dsh-plugin-subscriptions 0.5.2 → 0.6.0

package/lib/index.js

@@ -1,5 +1,6 @@
 import z from "@deepseek-ai/schemastery";
-import { CONTEXT_WINDOW_EXCEEDED_CODE, CallId, EMPTY_RESPONSE_CODE, LlmAdapter, LlmError, QUOTA_EXCEEDED_CODE, ReasoningEffortId, attributionHeaders, errorChain, isContextWindowExceededError, isQuotaExceededError, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
+import * as llm from "@deepseek-ai/dsh-llm";
+import { CONTEXT_WINDOW_EXCEEDED_CODE, EMPTY_RESPONSE_CODE, LlmAdapter, LlmError, QUOTA_EXCEEDED_CODE, ReasoningEffortId, attributionHeaders, errorChain, isContextWindowExceededError, isQuotaExceededError, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { createServer } from "node:http";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { ProxyAgent, fetch as fetch$1 } from "undici";
@@ -271,13 +272,13 @@ const DISABLED = {
 	bypass: []
 };
 /** Current config; updated by every load/apply/save. */
-let current = DISABLED;
+let current$1 = DISABLED;
 /** The live dispatcher, or undefined when proxies are off/errored. */
 let agent;
 /** Last load/apply failure, surfaced by the config view. */
 let configError;
 /** One lazy load of the on-disk config (module-import cheap; file read once). */
-let ready;
+let ready$1;
 /** Absolute path of the proxy config file. */
 function proxyFilePath() {
 	return dshHomePath("plugins", "subscriptions", "proxy.json");
@@ -392,7 +393,7 @@ async function applyConfig(cfg) {
 			withError(error);
 			next = void 0;
 		}
-		current = cfg;
+		current$1 = cfg;
 	}
 	const previous = agent;
 	agent = next;
@@ -432,16 +433,16 @@ async function loadConfigFile(path) {
 	});
 }
 /** Resolve the module state once from disk; failures disable the proxy. */
-async function ensureReady() {
-	ready ??= loadConfigFile(proxyFilePath()).then(async (cfg) => {
+async function ensureReady$1() {
+	ready$1 ??= loadConfigFile(proxyFilePath()).then(async (cfg) => {
 		await applyConfig(cfg);
-		return current;
+		return current$1;
 	}, async (error) => {
 		withError(error);
 		await applyConfig(void 0);
-		return current;
+		return current$1;
 	});
-	return ready;
+	return ready$1;
 }
 /** Persist a config atomically with owner-only permissions, then apply it. */
 async function persistConfig(cfg, path) {
@@ -462,13 +463,13 @@ async function persistConfig(cfg, path) {
 *   load/apply failure when the stored config is unusable.
 */
 async function proxyGetConfig() {
-	await ensureReady();
+	await ensureReady$1();
 	return {
-		enabled: current.enabled,
-		url: current.url,
-		...current.username === void 0 ? {} : { username: current.username },
-		passwordSet: current.password !== void 0 && current.password !== "",
-		bypass: [...current.bypass],
+		enabled: current$1.enabled,
+		url: current$1.url,
+		...current$1.username === void 0 ? {} : { username: current$1.username },
+		passwordSet: current$1.password !== void 0 && current$1.password !== "",
+		bypass: [...current$1.bypass],
 		...configError === void 0 ? {} : { error: configError }
 	};
 }
@@ -479,14 +480,14 @@ async function proxyGetConfig() {
 * @returns the resulting view (secrets omitted).
 */
 async function proxySetConfig(input) {
-	await ensureReady();
-	const password = input.password === void 0 ? current.password : input.password === null || input.password === "" ? void 0 : input.password;
+	await ensureReady$1();
+	const password = input.password === void 0 ? current$1.password : input.password === null || input.password === "" ? void 0 : input.password;
 	const next = normalizeConfig({
 		enabled: input.enabled,
 		url: input.url,
 		...input.username === void 0 ? {} : { username: input.username },
 		...password === void 0 ? {} : { password },
-		bypass: input.bypass ?? current.bypass
+		bypass: input.bypass ?? current$1.bypass
 	});
 	await persistConfig(next, proxyFilePath());
 	await applyConfig(next);
@@ -502,16 +503,16 @@ async function proxySetConfig(input) {
 * host's global fetch.
 */
 async function proxiedFetch(input, init = {}) {
-	await ensureReady();
+	await ensureReady$1();
 	let dispatcher;
-	if (current.enabled && agent !== void 0) {
+	if (current$1.enabled && agent !== void 0) {
 		let hostname = "";
 		try {
 			hostname = (typeof input === "string" ? new URL(input) : input instanceof URL ? input : new URL(input.url)).hostname;
 		} catch {
 			hostname = "";
 		}
-		if (!matchesBypass(hostname, current.bypass)) dispatcher = agent;
+		if (!matchesBypass(hostname, current$1.bypass)) dispatcher = agent;
 	}
 	if (dispatcher === void 0) return fetch(input, init);
 	return dispatchFetch(input, {
@@ -544,7 +545,7 @@ async function proxyTestConnection(target = DEFAULT_PROXY_TEST_URL, draft) {
 			error: errorMessage(error)
 		};
 	}
-	await ensureReady();
+	await ensureReady$1();
 	let probeAgent;
 	let viaProxy;
 	let closeProbe = false;
@@ -566,7 +567,7 @@ async function proxyTestConnection(target = DEFAULT_PROXY_TEST_URL, draft) {
 		};
 	}
 	else {
-		viaProxy = current.enabled && agent !== void 0 && !matchesBypass(parsed.hostname, current.bypass);
+		viaProxy = current$1.enabled && agent !== void 0 && !matchesBypass(parsed.hostname, current$1.bypass);
 		probeAgent = viaProxy ? agent : void 0;
 	}
 	const started = Date.now();
@@ -939,6 +940,31 @@ const PROVIDER_IDS = [
 	"copilot"
 ];
 /**
+* The stable identity of one session's account: codex keys on the always
+* present `accountId` claim, the others on their display identity, falling
+* back to a refresh-token hash for sessions stored before identity fields
+* existed. Logging the same account in again lands on the same key, so a
+* re-login updates in place instead of duplicating. (The hash fallback can
+* miss that dedup once for a legacy session re-logged with a now-known
+* identity — the duplicate is visible on the Settings page and can simply
+* be logged out.)
+* @param provider - the provider route.
+* @param session - the session to key.
+* @returns the account map key.
+*/
+function accountKeyOf(provider, session) {
+	switch (provider) {
+		case "codex": return session.accountId;
+		case "claude": return session.emailAddress ?? tokenHash(session.refreshToken);
+		case "grok": return session.account ?? tokenHash(session.refreshToken);
+		case "copilot": return session.account ?? tokenHash(session.refreshToken);
+	}
+}
+/** Short stable hash for sessions without an identity field. */
+function tokenHash(refreshToken) {
+	return `token-${createHash("sha256").update(refreshToken).digest("hex").slice(0, 16)}`;
+}
+/**
 * Absolute path of the auth store file.
 * @returns `dshHomePath('plugins', 'subscriptions', 'auth.json')`.
 */
@@ -949,16 +975,17 @@ function authFilePath() {
 function legacyAuthFilePath() {
 	return dshHomePath("plugins", "router", "auth.json");
 }
-/** Check that one durable entry carries the fields every session needs. */
-function assertSessionShape(provider, value) {
-	if (typeof value !== "object" || value === null) throw new Error(`subscriptions auth store: entry "${provider}" is not an object; fix or delete the store file`);
+/** Check that one durable session carries the fields every session needs. */
+function assertSessionShape(provider, account, value) {
+	if (typeof value !== "object" || value === null) throw new Error(`subscriptions auth store: entry "${provider}/${account}" is not an object; fix or delete the store file`);
 	const entry = value;
-	if (typeof entry.accessToken !== "string" || entry.accessToken.length === 0 || typeof entry.refreshToken !== "string" || entry.refreshToken.length === 0 || typeof entry.expiresAt !== "number" || !Number.isFinite(entry.expiresAt)) throw new Error(`subscriptions auth store: entry "${provider}" is missing accessToken/refreshToken/expiresAt; fix or delete the store file`);
+	if (typeof entry.accessToken !== "string" || entry.accessToken.length === 0 || typeof entry.refreshToken !== "string" || entry.refreshToken.length === 0 || typeof entry.expiresAt !== "number" || !Number.isFinite(entry.expiresAt)) throw new Error(`subscriptions auth store: entry "${provider}/${account}" is missing accessToken/refreshToken/expiresAt; fix or delete the store file`);
 }
 /**
 * Read the whole store. A missing file is an empty store; malformed JSON or a
 * malformed entry throws, because silently discarding tokens would strand the
-* user without a diagnosis.
+* user without a diagnosis. Single-account entries are migrated in memory;
+* the next write persists the new shape.
 * @param path - store file path; defaults to {@link authFilePath}.
 * @returns the parsed session map.
 */
@@ -982,7 +1009,7 @@ async function loadStore(path = authFilePath()) {
 	}
 	return parseStore(text, path);
 }
-/** Parse and validate store JSON read from `path`. */
+/** Parse, validate, and migrate store JSON read from `path`. */
 function parseStore(text, path) {
 	let parsed;
 	try {
@@ -991,10 +1018,28 @@ function parseStore(text, path) {
 		throw new Error(`subscriptions auth store at ${path} is not valid JSON; fix or delete the file`);
 	}
 	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error(`subscriptions auth store at ${path} must be a JSON object keyed by provider; fix or delete the file`);
-	const store = parsed;
+	const raw = parsed;
+	const store = {};
 	for (const provider of PROVIDER_IDS) {
-		const entry = store[provider];
-		if (entry !== void 0) assertSessionShape(provider, entry);
+		const entry = raw[provider];
+		if (entry === void 0) continue;
+		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) throw new Error(`subscriptions auth store: entry "${provider}" is not an object; fix or delete the store file`);
+		const record = entry;
+		if (typeof record.accessToken === "string") {
+			assertSessionShape(provider, "(legacy)", record);
+			const session = record;
+			const key = accountKeyOf(provider, session);
+			store[provider] = {
+				default: key,
+				accounts: { [key]: session }
+			};
+			continue;
+		}
+		const accounts = record.accounts;
+		if (typeof accounts !== "object" || accounts === null || Array.isArray(accounts)) throw new Error(`subscriptions auth store: entry "${provider}" has no accounts map; fix or delete the store file`);
+		if (record.default !== void 0 && typeof record.default !== "string") throw new Error(`subscriptions auth store: entry "${provider}" default is not a string; fix or delete the store file`);
+		for (const [account, session] of Object.entries(accounts)) assertSessionShape(provider, account, session);
+		store[provider] = record;
 	}
 	return store;
 }
@@ -1014,8 +1059,8 @@ async function writeStore(store, path) {
 /**
 * One write chain per store path. Every mutation is a read-modify-write of a
 * single JSON file, and the plugin has several independent writers — a login,
-* a logout, and one token refresh per provider adapter, each on its own
-* schedule. Overlapping them unserialized costs whichever provider read the
+* a logout, and one token refresh per provider account, each on its own
+* schedule. Overlapping them unserialized costs whichever account read the
 * store first its entry.
 *
 * A chain is dropped once nothing is queued behind it, so the map holds an
@@ -1040,37 +1085,94 @@ async function serialize(path, action) {
 	}
 }
 /**
-* Read one provider's session.
+* List one provider's accounts, default first.
+* @param provider - the provider route.
+* @param path - store file path; defaults to {@link authFilePath}.
+* @returns the account entries in stable order (empty when logged out).
+*/
+async function listAccounts(provider, path = authFilePath()) {
+	const entry = (await loadStore(path))[provider];
+	if (entry === void 0) return [];
+	const accounts = Object.entries(entry.accounts).map(([key, session]) => ({
+		key,
+		session
+	}));
+	accounts.sort((a, b) => Number(b.key === entry.default) - Number(a.key === entry.default));
+	return accounts;
+}
+/**
+* Read one account's session.
 * @param provider - the provider route.
+* @param account - the account key; defaults to the provider's default account.
 * @param path - store file path; defaults to {@link authFilePath}.
-* @returns the stored session, or `undefined` when logged out.
+* @returns the stored session, or `undefined` when absent.
 */
-async function getSession(provider, path = authFilePath()) {
-	return (await loadStore(path))[provider];
+async function getAccountSession(provider, account, path = authFilePath()) {
+	const entry = (await loadStore(path))[provider];
+	if (entry === void 0) return void 0;
+	const key = account ?? entry.default;
+	if (key === void 0) return void 0;
+	return entry.accounts[key];
 }
 /**
-* Write one provider's session, preserving the others.
+* Write one account's session, preserving the others. The first account of a
+* provider becomes its default.
 * @param provider - the provider route.
+* @param account - the account key (see {@link accountKeyOf}).
 * @param session - the fresh session from a login or refresh.
 * @param path - store file path; defaults to {@link authFilePath}.
 */
-async function saveSession(provider, session, path = authFilePath()) {
+async function saveAccountSession(provider, account, session, path = authFilePath()) {
 	return serialize(path, async () => {
 		const store = await loadStore(path);
-		store[provider] = session;
+		const entry = store[provider];
+		store[provider] = {
+			default: entry?.default ?? account,
+			accounts: {
+				...entry?.accounts,
+				[account]: session
+			}
+		};
+		await writeStore(store, path);
+	});
+}
+/**
+* Delete one account's session (logout). Deleting the default moves the badge
+* to the next remaining account.
+* @param provider - the provider route.
+* @param account - the account key.
+* @param path - store file path; defaults to {@link authFilePath}.
+*/
+async function deleteAccountSession(provider, account, path = authFilePath()) {
+	return serialize(path, async () => {
+		const store = await loadStore(path);
+		const entry = store[provider];
+		if (entry === void 0 || !(account in entry.accounts)) return;
+		const accounts = { ...entry.accounts };
+		delete accounts[account];
+		if (Object.keys(accounts).length === 0) delete store[provider];
+		else store[provider] = {
+			...entry.default === account ? { default: Object.keys(accounts)[0] } : { default: entry.default },
+			accounts
+		};
 		await writeStore(store, path);
 	});
 }
 /**
-* Delete one provider's session (logout).
+* Pin the account direct (non-pool) routes serve.
 * @param provider - the provider route.
+* @param account - the account key; must exist.
 * @param path - store file path; defaults to {@link authFilePath}.
 */
-async function deleteSession(provider, path = authFilePath()) {
+async function setDefaultAccount(provider, account, path = authFilePath()) {
 	return serialize(path, async () => {
 		const store = await loadStore(path);
-		if (store[provider] === void 0) return;
-		delete store[provider];
+		const entry = store[provider];
+		if (entry === void 0 || !(account in entry.accounts)) throw new Error(`no ${provider} account "${account}" is logged in`);
+		store[provider] = {
+			...entry,
+			default: account
+		};
 		await writeStore(store, path);
 	});
 }
@@ -1126,6 +1228,30 @@ function readString(payload, field) {
 	if (typeof value !== "string" || value.length === 0) throw new BadRequest(`payload.${field} must be a non-empty string`);
 	return value;
 }
+/** Validate the `setModelDefault` endpoint's payload. */
+function readModelDefaultInput(payload) {
+	const provider = readProvider(payload);
+	const model = readString(payload, "model");
+	const record = payload;
+	let effort;
+	if (record.effort !== void 0) {
+		if (typeof record.effort !== "string" || record.effort.length === 0) throw new BadRequest("payload.effort must be a non-empty string when present");
+		effort = record.effort;
+	}
+	return {
+		provider,
+		model,
+		...effort === void 0 ? {} : { effort }
+	};
+}
+/** Validate the optional Claude login method. */
+function readLoginMethod(payload, provider) {
+	const method = payload.method;
+	if (method === void 0) return void 0;
+	if (provider !== "claude") throw new BadRequest("payload.method is only valid for claude");
+	if (method !== "oauth" && method !== "keychain") throw new BadRequest("payload.method must be \"oauth\" or \"keychain\"");
+	return method;
+}
 /** Validate the `setSpeed` endpoint's tier. */
 function readSpeedTier(payload) {
 	const tier = payload.tier;
@@ -1170,6 +1296,14 @@ function readVideoName(payload) {
 	if (typeof name$1 !== "string" || !VIDEO_NAME_PATTERN.test(name$1)) throw new BadRequest("payload.name must be a bare .mp4 file name");
 	return name$1;
 }
+/** Validate the `usage` endpoint's optional force flag. */
+function readForce(payload) {
+	if (typeof payload !== "object" || payload === null) return false;
+	const force = payload.force;
+	if (force === void 0) return false;
+	if (typeof force !== "boolean") throw new BadRequest("payload.force must be a boolean when present");
+	return force;
+}
 /** Validate the session id both speed endpoints carry. */
 function readSessionId(payload) {
 	if (typeof payload !== "object" || payload === null) throw new BadRequest("payload must be an object");
@@ -1237,13 +1371,16 @@ function readProxyTestPayload(payload) {
 		...proxy === void 0 ? {} : { proxy }
 	};
 }
-async function dispatch(controller, speed, proxy, endpoint, payload, signal) {
+async function dispatch(controller, speed, proxy, modelDefaults, endpoint, payload, signal) {
 	switch (endpoint) {
 		case "status": {
 			const entries = await Promise.all(PROVIDER_IDS.map(async (provider) => [provider, await controller.status(provider)]));
 			return ok({ providers: Object.fromEntries(entries) });
 		}
-		case "login": return ok(await controller.login(readProvider(payload)));
+		case "login": {
+			const provider = readProvider(payload);
+			return ok(await controller.login(provider, readLoginMethod(payload, provider)));
+		}
 		case "manual": {
 			const provider = readProvider(payload);
 			await controller.manual(provider, readString(payload, "input"));
@@ -1252,10 +1389,20 @@ async function dispatch(controller, speed, proxy, endpoint, payload, signal) {
 		case "cancel":
 			await controller.cancel(readProvider(payload));
 			return ok({ ok: true });
-		case "logout":
-			await controller.logout(readProvider(payload));
+		case "logout": {
+			const provider = readProvider(payload);
+			await controller.logout(provider, readString(payload, "account"));
+			return ok({ ok: true });
+		}
+		case "setDefault": {
+			const provider = readProvider(payload);
+			await controller.setDefault(provider, readString(payload, "account"));
 			return ok({ ok: true });
-		case "usage": return ok(await controller.usage(readProvider(payload), signal));
+		}
+		case "usage": {
+			const provider = readProvider(payload);
+			return ok(await controller.usage(provider, readString(payload, "account"), signal, readForce(payload)));
+		}
 		case "image": return ok(await controller.readImage(readImageRef(payload), signal));
 		case "video": return ok(await controller.readVideo(readVideoName(payload), signal));
 		case "speed": return ok(await speed.speed(readSessionId(payload)));
@@ -1271,6 +1418,16 @@ async function dispatch(controller, speed, proxy, endpoint, payload, signal) {
 		case "proxyTest":
 			if (proxy === void 0) throw new BadRequest("proxy configuration is unavailable");
 			return ok(await proxy.test(readProxyTestPayload(payload)));
+		case "modelDefaults":
+			if (modelDefaults === void 0) throw new BadRequest("model defaults are unavailable");
+			return ok(await modelDefaults.catalog());
+		case "setModelDefault":
+			if (modelDefaults === void 0) throw new BadRequest("model defaults are unavailable");
+			{
+				const input = readModelDefaultInput(payload);
+				await modelDefaults.set(input.provider, input.model, input.effort);
+			}
+			return ok({ ok: true });
 		default: throw new BadRequest(`unknown /subscriptions-auth endpoint "${endpoint}"`);
 	}
 }
@@ -1280,13 +1437,14 @@ async function dispatch(controller, speed, proxy, endpoint, payload, signal) {
 * @param controller - the auth operations backing the endpoints.
 * @param speed - the per-session speed-tier state backing the Speed toggle.
 * @param proxy - optional proxy-config controller backing `proxyGet`/`proxySet`/`proxyTest`.
+* @param modelDefaults - optional per-model default-effort state backing `modelDefaults`/`setModelDefault`.
