@cortexkit/opencode-openai-auth 0.11.1 → 1.0.1

package/dist/index.d.ts

@@ -1,136 +1,529 @@
-import { C as CustodyManifestIo, E as detectClaustrumConnection, S as acquireRefreshFileLock, T as QuotaManager, _ as loadAccounts, b as ClaustrumCredentialCache, c as IdTokenClaims, d as parseJwtClaims, f as AccountStorage, g as OAuthQuotaSnapshot, h as OAuthAccount, l as TokenResponse, m as FallbackAccount, n as ResetTargetIdentity, p as AccountStoreTransaction, t as CommandContext, u as extractAccountIdFromClaims, v as mutateAccounts, w as CustodyManifestReadResult, x as resolveFallbackAccess, y as withAccountStoreTransaction } from "./internal-BTndPmW2.js";
-import { Q as VaultCustodyState, Z as CustodyInertReason, b as SidebarState, m as SidebarAccountCustody, v as SidebarMachineState } from "./sidebar-state-CoKYKcLn.js";
+import { c as TokenResponse, d as parseJwtClaims, f as AccountPaths, l as beginAccountLogin, p as PoolStore, r as OpenAiVault, s as IdTokenClaims, t as PoolLifecycleDeps, u as extractAccountIdFromClaims } from "./pool-lifecycle-DbDmgabd.js";
+import { _ as SidebarMachineState, b as SidebarState } from "./sidebar-state-D6cUKgkm.js";
 import { Hooks, Plugin, PluginInput } from "@opencode-ai/plugin";
-//#region src/core/custody-manifest.d.ts
-declare function readCustodyManifest(path?: string, io?: CustodyManifestIo): Promise<CustodyManifestReadResult>;
+//#region ../core/dist/provider.d.ts
+type QuotaWindowName = string;
+type ProviderQuotaFn = (input: {
+  accessToken: string;
+  fetchImpl: typeof fetch;
+  now: () => number;
+}) => Promise<OAuthQuotaSnapshot>;
 //#endregion
-//#region src/core/custody-transition.d.ts
-type TransitionOutcome = 'ready' | 'tombstoned' | Extract<CustodyInertReason, 'new-local-family-under-claustrum' | 'vault-cold' | 'vault-reauth' | 'identity-mismatch' | 'no-handle'> | 'torn-read-deferred' | `aborted:${string}`;
-type TransitionResult = {
-  status: 'completed' | 'incomplete' | 'aborted';
-  outcomes: Record<string, TransitionOutcome>;
-  reason?: string;
+//#region ../core/dist/quota-manager.d.ts
+type QuotaEntry = {
+  quota: OAuthQuotaSnapshot;
+  refreshAfter: number;
+  checkedAt: number;
+  accountId?: string;
 };
-type CustodyHostAuth = EnterClaustrumModeDeps['auth'];
-type Release = {
-  release(): Promise<void>;
+type QuotaManagerOptions = {
+  storage: AccountStorage | null;
+  fetchImpl?: typeof fetch;
+  /**
+   * Account config file this manager's cross-process refresh locks are named
+   * after. Host-resolved and required, so two hosts pointing at different
+   * stores never contend on one another's lock.
+   */
+  configPath: string;
+  now?: () => number;
+  /** Injected quota-fetch function — replaces the hard-imported Anthropic fetchOAuthQuotaSnapshot */
+  fetchQuotaFn?: ProviderQuotaFn;
+  onMainQuotaFetched?: (quota: OAuthQuotaSnapshot, checkedAt: number, fingerprint: string, fetchStartedAt: number) => void;
+  onApiError?: (error: AccountOperationError) => void;
 };
-type EnterClaustrumModeDeps = {
-  accountIds: readonly string[];
-  acquireLock(options: {
-    name: string;
-    renew: boolean;
-  }): Promise<Release | null>;
-  withStoreTransaction(action: (transaction: AccountStoreTransaction) => Promise<TransitionResult>): Promise<TransitionResult>;
-  readManifest(): Promise<CustodyManifestReadResult>;
-  preflight(input: {
-    id: string;
-    accountId?: string;
-    handle: string;
-  }): Promise<Exclude<TransitionOutcome, `aborted:${string}` | 'tombstoned' | 'new-local-family-under-claustrum' | 'torn-read-deferred'>>;
-  auth: {
-    all(): Promise<Record<string, unknown>>;
-    get(input: {
-      path: {
-        id: string;
-      };
-    }): Promise<unknown>;
-    set(input: {
-      path: {
-        id: string;
-      };
-      body: {
-        type: 'oauth';
-        access: string;
-        refresh: string;
-        expires: number;
-      };
-    }): Promise<unknown>;
+declare class QuotaManager {
+  private main;
+  private mainTokenFp;
+  private mainQuotaAccountId;
+  private fallbacks;
+  private fallbackTokenFps;
+  private inflightMain;
+  private inflightMainFp;
+  private inflightFallbacks;
+  private mainLastApiError;
+  private fallbackApiErrors;
+  private fallbackErrorTokenFps;
+  private rateLimitedUntilMap;
+  private apiGate;
+  private lastApiCallAt;
+  private storage;
+  private readonly fetchImpl;
+  private readonly now;
+  private readonly fetchQuotaFn;
+  private readonly onMainQuotaFetched;
+  private readonly onApiError;
+  private readonly configPath;
+  constructor(opts: QuotaManagerOptions);
+  /**
+   * Cached main quota entry. Pass the live access token to enforce token
+   * binding: if the cached entry was produced by a different token (main
+   * account switched), it is dropped and null is returned so the caller
+   * refetches for the current account. Called without a token (e.g. for
+   * display) it returns whatever is cached.
