@cortexkit/anthropic-auth-core 1.20.0 → 1.21.0

package/dist/accounts.js

@@ -5,7 +5,6 @@ import { dirname, join } from 'node:path';
 import { parseRetryAfterHeader, refreshClaudeOAuthToken } from './auth.js';
 import { CACHE_1H_MODES, CLAUDE_CODE_VERSION, DEFAULT_CACHE_1H_MODE, } from './constants.js';
 import { log, logger } from './logger.js';
-import { tokenFingerprint } from './token-fingerprint.js';
 const setRefreshLockRenewalTimeout = globalThis.setTimeout.bind(globalThis);
 const clearRefreshLockRenewalTimeout = globalThis.clearTimeout.bind(globalThis);
 export const ACCOUNT_FILE_NAME = 'anthropic-auth.json';
@@ -147,6 +146,10 @@ function normalizeOAuthAccountProfile(value) {
         tier: value.tier.trim(),
         orgType: value.orgType.trim(),
         checkedAt: value.checkedAt,
+        ...(typeof value.accountIdentity === 'string' &&
+            value.accountIdentity.trim() && {
+            accountIdentity: value.accountIdentity.trim(),
+        }),
         ...(typeof value.tokenFingerprint === 'string' &&
             value.tokenFingerprint.trim() && {
             tokenFingerprint: value.tokenFingerprint.trim(),
@@ -169,6 +172,9 @@ function normalizeOperationError(value) {
         checkedAt,
         nextRetryAt: Number.isFinite(nextRetryAt) ? nextRetryAt : undefined,
         retryCount: Number.isFinite(retryCount) ? retryCount : undefined,
+        accountIdentity: typeof value.accountIdentity === 'string' && value.accountIdentity.trim()
+            ? value.accountIdentity.trim()
+            : undefined,
         tokenHash: typeof value.tokenHash === 'string' ? value.tokenHash : undefined,
         // Preserve the dead-token discriminators across save/load. Without these,
         // a retry-exhausted transient (permanent=false, 24h backoff) would lose its
@@ -234,6 +240,10 @@ function normalizeQuota(value) {
     if (typeof value.checkedAt === 'number' && Number.isFinite(value.checkedAt)) {
         quota.checkedAt = value.checkedAt;
     }
+    if (typeof value.accountIdentity === 'string' &&
+        value.accountIdentity.trim()) {
+        quota.accountIdentity = value.accountIdentity.trim();
+    }
     if (Array.isArray(value.scoped)) {
         const scoped = value.scoped
             .map((entry) => {
@@ -332,6 +342,9 @@ function normalizeStorage(value) {
         return null;
     return {
         version: 1,
+        mainAccountId: typeof value.mainAccountId === 'string' && value.mainAccountId.trim()
+            ? value.mainAccountId.trim()
+            : undefined,
         main: {
             type: 'opencode',
             provider: 'anthropic',
@@ -343,6 +356,9 @@ function normalizeStorage(value) {
             : undefined,
         refresh: isRecord(value.refresh) ? value.refresh : undefined,
         quota: isRecord(value.quota) ? value.quota : undefined,
+        quotaHeaderFeed: isRecord(value.quotaHeaderFeed)
+            ? value.quotaHeaderFeed
+            : undefined,
         claudeCache: isRecord(value.claudeCache) ? value.claudeCache : undefined,
         dump: isRecord(value.dump) ? value.dump : undefined,
         claudeFast: isRecord(value.claudeFast) ? value.claudeFast : undefined,
@@ -403,6 +419,14 @@ function objectWithDefinedEntries(value) {
 function numericField(value) {
     return typeof value === 'number' && Number.isFinite(value) ? value : 0;
 }
+// A clear is a monotonic tombstone; older or absent writes must not reopen backoff.
