codex-multi-auth 2.17.0 → 2.17.3

package/dist/lib/runtime/automatic-subscription-checks.d.ts

@@ -1,7 +1,6 @@
 import { type AccountMetadataV3 } from "../storage.js";
 import { type CodexQuotaSnapshot } from "../quota-probe.js";
-type Observer = (account: AccountMetadataV3, snapshot: CodexQuotaSnapshot, accounts: AccountMetadataV3[]) => Promise<void> | void;
+type Observer = (account: AccountMetadataV3, snapshot: CodexQuotaSnapshot, accounts: AccountMetadataV3[], workspaceId: string) => Promise<void> | void;
 /** Captures this router's pool; reads only verified primary credentials, never API/ZDR entries. */
 export declare function createAutomaticSubscriptionCheck(observe?: Observer): (signal: AbortSignal) => Promise<void>;
 export {};
-//# sourceMappingURL=automatic-subscription-checks.d.ts.map

package/dist/lib/runtime/automatic-subscription-checks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"automatic-subscription-checks.d.ts","sourceRoot":"","sources":["../../../lib/runtime/automatic-subscription-checks.ts"],"names":[],"mappings":"AAIA,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAA2B,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAUrF,KAAK,QAAQ,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAClI,mGAAmG;AACnG,wBAAgB,gCAAgC,CAAC,OAAO,CAAC,EAAE,QAAQ,IASvD,QAAQ,WAAW,mBA+B9B"}
+{"version":3,"file":"automatic-subscription-checks.d.ts","sourceRoot":"","sources":["../../../lib/runtime/automatic-subscription-checks.ts"],"names":[],"mappings":"AAGA,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAA2B,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAOrF,KAAK,QAAQ,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACvJ,mGAAmG;AACnG,wBAAgB,gCAAgC,CAAC,OAAO,CAAC,EAAE,QAAQ,IASvD,QAAQ,WAAW,mBAgC9B"}