+   */
+  getMain(accessToken?: string): QuotaEntry | null;
+  /**
+   * Cached fallback quota entry. Pass the live access token to enforce token
+   * binding: if the entry was produced by a different token (account re-login),
+   * it is dropped and null is returned so the caller refetches.
+   */
+  getFallback(accountId: string, accessToken?: string): QuotaEntry | null;
+  getAllFallbacks(): Map<string, QuotaEntry>;
+  setMain(accessToken: string, entry: QuotaEntry, accountId?: string, completeSnapshot?: boolean): void;
+  /**
+   * Non-invalidating read of the cached main quota for POLICY decisions
+   * (killswitch). Unlike getMain(token), a token mismatch does NOT drop the
+   * cache — an access-token refresh is a same-account event and must not turn a
+   * known-exhausted account into "unknown" (which would fail open and spend).
+   *
+   * Pass the live ChatGPT accountId to still drop on a genuine account SWITCH:
+   * if the cached entry's account identity is known and differs, return null so
+   * the killswitch treats it as unknown rather than judging account A by account
+   * B's quota. When identity is unknown on either side, the cached snapshot is
+   * returned (best-effort) — the same fail-open-on-unknown stance as elsewhere.
+   */
+  peekMainForPolicy(accountId?: string): QuotaEntry | null;
+  /**
+   * Non-invalidating read of a cached fallback quota for POLICY decisions
+   * (killswitch, admission). Keyed by the stable internal account id, so a
+   * token refresh for the same account does not drop it (getFallback(id, token)
+   * would).
+   *
+   * Pass the live ChatGPT identity to still drop on a genuine re-login: if the
+   * cached entry's identity is known and differs, return null so the previous
+   * identity's (possibly exhausted) quota is never judged against its
+   * replacement. Unknown on either side fails open, matching peekMainForPolicy.
+   */
+  peekFallbackForPolicy(accountId: string, identity?: string): QuotaEntry | null;
+  setFallback(accountId: string, entry: QuotaEntry, accessToken?: string, completeSnapshot?: boolean, identity?: string): void;
+  /**
+   * Mark accountId ('main' or a fallback id) rate-limited until resetAtMs.
+   * Keeps the LATER reset: skips only when an existing mark is strictly
+   * later than resetAtMs, so an equal-reset re-mark still applies (idempotent)
+   * instead of being silently dropped by a stale `>=` comparison.
+   */
+  markRateLimited(accountId: string, resetAtMs: number): void;
+  /** True iff accountId has a mark whose reset has not yet passed. */
+  isRateLimited(accountId: string): boolean;
+  /**
+   * Raw stored reset for accountId's mark, or undefined if none. Unlike
+   * isRateLimited, this does NOT apply read-time expiry — callers on the
+   * block path already know the mark is live (isRateLimited just returned
+   * true) and want its exact reset estimate for a Retry-After computation.
+   */
+  rateLimitedUntil(accountId: string): number | undefined;
+  /** Explicit early clear — read-time expiry in isRateLimited is primary. */
+  clearRateLimited(accountId: string): void;
+  refreshMain(accessToken: string): Promise<OAuthQuotaSnapshot>;
+  refreshFallback(accountId: string, accessToken: string): Promise<OAuthQuotaSnapshot>;
+  refreshAllFallbacks(accounts: OAuthAccount[]): Promise<void>;
+  /**
+   * Fire-and-forget refresh. Does not await, swallows errors.
