@namzu/sdk 58.1.0 → 59.0.0

package/src/account/registry.ts

@@ -0,0 +1,413 @@
+import { randomBytes } from 'node:crypto'
+import {
+	chmodSync,
+	closeSync,
+	fsyncSync,
+	mkdirSync,
+	openSync,
+	readFileSync,
+	realpathSync,
+	renameSync,
+	rmSync,
+	unlinkSync,
+	writeSync,
+} from 'node:fs'
+import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path'
+import { z } from 'zod'
+import { resolveNamzuHome } from '../session/home.js'
+import { withAccountLockSync } from './lock.js'
+import {
+	type Account,
+	type AccountCredentialReaders,
+	type AccountId,
+	type AccountRegistry,
+	AccountRegistryError,
+	type AccountSource,
+	CredentialWithdrawnError,
+	DEFAULT_ACCOUNT_LABEL,
+	type NewAccount,
+	type ResolvedAccountCredential,
+} from './types.js'
+
+export const ACCOUNTS_FILE_NAME = 'accounts.json'
+export const ACCOUNTS_FILE_VERSION = 1
+const LABEL = /^[a-z0-9-]{1,32}$/
+const CODEX_PROVIDER = 'codex'
+const PROVIDER = /^[a-z0-9][a-z0-9._-]{0,63}$/
+
+// Unknown keys are kept so a store written by a newer build survives a rewrite by this one.
+const SourceSchema = z.discriminatedUnion('kind', [
+	z.object({ kind: z.literal('codex-home'), dir: z.string().min(1) }).passthrough(),
+	z.object({ kind: z.literal('api-key'), keyRef: z.string().min(1) }).passthrough(),
+])
+const AccountSchema = z
+	.object({
+		id: z.string().min(1),
+		provider: z.string().min(1),
+		label: z.string().min(1),
+		source: SourceSchema,
+		createdAt: z.string(),
+		display: z.string().optional(),
+		baseUrl: z.string().optional(),
+		defaultModel: z.string().optional(),
+	})
+	.passthrough()
+const FileSchema = z
+	.object({
+		version: z.literal(ACCOUNTS_FILE_VERSION),
+		accounts: z.array(AccountSchema),
+		keys: z.record(z.string()),
+	})
+	.passthrough()
+type StoreFile = z.infer<typeof FileSchema>
+
+export interface AccountRegistryOptions {
+	/** The Namzu home. Defaults to `resolveNamzuHome()`. */
+	readonly home?: string
+	/** Providers that always have a synthesised `default` account, even with no stored one. */
+	readonly defaultProviders?: readonly string[]
+	readonly readers?: AccountCredentialReaders
+	readonly now?: () => Date
+	/** Blocks between attempts to take the store lock. Defaults to a short real sleep. */
+	readonly lockWait?: (attempt: number) => void
+}
+
+function sleepBlocking(): void {
+	Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25)
+}
+
+export function accountId(provider: string, label: string): AccountId {
+	return `${provider}:${label}`
+}
+
+/** Split an id into provider and label, or `undefined` if it is not shaped `<provider>:<label>`. */
+export function parseAccountId(id: string): { provider: string; label: string } | undefined {
+	const at = id.indexOf(':')
+	if (at <= 0 || at === id.length - 1) return undefined
+	return { provider: id.slice(0, at), label: id.slice(at + 1) }
+}
+
+function writeAtomic(path: string, text: string): void {
+	const temporary = join(dirname(path), `.${randomBytes(8).toString('hex')}.accounts.tmp`)
+	const fd = openSync(temporary, 'wx', 0o600)
+	try {
+		writeSync(fd, text)
+		fsyncSync(fd)
+	} finally {
+		closeSync(fd)
+	}
+	try {
+		renameSync(temporary, path)
+	} catch (error) {
+		try {
+			unlinkSync(temporary)
+		} catch {
+			// The rename already failed; the leftover temporary is not the failure to report.
+		}
+		throw error
+	}
+}
+
+export function createAccountRegistry(options: AccountRegistryOptions = {}): AccountRegistry {
+	const home = options.home ?? resolveNamzuHome()
+	const path = join(home, ACCOUNTS_FILE_NAME)
+	const lockPath = `${path}.lock`
+	const accountsRoot = join(home, 'accounts')
+	const now = options.now ?? (() => new Date())
+
+	function defaultAccount(provider: string): Account {
+		return {
+			id: accountId(provider, DEFAULT_ACCOUNT_LABEL),
+			provider,
+			label: DEFAULT_ACCOUNT_LABEL,
+			source: { kind: 'existing-default' },
+			createdAt: new Date(0).toISOString(),
+		}
+	}
+
+	function read(): StoreFile {
+		let text: string
+		try {
+			text = readFileSync(path, 'utf8')
+		} catch (error) {
+			if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+				return { version: ACCOUNTS_FILE_VERSION, accounts: [], keys: {} }
+			}
+			throw error
+		}
+		let json: unknown
+		try {
+			json = JSON.parse(text)
+		} catch {
+			throw new AccountRegistryError(`${path} is not valid JSON; no account was changed.`)
+		}
+		const parsed = FileSchema.safeParse(json)
+		if (!parsed.success) {
+			throw new AccountRegistryError(
+				`${path} is not a version ${ACCOUNTS_FILE_VERSION} account store.`,
