@kaitranntt/ccs 8.4.0 → 8.5.0-dev.2

package/dist/cliproxy/quota/quota-fetcher-gemini-cli/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Barrel for the Gemini CLI quota fetcher submodule.
+ *
+ * Re-exports the original public surface of `quota-fetcher-gemini-cli.ts`
+ * so the file at the original path can be reduced to a thin re-export
+ * (preserving import paths and signatures). Submodules are private
+ * implementation detail; only the symbols below are part of the contract.
+ */
+export { fetchGeminiCliQuota, fetchAllGeminiCliQuotas } from './quota-fetcher';
+export { resolveGeminiCliProjectId } from './token-parsing';
+export { buildGeminiCliBuckets } from './bucket-building';
+export { sanitizeGeminiCliErrorDetail, extractGeminiCliNestedMessage, parseGeminiCliErrorBody, buildGeminiCliForbiddenActionHint, } from './error-parsing';
+import { sanitizeGeminiCliErrorDetail, extractGeminiCliNestedMessage, parseGeminiCliErrorBody, buildGeminiCliForbiddenActionHint } from './error-parsing';
+export declare const __testExports: {
+    sanitizeGeminiCliErrorDetail: typeof sanitizeGeminiCliErrorDetail;
+    extractGeminiCliNestedMessage: typeof extractGeminiCliNestedMessage;
+    parseGeminiCliErrorBody: typeof parseGeminiCliErrorBody;
+    buildGeminiCliForbiddenActionHint: typeof buildGeminiCliForbiddenActionHint;
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/cliproxy/quota/quota-fetcher-gemini-cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/cliproxy/quota/quota-fetcher-gemini-cli/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAI/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAI1D,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,uBAAuB,EACvB,iCAAiC,GAClC,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,uBAAuB,EACvB,iCAAiC,EAClC,MAAM,iBAAiB,CAAC;AAEzB,eAAO,MAAM,aAAa;;;;;CAKzB,CAAC"}

package/dist/cliproxy/quota/quota-fetcher-gemini-cli/index.js

@@ -0,0 +1,38 @@
+"use strict";
+/**
+ * Barrel for the Gemini CLI quota fetcher submodule.
+ *
+ * Re-exports the original public surface of `quota-fetcher-gemini-cli.ts`
+ * so the file at the original path can be reduced to a thin re-export
+ * (preserving import paths and signatures). Submodules are private
+ * implementation detail; only the symbols below are part of the contract.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.__testExports = exports.buildGeminiCliForbiddenActionHint = exports.parseGeminiCliErrorBody = exports.extractGeminiCliNestedMessage = exports.sanitizeGeminiCliErrorDetail = exports.buildGeminiCliBuckets = exports.resolveGeminiCliProjectId = exports.fetchAllGeminiCliQuotas = exports.fetchGeminiCliQuota = void 0;
+// Public API
+var quota_fetcher_1 = require("./quota-fetcher");
+Object.defineProperty(exports, "fetchGeminiCliQuota", { enumerable: true, get: function () { return quota_fetcher_1.fetchGeminiCliQuota; } });
+Object.defineProperty(exports, "fetchAllGeminiCliQuotas", { enumerable: true, get: function () { return quota_fetcher_1.fetchAllGeminiCliQuotas; } });
+// Exported helpers (also part of the public surface - used by tests and
+// the bucket/grouping normalization tests).
+var token_parsing_1 = require("./token-parsing");
+Object.defineProperty(exports, "resolveGeminiCliProjectId", { enumerable: true, get: function () { return token_parsing_1.resolveGeminiCliProjectId; } });
+var bucket_building_1 = require("./bucket-building");
+Object.defineProperty(exports, "buildGeminiCliBuckets", { enumerable: true, get: function () { return bucket_building_1.buildGeminiCliBuckets; } });
+// Test exports: keep the original `__testExports` bag shape stable so the
+// existing test suite (which destructures `__testExports`) keeps working.
