgotten. */
+  delete(answerIdsArg: readonly string[], signalArg: AbortSignal): Promise<void>;
+}
+
+/** How long one store write may take before it counts as failed. */
+const storeWriteTimeoutMs = 30_000;
+
+/** How many kept answers one read of the store loads at a time. */
+const loadPage = 256;
+
+/** The outbox's store in the proxy's database (`agl_inference_spend`, a model of `proxyModels`). */
+export class InferenceSpendStore implements IInferenceSpendStore {
+  public async load(signalArg: AbortSignal): Promise<IInferenceSpendEntry[]> {
+    const entries: IInferenceSpendEntry[] = [];
+    let after: string | undefined;
+    for (;;) {
+      const stored = await InferenceSpendModel.exact.findStored({ ...(after === undefined ? {} : { filter: { id: { $gt: after } } }),
+        sort: { id: 1 }, limit: loadPage, signal: signalArg });
+      for (const entry of stored) {
+        const document = InferenceSpendModel.exact.toPersisted(entry);
+        entries.push({ accountId: document.accountId, loginId: document.loginId, answer: answerOf(document) });
+      }
+      if (stored.length < loadPage) return entries;
+      after = entries.at(-1)!.answer.answerId;
+    }
+  }
+
+  public async insert(entryArg: IInferenceSpendEntry, signalArg: AbortSignal): Promise<void> {
+    const { answer } = entryArg;
+    const document: IInferenceSpendDocument = { id: answer.answerId, accountId: entryArg.accountId, loginId: entryArg.loginId,
+      endedAt: answer.endedAt,
+      model: answer.model, serviceTier: answer.serviceTier, microUsd: answer.microUsd, priceSource: answer.priceSource };
+    const inserted = await InferenceSpendModel.exact.insert(document, { signal: signalArg });
+    if (inserted.status !== 'conflict') return;
+    const held = InferenceSpendModel.exact.toPersisted(inserted.document);
+    if (JSON.stringify(held) !== JSON.stringify(document)) throw new Error('The proxy keeps another answer under this answer id.');
+  }
+
+  public async delete(answerIdsArg: readonly string[], signalArg: AbortSignal): Promise<void> {
+    for (const id of answerIdsArg) {
+      const current = await InferenceSpendModel.exact.findStoredOne({ id }, { signal: signalArg });
+      if (!current) continue;
+      const deleted = await InferenceSpendModel.exact.delete({ current }, { signal: signalArg });
+      if (deleted.status !== 'deleted' && await InferenceSpendModel.exact.findStoredOne({ id }, { signal: signalArg })) {
+        throw new Error('A spend answer could not be removed from the proxy\'s store.');
+      }
+    }
+  }
+}
+
+/**
+ * Something the outbox says in the proxy's journal: an answer that could not be priced (`unpriced`, an accounting
+ * error), a report the accounts service refused (`refused`), a key whose reports keep failing (`unreported`, said once
+ * until one goes through), answers the store could not keep (`unkept`) or acknowledged answers it could not remove
+ * (`unremoved`), each said once until the store takes writes again, an answer recorded with no login of its key
+ * (`unattributed`), and each answer that ended without its provider stating its usage, which counts nowhere (`uncounted`).
+ * Keys are named by their account's digest.
