dsh-github-copilot 0.4.0-alpha.30 → 0.4.0-alpha.32

package/lib/index.js

@@ -1,29 +1,29 @@
-import { C as currentSearchInitiator, D as GITHUB_COPILOT_CREDENTIAL_KEY, E as readCopilotCatalog, O as GITHUB_COPILOT_PREVIEW_PROVIDER_ID, S as currentChatRoute, T as isPluginPreviewProvider, _ as RESPONSES_WEB_SEARCH_TOOL_TYPE, a as COPILOT_HOSTED_SEARCH_PROVIDER_ID, b as candidatesForRoute, c as abortable$1, d as readBounded, f as applyRequestAuth, h as ANTHROPIC_WEB_SEARCH_TOOL_TYPE, i as describeSearchBackend, k as GITHUB_COPILOT_PROVIDER_ID, l as isAbortError, m as providerRequestHeaders, n as routeSessionSearch, o as GITHUB_COPILOT_HOSTED_SEARCH_PROVIDER_ID, p as normalizeRequestAuth, r as DescribedSearchFallbackError, s as createTraditionalSearchProvider, t as isCopilotSearchSelection, u as providerErrorMessage, v as SearchPlan, w as currentSearchSelection, x as sameCandidates, y as WEB_SEARCH_TOOL_TYPE } from "./search-routing-pFLux0W7.js";
+import { C as currentSearchInitiator, D as GITHUB_COPILOT_CREDENTIAL_KEY, E as readCopilotCatalog, O as GITHUB_COPILOT_PREVIEW_PROVIDER_ID, S as currentChatRoute, T as isPluginPreviewProvider, _ as RESPONSES_WEB_SEARCH_TOOL_TYPE, a as COPILOT_HOSTED_SEARCH_PROVIDER_ID, b as candidatesForRoute, c as abortable$1, d as readBounded, f as applyRequestAuth, h as ANTHROPIC_WEB_SEARCH_TOOL_TYPE, i as describeSearchBackend, k as GITHUB_COPILOT_PROVIDER_ID, l as isAbortError, m as providerRequestHeaders, n as routeSessionSearch, o as GITHUB_COPILOT_HOSTED_SEARCH_PROVIDER_ID, p as normalizeRequestAuth, r as DescribedSearchFallbackError, s as createTraditionalSearchProvider, t as isCopilotSearchSelection, u as providerErrorMessage, v as SearchPlan, w as currentSearchSelection, x as sameCandidates, y as WEB_SEARCH_TOOL_TYPE } from "./search-routing-DqLKem1c.js";
 import AuthorizationService from "@deepseek-ai/dsh-authorization";
 import { createHash, randomUUID } from "node:crypto";
 import * as dshScope from "@deepseek-ai/dsh-scope";
 import { Remote, RemoteError, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import z from "@deepseek-ai/schemastery";
 import { z as z$1 } from "zod";
+import { createModels, getSupportedThinkingLevels, hasApi, lazyStream } from "@earendil-works/pi-ai";
+import { githubCopilotProvider } from "@earendil-works/pi-ai/providers/github-copilot";
+import { getBuiltinModels } from "@earendil-works/pi-ai/providers/all";
 import * as dshLlm from "@deepseek-ai/dsh-llm";
 import { CONTEXT_WINDOW_EXCEEDED_CODE, LlmError, ReasoningEffortId, attributionHeaders, callConfigEquals, contentHasImage, isAgentLoopRequest, resolveImageAttachmentAccess, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { WebError } from "@deepseek-ai/dsh-web";
 import * as dshSettings from "@deepseek-ai/dsh-settings";
-import { getBuiltinModels } from "@earendil-works/pi-ai/providers/all";
-import { createModels, getSupportedThinkingLevels, hasApi, lazyStream } from "@earendil-works/pi-ai";
 import { credentialRef } from "@deepseek-ai/dsh-credentials";
-import { githubCopilotProvider } from "@earendil-works/pi-ai/providers/github-copilot";
 import { Config as Config$1, PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 import { estimateContextTokens, estimateMessageTokens } from "@earendil-works/pi-ai/utils/estimate";
 import { buildCopilotDynamicHeaders, hasCopilotVisionInput } from "@earendil-works/pi-ai/api/github-copilot-headers";
 //#region lib/types/dual-model-host.js
 /** Optional plugin-owned planner/executor sessions; no Core/default-model mutation. */
-var __runInitializers$2 = function(thisArg, initializers, value) {
+var __runInitializers$3 = function(thisArg, initializers, value) {
 	var useValue = arguments.length > 2;
 	for (var i = 0; i < initializers.length; i++) value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
 	return useValue ? value : void 0;
 };
-var __esDecorate$2 = function(ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+var __esDecorate$3 = function(ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
 	function accept(f) {
 		if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected");
 		return f;
@@ -305,7 +305,7 @@ let GitHubCopilotDualModel = (() => {
 			_view_decorators = [Remote];
 			_save_decorators = [Remote];
 			_create_decorators = [Remote];
-			__esDecorate$2(this, null, _view_decorators, {
+			__esDecorate$3(this, null, _view_decorators, {
 				kind: "method",
 				name: "view",
 				static: false,
@@ -316,7 +316,7 @@ let GitHubCopilotDualModel = (() => {
 				},
 				metadata: _metadata
 			}, null, _instanceExtraInitializers);
-			__esDecorate$2(this, null, _save_decorators, {
+			__esDecorate$3(this, null, _save_decorators, {
 				kind: "method",
 				name: "save",
 				static: false,
@@ -327,7 +327,7 @@ let GitHubCopilotDualModel = (() => {
 				},
 				metadata: _metadata
 			}, null, _instanceExtraInitializers);
-			__esDecorate$2(this, null, _create_decorators, {
+			__esDecorate$3(this, null, _create_decorators, {
 				kind: "method",
 				name: "create",
 				static: false,
@@ -345,7 +345,7 @@ let GitHubCopilotDualModel = (() => {
 				value: _metadata
 			});
 		}
-		owner = __runInitializers$2(this, _instanceExtraInitializers);
+		owner = __runInitializers$3(this, _instanceExtraInitializers);
 		lifetime = new AbortController();
 		creates = /* @__PURE__ */ new Map();
 		overlays = /* @__PURE__ */ new Map();
@@ -857,72 +857,847 @@ let GitHubCopilotDualModel = (() => {
 				throw error;
 			}
 		}
-	};
-})();
-//#endregion
-//#region lib/types/search-routing-remote.js
-const SearchProviderCatalogSchema = z$1.object({
-	supported: z$1.boolean(),
-	providers: z$1.array(z$1.object({ id: z$1.string().min(1).max(512) }).strict()).max(512)
-}).strict();
-//#endregion
-//#region lib/types/search-routing-host.js
-var __runInitializers$1 = function(thisArg, initializers, value) {
-	var useValue = arguments.length > 2;
-	for (var i = 0; i < initializers.length; i++) value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
-	return useValue ? value : void 0;
-};
-var __esDecorate$1 = function(ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
-	function accept(f) {
-		if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected");
-		return f;
+	};
+})();
+//#endregion
+//#region lib/types/search-routing-remote.js
+const SearchProviderCatalogSchema = z$1.object({
+	supported: z$1.boolean(),
+	providers: z$1.array(z$1.object({ id: z$1.string().min(1).max(512) }).strict()).max(512)
+}).strict();
+//#endregion
+//#region lib/types/search-routing-host.js
+var __runInitializers$2 = function(thisArg, initializers, value) {
+	var useValue = arguments.length > 2;
+	for (var i = 0; i < initializers.length; i++) value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+	return useValue ? value : void 0;
+};
+var __esDecorate$2 = function(ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+	function accept(f) {
+		if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected");
+		return f;
+	}
+	var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+	var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+	var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+	var _, done = false;
+	for (var i = decorators.length - 1; i >= 0; i--) {
+		var context = {};
+		for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+		for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+		context.addInitializer = function(f) {
+			if (done) throw new TypeError("Cannot add initializers after decoration has completed");
+			extraInitializers.push(accept(f || null));
+		};
+		var result = (0, decorators[i])(kind === "accessor" ? {
+			get: descriptor.get,
+			set: descriptor.set
+		} : descriptor[key], context);
+		if (kind === "accessor") {
+			if (result === void 0) continue;
+			if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+			if (_ = accept(result.get)) descriptor.get = _;
+			if (_ = accept(result.set)) descriptor.set = _;
+			if (_ = accept(result.init)) initializers.unshift(_);
+		} else if (_ = accept(result)) {
+			if (kind === "field") initializers.unshift(_);
+			else descriptor[key] = _;
+		}
+	}
+	if (target) Object.defineProperty(target, contextIn.name, descriptor);
+	done = true;
+};
+let SearchRoutingController = (() => {
+	let _classSuper = TypertRemoteService;
+	let _instanceExtraInitializers = [];
+	let _providers_decorators;
+	return class SearchRoutingController extends _classSuper {
+		static {
+			const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+			_providers_decorators = [Remote];
+			__esDecorate$2(this, null, _providers_decorators, {
+				kind: "method",
+				name: "providers",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "providers" in obj,
+					get: (obj) => obj.providers
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			if (_metadata) Object.defineProperty(this, Symbol.metadata, {
+				enumerable: true,
+				configurable: true,
+				writable: true,
+				value: _metadata
+			});
+		}
+		constructor(ctx) {
+			super(ctx, "githubCopilotSearchRouting");
+			__runInitializers$2(this, _instanceExtraInitializers);
+		}
+		providers() {
+			const unavailable = {
+				supported: false,
+				providers: []
+			};
+			const catalog = this.ctx.get("githubCopilotSearchCatalog");
+			if (typeof catalog?.list !== "function") return unavailable;
+			try {
+				const ids = catalog.list();
+				const parsed = SearchProviderCatalogSchema.safeParse({
+					supported: true,
+					providers: ids.map((id) => ({ id }))
+				});
+				if (!parsed.success || new Set(ids).size !== ids.length) return unavailable;
+				parsed.data.providers.sort((a, b) => a.id.localeCompare(b.id));
+				return parsed.data;
+			} catch {
+				return unavailable;
+			}
+		}
+	};
+})();
+//#endregion
+//#region lib/types/copilot-grant.js
+function nonEmptyOAuthString(value, field) {
+	if (typeof value !== "string" || value.trim().length === 0) throw new Error(`github-copilot: OAuth credential field "${field}" must be a non-empty string`);
+	return value;
+}
+/**
+* Rebuild pi-ai's GitHub Copilot grant as the exact JSON-safe provider shape.