+   */
+  refreshMainInBackground(accessToken: string): void;
+  isMainStale(): boolean;
+  isFallbackStale(accountId: string, accessToken?: string): boolean;
+  shouldRefreshOnRequestCount(requestCount: number): boolean;
+  /**
+   * Combined check: should a refresh happen right now?
+   * True if main is stale by time OR triggered by request count.
+   */
+  needsRefresh(requestCount: number): boolean;
+  updateStorage(storage: AccountStorage | null): void;
+  /**
+   * Seed/update the main quota cache from persisted state. This is deliberately
+   * callable after every disk load so another plugin process's fresh quota write
+   * can stop this process from showing "checking…" or making a redundant quota
+   * API call.
+   */
+  seedMainFromStorage(storage: AccountStorage | null, accessToken?: string): void;
+  private seedMainBackoffFromStorage;
+  /**
+   * Seed fallback cache entries from persisted account.quota data.
+   * Updates older in-memory entries so a fresh quota write from another plugin
+   * process prevents redundant checks and stale sidebar writes.
+   */
+  seedFallbacksFromAccounts(accounts: OAuthAccount[]): void;
+  /**
+   * Whether the MAIN quota API is currently in backoff. Scoped to the main
+   * account — a fallback account's 429 never reports here.
+   */
+  isBackedOff(): boolean;
+  /**
+   * Whether a specific fallback account's quota API is in backoff.
+   */
+  isFallbackBackedOff(accountId: string, accessToken?: string): boolean;
+  getLastApiError(): AccountOperationError | undefined;
+  /** Minimum gap between consecutive quota API calls (ms). */
+  private static readonly API_CALL_GAP_MS;
+  private static fallbackInflightKey;
+  private static quotaLockName;
+  /**
+   * Serialize API calls through a shared gate so only one
+   * quota API request runs at a time, with a minimum gap
+   * between calls. Prevents concurrent and rapid-fire calls
+   * from triggering rate limits.
+   */
+  private _enqueueApiFetch;
+  private _fetchMain;
+  private _fetchFallback;
+  /** Route through injected fetchQuotaFn, or throw if unset. */
+  private _fetchQuota;
+  private static isAuthError;
+  /** Main quota failure: arms main-only backoff and persists via onApiError. */
+  private _handleMainFetchError;
+  /**
+   * Fallback quota failure: arms backoff for THIS account only. Never touches
+   * main backoff state and never calls onApiError (which persists the main
+   * quota error) — the per-account error is recorded by the caller via the
+   * account's lastQuotaRefreshError.
+   */
+  private _handleFallbackFetchError;
+}
+//#endregion
+//#region ../core/dist/accounts.d.ts
+type AccountQuotaWindow = {
+  usedPercent: number;
+  remainingPercent: number;
+  resetsAt?: string;
+  checkedAt: number;
+  windowMinutes?: number;
+};
+interface OAuthQuotaSnapshot {
+  primary?: AccountQuotaWindow;
+  secondary?: AccountQuotaWindow;
+  resetCreditsAvailable?: number;
+  resetCreditsApplicable?: number;
+  spendControl?: OAuthSpendControlReading;
+  /**
+   * Set when the source explicitly reported that the account has no credit
+   * budget (wham's `spend_control` or `individual_limit` is null). An absent
+   * `spendControl` alone only means the source did not carry the field: header
+   * and WebSocket pushes never do, so merges keep the previous budget for them.
+   * This marker is what lets a merge drop a budget that no longer exists.
+   */
+  spendControlCleared?: true;
+  credits?: OAuthCredits;
+}
+interface OAuthSpendControlReading {
+  limit: number;
+  used: number;
+  remaining: number;
+  usedPercent: number;
+  remainingPercent: number;
+  resetsAt?: string;
+  unit?: string;
+  source?: string;
+  reached: boolean;
+}
+interface OAuthCredits {
+  hasCredits: boolean;
+  unlimited: boolean;
+  overageLimitReached: boolean;
+  balance?: number;
+}
+type AccountBase = {
+  id: string;
+  label?: string;
+  enabled?: boolean;
+  addedAt?: number;
+  lastUsed?: number;
+  /** Stable ChatGPT account identifier extracted from the OAuth token claims. */
+  accountId?: string;
+};
+type AccountOperationError = {
+  message: string;
+  checkedAt: number;
+  nextRetryAt?: number;
+  retryCount?: number;
+  tokenHash?: string;
+};
+type OAuthAccount = AccountBase & {
+  type: 'oauth';
+  corrupt?: false;
+  access?: string;
+  refresh: string;
+  expires?: number;
+  lastRefreshedAt?: number;
+  lastRefreshError?: AccountOperationError;
+  lastQuotaRefreshError?: AccountOperationError;
+  quota?: OAuthQuotaSnapshot;
+};
+type CorruptOAuthAccount = AccountBase & {
+  type: 'oauth';
+  corrupt: true;
+  access?: undefined;
+  refresh?: undefined;
+  expires?: undefined;
+  lastRefreshedAt?: undefined;
+  lastRefreshError?: undefined;
+  lastQuotaRefreshError?: undefined;
+  quota?: undefined;
+};
+type ApiKeyAccount = AccountBase & {
+  type: 'api';
+  apiKey?: string;
+  baseURL: string;
+  authHeader?: 'authorization-bearer' | 'x-api-key';
+};
+type FallbackAccount = OAuthAccount | CorruptOAuthAccount | ApiKeyAccount;
+/**
+ * `ordered` is the shared command menu's name for plain roster order; it is
+ * written only from that menu, which needs a migrated install.
