@cortexkit/anthropic-auth-core 1.23.0 → 2.0.0

package/dist/accounts.js

@@ -1,3881 +0,0 @@
-import { createHash, randomUUID } from 'node:crypto';
-import { mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
-import { homedir } from 'node:os';
-import { dirname, join, resolve } from 'node:path';
-import { parseRetryAfterHeader, refreshClaudeOAuthToken } from './auth.js';
-import { assertNotCustodyTombstone, CustodyTombstoneRefreshError, custodyTombstoneKey, isCustodyTombstoneValue, } from './claustrum.js';
-import { CACHE_1H_MODES, CLAUDE_CODE_VERSION, DEFAULT_CACHE_1H_MODE, } from './constants.js';
-import { parseJsonRedacted } from './json.js';
-import { log, logger } from './logger.js';
-import { isTransientNetworkError } from './network-errors.js';
-import { tokenFingerprint } from './token-fingerprint.js';
-const setRefreshLockRenewalTimeout = globalThis.setTimeout.bind(globalThis);
-const clearRefreshLockRenewalTimeout = globalThis.clearTimeout.bind(globalThis);
-export const ACCOUNT_FILE_NAME = 'anthropic-auth.json';
-export const ACCOUNT_STATE_FILE_NAME = 'anthropic-auth-state.json';
-export const QUOTA_URL = 'https://api.anthropic.com/api/oauth/usage';
-export const QUOTA_FIELD_NAMES = [
-    'five_hour',
-    'seven_day',
-    'scoped',
-    'extraUsage',
-    'bindingWindow',
-    'fallbackAdvised',
-];
-export function hasNoLocalCredential(account) {
-    return (account.access == null &&
-        (account.refresh == null || account.refresh === ''));
-}
-export function isOAuthAccount(account) {
-    return account.type === 'oauth';
-}
-export function isApiKeyAccount(account) {
-    return account.type === 'api';
-}
-export function isValidApiBaseURL(value) {
-    const raw = value?.trim();
-    if (!raw)
-        return false;
-    try {
-        const url = new URL(raw);
-        return ((url.protocol === 'http:' || url.protocol === 'https:') &&
-            !url.username &&
-            !url.password);
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Whether Anthropic OAuth model costs should be zeroed in the provider hook.
- * Defaults to enabled; only an explicit `costZeroing.enabled === false` opts out
- * (to display the provider's real model costs).
- */
-export function isCostZeroingEnabled(storage) {
-    return storage.costZeroing?.enabled !== false;
-}
-const DEFAULT_FALLBACK_ON = [401, 403, 429];
-const MIN_REFRESH_BEFORE_EXPIRY_MINUTES = 240;
-const DEFAULT_REFRESH_BEFORE_EXPIRY_MINUTES = MIN_REFRESH_BEFORE_EXPIRY_MINUTES;
-const DEFAULT_REFRESH_INTERVAL_MINUTES = 10;
-const MIN_REFRESH_RETRY_DELAY_MS = 5 * 60_000;
-const MAX_REFRESH_RETRY_DELAY_MS = 60 * 60_000;
-const NON_TRANSIENT_REFRESH_RETRY_DELAY_MS = 24 * 60 * 60_000;
-const MIN_QUOTA_RETRY_DELAY_MS = 60_000;
-const MAX_QUOTA_RETRY_DELAY_MS = 15 * 60_000;
-const NON_TRANSIENT_QUOTA_RETRY_DELAY_MS = 5 * 60_000;
-const DEFAULT_QUOTA_CHECK_INTERVAL_MINUTES = 5;
-const DEFAULT_MINIMUM_REMAINING = {
-    five_hour: 0,
-    seven_day: 0,
-};
-const DEFAULT_FAIL_CLOSED_ON_UNKNOWN_QUOTA = true;
-export const FALLBACK_BACKGROUND_TICK_MS = 60_000;
-const BACKGROUND_TICK_JITTER_MS = 60_000;
-const FALLBACK_REFRESH_LOCK_TTL_MS = 10 * 60_000;
-const FALLBACK_REFRESH_JOIN_WAIT_MS = 10_000;
-const FALLBACK_REFRESH_JOIN_POLL_MS = 100;
-function getConfigDir() {
-    if (process.env.OPENCODE_CONFIG_DIR?.trim()) {
-        return process.env.OPENCODE_CONFIG_DIR.trim();
-    }
-    return join(process.env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'opencode');
-}
-export function getAccountStoragePath() {
-    return (process.env.OPENCODE_ANTHROPIC_AUTH_FILE?.trim() ||
-        join(getConfigDir(), ACCOUNT_FILE_NAME));
-}
-export function getAccountStatePath(configPath = getAccountStoragePath()) {
-    const explicit = process.env.OPENCODE_ANTHROPIC_AUTH_STATE_FILE?.trim();
-    if (explicit)
-        return explicit;
-    return configPath.endsWith(ACCOUNT_FILE_NAME)
-        ? join(dirname(configPath), ACCOUNT_STATE_FILE_NAME)
-        : `${configPath}.state.json`;
-}
-function isRecord(value) {
-    return value != null && typeof value === 'object' && !Array.isArray(value);
-}
-function normalizeAccountBase(value) {
-    return {
-        id: typeof value.id === 'string' && value.id.trim()
-            ? value.id.trim()
-            : randomUUID(),
-        label: typeof value.label === 'string' ? value.label : undefined,
-        enabled: typeof value.enabled === 'boolean' ? value.enabled : undefined,
-        addedAt: typeof value.addedAt === 'number' ? value.addedAt : undefined,
-        lastUsed: typeof value.lastUsed === 'number' ? value.lastUsed : undefined,
-    };
-}
-function normalizeAccount(value) {
-    if (!isRecord(value))
-        return null;
-    if (value.type === 'api') {
-        const baseURL = typeof value.baseURL === 'string' ? value.baseURL.trim() : '';
-        const apiKey = typeof value.apiKey === 'string' ? value.apiKey.trim() : '';
-        if (!isValidApiBaseURL(baseURL))
-            return null;
-        const authHeader = value.authHeader === 'x-api-key' ? 'x-api-key' : 'authorization-bearer';
-        return {
