dsh-plugin-subscriptions 0.5.2 → 0.5.3

package/lib/providers/accounts.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Multi-account token plumbing: one {@link AccountTokenManager} per provider
+ * owns a lazily-built {@link TokenManager} per account, so refresh coalescing
+ * (`inflight`) and permanent-failure removal stay scoped to ONE account —
+ * a revoked account deletes itself without touching its siblings.
+ *
+ * {@link AccountAwareAdapter} is the internal interface the pool uses to
+ * stream through a specific account. A catalog model listed by several
+ * accounts failovers; one listed by a single account is pinned to it.
+ */
+import { LlmAdapter } from '@deepseek-ai/dsh-llm';
+import type { GenerateOptions, LlmModelInfo, LlmResolvedModelInfo, StreamChunk } from '@deepseek-ai/dsh-llm';
+import { TokenManager } from './common.js';
+import type { TokenManagerOptions } from './common.js';
+import type { AccountEntry, ProviderId } from '../auth/store.js';
+export { DISCOVERY_TIMEOUT_MS } from './common.js';
+/** Minimal session shape the token managers need (mirrors common.ts). */
+interface TimedSession {
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: number;
+}
+/** An adapter that can stream through a named account (the pool's seam). */
+export interface AccountAwareAdapter extends LlmAdapter {
+    /** Stream using the given account's credentials instead of the default. */
+    streamAccount(options: GenerateOptions, account: string): AsyncIterable<StreamChunk>;
+    /**
+     * The provider's own catalog: one account when `account` is set, otherwise
+     * the union of every logged-in account (default first; later duplicates
+     * dropped). The picker uses the union; pool assembly lists each account.
+     */
+    listOwnModels(provider: string, account?: string, signal?: AbortSignal): Promise<readonly LlmModelInfo[]>;
+    /**
+     * Capability resolution of the provider's OWN models, bypassing the pool
+     * delegation. The pool resolves its members through this — an account pool
+     * reuses the catalog wire id (e.g. `gpt-5.4`), so resolveModel would
+     * otherwise bounce straight back into the pool forever.
+     */
+    resolveOwnModel(provider: string, model: string): Promise<LlmResolvedModelInfo>;
+    /** Drop cached catalogs: one account, or every account when omitted (login/logout). */
+    clearAccountCatalog(account?: string): void;
+}
+/** Options for {@link unionAccountCatalogs}. */
+export interface UnionAccountCatalogsOptions {
+    /** Per-account bound; a hang sits that account out instead of blocking the picker. */
+    timeoutMs?: number;
+    /** Caller cancellation; aborting drops the whole union. */
+    signal?: AbortSignal;
+}
+/**
+ * Merge per-account catalogs, keeping the first occurrence of each model id.
+ * Rows that carry a numeric `priority` (Codex discovery) are then ordered by
+ * it so a model only the second account lists — e.g. `gpt-5.6-sol` — still
+ * sits with its generation instead of being appended after the default
+ * account's older ids.
+ */
+export declare function unionAccountCatalogs(accounts: readonly string[], listOne: (account: string, signal?: AbortSignal) => Promise<readonly LlmModelInfo[]>, options?: UnionAccountCatalogsOptions): Promise<LlmModelInfo[]>;
+/** Store I/O behind {@link AccountTokenManager} (injectable for tests). */
+export interface AccountStoreIo<S> {
+    list(): Promise<AccountEntry<S>[]>;
+    get(account?: string): Promise<S | undefined>;
+    save(account: string, session: S): Promise<void>;
+    remove(account: string): Promise<void>;
+}
+export interface AccountTokenManagerOptions<S extends TimedSession> {
+    provider: ProviderId;
+    /** Human-readable provider name for error messages. */
+    displayName: string;
+    /** Provider hooks shared by every account (load/save/remove are bound per account). */
+    makeOptions: (account: string) => Omit<TokenManagerOptions<S>, 'load' | 'save' | 'remove' | 'onRemoved' | 'displayName'>;
+    /** Called after a permanent refresh failure deleted one account's session. */
+    onAccountRemoved?: (account: string) => void;
+    /** Store backend; defaults to the durable auth store. */
+    io?: AccountStoreIo<S>;
+}
+export declare class AccountTokenManager<S extends TimedSession> {
+    private readonly options;
+    private readonly managers;
+    private readonly io;
+    constructor(options: AccountTokenManagerOptions<S>);
+    /** The provider's accounts, default first (straight from the store). */
+    list(): Promise<AccountEntry<S>[]>;
+    /** The default account's key, or undefined when logged out. */
+    defaultAccount(): Promise<string | undefined>;
+    /**
+     * Resolve a usable session for one account (default when omitted),
+     * refreshing proactively or on demand.