+* Prototype and unrelated extension members are intentionally not preserved.
+*/
+function normalizeGitHubCopilotOAuthCredential(credential) {
+	if (typeof credential !== "object" || credential === null) throw new Error("github-copilot: OAuth credential must be an object");
+	if (Reflect.get(credential, "type") !== "oauth") throw new Error("github-copilot: OAuth credential type must be \"oauth\"");
+	const refresh = nonEmptyOAuthString(Reflect.get(credential, "refresh"), "refresh");
+	const access = nonEmptyOAuthString(Reflect.get(credential, "access"), "access");
+	const expires = Reflect.get(credential, "expires");
+	if (typeof expires !== "number" || !Number.isFinite(expires)) throw new Error("github-copilot: OAuth credential field \"expires\" must be a finite number");
+	const enterpriseUrl = Reflect.get(credential, "enterpriseUrl");
+	if (enterpriseUrl !== void 0 && (typeof enterpriseUrl !== "string" || enterpriseUrl.trim().length === 0)) throw new Error("github-copilot: OAuth credential field \"enterpriseUrl\" must be a non-empty string");
+	const availableModelIds = Reflect.get(credential, "availableModelIds");
+	if (availableModelIds !== void 0 && (!Array.isArray(availableModelIds) || !availableModelIds.every((modelId) => typeof modelId === "string" && modelId.trim().length > 0))) throw new Error("github-copilot: OAuth credential field \"availableModelIds\" must be an array of non-empty strings");
+	return {
+		type: "oauth",
+		refresh,
+		access,
+		expires,
+		...enterpriseUrl === void 0 ? {} : { enterpriseUrl },
+		...availableModelIds === void 0 ? {} : { availableModelIds: [...new Set(availableModelIds)] }
+	};
+}
+//#endregion
+//#region lib/types/copilot-auth.js
+/**
+* Provider-side GitHub Copilot auth resolution over the same credential record
+* that DSH's built-in llm-pi-ai adapter owns.
+*/
+function credentialService(ctx) {
+	const candidate = ctx.get("credentials");
+	if (typeof candidate !== "object" || candidate === null) throw new Error("github-copilot: DSH credentials service is unavailable");
+	for (const method of [
+		"readRecord",
+		"listRecords",
+		"modifyRecord",
+		"deleteRecord"
+	]) if (typeof Reflect.get(candidate, method) !== "function") throw new Error(`github-copilot: required DSH credentials API "credentials.${method}" is unavailable`);
+	return candidate;
+}
+function toCredential(record) {
+	if (record === void 0) return void 0;
+	if (record.kind === "api-key") return {
+		type: "api_key",
+		...record.key === void 0 ? {} : { key: record.key },
+		...record.env === void 0 ? {} : { env: { ...record.env } }
+	};
+	if (typeof record.payload !== "object" || record.payload === null) throw new Error("github-copilot: stored llm-pi-ai GitHub Copilot grant is not an object");
+	return normalizeGitHubCopilotOAuthCredential(record.payload);
+}
+function toRecord(credential) {
+	if (credential.type === "api_key") return {
+		kind: "api-key",
+		...credential.key === void 0 ? {} : { key: credential.key },
+		...credential.env === void 0 ? {} : { env: { ...credential.env } }
+	};
+	return {
+		kind: "grant",
+		payload: normalizeGitHubCopilotOAuthCredential(credential)
+	};
+}
+/** Bind exactly one logical route to the canonical Host-owned credential record. */
+function createGitHubCopilotCredentialStore(ctx, logicalProviderId = GITHUB_COPILOT_PROVIDER_ID) {
+	const assertProvider = (providerId) => {
+		if (providerId !== logicalProviderId) throw new Error("COPILOT_CREDENTIAL_PROVIDER_MISMATCH");
+	};
+	return {
+		read: async (providerId) => {
+			assertProvider(providerId);
+			return toCredential(await credentialService(ctx).readRecord(GITHUB_COPILOT_CREDENTIAL_KEY));
+		},
+		list: async () => {
+			const record = await credentialService(ctx).readRecord(GITHUB_COPILOT_CREDENTIAL_KEY);
+			return record === void 0 ? [] : [{
+				providerId: logicalProviderId,
+				type: record.kind === "api-key" ? "api_key" : "oauth"
+			}];
+		},
+		modify: async (providerId, mutate) => {
+			assertProvider(providerId);
+			return toCredential(await credentialService(ctx).modifyRecord(GITHUB_COPILOT_CREDENTIAL_KEY, async (current) => {
+				const next = await mutate(toCredential(current));
+				return next === void 0 ? void 0 : toRecord(next);
+			}));
+		},
+		delete: async (providerId) => {
+			assertProvider(providerId);
+			await credentialService(ctx).deleteRecord(GITHUB_COPILOT_CREDENTIAL_KEY);
+		}
+	};
+}
+/**
+* Build one resolver whose pi-ai collection refreshes OAuth credentials inside
+* the DSH record's serialized modify operation before exposing request auth.
+*/
+function createGitHubCopilotTokenResolver(ctx, onCredentialChanged) {
+	const models = createModels({ credentials: createGitHubCopilotCredentialStore(ctx) });
+	const provider = githubCopilotProvider();
+	if (provider.auth.oauth === void 0) throw new Error("github-copilot: native OAuth method is unavailable");
+	models.setProvider({
+		...provider,
+		auth: { oauth: provider.auth.oauth }
+	});
+	return async (modelId) => {
+		const snapshot = readCopilotCatalog(ctx);
+		const native = new Map(snapshot.models.map((model) => [model.id, model])).get(modelId);
+		if (native === void 0) throw new Error(`github-copilot: pi-ai catalog has no GitHub Copilot model "${modelId}"`);
+		const resolved = await models.getAuth("github-copilot");
+		if (resolved === void 0) return void 0;
+		if (onCredentialChanged !== void 0) try {
+			await onCredentialChanged();
+		} catch (error) {
+			ctx.logger.warn("github-copilot: provider route reconciliation will retry after a later auth resolution");
+			ctx.logger.warn(error);
+		}
+		const stored = await credentialService(ctx).readRecord(GITHUB_COPILOT_CREDENTIAL_KEY);
+		if (!(stored?.kind === "grant" && (normalizeGitHubCopilotOAuthCredential(stored.payload).availableModelIds ?? []).includes(modelId))) throw new Error(`github-copilot: model "${modelId}" is not available for the signed-in Copilot account`);
+		const apiKey = resolved.auth.apiKey;
+		if (apiKey === void 0) return void 0;
+		return {
+			apiKey,
+			baseURL: trustedCopilotBaseUrl(resolved.auth.baseUrl ?? native.baseUrl, enterpriseDomainOf(stored)),
+			...resolved.auth.headers === void 0 ? {} : { headers: resolved.auth.headers }
+		};
+	};
+}
+function enterpriseDomainOf(record) {
+	if (record?.kind !== "grant" || typeof record.payload !== "object" || record.payload === null) return void 0;
+	const value = Reflect.get(record.payload, "enterpriseUrl");
+	if (typeof value !== "string" || value.trim().length === 0) return void 0;
+	try {
+		return (value.includes("://") ? new URL(value) : new URL(`https://${value}`)).hostname.toLowerCase();
+	} catch {
+		throw new Error("github-copilot: stored enterpriseUrl is invalid");
+	}
+}
+/** Validate an OAuth-derived endpoint without disclosing its value or credential payload. */
+function trustedGitHubCopilotBaseUrl(value, grant) {
+	return trustedCopilotBaseUrl(value, enterpriseDomainOf({
+		kind: "grant",
+		payload: normalizeGitHubCopilotOAuthCredential(grant)
+	}));
+}
+function trustedCopilotBaseUrl(value, enterpriseDomain) {
+	if (value === void 0) throw new Error("github-copilot: pi-ai resolved no Copilot API base URL");
+	const url = new URL(value);
+	const hostname = url.hostname.toLowerCase();
+	const githubHosted = /^api(?:\.[a-z0-9-]+)+\.githubcopilot\.com$/u.test(hostname);
+	const enterpriseHosted = enterpriseDomain !== void 0 && hostname === `copilot-api.${enterpriseDomain}`;
+	if (!(url.protocol === "https:" && (githubHosted || enterpriseHosted)) || url.username.length > 0 || url.password.length > 0) throw new Error("github-copilot: pi-ai resolved an untrusted Copilot API base URL");
+	return url.origin;
+}
+//#endregion
+//#region lib/types/account-model-auth.js
+/** Native getAuth renews within five minutes; reserve another thirty seconds for metadata preparation. */
+const ACCOUNT_MODEL_AUTH_MIN_VALIDITY_MS = 33e4;
+/** An opaque, process-local account key. Never a substitute for request credentials. */
+function copilotAccountKey(grant) {
+	return createHash("sha256").update(`${grant.refresh.length}:`).update(grant.refresh).update(grant.enterpriseUrl ?? "").digest("hex");
+}
+/** Compare normalized permission snapshots without retaining model credentials. */
+function copilotEntitlementKey(grant) {
+	const ids = grant.availableModelIds;
+	const normalized = ids === void 0 ? "missing" : JSON.stringify([...new Set(ids)].sort());
+	return createHash("sha256").update(normalized).digest("hex");
+}
+function authEntitlementKey(auth) {
+	return copilotEntitlementKey({ ...auth.availableModelIds === void 0 ? {} : { availableModelIds: [...auth.availableModelIds] } });
+}
+function active(signal) {
+	if (signal.aborted) throw new Error("COPILOT_ACCOUNT_AUTH_ABORTED");
+}
+/**
+* Bind model discovery to the existing native OAuth lifecycle. No model catalog,
+* login, environment fallback or separate credential record is introduced here.
