audit-tools 0.28.0

package/dist/audit/quota/index.d.ts

@@ -0,0 +1,383 @@
+import { z } from "zod";
+export { resolveLimits, classifyProvider, readQuotaState, writeQuotaState, computeMaxSafeConcurrency, recordWaveOutcome, getQuotaStatePath, decayWeight, applyDecayToEntry, computeBackoffCooldownMs, computeBackoffFailureWeight, computeRampUpConcurrency, setQuotaStateDir, detectRateLimitError, computeCooldownUntil, acquireLock, releaseLock, withFileLock, FileLockTimeoutError, runSlidingWindow, LearnedQuotaSource, CompositeQuotaSource, GenericErrorParser, ClaudeCodeErrorParser, getErrorParserForProvider, summarizeDispatchCapacityPools, } from "audit-tools/shared";
+export type { LimitResolutionResult, ResolveLimitsOptions, ProviderType, ResolvedLimits, LimitSource, LimitConfidence, HostConcurrencyLimit, HostConcurrencyLimitSource, QuotaState, QuotaStateEntry, ConcurrencyBucket, WaveSchedule, BackoffState, ObservedWaveOutcome, RateLimitDetectionResult, SlidingWindowResult, QuotaSource, QuotaUsageSnapshot, ErrorParser, WaveBindingCap, DispatchCapacityPoolSummary, } from "audit-tools/shared";
+export { scheduleWave, buildProviderModelKey, resolveHostModel } from "audit-tools/shared";
+export type { ScheduleWaveOptions } from "audit-tools/shared";
+export { computeDispatchCapacity } from "audit-tools/shared";
+export type { CapacityPool, PoolDispatchAllocation, DispatchCapacity, } from "audit-tools/shared";
+export { detectHostActiveSubagentLimit, resolveHostActiveSubagentLimit, } from "./hostLimits.js";
+export { lookupDiscoveredLimits, updateDiscoveredLimits, mergeDiscoveredLimits, readDiscoveredLimitsCache, writeDiscoveredLimitsCache, } from "./discoveredLimits.js";
+export type { DiscoveredRateLimits, DiscoveredLimitsCache, DiscoveredLimitsCacheEntry } from "./discoveredLimits.js";
+export { extractRateLimitHeaders } from "./headerExtraction.js";
+export type { ExtractedRateLimits } from "./headerExtraction.js";
+export type { HeaderExtractor } from "./headerExtractors/index.js";
+export { GenericHeaderExtractor, ClaudeCodeHeaderExtractor, getHeaderExtractorForProvider } from "./headerExtractors/index.js";
+export declare const DISPATCH_QUOTA_V1ALPHA1: "audit-code-dispatch-quota/v1alpha1";
+export declare const DISPATCH_QUOTA_V1ALPHA2: "audit-code-dispatch-quota/v1alpha2";
+export declare const DispatchQuotaSchema: z.ZodObject<{
+    contract_version: z.ZodEnum<["audit-code-dispatch-quota/v1alpha1", "audit-code-dispatch-quota/v1alpha2"]>;
+    run_id: z.ZodString;
+    model: z.ZodNullable<z.ZodString>;
+    resolved_limits: z.ZodObject<{
+        context_tokens: z.ZodNumber;
+        output_tokens: z.ZodNumber;
+        requests_per_minute: z.ZodNullable<z.ZodNumber>;
+        input_tokens_per_minute: z.ZodNullable<z.ZodNumber>;
+        output_tokens_per_minute: z.ZodNullable<z.ZodNumber>;
+    }, "strict", z.ZodTypeAny, {
+        requests_per_minute: number | null;
+        input_tokens_per_minute: number | null;
+        context_tokens: number;
+        output_tokens: number;
+        output_tokens_per_minute: number | null;
+    }, {
+        requests_per_minute: number | null;
+        input_tokens_per_minute: number | null;
+        context_tokens: number;
+        output_tokens: number;
+        output_tokens_per_minute: number | null;
+    }>;
+    confidence: z.ZodEnum<["high", "medium", "low"]>;
+    source: z.ZodEnum<["explicit_config", "discovered_capability", "cli_flags", "provider_default", "learned", "default"]>;
+    host_concurrency_limit: z.ZodNullable<z.ZodObject<{
+        active_subagents: z.ZodNumber;
+        source: z.ZodEnum<["cli_flags", "host_reported", "session_config", "environment"]>;
+        description: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        source: "cli_flags" | "host_reported" | "session_config" | "environment";
+        active_subagents: number;
+        description: string;
+    }, {
+        source: "cli_flags" | "host_reported" | "session_config" | "environment";
+        active_subagents: number;
+        description: string;
+    }>>;
+    max_concurrent_agents: z.ZodNumber;
+    cooldown_until: z.ZodNullable<z.ZodString>;
+    binding_cap: z.ZodOptional<z.ZodEnum<["rpm", "tpm", "learned", "fallback", "first_contact", "cooldown", "host_concurrency", "none"]>>;
+    capacity_pools: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        pool_id: z.ZodString;
+        rank: z.ZodOptional<z.ZodEnum<["small", "standard", "deep"]>>;
+        slots: z.ZodNumber;
+        model: z.ZodNullable<z.ZodString>;
+        confidence: z.ZodEnum<["high", "medium", "low"]>;