-            ...normalizeAccountBase(value),
-            type: 'api',
-            apiKey: apiKey || undefined,
-            baseURL,
-            authHeader,
-        };
-    }
-    if (value.type !== 'oauth')
-        return null;
-    const refresh = typeof value.refresh === 'string' ? value.refresh : '';
-    const rosterOnly = value.enabled === true &&
-        typeof value.id === 'string' &&
-        Boolean(value.id.trim()) &&
-        typeof value.label === 'string' &&
-        Boolean(value.label.trim()) &&
-        hasNoLocalCredential(value);
-    const scopedRosterOnly = typeof value.claustrumScopedCredentialId === 'string' &&
-        Boolean(value.claustrumScopedCredentialId.trim()) &&
-        typeof value.anthropicAccountUuid === 'string' &&
-        Boolean(value.anthropicAccountUuid.trim()) &&
-        hasNoLocalCredential(value);
-    if (!refresh.trim() && !rosterOnly && !scopedRosterOnly)
-        return null;
-    return {
-        ...normalizeAccountBase(value),
-        type: 'oauth',
-        authLineageId: typeof value.authLineageId === 'string' && value.authLineageId.trim()
-            ? value.authLineageId
-            : undefined,
-        anthropicAccountUuid: typeof value.anthropicAccountUuid === 'string' &&
-            value.anthropicAccountUuid.trim()
-            ? value.anthropicAccountUuid.trim()
-            : undefined,
-        claustrumHandle: typeof value.claustrumHandle === 'string' && value.claustrumHandle.trim()
-            ? value.claustrumHandle.trim()
-            : undefined,
-        claustrumScopedCredentialId: typeof value.claustrumScopedCredentialId === 'string' &&
-            value.claustrumScopedCredentialId.trim()
-            ? value.claustrumScopedCredentialId.trim()
-            : undefined,
-        claustrumScopedState: typeof value.claustrumScopedState === 'string' &&
-            value.claustrumScopedState.trim()
-            ? value.claustrumScopedState.trim()
-            : undefined,
-        access: typeof value.access === 'string' ? value.access : undefined,
-        refresh,
-        expires: typeof value.expires === 'number' ? value.expires : undefined,
-        lastRefreshedAt: typeof value.lastRefreshedAt === 'number'
-            ? value.lastRefreshedAt
-            : undefined,
-        lastRefreshError: normalizeOperationError(value.lastRefreshError),
-        lastQuotaRefreshError: normalizeOperationError(value.lastQuotaRefreshError),
-        quota: normalizeQuota(value.quota),
-        profile: normalizeOAuthAccountProfile(value.profile),
-        prime: normalizePrimeUsageCounters(value.prime),
-    };
-}
-function normalizeOAuthAccountProfile(value) {
-    if (!isRecord(value))
-        return undefined;
-    if (typeof value.tier !== 'string' ||
-        !value.tier.trim() ||
-        typeof value.orgType !== 'string' ||
-        !value.orgType.trim() ||
-        typeof value.checkedAt !== 'number' ||
-        !Number.isFinite(value.checkedAt)) {
-        return undefined;
-    }
-    return {
-        tier: value.tier.trim(),
-        orgType: value.orgType.trim(),
-        checkedAt: value.checkedAt,
-        ...(typeof value.accountIdentity === 'string' &&
-            value.accountIdentity.trim() && {
-            accountIdentity: value.accountIdentity.trim(),
-        }),
-        ...(typeof value.providerAccountUuid === 'string' &&
-            value.providerAccountUuid.trim() && {
-            providerAccountUuid: value.providerAccountUuid.trim(),
-        }),
-        ...(typeof value.tokenFingerprint === 'string' &&
-            value.tokenFingerprint.trim() && {
-            tokenFingerprint: value.tokenFingerprint.trim(),
-        }),
-    };
-}
-function normalizeOperationError(value) {
-    if (!isRecord(value))
-        return undefined;
-    if (typeof value.message !== 'string')
-        return undefined;
-    const checkedAt = Number(value.checkedAt);
-    if (!Number.isFinite(checkedAt))
-        return undefined;
-    const nextRetryAt = Number(value.nextRetryAt);
-    const retryCount = Number(value.retryCount);
-    const status = Number(value.status);
-    return {
-        message: value.message,
-        checkedAt,
-        nextRetryAt: Number.isFinite(nextRetryAt) ? nextRetryAt : undefined,
-        retryCount: Number.isFinite(retryCount) ? retryCount : undefined,
-        accountIdentity: typeof value.accountIdentity === 'string' && value.accountIdentity.trim()
-            ? value.accountIdentity.trim()
-            : undefined,
-        tokenHash: typeof value.tokenHash === 'string' ? value.tokenHash : undefined,
-        refreshTokenFingerprint: typeof value.refreshTokenFingerprint === 'string' &&
-            value.refreshTokenFingerprint.trim()
-            ? value.refreshTokenFingerprint.trim()
-            : undefined,
-        // Preserve the dead-token discriminators across save/load. Without these,
-        // a retry-exhausted transient (permanent=false, 24h backoff) would lose its
-        // flag on reload and the 24h-delay heuristic would wrongly re-classify it
-        // permanent → false "needs re-login" nag.
