@cortexkit/opencode-openai-auth 1.0.5 → 1.2.0

package/dist/{pool-lifecycle-C_6YRmsh.d.ts → codex-request-CjXETpTA.d.ts}

@@ -1,7 +1,8 @@
-import { n as QuotaMap } from "./map-m6f5a_IA.js";
+import { a as KnobValues, c as PluginExtraSection, i as CommandInvocation, l as PluginSection, o as MenuKnob, t as CommandApplyRequest } from "./model-CQcw10oW.js";
+import { mt as QuotaMap } from "./sidebar-state-BfQ4mpZO.js";
 import { ClaustrumClient, EnrollmentPollOutcome } from "@cortexkit/claustrum-client";
 import "@cortexkit/private-files";
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/schema.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/schema.d.ts
 type OAuthCredential = {
   type: 'oauth';
   access?: string;
@@ -190,7 +191,7 @@ interface PoolRow {
   unbound?: true;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/errors.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/errors.d.ts
 /** Every library operation that can fail, as named in the failure value. */
 type PoolOperation = 'initialize' | 'add' | 'replace' | 'rotate' | 'disable' | 'enable' | 'remove' | 'reorder' | 'updateSettings' | 'recordIdentity' | 'updateProviderState' | 'refresh' | 'pull' | 'publishRoster';
 /**
@@ -237,12 +238,12 @@ declare class PoolOperationError extends Error {
   });
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/hooks.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/hooks.d.ts
 interface PoolLogger {
   warn(message: string, data?: unknown): void;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/fs/refresh-file-lock.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/fs/refresh-file-lock.d.ts
 interface LockLoss {
   readonly reason: 'taken-over' | 'expired' | 'unreadable' | 'renewal-failed' | 'marker-lost';
   readonly expectedOwnerId: string;
@@ -257,7 +258,7 @@ interface RefreshFileLock {
   whenLost(): Promise<LockLoss>;
   hasLost(): boolean;
 }
-declare function acquireRefreshFileLock(options: {
+type RefreshFileLockOptions = {
   name: string;
   ttlMs: number;
   /**
@@ -266,7 +267,6 @@ declare function acquireRefreshFileLock(options: {
    * be one host's path.
    */
   path: string;
-  now?: () => number;
   renew?: boolean;
   renewIntervalMs?: number;
   /** Notifies a live-owner refusal without awaiting; observer failures are ignored. */
@@ -274,9 +274,11 @@ declare function acquireRefreshFileLock(options: {
   /** Synchronous, never awaited; throws and returned promise/thenable rejections are isolated. */
   onRenewalTimer?: (event: 'scheduled' | 'cancelled') => void;
   onStep?: (step: 'stale-marker-stat' | 'stale-marker-claimed' | 'stale-lock-observed' | 'lock-read-ready' | 'lock-missing' | 'stale-lock-confirmed' | 'stale-lock-removed' | 'stale-lock-recreated' | 'eviction-marker-acquired' | 'renewal-owner-confirmed' | 'renewal-marker-unavailable' | 'renewal-write-fenced' | 'renewal-write-ready' | 'renewal-write-finished' | 'relinquish-read' | 'renewal-finished' | 'release-owner-confirmed') => void | Promise<void>;
-}): Promise<RefreshFileLock | null>;
+};
+/** Filesystem leases share wall time across all callers and processes. */
+declare function acquireRefreshFileLock(options: RefreshFileLockOptions): Promise<RefreshFileLock | null>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/refresh-lock.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/refresh-lock.d.ts
 type LockStep = NonNullable<Parameters<typeof acquireRefreshFileLock>[0]['onStep']> extends ((step: infer S) => unknown) ? S : never;
 /** Tuning shared by every lock the store takes; each field is overridable. */
 interface PoolLockOptions {
@@ -297,7 +299,6 @@ type LockEvent = {
   path: string;
 };
 interface LockEnvironment {
-  now: () => number;
   onLockEvent?: (event: LockEvent) => void;
   onLockStep?: (lock: {
     name: string;
@@ -309,7 +310,7 @@ interface LockEnvironment {
   }, event: 'scheduled' | 'cancelled') => void;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/mutate.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/mutate.d.ts
 /** Named points on the write path, for crash and ownership injection. */
 type WriteStep = 'before-config-write' | 'after-config-write' | 'before-state-write' | 'after-state-write';
 /** Awaitable pause points on the pull and refresh paths. */
@@ -344,11 +345,11 @@ interface StoreContext {
 /** What `initializePool` did. */
