@cortexkit/opencode-openai-auth 0.7.2 → 0.8.0

package/src/tui-compiled/shared/paths.ts

@@ -0,0 +1,33 @@
+/**
+ * Pure path values shared by every host.
+ *
+ * Nothing here reads an environment variable or knows where a host keeps its
+ * configuration. A host resolves its own two file paths and hands them to the
+ * store as an `AccountPaths`; the only thing that must not drift between hosts
+ * is the file name itself, which is why the constants live here rather than in
+ * each host's own resolver.
+ */
+
+import { basename, dirname, join } from 'node:path'
+
+export const ACCOUNT_FILE_NAME = 'openai-auth.json'
+export const ACCOUNT_STATE_FILE_NAME = 'openai-auth-state.json'
+
+/**
+ * The config file and the runtime-state file a store operation reads and writes.
+ *
+ * Both are required. A store function never derives one from the other, because
+ * a host may point its state file somewhere the derivation would not reach and
+ * a silently derived path would lock one file while writing another.
+ */
+export interface AccountPaths {
+  configPath: string
+  statePath: string
+}
+
+/** Derive the state-file path from the config path without reading env vars. */
+export function deriveStatePath(configPath: string): string {
+  return basename(configPath) === ACCOUNT_FILE_NAME
+    ? join(dirname(configPath), ACCOUNT_STATE_FILE_NAME)
+    : `${configPath}.state.json`
+}

package/src/{core → tui-compiled/shared}/refresh-file-lock.ts

@@ -1,7 +1,6 @@
 import { randomUUID } from 'node:crypto'
 import { mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises'
 import { dirname, join } from 'node:path'
-import { getAccountStoragePath } from './account-paths'
 
 const setRefreshLockRenewalTimeout = globalThis.setTimeout.bind(globalThis)
 const clearRefreshLockRenewalTimeout = globalThis.clearTimeout.bind(globalThis)
@@ -18,7 +17,12 @@ export function isLostMarkerRaceError(error: unknown): boolean {
 export async function acquireRefreshFileLock(options: {
   name: string
   ttlMs: number
-  path?: string
+  /**
+   * File the lock is named after. Required: the lock and the write it guards
+   * must target the same file, and a default resolved in here could only ever
+   * be one host's path.
+   */
+  path: string
   now?: () => number
   renew?: boolean
   renewIntervalMs?: number
@@ -37,8 +41,7 @@ export async function acquireRefreshFileLock(options: {
       | 'release-owner-confirmed',
   ) => void | Promise<void>
 }): Promise<{ release: () => Promise<void> } | null> {
-  const accountPath = options.path ?? getAccountStoragePath()
-  const lockPath = `${accountPath}.${options.name}.lock`
+  const lockPath = `${options.path}.${options.name}.lock`
   const legacyOwnerPath = join(lockPath, 'owner.json')
   const ownerId = randomUUID()
   const now = options.now ?? Date.now

package/dist/cli.d.ts

@@ -1,2 +0,0 @@
-#!/usr/bin/env node
-export { openUrl as openBrowserForLogin } from './util/open-url';

