omnigateway 0.12.12 → 0.13.0

package/README.md

@@ -251,6 +251,7 @@ Use `--db <path>` to point one command somewhere else.
 | `omni usage` | spend and tokens, by provider, model, key, or day |
 | `omni quota` | provider quota per window: use, burn rate, and when it runs out |
 | `omni quota refresh <id> \| --all` | read provider quota now, without waiting for the next poll |
+| `omni quota resets <id>` / `omni quota reset <id>` | list / spend a banked Codex or Claude quota reset (irreversible) |
 | `omni connect <provider>` | authorize an account from the terminal |
 | `omni credentials …` | list, show, enable, disable, `set`, `rm`, refresh, `add-key`, health |
 | `omni models …` | list, show, put, `rm`, `dry-run`, `catalog` |

package/bin/omni.js

@@ -24739,12 +24739,18 @@ var ANTHROPIC_MODELS = {
 };
 var ONE_M_SUFFIX = "[1m]";
 var DATED_SUFFIX = /-\d{8}$/;
-function anthropicReasoningForm(model) {
+function anthropicChoice(model) {
   let id = model.trim();
   if (id.toLowerCase().endsWith(ONE_M_SUFFIX))
     id = id.slice(0, -ONE_M_SUFFIX.length).trim();
   id = id.replace(DATED_SUFFIX, "");
-  return ANTHROPIC_MODELS.models.find((m) => m.id === id)?.reasoningForm ?? "adaptive";
+  return ANTHROPIC_MODELS.models.find((m) => m.id === id);
+}
+function anthropicReasoningForm(model) {
+  return anthropicChoice(model)?.reasoningForm ?? "adaptive";
+}
+function anthropicMaxOutputTokens(model) {
+  return anthropicChoice(model)?.limits.maxOutputTokens;
 }
 
 // packages/providers/src/anthropic/descriptor.ts
@@ -25635,7 +25641,8 @@ function codecAdapter(id, capabilities2, codec2, origins) {
         credentials: req.credentials,
         fail,
         ...req.requestId === undefined ? {} : { requestId: req.requestId },
-        ...req.autoCache === undefined ? {} : { autoCacheEnabled: req.autoCache }
+        ...req.autoCache === undefined ? {} : { autoCacheEnabled: req.autoCache },
+        ...req.maxOutputTokens === undefined ? {} : { maxOutputTokens: req.maxOutputTokens }
       }));
       const described = built?.request ?? {};
       const request2 = {
@@ -27340,6 +27347,12 @@ function addAutoCacheBreakpoints(body, req, note2) {
   lastHistory.cache_control = { type: "ephemeral" };
   note2("anthropic:history-cache-breakpoint-added");
 }
+function defaultMaxTokens(model, saved) {
+  const ceiling = anthropicMaxOutputTokens(model);
+  if (saved === undefined)
+    return ceiling ?? 4096;
+  return ceiling === undefined ? saved : Math.min(saved, ceiling);
+}
 function toWire(req, model, opts) {
   const cloak = opts.cloak ?? null;
   const degradations = [];
@@ -27386,7 +27399,7 @@ function toWire(req, model, opts) {
       }
       return [{ role: m.role, content: encodeSystemTurn(m.content, cloak) }];
     }),
-    max_tokens: req.maxTokens ?? 4096,
+    max_tokens: req.maxTokens ?? defaultMaxTokens(model, opts.maxOutputTokens),
     stream: req.stream
   };
   if (systemCache.retarget !== undefined) {
@@ -27525,7 +27538,8 @@ var anthropicCodec = {
     const { body, degradations } = toWire(input2.request, input2.model, {
       oauth,
       cloak,
-      autoCache: input2.autoCacheEnabled === true
+      autoCache: input2.autoCacheEnabled === true,
+      ...input2.maxOutputTokens === undefined ? {} : { maxOutputTokens: input2.maxOutputTokens }
     });
     const firstUser = input2.request.messages.find((m) => m.role === "user");
     const firstText = firstUser?.content.find((b) => b.type === "text");
@@ -27858,8 +27872,125 @@ var anthropicOAuthFlow = {
     if (!usageReadable(res.status, "anthropic"))
       return null;
