dsh-plugin-subscription-oauth 0.6.1 → 0.8.0

package/lib/index.d.ts

@@ -45,16 +45,22 @@ export interface Config {
      */
     auto?: boolean;
     /**
-     * The credential reference a non-subscription provider's balance query uses, by
-     * provider id.
+     * The balance source a non-subscription provider uses, by provider id.
      *
      * A provider that is not a subscription this plugin serves has no usage windows to
      * meter, so the chip shows its balance instead — read by cc-switch's query, which needs
-     * the provider's API key. The provider's profile names that key by reference
-     * (`apiKeyEnv`), and the host's credential service resolves the name; this map is the
-     * one place a provider id is tied to that reference. A provider with no entry, or
-     * whose key does not resolve, gets no balance and the chip stays silent.
+     * the provider's API key and its own base URL (the balance endpoint lives beside the
+     * provider's OpenAI-compatible wire, not on DeepSeek's). Each entry names the
+     * credential reference the provider's profile uses (`apiKeyEnv`) and the base URL that
+     * profile connects to; the host's credential service resolves the reference. A provider
+     * with no entry, or whose key does not resolve, gets no balance and the chip stays
+     * silent.
      */
+    balanceSources?: Record<string, {
+        credentialRef: string;
+        baseUrl: string;
+    }>;
+    /** @deprecated Use {@link balanceSources}, which carries the base URL too. */
     balanceCredentialRefs?: Record<string, string>;
 }
 /** Configuration schema, with the config file's own defaults applied. */

package/lib/index.js

@@ -42,6 +42,8 @@ export const Config = z.object({
     defaultModel: z.string().default(KIMI_DEFAULT_MODEL),
     extraModels: z.array(z.string()).default([]),
     auto: z.boolean().default(true),
+    balanceSources: z.dict(z.object({ credentialRef: z.string(), baseUrl: z.string() })).default({}),
+    balanceCredentialRefs: z.dict(z.string()).default({}),
 });
 /**
  * Register every configured provider route, its credential store, and — when
@@ -188,13 +190,18 @@ export function apply(ctx, config = {}) {
         handles.set(route.id, handle);
         ctx.effect(() => () => handle(), `${name}: ${route.id} provider route`);
     }
-    // A non-subscription provider's balance is read by cc-switch's query, which needs the
-    // provider's API key. The provider's profile names that key by reference (`apiKeyEnv`),
-    // and the configured map ties a provider id to that reference; the host's credential
-    // service resolves it. The map lives in server config because that is where the rest
-    // of the plugin's wiring is, and the client learns a provider's balance by id, never
-    // by its credential reference.
-    const credentialRefs = config.balanceCredentialRefs ?? {};
+    // A non-subscription provider's balance is read by cc-switch's query against the
+    // provider's own base URL (the balance endpoint lives beside its OpenAI-compatible
+    // wire, not on DeepSeek's), which needs the provider's API key. Each configured source
+    // names the credential reference the provider's profile uses (`apiKeyEnv`) and the base
+    // URL that profile connects to; the host's credential service resolves the reference.
+    const balanceSources = config.balanceSources ?? {};
+    const credentialRefs = { ...config.balanceCredentialRefs };
+    const baseUrls = {};
+    for (const [provider, source] of Object.entries(balanceSources)) {
+        credentialRefs[provider] = source.credentialRef;
+        baseUrls[provider] = source.baseUrl;
+    }
     // The DeepSeek account's balance is read on the node half through the host's
     // `deepseekAccount` service; the browser reaches it through the plugin's own RPC, the
     // same channel as the rest of the chip's data. The service is read lazily, per request
@@ -202,6 +209,7 @@ export function apply(ctx, config = {}) {
     // without it still serves every other endpoint, and the balance endpoint answers nothing.
     const balanceContext = {
         credentialRefs,
+        baseUrls,
         resolveDeepSeekAccount: () => {
             try {
                 return ctx.get('deepseekAccount');
@@ -213,7 +221,20 @@ export function apply(ctx, config = {}) {
         resolveCredential: async (ref) => {
             try {
                 const credentials = ctx.get('credentials');
-                return (await credentials?.resolve?.(ref))?.value;
+                const hit = await credentials?.resolve?.(ref);
+                // The resolve answer is `{ value, source }`; an env-var source may name the var
+                // rather than carry the value, so both are considered before giving up.
+                if (typeof hit === 'object' && hit !== null) {
+                    const record = hit;
+                    if (typeof record.value === 'string' && record.value.trim() !== '')
+                        return record.value;
+                    if (typeof record.source === 'string') {
+                        const fromEnv = process.env[record.source];
+                        if (typeof fromEnv === 'string' && fromEnv.trim() !== '')
+                            return fromEnv;
+                    }
+                }
+                return undefined;
             }
             catch {
                 return undefined;