+*/
+function createAccountModelAuth(credentials, renewRejectedCredential) {
+	const native = githubCopilotProvider();
+	const oauth = native.auth.oauth;
+	if (oauth === void 0) throw new Error("COPILOT_ACCOUNT_OAUTH_UNAVAILABLE");
+	const readGrant = async (signal) => {
+		active(signal);
+		const stored = await credentials.read(GITHUB_COPILOT_PROVIDER_ID);
+		active(signal);
+		if (stored?.type !== "oauth") throw new Error("COPILOT_ACCOUNT_OAUTH_REQUIRED");
+		return normalizeGitHubCopilotOAuthCredential(stored);
+	};
+	const matches = (grant, key) => {
+		if (copilotAccountKey(grant) !== key) throw new Error("COPILOT_ACCOUNT_CHANGED");
+	};
+	const current = async (auth, signal) => {
+		active(signal);
+		const grant = await readGrant(signal);
+		matches(grant, auth.accountKey);
+		if (grant.access !== auth.apiKey || grant.expires <= Date.now()) throw new Error("COPILOT_ACCOUNT_TOKEN_CHANGED");
+		if (copilotEntitlementKey(grant) !== authEntitlementKey(auth)) throw new Error("COPILOT_ACCOUNT_ENTITLEMENT_CHANGED");
+		const derived = await oauth.toAuth(grant);
+		active(signal);
+		if (derived.apiKey !== auth.apiKey || trustedGitHubCopilotBaseUrl(derived.baseUrl, grant) !== auth.baseURL) throw new Error("COPILOT_ACCOUNT_AUTH_CHANGED");
+		const latest = await readGrant(signal);
+		matches(latest, auth.accountKey);
+		if (latest.access !== auth.apiKey || latest.expires <= Date.now()) throw new Error("COPILOT_ACCOUNT_TOKEN_CHANGED");
+		if (copilotEntitlementKey(latest) !== authEntitlementKey(auth)) throw new Error("COPILOT_ACCOUNT_ENTITLEMENT_CHANGED");
+	};
+	return {
+		async resolveAuth(signal) {
+			try {
+				const before = await readGrant(signal);
+				const key = copilotAccountKey(before);
+				const rejectedAccess = renewRejectedCredential?.(before) === true ? before.access : void 0;
+				const forResolution = (grant) => rejectedAccess !== void 0 && grant.access === rejectedAccess ? {
+					...grant,
+					expires: 0
+				} : grant;
+				const guardedOAuth = {
+					...oauth,
+					login: async () => {
+						throw new Error("COPILOT_ACCOUNT_USE_CANONICAL_SIGN_IN");
+					},
+					async refresh(credential, requestSignal) {
+						active(signal);
+						matches(normalizeGitHubCopilotOAuthCredential(credential), key);
+						const result = normalizeGitHubCopilotOAuthCredential(await oauth.refresh(credential, requestSignal === void 0 ? signal : AbortSignal.any([signal, requestSignal])));
+						active(signal);
+						matches(result, key);
+						return result;
+					},
+					async toAuth(credential) {
+						active(signal);
+						const grant = normalizeGitHubCopilotOAuthCredential(credential);
+						matches(grant, key);
+						const result = await oauth.toAuth(grant);
+						active(signal);
+						return {
+							...result,
+							baseUrl: trustedGitHubCopilotBaseUrl(result.baseUrl, grant)
+						};
+					}
+				};
+				const models = createModels({ credentials: {
+					read: async (provider) => {
+						const value = await credentials.read(provider);
+						active(signal);
+						if (value?.type !== "oauth") throw new Error("COPILOT_ACCOUNT_OAUTH_REQUIRED");
+						const grant = normalizeGitHubCopilotOAuthCredential(value);
+						matches(grant, key);
+						return forResolution(grant);
+					},
+					list: () => credentials.list(),
+					modify: (provider, mutate) => credentials.modify(provider, async (value) => {
+						active(signal);
+						if (value?.type !== "oauth") throw new Error("COPILOT_ACCOUNT_OAUTH_REQUIRED");
+						matches(normalizeGitHubCopilotOAuthCredential(value), key);
+						const next = await mutate(forResolution(normalizeGitHubCopilotOAuthCredential(value)));
+						active(signal);
+						if (next !== void 0) matches(normalizeGitHubCopilotOAuthCredential(next), key);
+						return next;
+					}),
+					delete: async () => {
+						throw new Error("COPILOT_ACCOUNT_DISCOVERY_CANNOT_SIGN_OUT");
+					}
+				} });
+				models.setProvider({
+					...native,
+					auth: { oauth: guardedOAuth }
+				});
+				const resolved = await models.getAuth(GITHUB_COPILOT_PROVIDER_ID, {
+					signal,
+					minOAuthValidityMs: ACCOUNT_MODEL_AUTH_MIN_VALIDITY_MS
+				});
+				active(signal);
+				if (resolved?.auth.apiKey === void 0) throw new Error("COPILOT_ACCOUNT_OAUTH_REQUIRED");
+				const grant = await readGrant(signal);
+				matches(grant, key);
+				if (rejectedAccess !== void 0 && grant.access === rejectedAccess) throw new Error("COPILOT_ACCOUNT_TOKEN_REJECTED");
+				const auth = {
+					apiKey: resolved.auth.apiKey,
+					baseURL: trustedGitHubCopilotBaseUrl(resolved.auth.baseUrl, grant),
+					accountKey: key,
+					...grant.availableModelIds === void 0 ? {} : { availableModelIds: Object.freeze([...grant.availableModelIds]) }
+				};
+				await current(auth, signal);
+				return Object.freeze(auth);
+			} catch {
+				throw new Error(signal.aborted ? "COPILOT_ACCOUNT_AUTH_ABORTED" : "COPILOT_ACCOUNT_AUTH_FAILED");
+			}
+		},
+		async assertAuthCurrent(auth, signal) {
+			try {
+				await current(auth, signal);
+			} catch {
+				throw new Error(signal.aborted ? "COPILOT_ACCOUNT_AUTH_ABORTED" : "COPILOT_ACCOUNT_AUTH_CHANGED");
+			}
+		}
+	};
+}
+//#endregion
+//#region lib/types/copilot-usage-types.js
+const COPILOT_USAGE_MAX_AMOUNT = 0xe8d4a51000;
+const COPILOT_USAGE_MAX_TIMESTAMP = 0xe677d21fdbff;
+//#endregion
+//#region lib/types/copilot-usage-normalize.js
+const amount = z$1.number().finite().min(0).max(COPILOT_USAGE_MAX_AMOUNT);
+const entitlement = z$1.union([
+	amount,
+	z$1.literal(-1),
+	z$1.string().max(32).regex(/^(?:-1|(?:0|[1-9]\d*)(?:\.\d+)?)$/u)
+]).transform(Number).refine((value) => Number.isFinite(value) && value <= 0xe8d4a51000);
+const snapshot = z$1.object({
+	unlimited: z$1.boolean(),
+	entitlement: entitlement.optional(),
+	percent_remaining: z$1.number().finite().min(0).max(100).optional(),
+	quota_remaining: amount.optional(),
+	credits_used: amount.optional(),
+	has_quota: z$1.boolean().optional(),
+	token_based_billing: z$1.boolean().optional(),
+	quota_reset_at: z$1.number().int().min(0).max(Math.floor(COPILOT_USAGE_MAX_TIMESTAMP / 1e3)).optional()
+});
+const response = z$1.object({
+	token_based_billing: z$1.boolean().optional(),
+	access_type_sku: z$1.string().max(128).optional(),
+	quota_reset_date: z$1.string().max(64).optional(),
+	quota_reset_date_utc: z$1.string().max(64).optional(),
+	limited_user_reset_date: z$1.string().max(64).optional(),
+	quota_snapshots: z$1.object({
+		chat: snapshot.optional(),
+		premium_interactions: snapshot.optional()
+	}).optional(),
+	monthly_quotas: z$1.object({ chat: amount }).optional(),
+	limited_user_quotas: z$1.object({ chat: amount }).optional()
+});
+function unavailableCopilotUsage(diagnostic, billing = "unknown", budget = "unknown") {
+	return {
+		state: diagnostic === "COPILOT_USAGE_SIGNED_OUT" ? "signed-out" : "unavailable",
+		billing,
+		budget,
+		diagnostic
+	};
+}
+function resetDate(value) {
+	if (!/^\d{4}-\d{2}-\d{2}(?:T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2}))?$/u.test(value)) return void 0;
+	const date = value.slice(0, 10);
+	const day = Date.parse(`${date}T00:00:00Z`);
+	if (!Number.isFinite(day) || new Date(day).toISOString().slice(0, 10) !== date) return void 0;
+	const parsed = Date.parse(value);
+	return Number.isFinite(parsed) && parsed >= 0 && parsed <= 0xe677d21fdbff ? parsed : void 0;
+}
+/**
+* Pinned VS Code 44825207: parseQuotas/getQuotaUsage and chatStatusDashboard
+* display account amounts directly. Only per-turn nano-AIU uses /1e9; it is
+* intentionally absent here. Pooled credits_used never shares an entitlement.