+     * @param account - the account key; the default account when undefined.
+     * @param forceRefresh - refresh regardless of expiry (used after a 401).
+     * @returns the persisted session to send.
+     * @throws LlmError MISSING_CREDENTIAL when the account is not logged in.
+     */
+    session(account?: string, forceRefresh?: boolean): Promise<S>;
+    /** Read an account's stored session without any refresh side effect. */
+    peek(account?: string): Promise<S | undefined>;
+    /** Whether a session is stored for the account (cheap; never refreshes). */
+    hasSession(account?: string): Promise<boolean>;
+    /** The TokenManager bound to one account (created lazily, then cached). */
+    tokensFor(account: string): TokenManager<S>;
+    /** The logged-out error, mirroring TokenManager's own message. */
+    private missingCredential;
+}

package/lib/providers/accounts.js

@@ -0,0 +1,123 @@
+/**
+ * Multi-account token plumbing: one {@link AccountTokenManager} per provider
+ * owns a lazily-built {@link TokenManager} per account, so refresh coalescing
+ * (`inflight`) and permanent-failure removal stay scoped to ONE account —
+ * a revoked account deletes itself without touching its siblings.
+ *
+ * {@link AccountAwareAdapter} is the internal interface the pool uses to
+ * stream through a specific account. A catalog model listed by several
+ * accounts failovers; one listed by a single account is pinned to it.
+ */
+import { LlmAdapter, LlmError } from '@deepseek-ai/dsh-llm';
+import { TokenManager, withTimeout } from './common.js';
+import { deleteAccountSession, getAccountSession, listAccounts, saveAccountSession, } from '../auth/store.js';
+export { DISCOVERY_TIMEOUT_MS } from './common.js';
+/** Catalog sort hint when the provider advertised one (Codex `priority`). */
+function catalogPriority(model) {
+    const ranked = model;
+    return typeof ranked.priority === 'number' ? ranked.priority : Number.MAX_SAFE_INTEGER;
+}
+/**
+ * Merge per-account catalogs, keeping the first occurrence of each model id.
+ * Rows that carry a numeric `priority` (Codex discovery) are then ordered by
+ * it so a model only the second account lists — e.g. `gpt-5.6-sol` — still
+ * sits with its generation instead of being appended after the default
+ * account's older ids.
+ */
+export async function unionAccountCatalogs(accounts, listOne, options) {
+    const timeoutMs = options?.timeoutMs;
+    const caller = options?.signal;
+    const catalogs = await Promise.all(accounts.map(async (account) => {
+        try {
+            if (timeoutMs === undefined)
+                return await listOne(account, caller);
+            const models = await withTimeout(timeoutSignal => listOne(account, caller === undefined ? timeoutSignal : AbortSignal.any([timeoutSignal, caller])), timeoutMs);
+            return models ?? [];
+        }
+        catch (error) {
+            // One expired or failing account must not hide models the others list.
