codex-multi-auth 2.16.0 → 2.17.0

package/dist/lib/runtime/account-pool.d.ts

@@ -1,6 +1,6 @@
 import type { Workspace } from "../accounts.js";
 import type { ModelFamily } from "../prompts/codex.js";
-import type { AccountStorageV3 } from "../storage.js";
+import type { AccountMetadataV3, AccountStorageV3 } from "../storage.js";
 import type { AccountIdSource, TokenResult } from "../types.js";
 export type TokenSuccessWithAccount = Extract<TokenResult, {
     type: "success";
@@ -9,6 +9,8 @@ export type TokenSuccessWithAccount = Extract<TokenResult, {
     accountIdSource?: AccountIdSource;
     accountLabel?: string;
     workspaces?: Workspace[];
+    /** Set, keep (undefined) or clear (null) the saved CodexCliMirror. */
+    codexCliMirror?: AccountMetadataV3["codexCliMirror"] | null;
 };
 export declare function persistAccountPoolResults(params: {
     results: TokenSuccessWithAccount[];

package/dist/lib/runtime/account-pool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-pool.d.ts","sourceRoot":"","sources":["../../../lib/runtime/account-pool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAqB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEhE,MAAM,MAAM,uBAAuB,GAAG,OAAO,CAC5C,WAAW,EACX;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CACnB,GAAG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;CACzB,CAAC;AAEF,wBAAsB,yBAAyB,CAAC,MAAM,EAAE;IACvD,OAAO,EAAE,uBAAuB,EAAE,CAAC;IACnC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,SAAS,WAAW,EAAE,CAAC;IACtC,6BAA6B,EAAE,CAAC,CAAC,EAChC,OAAO,EAAE,CACR,aAAa,EAAE,gBAAgB,GAAG,IAAI,EACtC,OAAO,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,KACjD,OAAO,CAAC,CAAC,CAAC,KACX,OAAO,CAAC,CAAC,CAAC,CAAC;IAChB,wBAAwB,EAAE,cAAc,eAAe,EAAE,wBAAwB,CAAC;IAClF,gBAAgB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAC9D,mBAAmB,EAAE,CACpB,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,MAAM,KACZ,MAAM,GAAG,SAAS,CAAC;IACxB,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;CACjE,GAAG,OAAO,CAAC,IAAI,CAAC,CA4KhB"}
+{"version":3,"file":"account-pool.d.ts","sourceRoot":"","sources":["../../../lib/runtime/account-pool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEhE,MAAM,MAAM,uBAAuB,GAAG,OAAO,CAC5C,WAAW,EACX;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CACnB,GAAG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB,sEAAsE;IACtE,cAAc,CAAC,EAAE,iBAAiB,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC;CAC5D,CAAC;AAEF,wBAAsB,yBAAyB,CAAC,MAAM,EAAE;IACvD,OAAO,EAAE,uBAAuB,EAAE,CAAC;IACnC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,SAAS,WAAW,EAAE,CAAC;IACtC,6BAA6B,EAAE,CAAC,CAAC,EAChC,OAAO,EAAE,CACR,aAAa,EAAE,gBAAgB,GAAG,IAAI,EACtC,OAAO,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,KACjD,OAAO,CAAC,CAAC,CAAC,KACX,OAAO,CAAC,CAAC,CAAC,CAAC;IAChB,wBAAwB,EAAE,cAAc,eAAe,EAAE,wBAAwB,CAAC;IAClF,gBAAgB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAC9D,mBAAmB,EAAE,CACpB,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,MAAM,KACZ,MAAM,GAAG,SAAS,CAAC;IACxB,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;CACjE,GAAG,OAAO,CAAC,IAAI,CAAC,CAiLhB"}

