codex-multi-auth 2.16.0 → 2.17.0

package/dist/lib/policy/runtime-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-policy.d.ts","sourceRoot":"","sources":["../../../lib/policy/runtime-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErE,OAAO,EAGN,KAAK,kBAAkB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAKN,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEN,KAAK,4BAA4B,EACjC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,oBAAoB,EAGpB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,qBAAqB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,iBAAiB,EAAE,qBAAqB,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IAClC,eAAe,EAAE,kBAAkB,CAAC;IACpC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,OAAO,EAAE,4BAA4B,CAAC;CACtC;AAED,MAAM,WAAW,oBAAoB;IACpC,MAAM,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,WAAW,EAAE,MAAM,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACvC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED,wBAAsB,sBAAsB,CAC3C,QAAQ,SAAgB,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAO7B;AA6DD,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IAClD,KAAK,EAAE,kBAAkB,CAAC;IAC1B,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,gBAAgB,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;CACb,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA6GjC;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IACjD,MAAM,EAAE,iBAAiB,CAAC;IAC1B,SAAS,EAAE,oBAAoB,CAAC;IAChC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,oBAAoB,CAAC;CACrC,GAAG,oBAAoB,CAiCvB"}
+{"version":3,"file":"runtime-policy.d.ts","sourceRoot":"","sources":["../../../lib/policy/runtime-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErE,OAAO,EAGN,KAAK,kBAAkB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAKN,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEN,KAAK,4BAA4B,EACjC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,oBAAoB,EAGpB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,qBAAqB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,iBAAiB,EAAE,qBAAqB,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IAClC,eAAe,EAAE,kBAAkB,CAAC;IACpC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,OAAO,EAAE,4BAA4B,CAAC;CACtC;AAED,MAAM,WAAW,oBAAoB;IACpC,MAAM,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,WAAW,EAAE,MAAM,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACvC,OAAO,EAAE,kBAAkB,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAED,wBAAsB,sBAAsB,CAC3C,QAAQ,SAAgB,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAO7B;AA6DD,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IAClD,KAAK,EAAE,kBAAkB,CAAC;IAC1B,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,gBAAgB,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;CACb,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAgHjC;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IACjD,MAAM,EAAE,iBAAiB,CAAC;IAC1B,SAAS,EAAE,oBAAoB,CAAC;IAChC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,oBAAoB,CAAC;CACrC,GAAG,oBAAoB,CAiCvB"}

package/dist/lib/policy/runtime-policy.js

@@ -72,6 +72,7 @@ export async function evaluateRuntimePolicy(input) {
     const blockedAccountIndexes = new Set();
     const blockedAccountReasons = {};
     const scoreBoostByAccount = {};
+    const priorityByAccount = {};
     const profile = input.state.project.profile;
     if (profile?.modelDenylist.length && matchesModel(profile.modelDenylist, input.model)) {
         reasons.push("routing profile denies requested model");
@@ -101,6 +102,7 @@ export async function evaluateRuntimePolicy(input) {
             refreshToken: account.refreshToken ?? undefined,
         }, account.index);
         const accountPolicy = input.state.accountPolicies.accounts[accountKey];
+        priorityByAccount[account.index] = accountPolicy?.priority ?? 1;
         let boost = 0;
         if (accountPolicy?.paused) {
             blockedAccountIndexes.add(account.index);
@@ -155,6 +157,7 @@ export async function evaluateRuntimePolicy(input) {
         blockedAccountIndexes,
         blockedAccountReasons,
         scoreBoostByAccount,
+        priorityByAccount,
         budgetEvaluations,
     };
 }

package/dist/lib/preemptive-quota-scheduler.d.ts

@@ -58,6 +58,8 @@ export declare class PreemptiveQuotaScheduler {
      * silent clear-all; use `clearAll()` when that is the intent.
      */
     clearByPrefix(prefix: string): void;
+    /** Forget one verified recovered model; preserve sibling quota buckets. */
+    clear(key: string): void;
     /** Forget every cached quota observation. */
     clearAll(): void;
     prune(now?: number): number;

