@juspay/neurolink 10.11.2 → 10.12.0

package/dist/lib/providers/googleNativeGemini3/utils.js

@@ -12,6 +12,7 @@ import { randomUUID } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 import { extname } from "node:path";
 import { DEFAULT_CONTEXT_GUARD_RATIO, DEFAULT_MAX_STEPS, DEFAULT_TOOL_MAX_RETRIES, DEFAULT_WRAPUP_TIME_LEAD_MS, } from "../../core/constants.js";
+import { needsAudioTranscode, toProviderCompatibleAudio, } from "../../adapters/audioFormatSupport.js";
 import { logger } from "../../utils/logger.js";
 import { resolveSamplingParams } from "../../models/modelRegistry.js";
 import { convertZodToJsonSchema, ensureNestedSchemaTypes, inlineJsonSchema, isZodSchema, normalizeJsonSchemaObject, } from "../../utils/schemaConversion.js";
@@ -1432,6 +1433,53 @@ conversationMessages) {
  * is skipped rather than aborting the entire request, matching prior
  * Vertex behaviour.
  */
+/**
+ * Append audio to a Gemini request as `inlineData` parts.
+ *
+ * Shared by both Gemini front ends. Vertex assembles its request here and AI
+ * Studio assembles it in `buildUserPartsWithMultimodal`; when this lived only in
+ * the Vertex client, AI Studio advertised audio support through
+ * `NATIVE_AUDIO_PROVIDERS` and then silently dropped the bytes.
+ *
+ * Gemini's native request shape is assembled directly rather than taken from the
+ * AI SDK's `file` parts, so audio has to be added explicitly the same way PDFs
+ * and images are — a `{ type: "file" }` part built upstream simply never
+ * reaches this request body. That asymmetry is why attaching a recording
+ * produced only the metadata summary even after the message builder learned to
+ * carry the bytes.
+ *
+ * A container Gemini does not accept is converted first; one that cannot be
+ * converted is skipped rather than sent, because an unsupported inlineData
+ * mimeType fails the whole request, and the caller still has the metadata
+ * summary in the text part.
+ */
+export async function appendNativeAudioParts(userParts, audioFiles, logPrefix = "[GeminiNative]") {
+    if (!audioFiles || audioFiles.length === 0) {
+        return;
+    }
+    for (const audio of audioFiles) {
+        // Split on both separators: a Windows-style name reaching a POSIX host
+        // would otherwise keep its whole path, and the extension lookup below
+        // needs the bare filename.
+        const base = audio.filename.split(/[\\/]/).pop() ?? audio.filename;
+        const dot = base.lastIndexOf(".");
+        const extension = dot > 0 ? base.slice(dot) : ".bin";
+        const compatible = await toProviderCompatibleAudio(audio.buffer, audio.mimeType, extension);
+        if (needsAudioTranscode(compatible.mimeType)) {
+            logger.warn(`${logPrefix} Skipping native audio for ${base}: ${compatible.mimeType} ` +
+                `is not accepted and could not be converted. The metadata summary was ` +
+                `still included.`);
+            continue;
+        }
+        userParts.push({
+            inlineData: {
+                mimeType: compatible.mimeType,
+                data: compatible.buffer.toString("base64"),
+            },
+        });
+        logger.debug(`${logPrefix} Added native audio part for ${base} (${compatible.mimeType})`);
+    }
+}
 export async function buildUserPartsWithMultimodal(input, textOverride, logPrefix = "[GeminiNative]") {
     const text = typeof textOverride === "string" ? textOverride : (input?.text ?? "");
     const parts = [{ text }];
@@ -1533,6 +1581,12 @@ export async function buildUserPartsWithMultimodal(input, textOverride, logPrefi
             });
         }
     }
+    // Audio last, and through the same helper the Vertex client uses. AI Studio
+    // never touches `buildMultimodalMessagesArray` — it overrides generate() and
+    // stream() and assembles its request here — so wiring audio only into the
+    // Vertex client left this front end advertising native audio via
+    // NATIVE_AUDIO_PROVIDERS and then dropping the bytes on the floor.
+    await appendNativeAudioParts(parts, input?.nativeAudioFiles, logPrefix);
     return parts;
 }
 //# sourceMappingURL=utils.js.map