package/dist/lib/runtime/account-pool.js

@@ -48,6 +48,7 @@ export async function persistAccountPoolResults(params) {
                     lastUsed: now,
                     workspaces: result.workspaces,
                     currentWorkspaceIndex: initialWorkspaceIndex,
+                    ...(result.codexCliMirror ? { codexCliMirror: result.codexCliMirror } : {}),
                 });
                 continue;
             }
@@ -105,6 +106,9 @@ export async function persistAccountPoolResults(params) {
                 lastUsed: now,
                 workspaces: mergedWorkspaces,
                 currentWorkspaceIndex: nextCurrentWorkspaceIndex,
+                codexCliMirror: result.codexCliMirror === null
+                    ? undefined
+                    : (result.codexCliMirror ?? existing.codexCliMirror),
             };
         }
         if (accounts.length === 0)

package/dist/lib/runtime/account-reset-credits.d.ts

@@ -0,0 +1,42 @@
+import { AccountManager } from '../accounts.js';
+import { type AccountMetadataV3 } from '../storage.js';
+import { ResetCreditService, type ResetTarget } from './reset-credits.js';
+export declare function resetTargetForStoredAccount(account: AccountMetadataV3): ResetTarget | null;
+export declare function isResetTargetEnabled(account: AccountMetadataV3, target: ResetTarget): boolean;
+export declare function createResetCreditService(manager?: AccountManager): ResetCreditService;
+export declare function loadResetCreditState(): Promise<{
+    version: 1;
+    policy: "manual" | "last-resort";
+    snapshots: Record<string, {
+        updatedAt: number;
+        availableCount: number | null;
+        ordinaryUsageAllowed: boolean | null;
+        planType: string | null;
+        primary: {
+            usedPercent?: number | undefined;
+            resetsAt?: number | null | undefined;
+            windowDurationMins?: number | null | undefined;
+        };
+        secondary: {
+            usedPercent?: number | undefined;
+            resetsAt?: number | null | undefined;
+            windowDurationMins?: number | null | undefined;
+        };
+    }>;
+    pending?: {
+        key: string;
+        idempotencyKey: string;
+    } | undefined;
+    lastAutomaticCheckAt?: number | undefined;
+    lastRedemptionAt?: number | undefined;
+    lastRedemption?: {
+        key: string;
+        at: number;
+        outcome: "reset" | "nothingToReset" | "noCredit" | "alreadyRedeemed";
+        automatic: boolean;
+    } | undefined;
+}>;
+/** Local terminal labels only; never used in provider requests or public artifacts. */
+export declare function resetAccountLabel(account: Pick<AccountMetadataV3, "email">, index: number): string;
+export declare function refreshAndPrintResetCredits(log: (message: string) => void): Promise<void>;
+//# sourceMappingURL=account-reset-credits.d.ts.map

package/dist/lib/runtime/account-reset-credits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-reset-credits.d.ts","sourceRoot":"","sources":["../../../lib/runtime/account-reset-credits.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAA2D,MAAM,gBAAgB,CAAC;AACzG,OAAO,EAAgB,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAOrE,OAAO,EAAE,kBAAkB,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAG1E,wBAAgB,2BAA2B,CAAC,OAAO,EAAC,iBAAiB,GAAE,WAAW,GAAC,IAAI,CAOtF;AACD,wBAAgB,oBAAoB,CAAC,OAAO,EAAC,iBAAiB,EAAC,MAAM,EAAC,WAAW,GAAE,OAAO,CAMzF;AAED,wBAAgB,wBAAwB,CAAC,OAAO,CAAC,EAAC,cAAc,GAAE,kBAAkB,CA2BnF;AACD,wBAAsB,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAA+C;AACzF,uFAAuF;AACvF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAIlG;AACD,wBAAsB,2BAA2B,CAAC,GAAG,EAAC,CAAC,OAAO,EAAC,MAAM,KAAG,IAAI,iBAQ3E"}

