@bitkyc08/opencodex 2.7.23 → 2.7.24

package/src/providers/openai-virtual-models.ts

@@ -0,0 +1,82 @@
+import { PROVIDER_REGISTRY } from "./registry";
+import { OPENAI_API_PROVIDER_ID } from "./openai-tiers";
+import type { OcxParsedRequest } from "../types";
+import type { RouteResult } from "../router";
+import type { RequestLogContext } from "../server/request-log";
+
+export interface OpenAiVirtualModelResolution {
+  selectedModelId: string;
+  wireModelId: string;
+  reasoningMode: "pro";
+}
+
+export class InvalidOpenAiVirtualModelRegistryError extends Error {
+  constructor(selectedModelId: string) {
+    super(`Invalid OpenAI virtual model registry definition: ${selectedModelId}`);
+    this.name = "InvalidOpenAiVirtualModelRegistryError";
+  }
+}
+
+export function validateOpenAiVirtualModelDefinition(
+  selectedModelId: string,
+  definition: unknown,
+): OpenAiVirtualModelResolution {
+  if (!definition || typeof definition !== "object" || Array.isArray(definition)) {
+    throw new InvalidOpenAiVirtualModelRegistryError(selectedModelId);
+  }
+  const raw = definition as { wireModelId?: unknown; reasoningMode?: unknown };
+  if (
+    typeof raw.wireModelId !== "string"
+    || raw.wireModelId.trim() !== raw.wireModelId
+    || raw.wireModelId.length === 0
+    || raw.wireModelId.includes("/")
+    || raw.wireModelId === selectedModelId
+    || raw.reasoningMode !== "pro"
+  ) {
+    throw new InvalidOpenAiVirtualModelRegistryError(selectedModelId);
+  }
+  return { selectedModelId, wireModelId: raw.wireModelId, reasoningMode: "pro" };
+}
+
+export function resolveOpenAiVirtualModel(
+  providerName: string,
+  selectedModelId: string,
+): OpenAiVirtualModelResolution | undefined {
+  if (providerName !== OPENAI_API_PROVIDER_ID) return undefined;
+  const entry = PROVIDER_REGISTRY.find(row => row.id === OPENAI_API_PROVIDER_ID);
+  if (!entry?.virtualModels || !Object.hasOwn(entry.virtualModels, selectedModelId)) return undefined;
+  const definition = entry.virtualModels[selectedModelId];
+  return validateOpenAiVirtualModelDefinition(selectedModelId, definition);
+}
+
+export function applyOpenAiVirtualModel(
+  parsed: OcxParsedRequest,
+  route: RouteResult,
+  logCtx: RequestLogContext,
+): OpenAiVirtualModelResolution | undefined {
+  const selectedModelId = logCtx.model && logCtx.model !== route.modelId ? logCtx.model : route.modelId;
+  const resolution = resolveOpenAiVirtualModel(route.providerName, selectedModelId);
+  if (!resolution) return undefined;
+
+  logCtx.model = resolution.selectedModelId;
+  logCtx.resolvedModel = resolution.wireModelId;
+  route.modelId = resolution.wireModelId;
+  parsed.modelId = resolution.wireModelId;
+
+  if (parsed._rawBody && typeof parsed._rawBody === "object" && !Array.isArray(parsed._rawBody)) {
+    const raw = parsed._rawBody as Record<string, unknown>;
+    raw.model = resolution.wireModelId;
+    const existing = raw.reasoning;
+    raw.reasoning = existing && typeof existing === "object" && !Array.isArray(existing)
+      ? { ...(existing as Record<string, unknown>), mode: resolution.reasoningMode }
+      : { mode: resolution.reasoningMode };
+  }
+  return resolution;
+}
+
+export function resolveOpenAiCompactModel(
+  providerName: string,
+  selectedModelId: string,
+): OpenAiVirtualModelResolution | undefined {
+  return resolveOpenAiVirtualModel(providerName, selectedModelId);
+}

package/src/providers/quota.ts

@@ -1,14 +1,18 @@
-import { listCodexAuthAccounts } from "../codex/auth-api";
+import { fetchMainAccountInfo, listCodexAuthAccounts } from "../codex/auth-api";
 import { MAIN_CODEX_ACCOUNT_ID } from "../codex/main-account";
 import { getValidAccessToken } from "../oauth";
 import { getCredential } from "../oauth/store";
 import { antigravityUserAgent } from "../adapters/client-fingerprint";
-import { getProviderRegistryEntry } from "./registry";
+import { getProviderRegistryEntry, providerCodexAccountMode } from "./registry";
 import type { OcxConfig, OcxProviderConfig } from "../types";
+import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "./openai-tiers";
 
