dsh-plugin-subscriptions 0.5.2 → 0.5.3

package/lib/providers/pool-usage.js

@@ -0,0 +1,130 @@
+/**
+ * Quota tracking for pool members: polls the providers' usage endpoints
+ * (the same normalized `ProviderUsage` shape the Settings page consumes) and
+ * turns the windows into a scheduling score.
+ *
+ * The score is a REQUIRED BURN RATE: the fraction of the window that must be
+ * consumed per millisecond for the quota to be exactly used up at reset time
+ * (`remaining / timeUntilReset`). Subscription quota does not roll over, so a
+ * window about to reset with plenty left is the most urgent to spend — the
+ * `quota_aware` strategy therefore prefers the highest-urgency member, which
+ * over time converges on every window hitting zero right at its reset.
+ */
+import { isMissingOrInvalidCredential } from './common.js';
+/** A member is taken out of rotation once any window crosses this fill level. */
+export const QUOTA_FULL_PERCENT = 95;
+/** How long a usage snapshot is trusted before a background refresh. */
+export const USAGE_TTL_MS = 5 * 60_000;
+/** Assumed window length when the provider discloses no `resetsAt`. */
+const FALLBACK_HORIZON_MS = {
+    session: 5 * 60 * 60_000,
+    weekly: 7 * 24 * 60 * 60_000,
+    other: 30 * 24 * 60 * 60_000,
+};
+/**
+ * Per-ACCOUNT usage snapshots with in-flight dedupe and
+ * stale-while-revalidate refresh. Providers without a usage endpoint
+ * (copilot) resolve no fetcher and score a constant zero urgency — which
+ * naturally ranks them behind every measured member. Fetchers are resolved
+ * lazily per (provider, account) so accounts added after startup join
+ * tracking on their first score.
+ */
+export class PoolUsageTracker {
+    fetcherFor;
+    ttlMs;
+    entries = new Map();
+    inflight = new Map();
+    constructor(fetcherFor, ttlMs = USAGE_TTL_MS) {
+        this.fetcherFor = fetcherFor;
+        this.ttlMs = ttlMs;
+    }
+    /**
+     * The quota view of one member. A cold cache awaits the first fetch; a
+     * stale one answers immediately while the refresh serves the NEXT call
+     * (member selection must never block on the network mid-conversation).
+     * @param member - the pool member to score (account resolved).
+     * @returns availability plus the urgency score.
+     */
+    async quotaFor(member) {
+        const key = `${member.provider}/${member.account}`;
+        const fetcher = this.fetcherFor(member.provider, member.account);
+        if (fetcher === undefined)
+            return { available: true, urgency: 0, fetchedAt: 0 };
+        const entry = this.entries.get(key);
+        if (entry !== undefined && Date.now() - entry.at < this.ttlMs) {
+            return this.score(member, entry);
+        }
+        if (entry !== undefined) {
+            void this.refresh(key, fetcher).catch(() => undefined);
+            return this.score(member, entry);
+        }
+        try {
+            const snapshot = await this.refresh(key, fetcher);
+            return this.score(member, { snapshot, at: Date.now() });
+        }
+        catch (error) {
+            // Logged out: the member cannot serve at all. Any other failure
+            // (network, endpoint rate limit) must not block routing — the member
+            // stays available with a zero score, degrading the strategy to plain
+            // priority order for it.
