@cortexkit/anthropic-auth-core 1.19.1 → 1.21.0

package/dist/accounts.js

@@ -2,10 +2,9 @@ import { createHash, randomUUID } from 'node:crypto';
 import { mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
-import { parseRetryAfterHeader, refreshClaudeOAuthToken } from "./auth.js";
-import { CACHE_1H_MODES, CLAUDE_CODE_VERSION, DEFAULT_CACHE_1H_MODE, } from "./constants.js";
-import { log, logger } from "./logger.js";
-import { tokenFingerprint } from "./token-fingerprint.js";
+import { parseRetryAfterHeader, refreshClaudeOAuthToken } from './auth.js';
+import { CACHE_1H_MODES, CLAUDE_CODE_VERSION, DEFAULT_CACHE_1H_MODE, } from './constants.js';
+import { log, logger } from './logger.js';
 const setRefreshLockRenewalTimeout = globalThis.setTimeout.bind(globalThis);
 const clearRefreshLockRenewalTimeout = globalThis.clearTimeout.bind(globalThis);
 export const ACCOUNT_FILE_NAME = 'anthropic-auth.json';
@@ -116,6 +115,9 @@ function normalizeAccount(value) {
     return {
         ...normalizeAccountBase(value),
         type: 'oauth',
+        authLineageId: typeof value.authLineageId === 'string' && value.authLineageId.trim()
+            ? value.authLineageId
+            : undefined,
         access: typeof value.access === 'string' ? value.access : undefined,
         refresh: value.refresh,
         expires: typeof value.expires === 'number' ? value.expires : undefined,
@@ -126,6 +128,7 @@ function normalizeAccount(value) {
         lastQuotaRefreshError: normalizeOperationError(value.lastQuotaRefreshError),
         quota: normalizeQuota(value.quota),
         profile: normalizeOAuthAccountProfile(value.profile),
+        prime: normalizePrimeUsageCounters(value.prime),
     };
 }
 function normalizeOAuthAccountProfile(value) {
@@ -143,6 +146,10 @@ function normalizeOAuthAccountProfile(value) {
         tier: value.tier.trim(),
         orgType: value.orgType.trim(),
         checkedAt: value.checkedAt,
+        ...(typeof value.accountIdentity === 'string' &&
+            value.accountIdentity.trim() && {
+            accountIdentity: value.accountIdentity.trim(),
+        }),
         ...(typeof value.tokenFingerprint === 'string' &&
             value.tokenFingerprint.trim() && {
             tokenFingerprint: value.tokenFingerprint.trim(),
@@ -165,6 +172,9 @@ function normalizeOperationError(value) {
         checkedAt,
         nextRetryAt: Number.isFinite(nextRetryAt) ? nextRetryAt : undefined,
         retryCount: Number.isFinite(retryCount) ? retryCount : undefined,
+        accountIdentity: typeof value.accountIdentity === 'string' && value.accountIdentity.trim()
+            ? value.accountIdentity.trim()
+            : undefined,
         tokenHash: typeof value.tokenHash === 'string' ? value.tokenHash : undefined,
         // Preserve the dead-token discriminators across save/load. Without these,
         // a retry-exhausted transient (permanent=false, 24h backoff) would lose its
@@ -192,6 +202,27 @@ function normalizeQuotaWindow(value) {
         resetsAt: typeof value.resetsAt === 'string' ? value.resetsAt : undefined,
     };
 }
+function normalizePrimeUsageCounters(value) {
+    if (!isRecord(value))
+        return undefined;
+    const count = Number(value.count);
+    const inputTokens = Number(value.inputTokens);
+    const outputTokens = Number(value.outputTokens);
+    const since = Number(value.since);
+    if (![count, inputTokens, outputTokens, since].every(Number.isFinite) ||
+        count < 0 ||
+        inputTokens < 0 ||
+        outputTokens < 0 ||
+        since < 0) {
+        return undefined;
+    }
+    return {
+        count: Math.floor(count),
+        inputTokens: Math.floor(inputTokens),
+        outputTokens: Math.floor(outputTokens),
+        since: Math.floor(since),
+    };
+}
 function normalizeQuota(value) {
     if (!isRecord(value))
         return undefined;
@@ -209,6 +240,10 @@ function normalizeQuota(value) {
     if (typeof value.checkedAt === 'number' && Number.isFinite(value.checkedAt)) {
         quota.checkedAt = value.checkedAt;
     }
+    if (typeof value.accountIdentity === 'string' &&
+        value.accountIdentity.trim()) {
+        quota.accountIdentity = value.accountIdentity.trim();
+    }
     if (Array.isArray(value.scoped)) {
         const scoped = value.scoped
             .map((entry) => {
@@ -307,6 +342,9 @@ function normalizeStorage(value) {
         return null;
     return {
         version: 1,
+        mainAccountId: typeof value.mainAccountId === 'string' && value.mainAccountId.trim()
+            ? value.mainAccountId.trim()
+            : undefined,
         main: {
             type: 'opencode',
             provider: 'anthropic',
@@ -318,6 +356,9 @@ function normalizeStorage(value) {
             : undefined,
         refresh: isRecord(value.refresh) ? value.refresh : undefined,
         quota: isRecord(value.quota) ? value.quota : undefined,
+        quotaHeaderFeed: isRecord(value.quotaHeaderFeed)
+            ? value.quotaHeaderFeed
+            : undefined,
         claudeCache: isRecord(value.claudeCache) ? value.claudeCache : undefined,
         dump: isRecord(value.dump) ? value.dump : undefined,
         claudeFast: isRecord(value.claudeFast) ? value.claudeFast : undefined,
@@ -326,6 +367,35 @@ function normalizeStorage(value) {
         relay: isRecord(value.relay) ? value.relay : undefined,
         logging: isRecord(value.logging) ? value.logging : undefined,
         killswitch: isRecord(value.killswitch) ? value.killswitch : undefined,
+        prime: (() => {
+            if (!isRecord(value.prime))
+                return undefined;
+            const enabled = typeof value.prime.enabled === 'boolean'
+                ? value.prime.enabled
+                : undefined;
+            const main = normalizePrimeUsageCounters(value.prime.main);
+            const mainAuthLineageId = typeof value.prime.mainAuthLineageId === 'string' &&
+                value.prime.mainAuthLineageId.trim()
+                ? value.prime.mainAuthLineageId
+                : undefined;
+            const mainAuthLineageRefreshTokenFingerprint = typeof value.prime.mainAuthLineageRefreshTokenFingerprint ===
+                'string' && value.prime.mainAuthLineageRefreshTokenFingerprint.trim()
+                ? value.prime.mainAuthLineageRefreshTokenFingerprint
+                : undefined;
+            if (enabled === undefined &&
+                !main &&
+                !mainAuthLineageId &&
+                !mainAuthLineageRefreshTokenFingerprint)
+                return undefined;
+            return {
+                ...(enabled !== undefined && { enabled }),
+                ...(main && { main }),
+                ...(mainAuthLineageId && { mainAuthLineageId }),
+                ...(mainAuthLineageRefreshTokenFingerprint && {
+                    mainAuthLineageRefreshTokenFingerprint,
+                }),
+            };
+        })(),
         accounts: value.accounts
             .map(normalizeAccount)
             .filter((account) => account != null),
@@ -349,6 +419,14 @@ function objectWithDefinedEntries(value) {
 function numericField(value) {
     return typeof value === 'number' && Number.isFinite(value) ? value : 0;
 }
+// A clear is a monotonic tombstone; older or absent writes must not reopen backoff.