package/dist/lib/preemptive-quota-scheduler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"preemptive-quota-scheduler.d.ts","sourceRoot":"","sources":["../../lib/preemptive-quota-scheduler.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,oBAAoB;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,oBAAoB,CAAC;IAC9B,SAAS,EAAE,oBAAoB,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACrC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,YAAY,GAAG,uBAAuB,CAAC;CAChD;AAED,MAAM,WAAW,qBAAqB;IACrC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gCAAgC,CAAC,EAAE,MAAM,CAAC;IAC1C,kCAAkC,CAAC,EAAE,MAAM,CAAC;IAC5C,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AA6GD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,sBAAsB,GAAG,IAAI,CAqB5H;AAED,qBAAa,wBAAwB;IACpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6C;IACvE,OAAO,CAAC,OAAO,CAAU;IACzB,OAAO,CAAC,gCAAgC,CAAS;IACjD,OAAO,CAAC,kCAAkC,CAAS;IACnD,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,WAAW,CAAK;gBAEZ,OAAO,GAAE,qBAA0B;IAQ/C,SAAS,CAAC,OAAO,GAAE,qBAA0B,GAAG,IAAI;IA2CpD,OAAO,CAAC,UAAU;IAMlB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,GAAG,IAAI;IAM3D,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,IAAI;IA8B1E,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,qBAAqB;IAkEjE;;;;;;;;OAQG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAOnC,6CAA6C;IAC7C,QAAQ,IAAI,IAAI;IAIhB,KAAK,CAAC,GAAG,SAAa,GAAG,MAAM;CAW/B"}
+{"version":3,"file":"preemptive-quota-scheduler.d.ts","sourceRoot":"","sources":["../../lib/preemptive-quota-scheduler.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,oBAAoB;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,oBAAoB,CAAC;IAC9B,SAAS,EAAE,oBAAoB,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACrC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,YAAY,GAAG,uBAAuB,CAAC;CAChD;AAED,MAAM,WAAW,qBAAqB;IACrC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gCAAgC,CAAC,EAAE,MAAM,CAAC;IAC1C,kCAAkC,CAAC,EAAE,MAAM,CAAC;IAC5C,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AA6GD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,sBAAsB,GAAG,IAAI,CAqB5H;AAED,qBAAa,wBAAwB;IACpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6C;IACvE,OAAO,CAAC,OAAO,CAAU;IACzB,OAAO,CAAC,gCAAgC,CAAS;IACjD,OAAO,CAAC,kCAAkC,CAAS;IACnD,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,WAAW,CAAK;gBAEZ,OAAO,GAAE,qBAA0B;IAQ/C,SAAS,CAAC,OAAO,GAAE,qBAA0B,GAAG,IAAI;IA2CpD,OAAO,CAAC,UAAU;IAMlB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,GAAG,IAAI;IAM3D,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,IAAI;IA8B1E,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,qBAAqB;IAkEjE;;;;;;;;OAQG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAOnC,2EAA2E;IAC3E,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAIxB,6CAA6C;IAC7C,QAAQ,IAAI,IAAI;IAIhB,KAAK,CAAC,GAAG,SAAa,GAAG,MAAM;CAW/B"}

package/dist/lib/preemptive-quota-scheduler.js

@@ -281,6 +281,10 @@ export class PreemptiveQuotaScheduler {
                 this.snapshots.delete(key);
         }
     }
+    /** Forget one verified recovered model; preserve sibling quota buckets. */
+    clear(key) {
+        this.snapshots.delete(key);
+    }
     /** Forget every cached quota observation. */
     clearAll() {
         this.snapshots.clear();

package/dist/lib/quota-probe.d.ts

@@ -1,3 +1,4 @@
+import { FirstUseProbeError } from "./runtime/subscription-first-use.js";
 /**
  * Human-readable note shown when a live probe fails solely because the account
  * lacks Codex entitlement (see {@link CodexUnavailableError}). Centralized so
@@ -25,6 +26,8 @@ export interface CodexQuotaWindow {
     resetAtMs?: number;
 }
 export interface CodexQuotaSnapshot {
+    primingCompleted?: boolean;
+    primingFailure?: FirstUseProbeError["reason"];
     status: number;
     planType?: string;
     activeLimit?: number;
@@ -57,6 +60,8 @@ export declare function formatQuotaResetAt(resetAtMs: number | undefined, nowMs?
  */
 export declare function formatQuotaSnapshotLine(snapshot: CodexQuotaSnapshot): string;
 export interface ProbeCodexQuotaOptions {
+    signal?: AbortSignal;
+    primeUnusedSubscription?: boolean;
     accountId: string;
     accessToken: string;
     model?: string;

package/dist/lib/quota-probe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"quota-probe.d.ts","sourceRoot":"","sources":["../../lib/quota-probe.ts"],"names":[],"mappings":"AAYA;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,yCAAyC,CAAC;AAEnF;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACxC,KAAK,EAAE,OAAO,EACd,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GACrC,MAAM,CAMR;AAED,MAAM,WAAW,gBAAgB;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,SAAS,EAAE,gBAAgB,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;CACd;AA0MD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CACjC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,KAAK,SAAa,GAChB,MAAM,GAAG,SAAS,CAqBpB;AAwBD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAa5E;AAED,MAAM,WAAW,sBAAsB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,uBAAuB,CAC5C,OAAO,EAAE,sBAAsB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CA4G7B"}
+{"version":3,"file":"quota-probe.d.ts","sourceRoot":"","sources":["../../lib/quota-probe.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,kBAAkB,EAAyD,MAAM,qCAAqC,CAAC;AAEhI;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,yCAAyC,CAAC;AAEnF;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACxC,KAAK,EAAE,OAAO,EACd,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GACrC,MAAM,CAMR;AAED,MAAM,WAAW,gBAAgB;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IAClC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,SAAS,EAAE,gBAAgB,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;CACd;AAiND;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CACjC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,KAAK,SAAa,GAChB,MAAM,GAAG,SAAS,CAqBpB;AAwBD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAa5E;AAED,MAAM,WAAW,sBAAsB;IACtC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,uBAAuB,CAC5C,OAAO,EAAE,sBAAsB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CA0H7B"}