package/dist/lib/runtime/automatic-subscription-checks.js

@@ -1,35 +1,33 @@
 import { getStoragePathState, runWithStoragePathState } from "../storage/path-state.js";
-import { join } from "node:path";
 import { AccountManager, resolveAccountRecordId } from "../accounts.js";
 import { getAccountPolicyKey, loadAccountPolicyStore } from "../account-policy.js";
 import { getStoragePath } from "../storage.js";
 import { fetchCodexQuotaSnapshot } from "../quota-probe.js";
 import { loadQuotaCache, saveQuotaCache } from "../quota-cache.js";
-import { updateQuotaCacheForAccount } from "../codex-manager/quota-cache-helpers.js";
-import { getCodexMultiAuthDir } from "../runtime-paths.js";
-import { withFileTransactionLock } from "../storage/file-lock.js";
+import { updateQuotaCacheForWorkspace } from "../codex-manager/quota-cache-helpers.js";
 import { createNativeAccountStorageReader } from "./native-account-storage.js";
 import { ensureFreshAccessToken } from "./rotation-token-refresh.js";
-import { workspaceModelScopes } from "./workspace-model-scopes.js";
-import { runAutomaticAccountChecks } from "./automatic-account-checks.js";
+import { automaticCheckWorkspaceId, runAutomaticAccountChecks } from "./automatic-account-checks.js";
 import { logWarn } from "../logger.js";
 /** Captures this router's pool; reads only verified primary credentials, never API/ZDR entries. */
 export function createAutomaticSubscriptionCheck(observe) {
     const path = getStoragePath(), storageState = getStoragePathState();
     const read = createNativeAccountStorageReader(undefined, path);
-    const quotaPath = join(getCodexMultiAuthDir(), "quota-cache.json");
-    const onQuota = observe ?? (async (account, snapshot, accounts) => withFileTransactionLock(quotaPath, async () => {
+    const onQuota = observe ?? (async (account, snapshot, accounts, workspaceId) => {
         const cache = await loadQuotaCache();
-        updateQuotaCacheForAccount(cache, account, snapshot, accounts);
-        await saveQuotaCache(cache);
-    }));
+        const baseline = structuredClone(cache);
+        updateQuotaCacheForWorkspace(cache, account, workspaceId, snapshot, accounts);
+        await saveQuotaCache(cache, baseline);
+    });
     return (signal) => runWithStoragePathState(storageState, () => runAutomaticAccountChecks({
         path: `${path}.automatic-checks.json`, signal, loadPolicies: loadAccountPolicyStore,
         loadAccounts: async () => { const snapshot = await read(); return snapshot.verified ? snapshot.storage : null; },
         check: async (storage, index) => {
             const manager = new AccountManager(undefined, storage);
             const account = manager.getAccountByIndex(index);
-            if (!account || !workspaceModelScopes(account).some(s => s.bound && s.routable) || signal.aborted)
+            const stored = storage.accounts[index];
+            const targetId = stored && automaticCheckWorkspaceId(stored);
+            if (!account || !targetId || signal.aborted)
                 return;
             const fresh = await ensureFreshAccessToken({ accountManager: manager, account, family: "codex", model: null, now: Date.now(), tokenRefreshSkewMs: 60000, tokenInvalidationCooldownMs: 300000 });
             try {
@@ -41,13 +39,12 @@ export function createAutomaticSubscriptionCheck(observe) {
                 const policy = current ? (await loadAccountPolicyStore()).accounts[getAccountPolicyKey(current)] : undefined;
                 if (!disk.storage || !current || current.refreshToken !== fresh.account.refreshToken || current.accessToken !== fresh.accessToken || !policy?.autoPrime || policy.paused || policy.drained || current.enabled === false || current.authInvalidatedAt || (current.coolingDownUntil ?? 0) > Date.now())
                     return;
-                const bound = workspaceModelScopes(fresh.account).find(s => s.bound && s.routable);
-                if (!bound || (current.accountId && current.accountId !== bound.accountId) || current.workspaces?.some(w => w.id === bound.accountId && w.enabled === false) || signal.aborted)
+                if (automaticCheckWorkspaceId(current) !== targetId || signal.aborted)
                     return;
-                const snapshot = await fetchCodexQuotaSnapshot({ accountId: bound.accountId, accessToken: fresh.accessToken, primeUnusedSubscription: true, signal });
+                const snapshot = await fetchCodexQuotaSnapshot({ accountId: targetId, accessToken: fresh.accessToken, primeUnusedSubscription: true, signal });
                 if (snapshot.primingFailure)
                     logWarn("Automatic first-use completion was not confirmed; retry deferred until the next check.");
-                await onQuota(current, snapshot, disk.storage.accounts);
+                await onQuota(current, snapshot, disk.storage.accounts, targetId);
             }
             finally {
                 await manager.flushPendingSave();

package/dist/lib/runtime/browser-oauth-flow.d.ts

@@ -29,4 +29,3 @@ export declare function runBrowserOAuthFlow(params: {
     exchangeAuthorizationCode: (code: string, verifier: string, redirectUri: string) => Promise<TokenResult>;
     redirectUri: string;
 }): Promise<TokenResult>;
-//# sourceMappingURL=browser-oauth-flow.d.ts.map

package/dist/lib/runtime/capability-boost.d.ts

@@ -22,4 +22,3 @@ export declare function buildCapabilityBoostByAccount(input: {
     };
     getBoost: (accountKey: string, capabilityKey: string) => number;
 }): number[];
-//# sourceMappingURL=capability-boost.d.ts.map

package/dist/lib/runtime/catalog-capabilities.d.ts

@@ -5,4 +5,3 @@ export declare function mergeCatalogModels(models: readonly CatalogModel[]): Cat
 export declare function mergeCatalogModel(a: CatalogModel, b: CatalogModel): CatalogModel;
 export declare function clampCatalogContext(a: CatalogModel, b: CatalogModel): CatalogModel;
 export declare function supportsCatalogSettings(model: CatalogModel, effort?: string, tier?: string): boolean;
-//# sourceMappingURL=catalog-capabilities.d.ts.map

package/dist/lib/runtime/config-toml.d.ts

@@ -21,4 +21,3 @@ export declare function configHasRuntimeRotationProvider(rawConfig: string): boo
  * rather than the dangling proxy id.
  */
 export declare function restoreConfigTomlFromRuntimeRotationProviderWithoutBackup(currentConfig: string, defaultProvider?: string): string;
-//# sourceMappingURL=config-toml.d.ts.map

