@cortexkit/opencode-openai-auth 0.7.2 → 0.8.0

package/dist/core/backoff.d.ts

@@ -1,53 +0,0 @@
-export declare const NON_TRANSIENT_REFRESH_RETRY_DELAY_MS: number;
-export declare function isTransientRefreshError(error: unknown): boolean;
-export declare function isTransientQuotaError(error: unknown): boolean;
-export declare function hashRefreshToken(refreshToken: string): string;
-export declare function buildRefreshOperationError(input: {
-    error: unknown;
-    now: number;
-    refreshToken: string;
-    previous?: {
-        message: string;
-        checkedAt: number;
-        nextRetryAt?: number;
-        retryCount?: number;
-        tokenHash?: string;
-    };
-}): {
-    message: string;
-    checkedAt: number;
-    nextRetryAt: number;
-    retryCount: number;
-    tokenHash: string;
-};
-export declare function refreshBackoffActive(error: {
-    nextRetryAt?: number;
-    tokenHash?: string;
-} | undefined, refreshToken: string | undefined, now: number): boolean;
-export declare function formatRefreshBackoffMessage(error: {
-    message: string;
-    nextRetryAt?: number;
-}, now: number): string;
-export declare function buildQuotaOperationError(input: {
-    error: unknown;
-    now: number;
-    previous?: {
-        message: string;
-        checkedAt: number;
-        nextRetryAt?: number;
-        retryCount?: number;
-    };
-}): {
-    message: string;
-    checkedAt: number;
-    nextRetryAt: number;
-    retryCount: number;
-};
-export declare function quotaBackoffActive(error: {
-    nextRetryAt?: number;
-} | undefined, now: number): boolean;
-export declare function formatQuotaBackoffMessage(error: {
-    message: string;
-    nextRetryAt?: number;
-}, now: number): string;
-export declare function parseRetryAfter(value: string | undefined | null): number | undefined;

package/dist/core/cachekeep.d.ts

@@ -1,118 +0,0 @@
-import type { AccountStorage } from './accounts.ts';
-export type CacheKeepWindow = {
-    startHour: number;
-    endHour: number;
-};
-export interface Target {
-    bodyText: string;
-    accountId: string | undefined;
-    chatgptAccountId?: string;
-    route: 'main';
-    cacheExpiresAt: number;
-    ttlMs: number;
-    warmCount: number;
-    lastRealRequestAt: number;
-    lastWarmedAt?: number;
-    backoffUntil?: number;
-    replayHeaders: Record<string, string>;
-    isSubagent?: boolean;
-    is56: boolean;
-}
-export interface CacheKeepManagerOptions {
-    fetchImpl: typeof fetch;
-    getMainToken: () => Promise<string>;
-    refreshFallback: (accountId: string) => Promise<string>;
-    codexResponsesUrl: string;
-    logger: {
-        info: (msg: string, data?: unknown) => void;
-        warn: (msg: string, data?: unknown) => void;
-        debug: (msg: string, data?: unknown) => void;
-        error: (msg: string, data?: unknown) => void;
-    };
-    now: () => number;
-    ttlMs?: number;
-    leadMs?: number;
-    maxDurationMs?: number;
-    maxIdleWarmMs?: number;
-    maxSubagentIdleMs?: number;
-    tickIntervalMs?: number;
-    maxTargets?: number;
-    maxBytes?: number;
-    /** Returns the configured clock-hour window; undefined means always warm. */
-    getWindow?: () => CacheKeepWindow | undefined;
-    /** Returns whether main-agent targets bypass only the idle warm cap. */
-    getSustain?: () => boolean;
-}
-export interface CacheKeepStatus {
-    running: boolean;
-    tracked: number;
-    generatedAt: number;
-    startedAt: number | null;
-    maxIdleWarmMs: number;
-    maxSubagentIdleMs: number;
-    ttlMs: number;
-    leadMs: number;
-    sustain: boolean;
-    window?: CacheKeepWindow;
-    targets: Array<{
-        sessionKey: string;
-        accountId: string | undefined;
-        route: 'main';
-        cacheExpiresAt: number;
-        lastRealRequestAt: number;
-        lastWarmedAt?: number;
-        backoffUntil?: number;
-        bodyBytes: number;
-    }>;
-}
-export interface KeepwarmCapture {
-    sessionKey: string;
-    bodyText: string;
-    replayHeaders: Record<string, string>;
-    isSubagent: boolean;
-}
-export declare function buildKeepwarmCapture(input: {
-    enabled: boolean;
-    includeSubagents: boolean;
-    headers: Headers;
-    body: unknown;
-}): KeepwarmCapture | undefined;
-export declare function getCacheKeepWindow(storage: AccountStorage | null): CacheKeepWindow | undefined;
-export declare function isWithinCacheKeepWindow(window: CacheKeepWindow | undefined, now?: Date): boolean;
-export declare function buildKeepwarmBody(bodyText: string): string;
-export declare function ttlForModel(bodyText: string, defaultTtlMs: number): number;
-export declare class CacheKeepManager {
-    private readonly targets;
-    private readonly fetchImpl;
-    private readonly getMainToken;
-    private readonly refreshFallback;
-    private readonly codexResponsesUrl;
-    private readonly log;
-    private readonly now;
-    private readonly ttlMs;
-    private readonly leadMs;
-    private readonly maxIdleWarmMs;
-    private readonly maxSubagentIdleMs;
-    private readonly tickIntervalMs;
-    private readonly maxTargets;
-    private readonly maxBytes;
-    private readonly getWindow?;
-    private readonly getSustain?;
-    private timer;
-    private startedAt;
-    private totalBytes;
-    private tickInFlight;
-    private disposed;
-    private abortController;
-    private logPayload;
-    constructor(options: CacheKeepManagerOptions);
-    track(sessionKey: string, bodyText: string, accountId: string | undefined, chatgptAccountId?: string, replayHeaders?: Record<string, string>, isSubagent?: boolean): void;
-    private isGpt56Subagent;
-    private pruneStale;
-    start(): void;
-    stop(): void;
-    remove(sessionKey: string): void;
-    status(): CacheKeepStatus;
-    tick(): Promise<void>;
-    private prewarm;
-}