package/dist/lib/runtime/account-reset-credits.js

@@ -0,0 +1,82 @@
+import { join } from 'node:path';
+import { AccountManager, extractAccountId, resolveAccountRecordId, sanitizeEmail } from '../accounts.js';
+import { loadAccounts } from '../storage.js';
+import { getCodexMultiAuthDir } from '../runtime-paths.js';
+import { ensureFreshAccessToken } from './rotation-token-refresh.js';
+import { modelScopeId, workspaceModelScopes } from './workspace-model-scopes.js';
+import { nativeRateLimitsRpc } from './native-rate-limits.js';
+import { codexCliAccountIdFor } from '../auth/token-utils.js';
+import { isRecord } from '../utils.js';
+import { ResetCreditService } from './reset-credits.js';
+import { withCheckProgress } from '../ui/check-progress.js';
+export function resetTargetForStoredAccount(account) {
+    // Organization display aliases are not native ChatGPT workspace identities.
+    const stored = account.accountId?.trim();
+    const id = stored?.startsWith("org-") ? extractAccountId(account.accessToken)?.trim() : stored;
+    const workspace = account.workspaces?.find(w => w.id === id);
+    if (!id || id.startsWith("org-") || account.enabled === false || workspace?.enabled === false)
+        return null;
+    return { key: modelScopeId('oauth', resolveAccountRecordId(account), id), accountId: id };
+}
+export function isResetTargetEnabled(account, target) {
+    if (account.enabled === false)
+        return false;
+    const canonical = resetTargetForStoredAccount(account);
+    if (canonical?.key === target.key && canonical.accountId === target.accountId)
+        return true;
+    const scopeKey = modelScopeId('oauth', resolveAccountRecordId(account), target.accountId);
+    return !target.accountId.startsWith('org-') && scopeKey === target.key && Boolean(account.workspaces?.some(w => w.id === target.accountId && w.enabled !== false));
+}
+export function createResetCreditService(manager) {
+    const auth = async (target) => {
+        const account = manager?.getAccountsSnapshot().find(a => workspaceModelScopes(a).some(s => s.id === target.key && s.accountId === target.accountId && s.routable) || (resetTargetForStoredAccount({ ...a, accessToken: a.access })?.key === target.key && resetTargetForStoredAccount({ ...a, accessToken: a.access })?.accountId === target.accountId));
+        const current = account && manager?.getAccountByIndex(account.index);
+        if (!manager || !current || current.enabled === false)
+            throw Error('Reset workspace is not enabled');
+        const fresh = await ensureFreshAccessToken({ accountManager: manager, account: current, family: 'codex', model: null, now: Date.now(), tokenRefreshSkewMs: 60000, tokenInvalidationCooldownMs: 300000 });
+        if (!fresh.ok)
+            throw Error('Reset account authentication unavailable');
+        // The mirror carries the id Codex CLI accepts when the backend refused an explicit binding.
+        return { accessToken: fresh.accessToken, accountId: target.accountId, expiresAt: fresh.account.expires ?? 0, codexCliMirror: current.codexCliMirror };
+    };
+    return new ResetCreditService(join(getCodexMultiAuthDir(), 'reset-credits.json'), {
+        read: async (target) => {
+            // The backend answers for the id written into its auth.json (the mirror id when one
+            // applies). Verify the reply against that id; the snapshot stays keyed on the target.
+            const freshAuth = await auth(target);
+            const sent = codexCliAccountIdFor(freshAuth, freshAuth.accessToken) ?? freshAuth.accountId;
+            const reply = await nativeRateLimitsRpc(freshAuth, 'account/rateLimits/read', { excludeResetCreditDetails: true });
+            if (!isRecord(reply) || reply.accountId !== sent)
+                throw Error('Reset credit workspace identity mismatch');
+            return { ...reply, accountId: target.accountId };
+        },
+        consume: async (target, idempotencyKey) => {
+            const freshAuth = await auth(target);
+            const disk = await loadAccounts();
+            if (!disk?.accounts.some(a => isResetTargetEnabled(a, target)))
+                throw Error('Reset target was removed, disabled, or changed; no credit consumed');
+            return nativeRateLimitsRpc(freshAuth, 'account/rateLimitResetCredit/consume', { idempotencyKey });
+        },
+    });
+}
+export async function loadResetCreditState() { return createResetCreditService().status(); }
+/** Local terminal labels only; never used in provider requests or public artifacts. */
+export function resetAccountLabel(account, index) {
+    const email = sanitizeEmail(account.email);
+    const printable = email && !/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(email);
+    return `Account ${index + 1}${printable ? ` (${email})` : ""}`;
+}
+export async function refreshAndPrintResetCredits(log) {
+    const storage = await loadAccounts();
+    if (!storage?.accounts.length)
+        return;
+    const manager = new AccountManager(undefined, storage);
+    const targets = storage.accounts.map(resetTargetForStoredAccount).filter((t) => Boolean(t));
+    try {
+        const snapshots = await withCheckProgress(`Checking reset credits for ${targets.length} accounts`, () => createResetCreditService(manager).refresh(targets), log);
+        storage.accounts.forEach((a, i) => { const target = resetTargetForStoredAccount(a); const count = target ? snapshots[target.key]?.availableCount : undefined; log(`${resetAccountLabel(a, i)}: available subscription resets: ${count ?? 'unknown (not verified)'}`); });
+    }
+    finally {
+        await manager.flushPendingSave();
+    }
+}