package/dist/lib/runtime/context-budget-settings.d.ts

@@ -10,4 +10,3 @@ export declare function applyContextBudgetGuardSettingsFromConfig(pluginConfig:
     getContextBudgetGuardHardPercent: (config: ReturnType<typeof import("../config.js").loadPluginConfig>) => number;
     getContextBudgetGuardModelWindowOverrides: (config: ReturnType<typeof import("../config.js").loadPluginConfig>) => Record<string, number>;
 }): void;
-//# sourceMappingURL=context-budget-settings.d.ts.map

package/dist/lib/runtime/event-handler.d.ts

@@ -19,4 +19,3 @@ export declare function handleRuntimeEvent(params: {
     logDebug: (message: string) => void;
     pluginName: string;
 }): Promise<void>;
-//# sourceMappingURL=event-handler.d.ts.map

package/dist/lib/runtime/first-run.d.ts

@@ -81,4 +81,3 @@ export declare function loadLauncherInstall(candidateOverride?: readonly string[
  */
 export declare function ensureFirstRunSetup(deps?: FirstRunSetupDeps): Promise<FirstRunResult>;
 export {};
-//# sourceMappingURL=first-run.d.ts.map

package/dist/lib/runtime/flagged-verify-types.d.ts

@@ -6,4 +6,3 @@ export type FlaggedVerificationState = {
     restored: TokenSuccessWithAccount<TokenSuccess>[];
 };
 export declare function createFlaggedVerificationState(): FlaggedVerificationState;
-//# sourceMappingURL=flagged-verify-types.d.ts.map

package/dist/lib/runtime/hydrate-emails.d.ts

@@ -10,4 +10,3 @@ export declare function hydrateRuntimeEmails(storage: AccountStorageV3 | null, d
     logWarn: (message: string) => void;
     pluginName: string;
 }): Promise<AccountStorageV3 | null>;
-//# sourceMappingURL=hydrate-emails.d.ts.map

package/dist/lib/runtime/inference-activity.d.ts

@@ -12,4 +12,3 @@ export declare function createInferenceActivityWriter(save?: (key: string, at: n
     flush(): Promise<void>;
 };
 export declare function loadInferenceRequestTimes(keys: string[]): Promise<Record<string, number>>;
-//# sourceMappingURL=inference-activity.d.ts.map

package/dist/lib/runtime/live-sync-entry.d.ts

@@ -40,4 +40,3 @@ export declare function ensureLiveAccountSyncEntry<TSync extends LiveAccountSync
     liveAccountSyncConfigKey: string | null;
 }>;
 export {};
-//# sourceMappingURL=live-sync-entry.d.ts.map

package/dist/lib/runtime/live-sync.d.ts

@@ -35,4 +35,3 @@ export declare function ensureRuntimeLiveAccountSync<TConfig, TSync extends Live
     configKey: string | null;
     cleanupRegistered: boolean;
 }>;
-//# sourceMappingURL=live-sync.d.ts.map

package/dist/lib/runtime/loader-setup.d.ts

@@ -7,4 +7,3 @@ export declare function applyLoaderRuntimeSetup(params: {
     applyPreemptiveQuotaSettings: (pluginConfig: ReturnType<typeof import("../config.js").loadPluginConfig>) => void;
     applyContextBudgetGuardSettings: (pluginConfig: ReturnType<typeof import("../config.js").loadPluginConfig>) => void;
 }): void;
-//# sourceMappingURL=loader-setup.d.ts.map

package/dist/lib/runtime/login-menu-accounts.d.ts

@@ -31,4 +31,3 @@ export declare function buildLoginMenuAccounts(accounts: Array<{
     }, now: number) => string | null;
 }): LoginMenuAccount[];
 export {};
-//# sourceMappingURL=login-menu-accounts.d.ts.map

package/dist/lib/runtime/manual-oauth-flow.d.ts

@@ -37,4 +37,3 @@ export declare function buildManualOAuthFlow(pkce: {
     verifier: string;
 }, url: string, expectedState: string, deps: RuntimeManualOAuthFlowDeps): ManualOAuthFlow<RuntimeResolvedToken>;
 export {};
-//# sourceMappingURL=manual-oauth-flow.d.ts.map

