codex-multi-auth 2.16.0 → 2.17.2

package/dist/lib/runtime/native-provider-config.js

@@ -0,0 +1,52 @@
+import { tomlStringLiteral } from "./config-toml.js";
+import { NATIVE_PROVIDER_BEGIN as BEGIN, hasNativeProviderConfig, } from "../runtime-constants.js";
+export { hasNativeProviderConfig } from "../runtime-constants.js";
+const END = "# codex-multi-auth native provider end";
+const ROOT_KEYS = /^\s*(model_provider|openai_base_url)\s*=/;
+function withoutNativeBlock(content) {
+    const start = content.indexOf(BEGIN);
+    if (start < 0)
+        return content;
+    const end = content.indexOf(END, start);
+    if (end < 0)
+        throw new Error("Incomplete native provider binding");
+    return (content.slice(0, start) +
+        content.slice(end + END.length).replace(/^\r?\n/, ""));
+}
+function rootLines(content, select) {
+    let root = true;
+    return content.split(/\r?\n/).filter((line) => {
+        if (/^\s*\[/.test(line))
+            root = false;
+        const match = root && ROOT_KEYS.test(line);
+        return select ? match : !match;
+    });
+}
+export function rewriteNativeProviderConfig(content, baseUrl) {
+    const url = new URL(baseUrl);
+    if (url.protocol !== "http:" ||
+        !["127.0.0.1", "[::1]"].includes(url.hostname) ||
+        !url.port ||
+        url.username ||
+        url.password ||
+        url.search ||
+        url.hash ||
+        url.pathname !== "/")
+        throw new Error("Native provider requires a loopback proxy origin");
+    const lines = rootLines(withoutNativeBlock(content), false);
+    return [
+        BEGIN,
+        'model_provider = "openai"',
+        `openai_base_url = ${tomlStringLiteral(baseUrl)}`,
+        END,
+        ...lines,
+    ].join("\n");
+}
+export function restoreNativeProviderConfig(content, original) {
+    if (!hasNativeProviderConfig(content))
+        return content;
+    return [
+        ...rootLines(original, true),
+        ...rootLines(withoutNativeBlock(content), false),
+    ].join("\n");
+}

package/dist/lib/runtime/native-rate-limits.d.ts

@@ -0,0 +1,18 @@
+import type { CodexCliMirror } from '../storage/public-types.js';
+export interface NativeUsageAuth {
+    accessToken: string;
+    accountId: string;
+    expiresAt: number;
+    idToken?: string;
+    codexCliMirror?: CodexCliMirror;
+}
+type Method = 'account/rateLimits/read' | 'account/rateLimitResetCredit/consume';
+/** One bounded native RPC session in an isolated home. No refresh token, API key,
+ * global configuration, or desktop auth changes are available to this process. */
+export declare function nativeRateLimitsRpc(auth: NativeUsageAuth, method: Method, params: Record<string, unknown>, options?: {
+    command?: string[];
+    tempRoot?: string;
+    timeoutMs?: number;
+}): Promise<unknown>;
+export {};
+//# sourceMappingURL=native-rate-limits.d.ts.map

package/dist/lib/runtime/native-rate-limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-rate-limits.d.ts","sourceRoot":"","sources":["../../../lib/runtime/native-rate-limits.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAIjE,MAAM,WAAW,eAAe;IAAE,WAAW,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAC;IAAA,OAAO,CAAC,EAAC,MAAM,CAAC;IAAA,cAAc,CAAC,EAAC,cAAc,CAAA;CAAC;AAUtI,KAAK,MAAM,GAAC,yBAAyB,GAAC,sCAAsC,CAAC;AAU7E;kFACkF;AAClF,wBAAsB,mBAAmB,CAAC,IAAI,EAAC,eAAe,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,CAAC,MAAM,EAAC,OAAO,CAAC,EAAC,OAAO,GAAC;IAAC,OAAO,CAAC,EAAC,MAAM,EAAE,CAAC;IAAA,QAAQ,CAAC,EAAC,MAAM,CAAC;IAAA,SAAS,CAAC,EAAC,MAAM,CAAA;CAAI,GAAE,OAAO,CAAC,OAAO,CAAC,CAyC7L"}

