dsh-github-copilot 0.4.0-alpha.31 → 0.4.0-alpha.32

package/lib/index.js

@@ -1,29 +1,29 @@
-import { C as currentSearchInitiator, D as GITHUB_COPILOT_CREDENTIAL_KEY, E as readCopilotCatalog, O as GITHUB_COPILOT_PREVIEW_PROVIDER_ID, S as currentChatRoute, T as isPluginPreviewProvider, _ as RESPONSES_WEB_SEARCH_TOOL_TYPE, a as COPILOT_HOSTED_SEARCH_PROVIDER_ID, b as candidatesForRoute, c as abortable$1, d as readBounded, f as applyRequestAuth, h as ANTHROPIC_WEB_SEARCH_TOOL_TYPE, i as describeSearchBackend, k as GITHUB_COPILOT_PROVIDER_ID, l as isAbortError, m as providerRequestHeaders, n as routeSessionSearch, o as GITHUB_COPILOT_HOSTED_SEARCH_PROVIDER_ID, p as normalizeRequestAuth, r as DescribedSearchFallbackError, s as createTraditionalSearchProvider, t as isCopilotSearchSelection, u as providerErrorMessage, v as SearchPlan, w as currentSearchSelection, x as sameCandidates, y as WEB_SEARCH_TOOL_TYPE } from "./search-routing-pFLux0W7.js";
+import { C as currentSearchInitiator, D as GITHUB_COPILOT_CREDENTIAL_KEY, E as readCopilotCatalog, O as GITHUB_COPILOT_PREVIEW_PROVIDER_ID, S as currentChatRoute, T as isPluginPreviewProvider, _ as RESPONSES_WEB_SEARCH_TOOL_TYPE, a as COPILOT_HOSTED_SEARCH_PROVIDER_ID, b as candidatesForRoute, c as abortable$1, d as readBounded, f as applyRequestAuth, h as ANTHROPIC_WEB_SEARCH_TOOL_TYPE, i as describeSearchBackend, k as GITHUB_COPILOT_PROVIDER_ID, l as isAbortError, m as providerRequestHeaders, n as routeSessionSearch, o as GITHUB_COPILOT_HOSTED_SEARCH_PROVIDER_ID, p as normalizeRequestAuth, r as DescribedSearchFallbackError, s as createTraditionalSearchProvider, t as isCopilotSearchSelection, u as providerErrorMessage, v as SearchPlan, w as currentSearchSelection, x as sameCandidates, y as WEB_SEARCH_TOOL_TYPE } from "./search-routing-DqLKem1c.js";
 import AuthorizationService from "@deepseek-ai/dsh-authorization";
 import { createHash, randomUUID } from "node:crypto";
 import * as dshScope from "@deepseek-ai/dsh-scope";
 import { Remote, RemoteError, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import z from "@deepseek-ai/schemastery";
 import { z as z$1 } from "zod";
+import { createModels, getSupportedThinkingLevels, hasApi, lazyStream } from "@earendil-works/pi-ai";
+import { githubCopilotProvider } from "@earendil-works/pi-ai/providers/github-copilot";
+import { getBuiltinModels } from "@earendil-works/pi-ai/providers/all";
 import * as dshLlm from "@deepseek-ai/dsh-llm";
 import { CONTEXT_WINDOW_EXCEEDED_CODE, LlmError, ReasoningEffortId, attributionHeaders, callConfigEquals, contentHasImage, isAgentLoopRequest, resolveImageAttachmentAccess, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { WebError } from "@deepseek-ai/dsh-web";
 import * as dshSettings from "@deepseek-ai/dsh-settings";
-import { getBuiltinModels } from "@earendil-works/pi-ai/providers/all";
-import { createModels, getSupportedThinkingLevels, hasApi, lazyStream } from "@earendil-works/pi-ai";
 import { credentialRef } from "@deepseek-ai/dsh-credentials";
-import { githubCopilotProvider } from "@earendil-works/pi-ai/providers/github-copilot";
 import { Config as Config$1, PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 import { estimateContextTokens, estimateMessageTokens } from "@earendil-works/pi-ai/utils/estimate";
 import { buildCopilotDynamicHeaders, hasCopilotVisionInput } from "@earendil-works/pi-ai/api/github-copilot-headers";
 //#region lib/types/dual-model-host.js
 /** Optional plugin-owned planner/executor sessions; no Core/default-model mutation. */
-var __runInitializers$2 = function(thisArg, initializers, value) {
+var __runInitializers$3 = function(thisArg, initializers, value) {
 	var useValue = arguments.length > 2;
 	for (var i = 0; i < initializers.length; i++) value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
 	return useValue ? value : void 0;
 };
-var __esDecorate$2 = function(ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+var __esDecorate$3 = function(ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
 	function accept(f) {
 		if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected");
 		return f;
@@ -305,7 +305,7 @@ let GitHubCopilotDualModel = (() => {
 			_view_decorators = [Remote];
 			_save_decorators = [Remote];
 			_create_decorators = [Remote];
-			__esDecorate$2(this, null, _view_decorators, {
+			__esDecorate$3(this, null, _view_decorators, {
 				kind: "method",
 				name: "view",
 				static: false,
@@ -316,7 +316,7 @@ let GitHubCopilotDualModel = (() => {
 				},
 				metadata: _metadata
 			}, null, _instanceExtraInitializers);
-			__esDecorate$2(this, null, _save_decorators, {
+			__esDecorate$3(this, null, _save_decorators, {
 				kind: "method",
 				name: "save",
 				static: false,
@@ -327,7 +327,7 @@ let GitHubCopilotDualModel = (() => {
 				},
 				metadata: _metadata
 			}, null, _instanceExtraInitializers);
-			__esDecorate$2(this, null, _create_decorators, {
+			__esDecorate$3(this, null, _create_decorators, {
 				kind: "method",
 				name: "create",
 				static: false,
@@ -345,7 +345,7 @@ let GitHubCopilotDualModel = (() => {
 				value: _metadata
 			});
 		}
-		owner = __runInitializers$2(this, _instanceExtraInitializers);
+		owner = __runInitializers$3(this, _instanceExtraInitializers);
 		lifetime = new AbortController();
 		creates = /* @__PURE__ */ new Map();
 		overlays = /* @__PURE__ */ new Map();
@@ -867,12 +867,12 @@ const SearchProviderCatalogSchema = z$1.object({
 }).strict();
 //#endregion
 //#region lib/types/search-routing-host.js
-var __runInitializers$1 = function(thisArg, initializers, value) {
+var __runInitializers$2 = function(thisArg, initializers, value) {
 	var useValue = arguments.length > 2;
 	for (var i = 0; i < initializers.length; i++) value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
 	return useValue ? value : void 0;
 };
-var __esDecorate$1 = function(ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+var __esDecorate$2 = function(ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
 	function accept(f) {
 		if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected");
 		return f;
@@ -915,7 +915,7 @@ let SearchRoutingController = (() => {
 		static {
 			const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
 			_providers_decorators = [Remote];
-			__esDecorate$1(this, null, _providers_decorators, {
+			__esDecorate$2(this, null, _providers_decorators, {
 				kind: "method",
 				name: "providers",
 				static: false,
@@ -935,7 +935,7 @@ let SearchRoutingController = (() => {
 		}
 		constructor(ctx) {
 			super(ctx, "githubCopilotSearchRouting");
-			__runInitializers$1(this, _instanceExtraInitializers);
+			__runInitializers$2(this, _instanceExtraInitializers);
 		}
 		providers() {
 			const unavailable = {
@@ -960,131 +960,901 @@ let SearchRoutingController = (() => {
 	};
 })();
 //#endregion
-//#region package.json
-var name$1 = "dsh-github-copilot";
-var version = "0.4.0-alpha.31";
+//#region lib/types/copilot-grant.js
+function nonEmptyOAuthString(value, field) {
+	if (typeof value !== "string" || value.trim().length === 0) throw new Error(`github-copilot: OAuth credential field "${field}" must be a non-empty string`);
+	return value;
+}
+/**
+* Rebuild pi-ai's GitHub Copilot grant as the exact JSON-safe provider shape.
+* Prototype and unrelated extension members are intentionally not preserved.
+*/
+function normalizeGitHubCopilotOAuthCredential(credential) {
+	if (typeof credential !== "object" || credential === null) throw new Error("github-copilot: OAuth credential must be an object");
+	if (Reflect.get(credential, "type") !== "oauth") throw new Error("github-copilot: OAuth credential type must be \"oauth\"");
+	const refresh = nonEmptyOAuthString(Reflect.get(credential, "refresh"), "refresh");
+	const access = nonEmptyOAuthString(Reflect.get(credential, "access"), "access");
+	const expires = Reflect.get(credential, "expires");
+	if (typeof expires !== "number" || !Number.isFinite(expires)) throw new Error("github-copilot: OAuth credential field \"expires\" must be a finite number");
+	const enterpriseUrl = Reflect.get(credential, "enterpriseUrl");
+	if (enterpriseUrl !== void 0 && (typeof enterpriseUrl !== "string" || enterpriseUrl.trim().length === 0)) throw new Error("github-copilot: OAuth credential field \"enterpriseUrl\" must be a non-empty string");
+	const availableModelIds = Reflect.get(credential, "availableModelIds");
+	if (availableModelIds !== void 0 && (!Array.isArray(availableModelIds) || !availableModelIds.every((modelId) => typeof modelId === "string" && modelId.trim().length > 0))) throw new Error("github-copilot: OAuth credential field \"availableModelIds\" must be an array of non-empty strings");
+	return {
+		type: "oauth",
+		refresh,
+		access,
+		expires,
+		...enterpriseUrl === void 0 ? {} : { enterpriseUrl },
+		...availableModelIds === void 0 ? {} : { availableModelIds: [...new Set(availableModelIds)] }
+	};
+}
 //#endregion
-//#region lib/types/probe.js
+//#region lib/types/copilot-auth.js
 /**
-* Capability probe: one bounded operation per candidate protocol that forces
-* the server-side web tool to run and checks the reply for the structured
-* evidence that it did. A protocol claim is trusted only after this passes —
-* several "Responses-compatible" gateways accept the `web_search` tool field
-* and silently ignore it (DeepSeek documents that unknown tool types are
-* ignored), which is exactly the failure mode static protocol detection
-* cannot see. The probe is what makes the auto-disable decision honest.
