agl 40.4.0 → 40.5.1

package/dist_ts_authswitch/authority-usagewindows.js

@@ -11,28 +11,51 @@ const openAiWindows = (limitNameArg, detailsArg) => ([detailsArg?.primaryWindow,
     estimatedUsedPercent: windowArg.estimated ? windowArg.estimatedUsedPercent ?? null : null,
     resetAt: new Date(windowArg.resetsAt * 1000).toISOString(),
 })));
+/** The name of an API key's one window, its spend in the calendar month against its limit. */
+export const authSwitchSpendWindowLabel = 'Monthly spend';
 /**
  * The windows of a reading: for ChatGPT the main limit's two windows, then each named extra limit's; for Claude the
- * windows as the service reported them. A missing reading has none.
+ * windows as the service reported them; for an API key with a spend limit one account window, the month's spend in
+ * percent of the limit, which resets when the month ends -- a key without a limit has none. A missing reading has none.
  */
 export const authSwitchUsageWindows = (readingArg) => {
     if (readingArg === null)
         return [];
-    if (readingArg.kind === 'openai') {
-        return [
-            ...openAiWindows(null, readingArg.rateLimits.rateLimit),
-            ...readingArg.rateLimits.additionalRateLimits.flatMap((limitArg) => (openAiWindows(limitArg.limitName, limitArg.rateLimit))),
-        ];
+    switch (readingArg.kind) {
+        case 'openai':
+            return [
+                ...openAiWindows(null, readingArg.rateLimits.rateLimit),
+                ...readingArg.rateLimits.additionalRateLimits.flatMap((limitArg) => (openAiWindows(limitArg.limitName, limitArg.rateLimit))),
+            ];
+        case 'anthropic':
+            return (readingArg.status.windows ?? []).map((windowArg) => ({
+                label: windowArg.label,
+                limitName: null,
+                scope: windowArg.scope,
+                durationSeconds: windowArg.durationSeconds,
+                usedPercent: windowArg.usedPercent,
+                estimatedUsedPercent: windowArg.estimated ? windowArg.estimatedUsedPercent ?? null : null,
+                resetAt: windowArg.resetAt,
+            }));
+        case 'spend': {
+            const spend = readingArg.spend;
+            if (spend.limitMicroUsd === null)
+                return [];
+            return [{
+                    label: authSwitchSpendWindowLabel,
+                    limitName: null,
+                    scope: 'account',
+                    durationSeconds: (Date.parse(spend.resetAt) - Date.parse(spend.periodStart)) / 1000,
+                    usedPercent: spend.spentMicroUsd * 100 / spend.limitMicroUsd,
+                    estimatedUsedPercent: null,
+                    resetAt: spend.resetAt,
+                }];
+        }
+        default: {