package/dist/lib/runtime/native-rate-limits.js

@@ -0,0 +1,135 @@
+import { spawn } from 'node:child_process';
+import { existsSync, promises as fs } from 'node:fs';
+import { createRequire } from 'node:module';
+import { isAbsolute, join } from 'node:path';
+import { codexCliAccountIdFor } from '../auth/token-utils.js';
+import { getCodexMultiAuthDir } from '../runtime-paths.js';
+import { isRecord } from '../utils.js';
+/** Longer than any live session (15s timeout), so only crash leftovers are swept. */
+const STALE_HOME_MS = 10 * 60_000;
+async function sweepStaleHomes(root) {
+    const entries = await fs.readdir(root).catch(() => []);
+    await Promise.all(entries.filter(name => name.startsWith('reset-rpc-')).map(async (name) => {
+        const path = join(root, name);
+        try {
+            if (Date.now() - (await fs.stat(path)).mtimeMs > STALE_HOME_MS)
+                await fs.rm(path, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
+        }
+        catch { /* Another process owns or already removed it. */ }
+    }));
+}
+function nativeCommand() {
+    const override = process.env.CODEX_MULTI_AUTH_USAGE_CODEX_BIN?.trim();
+    if (override) {
+        if (!isAbsolute(override) || !existsSync(override))
+            throw Error('Native usage executable must be an existing absolute path');
+        return [override];
+    }
+    // Prefer the desktop backend whose protocol supplies the native usage UI.
+    const bundled = '/Applications/ChatGPT.app/Contents/Resources/codex';
+    if (process.platform === 'darwin' && existsSync(bundled))
+        return [bundled];
+    try {
+        return [process.execPath, createRequire(import.meta.url).resolve('@openai/codex/bin/codex.js')];
+    }
+    catch {
+        throw Error('Native usage backend unavailable; set CODEX_MULTI_AUTH_USAGE_CODEX_BIN to the native Codex executable');
+    }
+}
+/** One bounded native RPC session in an isolated home. No refresh token, API key,
+ * global configuration, or desktop auth changes are available to this process. */
+export async function nativeRateLimitsRpc(auth, method, params, options = {}) {
+    if (!auth.accessToken || !auth.accountId || auth.expiresAt <= Date.now() + 30000)
+        throw Error('Native usage requires a fresh account access token');
+    const command = options.command ?? nativeCommand();
+    const executable = command[0];
+    if (!executable)
+        throw Error('Native usage backend unavailable');
+    // The home briefly holds an access token: keep it in the user-private multi-auth
+    // directory (chmod is a no-op on Windows %TEMP%) and sweep leftovers of hard kills.
+    const root = options.tempRoot ?? join(getCodexMultiAuthDir(), 'tmp');
+    await fs.mkdir(root, { recursive: true, mode: 0o700 });
+    await sweepStaleHomes(root);
+    const dir = await fs.mkdtemp(join(root, 'reset-rpc-'));
+    let stop = async () => { };
+    try {
+        await fs.chmod(dir, 0o700);
+        await fs.writeFile(join(dir, 'auth.json'), JSON.stringify({ auth_mode: 'chatgpt', OPENAI_API_KEY: null, tokens: { access_token: auth.accessToken, id_token: auth.idToken ?? auth.accessToken, refresh_token: '', account_id: codexCliAccountIdFor(auth, auth.accessToken, auth.idToken) }, last_refresh: new Date().toISOString() }), { mode: 0o600 });
+        await fs.writeFile(join(dir, 'config.toml'), 'cli_auth_credentials_store = "file"\n', { mode: 0o600 });
+        const env = { ...process.env, CODEX_HOME: dir };
+        // A native backend must not inherit API authentication or our own proxy route.
+        for (const key of ['NODE_OPTIONS', 'OPENAI_API_KEY', 'OPENAI_BASE_URL', 'CODEX_API_KEY'])
+            delete env[key];
+        const child = spawn(executable, [...command.slice(1), 'app-server'], { env, cwd: dir, stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true });
+        const exited = new Promise(resolve => { child.once('exit', () => resolve()); child.once('error', () => resolve()); });
+        stop = async () => { if (child.exitCode === null && child.signalCode === null && child.pid) {
+            child.kill('SIGTERM');
+            const timer = setTimeout(() => { if (child.pid && child.exitCode === null && child.signalCode === null)
+                child.kill('SIGKILL'); }, 1000);
+            try {
+                await exited;
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        } };
+        return await new Promise((resolve, reject) => {
+            let buffer = '';
+            let phase = 0;
+            let done = false;
+            const timer = setTimeout(() => fail('timed out'), options.timeoutMs ?? 15000);
+            const fail = (reason) => { if (done)
+                return; done = true; clearTimeout(timer); reject(Error('Native usage ' + reason)); };
+            const send = (value) => child.stdin.write(JSON.stringify(value) + '\n');
+            child.on('error', () => fail('backend failed to start'));
+            child.on('exit', () => fail('backend exited before replying'));
+            child.stdin.on('error', () => fail('backend pipe closed'));
+            child.stderr.resume();
+            child.stdout.setEncoding('utf8');
+            child.stdout.on('data', (data) => {
+                if (done)
+                    return;
+                buffer += data;
+                if (Buffer.byteLength(buffer) > 1024 * 1024) {
+                    fail('reply exceeded limit');
+                    return;
+                }
+                let newline;
+                while ((newline = buffer.indexOf('\n')) >= 0) {
+                    const line = buffer.slice(0, newline);
+                    buffer = buffer.slice(newline + 1);
+                    let reply;
+                    try {
+                        reply = JSON.parse(line);
+                    }
+                    catch {
+                        fail('reply was invalid');
+                        return;
+                    }
+                    if (!isRecord(reply) || reply.id !== phase + 1)
+                        continue;
+                    if (reply.error) {
+                        fail('operation rejected by backend');
+                        return;
+                    }
+                    if (phase === 0) {
+                        phase = 1;
+                        send({ method: 'initialized' });
+                        send({ id: 2, method, params });
+                    }
+                    else {
+                        done = true;
+                        clearTimeout(timer);
+                        resolve(reply.result);
+                        return;
+                    }
+                }
+            });
+            send({ id: 1, method: 'initialize', params: { clientInfo: { name: 'multi-auth-usage', version: '1.0' }, capabilities: { experimentalApi: true } } });
+        });
+    }
+    finally {
+        await stop();
+        await fs.rm(dir, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 });
+    }
+}