     return parseAnthropicUsage(parsed(res.body), now());
+  },
+  async* resetCredits({ secrets }) {
+    if (secrets.accessToken === null)
+      return null;
+    const res = yield getJsonRequest(RESET_STATUS_URL, anthropicProfile, {
+      accessToken: secrets.accessToken,
+      extraHeaders: SIDE_HEADERS
+    });
+    if (!usageReadable(res.status, "anthropic"))
+      return null;
+    const root = recordOf(parsed(res.body));
+    return root === null ? null : parseResetGrants(root.cedar_ember ?? null);
+  },
+  async* redeemReset({ secrets, creditId, requestId, fail }) {
+    if (secrets.accessToken === null)
+      throw fail("AUTH", "credential holds no access token");
+    const grantId = grantOf(creditId);
+    if (grantId === null)
+      throw fail("CONFLICT", "that reset credit is not available");
+    const profile = yield getJsonRequest(PROFILE_URL, anthropicProfile, {
+      accessToken: secrets.accessToken,
+      extraHeaders: SIDE_HEADERS
+    });
+    if (profile.status < 200 || profile.status >= 300) {
+      throw fail(redeemErrorCode(profile.status), `profile read refused: http_${profile.status}`, {
+        status: profile.status
+      });
+    }
+    const orgId = orgIdOf(parsed(profile.body));
+    if (orgId === null)
+      throw fail("UPSTREAM", "profile names no organization");
+    const res = yield postJsonRequest(`https://api.anthropic.com/api/organizations/${orgId}/reset_rate_limits`, anthropicProfile, {
+      contentType: "application/json",
+      body: JSON.stringify({ program: RESET_PROGRAM, grant_id: grantId, request_id: requestId }),
+      extraHeaders: [["Authorization", `Bearer ${secrets.accessToken}`], ...SIDE_HEADERS]
+    });
+    if (res.status < 200 || res.status >= 300) {
+      throw fail(redeemErrorCode(res.status), `reset claim refused: http_${res.status}`, {
+        status: res.status
+      });
+    }
+    return claimOutcome(parsed(res.body), fail);
   }
 };
+var RESET_PROGRAM = "cedar_ember";
+var RESET_STATUS_URL = `${USAGE_URL}?cedar_ember=1&skip_spend=1`;
+var PROFILE_URL = "https://api.anthropic.com/api/oauth/profile";
+var ORG_ID = /^[A-Za-z0-9-]{1,64}$/;
+var SIDE_HEADERS = [["anthropic-beta", "oauth-2025-04-20"]];
+var USE_SUFFIX = /-u(\d+)$/;
+function creditIdOf(grantId, left) {
+  return `${grantId}-u${left}`;
+}
+function grantOf(creditId) {
+  const grant = creditId.replace(USE_SUFFIX, "");
+  return grant === creditId || grant === "" ? null : grant;
+}
+function orgIdOf(value) {
+  const org = recordOf(recordOf(value)?.organization);
+  const uuid3 = org?.uuid;
+  return typeof uuid3 === "string" && ORG_ID.test(uuid3) ? uuid3 : null;
+}
+function parseResetGrants(value) {
+  if (value === null)
+    return { available: 0, credits: [] };
+  const block = recordOf(value);
+  if (block === null || !Array.isArray(block.grants))
+    return null;
+  const next = typeof block.next_grant_id === "string" ? block.next_grant_id : null;
+  const atLimit = block.at_limit === true;
+  let available = 0;
+  const credits = block.grants.flatMap((raw) => {
+    const g = recordOf(raw);
+    if (g === null || typeof g.id !== "string")
+      return [];
+    const left = typeof g.resets_left === "number" ? g.resets_left : 0;
+    const claimable = left > 0 && g.usable_now === true && g.paused !== true && (g.use_requires_limit !== true || atLimit) && (next === null || next === g.id);
+    if (claimable)
+      available += left;
+    return [
+      {
+        id: creditIdOf(g.id, left),
+        status: claimable ? "available" : left > 0 ? "unavailable" : "used",