package/dist/cli.js

@@ -1,15 +0,0 @@
-#!/usr/bin/env node
-import{J as C,K as E,L as X,r as $,y as q,z as B}from"./index-cfjed1st.js";import{ua as Y}from"./index-8f1200qx.js";import"./index-nrvjr97q.js";import{Ka as Z}from"./index-zxqb5ydj.js";import{execFileSync as U}from"node:child_process";function V(z,K=process.platform,H=U){try{if(K==="win32"){H("cmd",["/c","start","",z],{stdio:"ignore",timeout:3000});return}H(K==="darwin"?"open":"xdg-open",[z],{stdio:"ignore",timeout:3000})}catch{}}function W(){console.log(`Usage:
-  npx @cortexkit/opencode-openai-auth login [--label <name>] [--headless]
-  npx @cortexkit/opencode-openai-auth list
-  npx @cortexkit/opencode-openai-auth remove <id>
-
-Fallback accounts are stored in:
-  ${Y()}`)}function P(z){let K=[],H={};for(let N=0;N<z.length;N++){let j=z[N];if(!j)continue;if(j.startsWith("--")){let J=j.slice(2),D=z[N+1];if(D&&!D.startsWith("--"))H[J]=D,N++;else H[J]=!0}else K.push(j)}return{positional:K,flags:H}}async function R(){let{positional:z,flags:K}=P(process.argv.slice(2)),[H,...N]=z;if(!H||H==="help")W(),process.exit(0);switch(H){case"login":{let j=typeof K.label==="string"?K.label:void 0,J=Boolean(K.headless);try{$(j)}catch(G){console.error(`
-Error: ${G instanceof Error?G.message:String(G)}`),process.exit(1)}let{url:D,instructions:M,completion:T}=await B({label:j,headless:J});if(console.log(`
-Open this URL in your browser and complete sign-in:
-`),console.log(`${D}
-`),M)console.log(`${M}
-`);V(D);let O=await T,Q=!1;if(await X((G)=>{if(O.accountId&&G.mainAccountId&&O.accountId===G.mainAccountId)return Q=!0,G;return q(G.accounts,O),G}),Q)console.error(`
-Error: that account is already your main (same ChatGPT account).`),console.error("A self-fallback would retry on the account that just returned 429."),process.exit(1);if(console.log(`
-✓ Added account ${O.id}`),O.label)console.log(`  Label: ${O.label}`);break}case"list":{let j=await E();if(!j||j.accounts.length===0)console.log("No fallback accounts configured.");else for(let J of j.accounts){let D=J.label,M=[`  ${J.id}`];if(D)M.push(`(${D})`);M.push(J.enabled!==!1?"[enabled]":"[disabled]"),console.log(M.join(" "))}break}case"remove":{let j=N[0];if(!j)console.error("Error: remove requires an account ID."),W(),process.exit(1);let J=Y(),D=await C(J),M=D?D.has(j):!1,T=!1;if(await X((Q)=>{let G=Q.accounts.findIndex((L)=>L.id===j);if(G===-1)return Q;return Q.accounts.splice(G,1),T=!0,Q},J,{allowDrop:[j]}),!(T||M))console.error(`No account with id "${j}".`),process.exit(1);console.log(`Removed account ${j}.`);break}default:console.error(`Unknown command: ${H}`),W(),process.exit(1)}}if(Z.main==Z.module)R().catch((z)=>{console.error(z instanceof Error?z.message:String(z)),process.exit(1)});export{V as openBrowserForLogin};

package/dist/codex-http.d.ts

@@ -1,3 +0,0 @@
-export declare function hasWebSocketResponsesLiteMetadata(body: BodyInit | null | undefined): boolean;
-export declare function sanitizeHttpFallbackBody(body: BodyInit | null | undefined): string | ArrayBuffer | ArrayBufferView<ArrayBuffer> | Blob | FormData | ReadableStream<any> | URLSearchParams | null | undefined;
-export declare function sanitizeHttpFallbackInit(init: RequestInit | undefined): RequestInit | undefined;

