codex-multi-auth 2.16.0 → 2.17.2

package/dist/lib/runtime/account-model-catalog.d.ts

@@ -0,0 +1,64 @@
+export declare class CatalogRetryError extends Error {
+    readonly retryAfterMs: number;
+    constructor(retryAfterMs: number);
+}
+export type CatalogModel = Record<string, unknown> & {
+    slug: string;
+};
+/** Upper bound for a catalog 429 backoff, whatever Retry-After the upstream sends. */
+export declare const MAX_CATALOG_RETRY_MS: number;
+export declare function clampCatalogRetryMs(retryAfterMs: number | null | undefined): number;
+/**
+ * Per-proxy discovery cache. Failed refreshes never advertise stale access, but
+ * they are "unknown", not "empty": only a successful fetch can exclude a model.
+ * Routing fails open: an outage or throttle lets inference through, and the last
+ * successfully fetched catalog (whatever its age) is the only thing that excludes.
+ */
+export declare class AccountModelCatalog {
+    private readonly fetchCatalog;
+    private readonly now;
+    private readonly ttlMs;
+    private readonly cache;
+    private readonly updated;
+    private readonly pending;
+    constructor(fetchCatalog: (accountKey: string) => Promise<unknown>, now?: () => number, ttlMs?: number);
+    private read;
+    /** Picker-only stale-while-refresh view; routing still awaits fresh discovery. */
+    cachedList(accountKeys: string[]): CatalogModel[];
+    invalidate(): void;
+    /** Retry discovery while retaining known routing exclusions if it fails. */
+    refresh(): void;
+    supportsCached(key: string, model: string, effort?: string, tier?: string): boolean;
+    /**
+     * Routing view: the last successful catalog decides, whatever its age. A workspace
+     * that has never been fetched successfully (outage, throttle, slow discovery) is
+     * unknown and stays routable; only a fetched catalog can exclude a model.
+     */
+    supportsForRouting(key: string, model: string, effort?: string, tier?: string): boolean;
+    /** Refresh in the background; one fresh eligible route is enough to dispatch early.
+     * After the wait, routing falls back to {@link supportsForRouting}. The caller still ranks eligible accounts.
+     */
+    prepareRouting(keys: string[], model: string, effort?: string, tier?: string, eligible?: (key: string) => boolean, waitMs?: number): Promise<"ready" | "unavailable">;
+    list(accountKeys: string[], referenceKey?: string): Promise<CatalogModel[]>;
+    /** True unless a successfully fetched catalog omits the model. */
+    supports(accountKey: string, model: string, effort?: string, tier?: string): Promise<boolean>;
+    snapshot(key: string): {
+        checkedAt: number;
+        models: string[];
+        entitlements: {
+            serviceTiers: {
+                id: string;
+                name: string;
+            }[];
+            reasoningLevels: string[];
+            accessPrograms: string[];
+            probes?: {
+                [k: string]: "unsupported" | "verified" | "unverified" | "downgraded";
+            } | undefined;
+            checkedAt?: number | undefined;
+            model: string;
+        }[];
+        error: boolean;
+    };
+}
+//# sourceMappingURL=account-model-catalog.d.ts.map

package/dist/lib/runtime/account-model-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-model-catalog.d.ts","sourceRoot":"","sources":["../../../lib/runtime/account-model-catalog.ts"],"names":[],"mappings":"AAKA,qBAAa,iBAAkB,SAAQ,KAAK;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM;gBAApB,YAAY,EAAE,MAAM;CACzC;AAED,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtE,sFAAsF;AACtF,eAAO,MAAM,oBAAoB,QAAc,CAAC;AAChD,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAGnF;AAED;;;;;GAKG;AACH,qBAAa,mBAAmB;IAQ9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK;IATvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAGlB;IACJ,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqD;gBAE3D,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EACtD,GAAG,GAAE,MAAM,MAAiB,EAC5B,KAAK,SAAa;YAEtB,IAAI;IAkDlB,kFAAkF;IAClF,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,YAAY,EAAE;IAOjD,UAAU,IAAI,IAAI;IAClB,4EAA4E;IAC5E,OAAO,IAAI,IAAI;IACf,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO;IAInF;;;;OAIG;IACH,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO;IAIvF;;OAEG;IACG,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EACjF,QAAQ,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAoB,EAAE,MAAM,SAAO,GAC5D,OAAO,CAAC,OAAO,GAAG,aAAa,CAAC;IAe7B,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAYjF,kEAAkE;IAC5D,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAInG,QAAQ,CAAC,GAAG,EAAE,MAAM;;;;;;;;;;;;;;;;;;CAIpB"}