+        source: z.ZodEnum<["explicit_config", "discovered_capability", "cli_flags", "provider_default", "learned", "default"]>;
+        resolved_limits: z.ZodObject<{
+            context_tokens: z.ZodNumber;
+            output_tokens: z.ZodNumber;
+            requests_per_minute: z.ZodNullable<z.ZodNumber>;
+            input_tokens_per_minute: z.ZodNullable<z.ZodNumber>;
+            output_tokens_per_minute: z.ZodNullable<z.ZodNumber>;
+        }, "strict", z.ZodTypeAny, {
+            requests_per_minute: number | null;
+            input_tokens_per_minute: number | null;
+            context_tokens: number;
+            output_tokens: number;
+            output_tokens_per_minute: number | null;
+        }, {
+            requests_per_minute: number | null;
+            input_tokens_per_minute: number | null;
+            context_tokens: number;
+            output_tokens: number;
+            output_tokens_per_minute: number | null;
+        }>;
+        host_concurrency_limit: z.ZodNullable<z.ZodObject<{
+            active_subagents: z.ZodNumber;
+            source: z.ZodEnum<["cli_flags", "host_reported", "session_config", "environment"]>;
+            description: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            source: "cli_flags" | "host_reported" | "session_config" | "environment";
+            active_subagents: number;
+            description: string;
+        }, {
+            source: "cli_flags" | "host_reported" | "session_config" | "environment";
+            active_subagents: number;
+            description: string;
+        }>>;
+        cooldown_until: z.ZodNullable<z.ZodString>;
+        estimated_wave_tokens: z.ZodNumber;
+        binding_cap: z.ZodEnum<["rpm", "tpm", "learned", "fallback", "first_contact", "cooldown", "host_concurrency", "none"]>;
+        quota_source_snapshot: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            remaining_pct: z.ZodNullable<z.ZodNumber>;
+            reset_at: z.ZodNullable<z.ZodString>;
+            requests_remaining: z.ZodNullable<z.ZodNumber>;
+            tokens_remaining: z.ZodNullable<z.ZodNumber>;
+            captured_at: z.ZodString;
+            source: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            remaining_pct: number | null;
+            reset_at: string | null;
+            requests_remaining: number | null;
+            tokens_remaining: number | null;
+            captured_at: string;
+            source: string;
+        }, {
+            remaining_pct: number | null;
+            reset_at: string | null;
+            requests_remaining: number | null;
+            tokens_remaining: number | null;
+            captured_at: string;
+            source: string;
+        }>>>;
+    }, "strict", z.ZodTypeAny, {
+        confidence: "high" | "low" | "medium";
+        source: "default" | "explicit_config" | "discovered_capability" | "cli_flags" | "provider_default" | "learned";
+        cooldown_until: string | null;
+        pool_id: string;
+        slots: number;
+        model: string | null;
+        resolved_limits: {
+            requests_per_minute: number | null;
+            input_tokens_per_minute: number | null;
+            context_tokens: number;
+            output_tokens: number;
+            output_tokens_per_minute: number | null;
+        };
+        host_concurrency_limit: {
+            source: "cli_flags" | "host_reported" | "session_config" | "environment";
+            active_subagents: number;
+            description: string;
+        } | null;
+        estimated_wave_tokens: number;
+        binding_cap: "none" | "learned" | "rpm" | "tpm" | "fallback" | "first_contact" | "cooldown" | "host_concurrency";
+        rank?: "deep" | "small" | "standard" | undefined;
+        quota_source_snapshot?: {
+            remaining_pct: number | null;
+            reset_at: string | null;
+            requests_remaining: number | null;
+            tokens_remaining: number | null;
+            captured_at: string;
+            source: string;
+        } | null | undefined;
+    }, {
+        confidence: "high" | "low" | "medium";
+        source: "default" | "explicit_config" | "discovered_capability" | "cli_flags" | "provider_default" | "learned";
+        cooldown_until: string | null;
+        pool_id: string;
+        slots: number;
+        model: string | null;
+        resolved_limits: {
+            requests_per_minute: number | null;
+            input_tokens_per_minute: number | null;
+            context_tokens: number;
+            output_tokens: number;
