@cortexkit/pi-openai-auth 1.0.2 → 1.0.4

package/dist/index.d.ts

@@ -1,6 +1,8 @@
 import { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import "@cortexkit/private-files";
+import { ClaustrumClient, EnrollmentPollOutcome } from "@cortexkit/claustrum-client";
 import { Api, AssistantMessageEventStream, Context, Model, SimpleStreamOptions } from "@earendil-works/pi-ai";
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/pi-slot/slot.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/pi-slot/slot.d.ts
 interface PiSlotInspection {
   slot: 'original' | 'placeholder' | 'foreign' | 'empty';
   stash: 'valid' | 'missing';
@@ -11,7 +13,7 @@ interface PiSlot {
   exitVault(): Promise<'restored' | 'conflict' | 'nothing-to-do'>;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/schema.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/schema.d.ts
 type OAuthCredential = {
   type: 'oauth';
   access?: string;
@@ -40,6 +42,8 @@ type StoredCredential = (OAuthCredential & {
 /** Quota codec supplied by `/quota`: the store never interprets the map itself. */
 interface QuotaCodec {
   validate(value: unknown): boolean;
+  /** Normalize persisted quota before validation, when the codec supports it. */
+  decode?(value: unknown): unknown;
   merge(stored: unknown | undefined, observation: unknown): unknown;
 }
 /**
@@ -198,7 +202,7 @@ interface PoolRow {
   unbound?: true;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/errors.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/errors.d.ts
 /** Every library operation that can fail, as named in the failure value. */
 type PoolOperation = 'initialize' | 'add' | 'replace' | 'rotate' | 'disable' | 'enable' | 'remove' | 'reorder' | 'updateSettings' | 'recordIdentity' | 'updateProviderState' | 'refresh' | 'pull' | 'publishRoster';
 /**
@@ -245,12 +249,12 @@ declare class PoolOperationError extends Error {
   });
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/hooks.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/hooks.d.ts
 interface PoolLogger {
   warn(message: string, data?: unknown): void;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/fs/refresh-file-lock.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/fs/refresh-file-lock.d.ts
 interface LockLoss {
   readonly reason: 'taken-over' | 'expired' | 'unreadable' | 'renewal-failed' | 'marker-lost';
   readonly expectedOwnerId: string;
@@ -281,10 +285,10 @@ declare function acquireRefreshFileLock(options: {
   onContended?: () => void;
   /** Synchronous, never awaited; throws and returned promise/thenable rejections are isolated. */
   onRenewalTimer?: (event: 'scheduled' | 'cancelled') => void;
-  onStep?: (step: 'stale-marker-stat' | 'stale-marker-claimed' | 'stale-lock-observed' | 'stale-lock-confirmed' | 'stale-lock-removed' | 'stale-lock-recreated' | 'eviction-marker-acquired' | 'renewal-owner-confirmed' | 'renewal-marker-unavailable' | 'renewal-write-fenced' | 'renewal-write-ready' | 'relinquish-read' | 'renewal-finished' | 'release-owner-confirmed') => void | Promise<void>;
+  onStep?: (step: 'stale-marker-stat' | 'stale-marker-claimed' | 'stale-lock-observed' | 'lock-read-ready' | 'lock-missing' | 'stale-lock-confirmed' | 'stale-lock-removed' | 'stale-lock-recreated' | 'eviction-marker-acquired' | 'renewal-owner-confirmed' | 'renewal-marker-unavailable' | 'renewal-write-fenced' | 'renewal-write-ready' | 'renewal-write-finished' | 'relinquish-read' | 'renewal-finished' | 'release-owner-confirmed') => void | Promise<void>;
 }): Promise<RefreshFileLock | null>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/refresh-lock.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/refresh-lock.d.ts
 type LockStep = NonNullable<Parameters<typeof acquireRefreshFileLock>[0]['onStep']> extends ((step: infer S) => unknown) ? S : never;
 /** Tuning shared by every lock the store takes; each field is overridable. */
 interface PoolLockOptions {
@@ -311,9 +315,13 @@ interface LockEnvironment {
     name: string;
     path: string;
   }, step: LockStep) => void | Promise<void>;
+  onRenewalTimer?: (lock: {
+    name: string;
+    path: string;
+  }, event: 'scheduled' | 'cancelled') => void;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/mutate.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/mutate.d.ts
 /** Named points on the write path, for crash and ownership injection. */
 type WriteStep = 'before-config-write' | 'after-config-write' | 'before-state-write' | 'after-state-write';
 /** Awaitable pause points on the pull and refresh paths. */
@@ -348,11 +356,11 @@ interface StoreContext {
 /** What `initializePool` did. */
 type InitializeOutcome = 'initialized' | 'already-ready';
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/runtime.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/runtime.d.ts
 /** Where a pull was fired from; `load` fires at most once per process per row. */
 type PullReason = 'load' | 'add' | 'replace' | 'admission';
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/attribution.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/attribution.d.ts
 /**
  * What a pull or refresh captured about its row (named by id alongside) when
  * it was issued. A result applies only while the row with that id still has
@@ -375,7 +383,7 @@ interface Attribution {
   identity?: string;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/rows.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/rows.d.ts
 type FailureHook = (rowId: string, error: PoolOperationError) => void | Promise<void>;
 interface RowOperationOptions {
   /** Called once, awaited, on every non-success path, before locks release. */
@@ -591,7 +599,7 @@ interface RowTransitionResult {
   providerState?: unknown;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/provider-state.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/provider-state.d.ts