 type InitializeOutcome = 'initialized' | 'already-ready';
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/runtime.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/runtime.d.ts
 /** Where a pull was fired from; `load` fires at most once per process per row. */
 type PullReason = 'load' | 'add' | 'replace' | 'admission';
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/attribution.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/attribution.d.ts
 /**
  * What a pull or refresh captured about its row (named by id alongside) when
  * it was issued. A result applies only while the row with that id still has
@@ -371,7 +372,7 @@ interface Attribution {
   identity?: string;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/rows.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/rows.d.ts
 type FailureHook = (rowId: string, error: PoolOperationError) => void | Promise<void>;
 interface RowOperationOptions {
   /** Called once, awaited, on every non-success path, before locks release. */
@@ -587,7 +588,7 @@ interface RowTransitionResult {
   providerState?: unknown;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/provider-state.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/provider-state.d.ts
 /**
  * Receives a private copy of the row's provider state (undefined when the row
  * shows none) and the row as loaded under the locks, and returns the next
@@ -623,7 +624,7 @@ declare const DECLINE_TRANSITION: unique symbol;
  */
 type RowTransitionMutator = (current: unknown | undefined, row: PoolRow) => unknown | typeof DECLINE_TRANSITION | Promise<unknown | typeof DECLINE_TRANSITION>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/publication.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/publication.d.ts
 interface PublishPlan {
   operationId: string;
   remove: Array<{
@@ -666,7 +667,7 @@ interface PublishResult {
   receipt: PublicationReceipt;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/pull.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/pull.d.ts
 /** What a pull is issued with: the credential and its attribution tuple. */
 interface PullRequest {
   id: string;
@@ -677,7 +678,7 @@ interface PullRequest {
 }
 type PullHook = (request: PullRequest) => Promise<unknown>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/refresh.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/refresh.d.ts
 /** What the injected provider refresh function returns. */
 interface ProviderRefreshResult {
   access: string;
@@ -740,7 +741,7 @@ type RefreshOutcome = {
   reason: string;
 };
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/settings.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/settings.d.ts
 /** The plugin's settings: every top-level config key except the pool-owned ones. */
 type PoolSettings = Record<string, unknown>;
 type SettingsRead = {
@@ -784,7 +785,7 @@ type UpdateSettingsResult = {
   outcome: 'updated' | 'unchanged';
 };
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/pool.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/pool.d.ts
 interface OpenPoolStoreOptions {
   /** The provider every row of this pool belongs to; keys the provider-wide lock. */
   provider: string;
@@ -817,7 +818,7 @@ interface OpenPoolStoreOptions {
   requireCredentialStamps?: boolean;
   /** Require an exact secret fingerprint for every roster-publication removal. */
   requireRemovedFingerprint?: boolean;
-  /** Injected clock for leases, refresh stamps and `addedAt`. */
+  /** Logical clock for refresh stamps and `addedAt`; filesystem leases always use wall time. */
   now?: () => number;
   /**
    * Ordered store-lock list held across every read-modify-write. Defaults to
@@ -970,6 +971,44 @@ interface PoolStore {
   pullsSettled(): Promise<void>;
 }
 //#endregion
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/commands/seam.d.ts
+/** Where a dropped field is reported. Names only, never values. */
+interface SeamLogger {
+  warn(message: string, data?: unknown): void;
+}
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/commands/builtins.d.ts
+/**
+ * What a plugin's login hands back. `ready` adds the account now. `pending`
+ * means the user must finish somewhere else (a browser, a device code):
+ * `message` tells them how, and the account is added when `completion`
+ * settles, with the result sent to the invocation that started it.
