dsh-plugin-subscriptions 0.5.2 → 0.6.0

package/lib/providers/common.d.ts

@@ -5,8 +5,8 @@
  * Concurrent refreshes for one provider coalesce behind a single in-flight
  * promise (`inflight`), so a rotating refresh token is never spent twice.
  */
-import { LlmError } from '@deepseek-ai/dsh-llm';
-import type { ReasoningEffortId } from '@deepseek-ai/dsh-llm';
+import { LlmError, ReasoningEffortId } from '@deepseek-ai/dsh-llm';
+import type { RateLimitResetReader } from './rate-limit.js';
 /** One configured model catalog entry. */
 export interface ModelEntry {
     /** Wire model id; must be non-empty. */
@@ -33,14 +33,34 @@ export interface ModelEntry {
  * @returns the validated entries.
  */
 export declare function validateModels(models: readonly ModelEntry[], label: string): ModelEntry[];
+/** Optional per-call hooks {@link httpLlmError} uses to read a rate-limit window. */
+export interface HttpLlmErrorOptions {
+    /**
+     * The calling provider's reader for the instant its rate-limit window
+     * reopens. Consulted on a 429 only, and there ahead of the generic
+     * `retry-after` header, because a provider's own field names the window while
+     * `retry-after` often names a short backoff.
+     */
+    rateLimitReset?: RateLimitResetReader;
+    /** Diagnostic sink for a 429 that disclosed no reset instant this code recognizes. */
+    onWarn?: (message: string) => void;
+}
 /**
- * Build an LlmError from a non-2xx provider response, reading and truncating
- * the body for the message and mapping the status to a stable code.
+ * Build an LlmError from a non-2xx provider response, mapping the status to a
+ * stable code and, for a rate-limited request, the disclosed reset instant to
+ * the `providerRetryAfterMs` the retry plugin waits out.
+ *
+ * A 429 classifies as `RATE_LIMIT` on the strength of the status alone, ahead
+ * of the quota-wording check. On these routes there is no terminal quota to
+ * distinguish: a subscription has no balance to top up, only a window that
+ * reopens, and providers announce an exhausted window with wording
+ * (`usage_limit_reached`) the shared classifier reads as permanent.
  * @param response - the failed response.
  * @param label - diagnostic prefix naming the provider API.
+ * @param options - the calling provider's rate-limit reader and warning sink.
  * @returns the classified error.
  */
-export declare function httpLlmError(response: Response, label: string): Promise<LlmError>;
+export declare function httpLlmError(response: Response, label: string, options?: HttpLlmErrorOptions): Promise<LlmError>;
 /** An idle watchdog: aborts its signal when no SSE activity arrives within the timeout. */
 export interface IdleWatchdog {
     /** Signal to pass to fetch and body reads; aborts on caller cancel or idle expiry. */
@@ -76,7 +96,15 @@ export declare class OAuthEndpointError extends Error {
     readonly status: number;
     /** The provider's OAuth `error` code (e.g. `invalid_grant`), when present. */
     readonly oauthCode: string | undefined;
-    constructor(message: string, status: number, oauthCode?: string);
+    /**
+     * The endpoint's `retry-after`, in ms, when it sent one. Usage/models
+     * endpoints reuse this error type and can rate-limit progressively (each
+     * hit within the window extends the next one), so a caller retrying on a
+     * fixed schedule instead of honoring this can keep an account locked out
+     * indefinitely.
+     */
+    readonly retryAfterMs: number | undefined;
+    constructor(message: string, status: number, oauthCode?: string, retryAfterMs?: number);
 }
 /**
  * Read an OAuth JSON error body into an {@link OAuthEndpointError}.
@@ -141,6 +169,13 @@ export declare class TokenManager<S extends TimedSession> {
 }
 /** Fetch signature adapters accept for discovery calls (injectable for tests). */
 export type FetchFn = typeof fetch;
+/** Bound on one account catalog fetch or usage poll — a hang must not block the picker. */
+export declare const DISCOVERY_TIMEOUT_MS = 10000;
+/**
+ * Run `work` with an aborting signal. Resolves undefined when the timeout
+ * fires (the fetch is aborted); other failures propagate.
