@cortexkit/opencode-openai-auth 0.11.0 → 1.0.0

package/dist/pool-lifecycle-DbDmgabd.d.ts

@@ -0,0 +1,2430 @@
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/schema.d.ts
+type OAuthCredential = {
+  type: 'oauth';
+  access?: string;
+  refresh: string;
+  expires?: number;
+};
+type ApiKeyCredential = {
+  type: 'api';
+  apiKey: string;
+  baseURL: string;
+  authHeader?: 'authorization-bearer' | 'x-api-key';
+};
+type PoolCredential = OAuthCredential | ApiKeyCredential;
+/**
+ * What `rotate` takes. Rotation refreshes the secret of the endpoint a row
+ * already has, so an API key may leave out `baseURL` (and `authHeader`) to
+ * keep the row's; one it gives must equal the row's.
+ */
+type RotateCredential = OAuthCredential | (Omit<ApiKeyCredential, 'baseURL'> & {
+  baseURL?: string;
+});
+/** A credential as stored: an OAuth credential also carries its refresh stamp. */
+type StoredCredential = (OAuthCredential & {
+  lastRefreshedAt?: number;
+}) | ApiKeyCredential;
+/** Quota codec supplied by `/quota`: the store never interprets the map itself. */
+interface QuotaCodec {
+  validate(value: unknown): boolean;
+  merge(stored: unknown | undefined, observation: unknown): unknown;
+}
+/**
+ * What `ProviderStateCodec.onReplace` is told about a replacement: the row id,
+ * the credential epoch the new credential starts, `previousIdentity` (the
+ * identity the locked row recorded before the replace), `identity` (the
+ * identity the replace records), and the provider state the caller handed to
+ * `replace`, if any. Each identity is absent when none was recorded.
+ */
+interface ProviderStateReplacement {
+  id: string;
+  credentialEpoch: number;
+  previousIdentity?: string;
+  identity?: string;
+  incoming?: unknown;
+}
+/**
+ * Codec for the provider state a plugin keeps beside each row's credential
+ * (a project id, a device fingerprint, eligibility times: whatever belongs to
+ * that credential). The store never interprets the value: it stores it as
+ * JSON, asks `validate` before every write and on every load, and calls the
+ * hooks below where two values meet. Every hook is synchronous and runs
+ * under the store locks.
+ */
+interface ProviderStateCodec {
+  validate(value: unknown): boolean;
+  /**
+   * The part of a (valid) value that belongs to the credential: what is true
+   * of the account the credential signs in to, such as a project id or a
+   * device fingerprint, as opposed to what the plugin merely tracks about
+   * its use, such as a cooldown or a cursor. The credential stamp covers the
+   * digest of exactly this projection, so a foreign edit of it hides the
+   * value, while the rest may change through `updateProviderState` without
+   * the stamp being rewritten. It must be a pure function of the value that
+   * returns JSON with a deterministic key order. Without it the whole value
+   * is credential-bound.
+   */
+  credentialBound?(value: unknown): unknown;
+  /**
+   * Combines the value on disk with one a write brings (`add` of a secret the
+   * pool already holds, `rotate`, or a refresh whose provider returned a
+   * state). Called only when the row has a value on disk; without it the
+   * incoming value replaces the stored one. Its result is validated.
+   */
+  merge?(onDisk: unknown, incoming: unknown): unknown;
+  /**
+   * The provider state of a row once `replace` gives it a new credential
+   * epoch. `previous` is the old credential's value (undefined when the row
+   * shows none). Returning undefined clears it. Without this hook a replace
+   * keeps the value handed to `replace` and otherwise clears the state.
+   */
+  onReplace?(previous: unknown | undefined, replacement: ProviderStateReplacement): unknown | undefined;
+}
+/**
+ * Why a row shows no provider state although the state file holds one for it.
+ *
+ * `uncovered`: the value's credential-bound part (see
+ * `ProviderStateCodec.credentialBound`) is not the one this store last
+ * wrote beside the row's credential at its credential epoch and recorded
+ * identity. Another writer edited it, or
+ * wrote the credential beside it without knowing about it (an older version
+ * of this library, which drops the coverage, or a writer that does not know
+ * the pool at all), or it belongs to an earlier credential of the row.
+ * `invalid`: the value is covered but the codec rejects it, or the store was
+ * opened without a provider-state codec.
+ */
+type ProviderStateDrop = 'uncovered' | 'invalid';
+/**
+ * What the stamp beside a row's credential proves (see `CredentialStamp`).
+ *
+ * `none`: the row holds no credential, so there is nothing to stamp.
+ * `bound`: the stamp was written with this credential (its digest matches),
+ * names the row's credential epoch (1 for a row without a per-row entry),
+ * the identity it records (or its recording none) and any endpoint it
+ * records are the row's, and its dispatch digest matches everything a
+ * request would send (the OAuth access and refresh tokens and expiry; the API
+ * key with its `baseURL` and `authHeader`).
+ * `missing`: the credential carries no stamp (written by a writer that does
+ * not know about stamps, or one that dropped it).
+ * `malformed`: the stamp is not one this store writes (wrong shape, or an
+ * epoch outside the positive safe integers).
+ * `mismatched`: the stamp was written for another credential, epoch,
+ * identity, endpoint, or token to send than the row now holds.
+ * `legacy`: a well-formed stamp written with this credential's secret but
+ * with no dispatch digest (written by 0.4.3 or earlier), so it proves
+ * neither the token sent nor the account or endpoint it goes to.
+ */
+type CredentialStampStatus = 'none' | 'bound' | 'missing' | 'malformed' | 'mismatched' | 'legacy';
+/** One row of the pool as loaded. */
+interface PoolRow {
+  id: string;
+  type: 'oauth' | 'api';
+  label?: string;
+  enabled: boolean;
+  addedAt?: number;
+  /** Recorded wire identity (the roster row's `accountId`), when known. */
+  identity?: string;
+  /** Undefined when the state file holds no usable credential for the row. */
+  credential?: StoredCredential;
+  /** Stable hash of the credential's secret material; never persisted. */
+  fingerprint?: string;
+  /** Undefined when the row has no per-row entry yet. */
+  credentialEpoch?: number;
+  needsFirstReading: boolean;
+  disabledReason?: string;
+  /** Store-owned reservation; only `publishRoster` releases it for ordinary use. */
+  staged?: {
+    reservation: string;
+  };
+  /** The opaque quota map, as validated by the codec. */
+  quota?: unknown;
+  /**
+   * The opaque provider state kept beside the credential, as validated by
+   * the provider-state codec. Absent when the row has none, or when the one
+   * on disk is not shown (see `providerStateDropped`).
+   */
+  providerState?: unknown;
+  /**
+   * Set when the state file holds a provider state for the row that is not
+   * shown, and why. The value stays on disk untouched until a write on the
+   * row sets or clears it; the row itself stays usable.
+   */
+  providerStateDropped?: ProviderStateDrop;
+  hasEntry: boolean;
+  /** A row that may be refreshed, pulled for, or admitted. */
+  candidate: boolean;
+  /** Set when the roster row or the per-row entry failed validation. */
+  invalid?: 'roster' | 'entry';
+  /**
+   * Set when a replace stopped between its two writes: the state file holds
+   * the new credential, stamped with the epoch and the identity or endpoint
+   * it belongs to, and the config still holds the replaced row. Also set when
+   * a write that gives a row its first identity (`recordIdentity`, or a
+   * `rotate` or refresh that learns one) stopped after stamping the identity
+   * and before recording it in the config, and when an attributed `disable`
+   * or `enable` that changed the provider state stopped after its state
+   * write and before flipping the row in the config. The row is shown as the
+   * write leaves it once completed, is never a candidate, and the next store
+   * write on it writes the config to match.
+   */
+  torn?: true;
+  /**
+   * Whether the credential is the one the store last stamped for this row
+   * (see `CredentialStampStatus`). Every row the store loads carries it; a
+   * torn row reports the stamp of the row as it is shown completed. It is
+   * optional only so that rows built by hand (test fixtures) still type.
+   */
+  stamp?: CredentialStampStatus;
+  /**
+   * Set only when the store was opened with `requireCredentialStamps` and
+   * the row's `stamp` is not `bound`: the row is never a candidate, and
+   * `refresh`, quota pulls, `recordQuota`, `recordIdentity`, `rotate` and a
+   * re-`add` onto it refuse with `unbound-credential`. Only `replace` (or a
+   * new row) makes it usable again.
+   */
+  unbound?: true;
+}
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/errors.d.ts
+/** Every library operation that can fail, as named in the failure value. */
+type PoolOperation = 'initialize' | 'add' | 'replace' | 'rotate' | 'disable' | 'enable' | 'remove' | 'reorder' | 'updateSettings' | 'recordIdentity' | 'updateProviderState' | 'refresh' | 'pull' | 'publishRoster';
+/**
+ * How far an operation got before it failed.
+ *
+ * `before-first-write`: nothing was written; both files are as they were.
+ * `after-first-write`: the operation's first file write landed and a later one
+ * did not; what that first write left is on disk and is never rolled back
+ * (add: a state entry no roster row names, which no reader loads; replace:
+ * the new credential stamped ahead of the config, which readers show as a
+ * torn row and the next store write on it completes; rotate: the rotated
+ * credential beside the old per-row entry). `pull`: a quota pull, or the
+ * recording of its result, failed.
+ */
+type PoolFailurePhase = 'before-first-write' | 'after-first-write' | 'pull';
+/**
+ * Why an operation failed. `lock-contention` and `lock-ownership` are the two
+ * lock outcomes (a wait that ran out, and a lease found lost); the rest are
+ * refusals and failures of the operation itself.
+ */
+type PoolFailureKind = 'lock-contention' | 'lock-ownership' | 'pending-migration' | 'load-error' | 'snapshot-contended' | 'publication-sync' | 'publication-incomplete' | 'unknown-row' | 'invalid-row' | 'invalid-input' | 'id-exists' | 'id-removed' | 'type-mismatch' | 'no-credential' | 'row-disabled' | 'row-protected' | 'row-staged' | 'credential-exists' | 'publication-mismatch' | 'duplicate-identity' | 'identity-mismatch' | 'identity-contradicted' | 'endpoint-mismatch' | 'row-key-changed' | 'invalid-order' | 'refresh-stamp-ahead' | 'unbound-credential' | 'attribution' | 'provider' | 'pull' | 'invalid-quota' | 'invalid-provider-state' | 'after-persist-hook' | 'unexpected';
+/**
+ * The single failure value of every store operation. `committed` is present
+ * only when the operation had already written a credential to the state file
+ * before it failed (a partial rotation or refresh): it is the credential now
+ * on disk, so a caller never has to re-read the files to learn it.
+ */
+declare class PoolOperationError extends Error {
+  readonly operation: PoolOperation;
+  readonly rowId: string | undefined;
+  readonly phase: PoolFailurePhase;
+  readonly retryable: boolean;
+  readonly kind: PoolFailureKind;
+  readonly committed: StoredCredential | undefined;
+  constructor(details: {
+    operation: PoolOperation;
+    rowId?: string;
+    phase: PoolFailurePhase;
+    retryable: boolean;
+    kind: PoolFailureKind;
+    committed?: StoredCredential;
+    message?: string;
+    cause?: unknown;
+  });
+}
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/hooks.d.ts
+interface PoolLogger {
+  warn(message: string, data?: unknown): void;
+}
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/fs/refresh-file-lock.d.ts
+interface LockLoss {
+  readonly reason: 'taken-over' | 'expired' | 'unreadable' | 'renewal-failed' | 'marker-lost';
+  readonly expectedOwnerId: string;
+  readonly observedOwnerId?: string;
+  readonly observedExpiresAt?: number;
+}
+interface RefreshFileLock {
+  readonly ownerId: string;
+  assertOwned(): Promise<void>;
+  release(): Promise<void>;
+  /** Resolves once on detected loss; remains pending after an owner's release. */
+  whenLost(): Promise<LockLoss>;
+  hasLost(): boolean;
+}
+declare function acquireRefreshFileLock(options: {
+  name: string;
+  ttlMs: number;
+  /**
+   * File the lock is named after. Required: the lock and the write it guards
+   * must target the same file, and a default resolved in here could only ever
+   * be one host's path.