+var error_parsing_1 = require("./error-parsing");
+Object.defineProperty(exports, "sanitizeGeminiCliErrorDetail", { enumerable: true, get: function () { return error_parsing_1.sanitizeGeminiCliErrorDetail; } });
+Object.defineProperty(exports, "extractGeminiCliNestedMessage", { enumerable: true, get: function () { return error_parsing_1.extractGeminiCliNestedMessage; } });
+Object.defineProperty(exports, "parseGeminiCliErrorBody", { enumerable: true, get: function () { return error_parsing_1.parseGeminiCliErrorBody; } });
+Object.defineProperty(exports, "buildGeminiCliForbiddenActionHint", { enumerable: true, get: function () { return error_parsing_1.buildGeminiCliForbiddenActionHint; } });
+// Re-export `__testExports` as a single object to preserve the original
+// named-const export shape (`__testExports`).
+const error_parsing_2 = require("./error-parsing");
+exports.__testExports = {
+    sanitizeGeminiCliErrorDetail: error_parsing_2.sanitizeGeminiCliErrorDetail,
+    extractGeminiCliNestedMessage: error_parsing_2.extractGeminiCliNestedMessage,
+    parseGeminiCliErrorBody: error_parsing_2.parseGeminiCliErrorBody,
+    buildGeminiCliForbiddenActionHint: error_parsing_2.buildGeminiCliForbiddenActionHint,
+};
+//# sourceMappingURL=index.js.map

package/dist/cliproxy/quota/quota-fetcher-gemini-cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/cliproxy/quota/quota-fetcher-gemini-cli/index.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAEH,aAAa;AACb,iDAA+E;AAAtE,oHAAA,mBAAmB,OAAA;AAAE,wHAAA,uBAAuB,OAAA;AAErD,wEAAwE;AACxE,4CAA4C;AAC5C,iDAA4D;AAAnD,0HAAA,yBAAyB,OAAA;AAClC,qDAA0D;AAAjD,wHAAA,qBAAqB,OAAA;AAE9B,0EAA0E;AAC1E,0EAA0E;AAC1E,iDAKyB;AAJvB,6HAAA,4BAA4B,OAAA;AAC5B,8HAAA,6BAA6B,OAAA;AAC7B,wHAAA,uBAAuB,OAAA;AACvB,kIAAA,iCAAiC,OAAA;AAGnC,wEAAwE;AACxE,8CAA8C;AAC9C,mDAKyB;AAEZ,QAAA,aAAa,GAAG;IAC3B,4BAA4B,EAA5B,4CAA4B;IAC5B,6BAA6B,EAA7B,6CAA6B;IAC7B,uBAAuB,EAAvB,uCAAuB;IACvB,iCAAiC,EAAjC,iDAAiC;CAClC,CAAC"}

package/dist/cliproxy/quota/quota-fetcher-gemini-cli/managed-request.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Managed and direct HTTP request machinery for the Gemini CLI quota fetcher.
+ *
+ * Wraps the two upstream call paths used when fetching Gemini CLI quota and
+ * supplementary metadata:
+ *   - managed: delegated through the CLIProxy management API (uses $TOKEN$
+ *       substitution so the local process never holds the live token)
+ *   - direct:  bearer-token fetch against the Google Cloud Code endpoint
+ *
+ * The preferred path is configurable per call. On a 401 from the direct path,
+ * the managed path is retried as a delegated-auth refresh fallback. A
+ * `GeminiManagedAuthUnavailableError` is thrown when managed auth is required
+ * but unreachable, so callers can surface a retryable failure result.
+ */
+/// <reference types="bun-types" />
+/// <reference types="node" />
+import type { ManagedGeminiAuthContext, ManagedGeminiAuthLookupResult, ManagedGeminiRequestResult, ManagedResponse, ManagementAuthFile } from './types';
+/**
+ * Thrown when Gemini delegated auth refresh via the CLIProxy management API
+ * is required but temporarily unreachable. Callers translate this into a
+ * retryable failure result.
+ */
+export declare class GeminiManagedAuthUnavailableError extends Error {
+    constructor();
+}
+/**
+ * Read a fetch Response into the normalized {@link ManagedResponse} shape.
+ * `viaManagement` marks whether the response came through the managed API so
+ * downstream log messages can attribute the source correctly.
+ */
+export declare function readManagedResponse(response: Response, viaManagement: boolean): Promise<ManagedResponse>;
+/**
+ * Check whether a filename matches the Gemini CLI auth file naming patterns.
+ * Recognizes three patterns:
+ *   - legacy:  gemini-*.json
+ *   - new:     *-gen-lang-client-*.json
+ *   - email:   contains "@" (verified against type inside the payload later)
+ */
+export declare function isGeminiAuthFile(filename: string): boolean;
+/**
+ * Determine whether a management-API auth-file descriptor belongs to the
+ * given Gemini account. Matches on provider/type normalized to "gemini",
+ * then on email, filename, or sanitized email substring.