package/dist/lib/runtime/account-model-catalog.js

@@ -0,0 +1,154 @@
+import { buildVisibleModelUnion, supportsModelSettings, modelEntitlements } from "../model-route-policy.js";
+import { mapWithConcurrency } from "../concurrency.js";
+import { clampCatalogContext, supportsCatalogSettings } from "./catalog-capabilities.js";
+import { isRecord } from "../utils.js";
+export class CatalogRetryError extends Error {
+    retryAfterMs;
+    constructor(retryAfterMs) {
+        super("Catalog temporarily rate limited");
+        this.retryAfterMs = retryAfterMs;
+    }
+}
+/** Upper bound for a catalog 429 backoff, whatever Retry-After the upstream sends. */
+export const MAX_CATALOG_RETRY_MS = 15 * 60_000;
+export function clampCatalogRetryMs(retryAfterMs) {
+    const value = typeof retryAfterMs === "number" && Number.isFinite(retryAfterMs) ? retryAfterMs : 60_000;
+    return Math.min(MAX_CATALOG_RETRY_MS, Math.max(60_000, value));
+}
+/**
+ * Per-proxy discovery cache. Failed refreshes never advertise stale access, but
+ * they are "unknown", not "empty": only a successful fetch can exclude a model.
+ * Routing fails open: an outage or throttle lets inference through, and the last
+ * successfully fetched catalog (whatever its age) is the only thing that excludes.
+ */
+export class AccountModelCatalog {
+    fetchCatalog;
+    now;
+    ttlMs;
+    cache = new Map();
+    updated = new Set();
+    pending = new Map();
+    constructor(fetchCatalog, now = Date.now, ttlMs = 5 * 60_000) {
+        this.fetchCatalog = fetchCatalog;
+        this.now = now;
+        this.ttlMs = ttlMs;
+    }
+    async read(key) {
+        const cached = this.cache.get(key);
+        if (cached && cached.expires > this.now())
+            return cached.models;
+        const existing = this.pending.get(key);
+        if (existing)
+            return existing;
+        const task = (async () => {
+            let models = null;
+            let retryMs = Math.min(this.ttlMs, 5000);
+            try {
+                const value = await this.fetchCatalog(key);
+                if (!isRecord(value) ||
+                    !Array.isArray(value.models) ||
+                    value.models.length > 1000 ||
+                    !value.models.every((m) => isRecord(m) &&
+                        typeof m.slug === "string" &&
+                        m.slug.length > 0 &&
+                        m.slug.length < 256)) {
+                    throw new Error("Invalid account model catalog");
+                }
+                models = value.models;
+            }
+            catch (error) {
+                if (error instanceof CatalogRetryError)
+                    retryMs = clampCatalogRetryMs(error.retryAfterMs);
+                /* Unknown; list() advertises nothing from it and supports() fails open. */
+            }
+            const previous = this.cache.get(key);
+            if (!previous && this.cache.size >= 3000)
+                this.cache.delete(this.cache.keys().next().value ?? "");
+            this.cache.set(key, {
+                lastGood: models ?? previous?.lastGood ?? null,
+                checkedAt: this.now(), error: models === null,
+                expires: this.now() +
+                    (models !== null ? this.ttlMs : retryMs),
+                models,
+            });
+            for (const notify of this.updated)
+                notify();
+            return models;
+        })();
+        this.pending.set(key, task);
+        try {
+            return await task;
+        }
+        finally {
+            this.pending.delete(key);
+        }
+    }
+    /** Picker-only stale-while-refresh view; routing still awaits fresh discovery. */
+    cachedList(accountKeys) {
+        return buildVisibleModelUnion(accountKeys.map((key, index) => {