package/dist/lib/quota-probe.js

@@ -1,10 +1,11 @@
-import { CODEX_BASE_URL } from "./constants.js";
+import { CODEX_BASE_URL, MAX_RATE_LIMIT_DELAY_MS } from "./constants.js";
 import { createCodexHeaders, getUnsupportedCodexModelInfo } from "./request/fetch-helpers.js";
 import { QUOTA_PROBE_MODEL_CHAIN, resolveProbeReasoningEffort, } from "./request/helpers/model-map.js";
 import { CodexUnavailableError, isCodexUnavailableError } from "./errors.js";
 import { getCodexInstructions } from "./prompts/codex.js";
 import { mutateRuntimeObservabilitySnapshot } from "./runtime/runtime-observability.js";
 import { isRecord } from "./utils.js";
+import { FirstUseProbeError, finishSubscriptionFirstUse, needsSubscriptionFirstUse } from "./runtime/subscription-first-use.js";
 /**
  * Human-readable note shown when a live probe fails solely because the account
  * lacks Codex entitlement (see {@link CodexUnavailableError}). Centralized so
@@ -79,6 +80,12 @@ function parseFiniteIntHeader(headers, name) {
  * Security: does not emit or persist header values; callers must redact any sensitive tokens before storing or logging headers.
  */
 function parseResetAtMs(headers, prefix) {
+    const raw = parseUnboundedResetAtMs(headers, prefix);
+    // A bogus header (finite, but overflowing once scaled to ms) must not read as
+    // a window that never resets.
+    return raw === undefined || Number.isNaN(raw) ? undefined : Math.min(raw, Date.now() + MAX_RATE_LIMIT_DELAY_MS);
+}
+function parseUnboundedResetAtMs(headers, prefix) {
     const resetAfterSeconds = parseFiniteIntHeader(headers, `${prefix}-reset-after-seconds`);
     if (typeof resetAfterSeconds === "number" && resetAfterSeconds > 0) {
         return Date.now() + resetAfterSeconds * 1000;
@@ -324,9 +331,11 @@ export async function fetchCodexQuotaSnapshot(options) {
     let sawUnsupportedModel = false;
     let sawOtherFailure = false;
     for (const model of models) {
+        options.signal?.throwIfAborted();
         attemptedAnyModel = true;
         try {
             const instructions = await getCodexInstructions(model);
+            options.signal?.throwIfAborted();
             const probeBody = {
                 model,
                 stream: true,
@@ -362,7 +371,7 @@ export async function fetchCodexQuotaSnapshot(options) {
                     method: "POST",
                     headers,
                     body: JSON.stringify(probeBody),
-                    signal: controller.signal,
+                    signal: options.signal ? AbortSignal.any([controller.signal, options.signal]) : controller.signal,
                 });
             }
             finally {
@@ -370,6 +379,18 @@ export async function fetchCodexQuotaSnapshot(options) {
             }
             const snapshotBase = parseQuotaSnapshotBase(response.headers, response.status);
             if (snapshotBase) {
+                if (options.primeUnusedSubscription && needsSubscriptionFirstUse(snapshotBase, Date.now())) {
+                    try {
+                        await finishSubscriptionFirstUse(response, timeoutMs);
+                        return { ...snapshotBase, model, primingCompleted: true };
+                    }
+                    catch (error) {
+                        // Keep valid quota data without retrying an accepted inference.
+                        if (error instanceof FirstUseProbeError)
+                            return { ...snapshotBase, model, primingFailure: error.reason };
+                        throw error;
+                    }
+                }
                 try {
                     await response.body?.cancel();
                 }
@@ -406,6 +427,9 @@ export async function fetchCodexQuotaSnapshot(options) {
             lastError = new Error("Codex response did not include quota headers");
         }
         catch (error) {
+            options.signal?.throwIfAborted();
+            if (error instanceof FirstUseProbeError)
+                throw error;
             sawOtherFailure = true;
             lastError = error instanceof Error ? error : new Error(String(error));
         }

package/dist/lib/request/client-cancellation.d.ts

@@ -0,0 +1,5 @@
+/** Internal transport marker: upstream timeouts may also use AbortError. */
+export declare class ClientCancellationError extends Error {
+    constructor();
+}
+//# sourceMappingURL=client-cancellation.d.ts.map

package/dist/lib/request/client-cancellation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-cancellation.d.ts","sourceRoot":"","sources":["../../../lib/request/client-cancellation.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,qBAAa,uBAAwB,SAAQ,KAAK;;CAKjD"}

package/dist/lib/request/client-cancellation.js

@@ -0,0 +1,7 @@
+/** Internal transport marker: upstream timeouts may also use AbortError. */
+export class ClientCancellationError extends Error {
+    constructor() {
+        super("Client cancelled request");
+        this.name = "AbortError";
+    }
+}

package/dist/lib/request/response-outcome.d.ts

@@ -0,0 +1,25 @@
+export interface StreamCompletion {
+    success: boolean;
+    errorCode: string | null;
+    missingTerminal: boolean;
+}
+/** Protocol completion, separate from socket delivery. Never retain output or error messages. */
+export declare class ResponseOutcome {
+    private readonly requireTerminal;
+    private terminal;
+    rejection: {
+        error: {
+            code?: string;
+            param?: string;
+        };
+    } | undefined;
+    constructor(requireTerminal: boolean);
+    observe(value: unknown): void;
+    /**
+     * `response.incomplete` (e.g. max_output_tokens) is a delivered response, not an
+     * account failure: it counts as success for health and affinity, and its terminal
+     * type survives only as the usage annotation in `errorCode`.
+     */
+    finish(): StreamCompletion;
+}
+//# sourceMappingURL=response-outcome.d.ts.map