+   */
+  path: string;
+  now?: () => number;
+  renew?: boolean;
+  renewIntervalMs?: number;
+  /** Notifies a live-owner refusal without awaiting; observer failures are ignored. */
+  onContended?: () => void;
+  /** Synchronous, never awaited; throws and returned promise/thenable rejections are isolated. */
+  onRenewalTimer?: (event: 'scheduled' | 'cancelled') => void;
+  onStep?: (step: 'stale-marker-stat' | 'stale-marker-claimed' | 'stale-lock-observed' | 'stale-lock-confirmed' | 'stale-lock-removed' | 'stale-lock-recreated' | 'eviction-marker-acquired' | 'renewal-owner-confirmed' | 'renewal-marker-unavailable' | 'renewal-write-fenced' | 'renewal-write-ready' | 'relinquish-read' | 'renewal-finished' | 'release-owner-confirmed') => void | Promise<void>;
+}): Promise<RefreshFileLock | null>;
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/refresh-lock.d.ts
+type LockStep = NonNullable<Parameters<typeof acquireRefreshFileLock>[0]['onStep']> extends ((step: infer S) => unknown) ? S : never;
+/** Tuning shared by every lock the store takes; each field is overridable. */
+interface PoolLockOptions {
+  ttlMs: number;
+  timeoutMs: number;
+  retryMs: number;
+  renew: boolean;
+  renewIntervalMs?: number;
+}
+/** A lock: the (name, path) pair naming its file plus optional tuning. */
+interface PoolLockSpec extends Partial<PoolLockOptions> {
+  name: string;
+  path: string;
+}
+type LockEvent = {
+  type: 'acquired' | 'released' | 'contended';
+  name: string;
+  path: string;
+};
+interface LockEnvironment {
+  now: () => number;
+  onLockEvent?: (event: LockEvent) => void;
+  onLockStep?: (lock: {
+    name: string;
+    path: string;
+  }, step: LockStep) => void | Promise<void>;
+}
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/mutate.d.ts
+/** Named points on the write path, for crash and ownership injection. */
+type WriteStep = 'before-config-write' | 'after-config-write' | 'before-state-write' | 'after-state-write';
+/** Awaitable pause points on the pull and refresh paths. */
+type HoldPoint = 'refresh-before-provider' | 'pull-before-request';
+interface StoreContext {
+  provider: string;
+  configPath: string;
+  statePath: string;
+  codec: QuotaCodec;
+  /** The provider-state codec; without one no row shows a provider state. */
+  providerState?: ProviderStateCodec;
+  now: () => number;
+  storeLocks: readonly PoolLockSpec[];
+  lockDefaults: PoolLockOptions;
+  lockEnv: LockEnvironment;
+  logger?: PoolLogger;
+  onStep?: (step: WriteStep, info: {
+    operation: PoolOperation;
+    rowId: string | undefined;
+  }) => void | Promise<void>;
+  hold?: (point: HoldPoint, rowId: string) => void | Promise<void>;
+  /** Ids whose per-row entry a library write dropped in this process. */
+  removedIds: Set<string>;
+  /**
+   * When true, rows whose credential stamp is not bound load `unbound` and
+   * the operations that use a credential refuse them (see
+   * `OpenPoolStoreOptions.requireCredentialStamps`).
+   */
+  requireCredentialStamps?: boolean;
+  requireRemovedFingerprint?: boolean;
+}
+/** What `initializePool` did. */
+type InitializeOutcome = 'initialized' | 'already-ready';
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/runtime.d.ts
+/** Where a pull was fired from; `load` fires at most once per process per row. */
+type PullReason = 'load' | 'add' | 'replace' | 'admission';
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/attribution.d.ts
+/**
+ * What a pull or refresh captured about its row (named by id alongside) when
+ * it was issued. A result applies only while the row with that id still has
+ * this credential epoch and this recorded identity; a replaced credential
+ * bumps the epoch, so work issued for the old one is discarded.
+ *
+ * The epoch names one credential lineage of the row: a credential given by
+ * `add` or `replace`, through every refresh and `rotate` of it, which keep
+ * the epoch. Since 0.8.0 that holds across removal too: a row added under an
+ * id the pool held before starts past every epoch that id held (the store
+ * records them when it drops a row, in the config file, so every process
+ * sees it), so an attribution taken for a removed row is refused once the id
+ * is added again, even with the same identity. Writers older than 0.8.0
+ * start a re-added id at epoch 1 again, and a writer that does not know the
+ * pool can remove and re-add a row without the store seeing it; work
+ * attributed across either may still apply to the new credential.
+ */
+interface Attribution {
+  credentialEpoch: number;
+  identity?: string;
+}
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/rows.d.ts
+type FailureHook = (rowId: string, error: PoolOperationError) => void | Promise<void>;
+interface RowOperationOptions {
+  /** Called once, awaited, on every non-success path, before locks release. */
+  onFailure?: FailureHook;
+  /** The provider-wide lock, when an operation may change identity keying. */
+  providerLock?: PoolLockSpec;
+  /**
+   * Further locks taken after the row lock and the provider-wide lock, in
+   * this order, before the store locks: the same place `refresh` takes its
+   * extra locks, so a caller holding legacy locks around a row write and a
+   * refresh of that row acquire them in one order and cannot deadlock.
+   */
+  extraLocks?: readonly PoolLockSpec[];
+}
+interface RowProjection {
+  id: string;
+  type: 'oauth' | 'api';
+  label?: string;
+  enabled: boolean;
+  disabledReason?: string;
+  identity?: string;
+  credentialEpoch?: number;
+  stamp?: PoolRow['stamp'];
+  staged?: {
+    reservation: string;
+  };
+  torn?: true;
+  invalid?: 'roster' | 'entry';
+}
+interface ProtectView {
+  id: string;
+  row?: RowProjection;
+  rows: RowProjection[];
+  config: Readonly<Record<string, unknown>>;
+}
+type ProtectFn = (view: ProtectView) => string | undefined | Promise<string | undefined>;
+interface AddOptions extends RowOperationOptions {
+  onExisting?: 'rotate' | 'refuse' | 'stage-duplicate';
+  protect?: ProtectFn;
+}
+/** Options of `replace` and `rotate`. Without `attribution` a call behaves as before. */
+interface RowWriteOptions extends RowOperationOptions {
+  /**
+   * The credential epoch and recorded identity the caller read the row at
+   * when it decided on this write; an identity left out means the row had
+   * none. Compared exactly, under the row and store locks, before any write
+   * or replacement hook, including the completion of an interrupted replace.
+   * The call is refused (`attribution`, retryable, nothing written) once the
+   * row holds another epoch or identity, so a write decided on an older
+   * credential never overwrites the one that replaced it. `disable`, `enable`,
+   * `recordQuota` and `updateProviderState` take the same fence.
+   */
+  attribution?: Attribution;
+}
+/**
+ * Options of `disable`, `enable` and `remove`. The provider-wide lock guards
+ * changes to the recorded identity a row lock is named by; none of these
+ * three records an identity, so none takes it. The extra locks are taken
+ * where every other row write takes them, after the row lock and before the
+ * store locks.
+ */
+type RowToggleOptions = Pick<RowOperationOptions, 'onFailure' | 'extraLocks'>;
+/** What a `remove` protect predicate is shown, read under every lock. */
+interface RemoveView {
+  /**
+   * The row as loaded; undefined when the roster no longer holds the id and
+   * only its state-file entry is left (an add or removal interrupted between writes).
+   */
+  row: PoolRow | undefined;
+  /** The config file as read under the store locks. */
+  config: Readonly<Record<string, unknown>>;
+  /** The state file as read under the store locks. */
+  state: Readonly<Record<string, unknown>>;
+}
+interface RemoveOptions extends RowToggleOptions {
+  /** Exact reservation required to remove a row that is still staged. */
+  staged?: {
+    reservation: string;
+  };
+  /**
+   * The credential the removal was decided for (since 0.11.7). Checked under
+   * every lock, before `protect` and before anything is written or repaired:
+   * - a roster row must be bound to its credential stamp, not torn, and hold
+   *   exactly this epoch and recorded identity (absence included);
+   * - an orphan (only a state-file entry left, by a removal or add
+   *   interrupted between its writes) must carry a stamp this store can bind
+   *   to the credential beside it, and that stamp must name exactly this
+   *   epoch and identity.
+   * Epochs only grow per id (a removal records the dropped epoch, and a later
+   * add of the id starts past it), so an orphan an interrupted later add
+   * left under the same id never matches the epoch of the row the caller
+   * meant to remove. A mismatch refuses with kind `attribution`, an orphan
+   * or row with no bindable stamp with kind `unbound-credential`; both leave
+   * the files byte for byte unchanged. Without it, `remove` drops whatever
+   * the id holds, as before.
+   *
+   * The epoch survives a refresh or `rotate`, so it names a credential
+   * lineage, not one token: a caller that must remove only an exact token
+   * still checks the loaded credential in `protect`.
+   */
+  attribution?: Attribution;
+  /**
+   * Awaited under every lock before anything is written; a reason refuses
+   * the removal (kind `row-protected`) with both files unchanged. The store
+   * keeps no record of a plugin's in-flight work, so this is where a plugin
+   * refuses an id it reserves or one its own pending-operation record (kept
+   * in the config or state file) still names: reading that record from the
+   * locked files here cannot race a writer that holds the store locks.
+   */
+  protect?: (id: string, view: RemoveView) => string | undefined | Promise<string | undefined>;
+}
+type RemoveResult = {
+  id: string;
+  /**
+   * `removed`: the roster row was dropped (and its state entry, if any).
+   * `completed`: only a state-file entry was left, by a removal interrupted
+   * between its config and state writes or an add interrupted before its
+   * config write, and it is now dropped.
+   */
+  outcome: 'removed' | 'completed';
+};
+/**
+ * Options of `reorder`. It names no row, so its failure hook is handed only
+ * the failure; it takes no row lock and no provider-wide lock, so the extra
+ * locks are taken first, then the store locks.
+ */
+interface ReorderOptions {
+  /** Called once, awaited, on every non-success path, before the extra locks release. */
+  onFailure?: (error: PoolOperationError) => void | Promise<void>;
+  /** Locks taken, in this order, before the store locks. */
+  extraLocks?: readonly PoolLockSpec[];
+}
+type ReorderResult = {
+  /** The roster order now on disk. */
+  ids: string[];
+  /** `unchanged` when the roster was already in this order; nothing was written. */
+  outcome: 'reordered' | 'unchanged';
+};
+interface AddInput {
+  id: string;
+  credential: PoolCredential;
+  identity?: string;
+  label?: string;
+  disabled?: {
+    reason: string;
+  };
+  stage?: {
+    reservation: string;
+  };
+  /**
+   * Provider state for the credential, written in the same state write as
+   * the credential (needs the store's provider-state codec). On an `add`
+   * that rotates a row already holding this secret it is merged with the
+   * row's value (`ProviderStateCodec.merge`); left out, that row keeps its
+   * value.
+   */
+  providerState?: unknown;
+}
+/** What `replace` and `rotate` take beside the credential. */
+interface CredentialWriteInput {
+  identity?: string;
+  /**
+   * Provider state written in the same state write as the credential. For
+   * `rotate` it is merged with the row's value; left out, the row keeps its
+   * value. For `replace` see `ProviderStateCodec.onReplace`.
+   */
+  providerState?: unknown;
+}
+type AddResult = {
+  /** The row holding the credential; an existing row's id on a re-add. */
+  id: string;
+  outcome: 'added' | 'added-disabled' | 'completed' | 'rotated' | 'exists';
+  credential: StoredCredential;
+  credentialEpoch: number;
+};
+/**
+ * Options of `disable` and `enable`. A call that passes neither
+ * `attribution` nor `providerState` behaves exactly as it did before 0.7.0.
+ */
+interface RowTransitionOptions extends RowToggleOptions {
+  protect?: ProtectFn;
+  /**
+   * The credential epoch and recorded identity the caller's evidence for the
+   * transition was obtained under (as `recordQuota`'s attribution: an
+   * identity left out means the row had none). The call is refused
+   * (`attribution`, retryable, nothing written) once the row holds another
+   * epoch or identity, so a provider's late answer about a replaced
+   * credential never disables, or switches back on, the row now holding its
+   * successor.
+   */
+  attribution?: Attribution;
+  /**
+   * A provider-state change made in the same transaction as the transition,
+   * under the rules of `updateProviderState` (codec validation, the stamp
+   * rebound to the value, `unbound-credential` for a row no stamp of this
+   * store can bind it to); it requires `attribution`. The value and the
+   * enabled flag land together: no reader, and no crash at any write point,
+   * shows one without the other. Returning `DECLINE_TRANSITION` declines the
+   * whole call and writes nothing.
+   */
+  providerState?: RowTransitionMutator;
+}
+interface RowTransitionResult {
+  id: string;
+  /** The provider-state mutator declined: nothing was written. */
+  declined?: true;
+  /**
+   * Set when a provider-state mutator ran and did not decline: what it did
+   * to the value, as `updateProviderState` reports it.
+   */
+  providerStateOutcome?: UpdateProviderStateResult['outcome'];
+  /** The provider state the row now holds, when a mutator ran and left one. */
+  providerState?: unknown;
+}
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/provider-state.d.ts
+/**
+ * Receives a private copy of the row's provider state (undefined when the row
+ * shows none) and the row as loaded under the locks, and returns the next
+ * provider state; returning undefined clears it, so a mutator that means to
+ * keep the value returns it. It runs under the row lock and the store locks,
+ * so it must not call back into the store (`PoolReentryError`).
