@cortexkit/opencode-openai-auth 1.0.3 → 1.0.4

package/dist/{pool-lifecycle-YLz2B8A5.d.ts → pool-lifecycle-DqKq8Eej.d.ts}

@@ -1,4 +1,7 @@
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/schema.d.ts
+import { n as QuotaMap } from "./map-CCbSZIhT.js";
+import { ClaustrumClient, EnrollmentPollOutcome } from "@cortexkit/claustrum-client";
+import "@cortexkit/private-files";
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/schema.d.ts
 type OAuthCredential = {
   type: 'oauth';
   access?: string;
@@ -27,6 +30,8 @@ type StoredCredential = (OAuthCredential & {
 /** Quota codec supplied by `/quota`: the store never interprets the map itself. */
 interface QuotaCodec {
   validate(value: unknown): boolean;
+  /** Normalize persisted quota before validation, when the codec supports it. */
+  decode?(value: unknown): unknown;
   merge(stored: unknown | undefined, observation: unknown): unknown;
 }
 /**
@@ -185,7 +190,7 @@ interface PoolRow {
   unbound?: true;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/errors.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/errors.d.ts
 /** Every library operation that can fail, as named in the failure value. */
 type PoolOperation = 'initialize' | 'add' | 'replace' | 'rotate' | 'disable' | 'enable' | 'remove' | 'reorder' | 'updateSettings' | 'recordIdentity' | 'updateProviderState' | 'refresh' | 'pull' | 'publishRoster';
 /**
@@ -232,12 +237,12 @@ declare class PoolOperationError extends Error {
   });
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/hooks.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/hooks.d.ts
 interface PoolLogger {
   warn(message: string, data?: unknown): void;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/fs/refresh-file-lock.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/fs/refresh-file-lock.d.ts
 interface LockLoss {
   readonly reason: 'taken-over' | 'expired' | 'unreadable' | 'renewal-failed' | 'marker-lost';
   readonly expectedOwnerId: string;
@@ -268,10 +273,10 @@ declare function acquireRefreshFileLock(options: {
   onContended?: () => void;
   /** Synchronous, never awaited; throws and returned promise/thenable rejections are isolated. */
   onRenewalTimer?: (event: 'scheduled' | 'cancelled') => void;
-  onStep?: (step: 'stale-marker-stat' | 'stale-marker-claimed' | 'stale-lock-observed' | 'stale-lock-confirmed' | 'stale-lock-removed' | 'stale-lock-recreated' | 'eviction-marker-acquired' | 'renewal-owner-confirmed' | 'renewal-marker-unavailable' | 'renewal-write-fenced' | 'renewal-write-ready' | 'relinquish-read' | 'renewal-finished' | 'release-owner-confirmed') => void | Promise<void>;
+  onStep?: (step: 'stale-marker-stat' | 'stale-marker-claimed' | 'stale-lock-observed' | 'lock-read-ready' | 'lock-missing' | 'stale-lock-confirmed' | 'stale-lock-removed' | 'stale-lock-recreated' | 'eviction-marker-acquired' | 'renewal-owner-confirmed' | 'renewal-marker-unavailable' | 'renewal-write-fenced' | 'renewal-write-ready' | 'renewal-write-finished' | 'relinquish-read' | 'renewal-finished' | 'release-owner-confirmed') => void | Promise<void>;
 }): Promise<RefreshFileLock | null>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/refresh-lock.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/refresh-lock.d.ts
 type LockStep = NonNullable<Parameters<typeof acquireRefreshFileLock>[0]['onStep']> extends ((step: infer S) => unknown) ? S : never;
 /** Tuning shared by every lock the store takes; each field is overridable. */
 interface PoolLockOptions {
@@ -298,9 +303,13 @@ interface LockEnvironment {
     name: string;
     path: string;
   }, step: LockStep) => void | Promise<void>;
+  onRenewalTimer?: (lock: {
+    name: string;
+    path: string;
+  }, event: 'scheduled' | 'cancelled') => void;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/mutate.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/mutate.d.ts
 /** Named points on the write path, for crash and ownership injection. */
 type WriteStep = 'before-config-write' | 'after-config-write' | 'before-state-write' | 'after-state-write';
 /** Awaitable pause points on the pull and refresh paths. */
@@ -335,11 +344,11 @@ interface StoreContext {
 /** What `initializePool` did. */
 type InitializeOutcome = 'initialized' | 'already-ready';
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/runtime.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/runtime.d.ts
 /** Where a pull was fired from; `load` fires at most once per process per row. */
 type PullReason = 'load' | 'add' | 'replace' | 'admission';
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/attribution.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/attribution.d.ts
 /**
  * What a pull or refresh captured about its row (named by id alongside) when
  * it was issued. A result applies only while the row with that id still has
@@ -362,7 +371,7 @@ interface Attribution {
   identity?: string;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/rows.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/rows.d.ts
 type FailureHook = (rowId: string, error: PoolOperationError) => void | Promise<void>;
 interface RowOperationOptions {
   /** Called once, awaited, on every non-success path, before locks release. */
@@ -578,7 +587,7 @@ interface RowTransitionResult {
   providerState?: unknown;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/provider-state.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/provider-state.d.ts
 /**
  * Receives a private copy of the row's provider state (undefined when the row
  * shows none) and the row as loaded under the locks, and returns the next