+            return isMissingOrInvalidCredential(error)
+                ? { available: false, urgency: 0, fetchedAt: 0 }
+                : { available: true, urgency: 0, fetchedAt: 0 };
+        }
+    }
+    /** Drop cached snapshots: one account, or a whole provider when `account` is omitted. */
+    invalidate(provider, account) {
+        if (account !== undefined) {
+            this.entries.delete(`${provider}/${account}`);
+            return;
+        }
+        for (const key of [...this.entries.keys()]) {
+            if (key.startsWith(`${provider}/`))
+                this.entries.delete(key);
+        }
+    }
+    /** Run (or join) the single in-flight fetch for one account key. */
+    refresh(key, fetcher) {
+        let pending = this.inflight.get(key);
+        if (pending === undefined) {
+            pending = fetcher().then((snapshot) => {
+                this.entries.set(key, { snapshot, at: Date.now() });
+                return snapshot;
+            }).finally(() => {
+                this.inflight.delete(key);
+            });
+            this.inflight.set(key, pending);
+        }
+        return pending;
+    }
+    /** Score one member against a snapshot's windows. */
+    score(member, entry) {
+        const windows = (entry.snapshot.windows ?? []).filter(window => windowApplies(window, member.model));
+        let available = true;
+        let urgency = 0;
+        for (const window of windows) {
+            if (window.usedPercent >= QUOTA_FULL_PERCENT)
+                available = false;
+            urgency = Math.max(urgency, windowUrgency(window));
+        }
+        return { available, urgency, fetchedAt: entry.at };
+    }
+}
+/**
+ * Whether a window constrains this model: unscoped windows always do; a
+ * model-scoped window (Claude's Opus/Sonnet lanes) applies when its scope
+ * names the model family.
+ */
+function windowApplies(window, model) {
+    if (window.scope === undefined)
+        return true;
+    return model.toLowerCase().includes(window.scope.toLowerCase());
+}
+/** The required burn rate of one window (fraction per ms). */
+function windowUrgency(window, now = Date.now()) {
+    const remaining = Math.max(0, 1 - window.usedPercent / 100);
+    const horizon = window.resetsAt !== undefined
+        ? Math.max(window.resetsAt - now, 1)
+        : FALLBACK_HORIZON_MS[window.kind];
+    return remaining / horizon;
+}

package/lib/providers/pool.d.ts

@@ -0,0 +1,107 @@
+/**
+ * The pool adapter: same-subscription account routing, plus optional
+ * configured tier extras. The picker is the union of every account's
+ * catalog. A model listed by several accounts failovers; a model listed by
+ * one account is pinned to it. Tiers are extra picker rows. Member
+ * selection is sticky per session (so prompt caches survive) and optionally
+ * quota-aware; failures fail over to the next member as long as no stream
+ * chunk has been emitted.
+ */
+import { LlmAdapter } from '@deepseek-ai/dsh-llm';
+import type { GenerateOptions, LlmModelInfo, LlmResolvedModelInfo, StreamChunk } from '@deepseek-ai/dsh-llm';
+import type { ProviderId } from '../auth/store.js';
+import type { AccountAwareAdapter } from './accounts.js';
+import type { PoolDefinition, PoolMemberRef } from './pool-family.js';
+import { PoolHealthRegistry } from './pool-health.js';
+import type { PoolUsageTracker } from './pool-usage.js';
+/** Member-selection strategy: plain priority failover or quota-aware scheduling. */
+export type PoolStrategy = 'priority' | 'quota_aware';
+export interface PoolAdapterOptions {
+    /** The live subscription adapters, by provider route. */
+    adapters: Partial<Record<ProviderId, AccountAwareAdapter>>;
+    health: PoolHealthRegistry;
+    usage: PoolUsageTracker;
+    strategy: PoolStrategy;
+    /** A challenger must out-urgency the sticky member by this factor to take over. */
+    switchMargin: number;
+    /** The default account of one provider (for config members omitting `account`). */
+    defaultAccount: (provider: ProviderId) => Promise<string | undefined>;
+    /** Account pools (auto-aggregated plus config overrides), resolved lazily. */
+    families: () => Promise<Map<string, PoolDefinition>>;
+    /** User-configured extra picker entries (heterogeneous fallbacks), by pool id. */
+    tiers: Record<string, PoolMemberRef[]>;
+    onWarn: (message: string) => void;
+}
+export declare class PoolAdapter extends LlmAdapter {
+    private readonly options;
+    /** sessionId|poolId → member key of the last member that served a chunk. */
+    private readonly sticky;
+    /** Messages already warned about — configuration diagnostics repeat every request otherwise. */
+    private readonly warned;
+    /**
+     * Short-lived pools snapshot. `owns()` runs on every resolveModel — the
+     * model picker issues one per entry — and pool assembly touches every
+     * provider's catalog and account store, so recompute at most this often.
