agent-shim 11.75.0 → 11.76.0

package/dist/cli.cjs

@@ -28490,6 +28490,8 @@ var init_schema = __esm({
       $schema: external_exports.string().optional(),
       name: FileNameSchema,
       defaultConfigProfile: StoredNameSchema.optional(),
+      /** The provider this identity exists for: a launch on the identity routes through it unless `--provider`, `--no-provider` or a cascade layer's `launch.provider` says otherwise. Its sessions run on the provider's credential, so the identity needs no stored login. */
+      provider: StoredNameSchema.optional(),
       allowAmbientCredential: external_exports.boolean().default(false),
       credential: CredentialSchema.optional(),
       /** When this identity's five-hour window should be open: the front door opens one at each anchor if none is. Absent, nothing is opened on a schedule. */
@@ -37381,1099 +37383,744 @@ var init_proxyBypass2 = __esm({
   }
 });
 
-// src/usage/account.ts
-function isObject2(value2) {
-  return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+// src/providerAliases.ts
+function parseAliases(file2, raw) {
+  const parsed = ProviderAliasesSchema.safeParse(raw);
+  if (!parsed.success) {
+    throw new ConfigValidationError(file2, parsed.error.issues);
+  }
+  return parsed.data;
 }
-function isIdentityName(name) {
-  return IdentitySchema.shape.name.safeParse(name).success;
+function readProviderAliases(paths) {
+  return readJson(paths.providerAliasesFile, ProviderAliasesSchema) ?? {};
 }
-function claudeJsonPath(identitiesDir, identity) {
-  return import_node_path24.default.join(identitiesDir, identity, CLAUDE_JSON);
+function loadProviderAliases(file2, port) {
+  const raw = port.readConfigFile(file2);
+  return raw === void 0 ? {} : parseAliases(file2, raw);
 }
-function readAccountMetadata(fs31, identitiesDir, identity) {
-  if (!isIdentityName(identity)) {
-    throw new Error(`"${identity}" is not a valid identity name.`);
+function writeProviderAliases(paths, aliases) {
+  if (Object.keys(aliases).length === 0) {
+    import_node_fs9.default.rmSync(paths.providerAliasesFile, { force: true });
+    return;
   }
-  return readAccountMetadataFile(fs31, claudeJsonPath(identitiesDir, identity));
+  writeJsonAtomic(paths.providerAliasesFile, aliases);
 }
-function readAccountMetadataFile(fs31, file2) {
-  const raw = fs31.readFileUtf8(file2);
-  if (raw === void 0) {
-    return void 0;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    throw new AccountMetadataError(file2, "not valid JSON");
-  }
-  if (!isObject2(parsed)) {
-    throw new AccountMetadataError(file2, "not a JSON object");
-  }
-  const oauthAccount = parsed.oauthAccount;
-  if (!isObject2(oauthAccount)) {
-    return void 0;
+function canonicalProviderName(name, defined, aliases) {
+  if (defined(name)) {
+    return name;
   }
-  const picked = {};
-  for (const key of Object.keys(AccountMetadataSchema.shape)) {
-    const value2 = oauthAccount[key];
-    if (value2 !== null && value2 !== void 0) {
-      picked[key] = value2;
+  return aliases()[name] ?? name;
+}
+function aliasesAfterRename(aliases, from, to2) {
+  const next = {};
+  for (const [alias, target] of Object.entries(aliases)) {
+    if (alias !== to2) {
+      next[alias] = target === from ? to2 : target;
     }
   }
-  const account = AccountMetadataSchema.safeParse(picked);
-  if (!account.success) {
-    throw new AccountMetadataError(file2, account.error.issues.map((issue2) => `${issue2.path.join(".")}: ${issue2.message}`).join("; "));
+  next[from] = to2;
+  return next;
+}
+function aliasesOf(aliases, name) {
+  return Object.entries(aliases).filter(([, target]) => target === name).map(([alias]) => alias).sort();
+}
+function removeProviderAlias(paths, alias) {
+  const aliases = readProviderAliases(paths);
+  if (!(alias in aliases)) {
+    throw new ProviderAliasNotFoundError(alias);
   }
-  return account.data;
+  writeProviderAliases(paths, Object.fromEntries(Object.entries(aliases).filter(([name]) => name !== alias)));
 }
-function createAccountReader(fs31, identitiesDir) {
-  const cache = /* @__PURE__ */ new Map();
-  return (identity) => {
-    if (!isIdentityName(identity)) {
-      throw new Error(`"${identity}" is not a valid identity name.`);
+function aliasFindings(aliases, providerNames) {
+  return Object.entries(aliases).map(([alias, target]) => {
+    if (!providerNames.has(target)) {
+      return { level: "fail", alias, message: `${alias} is recorded as a former name of ${target}, which is not a provider. Run \`agent-shim provider unalias ${alias}\`.` };
     }
-    const stat = fs31.lstat(claudeJsonPath(identitiesDir, identity));
-    const stamp = stat === void 0 ? "absent" : `${String(stat.mtimeMs)}:${String(stat.sizeBytes)}`;
-    const cached2 = cache.get(identity);
-    if (cached2?.stamp === stamp) {
-      return cached2.account;
+    if (providerNames.has(alias)) {
+      return { level: "warn", alias, message: `${alias} is both a provider and a recorded former name of ${target}; the provider wins. Run \`agent-shim provider unalias ${alias}\`.` };
     }
-    const account = readAccountMetadata(fs31, identitiesDir, identity);
-    cache.set(identity, { stamp, account });
-    return account;
+    return { level: "pass", alias, message: `${alias} is a former name of ${target}, still honoured for sessions launched under it. Run \`agent-shim provider unalias ${alias}\` once none is running.` };
+  });
+}
+function createProviderCanonicaliser(params) {
+  const reported = /* @__PURE__ */ new Set();
+  return (name) => {
+    const current = canonicalProviderName(name, params.defined, () => {
+      try {
+        return params.aliases();
+      } catch (error63) {
+        params.log(`provider aliases ignored, the aliases file is unreadable: ${error63 instanceof Error ? error63.message : String(error63)}`);
+        return {};
+      }
+    });
+    if (current !== name && !reported.has(name)) {
+      reported.add(name);
+      params.log(`provider ${name} is a former name of ${current}; a session launched under it is still running`);
+    }
+    return current;
   };
 }
-var import_node_path24, CLAUDE_JSON, AccountMetadataError;
-var init_account = __esm({
-  "src/usage/account.ts"() {
+var import_node_fs9, ProviderAliasesSchema, ProviderAliasNotFoundError;
+var init_providerAliases = __esm({
+  "src/providerAliases.ts"() {
     "use strict";
-    import_node_path24 = __toESM(require("node:path"), 1);
+    import_node_fs9 = __toESM(require("node:fs"), 1);
+    init_zod();
     init_cliError();
-    init_schema();
-    init_schema2();
-    CLAUDE_JSON = ".claude.json";
-    AccountMetadataError = class extends CliError {
-      constructor(file2, detail) {
-        super(`${file2}: ${detail}, so its account metadata cannot be read.`);
-        this.file = file2;
-        this.name = "AccountMetadataError";
+    init_load();
+    init_store();
+    ProviderAliasesSchema = external_exports.record(external_exports.string().min(1), external_exports.string().min(1));
+    ProviderAliasNotFoundError = class extends CliError {
+      constructor(alias) {
+        super(`"${alias}" is not a former provider name. \`agent-shim provider list\` shows the ones recorded.`);
+        this.alias = alias;
+        this.name = "ProviderAliasNotFoundError";
       }
-      file;
+      alias;
     };
   }
 });
 
-// package.json
-var package_default;
-var init_package = __esm({
-  "package.json"() {
-    package_default = {
-      name: "agent-shim",
-      version: "11.75.0",
-      description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
-      license: "MIT",
-      author: "Joseph Mearman <joseph@mearman.co.uk>",
-      repository: {
-        type: "git",
-        url: "git+https://github.com/ExaDev/agent-shim.git"
-      },
-      homepage: "https://github.com/ExaDev/agent-shim#readme",
-      bugs: "https://github.com/ExaDev/agent-shim/issues",
-      keywords: [
-        "claude-code",
-        "claude",
-        "cli"
-      ],
-      packageManager: "pnpm@12.4.1+sha512.2e81e399d73fe8390dab25e06aa788ab7a5908248d2f5a370f82b481147a6a7a367bf8048f9a6fdb6460f21a66f0542dedb8b94ca2c8723596741920b1656d4c",
-      type: "module",
-      engines: {
-        node: "^22.18 || >=24"
-      },
-      bin: {
-        "agent-shim": "dist/cli.cjs",
-        "claude-use": "dist/cli.cjs"
-      },
-      files: [
-        "dist/cli.cjs",
-        "dist/index.mjs",
-        "dist/index.cjs",
-        "dist/types"
-      ],
-      scripts: {
-        prepare: "husky && node scripts/build.mts --bundle-only",
-        typecheck: "turbo run _typecheck",
-        _typecheck: "tsc --noEmit",
-        lint: "turbo run _lint",
-        _lint: "eslint . --cache --cache-location .eslintcache --max-warnings 0",
-        test: "turbo run _test",
-        _test: "vitest run",
-        "test:coverage": "turbo run _test:coverage",
-        "_test:coverage": "vitest run --coverage",
-        knip: "turbo run _knip",
-        _knip: "knip --cache",
-        build: "turbo run _build",
-        _build: "node scripts/build.mts",
-        "build:bundle": "node scripts/build.mts --bundle-only",
-        prepublishOnly: "pnpm build:bundle",
-        schema: "node scripts/gen-schema.mts"
-      },
-      dependencies: {
-        "@anthropic-ai/claude-agent-sdk": "0.3.292",
-        "@clack/prompts": "^1.8.0",
-        "@modelcontextprotocol/sdk": "1.32.0",
-        "@orpc/client": "2.0.0-beta.43",
-        "@orpc/openapi": "2.0.0-beta.43",
-        "@orpc/server": "2.0.0-beta.43",
-        commander: "^15.0.0",
-        cosmiconfig: "^10.0.1",
-        picomatch: "^4.0.7",
-        "string-width": "8.3.0",
-        trilean: "1.9.0",
-        undici: "7.30.1",
-        zod: "^4.6.7"
-      },
-      devDependencies: {
-        "@commitlint/cli": "^21.2.2",
-        "@commitlint/config-conventional": "^21.2.2",
-        "@exadev/eslint-config": "2.12.1",
-        "@semantic-release/changelog": "^7.0.0",
-        "@semantic-release/git": "^11.0.1",
-        "@semantic-release/npm": "^13.1.5",
-        "@types/node": "^26.5.1",
-        "@types/picomatch": "^4.0.3",
-        "@vitest/coverage-v8": "^4.1.12",
-        combinatrix: "2.0.1",
-        "conventional-changelog-conventionalcommits": "^10.4.0",
-        esbuild: "^0.28.2",
-        eslint: "^10.10.0",
-        globals: "^17.12.0",
-        husky: "^9.1.7",
-        jiti: "^2.7.0",
-        knip: "^6.35.1",
-        "lint-staged": "^17.5.0",
-        rollup: "4.64.0",
-        "rollup-plugin-dts": "6.5.1",
-        "semantic-release": "^25.0.9",
-        turbo: "^2.11.5",
-        typescript: "^6.0.3",
-        "typescript-eslint": "^8.70.0",
-        vitest: "^4.1.12",
-        yaml: "2.9.1"
-      },
-      main: "dist/index.cjs",
-      module: "dist/index.mjs",
-      types: "dist/types/index.d.ts",
-      exports: {
-        ".": {
-          types: "./dist/types/index.d.ts",
-          import: "./dist/index.mjs",
-          require: "./dist/index.cjs"
-        },
-        "./package.json": "./package.json"
-      }
-    };
+// src/models/identity.ts
+function withoutContextMarker(model) {
+  return model.toLowerCase().endsWith(CONTEXT_MARKER_1M) ? model.slice(0, -CONTEXT_MARKER_1M.length) : model;
+}
+function canonicalText(name) {
+  return name.trim().toLowerCase().replace(NON_IDENTITY_BRACKET_RE, "").replace(/[\s_]+/g, "-").replace(/([a-z])(\d+(?:\.\d+)+)/g, "$1-$2").replace(/-+/g, "-").replace(/^-|-$/g, "");
+}
+function splitVariants(tokens) {
+  const variants2 = [];
+  let end = tokens.length;
+  for (; ; ) {
+    const token = tokens[end - 1];
+    if (token === void 0 || !KNOWN_VARIANTS.has(token)) {
+      return { familyTokens: tokens.slice(0, end), variants: variants2 };
+    }
+    variants2.unshift(token);
+    end -= 1;
   }
-});
-
-// src/usage/plan.ts
-function planOf(account) {
-  const userTier = account?.userRateLimitTier;
-  if (userTier !== void 0 && ZERO_TIER.test(userTier)) {
-    return { kind: "pay-per-use", tier: userTier };
+}
+function versionOf(tokens) {
+  for (let index = 0; index < tokens.length; index += 1) {
+    const token = tokens[index];
+    const next = tokens[index + 1];
+    if (token === void 0) {
+      return "";
+    }
+    if (/^\d+$/.test(token) && next !== void 0 && /^\d+$/.test(next)) {
+      return `${token}.${next}`;
+    }
+    const dotted = /^\d+(?:\.\d+)+$/.exec(token);
+    if (dotted !== null) {
+      return dotted[0];
+    }
   }
-  const tier = account?.organizationRateLimitTier ?? userTier;
-  const tierField = tier === void 0 ? {} : { tier };
-  if (tier === void 0) {
-    return { kind: "subscription", capacity: 1, recognised: false };
+  return "";
+}
+function modelIdentity(rawName) {
+  const segments = rawName.trim().toLowerCase().split("/");
+  const stripped = canonicalText(segments[segments.length - 1] ?? "").split(":")[0] ?? "";
+  const withoutDate = stripped.replace(DATE_STAMP_RE, "");
+  const tokens = withoutDate.split("-").filter((token) => token !== "");
+  const { familyTokens, variants: variants2 } = splitVariants(tokens);
+  const version2 = versionOf(familyTokens);
+  const versionless = familyTokens.filter((token, index) => {
+    if (version2 === "") {
+      return true;
+    }
+    const dotted = /^\d+(?:\.\d+)+$/.test(token);
+    const previous = familyTokens[index - 1];
+    const next = familyTokens[index + 1];
+    const insideVersionRun = dotted || /^\d+$/.test(token) && (previous !== void 0 && /^\d+$/.test(previous) || next !== void 0 && /^\d+$/.test(next));
+    return !insideVersionRun;
+  });
+  const family = versionless.join("-");
+  const tokenVendor = familyTokens.find((token) => Object.keys(VENDOR_BY_TOKEN).some((key) => token === key || token.startsWith(key)));
+  const namespace = segments.length >= 2 ? (segments[0] ?? "").split(":").pop() ?? "" : "";
+  const namespaceVendor = VENDOR_BY_NAMESPACE[namespace] ?? "";
+  const tokenVendorName = tokenVendor === void 0 ? "" : VENDOR_BY_TOKEN[Object.keys(VENDOR_BY_TOKEN).find((key) => tokenVendor === key || tokenVendor.startsWith(key)) ?? ""] ?? "";
+  return {
+    vendor: tokenVendorName === "" ? namespaceVendor : tokenVendorName,
+    vendorConflict: tokenVendorName !== "" && namespaceVendor !== "" && tokenVendorName !== namespaceVendor,
+    family,
+    version: version2,
+    variant: variants2.join("-"),
+    familyAndVersion: version2 === "" ? family : `${family}-${version2.replace(/\./g, "-")}`
+  };
+}
+function relateModels(left, right) {
+  const a10 = modelIdentity(left);
+  const b = modelIdentity(right);
+  if (a10.familyAndVersion !== b.familyAndVersion) {
+    return sameFamilyOtherVersion(a10, b) ? "similar" : "distinct";
   }
-  if (ZERO_TIER.test(tier)) {
-    return { kind: "pay-per-use", ...tierField };
+  if (a10.variant !== b.variant || a10.vendorConflict || b.vendorConflict || a10.vendor !== "" && b.vendor !== "" && a10.vendor !== b.vendor) {
+    return "similar";
   }
-  const multiplier = TIER_MULTIPLIER.exec(tier)?.[1];
-  if (multiplier !== void 0) {
-    return { kind: "subscription", capacity: Number(multiplier), recognised: true, ...tierField };
+  return "same";
+}
+function sameFamilyOtherVersion(a10, b) {
+  if (a10.family !== b.family) {
+    return false;
   }
-  return { kind: "subscription", capacity: 1, recognised: BASE_TIER.test(tier), ...tierField };
+  if (a10.vendor !== "" && b.vendor !== "" && a10.vendor !== b.vendor) {
+    return false;
+  }
+  return true;
 }
-var PlanClassSchema, TIER_MULTIPLIER, ZERO_TIER, BASE_TIER;
-var init_plan2 = __esm({
-  "src/usage/plan.ts"() {
+var NON_IDENTITY_BRACKET_RE, CONTEXT_MARKER_1M, DATE_STAMP_RE, KNOWN_VARIANTS, VENDOR_BY_NAMESPACE, VENDOR_BY_TOKEN;
+var init_identity2 = __esm({
+  "src/models/identity.ts"() {
     "use strict";
-    init_zod();
-    PlanClassSchema = external_exports.union([
-      external_exports.strictObject({
-        kind: external_exports.literal("subscription"),
-        /** The plan's size as a multiple of the smallest subscription tier (Max is 5, Ultra is 20). */
-        capacity: external_exports.number().positive(),
-        /** False when the tier string named no multiplier and no tier this project knows, so `capacity` is the neutral 1 rather than a reading. */
-        recognised: external_exports.boolean(),
-        /** The tier string the classification rests on, when the account had one. */
-        tier: external_exports.string().optional()
-      }),
-      external_exports.strictObject({
-        kind: external_exports.literal("pay-per-use"),
-        tier: external_exports.string().optional()
-      })
-    ]);
-    TIER_MULTIPLIER = /(?:^|_)(\d+)x$/;
-    ZERO_TIER = /(?:^|_)zero$/;
-    BASE_TIER = /(?:^|_)(?:pro|free)$/;
+    NON_IDENTITY_BRACKET_RE = /\[[^\]]*\]/g;
+    CONTEXT_MARKER_1M = "[1m]";
+    DATE_STAMP_RE = /-(?:19|20)\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])$/;
+    KNOWN_VARIANTS = /* @__PURE__ */ new Set(["high", "medium", "low", "thinking", "xhigh", "max", "highspeed", "sol", "terra", "luna", "mini", "flash-lite", "turbo"]);
+    VENDOR_BY_NAMESPACE = Object.freeze({
+      anthropic: "anthropic",
+      google: "google",
+      openai: "openai",
+      zai: "zai",
+      "z-ai": "zai",
+      minimax: "minimax",
+      qwen: "qwen",
+      deepseek: "deepseek",
+      moonshot: "moonshot",
+      meta: "meta",
+      mistral: "mistral"
+    });
+    VENDOR_BY_TOKEN = Object.freeze({
+      claude: "anthropic",
+      gemini: "google",
+      antigravity: "google",
+      gpt: "openai",
+      glm: "zai",
+      minimax: "minimax",
+      qwen: "qwen",
+      deepseek: "deepseek",
+      kimi: "moonshot",
+      llama: "meta",
+      mistral: "mistral",
+      mixtral: "mistral"
+    });
   }
 });
 
-// src/usage/scan.ts
-function mergeUsage(current, raw) {
-  const parsed = AnthropicUsageSchema.safeParse(raw);
-  if (!parsed.success) {
-    return current;
+// src/models/families.ts
+function modelOf(ref) {
+  const slash = ref.indexOf("/");
+  return slash === -1 ? ref : ref.slice(slash + 1);
+}
+function familyKeyOf(rawModel) {
+  const identity = modelIdentity(rawModel);
+  return identity.variant === "" ? identity.familyAndVersion : `${identity.familyAndVersion}${VARIANT_SEPARATOR}${identity.variant}`;
+}
+function assertionsOf(models) {
+  return { same: models?.same ?? [], distinct: models?.distinct ?? [] };
+}
+function sameModel(left, right, assertions) {
+  if (assertions.distinct.some(([a10, b]) => a10 === left && b === right || a10 === right && b === left)) {
+    return false;
   }
-  const usage = parsed.data;
-  const merged = {
-    ...current,
-    ...typeof usage.input_tokens === "number" ? { inputTokens: usage.input_tokens } : {},
-    ...typeof usage.output_tokens === "number" ? { outputTokens: usage.output_tokens } : {},
-    ...typeof usage.cache_creation_input_tokens === "number" ? { cacheCreationInputTokens: usage.cache_creation_input_tokens } : {},
-    ...typeof usage.cache_read_input_tokens === "number" ? { cacheReadInputTokens: usage.cache_read_input_tokens } : {}
-  };
-  return Object.keys(merged).length === 0 ? current : merged;
+  const leftGroup = assertions.same.find((group) => group.includes(left));
+  const rightGroup = assertions.same.find((group) => group.includes(right));
+  if (leftGroup !== void 0 && leftGroup === rightGroup) {
+    return true;
+  }
+  if (leftGroup !== void 0 && !leftGroup.includes(right) || rightGroup !== void 0 && !rightGroup.includes(left)) {
+    return false;
+  }
+  return relateModels(modelOf(left), modelOf(right)) === "same";
 }
-function errorInfo(raw) {
-  const parsed = ErrorObjectSchema.safeParse(raw);
-  if (!parsed.success) {
+function pinnedTo(settings2, ref) {
+  return settings2?.names?.some((name) => name === ref || name === modelOf(ref)) === true;
+}
+function buildFamilies(refs, models) {
+  const assertions = assertionsOf(models);
+  const settingsByKey = models?.families ?? {};
+  const groups = [];
+  for (const ref of refs) {
+    const pinnedKey = Object.entries(settingsByKey).find(([, settings2]) => pinnedTo(settings2, ref))?.[0];
+    const joined3 = groups.find((group) => pinnedKey === void 0 ? group.refs.some((first) => sameModel(first, ref, assertions)) : group.key === pinnedKey);
+    if (joined3 !== void 0) {
+      joined3.refs.push(ref);
+    } else {
+      groups.push({ key: pinnedKey ?? familyKeyOf(modelOf(ref)), refs: [ref] });
+    }
+  }
+  return groups.map((group) => ({ key: group.key, refs: group.refs, settings: settingsByKey[group.key] ?? {} }));
+}
+function familyNamed(families, member) {
+  if (!member.startsWith(FAMILY_PREFIX)) {
     return void 0;
   }
-  const { type: type2, code, message } = parsed.data;
-  return {
-    ...type2 === void 0 ? {} : { type: type2 },
-    ...code === void 0 ? {} : { code: String(code) },
-    ...message === void 0 ? {} : { message }
-  };
+  const key = member.slice(FAMILY_PREFIX.length);
+  return families.find((family) => family.key === key);
 }
-function isObject3(value2) {
-  return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+function familyCapabilities(settings2) {
+  return { vision: settings2.vision ?? true, tools: settings2.tools ?? true, thinking: settings2.thinking ?? true };
 }
-function parseJson2(text5) {
-  try {
-    const parsed = JSON.parse(text5);
-    return parsed;
-  } catch {
-    return void 0;
+function familyMode(settings2) {
+  return settings2.mode ?? "ordered";
+}
+function sharedFamilies(families) {
+  return families.filter((family) => family.refs.length > 1);
+}
+function expandFamilyMembers(members2, families) {
+  const expanded = [];
+  for (const member of members2) {
+    for (const ref of member.startsWith(FAMILY_PREFIX) ? familyNamed(families, member)?.refs ?? [] : [member]) {
+      if (!expanded.includes(ref)) {
+        expanded.push(ref);
+      }
+    }
   }
+  return expanded;
 }
-function createSseScanner() {
-  let model;
-  let usage;
-  let error63;
-  let eventName;
-  let line = "";
-  let skipping = false;
-  let data = [];
-  const dispatch = () => {
-    if (data.length > 0) {
-      const payload = parseJson2(data.join("\n"));
-      if (isObject3(payload)) {
-        const type2 = typeof payload.type === "string" ? payload.type : void 0;
-        if (type2 === "message_start" && isObject3(payload.message)) {
-          if (typeof payload.message.model === "string") {
-            model = payload.message.model;
-          }
-          usage = mergeUsage(usage, payload.message.usage);
-        } else if (type2 === "message_delta") {
-          usage = mergeUsage(usage, payload.usage);
-        } else if (type2 === "error") {
-          error63 = errorInfo(payload.error) ?? error63;
-        }
-      }
-    }
-    eventName = void 0;
-    data = [];
-  };
-  const worthKeeping = (partial2) => {
-    if (!partial2.startsWith("data:")) {
-      return true;
-    }
-    if (eventName !== void 0) {
-      return METADATA_EVENTS.has(eventName);
-    }
-    const leading = LEADING_TYPE.exec(partial2.slice("data:".length));
-    if (leading?.[1] !== void 0) {
-      return METADATA_EVENTS.has(leading[1]);
-    }
-    return void 0;
-  };
-  const completeLine = (complete) => {
-    const text5 = complete.endsWith("\r") ? complete.slice(0, -1) : complete;
-    if (text5 === "") {
-      dispatch();
-      return;
-    }
-    if (text5.startsWith("event:")) {
-      eventName = text5.slice("event:".length).trim();
-      return;
-    }
-    if (text5.startsWith("data:")) {
-      const value2 = text5.slice("data:".length);
-      data.push(value2.startsWith(" ") ? value2.slice(1) : value2);
-    }
-  };
-  return {
-    push: (text5) => {
-      let start = 0;
-      for (; ; ) {
-        const newline = text5.indexOf("\n", start);
-        const piece = newline === -1 ? text5.slice(start) : text5.slice(start, newline);
-        if (!skipping) {
-          line += piece;
-          if (worthKeeping(line) === false) {
-            line = "";
-            skipping = true;
-          }
-        }
-        if (newline === -1) {
-          return;
-        }
-        if (!skipping) {
-          completeLine(line);
-        }
-        line = "";
-        skipping = false;
-        start = newline + 1;
-      }
-    },
-    result: () => {
-      if (!skipping && line !== "") {
-        completeLine(line);
-        line = "";
-      }
-      dispatch();
-      return { model, usage, error: error63 };
-    }
-  };
+function familyOfRef(families, ref) {
+  return families.find((family) => family.refs.includes(ref));
 }
-function createJsonScanner() {
-  const captured = /* @__PURE__ */ new Map();
-  let depth = 0;
-  let inString = false;
-  let escaped = false;
-  let readingKey = false;
-  let expectKey = false;
-  let key = "";
-  let capturing;
-  let capture = "";
-  let inValue = false;
-  let currentKey = "";
-  const endValue = () => {
-    if (capturing !== void 0) {
-      captured.set(capturing, capture.trim());
-    }
-    capturing = void 0;
-    capture = "";
-    inValue = false;
-  };
-  const step2 = (char) => {
-    if (capturing !== void 0 && !(depth === 1 && !inString && (char === "," || char === "}"))) {
-      capture += char;
-    }
-    if (inString) {
-      if (escaped) {
-        escaped = false;
-      } else if (char === "\\") {
-        escaped = true;
-      } else if (char === '"') {
-        inString = false;
-        if (readingKey) {
-          readingKey = false;
-          currentKey = key;
-        }
-        return;
-      }
-      if (readingKey) {
-        key += char;
-      }
-      return;
-    }
-    switch (char) {
-      case '"':
-        inString = true;
-        if (depth === 1 && expectKey) {
-          readingKey = true;
-          expectKey = false;
-          key = "";
-        }
-        return;
-      case "{":
-      case "[":
-        depth += 1;
-        if (depth === 1 && char === "{") {
-          expectKey = true;
-        }
-        return;
-      case "}":
-      case "]":
-        if (depth === 1) {
-          endValue();
-        }
-        depth -= 1;
-        return;
-      case ":":
-        if (depth === 1 && !inValue) {
-          inValue = true;
-          if (METADATA_KEYS.has(currentKey)) {
-            capturing = currentKey;
-            capture = "";
-          }
-        }
-        return;
-      case ",":
-        if (depth === 1) {
-          endValue();
-          expectKey = true;
-        }
-        return;
-      default:
-        return;
-    }
-  };
-  return {
-    push: (text5) => {
-      for (const char of text5) {
-        step2(char);
-      }
-    },
-    result: () => {
-      const model = parseJson2(captured.get("model") ?? "");
-      const usageRaw = parseJson2(captured.get("usage") ?? "");
-      const errorRaw = parseJson2(captured.get("error") ?? "");
-      return {
-        model: typeof model === "string" ? model : void 0,
-        usage: mergeUsage(void 0, usageRaw),
-        error: errorInfo(errorRaw)
-      };
-    }
-  };
+function accountRefsOf(models) {
+  const named = [...(models?.same ?? []).flat(), ...Object.values(models?.families ?? {}).flatMap((settings2) => settings2.names ?? [])];
+  return [...new Set(named.filter((ref) => ref.startsWith("acct:")))];