-* @module dsh-github-copilot/probe
+* Provider-side GitHub Copilot auth resolution over the same credential record
+* that DSH's built-in llm-pi-ai adapter owns.
 */
-/** Attribution header value sent on probe requests; single-sourced from package.json. */
-const USER_AGENT = `dsh-github-copilot/${version}`;
-/** Upper bound on generated tokens for a probe reply; the verdict needs none of it. */
-const PROBE_MAX_TOKENS = 64;
-/** Complete spelling rounds allowed after structurally valid transient replies. */
-const RESPONSES_PROBE_ROUNDS = 2;
-/** Upper bound on the whole probe (also the fetch signal bound), milliseconds. */
-const MAX_PROBE_TIMEOUT_MS = 2147483647;
+function credentialService(ctx) {
+	const candidate = ctx.get("credentials");
+	if (typeof candidate !== "object" || candidate === null) throw new Error("github-copilot: DSH credentials service is unavailable");
+	for (const method of [
+		"readRecord",
+		"listRecords",
+		"modifyRecord",
+		"deleteRecord"
+	]) if (typeof Reflect.get(candidate, method) !== "function") throw new Error(`github-copilot: required DSH credentials API "credentials.${method}" is unavailable`);
+	return candidate;
+}
+function toCredential(record) {
+	if (record === void 0) return void 0;
+	if (record.kind === "api-key") return {
+		type: "api_key",
+		...record.key === void 0 ? {} : { key: record.key },
+		...record.env === void 0 ? {} : { env: { ...record.env } }
+	};
+	if (typeof record.payload !== "object" || record.payload === null) throw new Error("github-copilot: stored llm-pi-ai GitHub Copilot grant is not an object");
+	return normalizeGitHubCopilotOAuthCredential(record.payload);
+}
+function toRecord(credential) {
+	if (credential.type === "api_key") return {
+		kind: "api-key",
+		...credential.key === void 0 ? {} : { key: credential.key },
+		...credential.env === void 0 ? {} : { env: { ...credential.env } }
+	};
+	return {
+		kind: "grant",
+		payload: normalizeGitHubCopilotOAuthCredential(credential)
+	};
+}
+/** Bind exactly one logical route to the canonical Host-owned credential record. */
+function createGitHubCopilotCredentialStore(ctx, logicalProviderId = GITHUB_COPILOT_PROVIDER_ID) {
+	const assertProvider = (providerId) => {
+		if (providerId !== logicalProviderId) throw new Error("COPILOT_CREDENTIAL_PROVIDER_MISMATCH");
+	};
+	return {
+		read: async (providerId) => {
+			assertProvider(providerId);
+			return toCredential(await credentialService(ctx).readRecord(GITHUB_COPILOT_CREDENTIAL_KEY));
+		},
+		list: async () => {
+			const record = await credentialService(ctx).readRecord(GITHUB_COPILOT_CREDENTIAL_KEY);
+			return record === void 0 ? [] : [{
+				providerId: logicalProviderId,
+				type: record.kind === "api-key" ? "api_key" : "oauth"
+			}];
+		},
+		modify: async (providerId, mutate) => {
+			assertProvider(providerId);
+			return toCredential(await credentialService(ctx).modifyRecord(GITHUB_COPILOT_CREDENTIAL_KEY, async (current) => {
+				const next = await mutate(toCredential(current));
+				return next === void 0 ? void 0 : toRecord(next);
+			}));
+		},
+		delete: async (providerId) => {
+			assertProvider(providerId);
+			await credentialService(ctx).deleteRecord(GITHUB_COPILOT_CREDENTIAL_KEY);
+		}
+	};
+}
 /**
-* Probe one candidate protocol with a bounded request sequence. The verdict is
-* structural: a Responses reply must contain a `web_search_call` item and a
-* Messages reply must contain a `web_search_tool_result` block; anything else
-* — HTTP error, unparseable body, silent tool ignore — is "not supported".
-* The timeout bounds the WHOLE probe, including credential resolution; the
-* probe never throws — every failure becomes a verdict.
-* @param candidate - the resolved endpoint facts to verify.
-* @param resolveApiKey - resolves the candidate's credential reference.
-* @param timeoutMs - bound on the whole probe.
-* @param signal - optional owner lifecycle cancellation; abort forbids later attempts.
-* @returns the verdict and a diagnostic detail.
+* Build one resolver whose pi-ai collection refreshes OAuth credentials inside
+* the DSH record's serialized modify operation before exposing request auth.
 */
-async function probeCandidate(candidate, resolveApiKey, timeoutMs, signal) {
-	const aborted = () => ({
-		supported: false,
-		detail: "probe was aborted"
+function createGitHubCopilotTokenResolver(ctx, onCredentialChanged) {
+	const models = createModels({ credentials: createGitHubCopilotCredentialStore(ctx) });
+	const provider = githubCopilotProvider();
+	if (provider.auth.oauth === void 0) throw new Error("github-copilot: native OAuth method is unavailable");
+	models.setProvider({
+		...provider,
+		auth: { oauth: provider.auth.oauth }
 	});
-	if (signal?.aborted === true) return aborted();
-	const bound = Math.min(Math.max(Math.trunc(timeoutMs), 1), MAX_PROBE_TIMEOUT_MS);
-	const deadline = Date.now() + bound;
-	const cancellation = new AbortController();
-	let timer;
-	let onAbort;
-	const cancelled = new Promise((resolve) => {
-		onAbort = () => {
-			cancellation.abort();
-			resolve(aborted());
+	return async (modelId) => {
+		const snapshot = readCopilotCatalog(ctx);
+		const native = new Map(snapshot.models.map((model) => [model.id, model])).get(modelId);
+		if (native === void 0) throw new Error(`github-copilot: pi-ai catalog has no GitHub Copilot model "${modelId}"`);
+		const resolved = await models.getAuth("github-copilot");
+		if (resolved === void 0) return void 0;
+		if (onCredentialChanged !== void 0) try {
+			await onCredentialChanged();
+		} catch (error) {
+			ctx.logger.warn("github-copilot: provider route reconciliation will retry after a later auth resolution");
+			ctx.logger.warn(error);
+		}
+		const stored = await credentialService(ctx).readRecord(GITHUB_COPILOT_CREDENTIAL_KEY);
+		if (!(stored?.kind === "grant" && (normalizeGitHubCopilotOAuthCredential(stored.payload).availableModelIds ?? []).includes(modelId))) throw new Error(`github-copilot: model "${modelId}" is not available for the signed-in Copilot account`);
+		const apiKey = resolved.auth.apiKey;
+		if (apiKey === void 0) return void 0;
+		return {
+			apiKey,
+			baseURL: trustedCopilotBaseUrl(resolved.auth.baseUrl ?? native.baseUrl, enterpriseDomainOf(stored)),
+			...resolved.auth.headers === void 0 ? {} : { headers: resolved.auth.headers }
 		};
-		signal?.addEventListener("abort", onAbort, { once: true });
-	});
-	try {
-		return await Promise.race([
-			cancelled,
-			runProbe(candidate, resolveApiKey, bound, deadline, cancellation.signal),
-			new Promise((resolve) => {
-				timer = setTimeout(() => {
-					cancellation.abort();
-					resolve({
-						supported: false,
-						detail: `probe timed out after ${bound}ms`
-					});
-				}, bound);
-			})
-		]);
-	} finally {
-		clearTimeout(timer);
-		if (onAbort !== void 0) signal?.removeEventListener("abort", onAbort);
-	}
+	};
 }
-/** Resolve the key and probe the endpoint under the shared whole-probe deadline. */
-async function runProbe(candidate, resolveApiKey, bound, deadline, cancellation) {
+function enterpriseDomainOf(record) {
+	if (record?.kind !== "grant" || typeof record.payload !== "object" || record.payload === null) return void 0;
+	const value = Reflect.get(record.payload, "enterpriseUrl");
+	if (typeof value !== "string" || value.trim().length === 0) return void 0;
 	try {
-		const auth = normalizeRequestAuth(await resolveApiKey(candidate));
-		if (auth === void 0 || auth.apiKey.length === 0) return {
-			supported: false,
-			detail: `no API key for "${candidate.apiKeyEnv}"`
-		};
-		candidate = applyRequestAuth(candidate, auth);
-		const apiKey = auth.apiKey;
-		const remaining = deadline - Date.now();
-		if (cancellation.aborted || remaining <= 0) return {
-			supported: false,
-			detail: `probe timed out after ${bound}ms`
-		};
-		return candidate.protocol === "openai-responses" ? await probeResponses(candidate, apiKey, cancellation) : await probeAnthropic(candidate, apiKey, cancellation);
-	} catch (error) {
-		if (error instanceof WebError) return {
-			supported: false,
-			detail: error.message
-		};
-		return {
-			supported: false,
-			detail: `probe failed: ${String(error)}`
-		};
+		return (value.includes("://") ? new URL(value) : new URL(`https://${value}`)).hostname.toLowerCase();
+	} catch {
+		throw new Error("github-copilot: stored enterpriseUrl is invalid");
 	}
 }
-/**
-* Probe the Responses endpoint with a single tool spelling: force the tool
-* (standard `required` or the gateway's object choice) and require a
-* `web_search_call` item as structural evidence.