 /**
  * Receives a private copy of the row's provider state (undefined when the row
  * shows none) and the row as loaded under the locks, and returns the next
@@ -627,7 +635,7 @@ declare const DECLINE_TRANSITION: unique symbol;
  */
 type RowTransitionMutator = (current: unknown | undefined, row: PoolRow) => unknown | typeof DECLINE_TRANSITION | Promise<unknown | typeof DECLINE_TRANSITION>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/publication.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/publication.d.ts
 interface PublishPlan {
   operationId: string;
   remove: Array<{
@@ -670,7 +678,7 @@ interface PublishResult {
   receipt: PublicationReceipt;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/pull.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/pull.d.ts
 /** What a pull is issued with: the credential and its attribution tuple. */
 interface PullRequest {
   id: string;
@@ -681,7 +689,7 @@ interface PullRequest {
 }
 type PullHook = (request: PullRequest) => Promise<unknown>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/refresh.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/refresh.d.ts
 /** What the injected provider refresh function returns. */
 interface ProviderRefreshResult {
   access: string;
@@ -744,7 +752,7 @@ type RefreshOutcome = {
   reason: string;
 };
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/settings.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/settings.d.ts
 /** The plugin's settings: every top-level config key except the pool-owned ones. */
 type PoolSettings = Record<string, unknown>;
 type SettingsRead = {
@@ -788,7 +796,7 @@ type UpdateSettingsResult = {
   outcome: 'updated' | 'unchanged';
 };
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/store/pool.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/pool.d.ts
 interface OpenPoolStoreOptions {
   /** The provider every row of this pool belongs to; keys the provider-wide lock. */
   provider: string;
@@ -845,6 +853,7 @@ interface OpenPoolStoreOptions {
   hold?: (point: HoldPoint, rowId: string) => void | Promise<void>;
   onLockEvent?: LockEnvironment['onLockEvent'];
   onLockStep?: LockEnvironment['onLockStep'];
+  onRenewalTimer?: LockEnvironment['onRenewalTimer'];
 }
 type PoolLoad = {
   status: 'ready';
@@ -1193,728 +1202,17 @@ interface RefreshAllQuotaResult {
   permanent?: boolean;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+subc-client@0.16.1/node_modules/@cortexkit/subc-client/dist/connection-file.d.ts
-interface Endpoint {
-  host: string;
-  port: number;
-}
-interface ConnectionInfo {
-  schema: number;
-  endpoints: Endpoint[];
-  /** Transport key bytes. Serialized on disk as a JSON array of numbers. */
-  key: Uint8Array;
-  /** 16-byte daemon identity. Serialized on disk as a JSON array of numbers. */
-  daemonId: Uint8Array;
-  pid: number;
-  daemonVer: string;
-}
-//#endregion
-//#region ../../node_modules/.bun/@cortexkit+subc-client@0.16.1/node_modules/@cortexkit/subc-client/dist/envelope.d.ts
-/** Scheduling priority carried in flags bits 1-2. */
-declare enum Priority {
-  Passive = 0,
-  Interactive = 1,
-  Background = 2
-}
-/** Admission behavior carried in flags bits 4-5. */
-declare enum AdmissionClass {
-  Normal = 0,
-  Expedite = 1,
-  Sheddable = 2
-}
-//#endregion
-//#region ../../node_modules/.bun/@cortexkit+subc-client@0.16.1/node_modules/@cortexkit/subc-client/dist/route-handle.d.ts
-interface ReverseRequestContext {
-  readonly corr: bigint;
-  readonly method: string;
-}
-type ReverseRequestHandler = (body: Uint8Array, ctx: ReverseRequestContext) => Promise<Uint8Array> | Uint8Array;
-/**
- * Mutable handler registry prepared before route.open. The client derives
- * consumer_capabilities from its method families and seals that set when the
- * route opens; handlers for declared families may still be replaced afterward.
- */
-declare class ReverseRequestRegistry {
-  private readonly handlers;
-  private declaredFamilies;
-  onRequest(methodFamily: string, handler: ReverseRequestHandler): void;
-  /** @internal */
-  capabilities(): string[];
-  /** @internal */
-  handler(methodFamily: string): ReverseRequestHandler | undefined;
-  /** @internal */
-  seal(): void;
-}
-/**
- * Immutable identity for one route binding on one live socket. Only channel and
- * epoch cross the wire; the connection token remains private to this SDK.
- */
-declare class RouteHandle {
-  readonly channel: number;
-  readonly epoch: number;
-  private constructor();
-  /** Replace the handler for a capability declared when this route opened. */
-  onRequest(methodFamily: string, handler: ReverseRequestHandler): void;
-  private static create;
-}
-//#endregion
-//#region ../../node_modules/.bun/@cortexkit+subc-client@0.16.1/node_modules/@cortexkit/subc-client/dist/client.d.ts
-interface BindIdentity {
-  project_root: string;
-  harness: string;
-  session: string;
-}
-type RouteTarget = {
-  kind: "tool_provider";
-  module_id: string;
-} | {
-  kind: "management_surface";
-  module_id: string;
-} | {
-  kind: "internal_service";
-  module_id: string;
-  service_id: string;
-};
-type ManagedRouteKind = "management_surface" | "tool_provider";
-interface ConsumerIdentity {
-  module_id: string;
-  launch_nonce: string;
-}
-interface RouteOpenOptions {
-  /** Optional override for the consumer identity; by default the SUBC_MODULE_ID and SUBC_LAUNCH_NONCE environment variables are used when both are non-empty. Set null to send route.open without consumer_identity. */
-  consumerIdentity?: ConsumerIdentity | null;
-  /**
-   * Handlers prepared before route.open. The client derives consumer_capabilities
-   * from this registry; callers cannot declare a capability without a handler.