+export function mergeMainQuotaErrorClearedAt(existing, incoming) {
+    if (incoming === undefined || !Number.isFinite(incoming))
+        return existing;
+    if (existing === undefined || !Number.isFinite(existing))
+        return incoming;
+    return Math.max(existing, incoming);
+}
 function accountCredentialTimestamp(value) {
     return Math.max(numericField(value.lastRefreshedAt), numericField(value.lastUsed), numericField(value.addedAt));
 }
@@ -447,6 +471,19 @@ function mergeConfigAndState(configValue, stateValue) {
     const refreshConfig = isRecord(configValue.refresh) ? configValue.refresh : {};
     const mainQuotaSource = mainState ?? quotaConfig;
     const mainRefreshSource = mainState ?? refreshConfig;
+    const mainQuotaErrorClearedAt = typeof mainState?.quotaErrorClearedAt === 'number' &&
+        Number.isFinite(mainState.quotaErrorClearedAt) &&
+        mainState.quotaErrorClearedAt >= 0
+        ? mainState.quotaErrorClearedAt
+        : undefined;
+    const configQuotaError = quotaConfig.mainLastQuotaApiError;
+    const mainLastQuotaApiError = mainState?.lastQuotaApiError ??
+        (mainQuotaErrorClearedAt !== undefined &&
+            isRecord(configQuotaError) &&
+            typeof configQuotaError.checkedAt === 'number' &&
+            configQuotaError.checkedAt <= mainQuotaErrorClearedAt
+            ? undefined
+            : configQuotaError);
     const accounts = Array.isArray(configValue.accounts)
         ? configValue.accounts.map((account) => {
             if (!isRecord(account))
@@ -476,7 +513,9 @@ function mergeConfigAndState(configValue, stateValue) {
             mainQuota: mainQuotaSource.quota,
             mainQuotaCheckedAt: mainQuotaSource.quotaCheckedAt,
             mainQuotaToken: mainQuotaSource.quotaToken,
-            mainLastQuotaApiError: mainQuotaSource.lastQuotaApiError,
+            mainLastQuotaApiError,
+            mainQuotaErrorGeneration: mainQuotaSource.quotaErrorGeneration,
+            mainQuotaErrorClearedAt: mainQuotaSource.quotaErrorClearedAt,
         }),
         // Carry the main-side prime counters from the state file back into the
         // merged storage so a subsequent read sees the cumulative counters. The
@@ -610,7 +649,7 @@ function mergeHeaderOwnedWindow(existingSnapshot, incomingSnapshot, key) {
         ? existing
         : incoming;
 }
-function mergeHeaderQuotaForPersistence(existing, incoming) {
+export function mergeHeaderQuotaForPersistence(existing, incoming) {
     if (!existing || incoming.source !== 'headers')
         return incoming;
     const preservePollBinding = existing.bindingWindowSource === 'poll';
@@ -730,11 +769,13 @@ function configFromStorage(storage) {
         : undefined;
     return omitUndefinedTopLevel({
         version: 1,
+        mainAccountId: storage.mainAccountId,
         main: { type: 'opencode', provider: 'anthropic' },
         routing: storage.routing,
         fallbackOn: storage.fallbackOn,
         refresh,
         quota,
+        quotaHeaderFeed: storage.quotaHeaderFeed,
         claudeCache: storage.claudeCache,
         dump: storage.dump,
         logging: storage.logging,
@@ -857,6 +898,27 @@ export function saveAccounts(storage, path = getAccountStoragePath(), options =
     const resolvedPath = path;
     return enqueueSave(() => saveAccountsLocked(storage, resolvedPath, options));
 }
+export async function getOrCreateMainAccountId(path = getAccountStoragePath(), createId = randomUUID) {
+    return enqueueSave(async () => {
+        const lock = await acquireAccountConfigWriteLock(path);
+        try {
+            const storage = (await loadAccounts(path)) ?? createEmptyStorage();
+            if (storage.mainAccountId)
+                return storage.mainAccountId;
+            const mainAccountId = createId();
+            const nextStorage = { ...storage, mainAccountId };
+            const existing = await loadExistingTopLevelFields(path);
+            await writeJsonAtomic(path, {
+                ...existing,
+                ...configFromStorage(nextStorage),
+            });
+            return mainAccountId;
+        }
+        finally {
+            await lock.release();
+        }
+    });
+}
 async function saveAccountsLocked(storage, path, options) {
     const lock = await acquireAccountConfigWriteLock(path);
     try {
@@ -892,6 +954,74 @@ function applyMainProfileStatePatch(state, storage) {
 }
 function applyMainQuotaStatePatch(state, storage) {
     state.main = state.main ?? {};
+    const incomingError = storage.quota?.mainLastQuotaApiError;
+    const incomingGeneration = typeof storage.quota?.mainQuotaErrorGeneration === 'number' &&
+        Number.isSafeInteger(storage.quota.mainQuotaErrorGeneration) &&
+        storage.quota.mainQuotaErrorGeneration >= 0
+        ? storage.quota.mainQuotaErrorGeneration
+        : undefined;
+    const incomingClearedAt = typeof storage.quota?.mainQuotaErrorClearedAt === 'number' &&
+        Number.isFinite(storage.quota.mainQuotaErrorClearedAt) &&