 }
-var AnthropicUsageSchema, ErrorObjectSchema, METADATA_EVENTS, LEADING_TYPE, METADATA_KEYS;
-var init_scan = __esm({
-  "src/usage/scan.ts"() {
+var FAMILY_PREFIX, VARIANT_SEPARATOR;
+var init_families = __esm({
+  "src/models/families.ts"() {
     "use strict";
-    init_zod();
-    AnthropicUsageSchema = external_exports.looseObject({
-      input_tokens: external_exports.number().int().nonnegative().nullish(),
-      output_tokens: external_exports.number().int().nonnegative().nullish(),
-      cache_creation_input_tokens: external_exports.number().int().nonnegative().nullish(),
-      cache_read_input_tokens: external_exports.number().int().nonnegative().nullish()
-    });
-    ErrorObjectSchema = external_exports.looseObject({
-      type: external_exports.string().optional(),
-      code: external_exports.union([external_exports.string(), external_exports.number()]).optional(),
-      message: external_exports.string().optional()
-    });
-    METADATA_EVENTS = /* @__PURE__ */ new Set(["message_start", "message_delta", "error"]);
-    LEADING_TYPE = /^\s*\{\s*"type"\s*:\s*"([^"]*)"/;
-    METADATA_KEYS = /* @__PURE__ */ new Set(["model", "usage", "error"]);
+    init_identity2();
+    FAMILY_PREFIX = "family:";
+    VARIANT_SEPARATOR = "+";
   }
 });
 
-// src/usage/middleware.ts
-function scannerFor(headers) {
-  const contentType = headerValue(headers, "content-type")?.toLowerCase() ?? "";
-  if (contentType.startsWith("text/event-stream")) {
-    return createSseScanner();
-  }
-  if (contentType.startsWith("application/json")) {
-    return createJsonScanner();
-  }
-  return void 0;
+// src/providersStore.ts
+function providerJsonPath(paths, name) {
+  return providerFilePath(paths.providersDir, name);
 }
-function headerValue(headers, name) {
-  for (const [key, value2] of Object.entries(headers)) {
-    if (key.toLowerCase() === name) {
-      return value2;
-    }
-  }
-  return void 0;
+function providerFileDefined(lstat, providersDir, name) {
+  return isStoredName(name) && lstat(providerFilePath(providersDir, name)) !== void 0;
 }
-function decoderFor(encoding) {
-  switch (encoding?.trim().toLowerCase()) {
-    case void 0:
-    case "":
-    case "identity":
-      return null;
-    case "gzip":
-    case "x-gzip":
-      return zlib.createGunzip();
-    case "deflate":
-      return zlib.createInflate();
-    case "br":
-      return zlib.createBrotliDecompress();
-    default:
-      return void 0;
-  }
+function providerExists(paths, name) {
+  return import_node_fs10.default.existsSync(providerJsonPath(paths, name));
 }
-function destinationOf(path73, sessionProvider) {
-  const scoped = parseProviderPath(path73);
-  if (scoped !== void 0) {
-    return { provider: scoped.provider, endpoint: scoped.rest };
+function requireProviderExists(paths, name) {
+  const canonical = canonicalProviderName(name, (candidate) => providerExists(paths, candidate), () => readProviderAliases(paths));
+  if (!providerExists(paths, canonical)) {
+    throw new ProviderNotFoundError(name);
   }
-  return { provider: sessionProvider ?? ANTHROPIC_PROVIDER, endpoint: path73 };
 }
-function modelChoiceOf(event, servedModel, provider) {
-  if (event.modelChoice !== void 0) return event.modelChoice;
-  if (event.requestedModel === void 0 || servedModel === void 0 || event.requestedModel === servedModel) return void 0;
-  return { requested: event.requestedModel, providers: [provider] };
+function isRecord4(value2) {
+  return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
-function buildRecord(event, context) {
-  const { scan } = context;
-  const { provider, endpoint } = destinationOf(event.servedPath, event.session.provider);
-  const choice = modelChoiceOf(event, scan?.model, provider);
-  const rateLimitHeaders = rateLimitHeadersOf(event.headers);
-  const limit = classifyLimit({ status: event.status, headers: rateLimitHeaders ?? {}, error: scan?.error, nowMs: context.endedAt });
-  const requestId = headerValue(event.headers, "request-id");
-  const { identity, sessionId, projectId } = event.session;
+function legacyProviderConversion(raw) {
+  if (!isRecord4(raw) || "credential" in raw) {
+    return void 0;
+  }
+  const env = isRecord4(raw.env) ? raw.env : void 0;
+  const legacyEnvKeys = env === void 0 ? [] : Object.keys(env).filter((key) => LEGACY_ENV_CREDENTIAL_KEYS.includes(key));
+  const fields = [...LEGACY_PROVIDER_FIELDS.filter((field) => field in raw), ...legacyEnvKeys.map((key) => `env.${key}`)];
+  if (fields.length === 0) {
+    return void 0;
+  }
+  const sources = [];
+  if (typeof raw.tokenEnv === "string") {
+    sources.push({ env: raw.tokenEnv });
+  }
+  if (Array.isArray(raw.tokenCommand)) {
+    sources.push({ command: raw.tokenCommand });
+  }
+  if (typeof env?.ANTHROPIC_AUTH_TOKEN === "string" && env.ANTHROPIC_AUTH_TOKEN !== "") {
+    sources.push({ literal: LEGACY_LITERAL_PLACEHOLDER });
+  }
+  const remainingEnv = env === void 0 ? void 0 : Object.fromEntries(Object.entries(env).filter(([key]) => !LEGACY_ENV_CREDENTIAL_KEYS.includes(key)));
+  const replacedKeys = [...LEGACY_PROVIDER_FIELDS, "env"];
+  const rest = Object.fromEntries(Object.entries(raw).filter(([key]) => !replacedKeys.includes(key)));
   return {
-    schemaVersion: USAGE_SCHEMA_VERSION,
-    at: new Date(event.receivedAt).toISOString(),
-    ...identity === void 0 ? {} : { identity },
-    provider,
-    ...sessionId === void 0 ? {} : { sessionId },
-    ...event.clientSessionId === void 0 ? {} : { clientSessionId: event.clientSessionId },
-    ...projectId === void 0 ? {} : { project: projectId },
-    viaHeadroom: event.viaHeadroom,
-    route: event.route,
-    method: event.method,
-    endpoint,
-    ...scan?.model === void 0 ? {} : { model: scan.model },
-    ...choice === void 0 ? {} : { requestedModel: choice.requested },
-    ...choice !== void 0 && choice.providers.length > 1 ? { candidateProviders: [...choice.providers] } : {},
-    status: event.status,
-    latencyMs: Math.max(0, Math.round(context.headAt - event.receivedAt)),
-    durationMs: Math.max(0, Math.round(context.endedAt - event.receivedAt)),
-    outcome: context.outcome,
-    ...scan?.usage === void 0 ? {} : { usage: scan.usage },
-    ...rateLimitHeaders === void 0 ? {} : { rateLimitHeaders },
-    ...limit === void 0 ? {} : { limit },
-    ...requestId === void 0 ? {} : { requestId }
-  };
-}
-function createUsageMiddleware(deps) {
-  return (event) => {
-    if (DOOR_ANSWERED_ROUTES.has(event.route)) {
-      return void 0;
-    }
-    const headAt = deps.now();
-    const scanner = scannerFor(event.headers);
-    const decoder = scanner === void 0 ? null : decoderFor(headerValue(event.headers, "content-encoding"));
-    let scanning = scanner !== void 0 && decoder !== void 0;
-    const text5 = new TextDecoder();
-    const feed = (bytes, final) => {
-      if (!scanning || scanner === void 0) {
-        return;
-      }
-      try {
-        scanner.push(text5.decode(bytes, { stream: !final }));
-      } catch (error63) {
-        scanning = false;
-        deps.log(`usage: body scan failed for ${event.route}: ${error63 instanceof Error ? error63.message : String(error63)}`);
-      }
-    };
-    const finish = (outcome) => {
-      const endedAt = deps.now();
-      deps.defer(() => {
-        try {
-          deps.record(buildRecord(event, { headAt, endedAt, outcome, scan: scanning && scanner !== void 0 ? scanner.result() : void 0 }), event);
-        } catch (error63) {
-          deps.log(`usage: could not record ${event.method} ${event.path} (${String(event.status)}): ${error63 instanceof Error ? error63.message : String(error63)}`);
-        }
-      });
-    };
-    if (decoder === null || decoder === void 0) {
-      return {
-        chunk: (bytes) => {
-          feed(bytes, false);
-        },
-        end: (outcome) => {
-          feed(new Uint8Array(), true);
-          finish(outcome);
-        }
-      };
+    fields,
+    replacement: {
+      ...rest,
+      credential: { sources, ...raw.authScheme === "apiKey" ? { target: "apiKey" } : {} },
+      ...remainingEnv === void 0 || Object.keys(remainingEnv).length === 0 ? {} : { env: remainingEnv }
     }
-    let ended;
-    let settled = false;
-    const settle2 = () => {
-      if (settled || ended === void 0) {
-        return;
-      }
-      settled = true;
-      feed(new Uint8Array(), true);
-      finish(ended);
-    };
-    decoder.on("data", (bytes) => {
-      feed(bytes, false);
-    });
-    decoder.on("error", (error63) => {
-      scanning = false;
-      deps.log(`usage: could not decompress the body of ${event.route}: ${error63.message}`);
-      settle2();
-    });
-    decoder.on("end", settle2);
-    return {
-      chunk: (bytes) => {
-        if (scanning) {
-          decoder.write(bytes);
-        }
-      },
-      end: (outcome) => {
-        ended = outcome;
-        if (!scanning || outcome === "aborted") {
-          decoder.destroy();
-          settle2();
-          return;
-        }
-        decoder.end();
-      }
-    };
   };
 }
-var zlib, ANTHROPIC_PROVIDER, DOOR_ANSWERED_ROUTES;
-var init_middleware = __esm({
-  "src/usage/middleware.ts"() {
-    "use strict";
-    zlib = __toESM(require("node:zlib"), 1);
-    init_route();
-    init_rateLimit();
-    init_scan();
-    init_schema2();
-    ANTHROPIC_PROVIDER = "anthropic";
-    DOOR_ANSWERED_ROUTES = /* @__PURE__ */ new Set(["(unauthorized)", "(unrouted)"]);
+function parseProviderFile(filePath, raw) {
+  const conversion = legacyProviderConversion(raw);
+  if (conversion !== void 0) {
+    throw new LegacyProviderFileError(filePath, conversion);
   }
-});
-
-// src/usage/quotaFacts.ts
-function windowFacts(window, nowMs) {
-  if (window?.utilization === void 0 || window.resetsAt === void 0) {
+  const parsed = parseIgnoringUnrecognisedKeys(ProviderSchema, raw);
+  if (!parsed.success) {
+    throw new ConfigValidationError(filePath, parsed.issues);
+  }
+  noteIgnoredKeys(filePath, parsed.ignored);
+  return parsed.data;
+}
+function readProvider(paths, name) {
+  const filePath = providerJsonPath(paths, name);
+  if (!import_node_fs10.default.existsSync(filePath)) {
     return void 0;
   }
-  return { remaining: Math.max(0, 1 - window.utilization), utilization: window.utilization, hoursUntilReset: Math.max(0, (Date.parse(window.resetsAt) - nowMs) / MS_PER_HOUR) };
+  const raw = JSON.parse(import_node_fs10.default.readFileSync(filePath, "utf8"));
+  return parseProviderFile(filePath, raw);
 }
-function quotaFactsOf(unified, nowMs) {
-  const fiveHour = windowFacts(unified?.fiveHour, nowMs);
-  const sevenDay = windowFacts(unified?.sevenDay, nowMs);
-  const extraUsage = windowFacts(unified === void 0 ? void 0 : soleOverageWindow(unified), nowMs);
-  return { ...fiveHour === void 0 ? {} : { fiveHour }, ...sevenDay === void 0 ? {} : { sevenDay }, ...extraUsage === void 0 ? {} : { extraUsage } };
+function loadProvider(providersDir, name, port) {
+  const filePath = providerFilePath(providersDir, name);
+  const raw = port.readConfigFile(filePath);
+  return raw === void 0 ? void 0 : parseProviderFile(filePath, raw);
 }
-var MS_PER_HOUR;
-var init_quotaFacts = __esm({
-  "src/usage/quotaFacts.ts"() {
-    "use strict";
-    init_rateLimit();
-    MS_PER_HOUR = 36e5;
-  }
-});
-
-// src/usage/pick.ts
-function unifiedOf(state) {
-  return state?.rateLimit?.unified;
+function reportInvalidProvider(name, message) {
+  console.error(`agent-shim: providers/${name}.json is invalid and was skipped: ${message}`);
 }
-function limitBlockedUntil(state, nowMs) {
-  const limit = state?.lastLimit;
-  if (state === void 0 || limit === void 0) {
-    return void 0;
-  }
-  if (state.lastRequestAt !== void 0 && Date.parse(state.lastRequestAt) > Date.parse(limit.observedAt)) {
-    return void 0;
+function listProviders(paths, onInvalid = reportInvalidProvider) {
+  const names = listProviderNames(
+    (dir) => import_node_fs10.default.readdirSync(dir),
+    paths.providersDir
+  );
+  const result = [];
+  for (const name of names) {
+    let provider;
+    try {
+      provider = readProvider(paths, name);
+    } catch (error63) {
+      if (!(error63 instanceof ConfigValidationError || error63 instanceof LegacyProviderFileError || error63 instanceof UnsafeNameError)) {
+        throw error63;
+      }
+      onInvalid(name, error63.message);
+      continue;
+    }
+    if (provider !== void 0) {
+      result.push({ name, provider });
+    }
   }
-  const until = limit.resetAt === void 0 ? limit.retryAfterSeconds === void 0 ? void 0 : Date.parse(limit.observedAt) + limit.retryAfterSeconds * MS_PER_SECOND5 : Date.parse(limit.resetAt);
-  return until !== void 0 && until > nowMs ? until : void 0;
+  return result;
 }
-function windowBlockedUntil(windows) {
-  const resets = windows.flatMap((window) => window.status === "rejected" && window.resetsAtMs !== void 0 ? [window.resetsAtMs] : []);
-  return resets.length === 0 ? void 0 : Math.max(...resets);
+function listProviderNames(readdir, providersDir) {
+  let entries;
+  try {
+    entries = readdir(providersDir);
+  } catch {
+    return [];
+  }
+  return entries.filter((entry) => entry.endsWith(".json")).map((entry) => entry.slice(0, -".json".length)).sort();
 }
-function windowBurn(records, which) {
-  const points = [];
-  for (const record2 of records) {
-    const window = record2.rateLimitHeaders === void 0 ? void 0 : parseUnifiedRateLimit(record2.rateLimitHeaders)?.[which];
-    if (window?.utilization !== void 0 && window.resetsAt !== void 0) {
-      points.push({ resetsAt: window.resetsAt, point: { atMs: Date.parse(record2.at), utilization: window.utilization } });
-    }
+function describeProviderEndpoint(provider) {
+  if (isCodexProvider(provider)) {
+    return "codex translation daemon";
   }
-  const latest = points.at(-1)?.resetsAt;
-  const current = points.filter((entry) => entry.resetsAt === latest).map((entry) => entry.point);
-  const first = current.at(0);
-  const last = current.at(-1);
-  if (first === void 0 || last === void 0 || last.atMs <= first.atMs || last.utilization <= first.utilization) {
-    return void 0;
+  if (isAntigravityProvider(provider)) {
+    return (provider.antigravity?.mode ?? ANTIGRAVITY_DEFAULT_MODE) === "local" ? "antigravity local (ACP daemon)" : "antigravity cloud (Gemini API)";
   }
-  return (last.utilization - first.utilization) / (last.atMs - first.atMs);
+  return isRouterProvider(provider) ? "the models block" : provider.baseUrl;
 }
-function billedTokensOf(record2) {
-  const usage = record2.usage;
-  return (usage?.inputTokens ?? 0) + (usage?.cacheCreationInputTokens ?? 0) + (usage?.outputTokens ?? 0);
+function isEmptyCodexConfig(config2) {
+  return config2 === void 0 || config2.defaultModel === void 0 && config2.effort === void 0 && config2.login === void 0 && (config2.models === void 0 || Object.keys(config2.models).length === 0);
 }
-function utilisationPerBilledToken(records) {
-  const points = [];
-  for (const record2 of records) {
-    const window = record2.rateLimitHeaders === void 0 ? void 0 : parseUnifiedRateLimit(record2.rateLimitHeaders)?.fiveHour;
-    if (window?.utilization !== void 0 && window.resetsAt !== void 0) {
-      points.push({ resetsAt: window.resetsAt, utilization: window.utilization, billed: billedTokensOf(record2) });
-    }
+function isEmptyAntigravityConfig(config2) {
+  return config2 === void 0 || config2.mode === void 0 && config2.defaultModel === void 0 && config2.effort === void 0 && config2.degradeDownTiers === void 0 && config2.cloud === void 0 && config2.local === void 0 && (config2.models === void 0 || Object.keys(config2.models).length === 0);
+}
+function addProvider(paths, name, input2) {
+  if (providerExists(paths, name)) {
+    throw new ProviderAlreadyExistsError(name);
   }
-  const latest = points.at(-1)?.resetsAt;
-  const current = points.filter((point) => point.resetsAt === latest);
-  const first = current.at(0);
-  const last = current.at(-1);
-  if (first === void 0 || last === void 0 || last.utilization <= first.utilization) {
-    return void 0;
+  requireNewProviderName(name);
+  const kind = input2.kind ?? "http";
+  if (kind === "codex" && input2.baseUrl !== void 0) {
+    throw new ProviderKindMismatchError("A codex provider has no base URL: the launcher points its sessions at the front-door daemon. Drop --base-url.");
   }
-  const billed = current.slice(1).reduce((sum2, point) => sum2 + point.billed, 0);
-  return billed > 0 ? (last.utilization - first.utilization) / billed : void 0;
-}
-function windowRatio(records) {
-  const points = [];
-  for (const record2 of records) {
-    const unified = record2.rateLimitHeaders === void 0 ? void 0 : parseUnifiedRateLimit(record2.rateLimitHeaders);
-    const five = unified?.fiveHour;
-    const seven = unified?.sevenDay;
-    if (five?.utilization !== void 0 && five.resetsAt !== void 0 && seven?.utilization !== void 0 && seven.resetsAt !== void 0) {
-      points.push({ fiveResetsAt: five.resetsAt, sevenResetsAt: seven.resetsAt, five: five.utilization, seven: seven.utilization });
-    }
+  if (kind === "antigravity" && input2.baseUrl !== void 0) {
+    throw new ProviderKindMismatchError("An antigravity provider has no base URL: the launcher points its sessions at the front-door daemon. Drop --base-url.");
   }
-  const latest = points.at(-1);
-  const current = points.filter((point) => point.fiveResetsAt === latest?.fiveResetsAt && point.sevenResetsAt === latest.sevenResetsAt);
-  const first = current.at(0);
-  const last = current.at(-1);
-  if (first === void 0 || last === void 0 || last.five <= first.five || last.seven <= first.seven) {
-    return void 0;
+  if (kind === "router" && input2.baseUrl !== void 0) {
+    throw new ProviderKindMismatchError("A router provider has no base URL: it resolves each request's model name through the models block. Drop --base-url.");
   }
-  return (last.seven - first.seven) / (last.five - first.five);
-}
-function percent(fraction) {
-  return `${String(Math.round(fraction * PERCENT))}%`;
+  if (kind === "http" && input2.baseUrl === void 0) {
+    throw new ProviderKindMismatchError("An http provider needs --base-url.");
+  }
+  if (kind === "router" && (input2.sources.length > 0 || input2.target !== void 0 || input2.env !== void 0 || input2.pickerModels !== void 0)) {
+    throw new ProviderKindMismatchError("A router provider has no credential, env or picker models of its own: the models block's targets carry their own.");
+  }
+  if (kind !== "http" && kind !== "router" && input2.catalogue !== void 0) {
+    throw new ProviderKindMismatchError("A model catalogue applies only to an http provider.");
+  }
+  if (kind !== "codex" && !isEmptyCodexConfig(input2.codex)) {
+    throw new ProviderKindMismatchError("Codex settings apply only to a codex provider (--kind codex).");
+  }
+  if (kind !== "antigravity" && !isEmptyAntigravityConfig(input2.antigravity)) {
+    throw new ProviderKindMismatchError("Antigravity settings apply only to an antigravity provider (--kind antigravity).");
+  }
+  const shared = {
+    displayName: input2.displayName,
+    credential: { sources: input2.sources, ...input2.target === void 0 ? {} : { target: input2.target } },
+    ...input2.env === void 0 || Object.keys(input2.env).length === 0 ? {} : { env: input2.env },
+    ...input2.pickerModels === void 0 || input2.pickerModels.length === 0 ? {} : { pickerModels: input2.pickerModels }
+  };
+  const parsed = ProviderSchema.safeParse(
+    kind === "router" ? { kind, displayName: input2.displayName } : kind === "codex" ? { kind, ...shared, ...isEmptyCodexConfig(input2.codex) ? {} : { codex: input2.codex } } : kind === "antigravity" ? { kind, ...shared, ...isEmptyAntigravityConfig(input2.antigravity) ? {} : { antigravity: input2.antigravity } } : { ...shared, baseUrl: input2.baseUrl, ...input2.catalogue === void 0 ? {} : { catalogue: input2.catalogue } }
+  );
+  if (!parsed.success) {
+    throw new ConfigValidationError(providerJsonPath(paths, name), parsed.error.issues);
+  }
+  writeJsonAtomic(providerJsonPath(paths, name), parsed.data);
+  return parsed.data;
 }
-function describeWindow(label2, window, effective, nowMs) {
-  if (effective.reset) {
-    return `${label2} window has reset`;
+function updateProvider(paths, name, input2) {
+  const existing = readProvider(paths, name);
+  if (existing === void 0) {
+    throw new ProviderNotFoundError(name);
   }
-  const used = effective.utilization === void 0 ? "usage unknown" : `${percent(effective.utilization)} used`;
-  const resets = effective.resetsAtMs === void 0 ? "" : `, resets in ${formatAge(effective.resetsAtMs - nowMs)}`;
-  return `${label2} ${used}${resets}${window.status === "allowed_warning" ? " (nearly used)" : ""}`;
+  const unset = new Set(input2.unsetEnv);
+  const existingEnv = isRouterProvider(existing) ? {} : existing.env;
+  const env = Object.fromEntries(Object.entries({ ...existingEnv, ...input2.env }).filter(([key]) => !unset.has(key)));
+  const unsetPicker = new Set(input2.unsetPickerModels);
+  const added = new Map((input2.pickerModels ?? []).map((entry) => [entry.model, entry]));
+  const existingPicker = isRouterProvider(existing) ? [] : existing.pickerModels;
+  const pickerModels = [
+    ...(existingPicker ?? []).filter((entry) => !unsetPicker.has(entry.model)).map((entry) => added.get(entry.model) ?? entry),
+    ...[...added.values()].filter((entry) => !(existingPicker ?? []).some((kept) => kept.model === entry.model))
+  ];
+  const router = isRouterProvider(existing);
+  const target = router ? void 0 : input2.target ?? existing.credential.target;
+  const cache = router ? void 0 : input2.cache === void 0 ? existing.credential.cache : input2.cache === false ? void 0 : input2.cache;
+  if (isCodexProvider(existing) && input2.baseUrl !== void 0) {
+    throw new ProviderKindMismatchError(`Provider "${name}" is a codex provider, which has no base URL.`);
+  }
+  if (isAntigravityProvider(existing) && input2.baseUrl !== void 0) {
+    throw new ProviderKindMismatchError(`Provider "${name}" is an antigravity provider, which has no base URL.`);
+  }
+  if ((isCodexProvider(existing) || isAntigravityProvider(existing)) && input2.catalogue !== void 0 && input2.catalogue !== false) {
+    throw new ProviderKindMismatchError(`Provider "${name}" is not an http provider; a model catalogue applies only to an http provider.`);
+  }
+  if (!isCodexProvider(existing) && !isEmptyCodexConfig(input2.codex)) {
+    throw new ProviderKindMismatchError(`Provider "${name}" is not a codex provider; codex settings apply only to a codex provider.`);
+  }
+  if (!isAntigravityProvider(existing) && !isEmptyAntigravityConfig(input2.antigravity)) {
+    throw new ProviderKindMismatchError(`Provider "${name}" is not an antigravity provider; antigravity settings apply only to an antigravity provider.`);
+  }
+  const shared = {
+    ...input2.displayName === void 0 ? {} : { displayName: input2.displayName },
+    ...router ? {} : {
+      credential: {
+        sources: input2.sources ?? existing.credential.sources,
+        ...target === void 0 ? {} : { target },
+        ...cache === void 0 ? {} : { cache }
+      }
+    },
+    env: Object.keys(env).length === 0 ? void 0 : env,
+    pickerModels: pickerModels.length === 0 ? void 0 : pickerModels
+  };
+  let candidate;
+  if (isCodexProvider(existing)) {
+    const codex = {
+      ...existing.codex,
+      ...input2.codex,
+      ...existing.codex?.models === void 0 && input2.codex?.models === void 0 ? {} : { models: { ...existing.codex?.models, ...input2.codex?.models } }
+    };
+    candidate = { ...existing, ...shared, codex: isEmptyCodexConfig(codex) ? void 0 : codex };
+  } else if (isAntigravityProvider(existing)) {
+    const antigravity = {
+      ...existing.antigravity,
+      ...input2.antigravity,
+      ...existing.antigravity?.models === void 0 && input2.antigravity?.models === void 0 ? {} : { models: { ...existing.antigravity?.models, ...input2.antigravity?.models } }
+    };
+    candidate = { ...existing, ...shared, antigravity: isEmptyAntigravityConfig(antigravity) ? void 0 : antigravity };
+  } else if (router) {
+    candidate = { kind: "router", ...shared };
+  } else {
+    const catalogue = input2.catalogue === void 0 ? existing.catalogue : input2.catalogue === false ? void 0 : input2.catalogue;
+    candidate = { ...existing, ...shared, catalogue, ...input2.baseUrl === void 0 ? {} : { baseUrl: input2.baseUrl } };
+  }
+  const parsed = ProviderSchema.safeParse(candidate);
+  if (!parsed.success) {
+    throw new ConfigValidationError(providerJsonPath(paths, name), parsed.error.issues);
+  }
+  writeJsonAtomic(providerJsonPath(paths, name), parsed.data);
+  return parsed.data;
 }
-function capacityOf(plan) {
-  return plan.kind === "subscription" ? plan.capacity : 1;
+function removeProvider(paths, name) {
+  if (!providerExists(paths, name)) {
+    throw new ProviderNotFoundError(name);
+  }
+  import_node_fs10.default.rmSync(providerJsonPath(paths, name));
 }
-function assessRefusedNested(member, nested, nowMs) {
-  const refusal2 = nested.earliestReturn === void 0 ? { reason: `no member of pool "${nested.pool}" can be picked` } : { reason: `every member of pool "${nested.pool}" is refused; ${nested.earliestReturn.identity} returns at ${new Date(nested.earliestReturn.atMs).toISOString()} (in ${formatAge(nested.earliestReturn.atMs - nowMs)})`, blockedUntilMs: nested.earliestReturn.atMs };
-  return {
-    candidate: {
-      identity: member.identity,
-      class: "ineligible",
-      ...refusal2.blockedUntilMs === void 0 ? {} : { blockedUntilMs: refusal2.blockedUntilMs },
-      plan: planOf(member.account),
-      reasons: [refusal2.reason]
+function cascadeProviderName(cascade, identityProvider) {
+  let name;
+  for (const layer of assembleCascade(cascade).layers) {
+    if (layer.launch?.provider !== void 0) {
+      name = layer.launch.provider;
     }
-  };
+  }
+  return name ?? identityProvider;
 }
-function assess(member, nowMs) {
-  const nested = member.nested;
-  if (nested === void 0) {
-    return assessIdentity(member, nowMs);
+function selectProvider(params) {
+  const cliName = params.cliProvider !== void 0 && params.cliProvider !== "" ? params.cliProvider : void 0;
+  const named = cliName ?? (params.cascade === void 0 ? params.identityProvider : cascadeProviderName(params.cascade, params.identityProvider));
+  if (named === void 0) {
+    return void 0;
   }
-  if (nested.kind === "refused") {
-    return assessRefusedNested(member, nested, nowMs);
+  const name = canonicalProviderName(named, (candidate) => loadProvider(params.paths.providersDir, candidate, params.port) !== void 0, () => loadProviderAliases(params.paths.providerAliasesFile, params.port));
+  const definition = loadProvider(params.paths.providersDir, name, params.port);
+  if (definition === void 0) {
+    const known = listProviderNames(params.port.readdir, params.paths.providersDir);
+    return {
+      ok: false,
+      status: 1,
+      message: `agent-shim: no provider named "${name}". ` + (known.length > 0 ? `Known providers: ${known.join(", ")}.` : "No providers are defined yet; run `agent-shim provider add`.")