package/dist/lib/runtime/model-discovery-status.d.ts

@@ -23,8 +23,8 @@ declare const schema: z.ZodObject<{
                 model: z.ZodString;
                 checkedAt: z.ZodOptional<z.ZodNumber>;
                 probes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<{
-                    unsupported: "unsupported";
                     verified: "verified";
+                    unsupported: "unsupported";
                     unverified: "unverified";
                     downgraded: "downgraded";
                 }>>>;
@@ -51,8 +51,8 @@ declare const schema: z.ZodObject<{
             model: z.ZodString;
             checkedAt: z.ZodOptional<z.ZodNumber>;
             probes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<{
-                unsupported: "unsupported";
                 verified: "verified";
+                unsupported: "unsupported";
                 unverified: "unverified";
                 downgraded: "downgraded";
             }>>>;
@@ -97,4 +97,3 @@ export declare function refreshAndPrintModelInventory(log: (message: string) =>
 /** Compare stable credential/workspace scopes, keeping the last successful baseline through outages. */
 export declare function withInventoryChanges(current: ModelInventory, previous: ModelInventory | null): ModelInventory;
 export {};
-//# sourceMappingURL=model-discovery-status.d.ts.map

package/dist/lib/runtime/native-account-storage.d.ts

@@ -8,4 +8,3 @@ export interface NativeAccountSnapshot {
 }
 /** Cache parsed primary storage only; backup recovery must never resurrect revoked credentials. */
 export declare function createNativeAccountStorageReader(read?: () => Promise<AccountStorageV3 | null>, path?: string): () => Promise<NativeAccountSnapshot>;
-//# sourceMappingURL=native-account-storage.d.ts.map

package/dist/lib/runtime/native-account-sync.d.ts

@@ -16,4 +16,3 @@ export declare function isSameNativeAccount(account: Identity, disk: Identity |
 /** Adopt credentials from a re-login without resetting independent quota state. */
 export declare function syncNativeAccountCredentials(manager: AccountManager, storage: AccountStorageV3): boolean;
 export {};
-//# sourceMappingURL=native-account-sync.d.ts.map

package/dist/lib/runtime/native-binding-lock.d.ts

@@ -1,3 +1,2 @@
 /** Shared across CLI processes: protect the native provider check and desktop auth write. */
 export declare function withNativeBindingLock<T>(configPath: string, action: () => Promise<T>): Promise<T>;
-//# sourceMappingURL=native-binding-lock.d.ts.map

package/dist/lib/runtime/native-client-auth.d.ts

@@ -1,3 +1,2 @@
 /** Trust the exact local desktop credential, never claims from the incoming bearer. */
 export declare function isNativeClientToken(bearer: string, now: number, read?: () => Promise<string>): Promise<boolean>;
-//# sourceMappingURL=native-client-auth.d.ts.map

package/dist/lib/runtime/native-provider-config.d.ts

@@ -1,4 +1,3 @@
 export { hasNativeProviderConfig } from "../runtime-constants.js";
 export declare function rewriteNativeProviderConfig(content: string, baseUrl: string): string;
 export declare function restoreNativeProviderConfig(content: string, original: string): string;
-//# sourceMappingURL=native-provider-config.d.ts.map

package/dist/lib/runtime/native-rate-limits.d.ts

@@ -7,6 +7,8 @@ export interface NativeUsageAuth {
     codexCliMirror?: CodexCliMirror;
 }
 type Method = 'account/rateLimits/read' | 'account/rateLimitResetCredit/consume';
+/** @internal Native usage needs the desktop backend when it is installed. */
+export declare function resolveNativeUsageCommand(platform?: NodeJS.Platform): string[];
 /** One bounded native RPC session in an isolated home. No refresh token, API key,
  * global configuration, or desktop auth changes are available to this process. */
 export declare function nativeRateLimitsRpc(auth: NativeUsageAuth, method: Method, params: Record<string, unknown>, options?: {
@@ -15,4 +17,3 @@ export declare function nativeRateLimitsRpc(auth: NativeUsageAuth, method: Metho
     timeoutMs?: number;
 }): Promise<unknown>;
 export {};
-//# sourceMappingURL=native-rate-limits.d.ts.map