+            output_tokens_per_minute: number | null;
+        };
+        host_concurrency_limit: {
+            source: "cli_flags" | "host_reported" | "session_config" | "environment";
+            active_subagents: number;
+            description: string;
+        } | null;
+        estimated_wave_tokens: number;
+        binding_cap: "none" | "learned" | "rpm" | "tpm" | "fallback" | "first_contact" | "cooldown" | "host_concurrency";
+        rank?: "deep" | "small" | "standard" | undefined;
+        quota_source_snapshot?: {
+            remaining_pct: number | null;
+            reset_at: string | null;
+            requests_remaining: number | null;
+            tokens_remaining: number | null;
+            captured_at: string;
+            source: string;
+        } | null | undefined;
+    }>, "many">>;
+    /** Echo of the host-reported model roster (lowest rank first), when given. */
+    host_model_roster: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        rank: z.ZodEnum<["small", "standard", "deep"]>;
+        context_tokens: z.ZodNumber;
+        output_tokens: z.ZodNumber;
+        model_id: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        context_tokens: number;
+        output_tokens: number;
+        rank: "deep" | "small" | "standard";
+        model_id?: string | undefined;
+    }, {
+        context_tokens: number;
+        output_tokens: number;
+        rank: "deep" | "small" | "standard";
+        model_id?: string | undefined;
+    }>, "many">>;
+    /** Per-tier packet input budgets (context − output) derived from the roster. */
+    tier_budgets: z.ZodOptional<z.ZodRecord<z.ZodEnum<["small", "standard", "deep"]>, z.ZodNumber>>;
+    quota_source_snapshot: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        remaining_pct: z.ZodNullable<z.ZodNumber>;
+        reset_at: z.ZodNullable<z.ZodString>;
+        requests_remaining: z.ZodNullable<z.ZodNumber>;
+        tokens_remaining: z.ZodNullable<z.ZodNumber>;
+        captured_at: z.ZodString;
+        source: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        remaining_pct: number | null;
+        reset_at: string | null;
+        requests_remaining: number | null;
+        tokens_remaining: number | null;
+        captured_at: string;
+        source: string;
+    }, {
+        remaining_pct: number | null;
+        reset_at: string | null;
+        requests_remaining: number | null;
+        tokens_remaining: number | null;
+        captured_at: string;
+        source: string;
+    }>>>;
+    backoff_state: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        consecutive_429_count: z.ZodNumber;
+        current_cooldown_ms: z.ZodNumber;
+        current_failure_weight: z.ZodNumber;
+    }, "strict", z.ZodTypeAny, {
+        consecutive_429_count: number;
+        current_cooldown_ms: number;
+        current_failure_weight: number;
+    }, {
+        consecutive_429_count: number;
+        current_cooldown_ms: number;
+        current_failure_weight: number;
+    }>>>;
+}, "strict", z.ZodTypeAny, {
+    confidence: "high" | "low" | "medium";
+    contract_version: "audit-code-dispatch-quota/v1alpha1" | "audit-code-dispatch-quota/v1alpha2";
+    source: "default" | "explicit_config" | "discovered_capability" | "cli_flags" | "provider_default" | "learned";
+    cooldown_until: string | null;
+    model: string | null;
+    resolved_limits: {
+        requests_per_minute: number | null;
+        input_tokens_per_minute: number | null;
+        context_tokens: number;
+        output_tokens: number;
+        output_tokens_per_minute: number | null;
+    };
+    host_concurrency_limit: {
+        source: "cli_flags" | "host_reported" | "session_config" | "environment";
+        active_subagents: number;
+        description: string;
+    } | null;
+    run_id: string;
+    max_concurrent_agents: number;
+    binding_cap?: "none" | "learned" | "rpm" | "tpm" | "fallback" | "first_contact" | "cooldown" | "host_concurrency" | undefined;
+    quota_source_snapshot?: {
+        remaining_pct: number | null;
+        reset_at: string | null;
+        requests_remaining: number | null;
+        tokens_remaining: number | null;
+        captured_at: string;
+        source: string;
+    } | null | undefined;
+    capacity_pools?: {
+        confidence: "high" | "low" | "medium";
+        source: "default" | "explicit_config" | "discovered_capability" | "cli_flags" | "provider_default" | "learned";
+        cooldown_until: string | null;
+        pool_id: string;
+        slots: number;
+        model: string | null;
+        resolved_limits: {