-* @param candidate - the resolved endpoint facts.
-* @param apiKey - the resolved credential.
-* @param signal - the probe timeout signal.
-* @param spelling - the tool type spelling to exercise.
-* @returns the verdict; `transient` is true only for a valid 2xx reply that
-*   omitted the required structural evidence.
-*/
-async function probeResponsesSpelling(candidate, apiKey, signal, spelling) {
-	const endpoint = `${candidate.baseURL.replace(/\/+$/, "")}/responses`;
-	let response;
-	try {
-		response = await fetch(endpoint, {
-			method: "POST",
-			redirect: "error",
-			headers: {
-				authorization: `Bearer ${apiKey}`,
-				"content-type": "application/json",
-				accept: "application/json",
-				"user-agent": USER_AGENT,
-				...providerRequestHeaders(candidate, "user")
-			},
+/** Validate an OAuth-derived endpoint without disclosing its value or credential payload. */
+function trustedGitHubCopilotBaseUrl(value, grant) {
+	return trustedCopilotBaseUrl(value, enterpriseDomainOf({
+		kind: "grant",
+		payload: normalizeGitHubCopilotOAuthCredential(grant)
+	}));
+}
+function trustedCopilotBaseUrl(value, enterpriseDomain) {
+	if (value === void 0) throw new Error("github-copilot: pi-ai resolved no Copilot API base URL");
+	const url = new URL(value);
+	const hostname = url.hostname.toLowerCase();
+	const githubHosted = /^api(?:\.[a-z0-9-]+)+\.githubcopilot\.com$/u.test(hostname);
+	const enterpriseHosted = enterpriseDomain !== void 0 && hostname === `copilot-api.${enterpriseDomain}`;
+	if (!(url.protocol === "https:" && (githubHosted || enterpriseHosted)) || url.username.length > 0 || url.password.length > 0) throw new Error("github-copilot: pi-ai resolved an untrusted Copilot API base URL");
+	return url.origin;
+}
+//#endregion
+//#region lib/types/account-model-auth.js
+/** Native getAuth renews within five minutes; reserve another thirty seconds for metadata preparation. */
+const ACCOUNT_MODEL_AUTH_MIN_VALIDITY_MS = 33e4;
+/** An opaque, process-local account key. Never a substitute for request credentials. */
+function copilotAccountKey(grant) {
+	return createHash("sha256").update(`${grant.refresh.length}:`).update(grant.refresh).update(grant.enterpriseUrl ?? "").digest("hex");
+}
+/** Compare normalized permission snapshots without retaining model credentials. */
+function copilotEntitlementKey(grant) {
+	const ids = grant.availableModelIds;
+	const normalized = ids === void 0 ? "missing" : JSON.stringify([...new Set(ids)].sort());
+	return createHash("sha256").update(normalized).digest("hex");
+}
+function authEntitlementKey(auth) {
+	return copilotEntitlementKey({ ...auth.availableModelIds === void 0 ? {} : { availableModelIds: [...auth.availableModelIds] } });
+}
+function active(signal) {
+	if (signal.aborted) throw new Error("COPILOT_ACCOUNT_AUTH_ABORTED");
+}
+/**
+* Bind model discovery to the existing native OAuth lifecycle. No model catalog,
+* login, environment fallback or separate credential record is introduced here.
+*/
+function createAccountModelAuth(credentials, renewRejectedCredential) {
+	const native = githubCopilotProvider();
+	const oauth = native.auth.oauth;
+	if (oauth === void 0) throw new Error("COPILOT_ACCOUNT_OAUTH_UNAVAILABLE");
+	const readGrant = async (signal) => {
+		active(signal);
+		const stored = await credentials.read(GITHUB_COPILOT_PROVIDER_ID);
+		active(signal);
+		if (stored?.type !== "oauth") throw new Error("COPILOT_ACCOUNT_OAUTH_REQUIRED");
+		return normalizeGitHubCopilotOAuthCredential(stored);
+	};
+	const matches = (grant, key) => {
+		if (copilotAccountKey(grant) !== key) throw new Error("COPILOT_ACCOUNT_CHANGED");
+	};
+	const current = async (auth, signal) => {
+		active(signal);
+		const grant = await readGrant(signal);
+		matches(grant, auth.accountKey);
+		if (grant.access !== auth.apiKey || grant.expires <= Date.now()) throw new Error("COPILOT_ACCOUNT_TOKEN_CHANGED");
+		if (copilotEntitlementKey(grant) !== authEntitlementKey(auth)) throw new Error("COPILOT_ACCOUNT_ENTITLEMENT_CHANGED");
+		const derived = await oauth.toAuth(grant);
+		active(signal);
+		if (derived.apiKey !== auth.apiKey || trustedGitHubCopilotBaseUrl(derived.baseUrl, grant) !== auth.baseURL) throw new Error("COPILOT_ACCOUNT_AUTH_CHANGED");
+		const latest = await readGrant(signal);
+		matches(latest, auth.accountKey);
+		if (latest.access !== auth.apiKey || latest.expires <= Date.now()) throw new Error("COPILOT_ACCOUNT_TOKEN_CHANGED");
+		if (copilotEntitlementKey(latest) !== authEntitlementKey(auth)) throw new Error("COPILOT_ACCOUNT_ENTITLEMENT_CHANGED");
+	};
+	return {
+		async resolveAuth(signal) {
+			try {
+				const before = await readGrant(signal);
+				const key = copilotAccountKey(before);
+				const rejectedAccess = renewRejectedCredential?.(before) === true ? before.access : void 0;
+				const forResolution = (grant) => rejectedAccess !== void 0 && grant.access === rejectedAccess ? {
+					...grant,
+					expires: 0
+				} : grant;
+				const guardedOAuth = {
+					...oauth,
+					login: async () => {
+						throw new Error("COPILOT_ACCOUNT_USE_CANONICAL_SIGN_IN");
+					},
+					async refresh(credential, requestSignal) {
+						active(signal);
+						matches(normalizeGitHubCopilotOAuthCredential(credential), key);
+						const result = normalizeGitHubCopilotOAuthCredential(await oauth.refresh(credential, requestSignal === void 0 ? signal : AbortSignal.any([signal, requestSignal])));
+						active(signal);
+						matches(result, key);
+						return result;
+					},
+					async toAuth(credential) {
+						active(signal);
+						const grant = normalizeGitHubCopilotOAuthCredential(credential);
+						matches(grant, key);
+						const result = await oauth.toAuth(grant);
+						active(signal);
+						return {
+							...result,
+							baseUrl: trustedGitHubCopilotBaseUrl(result.baseUrl, grant)
+						};
+					}
+				};
+				const models = createModels({ credentials: {
+					read: async (provider) => {
+						const value = await credentials.read(provider);
+						active(signal);
+						if (value?.type !== "oauth") throw new Error("COPILOT_ACCOUNT_OAUTH_REQUIRED");
+						const grant = normalizeGitHubCopilotOAuthCredential(value);
+						matches(grant, key);
+						return forResolution(grant);
+					},
+					list: () => credentials.list(),
+					modify: (provider, mutate) => credentials.modify(provider, async (value) => {
+						active(signal);
+						if (value?.type !== "oauth") throw new Error("COPILOT_ACCOUNT_OAUTH_REQUIRED");
+						matches(normalizeGitHubCopilotOAuthCredential(value), key);
+						const next = await mutate(forResolution(normalizeGitHubCopilotOAuthCredential(value)));
+						active(signal);
+						if (next !== void 0) matches(normalizeGitHubCopilotOAuthCredential(next), key);
+						return next;
+					}),
+					delete: async () => {
+						throw new Error("COPILOT_ACCOUNT_DISCOVERY_CANNOT_SIGN_OUT");
+					}
+				} });
+				models.setProvider({
+					...native,
+					auth: { oauth: guardedOAuth }
+				});
+				const resolved = await models.getAuth(GITHUB_COPILOT_PROVIDER_ID, {
+					signal,
+					minOAuthValidityMs: ACCOUNT_MODEL_AUTH_MIN_VALIDITY_MS
+				});
+				active(signal);
+				if (resolved?.auth.apiKey === void 0) throw new Error("COPILOT_ACCOUNT_OAUTH_REQUIRED");
+				const grant = await readGrant(signal);
+				matches(grant, key);
+				if (rejectedAccess !== void 0 && grant.access === rejectedAccess) throw new Error("COPILOT_ACCOUNT_TOKEN_REJECTED");
+				const auth = {
+					apiKey: resolved.auth.apiKey,
+					baseURL: trustedGitHubCopilotBaseUrl(resolved.auth.baseUrl, grant),
+					accountKey: key,
+					...grant.availableModelIds === void 0 ? {} : { availableModelIds: Object.freeze([...grant.availableModelIds]) }
+				};
+				await current(auth, signal);
+				return Object.freeze(auth);
+			} catch {
+				throw new Error(signal.aborted ? "COPILOT_ACCOUNT_AUTH_ABORTED" : "COPILOT_ACCOUNT_AUTH_FAILED");
+			}
+		},
+		async assertAuthCurrent(auth, signal) {
+			try {
+				await current(auth, signal);
+			} catch {
+				throw new Error(signal.aborted ? "COPILOT_ACCOUNT_AUTH_ABORTED" : "COPILOT_ACCOUNT_AUTH_CHANGED");
+			}
+		}
+	};
+}
+//#endregion
+//#region lib/types/copilot-usage-types.js
+const COPILOT_USAGE_MAX_AMOUNT = 0xe8d4a51000;
+const COPILOT_USAGE_MAX_TIMESTAMP = 0xe677d21fdbff;
+//#endregion
+//#region lib/types/copilot-usage-normalize.js
+const amount = z$1.number().finite().min(0).max(COPILOT_USAGE_MAX_AMOUNT);
+const entitlement = z$1.union([
+	amount,
+	z$1.literal(-1),
+	z$1.string().max(32).regex(/^(?:-1|(?:0|[1-9]\d*)(?:\.\d+)?)$/u)