-   */
-  reverseRequests?: ReverseRequestRegistry;
-}
-interface CatalogCapabilityRequirement {
-  capability: string;
-  need: "required" | "optional";
-}
-interface CatalogCapabilities {
-  provides: string[];
-  requires: CatalogCapabilityRequirement[];
-  must_never_reach: string[];
-}
-/** A self-signal's anchor relative to the external surface it shapes. */
-type CatalogSignalAnchor = "fixed_interval" | {
-  event: {
-    event: string;
-  };
-};
-/** The source of a self-signal's effective cadence. */
-type CatalogSignalCadence = {
-  literal: {
-    interval_ms: number;
-  };
-} | {
-  derived: {
-    source: string;
-  };
-};
-/** A self-signal declaration mirrored from a registered module manifest. */
-interface CatalogSelfSignalDeclaration {
-  name: string;
-  /** Open string for forward-compatible self-signal kinds. */
-  kind: string;
-  effect: "observe" | "mutate";
-  anchored_to: CatalogSignalAnchor;
-  cadence?: CatalogSignalCadence | null;
-  domain?: string | null;
-  note?: string | null;
-}
-interface CatalogEntry {
-  module_id: string;
-  roles: unknown[];
-  control_ops: string[];
-  /** Static capability claims mirrored from the registered module manifest. */
-  capabilities?: CatalogCapabilities | null;
-  /** Self-signal declarations mirrored verbatim from the registered manifest. */
-  self_signals?: CatalogSelfSignalDeclaration[] | null;
-}
-interface RequestOptions {
-  priority?: Priority;
-  admissionClass?: AdmissionClass;
-  timeoutMs?: number;
-  /**
-   * Set when the request body is opaque bytes rather than JSON. This flag is the
-   * receiver's only signal about the body representation; reply decoding follows
-   * the response frame's flag instead of this request option.
-   */
-  binary?: boolean;
-  /** Called for each interim PUSH / StreamData frame before the terminal reply. */
-  onProgress?: (body: Uint8Array) => void;
-  /**
-   * Abort the request: when this fires while the request is still in flight, the
-   * client emits a CANCEL frame carrying that request's own corr.
-   *
-   * The signal exists instead of exposing corr because corr lifetime is already
-   * tracked here to settle replies; handing it out would make every caller keep a
-   * second map that can disagree with this one, and would let a caller cancel a
-   * corr it does not own.
-   *
-   * Cancellation is best-effort by the wire's construction: the daemon forwards
-   * the frame on a live route and silently drops it on a departed one, and no
-   * acknowledgement exists at any layer. Only the module's own reply proves what
-   * happened, so the promise is NOT rejected here -- it settles however the module
-   * answers, which may be a normal completion that beat the cancel.
-   */
-  signal?: AbortSignal;
-}
-interface ManagedCallOptions extends RequestOptions {
-  /** Overrides the per-client identity used for route.open before this call. */
-  identity?: BindIdentity;
-  /** Defaults to management_surface, matching the store/host management APIs. */
-  targetKind?: ManagedRouteKind;
-  /** Optional override for the consumer identity; by default the SUBC_MODULE_ID and SUBC_LAUNCH_NONCE environment variables are used when both are non-empty. Set null to send route.open without consumer_identity. */
-  consumerIdentity?: ConsumerIdentity | null;
-  /** Reverse-request handlers used by the managed route and all of its reconnect reopens. */
-  reverseRequests?: ReverseRequestRegistry;
-}
-interface SubscribeOptions {
-  priority?: Priority;
-  admissionClass?: AdmissionClass;
-}
-type RoutePollKind = "status" | "liveness";
-interface RoutePollResult {
-  route_channel: number;
-  route_epoch: number;
-  status: string | null;
-  live: boolean | null;
-}
-interface CloseRouteOptions {
-  /**
-   * Await in-flight UNARY requests on the route to settle before tearing it down.
-   * Subscriptions are always aborted (a held-open stream cannot be drained).
-   * Defaults to false: close immediately, aborting everything in flight.
-   */
-  drain?: boolean;
-}
-interface ManagedCloseRouteOptions extends CloseRouteOptions {
-  /** Consumer identity used by the cached managed route. */
-  consumerIdentity?: ConsumerIdentity | null;
-  /** The registry whose derived capability set identifies the cached route. */
-  reverseRequests?: ReverseRequestRegistry;
-}
-/**
- * Capped exponential reconnect backoff. maxAttempts includes the first immediate
- * reconnect attempt; sleeps happen only between failed transient attempts.
- */
-interface ReconnectBackoff {
-  /** First retry delay. */
-  baseMs: number;
-  /** Delay ceiling (doubling is capped here). */
-  capMs: number;
-  /** Max attempts (including the first) before giving up. */
-  maxAttempts: number;
-}
-/**
- * A live subscription to a provider's event stream, riding a single held-open
- * request. `onEvent` fires for each StreamData frame; `closed` resolves when the
- * provider ends the stream (StreamEnd) or the consumer unsubscribes, and rejects on
- * an Error terminal or a route GOODBYE. `unsubscribe` cancels the held-open request
- * so the provider unwinds.
- */
-interface Subscription {
-  /** Cancel the subscription: sends Cancel on the held-open request; idempotent. */
-  unsubscribe(): void;
-  /** Resolves on StreamEnd or local unsubscribe; rejects on an Error terminal or route close. */
-  readonly closed: Promise<void>;
-}
-interface ConnectOptions {
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/claustrum/insula.d.ts
+/** Optional transport for custom scoped clients; getUsage must not retry refusals. */
+interface InsulaUsageTransport {
   connectionFile: string;
-  handshakeTimeoutMs?: number;
-  /** Default route identity used by managed call(); can be overridden per call. */
-  identity?: BindIdentity;
-  /** Default route target kind used by managed call(); defaults to management_surface. */
-  targetKind?: ManagedRouteKind;
-  /** Backoff for managed reconnect after a connection drop. */
-  reconnectBackoff?: ReconnectBackoff;
-  /** Injectable sleep for timer-free reconnect tests. */
-  sleep?: (ms: number) => Promise<void>;
-  /**
-   * How long managed calls keep retrying route.open in-place on retryable
-   * refusals (module_reloading, module_warming, target_unavailable, …) before
-   * settling not_sent. This deadline is the ONLY binder on those retries —
-   * module reloads legitimately take tens of seconds (the daemon's drain alone
-   * defaults to 30s), so the default matches the daemon's drain ceiling.