+export function mergeMainQuotaErrorClearedAt(existing, incoming) {
+    if (incoming === undefined || !Number.isFinite(incoming))
+        return existing;
+    if (existing === undefined || !Number.isFinite(existing))
+        return incoming;
+    return Math.max(existing, incoming);
+}
 function accountCredentialTimestamp(value) {
     return Math.max(numericField(value.lastRefreshedAt), numericField(value.lastUsed), numericField(value.addedAt));
 }
@@ -393,6 +471,19 @@ function mergeConfigAndState(configValue, stateValue) {
     const refreshConfig = isRecord(configValue.refresh) ? configValue.refresh : {};
     const mainQuotaSource = mainState ?? quotaConfig;
     const mainRefreshSource = mainState ?? refreshConfig;
+    const mainQuotaErrorClearedAt = typeof mainState?.quotaErrorClearedAt === 'number' &&
+        Number.isFinite(mainState.quotaErrorClearedAt) &&
+        mainState.quotaErrorClearedAt >= 0
+        ? mainState.quotaErrorClearedAt
+        : undefined;
+    const configQuotaError = quotaConfig.mainLastQuotaApiError;
+    const mainLastQuotaApiError = mainState?.lastQuotaApiError ??
+        (mainQuotaErrorClearedAt !== undefined &&
+            isRecord(configQuotaError) &&
+            typeof configQuotaError.checkedAt === 'number' &&
+            configQuotaError.checkedAt <= mainQuotaErrorClearedAt
+            ? undefined
+            : configQuotaError);
     const accounts = Array.isArray(configValue.accounts)
         ? configValue.accounts.map((account) => {
             if (!isRecord(account))
@@ -422,8 +513,44 @@ function mergeConfigAndState(configValue, stateValue) {
             mainQuota: mainQuotaSource.quota,
             mainQuotaCheckedAt: mainQuotaSource.quotaCheckedAt,
             mainQuotaToken: mainQuotaSource.quotaToken,
-            mainLastQuotaApiError: mainQuotaSource.lastQuotaApiError,
+            mainLastQuotaApiError,
+            mainQuotaErrorGeneration: mainQuotaSource.quotaErrorGeneration,
+            mainQuotaErrorClearedAt: mainQuotaSource.quotaErrorClearedAt,
         }),
+        // Carry the main-side prime counters from the state file back into the
+        // merged storage so a subsequent read sees the cumulative counters. The
+        // `enabled` flag stays sourced from the config side; main-side counters
+        // live exclusively on the state file.
+        prime: (() => {
+            const configPrime = isRecord(configValue.prime)
+                ? configValue.prime
+                : undefined;
+            const mainCounters = normalizePrimeUsageCounters(mainState?.prime);
+            const mainAuthLineageId = typeof mainState?.primeAuthLineageId === 'string' &&
+                mainState.primeAuthLineageId.trim()
+                ? mainState.primeAuthLineageId
+                : undefined;
+            const mainAuthLineageRefreshTokenFingerprint = typeof mainState?.primeAuthLineageRefreshTokenFingerprint ===
+                'string' && mainState.primeAuthLineageRefreshTokenFingerprint.trim()
+                ? mainState.primeAuthLineageRefreshTokenFingerprint
+                : undefined;
+            if (!configPrime &&
+                !mainCounters &&
+                !mainAuthLineageId &&
+                !mainAuthLineageRefreshTokenFingerprint)
+                return undefined;
+            return {
+                ...(configPrime &&
+                    typeof configPrime.enabled === 'boolean' && {
+                    enabled: configPrime.enabled,
+                }),
+                ...(mainCounters && { main: mainCounters }),
+                ...(mainAuthLineageId && { mainAuthLineageId }),
+                ...(mainAuthLineageRefreshTokenFingerprint && {
+                    mainAuthLineageRefreshTokenFingerprint,
+                }),
+            };
+        })(),
         accounts,
     };
 }
@@ -464,6 +591,7 @@ function accountRuntimeState(account) {
         });
     }
     return objectWithDefinedEntries({
+        authLineageId: account.authLineageId,
         access: account.access,
         refresh: account.refresh,
         expires: account.expires,
@@ -473,9 +601,11 @@ function accountRuntimeState(account) {
         lastQuotaRefreshError: account.lastQuotaRefreshError,
         quota: account.quota,
         profile: account.profile,
+        prime: account.prime,
     });
 }
-function quotaSnapshotCheckedAt(quota) {
+/** Returns the latest timestamp carried by any quota snapshot window. */
+export function quotaSnapshotCheckedAt(quota) {
     return Math.max(quota?.five_hour?.checkedAt ?? 0, quota?.seven_day?.checkedAt ?? 0, ...(quota?.scoped?.map((window) => window.checkedAt) ?? []), quota?.checkedAt ?? 0);
 }
 function quotaSourcePrecedence(quota) {
@@ -519,7 +649,7 @@ function mergeHeaderOwnedWindow(existingSnapshot, incomingSnapshot, key) {
         ? existing
         : incoming;
 }
-function mergeHeaderQuotaForPersistence(existing, incoming) {
+export function mergeHeaderQuotaForPersistence(existing, incoming) {
     if (!existing || incoming.source !== 'headers')
         return incoming;
     const preservePollBinding = existing.bindingWindowSource === 'poll';
@@ -639,11 +769,13 @@ function configFromStorage(storage) {
         : undefined;
     return omitUndefinedTopLevel({
         version: 1,
+        mainAccountId: storage.mainAccountId,
         main: { type: 'opencode', provider: 'anthropic' },
         routing: storage.routing,
         fallbackOn: storage.fallbackOn,
         refresh,
         quota,
+        quotaHeaderFeed: storage.quotaHeaderFeed,
         claudeCache: storage.claudeCache,
         dump: storage.dump,
         logging: storage.logging,
@@ -652,6 +784,15 @@ function configFromStorage(storage) {
         cacheKeep: storage.cacheKeep,
         relay: storage.relay,
         killswitch: storage.killswitch,
+        prime: (() => {
+            // Config side carries ONLY the `enabled` flag — runtime counters and
+            // lineage bindings stay on the state file. Write `enabled` whenever it was explicitly set so a
+            // toggle off persists `{ enabled: false }` and is visible to a stale
+            // reader that only inspects the config.