package/lib/providers/antigravity.d.ts

@@ -218,6 +218,12 @@ export declare class AntigravityAdapter extends LlmAdapter {
     private shippedCatalog;
     resolveModel(_provider: string, model: string): Promise<LlmResolvedModelInfo>;
     stream(options: GenerateOptions): AsyncIterable<StreamChunk>;
+    /** Whether an account is remembered as spent until a future reset. */
+    private isSpent;
+    /** The moment an account's allowance is known to reset, when recorded. */
+    private resetAt;
+    /** Remember an account as spent (its exact reset is learned separately). */
+    private noteSpent;
     /** Translate an auth failure into the message a user can act on. */
     private refreshHint;
     /** Build and send one streaming request for one model. */

package/lib/providers/antigravity.js

@@ -12,6 +12,7 @@
 import { EMPTY_RESPONSE_CODE, errorChain, LlmAdapter, LlmError, } from '@deepseek-ai/dsh-llm';
 import { REAUTH_REQUIRED, ProviderError } from '../errors.js';
 import { attributedHeaders } from '../auth/headers.js';
+import { allowanceScheduler } from '../auth/allowance-scheduler.js';
 import { LoopbackFlow } from '../auth/pkce-flow.js';
 import { TokenStore, finiteInstant, nonEmpty } from '../auth/store.js';
 import { TokenManager } from '../auth/tokens.js';
@@ -415,25 +416,53 @@ export class AntigravityAdapter extends LlmAdapter {
         const watchdog = idleWatchdog(options.signal, this.options.streamIdleTimeoutMs);
         try {
             // `auto` owns the fallback chain now, so this route serves exactly the
-            // model it was asked for.
+            // model it was asked for — but it draws on every account the provider holds, so a
+            // spent allowance moves to the next account rather than failing the call.
             const model = options.model;
+            // Accounts come from the manager when it can list them; a minimal manager (or a
+            // test double) without `accounts()` means a single account, which is just the
+            // default one.
+            const accounts = typeof this.options.tokens.accounts === 'function'
+                ? await this.options.tokens.accounts()
+                : [];
+            const tried = new Set();
             let token = await this.options.tokens.resolve();
-            let response = await this.request(options, model, token.account, token.accessToken, watchdog.signal);
-            if (response.status === 401 || response.status === 403) {
-                // The stored token was accepted locally but refused on the wire; force
-                // one refresh, then report the credential as dead if it still fails.
-                token = await this.options.tokens.resolve(token.account, true);
-                response = await this.request(options, model, token.account, token.accessToken, watchdog.signal);
+            // Move an account known to be spent (from a past failure) to the back, so a fresh
+            // request starts on one that has allowance. A lone account still serves.
+            const order = [...accounts.filter((a) => a !== token.account && !this.isSpent(a)), token.account,
+                ...accounts.filter((a) => a !== token.account && this.isSpent(a))];
+            for (const accountKey of order) {
+                if (tried.has(accountKey))
+                    continue;
+                tried.add(accountKey);
+                token = await this.options.tokens.resolve(accountKey);
+                let response = await this.request(options, model, token.account, token.accessToken, watchdog.signal);
                 if (response.status === 401 || response.status === 403) {
-                    this.options.onCredentialRejected?.(token.account);
+                    // The stored token was accepted locally but refused on the wire; force
+                    // one refresh, then report the credential as dead if it still fails.
+                    token = await this.options.tokens.resolve(token.account, true);