package/dist/lib/runtime/native-rate-limits.js

@@ -1,5 +1,5 @@
 import { spawn } from 'node:child_process';
-import { existsSync, promises as fs } from 'node:fs';
+import { accessSync, constants, existsSync, promises as fs, statSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { isAbsolute, join } from 'node:path';
 import { codexCliAccountIdFor } from '../auth/token-utils.js';
@@ -18,7 +18,8 @@ async function sweepStaleHomes(root) {
         catch { /* Another process owns or already removed it. */ }
     }));
 }
-function nativeCommand() {
+/** @internal Native usage needs the desktop backend when it is installed. */
+export function resolveNativeUsageCommand(platform = process.platform) {
     const override = process.env.CODEX_MULTI_AUTH_USAGE_CODEX_BIN?.trim();
     if (override) {
         if (!isAbsolute(override) || !existsSync(override))
@@ -26,9 +27,25 @@ function nativeCommand() {
         return [override];
     }
     // Prefer the desktop backend whose protocol supplies the native usage UI.
-    const bundled = '/Applications/ChatGPT.app/Contents/Resources/codex';
-    if (process.platform === 'darwin' && existsSync(bundled))
-        return [bundled];
+    const bundled = [
+        '/Applications/ChatGPT.app/Contents/Resources/codex-cli/bin/codex',
+        '/Applications/ChatGPT.app/Contents/Resources/codex',
+    ];
+    if (platform === 'darwin') {
+        const executable = bundled.find(path => {
+            try {
+                if (!statSync(path).isFile())
+                    return false;
+                accessSync(path, constants.X_OK);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        });
+        if (executable)
+            return [executable];
+    }
     try {
         return [process.execPath, createRequire(import.meta.url).resolve('@openai/codex/bin/codex.js')];
     }
@@ -41,7 +58,7 @@ function nativeCommand() {
 export async function nativeRateLimitsRpc(auth, method, params, options = {}) {
     if (!auth.accessToken || !auth.accountId || auth.expiresAt <= Date.now() + 30000)
         throw Error('Native usage requires a fresh account access token');
-    const command = options.command ?? nativeCommand();
+    const command = options.command ?? resolveNativeUsageCommand();
     const executable = command[0];
     if (!executable)
         throw Error('Native usage backend unavailable');

package/dist/lib/runtime/preemptive-quota.d.ts

@@ -10,4 +10,3 @@ export declare function applyRuntimePreemptiveQuotaSettings<TConfig>(pluginConfi
     getPreemptiveQuotaRemainingPercent7d: (config: TConfig) => number;
     getPreemptiveQuotaMaxDeferralMs: (config: TConfig) => number;
 }): void;
-//# sourceMappingURL=preemptive-quota.d.ts.map

package/dist/lib/runtime/quota-headers.d.ts

@@ -4,4 +4,3 @@ export type ParsedCodexQuotaSnapshot = Omit<CodexQuotaSnapshot, "model">;
 export declare function parseResetAtMs(headers: Headers, prefix: string): number | undefined;
 export declare function parseCodexQuotaSnapshot(headers: Headers, status: number): ParsedCodexQuotaSnapshot | null;
 export declare function formatCodexQuotaLine(snapshot: Pick<CodexQuotaSnapshot, "status" | "planType" | "activeLimit" | "primary" | "secondary">): string;
-//# sourceMappingURL=quota-headers.d.ts.map

package/dist/lib/runtime/quota-probe.d.ts

@@ -15,4 +15,3 @@ export declare function fetchRuntimeCodexQuotaSnapshot(params: {
         message?: string;
     };
 }): Promise<CodexQuotaSnapshot>;
-//# sourceMappingURL=quota-probe.d.ts.map

package/dist/lib/runtime/quota-settings.d.ts

@@ -11,4 +11,3 @@ export declare function applyPreemptiveQuotaSettingsFromConfig(pluginConfig: Ret
     getPreemptiveQuotaMaxDeferralMs: (config: ReturnType<typeof import("../config.js").loadPluginConfig>) => number;
 }): void;
 export declare function resolveUiRuntimeFromConfig(loadPluginConfig: () => ReturnType<typeof import("../config.js").loadPluginConfig>, applyUiRuntimeFromConfig: (pluginConfig: ReturnType<typeof import("../config.js").loadPluginConfig>) => ReturnType<typeof import("../ui/runtime.js").getUiRuntimeOptions>): ReturnType<typeof import("../ui/runtime.js").getUiRuntimeOptions>;
-//# sourceMappingURL=quota-settings.d.ts.map

package/dist/lib/runtime/refresh-guardian-entry.d.ts

@@ -29,4 +29,3 @@ export declare function ensureRefreshGuardianEntry<TGuardian>(params: {
     refreshGuardian: TGuardian | null;
     refreshGuardianConfigKey: string | null;
 };
-//# sourceMappingURL=refresh-guardian-entry.d.ts.map