package/dist/core/oauth.d.ts

@@ -1,138 +0,0 @@
-export declare const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
-export declare const ISSUER = "https://auth.openai.com";
-export declare const OAUTH_PORT = 1455;
-export declare const OAUTH_POLLING_SAFETY_MARGIN_MS = 3000;
-export declare const USER_AGENT = "cortexkit-opencode-openai-auth/0.7.2";
-export declare const RESERVED_ACCOUNT_ID = "main";
-export declare const RESERVED_ACCOUNT_ID_ERROR = "\"main\" is a reserved account id; choose a different label.";
-export interface PkceCodes {
-    verifier: string;
-    challenge: string;
-}
-export declare function base64UrlEncode(buffer: ArrayBuffer): string;
-export declare function generatePKCE(): Promise<PkceCodes>;
-export interface IdTokenClaims {
-    chatgpt_account_id?: string;
-    email?: string;
-    organizations?: Array<{
-        id: string;
-    }>;
-    'https://api.openai.com/auth'?: {
-        chatgpt_account_id?: string;
-    };
-}
-export declare function parseJwtClaims(token: string): IdTokenClaims | undefined;
-export declare function extractAccountIdFromClaims(claims: IdTokenClaims): string | undefined;
-export interface TokenResponse {
-    id_token: string;
-    access_token: string;
-    refresh_token: string;
-    expires_in?: number;
-}
-export declare function extractAccountId(tokens: TokenResponse): string | undefined;
-export declare function isReservedAccountId(value: string | undefined): boolean;
-export declare function assertFallbackAccountIdAllowed<T extends string | undefined>(value: T): T;
-export declare function buildAuthorizeUrl(redirectUri: string, pkce: PkceCodes, state: string): string;
-export declare function exchangeCodeForTokens(code: string, redirectUri: string, pkce: PkceCodes): Promise<TokenResponse>;
-export declare function escapeHtml(value: string): string;
-export declare const HTML_SUCCESS = "<!doctype html>\n<html>\n  <head>\n    <title>CortexKit OpenAI Auth - Authorization Successful</title>\n    <style>\n      body {\n        font-family:\n          system-ui,\n          -apple-system,\n          sans-serif;\n        display: flex;\n        justify-content: center;\n        align-items: center;\n        height: 100vh;\n        margin: 0;\n        background: #131010;\n        color: #f1ecec;\n      }\n      .container {\n        text-align: center;\n        padding: 2rem;\n      }\n      h1 {\n        color: #f1ecec;\n        margin-bottom: 1rem;\n      }\n      p {\n        color: #b7b1b1;\n      }\n    </style>\n  </head>\n  <body>\n    <div class=\"container\">\n      <h1>Authorization Successful</h1>\n      <p>You can close this window and return to OpenCode.</p>\n    </div>\n    <script>\n      setTimeout(() => window.close(), 2000)\n    </script>\n  </body>\n</html>";
-export declare const HTML_ERROR: (error: string) => string;
-export interface PendingOAuth {
-    pkce: PkceCodes;
-    state: string;
-    resolve: (tokens: TokenResponse) => void;
-    reject: (error: Error) => void;
-}
-export declare function flowCleanup(state: string): void;
-export declare function startOAuthServer(): Promise<{
-    port: number;
-    redirectUri: string;
-}>;
-export declare function stopOAuthServer(): void;