+        storage.quota.mainQuotaErrorClearedAt >= 0
+        ? storage.quota.mainQuotaErrorClearedAt
+        : undefined;
+    const existingGeneration = typeof state.main.quotaErrorGeneration === 'number' &&
+        Number.isSafeInteger(state.main.quotaErrorGeneration) &&
+        state.main.quotaErrorGeneration >= 0
+        ? state.main.quotaErrorGeneration
+        : 0;
+    const existingErrorObservedAt = typeof state.main.lastQuotaApiError?.checkedAt === 'number' &&
+        Number.isFinite(state.main.lastQuotaApiError.checkedAt) &&
+        state.main.lastQuotaApiError.checkedAt >= 0
+        ? state.main.lastQuotaApiError.checkedAt
+        : undefined;
+    const existingClearedAt = typeof state.main.quotaErrorClearedAt === 'number' &&
+        Number.isFinite(state.main.quotaErrorClearedAt) &&
+        state.main.quotaErrorClearedAt >= 0
+        ? state.main.quotaErrorClearedAt
+        : undefined;
+    const existingObservedAt = Math.max(existingErrorObservedAt ?? 0, existingClearedAt ?? 0);
+    const incomingErrorObservedAt = typeof incomingError?.checkedAt === 'number' &&
+        Number.isFinite(incomingError.checkedAt) &&
+        incomingError.checkedAt >= 0
+        ? incomingError.checkedAt
+        : undefined;
+    // Error transitions are ordered by observation time, not write order. All
+    // instances share one host clock, so an error observed before a clear cannot
+    // resurrect that clear even when both processes allocated the same generation.
+    if (incomingError === undefined &&
+        incomingClearedAt !== undefined &&
+        incomingClearedAt >= existingObservedAt) {
+        state.main.lastQuotaApiError = undefined;
+        state.main.quotaErrorClearedAt = mergeMainQuotaErrorClearedAt(existingClearedAt, incomingClearedAt);
+        if (incomingGeneration !== undefined &&
+            incomingGeneration >= existingGeneration) {
+            state.main.quotaErrorGeneration = incomingGeneration;
+        }
+    }
+    else if (incomingError) {
+        const acceptsByObservation = incomingErrorObservedAt !== undefined &&
+            incomingErrorObservedAt > existingObservedAt;
+        const acceptsEqualObservation = incomingErrorObservedAt !== undefined &&
+            incomingErrorObservedAt === existingObservedAt &&
+            existingErrorObservedAt !== undefined &&
+            existingClearedAt === undefined &&
+            incomingGeneration !== undefined &&
+            incomingGeneration >= existingGeneration;
+        const acceptsLegacyGeneration = incomingErrorObservedAt === undefined &&
+            incomingClearedAt === undefined &&
+            incomingGeneration !== undefined &&
+            incomingGeneration >= existingGeneration &&
+            existingClearedAt === undefined;
+        if (acceptsByObservation ||
+            acceptsEqualObservation ||
+            acceptsLegacyGeneration) {
+            state.main.lastQuotaApiError = incomingError;
+            if (incomingGeneration !== undefined) {
+                state.main.quotaErrorGeneration = Math.max(existingGeneration, incomingGeneration);
+            }
+        }
+    }
     const incomingQuota = storage.quota?.mainQuota;
     const sameToken = Boolean(state.main.quotaToken &&
         storage.quota?.mainQuotaToken &&
@@ -918,7 +1048,6 @@ function applyMainQuotaStatePatch(state, storage) {
         ? Math.max(existingCheckedAt, incomingCheckedAt)
         : storage.quota?.mainQuotaCheckedAt;
     state.main.quotaToken = storage.quota?.mainQuotaToken;
-    state.main.lastQuotaApiError = storage.quota?.mainLastQuotaApiError;
 }
 function applyMainRefreshStatePatch(state, storage) {
     state.main = state.main ?? {};
@@ -989,38 +1118,41 @@ export function saveOAuthProfileState(input, path = getAccountStoragePath()) {
                 const next = isRecord(existing)
                     ? { ...existing, version: 1 }
                     : { version: 1 };
-                const { accountId, expectedTokenFingerprint, profile } = input;
-                if (profile?.tokenFingerprint &&
-                    profile.tokenFingerprint !== expectedTokenFingerprint) {
-                    return false;
-                }
+                const { accountId, accountIdentity, profile } = input;
                 if (accountId === 'main') {
                     next.main = { ...(next.main ?? {}) };
                     const existingProfile = normalizeOAuthAccountProfile(next.main.profile);
-                    const persistedToken = next.main.profileToken ?? existingProfile?.tokenFingerprint;
-                    if (!profile &&
-                        existingProfile &&
-                        persistedToken === expectedTokenFingerprint) {
-                        return false;
-                    }
-                    if (profile) {
-                        if (persistedToken && persistedToken !== expectedTokenFingerprint) {
-                            return false;
-                        }