 const CACHE_TTL_MS = 5 * 60_000;
 const REQUEST_TIMEOUT_MS = 8_000;
-const REFRESH_SKEW_MS = 60_000;
+const KIMI_CODE_BASE_URL = "https://api.kimi.com/coding/v1";
+const KIMI_CODE_USAGE_URL = `${KIMI_CODE_BASE_URL}/usages`;
+/** Keep a failed probe's previous row at most this long before dropping it. */
+const LAST_GOOD_MAX_AGE_MS = 30 * 60_000;
 
 export interface ProviderQuotaWindow {
   label: string;
@@ -17,6 +21,8 @@ export interface ProviderQuotaWindow {
 }
 
 export interface ProviderQuota {
+  fiveHourPercent?: number;
+  fiveHourResetAt?: number;
   weeklyPercent?: number;
   weeklyResetAt?: number;
   monthlyPercent?: number;
@@ -40,15 +46,19 @@ export interface ProviderQuotaResponse {
 }
 
 let cache: { key: string; ts: number; response: ProviderQuotaResponse } | null = null;
+const inflight = new Map<string, { epoch: number; promise: Promise<ProviderQuotaResponse> }>();
+/** Bumped on cache clear and on force-refresh start; stale-epoch probes lose commit authority. */
+let invalidationEpoch = 0;
 
 /** Invalidate the report cache (e.g. after switching a provider's active account). */
 export function clearProviderQuotaCache(): void {
   cache = null;
+  invalidationEpoch += 1;
 }
 
 function cacheKey(config: OcxConfig): string {
   const providers = Object.entries(config.providers)
-    .map(([name, provider]) => `${name}:${provider.authMode ?? "key"}:${provider.disabled === true ? "off" : "on"}:${provider.baseUrl}`)
+    .map(([name, provider]) => `${name}:${provider.adapter}:${provider.authMode ?? "key"}:${providerCodexAccountMode(name, provider) ?? "none"}:${provider.disabled === true ? "off" : "on"}:${provider.baseUrl}`)
     .sort()
     .join("|");
   return `${config.defaultProvider}|${config.activeCodexAccountId ?? ""}|${providers}`;
@@ -56,7 +66,8 @@ function cacheKey(config: OcxConfig): string {
 
 function hasQuotaRows(quota: ProviderQuota | null | undefined): quota is ProviderQuota {
   if (!quota) return false;
-  return typeof quota.weeklyPercent === "number"
+  return typeof quota.fiveHourPercent === "number"
+    || typeof quota.weeklyPercent === "number"
     || typeof quota.monthlyPercent === "number"
     || !!quota.customWindows?.some(window => typeof window.percent === "number");
 }
@@ -93,12 +104,7 @@ function asRecord(value: unknown): Record<string, unknown> | null {
 }
 
 function isBuiltInChatGptForwardProvider(name: string, provider: OcxProviderConfig): boolean {
-  const base = provider.baseUrl.replace(/\/+$/, "");
-  const normalizedName = name.toLowerCase();
-  return (normalizedName === "openai" || normalizedName === "chatgpt")
-    && provider.adapter === "openai-responses"
-    && provider.authMode === "forward"
-    && base === "https://chatgpt.com/backend-api/codex";
+  return name === OPENAI_CODEX_PROVIDER_ID && isCanonicalOpenAiForwardProvider(provider);
 }
 
 function report(provider: string, source: string, quota: ProviderQuota): ProviderQuotaReport | null {
@@ -112,7 +118,17 @@ function report(provider: string, source: string, quota: ProviderQuota): Provide
   };
 }
 
-async function fetchChatGptForwardQuota(config: OcxConfig, provider: string, forceRefresh: boolean): Promise<ProviderQuotaReport | null> {
+async function fetchChatGptForwardQuota(
+  config: OcxConfig,
+  provider: string,
+  providerConfig: OcxProviderConfig,
+  forceRefresh: boolean,
+): Promise<ProviderQuotaReport | null> {
+  if (providerCodexAccountMode(provider, providerConfig) === "direct") {
+    const main = await fetchMainAccountInfo(forceRefresh);
+    const quota = main.quota ? { ...main.quota, updatedAt: Date.now() } as ProviderQuota : null;
+    return quota ? report(provider, "chatgpt:wham", quota) : null;
+  }
   const accounts = await listCodexAuthAccounts(config, forceRefresh);
   const activeId = config.activeCodexAccountId || MAIN_CODEX_ACCOUNT_ID;
   const active = accounts.find(account => account.id === activeId)
@@ -165,15 +181,19 @@ function parseClaudeBucket(value: unknown): { percent?: number; resetAt?: number
 }
 