package/dist/lib/providers/googleVertex/client.js

@@ -6,6 +6,7 @@ import os from "os";
 import { AIProviderName, ErrorCategory, ErrorSeverity, } from "../../constants/enums.js";
 import { BaseProvider } from "../../core/baseProvider.js";
 import { unwrapImagePayload } from "../../adapters/imageFormatSupport.js";
+import { appendNativeAudioParts } from "../googleNativeGemini3/utils.js";
 import { getMimeTypeForExtension } from "../../processors/config/mimeConstants.js";
 import { DEFAULT_GEMINI_STREAM_TIMEOUT_MS, DEFAULT_MAX_STEPS, DEFAULT_TOOL_EXECUTION_TIMEOUT_MS, DEFAULT_TOOL_MAX_RETRIES, GLOBAL_LOCATION_MODELS, IMAGE_GENERATION_MODELS, TOOL_STORAGE_TIMEOUT_MS, } from "../../core/constants.js";
 import { ModelConfigurationManager } from "../../core/modelConfiguration.js";
@@ -1403,6 +1404,7 @@ export class GoogleVertexProvider extends BaseProvider {
                 });
             }
         }
+        await appendNativeAudioParts(userParts, multimodalInput?.nativeAudioFiles, "[GoogleVertex]");
         // Add images as inlineData parts if present
         if (multimodalInput?.images && multimodalInput.images.length > 0) {
             logger.debug(`[GoogleVertex] Processing ${multimodalInput.images.length} image(s) for native stream`);
@@ -2408,6 +2410,7 @@ export class GoogleVertexProvider extends BaseProvider {
                 });
             }
         }
+        await appendNativeAudioParts(userParts, multimodalInput?.nativeAudioFiles, "[GoogleVertex]");
         // Add images as inlineData parts if present
         if (multimodalInput?.images && multimodalInput.images.length > 0) {
             logger.debug(`[GoogleVertex] Processing ${multimodalInput.images.length} image(s) for native generate`);

package/dist/lib/proxy/accountQuota.d.ts

@@ -48,4 +48,10 @@ export declare function loadAccountQuota(accountKey: string): Promise<AccountQuo
  * other accounts' snapshots and blinded quota-aware routing to them).
  */
 export declare function saveAccountQuota(accountKey: string, quota: AccountQuota): Promise<void>;
+/**
+ * Cancel any pending debounced write and flush the cache to disk now.
+ * Short-lived processes (CLI refresh path) must call this before exit —
+ * the debounce timer is unref()'d and will not keep the process alive.
+ */
+export declare function flushAccountQuotas(): Promise<void>;
 export declare function flushAccountQuotaStateForTests(): Promise<void>;

package/dist/lib/proxy/accountQuota.js

@@ -94,6 +94,7 @@ export function parseQuotaHeaders(headers) {
         upgradePaths: getHeader(headers, `${P}unified-upgrade-paths`),
         overageStatus: getHeader(headers, `${P}unified-overage-status`) ?? "unknown",
         lastUpdated: Date.now(),
+        source: "headers",
     };
 }
 // ---------------------------------------------------------------------------
@@ -229,17 +230,33 @@ export async function loadAccountQuota(accountKey) {
 export async function saveAccountQuota(accountKey, quota) {
     await stateMutex.runExclusive(async () => {
         await ensureAccountQuotasLoaded();
-        memoryCache[accountKey] = { ...quota };
+        const next = { ...quota };
+        // Header-sourced saves carry no dynamic windows; a passive capture right
+        // after a usage-API refresh must not erase the refreshed buckets.
+        const existing = memoryCache[accountKey];
+        if (next.windows === undefined && existing?.windows !== undefined) {
+            next.windows = existing.windows;
+            next.windowsUpdatedAt = existing.windowsUpdatedAt;
+        }
+        memoryCache[accountKey] = next;
         dirty = true;
         cacheVersion += 1;
     });
     scheduleFlush();
 }
-export async function flushAccountQuotaStateForTests() {
+/**
+ * Cancel any pending debounced write and flush the cache to disk now.
+ * Short-lived processes (CLI refresh path) must call this before exit —
+ * the debounce timer is unref()'d and will not keep the process alive.
+ */
+export async function flushAccountQuotas() {
     if (flushTimer) {
         clearTimeout(flushTimer);
         flushTimer = null;
     }
     await flushToDisk();
 }
+export async function flushAccountQuotaStateForTests() {
+    await flushAccountQuotas();
+}
 //# sourceMappingURL=accountQuota.js.map