@@ -614,7 +623,7 @@ declare const DECLINE_TRANSITION: unique symbol;
  */
 type RowTransitionMutator = (current: unknown | undefined, row: PoolRow) => unknown | typeof DECLINE_TRANSITION | Promise<unknown | typeof DECLINE_TRANSITION>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/publication.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/publication.d.ts
 interface PublishPlan {
   operationId: string;
   remove: Array<{
@@ -657,7 +666,7 @@ interface PublishResult {
   receipt: PublicationReceipt;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/pull.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/pull.d.ts
 /** What a pull is issued with: the credential and its attribution tuple. */
 interface PullRequest {
   id: string;
@@ -668,7 +677,7 @@ interface PullRequest {
 }
 type PullHook = (request: PullRequest) => Promise<unknown>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/refresh.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/refresh.d.ts
 /** What the injected provider refresh function returns. */
 interface ProviderRefreshResult {
   access: string;
@@ -731,7 +740,7 @@ type RefreshOutcome = {
   reason: string;
 };
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/settings.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/settings.d.ts
 /** The plugin's settings: every top-level config key except the pool-owned ones. */
 type PoolSettings = Record<string, unknown>;
 type SettingsRead = {
@@ -775,7 +784,7 @@ type UpdateSettingsResult = {
   outcome: 'updated' | 'unchanged';
 };
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/pool.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/pool.d.ts
 interface OpenPoolStoreOptions {
   /** The provider every row of this pool belongs to; keys the provider-wide lock. */
   provider: string;
@@ -832,6 +841,7 @@ interface OpenPoolStoreOptions {
   hold?: (point: HoldPoint, rowId: string) => void | Promise<void>;
   onLockEvent?: LockEnvironment['onLockEvent'];
   onLockStep?: LockEnvironment['onLockStep'];
+  onRenewalTimer?: LockEnvironment['onRenewalTimer'];
 }
 type PoolLoad = {
   status: 'ready';
@@ -1048,728 +1058,17 @@ interface BeginAccountLoginResult {
  */
 declare function beginAccountLogin(opts: BeginAccountLoginOptions): Promise<BeginAccountLoginResult>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+subc-client@0.16.1/node_modules/@cortexkit/subc-client/dist/connection-file.d.ts
-interface Endpoint {
-  host: string;
-  port: number;
-}
-interface ConnectionInfo {
-  schema: number;
-  endpoints: Endpoint[];
-  /** Transport key bytes. Serialized on disk as a JSON array of numbers. */
-  key: Uint8Array;
-  /** 16-byte daemon identity. Serialized on disk as a JSON array of numbers. */
-  daemonId: Uint8Array;
-  pid: number;
-  daemonVer: string;
-}
-//#endregion
-//#region ../../node_modules/.bun/@cortexkit+subc-client@0.16.1/node_modules/@cortexkit/subc-client/dist/envelope.d.ts
-/** Scheduling priority carried in flags bits 1-2. */
-declare enum Priority {
-  Passive = 0,
-  Interactive = 1,
-  Background = 2
-}
-/** Admission behavior carried in flags bits 4-5. */
-declare enum AdmissionClass {
-  Normal = 0,
-  Expedite = 1,
-  Sheddable = 2
-}
-//#endregion
-//#region ../../node_modules/.bun/@cortexkit+subc-client@0.16.1/node_modules/@cortexkit/subc-client/dist/route-handle.d.ts
-interface ReverseRequestContext {
-  readonly corr: bigint;
-  readonly method: string;
-}
-type ReverseRequestHandler = (body: Uint8Array, ctx: ReverseRequestContext) => Promise<Uint8Array> | Uint8Array;
-/**
- * Mutable handler registry prepared before route.open. The client derives
- * consumer_capabilities from its method families and seals that set when the
- * route opens; handlers for declared families may still be replaced afterward.
- */
-declare class ReverseRequestRegistry {
-  private readonly handlers;
-  private declaredFamilies;
-  onRequest(methodFamily: string, handler: ReverseRequestHandler): void;
-  /** @internal */
-  capabilities(): string[];
-  /** @internal */
-  handler(methodFamily: string): ReverseRequestHandler | undefined;
-  /** @internal */
-  seal(): void;
-}
-/**
- * Immutable identity for one route binding on one live socket. Only channel and
- * epoch cross the wire; the connection token remains private to this SDK.
- */
-declare class RouteHandle {
-  readonly channel: number;
-  readonly epoch: number;
-  private constructor();
-  /** Replace the handler for a capability declared when this route opened. */
-  onRequest(methodFamily: string, handler: ReverseRequestHandler): void;
-  private static create;
-}
-//#endregion
-//#region ../../node_modules/.bun/@cortexkit+subc-client@0.16.1/node_modules/@cortexkit/subc-client/dist/client.d.ts
-interface BindIdentity {
-  project_root: string;
-  harness: string;
-  session: string;
-}
-type RouteTarget = {
-  kind: "tool_provider";
-  module_id: string;
-} | {
-  kind: "management_surface";
-  module_id: string;
-} | {
-  kind: "internal_service";
-  module_id: string;
-  service_id: string;
-};
-type ManagedRouteKind = "management_surface" | "tool_provider";
-interface ConsumerIdentity {
-  module_id: string;
-  launch_nonce: string;
-}
-interface RouteOpenOptions {
-  /** Optional override for the consumer identity; by default the SUBC_MODULE_ID and SUBC_LAUNCH_NONCE environment variables are used when both are non-empty. Set null to send route.open without consumer_identity. */
-  consumerIdentity?: ConsumerIdentity | null;
-  /**
-   * Handlers prepared before route.open. The client derives consumer_capabilities
-   * from this registry; callers cannot declare a capability without a handler.