+                    if (!profile) {
                         if (existingProfile &&
-                            existingProfile.checkedAt > profile.checkedAt) {
+                            (accountIdentity === undefined ||
+                                existingProfile.accountIdentity === undefined ||
+                                existingProfile.accountIdentity === accountIdentity)) {
                             return false;
                         }
+                        next.main.profile = undefined;
+                        return await writeJsonAtomic(statePath, pruneUndefined(next)).then(() => true);
                     }
-                    next.main.profile = profile;
-                    next.main.profileToken = expectedTokenFingerprint;
+                    if (profile.accountIdentity !== undefined &&
+                        profile.accountIdentity !== accountIdentity) {
+                        return false;
+                    }
+                    const persistedProfile = accountIdentity === undefined ||
+                        profile.accountIdentity === accountIdentity
+                        ? profile
+                        : { ...profile, accountIdentity };
+                    if (existingProfile &&
+                        (accountIdentity === undefined ||
+                            existingProfile.accountIdentity === undefined ||
+                            existingProfile.accountIdentity === accountIdentity) &&
+                        existingProfile.checkedAt > persistedProfile.checkedAt) {
+                        return false;
+                    }
+                    next.main.profile = persistedProfile;
                 }
                 else {
                     const account = current?.accounts.find((candidate) => candidate.id === accountId && isOAuthAccount(candidate));
-                    if (!account?.access ||
-                        tokenFingerprint(account.access) !== expectedTokenFingerprint) {
+                    if (!account)
                         return false;
-                    }
                     next.accounts = {
                         ...(isRecord(next.accounts) ? next.accounts : {}),
                     };
@@ -1028,16 +1160,33 @@ export function saveOAuthProfileState(input, path = getAccountStoragePath()) {
                         ? { ...next.accounts[accountId] }
                         : {};
                     const existingProfile = normalizeOAuthAccountProfile(existingEntry.profile);
-                    if (!profile &&
-                        existingProfile?.tokenFingerprint === expectedTokenFingerprint) {
-                        return false;
+                    if (!profile) {
+                        if (existingProfile &&
+                            (accountIdentity === undefined ||
+                                existingProfile.accountIdentity === undefined ||
+                                existingProfile.accountIdentity === accountIdentity)) {
+                            return false;
+                        }
+                        existingEntry.profile = undefined;
                     }
-                    if (profile &&
-                        existingProfile &&
-                        existingProfile.checkedAt > profile.checkedAt) {
-                        return false;
+                    else {
+                        if (profile.accountIdentity !== undefined &&
+                            profile.accountIdentity !== accountIdentity) {
+                            return false;
+                        }
+                        const persistedProfile = accountIdentity === undefined ||
+                            profile.accountIdentity === accountIdentity
+                            ? profile
+                            : { ...profile, accountIdentity };
+                        if (existingProfile &&
+                            (accountIdentity === undefined ||
+                                existingProfile.accountIdentity === undefined ||
+                                existingProfile.accountIdentity === accountIdentity) &&
+                            existingProfile.checkedAt > persistedProfile.checkedAt) {
+                            return false;
+                        }
+                        existingEntry.profile = persistedProfile;
                     }
-                    existingEntry.profile = profile;
                     next.accounts[accountId] = existingEntry;
                 }
                 await writeJsonAtomic(statePath, pruneUndefined(next));
@@ -1421,12 +1570,8 @@ export async function setPrimePersistentEnabled(enabled, path = getAccountStorag
     await saveAccounts(storage, path);
     return storage;
 }
-/**
- * Return the stable prime marker identity for an OAuth account, seeding it in
- * runtime state when older storage has no lineage yet. Main lookups return
- * undefined when the live refresh token is unavailable and no lineage exists.