+        title: typeof g.label === "string" && g.label !== "" ? g.label : null,
+        grantedAt: isoOrNull(g.starts_at),
+        expiresAt: isoOrNull(g.ends_at)
+      }
+    ];
+  });
+  return { available, credits };
+}
+function claimOutcome(value, fail) {
+  const body = recordOf(value);
+  const result = typeof body?.result === "string" ? body.result : null;
+  if (result === "reset") {
+    return { windowsReset: Array.isArray(body?.cleared) ? body.cleared.length : null };
+  }
+  if (result === "cooldown")
+    throw fail("RATE_LIMIT", "reset claim refused: cooldown");
+  if (result === "already_used" || result === "not_limited" || result === "ineligible") {
+    throw fail("CONFLICT", `reset claim refused: ${result}`);
+  }
+  throw fail("UPSTREAM", "reset claim answered without a reset");
+}
+function redeemErrorCode(status) {
+  if (status === 429)
+    return "RATE_LIMIT";
+  if (status === 401 || status === 403)
+    return "AUTH";
+  if (status >= 400 && status < 500)
+    return "CONFLICT";
+  return "UPSTREAM";
+}
+function isoOrNull(value) {
+  if (typeof value !== "string")
+    return null;
+  const at = Date.parse(value);
+  return Number.isNaN(at) ? null : at;
+}
 // packages/providers/src/antigravity/codec.ts
 import { createHash as createHash2 } from "crypto";
 
@@ -29181,7 +29312,7 @@ var grokOAuthFlow = {
 
 // packages/providers/src/kilo/oauth.ts
 var CODES_URL = "https://api.kilo.ai/api/device-auth/codes";
-var PROFILE_URL = "https://api.kilo.ai/api/profile";
+var PROFILE_URL2 = "https://api.kilo.ai/api/profile";
 var FALLBACK_VERIFICATION_URL = "https://kilo.ai";
 var DEFAULT_EXPIRES_SECONDS = 300;
 var POLL_INTERVAL_SECONDS = 3;
@@ -29213,7 +29344,7 @@ function deviceCodeFrom(value, fail) {
 }
 async function* orgIdFor(accessToken) {
   try {
-    const res = yield getJsonRequest(PROFILE_URL, kiloProfile, { accessToken });
+    const res = yield getJsonRequest(PROFILE_URL2, kiloProfile, { accessToken });
     if (res.status < 200 || res.status >= 300)
       return null;
     const record2 = recordFrom(parsed(res.body));
@@ -29721,6 +29852,7 @@ var AUTHORIZE_URL3 = "https://auth.openai.com/oauth/authorize";
 var TOKEN_URL5 = "https://auth.openai.com/oauth/token";
 var SCOPES4 = "openid profile email offline_access";
 var USAGE_URL3 = "https://chatgpt.com/backend-api/wham/usage";
+var RESET_CREDITS_URL = "https://chatgpt.com/backend-api/wham/rate-limit-reset-credits";
 function isRecord7(value) {
   return typeof value === "object" && value !== null;
 }
@@ -29874,8 +30006,78 @@ var openaiOAuthFlow = {
     if (!usageReadable(res.status, "openai"))
       return null;
     return parseOpenAIUsage(parsed(res.body), now());
+  },
+  async* resetCredits({ secrets, providerData }) {
+    if (secrets.accessToken === null)
+      return null;
+    const res = yield getJsonRequest(RESET_CREDITS_URL, openaiProfile, {
+      accessToken: secrets.accessToken,
+      extraHeaders: accountHeader(providerData)
+    });
+    if (!usageReadable(res.status, "openai"))
+      return null;
+    return parseResetCredits(parsed(res.body));
+  },
+  async* redeemReset({ secrets, providerData, creditId, requestId, fail }) {
+    if (secrets.accessToken === null)
+      throw fail("AUTH", "credential holds no access token");
+    const res = yield postJsonRequest(`${RESET_CREDITS_URL}/consume`, openaiProfile, {
+      contentType: "application/json",
+      body: JSON.stringify({ credit_id: creditId, redeem_request_id: requestId }),
+      extraHeaders: [
+        ["Authorization", `Bearer ${secrets.accessToken}`],
+        ...accountHeader(providerData)
+      ]