-   */
-  reverseRequests?: ReverseRequestRegistry;
-}
-interface CatalogCapabilityRequirement {
-  capability: string;
-  need: "required" | "optional";
-}
-interface CatalogCapabilities {
-  provides: string[];
-  requires: CatalogCapabilityRequirement[];
-  must_never_reach: string[];
-}
-/** A self-signal's anchor relative to the external surface it shapes. */
-type CatalogSignalAnchor = "fixed_interval" | {
-  event: {
-    event: string;
-  };
-};
-/** The source of a self-signal's effective cadence. */
-type CatalogSignalCadence = {
-  literal: {
-    interval_ms: number;
-  };
-} | {
-  derived: {
-    source: string;
-  };
-};
-/** A self-signal declaration mirrored from a registered module manifest. */
-interface CatalogSelfSignalDeclaration {
-  name: string;
-  /** Open string for forward-compatible self-signal kinds. */
-  kind: string;
-  effect: "observe" | "mutate";
-  anchored_to: CatalogSignalAnchor;
-  cadence?: CatalogSignalCadence | null;
-  domain?: string | null;
-  note?: string | null;
-}
-interface CatalogEntry {
-  module_id: string;
-  roles: unknown[];
-  control_ops: string[];
-  /** Static capability claims mirrored from the registered module manifest. */
-  capabilities?: CatalogCapabilities | null;
-  /** Self-signal declarations mirrored verbatim from the registered manifest. */
-  self_signals?: CatalogSelfSignalDeclaration[] | null;
-}
-interface RequestOptions {
-  priority?: Priority;
-  admissionClass?: AdmissionClass;
-  timeoutMs?: number;
-  /**
-   * Set when the request body is opaque bytes rather than JSON. This flag is the
-   * receiver's only signal about the body representation; reply decoding follows
-   * the response frame's flag instead of this request option.
-   */
-  binary?: boolean;
-  /** Called for each interim PUSH / StreamData frame before the terminal reply. */
-  onProgress?: (body: Uint8Array) => void;
-  /**
-   * Abort the request: when this fires while the request is still in flight, the
-   * client emits a CANCEL frame carrying that request's own corr.
-   *
-   * The signal exists instead of exposing corr because corr lifetime is already
-   * tracked here to settle replies; handing it out would make every caller keep a
-   * second map that can disagree with this one, and would let a caller cancel a
-   * corr it does not own.
-   *
-   * Cancellation is best-effort by the wire's construction: the daemon forwards
-   * the frame on a live route and silently drops it on a departed one, and no
-   * acknowledgement exists at any layer. Only the module's own reply proves what
-   * happened, so the promise is NOT rejected here -- it settles however the module
-   * answers, which may be a normal completion that beat the cancel.
-   */
-  signal?: AbortSignal;
-}
-interface ManagedCallOptions extends RequestOptions {
-  /** Overrides the per-client identity used for route.open before this call. */
-  identity?: BindIdentity;
-  /** Defaults to management_surface, matching the store/host management APIs. */
-  targetKind?: ManagedRouteKind;
-  /** Optional override for the consumer identity; by default the SUBC_MODULE_ID and SUBC_LAUNCH_NONCE environment variables are used when both are non-empty. Set null to send route.open without consumer_identity. */
-  consumerIdentity?: ConsumerIdentity | null;
-  /** Reverse-request handlers used by the managed route and all of its reconnect reopens. */
-  reverseRequests?: ReverseRequestRegistry;
-}
-interface SubscribeOptions {
-  priority?: Priority;
-  admissionClass?: AdmissionClass;
-}
-type RoutePollKind = "status" | "liveness";
-interface RoutePollResult {
-  route_channel: number;
-  route_epoch: number;
-  status: string | null;
-  live: boolean | null;
-}
-interface CloseRouteOptions {
-  /**
-   * Await in-flight UNARY requests on the route to settle before tearing it down.
-   * Subscriptions are always aborted (a held-open stream cannot be drained).
-   * Defaults to false: close immediately, aborting everything in flight.
-   */
-  drain?: boolean;
-}
-interface ManagedCloseRouteOptions extends CloseRouteOptions {
-  /** Consumer identity used by the cached managed route. */
-  consumerIdentity?: ConsumerIdentity | null;
-  /** The registry whose derived capability set identifies the cached route. */
-  reverseRequests?: ReverseRequestRegistry;
-}
-/**
- * Capped exponential reconnect backoff. maxAttempts includes the first immediate
- * reconnect attempt; sleeps happen only between failed transient attempts.
- */
-interface ReconnectBackoff {
-  /** First retry delay. */
-  baseMs: number;
-  /** Delay ceiling (doubling is capped here). */
-  capMs: number;
-  /** Max attempts (including the first) before giving up. */
-  maxAttempts: number;
-}
-/**
- * A live subscription to a provider's event stream, riding a single held-open
- * request. `onEvent` fires for each StreamData frame; `closed` resolves when the
- * provider ends the stream (StreamEnd) or the consumer unsubscribes, and rejects on
- * an Error terminal or a route GOODBYE. `unsubscribe` cancels the held-open request
- * so the provider unwinds.
- */
-interface Subscription {
-  /** Cancel the subscription: sends Cancel on the held-open request; idempotent. */
-  unsubscribe(): void;
-  /** Resolves on StreamEnd or local unsubscribe; rejects on an Error terminal or route close. */
-  readonly closed: Promise<void>;
-}
-interface ConnectOptions {
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/claustrum/insula.d.ts
+/** Optional transport for custom scoped clients; getUsage must not retry refusals. */
+interface InsulaUsageTransport {
   connectionFile: string;
-  handshakeTimeoutMs?: number;
-  /** Default route identity used by managed call(); can be overridden per call. */
-  identity?: BindIdentity;
-  /** Default route target kind used by managed call(); defaults to management_surface. */
-  targetKind?: ManagedRouteKind;
-  /** Backoff for managed reconnect after a connection drop. */
-  reconnectBackoff?: ReconnectBackoff;
-  /** Injectable sleep for timer-free reconnect tests. */
-  sleep?: (ms: number) => Promise<void>;
-  /**
-   * How long managed calls keep retrying route.open in-place on retryable
-   * refusals (module_reloading, module_warming, target_unavailable, …) before
-   * settling not_sent. This deadline is the ONLY binder on those retries —
-   * module reloads legitimately take tens of seconds (the daemon's drain alone
-   * defaults to 30s), so the default matches the daemon's drain ceiling.