-   */
-  routeOpenRetryDeadlineMs?: number;
-  /**
-   * Window the post-deadline liveness probe waits for ANY inbound frame after
-   * sending its channel-0 Ping before convicting the socket as half-open.
-   * Genuine event-loop starvation self-protects at any setting: a loop starved
-   * enough to delay the probe's check also delays the read loop, and when it
-   * wakes the buffered Pong dispatches first. Exposed for deterministic tests.
-   */
-  livenessProbeWindowMs?: number;
-  /**
-   * Hard cap on the timeout-arbitration grace window (see
-   * TIMEOUT_ARBITRATION_GRACE_MS). A reply whose bytes are actively arriving when
-   * the request deadline fires is given up to this long to finish dispatching
-   * before the call settles as a timeout. Bounded and never a deadline extension;
-   * exposed mainly so tests can prove the arbitration deterministically.
-   */
-  timeoutArbitrationGraceMs?: number;
-  /**
-   * Observer for daemon-originated channel-0 control pushes (`route.closing`,
-   * `route.closed`, and any op added later). Purely advisory: the daemon's
-   * load-bearing route-death signal remains the GOODBYE frame, and nothing in
-   * the client's own route lifecycle consumes these. The contract is the wire
-   * contract verbatim -- unrecognized ops still arrive here (callers ignore
-   * what they don't know, per the MUST-ignore clause), a push that fails to
-   * parse as JSON is dropped without surfacing, and an observer throw is
-   * swallowed like every other caller callback so it cannot fail the read loop
-   * or unrelated requests.
-   */
-  onControlPush?: (push: ControlPush) => void;
-}
-/** A parsed daemon-originated channel-0 control push. */
-interface ControlPush {
-  /** The push discriminator, e.g. "route.closing" | "route.closed". */
-  op: string;
-  /** The full parsed body, `op` included, for op-specific fields. */
-  body: Record<string, unknown>;
-}
-declare class SubcClient {
-  private sock;
-  private currentConn;
-  private readonly opts;
-  private nextCorr;
-  private readonly pending;
-  private readonly lateResponses;
-  private readonly routes;
-  private readonly liveRoutes;
-  private connectionToken;
-  private ingressEpochDropCount;
-  private closedErr;
-  private closeStarted;
-  private reconnecting;
-  private generation;
-  private readerActive;
-  private constructor();
-  get conn(): ConnectionInfo;
-  /** Read the connection file, connect, authenticate, and start the read loop. */
-  static connect(opts: ConnectOptions): Promise<SubcClient>;
-  /** List modules subc knows about (channel-0 catalog.list). */
-  catalogList(moduleId?: string): Promise<CatalogEntry[]>;
-  /**
-   * Resolve the sole catalog claimant for a capability.
-   *
-   * This expresses singular intent even when the fleet permits plural claims;
-   * ambiguity is returned instead of selecting an arbitrary module.
-   */
-  resolveProvider(capability: string): Promise<string>;
-  /** Resolve every catalog claimant in deterministic module-id order. */
-  resolveProviders(capability: string): Promise<string[]>;
-  /** Open a route and return its connection-bound immutable handle. */
-  routeOpen(target: RouteTarget, identity: BindIdentity, opts?: RouteOpenOptions): Promise<RouteHandle>;
-  /** Send a data-plane request on exactly the supplied route generation. */
-  request(handle: RouteHandle, body: unknown, opts?: RequestOptions): Promise<unknown>;
-  /**
-   * Managed route + request convenience. Opens and caches a route for the module,
-   * reconnecting and re-opening cached routes after connection drops.
-   */
-  call<Response = unknown>(moduleId: string, method: string, params?: unknown, opts?: ManagedCallOptions): Promise<Response>;
-  /**
-   * Managed route + raw opaque-body request convenience. Unlike call(), this
-   * sends bytes without a JSON method envelope because the BINARY flag is the
-   * receiver's only signal that the body is not JSON. A BINARY reply resolves
-   * to Uint8Array; a non-binary reply is decoded as JSON.
-   */
-  callBinary(moduleId: string, body: Uint8Array, opts?: ManagedCallOptions): Promise<Uint8Array | unknown>;
-  private managedCall;
-  /** Open a held request on exactly one route generation. */
-  subscribe(handle: RouteHandle, body: unknown, onEvent: (event: Uint8Array) => void, opts?: SubscribeOptions): Subscription;
-  /**
-   * Emit CANCEL for one in-flight request when its caller's signal fires.
-   *
-   * Emits only while the request is unsettled by this client's own book, which is
-   * a fact it owns and can check without racing. It deliberately does NOT check
-   * whether the route still exists: that would be a guess, and a wrong guess turns
-   * a frame the daemon would harmlessly drop into a frame never sent -- removing
-   * the caller's only chance at the cost of saving nothing.
-   */
-  private attachCancelSignal;
-  /** Send a pure-header cancellation for an in-flight request. */
-  cancel(handle: RouteHandle, corr: bigint, priority?: Priority): void;
-  /** Poll status or liveness for exactly the supplied route generation. */
-  routePoll(handle: RouteHandle, kind: RoutePollKind): Promise<RoutePollResult>;
-  /** Tear down exactly the supplied route generation. */
-  closeRoute(handle: RouteHandle, opts?: CloseRouteOptions): Promise<void>;
-  /** Close a cached managed route by its route-open identity tuple. */
-  closeManagedRoute(target: Extract<RouteTarget, {
-    kind: ManagedRouteKind;
-  }>, identity: BindIdentity, opts?: ManagedCloseRouteOptions): Promise<void>;
-  /** Alias retained for callers that name the operation by protocol channel; it still requires a full handle. */
-  closeRouteChannel(handle: RouteHandle, opts?: CloseRouteOptions): Promise<void>;
-  close(): void;
-  private drainUnaryOnHandle;
-  private sendRouteGoodbye;
-  private static openConnection;
-  private controlRpc;
-  private send;
-  /**
-   * A request-deadline timer has fired. Before settling as a timeout, arbitrate
-   * the timer-vs-poll race: a reply may already be in the socket buffer, unread
-   * only because the loop was starved. Yield one check phase (setImmediate) so a
-   * fully-buffered reply dispatches and wins via settle()'s identity guard; then,
-   * only while the reader is actively draining THIS socket (a frame mid-arrival),
-   * grant a single hard-capped grace before finally settling. Absent replies
-   * still settle right after the check phase. The settle carries the deadline
-   * marker so the managed classifier reports deadline-not-drop.