package/dist/lib/runtime/reset-credit-routing.d.ts

@@ -0,0 +1,41 @@
+import { type AccountManager, type ManagedAccount } from '../accounts.js';
+import type { ModelFamily } from '../prompts/codex.js';
+import type { QuotaCacheEntry } from '../quota-cache.js';
+import { type ResetCreditService } from './reset-credits.js';
+import type { workspaceModelScopes } from './workspace-model-scopes.js';
+type Scope = ReturnType<typeof workspaceModelScopes>[number];
+export declare function recoverResetQuota(options: {
+    model: string;
+    family?: ModelFamily;
+    native: boolean;
+    pinned: boolean;
+    manager: AccountManager;
+    scopes: Map<number, Scope[]>;
+    priorityByAccount?: Record<number, number>;
+    preferredIndex?: number | null;
+    quotaForScope: (account: ManagedAccount, scope: Scope) => QuotaCacheEntry | null | undefined;
+    service: Pick<ResetCreditService, 'automatic'> & {
+        status: () => Promise<{
+            snapshots: Awaited<ReturnType<ResetCreditService['status']>>['snapshots'];
+        }>;
+    };
+    observations: Map<string, QuotaCacheEntry>;
+    clearQuotaScheduler: (account: ManagedAccount) => void;
+    now: () => number;
+}): Promise<boolean>;
+/** Apply a confirmed earned reset once per workspace/model observation. */
+export declare function applyConfirmedReset(options: {
+    account: ManagedAccount;
+    scope: Scope;
+    model: string;
+    family: ModelFamily;
+    manager: AccountManager;
+    snapshot: Awaited<ReturnType<ResetCreditService['status']>>['snapshots'][string] | undefined;
+    lastRedemptionAt: number | undefined;
+    previous: QuotaCacheEntry | null | undefined;
+    observations: Map<string, QuotaCacheEntry>;
+    clearQuotaScheduler: (account: ManagedAccount) => void;
+    now: number;
+}): boolean;
+export {};
+//# sourceMappingURL=reset-credit-routing.d.ts.map