+ */
+export declare function withTimeout<T>(work: (signal: AbortSignal) => Promise<T>, timeoutMs: number): Promise<T | undefined>;
 /** One rate-limit window reported by a provider's usage endpoint. */
 export interface UsageWindow {
     /** Window kind: `session` for the short rolling window, `weekly` for the 7-day one. */
@@ -196,6 +231,48 @@ export interface DiscoveredModel {
      */
     copilotResponses?: boolean;
 }
+/** Display name for a wire reasoning-effort identifier. */
+export declare function effortDisplayName(effort: string): string;
+/** The reasoning-block shape every caller passes to {@link mergeReasoning}. */
+export interface ReasoningBlock {
+    efforts: readonly {
+        id: ReasoningEffortId;
+        name: string;
+        description?: string;
+    }[];
+    defaultEffort?: ReasoningEffortId;
+}
+/**
+ * Fold a configured per-model default effort into a reasoning block, keeping
+ * the DSH runtime invariant `defaultEffort ∈ efforts` (the runtime rejects an
+ * unknown default with `INVALID_MODEL_REASONING`).
+ *
+ * A configured level the base set does not advertise is *dropped*, not
+ * appended: for claude/grok/copilot the base is the provider's live catalog,
+ * i.e. the truth about what the model accepts, so honouring a stale override
+ * would put an unsupported effort on every single request instead of letting
+ * the harness reject it before provider I/O. The override then simply falls
+ * back to the provider's own default until the user picks a level the catalog
+ * still lists.
+ *
+ * `extendable` opts into the opposite rule for a base that is a *built-in
+ * fallback* rather than discovered truth (codex, whose static effort list is
+ * known to trail the backend): there, appending the configured level is how a
+ * newly shipped tier becomes selectable at all.
+ * @param configuredDefault - the user-configured default effort id, or undefined.
+ * @param base - the discovered/built-in reasoning block, or undefined.
+ * @param options - `extendable` marks the base as a fallback that may be extended.
+ * @returns the merged block, or undefined when neither side contributes one.
+ */
+export declare function mergeReasoning(configuredDefault: string | undefined, base: ReasoningBlock | undefined, options?: {
+    extendable?: boolean;
+}): DiscoveredModel['reasoning'] | undefined;
+/**
+ * First account catalog that lists `model` (callers pass default-first).
+ * One failing lookup sits that account out so a sibling's metadata still
+ * resolves — the same isolation as the picker catalog union.
+ */
+export declare function discoverAcrossAccounts(accounts: readonly string[], lookup: (account: string) => Promise<DiscoveredModel | undefined>): Promise<DiscoveredModel | undefined>;
 /** How long a discovered catalog is trusted before re-fetching. */
 export declare const DISCOVERY_TTL_MS: number;
 /** A durable snapshot of one provider's discovered catalog. */
@@ -234,6 +311,8 @@ export declare class ModelCatalogCache {
     private seeded;
     /** Set by {@link invalidate} so an in-flight disk read cannot resurrect dropped state. */
     private seedDisabled;
+    /** Bumped by {@link invalidate} so a loser in-flight fetch cannot write back. */
+    private generation;
     constructor(persistence?: CatalogPersistence | undefined, ttlMs?: number);
     /**
      * The cached catalog when fresh, without fetching.
@@ -272,6 +351,8 @@ export declare class ModelCatalogCache {
 }
 /** Whether discovery failed because the stored login is gone. */
 export declare function isMissingOrInvalidCredential(error: unknown): boolean;
+/** Whether discovery stopped because the caller cancelled or the timeout fired. */
+export declare function isDiscoveryAborted(error: unknown, signal?: AbortSignal): boolean;
 /**
  * Run a catalog fetch, retrying once after a forced token refresh when the
  * first attempt is a 401/AUTH. Only {@link ModelCatalogCache.invalidate}s

package/lib/providers/common.js

@@ -5,7 +5,8 @@
  * Concurrent refreshes for one provider coalesce behind a single in-flight
  * promise (`inflight`), so a rotating refresh token is never spent twice.