+ */
+type RoutingMode = 'ordered' | 'main-first' | 'fallback-first' | 'sticky-balanced';
+type KillswitchThresholds = Partial<Record<QuotaWindowName | '5h' | '1w', number>>;
+type KillswitchConfig = {
+  enabled?: boolean;
+  main?: KillswitchThresholds;
+  accounts?: Record<string, KillswitchThresholds>;
+  /**
+   * In a `KILLSWITCH_FLOORS_SCHEMA` block, the floors of every account the
+   * block has no entry for, so an account added after the block was written
+   * is protected without anything writing floors for it.
+   */
+  defaults?: KillswitchThresholds;
+  /**
+   * `KILLSWITCH_FLOORS_SCHEMA` once the block holds explicit per-account
+   * floors; see that constant for how the two formats differ.
+   */
+  schema?: string;
+};
+/** The cache keep-warm settings; see `cacheKeepSettings`. */
+type CacheKeepSettings = {
+  enabled?: boolean;
+  subagents?: boolean;
+  sustain?: boolean;
+  /** Clock-hour window start (0-23, inclusive) — keeps cachekeep idle warming
+   *  inside `[startHour, endHour)` local hours. Omit to warm unconditionally. */
+  startHour?: number;
+  /** Clock-hour window end (0-23, exclusive) — must differ from startHour
+   *  to be honored; an unset or equal hour falls back to "always warm". */
+  endHour?: number;
+};
+interface ResetInFlight {
+  redeemRequestId: string;
+  creditId: string;
+  startedAt: number;
+}
+interface ResetLastOutcome {
+  code: string;
+  at: number;
+  previousOutcome?: {
+    code: string;
+    at: number;
+  };
+}
+interface ResetAccountState {
+  inFlight?: ResetInFlight | Record<string, unknown>;
+  lastOutcome?: ResetLastOutcome;
+  cooldownUntil?: number;
+}
+type ResetStateByAccount = Record<string, ResetAccountState>;
+type AccountStorage = {
+  version: 1;
+  main?: {
+    type: 'opencode';
+    provider: 'openai';
+  };
+  routing?: {
+    mode?: RoutingMode;
+  };
+  fallbackOn?: number[];
+  refresh?: {
+    enabled?: boolean;
+    refreshBeforeExpiryMinutes?: number;
+    mainLastRefreshError?: AccountOperationError;
+    mainRefreshLeaseId?: string;
+    mainRefreshLeaseUntil?: number;
+    mainRefreshLeaseTokenHash?: string;
+  };
+  quota?: {
+    enabled?: boolean;
+    checkIntervalMinutes?: number;
+    refreshEveryNRequests?: number;
+    minimumRemaining?: Partial<Record<QuotaWindowName | '5h' | '1w', number>>;
+    failClosedOnUnknownQuota?: boolean;
+    mainQuota?: OAuthQuotaSnapshot;
+    mainQuotaCheckedAt?: number;
+    mainQuotaToken?: string;
+    mainLastQuotaApiError?: AccountOperationError;
   };
-  onStep?(step: string): void | Promise<void>;
-  warn?(message: string): void;
+  reset?: ResetStateByAccount;
+  dump?: {
+    enabled?: boolean;
+  };
+  costZeroing?: {
+    enabled?: boolean;
+  };
+  killswitch?: KillswitchConfig;
+  logging?: {
+    level?: string;
+  };
+  /** The older name of `cacheKeep`; read only until a settings write renames it. */
+  cachekeep?: CacheKeepSettings;
+  cacheKeep?: CacheKeepSettings;
+  /** Stable ChatGPT account identifier of the main account (extracted from OAuth token). */
+  mainAccountId?: string;
+  accounts: FallbackAccount[];
 };
+declare function loadAccounts(paths: AccountPaths): Promise<AccountStorage | null>;
+//#endregion
+//#region ../core/dist/refresh-all-quota.d.ts
+interface RefreshAllQuotaResult {
+  account: string;
+  ok: boolean;
+  error?: string;
+  /**
+   * The account cannot recover on its own: the provider has rejected its
+   * credentials, so no amount of retrying will help until the operator re-adds
+   * it.