package/dist/lib/runtime/reset-credit-routing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reset-credit-routing.d.ts","sourceRoot":"","sources":["../../../lib/runtime/reset-credit-routing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC5F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGzD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,KAAK,KAAK,GAAC,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAC3D,wBAAsB,iBAAiB,CAAC,OAAO,EAAC;IAC/C,KAAK,EAAC,MAAM,CAAC;IAAA,MAAM,CAAC,EAAC,WAAW,CAAC;IAAA,MAAM,EAAC,OAAO,CAAC;IAAA,MAAM,EAAC,OAAO,CAAC;IAAA,OAAO,EAAC,cAAc,CAAC;IACtF,MAAM,EAAC,GAAG,CAAC,MAAM,EAAC,KAAK,EAAE,CAAC,CAAC;IAAA,iBAAiB,CAAC,EAAC,MAAM,CAAC,MAAM,EAAC,MAAM,CAAC,CAAC;IAAA,cAAc,CAAC,EAAC,MAAM,GAAC,IAAI,CAAC;IAAA,aAAa,EAAC,CAAC,OAAO,EAAC,cAAc,EAAC,KAAK,EAAC,KAAK,KAAG,eAAe,GAAC,IAAI,GAAC,SAAS,CAAC;IACnL,OAAO,EAAC,IAAI,CAAC,kBAAkB,EAAC,WAAW,CAAC,GAAG;QAAC,MAAM,EAAC,MAAI,OAAO,CAAC;YAAC,SAAS,EAAC,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;SAAC,CAAC,CAAA;KAAC,CAAC;IAChJ,YAAY,EAAC,GAAG,CAAC,MAAM,EAAC,eAAe,CAAC,CAAC;IAAA,mBAAmB,EAAC,CAAC,OAAO,EAAC,cAAc,KAAG,IAAI,CAAC;IAAA,GAAG,EAAC,MAAI,MAAM,CAAC;CAC3G,GAAE,OAAO,CAAC,OAAO,CAAC,CAiClB;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,OAAO,EAAC;IAAC,OAAO,EAAC,cAAc,CAAC;IAAA,KAAK,EAAC,KAAK,CAAC;IAAA,KAAK,EAAC,MAAM,CAAC;IAAA,MAAM,EAAC,WAAW,CAAC;IAAA,OAAO,EAAC,cAAc,CAAC;IAAA,QAAQ,EAAC,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,GAAC,SAAS,CAAC;IAAA,gBAAgB,EAAC,MAAM,GAAC,SAAS,CAAC;IAAA,QAAQ,EAAC,eAAe,GAAC,IAAI,GAAC,SAAS,CAAC;IAAA,YAAY,EAAC,GAAG,CAAC,MAAM,EAAC,eAAe,CAAC,CAAC;IAAA,mBAAmB,EAAC,CAAC,OAAO,EAAC,cAAc,KAAG,IAAI,CAAC;IAAA,GAAG,EAAC,MAAM,CAAA;CAAC,GAAE,OAAO,CAW1Z"}

package/dist/lib/runtime/reset-credit-routing.js

@@ -0,0 +1,66 @@
+import { extractAccountId } from '../accounts.js';
+import { parseModelRoute } from '../model-route-policy.js';
+import { subscriptionQuotaPreference } from './subscription-quota-order.js';
+import { resetSnapshotQuota } from './reset-credits.js';
+export async function recoverResetQuota(options) {
+    if (!options.native || options.pinned || parseModelRoute(options.model).kind !== 'oauth')
+        return false;
+    const family = options.family ?? 'codex';
+    const candidates = [...options.scopes].flatMap(([index, scopes]) => { const account = options.manager.getAccountByIndex(index); return account && !account.authInvalidatedAt ? scopes.map(scope => ({ account, scope })) : []; });
+    if (!candidates.length)
+        return false;
+    // Any usable capacity (including the reserve), unknown quota, or non-quota
+    // failure prevents an automatic credit from being spent.
+    if (candidates.some(({ account, scope }) => {
+        if (account.enabled === false || account.authInvalidatedAt || !scope.routable)
+            return true;
+        const skip = options.manager.getAccountRuntimeSkipReason(account.index, family, options.model);
+        if (skip && !['rate-limited', 'cooling-down:rate-limit'].includes(skip))
+            return true;
+        const quota = subscriptionQuotaPreference(options.quotaForScope(account, scope), options.now());
+        return !quota.exhausted && !['rate-limited', 'cooling-down:rate-limit'].includes(skip ?? '');
+    }))
+        return false;
+    candidates.sort((a, b) => Number(b.account.index === options.preferredIndex) - Number(a.account.index === options.preferredIndex) || (options.priorityByAccount?.[a.account.index] ?? 1) - (options.priorityByAccount?.[b.account.index] ?? 1));
+    const targets = candidates.filter(({ scope }) => !scope.accountId.startsWith("org-")).map(({ scope }) => ({ key: scope.id, accountId: scope.accountId }));
+    await options.service.automatic(targets);
+    const state = await options.service.status();
+    let recovered = false;
+    for (const { account, scope } of candidates) {
+        const snapshot = state.snapshots[scope.id];
+        const previous = options.quotaForScope(account, scope);
+        if (!snapshot || snapshot.updatedAt < (previous?.updatedAt ?? 0) || options.now() - snapshot.updatedAt > 60000 || snapshot.updatedAt > options.now())
+            continue;
+        options.observations.set(JSON.stringify([scope.id, options.model]), resetSnapshotQuota(snapshot));
+        if (snapshot.ordinaryUsageAllowed !== true)
+            continue;
+        // Do not clear sibling workspace/model throttles or authentication failures.
+        if ((scope.bound || (account.accountId?.startsWith('org-') && scope.accountId === extractAccountId(account.access))) && account.lastRateLimitReason === 'quota') {
+            delete account.rateLimitResetTimes[family];
+            delete account.rateLimitResetTimes[`${family}:${options.model}`];
+            if (account.cooldownReason === 'rate-limit')
+                options.manager.clearAccountCooldown(account);
+            options.clearQuotaScheduler(account);
+        }
+        recovered = true;
+    }
+    if (recovered)
+        options.manager.saveToDiskDebounced();
+    return recovered;
+}
+/** Apply a confirmed earned reset once per workspace/model observation. */
+export function applyConfirmedReset(options) {
+    const s = options.snapshot;
+    if (!s || options.lastRedemptionAt === undefined || s.updatedAt < options.lastRedemptionAt || s.ordinaryUsageAllowed !== true || s.updatedAt <= (options.previous?.updatedAt ?? 0) || options.now - s.updatedAt > 60000 || s.updatedAt > options.now)
+        return false;
+    options.observations.set(JSON.stringify([options.scope.id, options.model]), resetSnapshotQuota(s));
+    if ((options.scope.bound || (options.account.accountId?.startsWith('org-') && options.scope.accountId === extractAccountId(options.account.access))) && options.account.lastRateLimitReason === 'quota') {
+        delete options.account.rateLimitResetTimes[options.family];
+        delete options.account.rateLimitResetTimes[`${options.family}:${options.model}`];
+        if (options.account.cooldownReason === 'rate-limit')
+            options.manager.clearAccountCooldown(options.account);
+        options.clearQuotaScheduler(options.account);
+        options.manager.saveToDiskDebounced();
+    }
+    return true;
+}