+ */
+export type TInferenceSpendJournalEntry =
+  | { kind: 'unpriced'; account: string; model: string; reason: string }
+  | { kind: 'refused'; account: string; answers: number; error: string; retryAt: string }
+  | { kind: 'unreported'; account: string; answers: number; error: string }
+  | { kind: 'unkept'; answers: number; error: string }
+  | { kind: 'unremoved'; answers: number; error: string }
+  | { kind: 'unattributed'; account: string; model: string }
+  | { kind: 'uncounted'; account: string; model: string };
+
+/** A count of answers in words: `1 answer`, `2 answers`. */
+const answersText = (countArg: number): string => `${countArg} ${countArg === 1 ? 'answer' : 'answers'}`;
+
+const writeJournal = (entryArg: TInferenceSpendJournalEntry): void => {
+  process.stderr.write(entryArg.kind === 'unpriced'
+    ? `AGL proxy could not price an answer on API key ${entryArg.account} (${entryArg.model}): ${entryArg.reason}. It counts `
+      + 'as an answer that could not be priced, which holds a key with a monthly spend limit until its month ends or the '
+      + 'limit is removed.\n'
+    : entryArg.kind === 'refused'
+      ? `AGL proxy's spend report of API key ${entryArg.account} (${answersText(entryArg.answers)}) was refused by the accounts `
+        + `service: ${entryArg.error} The proxy keeps the answers and counts them, sends them again at ${entryArg.retryAt} `
+        + 'and at every start, and places nothing on the key while it has a monthly spend limit.\n'
+      : entryArg.kind === 'unreported'
+        ? `AGL proxy could not report the spend of API key ${entryArg.account} (${answersText(entryArg.answers)}) to the `
+          + `accounts service: ${entryArg.error} -- it keeps the answers, counts them against the key's limit and tries again.\n`
+        : entryArg.kind === 'unkept'
+          ? `AGL proxy could not keep the spend of ${answersText(entryArg.answers)} in its store: ${entryArg.error} -- it counts `
+            + 'them and tries again.\n'
+          : entryArg.kind === 'unremoved'
+            ? `AGL proxy could not remove ${answersText(entryArg.answers)}, acknowledged, from its store: ${entryArg.error} -- it `
+              + 'tries again; a start before then reports them again, which the accounts service records once.\n'
+            : entryArg.kind === 'unattributed'
+              ? `AGL proxy holds an answer on API key ${entryArg.account} (${entryArg.model}) with no login of the key to report `
+                + 'it on: it counts, and holds the key while it has a monthly spend limit, until the account service names a login.\n'
+              : `AGL proxy did not count an answer on API key ${entryArg.account} (${entryArg.model}): it ended without the provider `
+                + 'stating its usage, so nothing of it counts against the key\'s monthly spend limit, though the provider may bill it.\n');
+};
+
+export interface IInferenceSpendOutboxOptions {
+  store: IInferenceSpendStore;
+  /**
+   * Sends one report of answers a key served on one of its logins (`authswitch.authority.usage.spend`, one to 64 answers,
+   * each id once) and resolves with the key's usage the accounts service answered once the report committed.
+   */
+  report: (accountIdArg: string, loginIdArg: string, answersArg: TSpendAnswer[], signalArg: AbortSignal) => Promise<TUsageSnapshot>;
+  /**
+   * Names a login of the key for answers recorded without one -- the account service's live or removed API-key login of
+   * it -- or `undefined` while it names none; such answers count and hold the key until then.
+   */
+  attribute: (accountIdArg: string) => string | undefined;
+  /**
+   * Holds the usage an acknowledged report answered, which counts the report's answers: called in the same synchronous
+   * step that drops them from what is pending, so no reading is judged without them or with them twice.
+   */
+  acknowledged: (accountIdArg: string, usageArg: TUsageSnapshot) => void;
+  /** Where the outbox's journal entries go; one line on standard error, the proxy's journal, when unset. */
+  journal?: (entryArg: TInferenceSpendJournalEntry) => void;
+  now?: () => number;
+  /** The first wait after a report or a store write failed for a passing reason; it doubles up to `maxRetryMs`. */
+  retryMs?: number;
+  maxRetryMs?: number;
+  /** How long answers whose report the accounts service refused wait before they are sent again. */
+  heldRetryMs?: number;
+}
+
+interface IEntry {
+  answer: TSpendAnswer;
+  /** The key's login it was served on, which its report names; `null` until one is named (`attribute`). */
+  loginId: string | null;
+  /**
+   * The store keeps it: written as it is recorded, on a chain of store writes of its own that never waits for a report.
+   * An acknowledged answer is removed from the store, once it was kept.
+   */
+  kept: boolean;
+  /** A store write of it failed: until it is kept or acknowledged it is held in neither, and holds a limited key. */
+  keepFailed: boolean;
+  /** Its report was refused (`invalid_input`, or a malformed request): sent again at this time, or `null` while it is not. */
+  heldUntil: number | null;
+}
+
+interface IAccountState {
+  /** Reports of the key that failed in a row for a passing reason. */
+  failures: number;
+  /** No report of the key is sent before this time. */
+  retryAt: number;
+  /** The failures were said in the journal: once until a report goes through. */
+  said: boolean;
+}
+
+/**
+ * The spend of the answers the proxy relayed on API keys, kept until the accounts service acknowledged it: durable in
+ * the proxy's database (`agl_inference_spend`), never expired, and counted against each key's limit while unacknowledged
+ * (`judged`), across restarts.