package/dist/lib/request/response-outcome.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-outcome.d.ts","sourceRoot":"","sources":["../../../lib/request/response-outcome.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,gBAAgB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,eAAe,EAAE,OAAO,CAAC;CACzB;AAED,iGAAiG;AACjG,qBAAa,eAAe;IAIf,OAAO,CAAC,QAAQ,CAAC,eAAe;IAH5C,OAAO,CAAC,QAAQ,CAAkE;IAClF,SAAS,EAAE;QAAE,KAAK,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,SAAS,CAAC;gBAEvC,eAAe,EAAE,OAAO;IAErD,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI;IAuB7B;;;;OAIG;IACH,MAAM,IAAI,gBAAgB;CAS1B"}

package/dist/lib/request/response-outcome.js

@@ -0,0 +1,49 @@
+import { isRecord } from "../utils.js";
+/** Protocol completion, separate from socket delivery. Never retain output or error messages. */
+export class ResponseOutcome {
+    requireTerminal;
+    terminal;
+    rejection;
+    constructor(requireTerminal) {
+        this.requireTerminal = requireTerminal;
+    }
+    observe(value) {
+        if (!isRecord(value))
+            return;
+        let type = value.type ?? (value.object === "response" && typeof value.status === "string" ? `response.${value.status}` : undefined);
+        // SSE `response.done` carries its outcome in the nested status.
+        if (type === "response.done") {
+            const status = isRecord(value.response) ? value.response.status : undefined;
+            type = typeof status === "string" ? `response.${status}` : "response.completed";
+        }
+        if (type === "response.completed") {
+            if (!this.terminal)
+                this.terminal = "completed";
+            return;
+        }
+        const failure = type === "response.failed" || type === "error";
+        if (!failure && type !== "response.incomplete" && type !== "response.cancelled")
+            return;
+        this.terminal = failure ? "failed" : type === "response.incomplete" ? "incomplete" : "cancelled";
+        const response = isRecord(value.response) ? value.response : value;
+        const error = isRecord(response.error) ? response.error : type === "error" ? value : undefined;
+        if (error) {
+            const safe = (v) => typeof v === "string" && /^[A-Za-z0-9._-]{1,100}$/.test(v) ? v : undefined;
+            this.rejection = { error: { code: safe(error.code), param: safe(error.param) } };
+        }
+    }
+    /**
+     * `response.incomplete` (e.g. max_output_tokens) is a delivered response, not an
+     * account failure: it counts as success for health and affinity, and its terminal
+     * type survives only as the usage annotation in `errorCode`.
+     */
+    finish() {
+        const missingTerminal = this.requireTerminal && !this.terminal;
+        const success = !missingTerminal && (!this.terminal || this.terminal === "completed" || this.terminal === "incomplete");
+        return {
+            success,
+            missingTerminal,
+            errorCode: missingTerminal ? "upstream_missing_terminal" : this.terminal && this.terminal !== "completed" ? `upstream_response_${this.terminal}` : null,
+        };
+    }
+}

package/dist/lib/request/stream-failover-runtime.d.ts

@@ -1,5 +1,6 @@
 import type { ServerResponse } from "node:http";
 import type { RuntimeRotationProxyStatus } from "../runtime/rotation-server-types.js";
+import type { StreamCompletion } from "./response-outcome.js";
 export declare const HOP_BY_HOP_HEADERS: Set<string>;
 export declare function responseHeadersForClient(upstreamHeaders: Headers): Record<string, string>;
 export declare function withTimeout<T>(promise: Promise<T>, timeoutMs: number, onTimeout: () => void, message: string): Promise<T>;
@@ -13,5 +14,5 @@ export declare function forwardStreamingResponse(upstream: Response, res: Server
  */
 onChunk?: (chunk: Uint8Array) => void, 
 /** Additional response headers, applied after (so they can override) the forwarded upstream ones. */
-extraHeaders?: Record<string, string>): Promise<boolean>;
+extraHeaders?: Record<string, string>, completion?: () => StreamCompletion): Promise<boolean>;
 //# sourceMappingURL=stream-failover-runtime.d.ts.map

package/dist/lib/request/stream-failover-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stream-failover-runtime.d.ts","sourceRoot":"","sources":["../../../lib/request/stream-failover-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEtF,eAAO,MAAM,kBAAkB,aAW7B,CAAC;AAWH,wBAAgB,wBAAwB,CAAC,eAAe,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAUzF;AAED,wBAAsB,WAAW,CAAC,CAAC,EAClC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,IAAI,EACrB,OAAO,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,CAAC,CAmBZ;AAED,wBAAsB,aAAa,CAClC,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,QAAQ,SAAc,GACpB,OAAO,CAAC,MAAM,CAAC,CAuDjB;AAoBD,wBAAsB,wBAAwB,CAC7C,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,0BAA0B,EAClC,aAAa,EAAE,MAAM,IAAI,EACzB,oBAAoB,EAAE,MAAM;AAC5B;;;;;GAKG;AACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI;AACrC,qGAAqG;AACrG,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACnC,OAAO,CAAC,OAAO,CAAC,CAsDlB"}
+{"version":3,"file":"stream-failover-runtime.d.ts","sourceRoot":"","sources":["../../../lib/request/stream-failover-runtime.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,eAAO,MAAM,kBAAkB,aAW7B,CAAC;AAWH,wBAAgB,wBAAwB,CAAC,eAAe,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAUzF;AAED,wBAAsB,WAAW,CAAC,CAAC,EAClC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,IAAI,EACrB,OAAO,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,CAAC,CAmBZ;AAED,wBAAsB,aAAa,CAClC,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,QAAQ,SAAc,GACpB,OAAO,CAAC,MAAM,CAAC,CAuDjB;AAoBD,wBAAsB,wBAAwB,CAC7C,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,0BAA0B,EAClC,aAAa,EAAE,MAAM,IAAI,EACzB,oBAAoB,EAAE,MAAM;AAC5B;;;;;GAKG;AACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI;AACrC,qGAAqG;AACrG,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACrC,UAAU,CAAC,EAAE,MAAM,gBAAgB,GACjC,OAAO,CAAC,OAAO,CAAC,CAmElB"}