+*/
+function normalizeCopilotUsage(input, observedAt) {
+	const parsed = response.safeParse(input);
+	if (!parsed.success) return unavailableCopilotUsage("COPILOT_USAGE_INVALID_RESPONSE");
+	const data = parsed.data;
+	if (data.token_based_billing === void 0) return unavailableCopilotUsage("COPILOT_USAGE_BILLING_UNKNOWN");
+	const billing = data.token_based_billing ? "credits" : "requests";
+	const quota = data.access_type_sku === "free_limited_copilot" ? data.quota_snapshots?.chat : data.quota_snapshots?.premium_interactions;
+	const reset = data.quota_reset_date_utc ?? data.quota_reset_date ?? data.limited_user_reset_date;
+	const accountReset = reset === void 0 ? void 0 : resetDate(reset);
+	if (reset !== void 0 && accountReset === void 0) return unavailableCopilotUsage("COPILOT_USAGE_INVALID_RESPONSE", billing);
+	const resetAt = quota?.quota_reset_at === void 0 ? accountReset : quota.quota_reset_at * 1e3;
+	const dates = {
+		observedAt,
+		...resetAt === void 0 ? {} : { resetAt }
+	};
+	if (!quota) {
+		const limit = data.monthly_quotas?.chat, remaining = data.limited_user_quotas?.chat;
+		if (billing === "requests" && limit !== void 0 && limit > 0 && remaining !== void 0 && remaining <= limit) return {
+			state: "ready",
+			billing,
+			budget: "individual",
+			limit,
+			remaining,
+			used: limit - remaining,
+			percentUsed: (limit - remaining) / limit * 100,
+			...dates
+		};
+		return unavailableCopilotUsage("COPILOT_USAGE_SNAPSHOT_MISSING", billing);
+	}
+	if (quota.token_based_billing !== void 0 && quota.token_based_billing !== data.token_based_billing) return unavailableCopilotUsage("COPILOT_USAGE_INVALID_RESPONSE", billing);
+	if (quota.unlimited) {
+		if (quota.has_quota === false) return unavailableCopilotUsage("COPILOT_USAGE_POOLED_EXHAUSTED", billing, "pooled");
+		if (billing !== "credits" || quota.credits_used === void 0) return unavailableCopilotUsage("COPILOT_USAGE_POOLED_UNAVAILABLE", billing, "pooled");
+		return {
+			state: "ready",
+			billing,
+			budget: "pooled",
+			used: quota.credits_used,
+			...dates
+		};
+	}
+	const limit = quota.entitlement, percent = quota.percent_remaining;
+	if (limit === 0) return unavailableCopilotUsage("COPILOT_USAGE_NO_ALLOCATION", billing, "individual");
+	if (limit !== void 0 && limit < 0 || percent === void 0 || limit !== void 0 && quota.quota_remaining !== void 0 && quota.quota_remaining > limit) return unavailableCopilotUsage("COPILOT_USAGE_INVALID_RESPONSE", billing);
+	if (limit !== void 0 && quota.quota_remaining !== void 0 && Math.abs(quota.quota_remaining / limit * 100 - percent) > 1) return unavailableCopilotUsage("COPILOT_USAGE_INVALID_RESPONSE", billing);
+	const remaining = quota.quota_remaining;
+	return {
+		state: "ready",
+		billing,
+		budget: "individual",
+		percentUsed: 100 - percent,
+		...dates,
+		...limit === void 0 ? {} : { limit },
+		...remaining === void 0 ? {} : { remaining },
+		...limit === void 0 || remaining === void 0 ? {} : { used: limit - remaining }
+	};
+}
+//#endregion
+//#region lib/types/copilot-usage-host.js
+var __runInitializers$1 = function(thisArg, initializers, value) {
+	var useValue = arguments.length > 2;
+	for (var i = 0; i < initializers.length; i++) value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+	return useValue ? value : void 0;
+};
+var __esDecorate$1 = function(ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+	function accept(f) {
+		if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected");
+		return f;
+	}
+	var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+	var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+	var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+	var _, done = false;
+	for (var i = decorators.length - 1; i >= 0; i--) {
+		var context = {};
+		for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+		for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+		context.addInitializer = function(f) {
+			if (done) throw new TypeError("Cannot add initializers after decoration has completed");
+			extraInitializers.push(accept(f || null));
+		};
+		var result = (0, decorators[i])(kind === "accessor" ? {
+			get: descriptor.get,
+			set: descriptor.set
+		} : descriptor[key], context);
+		if (kind === "accessor") {
+			if (result === void 0) continue;
+			if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+			if (_ = accept(result.get)) descriptor.get = _;
+			if (_ = accept(result.set)) descriptor.set = _;
+			if (_ = accept(result.init)) initializers.unshift(_);
+		} else if (_ = accept(result)) {
+			if (kind === "field") initializers.unshift(_);
+			else descriptor[key] = _;
+		}
+	}
+	if (target) Object.defineProperty(target, contextIn.name, descriptor);
+	done = true;
+};
+const COPILOT_USAGE_ENDPOINT = "https://api.github.com/copilot_internal/user";
+const TTL_MS = 6e4;
+const REFRESH_INTERVAL_MS = 1e4;
+const FAILURE_COOLDOWN_MS = 3e4;
+const TIMEOUT_MS = 1e4;
+const MAX_BODY_BYTES = 262144;
+var UsageFailure = class extends Error {
+	diagnostic;
+	constructor(diagnostic) {
+		super(diagnostic);
+		this.diagnostic = diagnostic;
+	}
+};
+function failure$2(diagnostic) {
+	throw new UsageFailure(diagnostic);
+}
+async function readBody(response, signal) {
+	const length = response.headers.get("content-length");
+	if (length !== null && (!/^\d+$/u.test(length) || Number(length) > MAX_BODY_BYTES)) {
+		response.body?.cancel().catch(() => void 0);
+		failure$2("COPILOT_USAGE_BODY_TOO_LARGE");
+	}
+	if (!response.body) failure$2("COPILOT_USAGE_INVALID_RESPONSE");
+	const reader = response.body.getReader(), chunks = [];
+	const cancel = () => {
+		reader.cancel().catch(() => void 0);
+	};
+	signal.addEventListener("abort", cancel, { once: true });
+	if (signal.aborted) cancel();
+	let size = 0;
+	try {
+		while (true) {
+			const next = await reader.read();
+			if (next.done) break;
+			size += next.value.byteLength;
+			if (size > MAX_BODY_BYTES) {
+				reader.cancel().catch(() => void 0);
+				failure$2("COPILOT_USAGE_BODY_TOO_LARGE");
+			}
+			chunks.push(next.value);
+		}
+	} finally {
+		signal.removeEventListener("abort", cancel);
+		reader.releaseLock();
+	}
+	const bytes = new Uint8Array(size);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	try {
+		return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+	} catch {
+		failure$2("COPILOT_USAGE_INVALID_RESPONSE");
+	}
+}
+/** One Host-owned, memory-only account cache. No auth renewal, persistence or model transport. */
+var CopilotUsageSource = class {
+	dependencies;
+	fetcher;
+	now;
+	generation = 0;
+	disposed = false;
+	key;
+	cached;
+	last;
+	nextRefreshAt = 0;
+	failureUntil = 0;
+	flight;
+	constructor(dependencies) {
+		this.dependencies = dependencies;
+		this.fetcher = dependencies.fetch ?? globalThis.fetch;
+		this.now = dependencies.now ?? Date.now;
+	}
+	invalidate() {
+		this.generation++;
+		this.flight?.abort.abort();
+		this.flight = void 0;
+		this.key = void 0;
+		this.cached = void 0;
+		this.last = void 0;
+		this.nextRefreshAt = 0;
+		this.failureUntil = 0;
+	}
+	dispose() {
+		this.disposed = true;
+		this.invalidate();
+	}
+	get() {