 */
-function registerAuthRpc(ctx, controller, speed, proxy = void 0) {
+function registerAuthRpc(ctx, controller, speed, proxy = void 0, modelDefaults = void 0) {
 	ctx.inject(["connection"], (ctx$1) => {
 		const connection = ctx$1.get("connection");
 		ctx$1.effect(() => connection.rpc.handle(SUBSCRIPTIONS_AUTH_CHANNEL, async (endpoint, payload, signal) => {
 			try {
-				return await dispatch(controller, speed, proxy, endpoint, payload, signal);
+				return await dispatch(controller, speed, proxy, modelDefaults, endpoint, payload, signal);
 			} catch (error) {
 				return failure(error);
 			}
@@ -1294,6 +1452,442 @@ function registerAuthRpc(ctx, controller, speed, proxy = void 0) {
 	});
 }
 
+//#endregion
+//#region src/model-defaults.ts
+/** Absolute path of the defaults file. */
+function modelDefaultsFilePath() {
+	return dshHomePath("plugins", "subscriptions", "model-defaults.json");
+}
+const EMPTY = Object.freeze({});
+/** In-memory snapshot read by every consumer (adapters, RPC). */
+let current = EMPTY;
+/** One lazy load of the on-disk file (read once per process). */
+let ready;
+/** Last load failure, surfaced to callers that care; defaults stay empty. */
+let loadError;
+/**
+* Serialises every write: the read-modify-write sequence must not interleave,
+* or a fast second save would compute its snapshot from the stale `current`
+* and silently drop the first update (the UI disables only the row being
+* saved, so overlaps are reachable).
+*/
+let writeChain = Promise.resolve();
+/**
+* Validate one persisted provider section: a string→string map, or undefined.
+* Malformed *entries* are skipped, not the whole section: one bad value (a
+* hand edit losing its quotes) must not silently un-configure every model in
+* that provider. What was dropped is reported so the caller can surface it
+* instead of the loss disappearing.
+*/
+function sanitizeProvider(value, dropped) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+	const entries = {};
+	for (const [model, effort] of Object.entries(value)) {
+		if (typeof effort !== "string" || effort.length === 0) {
+			dropped.push(model);
+			continue;
+		}
+		entries[model] = effort;
+	}
+	if (Object.keys(entries).length === 0) return void 0;
+	return Object.freeze(entries);
+}
+/** Validate the raw document: only known providers, malformed sections dropped. */
+function sanitizeDefaults(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return {
+		defaults: EMPTY,
+		dropped: []
+	};
+	const record = value;
+	const result = {};
+	const dropped = [];
+	for (const provider of PROVIDER_IDS) {
+		const section = sanitizeProvider(record[provider], dropped);
+		if (section !== void 0) result[provider] = section;
+	}
+	return {
+		defaults: Object.freeze(result),
+		dropped
+	};
+}
+/** Read and validate the on-disk file; a missing file reads as empty. */
+async function loadFile(path) {
+	let text;
+	try {
+		text = await readFile(path, "utf8");
+	} catch (error) {
+		if (error.code === "ENOENT") return EMPTY;
+		throw error;
+	}
+	try {
+		const { defaults, dropped } = sanitizeDefaults(JSON.parse(text));
+		if (dropped.length > 0) loadError = /* @__PURE__ */ new Error(`subscriptions model defaults: ${dropped.length} malformed entr${dropped.length === 1 ? "y" : "ies"} skipped (${dropped.join(", ")}); fix or delete the file`);
+		return defaults;
+	} catch {
+		throw new Error(`subscriptions model defaults at ${path} are not valid JSON; fix or delete the file`);
+	}
+}
+/** Resolve the module state once from disk; failures leave the defaults empty. */
+async function ensureReady() {
+	ready ??= loadFile(modelDefaultsFilePath()).then((loaded) => {
+		current = loaded;
+	}, (error) => {
+		loadError = error;
+		current = EMPTY;
+	});
+	return ready;
+}
+/** Persist a snapshot atomically with owner-only permissions. */
+async function atomicPersist(defaults, path) {
+	await mkdir(dirname(path), { recursive: true });
+	const tmp = `${path}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
+	try {
+		await writeFile(tmp, JSON.stringify(defaults, null, 2), { mode: 384 });
+		await chmod(tmp, 384);
+		await rename(tmp, path);
+	} catch (error) {
+		await rm(tmp, { force: true });
+		throw error;
+	}
+}
+let persistDefaults = atomicPersist;
+/**
+* Clone one provider section, or undefined when nothing is configured for it.
+* The clone is prototype-less: model ids are provider-supplied catalog data
+* used as object keys, and consumers index the section directly (the RPC
+* catalog in index.ts does), so an id like `toString` would otherwise yield an
+* inherited *function* where a string is declared.
+*/
+function sectionOf(defaults, provider) {
+	const section = defaults[provider];
+	if (section === void 0) return void 0;
+	return Object.assign(Object.create(null), section);
+}
+/**
+* Ready the defaults store.
+* @internal Exported for tests; index.ts calls it at apply time so every
+* later synchronous read sees the persisted state.
+*/
+async function loadModelDefaults() {
+	await ensureReady();
+}
+/**
+* The configured default effort for one model, or undefined when none (the
+* picker then follows the provider's own default).
+* @internal Exported for the adapters' `defaultEffortOf` options.
+*/
+function defaultEffortOf(provider, model) {
+	const section = current[provider];
+	if (section === void 0) return void 0;
+	return Object.prototype.hasOwnProperty.call(section, model) ? section[model] : void 0;
+}
+/**
+* Set or clear one model's configured default effort, then persist. The
+* memory snapshot updates only after the atomic write succeeds, so a failed
+* write never leaves the live state ahead of the file.
+* @param provider - the subscription provider route.
+* @param model - the wire model id.
+* @param effort - the effort id, or undefined to clear the override.
+*/
+function setDefaultEffort(provider, model, effort) {
+	const run = writeChain.then(async () => {
+		await ensureReady();
+		const section = { ...sectionOf(current, provider) ?? {} };
+		if (effort === void 0) delete section[model];
+		else section[model] = effort;
+		const next = { ...current };
+		if (Object.keys(section).length === 0) delete next[provider];
+		else next[provider] = Object.freeze(section);
+		const frozen = Object.freeze(next);
+		await persistDefaults(frozen, modelDefaultsFilePath());
+		current = frozen;
+	});
+	writeChain = run.catch(() => void 0);
+	return run;
+}
+
+//#endregion
+//#region src/providers/rate-limit.ts
+/**
+* Extra time added to every provider-disclosed wait. Absorbs clock skew
+* between the harness and the provider, so a retry does not land a moment
+* before the window actually reopens and burn an attempt on a second 429.
+*/
+const RESET_GRACE_MS = 2e3;
+/** Shortest wait ever scheduled, including for a reset instant already in the past. */
+const MIN_WAIT_MS = 1e3;
+/** Below this a bare number is a delay in seconds rather than an epoch stamp. */
+const EPOCH_SECONDS_FLOOR = 1e9;
+/** At or above this a bare epoch stamp is already in milliseconds. */
+const EPOCH_MILLIS_FLOOR = 0xe8d4a51000;
+/** Node's maximum timer delay; a longer wait cannot be scheduled at all. */
+const MAX_TIMER_DELAY_MS = 2147483647;
+/** Default ceiling on a rate-limit wait: six hours covers a five-hour session window with slack. */
+const DEFAULT_RATE_LIMIT_MAX_WAIT_MS = 360 * 60 * 1e3;
+/**
+* Interpret a bare numeric rate-limit value, which providers write in three
+* shapes: epoch milliseconds, epoch seconds, or a delay in seconds. The
+* magnitude separates them unambiguously for any plausible value — an epoch in
+* seconds is ~1.8e9 today, while a delay of even a full week is ~6e5.
+* @param value - the raw numeric value.
+* @param now - the current epoch milliseconds.
+* @returns epoch milliseconds of the reset, or undefined when the value is unusable.
+*/
+function resetInstantFromNumber(value, now) {
+	if (!Number.isFinite(value) || value <= 0) return void 0;
+	if (value >= EPOCH_MILLIS_FLOOR) return value;
+	if (value >= EPOCH_SECONDS_FLOOR) return value * 1e3;
+	return now + value * 1e3;
+}
+/**
+* Parse a Go-style duration (`6m0s`, `1h2m3.5s`, `150ms`) into milliseconds —
+* the form OpenAI-compatible `x-ratelimit-reset-*` headers use.
+* @param text - the raw header value.
+* @returns the duration in milliseconds, or undefined when the text is not one.
+*/
+function durationMs(text) {
+	const trimmed = text.trim();
+	if (trimmed.length === 0) return void 0;
+	const pattern = /(\d+(?:\.\d+)?)(ms|h|m|s)/y;
+	const units = {
+		h: 36e5,
+		m: 6e4,
+		s: 1e3,
+		ms: 1
+	};
+	let total = 0;
+	let matched = false;
+	let index = 0;
+	let previousUnit = Number.POSITIVE_INFINITY;
+	for (;;) {
+		pattern.lastIndex = index;
+		const match = pattern.exec(trimmed);
+		if (match === null) break;
+		const unit = units[match[2]];
+		if (unit >= previousUnit) return void 0;
+		previousUnit = unit;
+		total += Number(match[1]) * unit;
+		index = pattern.lastIndex;
+		matched = true;
+	}
+	if (!matched || index !== trimmed.length) return void 0;
+	return total > 0 ? total : void 0;
+}
+/**
+* Interpret any single rate-limit value — a number, a numeric string, a
+* duration (`6m0s`), or a date — as the instant a window reopens. One reader
+* for every shape, so a provider that changes the encoding of a field it
+* already sends does not need a code change here.
+* @param value - the raw header value or JSON field.
+* @param now - the current epoch milliseconds.
+* @returns epoch milliseconds of the reset, or undefined when the value is unusable.
+*/
+function resetInstantFromValue(value, now) {
+	if (typeof value === "number") return resetInstantFromNumber(value, now);
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim();
+	if (trimmed.length === 0) return void 0;
+	const numeric = Number(trimmed);
+	if (Number.isFinite(numeric)) return resetInstantFromNumber(numeric, now);
+	const duration = durationMs(trimmed);
+	if (duration !== void 0) return now + duration;
+	const parsed = Date.parse(trimmed);
+	return Number.isFinite(parsed) ? parsed : void 0;
+}
+/**
+* Read a header carrying any of the {@link resetInstantFromValue} shapes.
+* @param response - the failed response.
+* @param name - the header to read.
+* @param now - the current epoch milliseconds.
+* @returns epoch milliseconds of the reset, or undefined when absent or unusable.
+*/
+function resetInstantFromHeader(response, name$1, now) {
+	return resetInstantFromValue(response.headers.get(name$1), now);
+}
+/**
+* Read the RFC 7231 `retry-after` header in both its forms: a delay in seconds
+* (never an epoch stamp, whatever its magnitude) or an HTTP-date.
+* @param response - the failed response.
+* @param now - the current epoch milliseconds.
+* @returns epoch milliseconds of the reset, or undefined when absent or unusable.
+*/
+function retryAfterInstant(response, now) {
+	const raw = response.headers.get("retry-after");
+	if (raw === null) return void 0;
+	const trimmed = raw.trim();
+	if (trimmed.length === 0) return void 0;
+	const seconds = Number(trimmed);
+	if (Number.isFinite(seconds)) return seconds > 0 ? now + seconds * 1e3 : void 0;
+	const parsed = Date.parse(trimmed);
+	return Number.isFinite(parsed) ? parsed : void 0;
+}
+/**
+* Parse a response body as JSON without throwing on the non-JSON bodies
+* providers occasionally return under load (an HTML gateway page, say).
+* @param body - the complete response body.
+* @returns the parsed value, or undefined when the body is not JSON.
+*/
+function jsonBody(body) {
+	if (body.length === 0) return void 0;
+	try {
+		return JSON.parse(body);
+	} catch {
+		return;
+	}
+}
+/** How deep {@link resetFromFields} walks; every observed payload nests one or two levels. */
+const MAX_BODY_DEPTH = 4;
+/**
+* Find a reset instant under any of the named keys, anywhere in a parsed body.
+*
+* The search is by key rather than by path on purpose: providers move the same
+* field between containers (`detail`, `error`, top level) across endpoints and
+* versions, and a path-shaped reader silently stops working when they do. Only
+* the key list is provider-specific.
+* @param value - the parsed body, or any nested value.
+* @param keys - field names this provider uses for a reset or delay.
+* @param now - the current epoch milliseconds.
+* @param depth - remaining recursion depth.
+* @returns the earliest instant found, or undefined when no key matched.
+*/
+function resetFromFields(value, keys, now, depth = MAX_BODY_DEPTH) {
+	if (depth <= 0 || value === null || typeof value !== "object") return void 0;
+	let earliest;
+	const consider = (candidate) => {
+		if (candidate !== void 0 && (earliest === void 0 || candidate < earliest)) earliest = candidate;
+	};
+	if (Array.isArray(value)) {
+		for (const item of value) consider(resetFromFields(item, keys, now, depth - 1));
+		return earliest;
+	}
+	for (const [key, nested] of Object.entries(value)) if (keys.includes(key)) consider(resetInstantFromValue(nested, now));
+	else consider(resetFromFields(nested, keys, now, depth - 1));
+	return earliest;
+}
+/**
+* The earliest of several candidate reset instants, ignoring absent ones. The
+* earliest is the one that matters: it is the first moment any of the reported
+* limits allows a request again.
+* @param candidates - reset instants in no particular order.
+* @returns the earliest instant, or undefined when every candidate is absent.
+*/
+function earliestReset(...candidates) {
+	let earliest;
+	for (const candidate of candidates) {
+		if (candidate === void 0) continue;
+		if (earliest === void 0 || candidate < earliest) earliest = candidate;
+	}
+	return earliest;
+}
+/**
+* Turn a reset instant into the wait to report as `providerRetryAfterMs`.
+*
+* Deliberately not capped: a reset beyond the policy's `maxDelayMs` makes the
+* retry plugin delegate immediately, failing the turn at once with the real
+* reset in the message, rather than clamping the wait down and burning the
+* retry budget against a window that is still closed.
+* @param instant - epoch milliseconds the window reopens.
+* @param now - the current epoch milliseconds.
+* @returns the wait in milliseconds, never below {@link MIN_WAIT_MS}.
+*/
+function waitFromReset(instant, now) {
+	return Math.max(MIN_WAIT_MS, instant - now + RESET_GRACE_MS);
+}
+/** Header names worth showing when a 429 disclosed no reset this code recognizes. */
+const DIAGNOSTIC_HEADER = /rate-?limit|retry|reset|^x-codex-/i;
+/**
+* Render the rate-limit-shaped headers and the head of the body of a 429 whose
+* reset instant nothing parsed. Emitted through the adapter's `onWarn`, this is
+* how an unrecognized provider field gets named from live traffic instead of
+* being guessed at.
+*
+* It is also where the per-bucket rollover snapshots land by design — no reader
+* parks a turn on one, because on a 429 they cannot say which bucket refused —
+* so the operator still sees what the provider disclosed.
+* @param response - the failed response.
+* @param body - the complete response body.
+* @returns a one-line diagnostic.
+*/
+function rateLimitDiagnostics(response, body) {
+	const headers = [];
+	response.headers.forEach((value, key) => {
+		if (DIAGNOSTIC_HEADER.test(key)) headers.push(`${key}: ${value}`);
+	});
+	headers.sort();
+	const rendered = headers.length > 0 ? headers.join("; ") : "(none)";
+	const head = body.slice(0, 200);
+	return `429 disclosed no reset time; headers [${rendered}]; body ${head.length > 0 ? head : "(empty)"}`;
+}
+/**
+* The retry shape every subscription route starts from: Claude Code's own SDK
+* numbers — ten retries after the first attempt, exponential backoff from 1s
+* doubling per attempt, capped at 60s, plus 20% jitter.
+*
+* Shared across all four routes rather than kept to claude, because what these
+* numbers are tuned for is the shape of a subscription endpoint — a consumer
+* plan behind a session window, which sheds load in bursts and rewards an
+* attempt that outlasts them — and that is the same on all four. The dsh-llm
+* defaults (5 retries from 500ms to 10s) give up after about fifteen seconds,
+* which is short for that.
+*
+* The 60s cap governs local backoff only: a disclosed rate-limit reset is
+* accepted up to the configured wait ceiling instead.
+*/
+const DEFAULT_RETRY = Object.freeze({
+	maxRetries: 10,
+	initialDelayMs: 1e3,
+	maxDelayMs: 6e4,
+	jitterRatio: .2
+});
+/** Waiting behavior a route falls back to when the plugin passed none (waiting on, six-hour ceiling). */
+const DEFAULT_RATE_LIMIT_WAIT = Object.freeze({
+	wait: true,
+	maxWaitMs: DEFAULT_RATE_LIMIT_MAX_WAIT_MS
+});
+/**
+* Validate and default the rate-limit waiting config.
+* @param config - the raw plugin config section, when present.
+* @param path - diagnostic path naming the config that owns the value.
+* @returns the resolved, immutable behavior.
+*/
+function resolveRateLimitWait(config, path) {
+	const wait = config?.wait ?? true;
+	const maxWaitMs = config?.maxWaitMs ?? DEFAULT_RATE_LIMIT_MAX_WAIT_MS;
+	if (!Number.isFinite(maxWaitMs) || maxWaitMs <= 0) throw new Error(`${path}.maxWaitMs must be a positive finite number of milliseconds`);
+	if (maxWaitMs > MAX_TIMER_DELAY_MS) throw new Error(`${path}.maxWaitMs must be no greater than ${String(MAX_TIMER_DELAY_MS)} (the maximum schedulable delay)`);
+	return Object.freeze({
+		wait,
+		maxWaitMs
+	});
+}
+/**
+* Resolve one route's retry policy, widening the delay ceiling to the
+* configured wait so a disclosed reset hours out is accepted rather than
+* refused.
+*
+* The ceiling is shared with local exponential backoff, so widening it also
+* raises how long an unrelated transient failure may back off for. That stays
+* bounded by the finite retry budget — the claude route's ten retries reach
+* 512 s per attempt at most — and it only governs when the provider disclosed
+* nothing, which is exactly the case where a longer wait is the safer guess.
+* @param defaults - the route's retry shape.
+* @param rateLimit - resolved waiting behavior.
+* @param path - diagnostic path naming the provider route.
+* @returns the policy to report from `providerRetryPolicy`.
+*/
+function subscriptionRetryPolicy(defaults, rateLimit, path) {
+	const maxDelayMs = rateLimit.wait ? Math.max(defaults.maxDelayMs, rateLimit.maxWaitMs) : defaults.maxDelayMs;
+	return resolveRetryPolicy({
+		mode: "normal",
+		maxRetries: defaults.maxRetries,
+		backoff: {
+			initialDelayMs: defaults.initialDelayMs,
+			maxDelayMs,
+			jitterRatio: defaults.jitterRatio
+		}
+	}, path);
+}
+
 //#endregion
 //#region src/providers/common.ts
 /**
@@ -1324,38 +1918,56 @@ function validateModels(models, label) {
 	});
 }
 /**
-* Build an LlmError from a non-2xx provider response, reading and truncating
-* the body for the message and mapping the status to a stable code.
+* Build an LlmError from a non-2xx provider response, mapping the status to a
+* stable code and, for a rate-limited request, the disclosed reset instant to
+* the `providerRetryAfterMs` the retry plugin waits out.
+*
+* A 429 classifies as `RATE_LIMIT` on the strength of the status alone, ahead
+* of the quota-wording check. On these routes there is no terminal quota to
+* distinguish: a subscription has no balance to top up, only a window that
+* reopens, and providers announce an exhausted window with wording
+* (`usage_limit_reached`) the shared classifier reads as permanent.
 * @param response - the failed response.
 * @param label - diagnostic prefix naming the provider API.
+* @param options - the calling provider's rate-limit reader and warning sink.
 * @returns the classified error.