+]).transform(Number).refine((value) => Number.isFinite(value) && value <= 0xe8d4a51000);
+const snapshot = z$1.object({
+	unlimited: z$1.boolean(),
+	entitlement: entitlement.optional(),
+	percent_remaining: z$1.number().finite().min(0).max(100).optional(),
+	quota_remaining: amount.optional(),
+	credits_used: amount.optional(),
+	has_quota: z$1.boolean().optional(),
+	token_based_billing: z$1.boolean().optional(),
+	quota_reset_at: z$1.number().int().min(0).max(Math.floor(COPILOT_USAGE_MAX_TIMESTAMP / 1e3)).optional()
+});
+const response = z$1.object({
+	token_based_billing: z$1.boolean().optional(),
+	access_type_sku: z$1.string().max(128).optional(),
+	quota_reset_date: z$1.string().max(64).optional(),
+	quota_reset_date_utc: z$1.string().max(64).optional(),
+	limited_user_reset_date: z$1.string().max(64).optional(),
+	quota_snapshots: z$1.object({
+		chat: snapshot.optional(),
+		premium_interactions: snapshot.optional()
+	}).optional(),
+	monthly_quotas: z$1.object({ chat: amount }).optional(),
+	limited_user_quotas: z$1.object({ chat: amount }).optional()
+});
+function unavailableCopilotUsage(diagnostic, billing = "unknown", budget = "unknown") {
+	return {
+		state: diagnostic === "COPILOT_USAGE_SIGNED_OUT" ? "signed-out" : "unavailable",
+		billing,
+		budget,
+		diagnostic
+	};
+}
+function resetDate(value) {
+	if (!/^\d{4}-\d{2}-\d{2}(?:T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2}))?$/u.test(value)) return void 0;
+	const date = value.slice(0, 10);
+	const day = Date.parse(`${date}T00:00:00Z`);
+	if (!Number.isFinite(day) || new Date(day).toISOString().slice(0, 10) !== date) return void 0;
+	const parsed = Date.parse(value);
+	return Number.isFinite(parsed) && parsed >= 0 && parsed <= 0xe677d21fdbff ? parsed : void 0;
+}
+/**
+* Pinned VS Code 44825207: parseQuotas/getQuotaUsage and chatStatusDashboard
+* display account amounts directly. Only per-turn nano-AIU uses /1e9; it is
+* intentionally absent here. Pooled credits_used never shares an entitlement.
+*/
+function normalizeCopilotUsage(input, observedAt) {
+	const parsed = response.safeParse(input);
+	if (!parsed.success) return unavailableCopilotUsage("COPILOT_USAGE_INVALID_RESPONSE");
+	const data = parsed.data;
+	if (data.token_based_billing === void 0) return unavailableCopilotUsage("COPILOT_USAGE_BILLING_UNKNOWN");
+	const billing = data.token_based_billing ? "credits" : "requests";
+	const quota = data.access_type_sku === "free_limited_copilot" ? data.quota_snapshots?.chat : data.quota_snapshots?.premium_interactions;
+	const reset = data.quota_reset_date_utc ?? data.quota_reset_date ?? data.limited_user_reset_date;
+	const accountReset = reset === void 0 ? void 0 : resetDate(reset);
+	if (reset !== void 0 && accountReset === void 0) return unavailableCopilotUsage("COPILOT_USAGE_INVALID_RESPONSE", billing);
+	const resetAt = quota?.quota_reset_at === void 0 ? accountReset : quota.quota_reset_at * 1e3;
+	const dates = {
+		observedAt,
+		...resetAt === void 0 ? {} : { resetAt }
+	};
+	if (!quota) {
+		const limit = data.monthly_quotas?.chat, remaining = data.limited_user_quotas?.chat;
+		if (billing === "requests" && limit !== void 0 && limit > 0 && remaining !== void 0 && remaining <= limit) return {
+			state: "ready",
+			billing,
+			budget: "individual",
+			limit,
+			remaining,
+			used: limit - remaining,
+			percentUsed: (limit - remaining) / limit * 100,
+			...dates
+		};
+		return unavailableCopilotUsage("COPILOT_USAGE_SNAPSHOT_MISSING", billing);
+	}
+	if (quota.token_based_billing !== void 0 && quota.token_based_billing !== data.token_based_billing) return unavailableCopilotUsage("COPILOT_USAGE_INVALID_RESPONSE", billing);
+	if (quota.unlimited) {
+		if (quota.has_quota === false) return unavailableCopilotUsage("COPILOT_USAGE_POOLED_EXHAUSTED", billing, "pooled");
+		if (billing !== "credits" || quota.credits_used === void 0) return unavailableCopilotUsage("COPILOT_USAGE_POOLED_UNAVAILABLE", billing, "pooled");
+		return {
+			state: "ready",
+			billing,
+			budget: "pooled",
+			used: quota.credits_used,
+			...dates
+		};
+	}
+	const limit = quota.entitlement, percent = quota.percent_remaining;
+	if (limit === 0) return unavailableCopilotUsage("COPILOT_USAGE_NO_ALLOCATION", billing, "individual");
+	if (limit !== void 0 && limit < 0 || percent === void 0 || limit !== void 0 && quota.quota_remaining !== void 0 && quota.quota_remaining > limit) return unavailableCopilotUsage("COPILOT_USAGE_INVALID_RESPONSE", billing);
+	if (limit !== void 0 && quota.quota_remaining !== void 0 && Math.abs(quota.quota_remaining / limit * 100 - percent) > 1) return unavailableCopilotUsage("COPILOT_USAGE_INVALID_RESPONSE", billing);
+	const remaining = quota.quota_remaining;
+	return {
+		state: "ready",
+		billing,
+		budget: "individual",
+		percentUsed: 100 - percent,
+		...dates,
+		...limit === void 0 ? {} : { limit },
+		...remaining === void 0 ? {} : { remaining },
+		...limit === void 0 || remaining === void 0 ? {} : { used: limit - remaining }
+	};
+}
+//#endregion
+//#region lib/types/copilot-usage-host.js
+var __runInitializers$1 = function(thisArg, initializers, value) {
+	var useValue = arguments.length > 2;
+	for (var i = 0; i < initializers.length; i++) value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+	return useValue ? value : void 0;
+};
+var __esDecorate$1 = function(ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+	function accept(f) {
+		if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected");
+		return f;
+	}
+	var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+	var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+	var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+	var _, done = false;
+	for (var i = decorators.length - 1; i >= 0; i--) {
+		var context = {};
+		for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+		for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+		context.addInitializer = function(f) {
+			if (done) throw new TypeError("Cannot add initializers after decoration has completed");
+			extraInitializers.push(accept(f || null));
+		};
+		var result = (0, decorators[i])(kind === "accessor" ? {
+			get: descriptor.get,
+			set: descriptor.set
+		} : descriptor[key], context);
+		if (kind === "accessor") {
+			if (result === void 0) continue;
+			if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+			if (_ = accept(result.get)) descriptor.get = _;
+			if (_ = accept(result.set)) descriptor.set = _;
+			if (_ = accept(result.init)) initializers.unshift(_);
+		} else if (_ = accept(result)) {
+			if (kind === "field") initializers.unshift(_);
+			else descriptor[key] = _;
+		}
+	}
+	if (target) Object.defineProperty(target, contextIn.name, descriptor);
+	done = true;
+};
+const COPILOT_USAGE_ENDPOINT = "https://api.github.com/copilot_internal/user";
+const TTL_MS = 6e4;
+const REFRESH_INTERVAL_MS = 1e4;
+const FAILURE_COOLDOWN_MS = 3e4;
+const TIMEOUT_MS = 1e4;
+const MAX_BODY_BYTES = 262144;
+var UsageFailure = class extends Error {
+	diagnostic;
+	constructor(diagnostic) {
+		super(diagnostic);
+		this.diagnostic = diagnostic;
+	}
+};
+function failure$2(diagnostic) {
+	throw new UsageFailure(diagnostic);
+}
+async function readBody(response, signal) {
+	const length = response.headers.get("content-length");
+	if (length !== null && (!/^\d+$/u.test(length) || Number(length) > MAX_BODY_BYTES)) {
+		response.body?.cancel().catch(() => void 0);
+		failure$2("COPILOT_USAGE_BODY_TOO_LARGE");
+	}
+	if (!response.body) failure$2("COPILOT_USAGE_INVALID_RESPONSE");
+	const reader = response.body.getReader(), chunks = [];
+	const cancel = () => {
+		reader.cancel().catch(() => void 0);
+	};
+	signal.addEventListener("abort", cancel, { once: true });
+	if (signal.aborted) cancel();
+	let size = 0;
+	try {
+		while (true) {
+			const next = await reader.read();
+			if (next.done) break;
+			size += next.value.byteLength;
+			if (size > MAX_BODY_BYTES) {
+				reader.cancel().catch(() => void 0);
+				failure$2("COPILOT_USAGE_BODY_TOO_LARGE");
+			}
+			chunks.push(next.value);
+		}
+	} finally {
+		signal.removeEventListener("abort", cancel);
+		reader.releaseLock();
+	}
+	const bytes = new Uint8Array(size);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	try {
+		return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+	} catch {
+		failure$2("COPILOT_USAGE_INVALID_RESPONSE");
+	}
+}
+/** One Host-owned, memory-only account cache. No auth renewal, persistence or model transport. */
+var CopilotUsageSource = class {
+	dependencies;
+	fetcher;
+	now;
+	generation = 0;
+	disposed = false;
+	key;
+	cached;