package/dist/lib/runtime/api-model-capabilities.d.ts

@@ -0,0 +1,30 @@
+import type { ApiRouteCredential } from "../api-route-store.js";
+import { type RouteModel } from "../model-route-policy.js";
+/** Read the explicit model-specific statement, never surrounding examples or another model's settings. */
+export declare function parseApiReasoningDocumentation(id: string, text: string): string[];
+export type ProbeResult = {
+    at: number;
+    levels: string[];
+    tiers: string[];
+    status: Record<string, string>;
+};
+export declare class ApiModelCapabilities {
+    private readonly fetchImpl;
+    private readonly now;
+    private activeProbes;
+    private readonly probeWaiters;
+    private withProbeSlot;
+    private readonly inFlight;
+    private readonly probes;
+    private readonly cache;
+    constructor(fetchImpl?: typeof fetch, now?: () => number);
+    /** Probe results keyed by an opaque hash, for a fresh CLI process to honour the 15-minute cache. */
+    exportProbes(): Array<[string, ProbeResult]>;
+    importProbes(entries: Array<[string, ProbeResult]>): void;
+    reasoning(id: string, refresh?: boolean): Promise<string[]>;
+    private documentation;
+    private probe;
+    private runProbe;
+    enrich(models: RouteModel[], refresh?: boolean, route?: ApiRouteCredential, forceProbes?: boolean): Promise<RouteModel[]>;
+}
+//# sourceMappingURL=api-model-capabilities.d.ts.map

package/dist/lib/runtime/api-model-capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-model-capabilities.d.ts","sourceRoot":"","sources":["../../../lib/runtime/api-model-capabilities.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAEN,KAAK,UAAU,EACf,MAAM,0BAA0B,CAAC;AAYlC,0GAA0G;AAC1G,wBAAgB,8BAA8B,CAC7C,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,GACV,MAAM,EAAE,CAuBV;AACD,MAAM,MAAM,WAAW,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B,CAAC;AAwCF,qBAAa,oBAAoB;IA2B/B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IA3BrB,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;YACxC,aAAa;IAY3B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA2C;IACpE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAQnB;IACJ,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA8D;gBAElE,SAAS,GAAE,OAAO,KAAa,EAC/B,GAAG,GAAE,MAAM,MAAiB;IAE9C,oGAAoG;IACpG,YAAY,IAAI,KAAK,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAG5C,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,GAAG,IAAI;IAMnD,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,UAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAGjD,aAAa;YA4Cb,KAAK;YAyBL,QAAQ;IA8MhB,MAAM,CACX,MAAM,EAAE,UAAU,EAAE,EACpB,OAAO,UAAQ,EACf,KAAK,CAAC,EAAE,kBAAkB,EAC1B,WAAW,UAAQ,GACjB,OAAO,CAAC,UAAU,EAAE,CAAC;CAqDxB"}