-   */
-  routeOpenRetryDeadlineMs?: number;
-  /**
-   * Window the post-deadline liveness probe waits for ANY inbound frame after
-   * sending its channel-0 Ping before convicting the socket as half-open.
-   * Genuine event-loop starvation self-protects at any setting: a loop starved
-   * enough to delay the probe's check also delays the read loop, and when it
-   * wakes the buffered Pong dispatches first. Exposed for deterministic tests.
-   */
-  livenessProbeWindowMs?: number;
-  /**
-   * Hard cap on the timeout-arbitration grace window (see
-   * TIMEOUT_ARBITRATION_GRACE_MS). A reply whose bytes are actively arriving when
-   * the request deadline fires is given up to this long to finish dispatching
-   * before the call settles as a timeout. Bounded and never a deadline extension;
-   * exposed mainly so tests can prove the arbitration deterministically.
-   */
-  timeoutArbitrationGraceMs?: number;
-  /**
-   * Observer for daemon-originated channel-0 control pushes (`route.closing`,
-   * `route.closed`, and any op added later). Purely advisory: the daemon's
-   * load-bearing route-death signal remains the GOODBYE frame, and nothing in
-   * the client's own route lifecycle consumes these. The contract is the wire
-   * contract verbatim -- unrecognized ops still arrive here (callers ignore
-   * what they don't know, per the MUST-ignore clause), a push that fails to
-   * parse as JSON is dropped without surfacing, and an observer throw is
-   * swallowed like every other caller callback so it cannot fail the read loop
-   * or unrelated requests.
-   */
-  onControlPush?: (push: ControlPush) => void;
-}
-/** A parsed daemon-originated channel-0 control push. */
-interface ControlPush {
-  /** The push discriminator, e.g. "route.closing" | "route.closed". */
-  op: string;
-  /** The full parsed body, `op` included, for op-specific fields. */
-  body: Record<string, unknown>;
-}
-declare class SubcClient {
-  private sock;
-  private currentConn;
-  private readonly opts;
-  private nextCorr;
-  private readonly pending;
-  private readonly lateResponses;
-  private readonly routes;
-  private readonly liveRoutes;
-  private connectionToken;
-  private ingressEpochDropCount;
-  private closedErr;
-  private closeStarted;
-  private reconnecting;
-  private generation;
-  private readerActive;
-  private constructor();
-  get conn(): ConnectionInfo;
-  /** Read the connection file, connect, authenticate, and start the read loop. */
-  static connect(opts: ConnectOptions): Promise<SubcClient>;
-  /** List modules subc knows about (channel-0 catalog.list). */
-  catalogList(moduleId?: string): Promise<CatalogEntry[]>;
-  /**
-   * Resolve the sole catalog claimant for a capability.
-   *
-   * This expresses singular intent even when the fleet permits plural claims;
-   * ambiguity is returned instead of selecting an arbitrary module.
-   */
-  resolveProvider(capability: string): Promise<string>;
-  /** Resolve every catalog claimant in deterministic module-id order. */
-  resolveProviders(capability: string): Promise<string[]>;
-  /** Open a route and return its connection-bound immutable handle. */
-  routeOpen(target: RouteTarget, identity: BindIdentity, opts?: RouteOpenOptions): Promise<RouteHandle>;
-  /** Send a data-plane request on exactly the supplied route generation. */
-  request(handle: RouteHandle, body: unknown, opts?: RequestOptions): Promise<unknown>;
-  /**
-   * Managed route + request convenience. Opens and caches a route for the module,
-   * reconnecting and re-opening cached routes after connection drops.
-   */
-  call<Response = unknown>(moduleId: string, method: string, params?: unknown, opts?: ManagedCallOptions): Promise<Response>;
-  /**
-   * Managed route + raw opaque-body request convenience. Unlike call(), this
-   * sends bytes without a JSON method envelope because the BINARY flag is the
-   * receiver's only signal that the body is not JSON. A BINARY reply resolves
-   * to Uint8Array; a non-binary reply is decoded as JSON.
-   */
-  callBinary(moduleId: string, body: Uint8Array, opts?: ManagedCallOptions): Promise<Uint8Array | unknown>;
-  private managedCall;
-  /** Open a held request on exactly one route generation. */
-  subscribe(handle: RouteHandle, body: unknown, onEvent: (event: Uint8Array) => void, opts?: SubscribeOptions): Subscription;
-  /**
-   * Emit CANCEL for one in-flight request when its caller's signal fires.
-   *
-   * Emits only while the request is unsettled by this client's own book, which is
-   * a fact it owns and can check without racing. It deliberately does NOT check
-   * whether the route still exists: that would be a guess, and a wrong guess turns
-   * a frame the daemon would harmlessly drop into a frame never sent -- removing
-   * the caller's only chance at the cost of saving nothing.
-   */
-  private attachCancelSignal;
-  /** Send a pure-header cancellation for an in-flight request. */
-  cancel(handle: RouteHandle, corr: bigint, priority?: Priority): void;
-  /** Poll status or liveness for exactly the supplied route generation. */
-  routePoll(handle: RouteHandle, kind: RoutePollKind): Promise<RoutePollResult>;
-  /** Tear down exactly the supplied route generation. */
-  closeRoute(handle: RouteHandle, opts?: CloseRouteOptions): Promise<void>;
-  /** Close a cached managed route by its route-open identity tuple. */
-  closeManagedRoute(target: Extract<RouteTarget, {
-    kind: ManagedRouteKind;
-  }>, identity: BindIdentity, opts?: ManagedCloseRouteOptions): Promise<void>;
-  /** Alias retained for callers that name the operation by protocol channel; it still requires a full handle. */
-  closeRouteChannel(handle: RouteHandle, opts?: CloseRouteOptions): Promise<void>;
-  close(): void;
-  private drainUnaryOnHandle;
-  private sendRouteGoodbye;
-  private static openConnection;
-  private controlRpc;
-  private send;
-  /**
-   * A request-deadline timer has fired. Before settling as a timeout, arbitrate
-   * the timer-vs-poll race: a reply may already be in the socket buffer, unread
-   * only because the loop was starved. Yield one check phase (setImmediate) so a
-   * fully-buffered reply dispatches and wins via settle()'s identity guard; then,
-   * only while the reader is actively draining THIS socket (a frame mid-arrival),
-   * grant a single hard-capped grace before finally settling. Absent replies
-   * still settle right after the check phase. The settle carries the deadline
-   * marker so the managed classifier reports deadline-not-drop.