package/dist/commands.d.ts

@@ -1,88 +0,0 @@
-import { type loadAccounts as defaultLoadAccounts } from './core/accounts';
-import type { CacheKeepManager, CacheKeepWindow } from './core/cachekeep';
-import type { QuotaManager } from './core/quota-manager';
-import type { RefreshAllQuotaResult } from './core/refresh-all-quota';
-import { type RunResetCreditResult } from './core/reset-credits';
-import type { ApplyRequest, ApplyResult, CommandModalName, OpenDialogPayload } from './rpc/protocol';
-export declare const OPENAI_QUOTA_COMMAND_NAME = "openai-quota";
-export declare const OPENAI_ACCOUNT_COMMAND_NAME = "openai-account";
-export declare const OPENAI_ROUTING_COMMAND_NAME = "openai-routing";
-export declare const OPENAI_KILLSWITCH_COMMAND_NAME = "openai-killswitch";
-export declare const OPENAI_DUMP_COMMAND_NAME = "openai-dump";
-export declare const OPENAI_LOGGING_COMMAND_NAME = "openai-logging";
-export declare const OPENAI_CACHEKEEP_COMMAND_NAME = "openai-cachekeep";
-export declare const OPENAI_RESET_COMMAND_NAME = "openai-reset";
-export declare const MODAL_COMMANDS: CommandModalName[];
-export interface CommandContext {
-    accountStoragePath: string;
-    quotaManager: QuotaManager;
-    loadAccounts: typeof defaultLoadAccounts;
-    client: {
-        auth: {
-            set: (input: {
-                path: {
-                    id: string;
-                };
-                body: {
-                    type: string;
-                    access?: string;
-                    refresh: string;
-                    expires?: number;
-                };
-            }) => Promise<unknown>;
-        };
-    };
-    /** Session ID for pushNotification delivery. */
-    sessionId?: string;
-    /** If set, pushNotification is wired up and can deliver feedback to the user. */
-    notify?: (payload: OpenDialogPayload) => void;
-    /** Refresh the sidebar-state file so the TUI modal shows current data. */
-    refreshSidebar?: () => Promise<void>;
-    /** Actively poll wham/usage for all accounts (main + fallbacks). */
-    refreshAllQuota?: () => Promise<RefreshAllQuotaResult[]>;
-    /** Prompt-cache cachekeep manager. Set when the command is wired. */
-    cacheKeepManager?: CacheKeepManager | null;
-    /** Updates the live loader's persisted-enabled cachekeep gate. */
-    setCacheKeepEnabled?: (enabled: boolean) => void;
-    /** Updates the live loader's persisted-subagent cachekeep gate. */
-    setCacheKeepSubagents?: (enabled: boolean) => void;
-    /** Updates the live loader's main-agent idle-cap bypass gate. */
-    setCacheKeepSustain?: (enabled: boolean) => void;
-    /** Updates the live loader's clock-hour warm window. undefined = no window. */
-    setCacheKeepWindow?: (window: CacheKeepWindow | undefined) => void;
-    /** Clears only the sticky account assignment for one OpenCode session. */
-    clearStickyRouting?: (sessionId: string) => Promise<boolean>;
-    /** Resolves the current session's usable sticky account, if one exists. */
-    getStickyRouting?: (sessionId: string) => Promise<string | undefined>;
-    resolveResetTarget?: (accountKey: string) => Promise<ResetTargetIdentity>;
-    fetchImpl?: typeof fetch;
-    now?: () => number;
-    randomUUID?: () => string;
-    refreshResetTargetQuota?: (accountKey: string) => Promise<RefreshAllQuotaResult>;
-}
-export interface ResetTargetIdentity {
-    accountKey: string;
-    label: string;
-    accessToken: string;
-    chatgptAccountId?: string;
-}
-type ResetCommandContext = CommandContext & Required<Pick<CommandContext, 'resolveResetTarget' | 'fetchImpl' | 'now' | 'randomUUID' | 'refreshResetTargetQuota'>>;
-export declare function renderResetCoordinatorResult(result: RunResetCreditResult, ctx: ResetCommandContext, boundChatgptAccountId?: string): Promise<OpenDialogPayload>;
-/**
- * Strip credential-shaped fields from a dialog payload's knobs.
- *
- * Knobs are returned across the loopback RPC and JSON-serialized to the TUI, so
- * a knob is a published surface. Individual commands project their own knobs
- * deliberately (see accountKnob), but this is the boundary backstop: a future
- * command that returns a stored object directly cannot leak credentials even if
- * the projection is forgotten, because nothing credential-shaped survives here.
- *
- * Scrub rather than throw. A rejected dialog is a visible outage for a live
- * command, while a scrubbed one keeps working with the leak removed; the warning
- * is what gets the projection fixed. Recurses into nested objects and arrays,
- * since the account list arrives as an array of records.
- */
-export declare function scrubKnobs(value: unknown, path: string, found: string[]): unknown;
-export declare function buildDialogPayload(command: CommandModalName, args: string, ctx: CommandContext): Promise<OpenDialogPayload>;
-export declare function applyCommand(request: ApplyRequest, ctx: CommandContext): Promise<ApplyResult>;
-export {};