+ *
+ * `record` counts an answer at once and writes it to the store at once, on a chain of store writes that never waits for
+ * a report, so an answer recorded while a report is in flight is durable before that report settles. Answers are
+ * reported whether the store kept them yet or not -- the ledger records an answer once, so either makes it durable --
+ * per key and login in batches of at most 64 unique answers, one report in flight at a time, the first as soon as an
+ * answer is recorded and every one at start. An answer held in neither after a failed store write holds its key, with
+ * a spend limit, like a refused report (`held`). The in-memory index is complete because the proxy store has one owner
+ * (`ProxyStore` refuses a second engine); a second writer of `agl_inference_spend` would break it.
+ * An acknowledgement drops the report's answers and holds the usage the service answered in one step (`acknowledged`).
+ * A refusal of the report -- `invalid_input`, or a malformed request (`isAuthSwitchMalformedRequest`) -- holds its
+ * answers: they keep counting, the key with a spend limit takes no request while any is held (`held`), the refusal goes
+ * to the journal, and the answers are sent again after `heldRetryMs` and at every start, never dropped. Every other
+ * failure, `Internal server error` included, is passing: the key's reports wait, doubling from `retryMs` to
+ * `maxRetryMs`. Answers of months before the previous one are acknowledged by the service and counted nowhere, so they
+ * leave as every acknowledged answer does.
+ */
+export class InferenceSpendOutbox {
+  /** The answers not acknowledged yet, by key, then answer id: an id is held once, so no report names one twice. */
+  private readonly entries = new Map<string, Map<string, IEntry>>();
+  private readonly accounts = new Map<string, IAccountState>();
+  /** Acknowledged answers still to be removed from the store. */
+  private readonly acknowledgedIds = new Set<string>();
+  private readonly abort = new AbortController();
+  private readonly now: () => number;
+  private readonly retryMs: number;
+  private readonly maxRetryMs: number;
+  private readonly heldRetryMs: number;
+  /** The store writes of recorded answers, one at a time, apart from the reports. */
+  private keepTail: Promise<void> = Promise.resolve();
+  private keepFailures = 0;
+  private keepRetryAt = 0;
+  private keepSaid = false;
+  private keepTimer?: ReturnType<typeof setTimeout>;
+  private forgetFailures = 0;
+  private forgetRetryAt = 0;
+  private forgetSaid = false;
+  private started = false;
+  private stopped = false;
+  private running?: Promise<void>;
+  private again = false;
+  private timer?: ReturnType<typeof setTimeout>;
+
+  constructor(private readonly options: IInferenceSpendOutboxOptions) {
+    this.now = options.now ?? Date.now;
+    this.retryMs = options.retryMs ?? 5_000;
+    this.maxRetryMs = options.maxRetryMs ?? 300_000;
+    this.heldRetryMs = options.heldRetryMs ?? 600_000;
+  }
+
+  /** Loads the answers a run before left unacknowledged and sends them all now. */
+  public async start(signalArg?: AbortSignal): Promise<void> {
+    if (this.started || this.stopped) throw new Error('The spend outbox cannot be started twice.');
+    for (const entry of await this.options.store.load(signalArg ?? this.abort.signal)) {
+      this.add(entry.accountId, { answer: entry.answer, loginId: entry.loginId, kept: true, keepFailed: false, heldUntil: null });
+    }
+    this.started = true;
+    this.kick();
+  }
+
+  /**
+   * Counts a relayed answer's spend at once, writes it to the store and reports it, naming the key's login it was served
+   * on (`loginIdArg`), until the accounts service acknowledged it; an answer that could not be priced goes to the journal
+   * as well. One recorded without a login (`null`) counts all the same, holds the key (`held`) and waits for a login to
+   * be named (`attribute`), which the journal says. Throws for an answer no report could carry, a defect of its caller.