+     * Auth changes bump {@link generation} so a stale snapshot cannot land.
+     */
+    private poolsCache;
+    private poolsInflight;
+    private generation;
+    constructor(options: PoolAdapterOptions);
+    /** Drop the pools snapshot so the next read reflects the current accounts. */
+    invalidate(): void;
+    /** Warn once per distinct message (pools() runs on every request). */
+    private warnOnce;
+    /** Drop members whose adapter is not registered (copy — caller state is shared). */
+    private usable;
+    /** Account pools (auto-aggregated plus config overrides) with usable members. */
+    private familyPools;
+    /** All pools (account pools merged with extra tiers) with usable members. */
+    private pools;
+    /** Recompute the pools snapshot (account pools merged with extra tiers). */
+    private assemblePools;
+    /**
+     * Extra picker rows one provider lists (configured tiers). Account pools
+     * reuse the catalog entry of the same wire id, so they are not listed
+     * again — the picker stays one row per model in ChatGPT / Claude / ….
+     */
+    modelsForProvider(provider: ProviderId): Promise<LlmModelInfo[]>;
+    /**
+     * Whether `model` on `provider`'s route is served here (several accounts
+     * fail over, one account is pinned, or a configured tier).
+     */
+    owns(provider: ProviderId, model: string): Promise<boolean>;
+    /**
+     * Resolve every member's account (config members may omit it to mean "the
+     * default account") and drop members with no resolvable login. Duplicates
+     * collapse — an explicitly pinned account and the default may coincide.
+     */
+    private concrete;
+    /**
+     * Resolve a pool model to the conservative INTERSECTION of its members'
+     * capabilities: the smallest context window and output cap, the reasoning
+     * efforts every member supports, and the modalities all of them accept —
+     * so a request valid for the pool stays valid after a failover. Capability
+     * metadata is provider-level, so each provider resolves once regardless of
+     * how many accounts it pools.
+     */
+    resolveModel(provider: string, model: string): Promise<LlmResolvedModelInfo>;
+    stream(options: GenerateOptions): AsyncIterable<StreamChunk>;
+    /**
+     * Order the candidates for one request. Health filters both strategies;
+     * `quota_aware` then ranks by urgency (members without telemetry, e.g.
+     * copilot, score zero and sink to the bottom of their class), while
+     * quota-exhausted members stay as a last-resort tail in pool order. The
+     * sticky member keeps its lead unless a challenger out-scores it by
+     * `switchMargin`.
+     */
+    private select;
+    /** Pin the serving member to the session (with bounded memory). */
+    private remember;
+    /**
+     * The error for an exhausted pool, carrying the earliest recovery hint of
+     * THIS pool's members (the health registry is shared across pools, so the
+     * hint is scoped to the keys this pool can actually recover through).
+     */
+    private exhausted;
+}

package/lib/providers/pool.js

@@ -0,0 +1,371 @@
+/**
+ * The pool adapter: same-subscription account routing, plus optional
+ * configured tier extras. The picker is the union of every account's
+ * catalog. A model listed by several accounts failovers; a model listed by
+ * one account is pinned to it. Tiers are extra picker rows. Member
+ * selection is sticky per session (so prompt caches survive) and optionally
+ * quota-aware; failures fail over to the next member as long as no stream
+ * chunk has been emitted.