package/dist/lib/request/stream-failover-runtime.js

@@ -1,3 +1,4 @@
+import { ClientCancellationError } from "./client-cancellation.js";
 export const HOP_BY_HOP_HEADERS = new Set([
     "connection",
     "content-length",
@@ -137,19 +138,34 @@ export async function forwardStreamingResponse(upstream, res, status, onStreamEr
  */
 onChunk, 
 /** Additional response headers, applied after (so they can override) the forwarded upstream ones. */
-extraHeaders) {
+extraHeaders, completion) {
     status.streamsStarted += 1;
     res.writeHead(upstream.status, {
         ...responseHeadersForClient(upstream.headers),
         ...extraHeaders,
     });
-    if (!upstream.body) {
+    let clientDisconnected = false;
+    const finish = () => {
+        if (clientDisconnected || res.destroyed)
+            return false;
+        const result = completion?.();
+        // Already ended by a concurrent close path: never write after end.
+        if (res.writableEnded)
+            return false;
+        if (result && !result.success) {
+            status.lastError = result.errorCode;
+            if (result.missingTerminal)
+                res.write(Buffer.from(`data: ${JSON.stringify({ type: "error", error: { code: result.errorCode, message: "Upstream ended before completing the response." } })}\n\n`));
+        }
         res.end();
-        return true;
-    }
+        return result?.success ?? true;
+    };
+    if (!upstream.body)
+        return finish();
     const reader = upstream.body.getReader();
     res.on("close", () => {
         if (!res.writableEnded) {
+            clientDisconnected = true;
             void reader.cancel().catch(() => undefined);
         }
     });
@@ -163,10 +179,9 @@ extraHeaders) {
             if (value && value.byteLength > 0) {
                 onChunk?.(value);
                 // If the response is already finished (clean end by a concurrent
-                // close-then-reader-cancel path), stop writing. Do NOT guard on
-                // res.destroyed here: a socket-error-during-backpressure scenario sets
-                // destroyed=true and then lets the next res.write() throw so the catch
-                // block can record the error and fire onStreamError correctly.
+                // close-then-reader-cancel path), stop writing. A destroyed response
+                // is left to the next res.write(), which throws into the catch below;
+                // that path returns false without penalizing the upstream account.
                 if (res.writableEnded)
                     break;
                 // Respect backpressure: when the client's socket buffer is full,
@@ -177,10 +192,14 @@ extraHeaders) {
                 }
             }
         }
-        res.end();
-        return true;
+        return finish();
     }
     catch (error) {
+        if (clientDisconnected || res.destroyed || (error instanceof ClientCancellationError)) {
+            if (!res.destroyed)
+                res.destroy();
+            return false;
+        }
         status.lastError = error instanceof Error ? error.message : String(error);
         onStreamError();
         if (!res.destroyed) {