+   */
+  public record(accountIdArg: string, loginIdArg: string | null, recordArg: IInferenceSpendRecord): void {
+    if (!hex64.test(accountIdArg) || (loginIdArg !== null && !hex64.test(loginIdArg))
+      || !plugins.authswitchAuthority.isAuthSwitchSpendAnswer(recordArg.answer)) {
+      throw new Error('A spend answer the accounts service would refuse was recorded.');
+    }
+    this.add(accountIdArg, { answer: { ...recordArg.answer }, loginId: loginIdArg, kept: false, keepFailed: false,
+      heldUntil: null });
+    if (recordArg.unpriced !== undefined) {
+      this.say({ kind: 'unpriced', account: accountDigest(accountIdArg), model: recordArg.answer.model, reason: recordArg.unpriced });
+    }
+    if (loginIdArg === null) this.say({ kind: 'unattributed', account: accountDigest(accountIdArg), model: recordArg.answer.model });
+    this.keep();
+    this.kick();
+  }
+
+  /**
+   * Says in the journal that an answer relayed on the key ended without its provider stating its usage -- the client left,
+   * the stream was cut, or the response failed stating none -- so nothing of it is counted; no usage is estimated for it
+   * (`inferenceOpenAiSpend`).
+   */
+  public uncounted(accountIdArg: string, modelArg: string): void {
+    this.say({ kind: 'uncounted', account: accountDigest(accountIdArg), model: modelArg });
+  }
+
+  /** The answers relayed on a key whose spend the accounts service has not acknowledged yet. */
+  public pending(accountIdArg: string): plugins.authswitchSpend.IAuthSwitchSpendPending[] {
+    return [...this.entries.get(accountIdArg)?.values() ?? []]
+      .map((entryArg) => ({ endedAt: entryArg.answer.endedAt, microUsd: entryArg.answer.microUsd }));
+  }
+
+  /**
+   * Whether spend of the key is not recorded and might never be: the accounts service refused a report of its answers
+   * that is still held, an answer is held in neither the store, whose write failed, nor the accounts service's ledger,
+   * or an answer has no login of the key to be reported on yet.
+   */
+  public held(accountIdArg: string): boolean {
+    return [...this.entries.get(accountIdArg)?.values() ?? []]
+      .some((entryArg) => entryArg.heldUntil !== null || (entryArg.keepFailed && !entryArg.kept) || entryArg.loginId === null);
+  }
+
+  /**
+   * A key's usage as the proxy judges it now: its spend reading with the answers not acknowledged yet added, in the
+   * month now falls in (`authSwitchSpendWithPending`). Any other usage is answered as it is.
+   */
+  public judged(accountIdArg: string, usageArg: TUsageSnapshot): TUsageSnapshot {
+    if (usageArg.reading?.kind !== 'spend') return usageArg;
+    return { ...usageArg, reading: { kind: 'spend', spend: plugins.authswitchSpend.authSwitchSpendWithPending(
+      usageArg.reading.spend, this.pending(accountIdArg), this.now()) } };
+  }
+
+  /**
+   * Stops sending; what is held stays in the store for the next start. The store writes in progress finish, and what is
+   * still not kept or not removed is written once more.
+   */
+  public async stop(): Promise<void> {
+    if (this.stopped) return;
+    this.stopped = true;
+    clearTimeout(this.timer);
+    this.timer = undefined;
+    clearTimeout(this.keepTimer);
+    this.keepTimer = undefined;
+    this.abort.abort(new Error('The spend outbox stopped.'));
+    await this.running;
+    await this.keepTail;
+    await this.keepOnce(true);
+    if (this.started) await this.forget(AbortSignal.timeout(storeWriteTimeoutMs), true);
+  }
+
+  private add(accountIdArg: string, entryArg: IEntry): void {
+    let entries = this.entries.get(accountIdArg);
+    if (!entries) { entries = new Map(); this.entries.set(accountIdArg, entries); }
+    entries.set(entryArg.answer.answerId, entryArg);
+  }
+
+  private say(entryArg: TInferenceSpendJournalEntry): void {
+    try { (this.options.journal ?? writeJournal)(entryArg); } catch { /* a journal line that fails changes nothing */ }
+  }
+
+  /** Runs the outbox's work now, or once more after the run in progress. */
+  private kick(): void {
+    if (!this.started || this.stopped) return;
+    if (this.running) { this.again = true; return; }
+    clearTimeout(this.timer);
+    this.timer = undefined;
+    this.running = (async () => {
+      do {
+        this.again = false;
+        await this.cycle();
+      } while (this.again && !this.stopped);
+    })().catch(() => undefined).finally(() => {
+      this.running = undefined;
+      this.arm();
+    });
+  }
+
+  /** Removes what was acknowledged from the store, then sends every report that is due. */
+  private async cycle(): Promise<void> {
+    const signal = this.abort.signal;
+    if (this.now() >= this.forgetRetryAt) await this.forget(signal, false);
+    for (let batch = this.nextBatch(); batch && !this.stopped; batch = this.nextBatch()) {
+      await this.send(batch.accountId, batch.loginId, batch.entries, signal);
+    }
+  }
+
+  /**
+   * Writes the recorded answers not kept yet to the store, on the outbox's chain of store writes, which runs apart from
+   * the reports and never waits for one; once they are kept the reports run. After a failed write the next waits,
+   * doubling from `retryMs`, unless an answer recorded meanwhile, or the stop, tries again sooner.