+                    response = await this.request(options, model, token.account, token.accessToken, watchdog.signal);
+                    if (response.status === 401 || response.status === 403) {
+                        this.options.onCredentialRejected?.(token.account);
+                    }
                 }
+                // A spent allowance (402/429) moves to the next account, remembering when this
+                // one refills so later requests skip it until then.
+                if (!response.ok && (response.status === 402 || response.status === 429) && order.length > 1) {
+                    this.noteSpent(token.account);
+                    const resetAt = await this.resetAt(token.account);
+                    allowanceScheduler.noteReset(ANTIGRAVITY_PROVIDER_ID, token.account, resetAt);
+                    continue;
+                }
+                if (!response.ok)
+                    throw await httpLlmError(response, 'Antigravity API');
+                if (response.body === null) {
+                    throw new LlmError('Antigravity API returned no response body', EMPTY_RESPONSE_CODE);
+                }
+                yield* streamAntigravity(response.body, () => { watchdog.pulse(); });
+                return;
             }
-            if (!response.ok)
-                throw await httpLlmError(response, 'Antigravity API');
-            if (response.body === null) {
-                throw new LlmError('Antigravity API returned no response body', EMPTY_RESPONSE_CODE);
-            }
-            yield* streamAntigravity(response.body, () => { watchdog.pulse(); });
+            throw new LlmError('Antigravity API: every account\'s allowance is spent', EMPTY_RESPONSE_CODE);
         }
         catch (error) {
             throw mapFetchFailure('Antigravity API', this.refreshHint(error), watchdog, options.signal);
@@ -442,6 +471,28 @@ export class AntigravityAdapter extends LlmAdapter {
             watchdog.stop();
         }
     }
+    /** Whether an account is remembered as spent until a future reset. */
+    isSpent(account) {
+        return allowanceScheduler.isSpentUntilReset(ANTIGRAVITY_PROVIDER_ID, account);
+    }
+    /** The moment an account's allowance is known to reset, when recorded. */
+    async resetAt(account) {
+        const held = await this.options.tokens.session(account);
+        if (held === undefined)
+            return undefined;
+        try {
+            const read = await this.usage(held.session.accessToken, held.session.projectId ?? '', held.session.email);
+            const spent = read.windows.find((window) => (window.usedPercent ?? 0) >= 100);
+            return spent?.resetsAt;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /** Remember an account as spent (its exact reset is learned separately). */
+    noteSpent(account) {
+        this.options.onWarn?.(`antigravity: account ${account} allowance spent; moving to another account`);
+    }
     /** Translate an auth failure into the message a user can act on. */
     refreshHint(error) {
         if (error instanceof ProviderError && error.code === REAUTH_REQUIRED) {

package/lib/providers/ark-provider.js

@@ -100,6 +100,14 @@ export function createArkProvider(options) {
         discovery: options.discovery,
         streamIdleTimeoutMs: options.streamIdleTimeoutMs,
         tokens,
+        readUsage: async (account) => {
+            const held = await tokens.session(account);
+            const sts = held?.session.sts;
+            if (sts === undefined)
+                return [];
+            const read = await readArkUsage({ credentials: sts, fetchFn });
+            return read.windows;
+        },
         ...options.onWarn === undefined ? {} : { onWarn: options.onWarn },
         ...options.resolveAttachments === undefined ? {} : { resolveAttachments: options.resolveAttachments },
         hiddenModels: () => options.preferences.hiddenIds(ARK_PROVIDER_ID),