  */
-import { CONTEXT_WINDOW_EXCEEDED_CODE, isContextWindowExceededError, isQuotaExceededError, LlmError, QUOTA_EXCEEDED_CODE, } from '@deepseek-ai/dsh-llm';
+import { CONTEXT_WINDOW_EXCEEDED_CODE, isContextWindowExceededError, isQuotaExceededError, LlmError, QUOTA_EXCEEDED_CODE, ReasoningEffortId, } from '@deepseek-ai/dsh-llm';
+import { rateLimitDiagnostics, retryAfterInstant, waitFromReset } from './rate-limit.js';
 /**
  * Validate a configured model catalog (mirrors llm-deepseek's resolveModels).
  * @param models - raw configured entries.
@@ -49,31 +50,41 @@ export function validateModels(models, label) {
     });
 }
 /**
- * Build an LlmError from a non-2xx provider response, reading and truncating
- * the body for the message and mapping the status to a stable code.
+ * Build an LlmError from a non-2xx provider response, mapping the status to a
+ * stable code and, for a rate-limited request, the disclosed reset instant to
+ * the `providerRetryAfterMs` the retry plugin waits out.
+ *
+ * A 429 classifies as `RATE_LIMIT` on the strength of the status alone, ahead
+ * of the quota-wording check. On these routes there is no terminal quota to
+ * distinguish: a subscription has no balance to top up, only a window that
+ * reopens, and providers announce an exhausted window with wording
+ * (`usage_limit_reached`) the shared classifier reads as permanent.
  * @param response - the failed response.
  * @param label - diagnostic prefix naming the provider API.
+ * @param options - the calling provider's rate-limit reader and warning sink.
  * @returns the classified error.
  */
-export async function httpLlmError(response, label) {
+export async function httpLlmError(response, label, options = {}) {
     let body = '';
     try {
-        body = (await response.text()).slice(0, 500);
+        body = await response.text();
     }
     catch {
         // Only swallow error-body reading: the HTTP status still identifies the failure.
     }
-    const message = body.length > 0
-        ? `${label} error (HTTP ${String(response.status)}): ${body}`
+    // Truncated for display only; the readers below need the whole body to parse it.
+    const shown = body.slice(0, 500);
+    const message = shown.length > 0
+        ? `${label} error (HTTP ${String(response.status)}): ${shown}`
         : `${label} error (HTTP ${String(response.status)})`;
     let code;
     if (response.status === 401 || response.status === 403)
         code = 'AUTH';
-    else if (isQuotaExceededError(body))
-        code = QUOTA_EXCEEDED_CODE;
     else if (response.status === 429)
         code = 'RATE_LIMIT';
-    else if (response.status === 400 && isContextWindowExceededError(body))
+    else if (isQuotaExceededError(shown))
+        code = QUOTA_EXCEEDED_CODE;
+    else if (response.status === 400 && isContextWindowExceededError(shown))
         code = CONTEXT_WINDOW_EXCEEDED_CODE;
     else if (response.status === 408 || response.status === 504)
         code = 'TIMEOUT';
@@ -81,18 +92,43 @@ export async function httpLlmError(response, label) {
         code = 'SERVER';
     else
         code = `HTTP_${String(response.status)}`;
-    const retryAfter = response.headers.get('retry-after');
-    let providerRetryAfterMs;
-    if (retryAfter !== null) {
-        const seconds = Number(retryAfter);
-        if (Number.isFinite(seconds) && seconds > 0)
-            providerRetryAfterMs = seconds * 1000;
+    const now = Date.now();
+    // The provider's reader runs on a 429 and nowhere else. Providers attach
+    // their rate-limit headers to every response, so reading them on a transient
+    // 500 would report the current window's rollover — hours out — as the delay
+    // before retrying a failure that has nothing to do with the window, and the
+    // retry plugin honours `providerRetryAfterMs` for every retryable code.