package/dist/lib/proxy/accountUsage.d.ts

@@ -0,0 +1,45 @@
+/**
+ * On-Demand Account Usage Fetch
+ *
+ * Manual refetch path for account limits: queries Anthropic's OAuth usage
+ * endpoint (the same call Claude Code's /usage makes) to get FRESH session /
+ * weekly / model-scoped windows for an account without consuming any tokens
+ * and without starting a 5h session window.
+ *
+ * This complements — never replaces — the passive header capture in
+ * accountQuota.ts: `usageToQuota` normalizes the endpoint payload into the
+ * same `AccountQuota` shape so refreshed data flows through the existing
+ * save/merge/cooldown chain.
+ *
+ * Only OAuth (Bearer) accounts have subscription windows; api_key accounts
+ * are skipped and keep their header-derived absolute limits.
+ */
+import type { AccountAllowlist, AccountQuota, AccountUsageFetchResult, AnthropicUsageResponse, ProxyPassthroughAccount } from "../types/index.js";
+export declare const ANTHROPIC_USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
+/**
+ * Enumerate stored Anthropic accounts for a usage refresh.
+ * Read-only: no token refresh, no disable side effects — those decisions
+ * belong to the caller (fetchAccountUsage / the routing path respectively).
+ */
+export declare function listAnthropicAccountsForUsage(allowlist?: AccountAllowlist): Promise<ProxyPassthroughAccount[]>;
+/**
+ * Fetch fresh usage windows for one account. Return-not-throw.
+ * Refreshes an expiring/expired token first (de-duped, rotation-safe), and
+ * retries once through a forced refresh on a 401.
+ */
+export declare function fetchAccountUsage(account: ProxyPassthroughAccount): Promise<AccountUsageFetchResult>;
+/**
+ * Normalize a usage-endpoint payload into the `AccountQuota` shape used by
+ * the passive header path, so a refresh writes through the exact same
+ * save/merge/cooldown chain.
+ *
+ * `prior` supplies fields the usage payload cannot express (fallback and
+ * upgrade-path signals) so `isQuotaOverageAvailable` behaves identically
+ * before and after a refresh. `unifiedStatus` is deliberately never set:
+ * fabricating it would let the reconcile path treat a refresh like a
+ * unified-rejected 429.
+ */
+export declare function usageToQuota(usage: AnthropicUsageResponse, opts: {
+    now: number;
+    prior?: AccountQuota | null;
+}): AccountQuota | null;