package/dist/config.d.ts

@@ -1,47 +0,0 @@
-export declare const DEFAULT_CODEX_API_ENDPOINT = "https://chatgpt.com/backend-api/codex/responses";
-/** Shape of ~/.config/opencode/openai-auth.json (all fields optional). */
-export interface OpenAIAuthConfig {
-    /** Inject the native web_search tool to keep the Codex prompt cache stable. Default true. */
-    webSearch?: boolean;
-    /** Use the WebSocket transport for /responses instead of plain HTTP. Default false. */
-    webSockets?: boolean;
-    /** Use the hand-rolled raw TCP/TLS WebSocket client (incremental streaming). Default false. */
-    rawWebSocket?: boolean;
-    /** Use Codex's Responses Lite request shape. Default false. */
-    responsesLite?: boolean;
-    /** Dump final Codex request bodies for cache debugging. Default false. */
-    dump?: boolean | {
-        enabled?: boolean;
-    };
-    /** Directory for request dumps. Defaults to the OS temp directory. */
-    dumpDir?: string;
-    /** Codex-compatible Responses endpoint. Defaults to ChatGPT's Codex backend. */
-    codexApiEndpoint?: string;
-}
-export interface ResolvedSettings {
-    webSearch: boolean;
-    webSockets: boolean;
-    rawWebSocket: boolean;
-    responsesLite: boolean;
-    dump: boolean;
-    dumpDir: string;
-    codexApiEndpoint: string;
-}
-export declare function getConfigDir(): string;
-export declare function getConfigPath(): string;
-/**
- * Resolved settings, memoized per process.
- *
- * Env and the config file are read once because neither changes under a running
- * process — except through a command that writes the config itself. Those
- * commands must call `refreshSettings()`, or the process keeps serving the
- * values it read at startup while the file on disk says otherwise.
- */
-export declare function getSettings(): ResolvedSettings;
-/**
- * Drop the memoized settings after a command writes the config file, so the
- * running process picks the change up without a restart.
- */
-export declare function refreshSettings(): ResolvedSettings;
-/** Test-only: drop the memoized settings so a later getSettings() re-reads env + config. */
-export declare function resetSettingsForTest(): void;

package/dist/core/account-paths.d.ts

@@ -1,25 +0,0 @@
-/**
- * Where the account store lives.
- *
- * This is the ONLY definition. It used to be duplicated verbatim in both
- * `accounts.ts` and `refresh-file-lock.ts`, because `accounts.ts` imports the
- * lock and the reverse import would have been a cycle. Two copies of a path
- * resolver is a bad trade for that: the lock and the write must agree on the
- * exact file, and if the copies ever drifted, a writer would take a lock on one
- * path while writing another — mutual exclusion silently lost on a file holding
- * credentials. Nothing would fail a test, since each copy works on its own.
- *
- * This module imports nothing from either side, so both can depend on it.
- */
-export declare const ACCOUNT_FILE_NAME = "openai-auth.json";
-export declare const ACCOUNT_STATE_FILE_NAME = "openai-auth-state.json";
-export declare function getAccountStoragePath(): string;
-/** Derive the state-file path from the config path without reading env vars. */
-export declare function deriveStatePath(configPath: string): string;
-/**
- * Detect path aliases without requiring either file to exist. This is defense
- * in depth: hardlinks and bind mounts can still make distinct paths share a
- * file, because neither is distinguishable through pathname identity.
- */
-export declare function accountPathsCollide(configPath: string, statePath: string, platform?: NodeJS.Platform): boolean;
-export declare function getAccountStatePath(configPath?: string): string;