+            if (typeof storage.prime?.enabled !== 'boolean')
+                return undefined;
+            return { enabled: storage.prime.enabled };
+        })(),
         accounts: storage.accounts.map(accountConfig),
     });
 }
@@ -757,6 +898,27 @@ export function saveAccounts(storage, path = getAccountStoragePath(), options =
     const resolvedPath = path;
     return enqueueSave(() => saveAccountsLocked(storage, resolvedPath, options));
 }
+export async function getOrCreateMainAccountId(path = getAccountStoragePath(), createId = randomUUID) {
+    return enqueueSave(async () => {
+        const lock = await acquireAccountConfigWriteLock(path);
+        try {
+            const storage = (await loadAccounts(path)) ?? createEmptyStorage();
+            if (storage.mainAccountId)
+                return storage.mainAccountId;
+            const mainAccountId = createId();
+            const nextStorage = { ...storage, mainAccountId };
+            const existing = await loadExistingTopLevelFields(path);
+            await writeJsonAtomic(path, {
+                ...existing,
+                ...configFromStorage(nextStorage),
+            });
+            return mainAccountId;
+        }
+        finally {
+            await lock.release();
+        }
+    });
+}
 async function saveAccountsLocked(storage, path, options) {
     const lock = await acquireAccountConfigWriteLock(path);
     try {
@@ -792,6 +954,74 @@ function applyMainProfileStatePatch(state, storage) {
 }
 function applyMainQuotaStatePatch(state, storage) {
     state.main = state.main ?? {};
+    const incomingError = storage.quota?.mainLastQuotaApiError;
+    const incomingGeneration = typeof storage.quota?.mainQuotaErrorGeneration === 'number' &&
+        Number.isSafeInteger(storage.quota.mainQuotaErrorGeneration) &&
+        storage.quota.mainQuotaErrorGeneration >= 0
+        ? storage.quota.mainQuotaErrorGeneration
+        : undefined;
+    const incomingClearedAt = typeof storage.quota?.mainQuotaErrorClearedAt === 'number' &&
+        Number.isFinite(storage.quota.mainQuotaErrorClearedAt) &&
+        storage.quota.mainQuotaErrorClearedAt >= 0
+        ? storage.quota.mainQuotaErrorClearedAt
+        : undefined;
+    const existingGeneration = typeof state.main.quotaErrorGeneration === 'number' &&
+        Number.isSafeInteger(state.main.quotaErrorGeneration) &&
+        state.main.quotaErrorGeneration >= 0
+        ? state.main.quotaErrorGeneration
+        : 0;
+    const existingErrorObservedAt = typeof state.main.lastQuotaApiError?.checkedAt === 'number' &&
+        Number.isFinite(state.main.lastQuotaApiError.checkedAt) &&
+        state.main.lastQuotaApiError.checkedAt >= 0
+        ? state.main.lastQuotaApiError.checkedAt
+        : undefined;
+    const existingClearedAt = typeof state.main.quotaErrorClearedAt === 'number' &&
+        Number.isFinite(state.main.quotaErrorClearedAt) &&
+        state.main.quotaErrorClearedAt >= 0
+        ? state.main.quotaErrorClearedAt
+        : undefined;
+    const existingObservedAt = Math.max(existingErrorObservedAt ?? 0, existingClearedAt ?? 0);
+    const incomingErrorObservedAt = typeof incomingError?.checkedAt === 'number' &&
+        Number.isFinite(incomingError.checkedAt) &&
+        incomingError.checkedAt >= 0
+        ? incomingError.checkedAt
+        : undefined;
+    // Error transitions are ordered by observation time, not write order. All
+    // instances share one host clock, so an error observed before a clear cannot
+    // resurrect that clear even when both processes allocated the same generation.