-   */
-  private arbitrateTimeout;
-  private managedRequest;
-  private sendManaged;
-  private cachedRouteHandle;
-  private openCachedRoute;
-  private lastInboundAtMs;
-  private livenessProbe;
-  /**
-   * Discriminate event-loop starvation from a half-open socket after a
-   * deadline-no-drop settle. The arbitration deliberately keeps the socket on
-   * that verdict (a late-read reply under load must not cost a healthy
-   * connection), but a half-open socket — peer vanished with no FIN/RST, as
-   * after host sleep/wake — yields the SAME verdict forever, so the keep
-   * becomes a permanent pin to a dead transport. The discriminator is
-   * socket-level liveness evidence: send a channel-0 Ping (the daemon always
-   * answers — subc-core control.rs) and require ANY inbound frame within the
-   * window; the Pong suffices, and a busy socket's other traffic proves the
-   * link just as well. Silence convicts: the socket is failed with a named
-   * cause and closed, so the ordinary drop path (pending rejection now,
-   * reconnect on the next call) takes over.
-   *
-   * Starvation cannot be falsely convicted by a short window: a loop starved
-   * enough to delay the read loop delays this probe's own timer identically,
-   * and when both wake the buffered Pong dispatches before the check runs.
-   *
-   * A PENDING CHANNEL-0 REQUEST SUSPENDS THE PROBE (both at launch and at the
-   * conviction check). The daemon's connection loop handles frames one at a
-   * time, and some channel-0 ops legally park it for seconds — route.open
-   * awaits the module's bind ack inline for up to route_bind_relay_timeout
-   * (~12s in production) — during which OUR Ping sits unread in the daemon's
-   * socket buffer. On an otherwise-quiet connection that silence is fully
-   * explained by our own in-flight control op, and convicting on it would
-   * tear down a healthy connection mid-bind (BROCA's Athena panel flagged
-   * this exact premise; the FIFO fact is verified in subc-core server.rs
-   * connection_loop + control.rs handle_route_open). The client always knows
-   * its own channel-0 pendings, so the gate is local and exact: no probe
-   * while one is in flight, no conviction if one appeared during the window.
-   *
-   * Scope: hooked from the managed-call path only. Control-plane requests
-   * (route.open, catalog.list) are short-lived and their failures already
-   * escalate through reconnect classification; the managed path is where a
-   * plugin lives for hours and where the pin was observed in production.
-   */
-  /** Any in-flight channel-0 request (pendings keyed without a route handle). */
-  private hasControlPending;
-  private probeLivenessAfterDeadline;
-  private ensureConnectedForManaged;
-  private scheduleReconnectAfterDrop;
-  private reconnectAfterDrop;
-  private reconnectWithRetry;
-  private replaceConnection;
-  private reopenCachedRoutes;
-  private timeoutMessage;
-  private routeClosedDuringOpen;
-  private readLoop;
-  private dispatch;
-  /**
-   * Settle a pending exactly once. The object-identity guard (the map still
-   * holds THIS pending under `key`) is the single-winner primitive: whichever of
-   * dispatch, a timeout, fail(), failChannel(), a GOODBYE, or a deferred timeout
-   * arbitration reaches it first wins, and every later caller no-ops. This is what
-   * makes the deferred-timeout arbitration safe — it cannot double-settle, reject
-   * an already-resolved promise, or delete a pending re-created for a later corr.
-   * Returns true when this call was the settler.
-   */
-  private settle;
-  private rejectPending;
-  private dispatchReverseRequest;
-  private sendReverseError;
-  private sendReverseReply;
-  private errorFromFrame;
-  private evictRouteHandle;
-  private failHandle;
-  private fail;
-  private notSentCallError;
-  private outcomeUnknownCallError;
-  private terminalCallError;
-  private notSentRecoveryError;
-  /** Number of nonzero-channel ingress frames dropped by endpoint epoch validation. */
-  get droppedIngressFrames(): number;
-  private installRoute;
-  private isLiveHandle;
-  private assertLiveConnection;
-  private assertLiveHandle;
-  private allocateCorr;
-  private closeConnectionAfterCleanupFailure;
-  private encode;
-  /** Decode a terminal response according to the representation on the wire. */
-  private decodeReply;
-  private parseJson;
+  getUsage(): Promise<unknown>;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+claustrum-client@0.6.2/node_modules/@cortexkit/claustrum-client/dist/wire.d.ts
-type ClaustrumConnector = (options: {
-  connectionFile: string;
-  handshakeTimeoutMs?: number;
-}) => Promise<SubcClient>;
-type ClaustrumClientOptions = {
-  connectionFile?: string;
-  handshakeTimeoutMs?: number;
-  projectRoot?: string;
-  storagePath?: string;
-  identity?: BindIdentity;
-  connector?: ClaustrumConnector;
-  logger?: (errorClass: string) => void;
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/claustrum/custody.d.ts
+type ClaustrumScopedClient = Pick<ClaustrumClient, 'listScoped' | 'getScoped' | 'reportAuthFailureScoped' | 'close'> & {
+  insula?: InsulaUsageTransport;
 };
-/**
- * Credential material plus optional non-secret identity metadata. Missing wire fields remain
- * `undefined`; a present non-string identity value rejects the response as invalid.
