@cortexkit/pi-openai-auth 1.2.0 → 1.4.0

package/dist/index.d.ts

@@ -2,7 +2,7 @@ import { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import "@cortexkit/private-files";
 import { ClaustrumClient, EnrollmentPollOutcome } from "@cortexkit/claustrum-client";
 import { Api, AssistantMessageEventStream, Context, Model, SimpleStreamOptions } from "@earendil-works/pi-ai";
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/pi-slot/slot.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/pi-slot/slot.d.ts
 interface PiSlotInspection {
   slot: 'original' | 'placeholder' | 'foreign' | 'empty';
   stash: 'valid' | 'missing';
@@ -13,7 +13,7 @@ interface PiSlot {
   exitVault(): Promise<'restored' | 'conflict' | 'nothing-to-do'>;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/schema.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/schema.d.ts
 type OAuthCredential = {
   type: 'oauth';
   access?: string;
@@ -202,7 +202,7 @@ interface PoolRow {
   unbound?: true;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/errors.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/errors.d.ts
 /** Every library operation that can fail, as named in the failure value. */
 type PoolOperation = 'initialize' | 'add' | 'replace' | 'rotate' | 'disable' | 'enable' | 'remove' | 'reorder' | 'updateSettings' | 'recordIdentity' | 'updateProviderState' | 'refresh' | 'pull' | 'publishRoster';
 /**
@@ -249,12 +249,12 @@ declare class PoolOperationError extends Error {
   });
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/hooks.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/hooks.d.ts
 interface PoolLogger {
   warn(message: string, data?: unknown): void;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/fs/refresh-file-lock.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/fs/refresh-file-lock.d.ts
 interface LockLoss {
   readonly reason: 'taken-over' | 'expired' | 'unreadable' | 'renewal-failed' | 'marker-lost';
   readonly expectedOwnerId: string;
@@ -289,7 +289,7 @@ type RefreshFileLockOptions = {
 /** Filesystem leases share wall time across all callers and processes. */
 declare function acquireRefreshFileLock(options: RefreshFileLockOptions): Promise<RefreshFileLock | null>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/refresh-lock.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/refresh-lock.d.ts
 type LockStep = NonNullable<Parameters<typeof acquireRefreshFileLock>[0]['onStep']> extends ((step: infer S) => unknown) ? S : never;
 /** Tuning shared by every lock the store takes; each field is overridable. */
 interface PoolLockOptions {
@@ -321,7 +321,7 @@ interface LockEnvironment {
   }, event: 'scheduled' | 'cancelled') => void;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/mutate.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/mutate.d.ts
 /** Named points on the write path, for crash and ownership injection. */
 type WriteStep = 'before-config-write' | 'after-config-write' | 'before-state-write' | 'after-state-write';
 /** Awaitable pause points on the pull and refresh paths. */
@@ -356,11 +356,11 @@ interface StoreContext {
 /** What `initializePool` did. */
 type InitializeOutcome = 'initialized' | 'already-ready';
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/runtime.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/runtime.d.ts
 /** Where a pull was fired from; `load` fires at most once per process per row. */
 type PullReason = 'load' | 'add' | 'replace' | 'admission';
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/attribution.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/attribution.d.ts
 /**
  * What a pull or refresh captured about its row (named by id alongside) when
  * it was issued. A result applies only while the row with that id still has
@@ -383,7 +383,7 @@ interface Attribution {
   identity?: string;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/rows.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/rows.d.ts
 type FailureHook = (rowId: string, error: PoolOperationError) => void | Promise<void>;
 interface RowOperationOptions {
   /** Called once, awaited, on every non-success path, before locks release. */
@@ -599,7 +599,7 @@ interface RowTransitionResult {
   providerState?: unknown;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/provider-state.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/provider-state.d.ts
 /**
  * Receives a private copy of the row's provider state (undefined when the row
  * shows none) and the row as loaded under the locks, and returns the next
@@ -635,7 +635,7 @@ declare const DECLINE_TRANSITION: unique symbol;
  */
 type RowTransitionMutator = (current: unknown | undefined, row: PoolRow) => unknown | typeof DECLINE_TRANSITION | Promise<unknown | typeof DECLINE_TRANSITION>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/publication.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/publication.d.ts