 */
-async function httpLlmError(response, label) {
+async function httpLlmError(response, label, options = {}) {
 	let body = "";
 	try {
-		body = (await response.text()).slice(0, 500);
+		body = await response.text();
 	} catch {}
-	const message = body.length > 0 ? `${label} error (HTTP ${String(response.status)}): ${body}` : `${label} error (HTTP ${String(response.status)})`;
+	const shown = body.slice(0, 500);
+	const message = shown.length > 0 ? `${label} error (HTTP ${String(response.status)}): ${shown}` : `${label} error (HTTP ${String(response.status)})`;
 	let code;
 	if (response.status === 401 || response.status === 403) code = "AUTH";
-	else if (isQuotaExceededError(body)) code = QUOTA_EXCEEDED_CODE;
 	else if (response.status === 429) code = "RATE_LIMIT";
-	else if (response.status === 400 && isContextWindowExceededError(body)) code = CONTEXT_WINDOW_EXCEEDED_CODE;
+	else if (isQuotaExceededError(shown)) code = QUOTA_EXCEEDED_CODE;
+	else if (response.status === 400 && isContextWindowExceededError(shown)) code = CONTEXT_WINDOW_EXCEEDED_CODE;
 	else if (response.status === 408 || response.status === 504) code = "TIMEOUT";
 	else if (response.status >= 500) code = "SERVER";
 	else code = `HTTP_${String(response.status)}`;
-	const retryAfter = response.headers.get("retry-after");
-	let providerRetryAfterMs;
-	if (retryAfter !== null) {
-		const seconds = Number(retryAfter);
-		if (Number.isFinite(seconds) && seconds > 0) providerRetryAfterMs = seconds * 1e3;
-	}
+	const now = Date.now();
+	const rateLimited = response.status === 429;
+	const reset = rateLimited ? options.rateLimitReset?.(response, body, now) ?? retryAfterInstant(response, now) : retryAfterInstant(response, now);
+	if (reset === void 0 && rateLimited) options.onWarn?.(`${label}: ${rateLimitDiagnostics(response, body)}`);
 	return new LlmError(message, code, {
 		status: response.status,
-		...providerRetryAfterMs === void 0 ? {} : { providerRetryAfterMs }
+		...reset === void 0 ? {} : { providerRetryAfterMs: waitFromReset(reset, now) }
 	});
 }
 /**
+* Parse a response's `retry-after` header (seconds) into milliseconds.
+* @param response - the failed response.
+* @returns the delay in ms, or undefined when absent/unusable.
+*/
+function parseRetryAfterMs(response) {
+	const retryAfter = response.headers.get("retry-after");
+	if (retryAfter === null) return void 0;
+	const seconds = Number(retryAfter);
+	return Number.isFinite(seconds) && seconds > 0 ? seconds * 1e3 : void 0;
+}
+/**
 * Create an idle watchdog chained to the caller's signal.
 * @param caller - the request's own abort signal, when present.
 * @param timeoutMs - maximum idle interval while a stream read is outstanding.
@@ -1409,11 +2021,20 @@ var OAuthEndpointError = class extends Error {
 	status;
 	/** The provider's OAuth `error` code (e.g. `invalid_grant`), when present. */
 	oauthCode;
-	constructor(message, status, oauthCode) {
+	/**
+	* The endpoint's `retry-after`, in ms, when it sent one. Usage/models
+	* endpoints reuse this error type and can rate-limit progressively (each
+	* hit within the window extends the next one), so a caller retrying on a
+	* fixed schedule instead of honoring this can keep an account locked out
+	* indefinitely.
+	*/
+	retryAfterMs;
+	constructor(message, status, oauthCode, retryAfterMs$1) {
 		super(message);
 		this.name = "OAuthEndpointError";
 		this.status = status;
 		this.oauthCode = oauthCode;
+		this.retryAfterMs = retryAfterMs$1;
 	}
 };
 /**
@@ -1430,7 +2051,7 @@ async function oauthEndpointError(response, label) {
 		oauthCode = typeof parsed.error === "string" ? parsed.error : void 0;
 		detail = typeof parsed.error_description === "string" ? parsed.error_description : oauthCode ?? "";
 	} catch {}
-	return new OAuthEndpointError(detail.length > 0 ? `${label} token endpoint error (HTTP ${String(response.status)}): ${detail}` : `${label} token endpoint error (HTTP ${String(response.status)})`, response.status, oauthCode);
+	return new OAuthEndpointError(detail.length > 0 ? `${label} token endpoint error (HTTP ${String(response.status)}): ${detail}` : `${label} token endpoint error (HTTP ${String(response.status)})`, response.status, oauthCode, parseRetryAfterMs(response));
 }
 /**
 * Per-provider session freshness: loads the stored session, refreshes
@@ -1487,13 +2108,94 @@ var TokenManager = class {
 		}
 	}
 	async doRefresh(session) {
-		const current$1 = await this.options.load();
-		if (current$1 !== void 0 && current$1.accessToken !== session.accessToken && current$1.expiresAt - Date.now() > this.options.preemptMs) return current$1;
-		const next = await this.options.refresh(current$1 ?? session);
+		const current$2 = await this.options.load();
+		if (current$2 !== void 0 && current$2.accessToken !== session.accessToken && current$2.expiresAt - Date.now() > this.options.preemptMs) return current$2;
+		const next = await this.options.refresh(current$2 ?? session);
 		await this.options.save(next);
 		return next;
 	}
 };
+/** Bound on one account catalog fetch or usage poll — a hang must not block the picker. */
+const DISCOVERY_TIMEOUT_MS = 1e4;
+/**
+* Run `work` with an aborting signal. Resolves undefined when the timeout
+* fires (the fetch is aborted); other failures propagate.
+*/
+function withTimeout(work, timeoutMs) {
+	const signal = AbortSignal.timeout(timeoutMs);
+	const aborted = new Promise((resolve) => {
+		if (signal.aborted) resolve(void 0);
+		else signal.addEventListener("abort", () => resolve(void 0), { once: true });
+	});
+	return Promise.race([work(signal).then((value) => signal.aborted ? void 0 : value, (error) => {
+		if (signal.aborted) return void 0;
+		throw error;
+	}), aborted]);
+}
+/** Display name for a wire reasoning-effort identifier. */
+function effortDisplayName(effort) {
+	return effort === "xhigh" ? "Extra High" : effort.charAt(0).toUpperCase() + effort.slice(1);
+}
+/**
+* Fold a configured per-model default effort into a reasoning block, keeping
+* the DSH runtime invariant `defaultEffort ∈ efforts` (the runtime rejects an
+* unknown default with `INVALID_MODEL_REASONING`).
+*
+* A configured level the base set does not advertise is *dropped*, not
+* appended: for claude/grok/copilot the base is the provider's live catalog,
+* i.e. the truth about what the model accepts, so honouring a stale override
+* would put an unsupported effort on every single request instead of letting
+* the harness reject it before provider I/O. The override then simply falls
+* back to the provider's own default until the user picks a level the catalog
+* still lists.
+*
+* `extendable` opts into the opposite rule for a base that is a *built-in
+* fallback* rather than discovered truth (codex, whose static effort list is
+* known to trail the backend): there, appending the configured level is how a
+* newly shipped tier becomes selectable at all.
+* @param configuredDefault - the user-configured default effort id, or undefined.
+* @param base - the discovered/built-in reasoning block, or undefined.
+* @param options - `extendable` marks the base as a fallback that may be extended.
+* @returns the merged block, or undefined when neither side contributes one.
+*/
+function mergeReasoning(configuredDefault, base, options) {
+	const detached = base === void 0 ? void 0 : {
+		efforts: [...base.efforts],
+		...base.defaultEffort === void 0 ? {} : { defaultEffort: base.defaultEffort }
+	};
+	if (configuredDefault === void 0) return detached;
+	const effort = ReasoningEffortId(configuredDefault);
+	if (base === void 0) return options?.extendable === true ? {
+		efforts: [{
+			id: effort,
+			name: effortDisplayName(effort)
+		}],
+		defaultEffort: effort
+	} : void 0;
+	if (base.efforts.some((entry) => entry.id === effort)) return {
+		efforts: [...base.efforts],
+		defaultEffort: effort
+	};
+	if (options?.extendable !== true) return detached;
+	return {
+		efforts: [...base.efforts, {
+			id: effort,
+			name: effortDisplayName(effort)
+		}],
+		defaultEffort: effort
+	};
+}
+/**
+* First account catalog that lists `model` (callers pass default-first).
+* One failing lookup sits that account out so a sibling's metadata still
+* resolves — the same isolation as the picker catalog union.
+*/
+async function discoverAcrossAccounts(accounts, lookup) {
+	for (const account of accounts) try {
+		const found = await lookup(account);
+		if (found !== void 0) return found;
+	} catch {}
+}
 /** How long a discovered catalog is trusted before re-fetching. */
 const DISCOVERY_TTL_MS = 5 * 6e4;
 /**
@@ -1515,6 +2217,8 @@ var ModelCatalogCache = class {
 	seeded;
 	/** Set by {@link invalidate} so an in-flight disk read cannot resurrect dropped state. */
 	seedDisabled = false;
+	/** Bumped by {@link invalidate} so a loser in-flight fetch cannot write back. */
+	generation = 0;
 	constructor(persistence, ttlMs = DISCOVERY_TTL_MS) {
 		this.persistence = persistence;
 		this.ttlMs = ttlMs;
@@ -1545,7 +2249,10 @@ var ModelCatalogCache = class {
 	}
 	/** Run (or join) the single in-flight fetch, updating memory and disk on success. */
 	refresh(fetcher) {
-		this.inflight ??= fetcher().then((models) => {
+		if (this.inflight !== void 0) return this.inflight;
+		const gen = this.generation;
+		const pending = fetcher().then((models) => {
+			if (this.generation !== gen) return models;
 			const snapshot = {
 				at: Date.now(),
 				models
@@ -1554,9 +2261,10 @@ var ModelCatalogCache = class {
 			this.persistence?.save(snapshot).catch(() => void 0);
 			return models;
 		}).finally(() => {
-			this.inflight = void 0;
+			if (this.generation === gen) this.inflight = void 0;
 		});
-		return this.inflight;
+		this.inflight = pending;
+		return pending;
 	}
 	/**
 	* Return the cached catalog when fresh, otherwise fetch and cache it.
@@ -1594,7 +2302,9 @@ var ModelCatalogCache = class {
 	}
 	/** Drop the cached catalog (e.g. after a 401 proved the credential changed). */
 	invalidate() {
+		this.generation += 1;
 		this.entry = void 0;
+		this.inflight = void 0;
 		this.seedDisabled = true;
 		this.persistence?.clear().catch(() => void 0);
 	}
@@ -1603,6 +2313,11 @@ var ModelCatalogCache = class {
 function isMissingOrInvalidCredential(error) {
 	return error instanceof LlmError && (error.code === "MISSING_CREDENTIAL" || error.code === "INVALID_CREDENTIAL");
 }
+/** Whether discovery stopped because the caller cancelled or the timeout fired. */
+function isDiscoveryAborted(error, signal) {
+	if (signal?.aborted === true) return true;
+	return signal !== void 0 && error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError");
+}
 /** Whether discovery failed because the access token was rejected. */
 function isDiscoveryAuthFailure(error) {
 	return error instanceof OAuthEndpointError && error.status === 401 || error instanceof LlmError && error.code === "AUTH";
@@ -1628,6 +2343,109 @@ async function discoverOrRetryAuth(session, catalog, run) {
 	}
 }
 
+//#endregion
+//#region src/providers/accounts.ts
+/** Catalog sort hint when the provider advertised one (Codex `priority`). */
+function catalogPriority(model) {
+	const ranked = model;
+	return typeof ranked.priority === "number" ? ranked.priority : Number.MAX_SAFE_INTEGER;
+}
+/**
+* Merge per-account catalogs, keeping the first occurrence of each model id.
+* Rows that carry a numeric `priority` (Codex discovery) are then ordered by
+* it so a model only the second account lists — e.g. `gpt-5.6-sol` — still
+* sits with its generation instead of being appended after the default
+* account's older ids.
+*/
+async function unionAccountCatalogs(accounts, listOne, options) {
+	const timeoutMs = options?.timeoutMs;
+	const caller = options?.signal;
+	const catalogs = await Promise.all(accounts.map(async (account) => {
+		try {
+			if (timeoutMs === void 0) return await listOne(account, caller);
+			return await withTimeout((timeoutSignal) => listOne(account, caller === void 0 ? timeoutSignal : AbortSignal.any([timeoutSignal, caller])), timeoutMs) ?? [];
+		} catch (error) {
+			if (caller?.aborted === true) throw error;
+			return [];
+		}
+	}));
+	const seen = /* @__PURE__ */ new Set();
+	const models = [];
+	for (const catalog of catalogs) for (const model of catalog) {
+		if (seen.has(model.id)) continue;
+		seen.add(model.id);
+		models.push(model);
+	}
+	models.sort((left, right) => catalogPriority(left) - catalogPriority(right));
+	return models;
+}
+var AccountTokenManager = class {
+	managers = /* @__PURE__ */ new Map();
+	io;
+	constructor(options) {
+		this.options = options;
+		const provider = options.provider;
+		this.io = options.io ?? {
+			list: () => listAccounts(provider),
+			get: (account) => getAccountSession(provider, account),
+			save: (account, session) => saveAccountSession(provider, account, session),
+			remove: (account) => deleteAccountSession(provider, account)
+		};
+	}
+	/** The provider's accounts, default first (straight from the store). */
+	list() {
+		return this.io.list();
+	}
+	/** The default account's key, or undefined when logged out. */
+	async defaultAccount() {
+		return (await this.list())[0]?.key;
+	}
+	/**
+	* Resolve a usable session for one account (default when omitted),
+	* refreshing proactively or on demand.
+	* @param account - the account key; the default account when undefined.
+	* @param forceRefresh - refresh regardless of expiry (used after a 401).
+	* @returns the persisted session to send.
+	* @throws LlmError MISSING_CREDENTIAL when the account is not logged in.
+	*/
+	async session(account, forceRefresh = false) {
+		const key = account ?? await this.defaultAccount();
+		if (key === void 0) throw this.missingCredential();
+		return this.tokensFor(key).session(forceRefresh);
+	}
+	/** Read an account's stored session without any refresh side effect. */
+	peek(account) {
+		return this.io.get(account);
+	}
+	/** Whether a session is stored for the account (cheap; never refreshes). */
+	async hasSession(account) {
+		return await this.peek(account) !== void 0;
+	}
+	/** The TokenManager bound to one account (created lazily, then cached). */
+	tokensFor(account) {
+		let manager = this.managers.get(account);
+		if (manager === void 0) {
+			const io = this.io;
+			manager = new TokenManager({
+				displayName: this.options.displayName,
+				...this.options.makeOptions(account),
+				load: () => io.get(account),
+				save: (session) => io.save(account, session),
+				remove: () => io.remove(account),
+				onRemoved: () => {
+					this.options.onAccountRemoved?.(account);
+				}
+			});
+			this.managers.set(account, manager);
+		}
+		return manager;
+	}
+	/** The logged-out error, mirroring TokenManager's own message. */
+	missingCredential() {
+		return new LlmError(`dsh-plugin-subscriptions: not logged in to ${this.options.displayName}; log in via Settings → Subscriptions in the dsh web app`, "MISSING_CREDENTIAL");
+	}
+};
+
 //#endregion
 //#region src/providers/catalog-store.ts
 /**
@@ -1717,59 +2535,722 @@ function sanitizeSnapshot(value) {
 		models
 	};
 }
-/** Read the whole file; missing or unparsable reads as an empty cache. */
-async function readCatalogFile(path) {
-	let text;
-	try {
-		text = await readFile(path, "utf8");
-	} catch {
-		return {};
+/** Read the whole file; missing or unparsable reads as an empty cache. */
+async function readCatalogFile(path) {
+	let text;
+	try {
+		text = await readFile(path, "utf8");
+	} catch {
+		return {};
+	}
+	try {
+		const parsed = JSON.parse(text);
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return {};
+		return parsed;
+	} catch {
+		return {};
+	}
+}
+/** Persist the whole file atomically (tmp file + rename). */
+async function writeCatalogFile(store, path) {
+	await mkdir(dirname(path), { recursive: true });
+	const tmp = `${path}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
+	try {
+		await writeFile(tmp, JSON.stringify(store, null, 2));
+		await rename(tmp, path);
+	} catch (error) {
+		await rm(tmp, { force: true });
+		throw error;
+	}
+}
+/**
+* Build the durable half of one provider's catalog cache over the shared
+* models.json file (concurrent writers are last-writer-wins, acceptable for
+* a cache).
+* @param provider - the provider route keying the file entry.
+* @param path - store file path; defaults to {@link modelsFilePath}.
+* @returns the persistence hooks for {@link ModelCatalogCache}.
+*/
+function catalogStore(provider, path = modelsFilePath()) {
+	return {
+		async load() {
+			return sanitizeSnapshot((await readCatalogFile(path))[provider]);
+		},
+		async save(snapshot) {
+			const store = await readCatalogFile(path);
+			store[provider] = snapshot;
+			await writeCatalogFile(store, path);
+		},
+		async clear() {
+			const store = await readCatalogFile(path);
+			if (store[provider] === void 0) return;
+			delete store[provider];
+			await writeCatalogFile(store, path);
+		}
+	};
+}
+
+//#endregion
+//#region src/providers/pool-family.ts
+/** Map key for one provider's pool of one model (ids collide across providers). */
+function poolKey(provider, model) {
+	return `${provider}/${model}`;
+}
+/**
+* Build per-provider account routes. Each model id becomes a definition of
+* the accounts that list it: two or more fail over; one is pinned to that
+* account (so a Max-only model is never sent to a Plus login). The picker
+* unions these catalogs; a logout that drops a model to one account keeps
+* the same id and pins it to whoever remains.
+* @param sources - per-account catalogs (providers with no accounts list
+*   nothing and simply never join a pool).
+* @returns `provider/model` → pool definition (not listed as an extra entry).
+*/
+function buildAccountPools(sources) {
+	const pools = /* @__PURE__ */ new Map();
+	for (const [provider, source] of Object.entries(sources)) {
+		const byModel = /* @__PURE__ */ new Map();
+		for (const catalog of source.catalogs) for (const model of catalog.models) {
+			let entry = byModel.get(model.id);
+			if (entry === void 0) {
+				entry = {
+					members: [],
+					info: model
+				};
+				byModel.set(model.id, entry);
+			}
+			entry.members.push({
+				provider,
+				account: catalog.account,
+				model: model.id
+			});
+		}
+		for (const [id, { members, info }] of byModel) pools.set(poolKey(provider, id), {
+			members,
+			...info.name === void 0 || info.name === id ? {} : { name: info.name },
+			...info.description === void 0 ? {} : { description: info.description }
+		});
+	}
+	return pools;
+}
+
+//#endregion
+//#region src/providers/pool-health.ts
+/** Registry key for one pool member. */
+function memberKey(provider, account, model) {
+	return `${provider}/${account}/${model}`;
+}
+/** Registry key parking EVERY member of one account (account-level failures). */
+function accountKey(provider, account) {
+	return `${provider}/${account}/*`;
+}
+/** Default cooldown when a quota/rate failure carries no `retry-after`. */
+const DEFAULT_QUOTA_COOLDOWN_MS = 5 * 6e4;
+/** Auth failures recheck after a day; a re-login clears the record immediately. */
+const AUTH_COOLDOWN_MS = 1440 * 6e4;
+/** Transient server-side failures cool down briefly. */
+const TRANSIENT_COOLDOWN_MS = 6e4;
+/**
+* Providers whose quota windows are model-scoped, so a quota failure on one
+* model says nothing about its siblings (Claude's Opus/Sonnet lanes). Every
+* other provider meters the account as a whole: one member hitting the wall
+* means its siblings on the SAME account would too, so the cooldown parks
+* the account (other accounts of the provider are unaffected).
+*/
+const MODEL_SCOPED_QUOTA_PROVIDERS = new Set(["claude"]);
+/** The `retry-after` an adapter propagated through `httpLlmError`, when any. */
+function retryAfterMs(error) {
+	return error.failure.providerRetryAfterMs;
+}
+/**
+* Classify a member failure. Quota and rate-limit failures cool down (using
+* the provider's own `retry-after` when sent, which is more accurate than
+* any fixed guess) — account-wide for account-metered providers, per-member
+* for model-scoped ones; auth failures park the account until re-login
+* (credentials are account-level); server/timeout failures get a short
+* per-member cooldown; transport failures switch without a record;
+* everything else — most importantly CONTEXT_WINDOW_EXCEEDED and ABORTED —
+* is the request's own fault and is rethrown untouched.
+* @param error - the failure thrown by a member adapter's stream.
+* @param provider - the failing member's provider (decides the quota scope).
+* @returns the action the pool should take.