+            if (caller?.aborted === true)
+                throw error;
+            return [];
+        }
+    }));
+    const seen = new Set();
+    const models = [];
+    for (const catalog of catalogs) {
+        for (const model of catalog) {
+            if (seen.has(model.id))
+                continue;
+            seen.add(model.id);
+            models.push(model);
+        }
+    }
+    models.sort((left, right) => catalogPriority(left) - catalogPriority(right));
+    return models;
+}
+export class AccountTokenManager {
+    options;
+    managers = new Map();
+    io;
+    constructor(options) {
+        this.options = options;
+        const provider = options.provider;
+        this.io = options.io ?? {
+            list: () => listAccounts(provider),
+            get: account => getAccountSession(provider, account),
+            save: (account, session) => saveAccountSession(provider, account, session),
+            remove: account => deleteAccountSession(provider, account),
+        };
+    }
+    /** The provider's accounts, default first (straight from the store). */
+    list() {
+        return this.io.list();
+    }
+    /** The default account's key, or undefined when logged out. */
+    async defaultAccount() {
+        return (await this.list())[0]?.key;
+    }
+    /**
+     * Resolve a usable session for one account (default when omitted),
+     * refreshing proactively or on demand.
+     * @param account - the account key; the default account when undefined.
+     * @param forceRefresh - refresh regardless of expiry (used after a 401).
+     * @returns the persisted session to send.
+     * @throws LlmError MISSING_CREDENTIAL when the account is not logged in.
+     */
+    async session(account, forceRefresh = false) {
+        const key = account ?? await this.defaultAccount();
+        if (key === undefined)
+            throw this.missingCredential();
+        return this.tokensFor(key).session(forceRefresh);
+    }
+    /** Read an account's stored session without any refresh side effect. */
+    peek(account) {
+        return this.io.get(account);
+    }
+    /** Whether a session is stored for the account (cheap; never refreshes). */
+    async hasSession(account) {
+        return (await this.peek(account)) !== undefined;
+    }
+    /** The TokenManager bound to one account (created lazily, then cached). */
+    tokensFor(account) {
+        let manager = this.managers.get(account);
+        if (manager === undefined) {
+            const io = this.io;
+            manager = new TokenManager({
+                displayName: this.options.displayName,
+                ...this.options.makeOptions(account),
+                load: () => io.get(account),
+                save: session => io.save(account, session),
+                remove: () => io.remove(account),
+                onRemoved: () => { this.options.onAccountRemoved?.(account); },
+            });
+            this.managers.set(account, manager);
+        }
+        return manager;
+    }
+    /** The logged-out error, mirroring TokenManager's own message. */
+    missingCredential() {
+        return new LlmError(`dsh-plugin-subscriptions: not logged in to ${this.options.displayName}; `
+            + 'log in via Settings → Subscriptions in the dsh web app', 'MISSING_CREDENTIAL');
+    }
+}

package/lib/providers/claude.d.ts

@@ -7,9 +7,10 @@ import { LlmAdapter } from '@deepseek-ai/dsh-llm';
 import type { GenerateOptions, LlmModelInfo, LlmProviderInfo, LlmResolvedModelInfo, StreamChunk } from '@deepseek-ai/dsh-llm';
 import type { FlowSpec } from '../auth/oauth-flow.js';
 import type { ClaudeSession } from '../auth/store.js';
+import type { PoolAdapter } from './pool.js';
 import type { AttachmentStore } from '@deepseek-ai/dsh-attachment';
 import type { TranslatableMessage } from '../translate/resolved.js';
-import { TokenManager } from './common.js';
+import { AccountTokenManager } from './accounts.js';
 import type { CatalogPersistence, DiscoveredModel, FetchFn, ModelEntry, ProviderUsage } from './common.js';
 export declare const CLAUDE_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
 export declare const CLAUDE_AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
@@ -64,13 +65,15 @@ export declare const CLAUDE_USAGE_URL = "https://api.anthropic.com/api/oauth/usa
  * @returns the mapped usage snapshot.