+    };
   }
-  const assessment = assessIdentity(member, nowMs);
-  return { ...assessment, candidate: { ...assessment.candidate, reasons: [`picked by pool "${nested.pool}"`, ...nested.reasons] } };
+  return { ok: true, provider: { name, definition } };
 }
-function assessIdentity(member, nowMs) {
-  const plan = planOf(member.account);
-  const planReasons = plan.kind === "pay-per-use" ? ["billed by use (no plan allowance)"] : plan.recognised ? [`${String(plan.capacity)}x plan`] : [`plan tier ${plan.tier === void 0 ? "not known" : `"${plan.tier}" not recognised`}, counted as 1x`];
-  const base = { identity: member.identity, plan };
-  if (member.readError !== void 0) {
-    return { candidate: { ...base, class: "unknown", reasons: [`usage state unreadable: ${member.readError}`, ...planReasons] } };
-  }
-  const state = member.snapshot?.providers[ANTHROPIC_PROVIDER];
-  const unified = unifiedOf(state);
-  if (member.snapshot === void 0 || state === void 0 || unified === void 0) {
-    return { candidate: { ...base, class: "unknown", reasons: ["no usage recorded yet, so its quota is unknown (turn on trackUsage for it)", ...planReasons] } };
+function resolveProvider(params) {
+  const selection = selectProvider(params);
+  if (selection?.ok !== true) {
+    return selection;
   }
-  const observedAgo = state.rateLimit === void 0 ? "" : ` (last seen ${formatAge(nowMs - Date.parse(state.rateLimit.observedAt))} ago)`;
-  const fiveHourWindow = unified.fiveHour;
-  const sevenDayWindow = unified.sevenDay;
-  const five = fiveHourWindow === void 0 ? void 0 : effectiveWindow(fiveHourWindow, nowMs);
-  const seven = sevenDayWindow === void 0 ? void 0 : effectiveWindow(sevenDayWindow, nowMs);
-  const windowReasons = [
-    ...fiveHourWindow === void 0 || five === void 0 ? [] : [describeWindow("5h", fiveHourWindow, five, nowMs)],
-    ...sevenDayWindow === void 0 || seven === void 0 ? [] : [describeWindow("7d", sevenDayWindow, seven, nowMs)]
-  ];
-  const overageWindow = soleOverageWindow(unified);
-  const overage = overageWindow === void 0 ? void 0 : effectiveWindow(overageWindow, nowMs);
-  const overageReasons = overageWindow === void 0 || overage === void 0 ? [] : [describeWindow("extra usage", overageWindow, overage, nowMs)];
-  const blockedUntil = Math.max(
-    windowBlockedUntil([five, seven, overage].flatMap((window) => window === void 0 ? [] : [window])) ?? 0,
-    limitBlockedUntil(state, nowMs) ?? 0
-  );
-  if (blockedUntil > nowMs) {
-    if (unified.overageStatus === "allowed") {
-      return { candidate: { ...base, class: "pay-per-use", planReturnsAtMs: blockedUntil, reasons: [`plan exhausted until ${new Date(blockedUntil).toISOString()} (in ${formatAge(blockedUntil - nowMs)}), continues as extra usage`, ...windowReasons, ...planReasons] } };
-    }
-    return { candidate: { ...base, class: "ineligible", blockedUntilMs: blockedUntil, reasons: [`refused until ${new Date(blockedUntil).toISOString()} (in ${formatAge(blockedUntil - nowMs)})`, ...unified.fallbackAvailable === true ? ["a fallback is on offer, so requests for some models may still be served"] : [], ...windowReasons, ...overageReasons, ...planReasons] } };
+  const { name, definition } = selection.provider;
+  if (isRouterProvider(definition)) {
+    return { ok: true, provider: { name, definition, credential: { target: "bearer", token: "", source: { env: "AGENT_SHIM_ROUTER" }, warnings: [] } }, warnings: [] };
   }
-  if (plan.kind === "pay-per-use" || fiveHourWindow === void 0 && sevenDayWindow === void 0) {
-    const headroom = overage?.utilization === void 0 ? void 0 : Math.max(0, 1 - overage.utilization);
-    return { candidate: { ...base, class: "pay-per-use", ...headroom === void 0 ? {} : { headroom }, reasons: [...plan.kind === "pay-per-use" ? planReasons : ["no plan windows reported, so usage bills as extra usage"], ...overageReasons] } };
+  if (params.credentials === void 0) {
+    return { ok: false, status: 1, message: `agent-shim: provider ${name} needs its credential resolved, but this launcher has no credential port wired` };
   }
-  const basis = seven?.utilization !== void 0 ? { window: seven, windowMs: SEVEN_DAY_WINDOW_MS, name: "sevenDay" } : five?.utilization !== void 0 ? { window: five, windowMs: FIVE_HOUR_WINDOW_MS, name: "fiveHour" } : void 0;
-  if (basis?.window.utilization === void 0) {
-    return { candidate: { ...base, class: "unknown", reasons: ["quota windows reported no utilisation", ...windowReasons, ...planReasons] } };
+  const resolution = resolveCredential({ credential: definition.credential, env: params.env, port: params.credentials, subject: `provider ${name}` });
+  if (!resolution.ok) {
+    return { ok: false, status: CREDENTIAL_UNAVAILABLE_EXIT, message: resolution.message };
   }
-  const remaining = Math.max(0, 1 - basis.window.utilization);
-  const untilResetMs = basis.window.resetsAtMs === void 0 ? basis.windowMs : Math.max(basis.window.resetsAtMs - nowMs, MS_PER_SECOND5);
-  const weeklyScore = remaining * plan.capacity / (untilResetMs / MS_PER_HOUR2);
-  const fiveRemaining = five?.utilization === void 0 ? void 0 : Math.max(0, 1 - five.utilization);
-  const fiveUntil = five?.resetsAtMs === void 0 ? FIVE_HOUR_WINDOW_MS : Math.max(five.resetsAtMs - nowMs, MS_PER_SECOND5);
-  const ratio = windowRatio(member.records);
-  const fiveHourScore = basis.name === "sevenDay" && fiveRemaining !== void 0 && ratio !== void 0 ? Math.min(fiveRemaining * ratio, remaining) * plan.capacity / (fiveUntil / MS_PER_HOUR2) : void 0;
-  const fiveHourLeads = fiveHourScore !== void 0 && fiveHourScore > weeklyScore;
-  const score = fiveHourLeads ? fiveHourScore : weeklyScore;
-  const scoreWindow = fiveHourLeads ? "fiveHour" : basis.name;
-  const fiveHourTermReasons = basis.name !== "sevenDay" || fiveRemaining === void 0 ? [] : ratio === void 0 ? ["5h reset not scored: no measured 5h to 7d ratio yet"] : fiveHourLeads ? [`5h term leads: ${percent(fiveRemaining)} of 5h unused is about ${percent(Math.min(fiveRemaining * ratio, remaining))} of the week at the measured ratio, resets in ${formatAge(fiveUntil)}`] : [];
-  const burn = windowBurn(member.records, "fiveHour");
-  const sevenRemaining = seven?.utilization === void 0 ? void 0 : Math.max(0, 1 - seven.utilization);
-  const sevenUntil = seven?.resetsAtMs === void 0 ? SEVEN_DAY_WINDOW_MS : Math.max(seven.resetsAtMs - nowMs, MS_PER_SECOND5);
-  const sevenDayBurn = windowBurn(member.records, "sevenDay");
-  return {
-    candidate: { ...base, class: "scored", score, scoreWindow, reasons: [...fiveHourTermReasons, ...windowReasons.map((reason, index) => index === windowReasons.length - 1 ? `${reason}${observedAgo}` : reason), ...planReasons] },
-    ...fiveRemaining === void 0 ? {} : { fiveHour: { remaining: fiveRemaining, untilResetMs: fiveUntil } },
-    ...burn === void 0 ? {} : { burn },
-    ...sevenRemaining === void 0 ? {} : { sevenDay: { remaining: sevenRemaining, untilResetMs: sevenUntil } },
-    ...sevenDayBurn === void 0 ? {} : { sevenDayBurn }
-  };
-}
-function poolFactsOf(member, nowMs, resuming, sticky) {
-  const { fiveHour, sevenDay, extraUsage } = quotaFactsOf(member.snapshot?.providers[ANTHROPIC_PROVIDER]?.rateLimit?.unified, nowMs);
-  const burn = windowBurn(member.records, "fiveHour");
-  return {
-    ...fiveHour === void 0 ? {} : { fiveHour },
-    ...sevenDay === void 0 ? {} : { sevenDay },
-    ...extraUsage === void 0 ? {} : { extraUsage },
-    ...burn === void 0 ? {} : { burnPerHour: burn * MS_PER_HOUR2 },
-    resuming,
-    ...sticky?.identity === member.identity ? { lastPickHoursAgo: Math.max(0, (nowMs - Date.parse(sticky.at)) / MS_PER_HOUR2) } : {}
-  };
+  return { ok: true, provider: { name, definition, credential: resolution.credential }, warnings: resolution.credential.warnings };
 }
-function rankPool(input2) {
-  const { members: members2, nowMs } = input2;
-  const assessments = members2.map((member) => ({ member, ...assess(member, nowMs) }));
-  const demands = assessments.flatMap(({ candidate, burn }) => burn === void 0 ? [] : [burn * capacityOf(candidate.plan)]);
-  const sharedDemand = demands.length === 0 ? void 0 : Math.max(...demands);
-  const guarded2 = assessments.map((assessment) => {
-    const { candidate } = assessment;
-    if (candidate.class === "ineligible" || assessment.member.policy === void 0) {
-      return assessment;
-    }
-    const context = { nowMs, env: {}, pool: poolFactsOf(assessment.member, nowMs, input2.resuming, input2.sticky) };
-    const verdict = evaluateWhen(assessment.member.policy, context);
-    if (verdict.status === "indeterminate") {
-      return { ...assessment, candidate: { ...candidate, policyDemoted: true, reasons: [`policy undecided (${verdict.checked.join(", ") === "predicate" ? "predicate" : verdict.checked.join(", ")}): ${verdict.reason}`, ...candidate.reasons] } };
-    }
-    if (verdict.passed) {
-      return assessment;
-    }
-    return { ...assessment, candidate: { ...candidate, class: "ineligible", reasons: [`skipped by policy (${verdict.checked.join(", ")}: did not hold)`, ...candidate.reasons] } };
-  });
-  const candidates = guarded2.map((assessment) => {
-    const { candidate, fiveHour, burn } = assessment;
-    const pace = burn ?? (sharedDemand === void 0 ? void 0 : sharedDemand / capacityOf(candidate.plan));
-    const { sevenDay, sevenDayBurn } = assessment;
-    if (candidate.class !== "scored") {
-      return { ...candidate, feasible: true };
-    }
-    const drySpots = [];
-    const dryAfterMs = [];
-    if (fiveHour !== void 0 && pace !== void 0) {
-      const runsDryInMs = fiveHour.remaining / pace;
-      if (runsDryInMs < fiveHour.untilResetMs) {
-        dryAfterMs.push(runsDryInMs);
-        drySpots.push(`5h window would run dry in ${formatAge(runsDryInMs)}, before it resets in ${formatAge(fiveHour.untilResetMs)}`);
-      }
-    }
-    if (sevenDay !== void 0 && sevenDayBurn !== void 0) {
-      const runsDryInMs = sevenDay.remaining / sevenDayBurn;
-      if (runsDryInMs < sevenDay.untilResetMs) {
-        dryAfterMs.push(runsDryInMs);
-        drySpots.push(`7d window would run dry in ${formatAge(runsDryInMs)}, before it resets in ${formatAge(sevenDay.untilResetMs)}`);
+function resolveRoutedProviderCredentials(params) {
+  const { models } = params;
+  if (models === void 0) {
+    return { ok: true, checked: [] };
+  }
+  const virtualNames = new Set(Object.keys(models.virtual ?? {}));
+  const providerNames = /* @__PURE__ */ new Set();
+  const families = () => buildFamilies(params.targets?.() ?? [], models);
+  const collect = (ref) => {
+    if (ref.startsWith(FAMILY_PREFIX)) {
+      for (const target of expandFamilyMembers([ref], families())) {
+        collect(target);
       }
+      return;
     }
-    const { sticky: sticky2 } = input2;
-    const warmHere = sticky2?.identity === candidate.identity && nowMs - Date.parse(sticky2.at) <= PROMPT_CACHE_TTL_MS;
-    if (input2.resuming && input2.resumeContextTokens !== void 0 && fiveHour !== void 0 && !warmHere) {
-      const perToken = utilisationPerBilledToken(assessment.member.records);
-      const committed = input2.committedContextTokens?.[candidate.identity] ?? 0;
-      const cost = perToken === void 0 ? void 0 : (input2.resumeContextTokens + committed) * perToken;
-      if (cost !== void 0 && cost > fiveHour.remaining) {
-        dryAfterMs.push(0);
-        const alongside = committed === 0 ? "" : ` (with ${String(committed)} tokens of other conversations already moving here)`;
-        drySpots.push(`resuming a ${String(input2.resumeContextTokens)}-token conversation here${alongside} would cost about ${percent(cost)} of the 5h window, which has ${percent(fiveHour.remaining)} left`);
-      }
+    if (ref.startsWith("acct:") || virtualNames.has(ref)) {
+      return;
     }
-    if (drySpots.length === 0) {
-      return { ...candidate, feasible: true };
+    const [provider] = ref.split("/", 1);
+    if (provider !== void 0 && provider !== "") {
+      providerNames.add(provider);
     }
-    return { ...candidate, feasible: false, runsDryAtMs: nowMs + Math.min(...dryAfterMs), reasons: [...drySpots, ...candidate.reasons] };
-  });
-  const ordered = input2.preference === "listed" ? [...candidates] : [...candidates].sort(
-    (left, right) => CLASS_ORDER[left.class] - CLASS_ORDER[right.class] || Number(left.policyDemoted ?? false) - Number(right.policyDemoted ?? false) || Number(right.feasible) - Number(left.feasible) || (right.headroom ?? 1) - (left.headroom ?? 1) || (right.score ?? 0) - (left.score ?? 0) || left.identity.localeCompare(right.identity)
-  );
-  const sticky = input2.sticky;
-  const stickyIndex = sticky === void 0 ? -1 : ordered.findIndex((candidate) => candidate.identity === sticky.identity);
-  const stickyCandidate = ordered[stickyIndex];
-  const keepSticky = stickyCandidate?.class === "scored" && stickyCandidate.feasible;
-  if (sticky !== void 0 && keepSticky) {
-    const ageMs = nowMs - Date.parse(sticky.at);
-    const warm = ageMs <= PROMPT_CACHE_TTL_MS;
-    if (input2.resuming || warm) {
-      const why = warm ? `used here ${formatAge(ageMs)} ago, prompt cache still warm` : "resuming a conversation started on this account";
-      ordered.splice(stickyIndex, 1);
-      ordered.unshift({ ...stickyCandidate, reasons: [why, ...stickyCandidate.reasons] });
+  };
+  for (const model of Object.values(models.virtual ?? {})) {
+    for (const member of model.members) {
+      collect(member);
     }
   }
-  const movedOff = sticky !== void 0 && input2.resuming && !keepSticky ? { identity: sticky.identity, reason: stickyCandidate?.reasons[0] ?? "no longer among the pool's members" } : void 0;
-  const pick2 = ordered.find((candidate) => candidate.class !== "ineligible");
-  const returns = ordered.flatMap((candidate) => candidate.blockedUntilMs === void 0 ? [] : [{ identity: candidate.identity, atMs: candidate.blockedUntilMs }]);
-  const earliestReturn = returns.length === 0 ? void 0 : returns.reduce((soonest, entry) => entry.atMs < soonest.atMs ? entry : soonest);
-  const holdForReturn = pick2?.runsDryAtMs === void 0 ? void 0 : returns.filter((entry) => entry.atMs < (pick2.runsDryAtMs ?? 0)).reduce((soonest, entry) => soonest === void 0 || entry.atMs < soonest.atMs ? entry : soonest, void 0);
-  return {
-    candidates: ordered,
-    ...pick2 === void 0 ? { ...earliestReturn === void 0 ? {} : { earliestReturn } } : { pick: pick2 },
-    ...movedOff === void 0 || pick2 === void 0 ? {} : { movedOff },
-    ...pick2?.planReturnsAtMs === void 0 ? {} : { planReturn: { identity: pick2.identity, atMs: pick2.planReturnsAtMs } },
-    ...holdForReturn === void 0 ? {} : { holdForReturn }
-  };
-}
-var MS_PER_SECOND5, MS_PER_HOUR2, HOURS_PER_DAY2, FIVE_HOURS, PROMPT_CACHE_TTL_HOURS, PERCENT, SEVEN_DAYS, FIVE_HOUR_WINDOW_MS, SEVEN_DAY_WINDOW_MS, PROMPT_CACHE_TTL_MS, CLASS_ORDER;
-var init_pick = __esm({
-  "src/usage/pick.ts"() {
-    "use strict";
-    init_conditions();
-    init_plan2();
-    init_middleware();
-    init_preflight();
-    init_quotaFacts();
-    init_rateLimit();
-    MS_PER_SECOND5 = 1e3;
-    MS_PER_HOUR2 = 36e5;
-    HOURS_PER_DAY2 = 24;
-    FIVE_HOURS = 5;
-    PROMPT_CACHE_TTL_HOURS = 1;
-    PERCENT = 100;
-    SEVEN_DAYS = 7;
-    FIVE_HOUR_WINDOW_MS = FIVE_HOURS * MS_PER_HOUR2;
-    SEVEN_DAY_WINDOW_MS = SEVEN_DAYS * HOURS_PER_DAY2 * MS_PER_HOUR2;
-    PROMPT_CACHE_TTL_MS = PROMPT_CACHE_TTL_HOURS * MS_PER_HOUR2;
-    CLASS_ORDER = { scored: 0, unknown: 1, "pay-per-use": 2, ineligible: 3 };
+  for (const ref of Object.values(models.tiers ?? {})) {
+    collect(ref);
   }
-});
-
-// src/usage/read.ts
-function segmentDay(epochMs) {
-  return new Date(epochMs).toISOString().slice(0, "YYYY-MM-DD".length);
-}
-function segmentName(day, pid) {
-  return `${day}.${String(pid)}.jsonl`;
-}
-function listLogSegments(fs31, logDir) {
-  return fs31.readdir(logDir).flatMap((name) => {
-    const match = SEGMENT_RE.exec(name);
-    const day = match?.[1];
-    if (day === void 0) {
-      return [];
-    }
-    return [{ name, day, endsAt: Date.parse(`${day}T00:00:00.000Z`) + DAY_MS }];
-  }).sort((left, right) => left.day.localeCompare(right.day) || left.name.localeCompare(right.name));
-}
-function readUsageLog(fs31, logDir, options = {}) {
-  const { sinceMs } = options;
-  const records = [];
-  let invalidLines = 0;
-  for (const segment of listLogSegments(fs31, logDir)) {
-    if (sinceMs !== void 0 && segment.endsAt <= sinceMs) {
+  if (providerNames.size === 0) {
+    return { ok: true, checked: [] };
+  }
+  if (params.credentials === void 0) {
+    return { ok: false, status: 1, message: `agent-shim: the models block routes to providers ${[...providerNames].sort().join(", ")}, which need their credentials resolved, but this launcher has no credential port wired` };
+  }
+  const failures = [];
+  let credentialFailure = false;
+  for (const name of [...providerNames].sort()) {
+    const definition = loadProvider(params.paths.providersDir, name, params.port);
+    if (definition === void 0) {
+      failures.push(`no provider named "${name}"`);
       continue;
     }
-    const read = readSegment(fs31, logDir, segment);
-    if (read === void 0) {
+    if (isRouterProvider(definition)) {
       continue;
     }
-    invalidLines += read.invalidLines;
-    for (const record2 of read.records) {
-      if (sinceMs === void 0 || Date.parse(record2.at) >= sinceMs) {
-        records.push(record2);
+    const resolution = resolveCredential({ credential: definition.credential, env: params.env, port: params.credentials, subject: `provider ${name}` });
+    if (!resolution.ok) {
+      failures.push(resolution.message.replace(/^agent-shim: /, ""));
+      credentialFailure = true;
+    }
+  }
+  if (failures.length > 0) {
+    return { ok: false, status: credentialFailure ? CREDENTIAL_UNAVAILABLE_EXIT : 1, message: `agent-shim: this launch routes model names through the models block, but: ${failures.join("; ")}` };
+  }
+  return { ok: true, checked: [...providerNames].sort() };
+}
+var import_node_fs10, ProviderNotFoundError, ProviderAlreadyExistsError, LEGACY_PROVIDER_FIELDS, LEGACY_ENV_CREDENTIAL_KEYS, LEGACY_LITERAL_PLACEHOLDER, LegacyProviderFileError, ProviderKindMismatchError;
+var init_providersStore = __esm({
+  "src/providersStore.ts"() {
+    "use strict";
+    import_node_fs10 = __toESM(require("node:fs"), 1);
+    init_load();
+    init_store();
+    init_unrecognisedKeys();
+    init_schema();
+    init_cliError();
+    init_providerAliases();
+    init_credential();
+    init_walk();
+    init_families();
+    init_names();
+    ProviderNotFoundError = class extends CliError {
+      constructor(name) {
+        super(`No provider named "${name}". Run \`agent-shim provider add ${name}\` first.`);
+        this.name = name;
+        this.name = "ProviderNotFoundError";
+      }
+      name;
+    };
+    ProviderAlreadyExistsError = class extends CliError {
+      constructor(providerName) {
+        super(`A provider named "${providerName}" already exists.`);
+        this.providerName = providerName;
+        this.name = "ProviderAlreadyExistsError";
+      }
+      providerName;
+    };
+    LEGACY_PROVIDER_FIELDS = ["tokenEnv", "tokenCommand", "authScheme"];
+    LEGACY_ENV_CREDENTIAL_KEYS = Object.values(CREDENTIAL_TARGET_VARS);
+    LEGACY_LITERAL_PLACEHOLDER = "<the value of env.ANTHROPIC_AUTH_TOKEN>";
+    LegacyProviderFileError = class extends CliError {
+      constructor(filePath, conversion) {
+        super(
+          `${filePath} uses ${conversion.fields.join(", ")}, which a credential block replaced. Rewrite it as:
+` + JSON.stringify(conversion.replacement, null, 2)
+        );
+        this.filePath = filePath;
+        this.conversion = conversion;
+        this.name = "LegacyProviderFileError";
       }
-    }
+      filePath;
+      conversion;
+    };
+    ProviderKindMismatchError = class extends UsageError {
+      constructor(message) {
+        super(message);
+        this.name = "ProviderKindMismatchError";
+      }
+    };
   }
-  records.sort((left, right) => left.at.localeCompare(right.at));
-  return { records, invalidLines };
+});
+
+// src/usage/account.ts
+function isObject2(value2) {
+  return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
-function readSegment(fs31, logDir, segment) {
-  const contents = fs31.readFileUtf8(import_node_path26.default.join(logDir, segment.name));
-  if (contents === void 0) {
-    return void 0;
-  }
-  const records = [];
-  let invalidLines = 0;
-  const lines = contents.split("\n");
-  lines.pop();
-  for (const line of lines) {
-    if (line === "") {
-      continue;
-    }
-    let raw;
-    try {
-      raw = JSON.parse(line);
-    } catch {
-      invalidLines += 1;
-      continue;
-    }
-    const parsed = UsageRecordSchema.safeParse(raw);
-    if (!parsed.success) {
-      invalidLines += 1;
-      continue;
-    }
-    records.push(parsed.data);
-  }
-  return { records, invalidLines };
+function isIdentityName(name) {
+  return IdentitySchema.shape.name.safeParse(name).success;
 }
-function readRecentUsageRecords(fs31, logDir, count2) {
-  const byDay = /* @__PURE__ */ new Map();
-  for (const segment of listLogSegments(fs31, logDir)) {
-    byDay.set(segment.day, [...byDay.get(segment.day) ?? [], segment]);
-  }
-  const days = [...byDay.values()];
-  let records = [];
-  for (let index = days.length - 1; index >= 0; index -= 1) {
-    const dayRecords = [];
-    for (const segment of days[index] ?? []) {
-      dayRecords.push(...readSegment(fs31, logDir, segment)?.records ?? []);
-    }
-    records = [...dayRecords, ...records];
-    records.sort((left, right) => left.at.localeCompare(right.at));
-    const olderDay = days[index - 1]?.[0];
-    const newestHeld = records[records.length - count2];
-    if (olderDay === void 0 || newestHeld !== void 0 && Date.parse(newestHeld.at) >= olderDay.endsAt) {
-      break;
-    }
-  }
-  return records.slice(-count2);
+function claudeJsonPath(identitiesDir, identity) {
+  return import_node_path24.default.join(identitiesDir, identity, CLAUDE_JSON);
 }
-function snapshotPath(snapshotsDir, identity) {
+function readAccountMetadata(fs31, identitiesDir, identity) {
   if (!isIdentityName(identity)) {
     throw new Error(`"${identity}" is not a valid identity name.`);
   }
-  return import_node_path26.default.join(snapshotsDir, `${identity}.json`);
+  return readAccountMetadataFile(fs31, claudeJsonPath(identitiesDir, identity));
 }
-function readUsageSnapshot(fs31, snapshotsDir, identity) {
-  const file2 = snapshotPath(snapshotsDir, identity);
+function readAccountMetadataFile(fs31, file2) {
   const raw = fs31.readFileUtf8(file2);
   if (raw === void 0) {
     return void 0;
@@ -38482,1225 +38129,1586 @@ function readUsageSnapshot(fs31, snapshotsDir, identity) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new UsageSnapshotError(file2, "not valid JSON");
+    throw new AccountMetadataError(file2, "not valid JSON");
   }
-  const snapshot = UsageSnapshotSchema.safeParse(parsed);
-  if (!snapshot.success) {
-    throw new UsageSnapshotError(file2, snapshot.error.issues.map((issue2) => `${issue2.path.join(".")}: ${issue2.message}`).join("; "));
+  if (!isObject2(parsed)) {
+    throw new AccountMetadataError(file2, "not a JSON object");
   }
-  return snapshot.data;
-}
-function listUsageSnapshots(fs31, snapshotsDir) {
-  return fs31.readdir(snapshotsDir).flatMap((name) => {
-    if (!name.endsWith(".json")) {
-      return [];
-    }
-    const identity = name.slice(0, -".json".length);
-    if (!isIdentityName(identity)) {
-      return [];
-    }
-    const snapshot = readUsageSnapshot(fs31, snapshotsDir, identity);
-    return snapshot === void 0 ? [] : [snapshot];
-  }).sort((left, right) => left.identity.localeCompare(right.identity));
-}
-function summariseUsage(records) {
-  const groups = /* @__PURE__ */ new Map();
-  for (const record2 of records) {
-    const key = `${record2.identity ?? ""}\0${record2.provider}`;
-    const group = groups.get(key);
-    if (group === void 0) {
-      groups.set(key, [record2]);
-    } else {
-      group.push(record2);
+  const oauthAccount = parsed.oauthAccount;
+  if (!isObject2(oauthAccount)) {
+    return void 0;
+  }
+  const picked = {};
+  for (const key of Object.keys(AccountMetadataSchema.shape)) {
+    const value2 = oauthAccount[key];
+    if (value2 !== null && value2 !== void 0) {
+      picked[key] = value2;
     }
   }
-  const summaries = [...groups.values()].flatMap((group) => {
-    const [first] = group;
-    const last = group.at(-1);
-    if (first === void 0 || last === void 0) {
-      return [];
+  const account = AccountMetadataSchema.safeParse(picked);
+  if (!account.success) {
+    throw new AccountMetadataError(file2, account.error.issues.map((issue2) => `${issue2.path.join(".")}: ${issue2.message}`).join("; "));
+  }
+  return account.data;
+}
+function createAccountReader(fs31, identitiesDir) {
+  const cache = /* @__PURE__ */ new Map();
+  return (identity) => {
+    if (!isIdentityName(identity)) {
+      throw new Error(`"${identity}" is not a valid identity name.`);
     }
-    const modelCounts = /* @__PURE__ */ new Map();
-    for (const record2 of group) {
-      if (record2.model !== void 0) {
-        modelCounts.set(record2.model, (modelCounts.get(record2.model) ?? 0) + 1);
-      }
+    const stat = fs31.lstat(claudeJsonPath(identitiesDir, identity));
+    const stamp = stat === void 0 ? "absent" : `${String(stat.mtimeMs)}:${String(stat.sizeBytes)}`;
+    const cached2 = cache.get(identity);
+    if (cached2?.stamp === stamp) {
+      return cached2.account;
     }
-    const sum2 = (field) => group.reduce((total, record2) => total + (record2.usage?.[field] ?? 0), 0);