+    if (incomingError === undefined &&
+        incomingClearedAt !== undefined &&
+        incomingClearedAt >= existingObservedAt) {
+        state.main.lastQuotaApiError = undefined;
+        state.main.quotaErrorClearedAt = mergeMainQuotaErrorClearedAt(existingClearedAt, incomingClearedAt);
+        if (incomingGeneration !== undefined &&
+            incomingGeneration >= existingGeneration) {
+            state.main.quotaErrorGeneration = incomingGeneration;
+        }
+    }
+    else if (incomingError) {
+        const acceptsByObservation = incomingErrorObservedAt !== undefined &&
+            incomingErrorObservedAt > existingObservedAt;
+        const acceptsEqualObservation = incomingErrorObservedAt !== undefined &&
+            incomingErrorObservedAt === existingObservedAt &&
+            existingErrorObservedAt !== undefined &&
+            existingClearedAt === undefined &&
+            incomingGeneration !== undefined &&
+            incomingGeneration >= existingGeneration;
+        const acceptsLegacyGeneration = incomingErrorObservedAt === undefined &&
+            incomingClearedAt === undefined &&
+            incomingGeneration !== undefined &&
+            incomingGeneration >= existingGeneration &&
+            existingClearedAt === undefined;
+        if (acceptsByObservation ||
+            acceptsEqualObservation ||
+            acceptsLegacyGeneration) {
+            state.main.lastQuotaApiError = incomingError;
+            if (incomingGeneration !== undefined) {
+                state.main.quotaErrorGeneration = Math.max(existingGeneration, incomingGeneration);
+            }
+        }
+    }
     const incomingQuota = storage.quota?.mainQuota;
     const sameToken = Boolean(state.main.quotaToken &&
         storage.quota?.mainQuotaToken &&
@@ -818,7 +1048,6 @@ function applyMainQuotaStatePatch(state, storage) {
         ? Math.max(existingCheckedAt, incomingCheckedAt)
         : storage.quota?.mainQuotaCheckedAt;
     state.main.quotaToken = storage.quota?.mainQuotaToken;
-    state.main.lastQuotaApiError = storage.quota?.mainLastQuotaApiError;
 }
 function applyMainRefreshStatePatch(state, storage) {
     state.main = state.main ?? {};
@@ -827,6 +1056,29 @@ function applyMainRefreshStatePatch(state, storage) {
     state.main.refreshLeaseUntil = storage.refresh?.mainRefreshLeaseUntil;
     state.main.refreshLeaseTokenHash = storage.refresh?.mainRefreshLeaseTokenHash;
 }
+function applyMainPrimeStatePatch(state, storage) {
+    const incoming = storage.prime?.main;
+    const incomingAuthLineageId = storage.prime?.mainAuthLineageId;
+    const incomingAuthLineageRefreshTokenFingerprint = storage.prime?.mainAuthLineageRefreshTokenFingerprint;
+    if (!incoming &&
+        !incomingAuthLineageId &&
+        !incomingAuthLineageRefreshTokenFingerprint)
+        return;
+    state.main = state.main ?? {};
+    // Last-writer-wins on prime counters — the only writer is the prime manager
+    // itself, monotonically accumulating per success, so there is no race for an
+    // older write to overwrite a newer one within this process. Across processes
+    // the cross-process claim marker (#1247) keeps the fire exclusive.
+    if (incoming)
+        state.main.prime = incoming;
+    if (incomingAuthLineageId) {
+        state.main.primeAuthLineageId = incomingAuthLineageId;
+    }
+    if (incomingAuthLineageRefreshTokenFingerprint) {
+        state.main.primeAuthLineageRefreshTokenFingerprint =
+            incomingAuthLineageRefreshTokenFingerprint;
+    }
+}
 function pruneUndefined(value) {
     if (Array.isArray(value))
         return value.map(pruneUndefined);
@@ -866,38 +1118,41 @@ export function saveOAuthProfileState(input, path = getAccountStoragePath()) {
                 const next = isRecord(existing)
                     ? { ...existing, version: 1 }
                     : { version: 1 };
-                const { accountId, expectedTokenFingerprint, profile } = input;
-                if (profile?.tokenFingerprint &&
-                    profile.tokenFingerprint !== expectedTokenFingerprint) {
-                    return false;
-                }
+                const { accountId, accountIdentity, profile } = input;
                 if (accountId === 'main') {
                     next.main = { ...(next.main ?? {}) };
                     const existingProfile = normalizeOAuthAccountProfile(next.main.profile);
-                    const persistedToken = next.main.profileToken ?? existingProfile?.tokenFingerprint;
-                    if (!profile &&
-                        existingProfile &&
-                        persistedToken === expectedTokenFingerprint) {
-                        return false;
-                    }
-                    if (profile) {
-                        if (persistedToken && persistedToken !== expectedTokenFingerprint) {
-                            return false;
-                        }
+                    if (!profile) {
                         if (existingProfile &&
-                            existingProfile.checkedAt > profile.checkedAt) {
+                            (accountIdentity === undefined ||
+                                existingProfile.accountIdentity === undefined ||
+                                existingProfile.accountIdentity === accountIdentity)) {
                             return false;
                         }
+                        next.main.profile = undefined;
+                        return await writeJsonAtomic(statePath, pruneUndefined(next)).then(() => true);
                     }
-                    next.main.profile = profile;
-                    next.main.profileToken = expectedTokenFingerprint;
+                    if (profile.accountIdentity !== undefined &&
+                        profile.accountIdentity !== accountIdentity) {
+                        return false;
+                    }
+                    const persistedProfile = accountIdentity === undefined ||
+                        profile.accountIdentity === accountIdentity
+                        ? profile
+                        : { ...profile, accountIdentity };
+                    if (existingProfile &&
+                        (accountIdentity === undefined ||
+                            existingProfile.accountIdentity === undefined ||
+                            existingProfile.accountIdentity === accountIdentity) &&
+                        existingProfile.checkedAt > persistedProfile.checkedAt) {
+                        return false;
+                    }
+                    next.main.profile = persistedProfile;
                 }
                 else {
                     const account = current?.accounts.find((candidate) => candidate.id === accountId && isOAuthAccount(candidate));
-                    if (!account?.access ||
-                        tokenFingerprint(account.access) !== expectedTokenFingerprint) {
+                    if (!account)
                         return false;
-                    }
                     next.accounts = {
                         ...(isRecord(next.accounts) ? next.accounts : {}),