  */
 export declare function fetchClaudeUsage(session: ClaudeSession, fetchFn?: FetchFn, signal?: AbortSignal): Promise<ProviderUsage>;
-/** Fetch the live model catalog from the subscription endpoint. */
-export declare function fetchClaudeModels(session: ClaudeSession, fetchFn?: FetchFn): Promise<DiscoveredModel[]>;
+/** Fetch the live model catalog from the subscription endpoint. `signal` cancels the request. */
+export declare function fetchClaudeModels(session: ClaudeSession, fetchFn?: FetchFn, signal?: AbortSignal): Promise<DiscoveredModel[]>;
 /** Constructor dependencies for {@link ClaudeAdapter}. */
 export interface ClaudeAdapterOptions {
     models: readonly ModelEntry[];
     streamIdleTimeoutMs: number;
-    tokens: TokenManager<ClaudeSession>;
+    tokens: AccountTokenManager<ClaudeSession>;
+    /** Late-bound pool facade (wired after adapter construction); pools list under their first member's provider. */
+    pool?: () => PoolAdapter | undefined;
     /** Whether to fetch the live catalog when logged in (false when config `models` overrides). */
     discovery: boolean;
     fetchFn?: FetchFn;
@@ -102,15 +105,30 @@ export declare function claudeRequestBody(options: GenerateOptions, messages: re
 export declare class ClaudeAdapter extends LlmAdapter {
     private readonly options;
     private readonly catalog;
+    /** In-memory catalogs for non-default accounts (the persisted cache is the default's). */
+    private readonly accountCatalogs;
+    /** Account whose snapshot currently lives in {@link catalog}; cleared on default change. */
+    private catalogOwner;
     constructor(options: ClaudeAdapterOptions);
     private fetchCatalog;
+    /** Drop cached catalogs after login/logout so the next list does not reuse a stale plan. */
+    clearAccountCatalog(account?: string): void;
+    /** Persisted cache for the default account; a throwaway cache for any other. */
+    private catalogFor;
     private discovered;
     private staticModels;
     providerInfo(provider: string): LlmProviderInfo;
     providerRetryPolicy(provider: string): import("@deepseek-ai/dsh-llm").ResolvedRetryPolicy | undefined;
     listModels(provider: string): Promise<readonly LlmModelInfo[]>;
+    /** The provider's own catalog: union of every account, or one account when named. */
+    listOwnModels(provider: string, account?: string, signal?: AbortSignal): Promise<readonly LlmModelInfo[]>;
     resolveModel(provider: string, model: string): Promise<LlmResolvedModelInfo>;
+    /** Capability resolution of the provider's own models (the pool resolves members here). */
+    resolveOwnModel(provider: string, model: string): Promise<LlmResolvedModelInfo>;
     stream(options: GenerateOptions): AsyncIterable<StreamChunk>;
+    /** Pool seam: stream through one specific account instead of the default. */
+    streamAccount(options: GenerateOptions, account: string): AsyncIterable<StreamChunk>;
+    private streamCore;
     /**
      * `display: 'summarized'` is set explicitly on both shapes: `adaptive`-type
      * models default to `display: 'omitted'`, which returns thinking blocks with

package/lib/providers/claude.js

@@ -7,7 +7,8 @@ import { execFileSync } from 'node:child_process';
 import { EMPTY_RESPONSE_CODE, errorChain, LlmAdapter, LlmError, ReasoningEffortId, resolveRetryPolicy } from '@deepseek-ai/dsh-llm';
 import { resolveImages } from '../translate/resolved.js';
 import { markMessageCache, streamAnthropic, toAnthropicMessages, toAnthropicSystem, toAnthropicTools, } from '../translate/anthropic.js';
-import { httpLlmError, idleWatchdog, mapFetchFailure, ModelCatalogCache, discoverOrRetryAuth, isMissingOrInvalidCredential, oauthEndpointError, OAuthEndpointError, TokenManager, } from './common.js';
+import { httpLlmError, idleWatchdog, mapFetchFailure, ModelCatalogCache, discoverAcrossAccounts, discoverOrRetryAuth, isDiscoveryAborted, isMissingOrInvalidCredential, oauthEndpointError, OAuthEndpointError, } from './common.js';
+import { AccountTokenManager, DISCOVERY_TIMEOUT_MS, unionAccountCatalogs } from './accounts.js';
 import { proxiedFetch } from '../http.js';
 export const CLAUDE_CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
 export const CLAUDE_AUTHORIZE_URL = 'https://claude.ai/oauth/authorize';
@@ -288,8 +289,8 @@ function claudeReasoning(capabilities) {