-    return [
-      {
-        identity: first.identity,
-        provider: first.provider,
-        requests: group.length,
-        failed: group.filter((record2) => record2.status >= FIRST_ERROR_STATUS).length,
-        limits: {
-          "rate-limited": group.filter((record2) => record2.limit?.kind === "rate-limited").length,
-          "quota-exhausted": group.filter((record2) => record2.limit?.kind === "quota-exhausted").length
-        },
-        tokens: {
-          inputTokens: sum2("inputTokens"),
-          outputTokens: sum2("outputTokens"),
-          cacheCreationInputTokens: sum2("cacheCreationInputTokens"),
-          cacheReadInputTokens: sum2("cacheReadInputTokens")
-        },
-        firstAt: first.at,
-        lastAt: last.at,
-        models: [...modelCounts.entries()].sort((left, right) => right[1] - left[1] || left[0].localeCompare(right[0])).map(([model]) => model)
-      }
-    ];
-  });
-  return summaries.sort((left, right) => (left.identity ?? "").localeCompare(right.identity ?? "") || left.provider.localeCompare(right.provider));
+    const account = readAccountMetadata(fs31, identitiesDir, identity);
+    cache.set(identity, { stamp, account });
+    return account;
+  };
 }
-var import_node_path26, SEGMENT_RE, DAY_MS, UsageSnapshotError, FIRST_ERROR_STATUS;
-var init_read = __esm({
-  "src/usage/read.ts"() {
+var import_node_path24, CLAUDE_JSON, AccountMetadataError;
+var init_account = __esm({
+  "src/usage/account.ts"() {
     "use strict";
-    import_node_path26 = __toESM(require("node:path"), 1);
-    init_account();
+    import_node_path24 = __toESM(require("node:path"), 1);
+    init_cliError();
+    init_schema();
     init_schema2();
-    SEGMENT_RE = /^(\d{4}-\d{2}-\d{2})\.(\d+)\.jsonl$/;
-    DAY_MS = 864e5;
-    UsageSnapshotError = class extends Error {
+    CLAUDE_JSON = ".claude.json";
+    AccountMetadataError = class extends CliError {
       constructor(file2, detail) {
-        super(`${file2} is not a usage snapshot this agent-shim can read (schema version ${String(USAGE_SCHEMA_VERSION)}): ${detail}`);
+        super(`${file2}: ${detail}, so its account metadata cannot be read.`);
         this.file = file2;
-        this.name = "UsageSnapshotError";
+        this.name = "AccountMetadataError";
       }
       file;
     };
-    FIRST_ERROR_STATUS = 400;
   }
 });
 
-// src/usage/store.ts
-function pruneUsageLog(fs31, logDir, nowMs) {
-  const cutoff = nowMs - USAGE_RETENTION_MS;
-  for (const segment of listLogSegments(fs31, logDir)) {
-    if (segment.endsAt <= cutoff) {
-      fs31.removeRecursive(import_node_path27.default.join(logDir, segment.name));
-    }
-  }
-}
-function later(left, right) {
-  return left.localeCompare(right) >= 0 ? left : right;
-}
-function observedAt(record2) {
-  return new Date(Date.parse(record2.at) + record2.latencyMs).toISOString();
-}
-function foldProviderState(current, record2) {
-  const seen = observedAt(record2);
-  const newest = current?.lastRequestAt === void 0 || record2.at.localeCompare(current.lastRequestAt) >= 0;
-  const rateLimit = record2.rateLimitHeaders === void 0 || current?.rateLimit !== void 0 && current.rateLimit.observedAt.localeCompare(seen) > 0 ? current?.rateLimit : (() => {
-    const unified = parseUnifiedRateLimit(record2.rateLimitHeaders);
-    return { observedAt: seen, headers: record2.rateLimitHeaders, ...unified === void 0 ? {} : { unified } };
-  })();
-  const lastLimit = record2.limit === void 0 || current?.lastLimit !== void 0 && current.lastLimit.observedAt.localeCompare(seen) > 0 ? current?.lastLimit : { ...record2.limit, observedAt: seen, status: record2.status };
-  const lastModel = newest ? record2.model ?? current?.lastModel : current.lastModel ?? record2.model;
-  return {
-    lastRequestAt: current?.lastRequestAt === void 0 ? record2.at : later(current.lastRequestAt, record2.at),
-    ...newest ? { lastStatus: record2.status } : current.lastStatus === void 0 ? {} : { lastStatus: current.lastStatus },
-    ...lastModel === void 0 ? {} : { lastModel },
-    ...rateLimit === void 0 ? {} : { rateLimit },
-    ...lastLimit === void 0 ? {} : { lastLimit },
-    ...current?.quota === void 0 ? {} : { quota: current.quota }
-  };
-}
-function createUsageStore(deps) {
-  const { fs: fs31, paths } = deps;
-  let prunedDay;
-  const rewriteSnapshot = (identity, fold) => {
-    if (!isIdentityName(identity)) {
-      deps.log(`usage: no snapshot for identity "${identity}", which is not a valid identity name`);
-      return false;
-    }
-    let current;
-    try {
-      current = readUsageSnapshot(fs31, paths.usageSnapshotsDir, identity);
-    } catch (error63) {
-      if (!(error63 instanceof UsageSnapshotError)) {
-        throw error63;
-      }
-      deps.log(`usage: replacing an unreadable snapshot: ${error63.message}`);
-    }
-    const providers = fold(current);
-    if (providers === void 0) {
-      return false;
-    }
-    let account;
-    try {
-      account = deps.readAccount(identity);
-    } catch (error63) {
-      if (!(error63 instanceof AccountMetadataError)) {
-        throw error63;
-      }
-      deps.log(`usage: snapshot for ${identity} written without account metadata: ${error63.message}`);
-    }
-    const snapshot = UsageSnapshotSchema.parse({
-      schemaVersion: USAGE_SCHEMA_VERSION,
-      identity,
-      updatedAt: new Date(deps.now()).toISOString(),
-      ...account === void 0 ? {} : { account },
-      providers
-    });
-    fs31.mkdirPrivate(paths.usageSnapshotsDir);
-    fs31.writeFilePrivate(snapshotPath(paths.usageSnapshotsDir, identity), `${JSON.stringify(snapshot, null, 2)}
-`);
-    deps.publish?.(snapshot);
-    return true;
-  };
-  return {
-    record: (input2) => {
-      const record2 = UsageRecordSchema.parse(input2);
-      const nowMs = deps.now();
-      fs31.mkdirPrivate(paths.usageDir);
-      fs31.mkdirPrivate(paths.usageLogDir);
-      const day = segmentDay(nowMs);
-      if (prunedDay !== day) {
-        pruneUsageLog(fs31, paths.usageLogDir, nowMs);
-        prunedDay = day;
-      }
-      fs31.appendFilePrivate(import_node_path27.default.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record2)}
-`);
-      deps.onRecord?.(record2);
-      if (record2.identity !== void 0) {
-        rewriteSnapshot(record2.identity, (current) => ({ ...current?.providers, [record2.provider]: foldProviderState(current?.providers[record2.provider], record2) }));
-      }
-    },
-    recordQuota: (identity, provider, quota) => rewriteSnapshot(identity, (current) => {
-      const state = current?.providers[provider];
-      if (current === void 0 || state === void 0) {
-        return void 0;
+// package.json
+var package_default;
+var init_package = __esm({
+  "package.json"() {
+    package_default = {
+      name: "agent-shim",
+      version: "11.76.0",
+      description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
+      license: "MIT",
+      author: "Joseph Mearman <joseph@mearman.co.uk>",
+      repository: {
+        type: "git",
+        url: "git+https://github.com/ExaDev/agent-shim.git"
+      },
+      homepage: "https://github.com/ExaDev/agent-shim#readme",
+      bugs: "https://github.com/ExaDev/agent-shim/issues",
+      keywords: [
+        "claude-code",
+        "claude",
+        "cli"
+      ],
+      packageManager: "pnpm@12.4.1+sha512.2e81e399d73fe8390dab25e06aa788ab7a5908248d2f5a370f82b481147a6a7a367bf8048f9a6fdb6460f21a66f0542dedb8b94ca2c8723596741920b1656d4c",
+      type: "module",
+      engines: {
+        node: "^22.18 || >=24"
+      },
+      bin: {
+        "agent-shim": "dist/cli.cjs",
+        "claude-use": "dist/cli.cjs"
+      },
+      files: [
+        "dist/cli.cjs",
+        "dist/index.mjs",
+        "dist/index.cjs",
+        "dist/types"
+      ],
+      scripts: {
+        prepare: "husky && node scripts/build.mts --bundle-only",
+        typecheck: "turbo run _typecheck",
+        _typecheck: "tsc --noEmit",
+        lint: "turbo run _lint",
+        _lint: "eslint . --cache --cache-location .eslintcache --max-warnings 0",
+        test: "turbo run _test",
+        _test: "vitest run",
+        "test:coverage": "turbo run _test:coverage",
+        "_test:coverage": "vitest run --coverage",
+        knip: "turbo run _knip",
+        _knip: "knip --cache",
+        build: "turbo run _build",
+        _build: "node scripts/build.mts",
+        "build:bundle": "node scripts/build.mts --bundle-only",
+        prepublishOnly: "pnpm build:bundle",
+        schema: "node scripts/gen-schema.mts"
+      },
+      dependencies: {
+        "@anthropic-ai/claude-agent-sdk": "0.3.292",
+        "@clack/prompts": "^1.8.0",
+        "@modelcontextprotocol/sdk": "1.32.0",
+        "@orpc/client": "2.0.0-beta.43",
+        "@orpc/openapi": "2.0.0-beta.43",
+        "@orpc/server": "2.0.0-beta.43",
+        commander: "^15.0.0",
+        cosmiconfig: "^10.0.1",
+        picomatch: "^4.0.7",
+        "string-width": "8.3.0",
+        trilean: "1.9.0",
+        undici: "7.30.1",
+        zod: "^4.6.7"
+      },
+      devDependencies: {
+        "@commitlint/cli": "^21.2.2",
+        "@commitlint/config-conventional": "^21.2.2",
+        "@exadev/eslint-config": "2.12.1",
+        "@semantic-release/changelog": "^7.0.0",
+        "@semantic-release/git": "^11.0.1",
+        "@semantic-release/npm": "^13.1.5",
+        "@types/node": "^26.5.1",
+        "@types/picomatch": "^4.0.3",
+        "@vitest/coverage-v8": "^4.1.12",
+        combinatrix: "2.0.1",
+        "conventional-changelog-conventionalcommits": "^10.4.0",
+        esbuild: "^0.28.2",
+        eslint: "^10.10.0",
+        globals: "^17.12.0",
+        husky: "^9.1.7",
+        jiti: "^2.7.0",
+        knip: "^6.35.1",
+        "lint-staged": "^17.5.0",
+        rollup: "4.64.0",
+        "rollup-plugin-dts": "6.5.1",
+        "semantic-release": "^25.0.9",
+        turbo: "^2.11.5",
+        typescript: "^6.0.3",
+        "typescript-eslint": "^8.70.0",
+        vitest: "^4.1.12",
+        yaml: "2.9.1"
+      },
+      main: "dist/index.cjs",
+      module: "dist/index.mjs",
+      types: "dist/types/index.d.ts",
+      exports: {
+        ".": {
+          types: "./dist/types/index.d.ts",
+          import: "./dist/index.mjs",
+          require: "./dist/index.cjs"
+        },
+        "./package.json": "./package.json"
       }
-      const keep = state.quota !== void 0 && state.quota.observedAt.localeCompare(quota.observedAt) > 0;
-      return { ...current.providers, [provider]: { ...state, quota: keep ? state.quota : quota } };
-    }),
-    recordRateLimit: (identity, provider, rateLimit) => rewriteSnapshot(identity, (current) => {
-      const state = current?.providers[provider] ?? {};
-      const keep = state.rateLimit !== void 0 && state.rateLimit.observedAt.localeCompare(rateLimit.observedAt) > 0;
-      const earlier = state.rateLimit;
-      const merged = rateLimit.unified === void 0 ? { ...earlier ?? rateLimit, planWindowsUnavailableAt: rateLimit.observedAt } : { ...rateLimit, unified: { ...earlier?.unified === void 0 ? {} : overageFactsOf(earlier.unified), ...rateLimit.unified } };
-      return { ...current?.providers, [provider]: { ...state, rateLimit: keep ? state.rateLimit : merged } };
-    })
-  };
-}
-var import_node_path27, DAY_MS2, DAYS_IN_WEEK2, USAGE_RETENTION_MS;
-var init_store2 = __esm({
-  "src/usage/store.ts"() {
-    "use strict";
-    import_node_path27 = __toESM(require("node:path"), 1);
-    init_account();
-    init_rateLimit();
-    init_read();
-    init_schema2();
-    DAY_MS2 = 864e5;
-    DAYS_IN_WEEK2 = 7;
-    USAGE_RETENTION_MS = DAYS_IN_WEEK2 * DAY_MS2;
+    };
   }
 });
 
-// src/usage/poolPick.ts
-function errorMessage(error63) {
-  return error63 instanceof Error ? error63.message : String(error63);
-}
-function loadPoolMembers(fs31, paths, identities, nowMs) {
-  const windowStartMs = nowMs - FIVE_HOUR_WINDOW_MS;
-  const log = readUsageLog(fs31, paths.usageLogDir, { sinceMs: windowStartMs });
-  return identities.map((identity) => {
-    const records = log.records.filter((record2) => record2.identity === identity && record2.provider === ANTHROPIC_PROVIDER && Date.parse(record2.at) >= windowStartMs);
-    try {
-      const snapshot = readUsageSnapshot(fs31, paths.usageSnapshotsDir, identity);
-      const account = readAccountMetadata(fs31, paths.identitiesDir, identity) ?? snapshot?.account;
-      return { identity, records, ...snapshot === void 0 ? {} : { snapshot }, ...account === void 0 ? {} : { account } };
-    } catch (error63) {
-      if (error63 instanceof UsageSnapshotError || error63 instanceof AccountMetadataError) {
-        return { identity, records, readError: errorMessage(error63) };
-      }
-      throw error63;
-    }
-  });
-}
-function rankPoolGraph(input2) {
-  return rankNamedPool(input2, input2.poolName, [], input2.sticky);
-}
-function rankNamedPool(input2, poolName, stack, sticky) {
-  const pool = input2.pools[poolName];
-  if (pool === void 0) {
-    throw new PoolGraphError(`No pool named "${poolName}". Run \`agent-shim pool add ${poolName} --identity <name>...\` first.`);
+// src/usage/plan.ts
+function planOf(account) {
+  const userTier = account?.userRateLimitTier;
+  if (userTier !== void 0 && ZERO_TIER.test(userTier)) {
+    return { kind: "pay-per-use", tier: userTier };
   }
-  const childStack = [...stack, poolName];
-  const direct = pool.identities.filter((entry) => poolNameOf(poolMemberIdentity(entry)) === void 0);
-  const missing = direct.filter((entry) => !input2.identityExists(poolMemberIdentity(entry))).map((entry) => ({ pool: poolName, identity: poolMemberIdentity(entry) }));
-  const loaded = new Map(loadPoolMembers(input2.fs, input2.paths, direct.filter((entry) => input2.identityExists(poolMemberIdentity(entry))).map(poolMemberIdentity), input2.nowMs).map((member) => [member.identity, member]));
-  const members2 = [];
-  for (const entry of pool.identities) {
-    const nestedName = poolNameOf(poolMemberIdentity(entry));
-    if (nestedName === void 0) {
-      const member = loaded.get(poolMemberIdentity(entry));
-      if (member !== void 0) {
-        members2.push(typeof entry === "string" ? member : { ...member, policy: entry.when });
-      }
-      continue;
-    }
-    assertNestable(input2.pools, poolName, poolMemberIdentity(entry), nestedName, childStack);
-    const nested = nestedMember(input2, nestedName, childStack, sticky);
-    members2.push(typeof entry === "string" ? nested.member : { ...nested.member, policy: entry.when });
-    missing.push(...nested.missing);
+  const tier = account?.organizationRateLimitTier ?? userTier;
+  const tierField = tier === void 0 ? {} : { tier };
+  if (tier === void 0) {
+    return { kind: "subscription", capacity: 1, recognised: false };
   }
-  const ranking = rankPool({
-    members: members2,
-    nowMs: input2.nowMs,
-    resuming: input2.resuming,
-    ...input2.resumeContextTokens === void 0 ? {} : { resumeContextTokens: input2.resumeContextTokens },
-    ...input2.committedContextTokens === void 0 ? {} : { committedContextTokens: input2.committedContextTokens },
-    ...sticky === void 0 ? {} : { sticky },
-    ...pool.preference === void 0 ? {} : { preference: pool.preference }
-  });
-  return { ranking, missing };
+  if (ZERO_TIER.test(tier)) {
+    return { kind: "pay-per-use", ...tierField };
+  }
+  const multiplier = TIER_MULTIPLIER.exec(tier)?.[1];
+  if (multiplier !== void 0) {
+    return { kind: "subscription", capacity: Number(multiplier), recognised: true, ...tierField };
+  }
+  return { kind: "subscription", capacity: 1, recognised: BASE_TIER.test(tier), ...tierField };
 }
-function assertNestable(pools, poolName, member, nestedName, childStack) {
-  if (pools[nestedName] === void 0) {
-    throw new PoolGraphError(`Pool "${poolName}" member "${member}" names a pool that is not defined.`);
+var PlanClassSchema, TIER_MULTIPLIER, ZERO_TIER, BASE_TIER;
+var init_plan2 = __esm({
+  "src/usage/plan.ts"() {
+    "use strict";
+    init_zod();
+    PlanClassSchema = external_exports.union([
+      external_exports.strictObject({
+        kind: external_exports.literal("subscription"),
+        /** The plan's size as a multiple of the smallest subscription tier (Max is 5, Ultra is 20). */
+        capacity: external_exports.number().positive(),
+        /** False when the tier string named no multiplier and no tier this project knows, so `capacity` is the neutral 1 rather than a reading. */
+        recognised: external_exports.boolean(),
+        /** The tier string the classification rests on, when the account had one. */
+        tier: external_exports.string().optional()
+      }),
+      external_exports.strictObject({
+        kind: external_exports.literal("pay-per-use"),
+        tier: external_exports.string().optional()
+      })
+    ]);
+    TIER_MULTIPLIER = /(?:^|_)(\d+)x$/;
+    ZERO_TIER = /(?:^|_)zero$/;
+    BASE_TIER = /(?:^|_)(?:pro|free)$/;
   }
-  if (childStack.includes(nestedName)) {
-    throw new PoolGraphError(`Pool "${poolName}" member "${member}" closes a cycle: ${[...childStack.slice(childStack.indexOf(nestedName)), nestedName].join(" -> ")}. A pool cannot nest itself, directly or through another pool.`);
+});
+
+// src/usage/scan.ts
+function mergeUsage(current, raw) {
+  const parsed = AnthropicUsageSchema.safeParse(raw);
+  if (!parsed.success) {
+    return current;
   }
+  const usage = parsed.data;
+  const merged = {
+    ...current,
+    ...typeof usage.input_tokens === "number" ? { inputTokens: usage.input_tokens } : {},
+    ...typeof usage.output_tokens === "number" ? { outputTokens: usage.output_tokens } : {},
+    ...typeof usage.cache_creation_input_tokens === "number" ? { cacheCreationInputTokens: usage.cache_creation_input_tokens } : {},
+    ...typeof usage.cache_read_input_tokens === "number" ? { cacheReadInputTokens: usage.cache_read_input_tokens } : {}
+  };
+  return Object.keys(merged).length === 0 ? current : merged;
 }
-function nestedMember(input2, nestedName, childStack, sticky) {
-  const nested = rankNamedPool(input2, nestedName, childStack, sticky);
-  const pick2 = nested.ranking.pick;
-  if (pick2 !== void 0) {
-    const [member] = loadPoolMembers(input2.fs, input2.paths, [pick2.identity], input2.nowMs);
-    return { member: { ...member ?? { identity: pick2.identity, records: [] }, nested: { kind: "pick", pool: nestedName, reasons: pick2.reasons } }, missing: nested.missing };
+function errorInfo(raw) {
+  const parsed = ErrorObjectSchema.safeParse(raw);
+  if (!parsed.success) {
+    return void 0;
   }
-  const earliestReturn = nested.ranking.earliestReturn;
+  const { type: type2, code, message } = parsed.data;
   return {
-    member: {
-      identity: earliestReturn?.identity ?? `pool:${nestedName}`,
-      records: [],
-      nested: { kind: "refused", pool: nestedName, ...earliestReturn === void 0 ? {} : { earliestReturn } }
-    },
-    missing: nested.missing
+    ...type2 === void 0 ? {} : { type: type2 },
+    ...code === void 0 ? {} : { code: String(code) },
+    ...message === void 0 ? {} : { message }
   };
 }
-function readPicksFile(fs31, file2) {
-  const empty = { schemaVersion: SCHEMA_VERSION, picks: {} };
-  const raw = fs31.readFileUtf8(file2);
-  if (raw === void 0) {
-    return { file: empty };
-  }
-  let parsed;
+function isObject3(value2) {
+  return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+}
+function parseJson2(text5) {
   try {
-    parsed = JSON.parse(raw);
+    const parsed = JSON.parse(text5);
+    return parsed;
   } catch {
-    return { file: empty, problem: `${file2} is not valid JSON` };
+    return void 0;
   }
-  const result = PicksFileSchema.safeParse(parsed);
-  return result.success ? { file: result.data } : { file: empty, problem: `${file2} is not a picks file this agent-shim can read` };
 }
-function readStickyPick(fs31, picksFile, directory) {
-  const read = readPicksFile(fs31, picksFile);
-  const entry = read.file.picks[directory];
-  return { ...entry === void 0 ? {} : { sticky: entry }, ...read.problem === void 0 ? {} : { problem: read.problem } };
+function createSseScanner() {
+  let model;
+  let usage;
+  let error63;
+  let eventName;
+  let line = "";
+  let skipping = false;
+  let data = [];
+  const dispatch = () => {
+    if (data.length > 0) {
+      const payload = parseJson2(data.join("\n"));
+      if (isObject3(payload)) {
+        const type2 = typeof payload.type === "string" ? payload.type : void 0;
+        if (type2 === "message_start" && isObject3(payload.message)) {
+          if (typeof payload.message.model === "string") {
+            model = payload.message.model;
+          }
+          usage = mergeUsage(usage, payload.message.usage);
+        } else if (type2 === "message_delta") {
+          usage = mergeUsage(usage, payload.usage);
+        } else if (type2 === "error") {
+          error63 = errorInfo(payload.error) ?? error63;
+        }
+      }
+    }
+    eventName = void 0;
+    data = [];
+  };
+  const worthKeeping = (partial2) => {
+    if (!partial2.startsWith("data:")) {
+      return true;
+    }
+    if (eventName !== void 0) {
+      return METADATA_EVENTS.has(eventName);
+    }
+    const leading = LEADING_TYPE.exec(partial2.slice("data:".length));
+    if (leading?.[1] !== void 0) {
+      return METADATA_EVENTS.has(leading[1]);
+    }
+    return void 0;
+  };
+  const completeLine = (complete) => {
+    const text5 = complete.endsWith("\r") ? complete.slice(0, -1) : complete;
+    if (text5 === "") {
+      dispatch();
+      return;
+    }
+    if (text5.startsWith("event:")) {
+      eventName = text5.slice("event:".length).trim();
+      return;
+    }
+    if (text5.startsWith("data:")) {
+      const value2 = text5.slice("data:".length);
+      data.push(value2.startsWith(" ") ? value2.slice(1) : value2);
+    }
+  };
+  return {
+    push: (text5) => {
+      let start = 0;
+      for (; ; ) {
+        const newline = text5.indexOf("\n", start);
+        const piece = newline === -1 ? text5.slice(start) : text5.slice(start, newline);
+        if (!skipping) {
+          line += piece;
+          if (worthKeeping(line) === false) {
+            line = "";
+            skipping = true;
+          }
+        }
+        if (newline === -1) {
+          return;
+        }
+        if (!skipping) {
+          completeLine(line);
+        }
+        line = "";
+        skipping = false;
+        start = newline + 1;
+      }
+    },
+    result: () => {
+      if (!skipping && line !== "") {
+        completeLine(line);
+        line = "";
+      }
+      dispatch();
+      return { model, usage, error: error63 };
+    }
+  };
 }
-function recordStickyPick(fs31, picksFile, directory, identity, nowMs) {
-  const current = readPicksFile(fs31, picksFile).file.picks;
-  const kept = Object.entries(current).filter(([, entry]) => nowMs - Date.parse(entry.at) <= USAGE_RETENTION_MS);
-  const next = { schemaVersion: SCHEMA_VERSION, picks: { ...Object.fromEntries(kept), [directory]: { identity, at: new Date(nowMs).toISOString() } } };
-  fs31.mkdirPrivate(import_node_path28.default.dirname(picksFile));
-  fs31.writeFilePrivate(picksFile, `${JSON.stringify(next, null, 2)}
-`);
+function createJsonScanner() {
+  const captured = /* @__PURE__ */ new Map();
+  let depth = 0;
+  let inString = false;
+  let escaped = false;
+  let readingKey = false;
+  let expectKey = false;
+  let key = "";
+  let capturing;
+  let capture = "";
+  let inValue = false;
+  let currentKey = "";
+  const endValue = () => {
+    if (capturing !== void 0) {
+      captured.set(capturing, capture.trim());
+    }
+    capturing = void 0;
+    capture = "";
+    inValue = false;
+  };
+  const step2 = (char) => {
+    if (capturing !== void 0 && !(depth === 1 && !inString && (char === "," || char === "}"))) {
+      capture += char;
+    }
+    if (inString) {
+      if (escaped) {
+        escaped = false;
+      } else if (char === "\\") {
+        escaped = true;
+      } else if (char === '"') {
+        inString = false;
+        if (readingKey) {
+          readingKey = false;
+          currentKey = key;
+        }
+        return;
+      }
+      if (readingKey) {
+        key += char;
+      }
+      return;
+    }
+    switch (char) {
+      case '"':
+        inString = true;
+        if (depth === 1 && expectKey) {
+          readingKey = true;
+          expectKey = false;
+          key = "";
+        }
+        return;
+      case "{":
+      case "[":
+        depth += 1;
+        if (depth === 1 && char === "{") {
+          expectKey = true;
+        }
+        return;
+      case "}":
+      case "]":
+        if (depth === 1) {
+          endValue();
+        }
+        depth -= 1;
+        return;
+      case ":":
+        if (depth === 1 && !inValue) {
+          inValue = true;
+          if (METADATA_KEYS.has(currentKey)) {
+            capturing = currentKey;
+            capture = "";
+          }
+        }
+        return;
+      case ",":
+        if (depth === 1) {
+          endValue();
+          expectKey = true;
+        }
+        return;
+      default:
+        return;
+    }
+  };
+  return {
+    push: (text5) => {
+      for (const char of text5) {
+        step2(char);
+      }
+    },
+    result: () => {
+      const model = parseJson2(captured.get("model") ?? "");
+      const usageRaw = parseJson2(captured.get("usage") ?? "");
+      const errorRaw = parseJson2(captured.get("error") ?? "");
+      return {
+        model: typeof model === "string" ? model : void 0,
+        usage: mergeUsage(void 0, usageRaw),
+        error: errorInfo(errorRaw)
+      };