package/dist/lib/runtime/reset-credits.d.ts

@@ -0,0 +1,101 @@
+import { z } from 'zod';
+import type { QuotaCacheEntry } from '../quota-cache.js';
+export interface ResetTarget {
+    key: string;
+    accountId: string;
+}
+declare const snapshotSchema: z.ZodObject<{
+    updatedAt: z.ZodNumber;
+    availableCount: z.ZodNullable<z.ZodNumber>;
+    ordinaryUsageAllowed: z.ZodNullable<z.ZodBoolean>;
+    planType: z.ZodNullable<z.ZodString>;
+    primary: z.ZodObject<{
+        usedPercent: z.ZodOptional<z.ZodNumber>;
+        resetsAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        windowDurationMins: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    }, z.core.$strip>;
+    secondary: z.ZodObject<{
+        usedPercent: z.ZodOptional<z.ZodNumber>;
+        resetsAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        windowDurationMins: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type ResetSnapshot = z.infer<typeof snapshotSchema>;
+declare const stateSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    policy: z.ZodDefault<z.ZodEnum<{
+        manual: "manual";
+        "last-resort": "last-resort";
+    }>>;
+    snapshots: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        updatedAt: z.ZodNumber;
+        availableCount: z.ZodNullable<z.ZodNumber>;
+        ordinaryUsageAllowed: z.ZodNullable<z.ZodBoolean>;
+        planType: z.ZodNullable<z.ZodString>;
+        primary: z.ZodObject<{
+            usedPercent: z.ZodOptional<z.ZodNumber>;
+            resetsAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+            windowDurationMins: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        }, z.core.$strip>;
+        secondary: z.ZodObject<{
+            usedPercent: z.ZodOptional<z.ZodNumber>;
+            resetsAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+            windowDurationMins: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>>;
+    pending: z.ZodOptional<z.ZodObject<{
+        key: z.ZodString;
+        idempotencyKey: z.ZodString;
+    }, z.core.$strip>>;
+    lastAutomaticCheckAt: z.ZodOptional<z.ZodNumber>;
+    lastRedemptionAt: z.ZodOptional<z.ZodNumber>;
+    lastRedemption: z.ZodOptional<z.ZodObject<{
+        key: z.ZodString;
+        at: z.ZodNumber;
+        outcome: z.ZodEnum<{
+            reset: "reset";
+            nothingToReset: "nothingToReset";
+            noCredit: "noCredit";
+            alreadyRedeemed: "alreadyRedeemed";
+        }>;
+        automatic: z.ZodBoolean;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type State = z.infer<typeof stateSchema>;
+declare const outcomeSchema: z.ZodObject<{
+    outcome: z.ZodEnum<{
+        reset: "reset";
+        nothingToReset: "nothingToReset";
+        noCredit: "noCredit";
+        alreadyRedeemed: "alreadyRedeemed";
+    }>;
+}, z.core.$strip>;
+export type ResetOutcome = z.infer<typeof outcomeSchema>['outcome'];
+export declare function parseResetSnapshot(value: unknown, accountId: string, now: number): ResetSnapshot;
+export declare function resetSnapshotQuota(snapshot: ResetSnapshot): QuotaCacheEntry;
+export declare function isResetSubscription(snapshot: ResetSnapshot): boolean;
+export interface ResetCreditIO {
+    read: (target: ResetTarget) => Promise<unknown>;
+    consume: (target: ResetTarget, idempotencyKey: string) => Promise<unknown>;
+    now?: () => number;
+}
+export declare class ResetCreditService {
+    private readonly path;
+    private readonly io;
+    constructor(path: string, io: ResetCreditIO);
+    private now;
+    status(): Promise<State>;
+    private save;
+    setPolicy(policy: State['policy']): Promise<void>;
+    private read;
+    refresh(targets: ResetTarget[]): Promise<Record<string, ResetSnapshot>>;
+    private consumeLocked;
+    redeem(target: ResetTarget): Promise<ResetOutcome>;
+    automatic(targets: ResetTarget[]): Promise<{
+        key: string;
+        outcome: ResetOutcome;
+    } | null>;
+    private automaticLocked;
+}
+export {};
+//# sourceMappingURL=reset-credits.d.ts.map