+*/
+function classifyPoolFailure(error, provider) {
+	if (!(error instanceof LlmError)) return { action: "throw" };
+	switch (error.code) {
+		case QUOTA_EXCEEDED_CODE:
+		case "RATE_LIMIT": return {
+			action: "switch",
+			cooldownMs: retryAfterMs(error) ?? DEFAULT_QUOTA_COOLDOWN_MS,
+			reason: error.code,
+			scope: MODEL_SCOPED_QUOTA_PROVIDERS.has(provider) ? "member" : "account"
+		};
+		case "AUTH":
+		case "INVALID_CREDENTIAL":
+		case "MISSING_CREDENTIAL": return {
+			action: "switch",
+			cooldownMs: AUTH_COOLDOWN_MS,
+			reason: error.code,
+			scope: "account"
+		};
+		case "SERVER":
+		case "TIMEOUT":
+		case "EMPTY_RESPONSE": return {
+			action: "switch",
+			cooldownMs: TRANSIENT_COOLDOWN_MS,
+			reason: error.code,
+			scope: "member"
+		};
+		case "TRANSPORT": return { action: "switch" };
+		case "HTTP_402":
+		case "HTTP_404": return {
+			action: "switch",
+			cooldownMs: TRANSIENT_COOLDOWN_MS,
+			reason: error.code,
+			scope: "member"
+		};
+		case CONTEXT_WINDOW_EXCEEDED_CODE:
+		case "ABORTED":
+		default: return { action: "throw" };
+	}
+}
+/**
+* Cooldown registry keyed by {@link memberKey}. A member whose cooldown has
+* expired is simply available again — recovery is proven by the next real
+* request, not by a background probe.
+*/
+var PoolHealthRegistry = class {
+	records = /* @__PURE__ */ new Map();
+	/** Whether a member may serve: neither it nor its whole account is cooling. */
+	isMemberAvailable(provider, account, model, now = Date.now()) {
+		return this.isAvailable(accountKey(provider, account), now) && this.isAvailable(memberKey(provider, account, model), now);
+	}
+	/** Whether one registry key is clear right now. */
+	isAvailable(key, now = Date.now()) {
+		const record = this.records.get(key);
+		if (record === void 0) return true;
+		if (record.unavailableUntil <= now) {
+			this.records.delete(key);
+			return true;
+		}
+		return false;
+	}
+	/** Park a member for `cooldownMs`; a longer existing cooldown wins. */
+	markUnavailable(key, cooldownMs, reason, now = Date.now()) {
+		const until = now + cooldownMs;
+		const existing = this.records.get(key);
+		if (existing !== void 0 && existing.unavailableUntil > until) return;
+		this.records.set(key, {
+			unavailableUntil: until,
+			reason
+		});
+	}
+	/**
+	* Epoch ms at which the earliest cooling record among `keys` recovers;
+	* `undefined` when none of them is cooling. The registry is shared by
+	* every pool, so the caller passes the keys of ITS members (member and
+	* account keys alike) — an unrelated pool's cooldown must not shape this
+	* pool's retry hint. Feeds the pool-exhausted error's
+	* `providerRetryAfterMs`.
+	*/
+	earliestRecovery(keys, now = Date.now()) {
+		let earliest;
+		for (const [key, record] of this.records) {
+			if (record.unavailableUntil <= now) {
+				this.records.delete(key);
+				continue;
+			}
+			if (!keys.has(key)) continue;
+			if (earliest === void 0 || record.unavailableUntil < earliest) earliest = record.unavailableUntil;
+		}
+		return earliest;
+	}
+	/** Drop records of one provider, or of a single account when given (auth changes). */
+	clear(provider, account) {
+		const prefix = account === void 0 ? `${provider}/` : `${provider}/${account}/`;
+		for (const key of [...this.records.keys()]) if (key.startsWith(prefix)) this.records.delete(key);
+	}
+};
+
+//#endregion
+//#region src/providers/pool.ts
+/** Bound on sticky-session memory; oldest entries evict past it. */
+const STICKY_SESSION_LIMIT = 1e3;
+/** Display form of one member (account shown when pinned). */
+function memberLabel(member) {
+	return member.account === void 0 ? `${member.provider}/${member.model}` : `${member.provider}/${member.account}/${member.model}`;
+}
+/** How long a pools snapshot is trusted (auth changes invalidate immediately). */
+const POOLS_CACHE_TTL_MS = 5e3;
+var PoolAdapter = class extends LlmAdapter {
+	/** sessionId|poolId → member key of the last member that served a chunk. */
+	sticky = /* @__PURE__ */ new Map();
+	/** Messages already warned about — configuration diagnostics repeat every request otherwise. */
+	warned = /* @__PURE__ */ new Set();
+	/**
+	* Short-lived pools snapshot. `owns()` runs on every resolveModel — the
+	* model picker issues one per entry — and pool assembly touches every
+	* provider's catalog and account store, so recompute at most this often.
+	* Auth changes bump {@link generation} so a stale snapshot cannot land.
+	*/
+	poolsCache;
+	poolsInflight;
+	generation = 0;
+	constructor(options) {
+		super();
+		this.options = options;
+	}
+	/** Drop the pools snapshot so the next read reflects the current accounts. */
+	invalidate() {
+		this.generation += 1;
+		this.poolsCache = void 0;
+		this.poolsInflight = void 0;
+	}
+	/** Warn once per distinct message (pools() runs on every request). */
+	warnOnce(message) {
+		if (this.warned.has(message)) return;
+		this.warned.add(message);
+		this.options.onWarn(message);
+	}
+	/** Drop members whose adapter is not registered (copy — caller state is shared). */
+	usable(pools) {
+		const result = new Map(pools);
+		for (const [id, definition] of [...result]) {
+			const kept = definition.members.filter((member) => this.options.adapters[member.provider] !== void 0);
+			if (kept.length === 0) result.delete(id);
+			else if (kept.length < definition.members.length) result.set(id, {
+				...definition,
+				members: kept
+			});
+		}
+		return result;
+	}
+	/** Account pools (auto-aggregated plus config overrides) with usable members. */
+	async familyPools() {
+		return this.usable(new Map(await this.options.families()));
+	}
+	/** All pools (account pools merged with extra tiers) with usable members. */
+	async pools() {
+		const cached = this.poolsCache;
+		if (cached !== void 0 && Date.now() - cached.at < POOLS_CACHE_TTL_MS) return cached.pools;
+		const gen = this.generation;
+		this.poolsInflight ??= this.assemblePools().then((pools) => {
+			if (this.generation === gen) this.poolsCache = {
+				at: Date.now(),
+				pools
+			};
+			return pools;
+		}).finally(() => {
+			this.poolsInflight = void 0;
+		});
+		return this.poolsInflight;
+	}
+	/** Recompute the pools snapshot (account pools merged with extra tiers). */
+	async assemblePools() {
+		const pools = await this.familyPools();
+		for (const [id, members] of Object.entries(this.options.tiers)) {
+			if (members.length === 0) continue;
+			const owner = members[0].provider;
+			const key = poolKey(owner, id);
+			if (pools.has(key)) this.warnOnce(`tier pool "${id}" overrides the account pool of the same id under ${owner}`);
+			pools.set(key, {
+				members,
+				extra: true
+			});
+		}
+		return this.usable(pools);
+	}
+	/**
+	* Extra picker rows one provider lists (configured tiers). Account pools
+	* reuse the catalog entry of the same wire id, so they are not listed
+	* again — the picker stays one row per model in ChatGPT / Claude / ….
+	*/
+	async modelsForProvider(provider) {
+		const pools = await this.pools();
+		const models = [];
+		for (const [key, definition] of pools) {
+			if (definition.extra !== true) continue;
+			if (!key.startsWith(`${provider}/`)) continue;
+			const id = key.slice(provider.length + 1);
+			models.push({
+				provider,
+				id,
+				name: definition.name ?? id,
+				...definition.description === void 0 ? {} : { description: definition.description }
+			});
+		}
+		return models;
+	}
+	/**
+	* Whether `model` on `provider`'s route is served here (several accounts
+	* fail over, one account is pinned, or a configured tier).
+	*/
+	async owns(provider, model) {
+		return (await this.pools()).has(poolKey(provider, model));
+	}
+	/**
+	* Resolve every member's account (config members may omit it to mean "the
+	* default account") and drop members with no resolvable login. Duplicates
+	* collapse — an explicitly pinned account and the default may coincide.
+	*/
+	async concrete(members) {
+		const seen = /* @__PURE__ */ new Set();
+		const resolved = [];
+		for (const member of members) {
+			const account = member.account ?? await this.options.defaultAccount(member.provider);
+			if (account === void 0) continue;
+			const key = memberKey(member.provider, account, member.model);
+			if (seen.has(key)) continue;
+			seen.add(key);
+			resolved.push({
+				provider: member.provider,
+				account,
+				model: member.model
+			});
+		}
+		return resolved;
+	}
+	/**
+	* Resolve a pool model to the conservative INTERSECTION of its members'
+	* capabilities: the smallest context window and output cap, the reasoning
+	* efforts every member supports, and the modalities all of them accept —
+	* so a request valid for the pool stays valid after a failover. Capability
+	* metadata is provider-level, so each provider resolves once regardless of
+	* how many accounts it pools.
+	*/
+	async resolveModel(provider, model) {
+		const definition = (await this.pools()).get(poolKey(provider, model));
+		if (definition === void 0) throw new LlmError(`unknown pool model "${model}"`, "NO_ADAPTER");
+		const resolved = [];
+		let lastFailure;
+		const seenProviders = /* @__PURE__ */ new Set();
+		for (const member of definition.members) {
+			if (seenProviders.has(member.provider)) continue;
+			seenProviders.add(member.provider);
+			const adapter = this.options.adapters[member.provider];
+			if (adapter === void 0) continue;
+			try {
+				resolved.push(await adapter.resolveOwnModel(member.provider, member.model));
+			} catch (error) {
+				lastFailure = error;
+				this.warnOnce(`pool "${model}": member ${memberLabel(member)} failed to resolve (${error instanceof Error ? error.message : String(error)}); excluding it`);
+			}
+		}
+		if (resolved.length === 0) throw new LlmError(`pool "${model}" has no usable member`, "NO_ADAPTER", { ...lastFailure === void 0 ? {} : { cause: lastFailure } });
+		const contextWindows = resolved.map((info) => info.context?.contextWindow).filter(isNumber);
+		const maxTokens = resolved.map((info) => info.defaultMaxTokens).filter(isNumber);
+		const reasoning = intersectReasoning(resolved);
+		const modalities = intersectModalities(resolved);
+		return {
+			provider,
+			id: model,
+			name: definition.name ?? model,
+			...definition.description === void 0 ? {} : { description: definition.description },
+			...contextWindows.length > 0 ? { context: { contextWindow: Math.min(...contextWindows) } } : {},
+			...maxTokens.length > 0 ? { defaultMaxTokens: Math.min(...maxTokens) } : {},
+			...reasoning === void 0 ? {} : { reasoning },
+			...modalities === void 0 ? {} : { inputModalities: modalities }
+		};
+	}
+	async *stream(options) {
+		const definition = (await this.pools()).get(poolKey(options.provider, options.model));
+		if (definition === void 0) throw new LlmError(`unknown pool model "${options.model}"`, "NO_ADAPTER");
+		const members = await this.concrete(definition.members);
+		const candidates = await this.select(options.model, members, options.sessionId);
+		if (candidates.length === 0) throw this.exhausted(options.model, members);
+		let lastError;
+		for (const member of candidates) {
+			const adapter = this.options.adapters[member.provider];
+			if (adapter === void 0) continue;
+			const iterator = adapter.streamAccount({
+				...options,
+				provider: member.provider,
+				model: member.model
+			}, member.account)[Symbol.asyncIterator]();
+			let first;
+			try {
+				first = await iterator.next();
+				if (first.done === true) throw new LlmError(`${memberLabel(member)} returned an empty stream`, EMPTY_RESPONSE_CODE);
+			} catch (error) {
+				const classification = classifyPoolFailure(error, member.provider);
+				if (classification.action === "throw") throw error;
+				if ("cooldownMs" in classification) {
+					this.options.health.markUnavailable(classification.scope === "account" ? accountKey(member.provider, member.account) : memberKey(member.provider, member.account, member.model), classification.cooldownMs, classification.reason);
+					if (classification.reason === QUOTA_EXCEEDED_CODE || classification.reason === "RATE_LIMIT") this.options.usage.invalidate(member.provider, member.account);
+				}
+				this.options.onWarn(`pool "${options.model}": ${memberLabel(member)} failed before any output (${error instanceof Error ? error.message : String(error)}); trying the next member`);
+				lastError = error;
+				continue;
+			}
+			this.remember(options.model, options.sessionId, member);
+			try {
+				yield first.value;
+				for (let next = await iterator.next(); next.done !== true; next = await iterator.next()) yield next.value;
+			} finally {
+				try {
+					await iterator.return?.();
+				} catch {}
+			}
+			return;
+		}
+		throw this.exhausted(options.model, members, lastError);
+	}
+	/**
+	* Order the candidates for one request. Health filters both strategies;
+	* `quota_aware` then ranks by urgency (members without telemetry, e.g.
+	* copilot, score zero and sink to the bottom of their class), while
+	* quota-exhausted members stay as a last-resort tail in pool order. The
+	* sticky member keeps its lead unless a challenger out-scores it by
+	* `switchMargin`.
+	*/
+	async select(poolId, members, sessionId) {
+		const usable = members.filter((member) => this.options.adapters[member.provider] !== void 0 && this.options.health.isMemberAvailable(member.provider, member.account, member.model));
+		if (usable.length === 0) return [];
+		const stickyMember = sessionId === void 0 ? void 0 : usable.find((member) => memberKey(member.provider, member.account, member.model) === this.sticky.get(stickyKey(poolId, sessionId)));
+		if (this.options.strategy === "priority") return stickyMember === void 0 ? usable : [stickyMember, ...usable.filter((member) => member !== stickyMember)];
+		const quotas = new Map(await Promise.all(usable.map(async (member) => [member, await this.options.usage.quotaFor(member)])));
+		const scored = usable.filter((member) => quotas.get(member)?.available === true);
+		const quotaFull = usable.filter((member) => quotas.get(member)?.available === false);
+		scored.sort((a, b) => (quotas.get(b)?.urgency ?? 0) - (quotas.get(a)?.urgency ?? 0));
+		if (stickyMember !== void 0 && scored.includes(stickyMember)) {
+			const best = scored[0];
+			const stickyUrgency = quotas.get(stickyMember)?.urgency ?? 0;
+			const bestUrgency = quotas.get(best)?.urgency ?? 0;
+			if (best === stickyMember || bestUrgency <= stickyUrgency * this.options.switchMargin) {
+				scored.splice(scored.indexOf(stickyMember), 1);
+				scored.unshift(stickyMember);
+			}
+		}
+		return [...scored, ...quotaFull];
+	}
+	/** Pin the serving member to the session (with bounded memory). */
+	remember(poolId, sessionId, member) {
+		if (sessionId === void 0) return;
+		const key = stickyKey(poolId, sessionId);
+		this.sticky.delete(key);
+		if (this.sticky.size >= STICKY_SESSION_LIMIT) {
+			const oldest = this.sticky.keys().next();
+			if (oldest.done !== true) this.sticky.delete(oldest.value);
+		}
+		this.sticky.set(key, memberKey(member.provider, member.account, member.model));
+	}
+	/**
+	* The error for an exhausted pool, carrying the earliest recovery hint of
+	* THIS pool's members (the health registry is shared across pools, so the
+	* hint is scoped to the keys this pool can actually recover through).
+	*/
+	exhausted(model, pool, cause) {
+		const keys = /* @__PURE__ */ new Set();
+		for (const member of pool) {
+			keys.add(memberKey(member.provider, member.account, member.model));
+			keys.add(accountKey(member.provider, member.account));
+		}
+		const recovery = this.options.health.earliestRecovery(keys);
+		const retryAfterMs$1 = recovery === void 0 ? void 0 : Math.max(recovery - Date.now(), 1);
+		return new LlmError(`pool "${model}" exhausted: every member is unavailable or failed`, "RATE_LIMIT", {
+			...retryAfterMs$1 === void 0 ? {} : { providerRetryAfterMs: retryAfterMs$1 },
+			...cause === void 0 ? {} : { cause }
+		});
+	}
+};
+function stickyKey(poolId, sessionId) {
+	return `${String(sessionId)}|${poolId}`;
+}
+function isNumber(value) {
+	return value !== void 0;
+}
+/** Reasoning efforts every member supports (id intersection, first member's order). */
+function intersectReasoning(resolved) {
+	const [first, ...rest] = resolved;
+	if (first?.reasoning === void 0) return void 0;
+	const efforts = first.reasoning.efforts.filter((effort) => rest.every((info) => info.reasoning?.efforts.some((other) => other.id === effort.id) === true));
+	if (efforts.length === 0) return void 0;
+	const defaultEffort = first.reasoning.defaultEffort !== void 0 && efforts.some((effort) => effort.id === first.reasoning?.defaultEffort) ? first.reasoning.defaultEffort : void 0;
+	return {
+		efforts,
+		...defaultEffort === void 0 ? {} : { defaultEffort }
+	};
+}
+/** Modalities all members accept; undefined when any member leaves it unknown. */
+function intersectModalities(resolved) {
+	const [first, ...rest] = resolved;
+	if (first?.inputModalities === void 0) return void 0;
+	const modalities = first.inputModalities.filter((modality) => rest.every((info) => info.inputModalities?.includes(modality) === true));
+	return modalities.length === 0 ? void 0 : modalities;
+}
+
+//#endregion
+//#region src/providers/pool-usage.ts
+/** A member is taken out of rotation once any window crosses this fill level. */
+const QUOTA_FULL_PERCENT = 95;
+/** How long a usage snapshot is trusted before a background refresh. */
+const USAGE_TTL_MS = 5 * 6e4;
+/** Assumed window length when the provider discloses no `resetsAt`. */
+const FALLBACK_HORIZON_MS = {
+	session: 300 * 6e4,
+	weekly: 10080 * 6e4,
+	other: 720 * 60 * 6e4
+};
+/**
+* Per-ACCOUNT usage snapshots with in-flight dedupe and
+* stale-while-revalidate refresh. Providers without a usage endpoint
+* (copilot) resolve no fetcher and score a constant zero urgency — which
+* naturally ranks them behind every measured member. Fetchers are resolved
+* lazily per (provider, account) so accounts added after startup join
+* tracking on their first score.
+*/
+var PoolUsageTracker = class {
+	entries = /* @__PURE__ */ new Map();
+	inflight = /* @__PURE__ */ new Map();
+	constructor(fetcherFor, ttlMs = USAGE_TTL_MS) {
+		this.fetcherFor = fetcherFor;
+		this.ttlMs = ttlMs;
 	}
-	try {
-		const parsed = JSON.parse(text);
-		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return {};
-		return parsed;
-	} catch {
-		return {};
+	/**
+	* The quota view of one member. A cold cache awaits the first fetch; a
+	* stale one answers immediately while the refresh serves the NEXT call
+	* (member selection must never block on the network mid-conversation). A
+	* failure still cooling down degrades immediately with no network call.
+	* @param member - the pool member to score (account resolved).
+	* @returns availability plus the urgency score.
+	*/
+	async quotaFor(member) {
+		const key = `${member.provider}/${member.account}`;
+		const fetcher = this.fetcherFor(member.provider, member.account);
+		if (fetcher === void 0) return {
+			available: true,
+			urgency: 0,
+			fetchedAt: 0
+		};
+		const entry = this.entries.get(key);
+		if (entry !== void 0) {
+			const fresh = Date.now() - entry.at < (entry.cooldownMs ?? this.ttlMs);
+			if (entry.snapshot !== void 0) {
+				if (!fresh) this.refresh(key, fetcher).catch(() => void 0);
+				return this.score(member, entry);
+			}
+			if (fresh) return degradedQuota(entry.error);
+		}
+		try {
+			const snapshot = await this.refresh(key, fetcher);
+			return this.score(member, {
+				snapshot,
+				at: Date.now()
+			});
+		} catch (error) {
+			return degradedQuota(error);
+		}
 	}
-}
-/** Persist the whole file atomically (tmp file + rename). */
-async function writeCatalogFile(store, path) {
-	await mkdir(dirname(path), { recursive: true });
-	const tmp = `${path}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
-	try {
-		await writeFile(tmp, JSON.stringify(store, null, 2));
-		await rename(tmp, path);
-	} catch (error) {
-		await rm(tmp, { force: true });
-		throw error;
+	/**
+	* Same cache as {@link quotaFor}, for direct display (the Settings page):
+	* the raw snapshot, or the original fetch error, instead of a routing
+	* score.