package/dist/core/accounts.d.ts

@@ -1,330 +0,0 @@
-import { ACCOUNT_FILE_NAME, ACCOUNT_STATE_FILE_NAME, deriveStatePath, getAccountStatePath, getAccountStoragePath } from './account-paths';
-import type { ProviderQuotaFn, ProviderRefreshFn, QuotaWindowName } from './provider.ts';
-import { PRIMARY, SECONDARY } from './provider.ts';
-export { ACCOUNT_FILE_NAME, ACCOUNT_STATE_FILE_NAME, deriveStatePath, getAccountStatePath, getAccountStoragePath, };
-export type { QuotaWindowName };
-export { PRIMARY, SECONDARY };
-export type AccountQuotaWindow = {
-    usedPercent: number;
-    remainingPercent: number;
-    resetsAt?: string;
-    checkedAt: number;
-    windowMinutes?: number;
-};
-export interface OAuthQuotaSnapshot {
-    primary?: AccountQuotaWindow;
-    secondary?: AccountQuotaWindow;
-    resetCreditsAvailable?: number;
-    resetCreditsApplicable?: number;
-}
-export type AccountBase = {
-    id: string;
-    label?: string;
-    enabled?: boolean;
-    addedAt?: number;
-    lastUsed?: number;
-    /** Stable ChatGPT account identifier extracted from the OAuth token claims. */
-    accountId?: string;
-};
-export type AccountOperationError = {
-    message: string;
-    checkedAt: number;
-    nextRetryAt?: number;
-    retryCount?: number;
-    tokenHash?: string;
-};
-export type OAuthAccount = AccountBase & {
-    type: 'oauth';
-    access?: string;
-    refresh: string;
-    expires?: number;
-    lastRefreshedAt?: number;
-    lastRefreshError?: AccountOperationError;
-    lastQuotaRefreshError?: AccountOperationError;
-    quota?: OAuthQuotaSnapshot;
-};
-export type ApiKeyAccount = AccountBase & {
-    type: 'api';
-    apiKey?: string;
-    baseURL: string;
-    authHeader?: 'authorization-bearer' | 'x-api-key';
-};
-export type FallbackAccount = OAuthAccount | ApiKeyAccount;
-export declare function isOAuthAccount(account: FallbackAccount): account is OAuthAccount;
-export declare function isApiKeyAccount(account: FallbackAccount): account is ApiKeyAccount;
-export declare function isValidApiBaseURL(value: string | undefined): boolean;
-export type RoutingMode = 'main-first' | 'fallback-first' | 'sticky-balanced';
-export type KillswitchThresholds = Partial<Record<QuotaWindowName | '5h' | '1w', number>>;
-export type KillswitchConfig = {
-    enabled?: boolean;
-    main?: KillswitchThresholds;
-    accounts?: Record<string, KillswitchThresholds>;
-};
-export interface ResetInFlight {
-    redeemRequestId: string;
-    creditId: string;
-    startedAt: number;
-}
-export interface ResetLastOutcome {
-    code: string;
-    at: number;
-    previousOutcome?: {
-        code: string;
-        at: number;
-    };
-}
-export interface ResetAccountState {
-    inFlight?: ResetInFlight | Record<string, unknown>;
-    lastOutcome?: ResetLastOutcome;
-    cooldownUntil?: number;
-}
-export type ResetStateByAccount = Record<string, ResetAccountState>;
-export type AccountStorage = {
-    version: 1;
-    main?: {
-        type: 'opencode';
-        provider: 'openai';
-    };
-    routing?: {
-        mode?: RoutingMode;
-    };
-    fallbackOn?: number[];
-    refresh?: {
-        enabled?: boolean;
-        intervalMinutes?: number;
-        refreshBeforeExpiryMinutes?: number;
-        mainLastRefreshError?: AccountOperationError;
-        mainRefreshLeaseId?: string;
-        mainRefreshLeaseUntil?: number;
-        mainRefreshLeaseTokenHash?: string;
-    };
-    quota?: {
-        enabled?: boolean;
-        checkIntervalMinutes?: number;
-        refreshEveryNRequests?: number;
-        minimumRemaining?: Partial<Record<QuotaWindowName | '5h' | '1w', number>>;
-        failClosedOnUnknownQuota?: boolean;
-        showToasts?: boolean;
-        mainQuota?: OAuthQuotaSnapshot;
-        mainQuotaCheckedAt?: number;
-        mainQuotaToken?: string;
-        mainLastQuotaApiError?: AccountOperationError;
-    };
-    reset?: ResetStateByAccount;
-    dump?: {
-        enabled?: boolean;
-    };
-    costZeroing?: {
-        enabled?: boolean;
-    };
-    killswitch?: KillswitchConfig;
-    logging?: {
-        level?: string;
-    };
-    cachekeep?: {
-        enabled?: boolean;
-        subagents?: boolean;
-        sustain?: boolean;
-        /** Clock-hour window start (0-23, inclusive) — keeps cachekeep idle warming
-         *  inside `[startHour, endHour)` local hours. Omit to warm unconditionally. */
-        startHour?: number;
-        /** Clock-hour window end (0-23, exclusive) — must differ from startHour
-         *  to be honored; an unset or equal hour falls back to "always warm". */
-        endHour?: number;
-    };
-    /** Stable ChatGPT account identifier of the main account (extracted from OAuth token). */
-    mainAccountId?: string;
-    accounts: FallbackAccount[];
-};
-export declare function isCostZeroingEnabled(storage: Pick<AccountStorage, 'costZeroing'>): boolean;