package/lib/providers/ark.d.ts

@@ -22,6 +22,7 @@ import type { TokenManager } from '../auth/tokens.js';
 import type { ArkStsCredentials } from '../auth/ark-control.js';
 import type { FetchFn } from '../http.js';
 import type { AttachmentStore } from '@deepseek-ai/dsh-attachment';
+import type { UsageWindow } from '../protocol.js';
 import type { CatalogEntry } from './catalog.js';
 import type { UsageRead } from './usage.js';
 /** Provider route this module serves. */
@@ -91,6 +92,8 @@ export interface ArkAdapterOptions {
     resolveAttachments?: () => AttachmentStore | undefined;
     onWarn?: (message: string) => void;
     onCredentialRejected?: (account: string) => void;
+    /** Read one account's metered windows, so the streamer can steer away from a spent one. */
+    readUsage?: ((account: string) => Promise<readonly UsageWindow[]>) | undefined;
     fetchFn?: FetchFn;
 }
 /** The adapter behind the `ark` route. */

package/lib/providers/ark.js

@@ -21,7 +21,7 @@ import { finiteInstant, nonEmpty } from '../auth/store.js';
 import { callArkControl, parseArkFreeUsage, parseArkPlanUsage } from '../auth/ark-control.js';
 import { proxiedFetch } from '../http.js';
 import { findEntry, resolveCatalog } from './catalog.js';
-import { streamProviderResponses } from './responses-stream.js';
+import { streamProviderResponses, accountPoolHooks } from './responses-stream.js';
 import { toResponsesInput, toResponsesTools } from '../translate/responses.js';
 /** Provider route this module serves. */
 export const ARK_PROVIDER_ID = 'ark';
@@ -167,6 +167,9 @@ export class ArkAdapter extends LlmAdapter {
             tokens: this.options.tokens,
             request: (call, model, accessToken, signal) => this.request(call, model, accessToken, signal),
             streamIdleTimeoutMs: this.options.streamIdleTimeoutMs,
+            // A 402/429 means this account's allowance is spent: draw on the next account's.
+            isAllowanceExhausted: (status) => status === 402 || status === 429,
+            ...accountPoolHooks({ provider: ARK_PROVIDER_ID, tokens: this.options.tokens, readUsage: this.options.readUsage }),
             ...this.options.onCredentialRejected === undefined
                 ? {}
                 : { onCredentialRejected: this.options.onCredentialRejected },

package/lib/providers/glm-provider.js

@@ -110,6 +110,11 @@ export function createGlmProvider(options) {
         ...options.resolveAttachments === undefined ? {} : { resolveAttachments: options.resolveAttachments },
         hiddenModels: () => options.preferences.hiddenIds(GLM_PROVIDER_ID),
         userModels: () => options.preferences.extraIds(GLM_PROVIDER_ID),
+        readUsage: async (account) => {
+            const token = await tokens.resolve(account);
+            const read = await readGlmUsage({ origin: GLM_ORIGIN, accessToken: token.accessToken, fetchFn });
+            return read.windows;
+        },
         ...options.extraModels === undefined ? {} : { extraModels: options.extraModels },
         fetchFn,
     });

package/lib/providers/glm.d.ts

@@ -86,6 +86,8 @@ export interface GlmAdapterOptions {
     resolveAttachments?: () => AttachmentStore | undefined;
     onWarn?: (message: string) => void;
     onCredentialRejected?: (account: string) => void;
+    /** Read one account's metered windows, so the streamer can steer away from a spent one. */
+    readUsage?: ((account: string) => Promise<readonly UsageWindow[]>) | undefined;
     /** Fetch implementation; defaults to the proxy-aware fetch. */
     fetchFn?: FetchFn;
 }