- */
-export async function getOrCreatePrimeAuthLineageId(accountId, path = getAccountStoragePath(), mainRefreshToken) {
+/** Return the stable prime marker identity for an OAuth account. */
+export async function getOrCreatePrimeAuthLineageId(accountId, path = getAccountStoragePath()) {
     return enqueueSave(async () => {
         const configLock = await acquireAccountConfigWriteLock(path);
         try {
@@ -1435,52 +1580,23 @@ export async function getOrCreatePrimeAuthLineageId(accountId, path = getAccount
                 const storage = (await loadAccounts(path)) ?? createEmptyStorage();
                 if (accountId === 'main') {
                     const existing = storage.prime?.mainAuthLineageId;
-                    const observedFingerprint = mainRefreshToken
-                        ? tokenFingerprint(mainRefreshToken)
-                        : undefined;
-                    const boundFingerprint = storage.prime?.mainAuthLineageRefreshTokenFingerprint;
-                    if (existing) {
-                        if (!observedFingerprint ||
-                            boundFingerprint === observedFingerprint)
-                            return existing;
-                        if (boundFingerprint &&
-                            storage.refresh?.mainRefreshLeaseUntil &&
-                            storage.refresh.mainRefreshLeaseUntil > Date.now()) {
-                            // The owner binds before publishing its rotated credential. An
-                            // active lease makes either side of that handoff ambiguous, so
-                            // suppress this tick instead of classifying it as a re-login.
-                            return existing;
-                        }
-                        if (!boundFingerprint) {
-                            // Legacy lineages predate refresh-token binding. The first
-                            // observation attaches the credential without changing markers.
-                            storage.prime = {
-                                ...(storage.prime ?? {}),
-                                mainAuthLineageRefreshTokenFingerprint: observedFingerprint,
-                            };
-                            await saveAccountStateUnlocked(storage, path, {
-                                mainPrime: true,
-                            });
-                            return existing;
-                        }
+                    if (existing)
+                        return existing;
+                    const mainAccountId = storage.mainAccountId ?? randomUUID();
+                    if (!storage.mainAccountId) {
+                        const existingConfig = await loadExistingTopLevelFields(path);
+                        await writeJsonAtomic(path, {
+                            ...existingConfig,
+                            ...configFromStorage({ ...storage, mainAccountId }),
+                        });
+                        storage.mainAccountId = mainAccountId;
                     }
-                    // Without the live host credential there is no safe way to bind a
-                    // new identity. Skip this tick rather than creating an unbound
-                    // namespace that could churn or suppress another account.
-                    if (!observedFingerprint)
-                        return undefined;
-                    // A bound mismatch that did not pass through the owned refresh path
-                    // is a host credential replacement and needs a fresh marker identity.