+	* @param provider - the account's provider.
+	* @param account - the account key.
+	* @param force - bypass a fresh cached SNAPSHOT for an honest re-check (the
+	*   manual Refresh button). A live failure cooldown is never bypassed —
+	*   retrying through it is exactly what turns a 429 into a permanent
+	*   lockout, so even a forced call still answers from the negative cache.
+	* @returns `{ supported: false }` when the provider has no usage fetcher.
+	*/
+	async snapshotFor(provider, account, force = false) {
+		const fetcher = this.fetcherFor(provider, account);
+		if (fetcher === void 0) return { supported: false };
+		const key = `${provider}/${account}`;
+		const entry = this.entries.get(key);
+		if (entry !== void 0 && Date.now() - entry.at < (entry.cooldownMs ?? this.ttlMs)) if (entry.snapshot !== void 0) {
+			if (!force) return entry.snapshot;
+		} else throw entry.error;
+		return this.refresh(key, fetcher);
+	}
+	/** Drop cached snapshots: one account, or a whole provider when `account` is omitted. */
+	invalidate(provider, account) {
+		if (account !== void 0) {
+			this.entries.delete(`${provider}/${account}`);
+			return;
+		}
+		for (const key of [...this.entries.keys()]) if (key.startsWith(`${provider}/`)) this.entries.delete(key);
+	}
+	/**
+	* Run (or join) the single in-flight fetch for one account key, caching
+	* either outcome. A missing/invalid credential is deliberately NOT
+	* negative-cached: it costs no network round trip (the session lookup
+	* fails before the request goes out) and re-checking live means the
+	* member rejoins routing the instant its login is fixed, rather than
+	* waiting out a stale cooldown.
+	*/
+	refresh(key, fetcher) {
+		let pending = this.inflight.get(key);
+		if (pending === void 0) {
+			pending = fetcher().then((snapshot) => {
+				this.entries.set(key, {
+					snapshot,
+					at: Date.now()
+				});
+				return snapshot;
+			}, (error) => {
+				if (!isMissingOrInvalidCredential(error)) this.entries.set(key, {
+					error,
+					at: Date.now(),
+					cooldownMs: cooldownFor(error, this.ttlMs)
+				});
+				throw error;
+			}).finally(() => {
+				this.inflight.delete(key);
+			});
+			this.inflight.set(key, pending);
+		}
+		return pending;
+	}
+	/** Score one member against a snapshot's windows. */
+	score(member, entry) {
+		const windows = (entry.snapshot.windows ?? []).filter((window) => windowApplies(window, member.model));
+		let available = true;
+		let urgency = 0;
+		for (const window of windows) {
+			if (window.usedPercent >= QUOTA_FULL_PERCENT) available = false;
+			urgency = Math.max(urgency, windowUrgency(window));
+		}
+		return {
+			available,
+			urgency,
+			fetchedAt: entry.at
+		};
 	}
+};
+/**
+* The routing view of a fetch failure. Logged out: the member cannot serve
+* at all. Any other failure (network, endpoint rate limit) must not block
+* routing — the member stays available with a zero score, degrading the
+* strategy to plain priority order for it.
+*/
+function degradedQuota(error) {
+	return isMissingOrInvalidCredential(error) ? {
+		available: false,
+		urgency: 0,
+		fetchedAt: 0
+	} : {
+		available: true,
+		urgency: 0,
+		fetchedAt: 0
+	};
+}
+/** How long to hold a failure in the negative cache: the endpoint's own `retry-after`, or the default TTL. */
+function cooldownFor(error, defaultTtlMs) {
+	return error instanceof OAuthEndpointError && error.retryAfterMs !== void 0 ? error.retryAfterMs : defaultTtlMs;
 }
 /**
-* Build the durable half of one provider's catalog cache over the shared
-* models.json file (concurrent writers are last-writer-wins, acceptable for
-* a cache).
-* @param provider - the provider route keying the file entry.
-* @param path - store file path; defaults to {@link modelsFilePath}.
-* @returns the persistence hooks for {@link ModelCatalogCache}.
+* Whether a window constrains this model: unscoped windows always do; a
+* model-scoped window (Claude's Opus/Sonnet lanes) applies when its scope
+* names the model family.
 */
-function catalogStore(provider, path = modelsFilePath()) {
-	return {
-		async load() {
-			return sanitizeSnapshot((await readCatalogFile(path))[provider]);
-		},
-		async save(snapshot) {
-			const store = await readCatalogFile(path);
-			store[provider] = snapshot;
-			await writeCatalogFile(store, path);
-		},
-		async clear() {
-			const store = await readCatalogFile(path);
-			if (store[provider] === void 0) return;
-			delete store[provider];
-			await writeCatalogFile(store, path);
-		}
-	};
+function windowApplies(window, model) {
+	if (window.scope === void 0) return true;
+	return model.toLowerCase().includes(window.scope.toLowerCase());
+}
+/** The required burn rate of one window (fraction per ms). */
+function windowUrgency(window, now = Date.now()) {
+	return Math.max(0, 1 - window.usedPercent / 100) / (window.resetsAt !== void 0 ? Math.max(window.resetsAt - now, 1) : FALLBACK_HORIZON_MS[window.kind]);
 }
 
 //#endregion
@@ -1825,6 +3306,14 @@ async function resolveImages(messages, attachments, signal) {
 	})));
 }
 
+//#endregion
+//#region src/compat.ts
+/** Brand a string as a tool-call id: alpha's `ToolCallId`, rc.2's `CallId`. */
+const ToolCallId = (() => {
+	const exports = llm;
+	return exports["ToolCallId"] ?? exports["CallId"];
+})();
+
 //#endregion
 //#region src/translate/sse.ts
 /**
@@ -2019,7 +3508,7 @@ function closeBlock$2(block) {
 		};
 		case "tool-call": return {
 			type: "tool-call",
-			id: CallId(block.callId),
+			id: ToolCallId(block.callId),
 			name: block.name ?? "",
 			arguments: block.text
 		};
@@ -2109,7 +3598,7 @@ var ResponsesStreamTranslator = class {
 					chunks.push({
 						type: "tool-call-delta",
 						index: block.index,
-						id: CallId(callId),
+						id: ToolCallId(callId),
 						...item.name === void 0 ? {} : { name: item.name },
 						argumentsDelta: ""
 					});
@@ -2151,7 +3640,7 @@ var ResponsesStreamTranslator = class {
 				chunks.push({
 					type: "tool-call-delta",
 					index: block.index,
-					id: CallId(block.callId),
+					id: ToolCallId(block.callId),
 					...block.name === void 0 ? {} : { name: block.name },
 					argumentsDelta: event.delta ?? ""
 				});
@@ -2244,6 +3733,28 @@ const CODEX_CONTEXT_WINDOW = 4e5;
 const CODEX_DEFAULT_MAX_TOKENS = 128e3;
 /** Refresh when the access token has less than this much life left. */
 const CODEX_PREEMPT_MS = 5 * 6e4;
+/**
+* Body fields the backend uses to name a reset. A window-exhaustion rejection
+* carries `usage_limit_reached` with the seconds left on the window — the case
+* that used to classify as a terminal quota and never be retried at all.
+*/
+const CODEX_RESET_FIELDS = [
+	"resets_in_seconds",
+	"reset_after_seconds",
+	"resets_at",
+	"reset_at"
+];
+/**
+* Reads the reset instant of the Codex window that rejected a request.
+*
+* Body only. The `x-codex-{primary,secondary}-reset-after-seconds` headers are
+* rollover snapshots the backend attaches to every response, one per window,
+* so they say nothing about which window refused: a burst 429 that would clear
+* in seconds still carries a primary rollover hours out, and reading it would
+* park the turn for those hours. They reach the operator through
+* `rateLimitDiagnostics` instead.
+*/
+const codexRateLimitReset = (_response, body, now) => resetFromFields(jsonBody(body), CODEX_RESET_FIELDS, now);
 /** Default instruction when the request carries no system prompt. */
 const DEFAULT_CODEX_INSTRUCTIONS = "You are Codex, a coding agent based on GPT-5. Help the user with their software engineering tasks.";
 /** Refresh-grant rejections that mean the login is gone for good. */
@@ -2492,10 +4003,6 @@ const CODEX_MODELS_URL = "https://chatgpt.com/backend-api/codex/models";
 * the range of current codex CLI releases.
 */
 const CODEX_CLIENT_VERSION = "0.147.0";
-/** Display name for a wire reasoning-effort value. */
-function effortName(effort) {
-	return effort === "xhigh" ? "Extra High" : effort.charAt(0).toUpperCase() + effort.slice(1);
-}
 /**
 * Whether a catalog entry advertises the fast tier. Mirrors codex-rs
 * `ModelPreset::supports_fast_mode`: a `service_tiers` id matching the fast
@@ -2508,16 +4015,20 @@ function supportsFastTier(entry) {
 * Fetch the live codex model catalog with the session's auth headers.
 * @param session - the stored session (used as-is; never refreshed here).
 * @param fetchFn - fetch implementation (injectable for tests).
+* @param signal - caller cancellation (pool-assembly timeout).
 * @returns discovered models: hidden entries dropped, sorted by priority.
 */
-async function fetchCodexModels(session, fetchFn = proxiedFetch) {
-	const response = await fetchFn(`${CODEX_MODELS_URL}?client_version=${CODEX_CLIENT_VERSION}`, { headers: {
-		"authorization": `Bearer ${session.accessToken}`,
-		"chatgpt-account-id": session.accountId,
-		"originator": "codex_cli_rs",
-		"accept": "application/json",
-		...attributionHeaders()
-	} });
+async function fetchCodexModels(session, fetchFn = proxiedFetch, signal) {
+	const response = await fetchFn(`${CODEX_MODELS_URL}?client_version=${CODEX_CLIENT_VERSION}`, {
+		headers: {
+			"authorization": `Bearer ${session.accessToken}`,
+			"chatgpt-account-id": session.accountId,
+			"originator": "codex_cli_rs",
+			"accept": "application/json",
+			...attributionHeaders()
+		},
+		...signal === void 0 ? {} : { signal }
+	});
 	if (!response.ok) throw await oauthEndpointError(response, "codex models");
 	const payload = await response.json();
 	if (!Array.isArray(payload.models)) throw new Error("codex models endpoint returned no models array");
@@ -2527,7 +4038,7 @@ async function fetchCodexModels(session, fetchFn = proxiedFetch) {
 		if (entry.visibility === "hide" || entry.visibility === "none") continue;
 		const efforts = (entry.supported_reasoning_levels ?? []).filter((level) => typeof level.effort === "string" && level.effort.length > 0).map((level) => ({
 			id: ReasoningEffortId(level.effort),
-			name: effortName(level.effort),
+			name: effortDisplayName(level.effort),
 			...level.description === void 0 ? {} : { description: level.description }
 		}));
 		const defaultEffort = typeof entry.default_reasoning_level === "string" && entry.default_reasoning_level.length > 0 && efforts.some((effort) => effort.id === ReasoningEffortId(entry.default_reasoning_level)) ? ReasoningEffortId(entry.default_reasoning_level) : void 0;
@@ -2621,14 +4132,43 @@ function codexRequestBody(options, resolved, fast) {
 /** Codex wire adapter: one instance serves the `codex` provider route. */
 var CodexAdapter = class extends LlmAdapter {
 	catalog;
+	/** In-memory catalogs for non-default accounts (the persisted cache is the default's). */
+	accountCatalogs = /* @__PURE__ */ new Map();
+	/** Account whose snapshot currently lives in {@link catalog}; cleared on default change. */
+	catalogOwner;
 	constructor(options) {
 		super();
 		this.options = options;
 		this.catalog = new ModelCatalogCache(options.catalogStore);
 	}
 	/** Discovery fetcher: resolves the session through the refresh-aware path. */
-	async fetchCatalog() {
-		return fetchCodexModels(await this.options.tokens.session(), this.options.fetchFn);
+	async fetchCatalog(account, signal) {
+		return fetchCodexModels(await this.options.tokens.session(account), this.options.fetchFn, signal);
+	}
+	/** Drop cached catalogs after login/logout so the next list does not reuse a stale plan. */
+	clearAccountCatalog(account) {
+		if (account === void 0) this.accountCatalogs.clear();
+		else this.accountCatalogs.delete(account);
+		if (account === void 0 || this.catalogOwner === account || this.catalogOwner === void 0) {
+			this.catalogOwner = void 0;
+			this.catalog.invalidate();
+		}
+	}
+	/** Persisted cache for the default account; a throwaway cache for any other. */
+	async catalogFor(account) {
+		const defaultKey = await this.options.tokens.defaultAccount();
+		const key = account ?? defaultKey;
+		if (key === void 0 || key === defaultKey) {
+			if (this.catalogOwner !== void 0 && this.catalogOwner !== defaultKey) this.catalog.invalidate();
+			this.catalogOwner = defaultKey;
+			return this.catalog;
+		}
+		let cache = this.accountCatalogs.get(key);
+		if (cache === void 0) {
+			cache = new ModelCatalogCache();
+			this.accountCatalogs.set(key, cache);
+		}
+		return cache;
 	}
 	providerInfo(provider) {
 		return {
@@ -2636,6 +4176,9 @@ var CodexAdapter = class extends LlmAdapter {
 			name: "ChatGPT (Codex)"
 		};
 	}
+	providerRetryPolicy(provider) {
+		return subscriptionRetryPolicy(DEFAULT_RETRY, this.options.rateLimit ?? DEFAULT_RATE_LIMIT_WAIT, `codex: provider "${provider}" retryPolicy`);
+	}
 	staticModels(provider) {
 		return this.options.models.map((model) => ({
 			provider,
@@ -2645,17 +4188,37 @@ var CodexAdapter = class extends LlmAdapter {
 		}));
 	}
 	async listModels(provider) {
-		if (await this.options.tokens.peek() === void 0) return [];
+		const own = await this.listOwnModels(provider);
+		const pool = this.options.pool?.();
+		if (pool === void 0) return own;
+		const extra = await pool.modelsForProvider(provider);
+		const seen = new Set(own.map((model) => model.id));
+		return [...own, ...extra.filter((model) => !seen.has(model.id))];
+	}
+	/** The provider's own catalog: union of every account, or one account when named. */
+	async listOwnModels(provider, account, signal) {
+		if (account === void 0) {
+			const accounts = (await this.options.tokens.list()).map((entry) => entry.key);
+			if (accounts.length === 0) return [];
+			return unionAccountCatalogs(accounts, (key, accountSignal) => this.listOwnModels(provider, key, accountSignal), {
+				timeoutMs: this.options.discoveryTimeoutMs ?? DISCOVERY_TIMEOUT_MS,
+				...signal === void 0 ? {} : { signal }
+			});
+		}
+		if (!await this.options.tokens.hasSession(account)) return [];
 		if (!this.options.discovery) return this.staticModels(provider);
+		const catalog = await this.catalogFor(account);
 		try {
-			return (await discoverOrRetryAuth((force) => this.options.tokens.session(force), this.catalog, () => this.catalog.get(() => this.fetchCatalog()))).map((model) => ({
+			return (await discoverOrRetryAuth((force) => this.options.tokens.session(account, force), catalog, () => catalog.get(() => this.fetchCatalog(account, signal)))).map((model) => ({
 				provider,
 				id: model.id,
 				name: model.name,
 				...model.description === void 0 ? {} : { description: model.description },
-				inputModalities: CODEX_MODALITIES
+				inputModalities: CODEX_MODALITIES,
+				...model.priority === void 0 ? {} : { priority: model.priority }
 			}));
 		} catch (error) {
+			if (isDiscoveryAborted(error, signal)) throw error;
 			if (isMissingOrInvalidCredential(error)) return [];
 			this.options.onWarn?.(`codex model discovery failed; using the built-in catalog (${errorChain(error)})`);
 			return this.staticModels(provider);
@@ -2670,7 +4233,9 @@ var CodexAdapter = class extends LlmAdapter {
 	*/
 	async discovered(model) {
 		if (!this.options.discovery) return void 0;
-		return (await this.catalog.resolve(() => this.fetchCatalog()))?.find((entry) => entry.id === model);
+		return discoverAcrossAccounts((await this.options.tokens.list()).map((entry) => entry.key), async (account) => {
+			return (await (await this.catalogFor(account)).resolve(() => this.fetchCatalog(account)))?.find((entry) => entry.id === model);
+		});
 	}
 	/** Whether the discovered catalog advertises a fast tier for this model. */
 	async supportsFastTier(model) {
@@ -2679,12 +4244,33 @@ var CodexAdapter = class extends LlmAdapter {
 	/** Ids of every discovered model with a fast tier (the Speed toggle's visibility list). */
 	async fastCapableModels() {
 		if (!this.options.discovery) return [];
-		if (await this.options.tokens.peek() === void 0) return [];
-		return (await this.catalog.resolve(() => this.fetchCatalog()) ?? []).filter((model) => model.fastTier === true).map((model) => model.id);
+		const accounts = (await this.options.tokens.list()).map((entry) => entry.key);
+		if (accounts.length === 0) return [];
+		const seen = /* @__PURE__ */ new Set();
+		const ids = [];
+		for (const account of accounts) try {
+			const models = await (await this.catalogFor(account)).resolve(() => this.fetchCatalog(account));
+			for (const model of models ?? []) {
+				if (model.fastTier !== true || seen.has(model.id)) continue;
+				seen.add(model.id);
+				ids.push(model.id);
+			}
+		} catch {}
+		return ids;
 	}
 	async resolveModel(provider, model) {
+		const pool = this.options.pool?.();
+		if (pool !== void 0 && await pool.owns(provider, model)) return pool.resolveModel(provider, model);
+		return this.resolveOwnModel(provider, model);
+	}
+	/** Capability resolution of the provider's own models (the pool resolves members here). */
+	async resolveOwnModel(provider, model) {
 		const discovered = await this.discovered(model);
 		const configured = this.options.models.find((entry) => entry.id === model);
+		const reasoning = mergeReasoning(this.options.defaultEffortOf?.(model), discovered?.reasoning ?? {
+			efforts: CODEX_EFFORTS,
+			defaultEffort: CODEX_DEFAULT_EFFORT
+		}, { extendable: discovered?.reasoning === void 0 });
 		return {
 			provider,
 			id: model,
@@ -2693,22 +4279,34 @@ var CodexAdapter = class extends LlmAdapter {
 			inputModalities: configured?.inputModalities ?? CODEX_MODALITIES,
 			context: { contextWindow: discovered?.contextWindow ?? configured?.contextWindow ?? CODEX_CONTEXT_WINDOW },
 			defaultMaxTokens: configured?.maxTokens ?? CODEX_DEFAULT_MAX_TOKENS,
-			reasoning: discovered?.reasoning ?? {
-				efforts: CODEX_EFFORTS,
-				defaultEffort: CODEX_DEFAULT_EFFORT
-			}
+			...reasoning === void 0 ? {} : { reasoning }
 		};
 	}
 	async *stream(options) {
+		const pool = this.options.pool?.();
+		if (pool !== void 0 && await pool.owns(options.provider, options.model)) {
+			yield* pool.stream(options);
+			return;
+		}
+		yield* this.streamCore(options);
+	}
+	/** Pool seam: stream through one specific account instead of the default. */
+	streamAccount(options, account) {
+		return this.streamCore(options, account);
+	}
+	async *streamCore(options, account) {
 		const watchdog = idleWatchdog(options.signal, this.options.streamIdleTimeoutMs);
 		try {
-			let session = await this.options.tokens.session();
+			let session = await this.options.tokens.session(account);
 			let response = await this.request(options, session, watchdog.signal);
 			if (response.status === 401) {
-				session = await this.options.tokens.session(true);
+				session = await this.options.tokens.session(account, true);
 				response = await this.request(options, session, watchdog.signal);
 			}
-			if (!response.ok) throw await httpLlmError(response, "codex API");
+			if (!response.ok) throw await httpLlmError(response, "codex API", {
+				rateLimitReset: codexRateLimitReset,
+				...this.options.onWarn === void 0 ? {} : { onWarn: this.options.onWarn }
+			});
 			if (response.body === null) throw new LlmError("codex API returned no response body", EMPTY_RESPONSE_CODE);
 			yield* streamResponses(response.body, () => {
 				watchdog.pulse();
@@ -2961,7 +4559,7 @@ function closeBlock$1(block) {
 		};
 		case "tool-call": return {
 			type: "tool-call",
-			id: CallId(block.callId),
+			id: ToolCallId(block.callId),
 			name: block.name ?? "",
 			arguments: block.text
 		};
@@ -3064,7 +4662,7 @@ var AnthropicStreamTranslator = class {
 						chunks.push({
 							type: "tool-call-delta",
 							index: opened.index,
-							id: CallId(opened.callId),
+							id: ToolCallId(opened.callId),
 							...block.name === void 0 ? {} : { name: block.name },
 							argumentsDelta: ""
 						});
@@ -3101,7 +4699,7 @@ var AnthropicStreamTranslator = class {
 						chunks.push({
 							type: "tool-call-delta",
 							index: block.index,
-							id: CallId(block.callId),
+							id: ToolCallId(block.callId),
 							...block.name === void 0 ? {} : { name: block.name },
 							argumentsDelta: delta.partial_json ?? ""
 						});
@@ -3205,6 +4803,34 @@ const CLAUDE_DEFAULT_MAX_TOKENS = 32e3;
 /** Refresh when the access token has less than this much life left. */
 const CLAUDE_PREEMPT_MS = 5 * 6e4;
 /**
+* Body fields Anthropic uses to name a reset instant, read when the unified
+* headers are absent.