package/dist/lib/runtime/api-model-capabilities.js

@@ -0,0 +1,434 @@
+import { mapWithConcurrency } from "../concurrency.js";
+import { classifyCapabilityFailure } from "./runtime-capability-failures.js";
+import { createHash } from "node:crypto";
+import { canonicalServiceTier, } from "../model-route-policy.js";
+import { isRecord } from "../utils.js";
+const efforts = new Set([
+    "none",
+    "minimal",
+    "low",
+    "medium",
+    "high",
+    "xhigh",
+    "max",
+]);
+/** Read the explicit model-specific statement, never surrounding examples or another model's settings. */
+export function parseApiReasoningDocumentation(id, text) {
+    if (text.match(/^Model ID:\s*`([^`]+)`/m)?.[1] !== id)
+        return [];
+    const statement = text.match(/`?reasoning\.effort`?\s+supports\s*:?\s*([^\n.]+)\./i)?.[1];
+    if (!statement)
+        return [];
+    const values = statement
+        .replace(/`|\(default\)/g, " ")
+        .split(/,|\band\b/)
+        .map((s) => s.trim())
+        .filter(Boolean);
+    if (!values.length ||
+        values.length > 16 ||
+        values.some((v) => !/^[a-z][a-z0-9_-]{0,31}$/.test(v) ||
+            v === "ultra" ||
+            v === "persistent"))
+        return [];
+    return [...new Set(values)];
+}
+/** Only the exact model's input declaration can enable native image attachments. */
+function parseInputModalities(id, text) {
+    if (text.match(/^Model ID:\s*`([^`]+)`/m)?.[1] !== id)
+        return undefined;
+    const details = text.split(/^## Model details[ \t]*\r?\n/m)[1]?.split(/^## /m)[0];
+    const declaration = details?.match(/^- Input modalities:[ \t]*([^\r\n]+)$/m)?.[1];
+    if (!declaration)
+        return undefined;
+    const modalities = declaration.split(",").map(value => value.trim());
+    if (!modalities.length || modalities.some(value => !["text", "image", "audio", "video"].includes(value)))
+        return undefined;
+    // The native coding picker currently accepts text and image inputs.
+    return [...new Set(modalities.filter(value => value === "text" || value === "image"))];
+}
+/** Codes and params that say the key, organization or project itself lacks access. */
+const CREDENTIAL_ACCESS_CODES = new Set([
+    "invalid_api_key", "insufficient_permissions", "permission_denied", "unauthorized",
+    "organization_deactivated", "account_deactivated", "project_not_found", "project_archived",
+    "ip_not_authorized", "unsupported_country_region_territory",
+]);
+/**
+ * A 403 either removes the credential's access ("lost"), denies the whole model
+ * on this credential ("model"), denies only the probed setting ("setting"), or
+ * explains nothing ("ambiguous").
+ */
+function classifyProbe403(data, setting) {
+    const error = isRecord(data) && isRecord(data.error) ? data.error : null;
+    if (!error)
+        return "ambiguous";
+    const code = String(error.code ?? ""), param = String(error.param ?? "");
+    if (CREDENTIAL_ACCESS_CODES.has(code) || ["api_key", "organization", "project"].includes(param))
+        return "lost";
+    // Same model-level denial codes the runtime capability classifier uses.
+    if (classifyCapabilityFailure(403, data) === "model")
+        return "model";
+    // Compatibility and tier probes also carry an effort, but only an effort probe
+    // tests it: an effort-param 403 elsewhere explains nothing about the probed setting.
+    const effortProbe = Boolean(setting.effort) && !setting.tier && !setting.compatibility;
+    if (effortProbe && ["reasoning.effort", "reasoning"].includes(param))
+        return "setting";
+    if (setting.tier && param === "service_tier")
+        return "setting";
+    if (setting.compatibility && ["tools", "tool_choice"].includes(param))
+        return "setting";
+    return "ambiguous";
+}
+export class ApiModelCapabilities {
+    fetchImpl;
+    now;
+    activeProbes = 0;
+    probeWaiters = [];
+    async withProbeSlot(operation) {
+        if (this.activeProbes >= 4)
+            await new Promise((resolve) => this.probeWaiters.push(resolve));
+        else
+            this.activeProbes++;
+        try {
+            return await operation();
+        }
+        finally {
+            const next = this.probeWaiters.shift();
+            if (next)
+                next();
+            else
+                this.activeProbes--;
+        }
+    }
+    inFlight = new Map();
+    probes = new Map();
+    cache = new Map();
+    constructor(fetchImpl = fetch, now = Date.now) {
+        this.fetchImpl = fetchImpl;
+        this.now = now;
+    }
+    /** Probe results keyed by an opaque hash, for a fresh CLI process to honour the 15-minute cache. */
+    exportProbes() {
+        return [...this.probes];
+    }
+    importProbes(entries) {
+        for (const [key, value] of entries.slice(-1000)) {
+            if (this.probes.has(key) || value.at > this.now())
+                continue;
+            this.probes.set(key, value);
+        }
+    }
+    async reasoning(id, refresh = false) {