-                    const authLineageId = randomUUID();
                     storage.prime = {
                         ...(storage.prime ?? {}),
-                        mainAuthLineageId: authLineageId,
-                        ...(observedFingerprint && {
-                            mainAuthLineageRefreshTokenFingerprint: observedFingerprint,
-                        }),
+                        mainAuthLineageId: mainAccountId,
                     };
                     await saveAccountStateUnlocked(storage, path, { mainPrime: true });
-                    return authLineageId;
+                    return mainAccountId;
                 }
                 const account = storage.accounts.find((candidate) => candidate.id === accountId && isOAuthAccount(candidate));
                 if (!account) {
@@ -1507,42 +1623,6 @@ export async function getOrCreatePrimeAuthLineageId(accountId, path = getAccount
         }
     });
 }
-/** Advance a main lineage across a refresh performed by this plugin. */
-export async function continueMainPrimeAuthLineageAfterRefresh(input, path = getAccountStoragePath()) {
-    return enqueueSave(async () => {
-        const configLock = await acquireAccountConfigWriteLock(path);
-        try {
-            const stateLock = await acquireAccountStateWriteLock(path);
-            try {
-                const storage = (await loadAccounts(path)) ?? createEmptyStorage();
-                const authLineageId = storage.prime?.mainAuthLineageId;
-                if (!authLineageId)
-                    return;
-                const previousFingerprint = tokenFingerprint(input.previousRefreshToken);
-                const currentFingerprint = tokenFingerprint(input.currentRefreshToken);
-                const boundFingerprint = storage.prime?.mainAuthLineageRefreshTokenFingerprint;
-                if (boundFingerprint &&
-                    boundFingerprint !== previousFingerprint &&
-                    boundFingerprint !== currentFingerprint) {
-                    // Another process observed a host replacement after this refresh
-                    // started; the stale rotation must not rebind that newer lineage.
-                    return;
-                }
-                storage.prime = {
-                    ...(storage.prime ?? {}),
-                    mainAuthLineageRefreshTokenFingerprint: currentFingerprint,
-                };
-                await saveAccountStateUnlocked(storage, path, { mainPrime: true });
-            }
-            finally {
-                await stateLock.release();
-            }
-        }
-        finally {
-            await configLock.release();
-        }
-    });
-}
 /**
  * Atomically increment an account's cumulative prime counters and persist via
  * the scoped runtime-state path. The `main` account lives at state.main.prime;
@@ -1659,9 +1739,8 @@ function isTransientRefreshError(error) {
                 error.code === 'UND_ERR_CONNECT_TIMEOUT')));
 }
 export function buildRefreshOperationError(input) {
-    const tokenHash = hashRefreshToken(input.refreshToken);
-    const previousRetryCount = input.previous?.tokenHash === tokenHash
-        ? (input.previous.retryCount ?? 0)
+    const previousRetryCount = input.previous?.accountIdentity === input.accountIdentity
+        ? (input.previous?.retryCount ?? 0)
         : 0;
     const retryCount = previousRetryCount + 1;
     const retryAfterFromError = input.error
@@ -1696,7 +1775,7 @@ export function buildRefreshOperationError(input) {
         checkedAt: input.now,
         nextRetryAt: input.now + delay,
         retryCount,
-        tokenHash,
+        accountIdentity: input.accountIdentity,
         status,
         permanent: status === 400 && isInvalidGrant,
     };
@@ -1729,12 +1808,14 @@ export function isPermanentRefreshError(error) {
     }
     return false;
 }
-export function refreshBackoffActive(error, refreshToken, now) {
+export function refreshBackoffActive(error, accountIdentity, now) {
     if (!error?.nextRetryAt || error.nextRetryAt <= now)
         return false;
-    if (!refreshToken)
+    if (!error.accountIdentity)
+        return true;
+    if (!accountIdentity)
         return true;
-    return error.tokenHash === hashRefreshToken(refreshToken);
+    return error.accountIdentity === accountIdentity;
 }
 export function formatRefreshBackoffMessage(error, now) {
     const seconds = Math.max(1, Math.ceil(((error.nextRetryAt ?? now) - now) / 1000));
@@ -1768,7 +1849,9 @@ export function isQuotaPolicyAuthError(error) {
     return /Claude quota check failed: 403\b/.test(formatErrorMessage(error));