 interface PublishPlan {
   operationId: string;
   remove: Array<{
@@ -678,7 +678,7 @@ interface PublishResult {
   receipt: PublicationReceipt;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/pull.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/pull.d.ts
 /** What a pull is issued with: the credential and its attribution tuple. */
 interface PullRequest {
   id: string;
@@ -689,7 +689,7 @@ interface PullRequest {
 }
 type PullHook = (request: PullRequest) => Promise<unknown>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/refresh.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/refresh.d.ts
 /** What the injected provider refresh function returns. */
 interface ProviderRefreshResult {
   access: string;
@@ -752,7 +752,7 @@ type RefreshOutcome = {
   reason: string;
 };
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/settings.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/settings.d.ts
 /** The plugin's settings: every top-level config key except the pool-owned ones. */
 type PoolSettings = Record<string, unknown>;
 type SettingsRead = {
@@ -796,7 +796,7 @@ type UpdateSettingsResult = {
   outcome: 'updated' | 'unchanged';
 };
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/pool.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/store/pool.d.ts
 interface OpenPoolStoreOptions {
   /** The provider every row of this pool belongs to; keys the provider-wide lock. */
   provider: string;
@@ -1033,11 +1033,19 @@ interface OAuthSpendControlReading {
   source?: string;
   reached: boolean;
 }
+/**
+ * Prepaid workspace credits as the Codex backend reports them, in the usage
+ * poll's `credits` object or the `x-codex-credits-*` response headers. The
+ * headers carry no overage verdict, so `overageLimitReached` is optional.
+ * `checkedAt` is when the source was read. It is optional because accounts
+ * files written by older versions hold credits without it.
+ */
 interface OAuthCredits {
   hasCredits: boolean;
   unlimited: boolean;
-  overageLimitReached: boolean;
+  overageLimitReached?: boolean;
   balance?: number;
+  checkedAt?: number;
 }
 type AccountBase = {
   id: string;
@@ -1202,17 +1210,92 @@ interface RefreshAllQuotaResult {
   permanent?: boolean;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/claustrum/insula.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/claustrum/watch.d.ts
+/**
+ * How a host currently learns about changes, for logs and status displays.
+ * `watching`: a watch was accepted and is open, so polling is reduced to a
+ * slow safety read. `polling`: no watch is open yet (not started, opening, or
+ * re-subscribing after a close), so the host polls at its usual interval.
+ * `fallback`: the watch is unavailable (an older module or client, a refusal,
+ * the watch limit, or repeated failures), so the host polls at its usual
+ * interval and may try a watch again later. Never carries secrets.
+ */
+type WatchMode = 'watching' | 'polling' | 'fallback';
+/**
+ * The fields every change notice carries, from the vault's watchScoped and
+ * insula's usage.watch alike.
+ */
+interface ChangeNotice {
+  readonly kind: string;
+  readonly epoch: string;
+  readonly seq: number;
+}
+/** A vault watch notice: `view` is the same digest `list_scoped` returns. */
+interface ScopedWatchNoticeShape extends ChangeNotice {
+  readonly view: string;
+}
+/**
+ * How a vault watch ended, as claustrum-client 0.12.0 reports it. `refused`
+ * and `not_accepting` both mean the watch closed before its first notice; the
+ * client then made one `list_scoped` read to learn why, and `refused` carries
+ * that read's refusal.
+ */
+type ScopedWatchEnd = {
+  readonly kind: 'refused';
+  readonly error: unknown;
+} | {
+  readonly kind: 'transport_lost';
+  readonly error: unknown;
+} | {
+  readonly kind: 'ended' | 'not_accepting' | 'unsupported' | 'stopped';
+};
+interface ScopedWatchHandle {
+  stop(): void;
+  readonly closed: Promise<ScopedWatchEnd>;
+}
+/**
+ * The part of a vault client that can watch. claustrum-client added
+ * `watchScoped` in 0.12.0; the peer range still admits 0.6.2, so it is
+ * optional and detected at run time.
+ */
+interface ScopedWatchSource {
+  watchScoped?(onNotice: (notice: ScopedWatchNoticeShape) => void, options?: {
+    enrollmentToken?: string;
+  }): ScopedWatchHandle;
+}
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/claustrum/insula.d.ts
+/**
+ * A held-open `usage.watch` stream. `closed` resolves when insula ends the
+ * stream (STREAM_END at shutdown, or a reply that ends it) or after `stop()`,
+ * and rejects with insula's refusal (an error with a `code`, such as
+ * `unknown_method` from an insula that predates the method, or
+ * `usage_watch_limit` when 64 watches are already open) or with the
+ * transport failure.