+            requests_per_minute: number | null;
+            input_tokens_per_minute: number | null;
+            context_tokens: number;
+            output_tokens: number;
+            output_tokens_per_minute: number | null;
+        };
+        host_concurrency_limit: {
+            source: "cli_flags" | "host_reported" | "session_config" | "environment";
+            active_subagents: number;
+            description: string;
+        } | null;
+        estimated_wave_tokens: number;
+        binding_cap: "none" | "learned" | "rpm" | "tpm" | "fallback" | "first_contact" | "cooldown" | "host_concurrency";
+        rank?: "deep" | "small" | "standard" | undefined;
+        quota_source_snapshot?: {
+            remaining_pct: number | null;
+            reset_at: string | null;
+            requests_remaining: number | null;
+            tokens_remaining: number | null;
+            captured_at: string;
+            source: string;
+        } | null | undefined;
+    }[] | undefined;
+    host_model_roster?: {
+        context_tokens: number;
+        output_tokens: number;
+        rank: "deep" | "small" | "standard";
+        model_id?: string | undefined;
+    }[] | undefined;
+    tier_budgets?: Partial<Record<"deep" | "small" | "standard", number>> | undefined;
+    backoff_state?: {
+        consecutive_429_count: number;
+        current_cooldown_ms: number;
+        current_failure_weight: number;
+    } | null | undefined;
+}, {
+    confidence: "high" | "low" | "medium";
+    contract_version: "audit-code-dispatch-quota/v1alpha1" | "audit-code-dispatch-quota/v1alpha2";
+    source: "default" | "explicit_config" | "discovered_capability" | "cli_flags" | "provider_default" | "learned";
+    cooldown_until: string | null;
+    model: string | null;
+    resolved_limits: {
+        requests_per_minute: number | null;
+        input_tokens_per_minute: number | null;
+        context_tokens: number;
+        output_tokens: number;
+        output_tokens_per_minute: number | null;
+    };
+    host_concurrency_limit: {
+        source: "cli_flags" | "host_reported" | "session_config" | "environment";
+        active_subagents: number;
+        description: string;
+    } | null;
+    run_id: string;
+    max_concurrent_agents: number;
+    binding_cap?: "none" | "learned" | "rpm" | "tpm" | "fallback" | "first_contact" | "cooldown" | "host_concurrency" | undefined;
+    quota_source_snapshot?: {
+        remaining_pct: number | null;
+        reset_at: string | null;
+        requests_remaining: number | null;
+        tokens_remaining: number | null;
+        captured_at: string;
+        source: string;
+    } | null | undefined;
+    capacity_pools?: {
+        confidence: "high" | "low" | "medium";
+        source: "default" | "explicit_config" | "discovered_capability" | "cli_flags" | "provider_default" | "learned";
+        cooldown_until: string | null;
+        pool_id: string;
+        slots: number;
+        model: string | null;
+        resolved_limits: {
+            requests_per_minute: number | null;
+            input_tokens_per_minute: number | null;
+            context_tokens: number;
+            output_tokens: number;
+            output_tokens_per_minute: number | null;
+        };
+        host_concurrency_limit: {
+            source: "cli_flags" | "host_reported" | "session_config" | "environment";
+            active_subagents: number;
+            description: string;
+        } | null;
+        estimated_wave_tokens: number;
+        binding_cap: "none" | "learned" | "rpm" | "tpm" | "fallback" | "first_contact" | "cooldown" | "host_concurrency";
+        rank?: "deep" | "small" | "standard" | undefined;
+        quota_source_snapshot?: {
+            remaining_pct: number | null;
+            reset_at: string | null;
+            requests_remaining: number | null;
+            tokens_remaining: number | null;
+            captured_at: string;
+            source: string;
+        } | null | undefined;
+    }[] | undefined;
+    host_model_roster?: {
+        context_tokens: number;
+        output_tokens: number;
+        rank: "deep" | "small" | "standard";
+        model_id?: string | undefined;
+    }[] | undefined;
+    tier_budgets?: Partial<Record<"deep" | "small" | "standard", number>> | undefined;
+    backoff_state?: {
+        consecutive_429_count: number;
+        current_cooldown_ms: number;
+        current_failure_weight: number;
+    } | null | undefined;
+}>;
+export type DispatchQuota = z.infer<typeof DispatchQuotaSchema>;
+//# sourceMappingURL=index.d.ts.map