 }
 export function buildQuotaOperationError(input) {
-    const previousRetryCount = input.previous?.retryCount ?? 0;
+    const previousRetryCount = input.previous?.accountIdentity === input.accountIdentity
+        ? (input.previous?.retryCount ?? 0)
+        : 0;
     const retryCount = previousRetryCount + 1;
     const delay = isTransientQuotaError(input.error)
         ? Math.min(MAX_QUOTA_RETRY_DELAY_MS, MIN_QUOTA_RETRY_DELAY_MS * 2 ** Math.min(retryCount - 1, 6))
@@ -1778,6 +1861,9 @@ export function buildQuotaOperationError(input) {
         checkedAt: input.now,
         nextRetryAt: input.now + delay,
         retryCount,
+        ...(input.accountIdentity !== undefined && {
+            accountIdentity: input.accountIdentity,
+        }),
     };
 }
 export function quotaBackoffActive(error, now) {
@@ -1813,6 +1899,7 @@ export function getPersistedMainQuota(storage) {
         quota: storage.quota.mainQuota,
         checkedAt: storage.quota.mainQuotaCheckedAt,
         tokenFingerprint: storage.quota.mainQuotaToken,
+        accountIdentity: storage.quota.mainQuota.accountIdentity,
     };
 }
 /**
@@ -1879,6 +1966,9 @@ export function quotaSnapshotPassesPolicy(quota, storage) {
     }
     return true;
 }
+export function quotaSnapshotHasStandardWindows(quota) {
+    return Boolean(quota?.five_hour && quota.seven_day);
+}
 // ---------------------------------------------------------------------------
 // Killswitch — hard-block requests when remaining quota drops below per-account
 // thresholds, even if the API would still accept them.
@@ -2351,7 +2441,7 @@ function recordRefreshError(account, error, now) {
     account.lastRefreshError = buildRefreshOperationError({
         error,
         now,
-        refreshToken: account.refresh,
+        accountIdentity: account.id,
         previous: account.lastRefreshError,
     });
 }
@@ -2406,7 +2496,7 @@ export class FallbackAccountManager {
         const checkedAt = quotaSnapshotCheckedAt(account.quota);
         if (checkedAt <= 0)
             return;
-        const existing = this.quotaManager.getFallback(account.id, account.access);
+        const existing = this.quotaManager.getFallback(account.id, account);
         if (existing && existing.checkedAt >= checkedAt)
             return;
         const checkInterval = getQuotaCheckIntervalMs(storage);
@@ -2414,7 +2504,7 @@ export class FallbackAccountManager {
             quota: account.quota,
             refreshAfter: checkedAt + checkInterval,
             checkedAt,
-        }, account.access);
+        }, account);
     }
     async load() {
         return loadAccounts(this.configPath);
@@ -2455,12 +2545,12 @@ export class FallbackAccountManager {
         for (const account of storage.accounts) {
             if (account.enabled === false || !isOAuthAccount(account))
                 continue;
+            let next = account;
             try {
-                let next = account;
                 if (tokenNeedsRefresh(next, storage, this.now())) {
                     const refreshError = next.lastRefreshError;
                     if (refreshError &&
-                        refreshBackoffActive(refreshError, next.refresh, this.now())) {
+                        refreshBackoffActive(refreshError, next.id, this.now())) {
                         throw createRefreshBackoffActiveError(refreshError, this.now());
                     }
                     next = await this.refreshAccount(next, storage);
@@ -2468,7 +2558,7 @@ export class FallbackAccountManager {
                 }
                 this.seedFallbackQuota(next, storage);
                 const stale = this.quotaManager
-                    ? this.quotaManager.isFallbackStale(next.id, next.access, options.modelId)
+                    ? this.quotaManager.isFallbackStale(next.id, next.access, options.modelId, next)
                     : quotaIsStale(next, storage, this.now(), options.modelId);
                 // Skip the request-time refresh when this account's quota API is
                 // backed off (recent 429/5xx). Hitting it again would extend the
@@ -2488,20 +2578,21 @@ export class FallbackAccountManager {
                     usable.push(next);
             }
             catch (error) {
-                if (canUseCachedQuotaAfterRefreshError(account, storage, error, this.now())) {
+                if (canUseCachedQuotaAfterRefreshError(next, storage, error, this.now())) {
                     log('[refresh] fallback quota using cached quota after refresh error', {