+	last;
+	nextRefreshAt = 0;
+	failureUntil = 0;
+	flight;
+	constructor(dependencies) {
+		this.dependencies = dependencies;
+		this.fetcher = dependencies.fetch ?? globalThis.fetch;
+		this.now = dependencies.now ?? Date.now;
+	}
+	invalidate() {
+		this.generation++;
+		this.flight?.abort.abort();
+		this.flight = void 0;
+		this.key = void 0;
+		this.cached = void 0;
+		this.last = void 0;
+		this.nextRefreshAt = 0;
+		this.failureUntil = 0;
+	}
+	dispose() {
+		this.disposed = true;
+		this.invalidate();
+	}
+	get() {
+		return this.load(false);
+	}
+	refresh() {
+		return this.load(true);
+	}
+	active(generation) {
+		if (this.disposed) failure$2("COPILOT_USAGE_DISPOSED");
+		if (generation !== this.generation) failure$2("COPILOT_USAGE_ACCOUNT_CHANGED");
+	}
+	async readAuth(generation) {
+		this.active(generation);
+		let stored;
+		try {
+			stored = await this.dependencies.readCredential();
+		} catch {
+			this.active(generation);
+			failure$2("COPILOT_USAGE_CREDENTIALS_UNAVAILABLE");
+		}
+		this.active(generation);
+		if (stored === void 0) failure$2("COPILOT_USAGE_SIGNED_OUT");
+		let grant;
+		try {
+			grant = normalizeGitHubCopilotOAuthCredential(stored);
+		} catch {
+			failure$2("COPILOT_USAGE_INVALID_GRANT");
+		}
+		if (grant.enterpriseUrl !== void 0) failure$2("COPILOT_USAGE_ENTERPRISE_UNSUPPORTED");
+		return {
+			grant,
+			key: copilotAccountKey(grant)
+		};
+	}
+	async assertCurrent(key, generation) {
+		if ((await this.readAuth(generation)).key !== key) failure$2("COPILOT_USAGE_ACCOUNT_CHANGED");
+	}
+	diagnostic(error) {
+		return error instanceof UsageFailure ? error.diagnostic : "COPILOT_USAGE_NETWORK";
+	}
+	async load(force) {
+		let generation = this.generation;
+		let auth;
+		try {
+			auth = await this.readAuth(generation);
+			this.active(generation);
+		} catch (error) {
+			if (generation === this.generation) this.invalidate();
+			return unavailableCopilotUsage(this.diagnostic(error));
+		}
+		if (this.key !== void 0 && this.key !== auth.key) {
+			this.invalidate();
+			generation = this.generation;
+		}
+		this.key = auth.key;
+		if (this.flight) {
+			const result = await this.flight.promise;
+			if (this.disposed) return unavailableCopilotUsage("COPILOT_USAGE_DISPOSED");
+			if (generation !== this.generation) return unavailableCopilotUsage("COPILOT_USAGE_ACCOUNT_CHANGED");
+			return { ...result };
+		}
+		const now = this.now();
+		if (this.last && now < this.failureUntil) return { ...this.last };
+		if (this.cached && (!force && now - this.cached.observedAt < TTL_MS || now < this.nextRefreshAt)) return { ...this.cached };
+		const abort = new AbortController();
+		const promise = this.request(auth, generation, abort);
+		this.flight = {
+			generation,
+			promise,
+			abort
+		};
+		try {
+			return { ...await promise };
+		} finally {
+			if (this.flight?.promise === promise) this.flight = void 0;
+		}
+	}
+	async fetchQuota(auth, abort) {
+		const response = await this.fetcher(COPILOT_USAGE_ENDPOINT, {
+			method: "GET",
+			redirect: "error",
+			signal: abort.signal,
+			cache: "no-store",
+			headers: {
+				Authorization: `token ${auth.grant.refresh}`,
+				Accept: "application/json",
+				"X-GitHub-Api-Version": "2025-04-01"
+			}
+		});
+		if (response.redirected || response.status >= 300 && response.status < 400) {
+			response.body?.cancel().catch(() => void 0);
+			failure$2("COPILOT_USAGE_REDIRECT");
+		}
+		if (!response.ok) {
+			response.body?.cancel().catch(() => void 0);
+			if (response.status === 401 || response.status === 403) failure$2("COPILOT_USAGE_AUTH_REJECTED");
+			if (response.status === 429) failure$2("COPILOT_USAGE_RATE_LIMITED");
+			failure$2("COPILOT_USAGE_HTTP_ERROR");
+		}
+		return readBody(response, abort.signal);
+	}
+	async request(auth, generation, abort) {
+		let timer;
+		let removeAbort;
+		let value;
+		let error;
+		try {
+			await this.assertCurrent(auth.key, generation);
+			this.active(generation);
+			this.nextRefreshAt = this.now() + REFRESH_INTERVAL_MS;
+			const cancellation = new Promise((_resolve, reject) => {
+				const cancel = () => reject(new UsageFailure(this.disposed ? "COPILOT_USAGE_DISPOSED" : "COPILOT_USAGE_ACCOUNT_CHANGED"));
+				abort.signal.addEventListener("abort", cancel, { once: true });
+				removeAbort = () => abort.signal.removeEventListener("abort", cancel);
+				timer = setTimeout(() => {
+					reject(new UsageFailure("COPILOT_USAGE_TIMEOUT"));
+					abort.abort();
+				}, TIMEOUT_MS);
+			});
+			value = normalizeCopilotUsage(await Promise.race([this.fetchQuota(auth, abort), cancellation]), this.now());
+		} catch (caught) {
+			error = caught;
+		} finally {
+			if (timer !== void 0) clearTimeout(timer);
+			removeAbort?.();
+		}
+		try {
+			await this.assertCurrent(auth.key, generation);
+			this.active(generation);
+		} catch (caught) {
+			if (generation === this.generation) this.invalidate();
+			return unavailableCopilotUsage(this.diagnostic(caught));
+		}
+		if (error !== void 0) {
+			const diagnostic = this.diagnostic(error);
+			if (diagnostic === "COPILOT_USAGE_ACCOUNT_CHANGED" || diagnostic === "COPILOT_USAGE_SIGNED_OUT" || diagnostic === "COPILOT_USAGE_INVALID_GRANT" || diagnostic === "COPILOT_USAGE_ENTERPRISE_UNSUPPORTED" || diagnostic === "COPILOT_USAGE_CREDENTIALS_UNAVAILABLE") {
+				this.invalidate();
+				return unavailableCopilotUsage(diagnostic);
+			}
+			const staleAllowed = [
+				"COPILOT_USAGE_NETWORK",
+				"COPILOT_USAGE_TIMEOUT",
+				"COPILOT_USAGE_HTTP_ERROR",
+				"COPILOT_USAGE_RATE_LIMITED"
+			].includes(diagnostic);
+			if (!staleAllowed) this.cached = void 0;
+			value = staleAllowed && this.cached ? {
+				...this.cached,
+				state: "stale",
+				diagnostic
+			} : unavailableCopilotUsage(diagnostic);
+		}
+		if (value === void 0) return unavailableCopilotUsage("COPILOT_USAGE_INVALID_RESPONSE");
+		this.last = value;
+		if (value.state === "ready") {
+			this.cached = value;
+			this.failureUntil = 0;
+		} else {
+			if (value.state !== "stale") this.cached = void 0;
+			this.failureUntil = this.now() + FAILURE_COOLDOWN_MS;
+		}
+		return value;
+	}
+};
+let GitHubCopilotUsageController = (() => {
+	let _classSuper = TypertRemoteService;
+	let _instanceExtraInitializers = [];
+	let _get_decorators;
+	let _refresh_decorators;
+	return class GitHubCopilotUsageController extends _classSuper {
+		static {
+			const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+			_get_decorators = [Remote];
+			_refresh_decorators = [Remote];
+			__esDecorate$1(this, null, _get_decorators, {
+				kind: "method",
+				name: "get",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "get" in obj,
+					get: (obj) => obj.get
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate$1(this, null, _refresh_decorators, {
+				kind: "method",
+				name: "refresh",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "refresh" in obj,
+					get: (obj) => obj.refresh
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			if (_metadata) Object.defineProperty(this, Symbol.metadata, {
+				enumerable: true,
+				configurable: true,
+				writable: true,
+				value: _metadata
+			});
+		}
+		source = __runInitializers$1(this, _instanceExtraInitializers);
+		constructor(ctx) {
+			super(ctx, "githubCopilotUsage");
+			const credentials = createGitHubCopilotCredentialStore(ctx);
+			this.source = new CopilotUsageSource({ readCredential: () => credentials.read(GITHUB_COPILOT_PROVIDER_ID) });
+			ctx.on("credentials/record-updated", (key) => {
+				if (key === "llm-pi-ai/github-copilot") this.source.invalidate();
+			});
+			ctx.on("settings/updated", (namespace) => {
+				if (namespace === "github-copilot" || namespace === "llm-pi-ai") this.source.invalidate();
+			});
+			ctx.effect(() => () => this.source.dispose());
+		}
+		async get() {
+			return this.source.get();
+		}
+		async refresh() {
+			return this.source.refresh();
+		}
+	};
+})();
+//#endregion
+//#region package.json
+var name$1 = "dsh-github-copilot";
+var version = "0.4.0-alpha.32";
+//#endregion
+//#region lib/types/probe.js
+/**
+* Capability probe: one bounded operation per candidate protocol that forces
+* the server-side web tool to run and checks the reply for the structured
+* evidence that it did. A protocol claim is trusted only after this passes —
+* several "Responses-compatible" gateways accept the `web_search` tool field
+* and silently ignore it (DeepSeek documents that unknown tool types are
+* ignored), which is exactly the failure mode static protocol detection
+* cannot see. The probe is what makes the auto-disable decision honest.