+ */
+type LoginOutcome = {
+  status: 'ready';
+  account: AddInput;
+} | {
+  status: 'pending';
+  message: string;
+  /** Resolves with the account to add, or undefined when the user gave up. */
+  completion: Promise<AddInput | undefined>;
+} | {
+  status: 'cancelled';
+  message?: string;
+};
+interface AccountsSectionOptions {
+  /** What to show as an account's identity; defaults to its recorded identity. */
+  describeIdentity?(row: PoolRow): string | undefined;
+  /** The plugin's login; without it the section offers no add action. */
+  login?: {
+    label?: string;
+    knobs?: MenuKnob[];
+    run(values: KnobValues, invocation: CommandInvocation): Promise<LoginOutcome>;
+  };
+  /** Passed to `store.remove`: a reason refuses removing that id. */
+  protect?: RemoveOptions['protect'];
+}
+//#endregion
 //#region ../core/dist/paths.d.ts
 /**
  * The config file and the runtime-state file a store operation reads and writes.
@@ -1058,14 +1097,14 @@ interface BeginAccountLoginResult {
  */
 declare function beginAccountLogin(opts: BeginAccountLoginOptions): Promise<BeginAccountLoginResult>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/claustrum/insula.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/claustrum/insula.d.ts
 /** Optional transport for custom scoped clients; getUsage must not retry refusals. */
 interface InsulaUsageTransport {
   connectionFile: string;
   getUsage(): Promise<unknown>;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/claustrum/custody.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/claustrum/custody.d.ts
 type ClaustrumScopedClient = Pick<ClaustrumClient, 'listScoped' | 'getScoped' | 'reportAuthFailureScoped' | 'close'> & {
   insula?: InsulaUsageTransport;
 };
@@ -1085,6 +1124,30 @@ interface SkippedVaultRecord {
   readonly credentialId?: string;
   readonly reason: SkippedVaultReason;
 }
+/**
+ * One grant this consumer's enrollment holds, as the vault's list reply names
+ * it: for example `{ selectorKind: 'category', selector: 'openai-native',
+ * operation: 'read' }`. `selectorKind` is `exact` (the selector is a credential
+ * id) or `category` (a bare category name); both open strings.
+ */
+interface VaultGrantTuple {
+  readonly selectorKind: string;
+  readonly selector: string;
+  readonly operation: string;
+}
+/**
+ * What this consumer is granted, independent of what those grants currently
+ * reach. It is what tells two empty listings apart: no rows with `grants === 0`
+ * means no grant at all (the fix is `ck auth grant`), while no rows with
+ * `grants > 0` means a grant that reaches no credential, usually logins that
+ * lack the category (`ck auth reclassify --from-registry`); `tuples` names the
+ * selector that matched nothing. Never written to the roster file.
+ */
+interface VaultGrantReach {
+  /** How many grants the consumer holds, deposit grants excluded. */
+  readonly grants: number;
+  readonly tuples: readonly VaultGrantTuple[];
+}
 /**
  * Where a receipt's `accountIdentity` came from: the vault asserted it in the
  * served reply, the plugin's `parseIdentity` read it from the served token, or
@@ -1131,7 +1194,7 @@ interface ClaustrumScopedAttempt {
   readonly expiresAtMs: number | null;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/claustrum/interlock.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/claustrum/interlock.d.ts
 /**
  * The declined-account interlock: the user's "do not use this vault account",
  * kept on the consumer side because the vault has no notion of it.