-export declare function resetOAuthStateForTest(): void;
-export declare function waitForOAuthCallback(pkce: PkceCodes, state: string, timeoutMs?: number, signal?: AbortSignal): Promise<TokenResponse>;
-export interface DeviceAuthInit {
-    device_auth_id: string;
-    user_code: string;
-    interval: string;
-    expires_in?: number | string;
-}
-export declare function beginDeviceAuth(): Promise<{
-    deviceData: DeviceAuthInit;
-    url: string;
-    instructions: string;
-}>;
-export declare function completeDeviceAuth(deviceData: DeviceAuthInit, signal?: AbortSignal): Promise<TokenResponse>;
-/**
- * Minimal shape of a fallback OAuth account for ingestion. Matches the
- * fields used by upsertAccount and beginAccountLogin, compatible with
- * the full OAuthAccount type in accounts.ts.
- */
-export interface IngestAccount {
-    id: string;
-    label?: string;
-    type: 'oauth';
-    access?: string;
-    refresh: string;
-    expires?: number;
-    enabled: boolean;
-    addedAt: number;
-    lastUsed: number;
-    /**
-     * When the token was obtained. Stamped at login so a freshly added account
-     * carries a refresh marker — without it, the runtime-state merge cannot tell a
-     * rotated token from a stale one (both default to 0) and a concurrent stale
-     * save could roll the token back.
-     */
-    lastRefreshedAt?: number;
-    /** Stable ChatGPT account identifier from the OAuth token claims. */
-    accountId?: string;
-}
-export interface AccountStorageLike {
-    version: 1;
-    mainAccountId?: string;
-    accounts: IngestAccount[];
-}
-/**
- * Dedup by stable accountId first (strongest signal — same ChatGPT account
- * added twice with different labels must merge), then by id, then by label.
- * If found, merge-update preserving addedAt. Otherwise push.
- * Re-running `add --label work` is idempotent.
- *
- * Accepts the accounts array directly (not the whole storage object) to
- * avoid coupling to any particular storage shape.
- */
-export declare function upsertAccount<T extends {
-    id: string;
-    label?: string;
-    accountId?: string;
-    addedAt?: number;
-}>(accounts: T[], account: T): number;
-export interface BeginAccountLoginOptions {
-    label?: string;
-    headless?: boolean;
-    signal?: AbortSignal;
-}
-export interface BeginAccountLoginResult {
-    url: string;
-    instructions: string;
-    /** Resolves after the user completes the OAuth flow with a ready-to-ingest account. */
-    completion: Promise<IngestAccount>;
-}
-/**
- * Split-return OAuth flow entry point.
- *
- * Browser flow (default):
- *   1. Start OAuth server, generate PKCE, build authorize URL
- *   2. Return { url, instructions, completion } — url is ready immediately
- *   3. completion resolves after browser callback + token exchange
- *
- * Headless flow:
- *   1. Begin device auth
- *   2. Return { url, instructions, completion }
- *   3. completion polls device endpoint + exchanges for tokens
- *
- * The split return allows the TUI command to show the URL before the
- * (potentially 30-60s) wait, avoiding a deadlock.
- */
-export declare function beginAccountLogin(opts?: BeginAccountLoginOptions): Promise<BeginAccountLoginResult>;