+ */
+export declare function isGeminiAuthFileForAccount(file: ManagementAuthFile, accountId: string): boolean;
+/**
+ * Look up the management-API auth index for a Gemini account.
+ * Hits `/v0/management/auth-files` and matches the entry for this account.
+ * Returns `{ unavailable: true }` if the management API is unreachable or
+ * returns a non-OK response, so callers can fall back to direct auth.
+ */
+export declare function findManagedGeminiAuthIndex(accountId: string, timeoutMs: number): Promise<ManagedGeminiAuthLookupResult>;
+/**
+ * Look up the management auth index for a Gemini account, deduping concurrent
+ * lookups for the same account via the shared {@link ManagedGeminiAuthContext}.
+ * The first caller wins; subsequent callers await the same promise.
+ */
+export declare function getManagedGeminiAuthIndex(accountId: string, timeoutMs: number, context?: ManagedGeminiAuthContext): Promise<ManagedGeminiAuthLookupResult>;
+/**
+ * Perform a single upstream request to the Gemini CLI API via the CLIProxy
+ * management `/v0/management/api-call` endpoint. Uses `$TOKEN$` substitution
+ * so the live token never leaves the management API. Returns
+ * `{ unavailable: true }` if the management path is unreachable; returns
+ * `{ response: null, unavailable: false }` if the request succeeded but no
+ * matching auth file was found.
+ */
+export declare function performManagedGeminiRequest(accountId: string, url: string, body: string, timeoutMs: number, authContext?: ManagedGeminiAuthContext): Promise<ManagedGeminiRequestResult>;
+/**
+ * Perform a Gemini CLI upstream request, preferring the managed path when
+ * requested and falling back to direct bearer-token auth. On a 401 from the
+ * direct path, retries via managed auth as a delegated-auth refresh; throws
+ * {@link GeminiManagedAuthUnavailableError} if that retry is unreachable.
+ *
+ * @param accountId     Account identifier (email), used for managed auth lookup.
+ * @param accessToken   Bearer token for the direct path. Never logged.
+ * @param url           Target Gemini CLI API URL.
+ * @param body          JSON request body string.
+ * @param preferManagement When true, try the managed path first.
+ * @param authContext   Optional shared context to dedupe auth-index lookups.
+ */
+export declare function performGeminiCliRequest(accountId: string, accessToken: string, url: string, body: string, preferManagement?: boolean, authContext?: ManagedGeminiAuthContext): Promise<ManagedResponse>;
+//# sourceMappingURL=managed-request.d.ts.map

package/dist/cliproxy/quota/quota-fetcher-gemini-cli/managed-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-request.d.ts","sourceRoot":"","sources":["../../../../src/cliproxy/quota/quota-fetcher-gemini-cli/managed-request.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;;;AAWH,OAAO,KAAK,EACV,wBAAwB,EACxB,6BAA6B,EAC7B,0BAA0B,EAC1B,eAAe,EAEf,kBAAkB,EACnB,MAAM,SAAS,CAAC;AAEjB;;;;GAIG;AACH,qBAAa,iCAAkC,SAAQ,KAAK;;CAK3D;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,QAAQ,EAClB,aAAa,EAAE,OAAO,GACrB,OAAO,CAAC,eAAe,CAAC,CAQ1B;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAS1D;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAwB/F;AAED;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,6BAA6B,CAAC,CAuBxC;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,6BAA6B,CAAC,CAOxC;AAED;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,WAAW,CAAC,EAAE,wBAAwB,GACrC,OAAO,CAAC,0BAA0B,CAAC,CA2DrC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,gBAAgB,UAAQ,EACxB,WAAW,CAAC,EAAE,wBAAwB,GACrC,OAAO,CAAC,eAAe,CAAC,CAmE1B"}

package/dist/cliproxy/quota/quota-fetcher-gemini-cli/managed-request.js

@@ -0,0 +1,263 @@
+"use strict";
+/**
+ * Managed and direct HTTP request machinery for the Gemini CLI quota fetcher.