package/lib/providers/glm.js

@@ -13,7 +13,7 @@ import { REAUTH_REQUIRED, ProviderError } from '../errors.js';
 import { finiteInstant, nonEmpty } from '../auth/store.js';
 import { proxiedFetch } from '../http.js';
 import { findEntry, resolveCatalog } from './catalog.js';
-import { streamProviderResponses } from './responses-stream.js';
+import { streamProviderResponses, accountPoolHooks } from './responses-stream.js';
 import { toResponsesInput, toResponsesTools } from '../translate/responses.js';
 /** Provider route this module serves. */
 export const GLM_PROVIDER_ID = 'glm';
@@ -278,6 +278,9 @@ export class GlmAdapter extends LlmAdapter {
             tokens: this.options.tokens,
             request: (call, model, accessToken, signal) => this.request(call, model, accessToken, signal),
             streamIdleTimeoutMs: this.options.streamIdleTimeoutMs,
+            // A 402/429 means this account's allowance is spent: draw on the next account's.
+            isAllowanceExhausted: (status) => status === 402 || status === 429,
+            ...accountPoolHooks({ provider: GLM_PROVIDER_ID, tokens: this.options.tokens, readUsage: this.options.readUsage }),
             ...this.options.onCredentialRejected === undefined
                 ? {}
                 : { onCredentialRejected: this.options.onCredentialRejected },

package/lib/providers/grok.d.ts

@@ -18,6 +18,7 @@ import type { ProviderRoute } from '../auth/registry.js';
 import type { ModelPreferences } from '../settings.js';
 import type { FetchFn } from '../http.js';
 import type { CatalogEntry } from './catalog.js';
+import type { UsageWindow } from '../protocol.js';
 /** Route key this module registers. */
 export declare const GROK_PROVIDER_ID = "grok";
 /** Display name for selectors and diagnostics. */
@@ -135,6 +136,8 @@ export interface GrokAdapterOptions {
     modelOrder?: () => Promise<readonly string[]>;
     fetchFn?: FetchFn;
     onCredentialRejected?: (account: string) => void;
+    /** Read one account's metered windows, so the streamer can steer away from a spent one. */
+    readUsage?: ((account: string) => Promise<readonly UsageWindow[]>) | undefined;
 }
 /** Grok wire adapter: one instance serves the `grok` provider route. */
 export declare class GrokAdapter extends LlmAdapter {

package/lib/providers/grok.js

@@ -18,7 +18,7 @@ import { ProviderController } from '../auth/provider-controller.js';
 import { proxiedFetch } from '../http.js';
 import { fallbackEntry, findEntry, resolveCatalog } from './catalog.js';
 import { isMissingOrInvalidCredential } from './common.js';
-import { streamProviderResponses } from './responses-stream.js';
+import { streamProviderResponses, accountPoolHooks } from './responses-stream.js';
 import { readGrokUsage } from './usage.js';
 import { toResponsesInput, toResponsesTools } from '../translate/responses.js';
 /** Route key this module registers. */
@@ -334,6 +334,9 @@ export class GrokAdapter extends LlmAdapter {
             tokens: this.options.tokens,
             request: (call, model, accessToken, signal) => this.request(call, model, accessToken, signal),
             streamIdleTimeoutMs: this.options.streamIdleTimeoutMs,
+            // A 402/429 means this account's allowance is spent: draw on the next account's.
+            isAllowanceExhausted: (status) => status === 402 || status === 429,
+            ...accountPoolHooks({ provider: GROK_PROVIDER_ID, tokens: this.options.tokens, readUsage: this.options.readUsage }),
             ...this.options.onCredentialRejected === undefined
                 ? {}
                 : { onCredentialRejected: this.options.onCredentialRejected },
@@ -648,6 +651,11 @@ export function createGrokProvider(options) {
         hiddenModels: () => options.preferences.hiddenIds(GROK_PROVIDER_ID),
         userModels: () => options.preferences.extraIds(GROK_PROVIDER_ID),
         modelOrder: () => options.preferences.orderOf(GROK_PROVIDER_ID),
+        readUsage: async (account) => {
+            const token = await tokens.resolve(account);
+            const read = await readGrokUsage({ accessToken: token.accessToken, fetchFn: options.discoveryFetchFn ?? proxiedFetch });
+            return read === undefined ? [] : read.windows;
+        },
         ...options.discoveryFetchFn === undefined ? {} : { fetchFn: options.discoveryFetchFn },
     });
     const spec = {