+* @module dsh-github-copilot/probe
+*/
+/** Attribution header value sent on probe requests; single-sourced from package.json. */
+const USER_AGENT = `dsh-github-copilot/${version}`;
+/** Upper bound on generated tokens for a probe reply; the verdict needs none of it. */
+const PROBE_MAX_TOKENS = 64;
+/** Complete spelling rounds allowed after structurally valid transient replies. */
+const RESPONSES_PROBE_ROUNDS = 2;
+/** Upper bound on the whole probe (also the fetch signal bound), milliseconds. */
+const MAX_PROBE_TIMEOUT_MS = 2147483647;
+/**
+* Probe one candidate protocol with a bounded request sequence. The verdict is
+* structural: a Responses reply must contain a `web_search_call` item and a
+* Messages reply must contain a `web_search_tool_result` block; anything else
+* — HTTP error, unparseable body, silent tool ignore — is "not supported".
+* The timeout bounds the WHOLE probe, including credential resolution; the
+* probe never throws — every failure becomes a verdict.
+* @param candidate - the resolved endpoint facts to verify.
+* @param resolveApiKey - resolves the candidate's credential reference.
+* @param timeoutMs - bound on the whole probe.
+* @param signal - optional owner lifecycle cancellation; abort forbids later attempts.
+* @returns the verdict and a diagnostic detail.
+*/
+async function probeCandidate(candidate, resolveApiKey, timeoutMs, signal) {
+	const aborted = () => ({
+		supported: false,
+		detail: "probe was aborted"
+	});
+	if (signal?.aborted === true) return aborted();
+	const bound = Math.min(Math.max(Math.trunc(timeoutMs), 1), MAX_PROBE_TIMEOUT_MS);
+	const deadline = Date.now() + bound;
+	const cancellation = new AbortController();
+	let timer;
+	let onAbort;
+	const cancelled = new Promise((resolve) => {
+		onAbort = () => {
+			cancellation.abort();
+			resolve(aborted());
+		};
+		signal?.addEventListener("abort", onAbort, { once: true });
+	});
+	try {
+		return await Promise.race([
+			cancelled,
+			runProbe(candidate, resolveApiKey, bound, deadline, cancellation.signal),
+			new Promise((resolve) => {
+				timer = setTimeout(() => {
+					cancellation.abort();
+					resolve({
+						supported: false,
+						detail: `probe timed out after ${bound}ms`
+					});
+				}, bound);
+			})
+		]);
+	} finally {
+		clearTimeout(timer);
+		if (onAbort !== void 0) signal?.removeEventListener("abort", onAbort);
+	}
+}
+/** Resolve the key and probe the endpoint under the shared whole-probe deadline. */
+async function runProbe(candidate, resolveApiKey, bound, deadline, cancellation) {
+	try {
+		const auth = normalizeRequestAuth(await resolveApiKey(candidate));
+		if (auth === void 0 || auth.apiKey.length === 0) return {
+			supported: false,
+			detail: `no API key for "${candidate.apiKeyEnv}"`
+		};
+		candidate = applyRequestAuth(candidate, auth);
+		const apiKey = auth.apiKey;
+		const remaining = deadline - Date.now();
+		if (cancellation.aborted || remaining <= 0) return {
+			supported: false,
+			detail: `probe timed out after ${bound}ms`
+		};
+		return candidate.protocol === "openai-responses" ? await probeResponses(candidate, apiKey, cancellation) : await probeAnthropic(candidate, apiKey, cancellation);
+	} catch (error) {
+		if (error instanceof WebError) return {
+			supported: false,
+			detail: error.message
+		};
+		return {
+			supported: false,
+			detail: `probe failed: ${String(error)}`
+		};
+	}
+}
+/**
+* Probe the Responses endpoint with a single tool spelling: force the tool
+* (standard `required` or the gateway's object choice) and require a
+* `web_search_call` item as structural evidence.
+* @param candidate - the resolved endpoint facts.
+* @param apiKey - the resolved credential.
+* @param signal - the probe timeout signal.
+* @param spelling - the tool type spelling to exercise.
+* @returns the verdict; `transient` is true only for a valid 2xx reply that
+*   omitted the required structural evidence.
+*/
+async function probeResponsesSpelling(candidate, apiKey, signal, spelling) {
+	const endpoint = `${candidate.baseURL.replace(/\/+$/, "")}/responses`;
+	let response;
+	try {
+		response = await fetch(endpoint, {
+			method: "POST",
+			redirect: "error",
+			headers: {
+				authorization: `Bearer ${apiKey}`,
+				"content-type": "application/json",
+				accept: "application/json",
+				"user-agent": USER_AGENT,
+				...providerRequestHeaders(candidate, "user")
+			},
 			body: JSON.stringify({
 				model: candidate.model,
 				input: [{
@@ -3127,36 +3897,6 @@ function assertDshCompatibility(ctx) {
 	if (typeof ctx["plugin"] !== "function") incompatible("context.plugin");
 }
 //#endregion
-//#region lib/types/copilot-grant.js
-function nonEmptyOAuthString(value, field) {
-	if (typeof value !== "string" || value.trim().length === 0) throw new Error(`github-copilot: OAuth credential field "${field}" must be a non-empty string`);
-	return value;
-}
-/**
-* Rebuild pi-ai's GitHub Copilot grant as the exact JSON-safe provider shape.
-* Prototype and unrelated extension members are intentionally not preserved.
-*/
-function normalizeGitHubCopilotOAuthCredential(credential) {
-	if (typeof credential !== "object" || credential === null) throw new Error("github-copilot: OAuth credential must be an object");
-	if (Reflect.get(credential, "type") !== "oauth") throw new Error("github-copilot: OAuth credential type must be \"oauth\"");
-	const refresh = nonEmptyOAuthString(Reflect.get(credential, "refresh"), "refresh");
-	const access = nonEmptyOAuthString(Reflect.get(credential, "access"), "access");
-	const expires = Reflect.get(credential, "expires");
-	if (typeof expires !== "number" || !Number.isFinite(expires)) throw new Error("github-copilot: OAuth credential field \"expires\" must be a finite number");
-	const enterpriseUrl = Reflect.get(credential, "enterpriseUrl");
-	if (enterpriseUrl !== void 0 && (typeof enterpriseUrl !== "string" || enterpriseUrl.trim().length === 0)) throw new Error("github-copilot: OAuth credential field \"enterpriseUrl\" must be a non-empty string");
-	const availableModelIds = Reflect.get(credential, "availableModelIds");
-	if (availableModelIds !== void 0 && (!Array.isArray(availableModelIds) || !availableModelIds.every((modelId) => typeof modelId === "string" && modelId.trim().length > 0))) throw new Error("github-copilot: OAuth credential field \"availableModelIds\" must be an array of non-empty strings");
-	return {
-		type: "oauth",
-		refresh,
-		access,
-		expires,
-		...enterpriseUrl === void 0 ? {} : { enterpriseUrl },
-		...availableModelIds === void 0 ? {} : { availableModelIds: [...new Set(availableModelIds)] }
-	};
-}
-//#endregion
 //#region lib/types/temporary-models.js
 const GPT_6_ASTRA = {
 	id: "gpt-6-astra",
@@ -4061,189 +4801,60 @@ let GitHubCopilotAuthorizationController = (() => {
 					},
 					prompt: (prompt) => {
 						if (prompt.kind === "text" && /GitHub Enterprise URL\/domain/i.test(prompt.message)) return Promise.resolve("");
-						return Promise.reject(/* @__PURE__ */ new Error(`github-copilot: this browser bridge cannot answer authorization prompt "${prompt.message}"`));
-					}
-				}
-			}).then(async (outcome) => {
-				if (outcome.status === "authorized") {
-					this.notices = [];
-					await this.ensureProviderProfile();
-					return;
-				}
-				this.notices = [];
-			}).catch((error) => {
-				this.notices = [];
-				this.failure = messageOf(error);
-				this.ctx.logger.error("github-copilot: GitHub Copilot authorization failed");
-				this.ctx.logger.error(error);
-			}).finally(() => {
-				this.attempt = void 0;
-			});
-			this.attempt = running;
-			return this.status();
-		}
-		async cancel() {
-			const authorization = service(this.ctx, "authorization", [
-				"describe",
-				"begin",
-				"cancel"
-			]);
-			this.notices = [];
-			authorization.cancel(GITHUB_COPILOT_CREDENTIAL_KEY);
-			return this.status();
-		}
-		async signOut() {
-			if (service(this.ctx, "authorization", [
-				"describe",
-				"begin",
-				"cancel"
-			]).describe("llm-pi-ai/github-copilot")?.inFlight === true) throw new Error("github-copilot: cancel the active sign-in attempt before signing out");
-			await service(this.ctx, "credentials", ["describeRecord", "deleteRecord"]).deleteRecord(GITHUB_COPILOT_CREDENTIAL_KEY);
-			this.notices = [];
-			this.failure = void 0;
-			this.reconciliationFailed = false;
-			return this.status();
-		}
-		async ensureProviderProfile() {
-			try {
-				await ensureGitHubCopilotProviderProfile(this.ctx);
-				this.reconciliationFailed = false;
-			} catch {
-				this.reconciliationFailed = true;
-				this.ctx.logger.warn("github-copilot: route reconciliation failed; review route status before retrying");
-			}
-		}
-	};
-})();
-//#endregion
-//#region lib/types/copilot-auth.js
-/**
-* Provider-side GitHub Copilot auth resolution over the same credential record
-* that DSH's built-in llm-pi-ai adapter owns.