package/dist/lib/runtime/reset-credits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reset-credits.d.ts","sourceRoot":"","sources":["../../../lib/runtime/reset-credits.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGzD,MAAM,WAAW,WAAW;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE;AAE/D,QAAA,MAAM,cAAc;;;;;;;;;;;;;;;iBAAiN,CAAC;AACtO,MAAM,MAAM,aAAa,GAAC,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AACzD,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAud,CAAC;AACze,KAAK,KAAK,GAAC,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEvC,QAAA,MAAM,aAAa;;;;;;;iBAAoF,CAAC;AACxG,MAAM,MAAM,YAAY,GAAC,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC,SAAS,CAAC,CAAC;AAClE,wBAAgB,kBAAkB,CAAC,KAAK,EAAC,OAAO,EAAC,SAAS,EAAC,MAAM,EAAC,GAAG,EAAC,MAAM,GAAE,aAAa,CAI1F;AACD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAC,aAAa,GAAE,eAAe,CAKzE;AACD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAC,aAAa,GAAE,OAAO,CAElE;AACD,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAC,CAAC,MAAM,EAAC,WAAW,KAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,EAAC,CAAC,MAAM,EAAC,WAAW,EAAC,cAAc,EAAC,MAAM,KAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrE,GAAG,CAAC,EAAC,MAAI,MAAM,CAAC;CAChB;AAOD,qBAAa,kBAAkB;IAClB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAQ,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAA/B,IAAI,EAAC,MAAM,EAAkB,EAAE,EAAC,aAAa;IAC1E,OAAO,CAAC,GAAG;IACL,MAAM,IAAG,OAAO,CAAC,KAAK,CAAC;YAIf,IAAI;IASZ,SAAS,CAAC,MAAM,EAAC,KAAK,CAAC,QAAQ,CAAC;YACxB,IAAI;IACZ,OAAO,CAAC,OAAO,EAAC,WAAW,EAAE,GAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAC,aAAa,CAAC,CAAC;YAI5D,aAAa;IAUrB,MAAM,CAAC,MAAM,EAAC,WAAW,GAAE,OAAO,CAAC,YAAY,CAAC;IAQtD,SAAS,CAAC,OAAO,EAAC,WAAW,EAAE,GAAE,OAAO,CAAC;QAAC,GAAG,EAAC,MAAM,CAAC;QAAA,OAAO,EAAC,YAAY,CAAA;KAAC,GAAC,IAAI,CAAC;YAQlE,eAAe;CAiB7B"}