+    // `retry-after` stays readable on any status: there it is a real backoff the
+    // provider asked for (a 503 shedding load), not a window snapshot.
+    //
+    // On a 429 the provider's own field wins outright rather than being raced
+    // against `retry-after`: a rejected window often carries both, and the
+    // generic header then names a short backoff that would burn the retry budget
+    // re-hitting the same closed window.
+    const rateLimited = response.status === 429;
+    const reset = rateLimited
+        ? options.rateLimitReset?.(response, body, now) ?? retryAfterInstant(response, now)
+        : retryAfterInstant(response, now);
+    if (reset === undefined && rateLimited) {
+        options.onWarn?.(`${label}: ${rateLimitDiagnostics(response, body)}`);
     }
     return new LlmError(message, code, {
         status: response.status,
-        ...providerRetryAfterMs === undefined ? {} : { providerRetryAfterMs },
+        ...reset === undefined ? {} : { providerRetryAfterMs: waitFromReset(reset, now) },
     });
 }
+/**
+ * Parse a response's `retry-after` header (seconds) into milliseconds.
+ * @param response - the failed response.
+ * @returns the delay in ms, or undefined when absent/unusable.
+ */
+function parseRetryAfterMs(response) {
+    const retryAfter = response.headers.get('retry-after');
+    if (retryAfter === null)
+        return undefined;
+    const seconds = Number(retryAfter);
+    return Number.isFinite(seconds) && seconds > 0 ? seconds * 1000 : undefined;
+}
 /**
  * Create an idle watchdog chained to the caller's signal.
  * @param caller - the request's own abort signal, when present.
@@ -154,11 +190,20 @@ export class OAuthEndpointError extends Error {
     status;
     /** The provider's OAuth `error` code (e.g. `invalid_grant`), when present. */
     oauthCode;
-    constructor(message, status, oauthCode) {
+    /**
+     * The endpoint's `retry-after`, in ms, when it sent one. Usage/models
+     * endpoints reuse this error type and can rate-limit progressively (each
+     * hit within the window extends the next one), so a caller retrying on a
+     * fixed schedule instead of honoring this can keep an account locked out
+     * indefinitely.
+     */
+    retryAfterMs;
+    constructor(message, status, oauthCode, retryAfterMs) {
         super(message);
         this.name = 'OAuthEndpointError';
         this.status = status;
         this.oauthCode = oauthCode;
+        this.retryAfterMs = retryAfterMs;
     }
 }
 /**
@@ -181,7 +226,7 @@ export async function oauthEndpointError(response, label) {
     const message = detail.length > 0
         ? `${label} token endpoint error (HTTP ${String(response.status)}): ${detail}`
         : `${label} token endpoint error (HTTP ${String(response.status)})`;
-    return new OAuthEndpointError(message, response.status, oauthCode);
+    return new OAuthEndpointError(message, response.status, oauthCode, parseRetryAfterMs(response));
 }
 /**
  * Per-provider session freshness: loads the stored session, refreshes
@@ -263,6 +308,101 @@ export class TokenManager {
         return next;
     }
 }
+/** Bound on one account catalog fetch or usage poll — a hang must not block the picker. */
+export const DISCOVERY_TIMEOUT_MS = 10_000;
+/**
+ * Run `work` with an aborting signal. Resolves undefined when the timeout
+ * fires (the fetch is aborted); other failures propagate.