+ */
+interface InsulaUsageWatch {
+  stop(): void;
+  readonly closed: Promise<void>;
+}
 /** Optional transport for custom scoped clients; getUsage must not retry refusals. */
 interface InsulaUsageTransport {
   connectionFile: string;
   getUsage(): Promise<unknown>;
+  /**
+   * Open a `usage.watch` stream, passing each notice's raw JSON body to
+   * `onNotice`. Optional: a transport without it is polled as before.
+   */
+  watchUsage?(onNotice: (body: Uint8Array) => void): InsulaUsageWatch;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/claustrum/custody.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/claustrum/custody.d.ts
+/**
+ * `watchScoped` is present from claustrum-client 0.12.0. Hosts detect it at
+ * run time and keep polling without it.
+ */
 type ClaustrumScopedClient = Pick<ClaustrumClient, 'listScoped' | 'getScoped' | 'reportAuthFailureScoped' | 'close'> & {
   insula?: InsulaUsageTransport;
-};
+} & ScopedWatchSource;
 /** The two credential types a plugin's family can hold; routing differs by type. */
 type VaultCredentialType = 'oauth' | 'api_key';
 /**
@@ -1297,9 +1380,20 @@ interface ClaustrumScopedAttempt {
   readonly accessToken: string;
   readonly recordVersion: number;
   readonly expiresAtMs: number | null;
+  /**
+   * True when this receipt was not freshly served but is the last token kept
+   * from an earlier read, used because the vault could not be reached. A 401
+   * with such a receipt must not be retried and is not reported to the vault,
+   * which is unreachable.
+   */
+  readonly fromKeptReceipt?: true;
+}
+interface KeptReceiptState {
+  readonly active: boolean;
+  readonly since: number | null;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/quota/map.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/quota/map.d.ts
 interface QuotaReadingEntry {
   scope: string;
   label: string;
@@ -1346,15 +1440,33 @@ interface QuotaCounter {
   value: number;
   checkedAt: number;
 }
+/**
+ * Prepaid credits a provider account holds beside its rate-limit windows (for
+ * example a ChatGPT workspace's credits, which keep requests working after a
+ * window is used up). This is a state, not a count or the spend budget: the
+ * account has credits or not, they may be unlimited, and the provider may
+ * report a balance. It carries its own observation time.
+ */
+interface QuotaCredits {
+  hasCredits: boolean;
+  unlimited: boolean;
+  /** The balance the provider reported, when it reported one. */
+  balance?: number;
+  /** The provider's verdict that the overage allowance is used up. */
+  overageLimitReached?: boolean;
+  checkedAt: number;
+}
 interface QuotaMap {
   limits: QuotaEntry[];
   /** Absent means no observation has reported on the budget yet. */
   budget?: CreditBudgetEntry;
   /** Provider-named counts, each with its own observation time. */
   counters?: Record<string, QuotaCounter>;
+  /** Absent means no observation has reported on prepaid credits yet. */
+  credits?: QuotaCredits;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/quota/merge.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/quota/merge.d.ts
 interface ObservedReading {
   /** Defaults to `all`. */
   scope?: string;
@@ -1390,9 +1502,14 @@ interface QuotaObservation {
   budget?: ObservedBudget;
   /** Each named count uses its own time, independently of limits and budget. */
   counters?: Record<string, QuotaCounter>;
+  /**
+   * Prepaid credits, judged by their own time independently of limits, budget
+   * and counters. Absent means the observation says nothing about credits.
+   */
+  credits?: QuotaCredits;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/claustrum/interlock.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/claustrum/interlock.d.ts
 /**
  * The declined-account interlock: the user's "do not use this vault account",
  * kept on the consumer side because the vault has no notion of it.
@@ -1411,7 +1528,7 @@ interface DeclinedAccount {
   readonly accountIdentity?: string;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/claustrum/roster.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/claustrum/roster.d.ts
 /**
  * One vault account as the pool sees it. It carries no bearer material: the
  * access token is fetched from the vault for every send. Several vault
@@ -1466,7 +1583,18 @@ interface VaultRosterFile {
  */
 type QuotaReceipt = Pick<ClaustrumScopedAttempt, 'credentialId' | 'accountIdentity' | 'accountIdentitySource' | 'expectedAccountIdentity'>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/claustrum/enrollment.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/claustrum/consumer.d.ts
+/**
+ * How a started consumer learns about changes, for logs and status displays.