package/dist/lib/runtime/reset-credits.js

@@ -0,0 +1,162 @@
+import { withRetry } from "../fs-retry.js";
+import { resolve } from "node:path";
+import { randomUUID } from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import { z } from 'zod';
+import { withFileTransactionLock } from '../storage/file-lock.js';
+import { mapWithConcurrency } from '../concurrency.js';
+import { MAX_RATE_LIMIT_DELAY_MS } from '../constants.js';
+const windowSchema = z.object({ usedPercent: z.number().min(0).max(100).optional(), resetsAt: z.number().nonnegative().nullish(), windowDurationMins: z.number().nonnegative().nullish() });
+const snapshotSchema = z.object({ updatedAt: z.number(), availableCount: z.number().int().nonnegative().nullable(), ordinaryUsageAllowed: z.boolean().nullable(), planType: z.string().nullable(), primary: windowSchema, secondary: windowSchema });
+const stateSchema = z.object({ version: z.literal(1), policy: z.enum(['manual', 'last-resort']).default('manual'), snapshots: z.record(z.string(), snapshotSchema).default({}), pending: z.object({ key: z.string(), idempotencyKey: z.string().uuid() }).optional(), lastAutomaticCheckAt: z.number().optional(), lastRedemptionAt: z.number().optional(), lastRedemption: z.object({ key: z.string(), at: z.number(), outcome: z.enum(['reset', 'nothingToReset', 'noCredit', 'alreadyRedeemed']), automatic: z.boolean() }).optional() });
+const readSchema = z.object({ accountId: z.string(), ordinaryUsageAllowed: z.boolean().nullish(), rateLimitResetCredits: z.object({ availableCount: z.number().int().nonnegative() }).nullish(), rateLimits: z.object({ planType: z.string().nullish(), primary: windowSchema.nullish(), secondary: windowSchema.nullish() }) });
+const outcomeSchema = z.object({ outcome: z.enum(['reset', 'nothingToReset', 'noCredit', 'alreadyRedeemed']) });
+export function parseResetSnapshot(value, accountId, now) {
+    const parsed = readSchema.parse(value);
+    if (parsed.accountId !== accountId)
+        throw Error('Reset credit workspace identity mismatch');
+    return { updatedAt: now, availableCount: parsed.rateLimitResetCredits?.availableCount ?? null, ordinaryUsageAllowed: parsed.ordinaryUsageAllowed ?? null, planType: parsed.rateLimits.planType ?? null, primary: parsed.rateLimits.primary ?? {}, secondary: parsed.rateLimits.secondary ?? {} };
+}
+export function resetSnapshotQuota(snapshot) {
+    // A bogus resetsAt must not read as a window that never resets.
+    const resetAtMs = (s) => typeof s === 'number' && Number.isFinite(s) ? Math.min(s * 1000, snapshot.updatedAt + MAX_RATE_LIMIT_DELAY_MS) : undefined;
+    const window = (w) => ({ usedPercent: w.usedPercent, resetAtMs: resetAtMs(w.resetsAt), windowMinutes: w.windowDurationMins ?? undefined });
+    return { updatedAt: snapshot.updatedAt, status: 200, model: 'usage-read', planType: snapshot.planType ?? undefined, primary: window(snapshot.primary), secondary: window(snapshot.secondary) };
+}
+export function isResetSubscription(snapshot) {
+    return ['plus', 'pro', 'prolite', 'team', 'business', 'self_serve_business_prolite', 'enterprise', 'edu', 'edu_plus', 'edu_pro'].includes(snapshot.planType ?? '');
+}
+/** No credentials or credit IDs are persisted. One global redemption lease covers
+ * all accounts: concurrent exhausted requests cannot independently spend credits. */
+/** A stored time further ahead than this came from a clock that has since stepped back: treat it as expired. */
+const FUTURE_SKEW_MS = 5 * 60000;
+const within = (at, now, windowMs) => at !== undefined && at <= now + FUTURE_SKEW_MS && now - at < windowMs;
+const automaticChecks = new Map();
+export class ResetCreditService {
+    path;
+    io;
+    constructor(path, io) {
+        this.path = path;
+        this.io = io;
+    }
+    now() { return this.io.now?.() ?? Date.now(); }
+    async status() {
+        try {
+            const stat = await fs.lstat(this.path);
+            if (!stat.isFile() || stat.isSymbolicLink())
+                throw Error('Invalid reset-credit state file');
+            return stateSchema.parse(JSON.parse(await fs.readFile(this.path, 'utf8')));
+        }
+        catch (e) {
+            if (e.code === 'ENOENT')
+                return { version: 1, policy: 'manual', snapshots: {} };
+            throw e;
+        }
+    }
+    async save(state) {
+        const path = this.path + '.' + randomUUID() + '.tmp';
+        try {
+            const file = await fs.open(path, 'wx', 0o600);
+            try {
+                await file.writeFile(JSON.stringify(stateSchema.parse(state)) + '\n');
+                await file.sync();
+            }
+            finally {
+                await file.close();
+            }
+            await withRetry(() => fs.rename(path, this.path), { maxAttempts: 6, backoffMs: 25 });
+        }
+        finally {
+            await fs.rm(path, { force: true });
+        }
+    }
+    async setPolicy(policy) { await withFileTransactionLock(this.path, async () => { const s = await this.status(); s.policy = policy; await this.save(s); }); }
+    async read(target) { return parseResetSnapshot(await this.io.read(target), target.accountId, this.now()); }
+    async refresh(targets) {
+        const results = await mapWithConcurrency(targets, 3, async (t) => { try {
+            return { key: t.key, snapshot: await this.read(t) };
+        }
+        catch {
+            return null;
+        } });
+        return withFileTransactionLock(this.path, async () => { const state = await this.status(); const updated = {}; const now = this.now(); for (const row of results)
+            if (row) {
+                const old = state.snapshots[row.key];
+                if (!old || old.updatedAt <= row.snapshot.updatedAt || old.updatedAt > now + FUTURE_SKEW_MS)
+                    state.snapshots[row.key] = row.snapshot;
+                updated[row.key] = row.snapshot;
+            } await this.save(state); return updated; });
+    }
+    async consumeLocked(state, target, automatic = false) {
+        if (state.pending && state.pending.key !== target.key)
+            throw Error('A reset redemption is pending for another account; retry that account explicitly first.');
+        state.pending ??= { key: target.key, idempotencyKey: randomUUID() };
+        state.lastRedemptionAt = this.now();
+        await this.save(state);
+        const result = outcomeSchema.parse(await this.io.consume(target, state.pending.idempotencyKey));
+        // Keep the same key on *any* ambiguous outcome, including a failed follow-up read.
+        state.snapshots[target.key] = await this.read(target);
+        state.lastRedemption = { key: target.key, at: this.now(), outcome: result.outcome, automatic };
+        delete state.pending;
+        await this.save(state);
+        return result.outcome;
+    }
+    async redeem(target) {
+        return withFileTransactionLock(this.path, async () => {
+            const state = await this.status();
+            if (!state.pending && within(state.lastRedemptionAt, this.now(), 10000))
+                throw Error('A reset was just redeemed; refresh usage before trying again.');
+            if (!state.pending) {
+                const snapshot = await this.read(target);
+                state.snapshots[target.key] = snapshot;
+                await this.save(state);
+                if (snapshot.availableCount === null)
+                    throw Error('Reset-credit availability is unknown');
+                if (snapshot.availableCount === 0)
+                    return 'noCredit';
+            }
+            return this.consumeLocked(state, target);
+        });
+    }
+    automatic(targets) {
+        const key = resolve(this.path), signature = JSON.stringify(targets), pending = automaticChecks.get(key);
+        if (pending)
+            return pending.targets === signature ? pending.promise : pending.promise.then(() => null);
+        if (automaticChecks.size >= 1000)
+            return Promise.resolve(null);
+        const promise = this.automaticLocked(targets).finally(() => { automaticChecks.delete(key); });
+        automaticChecks.set(key, { targets: signature, promise });
+        return promise;
+    }
+    async automaticLocked(targets) {
+        if (!targets.length || (await this.status()).policy !== 'last-resort')
+            return null;
+        return withFileTransactionLock(this.path, async () => {
+            const state = await this.status();
+            if (state.policy !== 'last-resort' || state.pending || within(state.lastAutomaticCheckAt, this.now(), 60000) || within(state.lastRedemptionAt, this.now(), 300000))
+                return null;
+            state.lastAutomaticCheckAt = this.now();
+            await this.save(state);
+            // Missing/failed reads prevent spending. A scheduled reset that has arrived
+            // is confirmed by ordinaryUsageAllowed, never inferred from a clock or %.
+            const reads = await mapWithConcurrency(targets, 3, async (t) => { try {
+                return await this.read(t);
+            }
+            catch {
+                return null;
+            } });
+            reads.forEach((s, i) => { const t = targets[i]; if (s && t)
+                state.snapshots[t.key] = s; });
+            await this.save(state);
+            if (reads.some(s => !s || !isResetSubscription(s) || s.ordinaryUsageAllowed !== false))
+                return null;
+            if (reads.some(s => s && [s.primary, s.secondary].some(w => w.usedPercent === 100 && typeof w.resetsAt === 'number' && w.resetsAt * 1000 <= this.now() + 60000)))
+                return null;
+            const index = reads.findIndex(s => s !== null && (s.availableCount ?? 0) > 0);
+            const target = targets[index];
+            if (!target)
+                return null;
+            return { key: target.key, outcome: await this.consumeLocked(state, target, true) };
+        }, { waitMs: 1000 });
+    }
+}