+ */
+import { EMPTY_RESPONSE_CODE, LlmAdapter, LlmError, QUOTA_EXCEEDED_CODE, } from '@deepseek-ai/dsh-llm';
+import { poolKey } from './pool-family.js';
+import { accountKey, classifyPoolFailure, memberKey, PoolHealthRegistry } from './pool-health.js';
+/** Bound on sticky-session memory; oldest entries evict past it. */
+const STICKY_SESSION_LIMIT = 1000;
+/** Display form of one member (account shown when pinned). */
+function memberLabel(member) {
+    return member.account === undefined
+        ? `${member.provider}/${member.model}`
+        : `${member.provider}/${member.account}/${member.model}`;
+}
+/** How long a pools snapshot is trusted (auth changes invalidate immediately). */
+const POOLS_CACHE_TTL_MS = 5_000;
+export class PoolAdapter extends LlmAdapter {
+    options;
+    /** sessionId|poolId → member key of the last member that served a chunk. */
+    sticky = new Map();
+    /** Messages already warned about — configuration diagnostics repeat every request otherwise. */
+    warned = new Set();
+    /**
+     * Short-lived pools snapshot. `owns()` runs on every resolveModel — the
+     * model picker issues one per entry — and pool assembly touches every
+     * provider's catalog and account store, so recompute at most this often.
+     * Auth changes bump {@link generation} so a stale snapshot cannot land.
+     */
+    poolsCache;
+    poolsInflight;
+    generation = 0;
+    constructor(options) {
+        super();
+        this.options = options;
+    }
+    /** Drop the pools snapshot so the next read reflects the current accounts. */
+    invalidate() {
+        this.generation += 1;
+        this.poolsCache = undefined;
+        this.poolsInflight = undefined;
+    }
+    /** Warn once per distinct message (pools() runs on every request). */
+    warnOnce(message) {
+        if (this.warned.has(message))
+            return;
+        this.warned.add(message);
+        this.options.onWarn(message);
+    }
+    /** Drop members whose adapter is not registered (copy — caller state is shared). */
+    usable(pools) {
+        const result = new Map(pools);
+        for (const [id, definition] of [...result]) {
+            const kept = definition.members.filter(member => this.options.adapters[member.provider] !== undefined);
+            if (kept.length === 0)
+                result.delete(id);
+            else if (kept.length < definition.members.length)
+                result.set(id, { ...definition, members: kept });
+        }
+        return result;
+    }
+    /** Account pools (auto-aggregated plus config overrides) with usable members. */
+    async familyPools() {
+        return this.usable(new Map(await this.options.families()));
+    }
+    /** All pools (account pools merged with extra tiers) with usable members. */
+    async pools() {
+        const cached = this.poolsCache;
+        if (cached !== undefined && Date.now() - cached.at < POOLS_CACHE_TTL_MS)
+            return cached.pools;
+        const gen = this.generation;
+        this.poolsInflight ??= this.assemblePools()
+            .then((pools) => {
+            if (this.generation === gen)
+                this.poolsCache = { at: Date.now(), pools };
+            return pools;
+        })
+            .finally(() => {
+            this.poolsInflight = undefined;
+        });
+        return this.poolsInflight;
+    }
+    /** Recompute the pools snapshot (account pools merged with extra tiers). */
+    async assemblePools() {
+        const pools = await this.familyPools();
+        for (const [id, members] of Object.entries(this.options.tiers)) {
+            if (members.length === 0)
+                continue;
+            const owner = members[0].provider;
+            const key = poolKey(owner, id);
+            if (pools.has(key))
+                this.warnOnce(`tier pool "${id}" overrides the account pool of the same id under ${owner}`);
+            pools.set(key, { members, extra: true });
+        }
+        return this.usable(pools);
+    }
+    /**
+     * Extra picker rows one provider lists (configured tiers). Account pools
+     * reuse the catalog entry of the same wire id, so they are not listed
+     * again — the picker stays one row per model in ChatGPT / Claude / ….