- *
- * An absent identity field means the vault had nothing to assert — NOT that identity failed.
- * Consumers must not collapse absence into mismatch: assert on presence, refuse on a present
- * difference, and serve (log, if it matters) when the field is missing. Absence proves neither
- * the right identity nor the wrong one, so treating it as a failure converts a vault that could
- * not answer into a consumer that cannot serve. The vault records no per-read success (at most
- * the first scoped read per principal), and nothing at all when a consumer declines to serve, so
- * an outage caused that way is visible only to the consumer that caused it.
- */
-type ServedCredential = {
-  material: string;
-  recordVersion: number;
-  expiresAtMs: number | null;
-  /**
-   * Operator-chosen record label for verifying a caller-held binding. It is not a routing key:
-   * account-scoped routing joins `accountId` with `recordVersion`.
-   */
-  credentialId?: string;
-  /** Non-secret Code Assist project identity, present only for antigravity credentials. */
-  projectId?: string;
-  /**
-   * Provider account identity the served token executes under. Account-scoped routing joins this
-   * value with `recordVersion`; it is neither the operator's credential label nor the bearer handle.
-   *
-   * BEST-EFFORT, NEVER GUARANTEED, including for JWT providers. The vault parses the claim live
-   * from the served access token and falls back to stored login-time identity; both legs can be
-   * empty, and the serve path yields nothing rather than fabricating an id. It is absent when the
-   * provider has no known claim, the token does not carry one, or no identity was captured at
-   * login. Do not gate serving on its presence.
-   */
-  accountId?: string;
-  /** Non-secret account display metadata captured at login. */
-  email?: string;
-  /** Non-secret organization or workspace display metadata captured at login. */
-  orgName?: string;
-};
-/**
- * Non-secret health for one handle, read without minting anything.
- *
- * An unresolved handle (unknown or revoked) is an ordinary answer, not an error: it decodes
- * as `ready: false, lastErrorCode: 'not_found'` with `credentialId`, `recordVersion` and
- * `stalePending` all absent. The vault omits them on purpose so a probe learns nothing about
- * what exists and no placeholder value is asserted about a record it never saw.
- */
-type CredentialStatus = {
-  ready: boolean;
-  lastErrorCode: string | null;
-  leaseHeld: boolean;
-  /**
-   * Operator-chosen record label the handle resolved to, for verifying a binding the caller
-   * already holds. Not a routing key. Absent when the handle did not resolve.
-   */
-  credentialId?: string;
-  /**
-   * The record's change cursor, present only when the handle resolved to a record.
-   *
-   * Optional, and OMITTED from the object rather than defaulted, because there is no honest
-   * default: 0 or -1 would compare as older than every real version, so a poller would read a
-   * revoked handle as a change it had yet to see, forever. With the key absent, TypeScript
-   * refuses arithmetic or ordering on it until the caller has handled `undefined`, and
-   * `'recordVersion' in status` is false. Never replace absence with a number (`?? 0`).
-   */
-  recordVersion?: number;
-  stalePending?: boolean;
-};
-type ClaustrumReporterSource = 'direct' | 'relay_status_field' | 'relay_message_parse';
-declare class ClaustrumClient {
-  #private;
-  private constructor();
-  static connect(options?: ClaustrumClientOptions): Promise<ClaustrumClient>;
-  getCredential(handle: string, minTtlMs?: number): Promise<ServedCredential>;
-  statusCredential(handle: string): Promise<CredentialStatus>;
-  reportAuthFailure(input: {
-    handle: string;
-    providerStatus: number;
-    recordVersion: number;
-    reporterSource: ClaustrumReporterSource;
-  }): Promise<void>;
-  /**
-   * Enumerate what this caller's grants cover.
-   *
-   * `params` is `{}` and must be PRESENT: the vault rejects an absent or null params
-   * object, so a caller cannot ask a different question by omitting it.
-   */
-  listScoped(enrollmentToken?: string): Promise<ScopedInventory>;
-  /**
-   * Fetch by credential id, authorized by a grant rather than a bearer handle.
-   *
-   * `minTtlMs` is a DEMAND, not a hint: if a real upstream exchange still cannot satisfy
-   * it, the vault refuses with `ttl_unsatisfiable` (class `context_overflow`) rather than
-   * serving a token that will die inside the caller's own margin. That class means
-   * reduce-and-retry, never wait-and-retry.
-   */
-  getScoped(input: {
-    credentialId: string;
-    enrollmentToken?: string;
-    minTtlMs?: number;
-  }): Promise<ServedCredential>;
-  /**
-   * Report a served credential dead, addressed by id rather than by handle.
-   *
-   * VERSION-FENCED: `recordVersion` must be the one this caller was SERVED. A report
-   * against a since-refreshed version is accepted and does nothing, which is the point --
-   * a stale report must not kill a fresh token. `accepted: true` is the receipt that the
-   * report was taken, never evidence that it applied.
-   */
-  reportAuthFailureScoped(input: {
-    credentialId: string;
-    enrollmentToken?: string;
-    providerStatus: number;
-    recordVersion: number;
-    reporterSource: ClaustrumReporterSource;
-  }): Promise<void>;
-  /**
-   * Propose an enrollment. The consumer mints `requestSecret` itself and sends only its
-   * hash; the raw secret NEVER leaves the process, and it is what authorizes the poll.
-   *
-   * IDEMPOTENT ON (name, secret): re-proposing with the same secret returns the SAME
-   * `requestId`. That exists because `requestId` is minted server-side, so a consumer
-   * cannot persist it before proposing -- a crash in that window would otherwise leave it
-   * holding a secret it cannot poll with and a name held until TTL. Persist the secret
-   * BEFORE calling this, and a crash costs nothing.