+		return this.load(false);
+	}
+	refresh() {
+		return this.load(true);
+	}
+	active(generation) {
+		if (this.disposed) failure$2("COPILOT_USAGE_DISPOSED");
+		if (generation !== this.generation) failure$2("COPILOT_USAGE_ACCOUNT_CHANGED");
+	}
+	async readAuth(generation) {
+		this.active(generation);
+		let stored;
+		try {
+			stored = await this.dependencies.readCredential();
+		} catch {
+			this.active(generation);
+			failure$2("COPILOT_USAGE_CREDENTIALS_UNAVAILABLE");
+		}
+		this.active(generation);
+		if (stored === void 0) failure$2("COPILOT_USAGE_SIGNED_OUT");
+		let grant;
+		try {
+			grant = normalizeGitHubCopilotOAuthCredential(stored);
+		} catch {
+			failure$2("COPILOT_USAGE_INVALID_GRANT");
+		}
+		if (grant.enterpriseUrl !== void 0) failure$2("COPILOT_USAGE_ENTERPRISE_UNSUPPORTED");
+		return {
+			grant,
+			key: copilotAccountKey(grant)
+		};
+	}
+	async assertCurrent(key, generation) {
+		if ((await this.readAuth(generation)).key !== key) failure$2("COPILOT_USAGE_ACCOUNT_CHANGED");
+	}
+	diagnostic(error) {
+		return error instanceof UsageFailure ? error.diagnostic : "COPILOT_USAGE_NETWORK";
+	}
+	async load(force) {
+		let generation = this.generation;
+		let auth;
+		try {
+			auth = await this.readAuth(generation);
+			this.active(generation);
+		} catch (error) {
+			if (generation === this.generation) this.invalidate();
+			return unavailableCopilotUsage(this.diagnostic(error));
+		}
+		if (this.key !== void 0 && this.key !== auth.key) {
+			this.invalidate();
+			generation = this.generation;
+		}
+		this.key = auth.key;
+		if (this.flight) {
+			const result = await this.flight.promise;
+			if (this.disposed) return unavailableCopilotUsage("COPILOT_USAGE_DISPOSED");
+			if (generation !== this.generation) return unavailableCopilotUsage("COPILOT_USAGE_ACCOUNT_CHANGED");
+			return { ...result };
+		}
+		const now = this.now();
+		if (this.last && now < this.failureUntil) return { ...this.last };
+		if (this.cached && (!force && now - this.cached.observedAt < TTL_MS || now < this.nextRefreshAt)) return { ...this.cached };
+		const abort = new AbortController();
+		const promise = this.request(auth, generation, abort);
+		this.flight = {
+			generation,
+			promise,
+			abort
+		};
+		try {
+			return { ...await promise };
+		} finally {
+			if (this.flight?.promise === promise) this.flight = void 0;
+		}
+	}
+	async fetchQuota(auth, abort) {
+		const response = await this.fetcher(COPILOT_USAGE_ENDPOINT, {
+			method: "GET",
+			redirect: "error",
+			signal: abort.signal,
+			cache: "no-store",
+			headers: {
+				Authorization: `token ${auth.grant.refresh}`,
+				Accept: "application/json",
+				"X-GitHub-Api-Version": "2025-04-01"
+			}
+		});
+		if (response.redirected || response.status >= 300 && response.status < 400) {
+			response.body?.cancel().catch(() => void 0);
+			failure$2("COPILOT_USAGE_REDIRECT");
+		}
+		if (!response.ok) {
+			response.body?.cancel().catch(() => void 0);
+			if (response.status === 401 || response.status === 403) failure$2("COPILOT_USAGE_AUTH_REJECTED");
+			if (response.status === 429) failure$2("COPILOT_USAGE_RATE_LIMITED");
+			failure$2("COPILOT_USAGE_HTTP_ERROR");
+		}
+		return readBody(response, abort.signal);
 	}
-	var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
-	var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
-	var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
-	var _, done = false;
-	for (var i = decorators.length - 1; i >= 0; i--) {
-		var context = {};
-		for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
-		for (var p in contextIn.access) context.access[p] = contextIn.access[p];
-		context.addInitializer = function(f) {
-			if (done) throw new TypeError("Cannot add initializers after decoration has completed");
-			extraInitializers.push(accept(f || null));
-		};
-		var result = (0, decorators[i])(kind === "accessor" ? {
-			get: descriptor.get,
-			set: descriptor.set
-		} : descriptor[key], context);
-		if (kind === "accessor") {
-			if (result === void 0) continue;
-			if (result === null || typeof result !== "object") throw new TypeError("Object expected");
-			if (_ = accept(result.get)) descriptor.get = _;
-			if (_ = accept(result.set)) descriptor.set = _;
-			if (_ = accept(result.init)) initializers.unshift(_);
-		} else if (_ = accept(result)) {
-			if (kind === "field") initializers.unshift(_);
-			else descriptor[key] = _;
+	async request(auth, generation, abort) {
+		let timer;
+		let removeAbort;
+		let value;
+		let error;
+		try {
+			await this.assertCurrent(auth.key, generation);
+			this.active(generation);
+			this.nextRefreshAt = this.now() + REFRESH_INTERVAL_MS;
+			const cancellation = new Promise((_resolve, reject) => {
+				const cancel = () => reject(new UsageFailure(this.disposed ? "COPILOT_USAGE_DISPOSED" : "COPILOT_USAGE_ACCOUNT_CHANGED"));
+				abort.signal.addEventListener("abort", cancel, { once: true });
+				removeAbort = () => abort.signal.removeEventListener("abort", cancel);
+				timer = setTimeout(() => {
+					reject(new UsageFailure("COPILOT_USAGE_TIMEOUT"));
+					abort.abort();
+				}, TIMEOUT_MS);
+			});
+			value = normalizeCopilotUsage(await Promise.race([this.fetchQuota(auth, abort), cancellation]), this.now());
+		} catch (caught) {
+			error = caught;
+		} finally {
+			if (timer !== void 0) clearTimeout(timer);
+			removeAbort?.();
+		}
+		try {
+			await this.assertCurrent(auth.key, generation);
+			this.active(generation);
+		} catch (caught) {
+			if (generation === this.generation) this.invalidate();
+			return unavailableCopilotUsage(this.diagnostic(caught));
 		}
+		if (error !== void 0) {
+			const diagnostic = this.diagnostic(error);
+			if (diagnostic === "COPILOT_USAGE_ACCOUNT_CHANGED" || diagnostic === "COPILOT_USAGE_SIGNED_OUT" || diagnostic === "COPILOT_USAGE_INVALID_GRANT" || diagnostic === "COPILOT_USAGE_ENTERPRISE_UNSUPPORTED" || diagnostic === "COPILOT_USAGE_CREDENTIALS_UNAVAILABLE") {
+				this.invalidate();
+				return unavailableCopilotUsage(diagnostic);
+			}
+			const staleAllowed = [
+				"COPILOT_USAGE_NETWORK",
+				"COPILOT_USAGE_TIMEOUT",
+				"COPILOT_USAGE_HTTP_ERROR",
+				"COPILOT_USAGE_RATE_LIMITED"
+			].includes(diagnostic);
+			if (!staleAllowed) this.cached = void 0;
+			value = staleAllowed && this.cached ? {
+				...this.cached,
+				state: "stale",
+				diagnostic
+			} : unavailableCopilotUsage(diagnostic);
+		}
+		if (value === void 0) return unavailableCopilotUsage("COPILOT_USAGE_INVALID_RESPONSE");
+		this.last = value;
+		if (value.state === "ready") {
+			this.cached = value;
+			this.failureUntil = 0;
+		} else {
+			if (value.state !== "stale") this.cached = void 0;
+			this.failureUntil = this.now() + FAILURE_COOLDOWN_MS;
+		}
+		return value;
 	}
-	if (target) Object.defineProperty(target, contextIn.name, descriptor);
-	done = true;
 };
-let SearchRoutingController = (() => {
+let GitHubCopilotUsageController = (() => {
 	let _classSuper = TypertRemoteService;
 	let _instanceExtraInitializers = [];
-	let _providers_decorators;
-	return class SearchRoutingController extends _classSuper {
+	let _get_decorators;