+    });
+    if (res.status < 200 || res.status >= 300) {
+      throw fail(redeemErrorCode2(res.status), `reset credit redeem refused: http_${res.status}`, {
+        status: res.status
+      });
+    }
+    const body = recordOf(parsed(res.body));
+    const windowsReset = body === null ? null : numberOf(body, ["windows_reset"]);
+    return { windowsReset };
   }
 };
+function accountHeader(providerData) {
+  const accountId = accountIdFromProviderData(providerData);
+  return accountId === null ? [] : [["chatgpt-account-id", accountId]];
+}
+function redeemErrorCode2(status) {
+  if (status === 429)
+    return "RATE_LIMIT";
+  if (status === 401 || status === 403)
+    return "AUTH";
+  if (status >= 400 && status < 500)
+    return "CONFLICT";
+  return "UPSTREAM";
+}
+function isoOrNull2(value) {
+  if (typeof value !== "string")
+    return null;
+  const at = Date.parse(value);
+  return Number.isFinite(at) ? at : null;
+}
+function parseResetCredits(value) {
+  const root = recordOf(value);
+  if (root === null || !Array.isArray(root.credits))
+    return null;
+  const credits = root.credits.flatMap((raw) => {
+    const c = recordOf(raw);
+    if (c === null || typeof c.id !== "string" || typeof c.status !== "string")
+      return [];
+    return [
+      {
+        id: c.id,
+        status: c.status,
+        title: typeof c.title === "string" ? c.title : null,
+        grantedAt: isoOrNull2(c.granted_at),
+        expiresAt: isoOrNull2(c.expires_at)
+      }
+    ];
+  });
+  return { available: credits.filter((c) => c.status === "available").length, credits };
+}
 
 // packages/providers/src/builtinOAuth.ts
 function builtinOAuthFlows() {
@@ -32601,6 +32803,24 @@ function createConnectFlows(deps) {
     if (provider === undefined)
       throw new GatewayError("BAD_REQUEST", "provider does not support OAuth");
     const result = await provider.exchange({ code, pending: flow.pending }, { http: deps.http, now: deps.now });
+    if (flow.credentialId !== undefined) {
+      const existing = await deps.store.credentials.get(flow.credentialId);
+      if (existing === null)
+        throw new GatewayError("BAD_REQUEST", "credential not found");
+      await deps.store.credentials.updateSecrets(flow.credentialId, result.secrets, result.expiresAt);
+      await deps.store.credentials.update(flow.credentialId, {
+        enabled: true,
+        disabledReason: null,
+        disabledAt: null,
+        accountEmail: result.accountEmail,
+        providerData: result.providerData
+      });
+      logger2.info("oauth reconnect completed", {
+        provider: flow.provider,
+        credentialId: flow.credentialId
+      });
+      return { id: flow.credentialId };
+    }
     const id = crypto.randomUUID();
     await deps.store.credentials.create({
       id,
@@ -32637,13 +32857,25 @@ function createConnectFlows(deps) {
   }
   return {
     connectableIds,
-    async start(providerInput, labelInput) {
+    async start(providerInput, labelInput, credentialIdInput) {
       const unconnectable = () => new GatewayError("BAD_REQUEST", `provider must be one of ${connectableIds().join(", ")}`);
       if (!exists(providerInput))
         throw unconnectable();
       const provider = deps.providers[providerInput];
       if (provider === undefined)
         throw unconnectable();
+      let credentialId;
+      if (credentialIdInput !== undefined) {
+        if (typeof credentialIdInput !== "string" || credentialIdInput.trim().length === 0) {
+          throw new GatewayError("BAD_REQUEST", "invalid credential for reconnect");
+        }