@@ -1150,7 +1213,7 @@ interface DeclinedAccount {
   readonly accountIdentity?: string;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/claustrum/roster.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/claustrum/roster.d.ts
 /**
  * One vault account as the pool sees it. It carries no bearer material: the
  * access token is fetched from the vault for every send. Several vault
@@ -1205,7 +1268,7 @@ interface VaultRosterFile {
  */
 type QuotaReceipt = Pick<ClaustrumScopedAttempt, 'credentialId' | 'accountIdentity' | 'accountIdentitySource' | 'expectedAccountIdentity'>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/claustrum/enrollment.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/claustrum/enrollment.d.ts
 interface ClaustrumEnrollmentClient {
   enrollPropose(input: {
     name: string;
@@ -1265,6 +1328,8 @@ interface VaultPaths extends ClaustrumEnrollmentPaths {
 /** One vault account as routing sees it. */
 interface VaultRoute {
   id: string;
+  /** The vault credential name, distinct from its stable routing id. */
+  credentialId?: string;
   kind: 'oauth' | 'api-key';
   /** The ChatGPT account it signs in as, when the vault knows it. */
   identity?: string;
@@ -1349,6 +1414,12 @@ declare class OpenAiVault {
    */
   refresh(): Promise<VaultRosterFile | undefined>;
   snapshot(): VaultRosterFile | undefined;
+  /**
+   * What the vault says this host is granted, from the latest list, without
+   * any I/O. Undefined is unknown (a vault that does not report grants, or
+   * nothing listed yet), never zero grants.
+   */
+  grantReach(): VaultGrantReach | undefined;
   /** Whether the vault serves this host any account (whatever its state). */
   serves(): boolean;
   /**
@@ -1455,6 +1526,9 @@ declare class OpenAiVault {
   close(): void;
 }
 //#endregion
+//#region ../core/dist/vault-account-menu.d.ts
+type MenuVault = Pick<OpenAiVault, 'authority' | 'refresh' | 'status' | 'identities' | 'routes' | 'pollQuota' | 'snapshot'>;
+//#endregion
 //#region ../core/dist/commands.d.ts
 /**
  * The prompt-cache manager, as the Cache section uses it.
@@ -1496,6 +1570,15 @@ interface ResetTargetIdentity {
   chatgptAccountId?: string;
   onAuthFailure?: (status: number) => Promise<void>;
 }
+interface AccountRules {
+  /**
+   * The legacy locks a write of row `id` holds besides the store's own: the
+   * locks an older openai-auth process holds while it refreshes that row.
+   * Taken by remove, enable, disable and replace (and by the replace a
+   * re-login becomes).
+   */
+  rowLocks?(id: string): readonly PoolLockSpec[];
+}
 /** One live process, on an older version, that keeps the accounts from moving to the account pool. */
 interface MigrationBlocker {
   /** `'unknown'` when the directory of process heartbeats could not be read. */
@@ -1508,6 +1591,53 @@ type MenuMigrationState = {
   migrated: false;
   blockers: readonly MigrationBlocker[];
 };
+/** A started OAuth login, as `beginAccountLogin` returns it. */
+interface MenuLoginFlow {
+  url: string;
+  instructions: string;
+  completion: Promise<IngestAccount>;
+}
+interface MenuLoginDeps {
+  /** Starts a browser login, or a device-code login when `headless`. */
+  begin(options: {
+    label?: string;
+    headless: boolean;
+  }): Promise<MenuLoginFlow>;
+  /** The main account's ChatGPT identity; a login of that account is refused. */
+  mainIdentity?(): Promise<string | undefined>;
+}
+interface OpenAiMenuOptions {
+  store: PoolStore;
+  vault?: MenuVault;
+  /** Display the normal actions, but refuse all applies before running one. */
+  readOnly?: boolean;
+  /** A host capability fence, checked before the shared engine runs an action. */
+  allowAction?: (request: CommandApplyRequest) => boolean;
+  /** Keep unsupported host sections in their normal positions without actions. */
+  unavailableSections?: readonly ('cache' | 'diagnostics' | 'reset')[];
+  /**
+   * The legacy locks the menu's writes that name no single row take (the
+   * roster order, settings, a new account).