+ * `insula` is present when the consumer was given an insula source. Never
+ * carries secrets.
+ */
+interface ClaustrumWatchState {
+  readonly vault: WatchMode;
+  readonly insula?: WatchMode;
+}
+//#endregion
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.23.0+48f2e2ce69c71a39/node_modules/@cortexkit/common-auth/dist/claustrum/enrollment.d.ts
 interface ClaustrumEnrollmentClient {
   enrollPropose(input: {
     name: string;
@@ -1567,6 +1695,12 @@ interface OpenAiVaultOptions {
   pollIntervalMs?: number;
   fetchImpl?: () => typeof fetch;
   now?: () => number;
+  /**
+   * Replace the timers behind the background poll, the vault and insula
+   * watches' retries and the outage probe (tests).
+   */
+  setTimeoutImpl?: typeof setTimeout;
+  clearTimeoutImpl?: typeof clearTimeout;
 }
 /** One host's view of its OpenAI accounts in the vault. */
 declare class OpenAiVault {
@@ -1585,9 +1719,13 @@ declare class OpenAiVault {
    */
   enrolled(): boolean;
   /**
-   * Polls enrollment files and the vault's accounts. With local authority the
-   * consumer sends no vault request. A new enrollment completed by another
-   * process is detected on the next poll.
+   * Starts the consumer's background poll and its vault and insula watches.
+   * With local authority the consumer sends no vault request. A new
+   * enrollment completed by another process is detected on the next poll.
+   * While the vault watch is open the poll lists the vault only every five
+   * minutes, and a notice that the visible accounts changed starts a
+   * discovery at once; without a watch (an older vault or client, or a
+   * refusal) every poll lists the vault as before.
    */
   start(): void;
   /**
@@ -1612,6 +1750,16 @@ declare class OpenAiVault {
    */
   refresh(): Promise<VaultRosterFile | undefined>;
   snapshot(): VaultRosterFile | undefined;
+  /**
+   * Whether the consumer learns about vault and insula changes from a watch
+   * or by polling, without any I/O.
+   */
+  watchState(): ClaustrumWatchState;
+  /**
+   * Whether any account is being served the last token the vault gave it
+   * because the vault cannot be reached, without any I/O.
+   */
+  keptReceiptState(): KeptReceiptState;
   /**
    * What the vault says this host is granted, from the latest list, without
    * any I/O. Undefined is unknown (a vault that does not report grants, or
@@ -1674,7 +1822,7 @@ declare class OpenAiVault {
    * the background; a failure is logged.
    */
   recordSnapshot(routeId: string, snapshot: unknown, complete: boolean, receipt: QuotaReceipt): Promise<void>;
-  /** Joins a quota poll; current insula quota for the same account replaces a background ChatGPT wham/usage request. */
+  /** Joins a quota poll; insula decides whether a background provider read is needed. */
   pollQuota(routeId: string, background?: boolean): Promise<{
     ok: boolean;
     error?: string;
@@ -1767,7 +1915,10 @@ declare class PiMainAccount {
   currentIdentity(): string | undefined;
   /** The quota map routing reads: undefined until a reading arrives. */
   quotaMap(): QuotaMap | undefined;
-  /** The fixed windows of the quota map, plus the last poll's budget and reset credits. */
+  /**
+   * The fixed windows of the quota map and its prepaid credits, plus the last
+   * poll's budget and reset credits.
+   */
   quotaSnapshot(): OAuthQuotaSnapshot | undefined;
   /**
    * Asks for a quota poll, at most once per `MAIN_PULL_RETRY_MS` unless
@@ -1972,6 +2123,11 @@ declare class PiOpenAIRuntime {
   readonly pool: PiPoolSource;
   readonly vault: OpenAiVault;
   private readonly deps;
+  /**
+   * Which accounts this runtime serves on prepaid credits, so the info line
+   * is written once when an account starts serving on them.
+   */
+  private readonly creditsServing;
   /**
    * The vault account behind each recent vault token, with the receipt the
    * vault served the token under, newest last, so a rate-limit frame