+			)
+		}
+		return parsed.data
+	}
+
+	function mutate<T>(change: (file: StoreFile) => T): T {
+		mkdirSync(home, { recursive: true, mode: 0o700 })
+		return withAccountLockSync(
+			lockPath,
+			() => {
+				const file = read()
+				const result = change(file)
+				writeAtomic(path, `${JSON.stringify(file, null, 2)}\n`)
+				try {
+					chmodSync(path, 0o600)
+				} catch {
+					// Windows has no POSIX mode; the temporary was already created 0600 where it applies.
+				}
+				return result
+			},
+			{ attempts: 80, wait: options.lockWait ?? sleepBlocking },
+		)
+	}
+
+	function ownDir(source: { kind: string; [key: string]: unknown }): string {
+		return String(source.dir)
+	}
+
+	function toAccount(stored: StoreFile['accounts'][number]): Account {
+		return stored as unknown as Account
+	}
+
+	function checkLabel(label: string): void {
+		if (!LABEL.test(label)) {
+			throw new AccountRegistryError(
+				'An account label is 1 to 32 characters: lowercase letters, digits and hyphens.',
+			)
+		}
+		if (label === DEFAULT_ACCOUNT_LABEL) {
+			throw new AccountRegistryError('The label "default" belongs to the existing sign-in.')
+		}
+	}
+
+	function checkEndpointAndModel(input: { baseUrl?: string; defaultModel?: string }): void {
+		if (input.baseUrl !== undefined) {
+			let url: URL
+			try {
+				url = new URL(input.baseUrl)
+			} catch {
+				throw new AccountRegistryError('The base URL is not a valid address.')
+			}
+			if (url.protocol !== 'https:' && url.protocol !== 'http:') {
+				throw new AccountRegistryError('The base URL must start with https:// or http://.')
+			}
+			if (url.username !== '' || url.password !== '') {
+				throw new AccountRegistryError('The base URL must not contain a user name or password.')
+			}
+		}
+		if (input.defaultModel !== undefined && !/^\S{1,200}$/.test(input.defaultModel)) {
+			throw new AccountRegistryError('The default model is one name of up to 200 characters.')
+		}
+	}
+
+	function realOrSelf(target: string): string {
+		// Resolve symlinks through the deepest existing ancestor, so a symlinked
+		// parent cannot lead outside the accounts folder.
+		let existing = resolve(target)
+		const rest: string[] = []
+		for (;;) {
+			try {
+				return join(realpathSync(existing), ...rest.reverse())
+			} catch {
+				const parent = dirname(existing)
+				if (parent === existing) return resolve(target)
+				rest.push(basename(existing))
+				existing = parent
+			}
+		}
+	}
+
+	function insideAccountsRoot(dir: string): boolean {
+		const rel = relative(realOrSelf(accountsRoot), realOrSelf(dir))
+		return rel !== '' && !rel.startsWith('..') && !isAbsolute(rel)
+	}
+
+	function nests(outer: string, inner: string): boolean {
+		const rel = relative(realOrSelf(outer), realOrSelf(inner))
+		return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel))
+	}
+
+	const registry: AccountRegistry = {
+		list(provider) {
+			const stored = read().accounts.map(toAccount)
+			const providers = new Set<string>([
+				...(options.defaultProviders ?? []),
+				...stored.map((a) => a.provider),
+			])
+			if (provider !== undefined) providers.add(provider)
+			const defaults = [...providers]
+				.filter((p) => provider === undefined || p === provider)
+				.map(defaultAccount)
+			return [
+				...defaults,
+				...stored.filter((a) => provider === undefined || a.provider === provider),
+			]
+		},
+
+		get(id) {
+			const parsed = parseAccountId(id)
+			if (!parsed) return undefined
+			if (parsed.label === DEFAULT_ACCOUNT_LABEL) return defaultAccount(parsed.provider)
+			const stored = read().accounts.find((a) => a.id === id)
+			return stored ? toAccount(stored) : undefined
+		},
+
+		add(input: NewAccount) {
+			if (!PROVIDER.test(input.provider)) {
+				throw new AccountRegistryError('The provider name is not valid.')
+			}
+			checkLabel(input.label)
+			const id = accountId(input.provider, input.label)
+			return mutate((file) => {
+				if (file.accounts.some((a) => a.id === id)) {
+					throw new AccountRegistryError(`There is already an account labelled "${input.label}".`)
+				}
+				let source: AccountSource
+				if (input.kind === 'api-key') {
+					if (input.apiKey.length === 0) throw new AccountRegistryError('The API key is empty.')
+					checkEndpointAndModel(input)
+					const keyRef = `key-${randomBytes(9).toString('hex')}`
+					file.keys[keyRef] = input.apiKey
+					source = { kind: 'api-key', keyRef }
+				} else {
+					if ((input as { provider: string }).provider !== CODEX_PROVIDER) {