+   *
+   * Carried as a flag rather than left for the caller to infer from `error`,
+   * because sniffing an error string for a user-facing decision breaks the
+   * moment the wording changes.
+   */
+  permanent?: boolean;
+}
 //#endregion
-//#region src/core/custody-runtime.d.ts
-type RuntimeLogger = {
-  info: (message: string, meta?: Record<string, unknown>) => void;
-  warn: (message: string, meta?: Record<string, unknown>) => void;
-  debug: (message: string, meta?: Record<string, unknown>) => void;
-  error: (message: string, meta?: Record<string, unknown>) => void;
+//#region ../core/dist/commands.d.ts
+/**
+ * The prompt-cache manager, as the Cache section uses it.
+ *
+ * Declared structurally rather than imported: the manager itself is tied to
+ * one host's live request loader and stays there. Only the members the Cache
+ * section and the host's session cleanup reach appear here.
+ */
+interface CacheKeepManager {
+  status(): {
+    running: boolean;
+    sustain: boolean;
+    window?: {
+      startHour: number;
+      endHour: number;
+    } | undefined;
+    tracked: number;
+    generatedAt: number;
+    ttlMs: number;
+    leadMs: number;
+    maxIdleWarmMs: number;
+    maxSubagentIdleMs: number;
+    targets: ReadonlyArray<{
+      sessionKey: string;
+      accountId?: string;
+      cacheExpiresAt: number;
+      lastWarmedAt?: number;
+      backoffUntil?: number;
+    }>;
+  };
+  start(): void;
+  stop(): void;
+  remove(sessionKey: string): void;
+}
+interface ResetTargetIdentity {
+  accountKey: string;
+  label: string;
+  accessToken: string;
+  chatgptAccountId?: string;
+  onAuthFailure?: (status: number) => Promise<void>;
+}
+/** One live process, on an older version, that keeps the accounts from moving to the account pool. */
+interface MigrationBlocker {
+  /** `'unknown'` when the directory of process heartbeats could not be read. */
+  pid: number | 'unknown';
+  version: string;
+}
+type MenuMigrationState = {
+  migrated: true;
+} | {
+  migrated: false;
+  blockers: readonly MigrationBlocker[];
 };
-type CustodyRuntimeOptions = {
-  /** Storage snapshot at loader time — used for the boot sweep pass. */
-  storage: AccountStorage | null;
-  configPath: string;
-  manifestPath?: string;
-  /** Test seam: the vendored detector. Production passes the real function. */
-  detectClaustrumConnection?: typeof detectClaustrumConnection;
-  /** Test seam: transport factory passed to `ClaustrumCredentialCache`. */
-  cacheConnector?: (options: {
-    connectionFile: string;
-    handshakeTimeoutMs?: number;
-  }) => Promise<ClaustrumCacheTransportLike>;
+//#endregion
+//#region src/commands.d.ts
+/** What the `/openai` menu reads and changes in this process. */
+interface OpenCodeMenuContext {
+  accountStoragePath: string;
+  /** Runtime-state file that goes with `accountStoragePath`. */
+  accountStatePath: string;
+  /** Host package version, sent as the version half of the OAuth `User-Agent`. */
+  packageVersion: string;
+  quotaManager: QuotaManager;
   loadAccounts: typeof loadAccounts;
-  mutateAccounts: typeof mutateAccounts;
-  withAccountStoreTransaction: typeof withAccountStoreTransaction;
-  readCustodyManifest: typeof readCustodyManifest;
-  acquireRefreshFileLock: typeof acquireRefreshFileLock;
-  auth?: CustodyHostAuth;
-  resolveFallbackVaultState?: (input: {
-    accountId: string;
-    handle: string;
-  }) => Promise<VaultCustodyState>;
+  /** The pool store the accounts live in. */
+  store: () => PoolStore;
+  /** Whether the install is migrated, and what holds it back when not. */
+  migration: () => Promise<MenuMigrationState>;
+  /** Starts an OAuth account-add flow; injected by the runtime boundary. */
+  beginAccountLogin?: typeof beginAccountLogin;
+  /** Actively poll quota for every account. */
+  refreshAllQuota?: () => Promise<RefreshAllQuotaResult[]>;
+  /** Refresh the sidebar-state file after a change. */
+  refreshSidebar?: () => Promise<void>;
+  /** Re-read the pool so requests route across the changed rows at once. */
+  afterWrite?: () => unknown;
+  cacheKeepManager?: CacheKeepManager | null;