-        status: Number.isFinite(status) ? status : undefined,
-        permanent: typeof value.permanent === 'boolean' ? value.permanent : undefined,
-    };
-}
-function normalizeQuotaWindow(value) {
-    if (!isRecord(value))
-        return undefined;
-    const usedPercent = Number(value.usedPercent);
-    const remainingPercent = Number(value.remainingPercent);
-    const checkedAt = Number(value.checkedAt);
-    if (!Number.isFinite(usedPercent) ||
-        !Number.isFinite(remainingPercent) ||
-        !Number.isFinite(checkedAt)) {
-        return undefined;
-    }
-    return {
-        usedPercent,
-        remainingPercent,
-        checkedAt,
-        resetsAt: typeof value.resetsAt === 'string' ? value.resetsAt : undefined,
-    };
-}
-function normalizePrimeUsageCounters(value) {
-    if (!isRecord(value))
-        return undefined;
-    const count = Number(value.count);
-    const inputTokens = Number(value.inputTokens);
-    const outputTokens = Number(value.outputTokens);
-    const since = Number(value.since);
-    if (![count, inputTokens, outputTokens, since].every(Number.isFinite) ||
-        count < 0 ||
-        inputTokens < 0 ||
-        outputTokens < 0 ||
-        since < 0) {
-        return undefined;
-    }
-    return {
-        count: Math.floor(count),
-        inputTokens: Math.floor(inputTokens),
-        outputTokens: Math.floor(outputTokens),
-        since: Math.floor(since),
-    };
-}
-function normalizeQuota(value) {
-    if (!isRecord(value))
-        return undefined;
-    const quota = {};
-    for (const key of ['five_hour', 'seven_day']) {
-        const normalized = normalizeQuotaWindow(value[key]);
-        if (normalized)
-            quota[key] = normalized;
-    }
-    // Persist a top-level snapshot checkedAt through normalize so the
-    // mergeAccountRuntimeState freshness comparison stays meaningful when the
-    // snapshot has no per-window checkedAt (e.g. {scoped:[]}). Pre-feature
-    // inputs without this key are unaffected — only on-disk snapshots that
-    // already carry it reach this branch.
-    if (typeof value.checkedAt === 'number' && Number.isFinite(value.checkedAt)) {
-        quota.checkedAt = value.checkedAt;
-    }
-    if (typeof value.accountIdentity === 'string' &&
-        value.accountIdentity.trim()) {
-        quota.accountIdentity = value.accountIdentity.trim();
-    }
-    if (Array.isArray(value.scoped)) {
-        const scoped = value.scoped
-            .map((entry) => {
-            if (!isRecord(entry))
-                return undefined;
-            const window = normalizeQuotaWindow(entry);
-            if (!window)
-                return undefined;
-            if (typeof entry.id !== 'string' || !entry.id.trim())
-                return undefined;
-            if (typeof entry.title !== 'string' || !entry.title.trim()) {
-                return undefined;
-            }
-            if (typeof entry.modelName !== 'string' || !entry.modelName.trim()) {
-                return undefined;
-            }
-            const modelId = typeof entry.modelId === 'string' && entry.modelId.trim()
-                ? entry.modelId.trim()
-                : undefined;
-            return {
-                ...window,
-                id: entry.id.trim(),
-                title: entry.title.trim(),
-                ...(modelId && { modelId }),
-                modelName: entry.modelName.trim(),
-            };
-        })
-            .filter((entry) => entry != null);
-        // Preserve empty `[]` so a downstream reader can distinguish "scoped
-        // owned by anthropic-auth, none visible" from "no scoped data on this
-        // snapshot". Pre-feature inputs without a `scoped` key are not affected
-        // — only inputs that already carried an array reach this line.