-                        accountId: account.id,
+                        accountId: next.id,
                         error: formatErrorMessage(error),
                     });
-                    if (this.accountPassesQuotaPolicy(this.quotaPolicyAccount(account), storage, {
+                    if (this.accountPassesQuotaPolicy(this.quotaPolicyAccount(next), storage, {
                         modelId: options.modelId,
                     })) {
-                        usable.push(account);
+                        usable.push(next);
                     }
                 }
                 else if (!failClosedOnUnknownQuota(storage) &&
-                    quotaSnapshotPassesModelScope(account.quota, options.modelId)) {
-                    usable.push(account);
+                    !refreshBackoffActive(next.lastRefreshError, next.id, this.now()) &&
+                    quotaSnapshotPassesModelScope(next.quota, options.modelId)) {
+                    usable.push(next);
                 }
             }
         }
@@ -2532,7 +2623,7 @@ export class FallbackAccountManager {
     quotaPolicyAccount(account) {
         if (!this.quotaManager)
             return account;
-        const cached = this.quotaManager.getFallback(account.id, account.access)?.quota;
+        const cached = this.quotaManager.getFallback(account.id, account)?.quota;
         return cached ? { ...account, quota: cached } : account;
     }
     async refreshDueAccounts() {
@@ -2545,7 +2636,7 @@ export class FallbackAccountManager {
                 continue;
             if (!tokenNeedsRefresh(account, storage, this.now()))
                 continue;
-            if (refreshBackoffActive(account.lastRefreshError, account.refresh, this.now())) {
+            if (refreshBackoffActive(account.lastRefreshError, account.id, this.now())) {
                 // Backoff skips are steady-state while a fallback account is waiting for
                 // its next retry. Logging every background tick from every OpenCode
                 // process creates noise without adding new diagnostic signal; the
@@ -2588,7 +2679,7 @@ export class FallbackAccountManager {
             let next = account;
             try {
                 if (tokenNeedsRefresh(next, storage, this.now())) {
-                    if (refreshBackoffActive(next.lastRefreshError, next.refresh, this.now())) {
+                    if (refreshBackoffActive(next.lastRefreshError, next.id, this.now())) {
                         continue;
                     }
                     next = await this.refreshAccount(next, storage);
@@ -2635,7 +2726,7 @@ export class FallbackAccountManager {
                 if (tokenNeedsRefresh(next, storage, this.now())) {
                     const refreshError = next.lastRefreshError;
                     if (refreshError &&
-                        refreshBackoffActive(refreshError, next.refresh, this.now())) {
+                        refreshBackoffActive(refreshError, next.id, this.now())) {
                         throw createRefreshBackoffActiveError(refreshError, this.now());
                     }
                     next = await this.refreshAccount(next, storage);
@@ -2709,7 +2800,7 @@ export class FallbackAccountManager {
             }
             const refreshError = latestAccount.lastRefreshError;
             if (refreshError &&
-                refreshBackoffActive(refreshError, latestAccount.refresh, this.now())) {
+                refreshBackoffActive(refreshError, latestAccount.id, this.now())) {
                 updateStoredAccount(storage, latestAccount);
                 throw createRefreshBackoffActiveError(refreshError, this.now());
             }
@@ -2797,7 +2888,7 @@ export class FallbackAccountManager {
         // deduplication and 429 backoff gating around the same quota API. Fall back
         // to a direct fetch only when no QuotaManager is wired (e.g. in isolation).
         const fetchSnapshot = (accessToken) => this.quotaManager
-            ? this.quotaManager.refreshFallbackWithMetadata(target.id, accessToken)
+            ? this.quotaManager.refreshFallbackWithMetadata(target.id, accessToken, target)
             : fetchOAuthQuotaSnapshot({
                 accessToken,
                 fetchImpl: this.fetchImpl,
@@ -2853,7 +2944,7 @@ export class FallbackAccountManager {
                 quota: target.quota,
                 refreshAfter: now + getQuotaCheckIntervalMs(storage),
                 checkedAt: now,
-            }, target.access);
+            }, target);
         }
         return { account: target, fetched };
     }