+   */
+  private keep(): void {
+    if (this.stopped) return;
+    clearTimeout(this.keepTimer);
+    this.keepTimer = undefined;
+    this.keepTail = this.keepTail.then(() => this.keepOnce(false));
+  }
+
+  /**
+   * One pass of the store writes: every answer not kept yet, one at a time. A write that fails is said once until the
+   * store takes writes again; the answers count meanwhile all the same.
+   */
+  private async keepOnce(finalArg: boolean): Promise<void> {
+    if (this.stopped && !finalArg) return;
+    const unkept = [...this.entries].flatMap(([accountId, entries]) => [...entries.values()]
+      .filter((entryArg) => !entryArg.kept).map((entryArg) => ({ accountId, entry: entryArg })));
+    if (!unkept.length) return;
+    try {
+      for (const { accountId, entry } of unkept) {
+        await this.options.store.insert({ accountId, loginId: entry.loginId, answer: entry.answer },
+          AbortSignal.timeout(storeWriteTimeoutMs));
+        entry.kept = true;
+        // Acknowledged while it was written: it leaves the store again.
+        if (this.entries.get(accountId)?.get(entry.answer.answerId) !== entry) this.acknowledgedIds.add(entry.answer.answerId);
+      }
+      this.keepFailures = 0;
+      this.keepRetryAt = 0;
+      this.keepSaid = false;
+      this.kick();
+    } catch (errorArg) {
+      for (const { entry } of unkept) if (!entry.kept) entry.keepFailed = true;
+      this.keepFailures += 1;
+      this.keepRetryAt = this.now() + this.backoff(this.keepFailures);
+      if (!this.keepSaid) {
+        this.keepSaid = true;
+        this.say({ kind: 'unkept', answers: unkept.filter((itemArg) => !itemArg.entry.kept).length, error: oneLine(errorArg) });
+      }
+      if (this.stopped) return;
+      clearTimeout(this.keepTimer);
+      this.keepTimer = setTimeout(() => this.keep(), Math.max(0, this.keepRetryAt - this.now()));
+      this.keepTimer.unref?.();
+    }
+  }
+
+  /** Removes the acknowledged answers from the store; a failed removal waits, doubling, said once. */
+  private async forget(signalArg: AbortSignal, finalArg: boolean): Promise<void> {
+    if (!this.acknowledgedIds.size) return;
+    const ids = [...this.acknowledgedIds];
+    try {
+      await this.options.store.delete(ids, signalArg);
+      for (const id of ids) this.acknowledgedIds.delete(id);
+      this.forgetFailures = 0;
+      this.forgetRetryAt = 0;
+      this.forgetSaid = false;
+    } catch (errorArg) {
+      if (this.stopped && !finalArg) return;
+      this.forgetFailures += 1;
+      this.forgetRetryAt = this.now() + this.backoff(this.forgetFailures);
+      if (!this.forgetSaid) {
+        this.forgetSaid = true;
+        this.say({ kind: 'unremoved', answers: ids.length, error: oneLine(errorArg) });
+      }
+    }
+  }
+
+  /**
+   * The next report due: a key's held answers once their wait ended, as a report of their own, else its other answers,
+   * kept or not; of one login, oldest first, at most 64, each id once. Answers recorded without a login take the one
+   * `attribute` names now; while it names none they wait, the key's reports backing off as after a passing failure.