-export type AccountRuntimeEntry = Partial<Pick<OAuthAccount, 'access' | 'refresh' | 'expires' | 'lastUsed' | 'lastRefreshedAt' | 'lastRefreshError' | 'lastQuotaRefreshError' | 'quota'> & Pick<ApiKeyAccount, 'apiKey' | 'lastUsed'>>;
-export type AccountRuntimeState = {
-    version: 1;
-    main?: {
-        quota?: OAuthQuotaSnapshot;
-        quotaCheckedAt?: number;
-        quotaToken?: string;
-        lastQuotaApiError?: AccountOperationError;
-        lastRefreshError?: AccountOperationError;
-        refreshLeaseId?: string;
-        refreshLeaseUntil?: number;
-        refreshLeaseTokenHash?: string;
-    };
-    accounts?: Record<string, AccountRuntimeEntry>;
-};
-export type AccountStateSaveScope = {
-    mainQuota?: boolean;
-    mainRefresh?: boolean;
-    accounts?: true | string[];
-};
-export type AccountManagerOptions = {
-    now?: () => number;
-    fetchImpl?: typeof fetch;
-    configPath?: string;
-    onFallbackStorageChanged?: () => void;
-    /** Provider token-refresh function (constructor-injected). */
-    refreshFn?: ProviderRefreshFn;
-    /** Provider quota-fetch function (constructor-injected, OPTIONAL wham/usage supplement). */
-    fetchQuotaFn?: ProviderQuotaFn;
-    /** QuotaManager instance for unified cache (constructor-injected). */
-    quotaManager?: import('./quota-manager.ts').QuotaManager;
-};
-export type AccountRefreshError = {
-    accountId: string;
-    message: string;
-};
-export declare class AccountRemovedDuringRefreshError extends Error {
-    readonly code = "ACCOUNT_REMOVED_DURING_REFRESH";
-    constructor(accountId: string);
-}
-export declare const DEFAULT_KILLSWITCH_THRESHOLDS: {
-    primary: number;
-    secondary: number;
-};
-export declare function isSafeResetAccountKey(accountKey: string): boolean;
-/**
- * The set of account ids present in the CONFIG file (the authoritative account
- * roster). Returns null when the config is absent or unreadable/malformed, so
- * callers can fall back to non-pruning behavior rather than risk wiping live
- * state. The config never holds secrets (see accountConfig), so reading it here
- * is safe. Reads are lock-free but the file is written atomically, so a
- * concurrent write is seen as either the complete old or complete new file.
- *
- * Trims and skips blank ids per the rule in collectConfigRosterIds above.
- */
-export declare function readConfigRosterIds(path: string): Promise<Set<string> | null>;
-export declare function loadAccounts(path?: string): Promise<AccountStorage | null>;
-export declare function saveAccounts(storage: AccountStorage, path?: string): Promise<void>;
-/**
- * Read-modify-write the account store atomically under the save lock.
- *
- * Unlike saveAccounts (which UNION-merges the incoming accounts with the latest
- * on-disk set so concurrent ADDS from another process are never lost), this
- * reads the freshest state under the lock and writes the mutator's result
- * AUTHORITATIVELY — no union. That is required for structural edits (remove,
- * reorder): a union cannot express a deletion (the removed id reappears from
- * `latest`) or a reordering (the union is seeded latest-first). Because the
- * mutator runs against freshly-read state under the lock, an add committed by a
- * concurrent process is still visible to it and preserved.
- *
- * The mutator may edit `current` in place and return it, or return a new
- * storage object. Returning undefined means "no change" and still rewrites the
- * freshly-read state (a harmless idempotent write).
- *
- * Load-time drop preservation: if normalizeAccount (called inside
- * normalizeStorage) rejects an account whose id IS in the raw config roster,
- * the previous behavior would erase that id silently on the next write. This
- * function now carries the dropped raw entry through to the written config
- * verbatim, so the on-disk state always matches the operator's intent (an
- * account they added, even if temporarily un-loadable, stays in their list
- * until they deliberately remove it).
- *
- * Removal seam: when the caller knows they are removing an id (e.g. the CLI
- * `remove` command) and that id may be load-dropped — in which case the
- * mutator cannot find it in `current.accounts` to splice it — the caller can
- * pass `options.allowDrop: [id]`. Ids in `allowDrop` are NOT preserved; the
- * mutator's splice still no-ops on a dropped id, but the absence of
- * preservation completes the removal end-to-end.
- */
-export declare function mutateAccounts(mutate: (current: AccountStorage) => AccountStorage | undefined, path?: string, options?: {
-    allowDrop?: readonly string[];
-}): Promise<AccountStorage>;
-export declare function saveAccountState(storage: AccountStorage, path?: string, scope?: AccountStateSaveScope): Promise<void>;