+ */
+type ProviderStateMutator = (current: unknown | undefined, row: PoolRow) => unknown | Promise<unknown>;
+type UpdateProviderStateResult = {
+  id: string;
+  /** The provider state now on disk; absent when the row has none. */
+  providerState?: unknown;
+  /**
+   * `unchanged`: the mutator returned what the row already shows (or cleared
+   * a row that holds none); nothing was written.
+   */
+  outcome: 'updated' | 'cleared' | 'unchanged';
+};
+/**
+ * Returned by the provider-state mutator of an attributed `disable` or
+ * `enable` to decline the whole transition: nothing is written, neither the
+ * provider state nor the row's enabled flag, and the call resolves with
+ * `declined: true`. A mutator declines when the state it is shown is newer
+ * than what its caller saw, such as an eligibility recorded after the
+ * request whose refusal is being acted on. It is a value of its own because
+ * `undefined` already means "clear the provider state". `Symbol.for` keeps it
+ * equal across two copies of this module loaded in one process.
+ */
+declare const DECLINE_TRANSITION: unique symbol;
+/**
+ * The provider-state mutator of an attributed `disable` or `enable`: as
+ * `ProviderStateMutator`, and it may also return `DECLINE_TRANSITION`.
+ */
+type RowTransitionMutator = (current: unknown | undefined, row: PoolRow) => unknown | typeof DECLINE_TRANSITION | Promise<unknown | typeof DECLINE_TRANSITION>;
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/publication.d.ts
+interface PublishPlan {
+  operationId: string;
+  remove: Array<{
+    id: string;
+    attribution: Attribution;
+    fingerprint?: string;
+  }>;
+  finalize: Array<{
+    id: string;
+    attribution: Attribution;
+    reservation: string;
+    enabled: boolean;
+    disabledReason?: string;
+  }>;
+  order: string[];
+}
+interface PublicationReceipt {
+  operationId: string;
+  planDigest: string;
+  phase: 'committed' | 'cleaned';
+  removed: Array<{
+    id: string;
+    credentialEpoch: number;
+  }>;
+  finalized: Array<{
+    id: string;
+    credentialEpoch: number;
+    reservation: string;
+    enabled: boolean;
+  }>;
+}
+interface PublishOptions {
+  protect?: ProtectFn;
+  extraLocks?: PoolLockSpec[];
+  providerLock?: PoolLockSpec;
+  onFailure?: FailureHook;
+}
+interface PublishResult {
+  outcome: 'published' | 'cleaned' | 'already-cleaned';
+  receipt: PublicationReceipt;
+}
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/pull.d.ts
+/** What a pull is issued with: the credential and its attribution tuple. */
+interface PullRequest {
+  id: string;
+  credential: StoredCredential;
+  credentialEpoch: number;
+  identity?: string;
+  reason: PullReason;
+}
+type PullHook = (request: PullRequest) => Promise<unknown>;
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/refresh.d.ts
+/** What the injected provider refresh function returns. */
+interface ProviderRefreshResult {
+  access: string;
+  refresh: string;
+  expires: number;
+  expiresIn?: number;
+  /** The account's wire identity, when the provider reports one. */
+  identity?: string;
+  /**
+   * Provider state that changes with the new token (needs the store's
+   * provider-state codec). It is merged with the row's value on disk
+   * (`ProviderStateCodec.merge`) and written in the same state write as the
+   * rotated credential, under the same commit fence. Left out, the row keeps
+   * its value.
+   */
+  providerState?: unknown;
+}
+type ProviderRefresh = (credential: OAuthCredential & {
+  lastRefreshedAt?: number;
+}, row: PoolRow) => Promise<ProviderRefreshResult>;
+interface RefreshOptions {
+  /** The one provider-wide lock serialising every provider call. */
+  providerLock?: PoolLockSpec;
+  /** Taken after the provider-wide lock in this order, released in reverse. */
+  extraLocks?: readonly PoolLockSpec[];
+  /**
+   * Awaited once an ordinary rotation is persisted and the store locks released.
+   * Never called for `identity-contradicted`: its credential must not propagate
+   * as the row's recorded account.
+   */
+  onPersisted?: (rowId: string, credential: StoredCredential) => void | Promise<void>;
+  onFailure?: FailureHook;
+  /**
+   * Awaited before any lock is taken, on the locked re-read, and at commit
+   * time under the store locks; a reason refuses the refresh there, leaving
+   * the stored credential untouched and discarding any rotated material.
+   */
+  refuse?: (row: PoolRow) => string | undefined | Promise<string | undefined>;
+}
+type RefreshOutcome = {
+  status: 'rotated';
+  rowId: string;
+  credential: StoredCredential;
+  identity?: string;
+} |
+/**
+ * The provider's successor credential is stored bound to expectedIdentity,
+ * not returnedIdentity. The row stays disabled until the adapter supplies
+ * an identity-validated replacement credential through replace.
+ */
+{
+  status: 'identity-contradicted';
+  rowId: string;
+  expectedIdentity: string;
+  returnedIdentity: string;
+  credential: StoredCredential;
+} | {
+  status: 'refused';
+  rowId: string;
+  reason: string;
+};
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/settings.d.ts
+/** The plugin's settings: every top-level config key except the pool-owned ones. */
+type PoolSettings = Record<string, unknown>;
+type SettingsRead = {
+  status: 'ready';
+  settings: PoolSettings;
+} |
+/**
+ * The config still holds a legacy roster with no pool key. Its settings
+ * read the same way; `updateSettings` refuses until the pool is initialized.
+ */
+{
+  status: 'pending-migration';
+  settings: PoolSettings;
+} | {
+  status: 'error';
+  file: 'config' | 'state';
+  reason: string;
+};
+/**
+ * Receives a private copy of the current settings and either edits it in
+ * place (returning nothing) or returns the complete next settings object.
+ * It runs under the store locks, so it must not call back into the store:
+ * a store operation called from inside it is refused (`PoolReentryError`).
+ */
+type SettingsMutator = (settings: PoolSettings) => PoolSettings | undefined | Promise<PoolSettings | undefined>;
+/**
+ * Options of `updateSettings`. It names no row, so its failure hook is
+ * handed only the failure; like `reorder` it takes the extra locks, then the
+ * store locks, and no row or provider-wide lock.
+ */
+interface UpdateSettingsOptions {
+  /** Called once, awaited, on every non-success path, before the extra locks release. */
+  onFailure?: (error: PoolOperationError) => void | Promise<void>;
+  /** Locks taken, in this order, before the store locks. */
+  extraLocks?: readonly PoolLockSpec[];
+}
+type UpdateSettingsResult = {
+  /** The settings now on disk. */
+  settings: PoolSettings;
+  /** `unchanged` when the mutator left the settings as they were; nothing was written. */
+  outcome: 'updated' | 'unchanged';
+};
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/pool.d.ts
+interface OpenPoolStoreOptions {
+  /** The provider every row of this pool belongs to; keys the provider-wide lock. */
+  provider: string;
+  configPath: string;
+  statePath: string;
+  quota: QuotaCodec;
+  /**
+   * The codec of the provider state kept beside each row's credential (see
+   * `ProviderStateCodec`). Without it no row shows a provider state, and
+   * every write that would set one refuses (`invalid-input`); writes that
+   * leave it alone keep the value on disk as it is, and `replace` clears it.
+   */
+  providerState?: ProviderStateCodec;
+  /**
+   * Refuse every credential this store did not stamp (default false, which
+   * loads unstamped and mis-stamped credentials as older writers left them).
+   * When true, a row whose `stamp` is not `bound` loads `unbound` and is no
+   * candidate, and every operation that would use or keep its credential or
+   * what was observed about it (`refresh`, quota pulls, `recordQuota`,
+   * `recordIdentity`, `rotate`, and an `add` of the same secret or onto the
+   * same credential-less row) refuses with `unbound-credential` before any
+   * provider call or write, checked again under the locks and at commit.
+   * Nothing makes such a row bound except `replace`, which starts a new
+   * credential epoch and drops what was observed about the old one.
+   * An interrupted add's state-only orphan is recovered only when its stamp
+   * binds the stored and incoming material, including a supplied identity and
+   * an API key's endpoint/header. Otherwise add refuses `unbound-credential`
+   * without writing; `remove(id)` explicitly discards the orphan.
+   */
+  requireCredentialStamps?: boolean;
+  /** Require an exact secret fingerprint for every roster-publication removal. */
+  requireRemovedFingerprint?: boolean;
+  /** Injected clock for leases, refresh stamps and `addedAt`. */
+  now?: () => number;
+  /**
+   * Ordered store-lock list held across every read-modify-write. Defaults to
+   * the older writers' `save` lock at the config path, then at the state path.
+   */
+  storeLocks?: readonly PoolLockSpec[];
+  /** Defaults for every lock the store takes (see `POOL_LOCK_DEFAULTS`). */
+  lockOptions?: Partial<PoolLockOptions>;
+  /** Overrides for the row locks only. */
+  rowLockOptions?: Partial<PoolLockOptions>;
+  /** The provider-wide lock; defaults to `provider-<provider>` beside the state file. */
+  providerLock?: PoolLockSpec;
+  /** Quota pull hook, fired without being awaited. */
+  pull?: PullHook;
+  /** Receives every pull failure, since no caller awaits a pull. */
+  onPullFailure?: (rowId: string, error: PoolOperationError) => void | Promise<void>;
+  logger?: PoolLogger;
+  /** Named write steps, awaited; a test seam for crash and ownership rows. */
+  onStep?: StoreContext['onStep'];
+  /** Awaitable hold points on the refresh and pull paths; a test seam. */
+  hold?: (point: HoldPoint, rowId: string) => void | Promise<void>;
+  onLockEvent?: LockEnvironment['onLockEvent'];
+  onLockStep?: LockEnvironment['onLockStep'];
+}
+type PoolLoad = {
+  status: 'ready';
+  schemaVersion: number;
+  rows: PoolRow[];
+} | {
+  status: 'pending-migration';
+  roster: unknown[];
+} | {
+  status: 'error';
+  file: 'config' | 'state';
+  reason: string;
+  kind?: 'snapshot-contended';
+  retryable?: true;
+};
+interface PoolStore {
+  /** Reads the pool and fires first-reading pulls; never writes a file itself. */
+  load(): Promise<PoolLoad>;
+  /** Reads the pool without firing anything. */
+  read(): Promise<PoolLoad>;
+  /**
+   * Turns a pending-migration config into an empty pool (the pool key with no
+   * row entries) in one locked config write, dropping the named top-level
+   * keys and keeping the rest. The start of a plugin's migration; a ready
+   * pool is left alone. Failures carry operation `initialize`.
+   */
+  initialize(input?: {
+    dropKeys?: readonly string[];
+  }): Promise<{
+    status: InitializeOutcome;
+  }>;
+  /**
+   * Adds a row, or completes or rotates the row already holding the id or
+   * the secret. A new row starts at credential epoch 1; since 0.8.0 one
+   * whose id the pool held before starts one past the highest epoch that id
+   * held (see `Attribution`), and an id that held `Number.MAX_SAFE_INTEGER`
+   * refuses (`id-removed`) before writing.
+   */
+  add(input: AddInput, options?: AddOptions): Promise<AddResult>;
+  publishRoster(plan: PublishPlan, options?: PublishOptions): Promise<PublishResult>;
+  publication(operationId: string): Promise<PublicationReceipt | undefined>;
+  /**
+   * Gives a row a new credential and a new credential epoch. Since 0.6.0 the
+   * row's provider state is whatever `ProviderStateCodec.onReplace` returns;
+   * without that hook it is `input.providerState`, else cleared.
+   * Optional `attribution` fences the write on the prior credential under the
+   * locks, before any write or replacement hook; see `RowWriteOptions`.
+   */
+  replace(id: string, credential: PoolCredential, input?: CredentialWriteInput, options?: RowWriteOptions): Promise<{
+    id: string;
+    credential: StoredCredential;
+    credentialEpoch: number;
+  }>;
+  /**
+   * Refreshes the secret a row holds without changing its account or
+   * endpoint. Since 0.4.1 an API key may leave out `baseURL` and `authHeader`
+   * to keep the row's, and one that gives another is refused
+   * (`endpoint-mismatch`) before writing: that is a `replace`.
+   * Takes the same optional attribution fence as `replace` (`RowWriteOptions`).
+   */
+  rotate(id: string, credential: RotateCredential, input?: CredentialWriteInput, options?: RowWriteOptions): Promise<{
+    id: string;
+    credential: StoredCredential;
+  }>;
+  /**
+   * Changes a row's provider state without touching its credential (since
+   * 0.6.0), under the row lock, `extraLocks` and the store locks. Refuses
+   * (`attribution`) once the row has moved off the credential epoch or
+   * identity in `fence`, and (`unknown-row`) once it is removed.