package/dist/core/provider.d.ts

@@ -1,70 +0,0 @@
-/**
- * Provider injection seam — shared types and the 2 Codex provider fns.
- *
- * Both fns are constructor-injected into FallbackAccountManager and
- * QuotaManager so the generic core never imports provider specifics
- * directly.
- */
-import type { OAuthQuotaSnapshot } from './accounts.ts';
-declare const log: {
-    error: (m: string, d?: unknown) => void;
-    warn: (m: string, d?: unknown) => void;
-    info: (m: string, d?: unknown) => void;
-    debug: (m: string, d?: unknown) => void;
-    trace: (m: string, d?: unknown) => void;
-};
-type QuotaLogger = Pick<typeof log, 'debug' | 'warn'>;
-export type QuotaWindowName = string;
-export declare const PRIMARY: QuotaWindowName;
-export declare const SECONDARY: QuotaWindowName;
-export interface ProviderHttpError extends Error {
-    status?: number;
-    retryAfter?: number;
-    /** True when this error originated from a token-refresh call (not a quota fetch). */
-    isRefreshError?: boolean;
-}
-export type ProviderRefreshFn = (input: {
-    refreshToken: string;
-    fetchImpl: typeof fetch;
-    now: () => number;
-}) => Promise<{
-    access: string;
-    refresh: string;
-    expires: number;
-    expiresIn: number;
-}>;
-export type ProviderQuotaFn = (input: {
-    accessToken: string;
-    fetchImpl: typeof fetch;
-    now: () => number;
-}) => Promise<OAuthQuotaSnapshot>;
-export declare const CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
-export declare const CODEX_ISSUER = "https://auth.openai.com";
-/**
- * Core Codex OAuth refresh — the single entry point for refreshing an
- * OpenAI OAuth token.  Used by both the legacy refreshAccessToken in
- * index.ts AND the FallbackAccountManager (via constructor injection).
- *
- * Throws a ProviderHttpError carrying `.status` (from the HTTP response)
- * and `.retryAfter` (parsed from Retry-After) so backoff machinery can
- * duck-type them without instanceof checks.
- */
-export declare function codexRefreshFn(input: {
-    refreshToken: string;
-    fetchImpl: typeof fetch;
-    now: () => number;
-}): Promise<{
-    access: string;
-    refresh: string;
-    expires: number;
-    expiresIn: number;
-}>;
-export declare function whamUsageFn(input: {
-    accessToken: string;
-    fetchImpl: typeof fetch;
-    now: () => number;
-    accountId?: string;
-    accountKey?: string;
-    logger?: QuotaLogger;
-}): Promise<OAuthQuotaSnapshot>;
-export {};