+ *
+ * Wraps the two upstream call paths used when fetching Gemini CLI quota and
+ * supplementary metadata:
+ *   - managed: delegated through the CLIProxy management API (uses $TOKEN$
+ *       substitution so the local process never holds the live token)
+ *   - direct:  bearer-token fetch against the Google Cloud Code endpoint
+ *
+ * The preferred path is configurable per call. On a 401 from the direct path,
+ * the managed path is retried as a delegated-auth refresh fallback. A
+ * `GeminiManagedAuthUnavailableError` is thrown when managed auth is required
+ * but unreachable, so callers can surface a retryable failure result.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.performGeminiCliRequest = exports.performManagedGeminiRequest = exports.getManagedGeminiAuthIndex = exports.findManagedGeminiAuthIndex = exports.isGeminiAuthFileForAccount = exports.isGeminiAuthFile = exports.readManagedResponse = exports.GeminiManagedAuthUnavailableError = void 0;
+const proxy_target_resolver_1 = require("../../proxy/proxy-target-resolver");
+const provider_capabilities_1 = require("../../provider-capabilities");
+const auth_utils_1 = require("../../auth/auth-utils");
+const constants_1 = require("./constants");
+const shared_utils_1 = require("./shared-utils");
+/**
+ * Thrown when Gemini delegated auth refresh via the CLIProxy management API
+ * is required but temporarily unreachable. Callers translate this into a
+ * retryable failure result.
+ */
+class GeminiManagedAuthUnavailableError extends Error {
+    constructor() {
+        super('CLIProxy managed Gemini auth is temporarily unavailable');
+        this.name = 'GeminiManagedAuthUnavailableError';
+    }
+}
+exports.GeminiManagedAuthUnavailableError = GeminiManagedAuthUnavailableError;
+/**
+ * Read a fetch Response into the normalized {@link ManagedResponse} shape.
+ * `viaManagement` marks whether the response came through the managed API so
+ * downstream log messages can attribute the source correctly.
+ */
+async function readManagedResponse(response, viaManagement) {
+    const bodyText = await response.text();
+    return {
+        status: response.status,
+        bodyText,
+        json: (0, shared_utils_1.safeParseJson)(bodyText),
+        viaManagement,
+    };
+}
+exports.readManagedResponse = readManagedResponse;
+/**
+ * Check whether a filename matches the Gemini CLI auth file naming patterns.
+ * Recognizes three patterns:
+ *   - legacy:  gemini-*.json
+ *   - new:     *-gen-lang-client-*.json
+ *   - email:   contains "@" (verified against type inside the payload later)
+ */
+function isGeminiAuthFile(filename) {
+    if (!filename.endsWith('.json'))
+        return false;
+    // Legacy pattern: gemini-email.json
+    if (filename.startsWith('gemini-'))
+        return true;
+    // New pattern: email-gen-lang-client-projectId.json
+    if (filename.includes('-gen-lang-client-'))
+        return true;
+    // Check if contains @ (email pattern) - will verify type inside
+    if (filename.includes('@'))
+        return true;
+    return false;
+}
+exports.isGeminiAuthFile = isGeminiAuthFile;
+/**
+ * Determine whether a management-API auth-file descriptor belongs to the
+ * given Gemini account. Matches on provider/type normalized to "gemini",
+ * then on email, filename, or sanitized email substring.
+ */
+function isGeminiAuthFileForAccount(file, accountId) {
+    const rawProvider = (0, shared_utils_1.normalizeStringValue)(file.provider ?? file.type);
+    if (!rawProvider || (0, provider_capabilities_1.mapExternalProviderName)(rawProvider) !== 'gemini') {
+        return false;
+    }
+    const email = (0, shared_utils_1.normalizeStringValue)(file.email);
+    const normalizedAccountId = accountId.trim().toLowerCase();
+    if (email?.toLowerCase() === normalizedAccountId) {
+        return true;
+    }
+    const normalizedName = (0, shared_utils_1.normalizeStringValue)(file.name);
+    if (!normalizedName) {
+        return false;
+    }
+    const normalizedFileName = normalizedName.toLowerCase();
+    const sanitizedAccount = (0, auth_utils_1.sanitizeEmail)(accountId).toLowerCase();
+    return (normalizedFileName === `gemini-${sanitizedAccount}.json` ||
+        normalizedFileName.startsWith(`${normalizedAccountId}-gen-lang-client-`) ||
+        normalizedFileName.includes(sanitizedAccount));
+}
+exports.isGeminiAuthFileForAccount = isGeminiAuthFileForAccount;
+/**
+ * Look up the management-API auth index for a Gemini account.