+  setCacheKeepEnabled?: (enabled: boolean) => void;
+  setCacheKeepSubagents?: (enabled: boolean) => void;
+  setCacheKeepSustain?: (enabled: boolean) => void;
+  setCacheKeepWindow?: (window: {
+    startHour: number;
+    endHour: number;
+  } | undefined) => void;
+  clearStickyRouting?: (sessionId: string) => Promise<boolean>;
+  getStickyRouting?: (sessionId: string) => Promise<string | undefined>;
+  resolveResetTarget?: (accountKey: string) => Promise<ResetTargetIdentity>;
+  refreshResetTargetQuota?: (accountKey: string) => Promise<RefreshAllQuotaResult>;
+  fetchImpl?: typeof fetch;
   now?: () => number;
-  setIntervalFn?: (callback: () => void, intervalMs: number) => ReturnType<typeof setInterval>;
-  clearIntervalFn?: (handle: ReturnType<typeof setInterval>) => void;
-  onReconcileStep?: (step: 'discovery-lock-acquired' | 'enabled-manifest-join', accountId?: string) => void | Promise<void>;
-  logger: RuntimeLogger;
-};
-type ClaustrumCacheTransportLike = {
-  getCredential(handle: string, minTtlMs?: number): Promise<{
-    material: string;
-    recordVersion: number;
-    expiresAtMs: number | null;
-    accountId?: string;
-  }>;
-  statusCredential(handle: string): Promise<{
-    ready: boolean;
-    lastErrorCode: string | null;
-    leaseHeld: boolean;
-    recordVersion: number;
-  }>;
-  reportAuthFailure(params: {
-    handle: string;
-    providerStatus: number;
-    recordVersion: number;
-    reporterSource: 'direct' | 'relay_status_field' | 'relay_message_parse';
-  }): Promise<void>;
-  close(): void;
-};
-type CustodyRuntime = {
-  /** Run the initial completion sweep. Resolves BEFORE the background refresh is armed. */
-  boot(): Promise<void>;
-  /** Clear the timer and close the cache + transport. Idempotent. */
-  dispose(): void;
-  /** Force one tick pass (used by the timer and tests). */
-  runTick(): Promise<void>;
-  /** Sync projection read for the sidebar writer. */
-  getCustodyProjection(account: OAuthAccount, now: number): SidebarAccountCustody | undefined;
-  /** Whether the custody runtime is enabled for this process. */
-  isEnabled(): boolean;
-  /** Cache handle (undefined when custody is disabled). */
-  getCache(): ClaustrumCredentialCache | undefined;
-  /** Connect the cache on demand and return it. */
-  ensureCache(): Promise<ClaustrumCredentialCache | undefined>;
-  /** Transport handle (undefined when custody is disabled). */
-  getTransport(): ClaustrumCacheTransportLike | undefined;
-  /** True if the detection step produced an `available` connection file. */
-  wasDetected(): boolean;
-};
-export declare function __createCustodyRuntimeForTest(options: CustodyRuntimeOptions): CustodyRuntime;
-export declare function __resetSweepFailureLogDedupeForTest(): void;
+  randomUUID?: () => string;
+  /** This host's connection to the Claustrum vault (the Vault section). */
+  vault?: OpenAiVault;
+}
+//#endregion
+//#region src/core/background-quota-refresh.d.ts
+type TimerHandle = ReturnType<typeof setInterval>;
+interface BackgroundQuotaRefreshOptions {
+  setIntervalFn?: (callback: () => void, intervalMs: number) => TimerHandle;
+  clearIntervalFn?: (timer: TimerHandle) => void;
+  random?: () => number;
+  onError?: (error: unknown) => void;
+}
+declare class BackgroundQuotaRefresh {
+  private readonly setIntervalFn;
+  private readonly clearIntervalFn;
+  private readonly random;
+  private onError;
+  private run;
+  private timer;
+  private tickPromise;
+  private stopped;
+  constructor(options?: BackgroundQuotaRefreshOptions);
+  start(run: () => Promise<void>, onError?: ((error: unknown) => void) | undefined): void;
+  stop(): void;
+  isStopped(): boolean;
+}
 //#endregion
 //#region src/index.d.ts
+export declare const ALLOWED_MODELS: Set<string>;
+export declare const DISALLOWED_MODELS: Set<string>;
+/**
+ * Whether a model (by its API id) is offered on a ChatGPT login: the allow
+ * list, else not the deny list and a GPT version above 5.4. The caller drops
+ * `pro` reasoning variants itself. Shared by the OpenCode 1 models hook and
+ * the OpenCode 2 model transform.