+        const id = credentialIdInput.trim();
+        const existing = await deps.store.credentials.get(id);
+        if (existing === null || existing.provider !== providerInput || existing.authType !== "oauth") {
+          throw new GatewayError("BAD_REQUEST", "invalid credential for reconnect");
+        }
+        credentialId = id;
+      }
       const label3 = typeof labelInput === "string" && labelInput.trim().length > 0 ? labelInput.trim() : providerInput;
       const redirectUri = callbackUri(providerInput);
       const oauthDeps = { http: deps.http, now: deps.now };
@@ -32653,6 +32885,7 @@ function createConnectFlows(deps) {
         provider: providerInput,
         label: label3,
         pending: start.pending,
+        ...credentialId === undefined ? {} : { credentialId },
         ...start.userCode === undefined ? {} : { userCode: start.userCode }
       });
       return {
@@ -32806,6 +33039,11 @@ var quotaRefreshSchema = exports_external.discriminatedUnion("kind", [
   }).strict(),
   exports_external.object({ kind: exports_external.literal("all") }).strict()
 ]);
+var accountIdSchema = exports_external.string().trim().min(1).max(64).regex(/^[A-Za-z0-9_-]+$/, "credentialId must be an account id");
+var redeemResetSchema = exports_external.object({
+  credentialId: accountIdSchema,
+  creditId: exports_external.string().min(1).max(128).regex(/^[A-Za-z0-9_-]+$/).optional()
+}).strict();
 var dimensionSchema = exports_external.enum([
   "credential",
   "model",
@@ -35215,6 +35453,29 @@ function oauthAdapter(id, flow, opts = {}) {
           return Promise.resolve(null);
         return runStep(id, "usage", step, deps, origins);
       }
+    },
+    ...flow.resetCredits === undefined ? {} : {
+      resetCredits: (secrets, deps, providerData) => {
+        const step = flow.resetCredits?.({ secrets, providerData, ...helpers(deps) });
+        if (step === undefined)
+          return Promise.resolve(null);
+        return runStep(id, "resetCredits", step, deps, origins);
+      }
+    },
+    ...flow.redeemReset === undefined ? {} : {
+      redeemReset: (secrets, deps, providerData, creditId, requestId) => {
+        const step = flow.redeemReset?.({
+          secrets,
+          providerData,
+          creditId,
+          requestId,
+          ...helpers(deps)
+        });
+        if (step === undefined) {
+          return Promise.reject(flowFailure(id, "redeemReset", "has no redeem step"));
+        }
+        return runStep(id, "redeemReset", step, deps, origins);
+      }
     }
   };
   if (flow.kind === "pkce")
@@ -35250,11 +35511,32 @@ function isAuthorizeStart(value) {
   const candidate = value;
   return typeof candidate.authorizeUrl === "string" && typeof candidate.pending === "object" && candidate.pending !== null;
 }
+function isResetCreditsOrNull(value) {
+  if (value === null)
+    return true;
+  if (typeof value !== "object")
+    return false;
+  const candidate = value;
+  return typeof candidate.available === "number" && Array.isArray(candidate.credits) && candidate.credits.every((c) => {
+    if (typeof c !== "object" || c === null)
+      return false;
+    const row = c;
+    return typeof row.id === "string" && typeof row.status === "string" && (row.title === null || typeof row.title === "string") && (row.grantedAt === null || typeof row.grantedAt === "number") && (row.expiresAt === null || typeof row.expiresAt === "number");
+  });
+}
+function isResetRedeemed(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const held = value.windowsReset;
+  return held === null || typeof held === "number";