package/dist/core/quota-manager.d.ts

@@ -1,192 +0,0 @@
-/**
- * Unified quota cache and API gateway.
- *
- * Single source of truth for main + fallback quota state. All consumers
- * share one QuotaManager instance so they see the same in-memory cache.
- * Handles deduplication, rate-limiting (429 backoff), and staleness.
- *
- * Adapted from anthropic-auth — provider-specific quota fetch injected via
- * fetchQuotaFn instead of hard-importing fetchOAuthQuotaSnapshot.
- */
-import type { AccountOperationError, AccountQuotaWindow, AccountStorage, OAuthAccount, OAuthQuotaSnapshot } from './accounts.ts';
-import { type ProviderQuotaFn } from './provider.ts';
-export type { ProviderQuotaFn };
-export declare function quotaWindowResetIsPast(window: AccountQuotaWindow | undefined, now: number): boolean;
-/**
- * Resolve when a WS-exhausted account becomes usable. Admission errors can
- * carry the provider's authoritative reset; response.failed frames do not, so
- * those fall back to the named window in the last-known quota snapshot. Never
- * borrow the other window's reset — an unrelated window can blackhole the
- * account long past its actual limit. The bounded default self-corrects when a
- * later request reports exhaustion again.
- */
-export declare function resolveMidStreamRateLimitResetAt(quota: OAuthQuotaSnapshot | undefined, window: string, now: number, defaultMs: number, explicitResetAt?: number): number;
-/**
- * Stable, non-reversible fingerprint of an access token. Used to detect a
- * main-account switch so a different account's persisted/cached quota is never
- * reused. Not a secret — a truncated SHA-256, safe to persist alongside quota.
- */
-export declare function tokenFingerprint(token: string): string;
-export type QuotaEntry = {
-    quota: OAuthQuotaSnapshot;
-    refreshAfter: number;
-    checkedAt: number;
-    accountId?: string;
-};
-export type QuotaManagerOptions = {
-    storage: AccountStorage | null;
-    fetchImpl?: typeof fetch;
-    now?: () => number;
-    /** Injected quota-fetch function — replaces the hard-imported Anthropic fetchOAuthQuotaSnapshot */
-    fetchQuotaFn?: ProviderQuotaFn;
-    onMainQuotaFetched?: (quota: OAuthQuotaSnapshot, checkedAt: number, fingerprint: string, fetchStartedAt: number) => void;
-    onApiError?: (error: AccountOperationError) => void;
-};
-export declare class QuotaManager {
-    private main;
-    private mainTokenFp;
-    private mainQuotaAccountId;
-    private fallbacks;
-    private fallbackTokenFps;
-    private inflightMain;
-    private inflightMainFp;
-    private inflightFallbacks;
-    private mainLastApiError;
-    private fallbackApiErrors;
-    private fallbackErrorTokenFps;
-    private rateLimitedUntilMap;
-    private apiGate;
-    private lastApiCallAt;
-    private storage;
-    private readonly fetchImpl;
-    private readonly now;
-    private readonly fetchQuotaFn;
-    private readonly onMainQuotaFetched;
-    private readonly onApiError;
-    constructor(opts: QuotaManagerOptions);
-    /**
-     * Cached main quota entry. Pass the live access token to enforce token
-     * binding: if the cached entry was produced by a different token (main
-     * account switched), it is dropped and null is returned so the caller
-     * refetches for the current account. Called without a token (e.g. for
-     * display) it returns whatever is cached.
-     */
-    getMain(accessToken?: string): QuotaEntry | null;
-    /**
-     * Cached fallback quota entry. Pass the live access token to enforce token
-     * binding: if the entry was produced by a different token (account re-login),
-     * it is dropped and null is returned so the caller refetches.
-     */
-    getFallback(accountId: string, accessToken?: string): QuotaEntry | null;
-    getAllFallbacks(): Map<string, QuotaEntry>;
-    setMain(accessToken: string, entry: QuotaEntry, accountId?: string, completeSnapshot?: boolean): void;
-    /**
-     * Non-invalidating read of the cached main quota for POLICY decisions
-     * (killswitch). Unlike getMain(token), a token mismatch does NOT drop the
-     * cache — an access-token refresh is a same-account event and must not turn a
-     * known-exhausted account into "unknown" (which would fail open and spend).
-     *
-     * Pass the live ChatGPT accountId to still drop on a genuine account SWITCH:
-     * if the cached entry's account identity is known and differs, return null so
-     * the killswitch treats it as unknown rather than judging account A by account
-     * B's quota. When identity is unknown on either side, the cached snapshot is
-     * returned (best-effort) — the same fail-open-on-unknown stance as elsewhere.
-     */
-    peekMainForPolicy(accountId?: string): QuotaEntry | null;
-    /**
-     * Non-invalidating read of a cached fallback quota for POLICY decisions