                     };
@@ -905,16 +1160,33 @@ export function saveOAuthProfileState(input, path = getAccountStoragePath()) {
                         ? { ...next.accounts[accountId] }
                         : {};
                     const existingProfile = normalizeOAuthAccountProfile(existingEntry.profile);
-                    if (!profile &&
-                        existingProfile?.tokenFingerprint === expectedTokenFingerprint) {
-                        return false;
+                    if (!profile) {
+                        if (existingProfile &&
+                            (accountIdentity === undefined ||
+                                existingProfile.accountIdentity === undefined ||
+                                existingProfile.accountIdentity === accountIdentity)) {
+                            return false;
+                        }
+                        existingEntry.profile = undefined;
                     }
-                    if (profile &&
-                        existingProfile &&
-                        existingProfile.checkedAt > profile.checkedAt) {
-                        return false;
+                    else {
+                        if (profile.accountIdentity !== undefined &&
+                            profile.accountIdentity !== accountIdentity) {
+                            return false;
+                        }
+                        const persistedProfile = accountIdentity === undefined ||
+                            profile.accountIdentity === accountIdentity
+                            ? profile
+                            : { ...profile, accountIdentity };
+                        if (existingProfile &&
+                            (accountIdentity === undefined ||
+                                existingProfile.accountIdentity === undefined ||
+                                existingProfile.accountIdentity === accountIdentity) &&
+                            existingProfile.checkedAt > persistedProfile.checkedAt) {
+                            return false;
+                        }
+                        existingEntry.profile = persistedProfile;
                     }
-                    existingEntry.profile = profile;
                     next.accounts[accountId] = existingEntry;
                 }
                 await writeJsonAtomic(statePath, pruneUndefined(next));
@@ -941,6 +1213,8 @@ async function saveAccountStateUnlocked(storage, path, scope) {
         applyMainQuotaStatePatch(next, storage);
     if (scope.mainRefresh)
         applyMainRefreshStatePatch(next, storage);
+    if (scope.mainPrime)
+        applyMainPrimeStatePatch(next, storage);
     if (scope.accounts) {
         const ids = scope.accounts === true ? null : new Set(scope.accounts);
         next.accounts = { ...(isRecord(next.accounts) ? next.accounts : {}) };
@@ -1284,6 +1558,134 @@ export async function setCacheKeepSubagentsEnabled(enabled, path = getAccountSto
     await saveAccounts(storage, path);
     return storage;
 }
+export function isPrimePersistentlyEnabled(storage) {
+    return storage?.prime?.enabled === true;
+}
+export async function setPrimePersistentEnabled(enabled, path = getAccountStoragePath()) {
+    const storage = (await loadAccounts(path)) ?? createEmptyStorage();
+    storage.prime = {
+        ...(storage.prime ?? {}),
+        enabled,
+    };
+    await saveAccounts(storage, path);
+    return storage;
+}
+/** Return the stable prime marker identity for an OAuth account. */
+export async function getOrCreatePrimeAuthLineageId(accountId, path = getAccountStoragePath()) {
+    return enqueueSave(async () => {
+        const configLock = await acquireAccountConfigWriteLock(path);
+        try {
+            const stateLock = await acquireAccountStateWriteLock(path);
+            try {
+                const storage = (await loadAccounts(path)) ?? createEmptyStorage();
+                if (accountId === 'main') {
+                    const existing = storage.prime?.mainAuthLineageId;
+                    if (existing)
+                        return existing;
+                    const mainAccountId = storage.mainAccountId ?? randomUUID();
+                    if (!storage.mainAccountId) {
+                        const existingConfig = await loadExistingTopLevelFields(path);
+                        await writeJsonAtomic(path, {
+                            ...existingConfig,
+                            ...configFromStorage({ ...storage, mainAccountId }),
+                        });
+                        storage.mainAccountId = mainAccountId;
+                    }
+                    storage.prime = {
+                        ...(storage.prime ?? {}),
+                        mainAuthLineageId: mainAccountId,
+                    };
+                    await saveAccountStateUnlocked(storage, path, { mainPrime: true });
+                    return mainAccountId;
+                }
+                const account = storage.accounts.find((candidate) => candidate.id === accountId && isOAuthAccount(candidate));
+                if (!account) {
+                    throw new Error(`getOrCreatePrimeAuthLineageId: OAuth account "${accountId}" not found`);
+                }
+                if (account.authLineageId)
+                    return account.authLineageId;
+                // Upgrading changes the marker namespace once, so an already-primed
+                // window may fire again; persisting the seed prevents every later token
+                // rotation from repeating that migration cost.
+                const authLineageId = randomUUID();
+                account.authLineageId = authLineageId;
+                await saveAccountStateUnlocked(storage, path, {
+                    accounts: [accountId],
+                });
+                return authLineageId;
+            }
+            finally {
+                await stateLock.release();
+            }
+        }
+        finally {
+            await configLock.release();
+        }
+    });
+}
+/**
+ * Atomically increment an account's cumulative prime counters and persist via
+ * the scoped runtime-state path. The `main` account lives at state.main.prime;
+ * every other account lives at state.accounts[id].prime. Config-side writes
+ * are intentionally NOT triggered so prime counters cannot leak into
+ * `anthropic-auth.json`. Callers should not depend on this function to mutate
+ * the caller's storage object.
+ */
+export async function incrementPrimeUsagePersistent(accountId, usage, path = getAccountStoragePath(), now = Date.now()) {
+    const inputTokens = Number.isFinite(usage?.inputTokens)
+        ? Math.max(0, Math.floor(usage.inputTokens))
+        : 0;
+    const outputTokens = Number.isFinite(usage?.outputTokens)
+        ? Math.max(0, Math.floor(usage.outputTokens))
+        : 0;
+    return enqueueSave(async () => {
+        // The config-write lock is the repository-wide outer lock for config and
+        // runtime-state RMW operations; taking it before the state write preserves
+        // saveAccountsLocked's config → state ordering across processes.