-export declare function shouldFallbackStatus(status: number, storage: AccountStorage | null): boolean;
-export declare function quotaSnapshotPassesPolicy(quota: OAuthQuotaSnapshot | undefined, storage: AccountStorage | null, now?: number): boolean;
-export declare function isKillswitchEnabled(storage: AccountStorage | null): boolean;
-export declare function getKillswitchThresholdsForAccount(storage: AccountStorage | null, accountId?: string): {
-    primary: number;
-    secondary: number;
-};
-export declare function killswitchPassesPolicy(quota: OAuthQuotaSnapshot | undefined, storage: AccountStorage | null, accountId?: string, now?: number): boolean;
-export declare function killswitchRetryAfterSeconds(mainQuota: OAuthQuotaSnapshot | undefined, fallbackAccounts: Array<{
-    accountId: string;
-    quota?: OAuthQuotaSnapshot;
-}>, now: number, storage: AccountStorage | null): number;
-/**
- * Migrate an existing single-slot token into the multi-account store.
- *
- * Reads the existing token via the caller-provided `getAuth` (the ONLY
- * read path — there is no `client.auth.get`). If a token exists and the
- * config file is NOT yet an account store (content discriminator), seeds
- * it as the primary OAuth account.
- *
- * Idempotent: a second run is a no-op because the content discriminator
- * will already match.
- *
- * Tolerates expired/revoked tokens (migrates them; refresh handles validity).
- *
- * Guards against first-run races with the same save-lock order used by
- * structural account mutations.
- */
-export declare function migrateIfNeeded(existingToken: {
-    type: 'oauth';
-    access: string;
-    refresh: string;
-    expires: number;
-} | undefined, path?: string): Promise<void>;
-export declare function getQuotaCheckIntervalMs(storage: AccountStorage | null): number;
-export declare function getRefreshIntervalMs(storage: AccountStorage | null): number;
-export declare class FallbackAccountManager {
-    private readonly now;
-    private readonly fetchImpl;
-    private readonly configPath;
-    private readonly refreshPromises;
-    private refreshTimer;
-    private quotaTimer;
-    readonly quotaManager: import('./quota-manager.ts').QuotaManager | null;
-    private readonly onFallbackStorageChanged;
-    private readonly options;
-    constructor(options?: AccountManagerOptions);
-    /**
-     * Seed QuotaManager from persisted account.quota if no cache entry exists
-     * yet. Prevents unnecessary API calls when the on-disk snapshot is fresh.
-     */
-    private seedFallbackQuota;
-    load(): Promise<AccountStorage | null>;
-    save(storage: AccountStorage, accountIds?: string[]): Promise<void>;
-    startBackgroundRefresh(): void;
-    stopBackgroundRefresh(): void;
-    getUsableFallbackAccounts(existingStorage?: AccountStorage | null): Promise<OAuthAccount[]>;
-    /**
-     * Stamp `lastUsed` on a served account.
-     *
-     * This runs on the request path after a response is already in hand, and
-     * `lastUsed` is telemetry: nothing reads it to make a routing, quota, or
-     * killswitch decision. The WHOLE operation is therefore best-effort, read
-     * included — loadAccounts deliberately rethrows anything that is not ENOENT so
-     * corruption surfaces to callers that must act on it, and a store lock shared
-     * by every session in the host process can legitimately time out under a burst
-     * of concurrent turns. Neither may reach this caller: it would discard a
-     * successful, already-billed provider response to record a timestamp. Losing
-     * the stamp costs nothing a later turn cannot redo.
-     *
-     * Contrast refreshAccount, whose save persists rotated tokens and MUST
-     * propagate: dropping it silently would strand a refresh and invalidate the
-     * account's credentials.
-     */
-    markUsed(account: FallbackAccount): Promise<void>;
-    accountPassesQuotaPolicy(account: OAuthAccount, storage: AccountStorage | null): boolean;
-    /**
-     * Return the account with its quota overlaid from the unified QuotaManager
-     * cache (token-bound) when available, so quota-policy decisions use the same
-     * source of truth as the staleness check. Falls back to the stored
-     * account.quota when no manager is wired or the cache has no entry.
-     */
-    private quotaPolicyAccount;
-    refreshDueAccounts(): Promise<void>;
-    refreshQuotaForDueAccounts(): Promise<void>;
-    refreshQuotaForAllAccounts(options?: {
-        force?: boolean;
-    }): Promise<{
-        storage: AccountStorage | null;
-        errors: AccountRefreshError[];
-    }>;
-    refreshAccount(account: OAuthAccount, storage: AccountStorage, options?: {
-        force?: boolean;
-    }): Promise<OAuthAccount>;
-    private waitForConcurrentFallbackRefresh;
-    private refreshAccountNow;
-    refreshAccountQuota(account: OAuthAccount, storage: AccountStorage): Promise<void>;
-}