 async function fetchAnthropicQuota(provider: string): Promise<ProviderQuotaReport | null> {
-  const credential = getCredential("anthropic");
-  if (!credential || credential.expires <= Date.now() + REFRESH_SKEW_MS) return null;
+  let accessToken: string;
+  try {
+    accessToken = await getValidAccessToken("anthropic");
+  } catch {
+    return null;
+  }
   const response = await fetch("https://api.anthropic.com/api/oauth/usage", {
     headers: {
       Accept: "application/json, text/plain, */*",
       "Content-Type": "application/json",
       "User-Agent": "claude-cli/2.1.63 (external, cli)",
       "anthropic-beta": "claude-code-20250219,oauth-2025-04-20,interleaved-thinking-2025-05-14,context-management-2025-06-27,prompt-caching-scope-2026-01-05",
-      Authorization: `Bearer ${credential.access}`,
+      Authorization: `Bearer ${accessToken}`,
     },
     signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
   });
@@ -197,6 +217,270 @@ async function fetchAnthropicQuota(provider: string): Promise<ProviderQuotaRepor
   return report(provider, "anthropic:oauth-usage", quota);
 }
 
+function normalizedBaseUrl(value: string): string | null {
+  try {
+    const url = new URL(value);
+    if (url.search || url.hash) return null;
+    return `${url.origin.toLowerCase()}${url.pathname.replace(/\/+$/, "")}`;
+  } catch {
+    return null;
+  }
+}
+
+function quotaResetAt(row: Record<string, unknown>): number | undefined {
+  return normalizeResetAt(row.resetTime ?? row.resetAt ?? row.reset_time ?? row.reset_at);
+}
+
+function parseKimiQuotaRow(value: unknown, resetFallback?: Record<string, unknown>): { percent: number; resetAt?: number } | null {
+  const row = asRecord(value);
+  if (!row) return null;
+  const limit = toFiniteNumber(row.limit);
+  if (limit === undefined || limit <= 0) return null;
+  let used = toFiniteNumber(row.used);
+  if (used === undefined) {
+    const remaining = toFiniteNumber(row.remaining);
+    if (remaining === undefined) return null;
+    used = limit - remaining;
+  }
+  const percent = normalizePercent((used / limit) * 100);
+  if (percent === undefined) return null;
+  const resetAt = quotaResetAt(row) ?? (resetFallback ? quotaResetAt(resetFallback) : undefined);
+  return { percent, ...(resetAt !== undefined ? { resetAt } : {}) };
+}
+
+function isKimiFiveHourLimit(item: Record<string, unknown>, detail: Record<string, unknown>, window: Record<string, unknown>): boolean {
+  const duration = toFiniteNumber(window.duration ?? item.duration ?? detail.duration);
+  const unit = String(window.timeUnit ?? item.timeUnit ?? detail.timeUnit ?? "").toUpperCase();
+  if ((unit.includes("MINUTE") && duration === 300) || (unit.includes("HOUR") && duration === 5)) return true;
+  const label = [item.name, item.title, item.scope, detail.name, detail.title]
+    .filter((value): value is string => typeof value === "string")
+    .join(" ")
+    .toLowerCase();
+  return /(^|\b)5\s*(?:h|hour)/.test(label);
+}
+
+function parseKimiQuotaPayload(value: unknown): ProviderQuota | null {
+  const body = asRecord(value);
+  if (!body) return null;
+  const weekly = parseKimiQuotaRow(body.usage);
+  const total = parseKimiQuotaRow(body.totalQuota);
+  let fiveHour: { percent: number; resetAt?: number } | null = null;
+  if (Array.isArray(body.limits)) {
+    for (const rawItem of body.limits) {
+      const item = asRecord(rawItem);
+      if (!item) continue;
+      const detail = asRecord(item.detail) ?? item;
+      const window = asRecord(item.window) ?? {};
+      if (!isKimiFiveHourLimit(item, detail, window)) continue;
+      fiveHour = parseKimiQuotaRow(detail, window);
+      if (fiveHour) break;
+    }
+  }
+  const quota: ProviderQuota = {
+    ...(fiveHour ? {
+      fiveHourPercent: fiveHour.percent,
+      ...(fiveHour.resetAt !== undefined ? { fiveHourResetAt: fiveHour.resetAt } : {}),
+    } : {}),
+    ...(weekly ? {
+      weeklyPercent: weekly.percent,
+      ...(weekly.resetAt !== undefined ? { weeklyResetAt: weekly.resetAt } : {}),
+    } : {}),
+    ...(total ? { customWindows: [{ label: "Total subscription credits", percent: total.percent, ...(total.resetAt !== undefined ? { resetAt: total.resetAt } : {}) }] } : {}),