+        const lock = await acquireAccountConfigWriteLock(path);
+        try {
+            const stateLock = await acquireAccountStateWriteLock(path);
+            try {
+                const storage = (await loadAccounts(path)) ?? createEmptyStorage();
+                if (accountId === 'main') {
+                    const existing = storage.prime?.main;
+                    const next = {
+                        count: (existing?.count ?? 0) + 1,
+                        inputTokens: (existing?.inputTokens ?? 0) + inputTokens,
+                        outputTokens: (existing?.outputTokens ?? 0) + outputTokens,
+                        since: existing?.since ?? Math.floor(now),
+                    };
+                    storage.prime = { ...(storage.prime ?? {}), main: next };
+                    await saveAccountStateUnlocked(storage, path, { mainPrime: true });
+                    return next;
+                }
+                const index = storage.accounts.findIndex((account) => account.id === accountId);
+                if (index < 0) {
+                    throw new Error(`incrementPrimeUsagePersistent: account "${accountId}" not found`);
+                }
+                const account = storage.accounts[index];
+                const existing = account.prime;
+                const next = {
+                    count: (existing?.count ?? 0) + 1,
+                    inputTokens: (existing?.inputTokens ?? 0) + inputTokens,
+                    outputTokens: (existing?.outputTokens ?? 0) + outputTokens,
+                    since: existing?.since ?? Math.floor(now),
+                };
+                storage.accounts[index] = { ...account, prime: next };
+                await saveAccountStateUnlocked(storage, path, {
+                    accounts: [accountId],
+                });
+                return next;
+            }
+            finally {
+                await stateLock.release();
+            }
+        }
+        finally {
+            await lock.release();
+        }
+    });
+}
 function getFallbackStatuses(storage) {
     return storage?.fallbackOn?.length ? storage.fallbackOn : DEFAULT_FALLBACK_ON;
 }
@@ -1337,9 +1739,8 @@ function isTransientRefreshError(error) {
                 error.code === 'UND_ERR_CONNECT_TIMEOUT')));
 }
 export function buildRefreshOperationError(input) {
-    const tokenHash = hashRefreshToken(input.refreshToken);
-    const previousRetryCount = input.previous?.tokenHash === tokenHash
-        ? (input.previous.retryCount ?? 0)
+    const previousRetryCount = input.previous?.accountIdentity === input.accountIdentity
+        ? (input.previous?.retryCount ?? 0)
         : 0;
     const retryCount = previousRetryCount + 1;
     const retryAfterFromError = input.error
@@ -1374,7 +1775,7 @@ export function buildRefreshOperationError(input) {
         checkedAt: input.now,
         nextRetryAt: input.now + delay,
         retryCount,
-        tokenHash,
+        accountIdentity: input.accountIdentity,
         status,
         permanent: status === 400 && isInvalidGrant,
     };
@@ -1407,17 +1808,40 @@ export function isPermanentRefreshError(error) {
     }
     return false;
 }
-export function refreshBackoffActive(error, refreshToken, now) {
+export function refreshBackoffActive(error, accountIdentity, now) {
     if (!error?.nextRetryAt || error.nextRetryAt <= now)
         return false;
-    if (!refreshToken)
+    if (!error.accountIdentity)
+        return true;
+    if (!accountIdentity)
         return true;
-    return error.tokenHash === hashRefreshToken(refreshToken);
+    return error.accountIdentity === accountIdentity;
 }
 export function formatRefreshBackoffMessage(error, now) {
     const seconds = Math.max(1, Math.ceil(((error.nextRetryAt ?? now) - now) / 1000));
     return `Claude OAuth refresh is backed off for ${seconds}s after: ${error.message}`;
 }
+function createRefreshBackoffActiveError(error, now) {
+    return Object.assign(new Error(formatRefreshBackoffMessage(error, now)), {
+        refreshBackoffError: error,
+    });
+}
+function existingRefreshBackoffError(error) {
+    if (!error || typeof error !== 'object')
+        return undefined;
+    const existing = error
+        .refreshBackoffError;
+    return existing && typeof existing.message === 'string' ? existing : undefined;
+}
+export function getFallbackReauthLabels(storage) {
+    if (!storage)
+        return [];
+    return storage.accounts
+        .filter((account) => account.enabled !== false &&
+        isOAuthAccount(account) &&
+        isPermanentRefreshError(account.lastRefreshError))
+        .map((account) => account.label?.trim() || account.id);
+}
 export function isQuotaPolicyAuthError(error) {
     const status = error.status;
     if (status === 403)
@@ -1425,7 +1849,9 @@ export function isQuotaPolicyAuthError(error) {
     return /Claude quota check failed: 403\b/.test(formatErrorMessage(error));
 }
 export function buildQuotaOperationError(input) {
-    const previousRetryCount = input.previous?.retryCount ?? 0;
+    const previousRetryCount = input.previous?.accountIdentity === input.accountIdentity
+        ? (input.previous?.retryCount ?? 0)
+        : 0;
     const retryCount = previousRetryCount + 1;
     const delay = isTransientQuotaError(input.error)
         ? Math.min(MAX_QUOTA_RETRY_DELAY_MS, MIN_QUOTA_RETRY_DELAY_MS * 2 ** Math.min(retryCount - 1, 6))
@@ -1435,6 +1861,9 @@ export function buildQuotaOperationError(input) {
         checkedAt: input.now,
         nextRetryAt: input.now + delay,
         retryCount,
+        ...(input.accountIdentity !== undefined && {
+            accountIdentity: input.accountIdentity,
+        }),
     };
 }
 export function quotaBackoffActive(error, now) {
@@ -1454,7 +1883,7 @@ export function getPersistedLogLevel(storage) {
     return storage?.logging?.level;
 }
 export async function setLogLevelPersistent(level, path = getAccountStoragePath()) {
-    const { setLogLevel } = await import("./logger.js");
+    const { setLogLevel } = await import('./logger.js');
     const storage = (await loadAccounts(path)) ?? createEmptyStorage();
     storage.logging = {
         ...(storage.logging ?? {}),
@@ -1470,6 +1899,7 @@ export function getPersistedMainQuota(storage) {
         quota: storage.quota.mainQuota,
         checkedAt: storage.quota.mainQuotaCheckedAt,
         tokenFingerprint: storage.quota.mainQuotaToken,
+        accountIdentity: storage.quota.mainQuota.accountIdentity,
     };
 }
 /**
@@ -1486,15 +1916,18 @@ function failClosedOnUnknownQuota(storage) {
     return (storage?.quota?.failClosedOnUnknownQuota ??