package/dist/lib/runtime/refresh-guardian.d.ts

@@ -21,4 +21,3 @@ export declare function ensureRuntimeRefreshGuardian<TConfig, TGuardian extends
     configKey: string | null;
     cleanupRegistered: boolean;
 };
-//# sourceMappingURL=refresh-guardian.d.ts.map

package/dist/lib/runtime/request-init.d.ts

@@ -2,4 +2,3 @@ export declare function normalizeRuntimeRequestInit(requestInput: Request | stri
 export declare function parseRuntimeRequestBody(body: unknown, deps: {
     logWarn: (message: string) => void;
 }): Promise<Record<string, unknown>>;
-//# sourceMappingURL=request-init.d.ts.map

package/dist/lib/runtime/reset-credit-routing.d.ts

@@ -38,4 +38,3 @@ export declare function applyConfirmedReset(options: {
     now: number;
 }): boolean;
 export {};
-//# sourceMappingURL=reset-credit-routing.d.ts.map

package/dist/lib/runtime/reset-credits.d.ts

@@ -98,4 +98,3 @@ export declare class ResetCreditService {
     private automaticLocked;
 }
 export {};
-//# sourceMappingURL=reset-credits.d.ts.map

package/dist/lib/runtime/response-output-history.d.ts

@@ -14,4 +14,3 @@ export declare class ResponseOutputHistory {
 /** A replay must carry each tool call before its corresponding result. */
 export declare function hasOrphanToolResult(input: unknown): boolean;
 export {};
-//# sourceMappingURL=response-output-history.d.ts.map

package/dist/lib/runtime/responses-websocket.d.ts

@@ -28,4 +28,3 @@ export declare class ResponsesWebSocketGateway {
     private serve;
     close(): void;
 }
-//# sourceMappingURL=responses-websocket.d.ts.map

package/dist/lib/runtime/resume-picker.d.ts

@@ -38,4 +38,3 @@ export declare function pickResumeThread(options: ResumePickerOptions, deps?: {
     select: (items: MenuItem<Choice>[], options: import("../ui/select.js").SelectOptions<Choice>) => Promise<Choice | null>;
 }): Promise<string | null>;
 export {};
-//# sourceMappingURL=resume-picker.d.ts.map

package/dist/lib/runtime/rotation-account-selection.d.ts

@@ -64,4 +64,3 @@ export declare function chooseAccount(params: {
      */
     allowPinnedCooldown?: boolean;
 }): ManagedAccount | null;
-//# sourceMappingURL=rotation-account-selection.d.ts.map

package/dist/lib/runtime/rotation-proxy-state.d.ts

@@ -101,4 +101,3 @@ export interface RotationProxyState extends RotationProxyStateInit {
 export declare function createRotationProxyState(init: RotationProxyStateInit): RotationProxyState;
 /** @internal */
 export declare function recoverStaleRuntimeState(state: RotationProxyState): Promise<AccountManager | null>;
-//# sourceMappingURL=rotation-proxy-state.d.ts.map

package/dist/lib/runtime/rotation-server-types.d.ts

@@ -106,4 +106,3 @@ export interface RuntimeRotationAccountIdentity {
     accountId: string | null;
     updatedAt: number;
 }
-//# sourceMappingURL=rotation-server-types.d.ts.map

package/dist/lib/runtime/rotation-storage-meta.d.ts

@@ -37,4 +37,3 @@ export declare function resetPinCacheForTesting(): void;
  * spinning up the full proxy. See issue #474.
  */
 export declare function maybeInvalidateAffinityFromDisk(sessionAffinityStore: SessionAffinityStore | null, lastObservedGeneration: number, storagePath?: string): number;
-//# sourceMappingURL=rotation-storage-meta.d.ts.map

package/dist/lib/runtime/rotation-token-refresh.d.ts

@@ -22,4 +22,3 @@ export declare function ensureFreshAccessToken(params: {
     retryable: boolean;
     invalidated?: boolean;
 }>;
-//# sourceMappingURL=rotation-token-refresh.d.ts.map