+            const entry = this.cache.get(key);
+            const usable = entry && !entry.error && entry.checkedAt <= this.now() && this.now() - entry.checkedAt < 15 * 60_000;
+            return { id: key, kind: "oauth", priority: index, enabled: true, models: usable ? entry.models ?? [] : [], visibleModels: null };
+        }));
+    }
+    invalidate() { this.cache.clear(); }
+    /** Retry discovery while retaining known routing exclusions if it fails. */
+    refresh() { for (const entry of this.cache.values())
+        entry.expires = Number.NEGATIVE_INFINITY; }
+    supportsCached(key, model, effort, tier) {
+        const cached = this.cache.get(key);
+        return Boolean(cached && !cached.error && cached.expires > this.now() && cached.models?.some(entry => entry.slug === model && supportsModelSettings(entry, effort, tier)));
+    }
+    /**
+     * Routing view: the last successful catalog decides, whatever its age. A workspace
+     * that has never been fetched successfully (outage, throttle, slow discovery) is
+     * unknown and stays routable; only a fetched catalog can exclude a model.
+     */
+    supportsForRouting(key, model, effort, tier) {
+        const known = this.cache.get(key)?.lastGood;
+        return !known || known.some(entry => entry.slug === model && supportsModelSettings(entry, effort, tier));
+    }
+    /** Refresh in the background; one fresh eligible route is enough to dispatch early.
+     * After the wait, routing falls back to {@link supportsForRouting}. The caller still ranks eligible accounts.
+     */
+    async prepareRouting(keys, model, effort, tier, eligible = () => true, waitMs = 2000) {
+        const ready = () => keys.some(key => eligible(key) && this.supportsCached(key, model, effort, tier));
+        let notify;
+        const available = new Promise(resolve => { notify = () => { if (ready())
+            resolve(); }; });
+        this.updated.add(notify);
+        let timer;
+        try {
+            const refresh = this.list(keys).then(() => undefined, () => undefined);
+            if (!ready())
+                await Promise.race([refresh, available, new Promise(resolve => { timer = setTimeout(resolve, waitMs); })]);
+            return ready() || keys.some(key => eligible(key) && this.supportsForRouting(key, model, effort, tier)) ? "ready" : "unavailable";
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+            this.updated.delete(notify);
+        }
+    }
+    async list(accountKeys, referenceKey) {
+        const models = new Map();
+        const catalogs = await mapWithConcurrency([...new Set([...accountKeys, ...(referenceKey ? [referenceKey] : [])])], 3, key => this.read(key));
+        const combined = buildVisibleModelUnion(catalogs.map((models, index) => ({ id: String(index), kind: "oauth", enabled: true, priority: index, models: models ?? [], visibleModels: null })));
+        for (const model of combined)
+            models.set(model.slug, model);
+        if (referenceKey) {
+            const reference = await this.read(referenceKey);
+            return (reference ?? []).map(model => clampCatalogContext(model, models.get(model.slug) ?? model));
+        }
+        return [...models.values()];
+    }
+    /** True unless a successfully fetched catalog omits the model. */
+    async supports(accountKey, model, effort, tier) {
+        const models = await this.read(accountKey);
+        return models === null ? true : models.some((entry) => entry.slug === model && supportsCatalogSettings(entry, effort, tier));
+    }
+    snapshot(key) {
+        const entry = this.cache.get(key);
+        return { checkedAt: entry?.checkedAt ?? 0, models: entry?.models?.map(m => m.slug) ?? [], entitlements: entry?.models?.map(modelEntitlements) ?? [], error: entry?.error ?? true };
+    }
+}