+            const unhandledReading = readingArg;
+            return unhandledReading;
+        }
     }
-    return (readingArg.status.windows ?? []).map((windowArg) => ({
-        label: windowArg.label,
-        limitName: null,
-        scope: windowArg.scope,
-        durationSeconds: windowArg.durationSeconds,
-        usedPercent: windowArg.usedPercent,
-        estimatedUsedPercent: windowArg.estimated ? windowArg.estimatedUsedPercent ?? null : null,
-        resetAt: windowArg.resetAt,
-    }));
 };
 /** The percent a window is used to as far as AGL knows: the estimate between reads, else the reported value. */
 export const authSwitchUsageWindowPercent = (windowArg) => windowArg.estimatedUsedPercent ?? windowArg.usedPercent;
@@ -53,6 +76,8 @@ export const authSwitchUsageProblemText = (problemArg) => {
         case 'expired': return 'The last reading is too old to show.';
         case 'held_in_container': return 'This login is in use in a container, so its usage is not read here.';
         case 'pending': return 'The account\'s usage has not been read yet.';
+        case 'spend_unavailable': return 'The key\'s spend could not be read, so AGL places nothing on it while it has a '
+            + 'spend limit.';
     }
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXR5LXVzYWdld2luZG93cy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX2F1dGhzd2l0Y2gvYXV0aG9yaXR5LXVzYWdld2luZG93cy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFTQSxPQUFPLEVBQUUsaUJBQWlCLEVBQUUsTUFBTSxlQUFlLENBQUM7QUErQmxELDRGQUE0RjtBQUM1RixNQUFNLGFBQWEsR0FBRyxDQUFDLFlBQTJCLEVBQ2hELFVBQStDLEVBQTRCLEVBQUUsQ0FBQyxDQUM5RSxDQUFDLFVBQVUsRUFBRSxhQUFhLEVBQUUsVUFBVSxFQUFFLGVBQWUsQ0FBQztLQUNyRCxNQUFNLENBQUMsQ0FBQyxTQUFTLEVBQThDLEVBQUUsQ0FBQyxTQUFTLEtBQUssU0FBUyxDQUFDO0tBQzFGLEdBQUcsQ0FBQyxDQUFDLFNBQVMsRUFBRSxFQUFFLENBQUMsQ0FBQztJQUNuQixLQUFLLEVBQUUsSUFBSTtJQUNYLFNBQVMsRUFBRSxZQUFZO0lBQ3ZCLEtBQUssRUFBRSxZQUFZLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxTQUFrQixDQUFDLENBQUMsQ0FBQyxTQUFrQjtJQUN0RSxlQUFlLEVBQUUsU0FBUyxDQUFDLGtCQUFrQjtJQUM3QyxXQUFXLEVBQUUsU0FBUyxDQUFDLFdBQVc7SUFDbEMsb0JBQW9CLEVBQUUsU0FBUyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLG9CQUFvQixJQUFJLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSTtJQUN6RixPQUFPLEVBQUUsSUFBSSxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsR0FBRyxJQUFJLENBQUMsQ0FBQyxXQUFXLEVBQUU7Q0FDM0QsQ0FBQyxDQUFDLENBQ04sQ0FBQztBQUVGOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLENBQUMsVUFBMEMsRUFBNEIsRUFBRTtJQUM3RyxJQUFJLFVBQVUsS0FBSyxJQUFJO1FBQUUsT0FBTyxFQUFFLENBQUM7SUFDbkMsSUFBSSxVQUFVLENBQUMsSUFBSSxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQ2pDLE9BQU87WUFDTCxHQUFHLGFBQWEsQ0FBQyxJQUFJLEVBQUUsVUFBVSxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUM7WUFDdkQsR0FBRyxVQUFVLENBQUMsVUFBVSxDQUFDLG9CQUFvQixDQUFDLE9BQU8sQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FDbEUsYUFBYSxDQUFDLFFBQVEsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLFNBQVMsQ0FBQyxDQUN0RCxDQUFDO1NBQ0gsQ0FBQztJQUNKLENBQUM7SUFDRCxPQUFPLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxPQUFPLElBQUksRUFBRSxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsU0FBUyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQzNELEtBQUssRUFBRSxTQUFTLENBQUMsS0FBSztRQUN0QixTQUFTLEVBQUUsSUFBSTtRQUNmLEtBQUssRUFBRSxTQUFTLENBQUMsS0FBSztRQUN0QixlQUFlLEVBQUUsU0FBUyxDQUFDLGVBQWU7UUFDMUMsV0FBVyxFQUFFLFNBQVMsQ0FBQyxXQUFXO1FBQ2xDLG9CQUFvQixFQUFFLFNBQVMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxvQkFBb0IsSUFBSSxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUk7UUFDekYsT0FBTyxFQUFFLFNBQVMsQ0FBQyxPQUFPO0tBQzNCLENBQUMsQ0FBQyxDQUFDO0FBQ04sQ0FBQyxDQUFDO0FBRUYsZ0hBQWdIO0FBQ2hILE1BQU0sQ0FBQyxNQUFNLDRCQUE0QixHQUFHLENBQUMsU0FBaUMsRUFBVSxFQUFFLENBQ3hGLFNBQVMsQ0FBQyxvQkFBb0IsSUFBSSxTQUFTLENBQUMsV0FBVyxDQUFDO0FBRTFELG1IQUFtSDtBQUNuSCxNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBRyxDQUFDLFNBQWlDLEVBQVUsRUFBRSxDQUFDLFNBQVMsQ0FBQyxLQUFLO09BQ2xHLEdBQUcsU0FBUyxDQUFDLFNBQVMsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsR0FBRyxTQUFTLENBQUMsU0FBUyxHQUFHLEdBQUcsaUJBQWlCLENBQUMsU0FBUyxDQUFDLGVBQWUsQ0FBQyxFQUFFLENBQUM7QUFFdkgsb0dBQW9HO0FBQ3BHLE1BQU0sQ0FBQyxNQUFNLDBCQUEwQixHQUFHLENBQUMsVUFBbUMsRUFBVSxFQUFFO0lBQ3hGLFFBQVEsVUFBVSxFQUFFLENBQUM7UUFDbkIsS0FBSyxNQUFNLEVBQUUsT0FBTyxFQUFFLENBQUM7UUFDdkIsS0FBSyxhQUFhLEVBQUUsT0FBTyxtQ0FBbUMsQ0FBQztRQUMvRCxLQUFLLG9CQUFvQixFQUFFLE9BQU8sZ0VBQWdFLENBQUM7UUFDbkcsS0FBSyxzQkFBc0IsRUFBRSxPQUFPLG9DQUFvQyxDQUFDO1FBQ3pFLEtBQUssbUJBQW1CLEVBQUUsT0FBTyx1Q0FBdUMsQ0FBQztRQUN6RSxLQUFLLHFCQUFxQixFQUFFLE9BQU8sMkNBQTJDLENBQUM7UUFDL0UsS0FBSyxtQkFBbUIsRUFBRSxPQUFPLGdEQUFnRCxDQUFDO1FBQ2xGLEtBQUssaUJBQWlCLEVBQUUsT0FBTyw0REFBNEQsQ0FBQztRQUM1RixLQUFLLFNBQVMsRUFBRSxPQUFPLHNDQUFzQyxDQUFDO1FBQzlELEtBQUssbUJBQW1CLEVBQUUsT0FBTyxxRUFBcUUsQ0FBQztRQUN2RyxLQUFLLFNBQVMsRUFBRSxPQUFPLDZDQUE2QyxDQUFDO0lBQ3ZFLENBQUM7QUFDSCxDQUFDLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aG9yaXR5LXVzYWdld2luZG93cy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX2F1dGhzd2l0Y2gvYXV0aG9yaXR5LXVzYWdld2luZG93cy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFTQSxPQUFPLEVBQUUsaUJBQWlCLEVBQUUsTUFBTSxlQUFlLENBQUM7QUErQmxELDRGQUE0RjtBQUM1RixNQUFNLGFBQWEsR0FBRyxDQUFDLFlBQTJCLEVBQ2hELFVBQStDLEVBQTRCLEVBQUUsQ0FBQyxDQUM5RSxDQUFDLFVBQVUsRUFBRSxhQUFhLEVBQUUsVUFBVSxFQUFFLGVBQWUsQ0FBQztLQUNyRCxNQUFNLENBQUMsQ0FBQyxTQUFTLEVBQThDLEVBQUUsQ0FBQyxTQUFTLEtBQUssU0FBUyxDQUFDO0tBQzFGLEdBQUcsQ0FBQyxDQUFDLFNBQVMsRUFBRSxFQUFFLENBQUMsQ0FBQztJQUNuQixLQUFLLEVBQUUsSUFBSTtJQUNYLFNBQVMsRUFBRSxZQUFZO0lBQ3ZCLEtBQUssRUFBRSxZQUFZLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxTQUFrQixDQUFDLENBQUMsQ0FBQyxTQUFrQjtJQUN0RSxlQUFlLEVBQUUsU0FBUyxDQUFDLGtCQUFrQjtJQUM3QyxXQUFXLEVBQUUsU0FBUyxDQUFDLFdBQVc7SUFDbEMsb0JBQW9CLEVBQUUsU0FBUyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLG9CQUFvQixJQUFJLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSTtJQUN6RixPQUFPLEVBQUUsSUFBSSxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsR0FBRyxJQUFJLENBQUMsQ0FBQyxXQUFXLEVBQUU7Q0FDM0QsQ0FBQyxDQUFDLENBQ04sQ0FBQztBQUVGLDhGQUE4RjtBQUM5RixNQUFNLENBQUMsTUFBTSwwQkFBMEIsR0FBRyxlQUFlLENBQUM7QUFFMUQ7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLENBQUMsVUFBMEMsRUFBNEIsRUFBRTtJQUM3RyxJQUFJLFVBQVUsS0FBSyxJQUFJO1FBQUUsT0FBTyxFQUFFLENBQUM7SUFDbkMsUUFBUSxVQUFVLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDeEIsS0FBSyxRQUFRO1lBQ1gsT0FBTztnQkFDTCxHQUFHLGFBQWEsQ0FBQyxJQUFJLEVBQUUsVUFBVSxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUM7Z0JBQ3ZELEdBQUcsVUFBVSxDQUFDLFVBQVUsQ0FBQyxvQkFBb0IsQ0FBQyxPQUFPLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQ2xFLGFBQWEsQ0FBQyxRQUFRLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxTQUFTLENBQUMsQ0FDdEQsQ0FBQzthQUNILENBQUM7UUFDSixLQUFLLFdBQVc7WUFDZCxPQUFPLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxPQUFPLElBQUksRUFBRSxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsU0FBUyxFQUFFLEVBQUUsQ0FBQyxDQUFDO2dCQUMzRCxLQUFLLEVBQUUsU0FBUyxDQUFDLEtBQUs7Z0JBQ3RCLFNBQVMsRUFBRSxJQUFJO2dCQUNmLEtBQUssRUFBRSxTQUFTLENBQUMsS0FBSztnQkFDdEIsZUFBZSxFQUFFLFNBQVMsQ0FBQyxlQUFlO2dCQUMxQyxXQUFXLEVBQUUsU0FBUyxDQUFDLFdBQVc7Z0JBQ2xDLG9CQUFvQixFQUFFLFNBQVMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxvQkFBb0IsSUFBSSxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUk7Z0JBQ3pGLE9BQU8sRUFBRSxTQUFTLENBQUMsT0FBTzthQUMzQixDQUFDLENBQUMsQ0FBQztRQUNOLEtBQUssT0FBTyxFQUFFLENBQUM7WUFDYixNQUFNLEtBQUssR0FBRyxVQUFVLENBQUMsS0FBSyxDQUFDO1lBQy9CLElBQUksS0FBSyxDQUFDLGFBQWEsS0FBSyxJQUFJO2dCQUFFLE9BQU8sRUFBRSxDQUFDO1lBQzVDLE9BQU8sQ0FBQztvQkFDTixLQUFLLEVBQUUsMEJBQTBCO29CQUNqQyxTQUFTLEVBQUUsSUFBSTtvQkFDZixLQUFLLEVBQUUsU0FBUztvQkFDaEIsZUFBZSxFQUFFLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLENBQUMsR0FBRyxJQUFJO29CQUNuRixXQUFXLEVBQUUsS0FBSyxDQUFDLGFBQWEsR0FBRyxHQUFHLEdBQUcsS0FBSyxDQUFDLGFBQWE7b0JBQzVELG9CQUFvQixFQUFFLElBQUk7b0JBQzFCLE9BQU8sRUFBRSxLQUFLLENBQUMsT0FBTztpQkFDdkIsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUNELFNBQVMsQ0FBQztZQUNSLE1BQU0sZ0JBQWdCLEdBQVUsVUFBVSxDQUFDO1lBQzNDLE9BQU8sZ0JBQWdCLENBQUM7UUFDMUIsQ0FBQztJQUNILENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRixnSEFBZ0g7QUFDaEgsTUFBTSxDQUFDLE1BQU0sNEJBQTRCLEdBQUcsQ0FBQyxTQUFpQyxFQUFVLEVBQUUsQ0FDeEYsU0FBUyxDQUFDLG9CQUFvQixJQUFJLFNBQVMsQ0FBQyxXQUFXLENBQUM7QUFFMUQsbUhBQW1IO0FBQ25ILE1BQU0sQ0FBQyxNQUFNLHlCQUF5QixHQUFHLENBQUMsU0FBaUMsRUFBVSxFQUFFLENBQUMsU0FBUyxDQUFDLEtBQUs7T0FDbEcsR0FBRyxTQUFTLENBQUMsU0FBUyxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxHQUFHLFNBQVMsQ0FBQyxTQUFTLEdBQUcsR0FBRyxpQkFBaUIsQ0FBQyxTQUFTLENBQUMsZUFBZSxDQUFDLEVBQUUsQ0FBQztBQUV2SCxvR0FBb0c7QUFDcEcsTUFBTSxDQUFDLE1BQU0sMEJBQTBCLEdBQUcsQ0FBQyxVQUFtQyxFQUFVLEVBQUU7SUFDeEYsUUFBUSxVQUFVLEVBQUUsQ0FBQztRQUNuQixLQUFLLE1BQU0sRUFBRSxPQUFPLEVBQUUsQ0FBQztRQUN2QixLQUFLLGFBQWEsRUFBRSxPQUFPLG1DQUFtQyxDQUFDO1FBQy9ELEtBQUssb0JBQW9CLEVBQUUsT0FBTyxnRUFBZ0UsQ0FBQztRQUNuRyxLQUFLLHNCQUFzQixFQUFFLE9BQU8sb0NBQW9DLENBQUM7UUFDekUsS0FBSyxtQkFBbUIsRUFBRSxPQUFPLHVDQUF1QyxDQUFDO1FBQ3pFLEtBQUsscUJBQXFCLEVBQUUsT0FBTywyQ0FBMkMsQ0FBQztRQUMvRSxLQUFLLG1CQUFtQixFQUFFLE9BQU8sZ0RBQWdELENBQUM7UUFDbEYsS0FBSyxpQkFBaUIsRUFBRSxPQUFPLDREQUE0RCxDQUFDO1FBQzVGLEtBQUssU0FBUyxFQUFFLE9BQU8sc0NBQXNDLENBQUM7UUFDOUQsS0FBSyxtQkFBbUIsRUFBRSxPQUFPLHFFQUFxRSxDQUFDO1FBQ3ZHLEtBQUssU0FBUyxFQUFFLE9BQU8sNkNBQTZDLENBQUM7UUFDckUsS0FBSyxtQkFBbUIsRUFBRSxPQUFPLGlGQUFpRjtjQUM5RyxjQUFjLENBQUM7SUFDckIsQ0FBQztBQUNILENBQUMsQ0FBQyJ9

package/dist_ts_authswitch/classes.authoritybroker.d.ts

@@ -1,8 +1,10 @@
 import { AuthSwitchOpenAiProvider } from './classes.openaiprovider.js';
 import type { IOpenAiOAuthCredential } from './interfaces.openai.js';
 import type { IAuthSwitchAccount, IAuthSwitchAccountEvent, IAuthSwitchBinding, IAuthSwitchOperation, IAuthSwitchSnapshot, IReq_AuthSwitchSnapshot, TAuthSwitchRevocation } from './authority-contract.js';
-import { AuthSwitchAuthorityDatabase } from './classes.authoritydatabase.js';
-import type { IStoredAuthorityAccount, IStoredAuthorityGrant } from './classes.authoritymodels.js';
+import { type TAuthSwitchApiKeyProvider } from './authority-contract.js';
+import { type TAuthSwitchApiKeyVerifier } from './authority-apikeys.js';
+import { AuthSwitchAuthorityDatabase, type TAuthSwitchBindPurpose } from './classes.authoritydatabase.js';
+import { type IStoredAuthorityAccount, type IStoredAuthorityGrant } from './classes.authoritymodels.js';
 import type { IAuthSwitchUsageContext } from './classes.authorityusage.js';
 import type { IClaudeNativeLogin } from './classes.claudenative.js';
 import { type IAuthSwitchSecretCodec } from './classes.authoritysecrets.js';
@@ -14,11 +16,10 @@ export interface IAuthSwitchAuthorityBrokerOptions {
     now?: () => number;
     proactive?: boolean;
     /**
-     * Asks Anthropic whether it accepts an API key before the authority stores it: by default a read of the models
-     * the key may use. It fails with `AnthropicApiKeyAuthError` for a key Anthropic rejected, otherwise with whatever
-     * kept the question from being answered.
+     * Asks a provider whether it accepts an API key before the authority stores it (`TAuthSwitchApiKeyVerifier`): by
+     * default a read of the models the key may use (`authSwitchApiKeyVerifier`).