+}
 var RETURN_SHAPE = {
   start: isAuthorizeStart,
   begin: isAuthorizeStart,
   exchange: isFlowResult,
-  refresh: isFlowResult
+  refresh: isFlowResult,
+  resetCredits: isResetCreditsOrNull,
+  redeemReset: isResetRedeemed
 };
 
 // packages/control/src/oauth/index.ts
@@ -35474,6 +35756,11 @@ function validateOAuthFlow(id, value) {
   if (value.usage !== undefined) {
     checkAt(typeof value.usage === "function", id, "oauth.usage", "a function");
   }
+  for (const fn of ["resetCredits", "redeemReset"]) {
+    if (value[fn] !== undefined) {
+      checkAt(typeof value[fn] === "function", id, `oauth.${fn}`, "a function");
+    }
+  }
   if (kind === "device") {
     checkAt(typeof value.begin === "function", id, "oauth.begin", "a function");
     checkAt(typeof value.needsDeviceId === "boolean", id, "oauth.needsDeviceId", "a boolean");
@@ -35669,6 +35956,52 @@ async function quotaHistory(deps, input2) {
 
 // packages/control/src/quota/clientHistory.ts
 var MAX_SPAN_MS = 16 * 24 * 60 * 60 * 1000;
+// packages/control/src/quota/resets.ts
+async function resettable(deps, credentialId) {
+  const credential = await deps.store.credentials.get(credentialId.trim());
+  if (credential === null)
+    throw new GatewayError("BAD_REQUEST", "no such credential");
+  const provider = deps.providers[credential.provider];
+  const list = provider?.resetCredits;
+  const redeem = provider?.redeemReset;
+  if (credential.authType !== "oauth" || list === undefined || redeem === undefined) {
+    throw new GatewayError("BAD_REQUEST", "this account's provider has no quota resets");
+  }
+  return { credential, list, redeem };
+}
+async function listFor(deps, r) {
+  const secrets = await usageSecretsFor(deps, r.credential);
+  const read = await r.list(secrets, { http: deps.http, now: deps.now }, r.credential.providerData);
+  if (read === null) {
+    throw new GatewayError("UPSTREAM", "provider answered the reset list with nothing usable", {
+      gatewayAuthored: true
+    });
+  }
+  return read;
+}
+async function listResetCredits(deps, credentialId) {
+  const r = await resettable(deps, credentialId);
+  return { credentialId: r.credential.id, ...await listFor(deps, r) };
+}
+async function redeemResetCredit(deps, request2) {
+  const r = await resettable(deps, request2.credentialId);
+  return deps.coord.mutex.withLock(PROBE_LOCK_PREFIX + r.credential.id, PROBE_LOCK_TTL_MS, PROBE_LOCK_WAIT_MS, () => redeemLocked(deps, r, request2));
+}
+async function redeemLocked(deps, r, request2) {
+  const available = (await listFor(deps, r)).credits.filter((c) => c.status === "available").sort((a, b) => (a.expiresAt ?? Number.POSITIVE_INFINITY) - (b.expiresAt ?? Number.POSITIVE_INFINITY));
+  const credit = request2.creditId === undefined ? available[0] : available.find((c) => c.id === request2.creditId);
+  if (credit === undefined) {
+    throw new GatewayError("CONFLICT", request2.creditId === undefined ? "no reset credit is available for this account" : "that reset credit is not available");
+  }
+  const secrets = await usageSecretsFor(deps, r.credential);
+  const { windowsReset } = await r.redeem(secrets, { http: deps.http, now: deps.now }, r.credential.providerData, credit.id, crypto.randomUUID());
+  let quotaRefreshed = false;
+  try {
+    quotaRefreshed = await probe(deps, r.credential) !== null;
+  } catch {}
+  return { credentialId: r.credential.id, creditId: credit.id, windowsReset, quotaRefreshed };
+}
+
 // packages/control/src/quota/poll.ts
 var CONCURRENCY = 4;
 var RATE_LIMIT_COOLDOWN_MS = 180000;