-        quota.scoped = scoped;
-    }
-    if (isRecord(value.extraUsage)) {
-        const used = normalizeQuotaMoney(value.extraUsage.used);
-        const limit = normalizeQuotaMoney(value.extraUsage.limit);
-        if (used && limit && typeof value.extraUsage.exhausted === 'boolean') {
-            quota.extraUsage = {
-                used,
-                limit,
-                ...(typeof value.extraUsage.utilizationPercent === 'number' &&
-                    Number.isFinite(value.extraUsage.utilizationPercent) && {
-                    utilizationPercent: value.extraUsage.utilizationPercent,
-                }),
-                ...(typeof value.extraUsage.severity === 'string' && {
-                    severity: value.extraUsage.severity,
-                }),
-                exhausted: value.extraUsage.exhausted,
-            };
-        }
-    }
-    if (typeof value.bindingWindow === 'string' && value.bindingWindow.trim()) {
-        quota.bindingWindow = value.bindingWindow.trim();
-    }
-    if (value.bindingWindowSource === 'poll' ||
-        value.bindingWindowSource === 'headers') {
-        quota.bindingWindowSource = value.bindingWindowSource;
-    }
-    if (typeof value.fallbackAdvised === 'boolean') {
-        quota.fallbackAdvised = value.fallbackAdvised;
-    }
-    if (value.source === 'poll' || value.source === 'headers') {
-        quota.source = value.source;
-    }
-    if (isRecord(value.fieldSources)) {
-        const fieldSources = {};
-        for (const field of QUOTA_FIELD_NAMES) {
-            if (quota[field] === undefined)
-                continue;
-            const source = value.fieldSources[field];
-            if (source === 'poll' || source === 'headers') {
-                fieldSources[field] = source;
-            }
-        }
-        if (Object.keys(fieldSources).length > 0) {
-            quota.fieldSources = fieldSources;
-        }
-    }
-    return Object.keys(quota).length ? quota : undefined;
-}
-function normalizeQuotaMoney(value) {
-    if (!isRecord(value))
-        return undefined;
-    if (typeof value.amountMinor !== 'number' ||
-        !Number.isFinite(value.amountMinor) ||
-        typeof value.currency !== 'string' ||
-        !value.currency.trim() ||
-        typeof value.exponent !== 'number' ||
-        !Number.isFinite(value.exponent)) {
-        return undefined;
-    }
-    return {
-        amountMinor: value.amountMinor,
-        currency: value.currency.trim(),
-        exponent: value.exponent,
-    };
-}
-// Fresh empty storage shell — main OpenCode OAuth account, no fallback
-// accounts. Returns a new object each call so mutating callers don't alias.
-export function createEmptyStorage() {
-    return {
-        version: 1,
-        main: { type: 'opencode', provider: 'anthropic' },
-        accounts: [],
-    };
-}
-function normalizeStorage(value) {
-    if (!isRecord(value) || !Array.isArray(value.accounts))
-        return null;
-    return {
-        version: 1,
-        mainAccountId: typeof value.mainAccountId === 'string' && value.mainAccountId.trim()
-            ? value.mainAccountId.trim()
-            : undefined,
-        main: {
-            type: 'opencode',
-            provider: 'anthropic',
-            profile: normalizeOAuthAccountProfile(isRecord(value.main) ? value.main.profile : undefined),
-        },
-        routing: isRecord(value.routing) ? value.routing : undefined,
-        fallbackOn: Array.isArray(value.fallbackOn)
-            ? value.fallbackOn.filter((status) => Number.isInteger(status))
-            : undefined,
-        refresh: isRecord(value.refresh) ? value.refresh : undefined,
-        quota: isRecord(value.quota) ? value.quota : undefined,
-        quotaHeaderFeed: isRecord(value.quotaHeaderFeed)
-            ? value.quotaHeaderFeed
-            : undefined,
-        claudeCache: isRecord(value.claudeCache) ? value.claudeCache : undefined,
-        dump: isRecord(value.dump) ? value.dump : undefined,
-        claudeFast: isRecord(value.claudeFast) ? value.claudeFast : undefined,
-        thinkingBinding: isRecord(value.thinkingBinding)
-            ? value.thinkingBinding
-            : undefined,
-        costZeroing: isRecord(value.costZeroing) ? value.costZeroing : undefined,
-        cacheKeep: isRecord(value.cacheKeep) ? value.cacheKeep : undefined,
-        relay: isRecord(value.relay) ? value.relay : undefined,
-        claustrum: normalizeClaustrumConfig(value.claustrum),
-        logging: isRecord(value.logging) ? value.logging : undefined,
-        killswitch: isRecord(value.killswitch) ? value.killswitch : undefined,
-        prime: (() => {
-            if (!isRecord(value.prime))
-                return undefined;
-            const enabled = typeof value.prime.enabled === 'boolean'
-                ? value.prime.enabled
-                : undefined;
-            const main = normalizePrimeUsageCounters(value.prime.main);
-            const mainAuthLineageId = typeof value.prime.mainAuthLineageId === 'string' &&
-                value.prime.mainAuthLineageId.trim()
-                ? value.prime.mainAuthLineageId
-                : undefined;
-            const mainAuthLineageRefreshTokenFingerprint = typeof value.prime.mainAuthLineageRefreshTokenFingerprint ===
-                'string' && value.prime.mainAuthLineageRefreshTokenFingerprint.trim()
-                ? value.prime.mainAuthLineageRefreshTokenFingerprint
-                : undefined;
-            if (enabled === undefined &&