-     * (killswitch, admission). Keyed by the stable internal account id, so a
-     * token refresh for the same account does not drop it (getFallback(id, token)
-     * would).
-     *
-     * Pass the live ChatGPT identity to still drop on a genuine re-login: if the
-     * cached entry's identity is known and differs, return null so the previous
-     * identity's (possibly exhausted) quota is never judged against its
-     * replacement. Unknown on either side fails open, matching peekMainForPolicy.
-     */
-    peekFallbackForPolicy(accountId: string, identity?: string): QuotaEntry | null;
-    setFallback(accountId: string, entry: QuotaEntry, accessToken?: string, completeSnapshot?: boolean, identity?: string): void;
-    /**
-     * Mark accountId ('main' or a fallback id) rate-limited until resetAtMs.
-     * Keeps the LATER reset: skips only when an existing mark is strictly
-     * later than resetAtMs, so an equal-reset re-mark still applies (idempotent)
-     * instead of being silently dropped by a stale `>=` comparison.
-     */
-    markRateLimited(accountId: string, resetAtMs: number): void;
-    /** True iff accountId has a mark whose reset has not yet passed. */
-    isRateLimited(accountId: string): boolean;
-    /**
-     * Raw stored reset for accountId's mark, or undefined if none. Unlike
-     * isRateLimited, this does NOT apply read-time expiry — callers on the
-     * block path already know the mark is live (isRateLimited just returned
-     * true) and want its exact reset estimate for a Retry-After computation.
-     */
-    rateLimitedUntil(accountId: string): number | undefined;
-    /** Explicit early clear — read-time expiry in isRateLimited is primary. */
-    clearRateLimited(accountId: string): void;
-    refreshMain(accessToken: string): Promise<OAuthQuotaSnapshot>;
-    refreshFallback(accountId: string, accessToken: string): Promise<OAuthQuotaSnapshot>;
-    refreshAllFallbacks(accounts: OAuthAccount[]): Promise<void>;
-    /**
-     * Fire-and-forget refresh. Does not await, swallows errors.
-     */
-    refreshMainInBackground(accessToken: string): void;
-    isMainStale(): boolean;
-    isFallbackStale(accountId: string, accessToken?: string): boolean;
-    shouldRefreshOnRequestCount(requestCount: number): boolean;
-    /**
-     * Combined check: should a refresh happen right now?
-     * True if main is stale by time OR triggered by request count.
-     */
-    needsRefresh(requestCount: number): boolean;
-    updateStorage(storage: AccountStorage | null): void;
-    /**
-     * Seed/update the main quota cache from persisted state. This is deliberately
-     * callable after every disk load so another plugin process's fresh quota write
-     * can stop this process from showing "checking…" or making a redundant quota
-     * API call.
-     */
-    seedMainFromStorage(storage: AccountStorage | null, accessToken?: string): void;
-    private seedMainBackoffFromStorage;
-    /**
-     * Seed fallback cache entries from persisted account.quota data.
-     * Updates older in-memory entries so a fresh quota write from another plugin
-     * process prevents redundant checks and stale sidebar writes.
-     */
-    seedFallbacksFromAccounts(accounts: OAuthAccount[]): void;
-    /**
-     * Whether the MAIN quota API is currently in backoff. Scoped to the main
-     * account — a fallback account's 429 never reports here.
-     */
-    isBackedOff(): boolean;
-    /**
-     * Whether a specific fallback account's quota API is in backoff.
-     */
-    isFallbackBackedOff(accountId: string, accessToken?: string): boolean;
-    getLastApiError(): AccountOperationError | undefined;
-    /** Minimum gap between consecutive quota API calls (ms). */
-    private static readonly API_CALL_GAP_MS;
-    private static fallbackInflightKey;
-    private static quotaLockName;
-    /**
-     * Serialize API calls through a shared gate so only one
-     * quota API request runs at a time, with a minimum gap
-     * between calls. Prevents concurrent and rapid-fire calls
-     * from triggering rate limits.
-     */
-    private _enqueueApiFetch;
-    private _fetchMain;
-    private _fetchFallback;
-    /** Route through injected fetchQuotaFn, or throw if unset. */
-    private _fetchQuota;
-    private static isAuthError;
-    /** Main quota failure: arms main-only backoff and persists via onApiError. */
-    private _handleMainFetchError;
-    /**
-     * Fallback quota failure: arms backoff for THIS account only. Never touches
-     * main backoff state and never calls onApiError (which persists the main
-     * quota error) — the per-account error is recorded by the caller via the
-     * account's lastQuotaRefreshError.
-     */
-    private _handleFallbackFetchError;
-}