+*/
+const CLAUDE_RESET_FIELDS = [
+	"resets_at",
+	"resetsAt",
+	"reset_at",
+	"retry_after"
+];
+/**
+* Reads the reset instant of the Anthropic window that rejected a request.
+*
+* `anthropic-ratelimit-unified-*` is the subscription-plan family — the one
+* Claude Code renders as "resets 3pm" — and is the only header that names the
+* window which actually rejected this request. The per-bucket
+* `anthropic-ratelimit-{requests,tokens,input-tokens,output-tokens}-reset`
+* headers are deliberately not read: they are rollover snapshots attached to
+* every response, so on a 429 they cannot say which bucket refused, and the
+* earliest of them is typically the bucket that still had room — a wait that
+* lands straight back in the closed window. They reach the operator through
+* `rateLimitDiagnostics` instead.
+*/
+const claudeRateLimitReset = (response, body, now) => {
+	const unified = earliestReset(resetInstantFromHeader(response, "anthropic-ratelimit-unified-reset", now), resetInstantFromHeader(response, "anthropic-ratelimit-unified-fallback-reset", now));
+	if (unified !== void 0) return unified;
+	return resetFromFields(jsonBody(body), CLAUDE_RESET_FIELDS, now);
+};
+/**
 * The subscription endpoint only serves requests presenting as Claude Code,
 * so these headers impersonate the CLI; the harness attribution user-agent
 * cannot be sent here (one user-agent slot, and the CLI's wins).
@@ -3444,15 +5070,18 @@ function claudeReasoning(capabilities) {
 	}));
 	return efforts.length > 0 ? { efforts } : void 0;
 }
-/** Fetch the live model catalog from the subscription endpoint. */
-async function fetchClaudeModels(session, fetchFn = proxiedFetch) {
-	const response = await fetchFn(CLAUDE_MODELS_URL, { headers: {
-		"authorization": `Bearer ${session.accessToken}`,
-		"anthropic-version": "2023-06-01",
-		"user-agent": getClaudeCliUserAgent(),
-		"anthropic-dangerous-direct-browser-access": "true",
-		"accept": "application/json"
-	} });
+/** Fetch the live model catalog from the subscription endpoint. `signal` cancels the request. */
+async function fetchClaudeModels(session, fetchFn = proxiedFetch, signal) {
+	const response = await fetchFn(CLAUDE_MODELS_URL, {
+		headers: {
+			"authorization": `Bearer ${session.accessToken}`,
+			"anthropic-version": "2023-06-01",
+			"user-agent": getClaudeCliUserAgent(),
+			"anthropic-dangerous-direct-browser-access": "true",
+			"accept": "application/json"
+		},
+		...signal === void 0 ? {} : { signal }
+	});
 	if (!response.ok) throw await httpLlmError(response, "claude models API");
 	const payload = await response.json();
 	if (!Array.isArray(payload.data)) throw new Error("claude models API returned an invalid catalog");
@@ -3469,14 +5098,6 @@ async function fetchClaudeModels(session, fetchFn = proxiedFetch) {
 	if (models.length === 0) throw new Error("claude models API returned an empty catalog");
 	return models;
 }
-/**
-* Claude Code's own SDK retry shape: exponential backoff starting at 1s,
-* doubling per attempt, capped at 60s, plus jitter. `maxRetries` is the
-* count of retries after the first attempt (Claude Code defaults to 10).
-*/
-const CLAUDE_RETRY_INITIAL_DELAY_MS = 1e3;
-const CLAUDE_RETRY_MAX_DELAY_MS = 6e4;
-const CLAUDE_RETRY_JITTER_RATIO = .2;
 /** The Claude 4.5 family accepts image input. */
 const CLAUDE_MODALITIES = ["text", "image"];
 /**
@@ -3512,17 +5133,48 @@ function claudeRequestBody(options, messages, maxTokens, thinking, effort) {
 /** Claude wire adapter: one instance serves the `claude` provider route. */
 var ClaudeAdapter = class extends LlmAdapter {
 	catalog;
+	/** In-memory catalogs for non-default accounts (the persisted cache is the default's). */
+	accountCatalogs = /* @__PURE__ */ new Map();
+	/** Account whose snapshot currently lives in {@link catalog}; cleared on default change. */
+	catalogOwner;
 	constructor(options) {
 		super();
 		this.options = options;
 		this.catalog = new ModelCatalogCache(options.catalogStore);
 	}
-	async fetchCatalog() {
-		return fetchClaudeModels(await this.options.tokens.session(), this.options.fetchFn);
+	async fetchCatalog(account, signal) {
+		return fetchClaudeModels(await this.options.tokens.session(account), this.options.fetchFn, signal);
+	}
+	/** Drop cached catalogs after login/logout so the next list does not reuse a stale plan. */
+	clearAccountCatalog(account) {
+		if (account === void 0) this.accountCatalogs.clear();
+		else this.accountCatalogs.delete(account);
+		if (account === void 0 || this.catalogOwner === account || this.catalogOwner === void 0) {
+			this.catalogOwner = void 0;
+			this.catalog.invalidate();
+		}
+	}
+	/** Persisted cache for the default account; a throwaway cache for any other. */
+	async catalogFor(account) {
+		const defaultKey = await this.options.tokens.defaultAccount();
+		const key = account ?? defaultKey;
+		if (key === void 0 || key === defaultKey) {
+			if (this.catalogOwner !== void 0 && this.catalogOwner !== defaultKey) this.catalog.invalidate();
+			this.catalogOwner = defaultKey;
+			return this.catalog;
+		}
+		let cache = this.accountCatalogs.get(key);
+		if (cache === void 0) {
+			cache = new ModelCatalogCache();
+			this.accountCatalogs.set(key, cache);
+		}
+		return cache;
 	}
 	async discovered(model) {
 		if (!this.options.discovery) return void 0;
-		return (await this.catalog.resolve(() => this.fetchCatalog()))?.find((entry) => entry.id === model);
+		return discoverAcrossAccounts((await this.options.tokens.list()).map((entry) => entry.key), async (account) => {
+			return (await (await this.catalogFor(account)).resolve(() => this.fetchCatalog(account)))?.find((entry) => entry.id === model);
+		});
 	}
 	staticModels(provider) {
 		return this.options.models.map((model) => ({
@@ -3539,37 +5191,53 @@ var ClaudeAdapter = class extends LlmAdapter {
 		};
 	}
 	providerRetryPolicy(provider) {
-		if (this.options.maxRetries === void 0) return void 0;
-		return resolveRetryPolicy({
-			mode: "normal",
-			maxRetries: this.options.maxRetries,
-			backoff: {
-				initialDelayMs: CLAUDE_RETRY_INITIAL_DELAY_MS,
-				maxDelayMs: CLAUDE_RETRY_MAX_DELAY_MS,
-				jitterRatio: CLAUDE_RETRY_JITTER_RATIO
-			}
-		}, `claude: provider "${provider}" retryPolicy`);
+		return subscriptionRetryPolicy(DEFAULT_RETRY, this.options.rateLimit ?? DEFAULT_RATE_LIMIT_WAIT, `claude: provider "${provider}" retryPolicy`);
 	}
 	async listModels(provider) {
-		if (await this.options.tokens.peek() === void 0) return [];
+		const own = await this.listOwnModels(provider);
+		const pool = this.options.pool?.();
+		if (pool === void 0) return own;
+		const extra = await pool.modelsForProvider(provider);
+		const seen = new Set(own.map((model) => model.id));
+		return [...own, ...extra.filter((model) => !seen.has(model.id))];
+	}
+	/** The provider's own catalog: union of every account, or one account when named. */
+	async listOwnModels(provider, account, signal) {
+		if (account === void 0) {
+			const accounts = (await this.options.tokens.list()).map((entry) => entry.key);
+			if (accounts.length === 0) return [];
+			return unionAccountCatalogs(accounts, (key, accountSignal) => this.listOwnModels(provider, key, accountSignal), {
+				timeoutMs: DISCOVERY_TIMEOUT_MS,
+				...signal === void 0 ? {} : { signal }
+			});
+		}
+		if (!await this.options.tokens.hasSession(account)) return [];
 		if (!this.options.discovery) return this.staticModels(provider);
+		const catalog = await this.catalogFor(account);
 		try {
-			return (await discoverOrRetryAuth((force) => this.options.tokens.session(force), this.catalog, () => this.catalog.get(() => this.fetchCatalog()))).map((model) => ({
+			return (await discoverOrRetryAuth((force) => this.options.tokens.session(account, force), catalog, () => catalog.get(() => this.fetchCatalog(account, signal)))).map((model) => ({
 				provider,
 				id: model.id,
 				name: model.name,
 				inputModalities: CLAUDE_MODALITIES
 			}));
 		} catch (error) {
+			if (isDiscoveryAborted(error, signal)) throw error;
 			if (isMissingOrInvalidCredential(error)) return [];
 			this.options.onWarn?.(`claude model discovery failed; using the built-in catalog (${errorChain(error)})`);
 			return this.staticModels(provider);
 		}
 	}
 	async resolveModel(provider, model) {
+		const pool = this.options.pool?.();
+		if (pool !== void 0 && await pool.owns(provider, model)) return pool.resolveModel(provider, model);
+		return this.resolveOwnModel(provider, model);
+	}
+	/** Capability resolution of the provider's own models (the pool resolves members here). */
+	async resolveOwnModel(provider, model) {
 		const disc = await this.discovered(model);
 		const configured = this.options.models.find((entry) => entry.id === model);
-		const reasoning = disc?.reasoning;
+		const reasoning = mergeReasoning(this.options.defaultEffortOf?.(model), disc?.reasoning);
 		return {
 			provider,
 			id: model,
@@ -3581,15 +5249,30 @@ var ClaudeAdapter = class extends LlmAdapter {
 		};
 	}
 	async *stream(options) {
+		const pool = this.options.pool?.();
+		if (pool !== void 0 && await pool.owns(options.provider, options.model)) {
+			yield* pool.stream(options);
+			return;
+		}
+		yield* this.streamCore(options);
+	}
+	/** Pool seam: stream through one specific account instead of the default. */
+	streamAccount(options, account) {
+		return this.streamCore(options, account);
+	}
+	async *streamCore(options, account) {
 		const watchdog = idleWatchdog(options.signal, this.options.streamIdleTimeoutMs);
 		try {
-			let session = await this.options.tokens.session();
+			let session = await this.options.tokens.session(account);
 			let response = await this.request(options, session, watchdog.signal);
 			if (response.status === 401) {
-				session = await this.options.tokens.session(true);
+				session = await this.options.tokens.session(account, true);
 				response = await this.request(options, session, watchdog.signal);
 			}
-			if (!response.ok) throw await httpLlmError(response, "claude API");
+			if (!response.ok) throw await httpLlmError(response, "claude API", {
+				rateLimitReset: claudeRateLimitReset,
+				...this.options.onWarn === void 0 ? {} : { onWarn: this.options.onWarn }
+			});
 			if (response.body === null) throw new LlmError("claude API returned no response body", EMPTY_RESPONSE_CODE);
 			yield* streamAnthropic(response.body, () => {
 				watchdog.pulse();
@@ -3656,6 +5339,24 @@ const GROK_CONTEXT_WINDOW = 256e3;
 const GROK_DEFAULT_MAX_TOKENS = 32e3;
 /** Refresh when the access token has less than this much life left. */
 const GROK_PREEMPT_MS = 2 * 6e4;
+/** Body fields xAI uses to name a delay or reset. */
+const GROK_RESET_FIELDS = [
+	"retry_after",
+	"retry_after_seconds",
+	"resets_at",
+	"reset_at"
+];
+/**
+* Reads the reset instant of the xAI window that rejected a request.
+*
+* Body only. xAI serves the OpenAI-compatible `x-ratelimit-reset-*` family,
+* whose values are rollover durations (`6m0s`) present on every response, one
+* per bucket — on a 429 the earliest of them is usually a bucket with room
+* (`0s` for the request bucket while the token bucket is the one exhausted),
+* which would burn the whole retry budget in seconds. They reach the operator
+* through `rateLimitDiagnostics` instead.
+*/
+const grokRateLimitReset = (_response, body, now) => resetFromFields(jsonBody(body), GROK_RESET_FIELDS, now);
 /** A discovered URL must be https on x.ai or a subdomain; anything else is a hostile document. */
 function assertXaiEndpoint(url, field) {
 	let parsed;
@@ -3918,15 +5619,19 @@ function grokCliReasoning(entry) {
 * Fetch the CLI catalog and index its per-model metadata by model id.
 * @param session - the stored session (used as-is; never refreshed here).
 * @param fetchFn - fetch implementation (injectable for tests).
+* @param signal - caller cancellation (pool-assembly timeout).
 * @returns model id → contributed metadata.
 */
-async function fetchGrokCliCatalog(session, fetchFn = proxiedFetch) {
-	const response = await fetchFn(GROK_CLI_MODELS_URL, { headers: {
-		"authorization": `Bearer ${session.accessToken}`,
-		"x-xai-token-auth": "xai-grok-cli",
-		"accept": "application/json",
-		...attributionHeaders()
-	} });
+async function fetchGrokCliCatalog(session, fetchFn = proxiedFetch, signal) {
+	const response = await fetchFn(GROK_CLI_MODELS_URL, {
+		headers: {
+			"authorization": `Bearer ${session.accessToken}`,
+			"x-xai-token-auth": "xai-grok-cli",
+			"accept": "application/json",
+			...attributionHeaders()
+		},
+		...signal === void 0 ? {} : { signal }
+	});
 	if (!response.ok) throw await oauthEndpointError(response, "grok CLI catalog");
 	const payload = await response.json();
 	if (!Array.isArray(payload.data)) throw new Error("grok CLI catalog returned no data array");
@@ -3979,15 +5684,20 @@ function grokPriorMeta(prior) {
 * @param onWarn - warning sink for a failed CLI catalog fetch.
 * @param previous - last-known catalog used to keep enrichment when the CLI
 *   catalog is down or omits a model.
+* @param signal - caller cancellation (pool-assembly timeout).
 * @returns discovered chat models in endpoint order.