+ * Hits `/v0/management/auth-files` and matches the entry for this account.
+ * Returns `{ unavailable: true }` if the management API is unreachable or
+ * returns a non-OK response, so callers can fall back to direct auth.
+ */
+async function findManagedGeminiAuthIndex(accountId, timeoutMs) {
+    const target = (0, proxy_target_resolver_1.getProxyTarget)();
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const response = await fetch((0, proxy_target_resolver_1.buildProxyUrl)(target, '/v0/management/auth-files'), {
+            signal: controller.signal,
+            headers: (0, proxy_target_resolver_1.buildManagementHeaders)(target),
+        });
+        clearTimeout(timeoutId);
+        if (!response.ok) {
+            return { authIndex: null, unavailable: true };
+        }
+        const data = (await response.json());
+        const match = data.files?.find((file) => isGeminiAuthFileForAccount(file, accountId));
+        return { authIndex: match?.auth_index ?? null, unavailable: false };
+    }
+    catch {
+        clearTimeout(timeoutId);
+        return { authIndex: null, unavailable: true };
+    }
+}
+exports.findManagedGeminiAuthIndex = findManagedGeminiAuthIndex;
+/**
+ * Look up the management auth index for a Gemini account, deduping concurrent
+ * lookups for the same account via the shared {@link ManagedGeminiAuthContext}.
+ * The first caller wins; subsequent callers await the same promise.
+ */
+async function getManagedGeminiAuthIndex(accountId, timeoutMs, context) {
+    if (!context) {
+        return await findManagedGeminiAuthIndex(accountId, timeoutMs);
+    }
+    context.authIndexLookupPromise ?? (context.authIndexLookupPromise = findManagedGeminiAuthIndex(accountId, timeoutMs));
+    return await context.authIndexLookupPromise;
+}
+exports.getManagedGeminiAuthIndex = getManagedGeminiAuthIndex;
+/**
+ * Perform a single upstream request to the Gemini CLI API via the CLIProxy
+ * management `/v0/management/api-call` endpoint. Uses `$TOKEN$` substitution
+ * so the live token never leaves the management API. Returns
+ * `{ unavailable: true }` if the management path is unreachable; returns
+ * `{ response: null, unavailable: false }` if the request succeeded but no
+ * matching auth file was found.
+ */
+async function performManagedGeminiRequest(accountId, url, body, timeoutMs, authContext) {
+    const deadlineMs = Date.now() + timeoutMs;
+    const lookupResult = await getManagedGeminiAuthIndex(accountId, (0, shared_utils_1.getRemainingTimeoutMs)(deadlineMs), authContext);
+    if (lookupResult.unavailable) {
+        return { response: null, unavailable: true };
+    }
+    const authIndex = lookupResult.authIndex;
+    if (authIndex === null || authIndex === undefined) {
+        return { response: null, unavailable: false };
+    }
+    const target = (0, proxy_target_resolver_1.getProxyTarget)();
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), (0, shared_utils_1.getRemainingTimeoutMs)(deadlineMs));
+    try {
+        const response = await fetch((0, proxy_target_resolver_1.buildProxyUrl)(target, '/v0/management/api-call'), {
+            method: 'POST',
+            signal: controller.signal,
+            headers: (0, proxy_target_resolver_1.buildManagementHeaders)(target, {
+                'Content-Type': 'application/json',
+            }),
+            body: JSON.stringify({
+                auth_index: authIndex,
+                method: 'POST',
+                url,
+                header: {
+                    Authorization: 'Bearer $TOKEN$',
+                    'Content-Type': 'application/json',
+                },
+                data: body,
+            }),
+        });
+        clearTimeout(timeoutId);
+        if (!response.ok) {
+            return { response: null, unavailable: true };
+        }
+        const apiResponse = (await response.json());
+        const bodyText = typeof apiResponse.body === 'string' ? apiResponse.body : '';
+        return {
+            response: {
+                status: typeof apiResponse.status_code === 'number' ? apiResponse.status_code : 500,
+                bodyText,
+                json: (0, shared_utils_1.safeParseJson)(bodyText),
+                viaManagement: true,
+            },
+            unavailable: false,
+        };
+    }
+    catch {
+        clearTimeout(timeoutId);
+        return { response: null, unavailable: true };
+    }
+}
+exports.performManagedGeminiRequest = performManagedGeminiRequest;
+/**
+ * Perform a Gemini CLI upstream request, preferring the managed path when
+ * requested and falling back to direct bearer-token auth. On a 401 from the
+ * direct path, retries via managed auth as a delegated-auth refresh; throws
+ * {@link GeminiManagedAuthUnavailableError} if that retry is unreachable.