      */
-    verifyAnthropicApiKey?: (apiKey: string, signal: AbortSignal) => Promise<void>;
+    verifyApiKey?: TAuthSwitchApiKeyVerifier;
 }
 export interface IAuthSwitchResolvedAccess {
     accessToken: string;
@@ -48,7 +49,7 @@ export declare class AuthSwitchAuthorityBroker {
     private readonly secrets;
     private readonly now;
     private readonly proactive;
-    private readonly verifyAnthropicApiKey;
+    private readonly verifyApiKey;
     private readonly starts;
     private readonly operations;
     private readonly refreshes;
@@ -130,6 +131,11 @@ export declare class AuthSwitchAuthorityBroker {
     setAccountMaxUsage(accountId: string, expectedRevision: number, maxUsagePercent: number | null): Promise<IAuthSwitchAccount>;
     /** Lifts only the reserve, atomically with the account revision; the original threshold stays saved. */
     liftAccountReserve(accountId: string, expectedRevision: number, hours: number): Promise<IAuthSwitchAccount>;
+    /**
+     * Sets or clears an API key account's monthly spend limit, as `setAccountMaxUsage` changes a sign-in's threshold.
+     * A key's limit applies from the next request on, to the month's spend so far.
+     */
+    setAccountSpendLimit(accountId: string, expectedRevision: number, spendLimitMicroUsd: number | null): Promise<IAuthSwitchAccount>;
     /**
      * Sets or clears the date an account's subscription ends, as `setAccountMaxUsage` changes its threshold. The date is
      * stored in its ISO 8601 UTC form; a past one is kept as given and means the account lapsed already.
@@ -167,7 +173,7 @@ export declare class AuthSwitchAuthorityBroker {
     bindAccount(input: {
         accountId: string;
         loginId: string;
-        purpose: 'openai_managed' | 'claude_host_native' | 'anthropic_api_key';
+        purpose: TAuthSwitchBindPurpose;
         runtime: IAuthSwitchBinding['runtime'];
         scopeId: string;
         incarnationId: string;
@@ -215,20 +221,25 @@ export declare class AuthSwitchAuthorityBroker {
      */
     private resolveClaudeAccess;
     /**
-     * A bound Anthropic API key, with the refusals `resolveManagedAccess` gives. A key is never renewed: one Anthropic
-     * rejected for exactly this generation ends (`needs_reauth`, `provider_rejected`), and only adding a key it accepts
-     * brings the account back.
+     * A bound Anthropic or OpenAI API key, with the refusals `resolveManagedAccess` gives. A key is never renewed: one its
+     * provider rejected for exactly this generation ends (`needs_reauth`, `provider_rejected`), and only adding a key the
+     * provider accepts brings the account back.
+     */
+    private resolveApiKeyAccess;
+    /**
+     * The key a daemon-held API key grant seals, proven to be the key its account is named by: its provider's sealed
+     * kind (`apiKeySealedKinds`) and a key whose digest is the account's subject.
      */
-    private resolveAnthropicApiKeyAccess;
-    /** The key a daemon-held Anthropic API key grant seals, proven to be the key its account is named by. */
-    private openAnthropicApiKeyAccess;
+    private openApiKeyAccess;
     /**
-     * Adds an Anthropic API key as an account of its own once Anthropic accepted it. The key is sealed like every login
-     * the authority holds and never answered on the management socket again. A key the authority holds already is
-     * refused while its account is ready; adding it after its account was removed, or after Anthropic rejected it,
-     * brings that account back with a new authorization, so a runtime bound to it binds again.
+     * Adds an Anthropic or OpenAI API key as an account of its own once its provider accepted it. A key that begins the
+     * way the other provider's keys do is refused before any request. The key is sealed like every login the authority
+     * holds and never answered on the management socket again; the account keeps only how it ends (`keyHint`). A key the
+     * authority holds already is refused while its account is ready; adding it after its account was removed, or after
+     * its provider rejected it, brings that account back with a new authorization, so a runtime bound to it binds again,
+     * and with the spend limit it had unless the request names one.
      */
-    addAnthropicApiKey(apiKey: string, label?: string): Promise<{
+    addApiKey(providerId: TAuthSwitchApiKeyProvider, apiKey: string, label?: string, spendLimitMicroUsd?: number): Promise<{
         account: IAuthSwitchAccount;
         loginId: string;
     }>;