         .map(level => ({ id: ReasoningEffortId(level), name: level[0].toUpperCase() + level.slice(1) }));
     return efforts.length > 0 ? { efforts } : undefined;
 }
-/** Fetch the live model catalog from the subscription endpoint. */
-export async function fetchClaudeModels(session, fetchFn = proxiedFetch) {
+/** Fetch the live model catalog from the subscription endpoint. `signal` cancels the request. */
+export async function fetchClaudeModels(session, fetchFn = proxiedFetch, signal) {
     const response = await fetchFn(CLAUDE_MODELS_URL, {
         headers: {
             'authorization': `Bearer ${session.accessToken}`,
@@ -298,6 +299,7 @@ export async function fetchClaudeModels(session, fetchFn = proxiedFetch) {
             'anthropic-dangerous-direct-browser-access': 'true',
             'accept': 'application/json',
         },
+        ...signal === undefined ? {} : { signal },
     });
     if (!response.ok)
         throw await httpLlmError(response, 'claude models API');
@@ -368,19 +370,56 @@ export function claudeRequestBody(options, messages, maxTokens, thinking, effort
 export class ClaudeAdapter extends LlmAdapter {
     options;
     catalog;
+    /** In-memory catalogs for non-default accounts (the persisted cache is the default's). */
+    accountCatalogs = new Map();
+    /** Account whose snapshot currently lives in {@link catalog}; cleared on default change. */
+    catalogOwner;
     constructor(options) {
         super();
         this.options = options;
         this.catalog = new ModelCatalogCache(options.catalogStore);
     }
-    async fetchCatalog() {
-        return fetchClaudeModels(await this.options.tokens.session(), this.options.fetchFn);
+    async fetchCatalog(account, signal) {
+        return fetchClaudeModels(await this.options.tokens.session(account), this.options.fetchFn, signal);
+    }
+    /** Drop cached catalogs after login/logout so the next list does not reuse a stale plan. */
+    clearAccountCatalog(account) {
+        if (account === undefined)
+            this.accountCatalogs.clear();
+        else
+            this.accountCatalogs.delete(account);
+        if (account === undefined || this.catalogOwner === account || this.catalogOwner === undefined) {
+            this.catalogOwner = undefined;
+            this.catalog.invalidate();
+        }
+    }
+    /** Persisted cache for the default account; a throwaway cache for any other. */
+    async catalogFor(account) {
+        const defaultKey = await this.options.tokens.defaultAccount();
+        const key = account ?? defaultKey;
+        if (key === undefined || key === defaultKey) {
+            if (this.catalogOwner !== undefined && this.catalogOwner !== defaultKey) {
+                this.catalog.invalidate();
+            }
+            this.catalogOwner = defaultKey;
+            return this.catalog;
+        }
+        let cache = this.accountCatalogs.get(key);
+        if (cache === undefined) {
+            cache = new ModelCatalogCache();
+            this.accountCatalogs.set(key, cache);
+        }
+        return cache;
     }
     async discovered(model) {
         if (!this.options.discovery)
             return undefined;
-        const models = await this.catalog.resolve(() => this.fetchCatalog());
-        return models?.find(entry => entry.id === model);
+        const accounts = (await this.options.tokens.list()).map(entry => entry.key);
+        return discoverAcrossAccounts(accounts, async (account) => {
+            const catalog = await this.catalogFor(account);
+            const models = await catalog.resolve(() => this.fetchCatalog(account));
+            return models?.find(entry => entry.id === model);
+        });
     }
     staticModels(provider) {
         return this.options.models.map(model => ({
@@ -407,12 +446,31 @@ export class ClaudeAdapter extends LlmAdapter {
         }, `claude: provider "${provider}" retryPolicy`);
     }
     async listModels(provider) {
-        if (await this.options.tokens.peek() === undefined)
+        const own = await this.listOwnModels(provider);
+        const pool = this.options.pool?.();
+        if (pool === undefined)
+            return own;
+        const extra = await pool.modelsForProvider(provider);
+        const seen = new Set(own.map(model => model.id));
+        // Account pools reuse the catalog row; only configured tiers are extra.