-   */
-  private arbitrateTimeout;
-  private managedRequest;
-  private sendManaged;
-  private cachedRouteHandle;
-  private openCachedRoute;
-  private lastInboundAtMs;
-  private livenessProbe;
-  /**
-   * Discriminate event-loop starvation from a half-open socket after a
-   * deadline-no-drop settle. The arbitration deliberately keeps the socket on
-   * that verdict (a late-read reply under load must not cost a healthy
-   * connection), but a half-open socket — peer vanished with no FIN/RST, as
-   * after host sleep/wake — yields the SAME verdict forever, so the keep
-   * becomes a permanent pin to a dead transport. The discriminator is
-   * socket-level liveness evidence: send a channel-0 Ping (the daemon always
-   * answers — subc-core control.rs) and require ANY inbound frame within the
-   * window; the Pong suffices, and a busy socket's other traffic proves the
-   * link just as well. Silence convicts: the socket is failed with a named
-   * cause and closed, so the ordinary drop path (pending rejection now,
-   * reconnect on the next call) takes over.
-   *
-   * Starvation cannot be falsely convicted by a short window: a loop starved
-   * enough to delay the read loop delays this probe's own timer identically,
-   * and when both wake the buffered Pong dispatches before the check runs.
-   *
-   * A PENDING CHANNEL-0 REQUEST SUSPENDS THE PROBE (both at launch and at the
-   * conviction check). The daemon's connection loop handles frames one at a
-   * time, and some channel-0 ops legally park it for seconds — route.open
-   * awaits the module's bind ack inline for up to route_bind_relay_timeout
-   * (~12s in production) — during which OUR Ping sits unread in the daemon's
-   * socket buffer. On an otherwise-quiet connection that silence is fully
-   * explained by our own in-flight control op, and convicting on it would
-   * tear down a healthy connection mid-bind (BROCA's Athena panel flagged
-   * this exact premise; the FIFO fact is verified in subc-core server.rs
-   * connection_loop + control.rs handle_route_open). The client always knows
-   * its own channel-0 pendings, so the gate is local and exact: no probe
-   * while one is in flight, no conviction if one appeared during the window.
-   *
-   * Scope: hooked from the managed-call path only. Control-plane requests
-   * (route.open, catalog.list) are short-lived and their failures already
-   * escalate through reconnect classification; the managed path is where a
-   * plugin lives for hours and where the pin was observed in production.
-   */
-  /** Any in-flight channel-0 request (pendings keyed without a route handle). */
-  private hasControlPending;
-  private probeLivenessAfterDeadline;
-  private ensureConnectedForManaged;
-  private scheduleReconnectAfterDrop;
-  private reconnectAfterDrop;
-  private reconnectWithRetry;
-  private replaceConnection;
-  private reopenCachedRoutes;
-  private timeoutMessage;
-  private routeClosedDuringOpen;
-  private readLoop;
-  private dispatch;
-  /**
-   * Settle a pending exactly once. The object-identity guard (the map still
-   * holds THIS pending under `key`) is the single-winner primitive: whichever of
-   * dispatch, a timeout, fail(), failChannel(), a GOODBYE, or a deferred timeout
-   * arbitration reaches it first wins, and every later caller no-ops. This is what
-   * makes the deferred-timeout arbitration safe — it cannot double-settle, reject
-   * an already-resolved promise, or delete a pending re-created for a later corr.
-   * Returns true when this call was the settler.
-   */
-  private settle;
-  private rejectPending;
-  private dispatchReverseRequest;
-  private sendReverseError;
-  private sendReverseReply;
-  private errorFromFrame;
-  private evictRouteHandle;
-  private failHandle;
-  private fail;
-  private notSentCallError;
-  private outcomeUnknownCallError;
-  private terminalCallError;
-  private notSentRecoveryError;
-  /** Number of nonzero-channel ingress frames dropped by endpoint epoch validation. */
-  get droppedIngressFrames(): number;
-  private installRoute;
-  private isLiveHandle;
-  private assertLiveConnection;
-  private assertLiveHandle;
-  private allocateCorr;
-  private closeConnectionAfterCleanupFailure;
-  private encode;
-  /** Decode a terminal response according to the representation on the wire. */
-  private decodeReply;
-  private parseJson;
+  getUsage(): Promise<unknown>;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+claustrum-client@0.6.2/node_modules/@cortexkit/claustrum-client/dist/wire.d.ts
-type ClaustrumConnector = (options: {
-  connectionFile: string;
-  handshakeTimeoutMs?: number;
-}) => Promise<SubcClient>;
-type ClaustrumClientOptions = {
-  connectionFile?: string;
-  handshakeTimeoutMs?: number;
-  projectRoot?: string;
-  storagePath?: string;
-  identity?: BindIdentity;
-  connector?: ClaustrumConnector;
-  logger?: (errorClass: string) => void;
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/claustrum/custody.d.ts
+type ClaustrumScopedClient = Pick<ClaustrumClient, 'listScoped' | 'getScoped' | 'reportAuthFailureScoped' | 'close'> & {
+  insula?: InsulaUsageTransport;
 };
-/**
- * Credential material plus optional non-secret identity metadata. Missing wire fields remain
- * `undefined`; a present non-string identity value rejects the response as invalid.