+	let _refresh_decorators;
+	return class GitHubCopilotUsageController extends _classSuper {
 		static {
 			const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
-			_providers_decorators = [Remote];
-			__esDecorate$1(this, null, _providers_decorators, {
+			_get_decorators = [Remote];
+			_refresh_decorators = [Remote];
+			__esDecorate$1(this, null, _get_decorators, {
 				kind: "method",
-				name: "providers",
+				name: "get",
 				static: false,
 				private: false,
 				access: {
-					has: (obj) => "providers" in obj,
-					get: (obj) => obj.providers
+					has: (obj) => "get" in obj,
+					get: (obj) => obj.get
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate$1(this, null, _refresh_decorators, {
+				kind: "method",
+				name: "refresh",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "refresh" in obj,
+					get: (obj) => obj.refresh
 				},
 				metadata: _metadata
 			}, null, _instanceExtraInitializers);
@@ -933,36 +1708,31 @@ let SearchRoutingController = (() => {
 				value: _metadata
 			});
 		}
+		source = __runInitializers$1(this, _instanceExtraInitializers);
 		constructor(ctx) {
-			super(ctx, "githubCopilotSearchRouting");
-			__runInitializers$1(this, _instanceExtraInitializers);
+			super(ctx, "githubCopilotUsage");
+			const credentials = createGitHubCopilotCredentialStore(ctx);
+			this.source = new CopilotUsageSource({ readCredential: () => credentials.read(GITHUB_COPILOT_PROVIDER_ID) });
+			ctx.on("credentials/record-updated", (key) => {
+				if (key === "llm-pi-ai/github-copilot") this.source.invalidate();
+			});
+			ctx.on("settings/updated", (namespace) => {
+				if (namespace === "github-copilot" || namespace === "llm-pi-ai") this.source.invalidate();
+			});
+			ctx.effect(() => () => this.source.dispose());
 		}
-		providers() {
-			const unavailable = {
-				supported: false,
-				providers: []
-			};
-			const catalog = this.ctx.get("githubCopilotSearchCatalog");
-			if (typeof catalog?.list !== "function") return unavailable;
-			try {
-				const ids = catalog.list();
-				const parsed = SearchProviderCatalogSchema.safeParse({
-					supported: true,
-					providers: ids.map((id) => ({ id }))
-				});
-				if (!parsed.success || new Set(ids).size !== ids.length) return unavailable;
-				parsed.data.providers.sort((a, b) => a.id.localeCompare(b.id));
-				return parsed.data;
-			} catch {
-				return unavailable;
-			}
+		async get() {
+			return this.source.get();
+		}
+		async refresh() {
+			return this.source.refresh();
 		}
 	};
 })();
 //#endregion
 //#region package.json
 var name$1 = "dsh-github-copilot";
-var version = "0.4.0-alpha.30";
+var version = "0.4.0-alpha.32";
 //#endregion
 //#region lib/types/probe.js
 /**
@@ -3127,36 +3897,6 @@ function assertDshCompatibility(ctx) {
 	if (typeof ctx["plugin"] !== "function") incompatible("context.plugin");
 }
 //#endregion
-//#region lib/types/copilot-grant.js
-function nonEmptyOAuthString(value, field) {
-	if (typeof value !== "string" || value.trim().length === 0) throw new Error(`github-copilot: OAuth credential field "${field}" must be a non-empty string`);
-	return value;
-}
-/**
-* Rebuild pi-ai's GitHub Copilot grant as the exact JSON-safe provider shape.
-* Prototype and unrelated extension members are intentionally not preserved.
-*/
-function normalizeGitHubCopilotOAuthCredential(credential) {
-	if (typeof credential !== "object" || credential === null) throw new Error("github-copilot: OAuth credential must be an object");
-	if (Reflect.get(credential, "type") !== "oauth") throw new Error("github-copilot: OAuth credential type must be \"oauth\"");
-	const refresh = nonEmptyOAuthString(Reflect.get(credential, "refresh"), "refresh");
-	const access = nonEmptyOAuthString(Reflect.get(credential, "access"), "access");
-	const expires = Reflect.get(credential, "expires");
-	if (typeof expires !== "number" || !Number.isFinite(expires)) throw new Error("github-copilot: OAuth credential field \"expires\" must be a finite number");
-	const enterpriseUrl = Reflect.get(credential, "enterpriseUrl");
-	if (enterpriseUrl !== void 0 && (typeof enterpriseUrl !== "string" || enterpriseUrl.trim().length === 0)) throw new Error("github-copilot: OAuth credential field \"enterpriseUrl\" must be a non-empty string");
-	const availableModelIds = Reflect.get(credential, "availableModelIds");
-	if (availableModelIds !== void 0 && (!Array.isArray(availableModelIds) || !availableModelIds.every((modelId) => typeof modelId === "string" && modelId.trim().length > 0))) throw new Error("github-copilot: OAuth credential field \"availableModelIds\" must be an array of non-empty strings");
-	return {
-		type: "oauth",
-		refresh,
-		access,
-		expires,
-		...enterpriseUrl === void 0 ? {} : { enterpriseUrl },
-		...availableModelIds === void 0 ? {} : { availableModelIds: [...new Set(availableModelIds)] }
-	};
-}
-//#endregion
 //#region lib/types/temporary-models.js
 const GPT_6_ASTRA = {
 	id: "gpt-6-astra",
@@ -4061,189 +4801,60 @@ let GitHubCopilotAuthorizationController = (() => {
 					},
 					prompt: (prompt) => {
 						if (prompt.kind === "text" && /GitHub Enterprise URL\/domain/i.test(prompt.message)) return Promise.resolve("");
-						return Promise.reject(/* @__PURE__ */ new Error(`github-copilot: this browser bridge cannot answer authorization prompt "${prompt.message}"`));
-					}
-				}
-			}).then(async (outcome) => {
-				if (outcome.status === "authorized") {
-					this.notices = [];
-					await this.ensureProviderProfile();
-					return;
-				}
-				this.notices = [];
-			}).catch((error) => {
-				this.notices = [];
-				this.failure = messageOf(error);
-				this.ctx.logger.error("github-copilot: GitHub Copilot authorization failed");
-				this.ctx.logger.error(error);
-			}).finally(() => {
-				this.attempt = void 0;
-			});
-			this.attempt = running;
-			return this.status();
-		}
-		async cancel() {
-			const authorization = service(this.ctx, "authorization", [
-				"describe",
-				"begin",
-				"cancel"
-			]);
-			this.notices = [];
-			authorization.cancel(GITHUB_COPILOT_CREDENTIAL_KEY);
-			return this.status();
-		}
-		async signOut() {
-			if (service(this.ctx, "authorization", [
-				"describe",
-				"begin",
-				"cancel"
-			]).describe("llm-pi-ai/github-copilot")?.inFlight === true) throw new Error("github-copilot: cancel the active sign-in attempt before signing out");
-			await service(this.ctx, "credentials", ["describeRecord", "deleteRecord"]).deleteRecord(GITHUB_COPILOT_CREDENTIAL_KEY);
-			this.notices = [];
-			this.failure = void 0;
-			this.reconciliationFailed = false;
-			return this.status();
-		}
-		async ensureProviderProfile() {
-			try {
-				await ensureGitHubCopilotProviderProfile(this.ctx);
-				this.reconciliationFailed = false;
-			} catch {
-				this.reconciliationFailed = true;
-				this.ctx.logger.warn("github-copilot: route reconciliation failed; review route status before retrying");
-			}
-		}
-	};
-})();
-//#endregion
-//#region lib/types/copilot-auth.js
-/**
-* Provider-side GitHub Copilot auth resolution over the same credential record
-* that DSH's built-in llm-pi-ai adapter owns.