+ */
+export function withTimeout(work, timeoutMs) {
+    const signal = AbortSignal.timeout(timeoutMs);
+    const aborted = new Promise(resolve => {
+        if (signal.aborted)
+            resolve(undefined);
+        else
+            signal.addEventListener('abort', () => resolve(undefined), { once: true });
+    });
+    return Promise.race([
+        work(signal).then(value => (signal.aborted ? undefined : value), (error) => {
+            if (signal.aborted)
+                return undefined;
+            throw error;
+        }),
+        aborted,
+    ]);
+}
+/** Display name for a wire reasoning-effort identifier. */
+export function effortDisplayName(effort) {
+    return effort === 'xhigh' ? 'Extra High' : effort.charAt(0).toUpperCase() + effort.slice(1);
+}
+/**
+ * Fold a configured per-model default effort into a reasoning block, keeping
+ * the DSH runtime invariant `defaultEffort ∈ efforts` (the runtime rejects an
+ * unknown default with `INVALID_MODEL_REASONING`).
+ *
+ * A configured level the base set does not advertise is *dropped*, not
+ * appended: for claude/grok/copilot the base is the provider's live catalog,
+ * i.e. the truth about what the model accepts, so honouring a stale override
+ * would put an unsupported effort on every single request instead of letting
+ * the harness reject it before provider I/O. The override then simply falls
+ * back to the provider's own default until the user picks a level the catalog
+ * still lists.
+ *
+ * `extendable` opts into the opposite rule for a base that is a *built-in
+ * fallback* rather than discovered truth (codex, whose static effort list is
+ * known to trail the backend): there, appending the configured level is how a
+ * newly shipped tier becomes selectable at all.
+ * @param configuredDefault - the user-configured default effort id, or undefined.
+ * @param base - the discovered/built-in reasoning block, or undefined.
+ * @param options - `extendable` marks the base as a fallback that may be extended.
+ * @returns the merged block, or undefined when neither side contributes one.
+ */
+export function mergeReasoning(configuredDefault, base, options) {
+    const detached = base === undefined
+        ? undefined
+        : {
+            efforts: [...base.efforts],
+            ...(base.defaultEffort === undefined ? {} : { defaultEffort: base.defaultEffort }),
+        };
+    if (configuredDefault === undefined)
+        return detached;
+    const effort = ReasoningEffortId(configuredDefault);
+    if (base === undefined) {
+        // No capability information at all (catalog unavailable, or a model the
+        // catalog does not cover). Inventing a reasoning block here would claim a
+        // capability nobody advertised; only a fallback-based provider may.
+        return options?.extendable === true
+            ? { efforts: [{ id: effort, name: effortDisplayName(effort) }], defaultEffort: effort }
+            : undefined;
+    }
+    if (base.efforts.some(entry => entry.id === effort)) {
+        return { efforts: [...base.efforts], defaultEffort: effort };
+    }
+    if (options?.extendable !== true)
+        return detached;
+    return {
+        efforts: [...base.efforts, { id: effort, name: effortDisplayName(effort) }],
+        defaultEffort: effort,
+    };
+}
+/**
+ * First account catalog that lists `model` (callers pass default-first).
+ * One failing lookup sits that account out so a sibling's metadata still
+ * resolves — the same isolation as the picker catalog union.
+ */
+export async function discoverAcrossAccounts(accounts, lookup) {
+    for (const account of accounts) {
+        try {
+            const found = await lookup(account);
+            if (found !== undefined)
+                return found;
+        }
+        catch {
+            // sit out
+        }
+    }
+    return undefined;
+}
 /** How long a discovered catalog is trusted before re-fetching. */
 export const DISCOVERY_TTL_MS = 5 * 60_000;
 /**
@@ -286,6 +426,8 @@ export class ModelCatalogCache {
     seeded;
     /** Set by {@link invalidate} so an in-flight disk read cannot resurrect dropped state. */
     seedDisabled = false;
+    /** Bumped by {@link invalidate} so a loser in-flight fetch cannot write back. */
+    generation = 0;
     constructor(persistence, ttlMs = DISCOVERY_TTL_MS) {
         this.persistence = persistence;
         this.ttlMs = ttlMs;
@@ -320,16 +462,25 @@ export class ModelCatalogCache {
     }
     /** Run (or join) the single in-flight fetch, updating memory and disk on success. */
     refresh(fetcher) {
-        this.inflight ??= fetcher()
+        if (this.inflight !== undefined)
+            return this.inflight;
+        const gen = this.generation;
+        const pending = fetcher()
             .then((models) => {
+            if (this.generation !== gen)
+                return models;
             const snapshot = { at: Date.now(), models };
             this.entry = snapshot;
             // Write-through is fire-and-forget: a failed save only costs durability.