+   */
+  updateProviderState(id: string, fence: Attribution, mutator: ProviderStateMutator, options?: RowToggleOptions): Promise<UpdateProviderStateResult>;
+  /**
+   * Sets `enabled: false` and the entry's `disabledReason`. Takes the row
+   * lock, then `extraLocks`, then the store locks (the row lock and
+   * `extraLocks` since 0.2.3). Since 0.7.0 it may be fenced on the
+   * credential the caller's evidence is about (`attribution`) and carry a
+   * provider-state change that lands with it (`providerState`); see
+   * `RowTransitionOptions`.
+   */
+  disable(id: string, reason: string, options?: RowTransitionOptions): Promise<RowTransitionResult>;
+  /**
+   * Clears `enabled: false` and `disabledReason` (since 0.2.3); refuses with
+   * `duplicate-identity` when another enabled OAuth row holds the row's
+   * identity. Locks as `disable`, and takes the same options since 0.7.0.
+   */
+  enable(id: string, options?: RowTransitionOptions): Promise<RowTransitionResult>;
+  /**
+   * Deletes the roster row, its per-row entry and its state-file credential
+   * (since 0.2.3). Locks as `disable`; `protect` can refuse the id.
+   */
+  remove(id: string, options?: RemoveOptions): Promise<RemoveResult>;
+  /**
+   * Sets the roster order (since 0.2.4) in one config write. `ids` must name
+   * every roster id exactly once; anything else refuses with `invalid-order`
+   * and writes nothing. Takes `extraLocks`, then the store locks; no row or
+   * provider-wide lock. Roster rows and their entries are left unchanged.
+   */
+  reorder(ids: readonly string[], options?: ReorderOptions): Promise<ReorderResult>;
+  /**
+   * The plugin's settings (since 0.2.6): every top-level key of the config
+   * file except the pool-owned ones (`POOL_OWNED_KEYS`). Never writes.
+   */
+  readSettings(): Promise<SettingsRead>;
+  /**
+   * One locked write of the plugin's settings (since 0.2.6) beside the pool,
+   * in the config file. Refuses a result that sets a pool-owned key
+   * (`invalid-input`). Takes `extraLocks`, then the store locks.
+   */
+  updateSettings(mutator: SettingsMutator, options?: UpdateSettingsOptions): Promise<UpdateSettingsResult>;
+  /**
+   * Records the identity a lookup found for the row's credential. Since
+   * 0.3.1 it takes the credential epoch the lookup was issued for, and
+   * refuses a lookup that completes after the row was replaced
+   * (`attribution`) or a row recorded for another account
+   * (`identity-mismatch`).
+   */
+  recordIdentity(id: string, identity: string, attribution: Pick<Attribution, 'credentialEpoch'>, options?: RowOperationOptions): Promise<{
+    id: string;
+    disabled: string[];
+  }>;
+  refresh(id: string, provider: ProviderRefresh, options?: RefreshOptions): Promise<RefreshOutcome>;
+  recordQuota(id: string, attribution: Attribution, observation: unknown): Promise<void>;
+  /** Fires a pull for a row admission refused for want of a reading. */
+  requestReading(id: string): void;
+  /** Resolves once every pull fired so far has settled. */
+  pullsSettled(): Promise<void>;
+}
+//#endregion
+//#region ../core/dist/paths.d.ts
+/**
+ * The config file and the runtime-state file a store operation reads and writes.
+ *
+ * Both are required. A store function never derives one from the other, because
+ * a host may point its state file somewhere the derivation would not reach and
+ * a silently derived path would lock one file while writing another.
+ */
+interface AccountPaths {
+  configPath: string;
+  statePath: string;
+}
+//#endregion
+//#region ../core/dist/oauth.d.ts
+interface IdTokenClaims {
+  chatgpt_account_id?: string;
+  email?: string;
+  organizations?: Array<{
+    id: string;
+  }>;
+  'https://api.openai.com/auth'?: {
+    chatgpt_account_id?: string;
+  };
+}
+declare function parseJwtClaims(token: string): IdTokenClaims | undefined;
+declare function extractAccountIdFromClaims(claims: IdTokenClaims): string | undefined;
+interface TokenResponse {
+  id_token: string;
+  access_token: string;
+  refresh_token: string;
+  expires_in?: number;
+}
+/**
+ * Minimal shape of a fallback OAuth account for ingestion. Matches the
+ * fields used by upsertAccount and beginAccountLogin, compatible with
+ * the full OAuthAccount type in accounts.ts.
+ */
+interface IngestAccount {
+  id: string;
+  label?: string;
+  type: 'oauth';
+  access?: string;
+  refresh: string;
+  expires?: number;
+  enabled: boolean;
+  addedAt: number;
+  lastUsed: number;
+  /**
+   * When the token was obtained. Stamped at login so a freshly added account
+   * carries a refresh marker — without it, the runtime-state merge cannot tell a
+   * rotated token from a stale one (both default to 0) and a concurrent stale
+   * save could roll the token back.
+   */
+  lastRefreshedAt?: number;
+  /** Stable ChatGPT account identifier from the OAuth token claims. */
+  accountId?: string;
+}
+interface BeginAccountLoginOptions {
+  label?: string;
+  headless?: boolean;
+  signal?: AbortSignal;
+  /** Host package version, sent as the version half of the `User-Agent`. */
+  version: string;
+}
+interface BeginAccountLoginResult {
+  url: string;
+  instructions: string;
+  /** Resolves after the user completes the OAuth flow with a ready-to-ingest account. */
+  completion: Promise<IngestAccount>;
+}
+/**
+ * Split-return OAuth flow entry point.
+ *
+ * Browser flow (default):
+ *   1. Start OAuth server, generate PKCE, build authorize URL
+ *   2. Return { url, instructions, completion } — url is ready immediately
+ *   3. completion resolves after browser callback + token exchange
+ *
+ * Headless flow:
+ *   1. Begin device auth
+ *   2. Return { url, instructions, completion }
+ *   3. completion polls device endpoint + exchanges for tokens
+ *
+ * The split return allows the TUI command to show the URL before the
+ * (potentially 30-60s) wait, avoiding a deadlock.
+ */
+declare function beginAccountLogin(opts: BeginAccountLoginOptions): Promise<BeginAccountLoginResult>;
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+subc-client@0.16.1/node_modules/@cortexkit/subc-client/dist/connection-file.d.ts
+interface Endpoint {
+  host: string;
+  port: number;
+}
+interface ConnectionInfo {
+  schema: number;
+  endpoints: Endpoint[];
+  /** Transport key bytes. Serialized on disk as a JSON array of numbers. */
+  key: Uint8Array;
+  /** 16-byte daemon identity. Serialized on disk as a JSON array of numbers. */
+  daemonId: Uint8Array;
+  pid: number;
+  daemonVer: string;
+}
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+subc-client@0.16.1/node_modules/@cortexkit/subc-client/dist/envelope.d.ts
+/** Scheduling priority carried in flags bits 1-2. */
+declare enum Priority {
+  Passive = 0,
+  Interactive = 1,
+  Background = 2
+}
+/** Admission behavior carried in flags bits 4-5. */
+declare enum AdmissionClass {
+  Normal = 0,
+  Expedite = 1,
+  Sheddable = 2
+}
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+subc-client@0.16.1/node_modules/@cortexkit/subc-client/dist/route-handle.d.ts
+interface ReverseRequestContext {
+  readonly corr: bigint;
+  readonly method: string;
+}
+type ReverseRequestHandler = (body: Uint8Array, ctx: ReverseRequestContext) => Promise<Uint8Array> | Uint8Array;
+/**
+ * Mutable handler registry prepared before route.open. The client derives
+ * consumer_capabilities from its method families and seals that set when the
+ * route opens; handlers for declared families may still be replaced afterward.
+ */
+declare class ReverseRequestRegistry {
+  private readonly handlers;
+  private declaredFamilies;
+  onRequest(methodFamily: string, handler: ReverseRequestHandler): void;
+  /** @internal */
+  capabilities(): string[];
+  /** @internal */
+  handler(methodFamily: string): ReverseRequestHandler | undefined;
+  /** @internal */
+  seal(): void;
+}
+/**
+ * Immutable identity for one route binding on one live socket. Only channel and
+ * epoch cross the wire; the connection token remains private to this SDK.
+ */
+declare class RouteHandle {
+  readonly channel: number;
+  readonly epoch: number;
+  private constructor();
+  /** Replace the handler for a capability declared when this route opened. */
+  onRequest(methodFamily: string, handler: ReverseRequestHandler): void;
+  private static create;
+}
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+subc-client@0.16.1/node_modules/@cortexkit/subc-client/dist/client.d.ts
+interface BindIdentity {
+  project_root: string;
+  harness: string;
+  session: string;
+}
+type RouteTarget = {
+  kind: "tool_provider";
+  module_id: string;
+} | {
+  kind: "management_surface";
+  module_id: string;
+} | {
+  kind: "internal_service";
+  module_id: string;
+  service_id: string;
+};
+type ManagedRouteKind = "management_surface" | "tool_provider";
+interface ConsumerIdentity {
+  module_id: string;
+  launch_nonce: string;
+}
+interface RouteOpenOptions {
+  /** Optional override for the consumer identity; by default the SUBC_MODULE_ID and SUBC_LAUNCH_NONCE environment variables are used when both are non-empty. Set null to send route.open without consumer_identity. */
+  consumerIdentity?: ConsumerIdentity | null;
+  /**
+   * Handlers prepared before route.open. The client derives consumer_capabilities
+   * from this registry; callers cannot declare a capability without a handler.
+   */
+  reverseRequests?: ReverseRequestRegistry;
+}
+interface CatalogCapabilityRequirement {
+  capability: string;
+  need: "required" | "optional";
+}
+interface CatalogCapabilities {
+  provides: string[];
+  requires: CatalogCapabilityRequirement[];
+  must_never_reach: string[];
+}
+/** A self-signal's anchor relative to the external surface it shapes. */
+type CatalogSignalAnchor = "fixed_interval" | {
+  event: {
+    event: string;
+  };
+};
+/** The source of a self-signal's effective cadence. */
+type CatalogSignalCadence = {
+  literal: {
+    interval_ms: number;
+  };
+} | {
+  derived: {
+    source: string;
+  };
+};
+/** A self-signal declaration mirrored from a registered module manifest. */
+interface CatalogSelfSignalDeclaration {
+  name: string;
+  /** Open string for forward-compatible self-signal kinds. */
+  kind: string;
+  effect: "observe" | "mutate";
+  anchored_to: CatalogSignalAnchor;
+  cadence?: CatalogSignalCadence | null;
+  domain?: string | null;
+  note?: string | null;
+}
+interface CatalogEntry {
+  module_id: string;
+  roles: unknown[];
+  control_ops: string[];
+  /** Static capability claims mirrored from the registered module manifest. */
+  capabilities?: CatalogCapabilities | null;
+  /** Self-signal declarations mirrored verbatim from the registered manifest. */
+  self_signals?: CatalogSelfSignalDeclaration[] | null;
+}
+interface RequestOptions {
+  priority?: Priority;
+  admissionClass?: AdmissionClass;
+  timeoutMs?: number;
+  /**
+   * Set when the request body is opaque bytes rather than JSON. This flag is the
+   * receiver's only signal about the body representation; reply decoding follows
+   * the response frame's flag instead of this request option.
+   */
+  binary?: boolean;
+  /** Called for each interim PUSH / StreamData frame before the terminal reply. */
+  onProgress?: (body: Uint8Array) => void;
+  /**
+   * Abort the request: when this fires while the request is still in flight, the
+   * client emits a CANCEL frame carrying that request's own corr.
+   *
+   * The signal exists instead of exposing corr because corr lifetime is already
+   * tracked here to settle replies; handing it out would make every caller keep a
+   * second map that can disagree with this one, and would let a caller cancel a
+   * corr it does not own.
+   *
+   * Cancellation is best-effort by the wire's construction: the daemon forwards
+   * the frame on a live route and silently drops it on a departed one, and no
+   * acknowledgement exists at any layer. Only the module's own reply proves what
+   * happened, so the promise is NOT rejected here -- it settles however the module
+   * answers, which may be a normal completion that beat the cancel.