+        return (await this.documentation(id, refresh)).levels;
+    }
+    async documentation(id, refresh = false) {
+        if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/.test(id))
+            return { levels: [] };
+        const cached = this.cache.get(id);
+        if (!refresh && cached && cached.at + 60000 > this.now())
+            return cached;
+        let metadata = { levels: [] };
+        try {
+            const response = await this.fetchImpl(`https://developers.openai.com/api/docs/models/${encodeURIComponent(id)}.md`, { redirect: "error", signal: AbortSignal.timeout(5000) });
+            if (!response.ok) {
+                await response.body?.cancel();
+                throw Error("Documentation unavailable");
+            }
+            const reader = response.body?.getReader();
+            if (!reader)
+                throw Error("No documentation");
+            const chunks = [];
+            let size = 0;
+            try {
+                for (;;) {
+                    const { done, value } = await reader.read();
+                    if (done)
+                        break;
+                    size += value.byteLength;
+                    if (size > 256 * 1024)
+                        throw Error("Documentation too large");
+                    chunks.push(value);
+                }
+            }
+            finally {
+                await reader.cancel();
+            }
+            const text = Buffer.concat(chunks).toString("utf8");
+            metadata = {
+                levels: parseApiReasoningDocumentation(id, text),
+                inputModalities: parseInputModalities(id, text),
+            };
+        }
+        catch {
+            // An outage is not a capability revocation. Keep last successful evidence.
+            metadata = cached ?? metadata;
+        }
+        if (this.cache.size >= 1000)
+            this.cache.delete(this.cache.keys().next().value ?? "");
+        this.cache.set(id, { ...metadata, at: this.now() });
+        return metadata;
+    }
+    async probe(route, id, documented, force = false) {
+        const key = createHash("sha256")
+            .update(route.id)
+            .update("\0")
+            .update(route.apiKey)
+            .update("\0")
+            .update(id)
+            .digest("hex");
+        const old = this.probes.get(key);
+        // A probe cut short by 401/403/429 is retried after a minute, not trusted for 15.
+        const freshFor = old?.status.retry === "transient" ? 60_000 : 900_000;
+        if (!force && old && old.at + freshFor > this.now())
+            return old;
+        const running = this.inFlight.get(key);
+        if (running)
+            return running;
+        const pending = this.runProbe(route, id, documented, key).finally(() => this.inFlight.delete(key));
+        this.inFlight.set(key, pending);
+        return pending;
+    }
+    async runProbe(route, id, documented, key) {
+        const result = {
+            at: this.now(),
+            levels: [...documented],
+            tiers: [],
+            status: {},
+        };
+        let credentialUnavailable = false;
+        // 401/403 means this credential lost access: nothing it verified before
+        // may still be advertised. A throttle (429) or transport failure is only
+        // inconclusive and keeps what an earlier probe verified. Only
+        // "unsupported" or "downgraded" removes a setting otherwise.
+        let lostAccess = false;
+        // A model-level denial hides the model on this credential: no efforts, no tiers.
+        let modelDenied = false;
+        const previous = this.probes.get(key);
+        const keep = (name, status) => status === "unverified" && !lostAccess && !modelDenied && previous?.status[name] === "verified" ? "verified" : status;
+        const attempt = async (setting) => {
+            // Lost access drops everything this credential verified; a model-level
+            // denial hides the model; a 403 naming the probed setting removes only it.
+            // An unexplained 403 changes nothing and the probe is retried soon.
+            const denied403 = (data) => {
+                const kind = classifyProbe403(data, setting);
+                if (kind === "lost") {
+                    credentialUnavailable = true;
+                    lostAccess = true;
+                    return "unverified";
+                }
+                if (kind === "model") {
+                    modelDenied = true;
+                    return "unsupported";
+                }
+                if (kind === "setting")
+                    return "unsupported";
+                credentialUnavailable = true;
+                return "unverified";
+            };
+            return this.withProbeSlot(async () => {
+                if (credentialUnavailable || modelDenied)
+                    return "unverified";
+                try {
+                    const response = await this.fetchImpl("https://api.openai.com/v1/responses", {
+                        method: "POST",