         DEFAULT_FAIL_CLOSED_ON_UNKNOWN_QUOTA);
 }
+function normalizeScopedQuotaModel(value) {
+    return value.toLowerCase().replace(/[^a-z0-9]/g, '');
+}
 function scopedQuotaModelKey(model) {
     if (typeof model !== 'string')
         return null;
-    const normalized = model.toLowerCase();
+    const normalized = normalizeScopedQuotaModel(model);
     if (normalized.includes('fable'))
         return 'fable';
     if (normalized.includes('mythos'))
         return 'mythos';
-    return null;
+    return normalized;
 }
 export function getScopedQuotaWindowForModel(quota, model) {
     const key = scopedQuotaModelKey(model);
@@ -1503,8 +1936,8 @@ export function getScopedQuotaWindowForModel(quota, model) {
     return quota?.scoped?.find((window) => {
         const haystack = [window.modelId, window.modelName, window.title]
             .filter((value) => typeof value === 'string')
-            .join(' ')
-            .toLowerCase();
+            .map(normalizeScopedQuotaModel)
+            .join(' ');
         return haystack.includes(key);
     });
 }
@@ -1533,6 +1966,9 @@ export function quotaSnapshotPassesPolicy(quota, storage) {
     }
     return true;
 }
+export function quotaSnapshotHasStandardWindows(quota) {
+    return Boolean(quota?.five_hour && quota.seven_day);
+}
 // ---------------------------------------------------------------------------
 // Killswitch — hard-block requests when remaining quota drops below per-account
 // thresholds, even if the API would still accept them.
@@ -1997,15 +2433,20 @@ function formatErrorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
 function recordRefreshError(account, error, now) {
+    const existing = existingRefreshBackoffError(error);
+    if (existing) {
+        account.lastRefreshError = existing;
+        return;
+    }
     account.lastRefreshError = buildRefreshOperationError({
         error,
         now,
-        refreshToken: account.refresh,
+        accountIdentity: account.id,
         previous: account.lastRefreshError,
     });
 }
 function recordQuotaRefreshError(account, error, now) {
-    if (isQuotaPolicyAuthError(error))
+    if (isQuotaPolicyAuthError(error) || existingRefreshBackoffError(error))
         return;
     account.lastQuotaRefreshError = buildQuotaOperationError({
         error,
@@ -2052,10 +2493,10 @@ export class FallbackAccountManager {
             return;
         if (!account.quota)
             return;
-        const checkedAt = Math.max(account.quota.five_hour?.checkedAt ?? 0, account.quota.seven_day?.checkedAt ?? 0);
+        const checkedAt = quotaSnapshotCheckedAt(account.quota);
         if (checkedAt <= 0)
             return;
-        const existing = this.quotaManager.getFallback(account.id, account.access);
+        const existing = this.quotaManager.getFallback(account.id, account);
         if (existing && existing.checkedAt >= checkedAt)
             return;
         const checkInterval = getQuotaCheckIntervalMs(storage);
@@ -2063,7 +2504,7 @@ export class FallbackAccountManager {
             quota: account.quota,
             refreshAfter: checkedAt + checkInterval,
             checkedAt,
-        }, account.access);
+        }, account);
     }
     async load() {
         return loadAccounts(this.configPath);
@@ -2104,20 +2545,20 @@ export class FallbackAccountManager {
         for (const account of storage.accounts) {
             if (account.enabled === false || !isOAuthAccount(account))
                 continue;
+            let next = account;
             try {
-                let next = account;
                 if (tokenNeedsRefresh(next, storage, this.now())) {
                     const refreshError = next.lastRefreshError;
                     if (refreshError &&
-                        refreshBackoffActive(refreshError, next.refresh, this.now())) {
-                        throw new Error(formatRefreshBackoffMessage(refreshError, this.now()));
+                        refreshBackoffActive(refreshError, next.id, this.now())) {
+                        throw createRefreshBackoffActiveError(refreshError, this.now());
                     }
                     next = await this.refreshAccount(next, storage);
                     changed = true;
                 }
                 this.seedFallbackQuota(next, storage);
                 const stale = this.quotaManager
-                    ? this.quotaManager.isFallbackStale(next.id, next.access, options.modelId)
+                    ? this.quotaManager.isFallbackStale(next.id, next.access, options.modelId, next)
                     : quotaIsStale(next, storage, this.now(), options.modelId);
                 // Skip the request-time refresh when this account's quota API is
                 // backed off (recent 429/5xx). Hitting it again would extend the
@@ -2125,7 +2566,7 @@ export class FallbackAccountManager {
                 // the background refreshQuotaForDueAccounts() guard.