+    }
+  };
 }
-var import_node_path28, PoolGraphError, SCHEMA_VERSION, PickEntrySchema, PicksFileSchema;
-var init_poolPick = __esm({
-  "src/usage/poolPick.ts"() {
+var AnthropicUsageSchema, ErrorObjectSchema, METADATA_EVENTS, LEADING_TYPE, METADATA_KEYS;
+var init_scan = __esm({
+  "src/usage/scan.ts"() {
     "use strict";
-    import_node_path28 = __toESM(require("node:path"), 1);
     init_zod();
-    init_cliError();
-    init_identity();
-    init_schema();
-    init_account();
-    init_pick();
-    init_read();
-    init_middleware();
-    init_store2();
-    PoolGraphError = class extends CliError {
-      constructor(message) {
-        super(message);
-        this.name = "PoolGraphError";
-      }
-    };
-    SCHEMA_VERSION = 1;
-    PickEntrySchema = external_exports.strictObject({ identity: external_exports.string().min(1), at: external_exports.iso.datetime() });
-    PicksFileSchema = external_exports.strictObject({
-      schemaVersion: external_exports.literal(SCHEMA_VERSION),
-      picks: external_exports.record(external_exports.string().min(1), PickEntrySchema)
+    AnthropicUsageSchema = external_exports.looseObject({
+      input_tokens: external_exports.number().int().nonnegative().nullish(),
+      output_tokens: external_exports.number().int().nonnegative().nullish(),
+      cache_creation_input_tokens: external_exports.number().int().nonnegative().nullish(),
+      cache_read_input_tokens: external_exports.number().int().nonnegative().nullish()
+    });
+    ErrorObjectSchema = external_exports.looseObject({
+      type: external_exports.string().optional(),
+      code: external_exports.union([external_exports.string(), external_exports.number()]).optional(),
+      message: external_exports.string().optional()
     });
+    METADATA_EVENTS = /* @__PURE__ */ new Set(["message_start", "message_delta", "error"]);
+    LEADING_TYPE = /^\s*\{\s*"type"\s*:\s*"([^"]*)"/;
+    METADATA_KEYS = /* @__PURE__ */ new Set(["model", "usage", "error"]);
   }
 });
 
-// src/realCredentialCache.ts
-function cacheFileNameFor(owner) {
-  return `${owner.replace(/[^A-Za-z0-9._-]/g, "_")}.json`;
+// src/usage/middleware.ts
+function scannerFor(headers) {
+  const contentType = headerValue(headers, "content-type")?.toLowerCase() ?? "";
+  if (contentType.startsWith("text/event-stream")) {
+    return createSseScanner();
+  }
+  if (contentType.startsWith("application/json")) {
+    return createJsonScanner();
+  }
+  return void 0;
 }
-function parseEntry(raw) {
-  let json2;
-  try {
-    json2 = JSON.parse(raw);
-  } catch {
-    return void 0;
+function headerValue(headers, name) {
+  for (const [key, value2] of Object.entries(headers)) {
+    if (key.toLowerCase() === name) {
+      return value2;
+    }
   }
-  const parsed = CachedCredentialSchema.safeParse(json2);
-  return parsed.success ? parsed.data : void 0;
+  return void 0;
 }
-function requireKeychain() {
-  if (process.platform !== "darwin") {
-    throw new Error("the keychain credential store needs macOS; use --credential-cache-store file");
+function decoderFor(encoding) {
+  switch (encoding?.trim().toLowerCase()) {
+    case void 0:
+    case "":
+    case "identity":
+      return null;
+    case "gzip":
+    case "x-gzip":
+      return zlib.createGunzip();
+    case "deflate":
+      return zlib.createInflate();
+    case "br":
+      return zlib.createBrotliDecompress();
+    default:
+      return void 0;
   }
 }
-function security(args, stdin2) {
-  const result = spawnSyncBlocking("a keychain call", "security", args, { encoding: "utf8", ...stdin2 === void 0 ? {} : { input: stdin2 }, stdio: ["pipe", "pipe", "ignore"] });
-  return { status: result.status, stdout: result.stdout };
+function destinationOf(path73, sessionProvider) {
+  const scoped = parseProviderPath(path73);
+  if (scoped !== void 0) {
+    return { provider: scoped.provider, endpoint: scoped.rest };
+  }
+  return { provider: sessionProvider ?? ANTHROPIC_PROVIDER, endpoint: path73 };
 }
-async function securityAsync(args, stdin2) {
-  return await new Promise((resolve3) => {
-    const child = (0, import_node_child_process4.spawn)("security", args, { stdio: ["pipe", "pipe", "ignore"] });
-    let stdout2 = "";
-    let settled = false;
-    const settle2 = (status) => {
-      if (!settled) {
-        settled = true;
-        resolve3({ status, stdout: stdout2 });
-      }
-    };
-    child.stdout.setEncoding("utf8");
-    child.stdout.on("data", (chunk2) => {
-      stdout2 += chunk2;
-    });
-    child.stdin.on("error", () => {
-    });
-    child.stdin.end(stdin2);
-    child.once("error", () => {
-      settle2(null);
-    });
-    child.once("close", settle2);
-  });
+function modelChoiceOf(event, servedModel, provider) {
+  if (event.modelChoice !== void 0) return event.modelChoice;
+  if (event.requestedModel === void 0 || servedModel === void 0 || event.requestedModel === servedModel) return void 0;
+  return { requested: event.requestedModel, providers: [provider] };
 }
-function createRealCredentialCache(root) {
-  const dir = import_node_path29.default.join(root, "credential-cache");
-  const filePath = (owner) => import_node_path29.default.join(dir, cacheFileNameFor(owner));
+function buildRecord(event, context) {
+  const { scan } = context;
+  const { provider, endpoint } = destinationOf(event.servedPath, event.session.provider);
+  const choice = modelChoiceOf(event, scan?.model, provider);
+  const rateLimitHeaders = rateLimitHeadersOf(event.headers);
+  const limit = classifyLimit({ status: event.status, headers: rateLimitHeaders ?? {}, error: scan?.error, nowMs: context.endedAt });
+  const requestId = headerValue(event.headers, "request-id");
+  const { identity, sessionId, projectId } = event.session;
   return {
-    read(store, owner) {
-      if (store === "file") {
-        try {
-          return parseEntry(import_node_fs9.default.readFileSync(filePath(owner), "utf8"));
-        } catch {
-          return void 0;
-        }
-      }
-      requireKeychain();
-      const result = security(["find-generic-password", "-s", KEYCHAIN_CACHE_SERVICE, "-a", owner, "-w"]);
-      return result.status === 0 ? parseEntry(Buffer.from(result.stdout.trim(), "base64").toString("utf8")) : void 0;
-    },
-    write(store, owner, entry) {
-      const serialised = JSON.stringify(entry);
-      if (store === "file") {
-        import_node_fs9.default.mkdirSync(dir, { recursive: true, mode: CACHE_DIR_MODE });
-        import_node_fs9.default.chmodSync(dir, CACHE_DIR_MODE);
-        const target = filePath(owner);
-        const temp = `${target}.${String(process.pid)}.tmp`;
-        import_node_fs9.default.writeFileSync(temp, serialised, { mode: CACHE_FILE_MODE });
-        import_node_fs9.default.renameSync(temp, target);
+    schemaVersion: USAGE_SCHEMA_VERSION,
+    at: new Date(event.receivedAt).toISOString(),
+    ...identity === void 0 ? {} : { identity },
+    provider,
+    ...sessionId === void 0 ? {} : { sessionId },
+    ...event.clientSessionId === void 0 ? {} : { clientSessionId: event.clientSessionId },
+    ...projectId === void 0 ? {} : { project: projectId },
+    viaHeadroom: event.viaHeadroom,
+    route: event.route,
+    method: event.method,
+    endpoint,
+    ...scan?.model === void 0 ? {} : { model: scan.model },
+    ...choice === void 0 ? {} : { requestedModel: choice.requested },
+    ...choice !== void 0 && choice.providers.length > 1 ? { candidateProviders: [...choice.providers] } : {},
+    status: event.status,
+    latencyMs: Math.max(0, Math.round(context.headAt - event.receivedAt)),
+    durationMs: Math.max(0, Math.round(context.endedAt - event.receivedAt)),
+    outcome: context.outcome,
+    ...scan?.usage === void 0 ? {} : { usage: scan.usage },
+    ...rateLimitHeaders === void 0 ? {} : { rateLimitHeaders },
+    ...limit === void 0 ? {} : { limit },
+    ...requestId === void 0 ? {} : { requestId }
+  };
+}
+function createUsageMiddleware(deps) {
+  return (event) => {
+    if (DOOR_ANSWERED_ROUTES.has(event.route)) {
+      return void 0;
+    }
+    const headAt = deps.now();
+    const scanner = scannerFor(event.headers);
+    const decoder = scanner === void 0 ? null : decoderFor(headerValue(event.headers, "content-encoding"));
+    let scanning = scanner !== void 0 && decoder !== void 0;
+    const text5 = new TextDecoder();
+    const feed = (bytes, final) => {
+      if (!scanning || scanner === void 0) {
         return;
       }
-      requireKeychain();
-      const encoded = Buffer.from(serialised, "utf8").toString("base64");
-      const result = security(["-i"], `add-generic-password -U -s ${KEYCHAIN_CACHE_SERVICE} -a ${JSON.stringify(owner)} -w ${encoded}
-`);
-      if (result.status !== 0) {
-        throw new Error(`could not write the keychain credential cache for ${owner}`);
-      }
-    },
-    remove(store, owner) {
-      if (store === "file") {
-        import_node_fs9.default.rmSync(filePath(owner), { force: true });
-        return;
+      try {
+        scanner.push(text5.decode(bytes, { stream: !final }));
+      } catch (error63) {
+        scanning = false;
+        deps.log(`usage: body scan failed for ${event.route}: ${error63 instanceof Error ? error63.message : String(error63)}`);
       }
-      requireKeychain();
-      security(["delete-generic-password", "-s", KEYCHAIN_CACHE_SERVICE, "-a", owner]);
-    }
-  };
-}
-function realCredentialCacheEnv(paths) {
-  return { port: createRealCredentialCache(paths.root), platform: process.platform, now: () => Date.now() };
-}
-function createAsyncRealCredentialCache(root) {
-  const dir = import_node_path29.default.join(root, "credential-cache");
-  const filePath = (owner) => import_node_path29.default.join(dir, cacheFileNameFor(owner));
-  return {
-    async read(store, owner) {
-      if (store === "file") {
+    };
+    const finish = (outcome) => {
+      const endedAt = deps.now();
+      deps.defer(() => {
         try {
-          return parseEntry(await import_node_fs9.default.promises.readFile(filePath(owner), "utf8"));
-        } catch {
-          return void 0;
+          deps.record(buildRecord(event, { headAt, endedAt, outcome, scan: scanning && scanner !== void 0 ? scanner.result() : void 0 }), event);
+        } catch (error63) {
+          deps.log(`usage: could not record ${event.method} ${event.path} (${String(event.status)}): ${error63 instanceof Error ? error63.message : String(error63)}`);
         }
-      }
-      requireKeychain();
-      const result = await securityAsync(["find-generic-password", "-s", KEYCHAIN_CACHE_SERVICE, "-a", owner, "-w"]);
-      return result.status === 0 ? parseEntry(Buffer.from(result.stdout.trim(), "base64").toString("utf8")) : void 0;
-    },
-    async write(store, owner, entry) {
-      const serialised = JSON.stringify(entry);
-      if (store === "file") {
-        await import_node_fs9.default.promises.mkdir(dir, { recursive: true, mode: CACHE_DIR_MODE });
-        await import_node_fs9.default.promises.chmod(dir, CACHE_DIR_MODE);
-        const target = filePath(owner);
-        const temp = `${target}.${String(process.pid)}.tmp`;
-        await import_node_fs9.default.promises.writeFile(temp, serialised, { mode: CACHE_FILE_MODE });
-        await import_node_fs9.default.promises.rename(temp, target);
+      });
+    };
+    if (decoder === null || decoder === void 0) {
+      return {
+        chunk: (bytes) => {
+          feed(bytes, false);
+        },
+        end: (outcome) => {
+          feed(new Uint8Array(), true);
+          finish(outcome);
+        }
+      };
+    }
+    let ended;
+    let settled = false;
+    const settle2 = () => {
+      if (settled || ended === void 0) {
         return;
       }
-      requireKeychain();
-      const encoded = Buffer.from(serialised, "utf8").toString("base64");
-      const result = await securityAsync(["-i"], `add-generic-password -U -s ${KEYCHAIN_CACHE_SERVICE} -a ${JSON.stringify(owner)} -w ${encoded}
-`);
-      if (result.status !== 0) {
-        throw new Error(`could not write the keychain credential cache for ${owner}`);
+      settled = true;
+      feed(new Uint8Array(), true);
+      finish(ended);
+    };
+    decoder.on("data", (bytes) => {
+      feed(bytes, false);
+    });
+    decoder.on("error", (error63) => {
+      scanning = false;
+      deps.log(`usage: could not decompress the body of ${event.route}: ${error63.message}`);
+      settle2();
+    });
+    decoder.on("end", settle2);
+    return {
+      chunk: (bytes) => {
+        if (scanning) {
+          decoder.write(bytes);
+        }
+      },
+      end: (outcome) => {
+        ended = outcome;
+        if (!scanning || outcome === "aborted") {
+          decoder.destroy();
+          settle2();
+          return;
+        }
+        decoder.end();
       }
-    }
+    };
   };
 }
-function realAsyncCredentialCacheEnv(paths) {
-  return { port: createAsyncRealCredentialCache(paths.root), platform: process.platform, now: () => Date.now() };
-}
-var import_node_child_process4, import_node_fs9, import_node_path29, KEYCHAIN_CACHE_SERVICE, CACHE_DIR_MODE, CACHE_FILE_MODE;
-var init_realCredentialCache = __esm({
-  "src/realCredentialCache.ts"() {
+var zlib, ANTHROPIC_PROVIDER, DOOR_ANSWERED_ROUTES;
+var init_middleware = __esm({
+  "src/usage/middleware.ts"() {
     "use strict";
-    import_node_child_process4 = require("node:child_process");
-    import_node_fs9 = __toESM(require("node:fs"), 1);
-    import_node_path29 = __toESM(require("node:path"), 1);
-    init_blockingSpawn();
-    init_credentialCache();
-    KEYCHAIN_CACHE_SERVICE = "agent-shim-credential-cache";
-    CACHE_DIR_MODE = 448;
-    CACHE_FILE_MODE = 384;
+    zlib = __toESM(require("node:zlib"), 1);
+    init_route();
+    init_rateLimit();
+    init_scan();
+    init_schema2();
+    ANTHROPIC_PROVIDER = "anthropic";
+    DOOR_ANSWERED_ROUTES = /* @__PURE__ */ new Set(["(unauthorized)", "(unrouted)"]);
   }
 });
 
-// src/providerAliases.ts
-function parseAliases(file2, raw) {
-  const parsed = ProviderAliasesSchema.safeParse(raw);
-  if (!parsed.success) {
-    throw new ConfigValidationError(file2, parsed.error.issues);
+// src/usage/quotaFacts.ts
+function windowFacts(window, nowMs) {
+  if (window?.utilization === void 0 || window.resetsAt === void 0) {
+    return void 0;
   }
-  return parsed.data;
-}
-function readProviderAliases(paths) {
-  return readJson(paths.providerAliasesFile, ProviderAliasesSchema) ?? {};
+  return { remaining: Math.max(0, 1 - window.utilization), utilization: window.utilization, hoursUntilReset: Math.max(0, (Date.parse(window.resetsAt) - nowMs) / MS_PER_HOUR) };
 }
-function loadProviderAliases(file2, port) {
-  const raw = port.readConfigFile(file2);
-  return raw === void 0 ? {} : parseAliases(file2, raw);
+function quotaFactsOf(unified, nowMs) {
+  const fiveHour = windowFacts(unified?.fiveHour, nowMs);
+  const sevenDay = windowFacts(unified?.sevenDay, nowMs);
+  const extraUsage = windowFacts(unified === void 0 ? void 0 : soleOverageWindow(unified), nowMs);
+  return { ...fiveHour === void 0 ? {} : { fiveHour }, ...sevenDay === void 0 ? {} : { sevenDay }, ...extraUsage === void 0 ? {} : { extraUsage } };
 }
-function writeProviderAliases(paths, aliases) {
-  if (Object.keys(aliases).length === 0) {
-    import_node_fs10.default.rmSync(paths.providerAliasesFile, { force: true });
-    return;
+var MS_PER_HOUR;
+var init_quotaFacts = __esm({
+  "src/usage/quotaFacts.ts"() {
+    "use strict";
+    init_rateLimit();
+    MS_PER_HOUR = 36e5;
   }
-  writeJsonAtomic(paths.providerAliasesFile, aliases);
+});
+
+// src/usage/pick.ts
+function unifiedOf(state) {
+  return state?.rateLimit?.unified;
 }
-function canonicalProviderName(name, defined, aliases) {
-  if (defined(name)) {
-    return name;
+function limitBlockedUntil(state, nowMs) {
+  const limit = state?.lastLimit;
+  if (state === void 0 || limit === void 0) {
+    return void 0;
   }
-  return aliases()[name] ?? name;
-}
-function aliasesAfterRename(aliases, from, to2) {
-  const next = {};
-  for (const [alias, target] of Object.entries(aliases)) {
-    if (alias !== to2) {
-      next[alias] = target === from ? to2 : target;
-    }
+  if (state.lastRequestAt !== void 0 && Date.parse(state.lastRequestAt) > Date.parse(limit.observedAt)) {
+    return void 0;
   }
-  next[from] = to2;
-  return next;
+  const until = limit.resetAt === void 0 ? limit.retryAfterSeconds === void 0 ? void 0 : Date.parse(limit.observedAt) + limit.retryAfterSeconds * MS_PER_SECOND5 : Date.parse(limit.resetAt);
+  return until !== void 0 && until > nowMs ? until : void 0;
 }
-function aliasesOf(aliases, name) {
-  return Object.entries(aliases).filter(([, target]) => target === name).map(([alias]) => alias).sort();
+function windowBlockedUntil(windows) {
+  const resets = windows.flatMap((window) => window.status === "rejected" && window.resetsAtMs !== void 0 ? [window.resetsAtMs] : []);
+  return resets.length === 0 ? void 0 : Math.max(...resets);
 }
-function removeProviderAlias(paths, alias) {
-  const aliases = readProviderAliases(paths);
-  if (!(alias in aliases)) {
-    throw new ProviderAliasNotFoundError(alias);
+function windowBurn(records, which) {
+  const points = [];
+  for (const record2 of records) {
+    const window = record2.rateLimitHeaders === void 0 ? void 0 : parseUnifiedRateLimit(record2.rateLimitHeaders)?.[which];
+    if (window?.utilization !== void 0 && window.resetsAt !== void 0) {
+      points.push({ resetsAt: window.resetsAt, point: { atMs: Date.parse(record2.at), utilization: window.utilization } });
+    }
   }
-  writeProviderAliases(paths, Object.fromEntries(Object.entries(aliases).filter(([name]) => name !== alias)));
+  const latest = points.at(-1)?.resetsAt;
+  const current = points.filter((entry) => entry.resetsAt === latest).map((entry) => entry.point);
+  const first = current.at(0);
+  const last = current.at(-1);
+  if (first === void 0 || last === void 0 || last.atMs <= first.atMs || last.utilization <= first.utilization) {
+    return void 0;
+  }
+  return (last.utilization - first.utilization) / (last.atMs - first.atMs);
 }
-function aliasFindings(aliases, providerNames) {
-  return Object.entries(aliases).map(([alias, target]) => {
-    if (!providerNames.has(target)) {
-      return { level: "fail", alias, message: `${alias} is recorded as a former name of ${target}, which is not a provider. Run \`agent-shim provider unalias ${alias}\`.` };
-    }
-    if (providerNames.has(alias)) {
-      return { level: "warn", alias, message: `${alias} is both a provider and a recorded former name of ${target}; the provider wins. Run \`agent-shim provider unalias ${alias}\`.` };
-    }
-    return { level: "pass", alias, message: `${alias} is a former name of ${target}, still honoured for sessions launched under it. Run \`agent-shim provider unalias ${alias}\` once none is running.` };
-  });
+function billedTokensOf(record2) {
+  const usage = record2.usage;
+  return (usage?.inputTokens ?? 0) + (usage?.cacheCreationInputTokens ?? 0) + (usage?.outputTokens ?? 0);
 }
-function createProviderCanonicaliser(params) {
-  const reported = /* @__PURE__ */ new Set();
-  return (name) => {
-    const current = canonicalProviderName(name, params.defined, () => {
-      try {
-        return params.aliases();
-      } catch (error63) {
-        params.log(`provider aliases ignored, the aliases file is unreadable: ${error63 instanceof Error ? error63.message : String(error63)}`);
-        return {};
-      }
-    });
-    if (current !== name && !reported.has(name)) {
-      reported.add(name);
-      params.log(`provider ${name} is a former name of ${current}; a session launched under it is still running`);
+function utilisationPerBilledToken(records) {
+  const points = [];
+  for (const record2 of records) {
+    const window = record2.rateLimitHeaders === void 0 ? void 0 : parseUnifiedRateLimit(record2.rateLimitHeaders)?.fiveHour;
+    if (window?.utilization !== void 0 && window.resetsAt !== void 0) {
+      points.push({ resetsAt: window.resetsAt, utilization: window.utilization, billed: billedTokensOf(record2) });
     }
-    return current;
-  };
-}
-var import_node_fs10, ProviderAliasesSchema, ProviderAliasNotFoundError;
-var init_providerAliases = __esm({
-  "src/providerAliases.ts"() {
-    "use strict";
-    import_node_fs10 = __toESM(require("node:fs"), 1);
-    init_zod();
-    init_cliError();
-    init_load();
-    init_store();
-    ProviderAliasesSchema = external_exports.record(external_exports.string().min(1), external_exports.string().min(1));
-    ProviderAliasNotFoundError = class extends CliError {
-      constructor(alias) {
-        super(`"${alias}" is not a former provider name. \`agent-shim provider list\` shows the ones recorded.`);
-        this.alias = alias;
-        this.name = "ProviderAliasNotFoundError";
-      }
-      alias;
-    };
   }
-});
-
-// src/models/identity.ts
-function withoutContextMarker(model) {
-  return model.toLowerCase().endsWith(CONTEXT_MARKER_1M) ? model.slice(0, -CONTEXT_MARKER_1M.length) : model;
-}
-function canonicalText(name) {
-  return name.trim().toLowerCase().replace(NON_IDENTITY_BRACKET_RE, "").replace(/[\s_]+/g, "-").replace(/([a-z])(\d+(?:\.\d+)+)/g, "$1-$2").replace(/-+/g, "-").replace(/^-|-$/g, "");
+  const latest = points.at(-1)?.resetsAt;
+  const current = points.filter((point) => point.resetsAt === latest);
+  const first = current.at(0);
+  const last = current.at(-1);
+  if (first === void 0 || last === void 0 || last.utilization <= first.utilization) {
+    return void 0;
+  }
+  const billed = current.slice(1).reduce((sum2, point) => sum2 + point.billed, 0);
+  return billed > 0 ? (last.utilization - first.utilization) / billed : void 0;
 }
-function splitVariants(tokens) {
-  const variants2 = [];
-  let end = tokens.length;
-  for (; ; ) {
-    const token = tokens[end - 1];
-    if (token === void 0 || !KNOWN_VARIANTS.has(token)) {
-      return { familyTokens: tokens.slice(0, end), variants: variants2 };
+function windowRatio(records) {
+  const points = [];
+  for (const record2 of records) {
+    const unified = record2.rateLimitHeaders === void 0 ? void 0 : parseUnifiedRateLimit(record2.rateLimitHeaders);
+    const five = unified?.fiveHour;
+    const seven = unified?.sevenDay;
+    if (five?.utilization !== void 0 && five.resetsAt !== void 0 && seven?.utilization !== void 0 && seven.resetsAt !== void 0) {
+      points.push({ fiveResetsAt: five.resetsAt, sevenResetsAt: seven.resetsAt, five: five.utilization, seven: seven.utilization });
     }
-    variants2.unshift(token);
-    end -= 1;
   }
+  const latest = points.at(-1);
+  const current = points.filter((point) => point.fiveResetsAt === latest?.fiveResetsAt && point.sevenResetsAt === latest.sevenResetsAt);
+  const first = current.at(0);
+  const last = current.at(-1);
+  if (first === void 0 || last === void 0 || last.five <= first.five || last.seven <= first.seven) {
+    return void 0;
+  }
+  return (last.seven - first.seven) / (last.five - first.five);
 }
-function versionOf(tokens) {
-  for (let index = 0; index < tokens.length; index += 1) {
-    const token = tokens[index];
-    const next = tokens[index + 1];
-    if (token === void 0) {
-      return "";
-    }
-    if (/^\d+$/.test(token) && next !== void 0 && /^\d+$/.test(next)) {
-      return `${token}.${next}`;
-    }
-    const dotted = /^\d+(?:\.\d+)+$/.exec(token);
-    if (dotted !== null) {
-      return dotted[0];
-    }
+function percent(fraction) {
+  return `${String(Math.round(fraction * PERCENT))}%`;
+}
+function describeWindow(label2, window, effective, nowMs) {
+  if (effective.reset) {
+    return `${label2} window has reset`;
   }
-  return "";
+  const used = effective.utilization === void 0 ? "usage unknown" : `${percent(effective.utilization)} used`;
+  const resets = effective.resetsAtMs === void 0 ? "" : `, resets in ${formatAge(effective.resetsAtMs - nowMs)}`;
+  return `${label2} ${used}${resets}${window.status === "allowed_warning" ? " (nearly used)" : ""}`;
 }
-function modelIdentity(rawName) {
-  const segments = rawName.trim().toLowerCase().split("/");
-  const stripped = canonicalText(segments[segments.length - 1] ?? "").split(":")[0] ?? "";
-  const withoutDate = stripped.replace(DATE_STAMP_RE, "");
-  const tokens = withoutDate.split("-").filter((token) => token !== "");
-  const { familyTokens, variants: variants2 } = splitVariants(tokens);
-  const version2 = versionOf(familyTokens);
-  const versionless = familyTokens.filter((token, index) => {
-    if (version2 === "") {
-      return true;
-    }
-    const dotted = /^\d+(?:\.\d+)+$/.test(token);
-    const previous = familyTokens[index - 1];
-    const next = familyTokens[index + 1];
-    const insideVersionRun = dotted || /^\d+$/.test(token) && (previous !== void 0 && /^\d+$/.test(previous) || next !== void 0 && /^\d+$/.test(next));
-    return !insideVersionRun;
-  });
-  const family = versionless.join("-");
-  const tokenVendor = familyTokens.find((token) => Object.keys(VENDOR_BY_TOKEN).some((key) => token === key || token.startsWith(key)));
-  const namespace = segments.length >= 2 ? (segments[0] ?? "").split(":").pop() ?? "" : "";
-  const namespaceVendor = VENDOR_BY_NAMESPACE[namespace] ?? "";
-  const tokenVendorName = tokenVendor === void 0 ? "" : VENDOR_BY_TOKEN[Object.keys(VENDOR_BY_TOKEN).find((key) => tokenVendor === key || tokenVendor.startsWith(key)) ?? ""] ?? "";
+function capacityOf(plan) {
+  return plan.kind === "subscription" ? plan.capacity : 1;
+}
+function assessRefusedNested(member, nested, nowMs) {