+						throw new AccountRegistryError(
+							'A Codex home account belongs to the codex provider only.',
+						)
+					}
+					const dir = resolve(input.dir ?? join(accountsRoot, 'codex', input.label))
+					if (!insideAccountsRoot(dir)) {
+						throw new AccountRegistryError(
+							'A Codex account directory must live under the Namzu accounts folder.',
+						)
+					}
+					if (
+						file.accounts.some(
+							(a) =>
+								a.source.kind === 'codex-home' &&
+								(nests(a.source.dir, dir) || nests(dir, a.source.dir)),
+						)
+					) {
+						throw new AccountRegistryError(
+							'Another account already uses that Codex directory, or one inside or around it.',
+						)
+					}
+					mkdirSync(dir, { recursive: true, mode: 0o700 })
+					source = { kind: 'codex-home', dir }
+				}
+				const account: Account = {
+					id,
+					provider: input.provider,
+					label: input.label,
+					source,
+					createdAt: now().toISOString(),
+					...(input.display !== undefined ? { display: input.display } : {}),
+					...(input.kind === 'api-key' && input.baseUrl !== undefined
+						? { baseUrl: input.baseUrl }
+						: {}),
+					...(input.kind === 'api-key' && input.defaultModel !== undefined
+						? { defaultModel: input.defaultModel }
+						: {}),
+				}
+				file.accounts.push(account as unknown as StoreFile['accounts'][number])
+				return account
+			})
+		},
+
+		rename(id, label) {
+			checkLabel(label)
+			return mutate((file) => {
+				const index = file.accounts.findIndex((a) => a.id === id)
+				const current = file.accounts[index]
+				if (!current) throw new AccountRegistryError('No such account.')
+				const nextId = accountId(current.provider, label)
+				if (file.accounts.some((a) => a.id === nextId)) {
+					throw new AccountRegistryError(`There is already an account labelled "${label}".`)
+				}
+				const renamed = { ...current, id: nextId, label }
+				file.accounts[index] = renamed
+				return toAccount(renamed)
+			})
+		},
+
+		remove(id) {
+			const parsed = parseAccountId(id)
+			if (parsed?.label === DEFAULT_ACCOUNT_LABEL) {
+				throw new AccountRegistryError(
+					'The existing sign-in is not an account that can be removed.',
+				)
+			}
+			mutate((file) => {
+				const index = file.accounts.findIndex((a) => a.id === id)
+				const current = file.accounts[index]
+				if (!current) throw new AccountRegistryError('No such account.')
+				file.accounts.splice(index, 1)
+				if (current.source.kind === 'api-key') {
+					delete file.keys[current.source.keyRef]
+				} else if (
+					insideAccountsRoot(ownDir(current.source)) &&
+					!file.accounts.some(
+						(a) => a.source.kind === 'codex-home' && nests(ownDir(current.source), a.source.dir),
+					)
+				) {
+					// Only a directory this registry could have created, and that holds no
+					// other account's directory, is ever deleted.
+					rmSync(ownDir(current.source), { recursive: true, force: true })
+				}
+			})
+		},
+
+		async resolve(id, signal): Promise<ResolvedAccountCredential> {
+			const account = registry.get(id)
+			if (!account) throw new CredentialWithdrawnError(id, 'That account no longer exists.')
+			const { source } = account
+			if (source.kind === 'existing-default') {
+				if (!options.readers?.existingDefault) {
+					throw new CredentialWithdrawnError(
+						id,
+						'No reader is configured for the existing sign-in.',
+					)
+				}
+				return options.readers.existingDefault(account.provider, signal)
+			}
+			if (source.kind === 'codex-home') {
+				if (account.provider !== CODEX_PROVIDER) {
+					throw new CredentialWithdrawnError(
+						id,
+						'A Codex home is only valid for the codex provider.',
+					)
+				}
+				if (!options.readers?.codexHome) {
+					throw new CredentialWithdrawnError(id, 'No reader is configured for Codex accounts.')
+				}
+				return options.readers.codexHome(
+					account as Account & { source: { kind: 'codex-home'; dir: string } },
+					signal,
+				)
+			}
+			const secret = read().keys[source.keyRef]
+			if (secret === undefined) {
+				throw new CredentialWithdrawnError(id, 'The saved key for this account is missing.')
+			}
+			return {
+				kind: 'api-key',
+				accessToken: secret,
+				...(account.baseUrl !== undefined ? { baseUrl: account.baseUrl } : {}),
+				...(account.defaultModel !== undefined ? { defaultModel: account.defaultModel } : {}),
+			}
+		},
+
+		next(provider, excluding) {
+			return registry.list(provider).find((a) => !excluding.includes(a.id))
+		},
+	}
+	return registry
+}