+     */
+    async modelsForProvider(provider) {
+        const pools = await this.pools();
+        const models = [];
+        for (const [key, definition] of pools) {
+            if (definition.extra !== true)
+                continue;
+            if (!key.startsWith(`${provider}/`))
+                continue;
+            const id = key.slice(provider.length + 1);
+            models.push({
+                provider,
+                id,
+                name: definition.name ?? id,
+                ...definition.description === undefined ? {} : { description: definition.description },
+            });
+        }
+        return models;
+    }
+    /**
+     * Whether `model` on `provider`'s route is served here (several accounts
+     * fail over, one account is pinned, or a configured tier).
+     */
+    async owns(provider, model) {
+        return (await this.pools()).has(poolKey(provider, model));
+    }
+    /**
+     * Resolve every member's account (config members may omit it to mean "the
+     * default account") and drop members with no resolvable login. Duplicates
+     * collapse — an explicitly pinned account and the default may coincide.
+     */
+    async concrete(members) {
+        const seen = new Set();
+        const resolved = [];
+        for (const member of members) {
+            const account = member.account ?? await this.options.defaultAccount(member.provider);
+            if (account === undefined)
+                continue;
+            const key = memberKey(member.provider, account, member.model);
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            resolved.push({ provider: member.provider, account, model: member.model });
+        }
+        return resolved;
+    }
+    /**
+     * Resolve a pool model to the conservative INTERSECTION of its members'
+     * capabilities: the smallest context window and output cap, the reasoning
+     * efforts every member supports, and the modalities all of them accept —
+     * so a request valid for the pool stays valid after a failover. Capability
+     * metadata is provider-level, so each provider resolves once regardless of
+     * how many accounts it pools.
+     */
+    async resolveModel(provider, model) {
+        const definition = (await this.pools()).get(poolKey(provider, model));
+        if (definition === undefined)
+            throw new LlmError(`unknown pool model "${model}"`, 'NO_ADAPTER');
+        const resolved = [];
+        let lastFailure;
+        const seenProviders = new Set();
+        for (const member of definition.members) {
+            if (seenProviders.has(member.provider))
+                continue;
+            seenProviders.add(member.provider);
+            const adapter = this.options.adapters[member.provider];
+            if (adapter === undefined)
+                continue;
+            // Tolerate per-member failures (a misconfigured tier member, a
+            // logged-out provider throwing AUTH): the pool serves as long as ONE
+            // member resolves, mirroring stream()'s failover semantics.
+            try {
+                resolved.push(await adapter.resolveOwnModel(member.provider, member.model));
+            }
+            catch (error) {
+                lastFailure = error;
+                this.warnOnce(`pool "${model}": member ${memberLabel(member)} failed to resolve`
+                    + ` (${error instanceof Error ? error.message : String(error)}); excluding it`);
+            }
+        }
+        if (resolved.length === 0) {
+            throw new LlmError(`pool "${model}" has no usable member`, 'NO_ADAPTER', {
+                ...lastFailure === undefined ? {} : { cause: lastFailure },
+            });
+        }
+        const contextWindows = resolved.map(info => info.context?.contextWindow).filter(isNumber);
+        const maxTokens = resolved.map(info => info.defaultMaxTokens).filter(isNumber);
+        const reasoning = intersectReasoning(resolved);
+        const modalities = intersectModalities(resolved);
+        return {
+            provider,
+            id: model,
+            name: definition.name ?? model,
+            ...definition.description === undefined ? {} : { description: definition.description },
+            ...contextWindows.length > 0 ? { context: { contextWindow: Math.min(...contextWindows) } } : {},
+            ...maxTokens.length > 0 ? { defaultMaxTokens: Math.min(...maxTokens) } : {},
+            ...reasoning === undefined ? {} : { reasoning },
+            ...modalities === undefined ? {} : { inputModalities: modalities },
+        };
+    }
+    async *stream(options) {
+        const definition = (await this.pools()).get(poolKey(options.provider, options.model));
+        if (definition === undefined)
+            throw new LlmError(`unknown pool model "${options.model}"`, 'NO_ADAPTER');
+        const members = await this.concrete(definition.members);
+        const candidates = await this.select(options.model, members, options.sessionId);
+        if (candidates.length === 0)
+            throw this.exhausted(options.model, members);
+        let lastError;