-                !main &&
-                !mainAuthLineageId &&
-                !mainAuthLineageRefreshTokenFingerprint)
-                return undefined;
-            return {
-                ...(enabled !== undefined && { enabled }),
-                ...(main && { main }),
-                ...(mainAuthLineageId && { mainAuthLineageId }),
-                ...(mainAuthLineageRefreshTokenFingerprint && {
-                    mainAuthLineageRefreshTokenFingerprint,
-                }),
-            };
-        })(),
-        accounts: value.accounts
-            .map(normalizeAccount)
-            .filter((account) => account != null),
-    };
-}
-function normalizeClaustrumConfig(value) {
-    if (!isRecord(value))
-        return undefined;
-    const mode = value.mode === 'local' || value.mode === 'claustrum'
-        ? value.mode
-        : undefined;
-    const handlesFile = typeof value.handlesFile === 'string' && value.handlesFile.trim()
-        ? value.handlesFile.trim()
-        : undefined;
-    const primary = isRecord(value.primaryAccount)
-        ? value.primaryAccount
-        : undefined;
-    const primaryAccount = primary &&
-        typeof primary.credentialId === 'string' &&
-        primary.credentialId.trim() &&
-        typeof primary.accountId === 'string' &&
-        primary.accountId.trim() &&
-        typeof primary.state === 'string'
-        ? {
-            credentialId: primary.credentialId.trim(),
-            accountId: primary.accountId.trim(),
-            state: primary.state,
-        }
-        : undefined;
-    const scopedRoster = value.scopedRoster === true;
-    const disabledAccountIdentities = Array.isArray(value.disabledAccountIdentities)
-        ? [
-            ...new Set(value.disabledAccountIdentities
-                .filter((id) => typeof id === 'string' && id.trim().length > 0)
-                .map((id) => id.trim())),
-        ]
-        : [];
-    const accounts = isRecord(value.accounts)
-        ? Object.fromEntries(Object.entries(value.accounts).flatMap(([id, entry]) => {
-            if (!isRecord(entry))
-                return [];
-            return [
-                [
-                    id,
-                    {
-                        ...(typeof entry.enabled === 'boolean' && {
-                            enabled: entry.enabled,
-                        }),
-                    },
-                ],
-            ];
-        }))
-        : undefined;
-    if (!mode &&
-        !handlesFile &&
-        !scopedRoster &&
-        disabledAccountIdentities.length === 0 &&
-        (!accounts || Object.keys(accounts).length === 0)) {
-        return undefined;
-    }
-    return {
-        ...(mode && { mode }),
-        ...(scopedRoster && { scopedRoster: true }),
-        ...(primaryAccount && { primaryAccount }),
-        ...(disabledAccountIdentities.length > 0 && { disabledAccountIdentities }),
-        ...(handlesFile && { handlesFile }),
-        ...(accounts && Object.keys(accounts).length > 0 && { accounts }),
-    };
-}
-async function readJsonIfPresent(path) {
-    try {
-        return {
-            exists: true,
-            value: parseJsonRedacted(await readFile(path, 'utf8')),
-        };
-    }
-    catch (error) {
-        if (error.code === 'ENOENT') {
-            return { exists: false, value: null };
-        }
-        const cause = error instanceof Error ? error.message : String(error);
-        throw new Error(`account store at ${path} is corrupt or unreadable (${cause}) — fix or remove it`);
-    }
-}
-function objectWithDefinedEntries(value) {
-    return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined));
-}
-function numericField(value) {
-    return typeof value === 'number' && Number.isFinite(value) ? value : 0;
-}
-// A clear is a monotonic tombstone; older or absent writes must not reopen backoff.
-export function mergeMainQuotaErrorClearedAt(existing, incoming) {
-    if (incoming === undefined || !Number.isFinite(incoming))
-        return existing;
-    if (existing === undefined || !Number.isFinite(existing))
-        return incoming;
-    return Math.max(existing, incoming);
-}
-export function mergeMainRefreshErrorClearedAt(existing, incoming) {
-    if (incoming === undefined || !Number.isFinite(incoming))
-        return existing;
-    if (existing === undefined || !Number.isFinite(existing))
-        return incoming;
-    return Math.max(existing, incoming);
-}
-function accountCredentialTimestamp(value) {
-    return Math.max(numericField(value.lastRefreshedAt), numericField(value.lastUsed), numericField(value.addedAt));
-}
-function legacyConfigCredentialsAreNewer(account, stateAccount) {
-    if (account.type !== 'oauth')
-        return false;
-    if (typeof account.refresh !== 'string' || !account.refresh.trim()) {
-        return false;
-    }
-    const tokenChanged = Boolean((typeof account.access === 'string' &&
-        typeof stateAccount.access === 'string' &&
-        account.access !== stateAccount.access) ||
-        (typeof account.refresh === 'string' &&
-            typeof stateAccount.refresh === 'string' &&
-            account.refresh !== stateAccount.refresh));
-    if (!tokenChanged)
-        return false;
-    return (accountCredentialTimestamp(account) >
-        accountCredentialTimestamp(stateAccount));
-}
-function mergeConfigAccountAndState(account, stateAccount) {
-    if (typeof account.claustrumScopedCredentialId === 'string' &&
-        typeof account.anthropicAccountUuid === 'string') {