+        return [...own, ...extra.filter(model => !seen.has(model.id))];
+    }
+    /** The provider's own catalog: union of every account, or one account when named. */
+    async listOwnModels(provider, account, signal) {
+        if (account === undefined) {
+            const accounts = (await this.options.tokens.list()).map(entry => entry.key);
+            if (accounts.length === 0)
+                return [];
+            return unionAccountCatalogs(accounts, (key, accountSignal) => this.listOwnModels(provider, key, accountSignal), { timeoutMs: DISCOVERY_TIMEOUT_MS, ...signal === undefined ? {} : { signal } });
+        }
+        if (!await this.options.tokens.hasSession(account)) {
             return [];
+        }
         if (!this.options.discovery)
             return this.staticModels(provider);
+        const catalog = await this.catalogFor(account);
         try {
-            const models = await discoverOrRetryAuth(force => this.options.tokens.session(force), this.catalog, () => this.catalog.get(() => this.fetchCatalog()));
+            const models = await discoverOrRetryAuth(force => this.options.tokens.session(account, force), catalog, () => catalog.get(() => this.fetchCatalog(account, signal)));
             return models.map(model => ({
                 provider,
                 id: model.id,
@@ -421,6 +479,8 @@ export class ClaudeAdapter extends LlmAdapter {
             }));
         }
         catch (error) {
+            if (isDiscoveryAborted(error, signal))
+                throw error;
             if (isMissingOrInvalidCredential(error))
                 return [];
             this.options.onWarn?.(`claude model discovery failed; using the built-in catalog (${errorChain(error)})`);
@@ -428,6 +488,14 @@ export class ClaudeAdapter extends LlmAdapter {
         }
     }
     async resolveModel(provider, model) {
+        const pool = this.options.pool?.();
+        if (pool !== undefined && await pool.owns(provider, model)) {
+            return pool.resolveModel(provider, model);
+        }
+        return this.resolveOwnModel(provider, model);
+    }
+    /** Capability resolution of the provider's own models (the pool resolves members here). */
+    async resolveOwnModel(provider, model) {
         const disc = await this.discovered(model);
         const configured = this.options.models.find(entry => entry.id === model);
         const reasoning = disc?.reasoning;
@@ -444,12 +512,24 @@ export class ClaudeAdapter extends LlmAdapter {
         };
     }
     async *stream(options) {
+        const pool = this.options.pool?.();
+        if (pool !== undefined && await pool.owns(options.provider, options.model)) {
+            yield* pool.stream(options);
+            return;
+        }
+        yield* this.streamCore(options);
+    }
+    /** Pool seam: stream through one specific account instead of the default. */
+    streamAccount(options, account) {
+        return this.streamCore(options, account);
+    }
+    async *streamCore(options, account) {
         const watchdog = idleWatchdog(options.signal, this.options.streamIdleTimeoutMs);
         try {
-            let session = await this.options.tokens.session();
+            let session = await this.options.tokens.session(account);
             let response = await this.request(options, session, watchdog.signal);
             if (response.status === 401) {
-                session = await this.options.tokens.session(true);
+                session = await this.options.tokens.session(account, true);
                 response = await this.request(options, session, watchdog.signal);
             }
             if (!response.ok)

package/lib/providers/codex.d.ts

@@ -7,9 +7,10 @@ import { LlmAdapter } from '@deepseek-ai/dsh-llm';
 import type { GenerateOptions, LlmModelInfo, LlmProviderInfo, LlmResolvedModelInfo, StreamChunk } from '@deepseek-ai/dsh-llm';
 import type { FlowSpec } from '../auth/oauth-flow.js';
 import type { CodexSession } from '../auth/store.js';
+import type { PoolAdapter } from './pool.js';
 import type { AttachmentStore } from '@deepseek-ai/dsh-attachment';
 import type { ResponsesRequestInput } from '../translate/responses.js';
-import { TokenManager } from './common.js';
+import { AccountTokenManager } from './accounts.js';
 import type { CatalogPersistence, DiscoveredModel, FetchFn, ModelEntry, ProviderUsage } from './common.js';
 export declare const CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 export declare const CODEX_AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
@@ -90,14 +91,17 @@ export declare const CODEX_CLIENT_VERSION = "0.147.0";
  * Fetch the live codex model catalog with the session's auth headers.