-*/
-function credentialService(ctx) {
-	const candidate = ctx.get("credentials");
-	if (typeof candidate !== "object" || candidate === null) throw new Error("github-copilot: DSH credentials service is unavailable");
-	for (const method of [
-		"readRecord",
-		"listRecords",
-		"modifyRecord",
-		"deleteRecord"
-	]) if (typeof Reflect.get(candidate, method) !== "function") throw new Error(`github-copilot: required DSH credentials API "credentials.${method}" is unavailable`);
-	return candidate;
-}
-function toCredential(record) {
-	if (record === void 0) return void 0;
-	if (record.kind === "api-key") return {
-		type: "api_key",
-		...record.key === void 0 ? {} : { key: record.key },
-		...record.env === void 0 ? {} : { env: { ...record.env } }
-	};
-	if (typeof record.payload !== "object" || record.payload === null) throw new Error("github-copilot: stored llm-pi-ai GitHub Copilot grant is not an object");
-	return normalizeGitHubCopilotOAuthCredential(record.payload);
-}
-function toRecord(credential) {
-	if (credential.type === "api_key") return {
-		kind: "api-key",
-		...credential.key === void 0 ? {} : { key: credential.key },
-		...credential.env === void 0 ? {} : { env: { ...credential.env } }
-	};
-	return {
-		kind: "grant",
-		payload: normalizeGitHubCopilotOAuthCredential(credential)
-	};
-}
-/** Bind exactly one logical route to the canonical Host-owned credential record. */
-function createGitHubCopilotCredentialStore(ctx, logicalProviderId = GITHUB_COPILOT_PROVIDER_ID) {
-	const assertProvider = (providerId) => {
-		if (providerId !== logicalProviderId) throw new Error("COPILOT_CREDENTIAL_PROVIDER_MISMATCH");
-	};
-	return {
-		read: async (providerId) => {
-			assertProvider(providerId);
-			return toCredential(await credentialService(ctx).readRecord(GITHUB_COPILOT_CREDENTIAL_KEY));
-		},
-		list: async () => {
-			const record = await credentialService(ctx).readRecord(GITHUB_COPILOT_CREDENTIAL_KEY);
-			return record === void 0 ? [] : [{
-				providerId: logicalProviderId,
-				type: record.kind === "api-key" ? "api_key" : "oauth"
-			}];
-		},
-		modify: async (providerId, mutate) => {
-			assertProvider(providerId);
-			return toCredential(await credentialService(ctx).modifyRecord(GITHUB_COPILOT_CREDENTIAL_KEY, async (current) => {
-				const next = await mutate(toCredential(current));
-				return next === void 0 ? void 0 : toRecord(next);
-			}));
-		},
-		delete: async (providerId) => {
-			assertProvider(providerId);
-			await credentialService(ctx).deleteRecord(GITHUB_COPILOT_CREDENTIAL_KEY);
+						return Promise.reject(/* @__PURE__ */ new Error(`github-copilot: this browser bridge cannot answer authorization prompt "${prompt.message}"`));
+					}
+				}
+			}).then(async (outcome) => {
+				if (outcome.status === "authorized") {
+					this.notices = [];
+					await this.ensureProviderProfile();
+					return;
+				}
+				this.notices = [];
+			}).catch((error) => {
+				this.notices = [];
+				this.failure = messageOf(error);
+				this.ctx.logger.error("github-copilot: GitHub Copilot authorization failed");
+				this.ctx.logger.error(error);
+			}).finally(() => {
+				this.attempt = void 0;
+			});
+			this.attempt = running;
+			return this.status();
 		}
-	};
-}
-/**
-* Build one resolver whose pi-ai collection refreshes OAuth credentials inside
-* the DSH record's serialized modify operation before exposing request auth.
-*/
-function createGitHubCopilotTokenResolver(ctx, onCredentialChanged) {
-	const models = createModels({ credentials: createGitHubCopilotCredentialStore(ctx) });
-	const provider = githubCopilotProvider();
-	if (provider.auth.oauth === void 0) throw new Error("github-copilot: native OAuth method is unavailable");
-	models.setProvider({
-		...provider,
-		auth: { oauth: provider.auth.oauth }
-	});
-	return async (modelId) => {
-		const snapshot = readCopilotCatalog(ctx);
-		const native = new Map(snapshot.models.map((model) => [model.id, model])).get(modelId);
-		if (native === void 0) throw new Error(`github-copilot: pi-ai catalog has no GitHub Copilot model "${modelId}"`);
-		const resolved = await models.getAuth("github-copilot");
-		if (resolved === void 0) return void 0;
-		if (onCredentialChanged !== void 0) try {
-			await onCredentialChanged();
-		} catch (error) {
-			ctx.logger.warn("github-copilot: provider route reconciliation will retry after a later auth resolution");
-			ctx.logger.warn(error);
+		async cancel() {
+			const authorization = service(this.ctx, "authorization", [
+				"describe",
+				"begin",
+				"cancel"
+			]);
+			this.notices = [];
+			authorization.cancel(GITHUB_COPILOT_CREDENTIAL_KEY);
+			return this.status();
+		}
+		async signOut() {
+			if (service(this.ctx, "authorization", [
+				"describe",
+				"begin",
+				"cancel"
+			]).describe("llm-pi-ai/github-copilot")?.inFlight === true) throw new Error("github-copilot: cancel the active sign-in attempt before signing out");
+			await service(this.ctx, "credentials", ["describeRecord", "deleteRecord"]).deleteRecord(GITHUB_COPILOT_CREDENTIAL_KEY);
+			this.notices = [];
+			this.failure = void 0;
+			this.reconciliationFailed = false;
+			return this.status();
+		}
+		async ensureProviderProfile() {
+			try {
+				await ensureGitHubCopilotProviderProfile(this.ctx);
+				this.reconciliationFailed = false;
+			} catch {
+				this.reconciliationFailed = true;
+				this.ctx.logger.warn("github-copilot: route reconciliation failed; review route status before retrying");
+			}
 		}
-		const stored = await credentialService(ctx).readRecord(GITHUB_COPILOT_CREDENTIAL_KEY);
-		if (!(stored?.kind === "grant" && (normalizeGitHubCopilotOAuthCredential(stored.payload).availableModelIds ?? []).includes(modelId))) throw new Error(`github-copilot: model "${modelId}" is not available for the signed-in Copilot account`);
-		const apiKey = resolved.auth.apiKey;
-		if (apiKey === void 0) return void 0;
-		return {
-			apiKey,
-			baseURL: trustedCopilotBaseUrl(resolved.auth.baseUrl ?? native.baseUrl, enterpriseDomainOf(stored)),
-			...resolved.auth.headers === void 0 ? {} : { headers: resolved.auth.headers }
-		};
 	};
-}
-function enterpriseDomainOf(record) {
-	if (record?.kind !== "grant" || typeof record.payload !== "object" || record.payload === null) return void 0;
-	const value = Reflect.get(record.payload, "enterpriseUrl");
-	if (typeof value !== "string" || value.trim().length === 0) return void 0;
-	try {
-		return (value.includes("://") ? new URL(value) : new URL(`https://${value}`)).hostname.toLowerCase();
-	} catch {
-		throw new Error("github-copilot: stored enterpriseUrl is invalid");
-	}
-}
-/** Validate an OAuth-derived endpoint without disclosing its value or credential payload. */
-function trustedGitHubCopilotBaseUrl(value, grant) {
-	return trustedCopilotBaseUrl(value, enterpriseDomainOf({
-		kind: "grant",
-		payload: normalizeGitHubCopilotOAuthCredential(grant)
-	}));
-}
-function trustedCopilotBaseUrl(value, enterpriseDomain) {
-	if (value === void 0) throw new Error("github-copilot: pi-ai resolved no Copilot API base URL");
-	const url = new URL(value);
-	const hostname = url.hostname.toLowerCase();
-	const githubHosted = /^api(?:\.[a-z0-9-]+)+\.githubcopilot\.com$/u.test(hostname);
-	const enterpriseHosted = enterpriseDomain !== void 0 && hostname === `copilot-api.${enterpriseDomain}`;
-	if (!(url.protocol === "https:" && (githubHosted || enterpriseHosted)) || url.username.length > 0 || url.password.length > 0) throw new Error("github-copilot: pi-ai resolved an untrusted Copilot API base URL");
-	return url.origin;
-}
+})();
 //#endregion
 //#region lib/types/tool-schema-compat.js
 const ESCALATION_FIELDS = /* @__PURE__ */ new Set(["sandbox_permissions", "justification"]);
@@ -4603,15 +5214,24 @@ function createAccountProvider(descriptors, guard, baseURL) {
 			}));
 			headers.authorization = `Bearer ${options.apiKey}`;
 			headers["x-api-key"] = null;
+			let unauthorized = false;
+			const fetch = options.fetch ?? globalThis.fetch;
+			const observeResponse = async (input, init) => {
+				const response = await fetch(input, init);
+				if (response.status === 401) unauthorized = true;
+				return response;
+			};
 			const wireOptions = model.api === "anthropic-messages" ? {
 				...options,
 				signal: lease.signal,
 				apiKey: void 0,
-				headers
+				headers,
+				fetch: observeResponse
 			} : {
 				...options,
 				signal: lease.signal,
-				headers
+				headers,
+				fetch: observeResponse
 			};
 			if (!hasApi(model, "openai-responses") && !hasApi(model, "openai-completions") && !hasApi(model, "anthropic-messages")) {
 				lease.release();
@@ -4622,6 +5242,9 @@ function createAccountProvider(descriptors, guard, baseURL) {
 					yield* native.streamSimple(model, context, wireOptions);
 				} finally {
 					lease.release();
+					if (unauthorized && !guard.signal.aborted && !options.signal?.aborted) try {
+						guard.onUnauthorized?.();
+					} catch {}
 				}
 			})();
 		})
@@ -4632,142 +5255,6 @@ function createAccountProvider(descriptors, guard, baseURL) {
 	};
 }
 //#endregion
-//#region lib/types/account-model-auth.js
-/** Native getAuth renews within five minutes; reserve another thirty seconds for metadata preparation. */
-const ACCOUNT_MODEL_AUTH_MIN_VALIDITY_MS = 33e4;
-/** An opaque, process-local account key. Never a substitute for request credentials. */
-function copilotAccountKey(grant) {
-	return createHash("sha256").update(`${grant.refresh.length}:`).update(grant.refresh).update(grant.enterpriseUrl ?? "").digest("hex");
-}
-/** Compare normalized permission snapshots without retaining model credentials. */
-function copilotEntitlementKey(grant) {
-	const ids = grant.availableModelIds;
-	const normalized = ids === void 0 ? "missing" : JSON.stringify([...new Set(ids)].sort());
-	return createHash("sha256").update(normalized).digest("hex");
-}
-function authEntitlementKey(auth) {
-	return copilotEntitlementKey({ ...auth.availableModelIds === void 0 ? {} : { availableModelIds: [...auth.availableModelIds] } });
-}
-function active(signal) {
-	if (signal.aborted) throw new Error("COPILOT_ACCOUNT_AUTH_ABORTED");
-}
-/**
-* Bind model discovery to the existing native OAuth lifecycle. No model catalog,
-* login, environment fallback or separate credential record is introduced here.