-        const sameBinding = stateAccount.claustrumScopedCredentialId ===
-            account.claustrumScopedCredentialId &&
-            stateAccount.anthropicAccountUuid === account.anthropicAccountUuid;
-        const scoped = {
-            ...(sameBinding ? stateAccount : {}),
-            ...account,
-            refresh: '',
-        };
-        delete scoped.access;
-        delete scoped.expires;
-        delete scoped.lastRefreshedAt;
-        delete scoped.lastRefreshError;
-        delete scoped.claustrumHandle;
-        return scoped;
-    }
-    if (legacyConfigCredentialsAreNewer(account, stateAccount)) {
-        const merged = { ...stateAccount, ...account };
-        const configTimestamp = accountCredentialTimestamp(account);
-        if (configTimestamp > numericField(merged.lastRefreshedAt)) {
-            merged.lastRefreshedAt = configTimestamp;
-        }
-        delete merged.quota;
-        delete merged.lastRefreshError;
-        delete merged.lastQuotaRefreshError;
-        return merged;
-    }
-    return { ...account, ...stateAccount };
-}
-function configAccountHasInvalidShape(account) {
-    if (account.type !== 'api' && account.type !== 'oauth')
-        return true;
-    if (account.type === 'api' &&
-        'baseURL' in account &&
-        (typeof account.baseURL !== 'string' || !isValidApiBaseURL(account.baseURL))) {
-        return true;
-    }
-    if (account.type === 'oauth' &&
-        'refresh' in account &&
-        (typeof account.refresh !== 'string' || !account.refresh.trim())) {
-        return true;
-    }
-    return false;
-}
-function mergeConfigAndState(configValue, stateValue) {
-    if (!isRecord(configValue))
-        return configValue;
-    const state = isRecord(stateValue) ? stateValue : {};
-    const mainState = isRecord(state.main) ? state.main : undefined;
-    const stateAccounts = isRecord(state.accounts) ? state.accounts : {};
-    const quotaConfig = isRecord(configValue.quota) ? configValue.quota : {};
-    const refreshConfig = isRecord(configValue.refresh) ? configValue.refresh : {};
-    const mainQuotaSource = mainState ?? quotaConfig;
-    const mainRefreshSource = mainState ?? refreshConfig;
-    const mainQuotaErrorClearedAt = typeof mainState?.quotaErrorClearedAt === 'number' &&
-        Number.isFinite(mainState.quotaErrorClearedAt) &&
-        mainState.quotaErrorClearedAt >= 0
-        ? mainState.quotaErrorClearedAt
-        : undefined;
-    const mainRefreshErrorClearedAt = typeof mainState?.refreshErrorClearedAt === 'number' &&
-        Number.isFinite(mainState.refreshErrorClearedAt) &&
-        mainState.refreshErrorClearedAt >= 0
-        ? mainState.refreshErrorClearedAt
-        : undefined;
-    const configQuotaError = quotaConfig.mainLastQuotaApiError;
-    const mainLastQuotaApiError = mainState?.lastQuotaApiError ??
-        (mainQuotaErrorClearedAt !== undefined &&
-            isRecord(configQuotaError) &&
-            typeof configQuotaError.checkedAt === 'number' &&
-            configQuotaError.checkedAt <= mainQuotaErrorClearedAt
-            ? undefined
-            : configQuotaError);
-    const configRefreshError = refreshConfig.mainLastRefreshError;
-    const mainLastRefreshError = mainState?.lastRefreshError ??
-        (mainRefreshErrorClearedAt !== undefined &&
-            isRecord(configRefreshError) &&
-            typeof configRefreshError.checkedAt === 'number' &&
-            configRefreshError.checkedAt <= mainRefreshErrorClearedAt
-            ? undefined
-            : configRefreshError);
-    const accounts = Array.isArray(configValue.accounts)
-        ? configValue.accounts.map((account) => {
-            if (!isRecord(account))
-                return account;
-            const rawId = typeof account.id === 'string' ? account.id : undefined;
-            const stateValue = rawId
-                ? (stateAccounts[rawId] ?? stateAccounts[rawId.trim()])
-                : undefined;
-            const stateAccount = isRecord(stateValue)
-                ? stateValue
-                : {};
-            return mergeConfigAccountAndState(account, stateAccount);
-        })
-        : [];
-    return {
-        ...configValue,
-        main: {
-            type: 'opencode',
-            provider: 'anthropic',
-            profile: normalizeOAuthAccountProfile(mainState?.profile),
-        },
-        refresh: objectWithDefinedEntries({
-            ...refreshConfig,
-            mainLastRefreshError,
-            mainRefreshErrorClearedAt: mainRefreshSource.refreshErrorClearedAt,
-            mainRefreshLeaseId: mainRefreshSource.refreshLeaseId,
-            mainRefreshLeaseUntil: mainRefreshSource.refreshLeaseUntil,
-            mainRefreshLeaseTokenHash: mainRefreshSource.refreshLeaseTokenHash,
-        }),
-        quota: objectWithDefinedEntries({
-            ...quotaConfig,
-            mainQuota: mainQuotaSource.quota,
-            mainQuotaCheckedAt: mainQuotaSource.quotaCheckedAt,
-            mainQuotaToken: mainQuotaSource.quotaToken,
-            mainLastQuotaApiError,
-            mainQuotaErrorGeneration: mainQuotaSource.quotaErrorGeneration,
-            mainQuotaErrorClearedAt: mainQuotaSource.quotaErrorClearedAt,
-        }),
-        // Carry the main-side prime counters from the state file back into the
-        // merged storage so a subsequent read sees the cumulative counters. The
-        // `enabled` flag stays sourced from the config side; main-side counters
-        // live exclusively on the state file.