package/lib/providers/kimi-provider.js

@@ -90,6 +90,11 @@ export function createKimiProvider(options) {
         ...options.onWarn === undefined ? {} : { onWarn: options.onWarn },
         ...options.resolveAttachments === undefined ? {} : { resolveAttachments: options.resolveAttachments },
         identityHeaders: async () => kimiIdentityHeaders(await loadOrCreateDeviceId(options.dataDir)),
+        readUsage: async (account) => {
+            const token = await tokens.resolve(account);
+            const read = await readKimiUsage({ apiBase: options.apiBase, accessToken: token.accessToken, fetchFn });
+            return read === undefined ? [] : read.windows;
+        },
         hiddenModels: () => options.preferences.hiddenIds(KIMI_PROVIDER_ID),
         userModels: () => options.preferences.extraIds(KIMI_PROVIDER_ID),
         modelOrder: () => options.preferences.orderOf(KIMI_PROVIDER_ID),

package/lib/providers/kimi.d.ts

@@ -10,6 +10,7 @@ import type { AttachmentStore } from '@deepseek-ai/dsh-attachment';
 import type { FetchFn } from '../http.js';
 import type { TokenManager } from '../auth/tokens.js';
 import type { SessionBase } from '../auth/store.js';
+import type { UsageWindow } from '../protocol.js';
 import type { CatalogEntry } from './catalog.js';
 /** One catalog entry exposed as a selectable model. */
 export type KimiModelEntry = CatalogEntry;
@@ -62,6 +63,14 @@ export interface KimiAdapterOptions {
     fetchFn?: FetchFn;
     /** Called when a call proved the stored credential unusable. */
     onCredentialRejected?: (account: string) => void;
+    /**
+     * Read one account's metered windows, so the streamer can steer away from an account
+     * whose allowance is spent before it fails there.
+     *
+     * Resolved per request; absence means the streamer only learns an account is spent by
+     * failing against it once.
+     */
+    readUsage?: (account: string) => Promise<readonly UsageWindow[]>;
     /** Extra model ids from the plugin configuration, appended to the catalog. */
     extraModels?: readonly string[];
     /**

package/lib/providers/kimi.js

@@ -11,7 +11,7 @@ import { kimiRequestHeaders } from '../auth/headers.js';
 import { REAUTH_REQUIRED, ProviderError } from '../errors.js';
 import { finiteInstant, nonEmpty } from '../auth/store.js';
 import { idleWatchdog, httpLlmError, isMissingOrInvalidCredential, mapFetchFailure } from './common.js';
-import { streamProviderResponses } from './responses-stream.js';
+import { streamProviderResponses, accountPoolHooks } from './responses-stream.js';
 import { fallbackEntry, findEntry, resolveCatalog } from './catalog.js';
 import { streamResponses, toResponsesInput, toResponsesTools } from '../translate/responses.js';
 import { prepareMoonshotTool } from '../translate/moonshot-schema.js';
@@ -228,6 +228,13 @@ export class KimiAdapter extends LlmAdapter {
             tokens: this.options.tokens,
             request: (call, model, accessToken, signal) => this.request(call, model, accessToken, signal),
             streamIdleTimeoutMs: this.options.streamIdleTimeoutMs,
+            // A 402/429 means this account's allowance is spent: draw on the next account's
+            // before giving up, so one model id uses the whole pool's quota.
+            isAllowanceExhausted: (status) => status === 402 || status === 429,
+            ...accountPoolHooks({ provider: KIMI_PROVIDER_ID, tokens: this.options.tokens, readUsage: this.options.readUsage }),
+            onAccountSwitch: (from, to, reason) => {
+                this.options.onWarn?.(`kimi: account ${from} allowance spent (${reason}); switching to ${to}`);
+            },
             ...this.options.onCredentialRejected === undefined
                 ? {}
                 : { onCredentialRejected: this.options.onCredentialRejected },