package/src/account/types.ts

@@ -0,0 +1,137 @@
+/**
+ * Accounts: more than one credential for one provider, chosen per session.
+ *
+ * An account is a provider plus a label. Today's single sign-in for each
+ * provider is the account labelled `default`; it is read exactly as before and
+ * is never stored here. Further accounts are one of two kinds: a private
+ * Codex home directory that holds its own `auth.json`, or a labelled API key.
+ *
+ * @experimental
+ */
+
+/** `<provider>:<label>`. The label is `[a-z0-9-]{1,32}`; `default` is reserved for today's sign-in. */
+export type AccountId = string
+
+/** The label of the account that wraps a provider's existing sign-in. */
+export const DEFAULT_ACCOUNT_LABEL = 'default'
+
+/** Where an account's credential comes from. */
+export type AccountSource =
+	/** The provider's existing sign-in, read the way it was before accounts existed. Synthesised, never stored. */
+	| { readonly kind: 'existing-default' }
+	/** A private Codex home: `dir/auth.json` was written by `codex login` run with `CODEX_HOME=dir`. */
+	| { readonly kind: 'codex-home'; readonly dir: string }
+	/** A labelled API key. `keyRef` names a slot in the registry's secret map; the key itself is never in a log. */
+	| { readonly kind: 'api-key'; readonly keyRef: string }
+
+export interface Account {
+	readonly id: AccountId
+	readonly provider: string
+	readonly label: string
+	readonly source: AccountSource
+	readonly createdAt: string
+	/** A short human tag such as the tail of the provider's account id. Never a token. */
+	readonly display?: string
+	/** API-key accounts only: the endpoint this key belongs to. A different endpoint is a different account. */
+	readonly baseUrl?: string
+	/** API-key accounts only: the model a session on this account starts with. */
+	readonly defaultModel?: string
+}
+
+/** What `add` accepts. The id, the creation time and the key slot are assigned by the registry. */
+export type NewAccount =
+	| {
+			readonly provider: string
+			readonly label: string
+			readonly kind: 'api-key'
+			readonly apiKey: string
+			readonly display?: string
+			/** An http(s) endpoint without embedded credentials. */
+			readonly baseUrl?: string
+			readonly defaultModel?: string
+	  }
+	| {
+			readonly provider: 'codex'
+			readonly label: string
+			readonly kind: 'codex-home'
+			/** Defaults to `<home>/accounts/codex/<label>`; must stay inside `<home>/accounts`. */
+			readonly dir?: string
+			readonly display?: string
+	  }
+
+/** A credential ready to put on a request. Never logged. */
+export interface ResolvedAccountCredential {
+	readonly kind: 'api-key' | 'oauth'
+	readonly accessToken: string
+	/** Set for an API-key account that names its own endpoint. */
+	readonly baseUrl?: string
+	/** Set for an API-key account that names a starting model. */
+	readonly defaultModel?: string
+	/** The provider-side account identity some drivers send as a header. */
+	readonly accountId?: string
+	/** Epoch milliseconds, when the credential expires. */
+	readonly expiresAt?: number
+}
+
+/** The credential behind an account is gone or unusable; the caller should offer another account. */
+export class CredentialWithdrawnError extends Error {
+	override readonly name = 'CredentialWithdrawnError'
+	constructor(
+		readonly accountId: AccountId,
+		message: string,
+	) {
+		super(message)
+	}
+}
+
+/** A registry mutation was refused: bad label, duplicate, unknown account, unreadable store. */
+export class AccountRegistryError extends Error {
+	override readonly name = 'AccountRegistryError'
+}
+
+/** Another owner holds the lock for a store or an account's credential file. */
+export class AccountLockError extends Error {
+	override readonly name = 'AccountLockError'
+	constructor(
+		readonly lockPath: string,
+		message: string,
+	) {
+		super(message)
+	}
+}
+
+/**
+ * Source-specific readers. The registry owns the bookkeeping; the code that
+ * knows how a provider's sign-in is discovered or refreshed lives with the
+ * provider and is handed in here.
+ */
+export interface AccountCredentialReaders {
+	/** Read the provider's existing sign-in. Throws {@link CredentialWithdrawnError} when there is none. */
+	readonly existingDefault?: (
+		provider: string,
+		signal: AbortSignal,
+	) => Promise<ResolvedAccountCredential>
+	/**
+	 * Read, and refresh when due, the credential in a private Codex home. An
+	 * implementation holds `withAccountRefreshLock` across the read-refresh-write
+	 * so two processes never spend one refresh token twice.
+	 */
+	readonly codexHome?: (
+		account: Account & { readonly source: { readonly kind: 'codex-home'; readonly dir: string } },
+		signal: AbortSignal,
+	) => Promise<ResolvedAccountCredential>
+}
+
+export interface AccountRegistry {
+	/** Stored accounts plus the synthesised `default` of each known provider. Defaults first, then creation order. */
+	list(provider?: string): Account[]
+	get(id: AccountId): Account | undefined
+	add(account: NewAccount): Account
+	/** Change an account's label; its id changes with it. Sessions bound to the old id fall back to `default`. */
+	rename(id: AccountId, label: string): Account
+	/** Remove a stored account and its secret or private Codex directory. The `default` account cannot be removed. */
+	remove(id: AccountId): void
+	resolve(id: AccountId, signal: AbortSignal): Promise<ResolvedAccountCredential>
+	/** The next account of `provider` not in `excluding`, for the "continue with another account" picker. */
+	next(provider: string, excluding: readonly AccountId[]): Account | undefined
+}