                 if (stale &&
                     !quotaBackoffActive(next.lastQuotaRefreshError, this.now())) {
-                    next = await this.refreshAccountQuota(next, storage);
+                    next = (await this.refreshAccountQuota(next, storage)).account;
                     changed = true;
                 }
                 // Single source of truth: evaluate quota policy from the unified
@@ -2137,20 +2578,21 @@ export class FallbackAccountManager {
                     usable.push(next);
             }
             catch (error) {
-                if (canUseCachedQuotaAfterRefreshError(account, storage, error, this.now())) {
+                if (canUseCachedQuotaAfterRefreshError(next, storage, error, this.now())) {
                     log('[refresh] fallback quota using cached quota after refresh error', {
-                        accountId: account.id,
+                        accountId: next.id,
                         error: formatErrorMessage(error),
                     });
-                    if (this.accountPassesQuotaPolicy(this.quotaPolicyAccount(account), storage, {
+                    if (this.accountPassesQuotaPolicy(this.quotaPolicyAccount(next), storage, {
                         modelId: options.modelId,
                     })) {
-                        usable.push(account);
+                        usable.push(next);
                     }
                 }
                 else if (!failClosedOnUnknownQuota(storage) &&
-                    quotaSnapshotPassesModelScope(account.quota, options.modelId)) {
-                    usable.push(account);
+                    !refreshBackoffActive(next.lastRefreshError, next.id, this.now()) &&
+                    quotaSnapshotPassesModelScope(next.quota, options.modelId)) {
+                    usable.push(next);
                 }
             }
         }
@@ -2181,7 +2623,7 @@ export class FallbackAccountManager {
     quotaPolicyAccount(account) {
         if (!this.quotaManager)
             return account;
-        const cached = this.quotaManager.getFallback(account.id, account.access)?.quota;
+        const cached = this.quotaManager.getFallback(account.id, account)?.quota;
         return cached ? { ...account, quota: cached } : account;
     }
     async refreshDueAccounts() {
@@ -2194,7 +2636,7 @@ export class FallbackAccountManager {
                 continue;
             if (!tokenNeedsRefresh(account, storage, this.now()))
                 continue;
-            if (refreshBackoffActive(account.lastRefreshError, account.refresh, this.now())) {
+            if (refreshBackoffActive(account.lastRefreshError, account.id, this.now())) {
                 // Backoff skips are steady-state while a fallback account is waiting for
                 // its next retry. Logging every background tick from every OpenCode
                 // process creates noise without adding new diagnostic signal; the
@@ -2237,7 +2679,7 @@ export class FallbackAccountManager {
             let next = account;
             try {
                 if (tokenNeedsRefresh(next, storage, this.now())) {
-                    if (refreshBackoffActive(next.lastRefreshError, next.refresh, this.now())) {
+                    if (refreshBackoffActive(next.lastRefreshError, next.id, this.now())) {
                         continue;
                     }
                     next = await this.refreshAccount(next, storage);
@@ -2284,8 +2726,8 @@ export class FallbackAccountManager {
                 if (tokenNeedsRefresh(next, storage, this.now())) {
                     const refreshError = next.lastRefreshError;
                     if (refreshError &&
-                        refreshBackoffActive(refreshError, next.refresh, this.now())) {
-                        throw new Error(formatRefreshBackoffMessage(refreshError, this.now()));
+                        refreshBackoffActive(refreshError, next.id, this.now())) {
+                        throw createRefreshBackoffActiveError(refreshError, this.now());
                     }
                     next = await this.refreshAccount(next, storage);
                     changed = true;
@@ -2358,9 +2800,9 @@ export class FallbackAccountManager {
             }
             const refreshError = latestAccount.lastRefreshError;
             if (refreshError &&
-                refreshBackoffActive(refreshError, latestAccount.refresh, this.now())) {
+                refreshBackoffActive(refreshError, latestAccount.id, this.now())) {
                 updateStoredAccount(storage, latestAccount);
-                throw new Error(formatRefreshBackoffMessage(refreshError, this.now()));
+                throw createRefreshBackoffActiveError(refreshError, this.now());
             }
         }
         return null;
@@ -2411,11 +2853,14 @@ export class FallbackAccountManager {
             });
             const refreshed = await refreshClaudeOAuthToken({
                 refreshToken,
+                authLineageId: sourceAccount.authLineageId,
                 fetchImpl: this.fetchImpl,
                 now: this.now,
             });
             sourceAccount.access = refreshed.access;
             sourceAccount.refresh = refreshed.refresh;
+            sourceAccount.authLineageId =
+                refreshed.authLineageId ?? sourceAccount.authLineageId;
             sourceAccount.expires = refreshed.expires;
             sourceAccount.lastRefreshedAt =
                 refreshed.expires - refreshed.expiresIn * 1000;
@@ -2443,15 +2888,18 @@ export class FallbackAccountManager {
         // deduplication and 429 backoff gating around the same quota API. Fall back
         // to a direct fetch only when no QuotaManager is wired (e.g. in isolation).
         const fetchSnapshot = (accessToken) => this.quotaManager
-            ? this.quotaManager.refreshFallback(target.id, accessToken)
+            ? this.quotaManager.refreshFallbackWithMetadata(target.id, accessToken, target)
             : fetchOAuthQuotaSnapshot({
                 accessToken,
                 fetchImpl: this.fetchImpl,
                 now: this.now,
-            });
+            }).then((quota) => ({ quota, fetched: true }));
         const fetchStartedAt = this.now();
+        let fetched = false;
         try {
-            target.quota = await fetchSnapshot(target.access);
+            const result = await fetchSnapshot(target.access);
+            target.quota = result.quota;
+            fetched = result.fetched;
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
@@ -2463,7 +2911,9 @@ export class FallbackAccountManager {
             if (!target.access)
                 throw error;
             // 401 does not arm QuotaManager backoff, so this retry proceeds.
-            target.quota = await fetchSnapshot(target.access);
+            const result = await fetchSnapshot(target.access);
+            target.quota = result.quota;
+            fetched = result.fetched;
         }
         const latestStorage = await this.load();
         const latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === target.id && isOAuthAccount(candidate));
@@ -2472,7 +2922,7 @@ export class FallbackAccountManager {
             latestAccount.access !== target.access) {
             this.seedFallbackQuota(latestAccount, latestStorage);
             updateStoredAccount(storage, latestAccount);
-            return latestAccount;
+            return { account: latestAccount, fetched: false };
         }
         if (latestStorage &&
             latestAccount?.access === target.access &&
@@ -2481,7 +2931,7 @@ export class FallbackAccountManager {
             quotaSnapshotIsFresh(latestAccount.quota, latestStorage, this.now())) {
             this.seedFallbackQuota(latestAccount, latestStorage);
             updateStoredAccount(storage, latestAccount);
-            return latestAccount;
+            return { account: latestAccount, fetched };
         }
         target.lastQuotaRefreshError = undefined;
         updateStoredAccount(storage, target);
@@ -2494,8 +2944,8 @@ export class FallbackAccountManager {
                 quota: target.quota,
                 refreshAfter: now + getQuotaCheckIntervalMs(storage),
                 checkedAt: now,
-            }, target.access);
+            }, target);
         }
-        return target;
+        return { account: target, fetched };
     }
 }