+   */
+  signal?: AbortSignal;
+}
+interface ManagedCallOptions extends RequestOptions {
+  /** Overrides the per-client identity used for route.open before this call. */
+  identity?: BindIdentity;
+  /** Defaults to management_surface, matching the store/host management APIs. */
+  targetKind?: ManagedRouteKind;
+  /** Optional override for the consumer identity; by default the SUBC_MODULE_ID and SUBC_LAUNCH_NONCE environment variables are used when both are non-empty. Set null to send route.open without consumer_identity. */
+  consumerIdentity?: ConsumerIdentity | null;
+  /** Reverse-request handlers used by the managed route and all of its reconnect reopens. */
+  reverseRequests?: ReverseRequestRegistry;
+}
+interface SubscribeOptions {
+  priority?: Priority;
+  admissionClass?: AdmissionClass;
+}
+type RoutePollKind = "status" | "liveness";
+interface RoutePollResult {
+  route_channel: number;
+  route_epoch: number;
+  status: string | null;
+  live: boolean | null;
+}
+interface CloseRouteOptions {
+  /**
+   * Await in-flight UNARY requests on the route to settle before tearing it down.
+   * Subscriptions are always aborted (a held-open stream cannot be drained).
+   * Defaults to false: close immediately, aborting everything in flight.
+   */
+  drain?: boolean;
+}
+interface ManagedCloseRouteOptions extends CloseRouteOptions {
+  /** Consumer identity used by the cached managed route. */
+  consumerIdentity?: ConsumerIdentity | null;
+  /** The registry whose derived capability set identifies the cached route. */
+  reverseRequests?: ReverseRequestRegistry;
+}
+/**
+ * Capped exponential reconnect backoff. maxAttempts includes the first immediate
+ * reconnect attempt; sleeps happen only between failed transient attempts.
+ */
+interface ReconnectBackoff {
+  /** First retry delay. */
+  baseMs: number;
+  /** Delay ceiling (doubling is capped here). */
+  capMs: number;
+  /** Max attempts (including the first) before giving up. */
+  maxAttempts: number;
+}
+/**
+ * A live subscription to a provider's event stream, riding a single held-open
+ * request. `onEvent` fires for each StreamData frame; `closed` resolves when the
+ * provider ends the stream (StreamEnd) or the consumer unsubscribes, and rejects on
+ * an Error terminal or a route GOODBYE. `unsubscribe` cancels the held-open request
+ * so the provider unwinds.
+ */
+interface Subscription {
+  /** Cancel the subscription: sends Cancel on the held-open request; idempotent. */
+  unsubscribe(): void;
+  /** Resolves on StreamEnd or local unsubscribe; rejects on an Error terminal or route close. */
+  readonly closed: Promise<void>;
+}
+interface ConnectOptions {
+  connectionFile: string;
+  handshakeTimeoutMs?: number;
+  /** Default route identity used by managed call(); can be overridden per call. */
+  identity?: BindIdentity;
+  /** Default route target kind used by managed call(); defaults to management_surface. */
+  targetKind?: ManagedRouteKind;
+  /** Backoff for managed reconnect after a connection drop. */
+  reconnectBackoff?: ReconnectBackoff;
+  /** Injectable sleep for timer-free reconnect tests. */
+  sleep?: (ms: number) => Promise<void>;
+  /**
+   * How long managed calls keep retrying route.open in-place on retryable
+   * refusals (module_reloading, module_warming, target_unavailable, …) before
+   * settling not_sent. This deadline is the ONLY binder on those retries —
+   * module reloads legitimately take tens of seconds (the daemon's drain alone
+   * defaults to 30s), so the default matches the daemon's drain ceiling.
+   */
+  routeOpenRetryDeadlineMs?: number;
+  /**
+   * Window the post-deadline liveness probe waits for ANY inbound frame after
+   * sending its channel-0 Ping before convicting the socket as half-open.
+   * Genuine event-loop starvation self-protects at any setting: a loop starved
+   * enough to delay the probe's check also delays the read loop, and when it
+   * wakes the buffered Pong dispatches first. Exposed for deterministic tests.
+   */
+  livenessProbeWindowMs?: number;
+  /**
+   * Hard cap on the timeout-arbitration grace window (see
+   * TIMEOUT_ARBITRATION_GRACE_MS). A reply whose bytes are actively arriving when
+   * the request deadline fires is given up to this long to finish dispatching
+   * before the call settles as a timeout. Bounded and never a deadline extension;
+   * exposed mainly so tests can prove the arbitration deterministically.
+   */
+  timeoutArbitrationGraceMs?: number;
+  /**
+   * Observer for daemon-originated channel-0 control pushes (`route.closing`,
+   * `route.closed`, and any op added later). Purely advisory: the daemon's
+   * load-bearing route-death signal remains the GOODBYE frame, and nothing in
+   * the client's own route lifecycle consumes these. The contract is the wire
+   * contract verbatim -- unrecognized ops still arrive here (callers ignore
+   * what they don't know, per the MUST-ignore clause), a push that fails to
+   * parse as JSON is dropped without surfacing, and an observer throw is
+   * swallowed like every other caller callback so it cannot fail the read loop
+   * or unrelated requests.
+   */
+  onControlPush?: (push: ControlPush) => void;
+}
+/** A parsed daemon-originated channel-0 control push. */
+interface ControlPush {
+  /** The push discriminator, e.g. "route.closing" | "route.closed". */
+  op: string;
+  /** The full parsed body, `op` included, for op-specific fields. */
+  body: Record<string, unknown>;
+}
+declare class SubcClient {
+  private sock;
+  private currentConn;
+  private readonly opts;
+  private nextCorr;
+  private readonly pending;
+  private readonly lateResponses;
+  private readonly routes;
+  private readonly liveRoutes;
+  private connectionToken;
+  private ingressEpochDropCount;
+  private closedErr;
+  private closeStarted;
+  private reconnecting;
+  private generation;
+  private readerActive;
+  private constructor();
+  get conn(): ConnectionInfo;
+  /** Read the connection file, connect, authenticate, and start the read loop. */
+  static connect(opts: ConnectOptions): Promise<SubcClient>;
+  /** List modules subc knows about (channel-0 catalog.list). */
+  catalogList(moduleId?: string): Promise<CatalogEntry[]>;
+  /**
+   * Resolve the sole catalog claimant for a capability.
+   *
+   * This expresses singular intent even when the fleet permits plural claims;
+   * ambiguity is returned instead of selecting an arbitrary module.
+   */
+  resolveProvider(capability: string): Promise<string>;
+  /** Resolve every catalog claimant in deterministic module-id order. */
+  resolveProviders(capability: string): Promise<string[]>;
+  /** Open a route and return its connection-bound immutable handle. */
+  routeOpen(target: RouteTarget, identity: BindIdentity, opts?: RouteOpenOptions): Promise<RouteHandle>;
+  /** Send a data-plane request on exactly the supplied route generation. */
+  request(handle: RouteHandle, body: unknown, opts?: RequestOptions): Promise<unknown>;
+  /**
+   * Managed route + request convenience. Opens and caches a route for the module,
+   * reconnecting and re-opening cached routes after connection drops.
+   */
+  call<Response = unknown>(moduleId: string, method: string, params?: unknown, opts?: ManagedCallOptions): Promise<Response>;
+  /**
+   * Managed route + raw opaque-body request convenience. Unlike call(), this
+   * sends bytes without a JSON method envelope because the BINARY flag is the
+   * receiver's only signal that the body is not JSON. A BINARY reply resolves
+   * to Uint8Array; a non-binary reply is decoded as JSON.
+   */
+  callBinary(moduleId: string, body: Uint8Array, opts?: ManagedCallOptions): Promise<Uint8Array | unknown>;
+  private managedCall;
+  /** Open a held request on exactly one route generation. */
+  subscribe(handle: RouteHandle, body: unknown, onEvent: (event: Uint8Array) => void, opts?: SubscribeOptions): Subscription;
+  /**
+   * Emit CANCEL for one in-flight request when its caller's signal fires.
+   *
+   * Emits only while the request is unsettled by this client's own book, which is
+   * a fact it owns and can check without racing. It deliberately does NOT check
+   * whether the route still exists: that would be a guess, and a wrong guess turns
+   * a frame the daemon would harmlessly drop into a frame never sent -- removing
+   * the caller's only chance at the cost of saving nothing.
+   */
+  private attachCancelSignal;
+  /** Send a pure-header cancellation for an in-flight request. */
+  cancel(handle: RouteHandle, corr: bigint, priority?: Priority): void;
+  /** Poll status or liveness for exactly the supplied route generation. */
+  routePoll(handle: RouteHandle, kind: RoutePollKind): Promise<RoutePollResult>;
+  /** Tear down exactly the supplied route generation. */
+  closeRoute(handle: RouteHandle, opts?: CloseRouteOptions): Promise<void>;
+  /** Close a cached managed route by its route-open identity tuple. */
+  closeManagedRoute(target: Extract<RouteTarget, {
+    kind: ManagedRouteKind;
+  }>, identity: BindIdentity, opts?: ManagedCloseRouteOptions): Promise<void>;
+  /** Alias retained for callers that name the operation by protocol channel; it still requires a full handle. */
+  closeRouteChannel(handle: RouteHandle, opts?: CloseRouteOptions): Promise<void>;
+  close(): void;
+  private drainUnaryOnHandle;
+  private sendRouteGoodbye;
+  private static openConnection;
+  private controlRpc;
+  private send;
+  /**
+   * A request-deadline timer has fired. Before settling as a timeout, arbitrate
+   * the timer-vs-poll race: a reply may already be in the socket buffer, unread
+   * only because the loop was starved. Yield one check phase (setImmediate) so a
+   * fully-buffered reply dispatches and wins via settle()'s identity guard; then,
+   * only while the reader is actively draining THIS socket (a frame mid-arrival),
+   * grant a single hard-capped grace before finally settling. Absent replies
+   * still settle right after the check phase. The settle carries the deadline
+   * marker so the managed classifier reports deadline-not-drop.
+   */
+  private arbitrateTimeout;
+  private managedRequest;
+  private sendManaged;
+  private cachedRouteHandle;
+  private openCachedRoute;
+  private lastInboundAtMs;
+  private livenessProbe;
+  /**
+   * Discriminate event-loop starvation from a half-open socket after a
+   * deadline-no-drop settle. The arbitration deliberately keeps the socket on
+   * that verdict (a late-read reply under load must not cost a healthy
+   * connection), but a half-open socket — peer vanished with no FIN/RST, as
+   * after host sleep/wake — yields the SAME verdict forever, so the keep
+   * becomes a permanent pin to a dead transport. The discriminator is
+   * socket-level liveness evidence: send a channel-0 Ping (the daemon always
+   * answers — subc-core control.rs) and require ANY inbound frame within the
+   * window; the Pong suffices, and a busy socket's other traffic proves the
+   * link just as well. Silence convicts: the socket is failed with a named
+   * cause and closed, so the ordinary drop path (pending rejection now,
+   * reconnect on the next call) takes over.
+   *
+   * Starvation cannot be falsely convicted by a short window: a loop starved
+   * enough to delay the read loop delays this probe's own timer identically,
+   * and when both wake the buffered Pong dispatches before the check runs.
+   *
+   * A PENDING CHANNEL-0 REQUEST SUSPENDS THE PROBE (both at launch and at the
+   * conviction check). The daemon's connection loop handles frames one at a
+   * time, and some channel-0 ops legally park it for seconds — route.open
+   * awaits the module's bind ack inline for up to route_bind_relay_timeout
+   * (~12s in production) — during which OUR Ping sits unread in the daemon's
+   * socket buffer. On an otherwise-quiet connection that silence is fully
+   * explained by our own in-flight control op, and convicting on it would
+   * tear down a healthy connection mid-bind (BROCA's Athena panel flagged
+   * this exact premise; the FIFO fact is verified in subc-core server.rs
+   * connection_loop + control.rs handle_route_open). The client always knows
+   * its own channel-0 pendings, so the gate is local and exact: no probe
+   * while one is in flight, no conviction if one appeared during the window.
+   *
+   * Scope: hooked from the managed-call path only. Control-plane requests
+   * (route.open, catalog.list) are short-lived and their failures already
+   * escalate through reconnect classification; the managed path is where a
+   * plugin lives for hours and where the pin was observed in production.
+   */
+  /** Any in-flight channel-0 request (pendings keyed without a route handle). */
+  private hasControlPending;
+  private probeLivenessAfterDeadline;
+  private ensureConnectedForManaged;
+  private scheduleReconnectAfterDrop;
+  private reconnectAfterDrop;
+  private reconnectWithRetry;
+  private replaceConnection;
+  private reopenCachedRoutes;
+  private timeoutMessage;
+  private routeClosedDuringOpen;
+  private readLoop;
+  private dispatch;
+  /**
+   * Settle a pending exactly once. The object-identity guard (the map still
+   * holds THIS pending under `key`) is the single-winner primitive: whichever of
+   * dispatch, a timeout, fail(), failChannel(), a GOODBYE, or a deferred timeout
+   * arbitration reaches it first wins, and every later caller no-ops. This is what
+   * makes the deferred-timeout arbitration safe — it cannot double-settle, reject
+   * an already-resolved promise, or delete a pending re-created for a later corr.
+   * Returns true when this call was the settler.