+ *
+ * @param accountId     Account identifier (email), used for managed auth lookup.
+ * @param accessToken   Bearer token for the direct path. Never logged.
+ * @param url           Target Gemini CLI API URL.
+ * @param body          JSON request body string.
+ * @param preferManagement When true, try the managed path first.
+ * @param authContext   Optional shared context to dedupe auth-index lookups.
+ */
+async function performGeminiCliRequest(accountId, accessToken, url, body, preferManagement = false, authContext) {
+    let managementAttempted = false;
+    let managementUnavailable = false;
+    if (preferManagement) {
+        managementAttempted = true;
+        const managedResult = await performManagedGeminiRequest(accountId, url, body, constants_1.MANAGEMENT_API_TIMEOUT_MS, authContext);
+        managementUnavailable = managedResult.unavailable;
+        if (managedResult.response) {
+            return managedResult.response;
+        }
+    }
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), managementAttempted ? constants_1.SECONDARY_REQUEST_TIMEOUT_MS : constants_1.MANAGEMENT_API_TIMEOUT_MS);
+    try {
+        const response = await fetch(url, {
+            method: 'POST',
+            signal: controller.signal,
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                'Content-Type': 'application/json',
+            },
+            body,
+        });
+        clearTimeout(timeoutId);
+        const directResult = await readManagedResponse(response, false);
+        if (directResult.status !== 401) {
+            return directResult;
+        }
+        if (managementAttempted) {
+            if (managementUnavailable) {
+                throw new GeminiManagedAuthUnavailableError();
+            }
+            return directResult;
+        }
+        const managedResult = await performManagedGeminiRequest(accountId, url, body, constants_1.SECONDARY_REQUEST_TIMEOUT_MS, authContext);
+        if (managedResult.response) {
+            return managedResult.response;
+        }
+        if (managedResult.unavailable) {
+            throw new GeminiManagedAuthUnavailableError();
+        }
+        return directResult;
+    }
+    catch (error) {
+        clearTimeout(timeoutId);
+        throw error;
+    }
+}
+exports.performGeminiCliRequest = performGeminiCliRequest;
+//# sourceMappingURL=managed-request.js.map

package/dist/cliproxy/quota/quota-fetcher-gemini-cli/managed-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-request.js","sourceRoot":"","sources":["../../../../src/cliproxy/quota/quota-fetcher-gemini-cli/managed-request.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;AAEH,6EAI2C;AAC3C,uEAAsE;AACtE,sDAAsD;AACtD,2CAAsF;AACtF,iDAA4F;AAU5F;;;;GAIG;AACH,MAAa,iCAAkC,SAAQ,KAAK;IAC1D;QACE,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;IAClD,CAAC;CACF;AALD,8EAKC;AAED;;;;GAIG;AACI,KAAK,UAAU,mBAAmB,CACvC,QAAkB,EAClB,aAAsB;IAEtB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACvC,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,QAAQ;QACR,IAAI,EAAE,IAAA,4BAAa,EAAC,QAAQ,CAAC;QAC7B,aAAa;KACd,CAAC;AACJ,CAAC;AAXD,kDAWC;AAED;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,oCAAoC;IACpC,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,oDAAoD;IACpD,IAAI,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,gEAAgE;IAChE,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,KAAK,CAAC;AACf,CAAC;AATD,4CASC;AAED;;;;GAIG;AACH,SAAgB,0BAA0B,CAAC,IAAwB,EAAE,SAAiB;IACpF,MAAM,WAAW,GAAG,IAAA,mCAAoB,EAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC;IACrE,IAAI,CAAC,WAAW,IAAI,IAAA,+CAAuB,EAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,IAAA,mCAAoB,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,mBAAmB,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3D,IAAI,KAAK,EAAE,WAAW,EAAE,KAAK,mBAAmB,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,cAAc,GAAG,IAAA,mCAAoB,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,kBAAkB,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC;IACxD,MAAM,gBAAgB,GAAG,IAAA,0BAAa,EAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IAChE,OAAO,CACL,kBAAkB,KAAK,UAAU,gBAAgB,OAAO;QACxD,kBAAkB,CAAC,UAAU,CAAC,GAAG,mBAAmB,mBAAmB,CAAC;QACxE,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAC9C,CAAC;AACJ,CAAC;AAxBD,gEAwBC;AAED;;;;;GAKG;AACI,KAAK,UAAU,0BAA0B,CAC9C,SAAiB,EACjB,SAAiB;IAEjB,MAAM,MAAM,GAAG,IAAA,sCAAc,GAAE,CAAC;IAChC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAElE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAA,qCAAa,EAAC,MAAM,EAAE,2BAA2B,CAAC,EAAE;YAC/E,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,IAAA,8CAAsB,EAAC,MAAM,CAAC;SACxC,CAAC,CAAC;QACH,YAAY,CAAC,SAAS,CAAC,CAAC;QAExB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqC,CAAC;QACzE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,0BAA0B,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QACtF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,IAAI,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;AACH,CAAC;AA1BD,gEA0BC;AAED;;;;GAIG;AACI,KAAK,UAAU,yBAAyB,CAC7C,SAAiB,EACjB,SAAiB,EACjB,OAAkC;IAElC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,MAAM,0BAA0B,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,CAAC,sBAAsB,KAA9B,OAAO,CAAC,sBAAsB,GAAK,0BAA0B,CAAC,SAAS,EAAE,SAAS,CAAC,EAAC;IACpF,OAAO,MAAM,OAAO,CAAC,sBAAsB,CAAC;AAC9C,CAAC;AAXD,8DAWC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,2BAA2B,CAC/C,SAAiB,EACjB,GAAW,EACX,IAAY,EACZ,SAAiB,EACjB,WAAsC;IAEtC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IAC1C,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAClD,SAAS,EACT,IAAA,oCAAqB,EAAC,UAAU,CAAC,EACjC,WAAW,CACZ,CAAC;IACF,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC;QAC7B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC/C,CAAC;IAED,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC;IACzC,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAClD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAChD,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,sCAAc,GAAE,CAAC;IAChC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAA,oCAAqB,EAAC,UAAU,CAAC,CAAC,CAAC;IAE1F,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAA,qCAAa,EAAC,MAAM,EAAE,yBAAyB,CAAC,EAAE;YAC7E,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,IAAA,8CAAsB,EAAC,MAAM,EAAE;gBACtC,cAAc,EAAE,kBAAkB;aACnC,CAAC;YACF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,SAAS;gBACrB,MAAM,EAAE,MAAM;gBACd,GAAG;gBACH,MAAM,EAAE;oBACN,aAAa,EAAE,gBAAgB;oBAC/B,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI;aACX,CAAC;SACH,CAAC,CAAC;QACH,YAAY,CAAC,SAAS,CAAC,CAAC;QAExB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QAC/C,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA8B,CAAC;QACzE,MAAM,QAAQ,GAAG,OAAO,WAAW,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,OAAO;YACL,QAAQ,EAAE;gBACR,MAAM,EAAE,OAAO,WAAW,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG;gBACnF,QAAQ;gBACR,IAAI,EAAE,IAAA,4BAAa,EAAC,QAAQ,CAAC;gBAC7B,aAAa,EAAE,IAAI;aACpB;YACD,WAAW,EAAE,KAAK;SACnB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC/C,CAAC;AACH,CAAC;AAjED,kEAiEC;AAED;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,uBAAuB,CAC3C,SAAiB,EACjB,WAAmB,EACnB,GAAW,EACX,IAAY,EACZ,gBAAgB,GAAG,KAAK,EACxB,WAAsC;IAEtC,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAChC,IAAI,qBAAqB,GAAG,KAAK,CAAC;IAElC,IAAI,gBAAgB,EAAE,CAAC;QACrB,mBAAmB,GAAG,IAAI,CAAC;QAC3B,MAAM,aAAa,GAAG,MAAM,2BAA2B,CACrD,SAAS,EACT,GAAG,EACH,IAAI,EACJ,qCAAyB,EACzB,WAAW,CACZ,CAAC;QACF,qBAAqB,GAAG,aAAa,CAAC,WAAW,CAAC;QAClD,IAAI,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO,aAAa,CAAC,QAAQ,CAAC;QAChC,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,UAAU,CAC1B,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,mBAAmB,CAAC,CAAC,CAAC,wCAA4B,CAAC,CAAC,CAAC,qCAAyB,CAC/E,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI;SACL,CAAC,CAAC;QACH,YAAY,CAAC,SAAS,CAAC,CAAC;QAExB,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChE,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAChC,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,IAAI,mBAAmB,EAAE,CAAC;YACxB,IAAI,qBAAqB,EAAE,CAAC;gBAC1B,MAAM,IAAI,iCAAiC,EAAE,CAAC;YAChD,CAAC;YACD,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,2BAA2B,CACrD,SAAS,EACT,GAAG,EACH,IAAI,EACJ,wCAA4B,EAC5B,WAAW,CACZ,CAAC;QACF,IAAI,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO,aAAa,CAAC,QAAQ,CAAC;QAChC,CAAC;QACD,IAAI,aAAa,CAAC,WAAW,EAAE,CAAC;YAC9B,MAAM,IAAI,iCAAiC,EAAE,CAAC;QAChD,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AA1ED,0DA0EC"}

package/dist/cliproxy/quota/quota-fetcher-gemini-cli/quota-fetcher.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Top-level quota fetch orchestration for Gemini CLI accounts.