             void this.persistence?.save(snapshot).catch(() => undefined);
             return models;
         })
-            .finally(() => { this.inflight = undefined; });
-        return this.inflight;
+            .finally(() => {
+            if (this.generation === gen)
+                this.inflight = undefined;
+        });
+        this.inflight = pending;
+        return pending;
     }
     /**
      * Return the cached catalog when fresh, otherwise fetch and cache it.
@@ -370,7 +521,9 @@ export class ModelCatalogCache {
     }
     /** Drop the cached catalog (e.g. after a 401 proved the credential changed). */
     invalidate() {
+        this.generation += 1;
         this.entry = undefined;
+        this.inflight = undefined;
         this.seedDisabled = true;
         void this.persistence?.clear().catch(() => undefined);
     }
@@ -380,6 +533,16 @@ export function isMissingOrInvalidCredential(error) {
     return error instanceof LlmError
         && (error.code === 'MISSING_CREDENTIAL' || error.code === 'INVALID_CREDENTIAL');
 }
+/** Whether discovery stopped because the caller cancelled or the timeout fired. */
+export function isDiscoveryAborted(error, signal) {
+    if (signal?.aborted === true)
+        return true;
+    // Only treat abort-shaped errors as cancellation when this call had a signal;
+    // a refresh TimeoutError must not fail the whole picker union.
+    return signal !== undefined
+        && error instanceof Error
+        && (error.name === 'AbortError' || error.name === 'TimeoutError');
+}
 /** Whether discovery failed because the access token was rejected. */
 function isDiscoveryAuthFailure(error) {
     return (error instanceof OAuthEndpointError && error.status === 401)

package/lib/providers/copilot.d.ts

@@ -17,10 +17,12 @@ import { LlmAdapter } from '@deepseek-ai/dsh-llm';
 import type { GenerateOptions, LlmModelInfo, LlmProviderInfo, LlmResolvedModelInfo, StreamChunk } from '@deepseek-ai/dsh-llm';
 import type { DeviceFlowSpec } from '../auth/device-flow.js';
 import type { CopilotSession } from '../auth/store.js';
+import type { PoolAdapter } from './pool.js';
 import type { AttachmentStore } from '@deepseek-ai/dsh-attachment';
 import type { ReasoningReplayItem, ResponsesRequestInput, ResponsesStreamEvent } from '../translate/responses.js';
-import { TokenManager } from './common.js';
+import { AccountTokenManager } from './accounts.js';
 import type { CatalogPersistence, DiscoveredModel, FetchFn, ModelEntry } from './common.js';
+import type { RateLimitWait } from './rate-limit.js';
 /**
  * Client id of the VS Code Copilot Chat GitHub App (pi-mono and
  * copilot2api-go use the same value): the app is pre-authorized for the
@@ -118,9 +120,10 @@ export declare function isCopilotPermanentRefreshError(error: unknown): boolean;
  * reasoning efforts (the endpoint discloses no default, so none is claimed).
  * @param session - the stored session (used as-is; never refreshed here).
  * @param fetchFn - fetch implementation (injectable for tests).
+ * @param signal - caller cancellation (pool-assembly timeout).
  * @returns discovered chat models in endpoint order.