package/dist/lib/runtime/response-output-history.d.ts

@@ -0,0 +1,17 @@
+type Item = Record<string, unknown>;
+/** Preserve completed streamed items when the terminal response omits its output. */
+export declare class ResponseOutputHistory {
+    private readonly maxBytes;
+    private readonly items;
+    private bytes;
+    private invalid;
+    constructor(maxBytes: number);
+    observe(event: Item): void;
+    finish(output: unknown): Item[] | undefined;
+    private invalidate;
+    private put;
+}
+/** A replay must carry each tool call before its corresponding result. */
+export declare function hasOrphanToolResult(input: unknown): boolean;
+export {};
+//# sourceMappingURL=response-output-history.d.ts.map

package/dist/lib/runtime/response-output-history.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-output-history.d.ts","sourceRoot":"","sources":["../../../lib/runtime/response-output-history.ts"],"names":[],"mappings":"AAEA,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpC,qFAAqF;AACrF,qBAAa,qBAAqB;IAIrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAHrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqE;IAC3F,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,OAAO,CAAS;gBACK,QAAQ,EAAE,MAAM;IAE7C,OAAO,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI;IAY1B,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,EAAE,GAAG,SAAS;IAqB3C,OAAO,CAAC,UAAU;IAKlB,OAAO,CAAC,GAAG;CAUX;AAED,0EAA0E;AAC1E,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAY3D"}