- *
- * An absent identity field means the vault had nothing to assert — NOT that identity failed.
- * Consumers must not collapse absence into mismatch: assert on presence, refuse on a present
- * difference, and serve (log, if it matters) when the field is missing. Absence proves neither
- * the right identity nor the wrong one, so treating it as a failure converts a vault that could
- * not answer into a consumer that cannot serve. The vault records no per-read success (at most
- * the first scoped read per principal), and nothing at all when a consumer declines to serve, so
- * an outage caused that way is visible only to the consumer that caused it.
- */
-type ServedCredential = {
-  material: string;
-  recordVersion: number;
-  expiresAtMs: number | null;
-  /**
-   * Operator-chosen record label for verifying a caller-held binding. It is not a routing key:
-   * account-scoped routing joins `accountId` with `recordVersion`.
-   */
-  credentialId?: string;
-  /** Non-secret Code Assist project identity, present only for antigravity credentials. */
-  projectId?: string;
-  /**
-   * Provider account identity the served token executes under. Account-scoped routing joins this
-   * value with `recordVersion`; it is neither the operator's credential label nor the bearer handle.
-   *
-   * BEST-EFFORT, NEVER GUARANTEED, including for JWT providers. The vault parses the claim live
-   * from the served access token and falls back to stored login-time identity; both legs can be
-   * empty, and the serve path yields nothing rather than fabricating an id. It is absent when the
-   * provider has no known claim, the token does not carry one, or no identity was captured at
-   * login. Do not gate serving on its presence.
-   */
-  accountId?: string;
-  /** Non-secret account display metadata captured at login. */
-  email?: string;
-  /** Non-secret organization or workspace display metadata captured at login. */
-  orgName?: string;
-};
-/**
- * Non-secret health for one handle, read without minting anything.
- *
- * An unresolved handle (unknown or revoked) is an ordinary answer, not an error: it decodes
- * as `ready: false, lastErrorCode: 'not_found'` with `credentialId`, `recordVersion` and
- * `stalePending` all absent. The vault omits them on purpose so a probe learns nothing about
- * what exists and no placeholder value is asserted about a record it never saw.
- */
-type CredentialStatus = {
-  ready: boolean;
-  lastErrorCode: string | null;
-  leaseHeld: boolean;
-  /**
-   * Operator-chosen record label the handle resolved to, for verifying a binding the caller
-   * already holds. Not a routing key. Absent when the handle did not resolve.
-   */
-  credentialId?: string;
-  /**
-   * The record's change cursor, present only when the handle resolved to a record.
-   *
-   * Optional, and OMITTED from the object rather than defaulted, because there is no honest
-   * default: 0 or -1 would compare as older than every real version, so a poller would read a
-   * revoked handle as a change it had yet to see, forever. With the key absent, TypeScript
-   * refuses arithmetic or ordering on it until the caller has handled `undefined`, and
-   * `'recordVersion' in status` is false. Never replace absence with a number (`?? 0`).
-   */
-  recordVersion?: number;
-  stalePending?: boolean;
-};
-type ClaustrumReporterSource = 'direct' | 'relay_status_field' | 'relay_message_parse';
-declare class ClaustrumClient {
-  #private;
-  private constructor();
-  static connect(options?: ClaustrumClientOptions): Promise<ClaustrumClient>;
-  getCredential(handle: string, minTtlMs?: number): Promise<ServedCredential>;
-  statusCredential(handle: string): Promise<CredentialStatus>;
-  reportAuthFailure(input: {
-    handle: string;
-    providerStatus: number;
-    recordVersion: number;
-    reporterSource: ClaustrumReporterSource;
-  }): Promise<void>;
-  /**
-   * Enumerate what this caller's grants cover.
-   *
-   * `params` is `{}` and must be PRESENT: the vault rejects an absent or null params
-   * object, so a caller cannot ask a different question by omitting it.
-   */
-  listScoped(enrollmentToken?: string): Promise<ScopedInventory>;
-  /**
-   * Fetch by credential id, authorized by a grant rather than a bearer handle.
-   *
-   * `minTtlMs` is a DEMAND, not a hint: if a real upstream exchange still cannot satisfy
-   * it, the vault refuses with `ttl_unsatisfiable` (class `context_overflow`) rather than
-   * serving a token that will die inside the caller's own margin. That class means
-   * reduce-and-retry, never wait-and-retry.
-   */
-  getScoped(input: {
-    credentialId: string;
-    enrollmentToken?: string;
-    minTtlMs?: number;
-  }): Promise<ServedCredential>;
-  /**
-   * Report a served credential dead, addressed by id rather than by handle.
-   *
-   * VERSION-FENCED: `recordVersion` must be the one this caller was SERVED. A report
-   * against a since-refreshed version is accepted and does nothing, which is the point --
-   * a stale report must not kill a fresh token. `accepted: true` is the receipt that the
-   * report was taken, never evidence that it applied.
-   */
-  reportAuthFailureScoped(input: {
-    credentialId: string;
-    enrollmentToken?: string;
-    providerStatus: number;
-    recordVersion: number;
-    reporterSource: ClaustrumReporterSource;
-  }): Promise<void>;
-  /**
-   * Propose an enrollment. The consumer mints `requestSecret` itself and sends only its
-   * hash; the raw secret NEVER leaves the process, and it is what authorizes the poll.
-   *
-   * IDEMPOTENT ON (name, secret): re-proposing with the same secret returns the SAME
-   * `requestId`. That exists because `requestId` is minted server-side, so a consumer
-   * cannot persist it before proposing -- a crash in that window would otherwise leave it
-   * holding a secret it cannot poll with and a name held until TTL. Persist the secret
-   * BEFORE calling this, and a crash costs nothing.
-   *
-   * A different secret on the same name is a different caller and is refused.