+  const refusal2 = nested.earliestReturn === void 0 ? { reason: `no member of pool "${nested.pool}" can be picked` } : { reason: `every member of pool "${nested.pool}" is refused; ${nested.earliestReturn.identity} returns at ${new Date(nested.earliestReturn.atMs).toISOString()} (in ${formatAge(nested.earliestReturn.atMs - nowMs)})`, blockedUntilMs: nested.earliestReturn.atMs };
   return {
-    vendor: tokenVendorName === "" ? namespaceVendor : tokenVendorName,
-    vendorConflict: tokenVendorName !== "" && namespaceVendor !== "" && tokenVendorName !== namespaceVendor,
-    family,
-    version: version2,
-    variant: variants2.join("-"),
-    familyAndVersion: version2 === "" ? family : `${family}-${version2.replace(/\./g, "-")}`
+    candidate: {
+      identity: member.identity,
+      class: "ineligible",
+      ...refusal2.blockedUntilMs === void 0 ? {} : { blockedUntilMs: refusal2.blockedUntilMs },
+      plan: planOf(member.account),
+      reasons: [refusal2.reason]
+    }
   };
 }
-function relateModels(left, right) {
-  const a10 = modelIdentity(left);
-  const b = modelIdentity(right);
-  if (a10.familyAndVersion !== b.familyAndVersion) {
-    return sameFamilyOtherVersion(a10, b) ? "similar" : "distinct";
+function assess(member, nowMs) {
+  const nested = member.nested;
+  if (nested === void 0) {
+    return assessIdentity(member, nowMs);
   }
-  if (a10.variant !== b.variant || a10.vendorConflict || b.vendorConflict || a10.vendor !== "" && b.vendor !== "" && a10.vendor !== b.vendor) {
-    return "similar";
+  if (nested.kind === "refused") {
+    return assessRefusedNested(member, nested, nowMs);
   }
-  return "same";
+  const assessment = assessIdentity(member, nowMs);
+  return { ...assessment, candidate: { ...assessment.candidate, reasons: [`picked by pool "${nested.pool}"`, ...nested.reasons] } };
 }
-function sameFamilyOtherVersion(a10, b) {
-  if (a10.family !== b.family) {
-    return false;
+function assessIdentity(member, nowMs) {
+  const plan = planOf(member.account);
+  const planReasons = plan.kind === "pay-per-use" ? ["billed by use (no plan allowance)"] : plan.recognised ? [`${String(plan.capacity)}x plan`] : [`plan tier ${plan.tier === void 0 ? "not known" : `"${plan.tier}" not recognised`}, counted as 1x`];
+  const base = { identity: member.identity, plan };
+  if (member.readError !== void 0) {
+    return { candidate: { ...base, class: "unknown", reasons: [`usage state unreadable: ${member.readError}`, ...planReasons] } };
   }
-  if (a10.vendor !== "" && b.vendor !== "" && a10.vendor !== b.vendor) {
-    return false;
+  const state = member.snapshot?.providers[ANTHROPIC_PROVIDER];
+  const unified = unifiedOf(state);
+  if (member.snapshot === void 0 || state === void 0 || unified === void 0) {
+    return { candidate: { ...base, class: "unknown", reasons: ["no usage recorded yet, so its quota is unknown (turn on trackUsage for it)", ...planReasons] } };
   }
-  return true;
+  const observedAgo = state.rateLimit === void 0 ? "" : ` (last seen ${formatAge(nowMs - Date.parse(state.rateLimit.observedAt))} ago)`;
+  const fiveHourWindow = unified.fiveHour;
+  const sevenDayWindow = unified.sevenDay;
+  const five = fiveHourWindow === void 0 ? void 0 : effectiveWindow(fiveHourWindow, nowMs);
+  const seven = sevenDayWindow === void 0 ? void 0 : effectiveWindow(sevenDayWindow, nowMs);
+  const windowReasons = [
+    ...fiveHourWindow === void 0 || five === void 0 ? [] : [describeWindow("5h", fiveHourWindow, five, nowMs)],
+    ...sevenDayWindow === void 0 || seven === void 0 ? [] : [describeWindow("7d", sevenDayWindow, seven, nowMs)]
+  ];
+  const overageWindow = soleOverageWindow(unified);
+  const overage = overageWindow === void 0 ? void 0 : effectiveWindow(overageWindow, nowMs);
+  const overageReasons = overageWindow === void 0 || overage === void 0 ? [] : [describeWindow("extra usage", overageWindow, overage, nowMs)];
+  const blockedUntil = Math.max(
+    windowBlockedUntil([five, seven, overage].flatMap((window) => window === void 0 ? [] : [window])) ?? 0,
+    limitBlockedUntil(state, nowMs) ?? 0
+  );
+  if (blockedUntil > nowMs) {
+    if (unified.overageStatus === "allowed") {
+      return { candidate: { ...base, class: "pay-per-use", planReturnsAtMs: blockedUntil, reasons: [`plan exhausted until ${new Date(blockedUntil).toISOString()} (in ${formatAge(blockedUntil - nowMs)}), continues as extra usage`, ...windowReasons, ...planReasons] } };
+    }
+    return { candidate: { ...base, class: "ineligible", blockedUntilMs: blockedUntil, reasons: [`refused until ${new Date(blockedUntil).toISOString()} (in ${formatAge(blockedUntil - nowMs)})`, ...unified.fallbackAvailable === true ? ["a fallback is on offer, so requests for some models may still be served"] : [], ...windowReasons, ...overageReasons, ...planReasons] } };
+  }
+  if (plan.kind === "pay-per-use" || fiveHourWindow === void 0 && sevenDayWindow === void 0) {
+    const headroom = overage?.utilization === void 0 ? void 0 : Math.max(0, 1 - overage.utilization);
+    return { candidate: { ...base, class: "pay-per-use", ...headroom === void 0 ? {} : { headroom }, reasons: [...plan.kind === "pay-per-use" ? planReasons : ["no plan windows reported, so usage bills as extra usage"], ...overageReasons] } };
+  }
+  const basis = seven?.utilization !== void 0 ? { window: seven, windowMs: SEVEN_DAY_WINDOW_MS, name: "sevenDay" } : five?.utilization !== void 0 ? { window: five, windowMs: FIVE_HOUR_WINDOW_MS, name: "fiveHour" } : void 0;
+  if (basis?.window.utilization === void 0) {
+    return { candidate: { ...base, class: "unknown", reasons: ["quota windows reported no utilisation", ...windowReasons, ...planReasons] } };
+  }
+  const remaining = Math.max(0, 1 - basis.window.utilization);
+  const untilResetMs = basis.window.resetsAtMs === void 0 ? basis.windowMs : Math.max(basis.window.resetsAtMs - nowMs, MS_PER_SECOND5);
+  const weeklyScore = remaining * plan.capacity / (untilResetMs / MS_PER_HOUR2);
+  const fiveRemaining = five?.utilization === void 0 ? void 0 : Math.max(0, 1 - five.utilization);
+  const fiveUntil = five?.resetsAtMs === void 0 ? FIVE_HOUR_WINDOW_MS : Math.max(five.resetsAtMs - nowMs, MS_PER_SECOND5);
+  const ratio = windowRatio(member.records);
+  const fiveHourScore = basis.name === "sevenDay" && fiveRemaining !== void 0 && ratio !== void 0 ? Math.min(fiveRemaining * ratio, remaining) * plan.capacity / (fiveUntil / MS_PER_HOUR2) : void 0;
+  const fiveHourLeads = fiveHourScore !== void 0 && fiveHourScore > weeklyScore;
+  const score = fiveHourLeads ? fiveHourScore : weeklyScore;
+  const scoreWindow = fiveHourLeads ? "fiveHour" : basis.name;
+  const fiveHourTermReasons = basis.name !== "sevenDay" || fiveRemaining === void 0 ? [] : ratio === void 0 ? ["5h reset not scored: no measured 5h to 7d ratio yet"] : fiveHourLeads ? [`5h term leads: ${percent(fiveRemaining)} of 5h unused is about ${percent(Math.min(fiveRemaining * ratio, remaining))} of the week at the measured ratio, resets in ${formatAge(fiveUntil)}`] : [];
+  const burn = windowBurn(member.records, "fiveHour");
+  const sevenRemaining = seven?.utilization === void 0 ? void 0 : Math.max(0, 1 - seven.utilization);
+  const sevenUntil = seven?.resetsAtMs === void 0 ? SEVEN_DAY_WINDOW_MS : Math.max(seven.resetsAtMs - nowMs, MS_PER_SECOND5);
+  const sevenDayBurn = windowBurn(member.records, "sevenDay");
+  return {
+    candidate: { ...base, class: "scored", score, scoreWindow, reasons: [...fiveHourTermReasons, ...windowReasons.map((reason, index) => index === windowReasons.length - 1 ? `${reason}${observedAgo}` : reason), ...planReasons] },
+    ...fiveRemaining === void 0 ? {} : { fiveHour: { remaining: fiveRemaining, untilResetMs: fiveUntil } },
+    ...burn === void 0 ? {} : { burn },
+    ...sevenRemaining === void 0 ? {} : { sevenDay: { remaining: sevenRemaining, untilResetMs: sevenUntil } },
+    ...sevenDayBurn === void 0 ? {} : { sevenDayBurn }
+  };
 }
-var NON_IDENTITY_BRACKET_RE, CONTEXT_MARKER_1M, DATE_STAMP_RE, KNOWN_VARIANTS, VENDOR_BY_NAMESPACE, VENDOR_BY_TOKEN;
-var init_identity2 = __esm({
-  "src/models/identity.ts"() {
-    "use strict";
-    NON_IDENTITY_BRACKET_RE = /\[[^\]]*\]/g;
-    CONTEXT_MARKER_1M = "[1m]";
-    DATE_STAMP_RE = /-(?:19|20)\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])$/;
-    KNOWN_VARIANTS = /* @__PURE__ */ new Set(["high", "medium", "low", "thinking", "xhigh", "max", "highspeed", "sol", "terra", "luna", "mini", "flash-lite", "turbo"]);
-    VENDOR_BY_NAMESPACE = Object.freeze({
-      anthropic: "anthropic",
-      google: "google",
-      openai: "openai",
-      zai: "zai",
-      "z-ai": "zai",
-      minimax: "minimax",
-      qwen: "qwen",
-      deepseek: "deepseek",
-      moonshot: "moonshot",
-      meta: "meta",
-      mistral: "mistral"
-    });
-    VENDOR_BY_TOKEN = Object.freeze({
-      claude: "anthropic",
-      gemini: "google",
-      antigravity: "google",
-      gpt: "openai",
-      glm: "zai",
-      minimax: "minimax",
-      qwen: "qwen",
-      deepseek: "deepseek",
-      kimi: "moonshot",
-      llama: "meta",
-      mistral: "mistral",
-      mixtral: "mistral"
-    });
+function poolFactsOf(member, nowMs, resuming, sticky) {
+  const { fiveHour, sevenDay, extraUsage } = quotaFactsOf(member.snapshot?.providers[ANTHROPIC_PROVIDER]?.rateLimit?.unified, nowMs);
+  const burn = windowBurn(member.records, "fiveHour");
+  return {
+    ...fiveHour === void 0 ? {} : { fiveHour },
+    ...sevenDay === void 0 ? {} : { sevenDay },
+    ...extraUsage === void 0 ? {} : { extraUsage },
+    ...burn === void 0 ? {} : { burnPerHour: burn * MS_PER_HOUR2 },
+    resuming,
+    ...sticky?.identity === member.identity ? { lastPickHoursAgo: Math.max(0, (nowMs - Date.parse(sticky.at)) / MS_PER_HOUR2) } : {}
+  };
+}
+function rankPool(input2) {
+  const { members: members2, nowMs } = input2;
+  const assessments = members2.map((member) => ({ member, ...assess(member, nowMs) }));
+  const demands = assessments.flatMap(({ candidate, burn }) => burn === void 0 ? [] : [burn * capacityOf(candidate.plan)]);
+  const sharedDemand = demands.length === 0 ? void 0 : Math.max(...demands);
+  const guarded2 = assessments.map((assessment) => {
+    const { candidate } = assessment;
+    if (candidate.class === "ineligible" || assessment.member.policy === void 0) {
+      return assessment;
+    }
+    const context = { nowMs, env: {}, pool: poolFactsOf(assessment.member, nowMs, input2.resuming, input2.sticky) };
+    const verdict = evaluateWhen(assessment.member.policy, context);
+    if (verdict.status === "indeterminate") {
+      return { ...assessment, candidate: { ...candidate, policyDemoted: true, reasons: [`policy undecided (${verdict.checked.join(", ") === "predicate" ? "predicate" : verdict.checked.join(", ")}): ${verdict.reason}`, ...candidate.reasons] } };
+    }
+    if (verdict.passed) {
+      return assessment;
+    }
+    return { ...assessment, candidate: { ...candidate, class: "ineligible", reasons: [`skipped by policy (${verdict.checked.join(", ")}: did not hold)`, ...candidate.reasons] } };
+  });
+  const candidates = guarded2.map((assessment) => {
+    const { candidate, fiveHour, burn } = assessment;
+    const pace = burn ?? (sharedDemand === void 0 ? void 0 : sharedDemand / capacityOf(candidate.plan));
+    const { sevenDay, sevenDayBurn } = assessment;
+    if (candidate.class !== "scored") {
+      return { ...candidate, feasible: true };
+    }
+    const drySpots = [];
+    const dryAfterMs = [];
+    if (fiveHour !== void 0 && pace !== void 0) {
+      const runsDryInMs = fiveHour.remaining / pace;
+      if (runsDryInMs < fiveHour.untilResetMs) {
+        dryAfterMs.push(runsDryInMs);
+        drySpots.push(`5h window would run dry in ${formatAge(runsDryInMs)}, before it resets in ${formatAge(fiveHour.untilResetMs)}`);
+      }
+    }
+    if (sevenDay !== void 0 && sevenDayBurn !== void 0) {
+      const runsDryInMs = sevenDay.remaining / sevenDayBurn;
+      if (runsDryInMs < sevenDay.untilResetMs) {
+        dryAfterMs.push(runsDryInMs);
+        drySpots.push(`7d window would run dry in ${formatAge(runsDryInMs)}, before it resets in ${formatAge(sevenDay.untilResetMs)}`);
+      }
+    }
+    const { sticky: sticky2 } = input2;
+    const warmHere = sticky2?.identity === candidate.identity && nowMs - Date.parse(sticky2.at) <= PROMPT_CACHE_TTL_MS;
+    if (input2.resuming && input2.resumeContextTokens !== void 0 && fiveHour !== void 0 && !warmHere) {
+      const perToken = utilisationPerBilledToken(assessment.member.records);
+      const committed = input2.committedContextTokens?.[candidate.identity] ?? 0;
+      const cost = perToken === void 0 ? void 0 : (input2.resumeContextTokens + committed) * perToken;
+      if (cost !== void 0 && cost > fiveHour.remaining) {
+        dryAfterMs.push(0);
+        const alongside = committed === 0 ? "" : ` (with ${String(committed)} tokens of other conversations already moving here)`;
+        drySpots.push(`resuming a ${String(input2.resumeContextTokens)}-token conversation here${alongside} would cost about ${percent(cost)} of the 5h window, which has ${percent(fiveHour.remaining)} left`);
+      }
+    }
+    if (drySpots.length === 0) {
+      return { ...candidate, feasible: true };
+    }
+    return { ...candidate, feasible: false, runsDryAtMs: nowMs + Math.min(...dryAfterMs), reasons: [...drySpots, ...candidate.reasons] };
+  });
+  const ordered = input2.preference === "listed" ? [...candidates] : [...candidates].sort(
+    (left, right) => CLASS_ORDER[left.class] - CLASS_ORDER[right.class] || Number(left.policyDemoted ?? false) - Number(right.policyDemoted ?? false) || Number(right.feasible) - Number(left.feasible) || (right.headroom ?? 1) - (left.headroom ?? 1) || (right.score ?? 0) - (left.score ?? 0) || left.identity.localeCompare(right.identity)
+  );
+  const sticky = input2.sticky;
+  const stickyIndex = sticky === void 0 ? -1 : ordered.findIndex((candidate) => candidate.identity === sticky.identity);
+  const stickyCandidate = ordered[stickyIndex];
+  const keepSticky = stickyCandidate?.class === "scored" && stickyCandidate.feasible;
+  if (sticky !== void 0 && keepSticky) {
+    const ageMs = nowMs - Date.parse(sticky.at);
+    const warm = ageMs <= PROMPT_CACHE_TTL_MS;
+    if (input2.resuming || warm) {
+      const why = warm ? `used here ${formatAge(ageMs)} ago, prompt cache still warm` : "resuming a conversation started on this account";
+      ordered.splice(stickyIndex, 1);
+      ordered.unshift({ ...stickyCandidate, reasons: [why, ...stickyCandidate.reasons] });
+    }
+  }
+  const movedOff = sticky !== void 0 && input2.resuming && !keepSticky ? { identity: sticky.identity, reason: stickyCandidate?.reasons[0] ?? "no longer among the pool's members" } : void 0;
+  const pick2 = ordered.find((candidate) => candidate.class !== "ineligible");
+  const returns = ordered.flatMap((candidate) => candidate.blockedUntilMs === void 0 ? [] : [{ identity: candidate.identity, atMs: candidate.blockedUntilMs }]);
+  const earliestReturn = returns.length === 0 ? void 0 : returns.reduce((soonest, entry) => entry.atMs < soonest.atMs ? entry : soonest);
+  const holdForReturn = pick2?.runsDryAtMs === void 0 ? void 0 : returns.filter((entry) => entry.atMs < (pick2.runsDryAtMs ?? 0)).reduce((soonest, entry) => soonest === void 0 || entry.atMs < soonest.atMs ? entry : soonest, void 0);
+  return {
+    candidates: ordered,
+    ...pick2 === void 0 ? { ...earliestReturn === void 0 ? {} : { earliestReturn } } : { pick: pick2 },
+    ...movedOff === void 0 || pick2 === void 0 ? {} : { movedOff },
+    ...pick2?.planReturnsAtMs === void 0 ? {} : { planReturn: { identity: pick2.identity, atMs: pick2.planReturnsAtMs } },
+    ...holdForReturn === void 0 ? {} : { holdForReturn }
+  };
+}
+var MS_PER_SECOND5, MS_PER_HOUR2, HOURS_PER_DAY2, FIVE_HOURS, PROMPT_CACHE_TTL_HOURS, PERCENT, SEVEN_DAYS, FIVE_HOUR_WINDOW_MS, SEVEN_DAY_WINDOW_MS, PROMPT_CACHE_TTL_MS, CLASS_ORDER;
+var init_pick = __esm({
+  "src/usage/pick.ts"() {
+    "use strict";
+    init_conditions();
+    init_plan2();
+    init_middleware();
+    init_preflight();
+    init_quotaFacts();
+    init_rateLimit();
+    MS_PER_SECOND5 = 1e3;
+    MS_PER_HOUR2 = 36e5;
+    HOURS_PER_DAY2 = 24;
+    FIVE_HOURS = 5;
+    PROMPT_CACHE_TTL_HOURS = 1;
+    PERCENT = 100;
+    SEVEN_DAYS = 7;
+    FIVE_HOUR_WINDOW_MS = FIVE_HOURS * MS_PER_HOUR2;
+    SEVEN_DAY_WINDOW_MS = SEVEN_DAYS * HOURS_PER_DAY2 * MS_PER_HOUR2;
+    PROMPT_CACHE_TTL_MS = PROMPT_CACHE_TTL_HOURS * MS_PER_HOUR2;
+    CLASS_ORDER = { scored: 0, unknown: 1, "pay-per-use": 2, ineligible: 3 };
   }
 });
 
-// src/models/families.ts
-function modelOf(ref) {
-  const slash = ref.indexOf("/");
-  return slash === -1 ? ref : ref.slice(slash + 1);
-}
-function familyKeyOf(rawModel) {
-  const identity = modelIdentity(rawModel);
-  return identity.variant === "" ? identity.familyAndVersion : `${identity.familyAndVersion}${VARIANT_SEPARATOR}${identity.variant}`;
-}
-function assertionsOf(models) {
-  return { same: models?.same ?? [], distinct: models?.distinct ?? [] };
+// src/usage/read.ts
+function segmentDay(epochMs) {
+  return new Date(epochMs).toISOString().slice(0, "YYYY-MM-DD".length);
 }
-function sameModel(left, right, assertions) {
-  if (assertions.distinct.some(([a10, b]) => a10 === left && b === right || a10 === right && b === left)) {
-    return false;
-  }
-  const leftGroup = assertions.same.find((group) => group.includes(left));
-  const rightGroup = assertions.same.find((group) => group.includes(right));
-  if (leftGroup !== void 0 && leftGroup === rightGroup) {
-    return true;
-  }
-  if (leftGroup !== void 0 && !leftGroup.includes(right) || rightGroup !== void 0 && !rightGroup.includes(left)) {
-    return false;
-  }
-  return relateModels(modelOf(left), modelOf(right)) === "same";
+function segmentName(day, pid) {
+  return `${day}.${String(pid)}.jsonl`;
 }
-function pinnedTo(settings2, ref) {
-  return settings2?.names?.some((name) => name === ref || name === modelOf(ref)) === true;
+function listLogSegments(fs31, logDir) {
+  return fs31.readdir(logDir).flatMap((name) => {
+    const match = SEGMENT_RE.exec(name);
+    const day = match?.[1];
+    if (day === void 0) {
+      return [];
+    }
+    return [{ name, day, endsAt: Date.parse(`${day}T00:00:00.000Z`) + DAY_MS }];
+  }).sort((left, right) => left.day.localeCompare(right.day) || left.name.localeCompare(right.name));
 }
-function buildFamilies(refs, models) {
-  const assertions = assertionsOf(models);
-  const settingsByKey = models?.families ?? {};
-  const groups = [];
-  for (const ref of refs) {
-    const pinnedKey = Object.entries(settingsByKey).find(([, settings2]) => pinnedTo(settings2, ref))?.[0];
-    const joined3 = groups.find((group) => pinnedKey === void 0 ? group.refs.some((first) => sameModel(first, ref, assertions)) : group.key === pinnedKey);
-    if (joined3 !== void 0) {
-      joined3.refs.push(ref);
-    } else {
-      groups.push({ key: pinnedKey ?? familyKeyOf(modelOf(ref)), refs: [ref] });
+function readUsageLog(fs31, logDir, options = {}) {
+  const { sinceMs } = options;
+  const records = [];
+  let invalidLines = 0;
+  for (const segment of listLogSegments(fs31, logDir)) {
+    if (sinceMs !== void 0 && segment.endsAt <= sinceMs) {
+      continue;
+    }
+    const read = readSegment(fs31, logDir, segment);
+    if (read === void 0) {
+      continue;
+    }
+    invalidLines += read.invalidLines;
+    for (const record2 of read.records) {
+      if (sinceMs === void 0 || Date.parse(record2.at) >= sinceMs) {
+        records.push(record2);
+      }
     }
   }
-  return groups.map((group) => ({ key: group.key, refs: group.refs, settings: settingsByKey[group.key] ?? {} }));
+  records.sort((left, right) => left.at.localeCompare(right.at));
+  return { records, invalidLines };
 }
-function familyNamed(families, member) {
-  if (!member.startsWith(FAMILY_PREFIX)) {
+function readSegment(fs31, logDir, segment) {
+  const contents = fs31.readFileUtf8(import_node_path26.default.join(logDir, segment.name));
+  if (contents === void 0) {
     return void 0;
   }
-  const key = member.slice(FAMILY_PREFIX.length);
-  return families.find((family) => family.key === key);
-}
-function familyCapabilities(settings2) {
-  return { vision: settings2.vision ?? true, tools: settings2.tools ?? true, thinking: settings2.thinking ?? true };
-}
-function familyMode(settings2) {
-  return settings2.mode ?? "ordered";
-}
-function sharedFamilies(families) {
-  return families.filter((family) => family.refs.length > 1);
-}
-function expandFamilyMembers(members2, families) {
-  const expanded = [];
-  for (const member of members2) {
-    for (const ref of member.startsWith(FAMILY_PREFIX) ? familyNamed(families, member)?.refs ?? [] : [member]) {
-      if (!expanded.includes(ref)) {
-        expanded.push(ref);
-      }
+  const records = [];
+  let invalidLines = 0;
+  const lines = contents.split("\n");
+  lines.pop();
+  for (const line of lines) {
+    if (line === "") {
+      continue;
+    }
+    let raw;
+    try {
+      raw = JSON.parse(line);
+    } catch {
+      invalidLines += 1;
+      continue;
+    }
+    const parsed = UsageRecordSchema.safeParse(raw);
+    if (!parsed.success) {
+      invalidLines += 1;
+      continue;
     }
+    records.push(parsed.data);
   }
-  return expanded;
-}
-function familyOfRef(families, ref) {
-  return families.find((family) => family.refs.includes(ref));
-}
-function accountRefsOf(models) {
-  const named = [...(models?.same ?? []).flat(), ...Object.values(models?.families ?? {}).flatMap((settings2) => settings2.names ?? [])];
-  return [...new Set(named.filter((ref) => ref.startsWith("acct:")))];
+  return { records, invalidLines };
 }
-var FAMILY_PREFIX, VARIANT_SEPARATOR;
-var init_families = __esm({
-  "src/models/families.ts"() {
-    "use strict";
-    init_identity2();
-    FAMILY_PREFIX = "family:";
-    VARIANT_SEPARATOR = "+";
+function readRecentUsageRecords(fs31, logDir, count2) {
+  const byDay = /* @__PURE__ */ new Map();
+  for (const segment of listLogSegments(fs31, logDir)) {
+    byDay.set(segment.day, [...byDay.get(segment.day) ?? [], segment]);
   }
-});
-
-// src/providersStore.ts
-function providerJsonPath(paths, name) {
-  return providerFilePath(paths.providersDir, name);
-}
-function providerFileDefined(lstat, providersDir, name) {
-  return isStoredName(name) && lstat(providerFilePath(providersDir, name)) !== void 0;
-}
-function providerExists(paths, name) {
-  return import_node_fs11.default.existsSync(providerJsonPath(paths, name));
-}
-function isRecord4(value2) {
-  return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+  const days = [...byDay.values()];
+  let records = [];
+  for (let index = days.length - 1; index >= 0; index -= 1) {
+    const dayRecords = [];
+    for (const segment of days[index] ?? []) {
+      dayRecords.push(...readSegment(fs31, logDir, segment)?.records ?? []);
+    }
+    records = [...dayRecords, ...records];
+    records.sort((left, right) => left.at.localeCompare(right.at));
+    const olderDay = days[index - 1]?.[0];
+    const newestHeld = records[records.length - count2];
+    if (olderDay === void 0 || newestHeld !== void 0 && Date.parse(newestHeld.at) >= olderDay.endsAt) {
+      break;
+    }
+  }
+  return records.slice(-count2);
 }
-function legacyProviderConversion(raw) {
-  if (!isRecord4(raw) || "credential" in raw) {
-    return void 0;
+function snapshotPath(snapshotsDir, identity) {
+  if (!isIdentityName(identity)) {
+    throw new Error(`"${identity}" is not a valid identity name.`);
   }
-  const env = isRecord4(raw.env) ? raw.env : void 0;
-  const legacyEnvKeys = env === void 0 ? [] : Object.keys(env).filter((key) => LEGACY_ENV_CREDENTIAL_KEYS.includes(key));
-  const fields = [...LEGACY_PROVIDER_FIELDS.filter((field) => field in raw), ...legacyEnvKeys.map((key) => `env.${key}`)];
-  if (fields.length === 0) {
+  return import_node_path26.default.join(snapshotsDir, `${identity}.json`);
+}
+function readUsageSnapshot(fs31, snapshotsDir, identity) {
+  const file2 = snapshotPath(snapshotsDir, identity);
+  const raw = fs31.readFileUtf8(file2);
+  if (raw === void 0) {
     return void 0;
   }
-  const sources = [];
-  if (typeof raw.tokenEnv === "string") {
-    sources.push({ env: raw.tokenEnv });
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new UsageSnapshotError(file2, "not valid JSON");
   }
-  if (Array.isArray(raw.tokenCommand)) {
-    sources.push({ command: raw.tokenCommand });
+  const snapshot = UsageSnapshotSchema.safeParse(parsed);
+  if (!snapshot.success) {
+    throw new UsageSnapshotError(file2, snapshot.error.issues.map((issue2) => `${issue2.path.join(".")}: ${issue2.message}`).join("; "));
   }
-  if (typeof env?.ANTHROPIC_AUTH_TOKEN === "string" && env.ANTHROPIC_AUTH_TOKEN !== "") {
-    sources.push({ literal: LEGACY_LITERAL_PLACEHOLDER });
+  return snapshot.data;
+}
+function listUsageSnapshots(fs31, snapshotsDir) {
+  return fs31.readdir(snapshotsDir).flatMap((name) => {
+    if (!name.endsWith(".json")) {
+      return [];
+    }
+    const identity = name.slice(0, -".json".length);
+    if (!isIdentityName(identity)) {
+      return [];
+    }
+    const snapshot = readUsageSnapshot(fs31, snapshotsDir, identity);
+    return snapshot === void 0 ? [] : [snapshot];
+  }).sort((left, right) => left.identity.localeCompare(right.identity));
+}
+function summariseUsage(records) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const record2 of records) {
+    const key = `${record2.identity ?? ""}\0${record2.provider}`;
+    const group = groups.get(key);
+    if (group === void 0) {
+      groups.set(key, [record2]);
+    } else {
+      group.push(record2);