package/dist/audit/quota/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/audit/quota/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAexB,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,wBAAwB,EACxB,2BAA2B,EAC3B,wBAAwB,EACxB,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACX,WAAW,EACX,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,YAAY,EACZ,cAAc,EACd,WAAW,EACX,eAAe,EACf,oBAAoB,EACpB,0BAA0B,EAC1B,UAAU,EACV,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAK5B,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3F,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAK9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,YAAY,EACV,YAAY,EACZ,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,GAC/B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAErH,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,YAAY,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAEjE,YAAY,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAG/H,eAAO,MAAM,uBAAuB,EAAG,oCAA6C,CAAC;AACrF,eAAO,MAAM,uBAAuB,EAAG,oCAA6C,CAAC;AAErF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAgB5B,8EAA8E;;;;;;;;;;;;;;;;;IAE9E,gFAAgF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAKzE,CAAC;AACZ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/audit/quota/index.js

@@ -0,0 +1,45 @@
+import { z } from "zod";
+import { ResolvedLimitsSchema, LimitConfidenceSchema, LimitSourceSchema, HostConcurrencyLimitSchema, QuotaUsageSnapshotSchema, BackoffStateSchema, WaveBindingCapSchema, DispatchCapacityPoolSummarySchema, DispatchModelTierSchema, HostModelRosterEntrySchema, } from "audit-tools/shared";
+// Re-exported from audit-tools/shared
+export { resolveLimits, classifyProvider, readQuotaState, writeQuotaState, computeMaxSafeConcurrency, recordWaveOutcome, getQuotaStatePath, decayWeight, applyDecayToEntry, computeBackoffCooldownMs, computeBackoffFailureWeight, computeRampUpConcurrency, setQuotaStateDir, detectRateLimitError, computeCooldownUntil, acquireLock, releaseLock, withFileLock, FileLockTimeoutError, runSlidingWindow, LearnedQuotaSource, CompositeQuotaSource, GenericErrorParser, ClaudeCodeErrorParser, getErrorParserForProvider, summarizeDispatchCapacityPools, } from "audit-tools/shared";
+// Wave scheduler now lives in audit-tools/shared (single source of truth for
+// both orchestrators). Auditor passes its discovered-limits via the structural
+// DiscoveredRateLimitsInput the shared scheduler accepts.
+export { scheduleWave, buildProviderModelKey, resolveHostModel } from "audit-tools/shared";
+// Capacity model: the JIT, multi-pool-capable layer both orchestrators size
+// dispatch with. Single host pool today; heterogeneous provider pools slot in
+// without changing call sites.
+export { computeDispatchCapacity } from "audit-tools/shared";
+// Auditor-specific: discovered limits, header extraction
+export { detectHostActiveSubagentLimit, resolveHostActiveSubagentLimit, } from "./hostLimits.js";
+export { lookupDiscoveredLimits, updateDiscoveredLimits, mergeDiscoveredLimits, readDiscoveredLimitsCache, writeDiscoveredLimitsCache, } from "./discoveredLimits.js";
+export { extractRateLimitHeaders } from "./headerExtraction.js";
+export { GenericHeaderExtractor, ClaudeCodeHeaderExtractor, getHeaderExtractorForProvider } from "./headerExtractors/index.js";
+// Auditor-only type (not in shared)
+export const DISPATCH_QUOTA_V1ALPHA1 = "audit-code-dispatch-quota/v1alpha1";
+export const DISPATCH_QUOTA_V1ALPHA2 = "audit-code-dispatch-quota/v1alpha2";
+export const DispatchQuotaSchema = z
+    .object({
+    contract_version: z.enum([
+        DISPATCH_QUOTA_V1ALPHA1,
+        DISPATCH_QUOTA_V1ALPHA2,
+    ]),
+    run_id: z.string(),
+    model: z.string().nullable(),
+    resolved_limits: ResolvedLimitsSchema,
+    confidence: LimitConfidenceSchema,
+    source: LimitSourceSchema,
+    host_concurrency_limit: HostConcurrencyLimitSchema.nullable(),
+    max_concurrent_agents: z.number().int().min(1),
+    cooldown_until: z.string().nullable(),
+    binding_cap: WaveBindingCapSchema.optional(),
+    capacity_pools: z.array(DispatchCapacityPoolSummarySchema).optional(),
+    /** Echo of the host-reported model roster (lowest rank first), when given. */
+    host_model_roster: z.array(HostModelRosterEntrySchema).optional(),
+    /** Per-tier packet input budgets (context − output) derived from the roster. */
+    tier_budgets: z.record(DispatchModelTierSchema, z.number()).optional(),
+    quota_source_snapshot: QuotaUsageSnapshotSchema.nullable().optional(),
+    backoff_state: BackoffStateSchema.nullable().optional(),
+})
+    .strict();
+//# sourceMappingURL=index.js.map