 */
-async function fetchGrokModels(session, fetchFn = proxiedFetch, onWarn, previous) {
+async function fetchGrokModels(session, fetchFn = proxiedFetch, onWarn, previous, signal) {
 	const previousById = previous === void 0 || previous.length === 0 ? void 0 : new Map(previous.map((model) => [model.id, model]));
-	const [response, cliCatalog] = await Promise.all([fetchFn(GROK_MODELS_URL, { headers: {
-		"authorization": `Bearer ${session.accessToken}`,
-		"accept": "application/json",
-		...attributionHeaders()
-	} }), fetchGrokCliCatalog(session, fetchFn).catch((error) => {
+	const [response, cliCatalog] = await Promise.all([fetchFn(GROK_MODELS_URL, {
+		headers: {
+			"authorization": `Bearer ${session.accessToken}`,
+			"accept": "application/json",
+			...attributionHeaders()
+		},
+		...signal === void 0 ? {} : { signal }
+	}), fetchGrokCliCatalog(session, fetchFn, signal).catch((error) => {
+		if (isDiscoveryAborted(error, signal)) throw error;
 		onWarn?.(previousById === void 0 ? `grok CLI catalog fetch failed; reasoning efforts are unavailable (${errorChain(error)})` : `grok CLI catalog fetch failed; keeping last-known reasoning efforts (${errorChain(error)})`);
 	})]);
 	if (!response.ok) throw await oauthEndpointError(response, "grok models");
@@ -4012,14 +5722,44 @@ async function fetchGrokModels(session, fetchFn = proxiedFetch, onWarn, previous
 /** Grok wire adapter: one instance serves the `grok` provider route. */
 var GrokAdapter = class extends LlmAdapter {
 	catalog;
+	/** In-memory catalogs for non-default accounts (the persisted cache is the default's). */
+	accountCatalogs = /* @__PURE__ */ new Map();
+	/** Account whose snapshot currently lives in {@link catalog}; cleared on default change. */
+	catalogOwner;
 	constructor(options) {
 		super();
 		this.options = options;
 		this.catalog = new ModelCatalogCache(options.catalogStore);
 	}
 	/** Discovery fetcher: resolves the session through the refresh-aware path. */
-	async fetchCatalog() {
-		return fetchGrokModels(await this.options.tokens.session(), this.options.fetchFn, this.options.onWarn, this.catalog.lastKnown());
+	async fetchCatalog(account, signal) {
+		const lastKnown = account === void 0 || account === await this.options.tokens.defaultAccount() ? this.catalog.lastKnown() : this.accountCatalogs.get(account)?.lastKnown();
+		return fetchGrokModels(await this.options.tokens.session(account), this.options.fetchFn, this.options.onWarn, lastKnown, signal);
+	}
+	/** Drop cached catalogs after login/logout so the next list does not reuse a stale plan. */
+	clearAccountCatalog(account) {
+		if (account === void 0) this.accountCatalogs.clear();
+		else this.accountCatalogs.delete(account);
+		if (account === void 0 || this.catalogOwner === account || this.catalogOwner === void 0) {
+			this.catalogOwner = void 0;
+			this.catalog.invalidate();
+		}
+	}
+	/** Persisted cache for the default account; a throwaway cache for any other. */
+	async catalogFor(account) {
+		const defaultKey = await this.options.tokens.defaultAccount();
+		const key = account ?? defaultKey;
+		if (key === void 0 || key === defaultKey) {
+			if (this.catalogOwner !== void 0 && this.catalogOwner !== defaultKey) this.catalog.invalidate();
+			this.catalogOwner = defaultKey;
+			return this.catalog;
+		}
+		let cache = this.accountCatalogs.get(key);
+		if (cache === void 0) {
+			cache = new ModelCatalogCache();
+			this.accountCatalogs.set(key, cache);
+		}
+		return cache;
 	}
 	listed(provider, discovered) {
 		return discovered.map((model) => ({
@@ -4036,6 +5776,9 @@ var GrokAdapter = class extends LlmAdapter {
 			name: "Grok (Subscription)"
 		};
 	}
+	providerRetryPolicy(provider) {
+		return subscriptionRetryPolicy(DEFAULT_RETRY, this.options.rateLimit ?? DEFAULT_RATE_LIMIT_WAIT, `grok: provider "${provider}" retryPolicy`);
+	}
 	staticModels(provider) {
 		return this.options.models.map((model) => ({
 			provider,
@@ -4045,11 +5788,30 @@ var GrokAdapter = class extends LlmAdapter {
 		}));
 	}
 	async listModels(provider) {
-		if (await this.options.tokens.peek() === void 0) return [];
+		const own = await this.listOwnModels(provider);
+		const pool = this.options.pool?.();
+		if (pool === void 0) return own;
+		const extra = await pool.modelsForProvider(provider);
+		const seen = new Set(own.map((model) => model.id));
+		return [...own, ...extra.filter((model) => !seen.has(model.id))];
+	}
+	/** The provider's own catalog: union of every account, or one account when named. */
+	async listOwnModels(provider, account, signal) {
+		if (account === void 0) {
+			const accounts = (await this.options.tokens.list()).map((entry) => entry.key);
+			if (accounts.length === 0) return [];
+			return unionAccountCatalogs(accounts, (key, accountSignal) => this.listOwnModels(provider, key, accountSignal), {
+				timeoutMs: DISCOVERY_TIMEOUT_MS,
+				...signal === void 0 ? {} : { signal }
+			});
+		}
+		if (!await this.options.tokens.hasSession(account)) return [];
 		if (!this.options.discovery) return this.staticModels(provider);
+		const catalog = await this.catalogFor(account);
 		try {
-			return this.listed(provider, await discoverOrRetryAuth((force) => this.options.tokens.session(force), this.catalog, () => this.catalog.get(() => this.fetchCatalog())));
+			return this.listed(provider, await discoverOrRetryAuth((force) => this.options.tokens.session(account, force), catalog, () => catalog.get(() => this.fetchCatalog(account, signal))));
 		} catch (error) {
+			if (isDiscoveryAborted(error, signal)) throw error;
 			if (isMissingOrInvalidCredential(error)) return [];
 			this.options.onWarn?.(`grok model discovery failed; using the built-in catalog (${errorChain(error)})`);
 			return this.staticModels(provider);
@@ -4065,11 +5827,20 @@ var GrokAdapter = class extends LlmAdapter {
 	*/
 	async discovered(model) {
 		if (!this.options.discovery) return void 0;
-		return (await this.catalog.resolve(() => this.fetchCatalog()))?.find((entry) => entry.id === model);
+		return discoverAcrossAccounts((await this.options.tokens.list()).map((entry) => entry.key), async (account) => {
+			return (await (await this.catalogFor(account)).resolve(() => this.fetchCatalog(account)))?.find((entry) => entry.id === model);
+		});
 	}
 	async resolveModel(provider, model) {
+		const pool = this.options.pool?.();
+		if (pool !== void 0 && await pool.owns(provider, model)) return pool.resolveModel(provider, model);
+		return this.resolveOwnModel(provider, model);
+	}
+	/** Capability resolution of the provider's own models (the pool resolves members here). */
+	async resolveOwnModel(provider, model) {
 		const discovered = await this.discovered(model);
 		const configured = this.options.models.find((entry) => entry.id === model);
+		const reasoning = mergeReasoning(this.options.defaultEffortOf?.(model), discovered?.reasoning);
 		return {
 			provider,
 			id: model,
@@ -4078,19 +5849,34 @@ var GrokAdapter = class extends LlmAdapter {
 			inputModalities: configured?.inputModalities ?? grokModalities(model),
 			context: { contextWindow: discovered?.contextWindow ?? configured?.contextWindow ?? GROK_CONTEXT_WINDOW },
 			defaultMaxTokens: configured?.maxTokens ?? GROK_DEFAULT_MAX_TOKENS,
-			...discovered?.reasoning === void 0 ? {} : { reasoning: discovered.reasoning }
+			...reasoning === void 0 ? {} : { reasoning }
 		};
 	}
 	async *stream(options) {
+		const pool = this.options.pool?.();
+		if (pool !== void 0 && await pool.owns(options.provider, options.model)) {
+			yield* pool.stream(options);
+			return;
+		}
+		yield* this.streamCore(options);
+	}
+	/** Pool seam: stream through one specific account instead of the default. */
+	streamAccount(options, account) {
+		return this.streamCore(options, account);
+	}
+	async *streamCore(options, account) {
 		const watchdog = idleWatchdog(options.signal, this.options.streamIdleTimeoutMs);
 		try {
-			let session = await this.options.tokens.session();
+			let session = await this.options.tokens.session(account);
 			let response = await this.request(options, session, watchdog.signal);
 			if (response.status === 401) {
-				session = await this.options.tokens.session(true);
+				session = await this.options.tokens.session(account, true);
 				response = await this.request(options, session, watchdog.signal);
 			}
-			if (!response.ok) throw await httpLlmError(response, "grok API");
+			if (!response.ok) throw await httpLlmError(response, "grok API", {
+				rateLimitReset: grokRateLimitReset,
+				...this.options.onWarn === void 0 ? {} : { onWarn: this.options.onWarn }
+			});
 			if (response.body === null) throw new LlmError("grok API returned no response body", EMPTY_RESPONSE_CODE);
 			yield* streamResponses(response.body, () => {
 				watchdog.pulse();
@@ -4112,6 +5898,7 @@ var GrokAdapter = class extends LlmAdapter {
 			parallel_tool_calls: true,
 			...options.maxTokens !== void 0 ? { max_output_tokens: options.maxTokens } : {},
 			...options.reasoningEffort !== void 0 ? { reasoning: { effort: String(options.reasoningEffort) } } : {},
+			...options.sessionId !== void 0 ? { prompt_cache_key: String(options.sessionId) } : {},
 			store: false,
 			stream: true
 		};
@@ -4274,7 +6061,7 @@ function closeBlock(block) {
 		};
 		case "tool-call": return {
 			type: "tool-call",
-			id: CallId(block.callId),
+			id: ToolCallId(block.callId),
 			name: block.name ?? "",
 			arguments: block.text
 		};
@@ -4428,7 +6215,7 @@ var ChatCompletionsStreamTranslator = class {
 					chunks.push({
 						type: "tool-call-delta",
 						index: block.index,
-						id: CallId(block.callId),
+						id: ToolCallId(block.callId),
 						...block.name === void 0 ? {} : { name: block.name },
 						argumentsDelta: ""
 					});
@@ -4438,7 +6225,7 @@ var ChatCompletionsStreamTranslator = class {
 					chunks.push({
 						type: "tool-call-delta",
 						index: block.index,
-						id: CallId(block.callId),
+						id: ToolCallId(block.callId),
 						argumentsDelta: call.function.arguments
 					});
 				}
@@ -4694,14 +6481,18 @@ function copilotReasoning(entry) {
 * reasoning efforts (the endpoint discloses no default, so none is claimed).
 * @param session - the stored session (used as-is; never refreshed here).
 * @param fetchFn - fetch implementation (injectable for tests).
+* @param signal - caller cancellation (pool-assembly timeout).
 * @returns discovered chat models in endpoint order.
 */
-async function fetchCopilotModels(session, fetchFn = proxiedFetch) {
-	const response = await fetchFn(COPILOT_MODELS_URL, { headers: {
-		"authorization": `Bearer ${session.accessToken}`,
-		"accept": "application/json",
-		...copilotHeaders(false, await latestVsCodeVersion(fetchFn))
-	} });
+async function fetchCopilotModels(session, fetchFn = proxiedFetch, signal) {
+	const response = await fetchFn(COPILOT_MODELS_URL, {
+		headers: {
+			"authorization": `Bearer ${session.accessToken}`,
+			"accept": "application/json",
+			...copilotHeaders(false, await latestVsCodeVersion(fetchFn))
+		},
+		...signal === void 0 ? {} : { signal }
+	});
 	if (!response.ok) throw await oauthEndpointError(response, "copilot models");
 	const payload = await response.json();
 	if (!Array.isArray(payload.data)) throw new Error("copilot models endpoint returned no data array");
@@ -4923,6 +6714,10 @@ var CopilotResponsesItemNormalizer = class {
 /** Copilot wire adapter: one instance serves the `copilot` provider route. */
 var CopilotAdapter = class CopilotAdapter extends LlmAdapter {
 	catalog;
+	/** In-memory catalogs for non-default accounts (the persisted cache is the default's). */
+	accountCatalogs = /* @__PURE__ */ new Map();
+	/** Account whose snapshot currently lives in {@link catalog}; cleared on default change. */
+	catalogOwner;
 	/**
 	* [2026-08-23]-[a reasoning model continuing a tool chain must get its
 	* reasoning back or it restarts from scratch every tool round trip; the
@@ -4945,8 +6740,33 @@ var CopilotAdapter = class CopilotAdapter extends LlmAdapter {
 		this.catalog = new ModelCatalogCache(options.catalogStore);
 	}
 	/** Discovery fetcher: resolves the session through the refresh-aware path. */
-	async fetchCatalog() {
-		return fetchCopilotModels(await this.options.tokens.session(), this.options.fetchFn);
+	async fetchCatalog(account, signal) {
+		return fetchCopilotModels(await this.options.tokens.session(account), this.options.fetchFn, signal);
+	}
+	/** Drop cached catalogs after login/logout so the next list does not reuse a stale plan. */
+	clearAccountCatalog(account) {
+		if (account === void 0) this.accountCatalogs.clear();
+		else this.accountCatalogs.delete(account);
+		if (account === void 0 || this.catalogOwner === account || this.catalogOwner === void 0) {
+			this.catalogOwner = void 0;
+			this.catalog.invalidate();
+		}
+	}
+	/** Persisted cache for the default account; a throwaway cache for any other. */
+	async catalogFor(account) {
+		const defaultKey = await this.options.tokens.defaultAccount();
+		const key = account ?? defaultKey;
+		if (key === void 0 || key === defaultKey) {
+			if (this.catalogOwner !== void 0 && this.catalogOwner !== defaultKey) this.catalog.invalidate();
+			this.catalogOwner = defaultKey;
+			return this.catalog;
+		}
+		let cache = this.accountCatalogs.get(key);
+		if (cache === void 0) {
+			cache = new ModelCatalogCache();
+			this.accountCatalogs.set(key, cache);
+		}
+		return cache;
 	}
 	providerInfo(provider) {
 		return {
@@ -4954,6 +6774,9 @@ var CopilotAdapter = class CopilotAdapter extends LlmAdapter {
 			name: "GitHub Copilot"
 		};
 	}
+	providerRetryPolicy(provider) {
+		return subscriptionRetryPolicy(DEFAULT_RETRY, this.options.rateLimit ?? DEFAULT_RATE_LIMIT_WAIT, `copilot: provider "${provider}" retryPolicy`);
+	}
 	staticModels(provider) {
 		return this.options.models.map((model) => ({
 			provider,
@@ -4963,10 +6786,28 @@ var CopilotAdapter = class CopilotAdapter extends LlmAdapter {
 		}));
 	}
 	async listModels(provider) {
-		if (await this.options.tokens.peek() === void 0) return [];
+		const own = await this.listOwnModels(provider);
+		const pool = this.options.pool?.();
+		if (pool === void 0) return own;
+		const extra = await pool.modelsForProvider(provider);
+		const seen = new Set(own.map((model) => model.id));
+		return [...own, ...extra.filter((model) => !seen.has(model.id))];
+	}
+	/** The provider's own catalog: union of every account, or one account when named. */
+	async listOwnModels(provider, account, signal) {
+		if (account === void 0) {
+			const accounts = (await this.options.tokens.list()).map((entry) => entry.key);
+			if (accounts.length === 0) return [];
+			return unionAccountCatalogs(accounts, (key, accountSignal) => this.listOwnModels(provider, key, accountSignal), {
+				timeoutMs: DISCOVERY_TIMEOUT_MS,
+				...signal === void 0 ? {} : { signal }
+			});
+		}
+		if (!await this.options.tokens.hasSession(account)) return [];
 		if (!this.options.discovery) return this.staticModels(provider);
+		const catalog = await this.catalogFor(account);
 		try {
-			return (await discoverOrRetryAuth((force) => this.options.tokens.session(force), this.catalog, () => this.catalog.get(() => this.fetchCatalog()))).map((model) => ({
+			return (await discoverOrRetryAuth((force) => this.options.tokens.session(account, force), catalog, () => catalog.get(() => this.fetchCatalog(account, signal)))).map((model) => ({
 				provider,
 				id: model.id,
 				name: model.name,
@@ -4974,6 +6815,7 @@ var CopilotAdapter = class CopilotAdapter extends LlmAdapter {
 				...model.inputModalities === void 0 ? {} : { inputModalities: model.inputModalities }
 			}));
 		} catch (error) {
+			if (isDiscoveryAborted(error, signal)) throw error;
 			if (isMissingOrInvalidCredential(error)) return [];
 			this.options.onWarn?.(`copilot model discovery failed; using the built-in catalog (${errorChain(error)})`);
 			return this.staticModels(provider);
@@ -4987,7 +6829,9 @@ var CopilotAdapter = class CopilotAdapter extends LlmAdapter {
 	*/
 	async discovered(model) {
 		if (!this.options.discovery) return void 0;
-		return (await this.catalog.resolve(() => this.fetchCatalog()))?.find((entry) => entry.id === model);
+		return discoverAcrossAccounts((await this.options.tokens.list()).map((entry) => entry.key), async (account) => {
+			return (await (await this.catalogFor(account)).resolve(() => this.fetchCatalog(account)))?.find((entry) => entry.id === model);
+		});
 	}
 	/**
 	* [2026-08-23]-[a manually configured responses-only model combined with
@@ -5087,8 +6931,15 @@ var CopilotAdapter = class CopilotAdapter extends LlmAdapter {
 		this.replayByScope.clear();
 	}
 	async resolveModel(provider, model) {
+		const pool = this.options.pool?.();
+		if (pool !== void 0 && await pool.owns(provider, model)) return pool.resolveModel(provider, model);
+		return this.resolveOwnModel(provider, model);
+	}
+	/** Capability resolution of the provider's own models (the pool resolves members here). */
+	async resolveOwnModel(provider, model) {
 		const discovered = await this.discovered(model);
 		const configured = this.options.models.find((entry) => entry.id === model);
+		const reasoning = mergeReasoning(this.options.defaultEffortOf?.(model), discovered?.reasoning);
 		return {
 			provider,
 			id: model,
@@ -5097,22 +6948,34 @@ var CopilotAdapter = class CopilotAdapter extends LlmAdapter {
 			inputModalities: discovered?.inputModalities ?? configured?.inputModalities ?? ["text"],
 			context: { contextWindow: discovered?.contextWindow ?? configured?.contextWindow ?? COPILOT_CONTEXT_WINDOW },
 			defaultMaxTokens: configured?.maxTokens ?? COPILOT_DEFAULT_MAX_TOKENS,
-			...discovered?.reasoning === void 0 ? {} : { reasoning: discovered.reasoning }
+			...reasoning === void 0 ? {} : { reasoning }
 		};
 	}
 	async *stream(options) {
+		const pool = this.options.pool?.();
+		if (pool !== void 0 && await pool.owns(options.provider, options.model)) {
+			yield* pool.stream(options);
+			return;
+		}
+		yield* this.streamCore(options);
+	}
+	/** Pool seam: stream through one specific account instead of the default. */
+	streamAccount(options, account) {
+		return this.streamCore(options, account);
+	}
+	async *streamCore(options, account) {
 		const watchdog = idleWatchdog(options.signal, this.options.streamIdleTimeoutMs);
 		try {
 			const wire = copilotRequestWire(this.configuredWireEntry(options.model) ?? await this.discovered(options.model), options);
-			let session = await this.options.tokens.session();
+			let session = await this.options.tokens.session(account);
 			const scope = this.replayScope(session.refreshToken, options);
 			let response = await this.request(options, session, watchdog.signal, wire, scope);
 			if (response.status === 401) {
 				await latestVsCodeVersion(this.options.fetchFn ?? proxiedFetch, true);
-				session = await this.options.tokens.session(true);
+				session = await this.options.tokens.session(account, true);
 				response = await this.request(options, session, watchdog.signal, wire, scope);
 			}
-			if (!response.ok) throw await httpLlmError(response, "copilot API");
+			if (!response.ok) throw await httpLlmError(response, "copilot API", { ...this.options.onWarn === void 0 ? {} : { onWarn: this.options.onWarn } });
 			if (response.body === null) throw new LlmError("copilot API returned no response body", EMPTY_RESPONSE_CODE);
 			const pulse = () => {
 				watchdog.pulse();
@@ -5435,13 +7298,13 @@ function truncate$1(text, max = 60) {
 * image input; any resolution failure means "no".
 */
 async function routeDeclaresImageInput(resolveLlm, exec) {
-	const llm = resolveLlm?.();
+	const llm$1 = resolveLlm?.();
 	const routed = exec.agent?.session.requestHeader()?.config;
 	const provider = routed?.provider ?? exec.agent?.options.provider;
 	const model = routed?.model ?? exec.agent?.options.model;
-	if (llm === void 0 || provider === void 0 || model === void 0) return false;
+	if (llm$1 === void 0 || provider === void 0 || model === void 0) return false;
 	try {
-		return (await llm.resolveModelInfo(provider, model, exec.signal)).inputModalities?.includes("image") === true;
+		return (await llm$1.resolveModelInfo(provider, model, exec.signal)).inputModalities?.includes("image") === true;
 	} catch {
 		return false;
 	}
@@ -5901,6 +7764,8 @@ const name = "dsh-plugin-subscriptions";
 const inject = ["llm"];
 /** Default maximum provider idle time while one stream read is outstanding. */
 const DEFAULT_STREAM_IDLE_TIMEOUT_MS = 3e5;
+/** Bound on one pool quota poll — member selection must not hang on a usage endpoint. */
+const POOL_USAGE_TIMEOUT_MS = DISCOVERY_TIMEOUT_MS;
 const providerIdSchema = z.union([
 	"codex",
 	"claude",
@@ -5915,6 +7780,11 @@ const modelEntrySchema = z.object({
 	inputModalities: z.array(z.union(["text", "image"])),
 	wire: z.union(["chat-completions", "responses"])
 });
+const poolMemberSchema = z.object({
+	provider: providerIdSchema.required(),
+	account: z.string(),
+	model: z.string().required()
+});
 const Config = z.object({
 	providers: z.array(providerIdSchema).default([
 		"codex",
@@ -5923,11 +7793,24 @@ const Config = z.object({
 		"copilot"
 	]),
 	streamIdleTimeoutMs: z.number().min(1).default(DEFAULT_STREAM_IDLE_TIMEOUT_MS),
+	rateLimit: z.object({
+		wait: z.boolean().default(true),
+		maxWaitMs: z.number().min(1).default(DEFAULT_RATE_LIMIT_MAX_WAIT_MS)
+	}),
 	models: z.object({
 		codex: z.array(modelEntrySchema),
 		claude: z.array(modelEntrySchema),
 		grok: z.array(modelEntrySchema),
 		copilot: z.array(modelEntrySchema)
+	}),
+	pool: z.object({
+		enabled: z.boolean().default(true),
+		strategy: z.union(["priority", "quota_aware"]).default("quota_aware"),
+		switchMargin: z.number().min(1).default(2),
+		autoAccounts: z.boolean().default(true),
+		autoFamilies: z.boolean(),
+		families: z.dict(z.array(poolMemberSchema)),
+		tiers: z.dict(z.array(poolMemberSchema))
 	})
 });
 /** Built-in catalogs used when the config does not override a provider's models. */
@@ -6034,6 +7917,15 @@ function accountOf(provider, session) {
 		case "copilot": return session.account;
 	}
 }
+/** The plan name a stored session carries, when the provider told us. */
+function planOf(provider, session) {
+	switch (provider) {
+		case "codex": return session.planType;
+		case "claude": return session.subscriptionType;
+		case "grok": return;
+		case "copilot": return;
+	}
+}
 /**
 * Auth operations behind the `/subscriptions-auth` RPC channel: start/complete
 * OAuth attempts in the background, feed pasted codes, cancel, log out, and
@@ -6067,18 +7959,20 @@ var SubscriptionsAuthController = class {
 	* cannot be read off the flow manager.