-*/
-function createAccountModelAuth(credentials) {
-	const native = githubCopilotProvider();
-	const oauth = native.auth.oauth;
-	if (oauth === void 0) throw new Error("COPILOT_ACCOUNT_OAUTH_UNAVAILABLE");
-	const readGrant = async (signal) => {
-		active(signal);
-		const stored = await credentials.read(GITHUB_COPILOT_PROVIDER_ID);
-		active(signal);
-		if (stored?.type !== "oauth") throw new Error("COPILOT_ACCOUNT_OAUTH_REQUIRED");
-		return normalizeGitHubCopilotOAuthCredential(stored);
-	};
-	const matches = (grant, key) => {
-		if (copilotAccountKey(grant) !== key) throw new Error("COPILOT_ACCOUNT_CHANGED");
-	};
-	const current = async (auth, signal) => {
-		active(signal);
-		const grant = await readGrant(signal);
-		matches(grant, auth.accountKey);
-		if (grant.access !== auth.apiKey || grant.expires <= Date.now()) throw new Error("COPILOT_ACCOUNT_TOKEN_CHANGED");
-		if (copilotEntitlementKey(grant) !== authEntitlementKey(auth)) throw new Error("COPILOT_ACCOUNT_ENTITLEMENT_CHANGED");
-		const derived = await oauth.toAuth(grant);
-		active(signal);
-		if (derived.apiKey !== auth.apiKey || trustedGitHubCopilotBaseUrl(derived.baseUrl, grant) !== auth.baseURL) throw new Error("COPILOT_ACCOUNT_AUTH_CHANGED");
-		const latest = await readGrant(signal);
-		matches(latest, auth.accountKey);
-		if (latest.access !== auth.apiKey || latest.expires <= Date.now()) throw new Error("COPILOT_ACCOUNT_TOKEN_CHANGED");
-		if (copilotEntitlementKey(latest) !== authEntitlementKey(auth)) throw new Error("COPILOT_ACCOUNT_ENTITLEMENT_CHANGED");
-	};
-	return {
-		async resolveAuth(signal) {
-			try {
-				const key = copilotAccountKey(await readGrant(signal));
-				const guardedOAuth = {
-					...oauth,
-					login: async () => {
-						throw new Error("COPILOT_ACCOUNT_USE_CANONICAL_SIGN_IN");
-					},
-					async refresh(credential, requestSignal) {
-						active(signal);
-						matches(normalizeGitHubCopilotOAuthCredential(credential), key);
-						const result = normalizeGitHubCopilotOAuthCredential(await oauth.refresh(credential, requestSignal === void 0 ? signal : AbortSignal.any([signal, requestSignal])));
-						active(signal);
-						matches(result, key);
-						return result;
-					},
-					async toAuth(credential) {
-						active(signal);
-						const grant = normalizeGitHubCopilotOAuthCredential(credential);
-						matches(grant, key);
-						const result = await oauth.toAuth(grant);
-						active(signal);
-						return {
-							...result,
-							baseUrl: trustedGitHubCopilotBaseUrl(result.baseUrl, grant)
-						};
-					}
-				};
-				const models = createModels({ credentials: {
-					read: async (provider) => {
-						const value = await credentials.read(provider);
-						active(signal);
-						if (value?.type !== "oauth") throw new Error("COPILOT_ACCOUNT_OAUTH_REQUIRED");
-						matches(normalizeGitHubCopilotOAuthCredential(value), key);
-						return value;
-					},
-					list: () => credentials.list(),
-					modify: (provider, mutate) => credentials.modify(provider, async (value) => {
-						active(signal);
-						if (value?.type !== "oauth") throw new Error("COPILOT_ACCOUNT_OAUTH_REQUIRED");
-						matches(normalizeGitHubCopilotOAuthCredential(value), key);
-						const next = await mutate(value);
-						active(signal);
-						if (next !== void 0) matches(normalizeGitHubCopilotOAuthCredential(next), key);
-						return next;
-					}),
-					delete: async () => {
-						throw new Error("COPILOT_ACCOUNT_DISCOVERY_CANNOT_SIGN_OUT");
-					}
-				} });
-				models.setProvider({
-					...native,
-					auth: { oauth: guardedOAuth }
-				});
-				const resolved = await models.getAuth(GITHUB_COPILOT_PROVIDER_ID, {
-					signal,
-					minOAuthValidityMs: ACCOUNT_MODEL_AUTH_MIN_VALIDITY_MS
-				});
-				active(signal);
-				if (resolved?.auth.apiKey === void 0) throw new Error("COPILOT_ACCOUNT_OAUTH_REQUIRED");
-				const grant = await readGrant(signal);
-				matches(grant, key);
-				const auth = {
-					apiKey: resolved.auth.apiKey,
-					baseURL: trustedGitHubCopilotBaseUrl(resolved.auth.baseUrl, grant),
-					accountKey: key,
-					...grant.availableModelIds === void 0 ? {} : { availableModelIds: Object.freeze([...grant.availableModelIds]) }
-				};
-				await current(auth, signal);
-				return Object.freeze(auth);
-			} catch {
-				throw new Error(signal.aborted ? "COPILOT_ACCOUNT_AUTH_ABORTED" : "COPILOT_ACCOUNT_AUTH_FAILED");
-			}
-		},
-		async assertAuthCurrent(auth, signal) {
-			try {
-				await current(auth, signal);
-			} catch {
-				throw new Error(signal.aborted ? "COPILOT_ACCOUNT_AUTH_ABORTED" : "COPILOT_ACCOUNT_AUTH_CHANGED");
-			}
-		}
-	};
-}
-//#endregion
 //#region lib/types/account-model-catalog.js
 /** Pure normalization of account /models metadata; no transport, credentials, or model-name rules. */
 const ACCOUNT_MODEL_CATALOG_LIMITS = Object.freeze({
@@ -5890,7 +6377,21 @@ function apply$1(ctx, config = {}) {
 	const budgetSettings = requestBudgetSettings ?? (() => requestBudget ?? {});
 	resolveRequestBudgetPolicy(budgetSettings());
 	const store = createGitHubCopilotCredentialStore(ctx, GITHUB_COPILOT_PREVIEW_PROVIDER_ID);
-	const nativeAuth = createAccountModelAuth(createGitHubCopilotCredentialStore(ctx));
+	let rejectedAuth;
+	let authRecovery;
+	const nativeAuth = createAccountModelAuth(createGitHubCopilotCredentialStore(ctx), (grant) => {
+		const accountKey = copilotAccountKey(grant);
+		if (rejectedAuth?.accountKey !== accountKey || rejectedAuth.tokenFingerprint !== tokenFingerprint(grant.access)) return false;
+		const now = Date.now();
+		const cooldown = Math.max(1e3, cacheSettings().accountModelFailureCooldownMs ?? 3e5);
+		const age = authRecovery === void 0 ? void 0 : now - authRecovery.at;
+		if (!Number.isFinite(now) || authRecovery?.accountKey === accountKey && (age === void 0 || !Number.isFinite(age) || age < cooldown)) throw failure("COPILOT_PREVIEW_AUTH_RECOVERY_COOLDOWN");
+		authRecovery = {
+			accountKey,
+			at: now
+		};
+		return true;
+	});
 	const nativeModels = getBuiltinModels("github-copilot");
 	const nativeApis = new Map(nativeModels.map((model) => [model.id, model.api]));
 	let lastValidatedProof;
@@ -6086,7 +6587,15 @@ function apply$1(ctx, config = {}) {
 	const optionsFor = (lease, inspectRequest) => {
 		const guard = {
 			...lifetime.guard(lease),
-			...inspectRequest === void 0 ? {} : { inspectRequest }
+			...inspectRequest === void 0 ? {} : { inspectRequest },
+			onUnauthorized() {
+				if (lease === void 0 || !lifetime.isCurrent(lease.revision) || source.readDisplaySnapshot() !== lease.snapshot || provenSnapshot !== lease.snapshot || snapshotProof !== lease.proof) return;
+				rejectedAuth = lease.proof;
+				lifetime.change();
+				provenSnapshot = void 0;
+				snapshotProof = void 0;
+				lastValidatedProof = void 0;
+			}
 		};
 		const { provider } = createAccountProvider(lease?.snapshot.models ?? [], guard, lease?.proof.baseURL ?? "https://api.individual.githubcopilot.com");
 		const profile = Object.freeze({
@@ -6303,6 +6812,7 @@ function activate(ctx, config) {
 	ctx.plugin(GitHubCopilotAuthorizationController);
 	ctx.plugin(GitHubCopilotDualModel);
 	ctx.plugin(SearchRoutingController);
+	ctx.plugin(GitHubCopilotUsageController);
 	const resolveGitHubCopilotToken = createGitHubCopilotTokenResolver(ctx, async () => {
 		await ensureGitHubCopilotProviderProfile(ctx);
 	});