+   */
+  private settle;
+  private rejectPending;
+  private dispatchReverseRequest;
+  private sendReverseError;
+  private sendReverseReply;
+  private errorFromFrame;
+  private evictRouteHandle;
+  private failHandle;
+  private fail;
+  private notSentCallError;
+  private outcomeUnknownCallError;
+  private terminalCallError;
+  private notSentRecoveryError;
+  /** Number of nonzero-channel ingress frames dropped by endpoint epoch validation. */
+  get droppedIngressFrames(): number;
+  private installRoute;
+  private isLiveHandle;
+  private assertLiveConnection;
+  private assertLiveHandle;
+  private allocateCorr;
+  private closeConnectionAfterCleanupFailure;
+  private encode;
+  /** Decode a terminal response according to the representation on the wire. */
+  private decodeReply;
+  private parseJson;
+}
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+claustrum-client@0.6.2/node_modules/@cortexkit/claustrum-client/dist/wire.d.ts
+type ClaustrumConnector = (options: {
+  connectionFile: string;
+  handshakeTimeoutMs?: number;
+}) => Promise<SubcClient>;
+type ClaustrumClientOptions = {
+  connectionFile?: string;
+  handshakeTimeoutMs?: number;
+  projectRoot?: string;
+  storagePath?: string;
+  identity?: BindIdentity;
+  connector?: ClaustrumConnector;
+  logger?: (errorClass: string) => void;
+};
+/**
+ * Credential material plus optional non-secret identity metadata. Missing wire fields remain
+ * `undefined`; a present non-string identity value rejects the response as invalid.
+ *
+ * An absent identity field means the vault had nothing to assert — NOT that identity failed.
+ * Consumers must not collapse absence into mismatch: assert on presence, refuse on a present
+ * difference, and serve (log, if it matters) when the field is missing. Absence proves neither
+ * the right identity nor the wrong one, so treating it as a failure converts a vault that could
+ * not answer into a consumer that cannot serve. The vault records no per-read success (at most
+ * the first scoped read per principal), and nothing at all when a consumer declines to serve, so
+ * an outage caused that way is visible only to the consumer that caused it.
+ */
+type ServedCredential = {
+  material: string;
+  recordVersion: number;
+  expiresAtMs: number | null;
+  /**
+   * Operator-chosen record label for verifying a caller-held binding. It is not a routing key:
+   * account-scoped routing joins `accountId` with `recordVersion`.
+   */
+  credentialId?: string;
+  /** Non-secret Code Assist project identity, present only for antigravity credentials. */
+  projectId?: string;
+  /**
+   * Provider account identity the served token executes under. Account-scoped routing joins this
+   * value with `recordVersion`; it is neither the operator's credential label nor the bearer handle.
+   *
+   * BEST-EFFORT, NEVER GUARANTEED, including for JWT providers. The vault parses the claim live
+   * from the served access token and falls back to stored login-time identity; both legs can be
+   * empty, and the serve path yields nothing rather than fabricating an id. It is absent when the
+   * provider has no known claim, the token does not carry one, or no identity was captured at
+   * login. Do not gate serving on its presence.
+   */
+  accountId?: string;
+  /** Non-secret account display metadata captured at login. */
+  email?: string;
+  /** Non-secret organization or workspace display metadata captured at login. */
+  orgName?: string;
+};
+/**
+ * Non-secret health for one handle, read without minting anything.
+ *
+ * An unresolved handle (unknown or revoked) is an ordinary answer, not an error: it decodes
+ * as `ready: false, lastErrorCode: 'not_found'` with `credentialId`, `recordVersion` and
+ * `stalePending` all absent. The vault omits them on purpose so a probe learns nothing about
+ * what exists and no placeholder value is asserted about a record it never saw.
+ */
+type CredentialStatus = {
+  ready: boolean;
+  lastErrorCode: string | null;
+  leaseHeld: boolean;
+  /**
+   * Operator-chosen record label the handle resolved to, for verifying a binding the caller
+   * already holds. Not a routing key. Absent when the handle did not resolve.
+   */
+  credentialId?: string;
+  /**
+   * The record's change cursor, present only when the handle resolved to a record.
+   *
+   * Optional, and OMITTED from the object rather than defaulted, because there is no honest
+   * default: 0 or -1 would compare as older than every real version, so a poller would read a
+   * revoked handle as a change it had yet to see, forever. With the key absent, TypeScript
+   * refuses arithmetic or ordering on it until the caller has handled `undefined`, and
+   * `'recordVersion' in status` is false. Never replace absence with a number (`?? 0`).
+   */
+  recordVersion?: number;
+  stalePending?: boolean;
+};
+type ClaustrumReporterSource = 'direct' | 'relay_status_field' | 'relay_message_parse';
+declare class ClaustrumClient {
+  #private;
+  private constructor();
+  static connect(options?: ClaustrumClientOptions): Promise<ClaustrumClient>;
+  getCredential(handle: string, minTtlMs?: number): Promise<ServedCredential>;
+  statusCredential(handle: string): Promise<CredentialStatus>;
+  reportAuthFailure(input: {
+    handle: string;
+    providerStatus: number;
+    recordVersion: number;
+    reporterSource: ClaustrumReporterSource;
+  }): Promise<void>;
+  /**
+   * Enumerate what this caller's grants cover.
+   *
+   * `params` is `{}` and must be PRESENT: the vault rejects an absent or null params
+   * object, so a caller cannot ask a different question by omitting it.
+   */
+  listScoped(enrollmentToken?: string): Promise<ScopedInventory>;
+  /**
+   * Fetch by credential id, authorized by a grant rather than a bearer handle.
+   *
+   * `minTtlMs` is a DEMAND, not a hint: if a real upstream exchange still cannot satisfy
+   * it, the vault refuses with `ttl_unsatisfiable` (class `context_overflow`) rather than
+   * serving a token that will die inside the caller's own margin. That class means
+   * reduce-and-retry, never wait-and-retry.
+   */
+  getScoped(input: {
+    credentialId: string;
+    enrollmentToken?: string;
+    minTtlMs?: number;
+  }): Promise<ServedCredential>;
+  /**
+   * Report a served credential dead, addressed by id rather than by handle.
+   *
+   * VERSION-FENCED: `recordVersion` must be the one this caller was SERVED. A report
+   * against a since-refreshed version is accepted and does nothing, which is the point --
+   * a stale report must not kill a fresh token. `accepted: true` is the receipt that the
+   * report was taken, never evidence that it applied.
+   */
+  reportAuthFailureScoped(input: {
+    credentialId: string;
+    enrollmentToken?: string;
+    providerStatus: number;
+    recordVersion: number;
+    reporterSource: ClaustrumReporterSource;
+  }): Promise<void>;
+  /**
+   * Propose an enrollment. The consumer mints `requestSecret` itself and sends only its
+   * hash; the raw secret NEVER leaves the process, and it is what authorizes the poll.
+   *
+   * IDEMPOTENT ON (name, secret): re-proposing with the same secret returns the SAME
+   * `requestId`. That exists because `requestId` is minted server-side, so a consumer
+   * cannot persist it before proposing -- a crash in that window would otherwise leave it
+   * holding a secret it cannot poll with and a name held until TTL. Persist the secret
+   * BEFORE calling this, and a crash costs nothing.
+   *
+   * A different secret on the same name is a different caller and is refused.
+   */
+  enrollPropose(input: {
+    name: string;
+    requestSecretHash: string;
+  }): Promise<{
+    requestId: string;
+  }>;
+  /**
+   * Poll a proposal. Returns `pending` until an operator decides, then exactly once
+   * returns the token.
+   *
+   * THE TOKEN IS RETURNED ONCE. Persist it before doing anything else with it; a lost
+   * token needs a fresh ceremony, not a second poll.
+   */
+  enrollPoll(input: {
+    requestId: string;
+    requestSecret: string;
+  }): Promise<EnrollmentPollOutcome>;
+  /**
+   * Exchange a live token for its successor. The old token dies when the new one is issued.
+   *
+   * `expectedTokenGeneration` IS REQUIRED AND IS A FENCE, not bookkeeping: it must be the
+   * generation this caller currently holds. Two rotations racing — a retry after an
+   * uncertain reply, or two instances of the same consumer — would otherwise each mint a
+   * successor and each invalidate the other's, leaving a consumer holding a token the
+   * vault has already replaced. The vault refuses a rotation whose expectation does not
+   * match, so the loser learns it lost instead of discovering it on a later spend.
+   */
+  enrollRotate(input: {
+    token: string;
+    expectedTokenGeneration: number;
+  }): Promise<{
+    token: string;
+    tokenGeneration: number;
+  }>;
+  close(): void;
+}
+/**
+ * A row from the caller's own grant-covered inventory.
+ *
+ * Selection fields answer different questions. Pick by what you are about
+ * to do with the token:
+ *
+ * - `providerIds` — operator-assigned catalog provider ids; match exactly, with no fallback.
+ * - `authMethod` — the closed authentication method derived from the unsealed record,
+ *   not the id spelling. Absent on sign/open-only rows or when no method is defined.
+ *
+ * - `refreshAdapter` — whose PROTOCOL the credential speaks. Use it when the token
+ *   goes to a provider's own endpoints. Anything else is invalid there.
+ * - `serves` — which model VENDORS are reachable through it. Use it when choosing
+ *   where a model can be served from, and the protocol is not yours to care about.
+ *
+ * Never infer these fields from the id spelling. A credential reaching Anthropic models
+ * through OpenRouter still speaks OpenRouter's protocol, not Anthropic's.
+ */
+interface ScopedInventoryRow {
+  readonly id: string;
+  readonly categories: readonly string[];
+  readonly credentialType: string;
+  readonly serves: readonly string[];
+  /**
+   * Operator-assigned catalog ids; empty when none are set. Always present on this type.
+   * A daemon older than the field omits it from the wire, and that decodes as empty,
+   * which is also what an unmapped credential reports.
+   */
+  readonly providerIds: readonly string[];
+  readonly authMethod?: 'apikey' | 'chatgpt' | 'antigravity' | 'oauth';
+  /**
+   * Which provider protocol this credential speaks. Absent for static keys.
+   *
+   * SELECT ON THIS, NOT ON `serves`, WHEN THE TOKEN GOES TO A PROVIDER'S OWN ENDPOINTS.
+   * Measured on a live vault: eight rows serve Anthropic models and only five are Claude
+   * OAuth -- openrouter, antigravity and cursor reach Anthropic models through their own
+   * APIs. The id spelling does not separate them either: two contain no "anthropic" at
+   * all, and `credentialType === 'oauth'` catches antigravity and cursor too.
+   */
+  readonly refreshAdapter?: string;
+  readonly state: string;
+  readonly recordVersion: number;
+  readonly operations: readonly string[];
+  /**
+   * NOT SERVED TODAY. The field is absent from `ListScopedCredential`, so this is always
+   * null; it is declared because a consumer's discovery high-water mark needs it and the
+   * absence should be visible in the type rather than discovered at runtime.
+   */
+  readonly createdAtMs: number | null;
+  readonly accountId?: string;
+  readonly email?: string;
+  readonly orgName?: string;
+}
+/**
+ * An inventory reply: the covered rows, plus the cursor that says whether they moved.
+ *
+ * `view` is a DIGEST OVER WHAT THIS CALLER CAN SEE — ids, categories, state, operations —
+ * and deliberately NOT over `record_version`, so a routine token refresh does not move it.
+ * Compare it against the previous call's to decide whether to reconcile at all; it is an
+ * opaque string and nothing but equality is defined on it.
+ */
+interface ScopedInventory {
+  readonly rows: readonly ScopedInventoryRow[];
+  readonly view: string;
+}
+/** What a poll found. `pending` is not an error: the operator has not decided yet. */
+type EnrollmentPollOutcome = {
+  readonly status: 'pending';
+} | {
+  readonly status: 'approved';
+  readonly name: string;
+  readonly token: string;
+  readonly tokenGeneration: number;
+} | {
+  readonly status: 'denied';
+};
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/claustrum/custody.d.ts
+type ClaustrumScopedClient = Pick<ClaustrumClient, 'listScoped' | 'getScoped' | 'reportAuthFailureScoped' | 'close'>;
+/** The two credential types a plugin's family can hold; routing differs by type. */
+type VaultCredentialType = 'oauth' | 'api_key';
+/**
+ * Why a listed vault record could not be used. A closed set of fixed codes, so
+ * a log line or a roster file that carries one never echoes vault data.
+ */
+type SkippedVaultReason = 'empty credential id' | 'duplicate credential id' | 'blank account identity' | 'empty state';
+/**
+ * A vault record this consumer could not use. `credentialId` is absent when
+ * the record's id itself was unusable, so nothing can say which account the
+ * record was.