package/dist/lib/runtime/account-pool.d.ts

@@ -1,6 +1,6 @@
 import type { Workspace } from "../accounts.js";
 import type { ModelFamily } from "../prompts/codex.js";
-import type { AccountStorageV3 } from "../storage.js";
+import type { AccountMetadataV3, AccountStorageV3 } from "../storage.js";
 import type { AccountIdSource, TokenResult } from "../types.js";
 export type TokenSuccessWithAccount = Extract<TokenResult, {
     type: "success";
@@ -9,6 +9,8 @@ export type TokenSuccessWithAccount = Extract<TokenResult, {
     accountIdSource?: AccountIdSource;
     accountLabel?: string;
     workspaces?: Workspace[];
+    /** Set, keep (undefined) or clear (null) the saved CodexCliMirror. */
+    codexCliMirror?: AccountMetadataV3["codexCliMirror"] | null;
 };
 export declare function persistAccountPoolResults(params: {
     results: TokenSuccessWithAccount[];

package/dist/lib/runtime/account-pool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-pool.d.ts","sourceRoot":"","sources":["../../../lib/runtime/account-pool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAqB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEhE,MAAM,MAAM,uBAAuB,GAAG,OAAO,CAC5C,WAAW,EACX;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CACnB,GAAG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;CACzB,CAAC;AAEF,wBAAsB,yBAAyB,CAAC,MAAM,EAAE;IACvD,OAAO,EAAE,uBAAuB,EAAE,CAAC;IACnC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,SAAS,WAAW,EAAE,CAAC;IACtC,6BAA6B,EAAE,CAAC,CAAC,EAChC,OAAO,EAAE,CACR,aAAa,EAAE,gBAAgB,GAAG,IAAI,EACtC,OAAO,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,KACjD,OAAO,CAAC,CAAC,CAAC,KACX,OAAO,CAAC,CAAC,CAAC,CAAC;IAChB,wBAAwB,EAAE,cAAc,eAAe,EAAE,wBAAwB,CAAC;IAClF,gBAAgB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAC9D,mBAAmB,EAAE,CACpB,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,MAAM,KACZ,MAAM,GAAG,SAAS,CAAC;IACxB,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;CACjE,GAAG,OAAO,CAAC,IAAI,CAAC,CA4KhB"}
+{"version":3,"file":"account-pool.d.ts","sourceRoot":"","sources":["../../../lib/runtime/account-pool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEhE,MAAM,MAAM,uBAAuB,GAAG,OAAO,CAC5C,WAAW,EACX;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CACnB,GAAG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB,sEAAsE;IACtE,cAAc,CAAC,EAAE,iBAAiB,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC;CAC5D,CAAC;AAEF,wBAAsB,yBAAyB,CAAC,MAAM,EAAE;IACvD,OAAO,EAAE,uBAAuB,EAAE,CAAC;IACnC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,SAAS,WAAW,EAAE,CAAC;IACtC,6BAA6B,EAAE,CAAC,CAAC,EAChC,OAAO,EAAE,CACR,aAAa,EAAE,gBAAgB,GAAG,IAAI,EACtC,OAAO,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,KACjD,OAAO,CAAC,CAAC,CAAC,KACX,OAAO,CAAC,CAAC,CAAC,CAAC;IAChB,wBAAwB,EAAE,cAAc,eAAe,EAAE,wBAAwB,CAAC;IAClF,gBAAgB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAC9D,mBAAmB,EAAE,CACpB,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,MAAM,KACZ,MAAM,GAAG,SAAS,CAAC;IACxB,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;CACjE,GAAG,OAAO,CAAC,IAAI,CAAC,CAiLhB"}