-   *
-   * A different secret on the same name is a different caller and is refused.
-   */
-  enrollPropose(input: {
-    name: string;
-    requestSecretHash: string;
-  }): Promise<{
-    requestId: string;
-  }>;
-  /**
-   * Poll a proposal. Returns `pending` until an operator decides, then exactly once
-   * returns the token.
-   *
-   * THE TOKEN IS RETURNED ONCE. Persist it before doing anything else with it; a lost
-   * token needs a fresh ceremony, not a second poll.
-   */
-  enrollPoll(input: {
-    requestId: string;
-    requestSecret: string;
-  }): Promise<EnrollmentPollOutcome>;
-  /**
-   * Exchange a live token for its successor. The old token dies when the new one is issued.
-   *
-   * `expectedTokenGeneration` IS REQUIRED AND IS A FENCE, not bookkeeping: it must be the
-   * generation this caller currently holds. Two rotations racing — a retry after an
-   * uncertain reply, or two instances of the same consumer — would otherwise each mint a
-   * successor and each invalidate the other's, leaving a consumer holding a token the
-   * vault has already replaced. The vault refuses a rotation whose expectation does not
-   * match, so the loser learns it lost instead of discovering it on a later spend.
-   */
-  enrollRotate(input: {
-    token: string;
-    expectedTokenGeneration: number;
-  }): Promise<{
-    token: string;
-    tokenGeneration: number;
-  }>;
-  close(): void;
-}
-/**
- * A row from the caller's own grant-covered inventory.
- *
- * Selection fields answer different questions. Pick by what you are about
- * to do with the token:
- *
- * - `providerIds` — operator-assigned catalog provider ids; match exactly, with no fallback.
- * - `authMethod` — the closed authentication method derived from the unsealed record,
- *   not the id spelling. Absent on sign/open-only rows or when no method is defined.
- *
- * - `refreshAdapter` — whose PROTOCOL the credential speaks. Use it when the token
- *   goes to a provider's own endpoints. Anything else is invalid there.
- * - `serves` — which model VENDORS are reachable through it. Use it when choosing
- *   where a model can be served from, and the protocol is not yours to care about.
- *
- * Never infer these fields from the id spelling. A credential reaching Anthropic models
- * through OpenRouter still speaks OpenRouter's protocol, not Anthropic's.
- */
-interface ScopedInventoryRow {
-  readonly id: string;
-  readonly categories: readonly string[];
-  readonly credentialType: string;
-  readonly serves: readonly string[];
-  /**
-   * Operator-assigned catalog ids; empty when none are set. Always present on this type.
-   * A daemon older than the field omits it from the wire, and that decodes as empty,
-   * which is also what an unmapped credential reports.
-   */
-  readonly providerIds: readonly string[];
-  readonly authMethod?: 'apikey' | 'chatgpt' | 'antigravity' | 'oauth';
-  /**
-   * Which provider protocol this credential speaks. Absent for static keys.
-   *
-   * SELECT ON THIS, NOT ON `serves`, WHEN THE TOKEN GOES TO A PROVIDER'S OWN ENDPOINTS.
-   * Measured on a live vault: eight rows serve Anthropic models and only five are Claude
-   * OAuth -- openrouter, antigravity and cursor reach Anthropic models through their own
-   * APIs. The id spelling does not separate them either: two contain no "anthropic" at
-   * all, and `credentialType === 'oauth'` catches antigravity and cursor too.
-   */
-  readonly refreshAdapter?: string;
-  readonly state: string;
-  readonly recordVersion: number;
-  readonly operations: readonly string[];
-  /**
-   * NOT SERVED TODAY. The field is absent from `ListScopedCredential`, so this is always
-   * null; it is declared because a consumer's discovery high-water mark needs it and the
-   * absence should be visible in the type rather than discovered at runtime.
-   */
-  readonly createdAtMs: number | null;
-  readonly accountId?: string;
-  readonly email?: string;
-  readonly orgName?: string;
-}
-/**
- * An inventory reply: the covered rows, plus the cursor that says whether they moved.
- *
- * `view` is a DIGEST OVER WHAT THIS CALLER CAN SEE — ids, categories, state, operations —
- * and deliberately NOT over `record_version`, so a routine token refresh does not move it.
- * Compare it against the previous call's to decide whether to reconcile at all; it is an
- * opaque string and nothing but equality is defined on it.
- */
-interface ScopedInventory {
-  readonly rows: readonly ScopedInventoryRow[];
-  readonly view: string;
-}
-/** What a poll found. `pending` is not an error: the operator has not decided yet. */
-type EnrollmentPollOutcome = {
-  readonly status: 'pending';
-} | {
-  readonly status: 'approved';
-  readonly name: string;
-  readonly token: string;
-  readonly tokenGeneration: number;
-} | {
-  readonly status: 'denied';
-};
-//#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/claustrum/custody.d.ts
-type ClaustrumScopedClient = Pick<ClaustrumClient, 'listScoped' | 'getScoped' | 'reportAuthFailureScoped' | 'close'>;
 /** The two credential types a plugin's family can hold; routing differs by type. */
 type VaultCredentialType = 'oauth' | 'api_key';
 /**
@@ -1977,7 +1275,7 @@ interface ClaustrumScopedAttempt {
   readonly expiresAtMs: number | null;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/quota/map.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/quota/map.d.ts
 interface QuotaReadingEntry {
   scope: string;
   label: string;
@@ -2020,13 +1318,19 @@ interface CreditBudgetCleared {
   checkedAt: number;
 }
 type CreditBudgetEntry = CreditBudgetReading | CreditBudgetCleared;
+interface QuotaCounter {
+  value: number;
+  checkedAt: number;
+}
 interface QuotaMap {
   limits: QuotaEntry[];
   /** Absent means no observation has reported on the budget yet. */
   budget?: CreditBudgetEntry;
+  /** Provider-named counts, each with its own observation time. */
+  counters?: Record<string, QuotaCounter>;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/quota/merge.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/quota/merge.d.ts
 interface ObservedReading {
   /** Defaults to `all`. */
   scope?: string;
@@ -2060,9 +1364,11 @@ interface QuotaObservation {
   coverage?: ObservedPair[];
   /** Absent means the observation says nothing about the budget. */
   budget?: ObservedBudget;
+  /** Each named count uses its own time, independently of limits and budget. */
+  counters?: Record<string, QuotaCounter>;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/claustrum/interlock.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/claustrum/interlock.d.ts
 /**
  * The declined-account interlock: the user's "do not use this vault account",
  * kept on the consumer side because the vault has no notion of it.