+    updatedAt: Date.now(),
+  };
+  return hasQuotaRows(quota) ? quota : null;
+}
+
+async function fetchKimiQuota(provider: string, config: OcxProviderConfig): Promise<ProviderQuotaReport | null> {
+  // Never release an OAuth token to a user-edited or lookalike provider host.
+  if (normalizedBaseUrl(config.baseUrl) !== KIMI_CODE_BASE_URL) return null;
+  let accessToken: string;
+  try {
+    accessToken = await getValidAccessToken("kimi");
+  } catch {
+    return null;
+  }
+  const response = await fetch(KIMI_CODE_USAGE_URL, {
+    headers: { Accept: "application/json", Authorization: `Bearer ${accessToken}` },
+    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+  });
+  if (!response.ok) return null;
+  const quota = parseKimiQuotaPayload(await response.json().catch(() => null));
+  return quota ? report(provider, "kimi:usages", quota) : null;
+}
+
+/** Cursor included usage via api2.cursor.sh (Bearer from OAuth) — unofficial, may change. */
+async function fetchCursorQuota(provider: string): Promise<ProviderQuotaReport | null> {
+  let accessToken: string;
+  try {
+    accessToken = await getValidAccessToken("cursor");
+  } catch {
+    return null;
+  }
+
+  const authHeaders = {
+    Accept: "application/json",
+    Authorization: `Bearer ${accessToken}`,
+    "User-Agent": "opencodex-quota",
+  } as const;
+
+  // Prefer dashboard period usage (Pro/Team/Ultra spend allowance in USD cents).
+  // Field names follow Cursor's Connect RPC shape (limit/remaining/includedSpend), not usedCents.
+  try {
+    const periodRes = await fetch("https://api2.cursor.sh/aiserver.v1.DashboardService/GetCurrentPeriodUsage", {
+      method: "POST",
+      headers: {
+        ...authHeaders,
+        "Content-Type": "application/json",
+        "Connect-Protocol-Version": "1",
+      },
+      body: "{}",
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    });
+    if (periodRes.ok) {
+      const body = asRecord(await periodRes.json().catch(() => null));
+      const planUsage = asRecord(body?.planUsage);
+      if (planUsage) {
+        const resetAt = normalizeResetAt(body?.billingCycleEnd ?? planUsage.billingCycleEnd ?? body?.periodEnd);
+        // Cursor tracks two linked pools: First-party models (Auto/Composer/Grok) and API usage.
+        const autoPercent = normalizePercent(planUsage.autoPercentUsed);
+        const apiPercent = normalizePercent(planUsage.apiPercentUsed);
+        const customWindows: ProviderQuotaWindow[] = [];
+        if (autoPercent !== undefined) {
+          customWindows.push({
+            label: "First-party models",
+            percent: autoPercent,
+            ...(resetAt !== undefined ? { resetAt } : {}),
+          });
+        }
+        if (apiPercent !== undefined) {
+          customWindows.push({
+            label: "API usage",
+            percent: apiPercent,
+            ...(resetAt !== undefined ? { resetAt } : {}),
+          });
+        }
+        if (customWindows.length > 0) {
+          const built = report(provider, "cursor:period-usage", {
+            customWindows,
+            updatedAt: Date.now(),
+          });
+          if (built) return { ...built, reverseEngineered: true };
+        }
+
+        const limit = toFiniteNumber(planUsage.limit ?? planUsage.limitCents ?? planUsage.totalLimitCents);
+        const remaining = toFiniteNumber(planUsage.remaining ?? planUsage.remainingCents);
+        const includedSpend = toFiniteNumber(planUsage.includedSpend ?? planUsage.usedCents ?? planUsage.used);
+        const totalSpend = toFiniteNumber(planUsage.totalSpend);
+        let used: number | undefined;
+        if (includedSpend !== undefined) used = includedSpend;
+        else if (limit !== undefined && remaining !== undefined) used = Math.max(0, limit - remaining);
+        else if (totalSpend !== undefined) used = totalSpend;
+        const totalPercent = normalizePercent(planUsage.totalPercentUsed ?? planUsage.percentUsed);
+        if (limit !== undefined && limit > 0 && used !== undefined) {
+          const percent = totalPercent ?? normalizePercent((used / limit) * 100);