+ */
+interface SkippedVaultRecord {
+  readonly credentialId?: string;
+  readonly reason: SkippedVaultReason;
+}
+/**
+ * Where a receipt's `accountIdentity` came from: the vault asserted it in the
+ * served reply, the plugin's `parseIdentity` read it from the served token, or
+ * neither did and it is only the roster's expectation (`none`: no identity at
+ * all).
+ */
+type AccountIdentitySource = 'asserted' | 'parsed' | 'expected' | 'none';
+/**
+ * A receipt: what the vault served for one physical send. Each attempt gets
+ * its own. It records the exact record version served, because a 401 for
+ * this send is reported to the vault against that version.
+ */
+interface ClaustrumScopedAttempt {
+  readonly credentialId: string;
+  readonly credentialType: VaultCredentialType;
+  /**
+   * The account this receipt is bound to: the vault's assertion, else the
+   * plugin's parse of the token, else the roster's expectation. Check
+   * `accountIdentitySource` before treating it as proof.
+   */
+  readonly accountIdentity?: string;
+  readonly accountIdentitySource: AccountIdentitySource;
+  /** The account the roster row named when this receipt was requested. */
+  readonly expectedAccountIdentity?: string;
+  /** The credential id the vault itself put in the served reply, if any. */
+  readonly assertedCredentialId?: string;
+  /**
+   * The account the vault itself put in the served reply, if any. Never filled
+   * in from the roster or from a token parse.
+   */
+  readonly assertedAccountIdentity?: string;
+  /**
+   * The non-secret Google Cloud project id the vault served in get_scoped for
+   * this attempt, if any. Never filled in from list_scoped, the roster or a
+   * token parse. A project change in the vault takes effect on the next send.
+   */
+  readonly projectId?: string;
+  /**
+   * Kept in memory only and hidden from JSON.stringify and object spreads, so
+   * logging a receipt never leaks it. Authorize again for every dispatch and retry.
+   */
+  readonly accessToken: string;
+  readonly recordVersion: number;
+  readonly expiresAtMs: number | null;
+}
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/quota/map.d.ts
+interface QuotaReadingEntry {
+  scope: string;
+  label: string;
+  kind: 'reading';
+  checkedAt: number;
+  usedPercent: number;
+  /** ISO timestamp at which the window resets, as the provider reported it. */
+  resetsAt?: string;
+  /** Window length in minutes, when the provider reported one. */
+  windowMinutes?: number;
+}
+interface QuotaRetiredEntry {
+  scope: string;
+  label: string;
+  kind: 'retired';
+  retiredAt: number;
+}
+interface QuotaAbsentEntry {
+  scope: string;
+  label: string;
+  kind: 'absent';
+  checkedAt: number;
+}
+type QuotaEntry = QuotaReadingEntry | QuotaRetiredEntry | QuotaAbsentEntry;
+interface CreditBudgetReading {
+  kind: 'reading';
+  checkedAt: number;
+  /** The provider's own verdict that the budget is spent. */
+  reached: boolean;
+  remainingPercent?: number;
+  usedPercent?: number;
+  resetsAt?: string;
+  limit?: number;
+  used?: number;
+  remaining?: number;
+  unit?: string;
+}
+interface CreditBudgetCleared {
+  kind: 'cleared';
+  checkedAt: number;
+}
+type CreditBudgetEntry = CreditBudgetReading | CreditBudgetCleared;
+interface QuotaMap {
+  limits: QuotaEntry[];
+  /** Absent means no observation has reported on the budget yet. */
+  budget?: CreditBudgetEntry;
+}
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/claustrum/interlock.d.ts
+/**
+ * The declined-account interlock: the user's "do not use this vault account",
+ * kept on the consumer side because the vault has no notion of it.
+ *
+ * A decline follows the provider account, not the vault record: an entry made
+ * while the account was known matches any credential id or alias that logs
+ * into that same account, so relabelling, adding an alias or removing and
+ * re-adding the account never lifts it. A credential id that now logs into a
+ * different known account does not match, because that account has its own
+ * policy. While either side's account is unknown the entry falls back to the
+ * credential id, so an adapter that makes no identity claim cannot slip past
+ * it. Never keyed on the record version, so a token refresh cannot lift it.
+ */
+interface DeclinedAccount {
+  readonly credentialId: string;
+  readonly accountIdentity?: string;
+}
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/claustrum/roster.d.ts
+/**
+ * One vault account as the pool sees it. It carries no bearer material: the
+ * access token is fetched from the vault for every send. Several vault
+ * records logged into the same provider account collapse into one row, so
+ * duplicate logins never count as extra quota.
+ */
+interface VaultRosterRow {
+  routeId: string;
+  credentialId: string;
+  credentialType: VaultCredentialType;
+  accountIdentity?: string;
+  /** Other credential ids logged into the same provider account. */
+  aliases?: string[];
+  state: string;
+  label: string;
+  email?: string;
+  orgName?: string;
+  enabled: boolean;
+  addedAt: number;
+  quota?: QuotaMap;
+  /**
+   * The vault listed this record in a form this consumer could not use, so the
+   * row is the last good projection kept as it was rather than dropped.
+   */
+  stale?: true;
+  /**
+   * The vault's latest list named no account for `credentialId`, so
+   * `accountIdentity` is the last account that credential was known to log
+   * into, kept until the vault names one again. It proves neither that the
+   * credential still logs into that account nor that it changed accounts.
+   */
+  unclaimed?: true;
+}
+interface VaultRosterFile {
+  version: 1;
+  view?: string;
+  /**
+   * False when the vault's reply carried records this consumer could not use.
+   * An incomplete reply never removes an account it may still hold: every
+   * previous member it does not account for is kept.
+   */
+  complete: boolean;
+  /** The unusable records of an incomplete reply: a safe id and a fixed reason. */
+  rejected?: SkippedVaultRecord[];
+  rows: VaultRosterRow[];
+  declined: DeclinedAccount[];
+}
+/**
+ * The receipt fields a quota or profile observation must carry to say which
+ * send (credential and account) it came from. Pass the
+ * `ClaustrumScopedAttempt` that send was authorized with.
+ */
+type QuotaReceipt = Pick<ClaustrumScopedAttempt, 'credentialId' | 'accountIdentity' | 'accountIdentitySource' | 'expectedAccountIdentity'>;
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/claustrum/enrollment.d.ts
+interface ClaustrumEnrollmentClient {
+  enrollPropose(input: {
+    name: string;
+    requestSecretHash: string;
+  }): Promise<{
+    requestId: string;
+  }>;
+  enrollPoll(input: {
+    requestId: string;
+    requestSecret: string;
+  }): Promise<EnrollmentPollOutcome>;
+}
+interface ClaustrumEnrollmentConnection extends ClaustrumEnrollmentClient {
+  close(): void;
+}
+type ClaustrumEnrollmentStatus = {
+  state: 'idle';
+} | {
+  state: 'pending';
+  proposedName: string;
+  requestId?: string;
+  retryCode?: string;
+} | {
+  state: 'approved';
+  proposedName: string;
+  approvedName?: string;
+  tokenGeneration: number;
+} | {
+  state: 'denied';
+  proposedName: string;
+} | {
+  state: 'blocked';
+  proposedName: string;
+  code: string;
+} | {
+  state: 'unavailable';
+  proposedName: string;
+  code: string;
+} | {
+  state: 'busy';
+};
+interface ClaustrumEnrollmentPaths {
+  statePath: string;
+  tokenPath: string;
+}
+//#endregion
+//#region ../core/dist/vault.d.ts
+type VaultHost = 'opencode' | 'pi';
+interface VaultPaths extends ClaustrumEnrollmentPaths {
+  /** The roster: the vault accounts, their quota and the declined ones. Holds no token. */
+  rosterPath: string;
+}
+/** One vault account as routing sees it. */
+interface VaultRoute {
+  id: string;
+  kind: 'oauth' | 'api-key';
+  /** The ChatGPT account it signs in as, when the vault knows it. */
+  identity?: string;
+  quota?: QuotaMap;
+}
+interface VaultStatus {
+  host: VaultHost;
+  /** The name this host enrolls as. */
+  name: string;
+  enrollment: ClaustrumEnrollmentStatus;
+  /** Every vault account this host can see, declined and cold ones included. */
+  accounts: readonly VaultRosterRow[];
+  lastError?: string;
+}
+interface VaultWaitOptions {
+  /** Called with each status while the request waits for approval. */
+  onPending?: (status: ClaustrumEnrollmentStatus) => void;
+  pollIntervalMs?: number;
+  timeoutMs?: number;
+  sleep?: (ms: number) => Promise<void>;
+}
+interface OpenAiVaultOptions {
+  host: VaultHost;
+  /** This host's vault directory; see `vaultStateDir`. */
+  stateDir: string;
+  /** The vault's connection file; `CLAUSTRUM_SUBC_CONNECTION` or the default by default. */
+  connectionFile?: () => string;
+  /** The project this host runs in, part of the identity the vault sees. */
+  projectRoot?: string;
+  /** Replaces the request-path connection (tests). */
+  connectScoped?: () => Promise<ClaustrumScopedClient>;
+  /** Replaces the setup-only enrollment connection (tests). */
+  connectEnrollment?: () => Promise<ClaustrumEnrollmentConnection>;
+  /** Ids of the local pool rows; no vault route takes one. */
+  reservedRouteIds?: () => Iterable<string>;
+  /** How often the roster is re-read from the vault; 0 stops the poll. */
+  pollIntervalMs?: number;
+  fetchImpl?: () => typeof fetch;
+  now?: () => number;
+}
+/** One host's view of its OpenAI accounts in the vault. */
+declare class OpenAiVault {
+  #private;
+  readonly host: VaultHost;
+  readonly name: string;
+  readonly paths: VaultPaths;
+  constructor(options: OpenAiVaultOptions);
+  /** Read enrollment files before a request, menu action or background pass, using common-auth's mode rules. */
+  authority(): Promise<'vault' | 'local' | 'unreadable'>;
+  /**
+   * Callbacks that cannot await use the last authority value only while the
+   * enrollment files are unchanged. Before the first read, or after a change,
+   * local token refreshes, quota polls and account writes are blocked.
+   * Requests and menus await authority() instead of trusting the cached value.
+   */
+  enrolled(): boolean;
+  /**
+   * Polls enrollment files and the vault's accounts. With local authority the
+   * consumer sends no vault request. A new enrollment completed by another
+   * process is detected on the next poll.
+   */
+  start(): void;
+  /**
+   * Resolves once this instance's first roster discovery has ended, whether
+   * it read the vault or failed, or once the instance is closed. Never
+   * rejects. A vault-mode request waits for it, bounded by
+   * `VAULT_REQUEST_ROSTER_WAIT_MS`.
+   */
+  firstRoster(): Promise<void>;
+  /**
+   * Re-reads the accounts from the vault now. Never rejects. It resolves only
+   * after a discovery that began after this call: one already in flight (the
+   * poll, or a refresh another caller started) may have read the enrollment
+   * and the vault before what this caller just changed, so it is waited out
+   * and a new one runs. Callers that arrive while that new one runs share it.
+   */
+  refresh(): Promise<VaultRosterFile | undefined>;
+  snapshot(): VaultRosterFile | undefined;
+  /** Whether the vault serves this host any account (whatever its state). */
+  serves(): boolean;
+  /**
+   * The ChatGPT accounts the vault holds for this host, declined and cold
+   * ones included. Empty unless this host is enrolled; while it is, no local
+   * row is used at all (vault mode), so this only names which vault account
+   * a set-aside local row belongs to.
+   */
+  identities(): ReadonlySet<string>;
+  /** The vault accounts that may route now: enabled and active. */
+  routes(): VaultRoute[];
+  /** Whether a route id names a vault account. */
+  owns(routeId: string): boolean;
+  /**
+   * Sends one request on a vault account. `dispatch` sends with the token
+   * the vault serves for this attempt and may be called twice (a 401 is
+   * retried once when the vault has a newer version of the same login), so
+   * it must be able to rebuild its body. Returns undefined when the vault
+   * refused before anything was sent (not enrolled, declined, cold,
+   * unreachable): the caller treats the account like a row with no token.
+   * An error from `dispatch` itself (a transport failure, an abort) is
+   * rethrown.
+   */
+  send(routeId: string, dispatch: (token: string, attempt: ClaustrumScopedAttempt) => Promise<Response>, options: {
+    site: string;
+    signal?: AbortSignal;
+  }): Promise<Response | undefined>;
+  /**
+   * Authorizes one send on a vault account for a caller that sends the
+   * request itself (OpenCode 2's host does): the receipt holds the token to
+   * send with and the record version a 401 on that send is reported
+   * against (`reportFailure`). Undefined when the vault refused (not
+   * enrolled, declined, cold, unreachable): the caller treats the account
+   * like a row with no token. Authorize again for every send; a receipt is
+   * never reused.