package/dist/lib/proxy/accountUsage.js

@@ -0,0 +1,289 @@
+/**
+ * On-Demand Account Usage Fetch
+ *
+ * Manual refetch path for account limits: queries Anthropic's OAuth usage
+ * endpoint (the same call Claude Code's /usage makes) to get FRESH session /
+ * weekly / model-scoped windows for an account without consuming any tokens
+ * and without starting a 5h session window.
+ *
+ * This complements — never replaces — the passive header capture in
+ * accountQuota.ts: `usageToQuota` normalizes the endpoint payload into the
+ * same `AccountQuota` shape so refreshed data flows through the existing
+ * save/merge/cooldown chain.
+ *
+ * Only OAuth (Bearer) accounts have subscription windows; api_key accounts
+ * are skipped and keep their header-derived absolute limits.
+ */
+import { logger } from "../utils/logger.js";
+import { tokenStore } from "../auth/tokenStore.js";
+import { CLAUDE_CLI_USER_AGENT, OAUTH_BETA_HEADERS, } from "../auth/anthropicOAuth.js";
+import { needsRefresh, refreshTokenFromLatest, isPermanentRefreshFailure, persistTokens, } from "./tokenRefresh.js";
+import { isAccountAllowed } from "./accountSelection.js";
+export const ANTHROPIC_USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
+const USAGE_FETCH_TIMEOUT_MS = 10_000;
+/**
+ * Enumerate stored Anthropic accounts for a usage refresh.
+ * Read-only: no token refresh, no disable side effects — those decisions
+ * belong to the caller (fetchAccountUsage / the routing path respectively).
+ */
+export async function listAnthropicAccountsForUsage(allowlist) {
+    const accounts = [];
+    const compoundKeys = await tokenStore.listByPrefix("anthropic:");
+    for (const key of compoundKeys) {
+        if (!isAccountAllowed(key, allowlist)) {
+            continue;
+        }
+        if (await tokenStore.isDisabled(key)) {
+            continue;
+        }
+        const tokens = await tokenStore.loadTokens(key);
+        if (!tokens) {
+            continue;
+        }
+        // Full suffix after the first ":" — a label may itself contain colons,
+        // and the quota store and `auth list` rendering key by the full label.
+        const separatorIndex = key.indexOf(":");
+        accounts.push({
+            key,
+            label: separatorIndex >= 0 ? key.slice(separatorIndex + 1) : key,
+            token: tokens.accessToken,
+            refreshToken: tokens.refreshToken,
+            expiresAt: tokens.expiresAt,
+            type: tokens.tokenType === "Bearer" ? "oauth" : "api_key",
+            persistTarget: { providerKey: key },
+        });
+    }
+    return accounts;
+}
+async function requestUsage(token) {
+    try {
+        const response = await fetch(ANTHROPIC_USAGE_URL, {
+            method: "GET",
+            headers: {
+                authorization: `Bearer ${token}`,
+                "anthropic-beta": OAUTH_BETA_HEADERS,
+                "user-agent": CLAUDE_CLI_USER_AGENT,
+                accept: "application/json",
+            },
+            signal: AbortSignal.timeout(USAGE_FETCH_TIMEOUT_MS),
+        });
+        return { response };
+    }
+    catch (err) {
+        return { networkError: err instanceof Error ? err.message : String(err) };
+    }
+}
+/**
+ * Fetch fresh usage windows for one account. Return-not-throw.
+ * Refreshes an expiring/expired token first (de-duped, rotation-safe), and
+ * retries once through a forced refresh on a 401.
+ */
+export async function fetchAccountUsage(account) {
+    if (account.type !== "oauth") {
+        return {
+            ok: false,
+            reason: "not_oauth",
+            error: "api_key accounts have no subscription usage windows",
+        };
+    }
+    const runRefresh = async () => {
+        const result = await refreshTokenFromLatest(account, account.persistTarget);
+        if (result.success) {
+            if (account.persistTarget) {
+                await persistTokens(account.persistTarget, account);
+            }
+            return null;
+        }
+        if (isPermanentRefreshFailure(result)) {
+            return {
+                ok: false,
+                reason: "auth",
+                error: "reauth required (refresh token rejected)",
+                status: result.status,
+            };
+        }
+        const tokenExpired = account.expiresAt
+            ? account.expiresAt <= Date.now()
+            : false;
+        return tokenExpired
+            ? {
+                ok: false,
+                reason: "auth",
+                error: "token expired and refresh failed",
+                status: result.status,
+            }
+            : null; // token still valid — attempt the fetch with it
+    };
+    let refreshedThisCall = false;
+    if (needsRefresh(account)) {
+        refreshedThisCall = true;
+        const failure = await runRefresh();
+        if (failure) {
+            return failure;
+        }
+    }
+    let { response, networkError } = await requestUsage(account.token);
+    if (response?.status === 401 && account.refreshToken && !refreshedThisCall) {
+        const failure = await runRefresh();
+        if (failure) {
+            return failure;
+        }
+        ({ response, networkError } = await requestUsage(account.token));
+    }
+    if (!response) {
+        return {
+            ok: false,
+            reason: "network",
+            error: networkError ?? "network failure",
+        };
+    }
+    if (!response.ok) {
+        const body = await response.text().catch(() => "");
+        logger.debug(`[account-usage] usage fetch failed for ${account.label}`, {
+            status: response.status,
+            body: body.slice(0, 300),
+        });
+        return {