-   */
-  enrollPropose(input: {
-    name: string;
-    requestSecretHash: string;
-  }): Promise<{
-    requestId: string;
-  }>;
-  /**
-   * Poll a proposal. Returns `pending` until an operator decides, then exactly once
-   * returns the token.
-   *
-   * THE TOKEN IS RETURNED ONCE. Persist it before doing anything else with it; a lost
-   * token needs a fresh ceremony, not a second poll.
-   */
-  enrollPoll(input: {
-    requestId: string;
-    requestSecret: string;
-  }): Promise<EnrollmentPollOutcome>;
-  /**
-   * Exchange a live token for its successor. The old token dies when the new one is issued.
-   *
-   * `expectedTokenGeneration` IS REQUIRED AND IS A FENCE, not bookkeeping: it must be the
-   * generation this caller currently holds. Two rotations racing — a retry after an
-   * uncertain reply, or two instances of the same consumer — would otherwise each mint a
-   * successor and each invalidate the other's, leaving a consumer holding a token the
-   * vault has already replaced. The vault refuses a rotation whose expectation does not
-   * match, so the loser learns it lost instead of discovering it on a later spend.
-   */
-  enrollRotate(input: {
-    token: string;
-    expectedTokenGeneration: number;
-  }): Promise<{
-    token: string;
-    tokenGeneration: number;
-  }>;
-  close(): void;
-}
-/**
- * A row from the caller's own grant-covered inventory.
- *
- * Selection fields answer different questions. Pick by what you are about
- * to do with the token:
- *
- * - `providerIds` — operator-assigned catalog provider ids; match exactly, with no fallback.
- * - `authMethod` — the closed authentication method derived from the unsealed record,
- *   not the id spelling. Absent on sign/open-only rows or when no method is defined.
- *
- * - `refreshAdapter` — whose PROTOCOL the credential speaks. Use it when the token
- *   goes to a provider's own endpoints. Anything else is invalid there.
- * - `serves` — which model VENDORS are reachable through it. Use it when choosing
- *   where a model can be served from, and the protocol is not yours to care about.
- *
- * Never infer these fields from the id spelling. A credential reaching Anthropic models
- * through OpenRouter still speaks OpenRouter's protocol, not Anthropic's.
- */
-interface ScopedInventoryRow {
-  readonly id: string;
-  readonly categories: readonly string[];
-  readonly credentialType: string;
-  readonly serves: readonly string[];
-  /**
-   * Operator-assigned catalog ids; empty when none are set. Always present on this type.
-   * A daemon older than the field omits it from the wire, and that decodes as empty,
-   * which is also what an unmapped credential reports.
-   */
-  readonly providerIds: readonly string[];
-  readonly authMethod?: 'apikey' | 'chatgpt' | 'antigravity' | 'oauth';
-  /**
-   * Which provider protocol this credential speaks. Absent for static keys.
-   *
-   * SELECT ON THIS, NOT ON `serves`, WHEN THE TOKEN GOES TO A PROVIDER'S OWN ENDPOINTS.
-   * Measured on a live vault: eight rows serve Anthropic models and only five are Claude
-   * OAuth -- openrouter, antigravity and cursor reach Anthropic models through their own
-   * APIs. The id spelling does not separate them either: two contain no "anthropic" at
-   * all, and `credentialType === 'oauth'` catches antigravity and cursor too.
-   */
-  readonly refreshAdapter?: string;
-  readonly state: string;
-  readonly recordVersion: number;
-  readonly operations: readonly string[];
-  /**
-   * NOT SERVED TODAY. The field is absent from `ListScopedCredential`, so this is always
-   * null; it is declared because a consumer's discovery high-water mark needs it and the
-   * absence should be visible in the type rather than discovered at runtime.
-   */
-  readonly createdAtMs: number | null;
-  readonly accountId?: string;
-  readonly email?: string;
-  readonly orgName?: string;
-}
-/**
- * An inventory reply: the covered rows, plus the cursor that says whether they moved.
- *
- * `view` is a DIGEST OVER WHAT THIS CALLER CAN SEE — ids, categories, state, operations —
- * and deliberately NOT over `record_version`, so a routine token refresh does not move it.
- * Compare it against the previous call's to decide whether to reconcile at all; it is an
- * opaque string and nothing but equality is defined on it.
- */
-interface ScopedInventory {
-  readonly rows: readonly ScopedInventoryRow[];
-  readonly view: string;
-}
-/** What a poll found. `pending` is not an error: the operator has not decided yet. */
-type EnrollmentPollOutcome = {
-  readonly status: 'pending';
-} | {
-  readonly status: 'approved';
-  readonly name: string;
-  readonly token: string;
-  readonly tokenGeneration: number;
-} | {
-  readonly status: 'denied';
-};
-//#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/claustrum/custody.d.ts
-type ClaustrumScopedClient = Pick<ClaustrumClient, 'listScoped' | 'getScoped' | 'reportAuthFailureScoped' | 'close'>;
 /** The two credential types a plugin's family can hold; routing differs by type. */
 type VaultCredentialType = 'oauth' | 'api_key';
 /**
@@ -1832,56 +1131,7 @@ interface ClaustrumScopedAttempt {
   readonly expiresAtMs: number | null;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/quota/map.d.ts
-interface QuotaReadingEntry {
-  scope: string;
-  label: string;
-  kind: 'reading';
-  checkedAt: number;
-  usedPercent: number;
-  /** ISO timestamp at which the window resets, as the provider reported it. */
-  resetsAt?: string;
-  /** Window length in minutes, when the provider reported one. */
-  windowMinutes?: number;
-}
-interface QuotaRetiredEntry {
-  scope: string;
-  label: string;
-  kind: 'retired';
-  retiredAt: number;
-}
-interface QuotaAbsentEntry {
-  scope: string;
-  label: string;
-  kind: 'absent';
-  checkedAt: number;
-}
-type QuotaEntry = QuotaReadingEntry | QuotaRetiredEntry | QuotaAbsentEntry;
-interface CreditBudgetReading {
-  kind: 'reading';
-  checkedAt: number;
-  /** The provider's own verdict that the budget is spent. */
-  reached: boolean;
-  remainingPercent?: number;
-  usedPercent?: number;
-  resetsAt?: string;
-  limit?: number;
-  used?: number;
-  remaining?: number;
-  unit?: string;
-}
-interface CreditBudgetCleared {
-  kind: 'cleared';
-  checkedAt: number;
-}
-type CreditBudgetEntry = CreditBudgetReading | CreditBudgetCleared;
-interface QuotaMap {
-  limits: QuotaEntry[];
-  /** Absent means no observation has reported on the budget yet. */
-  budget?: CreditBudgetEntry;
-}
-//#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/claustrum/interlock.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/claustrum/interlock.d.ts
 /**
  * The declined-account interlock: the user's "do not use this vault account",
  * kept on the consumer side because the vault has no notion of it.