package/src/peers/record.ts

@@ -43,9 +43,27 @@ export const PeerRecordSchema = z
 		token: z.string().min(1),
 		protocol: z.literal(PEER_PROTOCOL_VERSION),
 		cliVersion: z.string(),
+		/** The slot a spaces host gave this terminal at launch; how the host finds its own sessions. */
+		hostSlot: z.string().min(1).max(128).optional(),
+		/** The conversation this terminal is on, once it has one. */
+		conversationId: z.string().min(1).optional(),
+		/** The label of the non-default account the conversation is bound to; absent for the default. */
+		account: z.string().min(1).optional(),
+		/** True while the bound account is out of allowance and the terminal is waiting for a choice. */
+		limited: z.boolean().optional(),
+		/** When the allowance is expected back (epoch ms); absent when the provider did not say. */
+		limitedUntil: z.number().int().positive().optional(),
 	})
 	.strict()
 
+/**
+ * The reader's view of a record: the same fields, but a key this build does
+ * not know is dropped instead of failing the whole record. A record written by
+ * a newer build (extra optional fields) stays visible to an older reader.
+ * Writers keep using the strict `PeerRecordSchema`.
+ */
+export const PeerRecordReaderSchema = PeerRecordSchema.strip()
+
 export type PeerRecord = z.infer<typeof PeerRecordSchema>
 
 const PEER_REF_HEX_LENGTH = 6

package/src/peers/registry.ts

@@ -20,7 +20,7 @@ import {
 import { basename, dirname, join } from 'node:path'
 import { parsePeerAddress } from './address.js'
 import { pingPeer } from './client.js'
-import { type PeerRecord, PeerRecordSchema } from './record.js'
+import { type PeerRecord, PeerRecordReaderSchema, PeerRecordSchema } from './record.js'
 