+                        headers: {
+                            authorization: `Bearer ${route.apiKey}`,
+                            "content-type": "application/json",
+                        },
+                        redirect: "error",
+                        signal: AbortSignal.timeout(15000),
+                        body: JSON.stringify({
+                            model: id,
+                            input: "Reply OK.",
+                            store: false,
+                            max_output_tokens: 16,
+                            ...(setting.compatibility
+                                ? {
+                                    tools: [
+                                        {
+                                            type: "function",
+                                            name: "capability_probe",
+                                            parameters: {
+                                                type: "object",
+                                                properties: {},
+                                                required: [],
+                                                additionalProperties: false,
+                                            },
+                                            strict: true,
+                                        },
+                                    ],
+                                    tool_choice: {
+                                        type: "function",
+                                        name: "capability_probe",
+                                    },
+                                }
+                                : {}),
+                            ...(setting.effort
+                                ? { reasoning: { effort: setting.effort } }
+                                : {}),
+                            ...(setting.tier ? { service_tier: setting.tier } : {}),
+                        }),
+                    });
+                    if ([401, 429].includes(response.status))
+                        credentialUnavailable = true;
+                    if (response.status === 401)
+                        lostAccess = true;
+                    // Probe bodies are tiny, but an upstream error must not grow local memory unboundedly.
+                    const reader = response.body?.getReader();
+                    if (!reader)
+                        return response.status === 403 ? denied403(null) : "unverified";
+                    const chunks = [];
+                    let bytes = 0;
+                    try {
+                        for (;;) {
+                            const { done, value } = await reader.read();
+                            if (done)
+                                break;
+                            bytes += value.byteLength;
+                            if (bytes > 256 * 1024)
+                                throw Error("Probe response too large");
+                            chunks.push(value);
+                        }
+                    }
+                    finally {
+                        await reader.cancel();
+                    }
+                    let data;
+                    try {
+                        data = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+                    }
+                    catch {
+                        return response.status === 403 ? denied403(null) : "unverified";
+                    }
+                    if (response.status === 403)
+                        return denied403(data);
+                    if (!response.ok) {
+                        if (setting.compatibility) {
+                            const error = isRecord(data) && isRecord(data.error) ? data.error : null;
+                            return classifyCapabilityFailure(response.status, data) ===
+                                "model" ||
+                                (response.status === 400 &&
+                                    error &&
+                                    ["tools", "tool_choice"].includes(String(error.param)) &&
+                                    ["unsupported_parameter", "unsupported_value"].includes(String(error.code)))
+                                ? "unsupported"
+                                : "unverified";
+                        }
+                        const error = isRecord(data) && isRecord(data.error) ? data.error : null;
+                        return response.status === 400 &&
+                            error &&
+                            typeof error.param === "string" &&
+                            ["reasoning.effort", "reasoning", "service_tier"].includes(error.param)
+                            ? "unsupported"
+                            : "unverified";
+                    }
+                    if (setting.compatibility)
+                        return isRecord(data) &&
+                            Array.isArray(data.output) &&
+                            data.output.some((item) => isRecord(item) &&