package/dist/lib/runtime/runtime-capability-failures.d.ts

@@ -11,4 +11,3 @@ export declare class RuntimeCapabilityFailures {
     record(credential: string, model: string, kind: CapabilityFailure, effort?: string, tier?: string): void;
     supports(credential: string, model: string, effort?: string, tier?: string): boolean;
 }
-//# sourceMappingURL=runtime-capability-failures.d.ts.map

package/dist/lib/runtime/runtime-current-account.d.ts

@@ -50,4 +50,3 @@ export declare function resolveRuntimeCurrentAccount(storage: AccountStorageV3,
 export declare function resolveAccountCurrentMarkers(index: number, storedCurrentIndex: number, runtimeCurrent: RuntimeCurrentAccountSelection | null): AccountCurrentMarker[];
 export declare function isDisplayCurrentAccount(index: number, storedCurrentIndex: number, runtimeCurrent: RuntimeCurrentAccountSelection | null): boolean;
 export {};
-//# sourceMappingURL=runtime-current-account.d.ts.map

package/dist/lib/runtime/runtime-observability.d.ts

@@ -81,4 +81,3 @@ export declare function recordRuntimeReset(reason: string): void;
 export declare function recordRuntimeAccountRecovery(index: number): void;
 export declare function loadPersistedRuntimeObservabilitySnapshot(): Promise<RuntimeObservabilitySnapshot | null>;
 export {};
-//# sourceMappingURL=runtime-observability.d.ts.map

package/dist/lib/runtime/runtime-services.d.ts

@@ -58,4 +58,3 @@ export declare function ensureSessionAffinityState<TStore extends SessionAffinit
     sessionAffinityConfigKey: string | null;
 };
 export {};
-//# sourceMappingURL=runtime-services.d.ts.map

package/dist/lib/runtime/session-affinity-entry.d.ts

@@ -27,4 +27,3 @@ export declare function ensureSessionAffinityEntry<TStore>(params: {
     sessionAffinityStore: TStore | null;
     sessionAffinityConfigKey: string | null;
 };
-//# sourceMappingURL=session-affinity-entry.d.ts.map

package/dist/lib/runtime/session-recovery.d.ts

@@ -5,4 +5,3 @@ export declare function createRuntimeSessionRecoveryHook(deps: {
     directory: string;
     autoResume: boolean;
 }): import("../recovery.js").SessionRecoveryHook | null;
-//# sourceMappingURL=session-recovery.d.ts.map

package/dist/lib/runtime/status-marker.d.ts

@@ -1,3 +1,2 @@
 import type { UiRuntimeOptions } from "../ui/runtime.js";
 export declare function getRuntimeStatusMarker(ui: UiRuntimeOptions, status: "ok" | "warning" | "error"): string;
-//# sourceMappingURL=status-marker.d.ts.map

package/dist/lib/runtime/storage-scope.d.ts

@@ -10,4 +10,3 @@ export declare function applyAccountStorageScopeFromConfig(pluginConfig: ReturnT
     setStoragePath: (path: string | null) => void;
     cwd: () => string;
 }): void;
-//# sourceMappingURL=storage-scope.d.ts.map

package/dist/lib/runtime/subscription-first-use.d.ts

@@ -7,4 +7,3 @@ export declare class FirstUseProbeError extends Error {
 }
 /** Consume the already-open tiny response, never start a second request. */
 export declare function finishSubscriptionFirstUse(response: Response, timeoutMs: number): Promise<void>;
-//# sourceMappingURL=subscription-first-use.d.ts.map

package/dist/lib/runtime/subscription-quota-event.d.ts

@@ -3,4 +3,3 @@ import type { QuotaSchedulerSnapshot } from "../preemptive-quota-scheduler.js";
 export declare function readSubscriptionQuotaEvent(event: unknown, now: number): (QuotaSchedulerSnapshot & {
     planType?: string;
 }) | null;
-//# sourceMappingURL=subscription-quota-event.d.ts.map

package/dist/lib/runtime/subscription-quota-order.d.ts

@@ -14,4 +14,3 @@ export declare function subscriptionQuotaPreference(entry: QuotaCacheEntry | nul
 export declare function usesSubscriptionReserve(preference: SubscriptionQuotaPreference | undefined): boolean;
 /** Negative means a should be used first. Equal hints leave existing health/affinity scoring intact. */
 export declare function compareSubscriptionQuota(a: SubscriptionQuotaPreference, b: SubscriptionQuotaPreference): number;
-//# sourceMappingURL=subscription-quota-order.d.ts.map