  */
-export declare function fetchCopilotModels(session: CopilotSession, fetchFn?: FetchFn): Promise<DiscoveredModel[]>;
+export declare function fetchCopilotModels(session: CopilotSession, fetchFn?: FetchFn, signal?: AbortSignal): Promise<DiscoveredModel[]>;
 /** Which upstream protocol one Copilot model speaks. */
 export type CopilotWire = 'chat-completions' | 'responses';
 /**
@@ -215,7 +218,9 @@ export declare class CopilotResponsesItemNormalizer {
 export interface CopilotAdapterOptions {
     models: readonly ModelEntry[];
     streamIdleTimeoutMs: number;
-    tokens: TokenManager<CopilotSession>;
+    tokens: AccountTokenManager<CopilotSession>;
+    /** Late-bound pool facade (wired after adapter construction); pools list under their first member's provider. */
+    pool?: () => PoolAdapter | undefined;
     /** Whether to fetch the live catalog when logged in (false when config `models` overrides). */
     discovery: boolean;
     /** Warning sink for discovery failures that fall back to the static catalog. */
@@ -226,11 +231,23 @@ export interface CopilotAdapterOptions {
     resolveAttachments?: () => AttachmentStore | undefined;
     /** Durable catalog store seeding capability metadata across restarts. */
     catalogStore?: CatalogPersistence;
+    /** How long this route may hold a turn open waiting for a rate-limit window; defaults to waiting on, six-hour ceiling. */
+    rateLimit?: RateLimitWait;
+    /**
+     * Per-model default reasoning effort override (the Settings page's picker).
+     * Returns the user-configured default for one model, or undefined to follow
+     * the provider's own default.
+     */
+    defaultEffortOf?: (model: string) => string | undefined;
 }
 /** Copilot wire adapter: one instance serves the `copilot` provider route. */
 export declare class CopilotAdapter extends LlmAdapter {
     private readonly options;
     private readonly catalog;
+    /** In-memory catalogs for non-default accounts (the persisted cache is the default's). */
+    private readonly accountCatalogs;
+    /** Account whose snapshot currently lives in {@link catalog}; cleared on default change. */
+    private catalogOwner;
     /**
      * [2026-08-23]-[a reasoning model continuing a tool chain must get its
      * reasoning back or it restarts from scratch every tool round trip; the
@@ -250,9 +267,16 @@ export declare class CopilotAdapter extends LlmAdapter {
     constructor(options: CopilotAdapterOptions);
     /** Discovery fetcher: resolves the session through the refresh-aware path. */
     private fetchCatalog;
+    /** Drop cached catalogs after login/logout so the next list does not reuse a stale plan. */
+    clearAccountCatalog(account?: string): void;
+    /** Persisted cache for the default account; a throwaway cache for any other. */
+    private catalogFor;
     providerInfo(provider: string): LlmProviderInfo;
+    providerRetryPolicy(provider: string): import("@deepseek-ai/dsh-llm").ResolvedRetryPolicy;
     private staticModels;
     listModels(provider: string): Promise<readonly LlmModelInfo[]>;
+    /** The provider's own catalog: union of every account, or one account when named. */
+    listOwnModels(provider: string, account?: string, signal?: AbortSignal): Promise<readonly LlmModelInfo[]>;
     /**
      * The discovered entry for one model. Resolved through the cache's
      * stale-while-revalidate path: capability metadata must stay stable across
@@ -309,7 +333,12 @@ export declare class CopilotAdapter extends LlmAdapter {
      */
     clearReplayState(): void;
     resolveModel(provider: string, model: string): Promise<LlmResolvedModelInfo>;
+    /** Capability resolution of the provider's own models (the pool resolves members here). */
+    resolveOwnModel(provider: string, model: string): Promise<LlmResolvedModelInfo>;
     stream(options: GenerateOptions): AsyncIterable<StreamChunk>;
+    /** Pool seam: stream through one specific account instead of the default. */
+    streamAccount(options: GenerateOptions, account: string): AsyncIterable<StreamChunk>;
+    private streamCore;
     private request;
 }
 export {};