+   */
+  extraLocks?: readonly PoolLockSpec[];
+  /** The legacy locks a write of one row takes; see `AccountRules`. */
+  rowLocks?: AccountRules['rowLocks'];
+  /** Whether the install is migrated; absent means it always is (Pi). */
+  migration?(): Promise<MenuMigrationState>;
+  login?: MenuLoginDeps;
+  /** Passed to every removal: refuses row `main` and a pending transfer's row. */
+  protect?: RemoveOptions['protect'];
+  describeIdentity?: AccountsSectionOptions['describeIdentity'];
+  /** The plugin's "check quota now"; without it the store pulls each row. */
+  quotaCheck?(ids: readonly string[], invocation: CommandInvocation): Promise<void>;
+  cache?: PluginSection;
+  diagnostics?: PluginSection;
+  extras?: readonly PluginExtraSection[];
+  /** Runs after every successful apply (the host re-reads its rows). */
+  afterApply?(): unknown;
+  logger?: SeamLogger;
+  now?: () => number;
+}
 //#endregion
 //#region src/core/version-fence.d.ts
 /** One live process that keeps the fence shut. */
@@ -1566,6 +1696,8 @@ interface LegacyLockOptions {
 interface PoolMigrationDeps {
   paths: AccountPaths;
   slot: HostSlotAdapter;
+  /** Stop waiting for transfer locks; a transfer already holding them finishes. */
+  signal?: AbortSignal;
   now?: () => number;
   sleep?: (ms: number) => Promise<void>;
   /** Id for a new row whose login carries no usable wire identity. */
@@ -1741,4 +1873,35 @@ interface PoolLifecycleDeps {
   paused?: () => boolean | Promise<boolean>;
 }
 //#endregion
-export { ResetTargetIdentity as a, BeginAccountLoginOptions as c, TokenResponse as d, beginAccountLogin as f, PoolStore as g, AccountPaths as h, MenuMigrationState as i, BeginAccountLoginResult as l, parseJwtClaims as m, HostSlotAdapter as n, OpenAiVault as o, extractAccountIdFromClaims as p, CacheKeepManager as r, OpenAiVaultOptions as s, PoolLifecycleDeps as t, IdTokenClaims as u };
+//#region src/util/canonical-input.d.ts
+interface CanonicalInput {
+  texts: string[];
+  snapshots: unknown[];
+  retainable: boolean;
+}
+//#endregion
+//#region src/codex-request.d.ts
+declare const RESPONSES_LITE_MODELS: ReadonlySet<string>;
+declare const CODEX_VERSION = "0.159.0";
+declare const CODEX_USER_AGENT = "codex_exec/0.159.0 (Debian 12.0.0; aarch64) unknown (codex_exec; 0.159.0)";
+interface CodexSessionMetadata {
+  threadID: string;
+  turnID: string;
+  windowID: string;
+  turnStartedAt?: number;
+  input?: unknown[];
+  canonicalInput?: CanonicalInput;
+  /** Keep the opening effort fixed while later changes travel as input items. */
+  pinnedEffort?: string;
+  effortUpdates?: Array<{
+    anchor: number;
+    fingerprint: string;
+    effort: string;
+  }>;
+}
+interface CodexRequestRuntime {
+  now: () => number;
+  uuid: () => string;
+}
+//#endregion
+export { PoolStore as S, TokenResponse as _, RESPONSES_LITE_MODELS as a, parseJwtClaims as b, CacheKeepManager as c, ResetTargetIdentity as d, OpenAiVault as f, IdTokenClaims as g, BeginAccountLoginResult as h, CodexSessionMetadata as i, MenuMigrationState as l, BeginAccountLoginOptions as m, CODEX_VERSION as n, PoolLifecycleDeps as o, OpenAiVaultOptions as p, CodexRequestRuntime as r, HostSlotAdapter as s, CODEX_USER_AGENT as t, OpenAiMenuOptions as u, beginAccountLogin as v, AccountPaths as x, extractAccountIdFromClaims as y };