package/dist/lib/runtime/account-check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-check.d.ts","sourceRoot":"","sources":["../../../lib/runtime/account-check.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EACN,KAAK,gBAAgB,EAErB,KAAK,wBAAwB,EAE7B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,wBAAsB,sBAAsB,CAC3C,SAAS,EAAE,OAAO,EAClB,IAAI,EAAE;IACL,aAAa,EAAE,CACd,OAAO,EAAE,gBAAgB,GAAG,IAAI,KAC5B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACtC,YAAY,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrD,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;IAC3C,mBAAmB,EAAE,MAAM,OAAO,CAAC;QAClC,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,CAAC,CAAC;IACH,8BAA8B,EAAE,CAAC,cAAc,EAAE;QAChD,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,KAAK,wBAAwB,CAAC;IAC/B,2BAA2B,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAChE;QACA,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KAClB,GACD,IAAI,GACJ,SAAS,CACX,CAAC;IACF,gBAAgB,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;IAC1E,8BAA8B,EAAE,CAC/B,MAAM,EAAE,eAAe,GAAG,SAAS,EACnC,gBAAgB,EAAE,MAAM,GAAG,SAAS,KAChC,OAAO,CAAC;IACb,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;IACjE,mBAAmB,EAAE,CACpB,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,KACxB,MAAM,GAAG,SAAS,CAAC;IACxB,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9D,yBAAyB,EAAE,CAC1B,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC,KAC7C,OAAO,CAAC;IACb,uBAAuB,EAAE,CAAC,MAAM,EAAE;QACjC,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACpB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClC,uBAAuB,EAAE,CACxB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,eAAe,EAAE,eAAe,GAAG,SAAS,EAC5C,cAAc,EAAE,MAAM,GAAG,SAAS,KAC9B,MAAM,GAAG,SAAS,CAAC;IACxB,oBAAoB,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,MAAM,CAAC;IAC/D,yBAAyB,EAAE,CAC1B,OAAO,EAAE,gBAAgB,EACzB,aAAa,EAAE,SAAS,WAAW,EAAE,KACjC,IAAI,CAAC;IACV,cAAc,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,YAAY,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,6BAA6B,EAAE,MAAM,IAAI,CAAC;IAC1C,mBAAmB,EAAE,CAAC,OAAO,EAAE;QAC9B,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpB,+BAA+B,CAAC,EAAE,CACjC,cAAc,EAAE,gBAAgB,EAChC,cAAc,EAAE;QACf,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,KACG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC,GACC,OAAO,CAAC,IAAI,CAAC,CA2Sf"}
+{"version":3,"file":"account-check.d.ts","sourceRoot":"","sources":["../../../lib/runtime/account-check.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EACN,KAAK,gBAAgB,EAGrB,KAAK,wBAAwB,EAE7B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,wBAAsB,sBAAsB,CAC3C,SAAS,EAAE,OAAO,EAClB,IAAI,EAAE;IACL,aAAa,EAAE,CACd,OAAO,EAAE,gBAAgB,GAAG,IAAI,KAC5B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACtC,YAAY,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrD,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;IAC3C,mBAAmB,EAAE,MAAM,OAAO,CAAC;QAClC,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,CAAC,CAAC;IACH,8BAA8B,EAAE,CAAC,cAAc,EAAE;QAChD,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,KAAK,wBAAwB,CAAC;IAC/B,2BAA2B,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAChE;QACA,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KAClB,GACD,IAAI,GACJ,SAAS,CACX,CAAC;IACF,gBAAgB,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;IAC1E,8BAA8B,EAAE,CAC/B,MAAM,EAAE,eAAe,GAAG,SAAS,EACnC,gBAAgB,EAAE,MAAM,GAAG,SAAS,KAChC,OAAO,CAAC;IACb,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;IACjE,mBAAmB,EAAE,CACpB,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,KACxB,MAAM,GAAG,SAAS,CAAC;IACxB,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9D,yBAAyB,EAAE,CAC1B,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC,KAC7C,OAAO,CAAC;IACb,uBAAuB,EAAE,CAAC,MAAM,EAAE;QACjC,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACpB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClC,uBAAuB,EAAE,CACxB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,eAAe,EAAE,eAAe,GAAG,SAAS,EAC5C,cAAc,EAAE,MAAM,GAAG,SAAS,KAC9B,MAAM,GAAG,SAAS,CAAC;IACxB,oBAAoB,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,MAAM,CAAC;IAC/D,yBAAyB,EAAE,CAC1B,OAAO,EAAE,gBAAgB,EACzB,aAAa,EAAE,SAAS,WAAW,EAAE,KACjC,IAAI,CAAC;IACV,cAAc,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,YAAY,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,6BAA6B,EAAE,MAAM,IAAI,CAAC;IAC1C,mBAAmB,EAAE,CAAC,OAAO,EAAE;QAC9B,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpB,+BAA+B,CAAC,EAAE,CACjC,cAAc,EAAE,gBAAgB,EAChC,cAAc,EAAE;QACf,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;KACrC,KACG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC,GACC,OAAO,CAAC,IAAI,CAAC,CAqSf"}

package/dist/lib/runtime/account-check.js

@@ -1,17 +1,11 @@
 import { maskEmail } from "../logger.js";
 import { CODEX_UNAVAILABLE_PROBE_NOTE } from "../quota-probe.js";
 import { isCodexUnavailableError } from "../errors.js";
-import { bumpStorageAffinityGeneration, reconcilePinnedAccountIndex, } from "../storage.js";
+import { cloneTrackedAccountStorage, bumpStorageAffinityGeneration, reconcilePinnedAccountIndex, } from "../storage.js";
 export async function runRuntimeAccountCheck(deepProbe, deps) {
     const loadedStorage = await deps.hydrateEmails(await deps.loadAccounts());
     const workingStorage = loadedStorage
-        ? {
-            ...loadedStorage,
-            accounts: loadedStorage.accounts.map((account) => ({ ...account })),
-            activeIndexByFamily: loadedStorage.activeIndexByFamily
-                ? { ...loadedStorage.activeIndexByFamily }
-                : {},
-        }
+        ? cloneTrackedAccountStorage(loadedStorage)
         : deps.createEmptyStorage();
     if (workingStorage.accounts.length === 0) {
         deps.showLine("\nNo accounts to check.\n");