-*/
-function credentialService(ctx) {
-	const candidate = ctx.get("credentials");
-	if (typeof candidate !== "object" || candidate === null) throw new Error("github-copilot: DSH credentials service is unavailable");
-	for (const method of [
-		"readRecord",
-		"listRecords",
-		"modifyRecord",
-		"deleteRecord"
-	]) if (typeof Reflect.get(candidate, method) !== "function") throw new Error(`github-copilot: required DSH credentials API "credentials.${method}" is unavailable`);
-	return candidate;
-}
-function toCredential(record) {
-	if (record === void 0) return void 0;
-	if (record.kind === "api-key") return {
-		type: "api_key",
-		...record.key === void 0 ? {} : { key: record.key },
-		...record.env === void 0 ? {} : { env: { ...record.env } }
-	};
-	if (typeof record.payload !== "object" || record.payload === null) throw new Error("github-copilot: stored llm-pi-ai GitHub Copilot grant is not an object");
-	return normalizeGitHubCopilotOAuthCredential(record.payload);
-}
-function toRecord(credential) {
-	if (credential.type === "api_key") return {
-		kind: "api-key",
-		...credential.key === void 0 ? {} : { key: credential.key },
-		...credential.env === void 0 ? {} : { env: { ...credential.env } }
-	};
-	return {
-		kind: "grant",
-		payload: normalizeGitHubCopilotOAuthCredential(credential)
-	};
-}
-/** Bind exactly one logical route to the canonical Host-owned credential record. */
-function createGitHubCopilotCredentialStore(ctx, logicalProviderId = GITHUB_COPILOT_PROVIDER_ID) {
-	const assertProvider = (providerId) => {
-		if (providerId !== logicalProviderId) throw new Error("COPILOT_CREDENTIAL_PROVIDER_MISMATCH");
-	};
-	return {
-		read: async (providerId) => {
-			assertProvider(providerId);
-			return toCredential(await credentialService(ctx).readRecord(GITHUB_COPILOT_CREDENTIAL_KEY));
-		},
-		list: async () => {
-			const record = await credentialService(ctx).readRecord(GITHUB_COPILOT_CREDENTIAL_KEY);
-			return record === void 0 ? [] : [{
-				providerId: logicalProviderId,
-				type: record.kind === "api-key" ? "api_key" : "oauth"
-			}];
-		},
-		modify: async (providerId, mutate) => {
-			assertProvider(providerId);
-			return toCredential(await credentialService(ctx).modifyRecord(GITHUB_COPILOT_CREDENTIAL_KEY, async (current) => {
-				const next = await mutate(toCredential(current));
-				return next === void 0 ? void 0 : toRecord(next);
-			}));
-		},
-		delete: async (providerId) => {
-			assertProvider(providerId);
-			await credentialService(ctx).deleteRecord(GITHUB_COPILOT_CREDENTIAL_KEY);
+						return Promise.reject(/* @__PURE__ */ new Error(`github-copilot: this browser bridge cannot answer authorization prompt "${prompt.message}"`));
+					}
+				}
+			}).then(async (outcome) => {
+				if (outcome.status === "authorized") {
+					this.notices = [];
+					await this.ensureProviderProfile();
+					return;
+				}
+				this.notices = [];
+			}).catch((error) => {
+				this.notices = [];
+				this.failure = messageOf(error);
+				this.ctx.logger.error("github-copilot: GitHub Copilot authorization failed");
+				this.ctx.logger.error(error);
+			}).finally(() => {
+				this.attempt = void 0;
+			});
+			this.attempt = running;
+			return this.status();
 		}
-	};
-}
-/**
-* Build one resolver whose pi-ai collection refreshes OAuth credentials inside
-* the DSH record's serialized modify operation before exposing request auth.
-*/
-function createGitHubCopilotTokenResolver(ctx, onCredentialChanged) {
-	const models = createModels({ credentials: createGitHubCopilotCredentialStore(ctx) });
-	const provider = githubCopilotProvider();
-	if (provider.auth.oauth === void 0) throw new Error("github-copilot: native OAuth method is unavailable");
-	models.setProvider({
-		...provider,
-		auth: { oauth: provider.auth.oauth }
-	});
-	return async (modelId) => {
-		const snapshot = readCopilotCatalog(ctx);
-		const native = new Map(snapshot.models.map((model) => [model.id, model])).get(modelId);
-		if (native === void 0) throw new Error(`github-copilot: pi-ai catalog has no GitHub Copilot model "${modelId}"`);
-		const resolved = await models.getAuth("github-copilot");
-		if (resolved === void 0) return void 0;
-		if (onCredentialChanged !== void 0) try {
-			await onCredentialChanged();
-		} catch (error) {
-			ctx.logger.warn("github-copilot: provider route reconciliation will retry after a later auth resolution");
-			ctx.logger.warn(error);
+		async cancel() {
+			const authorization = service(this.ctx, "authorization", [
+				"describe",
+				"begin",
+				"cancel"
+			]);
+			this.notices = [];
+			authorization.cancel(GITHUB_COPILOT_CREDENTIAL_KEY);
+			return this.status();
+		}
+		async signOut() {
+			if (service(this.ctx, "authorization", [
+				"describe",
+				"begin",
+				"cancel"
+			]).describe("llm-pi-ai/github-copilot")?.inFlight === true) throw new Error("github-copilot: cancel the active sign-in attempt before signing out");
+			await service(this.ctx, "credentials", ["describeRecord", "deleteRecord"]).deleteRecord(GITHUB_COPILOT_CREDENTIAL_KEY);
+			this.notices = [];
+			this.failure = void 0;
+			this.reconciliationFailed = false;
+			return this.status();
+		}
+		async ensureProviderProfile() {
+			try {
+				await ensureGitHubCopilotProviderProfile(this.ctx);
+				this.reconciliationFailed = false;
+			} catch {
+				this.reconciliationFailed = true;
+				this.ctx.logger.warn("github-copilot: route reconciliation failed; review route status before retrying");
+			}
 		}
-		const stored = await credentialService(ctx).readRecord(GITHUB_COPILOT_CREDENTIAL_KEY);
-		if (!(stored?.kind === "grant" && (normalizeGitHubCopilotOAuthCredential(stored.payload).availableModelIds ?? []).includes(modelId))) throw new Error(`github-copilot: model "${modelId}" is not available for the signed-in Copilot account`);
-		const apiKey = resolved.auth.apiKey;
-		if (apiKey === void 0) return void 0;
-		return {
-			apiKey,
-			baseURL: trustedCopilotBaseUrl(resolved.auth.baseUrl ?? native.baseUrl, enterpriseDomainOf(stored)),
-			...resolved.auth.headers === void 0 ? {} : { headers: resolved.auth.headers }
-		};
 	};
-}
-function enterpriseDomainOf(record) {
-	if (record?.kind !== "grant" || typeof record.payload !== "object" || record.payload === null) return void 0;
-	const value = Reflect.get(record.payload, "enterpriseUrl");
-	if (typeof value !== "string" || value.trim().length === 0) return void 0;
-	try {
-		return (value.includes("://") ? new URL(value) : new URL(`https://${value}`)).hostname.toLowerCase();
-	} catch {
-		throw new Error("github-copilot: stored enterpriseUrl is invalid");
-	}
-}
-/** Validate an OAuth-derived endpoint without disclosing its value or credential payload. */
-function trustedGitHubCopilotBaseUrl(value, grant) {
-	return trustedCopilotBaseUrl(value, enterpriseDomainOf({
-		kind: "grant",
-		payload: normalizeGitHubCopilotOAuthCredential(grant)
-	}));
-}
-function trustedCopilotBaseUrl(value, enterpriseDomain) {
-	if (value === void 0) throw new Error("github-copilot: pi-ai resolved no Copilot API base URL");
-	const url = new URL(value);
-	const hostname = url.hostname.toLowerCase();
-	const githubHosted = /^api(?:\.[a-z0-9-]+)+\.githubcopilot\.com$/u.test(hostname);
-	const enterpriseHosted = enterpriseDomain !== void 0 && hostname === `copilot-api.${enterpriseDomain}`;
-	if (!(url.protocol === "https:" && (githubHosted || enterpriseHosted)) || url.username.length > 0 || url.password.length > 0) throw new Error("github-copilot: pi-ai resolved an untrusted Copilot API base URL");
-	return url.origin;
-}
+})();
 //#endregion
 //#region lib/types/tool-schema-compat.js
 const ESCALATION_FIELDS = /* @__PURE__ */ new Set(["sandbox_permissions", "justification"]);
@@ -4644,150 +5255,6 @@ function createAccountProvider(descriptors, guard, baseURL) {
 	};
 }
 //#endregion
-//#region lib/types/account-model-auth.js
-/** Native getAuth renews within five minutes; reserve another thirty seconds for metadata preparation. */
-const ACCOUNT_MODEL_AUTH_MIN_VALIDITY_MS = 33e4;
-/** An opaque, process-local account key. Never a substitute for request credentials. */
-function copilotAccountKey(grant) {
-	return createHash("sha256").update(`${grant.refresh.length}:`).update(grant.refresh).update(grant.enterpriseUrl ?? "").digest("hex");
-}
-/** Compare normalized permission snapshots without retaining model credentials. */
-function copilotEntitlementKey(grant) {
-	const ids = grant.availableModelIds;
-	const normalized = ids === void 0 ? "missing" : JSON.stringify([...new Set(ids)].sort());
-	return createHash("sha256").update(normalized).digest("hex");
-}
-function authEntitlementKey(auth) {
-	return copilotEntitlementKey({ ...auth.availableModelIds === void 0 ? {} : { availableModelIds: [...auth.availableModelIds] } });
-}
-function active(signal) {
-	if (signal.aborted) throw new Error("COPILOT_ACCOUNT_AUTH_ABORTED");
-}
-/**
-* Bind model discovery to the existing native OAuth lifecycle. No model catalog,
-* login, environment fallback or separate credential record is introduced here.