package/dist/audit/quota/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/audit/quota/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,0BAA0B,EAC1B,wBAAwB,EACxB,kBAAkB,EAClB,oBAAoB,EACpB,iCAAiC,EACjC,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAE5B,sCAAsC;AACtC,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,wBAAwB,EACxB,2BAA2B,EAC3B,wBAAwB,EACxB,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACX,WAAW,EACX,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,oBAAoB,CAAC;AA0B5B,6EAA6E;AAC7E,+EAA+E;AAC/E,0DAA0D;AAC1D,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAG3F,4EAA4E;AAC5E,8EAA8E;AAC9E,+BAA+B;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAO7D,yDAAyD;AACzD,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,GAC/B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAIhE,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAE/H,oCAAoC;AACpC,MAAM,CAAC,MAAM,uBAAuB,GAAG,oCAA6C,CAAC;AACrF,MAAM,CAAC,MAAM,uBAAuB,GAAG,oCAA6C,CAAC;AAErF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC;QACvB,uBAAuB;QACvB,uBAAuB;KACxB,CAAC;IACF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,eAAe,EAAE,oBAAoB;IACrC,UAAU,EAAE,qBAAqB;IACjC,MAAM,EAAE,iBAAiB;IACzB,sBAAsB,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAC7D,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,WAAW,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAC5C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;IACrE,8EAA8E;IAC9E,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,QAAQ,EAAE;IACjE,gFAAgF;IAChF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtE,qBAAqB,EAAE,wBAAwB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrE,aAAa,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACxD,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/audit/reporting/findingIdentity.d.ts

@@ -0,0 +1,34 @@
+import { findingIdentitySignature } from "audit-tools/shared";
+import type { FindingIdentityFields } from "audit-tools/shared";
+import type { Finding } from "../types.js";
+export { findingIdentitySignature };
+export type { FindingIdentityFields };
+/**
+ * Re-key finalized findings with globally-unique, content-addressed ids at the
+ * synthesis boundary.
+ *
+ * Worker packets assign locally-scoped ids (e.g. `MNT-001`) that collide across
+ * packets once merged, which breaks `audit-findings.json` as a machine contract:
+ * `buildWorkBlocks` keys its union-find on `id` (so colliding ids fuse unrelated
+ * findings into one block), and `work_blocks.finding_ids` / theme `finding_ids` /
+ * the remediator's per-finding addressing can no longer resolve a single finding.
+ *
+ * The id is `<LENS_PREFIX>-<sha256(signature)[:8]>`, where the signature comes
+ * from the shared deterministic fallback ladder in `findingIdentitySignature` —
+ * stable semantic fields only, so the same semantic finding keeps the same id
+ * across passes and re-syntheses even when volatile fields (line numbers, pass
+ * ordinals, unit ids, timestamps, title phrasing) drift. By the time findings
+ * reach this function, mergeFindings() has already collapsed every re-emission
+ * of one file-independent identity (exact normalized lens|category|title) into
+ * a single multi-file finding, and the hash never covers the merged file list,
+ * so the id also stays stable as a finding's merged file set grows. Distinct
+ * findings that share a signature (e.g. two issues anchored at the same
+ * path + scope) are disambiguated deterministically with a numeric suffix
+ * (findings arrive in mergeFindings()' stable order).
+ *
+ * `related_findings`, when present, referenced the old colliding ids and cannot
+ * be remapped unambiguously, so it is dropped rather than left dangling. (It is
+ * unpopulated by every current extractor.)
+ */
+export declare function assignStableFindingIds(findings: Finding[]): Finding[];
+//# sourceMappingURL=findingIdentity.d.ts.map