+                                item.type === "function_call" &&
+                                item.name === "capability_probe")
+                            ? "verified"
+                            : "unverified";
+                    if (!setting.tier)
+                        return isRecord(data) &&
+                            isRecord(data.reasoning) &&
+                            data.reasoning.effort === setting.effort
+                            ? "verified"
+                            : "unverified";
+                    if (!isRecord(data) || typeof data.service_tier !== "string")
+                        return "unverified";
+                    return canonicalServiceTier(data.service_tier) ===
+                        canonicalServiceTier(setting.tier)
+                        ? "verified"
+                        : "downgraded";
+                }
+                catch {
+                    return "unverified";
+                }
+            });
+        };
+        {
+            const checked = await Promise.all([...efforts]
+                .filter((effort) => !documented.includes(effort))
+                .map(async (effort) => ({
+                effort,
+                status: await attempt({ effort }),
+            })));
+            for (const { effort, status } of checked) {
+                const effective = keep(`effort:${effort}`, status);
+                result.status[`effort:${effort}`] = effective;
+                if (effective === "verified")
+                    result.levels.push(effort);
+            }
+        }
+        const effort = result.levels.includes("low") ? "low" : result.levels[0];
+        result.status.responses = keep("responses", await attempt({ compatibility: true, effort }));
+        const checkedTiers = await Promise.all(["fast", "ultrafast"].map(async (tier) => ({
+            tier,
+            status: await attempt({ tier: tier === "fast" ? "priority" : tier, effort }),
+        })));
+        for (const { tier, status } of checkedTiers) {
+            const effective = keep(tier, status);
+            result.status[tier] = effective;
+            if (effective === "verified")
+                result.tiers.push(tier);
+        }
+        if (modelDenied) {
+            result.levels = [];
+            result.tiers = [];
+            for (const name of Object.keys(result.status))
+                result.status[name] = "unsupported";
+            result.status.responses = "unsupported";
+        }
+        if (credentialUnavailable && !modelDenied)
+            result.status.retry = "transient";
+        result.at = this.now();
+        if (this.probes.size >= 1000)
+            this.probes.delete(this.probes.keys().next().value ?? "");
+        this.probes.set(key, result);
+        return result;
+    }
+    async enrich(models, refresh = false, route, forceProbes = false) {
+        return mapWithConcurrency(models, 3, async (model) => {
+            const documented = await this.documentation(model.slug, refresh);
+            let levels = documented.levels;
+            let extra = {};
+            if (route?.enabled && route.probeCapabilities) {
+                const probed = await this.probe(route, model.slug, levels, forceProbes);
+                levels = probed.levels;
+                extra = {
+                    service_tiers: probed.tiers.map((id) => ({
+                        id: id === "fast" ? "priority" : id,
+                        name: id === "fast" ? "Fast" : "Ultrafast",
+                        description: "Verified by an API probe; runtime capacity can still downgrade processing.",
+                    })),
+                    default_service_tier: "default",
+                    additional_speed_tiers: probed.tiers,
+                    capability_probe_status: probed.status,
+                    capability_checked_at: probed.at,
+                };
+            }
+            // Ultra is a native orchestration mode. Codex resolves it to this
+            // supported wire effort; it is not an API entitlement named "ultra".
+            const multiAgentEffort = ["max", "xhigh", "high"].find((level) => levels.includes(level)) ?? null;
+            const nativeLevels = multiAgentEffort
+                ? [...levels, "ultra"]
+                : levels;
+            return {
+                ...model,
+                ...extra,
+                ...(documented.inputModalities ? { input_modalities: documented.inputModalities } : {}),
+                multi_agent_reasoning_effort: multiAgentEffort,
+                supported_reasoning_levels: nativeLevels.map((effort) => ({
+                    effort,
+                    description: effort === "ultra"
+                        ? "Proactive multi-agent mode using a supported API reasoning effort"
+                        : `${effort} reasoning effort`,
+                })),
+                default_reasoning_level: levels.includes("medium")
+                    ? "medium"
+                    : (levels[0] ?? null),
+            };
+        });
+    }
+}