-*/
-function createAccountModelAuth(credentials, renewRejectedCredential) {
-	const native = githubCopilotProvider();
-	const oauth = native.auth.oauth;
-	if (oauth === void 0) throw new Error("COPILOT_ACCOUNT_OAUTH_UNAVAILABLE");
-	const readGrant = async (signal) => {
-		active(signal);
-		const stored = await credentials.read(GITHUB_COPILOT_PROVIDER_ID);
-		active(signal);
-		if (stored?.type !== "oauth") throw new Error("COPILOT_ACCOUNT_OAUTH_REQUIRED");
-		return normalizeGitHubCopilotOAuthCredential(stored);
-	};
-	const matches = (grant, key) => {
-		if (copilotAccountKey(grant) !== key) throw new Error("COPILOT_ACCOUNT_CHANGED");
-	};
-	const current = async (auth, signal) => {
-		active(signal);
-		const grant = await readGrant(signal);
-		matches(grant, auth.accountKey);
-		if (grant.access !== auth.apiKey || grant.expires <= Date.now()) throw new Error("COPILOT_ACCOUNT_TOKEN_CHANGED");
-		if (copilotEntitlementKey(grant) !== authEntitlementKey(auth)) throw new Error("COPILOT_ACCOUNT_ENTITLEMENT_CHANGED");
-		const derived = await oauth.toAuth(grant);
-		active(signal);
-		if (derived.apiKey !== auth.apiKey || trustedGitHubCopilotBaseUrl(derived.baseUrl, grant) !== auth.baseURL) throw new Error("COPILOT_ACCOUNT_AUTH_CHANGED");
-		const latest = await readGrant(signal);
-		matches(latest, auth.accountKey);
-		if (latest.access !== auth.apiKey || latest.expires <= Date.now()) throw new Error("COPILOT_ACCOUNT_TOKEN_CHANGED");
-		if (copilotEntitlementKey(latest) !== authEntitlementKey(auth)) throw new Error("COPILOT_ACCOUNT_ENTITLEMENT_CHANGED");
-	};
-	return {
-		async resolveAuth(signal) {
-			try {
-				const before = await readGrant(signal);
-				const key = copilotAccountKey(before);
-				const rejectedAccess = renewRejectedCredential?.(before) === true ? before.access : void 0;
-				const forResolution = (grant) => rejectedAccess !== void 0 && grant.access === rejectedAccess ? {
-					...grant,
-					expires: 0
-				} : grant;
-				const guardedOAuth = {
-					...oauth,
-					login: async () => {
-						throw new Error("COPILOT_ACCOUNT_USE_CANONICAL_SIGN_IN");
-					},
-					async refresh(credential, requestSignal) {
-						active(signal);
-						matches(normalizeGitHubCopilotOAuthCredential(credential), key);
-						const result = normalizeGitHubCopilotOAuthCredential(await oauth.refresh(credential, requestSignal === void 0 ? signal : AbortSignal.any([signal, requestSignal])));
-						active(signal);
-						matches(result, key);
-						return result;
-					},
-					async toAuth(credential) {
-						active(signal);
-						const grant = normalizeGitHubCopilotOAuthCredential(credential);
-						matches(grant, key);
-						const result = await oauth.toAuth(grant);
-						active(signal);
-						return {
-							...result,
-							baseUrl: trustedGitHubCopilotBaseUrl(result.baseUrl, grant)
-						};
-					}
-				};
-				const models = createModels({ credentials: {
-					read: async (provider) => {
-						const value = await credentials.read(provider);
-						active(signal);
-						if (value?.type !== "oauth") throw new Error("COPILOT_ACCOUNT_OAUTH_REQUIRED");
-						const grant = normalizeGitHubCopilotOAuthCredential(value);
-						matches(grant, key);
-						return forResolution(grant);
-					},
-					list: () => credentials.list(),
-					modify: (provider, mutate) => credentials.modify(provider, async (value) => {
-						active(signal);
-						if (value?.type !== "oauth") throw new Error("COPILOT_ACCOUNT_OAUTH_REQUIRED");
-						matches(normalizeGitHubCopilotOAuthCredential(value), key);
-						const next = await mutate(forResolution(normalizeGitHubCopilotOAuthCredential(value)));
-						active(signal);
-						if (next !== void 0) matches(normalizeGitHubCopilotOAuthCredential(next), key);
-						return next;
-					}),
-					delete: async () => {
-						throw new Error("COPILOT_ACCOUNT_DISCOVERY_CANNOT_SIGN_OUT");
-					}
-				} });
-				models.setProvider({
-					...native,
-					auth: { oauth: guardedOAuth }
-				});
-				const resolved = await models.getAuth(GITHUB_COPILOT_PROVIDER_ID, {
-					signal,
-					minOAuthValidityMs: ACCOUNT_MODEL_AUTH_MIN_VALIDITY_MS
-				});
-				active(signal);
-				if (resolved?.auth.apiKey === void 0) throw new Error("COPILOT_ACCOUNT_OAUTH_REQUIRED");
-				const grant = await readGrant(signal);
-				matches(grant, key);
-				if (rejectedAccess !== void 0 && grant.access === rejectedAccess) throw new Error("COPILOT_ACCOUNT_TOKEN_REJECTED");
-				const auth = {
-					apiKey: resolved.auth.apiKey,
-					baseURL: trustedGitHubCopilotBaseUrl(resolved.auth.baseUrl, grant),
-					accountKey: key,
-					...grant.availableModelIds === void 0 ? {} : { availableModelIds: Object.freeze([...grant.availableModelIds]) }
-				};
-				await current(auth, signal);
-				return Object.freeze(auth);
-			} catch {
-				throw new Error(signal.aborted ? "COPILOT_ACCOUNT_AUTH_ABORTED" : "COPILOT_ACCOUNT_AUTH_FAILED");
-			}
-		},
-		async assertAuthCurrent(auth, signal) {
-			try {
-				await current(auth, signal);
-			} catch {
-				throw new Error(signal.aborted ? "COPILOT_ACCOUNT_AUTH_ABORTED" : "COPILOT_ACCOUNT_AUTH_CHANGED");
-			}
-		}
-	};
-}
-//#endregion
 //#region lib/types/account-model-catalog.js
 /** Pure normalization of account /models metadata; no transport, credentials, or model-name rules. */
 const ACCOUNT_MODEL_CATALOG_LIMITS = Object.freeze({
@@ -6345,6 +6812,7 @@ function activate(ctx, config) {
 	ctx.plugin(GitHubCopilotAuthorizationController);
 	ctx.plugin(GitHubCopilotDualModel);
 	ctx.plugin(SearchRoutingController);
+	ctx.plugin(GitHubCopilotUsageController);
 	const resolveGitHubCopilotToken = createGitHubCopilotTokenResolver(ctx, async () => {
 		await ensureGitHubCopilotProviderProfile(ctx);
 	});