+ */
+export declare function codexOAuthModelListed(apiId: string): boolean;
+/**
+ * The context window a ChatGPT login gets for a model (by its id), or
+ * undefined to keep the model's own. Shared by the OpenCode 1 models hook and
+ * the OpenCode 2 model transform.
+ */
+export declare function codexOAuthModelLimit(modelId: string): {
+  context: number;
+  input: number;
+  output: number;
+} | undefined;
 /**
  * Surfaced when a request would go to the wire with no credential.
  *
@@ -141,9 +534,13 @@ export declare function __resetSweepFailureLogDedupeForTest(): void;
  * transport log.
  */
 export declare const EMPTY_BEARER_MESSAGE = "Refusing to send a request with no access token. This is a defect in the plugin, not a problem with the provider or the account; the transport log names the account and the path that produced it.";
+export declare const RESPONSES_LITE_MODELS: ReadonlySet<string>;
+export declare const CODEX_VERSION = "0.159.0";
+export declare const CODEX_USER_AGENT = "codex_exec/0.159.0 (Debian 12.0.0; aarch64) unknown (codex_exec; 0.159.0)";
 export declare const getMainRefreshLockName: () => string;
 export declare const MAIN_REFRESH_LOCK_TTL_MS: number;
 export declare const MAIN_REFRESH_LEASE_TTL_MS = 90000;
+export declare function __bootQuotaSeedPromiseForTest(): Promise<unknown> | undefined;
 export declare function __resetBootQuotaSeedForTest(): void;
 export declare class AuthPersistError extends Error {
   readonly code = "OPENAI_AUTH_PERSIST_FAILED";
@@ -167,17 +564,32 @@ interface ResetTargetResolverDeps {
     expires: number;
   }>;
   refreshFallbackAccount: (account: OAuthAccount, storage: AccountStorage) => Promise<OAuthAccount>;
+  /**
+   * Refresh the pool row `main` while it serves as the main account. Defaults
+   * to refreshFallbackAccount.
+   */
+  refreshPoolMainRow?: (account: OAuthAccount, storage: AccountStorage) => Promise<OAuthAccount>;
+  /**
+   * On a migrated install, the pool row behind an account key (`main` is row
+   * `main`) and its usable bearer, refreshed through the pool. Undefined when
+   * the install is not migrated; the legacy slot and roster then apply.
+   */
+  poolAccess?: (accountKey: string) => Promise<PoolResetAccess | undefined>;
   loadAccounts: typeof loadAccounts;
   accountStoragePath: string;
   accountStatePath: string;
   now: () => number;
-  isFallbackRefreshInert?: (account: OAuthAccount, storage: AccountStorage) => Promise<boolean>;
-  resolveFallbackAccess?: (account: OAuthAccount, storage: AccountStorage) => ReturnType<typeof resolveFallbackAccess>;
-  reportAuthFailure?: (params: {
-    handle: string;
-    providerStatus: number;
-    recordVersion: number;
-  }) => Promise<void>;
+}
+/** A pool row as the reset-credit resolver sees it; `row` is absent when no row has the id. */
+export interface PoolResetAccess {
+  row?: {
+    id: string;
+    type: 'oauth' | 'api';
+    enabled: boolean;
+    label?: string;
+    identity?: string;
+  };
+  token?: string;
 }
 export declare function createResetTargetResolver(deps: ResetTargetResolverDeps): (accountKey: string) => Promise<ResetTargetIdentity>;
 export declare function buildResetRedemptionDeps(): {
@@ -185,27 +597,46 @@ export declare function buildResetRedemptionDeps(): {
   now: () => number;
   randomUUID: () => `${string}-${string}-${string}-${string}-${string}`;
 };
+/**
+ * Test seam: the context the latest loader run gave the `/openai` menu, so a
+ * test of the loader's live gates (keep-warm, sticky pins) can drive them on
+ * an install the menu itself would not open on.