+        for (const member of candidates) {
+            const adapter = this.options.adapters[member.provider];
+            if (adapter === undefined)
+                continue;
+            const iterator = adapter.streamAccount({ ...options, provider: member.provider, model: member.model }, member.account)[Symbol.asyncIterator]();
+            let first;
+            try {
+                first = await iterator.next();
+                if (first.done === true) {
+                    throw new LlmError(`${memberLabel(member)} returned an empty stream`, EMPTY_RESPONSE_CODE);
+                }
+            }
+            catch (error) {
+                const classification = classifyPoolFailure(error, member.provider);
+                if (classification.action === 'throw')
+                    throw error;
+                if ('cooldownMs' in classification) {
+                    this.options.health.markUnavailable(classification.scope === 'account'
+                        ? accountKey(member.provider, member.account)
+                        : memberKey(member.provider, member.account, member.model), classification.cooldownMs, classification.reason);
+                    // A quota failure invalidates the cached usage snapshot so the NEXT
+                    // selection re-polls instead of trusting minutes-old percentages.
+                    // Transient/auth failures say nothing about quota — keep the cache.
+                    if (classification.reason === QUOTA_EXCEEDED_CODE || classification.reason === 'RATE_LIMIT') {
+                        this.options.usage.invalidate(member.provider, member.account);
+                    }
+                }
+                this.options.onWarn(`pool "${options.model}": ${memberLabel(member)} failed before any output`
+                    + ` (${error instanceof Error ? error.message : String(error)}); trying the next member`);
+                lastError = error;
+                continue;
+            }
+            this.remember(options.model, options.sessionId, member);
+            // Past the first chunk there is no clean attempt boundary: whatever
+            // the member does next (including failing) reaches the caller as-is.
+            // The finally closes the member stream when the CALLER walks away
+            // early (break / .return()) — manual iteration does not propagate
+            // closure the way `yield*` would, and a half-consumed member stream
+            // must not linger holding its connection.
+            try {
+                yield first.value;
+                for (let next = await iterator.next(); next.done !== true; next = await iterator.next()) {
+                    yield next.value;
+                }
+            }
+            finally {
+                try {
+                    await iterator.return?.();
+                }
+                catch {
+                    // Closing a half-consumed member stream must not mask the outcome.
+                }
+            }
+            return;
+        }
+        throw this.exhausted(options.model, members, lastError);
+    }
+    /**
+     * Order the candidates for one request. Health filters both strategies;
+     * `quota_aware` then ranks by urgency (members without telemetry, e.g.
+     * copilot, score zero and sink to the bottom of their class), while
+     * quota-exhausted members stay as a last-resort tail in pool order. The
+     * sticky member keeps its lead unless a challenger out-scores it by
+     * `switchMargin`.
+     */
+    async select(poolId, members, sessionId) {
+        const usable = members.filter(member => this.options.adapters[member.provider] !== undefined
+            && this.options.health.isMemberAvailable(member.provider, member.account, member.model));
+        if (usable.length === 0)
+            return [];
+        const stickyMember = sessionId === undefined
+            ? undefined
+            : usable.find(member => memberKey(member.provider, member.account, member.model) === this.sticky.get(stickyKey(poolId, sessionId)));
+        if (this.options.strategy === 'priority') {
+            return stickyMember === undefined
+                ? usable
+                : [stickyMember, ...usable.filter(member => member !== stickyMember)];
+        }
+        const quotas = new Map(await Promise.all(usable.map(async (member) => [member, await this.options.usage.quotaFor(member)])));
+        const scored = usable.filter(member => quotas.get(member)?.available === true);
+        const quotaFull = usable.filter(member => quotas.get(member)?.available === false);
+        scored.sort((a, b) => (quotas.get(b)?.urgency ?? 0) - (quotas.get(a)?.urgency ?? 0));
+        if (stickyMember !== undefined && scored.includes(stickyMember)) {
+            const best = scored[0];
+            const stickyUrgency = quotas.get(stickyMember)?.urgency ?? 0;
+            const bestUrgency = quotas.get(best)?.urgency ?? 0;
+            if (best === stickyMember || bestUrgency <= stickyUrgency * this.options.switchMargin) {
+                // Sticky holds (no challenger beats it by the margin): lead with it.