package/dist/lib/runtime/account-model-catalog.d.ts

@@ -0,0 +1,64 @@
+export declare class CatalogRetryError extends Error {
+    readonly retryAfterMs: number;
+    constructor(retryAfterMs: number);
+}
+export type CatalogModel = Record<string, unknown> & {
+    slug: string;
+};
+/** Upper bound for a catalog 429 backoff, whatever Retry-After the upstream sends. */
+export declare const MAX_CATALOG_RETRY_MS: number;
+export declare function clampCatalogRetryMs(retryAfterMs: number | null | undefined): number;
+/**
+ * Per-proxy discovery cache. Failed refreshes never advertise stale access, but
+ * they are "unknown", not "empty": only a successful fetch can exclude a model.
+ * Routing fails open: an outage or throttle lets inference through, and the last
+ * successfully fetched catalog (whatever its age) is the only thing that excludes.
+ */
+export declare class AccountModelCatalog {
+    private readonly fetchCatalog;
+    private readonly now;
+    private readonly ttlMs;
+    private readonly cache;
+    private readonly updated;
+    private readonly pending;
+    constructor(fetchCatalog: (accountKey: string) => Promise<unknown>, now?: () => number, ttlMs?: number);
+    private read;
+    /** Picker-only stale-while-refresh view; routing still awaits fresh discovery. */
+    cachedList(accountKeys: string[]): CatalogModel[];
+    invalidate(): void;
+    /** Retry discovery while retaining known routing exclusions if it fails. */
+    refresh(): void;
+    supportsCached(key: string, model: string, effort?: string, tier?: string): boolean;
+    /**
+     * Routing view: the last successful catalog decides, whatever its age. A workspace
+     * that has never been fetched successfully (outage, throttle, slow discovery) is
+     * unknown and stays routable; only a fetched catalog can exclude a model.
+     */
+    supportsForRouting(key: string, model: string, effort?: string, tier?: string): boolean;
+    /** Refresh in the background; one fresh eligible route is enough to dispatch early.
+     * After the wait, routing falls back to {@link supportsForRouting}. The caller still ranks eligible accounts.
+     */
+    prepareRouting(keys: string[], model: string, effort?: string, tier?: string, eligible?: (key: string) => boolean, waitMs?: number): Promise<"ready" | "unavailable">;
+    list(accountKeys: string[], referenceKey?: string): Promise<CatalogModel[]>;
+    /** True unless a successfully fetched catalog omits the model. */
+    supports(accountKey: string, model: string, effort?: string, tier?: string): Promise<boolean>;
+    snapshot(key: string): {
+        checkedAt: number;
+        models: string[];
+        entitlements: {
+            serviceTiers: {
+                id: string;
+                name: string;
+            }[];
+            reasoningLevels: string[];
+            accessPrograms: string[];
+            probes?: {
+                [k: string]: "unsupported" | "verified" | "unverified" | "downgraded";
+            } | undefined;
+            checkedAt?: number | undefined;
+            model: string;
+        }[];
+        error: boolean;
+    };
+}
+//# sourceMappingURL=account-model-catalog.d.ts.map

package/dist/lib/runtime/account-model-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-model-catalog.d.ts","sourceRoot":"","sources":["../../../lib/runtime/account-model-catalog.ts"],"names":[],"mappings":"AAKA,qBAAa,iBAAkB,SAAQ,KAAK;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM;gBAApB,YAAY,EAAE,MAAM;CACzC;AAED,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtE,sFAAsF;AACtF,eAAO,MAAM,oBAAoB,QAAc,CAAC;AAChD,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAGnF;AAED;;;;;GAKG;AACH,qBAAa,mBAAmB;IAQ9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK;IATvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAGlB;IACJ,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqD;gBAE3D,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EACtD,GAAG,GAAE,MAAM,MAAiB,EAC5B,KAAK,SAAa;YAEtB,IAAI;IAkDlB,kFAAkF;IAClF,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,YAAY,EAAE;IAOjD,UAAU,IAAI,IAAI;IAClB,4EAA4E;IAC5E,OAAO,IAAI,IAAI;IACf,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO;IAInF;;;;OAIG;IACH,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO;IAIvF;;OAEG;IACG,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EACjF,QAAQ,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAoB,EAAE,MAAM,SAAO,GAC5D,OAAO,CAAC,OAAO,GAAG,aAAa,CAAC;IAe7B,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAYjF,kEAAkE;IAC5D,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAInG,QAAQ,CAAC,GAAG,EAAE,MAAM;;;;;;;;;;;;;;;;;;CAIpB"}