+          if (percent !== undefined) {
+            const built = report(provider, "cursor:period-usage", {
+              monthlyPercent: percent,
+              ...(resetAt !== undefined ? { monthlyResetAt: resetAt } : {}),
+              updatedAt: Date.now(),
+            });
+            if (built) return { ...built, reverseEngineered: true };
+          }
+        } else if (totalPercent !== undefined) {
+          const built = report(provider, "cursor:period-usage", {
+            monthlyPercent: totalPercent,
+            ...(resetAt !== undefined ? { monthlyResetAt: resetAt } : {}),
+            updatedAt: Date.now(),
+          });
+          if (built) return { ...built, reverseEngineered: true };
+        }
+      }
+    }
+  } catch {
+    /* fall through */
+  }
+
+  // /api/usage/summary — same host, sometimes richer than /auth/usage for Team plans.
+  try {
+    const summaryRes = await fetch("https://api2.cursor.sh/api/usage/summary", {
+      headers: authHeaders,
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    });
+    if (summaryRes.ok) {
+      const body = asRecord(await summaryRes.json().catch(() => null));
+      const individual = asRecord(body?.individualUsage);
+      const plan = asRecord(individual?.plan);
+      if (plan) {
+        const used = toFiniteNumber(plan.used);
+        const limit = toFiniteNumber(plan.limit);
+        const percent = normalizePercent(plan.totalPercentUsed)
+          ?? (used !== undefined && limit !== undefined && limit > 0
+            ? normalizePercent((used / limit) * 100)
+            : undefined);
+        if (percent !== undefined) {
+          const built = report(provider, "cursor:usage-summary", {
+            monthlyPercent: percent,
+            monthlyResetAt: normalizeResetAt(body?.billingCycleEnd),
+            updatedAt: Date.now(),
+          });
+          if (built) return { ...built, reverseEngineered: true };
+        }
+      }
+    }
+  } catch {
+    /* fall through to /auth/usage */
+  }
+
+  const response = await fetch("https://api2.cursor.sh/auth/usage", {
+    headers: authHeaders,
+    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+  });
+  if (!response.ok) return null;
+  const body = asRecord(await response.json().catch(() => null));
+  if (!body) return null;
+
+  // Prefer the gpt-4 bucket (historical "fast requests"); else first model with used+limit.
+  let used: number | undefined;
+  let limit: number | undefined;
+  const gpt4 = asRecord(body["gpt-4"]);
+  if (gpt4) {
+    used = toFiniteNumber(gpt4.numRequests ?? gpt4.used);
+    limit = toFiniteNumber(gpt4.maxRequestUsage ?? gpt4.limit ?? gpt4.maxRequests);
+  }
+  if (used === undefined || limit === undefined || limit <= 0) {
+    for (const [key, value] of Object.entries(body)) {
+      if (key === "startOfMonth" || key === "billingCycleStart") continue;
+      const bucket = asRecord(value);
+      if (!bucket) continue;
+      const bucketUsed = toFiniteNumber(bucket.numRequests ?? bucket.used);
+      const bucketLimit = toFiniteNumber(bucket.maxRequestUsage ?? bucket.limit ?? bucket.maxRequests);
+      if (bucketUsed !== undefined && bucketLimit !== undefined && bucketLimit > 0) {
+        used = bucketUsed;
+        limit = bucketLimit;
+        break;
+      }
+    }
+  }
+  if (used === undefined || limit === undefined || limit <= 0) return null;
+  const percent = normalizePercent((used / limit) * 100);
+  if (percent === undefined) return null;
+  const startOfMonth = normalizeResetAt(body.startOfMonth ?? body.billingCycleStart);
+  // Next reset = same day next month, computed in UTC to avoid timezone-shifted rollover.
+  const monthlyResetAt = startOfMonth !== undefined
+    ? (() => {
+        const start = new Date(startOfMonth);
+        return Date.UTC(start.getUTCFullYear(), start.getUTCMonth() + 1, start.getUTCDate());
+      })()
+    : undefined;
+  const built = report(provider, "cursor:auth-usage", {
+    monthlyPercent: percent,
+    ...(monthlyResetAt !== undefined ? { monthlyResetAt } : {}),
+    updatedAt: Date.now(),
+  });
+  return built ? { ...built, reverseEngineered: true } : null;
+}
+