package/dist/core/atomic-write.d.ts

@@ -1 +0,0 @@
-export declare function writeJsonAtomic(path: string, value: unknown): Promise<void>;

package/dist/core/background-quota-refresh.d.ts

@@ -1,46 +0,0 @@
-import { type RefreshAllQuotaDeps, type RefreshAllQuotaResult } from './refresh-all-quota';
-export declare const BACKGROUND_QUOTA_REFRESH_INTERVAL_MS: number;
-export declare const BACKGROUND_QUOTA_REFRESH_JITTER_MS = 30000;
-export declare const BACKGROUND_QUOTA_FRESHNESS_MS: number;
-export declare const BACKGROUND_QUOTA_REFRESH_LOCK_NAME = "bg-quota-refresh";
-export declare const BACKGROUND_QUOTA_REFRESH_LOCK_TTL_MS = 120000;
-type TimerHandle = ReturnType<typeof setInterval>;
-interface BackgroundQuotaRefreshOptions {
-    setIntervalFn?: (callback: () => void, intervalMs: number) => TimerHandle;
-    clearIntervalFn?: (timer: TimerHandle) => void;
-    random?: () => number;
-    onError?: (error: unknown) => void;
-}
-type RefreshAllQuotaFn = (deps: RefreshAllQuotaDeps) => Promise<RefreshAllQuotaResult[]>;
-type BackgroundLockHandle = {
-    release: () => Promise<void>;
-};
-export type BackgroundLockAcquirer = () => Promise<BackgroundLockHandle | null>;
-/**
- * Acquire the cross-process lock that serializes the background refresh.
- * `renew` re-arms the TTL on an interval until release(), so a serial pass that
- * outlasts the TTL (a fleet of accounts each costing a token refresh plus a
- * wham fetch) never lets the lock expire mid-run — an expiry would let a second
- * process start a concurrent refresh. Overrides exist so tests can drive the
- * renewal with a mock clock and a fast interval.
- */
-export declare function acquireBackgroundRefreshLock(configPath: string, overrides?: {
-    now?: () => number;
-    renewIntervalMs?: number;
-}): Promise<BackgroundLockHandle | null>;
-export declare function refreshQuotaInBackground(deps: RefreshAllQuotaDeps, refreshFn?: RefreshAllQuotaFn, acquireLock?: BackgroundLockAcquirer): Promise<RefreshAllQuotaResult[]>;
-export declare class BackgroundQuotaRefresh {
-    private readonly setIntervalFn;
-    private readonly clearIntervalFn;
-    private readonly random;
-    private onError;
-    private run;
-    private timer;
-    private tickPromise;
-    private stopped;
-    constructor(options?: BackgroundQuotaRefreshOptions);
-    start(run: () => Promise<void>, onError?: ((error: unknown) => void) | undefined): void;
-    stop(): void;
-    isStopped(): boolean;
-}
-export {};