-        prime: (() => {
-            const configPrime = isRecord(configValue.prime)
-                ? configValue.prime
-                : undefined;
-            const mainCounters = normalizePrimeUsageCounters(mainState?.prime);
-            const mainAuthLineageId = typeof mainState?.primeAuthLineageId === 'string' &&
-                mainState.primeAuthLineageId.trim()
-                ? mainState.primeAuthLineageId
-                : undefined;
-            const mainAuthLineageRefreshTokenFingerprint = typeof mainState?.primeAuthLineageRefreshTokenFingerprint ===
-                'string' && mainState.primeAuthLineageRefreshTokenFingerprint.trim()
-                ? mainState.primeAuthLineageRefreshTokenFingerprint
-                : undefined;
-            if (!configPrime &&
-                !mainCounters &&
-                !mainAuthLineageId &&
-                !mainAuthLineageRefreshTokenFingerprint)
-                return undefined;
-            return {
-                ...(configPrime &&
-                    typeof configPrime.enabled === 'boolean' && {
-                    enabled: configPrime.enabled,
-                }),
-                ...(mainCounters && { main: mainCounters }),
-                ...(mainAuthLineageId && { mainAuthLineageId }),
-                ...(mainAuthLineageRefreshTokenFingerprint && {
-                    mainAuthLineageRefreshTokenFingerprint,
-                }),
-            };
-        })(),
-        accounts,
-    };
-}
-export async function loadAccounts(path = getAccountStoragePath()) {
-    const config = await readJsonIfPresent(path);
-    const state = await readJsonIfPresent(getAccountStatePath(path));
-    // Runtime-only flows (main-OAuth refresh with no fallback accounts) write the
-    // state file but never the config file, so the store is absent only when
-    // neither exists. Synthesize an empty config to merge state into otherwise.
-    if (!config.exists && !state.exists)
-        return null;
-    const configValue = config.exists ? config.value : createEmptyStorage();
-    return normalizeStorage(mergeConfigAndState(configValue, state.value));
-}
-async function loadExistingTopLevelFields(path) {
-    const existing = await readJsonIfPresent(path);
-    return isRecord(existing.value) ? existing.value : {};
-}
-function omitUndefinedTopLevel(value) {
-    return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined));
-}
-function accountConfig(account) {
-    return objectWithDefinedEntries({
-        id: account.id,
-        label: account.label,
-        type: account.type,
-        enabled: account.enabled,
-        addedAt: account.addedAt,
-        baseURL: account.type === 'api' ? account.baseURL : undefined,
-        authHeader: account.type === 'api' ? account.authHeader : undefined,
-        claustrumScopedCredentialId: account.type === 'oauth'
-            ? account.claustrumScopedCredentialId
-            : undefined,
-        anthropicAccountUuid: account.type === 'oauth' && account.claustrumScopedCredentialId
-            ? account.anthropicAccountUuid
-            : undefined,
-    });
-}
-function accountRuntimeState(account) {
-    if (account.type === 'api') {
-        return objectWithDefinedEntries({
-            apiKey: account.apiKey,
-            lastUsed: account.lastUsed,
-        });
-    }
-    return objectWithDefinedEntries({
-        authLineageId: account.authLineageId,
-        anthropicAccountUuid: account.anthropicAccountUuid,
-        claustrumHandle: account.claustrumHandle,
-        claustrumScopedCredentialId: account.claustrumScopedCredentialId,
-        claustrumScopedState: account.claustrumScopedState,
-        access: account.access,
-        refresh: account.refresh,
-        expires: account.expires,
-        lastUsed: account.lastUsed,
-        lastRefreshedAt: account.lastRefreshedAt,
-        lastRefreshError: account.lastRefreshError,
-        lastQuotaRefreshError: account.lastQuotaRefreshError,
-        quota: account.quota,
-        profile: account.profile,
-        prime: account.prime,
-    });
-}
-/** Returns the latest timestamp carried by any quota snapshot window. */
-export function quotaSnapshotCheckedAt(quota) {
-    return Math.max(quota?.five_hour?.checkedAt ?? 0, quota?.seven_day?.checkedAt ?? 0, ...(quota?.scoped?.map((window) => window.checkedAt) ?? []), quota?.checkedAt ?? 0);
-}
-function quotaSourcePrecedence(quota) {
-    if (quota?.source === 'poll')
-        return 2;
-    if (quota?.source === 'headers')
-        return 1;
-    return 0;
-}
-function mergeHeaderScopedQuota(existing, incoming) {
-    if (!('scoped' in existing))
-        return incoming.scoped;
-    if (!Array.isArray(existing.scoped) || existing.scoped.length === 0) {
-        return existing.scoped;
-    }
-    if (!Array.isArray(incoming.scoped) || incoming.scoped.length === 0) {
-        return existing.scoped;
-    }
-    const merged = new Map(incoming.scoped.map((window) => [window.id, window]));
-    for (const window of existing.scoped) {
-        const candidate = merged.get(window.id);
-        if (!candidate || window.checkedAt >= candidate.checkedAt) {
-            merged.set(window.id, window);
-        }
-    }
-    return [...merged.values()];
-}
-function mergeHeaderOwnedWindow(existingSnapshot, incomingSnapshot, key) {
-    const existing = existingSnapshot[key];
-    const incoming = incomingSnapshot[key];
-    if (!incoming)
-        return existing;
-    if (!existing)
-        return incoming;
-    if (incoming.checkedAt > existing.checkedAt)
-        return incoming;
-    if (incoming.checkedAt < existing.checkedAt)
-        return existing;
-    return quotaSourcePrecedence(existingSnapshot) >
-        quotaSourcePrecedence(incomingSnapshot)
-        ? existing
-        : incoming;
-}
-export function quotaFieldSource(snapshot, field) {
-    if (!snapshot || snapshot[field] === undefined)
-        return undefined;
-    return (snapshot.fieldSources?.[field] ??