+                scored.splice(scored.indexOf(stickyMember), 1);
+                scored.unshift(stickyMember);
+            }
+        }
+        return [...scored, ...quotaFull];
+    }
+    /** Pin the serving member to the session (with bounded memory). */
+    remember(poolId, sessionId, member) {
+        if (sessionId === undefined)
+            return;
+        const key = stickyKey(poolId, sessionId);
+        this.sticky.delete(key);
+        if (this.sticky.size >= STICKY_SESSION_LIMIT) {
+            const oldest = this.sticky.keys().next();
+            if (oldest.done !== true)
+                this.sticky.delete(oldest.value);
+        }
+        this.sticky.set(key, memberKey(member.provider, member.account, member.model));
+    }
+    /**
+     * The error for an exhausted pool, carrying the earliest recovery hint of
+     * THIS pool's members (the health registry is shared across pools, so the
+     * hint is scoped to the keys this pool can actually recover through).
+     */
+    exhausted(model, pool, cause) {
+        const keys = new Set();
+        for (const member of pool) {
+            keys.add(memberKey(member.provider, member.account, member.model));
+            keys.add(accountKey(member.provider, member.account));
+        }
+        const recovery = this.options.health.earliestRecovery(keys);
+        const retryAfterMs = recovery === undefined ? undefined : Math.max(recovery - Date.now(), 1);
+        return new LlmError(`pool "${model}" exhausted: every member is unavailable or failed`, 'RATE_LIMIT', {
+            ...retryAfterMs === undefined ? {} : { providerRetryAfterMs: retryAfterMs },
+            ...cause === undefined ? {} : { cause },
+        });
+    }
+}
+function stickyKey(poolId, sessionId) {
+    return `${String(sessionId)}|${poolId}`;
+}
+function isNumber(value) {
+    return value !== undefined;
+}
+/** Reasoning efforts every member supports (id intersection, first member's order). */
+function intersectReasoning(resolved) {
+    const [first, ...rest] = resolved;
+    if (first?.reasoning === undefined)
+        return undefined;
+    const efforts = first.reasoning.efforts.filter(effort => rest.every(info => info.reasoning?.efforts.some(other => other.id === effort.id) === true));
+    if (efforts.length === 0)
+        return undefined;
+    const defaultEffort = first.reasoning.defaultEffort !== undefined
+        && efforts.some(effort => effort.id === first.reasoning?.defaultEffort)
+        ? first.reasoning.defaultEffort
+        : undefined;
+    return { efforts, ...defaultEffort === undefined ? {} : { defaultEffort } };
+}
+/** Modalities all members accept; undefined when any member leaves it unknown. */
+function intersectModalities(resolved) {
+    const [first, ...rest] = resolved;
+    if (first?.inputModalities === undefined)
+        return undefined;
+    const modalities = first.inputModalities.filter(modality => rest.every(info => info.inputModalities?.includes(modality) === true));
+    // An empty intersection would declare negative capability ("accepts
+    // nothing"); report unknown instead — the serving member enforces its own
+    // limits at request time.