 const RECORD_FILE_MODE = 0o600
 
@@ -75,7 +75,7 @@ function parseRecordText(text: string): PeerRecord | undefined {
 	} catch {
 		return undefined
 	}
-	const result = PeerRecordSchema.safeParse(parsed)
+	const result = PeerRecordReaderSchema.safeParse(parsed)
 	return result.success ? result.data : undefined
 }
 

package/src/provider/errors.ts

@@ -33,6 +33,7 @@ import { LOG_SECRET_PATTERNS } from '../constants/secret-patterns.js'
 import type { ProviderErrorKind, ProviderRequestErrorInit } from '../types/provider/error.js'
 import {
 	type TransportCause,
+	isUsageLimitSignal,
 	readCertificateFailure,
 	readTransportCause,
 } from '../types/provider/errors.js'
@@ -130,6 +131,31 @@ function providerCode(value: unknown): string | undefined {
 	return safeProviderCode(record.code ?? nested)
 }
 
+/**
+ * A vendor can name a spent allowance in `type` instead of `code`
+ * (`{"error":{"type":"usage_limit_reached"}}`, `{"error":{"type":"billing_error"}}`).
+ * Only those identifiers are lifted to a provider code; any other `type` is a
+ * category and stays where it was.
+ */
+function usageLimitTypeOf(error: unknown): string | undefined {
+	if (typeof error !== 'object' || error === null) return undefined
+	const outer = error as { type?: unknown; error?: unknown }
+	const inner =
+		typeof outer.error === 'object' && outer.error !== null
+			? (outer.error as { type?: unknown; error?: unknown })
+			: undefined
+	const innermost =
+		typeof inner?.error === 'object' && inner.error !== null
+			? (inner.error as { type?: unknown })
+			: undefined
+	for (const candidate of [outer.type, inner?.type, innermost?.type]) {
+		if (typeof candidate === 'string' && isUsageLimitSignal(candidate, undefined)) {
+			return safeProviderCode(candidate)
+		}
+	}
+	return undefined
+}
+
 /**
  * Credential shapes to scrub before a provider's words are kept.
  *
@@ -524,7 +550,7 @@ export function providerVendorError(input: {
 }): ProviderRequestError {
 	const { error } = input
 	const status = vendorErrorStatus(error)
-	const exactProviderCode = providerCode(error)
+	const exactProviderCode = providerCode(error) ?? usageLimitTypeOf(error)
 	const name = error instanceof Error ? error.name : ''
 	const message = error instanceof Error ? error.message : ''
 

package/src/provider/token-budget.ts

@@ -29,9 +29,14 @@ function rejectedBeforeGeneration(error: unknown): boolean {
 			[400, 401, 403, 404, 413, 422, 429].includes(classified.status))
 	return (
 		explicitRejection &&
-		['auth', 'rate_limit', 'context_length_exceeded', 'invalid_request', 'not_found'].includes(
-			classified.code,
-		)
+		[
+			'auth',
+			'rate_limit',
+			'usage_limit',
+			'context_length_exceeded',
+			'invalid_request',
+			'not_found',
+		].includes(classified.code)
 	)
 }
 
@@ -96,6 +101,7 @@ export function withTokenBudget(provider: LLMProvider, budget: SessionTokenBudge
 					![
 						'auth',
 						'rate_limit',
+						'usage_limit',
 						'context_length_exceeded',
 						'invalid_request',
 						'not_found',

package/src/public-runtime.ts

@@ -1869,6 +1869,23 @@ export {
 	udsPeerAddress,
 	writePeerRecord,
 } from './peers/index.js'
+export {
+	ACCOUNTS_FILE_NAME,
+	ACCOUNTS_FILE_VERSION,
+	AccountLockError,
+	AccountRegistryError,
+	CredentialWithdrawnError,
+	DEFAULT_ACCOUNT_LABEL,
+	accountBoundPayload,
+	accountId,
+	codexRefreshLockPath,
+	createAccountRegistry,
+	parseAccountId,
+	resolveBoundAccount,
+	withAccountLock,
+	withAccountLockSync,
+	withAccountRefreshLock,
+} from './account/index.js'
 export { DiskPalStore, PalConflictError } from './pals/store.js'
 export { PalRuntime, PalUnavailableError } from './pals/runtime.js'
 export { buildPalSystemPrompt, palConversationGreeting } from './pals/prompt.js'