package/dist/lib/runtime/account-pool.js

@@ -48,6 +48,7 @@ export async function persistAccountPoolResults(params) {
                     lastUsed: now,
                     workspaces: result.workspaces,
                     currentWorkspaceIndex: initialWorkspaceIndex,
+                    ...(result.codexCliMirror ? { codexCliMirror: result.codexCliMirror } : {}),
                 });
                 continue;
             }
@@ -105,6 +106,9 @@ export async function persistAccountPoolResults(params) {
                 lastUsed: now,
                 workspaces: mergedWorkspaces,
                 currentWorkspaceIndex: nextCurrentWorkspaceIndex,
+                codexCliMirror: result.codexCliMirror === null
+                    ? undefined
+                    : (result.codexCliMirror ?? existing.codexCliMirror),
             };
         }
         if (accounts.length === 0)

package/dist/lib/runtime/account-reset-credits.d.ts

@@ -0,0 +1,42 @@
+import { AccountManager } from '../accounts.js';
+import { type AccountMetadataV3 } from '../storage.js';
+import { ResetCreditService, type ResetTarget } from './reset-credits.js';
+export declare function resetTargetForStoredAccount(account: AccountMetadataV3): ResetTarget | null;
+export declare function isResetTargetEnabled(account: AccountMetadataV3, target: ResetTarget): boolean;
+export declare function createResetCreditService(manager?: AccountManager): ResetCreditService;
+export declare function loadResetCreditState(): Promise<{
+    version: 1;
+    policy: "manual" | "last-resort";
+    snapshots: Record<string, {
+        updatedAt: number;
+        availableCount: number | null;
+        ordinaryUsageAllowed: boolean | null;
+        planType: string | null;
+        primary: {
+            usedPercent?: number | undefined;
+            resetsAt?: number | null | undefined;
+            windowDurationMins?: number | null | undefined;
+        };
+        secondary: {
+            usedPercent?: number | undefined;
+            resetsAt?: number | null | undefined;
+            windowDurationMins?: number | null | undefined;
+        };
+    }>;
+    pending?: {
+        key: string;
+        idempotencyKey: string;
+    } | undefined;
+    lastAutomaticCheckAt?: number | undefined;
+    lastRedemptionAt?: number | undefined;
+    lastRedemption?: {
+        key: string;
+        at: number;
+        outcome: "reset" | "nothingToReset" | "noCredit" | "alreadyRedeemed";
+        automatic: boolean;
+    } | undefined;
+}>;
+/** Local terminal labels only; never used in provider requests or public artifacts. */
+export declare function resetAccountLabel(account: Pick<AccountMetadataV3, "email">, index: number): string;
+export declare function refreshAndPrintResetCredits(log: (message: string) => void): Promise<void>;
+//# sourceMappingURL=account-reset-credits.d.ts.map

package/dist/lib/runtime/account-reset-credits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-reset-credits.d.ts","sourceRoot":"","sources":["../../../lib/runtime/account-reset-credits.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAA2D,MAAM,gBAAgB,CAAC;AACzG,OAAO,EAAgB,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAOrE,OAAO,EAAE,kBAAkB,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAG1E,wBAAgB,2BAA2B,CAAC,OAAO,EAAC,iBAAiB,GAAE,WAAW,GAAC,IAAI,CAOtF;AACD,wBAAgB,oBAAoB,CAAC,OAAO,EAAC,iBAAiB,EAAC,MAAM,EAAC,WAAW,GAAE,OAAO,CAMzF;AAED,wBAAgB,wBAAwB,CAAC,OAAO,CAAC,EAAC,cAAc,GAAE,kBAAkB,CA2BnF;AACD,wBAAsB,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAA+C;AACzF,uFAAuF;AACvF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAIlG;AACD,wBAAsB,2BAA2B,CAAC,GAAG,EAAC,CAAC,OAAO,EAAC,MAAM,KAAG,IAAI,iBAQ3E"}