+   */
+  private nextBatch(): { accountId: string; loginId: string; entries: IEntry[] } | undefined {
+    const now = this.now();
+    for (const [accountId, entries] of this.entries) {
+      if ((this.accounts.get(accountId)?.retryAt ?? 0) > now) continue;
+      const all = [...entries.values()];
+      if (all.some((entryArg) => entryArg.loginId === null)) {
+        const login = this.options.attribute(accountId);
+        if (login !== undefined && hex64.test(login)) for (const entry of all) entry.loginId ??= login;
+      }
+      const named = all.filter((entryArg) => entryArg.loginId !== null);
+      const due = named.filter((entryArg) => entryArg.heldUntil !== null && entryArg.heldUntil <= now);
+      const fresh = named.filter((entryArg) => entryArg.heldUntil === null);
+      const oldest = (due.length ? due : fresh)
+        .sort((leftArg, rightArg) => Date.parse(leftArg.answer.endedAt) - Date.parse(rightArg.answer.endedAt));
+      const loginId = oldest[0]?.loginId;
+      if (loginId) {
+        return { accountId, loginId, entries: oldest.filter((entryArg) => entryArg.loginId === loginId)
+          .slice(0, plugins.authswitchAuthority.authSwitchSpendAnswerBatchLimit) };
+      }
+      if (named.length < all.length) {
+        // Nothing of the key can be reported until a login is named: ask again later.
+        const account = this.accounts.get(accountId) ?? { failures: 0, retryAt: 0, said: true };
+        account.failures += 1;
+        account.retryAt = now + this.backoff(account.failures);
+        this.accounts.set(accountId, account);
+      }
+    }
+    return undefined;
+  }
+
+  private async send(accountIdArg: string, loginIdArg: string, entriesArg: IEntry[], signalArg: AbortSignal): Promise<void> {
+    const account = this.accounts.get(accountIdArg) ?? { failures: 0, retryAt: 0, said: false };
+    this.accounts.set(accountIdArg, account);
+    let usage: TUsageSnapshot;
+    try {
+      usage = await this.options.report(accountIdArg, loginIdArg, entriesArg.map((entryArg) => ({ ...entryArg.answer })),
+        signalArg);
+    } catch (errorArg) {
+      if (this.stopped) return;
+      const refusal = plugins.authswitchAuthority.asAuthSwitchRefusal(errorArg);
+      if (refusal?.code === 'invalid_input' || plugins.authswitchAuthority.isAuthSwitchMalformedRequest(errorArg)) {
+        const retryAt = this.now() + this.heldRetryMs;
+        for (const entry of entriesArg) entry.heldUntil = retryAt;
+        this.say({ kind: 'refused', account: accountDigest(accountIdArg), answers: entriesArg.length,
+          error: refusal?.instruction ?? plugins.authswitchAuthority.authSwitchMalformedRequestText,
+          retryAt: new Date(retryAt).toISOString() });
+        return;
+      }
+      account.failures += 1;
+      account.retryAt = this.now() + this.backoff(account.failures);
+      if (!account.said) {
+        account.said = true;
+        this.say({ kind: 'unreported', account: accountDigest(accountIdArg),
+          answers: this.entries.get(accountIdArg)?.size ?? entriesArg.length, error: oneLine(errorArg) });
+      }
+      return;
+    }
+    // The one acknowledgement step: the service's answer, which counts the report's answers, replaces the held reading
+    // in the same synchronous step that drops them from what is pending.
+    this.options.acknowledged(accountIdArg, usage);
+    const entries = this.entries.get(accountIdArg);
+    for (const entry of entriesArg) {
+      entries?.delete(entry.answer.answerId);
+      // One the store has not kept yet leaves it once its write lands (`keepOnce`).
+      if (entry.kept) this.acknowledgedIds.add(entry.answer.answerId);
+    }
+    if (entries?.size === 0) this.entries.delete(accountIdArg);
+    this.accounts.delete(accountIdArg);
+  }
+
+  private backoff(failuresArg: number): number {
+    return Math.min(this.maxRetryMs, this.retryMs * 2 ** Math.max(0, failuresArg - 1));
+  }
+
+  /** Wakes the reports when the next held or waiting answer, or a removal to try again, is due. */
+  private arm(): void {
+    clearTimeout(this.timer);
+    this.timer = undefined;
+    if (this.stopped || !this.started) return;
+    let due = Number.POSITIVE_INFINITY;
+    if (this.acknowledgedIds.size) due = Math.min(due, this.forgetRetryAt);
+    for (const [accountId, entries] of this.entries) {
+      const retryAt = this.accounts.get(accountId)?.retryAt ?? 0;
+      for (const entry of entries.values()) due = Math.min(due, Math.max(retryAt, entry.heldUntil ?? 0));
+    }
+    if (!Number.isFinite(due)) return;
+    this.timer = setTimeout(() => this.kick(), Math.max(0, due - this.now()));
+    this.timer.unref?.();
+  }
+}