+    }
   }
-  const remainingEnv = env === void 0 ? void 0 : Object.fromEntries(Object.entries(env).filter(([key]) => !LEGACY_ENV_CREDENTIAL_KEYS.includes(key)));
-  const replacedKeys = [...LEGACY_PROVIDER_FIELDS, "env"];
-  const rest = Object.fromEntries(Object.entries(raw).filter(([key]) => !replacedKeys.includes(key)));
-  return {
-    fields,
-    replacement: {
-      ...rest,
-      credential: { sources, ...raw.authScheme === "apiKey" ? { target: "apiKey" } : {} },
-      ...remainingEnv === void 0 || Object.keys(remainingEnv).length === 0 ? {} : { env: remainingEnv }
+  const summaries = [...groups.values()].flatMap((group) => {
+    const [first] = group;
+    const last = group.at(-1);
+    if (first === void 0 || last === void 0) {
+      return [];
     }
-  };
+    const modelCounts = /* @__PURE__ */ new Map();
+    for (const record2 of group) {
+      if (record2.model !== void 0) {
+        modelCounts.set(record2.model, (modelCounts.get(record2.model) ?? 0) + 1);
+      }
+    }
+    const sum2 = (field) => group.reduce((total, record2) => total + (record2.usage?.[field] ?? 0), 0);
+    return [
+      {
+        identity: first.identity,
+        provider: first.provider,
+        requests: group.length,
+        failed: group.filter((record2) => record2.status >= FIRST_ERROR_STATUS).length,
+        limits: {
+          "rate-limited": group.filter((record2) => record2.limit?.kind === "rate-limited").length,
+          "quota-exhausted": group.filter((record2) => record2.limit?.kind === "quota-exhausted").length
+        },
+        tokens: {
+          inputTokens: sum2("inputTokens"),
+          outputTokens: sum2("outputTokens"),
+          cacheCreationInputTokens: sum2("cacheCreationInputTokens"),
+          cacheReadInputTokens: sum2("cacheReadInputTokens")
+        },
+        firstAt: first.at,
+        lastAt: last.at,
+        models: [...modelCounts.entries()].sort((left, right) => right[1] - left[1] || left[0].localeCompare(right[0])).map(([model]) => model)
+      }
+    ];
+  });
+  return summaries.sort((left, right) => (left.identity ?? "").localeCompare(right.identity ?? "") || left.provider.localeCompare(right.provider));
 }
-function parseProviderFile(filePath, raw) {
-  const conversion = legacyProviderConversion(raw);
-  if (conversion !== void 0) {
-    throw new LegacyProviderFileError(filePath, conversion);
+var import_node_path26, SEGMENT_RE, DAY_MS, UsageSnapshotError, FIRST_ERROR_STATUS;
+var init_read = __esm({
+  "src/usage/read.ts"() {
+    "use strict";
+    import_node_path26 = __toESM(require("node:path"), 1);
+    init_account();
+    init_schema2();
+    SEGMENT_RE = /^(\d{4}-\d{2}-\d{2})\.(\d+)\.jsonl$/;
+    DAY_MS = 864e5;
+    UsageSnapshotError = class extends Error {
+      constructor(file2, detail) {
+        super(`${file2} is not a usage snapshot this agent-shim can read (schema version ${String(USAGE_SCHEMA_VERSION)}): ${detail}`);
+        this.file = file2;
+        this.name = "UsageSnapshotError";
+      }
+      file;
+    };
+    FIRST_ERROR_STATUS = 400;
   }
-  const parsed = parseIgnoringUnrecognisedKeys(ProviderSchema, raw);
-  if (!parsed.success) {
-    throw new ConfigValidationError(filePath, parsed.issues);
+});
+
+// src/usage/store.ts
+function pruneUsageLog(fs31, logDir, nowMs) {
+  const cutoff = nowMs - USAGE_RETENTION_MS;
+  for (const segment of listLogSegments(fs31, logDir)) {
+    if (segment.endsAt <= cutoff) {
+      fs31.removeRecursive(import_node_path27.default.join(logDir, segment.name));
+    }
   }
-  noteIgnoredKeys(filePath, parsed.ignored);
-  return parsed.data;
 }
-function readProvider(paths, name) {
-  const filePath = providerJsonPath(paths, name);
-  if (!import_node_fs11.default.existsSync(filePath)) {
-    return void 0;
-  }
-  const raw = JSON.parse(import_node_fs11.default.readFileSync(filePath, "utf8"));
-  return parseProviderFile(filePath, raw);
+function later(left, right) {
+  return left.localeCompare(right) >= 0 ? left : right;
 }
-function loadProvider(providersDir, name, port) {
-  const filePath = providerFilePath(providersDir, name);
-  const raw = port.readConfigFile(filePath);
-  return raw === void 0 ? void 0 : parseProviderFile(filePath, raw);
+function observedAt(record2) {
+  return new Date(Date.parse(record2.at) + record2.latencyMs).toISOString();
 }
-function reportInvalidProvider(name, message) {
-  console.error(`agent-shim: providers/${name}.json is invalid and was skipped: ${message}`);
+function foldProviderState(current, record2) {
+  const seen = observedAt(record2);
+  const newest = current?.lastRequestAt === void 0 || record2.at.localeCompare(current.lastRequestAt) >= 0;
+  const rateLimit = record2.rateLimitHeaders === void 0 || current?.rateLimit !== void 0 && current.rateLimit.observedAt.localeCompare(seen) > 0 ? current?.rateLimit : (() => {
+    const unified = parseUnifiedRateLimit(record2.rateLimitHeaders);
+    return { observedAt: seen, headers: record2.rateLimitHeaders, ...unified === void 0 ? {} : { unified } };
+  })();
+  const lastLimit = record2.limit === void 0 || current?.lastLimit !== void 0 && current.lastLimit.observedAt.localeCompare(seen) > 0 ? current?.lastLimit : { ...record2.limit, observedAt: seen, status: record2.status };
+  const lastModel = newest ? record2.model ?? current?.lastModel : current.lastModel ?? record2.model;
+  return {
+    lastRequestAt: current?.lastRequestAt === void 0 ? record2.at : later(current.lastRequestAt, record2.at),
+    ...newest ? { lastStatus: record2.status } : current.lastStatus === void 0 ? {} : { lastStatus: current.lastStatus },
+    ...lastModel === void 0 ? {} : { lastModel },
+    ...rateLimit === void 0 ? {} : { rateLimit },
+    ...lastLimit === void 0 ? {} : { lastLimit },
+    ...current?.quota === void 0 ? {} : { quota: current.quota }
+  };
 }
-function listProviders(paths, onInvalid = reportInvalidProvider) {
-  const names = listProviderNames(
-    (dir) => import_node_fs11.default.readdirSync(dir),
-    paths.providersDir
-  );
-  const result = [];
-  for (const name of names) {
-    let provider;
+function createUsageStore(deps) {
+  const { fs: fs31, paths } = deps;
+  let prunedDay;
+  const rewriteSnapshot = (identity, fold) => {
+    if (!isIdentityName(identity)) {
+      deps.log(`usage: no snapshot for identity "${identity}", which is not a valid identity name`);
+      return false;
+    }
+    let current;
     try {
-      provider = readProvider(paths, name);
+      current = readUsageSnapshot(fs31, paths.usageSnapshotsDir, identity);
     } catch (error63) {
-      if (!(error63 instanceof ConfigValidationError || error63 instanceof LegacyProviderFileError || error63 instanceof UnsafeNameError)) {
+      if (!(error63 instanceof UsageSnapshotError)) {
         throw error63;
       }
-      onInvalid(name, error63.message);
-      continue;
+      deps.log(`usage: replacing an unreadable snapshot: ${error63.message}`);
     }
-    if (provider !== void 0) {
-      result.push({ name, provider });
+    const providers = fold(current);
+    if (providers === void 0) {
+      return false;
     }
-  }
-  return result;
-}
-function listProviderNames(readdir, providersDir) {
-  let entries;
-  try {
-    entries = readdir(providersDir);
-  } catch {
-    return [];
-  }
-  return entries.filter((entry) => entry.endsWith(".json")).map((entry) => entry.slice(0, -".json".length)).sort();
-}
-function describeProviderEndpoint(provider) {
-  if (isCodexProvider(provider)) {
-    return "codex translation daemon";
-  }
-  if (isAntigravityProvider(provider)) {
-    return (provider.antigravity?.mode ?? ANTIGRAVITY_DEFAULT_MODE) === "local" ? "antigravity local (ACP daemon)" : "antigravity cloud (Gemini API)";
-  }
-  return isRouterProvider(provider) ? "the models block" : provider.baseUrl;
-}
-function isEmptyCodexConfig(config2) {
-  return config2 === void 0 || config2.defaultModel === void 0 && config2.effort === void 0 && config2.login === void 0 && (config2.models === void 0 || Object.keys(config2.models).length === 0);
-}
-function isEmptyAntigravityConfig(config2) {
-  return config2 === void 0 || config2.mode === void 0 && config2.defaultModel === void 0 && config2.effort === void 0 && config2.degradeDownTiers === void 0 && config2.cloud === void 0 && config2.local === void 0 && (config2.models === void 0 || Object.keys(config2.models).length === 0);
-}
-function addProvider(paths, name, input2) {
-  if (providerExists(paths, name)) {
-    throw new ProviderAlreadyExistsError(name);
-  }
-  requireNewProviderName(name);
-  const kind = input2.kind ?? "http";
-  if (kind === "codex" && input2.baseUrl !== void 0) {
-    throw new ProviderKindMismatchError("A codex provider has no base URL: the launcher points its sessions at the front-door daemon. Drop --base-url.");
-  }
-  if (kind === "antigravity" && input2.baseUrl !== void 0) {
-    throw new ProviderKindMismatchError("An antigravity provider has no base URL: the launcher points its sessions at the front-door daemon. Drop --base-url.");
-  }
-  if (kind === "router" && input2.baseUrl !== void 0) {
-    throw new ProviderKindMismatchError("A router provider has no base URL: it resolves each request's model name through the models block. Drop --base-url.");
-  }
-  if (kind === "http" && input2.baseUrl === void 0) {
-    throw new ProviderKindMismatchError("An http provider needs --base-url.");
-  }
-  if (kind === "router" && (input2.sources.length > 0 || input2.target !== void 0 || input2.env !== void 0 || input2.pickerModels !== void 0)) {
-    throw new ProviderKindMismatchError("A router provider has no credential, env or picker models of its own: the models block's targets carry their own.");
-  }
-  if (kind !== "http" && kind !== "router" && input2.catalogue !== void 0) {
-    throw new ProviderKindMismatchError("A model catalogue applies only to an http provider.");
-  }
-  if (kind !== "codex" && !isEmptyCodexConfig(input2.codex)) {
-    throw new ProviderKindMismatchError("Codex settings apply only to a codex provider (--kind codex).");
-  }
-  if (kind !== "antigravity" && !isEmptyAntigravityConfig(input2.antigravity)) {
-    throw new ProviderKindMismatchError("Antigravity settings apply only to an antigravity provider (--kind antigravity).");
-  }
-  const shared = {
-    displayName: input2.displayName,
-    credential: { sources: input2.sources, ...input2.target === void 0 ? {} : { target: input2.target } },
-    ...input2.env === void 0 || Object.keys(input2.env).length === 0 ? {} : { env: input2.env },
-    ...input2.pickerModels === void 0 || input2.pickerModels.length === 0 ? {} : { pickerModels: input2.pickerModels }
+    let account;
+    try {
+      account = deps.readAccount(identity);
+    } catch (error63) {
+      if (!(error63 instanceof AccountMetadataError)) {
+        throw error63;
+      }
+      deps.log(`usage: snapshot for ${identity} written without account metadata: ${error63.message}`);
+    }
+    const snapshot = UsageSnapshotSchema.parse({
+      schemaVersion: USAGE_SCHEMA_VERSION,
+      identity,
+      updatedAt: new Date(deps.now()).toISOString(),
+      ...account === void 0 ? {} : { account },
+      providers
+    });
+    fs31.mkdirPrivate(paths.usageSnapshotsDir);
+    fs31.writeFilePrivate(snapshotPath(paths.usageSnapshotsDir, identity), `${JSON.stringify(snapshot, null, 2)}
+`);
+    deps.publish?.(snapshot);
+    return true;
+  };
+  return {
+    record: (input2) => {
+      const record2 = UsageRecordSchema.parse(input2);
+      const nowMs = deps.now();
+      fs31.mkdirPrivate(paths.usageDir);
+      fs31.mkdirPrivate(paths.usageLogDir);
+      const day = segmentDay(nowMs);
+      if (prunedDay !== day) {
+        pruneUsageLog(fs31, paths.usageLogDir, nowMs);
+        prunedDay = day;
+      }
+      fs31.appendFilePrivate(import_node_path27.default.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record2)}
+`);
+      deps.onRecord?.(record2);
+      if (record2.identity !== void 0) {
+        rewriteSnapshot(record2.identity, (current) => ({ ...current?.providers, [record2.provider]: foldProviderState(current?.providers[record2.provider], record2) }));
+      }
+    },
+    recordQuota: (identity, provider, quota) => rewriteSnapshot(identity, (current) => {
+      const state = current?.providers[provider];
+      if (current === void 0 || state === void 0) {
+        return void 0;
+      }
+      const keep = state.quota !== void 0 && state.quota.observedAt.localeCompare(quota.observedAt) > 0;
+      return { ...current.providers, [provider]: { ...state, quota: keep ? state.quota : quota } };
+    }),
+    recordRateLimit: (identity, provider, rateLimit) => rewriteSnapshot(identity, (current) => {
+      const state = current?.providers[provider] ?? {};
+      const keep = state.rateLimit !== void 0 && state.rateLimit.observedAt.localeCompare(rateLimit.observedAt) > 0;
+      const earlier = state.rateLimit;
+      const merged = rateLimit.unified === void 0 ? { ...earlier ?? rateLimit, planWindowsUnavailableAt: rateLimit.observedAt } : { ...rateLimit, unified: { ...earlier?.unified === void 0 ? {} : overageFactsOf(earlier.unified), ...rateLimit.unified } };
+      return { ...current?.providers, [provider]: { ...state, rateLimit: keep ? state.rateLimit : merged } };
+    })
   };
-  const parsed = ProviderSchema.safeParse(
-    kind === "router" ? { kind, displayName: input2.displayName } : kind === "codex" ? { kind, ...shared, ...isEmptyCodexConfig(input2.codex) ? {} : { codex: input2.codex } } : kind === "antigravity" ? { kind, ...shared, ...isEmptyAntigravityConfig(input2.antigravity) ? {} : { antigravity: input2.antigravity } } : { ...shared, baseUrl: input2.baseUrl, ...input2.catalogue === void 0 ? {} : { catalogue: input2.catalogue } }
-  );
-  if (!parsed.success) {
-    throw new ConfigValidationError(providerJsonPath(paths, name), parsed.error.issues);
-  }
-  writeJsonAtomic(providerJsonPath(paths, name), parsed.data);
-  return parsed.data;
 }
-function updateProvider(paths, name, input2) {
-  const existing = readProvider(paths, name);
-  if (existing === void 0) {
-    throw new ProviderNotFoundError(name);
+var import_node_path27, DAY_MS2, DAYS_IN_WEEK2, USAGE_RETENTION_MS;
+var init_store2 = __esm({
+  "src/usage/store.ts"() {
+    "use strict";
+    import_node_path27 = __toESM(require("node:path"), 1);
+    init_account();
+    init_rateLimit();
+    init_read();
+    init_schema2();
+    DAY_MS2 = 864e5;
+    DAYS_IN_WEEK2 = 7;
+    USAGE_RETENTION_MS = DAYS_IN_WEEK2 * DAY_MS2;
   }
-  const unset = new Set(input2.unsetEnv);
-  const existingEnv = isRouterProvider(existing) ? {} : existing.env;
-  const env = Object.fromEntries(Object.entries({ ...existingEnv, ...input2.env }).filter(([key]) => !unset.has(key)));
-  const unsetPicker = new Set(input2.unsetPickerModels);
-  const added = new Map((input2.pickerModels ?? []).map((entry) => [entry.model, entry]));
-  const existingPicker = isRouterProvider(existing) ? [] : existing.pickerModels;
-  const pickerModels = [
-    ...(existingPicker ?? []).filter((entry) => !unsetPicker.has(entry.model)).map((entry) => added.get(entry.model) ?? entry),
-    ...[...added.values()].filter((entry) => !(existingPicker ?? []).some((kept) => kept.model === entry.model))
-  ];
-  const router = isRouterProvider(existing);
-  const target = router ? void 0 : input2.target ?? existing.credential.target;
-  const cache = router ? void 0 : input2.cache === void 0 ? existing.credential.cache : input2.cache === false ? void 0 : input2.cache;
-  if (isCodexProvider(existing) && input2.baseUrl !== void 0) {
-    throw new ProviderKindMismatchError(`Provider "${name}" is a codex provider, which has no base URL.`);
+});
+
+// src/usage/poolPick.ts
+function errorMessage(error63) {
+  return error63 instanceof Error ? error63.message : String(error63);
+}
+function loadPoolMembers(fs31, paths, identities, nowMs) {
+  const windowStartMs = nowMs - FIVE_HOUR_WINDOW_MS;
+  const log = readUsageLog(fs31, paths.usageLogDir, { sinceMs: windowStartMs });
+  return identities.map((identity) => {
+    const records = log.records.filter((record2) => record2.identity === identity && record2.provider === ANTHROPIC_PROVIDER && Date.parse(record2.at) >= windowStartMs);
+    try {
+      const snapshot = readUsageSnapshot(fs31, paths.usageSnapshotsDir, identity);
+      const account = readAccountMetadata(fs31, paths.identitiesDir, identity) ?? snapshot?.account;
+      return { identity, records, ...snapshot === void 0 ? {} : { snapshot }, ...account === void 0 ? {} : { account } };
+    } catch (error63) {
+      if (error63 instanceof UsageSnapshotError || error63 instanceof AccountMetadataError) {
+        return { identity, records, readError: errorMessage(error63) };
+      }
+      throw error63;
+    }
+  });
+}
+function rankPoolGraph(input2) {
+  return rankNamedPool(input2, input2.poolName, [], input2.sticky);
+}
+function rankNamedPool(input2, poolName, stack, sticky) {
+  const pool = input2.pools[poolName];
+  if (pool === void 0) {
+    throw new PoolGraphError(`No pool named "${poolName}". Run \`agent-shim pool add ${poolName} --identity <name>...\` first.`);
   }
-  if (isAntigravityProvider(existing) && input2.baseUrl !== void 0) {
-    throw new ProviderKindMismatchError(`Provider "${name}" is an antigravity provider, which has no base URL.`);
+  const childStack = [...stack, poolName];
+  const direct = pool.identities.filter((entry) => poolNameOf(poolMemberIdentity(entry)) === void 0);
+  const missing = direct.filter((entry) => !input2.identityExists(poolMemberIdentity(entry))).map((entry) => ({ pool: poolName, identity: poolMemberIdentity(entry) }));
+  const loaded = new Map(loadPoolMembers(input2.fs, input2.paths, direct.filter((entry) => input2.identityExists(poolMemberIdentity(entry))).map(poolMemberIdentity), input2.nowMs).map((member) => [member.identity, member]));
+  const members2 = [];
+  for (const entry of pool.identities) {
+    const nestedName = poolNameOf(poolMemberIdentity(entry));
+    if (nestedName === void 0) {
+      const member = loaded.get(poolMemberIdentity(entry));
+      if (member !== void 0) {
+        members2.push(typeof entry === "string" ? member : { ...member, policy: entry.when });
+      }
+      continue;
+    }
+    assertNestable(input2.pools, poolName, poolMemberIdentity(entry), nestedName, childStack);
+    const nested = nestedMember(input2, nestedName, childStack, sticky);
+    members2.push(typeof entry === "string" ? nested.member : { ...nested.member, policy: entry.when });
+    missing.push(...nested.missing);
   }
-  if ((isCodexProvider(existing) || isAntigravityProvider(existing)) && input2.catalogue !== void 0 && input2.catalogue !== false) {
-    throw new ProviderKindMismatchError(`Provider "${name}" is not an http provider; a model catalogue applies only to an http provider.`);
+  const ranking = rankPool({
+    members: members2,
+    nowMs: input2.nowMs,
+    resuming: input2.resuming,
+    ...input2.resumeContextTokens === void 0 ? {} : { resumeContextTokens: input2.resumeContextTokens },
+    ...input2.committedContextTokens === void 0 ? {} : { committedContextTokens: input2.committedContextTokens },
+    ...sticky === void 0 ? {} : { sticky },
+    ...pool.preference === void 0 ? {} : { preference: pool.preference }
+  });
+  return { ranking, missing };
+}
+function assertNestable(pools, poolName, member, nestedName, childStack) {
+  if (pools[nestedName] === void 0) {
+    throw new PoolGraphError(`Pool "${poolName}" member "${member}" names a pool that is not defined.`);
   }
-  if (!isCodexProvider(existing) && !isEmptyCodexConfig(input2.codex)) {
-    throw new ProviderKindMismatchError(`Provider "${name}" is not a codex provider; codex settings apply only to a codex provider.`);
+  if (childStack.includes(nestedName)) {
+    throw new PoolGraphError(`Pool "${poolName}" member "${member}" closes a cycle: ${[...childStack.slice(childStack.indexOf(nestedName)), nestedName].join(" -> ")}. A pool cannot nest itself, directly or through another pool.`);
   }
-  if (!isAntigravityProvider(existing) && !isEmptyAntigravityConfig(input2.antigravity)) {
-    throw new ProviderKindMismatchError(`Provider "${name}" is not an antigravity provider; antigravity settings apply only to an antigravity provider.`);
+}
+function nestedMember(input2, nestedName, childStack, sticky) {
+  const nested = rankNamedPool(input2, nestedName, childStack, sticky);
+  const pick2 = nested.ranking.pick;
+  if (pick2 !== void 0) {
+    const [member] = loadPoolMembers(input2.fs, input2.paths, [pick2.identity], input2.nowMs);
+    return { member: { ...member ?? { identity: pick2.identity, records: [] }, nested: { kind: "pick", pool: nestedName, reasons: pick2.reasons } }, missing: nested.missing };
   }
-  const shared = {
-    ...input2.displayName === void 0 ? {} : { displayName: input2.displayName },
-    ...router ? {} : {
-      credential: {
-        sources: input2.sources ?? existing.credential.sources,
-        ...target === void 0 ? {} : { target },
-        ...cache === void 0 ? {} : { cache }
-      }
+  const earliestReturn = nested.ranking.earliestReturn;
+  return {
+    member: {
+      identity: earliestReturn?.identity ?? `pool:${nestedName}`,
+      records: [],
+      nested: { kind: "refused", pool: nestedName, ...earliestReturn === void 0 ? {} : { earliestReturn } }
     },
-    env: Object.keys(env).length === 0 ? void 0 : env,
-    pickerModels: pickerModels.length === 0 ? void 0 : pickerModels
+    missing: nested.missing
   };
-  let candidate;
-  if (isCodexProvider(existing)) {
-    const codex = {
-      ...existing.codex,
-      ...input2.codex,
-      ...existing.codex?.models === void 0 && input2.codex?.models === void 0 ? {} : { models: { ...existing.codex?.models, ...input2.codex?.models } }
-    };
-    candidate = { ...existing, ...shared, codex: isEmptyCodexConfig(codex) ? void 0 : codex };
-  } else if (isAntigravityProvider(existing)) {
-    const antigravity = {
-      ...existing.antigravity,
-      ...input2.antigravity,
-      ...existing.antigravity?.models === void 0 && input2.antigravity?.models === void 0 ? {} : { models: { ...existing.antigravity?.models, ...input2.antigravity?.models } }
-    };
-    candidate = { ...existing, ...shared, antigravity: isEmptyAntigravityConfig(antigravity) ? void 0 : antigravity };
-  } else if (router) {
-    candidate = { kind: "router", ...shared };
-  } else {
-    const catalogue = input2.catalogue === void 0 ? existing.catalogue : input2.catalogue === false ? void 0 : input2.catalogue;
-    candidate = { ...existing, ...shared, catalogue, ...input2.baseUrl === void 0 ? {} : { baseUrl: input2.baseUrl } };
+}
+function readPicksFile(fs31, file2) {
+  const empty = { schemaVersion: SCHEMA_VERSION, picks: {} };
+  const raw = fs31.readFileUtf8(file2);
+  if (raw === void 0) {
+    return { file: empty };
   }
-  const parsed = ProviderSchema.safeParse(candidate);
-  if (!parsed.success) {
-    throw new ConfigValidationError(providerJsonPath(paths, name), parsed.error.issues);
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { file: empty, problem: `${file2} is not valid JSON` };
   }
-  writeJsonAtomic(providerJsonPath(paths, name), parsed.data);
-  return parsed.data;
+  const result = PicksFileSchema.safeParse(parsed);
+  return result.success ? { file: result.data } : { file: empty, problem: `${file2} is not a picks file this agent-shim can read` };
 }
-function removeProvider(paths, name) {
-  if (!providerExists(paths, name)) {
-    throw new ProviderNotFoundError(name);
-  }
-  import_node_fs11.default.rmSync(providerJsonPath(paths, name));
+function readStickyPick(fs31, picksFile, directory) {
+  const read = readPicksFile(fs31, picksFile);
+  const entry = read.file.picks[directory];
+  return { ...entry === void 0 ? {} : { sticky: entry }, ...read.problem === void 0 ? {} : { problem: read.problem } };
 }
-function cascadeProviderName(cascade) {
-  let name;
-  for (const layer of assembleCascade(cascade).layers) {
-    if (layer.launch?.provider !== void 0) {
-      name = layer.launch.provider;
-    }
-  }
-  return name;
+function recordStickyPick(fs31, picksFile, directory, identity, nowMs) {
+  const current = readPicksFile(fs31, picksFile).file.picks;
+  const kept = Object.entries(current).filter(([, entry]) => nowMs - Date.parse(entry.at) <= USAGE_RETENTION_MS);
+  const next = { schemaVersion: SCHEMA_VERSION, picks: { ...Object.fromEntries(kept), [directory]: { identity, at: new Date(nowMs).toISOString() } } };
+  fs31.mkdirPrivate(import_node_path28.default.dirname(picksFile));
+  fs31.writeFilePrivate(picksFile, `${JSON.stringify(next, null, 2)}
+`);
 }
-function selectProvider(params) {
-  const cliName = params.cliProvider !== void 0 && params.cliProvider !== "" ? params.cliProvider : void 0;
-  const named = cliName ?? (params.cascade === void 0 ? void 0 : cascadeProviderName(params.cascade));
-  if (named === void 0) {
-    return void 0;
-  }
-  const name = canonicalProviderName(named, (candidate) => loadProvider(params.paths.providersDir, candidate, params.port) !== void 0, () => loadProviderAliases(params.paths.providerAliasesFile, params.port));
-  const definition = loadProvider(params.paths.providersDir, name, params.port);
-  if (definition === void 0) {
-    const known = listProviderNames(params.port.readdir, params.paths.providersDir);
-    return {
-      ok: false,
-      status: 1,
-      message: `agent-shim: no provider named "${name}". ` + (known.length > 0 ? `Known providers: ${known.join(", ")}.` : "No providers are defined yet; run `agent-shim provider add`.")