package/dist/lib/runtime/account-reset-credits.js

@@ -0,0 +1,82 @@
+import { join } from 'node:path';
+import { AccountManager, extractAccountId, resolveAccountRecordId, sanitizeEmail } from '../accounts.js';
+import { loadAccounts } from '../storage.js';
+import { getCodexMultiAuthDir } from '../runtime-paths.js';
+import { ensureFreshAccessToken } from './rotation-token-refresh.js';
+import { modelScopeId, workspaceModelScopes } from './workspace-model-scopes.js';
+import { nativeRateLimitsRpc } from './native-rate-limits.js';
+import { codexCliAccountIdFor } from '../auth/token-utils.js';
+import { isRecord } from '../utils.js';
+import { ResetCreditService } from './reset-credits.js';
+import { withCheckProgress } from '../ui/check-progress.js';
+export function resetTargetForStoredAccount(account) {
+    // Organization display aliases are not native ChatGPT workspace identities.
+    const stored = account.accountId?.trim();
+    const id = stored?.startsWith("org-") ? extractAccountId(account.accessToken)?.trim() : stored;
+    const workspace = account.workspaces?.find(w => w.id === id);
+    if (!id || id.startsWith("org-") || account.enabled === false || workspace?.enabled === false)
+        return null;
+    return { key: modelScopeId('oauth', resolveAccountRecordId(account), id), accountId: id };
+}
+export function isResetTargetEnabled(account, target) {
+    if (account.enabled === false)
+        return false;
+    const canonical = resetTargetForStoredAccount(account);
+    if (canonical?.key === target.key && canonical.accountId === target.accountId)
+        return true;
+    const scopeKey = modelScopeId('oauth', resolveAccountRecordId(account), target.accountId);
+    return !target.accountId.startsWith('org-') && scopeKey === target.key && Boolean(account.workspaces?.some(w => w.id === target.accountId && w.enabled !== false));
+}
+export function createResetCreditService(manager) {
+    const auth = async (target) => {
+        const account = manager?.getAccountsSnapshot().find(a => workspaceModelScopes(a).some(s => s.id === target.key && s.accountId === target.accountId && s.routable) || (resetTargetForStoredAccount({ ...a, accessToken: a.access })?.key === target.key && resetTargetForStoredAccount({ ...a, accessToken: a.access })?.accountId === target.accountId));
+        const current = account && manager?.getAccountByIndex(account.index);
+        if (!manager || !current || current.enabled === false)
+            throw Error('Reset workspace is not enabled');
+        const fresh = await ensureFreshAccessToken({ accountManager: manager, account: current, family: 'codex', model: null, now: Date.now(), tokenRefreshSkewMs: 60000, tokenInvalidationCooldownMs: 300000 });
+        if (!fresh.ok)
+            throw Error('Reset account authentication unavailable');
+        // The mirror carries the id Codex CLI accepts when the backend refused an explicit binding.
+        return { accessToken: fresh.accessToken, accountId: target.accountId, expiresAt: fresh.account.expires ?? 0, codexCliMirror: current.codexCliMirror };
+    };
+    return new ResetCreditService(join(getCodexMultiAuthDir(), 'reset-credits.json'), {
+        read: async (target) => {
+            // The backend answers for the id written into its auth.json (the mirror id when one
+            // applies). Verify the reply against that id; the snapshot stays keyed on the target.
+            const freshAuth = await auth(target);
+            const sent = codexCliAccountIdFor(freshAuth, freshAuth.accessToken) ?? freshAuth.accountId;
+            const reply = await nativeRateLimitsRpc(freshAuth, 'account/rateLimits/read', { excludeResetCreditDetails: true });
+            if (!isRecord(reply) || reply.accountId !== sent)
+                throw Error('Reset credit workspace identity mismatch');
+            return { ...reply, accountId: target.accountId };
+        },
+        consume: async (target, idempotencyKey) => {
+            const freshAuth = await auth(target);
+            const disk = await loadAccounts();
+            if (!disk?.accounts.some(a => isResetTargetEnabled(a, target)))
+                throw Error('Reset target was removed, disabled, or changed; no credit consumed');
+            return nativeRateLimitsRpc(freshAuth, 'account/rateLimitResetCredit/consume', { idempotencyKey });
+        },
+    });
+}
+export async function loadResetCreditState() { return createResetCreditService().status(); }
+/** Local terminal labels only; never used in provider requests or public artifacts. */
+export function resetAccountLabel(account, index) {
+    const email = sanitizeEmail(account.email);
+    const printable = email && !/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(email);
+    return `Account ${index + 1}${printable ? ` (${email})` : ""}`;
+}
+export async function refreshAndPrintResetCredits(log) {
+    const storage = await loadAccounts();
+    if (!storage?.accounts.length)
+        return;
+    const manager = new AccountManager(undefined, storage);
+    const targets = storage.accounts.map(resetTargetForStoredAccount).filter((t) => Boolean(t));
+    try {
+        const snapshots = await withCheckProgress(`Checking reset credits for ${targets.length} accounts`, () => createResetCreditService(manager).refresh(targets), log);
+        storage.accounts.forEach((a, i) => { const target = resetTargetForStoredAccount(a); const count = target ? snapshots[target.key]?.availableCount : undefined; log(`${resetAccountLabel(a, i)}: available subscription resets: ${count ?? 'unknown (not verified)'}`); });
+    }
+    finally {
+        await manager.flushPendingSave();
+    }
+}