+ *
+ * Coordinates auth-file discovery, the managed/direct upstream quota request,
+ * supplementary tier/credit metadata, and structured failure-result building.
+ * Preserves the structured logging from the original god file (events:
+ * gemini_cli.fetch_start, gemini_cli.auth_file_missing, gemini_cli.token_expired,
+ * gemini_cli.missing_project_id, gemini_cli.api_status, gemini_cli.buckets_found,
+ * gemini_cli.quota_fetch_error). Token values are never logged.
+ */
+import type { GeminiCliQuotaResult } from '../quota-types';
+import type { GeminiCliAuthData } from './types';
+/**
+ * Internal helper: fetch quota with already-validated auth data.
+ *
+ * Extracted to support the auto-refresh retry path: the caller resolves auth
+ * data once (legacy file or managed), then this function performs the upstream
+ * quota request and supplementary metadata fetch in parallel. On success it
+ * persists the resolved tier back to the account via `setAccountTier`.
+ */
+export declare function fetchWithAuthData(authData: GeminiCliAuthData, accountId: string, verbose: boolean): Promise<GeminiCliQuotaResult>;
+/**
+ * Fetch quota for a single Gemini CLI account.
+ *
+ * Reads the on-disk auth file, emits the structured `gemini_cli.fetch_start`
+ * and `gemini_cli.auth_file_missing` / `gemini_cli.token_expired` log events
+ * (gated on `verbose`), and delegates to {@link fetchWithAuthData}. Token
+ * values are never logged; only the expiry label is surfaced.
+ *
+ * @param accountId - Account identifier (email)
+ * @param verbose   - Show detailed diagnostics
+ * @returns Quota result with buckets, percentages, tier, and entitlement evidence
+ */
+export declare function fetchGeminiCliQuota(accountId: string, verbose?: boolean): Promise<GeminiCliQuotaResult>;
+/**
+ * Fetch quota for all configured Gemini CLI accounts in parallel.
+ *
+ * @param verbose - Show detailed diagnostics (forwarded to each per-account fetch)
+ * @returns Array of `{ account, quota }` entries, one per active Gemini account.
+ *          Returns an empty array when there are no Gemini accounts configured.
+ */
+export declare function fetchAllGeminiCliQuotas(verbose?: boolean): Promise<{
+    account: string;
+    quota: GeminiCliQuotaResult;
+}[]>;
+//# sourceMappingURL=quota-fetcher.d.ts.map

package/dist/cliproxy/quota/quota-fetcher-gemini-cli/quota-fetcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quota-fetcher.d.ts","sourceRoot":"","sources":["../../../../src/cliproxy/quota/quota-fetcher-gemini-cli/quota-fetcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAQ3D,OAAO,KAAK,EAAE,iBAAiB,EAAoD,MAAM,SAAS,CAAC;AAEnG;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,iBAAiB,EAC3B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,oBAAoB,CAAC,CA8H/B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,OAAO,UAAQ,GACd,OAAO,CAAC,oBAAoB,CAAC,CAoC/B;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,UAAQ,GACd,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,EAAE,CAAC,CAe7D"}