+            ok: false,
+            reason: response.status === 401 || response.status === 403 ? "auth" : "http",
+            error: `usage endpoint returned HTTP ${response.status}`,
+            status: response.status,
+        };
+    }
+    try {
+        const usage = (await response.json());
+        return { ok: true, usage };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            reason: "parse",
+            error: err instanceof Error ? err.message : String(err),
+        };
+    }
+}
+// ---------------------------------------------------------------------------
+// Normalization (pure CPU — unit-testable, no I/O)
+// ---------------------------------------------------------------------------
+const REJECTED_SEVERITIES = new Set([
+    "rejected",
+    "exceeded",
+    "over_limit",
+    "blocked",
+]);
+/**
+ * "rejected" iff the window is fully used or the provider severity marks it
+ * exhausted; anything unknown stays "allowed". Conservative on purpose: a
+ * wrong "rejected" would park an account, a wrong "allowed" just delays
+ * parking until the passive capture or the reset. Raw severity is preserved
+ * on the window so nothing is lost.
+ */
+function deriveWindowStatus(percent, severity) {
+    const sev = severity?.trim().toLowerCase();
+    if ((typeof percent === "number" && percent >= 100) ||
+        (sev !== undefined && REJECTED_SEVERITIES.has(sev))) {
+        return "rejected";
+    }
+    return "allowed";
+}
+/** ISO-8601 → unix seconds; 0 when absent/unparseable (matches headers). */
+function isoToEpochSeconds(value) {
+    if (!value) {
+        return 0;
+    }
+    const ms = Date.parse(value);
+    return Number.isNaN(ms) ? 0 : Math.floor(ms / 1000);
+}
+function toFraction(percent) {
+    return typeof percent === "number" && Number.isFinite(percent)
+        ? percent / 100
+        : undefined;
+}
+function mapUsageLimit(entry) {
+    const window = {
+        kind: entry.kind ?? "unknown",
+        used: toFraction(entry.percent) ?? 0,
+        status: deriveWindowStatus(entry.percent, entry.severity),
+        resetsAt: isoToEpochSeconds(entry.resets_at),
+    };
+    if (entry.group !== undefined) {
+        window.group = entry.group;
+    }
+    if (entry.severity !== null && entry.severity !== undefined) {
+        window.severity = entry.severity;
+    }
+    if (entry.is_active !== null && entry.is_active !== undefined) {
+        window.isActive = entry.is_active;
+    }
+    const scopeModel = entry.scope?.model?.display_name;
+    if (scopeModel) {
+        window.scopeModel = scopeModel;
+    }
+    const scopeSurface = entry.scope?.surface;
+    if (scopeSurface) {
+        window.scopeSurface = scopeSurface;
+    }
+    return window;
+}
+/**
+ * Normalize a usage-endpoint payload into the `AccountQuota` shape used by
+ * the passive header path, so a refresh writes through the exact same
+ * save/merge/cooldown chain.
+ *
+ * `prior` supplies fields the usage payload cannot express (fallback and
+ * upgrade-path signals) so `isQuotaOverageAvailable` behaves identically
+ * before and after a refresh. `unifiedStatus` is deliberately never set:
+ * fabricating it would let the reconcile path treat a refresh like a
+ * unified-rejected 429.
+ */
+export function usageToQuota(usage, opts) {
+    const limits = Array.isArray(usage.limits) ? usage.limits : [];
+    if (!usage.five_hour && !usage.seven_day && limits.length === 0) {
+        return null;
+    }
+    const { now, prior } = opts;
+    const windows = limits.map(mapUsageLimit);
+    const sessionLimit = limits.find((entry) => entry.kind === "session");
+    const weeklyLimit = limits.find((entry) => entry.kind === "weekly_all");
+    const sessionPct = usage.five_hour?.utilization ?? sessionLimit?.percent ?? undefined;
+    const weeklyPct = usage.seven_day?.utilization ?? weeklyLimit?.percent ?? undefined;
+    // A refresh must never replace a known reset with 0: the payload omits
+    // `resets_at` for untouched windows, and a zero reset would stop
+    // reconcileCooldownFromQuota from parking a rejected window and make the
+    // routing metrics treat it as non-ticking. A stale prior reset degrades
+    // gracefully (past resets are ignored / freshened downstream).
+    const sessionResetAt = isoToEpochSeconds(usage.five_hour?.resets_at) ||
+        isoToEpochSeconds(sessionLimit?.resets_at) ||
+        (prior?.sessionResetAt ?? 0);
+    const weeklyResetAt = isoToEpochSeconds(usage.seven_day?.resets_at) ||
+        isoToEpochSeconds(weeklyLimit?.resets_at) ||
+        (prior?.weeklyResetAt ?? 0);
+    const overageEnabled = usage.extra_usage?.is_enabled;
+    const overageStatus = overageEnabled === true
+        ? "allowed"
+        : overageEnabled === false
+            ? "rejected"
+            : (prior?.overageStatus ?? "unknown");
+    const quota = {
+        sessionUsed: toFraction(sessionPct) ?? prior?.sessionUsed ?? 0,
+        sessionStatus: deriveWindowStatus(sessionPct, sessionLimit?.severity),
+        sessionResetAt,
+        weeklyUsed: toFraction(weeklyPct) ?? prior?.weeklyUsed ?? 0,
+        weeklyStatus: deriveWindowStatus(weeklyPct, weeklyLimit?.severity),
+        weeklyResetAt,
+        fallbackPercentage: prior?.fallbackPercentage ?? 0,
+        overageStatus,
+        lastUpdated: now,
+        windows,
+        windowsUpdatedAt: now,
+        source: "usage-api",
+    };
+    if (prior?.fallbackStatus !== undefined) {
+        quota.fallbackStatus = prior.fallbackStatus;
+    }
+    if (prior?.upgradePaths !== undefined) {
+        quota.upgradePaths = prior.upgradePaths;
+    }
+    return quota;
+}
+//# sourceMappingURL=accountUsage.js.map