package/dist/lib/runtime/account-model-catalog.js

@@ -0,0 +1,154 @@
+import { buildVisibleModelUnion, supportsModelSettings, modelEntitlements } from "../model-route-policy.js";
+import { mapWithConcurrency } from "../concurrency.js";
+import { clampCatalogContext, supportsCatalogSettings } from "./catalog-capabilities.js";
+import { isRecord } from "../utils.js";
+export class CatalogRetryError extends Error {
+    retryAfterMs;
+    constructor(retryAfterMs) {
+        super("Catalog temporarily rate limited");
+        this.retryAfterMs = retryAfterMs;
+    }
+}
+/** Upper bound for a catalog 429 backoff, whatever Retry-After the upstream sends. */
+export const MAX_CATALOG_RETRY_MS = 15 * 60_000;
+export function clampCatalogRetryMs(retryAfterMs) {
+    const value = typeof retryAfterMs === "number" && Number.isFinite(retryAfterMs) ? retryAfterMs : 60_000;
+    return Math.min(MAX_CATALOG_RETRY_MS, Math.max(60_000, value));
+}
+/**
+ * Per-proxy discovery cache. Failed refreshes never advertise stale access, but
+ * they are "unknown", not "empty": only a successful fetch can exclude a model.
+ * Routing fails open: an outage or throttle lets inference through, and the last
+ * successfully fetched catalog (whatever its age) is the only thing that excludes.
+ */
+export class AccountModelCatalog {
+    fetchCatalog;
+    now;
+    ttlMs;
+    cache = new Map();
+    updated = new Set();
+    pending = new Map();
+    constructor(fetchCatalog, now = Date.now, ttlMs = 5 * 60_000) {
+        this.fetchCatalog = fetchCatalog;
+        this.now = now;
+        this.ttlMs = ttlMs;
+    }
+    async read(key) {
+        const cached = this.cache.get(key);
+        if (cached && cached.expires > this.now())
+            return cached.models;
+        const existing = this.pending.get(key);
+        if (existing)
+            return existing;
+        const task = (async () => {
+            let models = null;
+            let retryMs = Math.min(this.ttlMs, 5000);
+            try {
+                const value = await this.fetchCatalog(key);
+                if (!isRecord(value) ||
+                    !Array.isArray(value.models) ||
+                    value.models.length > 1000 ||
+                    !value.models.every((m) => isRecord(m) &&
+                        typeof m.slug === "string" &&
+                        m.slug.length > 0 &&
+                        m.slug.length < 256)) {
+                    throw new Error("Invalid account model catalog");
+                }
+                models = value.models;
+            }
+            catch (error) {
+                if (error instanceof CatalogRetryError)
+                    retryMs = clampCatalogRetryMs(error.retryAfterMs);
+                /* Unknown; list() advertises nothing from it and supports() fails open. */
+            }
+            const previous = this.cache.get(key);
+            if (!previous && this.cache.size >= 3000)
+                this.cache.delete(this.cache.keys().next().value ?? "");
+            this.cache.set(key, {
+                lastGood: models ?? previous?.lastGood ?? null,
+                checkedAt: this.now(), error: models === null,
+                expires: this.now() +
+                    (models !== null ? this.ttlMs : retryMs),
+                models,
+            });
+            for (const notify of this.updated)
+                notify();
+            return models;
+        })();
+        this.pending.set(key, task);
+        try {
+            return await task;
+        }
+        finally {
+            this.pending.delete(key);
+        }
+    }
+    /** Picker-only stale-while-refresh view; routing still awaits fresh discovery. */
+    cachedList(accountKeys) {
+        return buildVisibleModelUnion(accountKeys.map((key, index) => {
+            const entry = this.cache.get(key);
+            const usable = entry && !entry.error && entry.checkedAt <= this.now() && this.now() - entry.checkedAt < 15 * 60_000;
+            return { id: key, kind: "oauth", priority: index, enabled: true, models: usable ? entry.models ?? [] : [], visibleModels: null };
+        }));
+    }
+    invalidate() { this.cache.clear(); }
+    /** Retry discovery while retaining known routing exclusions if it fails. */
+    refresh() { for (const entry of this.cache.values())
+        entry.expires = Number.NEGATIVE_INFINITY; }
+    supportsCached(key, model, effort, tier) {
+        const cached = this.cache.get(key);
+        return Boolean(cached && !cached.error && cached.expires > this.now() && cached.models?.some(entry => entry.slug === model && supportsModelSettings(entry, effort, tier)));
+    }
+    /**
+     * Routing view: the last successful catalog decides, whatever its age. A workspace
+     * that has never been fetched successfully (outage, throttle, slow discovery) is
+     * unknown and stays routable; only a fetched catalog can exclude a model.
+     */
+    supportsForRouting(key, model, effort, tier) {
+        const known = this.cache.get(key)?.lastGood;
+        return !known || known.some(entry => entry.slug === model && supportsModelSettings(entry, effort, tier));
+    }
+    /** Refresh in the background; one fresh eligible route is enough to dispatch early.
+     * After the wait, routing falls back to {@link supportsForRouting}. The caller still ranks eligible accounts.
+     */
+    async prepareRouting(keys, model, effort, tier, eligible = () => true, waitMs = 2000) {
+        const ready = () => keys.some(key => eligible(key) && this.supportsCached(key, model, effort, tier));
+        let notify;
+        const available = new Promise(resolve => { notify = () => { if (ready())
+            resolve(); }; });
+        this.updated.add(notify);
+        let timer;
+        try {
+            const refresh = this.list(keys).then(() => undefined, () => undefined);
+            if (!ready())
+                await Promise.race([refresh, available, new Promise(resolve => { timer = setTimeout(resolve, waitMs); })]);
+            return ready() || keys.some(key => eligible(key) && this.supportsForRouting(key, model, effort, tier)) ? "ready" : "unavailable";
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+            this.updated.delete(notify);
+        }
+    }
+    async list(accountKeys, referenceKey) {
+        const models = new Map();
+        const catalogs = await mapWithConcurrency([...new Set([...accountKeys, ...(referenceKey ? [referenceKey] : [])])], 3, key => this.read(key));
+        const combined = buildVisibleModelUnion(catalogs.map((models, index) => ({ id: String(index), kind: "oauth", enabled: true, priority: index, models: models ?? [], visibleModels: null })));
+        for (const model of combined)
+            models.set(model.slug, model);
+        if (referenceKey) {
+            const reference = await this.read(referenceKey);
+            return (reference ?? []).map(model => clampCatalogContext(model, models.get(model.slug) ?? model));
+        }
+        return [...models.values()];
+    }
+    /** True unless a successfully fetched catalog omits the model. */
+    async supports(accountKey, model, effort, tier) {
+        const models = await this.read(accountKey);
+        return models === null ? true : models.some((entry) => entry.slug === model && supportsCatalogSettings(entry, effort, tier));
+    }
+    snapshot(key) {
+        const entry = this.cache.get(key);
+        return { checkedAt: entry?.checkedAt ?? 0, models: entry?.models?.map(m => m.slug) ?? [], entitlements: entry?.models?.map(modelEntitlements) ?? [], error: entry?.error ?? true };
+    }
+}