+ */
+export declare function __menuContextForTest(): OpenCodeMenuContext | null;
+export declare const POOL_MIGRATION_ENABLED = true;
 interface CodexAuthPluginOptions {
+  /**
+   * Test seams for the background account-pool migration and adoption
+   * (`core/pool-lifecycle.ts`): its fence, timers, run functions and
+   * per-run dependencies.
+   */
+  poolMigration?: Partial<Pick<PoolLifecycleDeps, 'fence' | 'migrate' | 'adopt' | 'timers' | 'random' | 'runDeps' | 'log'>> & {
+    /** Overrides POOL_MIGRATION_ENABLED, so tests can run the migration. */
+    enabled?: boolean;
+  };
+  /** Test seam: timer functions for the background quota poller, so a test can fire its tick. */
+  backgroundQuota?: ConstructorParameters<typeof BackgroundQuotaRefresh>[0];
   issuer?: string;
   codexApiEndpoint?: string;
   experimentalWebSockets?: boolean;
   responsesLite?: boolean;
-  custody?: {
-    /** Test seam: the transport backing the loader-owned runtime. */
-    transport: ClaustrumCacheTransportLike;
-    /** Test seam: override the connection-file detection result. */
-    detection?: 'available' | 'absent';
-    /** Test seam: observes the loader-owned runtime for explicit ticks. */
-    onRuntime?: (runtime: CustodyRuntime) => void;
-    /** Test seam: controls the runtime clock for expiry-bound scenarios. */
-    now?: () => number;
-    /** Test seam: controls bounded host-write observation without real timers. */
+  /**
+   * Test seams for the Claustrum vault: its connections and the directory its
+   * token and roster live in.
+   */
+  vault?: Partial<Pick<ConstructorParameters<typeof OpenAiVault>[0], 'stateDir' | 'connectionFile' | 'connectScoped' | 'connectEnrollment' | 'pollIntervalMs'>> & {
+    /**
+     * Longest an adoption or the pool source's first quota polls wait for
+     * the vault's first roster; `VAULT_FIRST_ROSTER_BACKGROUND_WAIT_MS` by
+     * default.
+     */
+    firstRosterWaitMs?: number;
+  };
+  /** Test seams for the OAuth logins of the auth methods. */
+  login?: {
+    /** Controls the wait for the host's slot write without real timers. */
     sleep?: (ms: number) => Promise<void>;
-    /** Test seam: observes a host-write observation deadline warning. */
-    warn?: (message: string) => void;
-    /** Test seam: observes the account lock around custody binding checks. */
-    withFallbackAccountLock?: CommandContext['withFallbackAccountLock'];
-    /** Test seam: replaces external OAuth I/O while preserving the hook callback. */
+    /** Replaces external OAuth I/O while preserving the hook callback. */
     authorize?: {
       browser?: () => Promise<{
         url: string;
@@ -222,9 +653,11 @@ interface CodexAuthPluginOptions {
 }
 export declare function findCachekeepFallbackAccount(accounts: FallbackAccount[], accountId: string): OAuthAccount | undefined;
 export declare function mergePushedQuotaMetadata(incoming: OAuthQuotaSnapshot, previous: OAuthQuotaSnapshot | undefined): OAuthQuotaSnapshot;
-export declare function buildSidebarMachineState(qm: QuotaManager, store: AccountStorage, now?: number, mainAccountIdentity?: string | undefined, projectCustody?: (account: FallbackAccount, now: number) => SidebarAccountCustody | undefined): SidebarMachineState;
+export declare function buildSidebarMachineState(qm: QuotaManager, store: AccountStorage, now?: number, mainAccountIdentity?: string | undefined): SidebarMachineState;
 export declare function buildSidebarState(qm: QuotaManager, store: AccountStorage, activeId: string, now?: number): SidebarState;
 export declare function resolveSidebarSessionId(headers: Headers): string | undefined;
+export declare const MID_CONVERSATION_EFFORT_MODELS: ReadonlySet<string>;
+export declare function rewriteResponsesLiteBody(parsed: Record<string, unknown>): void;
 export declare function CodexAuthPlugin(input: PluginInput, options?: CodexAuthPluginOptions): Promise<Hooks>;
 export declare const OpenAIAuthPlugin: Plugin;
 declare const _default: {
@@ -232,4 +665,4 @@ declare const _default: {
   server: Plugin;
 };
 //#endregion
-export { type ClaustrumCacheTransportLike, type CustodyRuntime, type CustodyRuntimeOptions, type IdTokenClaims, _default as default, extractAccountIdFromClaims, parseJwtClaims };
+export { type IdTokenClaims, _default as default, extractAccountIdFromClaims, parseJwtClaims };