package/dist/lib/server/routes/claudeProxyRoutes.d.ts

@@ -12,7 +12,7 @@
 import { buildTranslationOptions } from "../../proxy/proxyTranslationEngine.js";
 import { ProxyTracer } from "../../proxy/proxyTracer.js";
 import { isPermanentRefreshFailure } from "../../proxy/tokenRefresh.js";
-import type { AccountAllowlist, AccountAdmissionLease, AccountCooldownPlan, AccountQuota, AnthropicAttemptLogger, AnthropicAuthRetryResult, AnthropicLoopState, AnthropicNonOkResult, AnthropicSuccessResult, AnthropicUpstreamFetchResult, ClaudeFinalRequestLogger, ClaudeLoggedErrorBuilder, ClaudeRequest, ClaudeProxyRouteRuntimeOptions, ModelRouterInterface, ParsedClaudeError, ProxyAccountRoutingDecision, ProxyAccountSortMetrics, ProxyBodyCaptureLogger, ProxyQuotaCooldownUpdate, ProxyPassthroughAccount, QueuedAccountAdmission, RouteGroup, RuntimeAccountState, ServerContext, StreamTerminalOutcome } from "../../types/index.js";
+import type { AccountAllowlist, AccountAdmissionLease, AccountCooldownPlan, AccountQuota, AnthropicAttemptLogger, AnthropicAuthRetryResult, AnthropicLoopState, AnthropicNonOkResult, AnthropicSuccessResult, AnthropicUpstreamFetchResult, ClaudeFinalRequestLogger, ClaudeLoggedErrorBuilder, ClaudeRequest, ClaudeProxyRouteRuntimeOptions, ModelRouterInterface, ParsedClaudeError, ProxyAccountRoutingDecision, ProxyAccountSortMetrics, ProxyBodyCaptureLogger, ProxyLimitsRefreshResponse, ProxyQuotaCooldownUpdate, ProxyPassthroughAccount, QueuedAccountAdmission, RouteGroup, RuntimeAccountState, ServerContext, StreamTerminalOutcome } from "../../types/index.js";
 declare function tryAcquireAccountAdmission(accountKey: string, capacity: number | undefined): AccountAdmissionLease | undefined;
 declare function enqueueAccountAdmission(accountKey: string, capacity: number): QueuedAccountAdmission;
 declare function acquireAccountAdmission(accountKey: string, capacity: number, abortSignal?: AbortSignal, timeoutMs?: number): Promise<AccountAdmissionLease | undefined>;
@@ -74,6 +74,18 @@ declare function reconcileCooldownFromQuota(state: RuntimeAccountState, quota: A
  * gracefully because past reset timestamps are ignored by resetEpochToMs.
  */
 declare function seedRuntimeQuotasFromDisk(accounts: ProxyPassthroughAccount[]): Promise<void>;
+/**
+ * Fetch fresh limits from Anthropic's usage endpoint for every eligible OAuth
+ * account and write them through the exact same chain the passive header
+ * capture uses (runtime state → cooldown reconciliation → debounced disk
+ * snapshot), so routing and `auth list` see the refreshed windows and the
+ * automatic path keeps working unchanged on top of them.
+ */
+declare function refreshAccountLimits(options?: {
+    accountAllowlist?: AccountAllowlist;
+    accountFilter?: string;
+    snapshotOnly?: boolean;
+}): Promise<ProxyLimitsRefreshResponse>;
 /**
  * Order accounts to MAXIMIZE quota utilization (fill-first, smart order):
  * spend the overall weekly allowance that expires SOONEST first, so quota
@@ -345,6 +357,8 @@ export declare const __testHooks: {
     maybeResetPrimaryToHome: typeof maybeResetPrimaryToHome;
     planCooldownFor429: typeof planCooldownFor429;
     reconcileCooldownFromQuota: typeof reconcileCooldownFromQuota;
+    refreshAccountLimits: typeof refreshAccountLimits;
+    clearLimitsRefreshStateForTests: () => void;
     isRetryableNetworkError: typeof isRetryableNetworkError;
     isPermanentRefreshFailure: typeof isPermanentRefreshFailure;
     getStreamFailureDetails: typeof getStreamFailureDetails;