@@ -35676,14 +36009,17 @@ var COOLDOWN_PREFIX = "quota:cooldown:";
 var PROBE_LOCK_PREFIX = "quota:probe:";
 var PROBE_LOCK_TTL_MS = 60000;
 var PROBE_LOCK_WAIT_MS = 30000;
+async function usageSecretsFor(deps, credential) {
+  const refreshed = credential.hasRefreshToken && credential.expiresAt !== null && credential.expiresAt - SCHEDULER_REFRESH_LEAD_MS <= deps.now() ? await deps.refresh(credential) : null;
+  return refreshed === null ? await credential.openForUsage() : { accessToken: refreshed.accessToken };
+}
 async function probe(deps, credential) {
   if (credential.authType !== "oauth")
     return null;
   const provider = deps.providers[credential.provider];
   if (provider?.usage === undefined)
     return null;
-  const refreshed = credential.hasRefreshToken && credential.expiresAt !== null && credential.expiresAt - SCHEDULER_REFRESH_LEAD_MS <= deps.now() ? await deps.refresh(credential) : null;
-  const secrets = refreshed === null ? await credential.openForUsage() : { accessToken: refreshed.accessToken };
+  const secrets = await usageSecretsFor(deps, credential);
   const report = await provider.usage(secrets, { http: deps.http, now: deps.now }, credential.providerData);
   if (report === null || report.windows.length === 0)
     return null;
@@ -35846,6 +36182,12 @@ function quotaOps(deps) {
         outcomes.push(result?.outcome ?? { kind: "failed", credentialId: credential.id, code: "INTERNAL" });
       }
       return { outcomes };
+    },
+    resetCredits: (credentialId) => listResetCredits(deps, credentialId),
+    redeemReset: (request2) => redeemResetCredit(deps, request2),
+    hasResets: (provider) => {
+      const flow = deps.providers[provider];
+      return flow?.resetCredits !== undefined && flow.redeemReset !== undefined;
     }
   };
 }
@@ -36541,9 +36883,9 @@ var bodies = {
 // apps/cli/src/commands/connect.ts
 var DEVICE_TIMEOUT_MS = 600000;
 var connect = {
-  usage: "connect <provider> [--label L]",
+  usage: "connect <provider> [--label L] [--credential ID]",
   summary: "Authorize a provider account from the terminal",
-  options: { label: { type: "string" } },
+  options: { label: { type: "string" }, credential: { type: "string" } },
   async run(args, { ctx, writer, prompt, connect: connectFlows, connectable }) {
     const providerId = requirePositional(args, 0, "provider");
     const { ids, failures } = await connectable();
@@ -36552,7 +36894,8 @@ var connect = {
       throw new UsageError(broken === undefined ? `provider must be one of ${ids.join(", ")}` : `provider ${providerId} comes from a plugin that failed to load: ${broken.reason}`);
     }
     const flows = await connectFlows(await ctx.store());
-    const start = await flows.start(providerId, stringFlag(args.values, "label"));
+    const credentialId = stringFlag(args.values, "credential");
+    const start = await flows.start(providerId, stringFlag(args.values, "label"), credentialId);
     writer.err("");
     writer.err(`Open this URL to authorize ${providerId}:`);
     writer.err(`  ${start.authorizeUrl}`);
@@ -38030,16 +38373,7 @@ var quotaRefresh = {
     const store = await ctx.store();
     const credentials = await listCredentials(store);
     const wanted = id === undefined ? credentials : credentials.filter((c) => c.id === id);
-    const providers = wanted.every((c) => Object.hasOwn(PROVIDER_DESCRIPTORS, c.provider)) ? OAUTH_PROVIDERS : (await connectRegistryFor(ctx.root.root)).providers;
-    const http = nodeHttpClient();
-    const ops = quotaOps({
-      store,
-      coord: memoryCoord({ now: ctx.now }),
-      providers,
-      http,