package/lib/providers/responses-stream.d.ts

@@ -14,6 +14,24 @@
 import type { GenerateOptions, StreamChunk } from '@deepseek-ai/dsh-llm';
 import type { SessionBase } from '../auth/store.js';
 import type { TokenManager } from '../auth/tokens.js';
+import type { UsageWindow } from '../protocol.js';
+/**
+ * Build the cross-account hooks one route needs to draw on its whole account pool.
+ *
+ * Every Responses-wire route (Kimi, Grok, GLM, Ark) meters per account and can run out;
+ * this wires the three account hooks identically, so a route only supplies how to read
+ * one account's allowance and its provider id. A route with no `readUsage` still rotates
+ * accounts on failure, it just cannot predict exhaustion before the first failure.
+ *
+ * @param provider - the provider route id, the scheduler's key.
+ * @param tokens - the route's token manager, enumerates accounts.
+ * @param readUsage - read one account's metered windows, when wired.
+ */
+export declare function accountPoolHooks<S extends SessionBase>(input: {
+    provider: string;
+    tokens: TokenManager<S>;
+    readUsage?: ((account: string) => Promise<readonly UsageWindow[]>) | undefined;
+}): Pick<ResponsesStreamInput<S>, 'accounts' | 'isAccountSpent' | 'noteAccountSpent' | 'resetsAt'>;
 /** Constructor inputs for {@link streamProviderResponses}. */
 export interface ResponsesStreamInput<S extends SessionBase> {
     /** Endpoint name used in failure messages, e.g. `Kimi API`. */
@@ -37,6 +55,32 @@ export interface ResponsesStreamInput<S extends SessionBase> {
     describeFailure?(error: unknown): unknown;
     /** Called when a model in the chain was skipped, with the reason. */
     onFallback?: (from: string, to: string, reason: string) => void;
+    /**
+     * Whether a 402/429 on this provider means "this account's allowance is spent",
+     * so the call should move to the next account rather than fail.
+     *
+     * When omitted, an exhausted allowance fails the call (the old behaviour). When
+     * set, the caller enumerates the provider's other accounts and retries each until
+     * one serves the request or every account is spent.
+     */
+    isAllowanceExhausted?: (status: number) => boolean;
+    /** Enumerate the provider's accounts, most preferred first; enables cross-account retry. */
+    accounts?: () => Promise<readonly string[]>;
+    /** Called when a call moved to another account because the first was spent. */
+    onAccountSwitch?: (from: string, to: string, reason: string) => void;
+    /**
+     * Whether one account's allowance is best not used for a fresh request right now.
+     *
+     * The caller supplies this to steer a request away from an account that is nearly
+     * spent (or already spent until a remembered reset), so the request starts on a fuller
+     * account instead of failing once to find out. It may read the account's live figures;
+     * an account flagged here is tried last, not skipped, so a lone account still serves.
+     */
+    isAccountSpent?: (account: string) => Promise<boolean>;
+    /** Remember that an account's allowance is spent until a given reset moment. */
+    noteAccountSpent?: (account: string, resetsAt: number | undefined) => void;
+    /** The moment one account's allowance is known to reset, when it was recorded. */
+    resetsAt?: (account: string) => Promise<number | undefined>;
 }
 /**
  * Run one model call over the Responses wire, walking a model chain.