package/dist/lib/runtime/toast.d.ts

@@ -13,4 +13,3 @@ export declare function showRuntimeToast(client: {
     title?: string;
     duration?: number;
 }): Promise<void>;
-//# sourceMappingURL=toast.d.ts.map

package/dist/lib/runtime/ui-runtime-entry.d.ts

@@ -4,4 +4,3 @@ export declare function resolveUiRuntimeEntry(params: {
     resolveUiRuntimeFromConfig: (loadPluginConfig: () => ReturnType<typeof import("../config.js").loadPluginConfig>, applyUiRuntimeFromConfig: (pluginConfig: ReturnType<typeof import("../config.js").loadPluginConfig>) => UiRuntimeOptions) => UiRuntimeOptions;
     applyUiRuntimeFromConfig: (pluginConfig: ReturnType<typeof import("../config.js").loadPluginConfig>) => UiRuntimeOptions;
 }): UiRuntimeOptions;
-//# sourceMappingURL=ui-runtime-entry.d.ts.map

package/dist/lib/runtime/ui-runtime.d.ts

@@ -6,4 +6,3 @@ export declare function applyUiRuntimeFromConfig(pluginConfig: ReturnType<typeof
     glyphMode: ReturnType<typeof getCodexTuiGlyphMode>;
 }) => UiRuntimeOptions): UiRuntimeOptions;
 export declare function getStatusMarker(ui: UiRuntimeOptions, status: "ok" | "warning" | "error"): string;
-//# sourceMappingURL=ui-runtime.d.ts.map

package/dist/lib/runtime/verify-flagged.d.ts

@@ -45,4 +45,3 @@ export declare function verifyRuntimeFlaggedAccounts(deps: {
     now?: () => number;
 }): Promise<void>;
 export {};
-//# sourceMappingURL=verify-flagged.d.ts.map

package/dist/lib/runtime/workspace-model-scopes.d.ts

@@ -12,4 +12,3 @@ export declare function workspaceModelScopes(account: ManagedAccount): {
     workspaceIndex: number;
     enabled: boolean;
 }[];
-//# sourceMappingURL=workspace-model-scopes.d.ts.map

package/dist/lib/runtime-constants.d.ts

@@ -35,4 +35,3 @@ export declare function listRuntimeHelperOwnerPaths(baseDir: string, entries: re
 /** Marker shared by config binding and desktop-auth sync protection. */
 export declare const NATIVE_PROVIDER_BEGIN = "# codex-multi-auth native provider begin";
 export declare function hasNativeProviderConfig(content: string): boolean;
-//# sourceMappingURL=runtime-constants.d.ts.map

package/dist/lib/runtime-paths.d.ts

@@ -55,4 +55,3 @@ export declare function getCodexLogDir(): string;
  * @returns The filesystem path for the legacy directory (e.g. `/home/alice/.codex`).
  */
 export declare function getLegacyCodexDir(): string;
-//# sourceMappingURL=runtime-paths.d.ts.map

package/dist/lib/runtime-rotation-proxy.d.ts

@@ -7,6 +7,7 @@ export type { PinnedUnavailableErrorBody } from "./request/rate-limit-decision.j
 export { chooseAccount } from "./runtime/rotation-account-selection.js";
 export { maybeInvalidateAffinityFromDisk, readPinnedAccountIndexFromDisk, readStorageMetaFromDisk, resetPinCacheForTesting, } from "./runtime/rotation-storage-meta.js";
 export type { StorageMeta } from "./runtime/rotation-storage-meta.js";
+export { resetRuntimePolicyCacheForTests } from "./policy/runtime-policy-cache.js";
 /** @internal Stable identity key for in-memory quota snapshots across reloads. */
 /**
  * Quota-scheduler key prefix identifying ONE account across every family and
@@ -47,4 +48,3 @@ export declare function resolveModelCapacityRetryMs(env?: NodeJS.ProcessEnv): nu
  */
 export declare function normalizeForcedAccountIndex(value: number | string | null | undefined): number | null;
 export declare function startRuntimeRotationProxy(options: RuntimeRotationProxyOptions): Promise<RuntimeRotationProxyServer>;
-//# sourceMappingURL=runtime-rotation-proxy.d.ts.map