 function quotaInfoEntries(modelInfo: Record<string, unknown>): Record<string, unknown>[] {
   const entries: Record<string, unknown>[] = [];
   const add = (value: unknown, tier?: string) => {
@@ -307,10 +591,12 @@ async function maybeFetchProviderQuota(
 ): Promise<ProviderQuotaReport | null> {
   if (provider.disabled === true) return null;
   try {
-    if (isBuiltInChatGptForwardProvider(name, provider)) return fetchChatGptForwardQuota(config, name, forceRefresh);
+    if (isBuiltInChatGptForwardProvider(name, provider)) return fetchChatGptForwardQuota(config, name, provider, forceRefresh);
     if (provider.authMode === "oauth" && name === "xai") return fetchXaiQuota(name);
     if (provider.authMode === "oauth" && name === "anthropic") return fetchAnthropicQuota(name);
+    if (provider.authMode === "oauth" && name === "cursor") return fetchCursorQuota(name);
     if (provider.authMode === "oauth" && name === "google-antigravity") return fetchAntigravityQuota(name, provider);
+    if (provider.authMode === "oauth" && name === "kimi") return fetchKimiQuota(name, provider);
     return null;
   } catch {
     return null;
@@ -320,12 +606,46 @@ async function maybeFetchProviderQuota(
 export async function fetchProviderQuotaReports(config: OcxConfig, forceRefresh = false): Promise<ProviderQuotaResponse> {
   const key = cacheKey(config);
   const now = Date.now();
-  if (!forceRefresh && cache && cache.key === key && now - cache.ts < CACHE_TTL_MS) return cache.response;
-
-  const reports = (await Promise.all(
-    Object.entries(config.providers).map(([name, provider]) => maybeFetchProviderQuota(name, provider, config, forceRefresh)),
-  )).filter((item): item is ProviderQuotaReport => item !== null);
-  const response = { generatedAt: Date.now(), reports };
-  cache = { key, ts: now, response };
-  return response;
+  // The cache fast path must not extend a preserved last-good row past its 30-minute bound:
+  // a row preserved at age 29:59 plus a full 5-minute TTL would otherwise serve until ~35min.
+  const cacheFresh = cache && cache.key === key && now - cache.ts < CACHE_TTL_MS
+    && cache.response.reports.every(item => now - item.updatedAt < LAST_GOOD_MAX_AGE_MS);
+  if (!forceRefresh && cacheFresh) return cache!.response;
+  const joinable = inflight.get(key);
+  if (!forceRefresh && joinable && joinable.epoch === invalidationEpoch) return joinable.promise;
+  // A forced probe takes commit authority: older in-flight probes must not overwrite its result.
+  if (forceRefresh) invalidationEpoch += 1;
+  const epoch = invalidationEpoch;
+
+  const promise = (async (): Promise<ProviderQuotaResponse> => {
+    const previous = cache && cache.key === key ? cache.response.reports : [];
+    const fresh = (await Promise.all(
+      Object.entries(config.providers).map(([name, provider]) => maybeFetchProviderQuota(name, provider, config, forceRefresh)),
+    )).filter((item): item is ProviderQuotaReport => item !== null);
+
+    // Keep bounded last-good rows when a probe fails (e.g. transient upstream flake); never
+    // re-stamp their timestamps, and drop rows older than LAST_GOOD_MAX_AGE_MS.
+    // Note: the cache key encodes the provider set (name/adapter/authMode/disabled/baseUrl),
+    // so previous rows always correspond to currently configured, enabled providers — a
+    // disabled or removed provider changes the key and starts from an empty previous set.
+    const cutoff = Date.now() - LAST_GOOD_MAX_AGE_MS;
+    const byProvider = new Map<string, ProviderQuotaReport>();
+    for (const item of previous) {
+      if (item.updatedAt >= cutoff) byProvider.set(item.provider, item);
+    }
+    for (const item of fresh) byProvider.set(item.provider, item);
+
+    const response = { generatedAt: Date.now(), reports: [...byProvider.values()] };
+    // Commit only when this probe still holds authority (no clear/force superseded it).
+    if (epoch === invalidationEpoch) cache = { key, ts: Date.now(), response };
+    return response;
+  })();
+
+  const entry = { epoch, promise };
+  inflight.set(key, entry);
+  try {
+    return await promise;
+  } finally {
+    if (inflight.get(key) === entry) inflight.delete(key);
+  }
 }