package/dist/core/refresh-all-quota.d.ts

@@ -1,86 +0,0 @@
-import { type SidebarState } from '../sidebar-state';
-import type { FallbackAccountManager, isOAuthAccount, loadAccounts } from './accounts';
-import type { whamUsageFn } from './provider';
-import type { QuotaManager } from './quota-manager';
-declare const log: {
-    error: (m: string, d?: unknown) => void;
-    warn: (m: string, d?: unknown) => void;
-    info: (m: string, d?: unknown) => void;
-    debug: (m: string, d?: unknown) => void;
-    trace: (m: string, d?: unknown) => void;
-};
-type QuotaLogger = Pick<typeof log, 'debug' | 'warn'>;
-export interface RefreshAllQuotaDeps {
-    getAuth: () => Promise<{
-        type: string;
-        access?: string;
-        refresh?: string;
-        expires?: number;
-    }>;
-    codexRefreshFn: (input: {
-        refreshToken: string;
-        fetchImpl: typeof fetch;
-        now: () => number;
-    }) => Promise<{
-        access: string;
-        refresh: string;
-        expires: number;
-    }>;
-    refreshMainWithLease: () => Promise<{
-        access: string;
-        refresh: string;
-        expires: number;
-    }>;
-    fallbackManager: FallbackAccountManager;
-    quotaManager: QuotaManager;
-    loadAccounts: typeof loadAccounts;
-    writeSidebarState: (qm: QuotaManager, store: Awaited<ReturnType<typeof loadAccounts>>) => Promise<void>;
-    client: {
-        auth: {
-            set: (input: {
-                path: {
-                    id: string;
-                };
-                body: {
-                    type: string;
-                    access?: string;
-                    refresh: string;
-                    expires?: number;
-                };
-            }) => Promise<unknown>;
-        };
-    };
-    fetchImpl: typeof fetch;
-    now: () => number;
-    configPath: string;
-    storageMainAccountId: string | undefined;
-    isOAuthAccountFn: typeof isOAuthAccount;
-    whamFn?: typeof whamUsageFn;
-    respectBackoff?: boolean;
-    logger?: QuotaLogger;
-    skipFresherThanMs?: number;
-    readSidebarState?: () => Promise<SidebarState>;
-}
-export interface RefreshAllQuotaOptions {
-    accountKey?: string;
-}
-export interface RefreshAllQuotaOptions {
-    accountKey?: string;
-}
-export interface RefreshAllQuotaResult {
-    account: string;
-    ok: boolean;
-    error?: string;
-    /**
-     * The account cannot recover on its own: the provider has rejected its
-     * credentials, so no amount of retrying will help until the operator re-adds
-     * it.
-     *
-     * Carried as a flag rather than left for the caller to infer from `error`,
-     * because sniffing an error string for a user-facing decision breaks the
-     * moment the wording changes.
-     */
-    permanent?: boolean;
-}
-export declare function refreshAllQuota(deps: RefreshAllQuotaDeps, options?: RefreshAllQuotaOptions): Promise<RefreshAllQuotaResult[]>;
-export {};

package/dist/core/refresh-file-lock.d.ts

@@ -1,12 +0,0 @@
-export declare function isLostMarkerRaceError(error: unknown): boolean;
-export declare function acquireRefreshFileLock(options: {
-    name: string;
-    ttlMs: number;
-    path?: string;
-    now?: () => number;
-    renew?: boolean;
-    renewIntervalMs?: number;
-    onStep?: (step: 'stale-marker-stat' | 'stale-marker-claimed' | 'stale-lock-confirmed' | 'eviction-marker-acquired' | 'renewal-owner-confirmed' | 'renewal-marker-unavailable' | 'renewal-write-fenced' | 'renewal-write-ready' | 'relinquish-read' | 'renewal-finished' | 'release-owner-confirmed') => void | Promise<void>;
-}): Promise<{
-    release: () => Promise<void>;
-} | null>;