  * @param session - the stored session (used as-is; never refreshed here).
  * @param fetchFn - fetch implementation (injectable for tests).
+ * @param signal - caller cancellation (pool-assembly timeout).
  * @returns discovered models: hidden entries dropped, sorted by priority.
  */
-export declare function fetchCodexModels(session: CodexSession, fetchFn?: FetchFn): Promise<DiscoveredModel[]>;
+export declare function fetchCodexModels(session: CodexSession, fetchFn?: FetchFn, signal?: AbortSignal): Promise<DiscoveredModel[]>;
 /** Constructor dependencies for {@link CodexAdapter}. */
 export interface CodexAdapterOptions {
     models: readonly ModelEntry[];
     streamIdleTimeoutMs: number;
-    tokens: TokenManager<CodexSession>;
+    tokens: AccountTokenManager<CodexSession>;
+    /** Late-bound pool facade (wired after adapter construction); pools list under their first member's provider. */
+    pool?: () => PoolAdapter | undefined;
     /** Whether to fetch the live catalog when logged in (false when config `models` overrides). */
     discovery: boolean;
     /** Warning sink for discovery failures that fall back to the static catalog. */
@@ -108,6 +112,8 @@ export interface CodexAdapterOptions {
     resolveAttachments?: () => AttachmentStore | undefined;
     /** Durable catalog store seeding capability metadata across restarts. */
     catalogStore?: CatalogPersistence;
+    /** Per-account catalog bound for the picker union (defaults to {@link DISCOVERY_TIMEOUT_MS}). */
+    discoveryTimeoutMs?: number;
     /**
      * Per-request speed lookup (the composer Speed toggle's host half). Returns
      * whether this session's current choice sends the model on the fast tier;
@@ -126,12 +132,22 @@ export declare function codexRequestBody(options: GenerateOptions, resolved: Res
 export declare class CodexAdapter extends LlmAdapter {
     private readonly options;
     private readonly catalog;
+    /** In-memory catalogs for non-default accounts (the persisted cache is the default's). */
+    private readonly accountCatalogs;
+    /** Account whose snapshot currently lives in {@link catalog}; cleared on default change. */
+    private catalogOwner;
     constructor(options: CodexAdapterOptions);
     /** Discovery fetcher: resolves the session through the refresh-aware path. */
     private fetchCatalog;
+    /** Drop cached catalogs after login/logout so the next list does not reuse a stale plan. */
+    clearAccountCatalog(account?: string): void;
+    /** Persisted cache for the default account; a throwaway cache for any other. */
+    private catalogFor;
     providerInfo(provider: string): LlmProviderInfo;
     private staticModels;
     listModels(provider: string): Promise<readonly LlmModelInfo[]>;
+    /** The provider's own catalog: union of every account, or one account when named. */
+    listOwnModels(provider: string, account?: string, signal?: AbortSignal): Promise<readonly LlmModelInfo[]>;
     /**
      * The discovered entry for one model. Resolved through the cache's
      * stale-while-revalidate path so capability metadata stays stable across a
@@ -145,6 +161,11 @@ export declare class CodexAdapter extends LlmAdapter {
     /** Ids of every discovered model with a fast tier (the Speed toggle's visibility list). */
     fastCapableModels(): Promise<string[]>;
     resolveModel(provider: string, model: string): Promise<LlmResolvedModelInfo>;
+    /** Capability resolution of the provider's own models (the pool resolves members here). */
+    resolveOwnModel(provider: string, model: string): Promise<LlmResolvedModelInfo>;
     stream(options: GenerateOptions): AsyncIterable<StreamChunk>;
+    /** Pool seam: stream through one specific account instead of the default. */
+    streamAccount(options: GenerateOptions, account: string): AsyncIterable<StreamChunk>;
+    private streamCore;
     private request;
 }