+   */
+  authorize(routeId: string, options?: {
+    signal?: AbortSignal;
+  }): Promise<ClaustrumScopedAttempt | undefined>;
+  /**
+   * Reports the provider's answer to a send made with `authorize`'s receipt.
+   * Only a 401 is reported, against the receipt's record version; anything
+   * else is ignored. The roster is re-read afterwards so an account the
+   * vault now marks as needing a new login stops routing. Never rejects.
+   */
+  reportFailure(attempt: ClaustrumScopedAttempt, status: number): Promise<void>;
+  /**
+   * Records a quota snapshot (response headers, a WebSocket rate-limit frame,
+   * a usage poll) for a vault account. `receipt` is what the send that
+   * produced the reading was served with (its credential id and the account
+   * it was bound to, and how that account was known); the reading is kept
+   * only while the route still holds that credential and account, so a
+   * reading taken before the vault replaced the account is dropped. Runs in
+   * the background; a failure is logged.
+   */
+  recordSnapshot(routeId: string, snapshot: unknown, complete: boolean, receipt: QuotaReceipt): Promise<void>;
+  /** Takes one quota reading for a vault account through the usage endpoint. */
+  pollQuota(routeId: string): Promise<{
+    ok: boolean;
+    error?: string;
+  }>;
+  /**
+   * Asks for a quota reading of a vault account that admission refused
+   * because it has no reading yet. At most one reading per account is in
+   * flight.
+   */
+  requestReading(routeId: string): void;
+  /** Readings for the routable vault accounts whose last one is older than `maxAgeMs`. */
+  pollStale(maxAgeMs: number): Promise<Array<{
+    id: string;
+    ok: boolean;
+    error?: string;
+  }>>;
+  /** Declines a vault account: it stays listed and never routes until accepted. */
+  decline(routeId: string): Promise<void>;
+  accept(routeId: string): Promise<void>;
+  status(): Promise<VaultStatus>;
+  /**
+   * One step of enrollment: proposes this host to the vault, or polls the
+   * proposal already on disk. A denied or blocked request is cleared first,
+   * so Connect always starts a usable request.
+   */
+  connectStep(): Promise<ClaustrumEnrollmentStatus>;
+  /**
+   * Polls the enrollment until the operator approves or denies it, or until
+   * `timeoutMs`. One wait runs at a time; a second caller shares it.
+   */
+  waitForApproval(options?: VaultWaitOptions): Promise<ClaustrumEnrollmentStatus>;
+  /**
+   * Forgets this host's enrollment: its token and ceremony state are
+   * deleted, and the vault accounts stop routing at once. The roster (the
+   * declined accounts and their quota) is kept for a later Connect. The
+   * enrollment itself stays approved in the vault until the operator revokes
+   * it there.
+   */
+  disconnect(): Promise<void>;
+  /**
+   * Refuses a real login in the host's own slot while the vault serves this
+   * host's accounts: serving either one would silently pick one of two
+   * accounts the user may not mean. The pool placeholder and the old
+   * tombstone are not logins and must be screened out by the caller.
+   */
+  assertHostSlot(auth: unknown): void;
+  close(): void;
+}
+//#endregion
+//#region src/core/version-fence.d.ts
+/** One live process that keeps the fence shut. */
+interface VersionFenceBlocker {
+  /** `'unknown'` when a whole directory could not be read. */
+  pid: number | 'unknown';
+  /** The version its heartbeat names, or `'unknown'`. */
+  version: string;
+  /** The file or directory that showed it. */
+  detail: string;
+}
+type VersionFenceResult = {
+  open: true;
+} | {
+  open: false;
+  blockers: VersionFenceBlocker[];
+};
+//#endregion
+//#region src/core/pool-migration.d.ts
+/** The host login slot, shaped like the plugin's `client.auth`. */
+interface HostSlotAdapter {
+  /** The shared auth.json path, independent of a plugin's config root. */
+  path?: string;
+  migrationDisabledReason?: () => string | undefined;
+  get(input: {
+    path: {
+      id: string;
+    };
+  }): Promise<unknown>;
+  set(input: {
+    path: {
+      id: string;
+    };
+    body: unknown;
+  }): Promise<unknown>;
+  all(): Promise<Record<string, unknown>>;
+}
+interface PoolMigrationLogger {
+  info(message: string, data?: Record<string, unknown>): void;
+  warn(message: string, data?: Record<string, unknown>): void;
+}
+/** Named points between this module's own writes; awaited, for crash tests. */
+type PoolMigrationStep = 'after-pool-key-write' | 'after-record-write' | 'after-row-write' | 'after-verify' | 'after-carry-over' | 'before-placeholder-write' | 'after-placeholder-write' | 'after-record-clear' | 'after-marker-write';
+/** Timing of the legacy file locks and of waits on them. */
+interface LegacyLockOptions {
+  mainRefreshTtlMs: number;
+  fallbackTtlMs: number;
+  /** Lease of the `save` lock pair around this module's own config writes. */
+  saveTtlMs: number;
+  renew: boolean;
+  renewIntervalMs?: number;
+  /** How long to wait for a held legacy lock before giving up (real clock). */
+  timeoutMs: number;
+  retryMs: number;
+}
+interface PoolMigrationDeps {
+  paths: AccountPaths;
+  slot: HostSlotAdapter;
+  now?: () => number;
+  sleep?: (ms: number) => Promise<void>;
+  /** Id for a new row whose login carries no usable wire identity. */
+  newId?: () => string;
+  log?: PoolMigrationLogger;
+  legacyLocks?: Partial<LegacyLockOptions>;
+  /** Bound and poll interval for waiting out an active legacy main lease. */
+  leaseWait?: {
+    timeoutMs: number;
+    pollMs: number;
+  };
+  /** Pass-through options for the pool store this module opens. */
+  store?: Partial<Pick<OpenPoolStoreOptions, 'lockOptions' | 'rowLockOptions' | 'providerLock' | 'storeLocks' | 'onStep' | 'onLockEvent'>>;
+  onStep?: (step: PoolMigrationStep) => void | Promise<void>;
+  /**
+   * Whether the Claustrum vault serves this host's accounts. The built-in
+   * adopter does not change course on it: a pool row for an account the
+   * vault also holds is skipped by the account source (`pool-account-source.ts`),
+   * which neither routes nor refreshes it locally, so adoption can safely
+   * move a slot login into the pool and put the placeholder back. The
+   * placeholder has to be back: OpenCode 1 installs the plugin's fetch only
+   * when its `openai` slot holds an OAuth value.
+   */
+  vaultServes?: () => boolean;
+}
+type SlotNothingKind = 'api' | 'placeholder' | 'empty' | 'tombstone' | 'slot-absent' | 'declined';
+type PoolTransferOutcome = {
+  status: 'slot-read-only';
+  reason: string;
+} |
+/**
+ * The adoption left the slot alone because the vault serves this host's
+ * accounts. The built-in adopter (`adoptHostSlotLogin`) no longer returns
+ * this; it can still come from a custom adopter passed to the background
+ * runner (`adopt` in `pool-lifecycle.ts`).
+ */
+{
+  status: 'vault-owns-accounts';
+} |
+/**
+ * An openai-auth process older than this one is running (see
+ * `version-fence.ts`); nothing was written. The migration runs once they
+ * are gone.
+ */
+{
+  status: 'deferred';
+  reason: 'older-version-running';
+  blockers: VersionFenceBlocker[];
+} |
+/** Migration already recorded as done; nothing was imported. */
+{
+  status: 'already-migrated';
+} |
+/**
+ * The slot holds the placeholder, but it was not this store that moved the
+ * login out of the slot. The transfer record below is the pending-transfer
+ * record in this store's config, written before a transfer touches a row.
+ * - `placeholder-without-main`: another store sharing this login slot
+ *   moved the login, so the login is that store's. Either this store has
+ *   no `main` row and no transfer record, and nothing is written; or this
+ *   store's own transfer was under way and found the placeholder tagged
+ *   with another config root, and only the copy that transfer had put into
+ *   a row is removed (the other store holds the login now) and the record
+ *   cleared.
+ * - `placeholder-origin-unknown`: this store has a transfer record, but
+ *   the placeholder is untagged (it has no `accountId` naming the config
+ *   root that wrote it; builds before this one wrote it that way). The
+ *   row copy may be this store's only copy of the credential, so it is not
+ *   deleted; another store may own the login, so the row is disabled
+ *   rather than routed or refreshed. The record is cleared so that a later
+ *   background run does not find it and disable the row again after
+ *   someone has re-enabled it.
+ */
+{
+  status: 'refused';
+  reason: 'placeholder-without-main' | 'placeholder-origin-unknown';
+} |
+/** Adoption asked for before the migration ran. */
+{
+  status: 'not-migrated';
+} | {
+  status: 'nothing-to-import';
+  slot: SlotNothingKind;
+} | {
+  status: 'completed';
+  rowId: string;
+  operation: 'add' | 'rotate' | 'replace' | 'resumed';
+  /**
+   * `written`: the placeholder was written and read back.
+   * `already-present`: a resumed run found the placeholder in place.
+   * `slot-moved-on`: the slot changed to another value before the fence;
+   * it is left for the next adoption. (A placeholder replaced between its
+   * write and the readback ends the run as `retry`,
+   * `placeholder-overwritten`, not here.)
+   */
+  placeholder: 'written' | 'already-present' | 'slot-moved-on';
+} |
+/**
+ * An interrupted transfer's row holds neither its old credential nor the
+ * slot's: someone rotated it after the interruption, so the slot copy may
+ * be stale. The slot is left alone and this exact slot value is declined
+ * for adoption; the user's next login resolves it.
+ */
+{
+  status: 'ambiguous';
+  rowId: string;
+} | {
+  status: 'retry';
+  reason: 'host-slot-indeterminate' | 'legacy-refresh-in-progress' | 'lock-contention' | 'verify-failed' | 'torn-read' | 'slot-changed' |
+  /**
+   * Something replaced the placeholder between its write and the
+   * readback. The record and the shield stay, since the slot may hold
+   * the very token the row now holds; the next run reads the slot
+   * again and finishes the transfer from what it finds.
+   */
+  'placeholder-overwritten' | 'unsettled' |
+  /**
+   * An adoption found the vault's first roster read still unfinished
+   * after its wait, so whether the vault serves this host was unknown;
+   * nothing was adopted.
+   */
+  'vault-roster-pending' | `store-${string}`;
+} | {
+  status: 'error';
+  reason: string;
+};
+/** What the migration needs beyond an adoption run. */
+interface PoolMigrationFenceDeps {
+  /**
+   * The version fence (`migrationFenceOpen` in `version-fence.ts`, bound to
+   * this build's version). While it is shut the migration writes nothing.
+   */
+  fence: () => Promise<VersionFenceResult>;
+}
+/**
+ * One-time move of the host-slot credential into the pool row `main`
+ * (fallback rows are already pool rows: same ids, same files). It writes
+ * nothing while an older openai-auth process runs (`deferred`). A re-run
+ * after completion does nothing.
+ */
+declare function migrateToPool(deps: PoolMigrationDeps & PoolMigrationFenceDeps): Promise<PoolTransferOutcome>;
+/**
+ * After migration: a real login found in the host slot (someone ran
+ * `/login openai` in OpenCode) moves into the pool, matched by wire identity,
+ * and the placeholder goes back into the slot.
+ */
+declare function adoptHostSlotLogin(deps: PoolMigrationDeps): Promise<PoolTransferOutcome>;
+//#endregion
+//#region src/core/pool-lifecycle.d.ts
+interface PoolLifecycleTimers {
+  set(run: () => void, ms: number): unknown;
+  clear(handle: unknown): void;
+}
+interface PoolLifecycleDeps {
+  /** Read at every run, so it follows the configured store path. */
+  paths: () => AccountPaths;
+  slot: HostSlotAdapter;
+  /** This build's version, for the version fence. */
+  version: string;
+  log?: PoolMigrationLogger;
+  /** Defaults to `migrationFenceOpen` for `version`. */
+  fence?: () => Promise<VersionFenceResult>;
+  migrate?: typeof migrateToPool;
+  adopt?: typeof adoptHostSlotLogin;
+  timers?: PoolLifecycleTimers;
+  random?: () => number;
+  /** Passed through to every migration and adoption run (tests). */
+  runDeps?: Partial<PoolMigrationDeps>;
+  /**
+   * True while no migration or adoption may run: the host is in vault mode,
+   * which writes no local account file. Read before every run.
+   */
+  paused?: () => boolean | Promise<boolean>;
+}
+//#endregion
+export { BeginAccountLoginOptions as a, TokenResponse as c, parseJwtClaims as d, AccountPaths as f, OpenAiVaultOptions as i, beginAccountLogin as l, HostSlotAdapter as n, BeginAccountLoginResult as o, PoolStore as p, OpenAiVault as r, IdTokenClaims as s, PoolLifecycleDeps as t, extractAccountIdFromClaims as u };