+    return modalities.length === 0 ? undefined : modalities;
+}

package/lib/tools/image-generate.d.ts

@@ -16,7 +16,7 @@ import type { AttachmentStore } from '@deepseek-ai/dsh-attachment';
 import type { LlmRuntime } from '@deepseek-ai/dsh-llm';
 import type { ToolDefinition } from '@deepseek-ai/dsh-tools';
 import type { CodexSession, GrokSession } from '../auth/store.js';
-import { TokenManager } from '../providers/common.js';
+import { AccountTokenManager } from '../providers/accounts.js';
 import type { FetchFn } from '../providers/common.js';
 /** Endpoint the codex generation request is posted to. */
 export declare const IMAGE_GENERATE_URL = "https://chatgpt.com/backend-api/codex/images/generations";
@@ -29,9 +29,9 @@ export declare const GROK_IMAGE_GENERATE_MODEL = "grok-imagine-image-2.0";
 /** Dependencies of the `image_generate` tool. */
 export interface ImageGenerateToolOptions {
     /** Codex session source; the default preferred provider (`provider: 'gpt'`). */
-    codexTokens?: TokenManager<CodexSession>;
+    codexTokens?: AccountTokenManager<CodexSession>;
     /** Grok session source; preferred when the call passes `provider: 'grok'`. */
-    grokTokens?: TokenManager<GrokSession>;
+    grokTokens?: AccountTokenManager<GrokSession>;
     /** Fetch implementation (injectable for tests). */
     fetchFn?: FetchFn;
     /** Directory override for saved images (defaults under the harness home). */

package/lib/tools/image-generate.js

@@ -17,7 +17,8 @@ import { basename, join } from 'node:path';
 import { dshHomePath } from '@deepseek-ai/dsh-home-paths';
 import { AttachmentId } from '@deepseek-ai/dsh-attachment';
 import { defineTool } from '@deepseek-ai/dsh-tools';
-import { httpLlmError, TokenManager } from '../providers/common.js';
+import { httpLlmError } from '../providers/common.js';
+import { AccountTokenManager } from '../providers/accounts.js';
 import { proxiedFetch } from '../http.js';
 /** Endpoint the codex generation request is posted to. */
 export const IMAGE_GENERATE_URL = 'https://chatgpt.com/backend-api/codex/images/generations';

package/lib/tools/video-generate.d.ts

@@ -10,7 +10,7 @@
  */
 import type { ToolDefinition } from '@deepseek-ai/dsh-tools';
 import type { GrokSession } from '../auth/store.js';
-import { TokenManager } from '../providers/common.js';
+import { AccountTokenManager } from '../providers/accounts.js';
 import type { FetchFn } from '../providers/common.js';
 /** Endpoint the generation request is posted to. */
 export declare const VIDEO_GENERATE_URL = "https://api.x.ai/v1/videos/generations";
@@ -25,7 +25,7 @@ export declare const DEFAULT_MAX_WAIT_MS: number;
 /** Dependencies of the `video_generate` tool. */
 export interface VideoGenerateToolOptions {
     /** Grok session source; a missing session throws the log-in hint. */
-    tokens: TokenManager<GrokSession>;
+    tokens: AccountTokenManager<GrokSession>;
     /** Fetch implementation (injectable for tests). */
     fetchFn?: FetchFn;
     /** Directory override for saved videos (defaults under the harness home). */

package/lib/tools/video-generate.js

@@ -12,7 +12,8 @@ import { mkdir, writeFile } from 'node:fs/promises';
 import { basename, join } from 'node:path';
 import { dshHomePath } from '@deepseek-ai/dsh-home-paths';
 import { defineTool } from '@deepseek-ai/dsh-tools';
-import { httpLlmError, TokenManager } from '../providers/common.js';
+import { httpLlmError } from '../providers/common.js';
+import { AccountTokenManager } from '../providers/accounts.js';
 import { proxiedFetch } from '../http.js';
 /** Endpoint the generation request is posted to. */
 export const VIDEO_GENERATE_URL = 'https://api.x.ai/v1/videos/generations';