-      refresh: createRefresher({ store, providers, http, now: ctx.now }),
-      now: ctx.now
-    });
+    const ops = await opsFor(ctx, wanted);
     note(ctx, writer, id === undefined ? "refreshing every account\u2026" : `refreshing ${id}\u2026`);
     const result = await ops.refresh(id === undefined ? { kind: "all" } : { kind: "one", credentialId: id });
     const labels = new Map(credentials.map((c) => [c.id, c.label]));
@@ -38065,6 +38399,59 @@ var quotaRefresh = {
     }
   }
 };
+async function opsFor(ctx, wanted) {
+  const store = await ctx.store();
+  const providers = wanted.every((c) => Object.hasOwn(PROVIDER_DESCRIPTORS, c.provider)) ? OAUTH_PROVIDERS : (await connectRegistryFor(ctx.root.root)).providers;
+  const http = nodeHttpClient();
+  return quotaOps({
+    store,
+    coord: memoryCoord({ now: ctx.now }),
+    providers,
+    http,
+    refresh: createRefresher({ store, providers, http, now: ctx.now }),
+    now: ctx.now
+  });
+}
+var quotaResets = {
+  usage: "quota resets <id>",
+  summary: "List an account's banked quota resets (Codex, Claude)",
+  async run(args, { ctx, writer }) {
+    const id = requirePositional(args, 0, "credential id");
+    const credentials = (await listCredentials(await ctx.store())).filter((c) => c.id === id);
+    const listed = await (await opsFor(ctx, credentials)).resetCredits(id);
+    emit(ctx, writer, listed, () => [
+      table([{ header: "CREDIT" }, { header: "STATUS" }, { header: "TITLE" }, { header: "EXPIRES" }], listed.credits.map((c) => [c.id, c.status, c.title ?? dash, formatTime(c.expiresAt)])),
+      "",
+      `${listed.available} available`
+    ].join(`
+`));
+  }
+};
+var quotaReset = {
+  usage: "quota reset <id> [--credit CREDIT_ID]",
+  summary: "Spend one banked quota reset on an account (irreversible)",
+  options: { credit: { type: "string" } },
+  async run(args, { ctx, writer, prompt }) {
+    const id = requirePositional(args, 0, "credential id");
+    const creditId = stringFlag(args.values, "credit");
+    const credentials = (await listCredentials(await ctx.store())).filter((c) => c.id === id);
+    const label3 = credentials[0]?.label ?? id;
+    const ops = await opsFor(ctx, credentials);
+    const provider2 = credentials[0]?.provider;
+    if (provider2 === undefined)
+      throw new CliError("no such credential");
+    if (!ops.hasResets(provider2))
+      throw new CliError("this account's provider has no quota resets");
+    if (!await prompt.confirm(`spend one banked quota reset on "${label3}" (${id})?`)) {
+      throw new CliError("cancelled");
+    }
+    const result = await ops.redeemReset({
+      credentialId: id,
+      ...creditId === undefined ? {} : { creditId }
+    });
+    emit(ctx, writer, result, () => `${label3}: reset ${result.creditId} redeemed` + (result.windowsReset === null ? "" : `, ${result.windowsReset} window(s) reset`) + (result.quotaRefreshed ? "; quota re-read" : "; quota re-read failed, next poll will update it"));
+  }
+};
 
 // apps/cli/src/commands/service.ts
 import { existsSync as existsSync5 } from "fs";
@@ -38155,7 +38542,7 @@ function createServiceDeps(input2) {
 }
 
 // apps/cli/src/version.ts
-var VERSION = "0.12.12";
+var VERSION = "0.13.0";
 
 // apps/cli/src/commands/service.ts
 function gatewayArgv(root) {
@@ -38872,6 +39259,8 @@ var COMMANDS = {
   "credentials add-key": credentialsAddKey,
   "credentials health": credentialsHealth,
   "quota refresh": quotaRefresh,
+  "quota resets": quotaResets,
+  "quota reset": quotaReset,
   "models list": modelsList,
   "models show": modelsShow,
   "models put": modelsPut,