package/dist/audit/reporting/findingIdentity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"findingIdentity.d.ts","sourceRoot":"","sources":["../../../src/audit/reporting/findingIdentity.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,wBAAwB,EACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAS3C,OAAO,EAAE,wBAAwB,EAAE,CAAC;AACpC,YAAY,EAAE,qBAAqB,EAAE,CAAC;AAmBtC;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAUrE"}

package/dist/audit/reporting/findingIdentity.js

@@ -0,0 +1,64 @@
+import { hashContent, mintUniqueId, findingIdentityKey, findingIdentitySignature, } from "audit-tools/shared";
+// The finding-identity-signature authority now lives in audit-tools/shared
+// (drift-plan R2 — one rule for "is this the same finding?" across the auditor,
+// the remediator's dedup, and the coverage ledger). This module keeps only the
+// audit-specific concern: turning that signature into the stable, lens-prefixed,
+// content-addressed id written to `audit-findings.json`. The signature itself
+// (and `FindingIdentityFields`) is re-exported so existing importers and tests
+// keep their import site, but there is exactly one implementation.
+export { findingIdentitySignature };
+// Stable lens -> id prefix. The lens is the canonical addressing axis, so the
+// prefix always matches it (no convention drift) and the content hash that
+// follows guarantees global uniqueness.
+const LENS_ID_PREFIX = {
+    correctness: "COR",
+    architecture: "ARC",
+    maintainability: "MNT",
+    security: "SEC",
+    reliability: "REL",
+    performance: "PRF",
+    data_integrity: "DAT",
+    tests: "TST",
+    operability: "OPR",
+    config_deployment: "CFG",
+    observability: "OBS",
+};
+/**
+ * Re-key finalized findings with globally-unique, content-addressed ids at the
+ * synthesis boundary.
+ *
+ * Worker packets assign locally-scoped ids (e.g. `MNT-001`) that collide across
+ * packets once merged, which breaks `audit-findings.json` as a machine contract:
+ * `buildWorkBlocks` keys its union-find on `id` (so colliding ids fuse unrelated
+ * findings into one block), and `work_blocks.finding_ids` / theme `finding_ids` /
+ * the remediator's per-finding addressing can no longer resolve a single finding.
+ *
+ * The id is `<LENS_PREFIX>-<sha256(signature)[:8]>`, where the signature comes
+ * from the shared deterministic fallback ladder in `findingIdentitySignature` —
+ * stable semantic fields only, so the same semantic finding keeps the same id
+ * across passes and re-syntheses even when volatile fields (line numbers, pass
+ * ordinals, unit ids, timestamps, title phrasing) drift. By the time findings
+ * reach this function, mergeFindings() has already collapsed every re-emission
+ * of one file-independent identity (exact normalized lens|category|title) into
+ * a single multi-file finding, and the hash never covers the merged file list,
+ * so the id also stays stable as a finding's merged file set grows. Distinct
+ * findings that share a signature (e.g. two issues anchored at the same
+ * path + scope) are disambiguated deterministically with a numeric suffix
+ * (findings arrive in mergeFindings()' stable order).
+ *
+ * `related_findings`, when present, referenced the old colliding ids and cannot
+ * be remapped unambiguously, so it is dropped rather than left dangling. (It is
+ * unpopulated by every current extractor.)
+ */
+export function assignStableFindingIds(findings) {
+    const used = new Set();
+    return findings.map((finding) => {
+        const prefix = LENS_ID_PREFIX[finding.lens.trim().toLowerCase()] ?? "FND";
+        const hash = hashContent(findingIdentityKey(finding), { length: 8 });
+        const id = mintUniqueId(used, `${prefix}-${hash}`);
+        const reKeyed = { ...finding, id };
+        delete reKeyed.related_findings;
+        return reKeyed;
+    });
+}
+//# sourceMappingURL=findingIdentity.js.map