@@ -1900,7 +1150,7 @@ interface DeclinedAccount {
   readonly accountIdentity?: string;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/claustrum/roster.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/claustrum/roster.d.ts
 /**
  * One vault account as the pool sees it. It carries no bearer material: the
  * access token is fetched from the vault for every send. Several vault
@@ -1955,7 +1205,7 @@ interface VaultRosterFile {
  */
 type QuotaReceipt = Pick<ClaustrumScopedAttempt, 'credentialId' | 'accountIdentity' | 'accountIdentitySource' | 'expectedAccountIdentity'>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/claustrum/enrollment.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/claustrum/enrollment.d.ts
 interface ClaustrumEnrollmentClient {
   enrollPropose(input: {
     name: string;
@@ -2084,6 +1334,12 @@ declare class OpenAiVault {
    * `VAULT_REQUEST_ROSTER_WAIT_MS`.
    */
   firstRoster(): Promise<void>;
+  /**
+   * Readies a current vault roster before request routing. The startup
+   * discovery may have settled while this host was local, so firstRoster()
+   * alone cannot tell a vault-mode request that it has a roster to use.
+   */
+  awaitRequestRoster(): Promise<void>;
   /**
    * Re-reads the accounts from the vault now. Never rejects. It resolves only
    * after a discovery that began after this call: one already in flight (the
@@ -2149,8 +1405,8 @@ declare class OpenAiVault {
    * the background; a failure is logged.
    */
   recordSnapshot(routeId: string, snapshot: unknown, complete: boolean, receipt: QuotaReceipt): Promise<void>;
-  /** Joins an existing quota poll, or starts one through the usage endpoint. */
-  pollQuota(routeId: string): Promise<{
+  /** Joins a quota poll; current insula quota for the same account replaces a background ChatGPT wham/usage request. */
+  pollQuota(routeId: string, background?: boolean): Promise<{
     ok: boolean;
     error?: string;
   }>;
@@ -2199,6 +1455,60 @@ declare class OpenAiVault {
   close(): void;
 }
 //#endregion
+//#region ../core/dist/commands.d.ts
+/**
+ * The prompt-cache manager, as the Cache section uses it.
+ *
+ * Declared structurally rather than imported: the manager itself is tied to
+ * one host's live request loader and stays there. Only the members the Cache
+ * section and the host's session cleanup reach appear here.
+ */
+interface CacheKeepManager {
+  status(): {
+    running: boolean;
+    sustain: boolean;
+    window?: {
+      startHour: number;
+      endHour: number;
+    } | undefined;
+    tracked: number;
+    generatedAt: number;
+    ttlMs: number;
+    leadMs: number;
+    maxIdleWarmMs: number;
+    maxSubagentIdleMs: number;
+    targets: ReadonlyArray<{
+      sessionKey: string;
+      accountId?: string;
+      cacheExpiresAt: number;
+      lastWarmedAt?: number;
+      backoffUntil?: number;
+    }>;
+  };
+  start(): void;
+  stop(): void;
+  remove(sessionKey: string): void;
+}
+interface ResetTargetIdentity {
+  accountKey: string;
+  label: string;
+  accessToken: string;
+  chatgptAccountId?: string;
+  onAuthFailure?: (status: number) => Promise<void>;
+}
+/** One live process, on an older version, that keeps the accounts from moving to the account pool. */
+interface MigrationBlocker {
+  /** `'unknown'` when the directory of process heartbeats could not be read. */
+  pid: number | 'unknown';
+  version: string;
+}
+type MenuMigrationState = {
+  migrated: true;
+} | {
+  migrated: false;
+  blockers: readonly MigrationBlocker[];
+};
+//#endregion
 //#region src/core/version-fence.d.ts
 /** One live process that keeps the fence shut. */
 interface VersionFenceBlocker {
@@ -2431,4 +1741,4 @@ interface PoolLifecycleDeps {
   paused?: () => boolean | Promise<boolean>;
 }
 //#endregion
-export { BeginAccountLoginOptions as a, TokenResponse as c, parseJwtClaims as d, AccountPaths as f, OpenAiVaultOptions as i, beginAccountLogin as l, HostSlotAdapter as n, BeginAccountLoginResult as o, PoolStore as p, OpenAiVault as r, IdTokenClaims as s, PoolLifecycleDeps as t, extractAccountIdFromClaims as u };
+export { ResetTargetIdentity as a, BeginAccountLoginOptions as c, TokenResponse as d, beginAccountLogin as f, PoolStore as g, AccountPaths as h, MenuMigrationState as i, BeginAccountLoginResult as l, parseJwtClaims as m, HostSlotAdapter as n, OpenAiVault as o, extractAccountIdFromClaims as p, CacheKeepManager as r, OpenAiVaultOptions as s, PoolLifecycleDeps as t, IdTokenClaims as u };