+var import_node_path28, PoolGraphError, SCHEMA_VERSION, PickEntrySchema, PicksFileSchema;
+var init_poolPick = __esm({
+  "src/usage/poolPick.ts"() {
+    "use strict";
+    import_node_path28 = __toESM(require("node:path"), 1);
+    init_zod();
+    init_cliError();
+    init_identity();
+    init_schema();
+    init_account();
+    init_pick();
+    init_read();
+    init_middleware();
+    init_store2();
+    PoolGraphError = class extends CliError {
+      constructor(message) {
+        super(message);
+        this.name = "PoolGraphError";
+      }
     };
+    SCHEMA_VERSION = 1;
+    PickEntrySchema = external_exports.strictObject({ identity: external_exports.string().min(1), at: external_exports.iso.datetime() });
+    PicksFileSchema = external_exports.strictObject({
+      schemaVersion: external_exports.literal(SCHEMA_VERSION),
+      picks: external_exports.record(external_exports.string().min(1), PickEntrySchema)
+    });
   }
-  return { ok: true, provider: { name, definition } };
+});
+
+// src/realCredentialCache.ts
+function cacheFileNameFor(owner) {
+  return `${owner.replace(/[^A-Za-z0-9._-]/g, "_")}.json`;
 }
-function resolveProvider(params) {
-  const selection = selectProvider(params);
-  if (selection?.ok !== true) {
-    return selection;
-  }
-  const { name, definition } = selection.provider;
-  if (isRouterProvider(definition)) {
-    return { ok: true, provider: { name, definition, credential: { target: "bearer", token: "", source: { env: "AGENT_SHIM_ROUTER" }, warnings: [] } }, warnings: [] };
-  }
-  if (params.credentials === void 0) {
-    return { ok: false, status: 1, message: `agent-shim: provider ${name} needs its credential resolved, but this launcher has no credential port wired` };
-  }
-  const resolution = resolveCredential({ credential: definition.credential, env: params.env, port: params.credentials, subject: `provider ${name}` });
-  if (!resolution.ok) {
-    return { ok: false, status: CREDENTIAL_UNAVAILABLE_EXIT, message: resolution.message };
+function parseEntry(raw) {
+  let json2;
+  try {
+    json2 = JSON.parse(raw);
+  } catch {
+    return void 0;
   }
-  return { ok: true, provider: { name, definition, credential: resolution.credential }, warnings: resolution.credential.warnings };
+  const parsed = CachedCredentialSchema.safeParse(json2);
+  return parsed.success ? parsed.data : void 0;
 }
-function resolveRoutedProviderCredentials(params) {
-  const { models } = params;
-  if (models === void 0) {
-    return { ok: true, checked: [] };
+function requireKeychain() {
+  if (process.platform !== "darwin") {
+    throw new Error("the keychain credential store needs macOS; use --credential-cache-store file");
   }
-  const virtualNames = new Set(Object.keys(models.virtual ?? {}));
-  const providerNames = /* @__PURE__ */ new Set();
-  const families = () => buildFamilies(params.targets?.() ?? [], models);
-  const collect = (ref) => {
-    if (ref.startsWith(FAMILY_PREFIX)) {
-      for (const target of expandFamilyMembers([ref], families())) {
-        collect(target);
+}
+function security(args, stdin2) {
+  const result = spawnSyncBlocking("a keychain call", "security", args, { encoding: "utf8", ...stdin2 === void 0 ? {} : { input: stdin2 }, stdio: ["pipe", "pipe", "ignore"] });
+  return { status: result.status, stdout: result.stdout };
+}
+async function securityAsync(args, stdin2) {
+  return await new Promise((resolve3) => {
+    const child = (0, import_node_child_process4.spawn)("security", args, { stdio: ["pipe", "pipe", "ignore"] });
+    let stdout2 = "";
+    let settled = false;
+    const settle2 = (status) => {
+      if (!settled) {
+        settled = true;
+        resolve3({ status, stdout: stdout2 });
       }
-      return;
-    }
-    if (ref.startsWith("acct:") || virtualNames.has(ref)) {
-      return;
-    }
-    const [provider] = ref.split("/", 1);
-    if (provider !== void 0 && provider !== "") {
-      providerNames.add(provider);
+    };
+    child.stdout.setEncoding("utf8");
+    child.stdout.on("data", (chunk2) => {
+      stdout2 += chunk2;
+    });
+    child.stdin.on("error", () => {
+    });
+    child.stdin.end(stdin2);
+    child.once("error", () => {
+      settle2(null);
+    });
+    child.once("close", settle2);
+  });
+}
+function createRealCredentialCache(root) {
+  const dir = import_node_path29.default.join(root, "credential-cache");
+  const filePath = (owner) => import_node_path29.default.join(dir, cacheFileNameFor(owner));
+  return {
+    read(store, owner) {
+      if (store === "file") {
+        try {
+          return parseEntry(import_node_fs11.default.readFileSync(filePath(owner), "utf8"));
+        } catch {
+          return void 0;
+        }
+      }
+      requireKeychain();
+      const result = security(["find-generic-password", "-s", KEYCHAIN_CACHE_SERVICE, "-a", owner, "-w"]);
+      return result.status === 0 ? parseEntry(Buffer.from(result.stdout.trim(), "base64").toString("utf8")) : void 0;
+    },
+    write(store, owner, entry) {
+      const serialised = JSON.stringify(entry);
+      if (store === "file") {
+        import_node_fs11.default.mkdirSync(dir, { recursive: true, mode: CACHE_DIR_MODE });
+        import_node_fs11.default.chmodSync(dir, CACHE_DIR_MODE);
+        const target = filePath(owner);
+        const temp = `${target}.${String(process.pid)}.tmp`;
+        import_node_fs11.default.writeFileSync(temp, serialised, { mode: CACHE_FILE_MODE });
+        import_node_fs11.default.renameSync(temp, target);
+        return;
+      }
+      requireKeychain();
+      const encoded = Buffer.from(serialised, "utf8").toString("base64");
+      const result = security(["-i"], `add-generic-password -U -s ${KEYCHAIN_CACHE_SERVICE} -a ${JSON.stringify(owner)} -w ${encoded}
+`);
+      if (result.status !== 0) {
+        throw new Error(`could not write the keychain credential cache for ${owner}`);
+      }
+    },
+    remove(store, owner) {
+      if (store === "file") {
+        import_node_fs11.default.rmSync(filePath(owner), { force: true });
+        return;
+      }
+      requireKeychain();
+      security(["delete-generic-password", "-s", KEYCHAIN_CACHE_SERVICE, "-a", owner]);
     }
   };
-  for (const model of Object.values(models.virtual ?? {})) {
-    for (const member of model.members) {
-      collect(member);
-    }
-  }
-  for (const ref of Object.values(models.tiers ?? {})) {
-    collect(ref);
-  }
-  if (providerNames.size === 0) {
-    return { ok: true, checked: [] };
-  }
-  if (params.credentials === void 0) {
-    return { ok: false, status: 1, message: `agent-shim: the models block routes to providers ${[...providerNames].sort().join(", ")}, which need their credentials resolved, but this launcher has no credential port wired` };
-  }
-  const failures = [];
-  let credentialFailure = false;
-  for (const name of [...providerNames].sort()) {
-    const definition = loadProvider(params.paths.providersDir, name, params.port);
-    if (definition === void 0) {
-      failures.push(`no provider named "${name}"`);
-      continue;
-    }
-    if (isRouterProvider(definition)) {
-      continue;
-    }
-    const resolution = resolveCredential({ credential: definition.credential, env: params.env, port: params.credentials, subject: `provider ${name}` });
-    if (!resolution.ok) {
-      failures.push(resolution.message.replace(/^agent-shim: /, ""));
-      credentialFailure = true;
-    }
-  }
-  if (failures.length > 0) {
-    return { ok: false, status: credentialFailure ? CREDENTIAL_UNAVAILABLE_EXIT : 1, message: `agent-shim: this launch routes model names through the models block, but: ${failures.join("; ")}` };
-  }
-  return { ok: true, checked: [...providerNames].sort() };
 }
-var import_node_fs11, ProviderNotFoundError, ProviderAlreadyExistsError, LEGACY_PROVIDER_FIELDS, LEGACY_ENV_CREDENTIAL_KEYS, LEGACY_LITERAL_PLACEHOLDER, LegacyProviderFileError, ProviderKindMismatchError;
-var init_providersStore = __esm({
-  "src/providersStore.ts"() {
-    "use strict";
-    import_node_fs11 = __toESM(require("node:fs"), 1);
-    init_load();
-    init_store();
-    init_unrecognisedKeys();
-    init_schema();
-    init_cliError();
-    init_providerAliases();
-    init_credential();
-    init_walk();
-    init_families();
-    init_names();
-    ProviderNotFoundError = class extends CliError {
-      constructor(name) {
-        super(`No provider named "${name}". Run \`agent-shim provider add ${name}\` first.`);
-        this.name = name;
-        this.name = "ProviderNotFoundError";
-      }
-      name;
-    };
-    ProviderAlreadyExistsError = class extends CliError {
-      constructor(providerName) {
-        super(`A provider named "${providerName}" already exists.`);
-        this.providerName = providerName;
-        this.name = "ProviderAlreadyExistsError";
+function realCredentialCacheEnv(paths) {
+  return { port: createRealCredentialCache(paths.root), platform: process.platform, now: () => Date.now() };
+}
+function createAsyncRealCredentialCache(root) {
+  const dir = import_node_path29.default.join(root, "credential-cache");
+  const filePath = (owner) => import_node_path29.default.join(dir, cacheFileNameFor(owner));
+  return {
+    async read(store, owner) {
+      if (store === "file") {
+        try {
+          return parseEntry(await import_node_fs11.default.promises.readFile(filePath(owner), "utf8"));
+        } catch {
+          return void 0;
+        }
       }
-      providerName;
-    };
-    LEGACY_PROVIDER_FIELDS = ["tokenEnv", "tokenCommand", "authScheme"];
-    LEGACY_ENV_CREDENTIAL_KEYS = Object.values(CREDENTIAL_TARGET_VARS);
-    LEGACY_LITERAL_PLACEHOLDER = "<the value of env.ANTHROPIC_AUTH_TOKEN>";
-    LegacyProviderFileError = class extends CliError {
-      constructor(filePath, conversion) {
-        super(
-          `${filePath} uses ${conversion.fields.join(", ")}, which a credential block replaced. Rewrite it as:
-` + JSON.stringify(conversion.replacement, null, 2)
-        );
-        this.filePath = filePath;
-        this.conversion = conversion;
-        this.name = "LegacyProviderFileError";
+      requireKeychain();
+      const result = await securityAsync(["find-generic-password", "-s", KEYCHAIN_CACHE_SERVICE, "-a", owner, "-w"]);
+      return result.status === 0 ? parseEntry(Buffer.from(result.stdout.trim(), "base64").toString("utf8")) : void 0;
+    },
+    async write(store, owner, entry) {
+      const serialised = JSON.stringify(entry);
+      if (store === "file") {
+        await import_node_fs11.default.promises.mkdir(dir, { recursive: true, mode: CACHE_DIR_MODE });
+        await import_node_fs11.default.promises.chmod(dir, CACHE_DIR_MODE);
+        const target = filePath(owner);
+        const temp = `${target}.${String(process.pid)}.tmp`;
+        await import_node_fs11.default.promises.writeFile(temp, serialised, { mode: CACHE_FILE_MODE });
+        await import_node_fs11.default.promises.rename(temp, target);
+        return;
       }
-      filePath;
-      conversion;
-    };
-    ProviderKindMismatchError = class extends UsageError {
-      constructor(message) {
-        super(message);
-        this.name = "ProviderKindMismatchError";
+      requireKeychain();
+      const encoded = Buffer.from(serialised, "utf8").toString("base64");
+      const result = await securityAsync(["-i"], `add-generic-password -U -s ${KEYCHAIN_CACHE_SERVICE} -a ${JSON.stringify(owner)} -w ${encoded}
+`);
+      if (result.status !== 0) {
+        throw new Error(`could not write the keychain credential cache for ${owner}`);
       }
-    };
+    }
+  };
+}
+function realAsyncCredentialCacheEnv(paths) {
+  return { port: createAsyncRealCredentialCache(paths.root), platform: process.platform, now: () => Date.now() };
+}
+var import_node_child_process4, import_node_fs11, import_node_path29, KEYCHAIN_CACHE_SERVICE, CACHE_DIR_MODE, CACHE_FILE_MODE;
+var init_realCredentialCache = __esm({
+  "src/realCredentialCache.ts"() {
+    "use strict";
+    import_node_child_process4 = require("node:child_process");
+    import_node_fs11 = __toESM(require("node:fs"), 1);
+    import_node_path29 = __toESM(require("node:path"), 1);
+    init_blockingSpawn();
+    init_credentialCache();
+    KEYCHAIN_CACHE_SERVICE = "agent-shim-credential-cache";
+    CACHE_DIR_MODE = 448;
+    CACHE_FILE_MODE = 384;
   }
 });
 
@@ -39715,6 +39723,9 @@ function decideSignIn(facts) {
   if (facts.hasCredentialBlock) {
     return { state: "token", detail: "supplies its own credential through a credential block, so a stored login is not what a launch uses" };
   }
+  if (facts.provider !== void 0) {
+    return { state: "token", detail: "runs provider sessions with the provider's credential, so a stored login is not what a launch uses" };
+  }
   if (facts.keychainItem === true) {
     return { state: "signed-in", detail: "a login is stored in the macOS Keychain" };
   }
@@ -39727,9 +39738,10 @@ function credentialsFilePath(farmRoot) {
   return import_node_path30.default.join(farmRoot, CREDENTIALS_FILE);
 }
 function identitySignIn(fs31, probe, identity) {
-  const probing = !identity.hasCredentialBlock;
+  const probing = !identity.hasCredentialBlock && identity.provider === void 0;
   return decideSignIn({
     hasCredentialBlock: identity.hasCredentialBlock,
+    provider: identity.provider,
     keychainItem: probing && probe.platform === "darwin" && probe.run !== void 0 ? keychainHasItem(probe.run, identity.farmRoot) : void 0,
     credentialsFile: probing && fs31.lstat(credentialsFilePath(identity.farmRoot)) !== void 0,
     platform: probe.platform
@@ -69869,7 +69881,8 @@ function decideLaunch(params, readOnly) {
     paths,
     port: fs31,
     ...parsedArgv.provider === void 0 || parsedArgv.provider === false ? {} : { cliProvider: parsedArgv.provider },
-    ...farmContext === void 0 ? {} : { cascade: farmContext.cascade }
+    ...farmContext === void 0 ? {} : { cascade: farmContext.cascade },
+    ...loadedIdentity?.config.provider === void 0 ? {} : { identityProvider: loadedIdentity.config.provider }
   };
   let selectedProvider;
   let resolvedProvider;
@@ -70339,7 +70352,7 @@ function realPrepareLaunchParams(paths, options) {
     frontdoor: realFrontDoorPort(paths, options.spawnDaemon),
     credentials: { ...realCredentialPort, cache: realCredentialCacheEnv(paths) },
     hold: realHoldPort,
-    hasStoredLogin: (identity) => identitySignIn(realFarmFs, { platform: process.platform, run: options.run ?? realRunPort }, { farmRoot: import_node_path44.default.join(paths.identitiesDir, identity), hasCredentialBlock: false }).state !== "signed-out",
+    hasStoredLogin: (identity) => identitySignIn(realFarmFs, { platform: process.platform, run: options.run ?? realRunPort }, { farmRoot: import_node_path44.default.join(paths.identitiesDir, identity), hasCredentialBlock: false, provider: void 0 }).state !== "signed-out",
     ...farm.directoryIdentity === void 0 ? {} : { directoryPinnedIdentity: farm.directoryIdentity },
     ...farm.directoryConfigProfile === void 0 ? {} : { directoryRuleConfigProfile: farm.directoryConfigProfile },
     ...farm.globalDefaultConfigProfile === void 0 ? {} : { globalDefaultConfigProfile: farm.globalDefaultConfigProfile },
@@ -116380,6 +116393,12 @@ function setDefaultConfigProfile(paths, identityName, profileName) {
     defaultConfigProfile: profileName
   });
 }
+function setIdentityProvider(paths, identityName, providerName) {
+  if (!identityExists(paths, identityName)) {
+    throw new IdentityNotFoundError(identityName);
+  }
+  return applyPatch(identityJsonPath(paths, identityName), IdentitySchema, { provider: providerName });
+}
 function setAllowAmbientCredential(paths, identityName, allow) {
   if (!identityExists(paths, identityName)) {
     throw new IdentityNotFoundError(identityName);
@@ -117524,6 +117543,7 @@ function registerProfileCommand(program2, deps) {
 }
 
 // src/identityManager.ts
+init_providersStore();
 init_identity();
 init_realPorts();
 
@@ -117662,6 +117682,7 @@ function toIdentityView(paths, { entry, read }, sharesLoginWith) {
     directory: import_node_path25.default.join(paths.identitiesDir, entry.name),
     ...entry.problem === void 0 ? {
       ...entry.identity.defaultConfigProfile === void 0 ? {} : { defaultConfigProfile: entry.identity.defaultConfigProfile },
+      ...entry.identity.provider === void 0 ? {} : { provider: entry.identity.provider },
       allowAmbientCredential: entry.identity.allowAmbientCredential,
       ...entry.identity.credential === void 0 ? {} : { credential: summariseCredential(entry.identity.credential) },
       ...entry.identity.anchors === void 0 ? {} : { anchors: entry.identity.anchors }
@@ -117688,9 +117709,10 @@ function formatIdentityLine(entry, view) {
     return `${marker}${entry.name} [unreadable: ${entry.problem}]${account}${accountProblem}`;
   }
   const defaultProfile = entry.identity.defaultConfigProfile === void 0 ? "" : ` (default profile: ${entry.identity.defaultConfigProfile})`;
+  const provider = entry.identity.provider === void 0 ? "" : ` (provider: ${entry.identity.provider})`;
   const ambient = entry.identity.allowAmbientCredential ? " [allows ambient credential]" : "";
   const credential = entry.identity.credential === void 0 ? "" : ` [credential ${describeCredential(entry.identity.credential)}]`;
-  return `${marker}${entry.name}${defaultProfile}${ambient}${credential}${account}${accountProblem}`;
+  return `${marker}${entry.name}${defaultProfile}${provider}${ambient}${credential}${account}${accountProblem}`;
 }
 function registerIdentityCommand(program2, deps) {
   const { paths } = deps;
@@ -117763,13 +117785,14 @@ function registerIdentityCommand(program2, deps) {
         return;
       }
       console.log(`Default configuration profile: ${view.defaultConfigProfile ?? "(none)"}`);
+      console.log(`Provider: ${view.provider ?? "(none)"}`);
       console.log(`Allows ambient credential: ${view.allowAmbientCredential === true ? "yes" : "no"}`);
       console.log(`Credential: ${entry.identity?.credential === void 0 ? "(none; uses its stored login)" : describeCredential(entry.identity.credential)}`);
       console.log(`Anchors: ${view.anchors === void 0 ? "(none)" : view.anchors.map(formatAnchor).join(" ")}`);
     }),
     ["agent-shim identity show work", "agent-shim identity show work --json"]
   );
-  const identitySet = identity.command("set <name>").description("Update an identity's settings.").option("--json", "Print the result as JSON.").option("--default-profile <profile>", "Configuration profile this identity uses when nothing more specific selects one.").option("--no-default-profile", "Clear this identity's default configuration profile.").option("--allow-ambient-credential", "Allow this identity to launch even with an ambient credential env var set.").option("--no-allow-ambient-credential", "Disallow ambient credential env vars for this identity (the default).").option(
+  const identitySet = identity.command("set <name>").description("Update an identity's settings.").option("--json", "Print the result as JSON.").option("--default-profile <profile>", "Configuration profile this identity uses when nothing more specific selects one.").option("--no-default-profile", "Clear this identity's default configuration profile.").option("--provider <provider>", "Provider this identity exists for: a launch on it routes through the provider unless a flag, directory rule or profile selects another, and doctor expects no stored login.").option("--no-provider", "Clear this identity's provider.").option("--allow-ambient-credential", "Allow this identity to launch even with an ambient credential env var set.").option("--no-allow-ambient-credential", "Disallow ambient credential env vars for this identity (the default).").option(
     "--credential <source>",
     `Authenticate this identity from a token instead of its stored login, replacing any existing sources (repeatable, in the order tried): ${CREDENTIAL_SOURCE_SYNTAX}.`,
     collectCredentialSource
@@ -117789,12 +117812,15 @@ function registerIdentityCommand(program2, deps) {
       const { json: json2, ...options } = allOptions;
       if (Object.entries(allOptions).every(([key, value2]) => key === "json" || value2 === void 0)) {
         throw new UsageError(
-          "Nothing to change: pass --default-profile, --no-default-profile, --allow-ambient-credential, --no-allow-ambient-credential, --credential, --no-credential, --credential-target, --anchor, --no-anchor or a --credential-cache option."
+          "Nothing to change: pass --default-profile, --no-default-profile, --provider, --no-provider, --allow-ambient-credential, --no-allow-ambient-credential, --credential, --no-credential, --credential-target, --anchor, --no-anchor or a --credential-cache option."
         );
       }
       if (!identityExists(paths, name)) {
         throw new IdentityNotFoundError(name);
       }
+      if (typeof options.provider === "string") {
+        requireProviderExists(paths, options.provider);
+      }
       const messages = [];
       if (options.defaultProfile !== void 0) {
         const profileName = options.defaultProfile === false ? void 0 : options.defaultProfile;
@@ -117806,6 +117832,11 @@ function registerIdentityCommand(program2, deps) {
           profileName === void 0 ? `Identity "${name}" no longer has a default configuration profile.` : `Identity "${name}" now defaults to configuration profile "${profileName}".`
         );
       }
+      if (options.provider !== void 0) {
+        const providerName = options.provider === false ? void 0 : options.provider;
+        setIdentityProvider(paths, name, providerName);
+        messages.push(providerName === void 0 ? `Identity "${name}" no longer has a provider.` : `Identity "${name}" now runs on provider "${providerName}" unless something more specific selects one.`);
+      }
       if (options.allowAmbientCredential !== void 0) {
         setAllowAmbientCredential(paths, name, options.allowAmbientCredential);
         messages.push(`Identity "${name}" ${options.allowAmbientCredential ? "now allows" : "no longer allows"} an ambient credential.`);
@@ -117836,6 +117867,7 @@ function registerIdentityCommand(program2, deps) {
     }),
     [
       "agent-shim identity set work --default-profile client-acme",
+      "agent-shim identity set minimax --provider minimax",
       "agent-shim identity set work --allow-ambient-credential",
       "agent-shim identity set work --credential-target oauthToken --credential op:op://vault/claude-work/token",
       "agent-shim identity set work --no-credential",
@@ -118352,7 +118384,7 @@ function collectCheckReport(params) {
     read,
     ...configProfileDecision.name === void 0 ? {} : { baseConfigProfile: configProfileDecision.name }
   }).input;
-  const providerName = cascadeProviderName(cascade);
+  const providerName = cascadeProviderName(cascade, identityConfig?.provider);
   const provider = providerName === void 0 ? void 0 : loadCheckProvider(paths, providerName);
   const farmRoot = identityDecision.name === void 0 ? void 0 : import_node_path31.default.join(paths.identitiesDir, identityDecision.name);
   const settingsFiles = {
@@ -123579,6 +123611,7 @@ function runDoctor(params) {
     }
   }
   const validProfileNames = new Set(profileSources.keys());
+  const validProviderNames = /* @__PURE__ */ new Set([...params.providers.map((entry) => entry.name), ...Object.keys(params.providerAliases ?? {})]);
   const validIdentityNames = /* @__PURE__ */ new Set();
   for (const entry of params.identities) {
     const validated2 = validate3(IdentitySchema, entry, "identity", entry.name);
@@ -123588,35 +123621,47 @@ function runDoctor(params) {
     }
     validIdentityNames.add(entry.name);
     const defaultProfile = validated2.data.defaultConfigProfile;
+    let consistent = true;
     if (defaultProfile !== void 0 && !validProfileNames.has(defaultProfile)) {
+      consistent = false;
       push(
         "identity",
         "fail",
         `Identity "${entry.name}" names configuration profile "${defaultProfile}" as its default, but no such profile exists.`,
         entry.name
       );
-    } else {
-      const credential = validated2.data.credential;
-      const cache = credential === void 0 ? { text: "", unreadable: false } : cacheClause(params.credentialCache, `identity ${entry.name}`, credential);
-      push(
-        "identity",
-        cache.unreadable ? "fail" : "pass",
-        `${entry.name} is valid and authenticates with ${credential === void 0 ? "its stored login" : `credential ${describeCredential(credential)}`}${cache.text}.`,
-        entry.name
-      );
-      const signIn = decideSignIn({
-        hasCredentialBlock: credential !== void 0,
-        keychainItem: params.platform === "darwin" && params.run !== void 0 ? keychainHasItem(params.run, entry.farmRoot) : void 0,
-        credentialsFile: entry.credentialsFilePresent,
-        platform: params.platform
-      });
-      push(
-        "sign-in",
-        signIn.state === "signed-out" ? "warn" : "pass",
-        signIn.state === "signed-out" ? `${entry.name} is signed out (${signIn.detail}). Run \`agent-shim run @${entry.name}\` and sign in.` : `${entry.name} ${signIn.state === "token" ? "uses a credential block" : "is signed in"} (${signIn.detail}).`,
-        entry.name
-      );
     }
+    const identityProvider = validated2.data.provider;
+    if (identityProvider !== void 0 && !validProviderNames.has(identityProvider)) {
+      consistent = false;
+      push("identity", "fail", `Identity "${entry.name}" names provider "${identityProvider}" as its provider, but no such provider exists.`, entry.name);
+    }
+    if (!consistent) {
+      continue;
+    }
+    const credential = validated2.data.credential;
+    const cache = credential === void 0 ? { text: "", unreadable: false } : cacheClause(params.credentialCache, `identity ${entry.name}`, credential);
+    const authenticatesWith = credential !== void 0 ? `credential ${describeCredential(credential)}` : identityProvider !== void 0 ? `the credential of provider "${identityProvider}"` : "its stored login";
+    push(
+      "identity",
+      cache.unreadable ? "fail" : "pass",
+      `${entry.name} is valid and authenticates with ${authenticatesWith}${cache.text}.`,
+      entry.name
+    );
+    const standing = credential !== void 0 ? "uses a credential block" : identityProvider !== void 0 ? `exists for provider "${identityProvider}"` : "is signed in";
+    const signIn = decideSignIn({
+      hasCredentialBlock: credential !== void 0,
+      provider: identityProvider,
+      keychainItem: params.platform === "darwin" && params.run !== void 0 ? keychainHasItem(params.run, entry.farmRoot) : void 0,
+      credentialsFile: entry.credentialsFilePresent,
+      platform: params.platform
+    });
+    push(
+      "sign-in",
+      signIn.state === "signed-out" ? "warn" : "pass",
+      signIn.state === "signed-out" ? `${entry.name} is signed out (${signIn.detail}). Run \`agent-shim run @${entry.name}\` and sign in.` : `${entry.name} ${standing} (${signIn.detail}).`,
+      entry.name
+    );
   }
   const validatedGlobalConfig = params.globalConfig.raw === void 0 ? void 0 : validateJson(GlobalConfigSchema, params.globalConfig);
   const pools = validatedGlobalConfig?.ok === true ? validatedGlobalConfig.data.pools ?? {} : {};
@@ -133043,6 +133088,7 @@ var storedMutationOutput = (kind, action, value2) => external_exports.strictObje
 var IdentityValueSchema = external_exports.strictObject({
   name: external_exports.string(),
   defaultConfigProfile: external_exports.string().optional(),
+  provider: external_exports.string().optional(),
   allowAmbientCredential: external_exports.boolean(),
   credential: CredentialSummarySchema2.optional(),
   anchors: external_exports.array(AnchorSchema).optional()
@@ -133062,6 +133108,8 @@ var ConfigIdentityAddOutputSchema = storedMutationOutput("identity", "created",
 var ConfigIdentitySetInputSchema = external_exports.strictObject({
   name: external_exports.string().min(1),
   defaultConfigProfile: external_exports.union([external_exports.string().min(1), external_exports.literal(false)]).optional(),
+  /** The provider the identity exists for; `false` clears it. */
+  provider: external_exports.union([external_exports.string().min(1), external_exports.literal(false)]).optional(),
   allowAmbientCredential: external_exports.boolean().optional(),
   credential: external_exports.union([external_exports.literal(false), CredentialWriteSchema(CREDENTIAL_TARGETS)]).optional(),
   /** `false` removes the anchors; a list replaces them. */
@@ -133206,6 +133254,7 @@ function identityValue(name, paths) {
   return {
     name: identity.name,
     ...identity.defaultConfigProfile === void 0 ? {} : { defaultConfigProfile: identity.defaultConfigProfile },
+    ...identity.provider === void 0 ? {} : { provider: identity.provider },
     allowAmbientCredential: identity.allowAmbientCredential,
     ...identity.credential === void 0 ? {} : { credential: summariseCredential(identity.credential) },
     ...identity.anchors === void 0 ? {} : { anchors: identity.anchors }
@@ -133238,18 +133287,24 @@ function createConfigApiRouter(deps) {
             return { action: "created", kind: "identity", name: input2.name, value: identityValue(input2.name, paths) };
           })
         ),
-        set: route("/rest/config/identity/set", "Update an identity's default profile, ambient-credential setting, credential or anchors").input(ConfigIdentitySetInputSchema).output(ConfigIdentitySetOutputSchema).handler(
+        set: route("/rest/config/identity/set", "Update an identity's default profile, provider, ambient-credential setting, credential or anchors").input(ConfigIdentitySetInputSchema).output(ConfigIdentitySetOutputSchema).handler(
           ({ input: input2 }) => guarded(() => {
-            requireChange(input2.defaultConfigProfile !== void 0 || input2.allowAmbientCredential !== void 0 || input2.credential !== void 0 || input2.anchors !== void 0, "defaultConfigProfile, allowAmbientCredential, credential or anchors");
+            requireChange(input2.defaultConfigProfile !== void 0 || input2.provider !== void 0 || input2.allowAmbientCredential !== void 0 || input2.credential !== void 0 || input2.anchors !== void 0, "defaultConfigProfile, provider, allowAmbientCredential, credential or anchors");
             if (!identityExists(paths, input2.name)) {
               throw new IdentityNotFoundError(input2.name);
             }
             if (typeof input2.defaultConfigProfile === "string") {
               requireProfileExists(paths, input2.defaultConfigProfile);
             }
+            if (typeof input2.provider === "string") {
+              requireProviderExists(paths, input2.provider);
+            }
             if (input2.defaultConfigProfile !== void 0) {
               setDefaultConfigProfile(paths, input2.name, input2.defaultConfigProfile === false ? void 0 : input2.defaultConfigProfile);
             }
+            if (input2.provider !== void 0) {
+              setIdentityProvider(paths, input2.name, input2.provider === false ? void 0 : input2.provider);
+            }
             if (input2.allowAmbientCredential !== void 0) {
               setAllowAmbientCredential(paths, input2.name, input2.allowAmbientCredential);
             }
@@ -156467,6 +156522,12 @@ function rewriteReferences(paths, from, to2) {
       rewritten.push(`profile ${name}`);
     }
   }
+  for (const entry of listIdentities(paths)) {
+    if (entry.identity?.provider === from) {
+      setIdentityProvider(paths, entry.name, to2);
+      rewritten.push(`identity ${entry.name}`);
+    }
+  }
   const rules = readDirectoryRules(paths);
   const renamedRules = rules.rules.map((rule) => {
     const launch = renamedLaunch(rule.launch, from, to2);
@@ -157426,12 +157487,15 @@ function collectAccounts(fs31, paths, identity, probe) {
     requireIdentity(paths, identity);
   }
   const names = identity === void 0 ? listIdentities(paths).map((entry) => entry.name) : [identity];
-  return names.map((name) => ({
-    identity: name,
-    account: readAccountMetadata(fs31, paths.identitiesDir, name),
-    signIn: identitySignIn(fs31, probe, { farmRoot: import_node_path70.default.join(paths.identitiesDir, name), hasCredentialBlock: readIdentity(paths, name)?.credential !== void 0 }),
-    usage: readUsageSnapshot(fs31, paths.usageSnapshotsDir, name)
-  }));
+  return names.map((name) => {
+    const stored2 = readIdentity(paths, name);
+    return {
+      identity: name,
+      account: readAccountMetadata(fs31, paths.identitiesDir, name),
+      signIn: identitySignIn(fs31, probe, { farmRoot: import_node_path70.default.join(paths.identitiesDir, name), hasCredentialBlock: stored2?.credential !== void 0, provider: stored2?.provider }),
+      usage: readUsageSnapshot(fs31, paths.usageSnapshotsDir, name)
+    };
+  });
 }
 function formatAccounts(views) {
   if (views.length === 0) {