package/dist/audit/reporting/findingIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"findingIdentity.js","sourceRoot":"","sources":["../../../src/audit/reporting/findingIdentity.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,YAAY,EACZ,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAI5B,2EAA2E;AAC3E,gFAAgF;AAChF,+EAA+E;AAC/E,iFAAiF;AACjF,8EAA8E;AAC9E,+EAA+E;AAC/E,mEAAmE;AACnE,OAAO,EAAE,wBAAwB,EAAE,CAAC;AAGpC,8EAA8E;AAC9E,2EAA2E;AAC3E,wCAAwC;AACxC,MAAM,cAAc,GAA2B;IAC7C,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,KAAK;IACnB,eAAe,EAAE,KAAK;IACtB,QAAQ,EAAE,KAAK;IACf,WAAW,EAAE,KAAK;IAClB,WAAW,EAAE,KAAK;IAClB,cAAc,EAAE,KAAK;IACrB,KAAK,EAAE,KAAK;IACZ,WAAW,EAAE,KAAK;IAClB,iBAAiB,EAAE,KAAK;IACxB,aAAa,EAAE,KAAK;CACrB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAmB;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK,CAAC;QAC1E,MAAM,IAAI,GAAG,WAAW,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACrE,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,OAAO,GAAY,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,CAAC;QAC5C,OAAO,OAAO,CAAC,gBAAgB,CAAC;QAChC,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/audit/reporting/findingRanks.d.ts

@@ -0,0 +1,2 @@
+export { severityRank, confidenceRank, severityCompare } from "audit-tools/shared";
+//# sourceMappingURL=findingRanks.d.ts.map

package/dist/audit/reporting/findingRanks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"findingRanks.d.ts","sourceRoot":"","sources":["../../../src/audit/reporting/findingRanks.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/audit/reporting/findingRanks.js

@@ -0,0 +1,7 @@
+// Severity / confidence ranking is single-sourced in audit-tools/shared
+// (derived from the canonical SEVERITIES/CONFIDENCES tuples so it can never
+// drift). This module re-exports the shared functions under the existing import
+// path so the auditor's reporting code (workBlocks, mergeFindings) keeps working
+// without each package hand-copying a rank table.
+export { severityRank, confidenceRank, severityCompare } from "audit-tools/shared";
+//# sourceMappingURL=findingRanks.js.map

package/dist/audit/reporting/findingRanks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"findingRanks.js","sourceRoot":"","sources":["../../../src/audit/reporting/findingRanks.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,4EAA4E;AAC5E,gFAAgF;AAChF,iFAAiF;AACjF,kDAAkD;AAClD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/audit/reporting/mergeFindings.d.ts

@@ -0,0 +1,6 @@
+import type { AuditResult, Finding } from "../types.js";
+import type { DesignAssessment } from "../types/designAssessment.js";
+import type { ExternalAnalyzerResults } from "../types/externalAnalyzer.js";
+import type { RuntimeValidationReport } from "../types/runtimeValidation.js";
+export declare function mergeFindings(results: AuditResult[], runtimeReport?: RuntimeValidationReport, externalAnalyzerResults?: ExternalAnalyzerResults, designAssessment?: DesignAssessment): Finding[];
+//# sourceMappingURL=mergeFindings.d.ts.map

package/dist/audit/reporting/mergeFindings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mergeFindings.d.ts","sourceRoot":"","sources":["../../../src/audit/reporting/mergeFindings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AA+T7E,wBAAgB,aAAa,CAC3B,OAAO,EAAE,WAAW,EAAE,EACtB,aAAa,CAAC,EAAE,uBAAuB,EACvC,uBAAuB,CAAC,EAAE,uBAAuB,EACjD,gBAAgB,CAAC,EAAE,gBAAgB,GAClC,OAAO,EAAE,CA8CX"}