@@ -2081,7 +1387,7 @@ interface DeclinedAccount {
   readonly accountIdentity?: string;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/claustrum/roster.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/claustrum/roster.d.ts
 /**
  * One vault account as the pool sees it. It carries no bearer material: the
  * access token is fetched from the vault for every send. Several vault
@@ -2136,7 +1442,7 @@ interface VaultRosterFile {
  */
 type QuotaReceipt = Pick<ClaustrumScopedAttempt, 'credentialId' | 'accountIdentity' | 'accountIdentitySource' | 'expectedAccountIdentity'>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.14.2+49be191d46b46482/node_modules/@cortexkit/common-auth/dist/claustrum/enrollment.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.0+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/claustrum/enrollment.d.ts
 interface ClaustrumEnrollmentClient {
   enrollPropose(input: {
     name: string;
@@ -2183,6 +1489,10 @@ interface ClaustrumEnrollmentPaths {
   tokenPath: string;
 }
 //#endregion
+//#region ../core/dist/pool-routing.d.ts
+/** Existing callbacks may return a promise for an in-progress quota poll. */
+type QuotaReadingRequest = ((id: string) => void) | ((id: string) => Promise<unknown> | undefined);
+//#endregion
 //#region ../core/dist/vault.d.ts
 type VaultHost = 'opencode' | 'pi';
 interface VaultPaths extends ClaustrumEnrollmentPaths {
@@ -2261,6 +1571,12 @@ declare class OpenAiVault {
    * `VAULT_REQUEST_ROSTER_WAIT_MS`.
    */
   firstRoster(): Promise<void>;
+  /**
+   * Readies a current vault roster before request routing. The startup
+   * discovery may have settled while this host was local, so firstRoster()
+   * alone cannot tell a vault-mode request that it has a roster to use.
+   */
+  awaitRequestRoster(): Promise<void>;
   /**
    * Re-reads the accounts from the vault now. Never rejects. It resolves only
    * after a discovery that began after this call: one already in flight (the
@@ -2326,8 +1642,8 @@ declare class OpenAiVault {
    * the background; a failure is logged.
    */
   recordSnapshot(routeId: string, snapshot: unknown, complete: boolean, receipt: QuotaReceipt): Promise<void>;
-  /** Takes one quota reading for a vault account through the usage endpoint. */
-  pollQuota(routeId: string): Promise<{
+  /** Joins a quota poll; current insula quota for the same account replaces a background ChatGPT wham/usage request. */
+  pollQuota(routeId: string, background?: boolean): Promise<{
     ok: boolean;
     error?: string;
   }>;
@@ -2336,7 +1652,7 @@ declare class OpenAiVault {
    * because it has no reading yet. At most one reading per account is in
    * flight.
    */
-  requestReading(routeId: string): void;
+  requestReading(routeId: string): ReturnType<QuotaReadingRequest>;
   /** Readings for the routable vault accounts whose last one is older than `maxAgeMs`. */
   pollStale(maxAgeMs: number): Promise<Array<{
     id: string;
@@ -2424,9 +1740,9 @@ declare class PiMainAccount {
   /**
    * Asks for a quota poll, at most once per `MAIN_PULL_RETRY_MS` unless
    * `force`. Admission calls this for every refusal for want of a reading, so
-   * it never waits.
+   * callers may join the returned poll for their first reading.
    */
-  requestReading(force?: boolean): void;
+  requestReading(force?: boolean): Promise<MainPollResult> | undefined;
   /** The poll under way, if any, so a caller may wait a bounded time for it. */
   pending(): Promise<MainPollResult> | undefined;
   /** Polls now (joining a poll already under way) and reports how it ended. */
@@ -2500,6 +1816,7 @@ declare class PiPoolSource {
   private readonly pending;
   private readonly writes;
   private readonly lastPull;
+  private readonly quotaPulls;
   private readonly polled;
   /** The latest full poll snapshot per row id, for the `/openai` quota check. */
   private readonly polledSnapshots;
@@ -2537,7 +1854,6 @@ declare class PiPoolSource {
    * observed whose store write has not landed.
    */
   private withLocalState;
-  private merged;
   private replaceRow;
   /**
    * Polls every row this process has not polled for its current credential:
@@ -2548,9 +1864,11 @@ declare class PiPoolSource {
   /**
    * Asks the store for a quota poll of one row, at most once per
    * `POOL_PULL_RETRY_MS` unless `force`. Admission calls this for every row
-   * it refuses for want of a reading, so it never waits.
+   * it refuses for want of a reading. First-reading admission may join the
+   * returned promise; callers with an existing reading remain nonblocking.
    */
-  requestReading(id: string, force?: boolean): void;
+  requestReading(id: string, force?: boolean): Promise<void> | undefined;
+  private coalescedPull;
   private pull;
   private applyObservation;
   /**
@@ -2750,4 +2068,5 @@ export declare function registerPiProvider(pi: Pick<ExtensionAPI, 'registerProvi
  */
 export declare function createPiOpenAIRuntime(): PiOpenAIRuntime;
 export default function cortexKitPiOpenAIAuth(pi: ExtensionAPI): Promise<void>;
-//#endregion
+//#endregion
+export {};