 	*/
 	claims = /* @__PURE__ */ new Map();
-	constructor(flows, deviceFlows, onAuthChanged, resolveAttachments, usageFetchers = {}, readClaudeCreds = readClaudeCodeCredentials) {
+	constructor(flows, deviceFlows, onAuthChanged, resolveAttachments, usageFetchers = {}, readClaudeCreds = readClaudeCodeCredentials, poolUsage = void 0) {
 		this.flows = flows;
 		this.deviceFlows = deviceFlows;
 		this.onAuthChanged = onAuthChanged;
 		this.resolveAttachments = resolveAttachments;
 		this.usageFetchers = usageFetchers;
 		this.readClaudeCreds = readClaudeCreds;
+		this.poolUsage = poolUsage;
 	}
-	usage(provider, signal) {
+	usage(provider, account, signal, force = false) {
 		const fetcher = this.usageFetchers[provider];
 		if (fetcher === void 0) return Promise.resolve({ supported: false });
-		return fetcher(signal);
+		if (this.poolUsage === void 0) return fetcher(account, signal);
+		return this.poolUsage.snapshotFor(provider, account, force);
 	}
 	async readImage(ref, signal) {
 		const attachments = this.resolveAttachments();
@@ -6096,28 +7990,45 @@ var SubscriptionsAuthController = class {
 		};
 	}
 	async status(provider) {
-		const session = await getSession(provider);
-		const account = accountOf(provider, session);
+		const entries = await listAccounts(provider);
 		const detail = this.lastError.get(provider);
 		return {
-			loggedIn: session !== void 0,
 			busy: this.flows.isBusy(provider) || this.deviceFlows.isBusy(provider) || this.finalizing.has(provider),
-			...session === void 0 ? {} : { expiresAt: session.expiresAt },
-			...account === void 0 ? {} : { account },
+			accounts: entries.map(({ key, session }, index) => {
+				const account = accountOf(provider, session);
+				const plan = planOf(provider, session);
+				return {
+					key,
+					isDefault: index === 0,
+					expiresAt: session.expiresAt,
+					...account === void 0 ? {} : { account },
+					...plan === void 0 ? {} : { plan }
+				};
+			}),
 			...detail === void 0 ? {} : { detail }
 		};
 	}
-	async login(provider) {
-		if (provider === "claude") {
+	async login(provider, method) {
+		if (provider === "claude" && method !== "oauth") {
 			const imported = this.readClaudeCreds();
 			if (imported !== void 0) {
 				this.claim("claude");
 				this.flows.pending("claude")?.cancel();
-				await this.persist("claude", imported);
+				const session = {
+					...imported,
+					keychainBound: true
+				};
+				await this.persist("claude", session);
 				this.lastError.delete("claude");
-				this.onAuthChanged("claude");
+				this.onAuthChanged("claude", accountKeyOf("claude", session));
 				return { authorizeUrl: "" };
 			}
+			if (method === "keychain") throw new Error("no Claude Code credentials found; run `claude` and log in first, or choose the browser flow");
+			const attempt$1 = await this.flows.start("claude", claudeFlow);
+			this.completions.set("claude", this.complete("claude", attempt$1, this.claim("claude")));
+			return { authorizeUrl: attempt$1.authorizeUrl };
+		}
+		if (provider === "claude") {
 			const attempt$1 = await this.flows.start("claude", claudeFlow);
 			this.completions.set("claude", this.complete("claude", attempt$1, this.claim("claude")));
 			return { authorizeUrl: attempt$1.authorizeUrl };
@@ -6159,7 +8070,7 @@ var SubscriptionsAuthController = class {
 			if (this.claims.get(provider) !== claim) return;
 			await this.persist(provider, session);
 			this.lastError.delete(provider);
-			this.onAuthChanged(provider);
+			this.onAuthChanged(provider, accountKeyOf(provider, session));
 		} catch (error) {
 			if (this.claims.get(provider) !== claim) return;
 			if (!(error instanceof Error && error.message === "login cancelled")) this.lastError.set(provider, errorChain(error));
@@ -6171,7 +8082,7 @@ var SubscriptionsAuthController = class {
 			const session = await completeCopilotLogin(await attempt.waitToken());
 			await this.persist(provider, session);
 			this.lastError.delete(provider);
-			this.onAuthChanged(provider);
+			this.onAuthChanged(provider, accountKeyOf(provider, session));
 		} catch (error) {
 			if (!(error instanceof Error && error.message === "login cancelled")) this.lastError.set(provider, errorChain(error));
 		} finally {
@@ -6187,12 +8098,7 @@ var SubscriptionsAuthController = class {
 		}
 	}
 	persist(provider, session) {
-		switch (provider) {
-			case "codex": return saveSession("codex", session);
-			case "claude": return saveSession("claude", session);
-			case "grok": return saveSession("grok", session);
-			case "copilot": return saveSession("copilot", session);
-		}
+		return saveAccountSession(provider, accountKeyOf(provider, session), session);
 	}
 	/**
 	* Settle once no OAuth completion is running for a provider.
@@ -6216,19 +8122,24 @@ var SubscriptionsAuthController = class {
 		this.deviceFlows.pending(provider)?.cancel();
 		return Promise.resolve();
 	}
-	async logout(provider) {
+	async logout(provider, account) {
 		this.claim(provider);
 		this.flows.pending(provider)?.cancel();
 		this.deviceFlows.pending(provider)?.cancel();
-		await deleteSession(provider);
+		await deleteAccountSession(provider, account);
 		this.lastError.delete(provider);
-		this.onAuthChanged(provider);
+		this.onAuthChanged(provider, account);
+	}
+	async setDefault(provider, account) {
+		await setDefaultAccount(provider, account);
+		this.onAuthChanged(provider, account);
 	}
 };
 function apply(ctx, config) {
 	const providers = [...new Set(config.providers ?? [...PROVIDER_IDS])];
 	const streamIdleTimeoutMs = config.streamIdleTimeoutMs ?? DEFAULT_STREAM_IDLE_TIMEOUT_MS;
 	if (!Number.isFinite(streamIdleTimeoutMs) || streamIdleTimeoutMs <= 0) throw new Error(`${name}: streamIdleTimeoutMs must be a positive finite number`);
+	const rateLimit = resolveRateLimitWait(config.rateLimit, `${name}: rateLimit`);
 	const catalog = resolveCatalog(config.models);
 	const overridden = new Set(PROVIDER_IDS.filter((provider) => (config.models?.[provider]?.length ?? 0) > 0));
 	const flows = new OAuthFlowManager();
@@ -6238,10 +8149,20 @@ function apply(ctx, config) {
 	};
 	const resolveAttachments = () => ctx.get("attachments");
 	const handles = /* @__PURE__ */ new Map();
-	const authChanged = (provider) => {
+	const adapters = /* @__PURE__ */ new Map();
+	const accountTokens = /* @__PURE__ */ new Map();
+	let poolHealth;
+	let poolUsage;
+	let poolAdapter;
+	const authChanged = (provider, account) => {
 		if (provider === "copilot") copilotAdapter?.clearReplayState();
-		handles.get(provider)?.replace([provider]);
+		adapters.get(provider)?.clearAccountCatalog(account);
+		poolHealth?.clear(provider, account);
+		poolUsage?.invalidate(provider, account);
+		poolAdapter?.invalidate();
+		for (const [route, handle] of handles) handle.replace([route]);
 	};
+	loadModelDefaults();
 	let codexTokens;
 	let claudeTokens;
 	let grokTokens;
@@ -6251,115 +8172,199 @@ function apply(ctx, config) {
 	let copilotAdapter;
 	for (const provider of providers) switch (provider) {
 		case "codex": {
-			const tokens = new TokenManager({
+			const tokens = new AccountTokenManager({
+				provider: "codex",
 				displayName: "ChatGPT (Codex)",
-				preemptMs: CODEX_PREEMPT_MS,
-				load: () => getSession("codex"),
-				save: (session) => saveSession("codex", session),
-				remove: () => deleteSession("codex"),
-				refresh: refreshCodex,
-				isPermanent: isCodexPermanentRefreshError,
-				onRemoved: () => {
-					authChanged("codex");
+				makeOptions: () => ({
+					preemptMs: CODEX_PREEMPT_MS,
+					refresh: refreshCodex,
+					isPermanent: isCodexPermanentRefreshError
+				}),
+				onAccountRemoved: (account) => {
+					authChanged("codex", account);
 				}
 			});
 			codexTokens = tokens;
-			usageFetchers.codex = async (signal) => fetchCodexUsage(await tokens.session(), proxiedFetch, signal);
+			accountTokens.set("codex", tokens);
+			usageFetchers.codex = async (account, signal) => fetchCodexUsage(await tokens.session(account), proxiedFetch, signal);
 			let adapter;
 			adapter = new CodexAdapter({
 				models: catalog.codex,
 				streamIdleTimeoutMs,
+				rateLimit,
 				tokens,
 				discovery: !overridden.has("codex"),
 				onWarn,
 				resolveAttachments,
 				catalogStore: catalogStore("codex"),
+				defaultEffortOf: (model) => defaultEffortOf("codex", model),
+				pool: () => poolAdapter,
 				speedFor: (sessionId, model) => sessionId !== void 0 && speedBySession.get(sessionId) === "fast" && adapter.supportsFastTier(model)
 			});
 			codexAdapter = adapter;
+			adapters.set("codex", adapter);
 			handles.set("codex", ctx.llm.registerAdapter(["codex"], adapter));
 			break;
 		}
 		case "claude": {
-			const tokens = new TokenManager({
+			const tokens = new AccountTokenManager({
+				provider: "claude",
 				displayName: "Claude (Subscription)",
-				preemptMs: CLAUDE_PREEMPT_MS,
-				load: () => getSession("claude"),
-				save: (session) => saveSession("claude", session),
-				remove: () => deleteSession("claude"),
-				refresh: (session) => refreshClaudeSynced(session, refreshClaude),
-				isPermanent: isClaudePermanentRefreshError,
-				onRemoved: () => {
-					authChanged("claude");
+				makeOptions: () => ({
+					preemptMs: CLAUDE_PREEMPT_MS,
+					refresh: (session) => session.keychainBound === true ? refreshClaudeSynced(session, refreshClaude) : refreshClaude(session),
+					isPermanent: isClaudePermanentRefreshError
+				}),
+				onAccountRemoved: (account) => {
+					authChanged("claude", account);
 				}
 			});
 			claudeTokens = tokens;
-			usageFetchers.claude = async (signal) => fetchClaudeUsage(await tokens.session(), proxiedFetch, signal);
-			handles.set("claude", ctx.llm.registerAdapter(["claude"], new ClaudeAdapter({
+			accountTokens.set("claude", tokens);
+			usageFetchers.claude = async (account, signal) => fetchClaudeUsage(await tokens.session(account), proxiedFetch, signal);
+			const adapter = new ClaudeAdapter({
 				models: catalog.claude,
 				streamIdleTimeoutMs,
+				rateLimit,
 				tokens,
 				discovery: !overridden.has("claude"),
 				onWarn,
-				maxRetries: 10,
 				resolveAttachments,
-				catalogStore: catalogStore("claude")
-			})));
+				catalogStore: catalogStore("claude"),
+				defaultEffortOf: (model) => defaultEffortOf("claude", model),
+				pool: () => poolAdapter
+			});
+			adapters.set("claude", adapter);
+			handles.set("claude", ctx.llm.registerAdapter(["claude"], adapter));
 			break;
 		}
 		case "grok": {
-			const tokens = new TokenManager({
+			const tokens = new AccountTokenManager({
+				provider: "grok",
 				displayName: "Grok (Subscription)",
-				preemptMs: GROK_PREEMPT_MS,
-				load: () => getSession("grok"),
-				save: (session) => saveSession("grok", session),
-				remove: () => deleteSession("grok"),
-				refresh: refreshGrok,
-				isPermanent: isGrokPermanentRefreshError,
-				onRemoved: () => {
-					authChanged("grok");
+				makeOptions: () => ({
+					preemptMs: GROK_PREEMPT_MS,
+					refresh: refreshGrok,
+					isPermanent: isGrokPermanentRefreshError
+				}),
+				onAccountRemoved: (account) => {
+					authChanged("grok", account);
 				}
 			});
 			grokTokens = tokens;
-			usageFetchers.grok = async (signal) => fetchGrokUsage(await tokens.session(), proxiedFetch, signal);
-			handles.set("grok", ctx.llm.registerAdapter(["grok"], new GrokAdapter({
+			accountTokens.set("grok", tokens);
+			usageFetchers.grok = async (account, signal) => fetchGrokUsage(await tokens.session(account), proxiedFetch, signal);
+			const adapter = new GrokAdapter({
 				models: catalog.grok,
 				streamIdleTimeoutMs,
+				rateLimit,
 				tokens,
 				discovery: !overridden.has("grok"),
 				onWarn,
 				resolveAttachments,
-				catalogStore: catalogStore("grok")
-			})));
+				catalogStore: catalogStore("grok"),
+				defaultEffortOf: (model) => defaultEffortOf("grok", model),
+				pool: () => poolAdapter
+			});
+			adapters.set("grok", adapter);
+			handles.set("grok", ctx.llm.registerAdapter(["grok"], adapter));
 			break;
 		}
 		case "copilot": {
-			const tokens = new TokenManager({
+			const tokens = new AccountTokenManager({
+				provider: "copilot",
 				displayName: "GitHub Copilot",
-				preemptMs: COPILOT_PREEMPT_MS,
-				load: () => getSession("copilot"),
-				save: (session) => saveSession("copilot", session),
-				remove: () => deleteSession("copilot"),
-				refresh: refreshCopilot,
-				isPermanent: isCopilotPermanentRefreshError,
-				onRemoved: () => {
-					authChanged("copilot");
+				makeOptions: () => ({
+					preemptMs: COPILOT_PREEMPT_MS,
+					refresh: refreshCopilot,
+					isPermanent: isCopilotPermanentRefreshError
+				}),
+				onAccountRemoved: (account) => {
+					authChanged("copilot", account);
 				}
 			});
+			accountTokens.set("copilot", tokens);
 			copilotAdapter = new CopilotAdapter({
 				models: catalog.copilot,
 				streamIdleTimeoutMs,
+				rateLimit,
 				tokens,
 				discovery: !overridden.has("copilot"),
 				onWarn,
 				resolveAttachments,
-				catalogStore: catalogStore("copilot")
+				catalogStore: catalogStore("copilot"),
+				defaultEffortOf: (model) => defaultEffortOf("copilot", model),
+				pool: () => poolAdapter
 			});
+			adapters.set("copilot", copilotAdapter);
 			handles.set("copilot", ctx.llm.registerAdapter(["copilot"], copilotAdapter));
 			break;
 		}
 	}
-	registerAuthRpc(ctx, new SubscriptionsAuthController(flows, deviceFlows, authChanged, resolveAttachments, usageFetchers), {
+	const poolConfig = config.pool;
+	const autoAccounts = poolConfig?.autoAccounts ?? poolConfig?.autoFamilies ?? true;
+	if (poolConfig?.enabled !== false && adapters.size >= 1) {
+		const fetcherFor = (provider, account) => {
+			switch (provider) {
+				case "codex": {
+					const tokens = codexTokens;
+					return tokens === void 0 ? void 0 : async () => fetchCodexUsage(await tokens.session(account), proxiedFetch, AbortSignal.timeout(POOL_USAGE_TIMEOUT_MS));
+				}
+				case "claude": {
+					const tokens = claudeTokens;
+					return tokens === void 0 ? void 0 : async () => fetchClaudeUsage(await tokens.session(account), proxiedFetch, AbortSignal.timeout(POOL_USAGE_TIMEOUT_MS));
+				}
+				case "grok": {
+					const tokens = grokTokens;
+					return tokens === void 0 ? void 0 : async () => fetchGrokUsage(await tokens.session(account), proxiedFetch, AbortSignal.timeout(POOL_USAGE_TIMEOUT_MS));
+				}
+				case "copilot": return;
+			}
+		};
+		poolHealth = new PoolHealthRegistry();
+		poolUsage = new PoolUsageTracker(fetcherFor);
+		const families = async () => {
+			const pools = /* @__PURE__ */ new Map();
+			if (autoAccounts) {
+				const sources = {};
+				await Promise.all([...adapters].map(async ([provider, adapter]) => {
+					try {
+						const accounts = (await accountTokens.get(provider)?.list() ?? []).map((entry) => entry.key);
+						if (accounts.length < 2) return;
+						const catalogs = (await Promise.all(accounts.map(async (account) => {
+							const models = await withTimeout((signal) => adapter.listOwnModels(provider, account, signal), POOL_USAGE_TIMEOUT_MS);
+							return models === void 0 ? void 0 : {
+								account,
+								models
+							};
+						}))).filter((entry) => entry !== void 0);
+						if (catalogs.length >= 2) sources[provider] = { catalogs };
+					} catch {}
+				}));
+				for (const [key, definition] of buildAccountPools(sources)) pools.set(key, definition);
+			}
+			for (const [id, members] of Object.entries(poolConfig?.families ?? {})) {
+				if (members.length === 0) continue;
+				const owner = members[0].provider;
+				const kept = members.filter((member) => member.provider === owner);
+				if (kept.length < members.length) onWarn(`pool "${id}": cross-provider members are ignored; only ${owner} accounts are pooled`);
+				pools.set(poolKey(owner, id), { members: kept });
+			}
+			return pools;
+		};
+		poolAdapter = new PoolAdapter({
+			adapters: Object.fromEntries(adapters),
+			health: poolHealth,
+			usage: poolUsage,
+			strategy: poolConfig?.strategy ?? "quota_aware",
+			switchMargin: poolConfig?.switchMargin ?? 2,
+			defaultAccount: (provider) => accountTokens.get(provider)?.defaultAccount() ?? Promise.resolve(void 0),
+			families,
+			tiers: poolConfig?.tiers ?? {},
+			onWarn
+		});
+	}
+	registerAuthRpc(ctx, new SubscriptionsAuthController(flows, deviceFlows, authChanged, resolveAttachments, usageFetchers, void 0, poolUsage), {
 		async speed(sessionId) {
 			return {
 				tier: speedBySession.get(sessionId) ?? "standard",
@@ -6374,10 +8379,73 @@ function apply(ctx, config) {
 		get: () => proxyGetConfig(),
 		set: (input) => proxySetConfig(input),
 		test: (payload) => proxyTestConnection(payload.url, payload.proxy)
+	}, {
+		async catalog() {
+			const visible = new Set((await ctx.llm.listProviders()).map((provider) => provider.id));
+			const catalog$1 = [];
+			for (const provider of PROVIDER_IDS) {
+				if (!visible.has(provider)) continue;
+				let models = [];
+				try {
+					models = await ctx.llm.listModels(provider);
+				} catch {
+					continue;
+				}
+				let tierIds = /* @__PURE__ */ new Set();
+				try {
+					const tiers = await poolAdapter?.modelsForProvider(provider);
+					if (tiers !== void 0) tierIds = new Set(tiers.map((tier) => tier.id));
+				} catch {}
+				const views = [];
+				for (const model of models) {
+					if (tierIds.has(model.id)) continue;
+					let info;
+					try {
+						info = await ctx.llm.resolveModelInfo(provider, model.id);
+					} catch {
+						continue;
+					}
+					if (info === void 0) continue;
+					const override = defaultEffortOf(provider, model.id);
+					views.push({
+						id: model.id,
+						name: model.name,
+						efforts: info.reasoning?.efforts.map((effort) => ({
+							id: effort.id,
+							name: effort.name
+						})) ?? [],
+						...override === void 0 ? {} : { configured: override }
+					});
+				}
+				catalog$1.push({
+					provider,
+					models: views
+				});
+			}
+			return catalog$1;
+		},
+		async set(provider, model, effort) {
+			if (effort !== void 0) {
+				let info;
+				try {
+					info = await ctx.llm.resolveModelInfo(provider, model);
+				} catch {}
+				const offered = info?.reasoning?.efforts ?? [];
+				if (offered.length > 0 && !offered.some((entry) => entry.id === effort)) throw new BadRequest(`model ${model} does not advertise a "${effort}" reasoning effort`);
+			}
+			await setDefaultEffort(provider, model, effort);
+			handles.get(provider)?.replace([provider]);
+		}
 	});
 	if (claudeTokens !== void 0) {
+		const tokens = claudeTokens;
 		const syncTimer = setInterval(() => {
-			claudeTokens?.session().catch(() => {});
+			tokens.list().then((accounts) => {
+				for (const { key, session } of accounts) {
+					if (session.keychainBound !== true) continue;
+					tokens.session(key).catch(() => {});
+				}
+			}, () => void 0);
 		}, 5 * 6e4);
 		ctx.effect(() => () => {
 			clearInterval(syncTimer);
@@ -6398,4 +8466,4 @@ function apply(ctx, config) {
 }
 
 //#endregion
-export { Config, DEFAULT_STREAM_IDLE_TIMEOUT_MS, SubscriptionsAuthController, apply, inject, name };
+export { Config, DEFAULT_STREAM_IDLE_TIMEOUT_MS, POOL_USAGE_TIMEOUT_MS, SubscriptionsAuthController, apply, inject, name, withTimeout };