package/dist/lib/runtime/api-model-capabilities.d.ts

@@ -0,0 +1,30 @@
+import type { ApiRouteCredential } from "../api-route-store.js";
+import { type RouteModel } from "../model-route-policy.js";
+/** Read the explicit model-specific statement, never surrounding examples or another model's settings. */
+export declare function parseApiReasoningDocumentation(id: string, text: string): string[];
+export type ProbeResult = {
+    at: number;
+    levels: string[];
+    tiers: string[];
+    status: Record<string, string>;
+};
+export declare class ApiModelCapabilities {
+    private readonly fetchImpl;
+    private readonly now;
+    private activeProbes;
+    private readonly probeWaiters;
+    private withProbeSlot;
+    private readonly inFlight;
+    private readonly probes;
+    private readonly cache;
+    constructor(fetchImpl?: typeof fetch, now?: () => number);
+    /** Probe results keyed by an opaque hash, for a fresh CLI process to honour the 15-minute cache. */
+    exportProbes(): Array<[string, ProbeResult]>;
+    importProbes(entries: Array<[string, ProbeResult]>): void;
+    reasoning(id: string, refresh?: boolean): Promise<string[]>;
+    private documentation;
+    private probe;
+    private runProbe;
+    enrich(models: RouteModel[], refresh?: boolean, route?: ApiRouteCredential, forceProbes?: boolean): Promise<RouteModel[]>;
+}
+//# sourceMappingURL=api-model-capabilities.d.ts.map

package/dist/lib/runtime/api-model-capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-model-capabilities.d.ts","sourceRoot":"","sources":["../../../lib/runtime/api-model-capabilities.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAEN,KAAK,UAAU,EACf,MAAM,0BAA0B,CAAC;AAYlC,0GAA0G;AAC1G,wBAAgB,8BAA8B,CAC7C,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,GACV,MAAM,EAAE,CAuBV;AACD,MAAM,MAAM,WAAW,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B,CAAC;AAwCF,qBAAa,oBAAoB;IA2B/B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IA3BrB,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAyB;YACxC,aAAa;IAY3B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA2C;IACpE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAQnB;IACJ,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA8D;gBAElE,SAAS,GAAE,OAAO,KAAa,EAC/B,GAAG,GAAE,MAAM,MAAiB;IAE9C,oGAAoG;IACpG,YAAY,IAAI,KAAK,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAG5C,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,GAAG,IAAI;IAMnD,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,UAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAGjD,aAAa;YA4Cb,KAAK;YAyBL,QAAQ;IA8MhB,MAAM,CACX,MAAM,EAAE,UAAU,EAAE,EACpB,OAAO,UAAQ,EACf,KAAK,CAAC,EAAE,kBAAkB,EAC1B,WAAW,UAAQ,GACjB,OAAO,CAAC,UAAU,EAAE,CAAC;CAqDxB"}