-        (snapshot.source === 'poll' || snapshot.source === 'headers'
-            ? snapshot.source
-            : undefined));
-}
-function fieldSourcesForMergedQuota(existing, incoming, merged) {
-    const fieldSources = {};
-    for (const field of QUOTA_FIELD_NAMES) {
-        if (merged[field] === undefined)
-            continue;
-        if (field === 'scoped' || field === 'extraUsage') {
-            fieldSources[field] = 'poll';
-            continue;
-        }
-        if (field === 'bindingWindow' &&
-            existing.bindingWindowSource === 'poll' &&
-            existing.bindingWindow === merged.bindingWindow) {
-            fieldSources[field] = 'poll';
-            continue;
-        }
-        if (field === 'fallbackAdvised' &&
-            incoming.fieldSources?.fallbackAdvised === undefined) {
-            const source = quotaFieldSource(existing, field);
-            if (source)
-                fieldSources[field] = source;
-            continue;
-        }
-        const source = incoming[field] === merged[field]
-            ? quotaFieldSource(incoming, field)
-            : existing[field] === merged[field]
-                ? quotaFieldSource(existing, field)
-                : (quotaFieldSource(existing, field) ??
-                    quotaFieldSource(incoming, field));
-        if (source)
-            fieldSources[field] = source;
-    }
-    return Object.keys(fieldSources).length > 0 ? fieldSources : undefined;
-}
-export function mergeHeaderQuotaForPersistence(existing, incoming) {
-    if (!existing || incoming.source !== 'headers')
-        return incoming;
-    const preservePollBinding = existing.bindingWindowSource === 'poll';
-    const merged = {
-        ...existing,
-        ...incoming,
-        five_hour: mergeHeaderOwnedWindow(existing, incoming, 'five_hour'),
-        seven_day: mergeHeaderOwnedWindow(existing, incoming, 'seven_day'),
-        scoped: mergeHeaderScopedQuota(existing, incoming),
-        extraUsage: existing.extraUsage ?? incoming.extraUsage,
-        fallbackAdvised: incoming.fieldSources?.fallbackAdvised !== undefined
-            ? incoming.fallbackAdvised
-            : (existing.fallbackAdvised ?? incoming.fallbackAdvised),
-        bindingWindow: preservePollBinding
-            ? existing.bindingWindow
-            : (incoming.bindingWindow ?? existing.bindingWindow),
-        bindingWindowSource: preservePollBinding
-            ? 'poll'
-            : (incoming.bindingWindowSource ?? existing.bindingWindowSource),
-    };
-    const fieldSources = fieldSourcesForMergedQuota(existing, incoming, merged);
-    return {
-        ...merged,
-        ...(fieldSources && { fieldSources }),
-    };
-}
-function mergeAccountRuntimeState(existing, incoming, setClaustrumHandle = false) {
-    if (!isRecord(existing))
-        return incoming;
-    const incomingForMerge = { ...incoming };
-    if (!setClaustrumHandle)
-        delete incomingForMerge.claustrumHandle;
-    const existingEntry = existing;
-    const tokenChanged = Boolean((existingEntry.access &&
-        incomingForMerge.access &&
-        existingEntry.access !== incomingForMerge.access) ||
-        (existingEntry.refresh &&
-            incomingForMerge.refresh &&
-            existingEntry.refresh !== incomingForMerge.refresh));
-    const mergesHeaderQuota = Boolean(!tokenChanged && incomingForMerge.quota?.source === 'headers');
-    const effectiveIncoming = mergesHeaderQuota && incomingForMerge.quota
-        ? {
-            ...incomingForMerge,
-            quota: mergeHeaderQuotaForPersistence(existingEntry.quota, incomingForMerge.quota),
-        }
-        : incomingForMerge;
-    if (existingEntry.refresh === custodyTombstoneKey('anthropic') &&
-        ((typeof effectiveIncoming.access === 'string' &&
-            effectiveIncoming.access.length > 0) ||
-            (typeof effectiveIncoming.refresh === 'string' &&
-                effectiveIncoming.refresh !== custodyTombstoneKey('anthropic'))) &&
-        (!effectiveIncoming.authLineageId ||
-            effectiveIncoming.authLineageId === existingEntry.authLineageId)) {
-        logger.warn('accounts', 'discarded stale credential write over a custody tombstone');
-        const { access: _access, refresh: _refresh, expires: _expires, ...safe } = effectiveIncoming;
-        return mergeAccountRuntimeState(existingEntry, safe, setClaustrumHandle);
-    }
-    const preferredRefreshError = (() => {
-        const existingError = existingEntry.lastRefreshError;
-        const incomingError = effectiveIncoming.lastRefreshError;
-        if (!existingError)
-            return incomingError;
-        if (incomingError) {
-            return incomingError.checkedAt >= existingError.checkedAt
-                ? incomingError
-                : existingError;
-        }
-        return (effectiveIncoming.lastRefreshedAt ?? 0) >
-            (existingEntry.lastRefreshedAt ?? 0)
-            ? undefined
-            : existingError;
-    })();
-    const existingQuotaCheckedAt = quotaSnapshotCheckedAt(existingEntry.quota);
-    const incomingQuotaCheckedAt = quotaSnapshotCheckedAt(effectiveIncoming.quota);
-    const existingQuotaWinsEqualTimestamp = Boolean(existingQuotaCheckedAt === incomingQuotaCheckedAt &&
-        quotaSourcePrecedence(existingEntry.quota) >
-            quotaSourcePrecedence(effectiveIncoming.quota));
-    if (!mergesHeaderQuota &&
-        (existingQuotaCheckedAt > incomingQuotaCheckedAt ||
-            existingQuotaWinsEqualTimestamp)) {
-        const existingRefreshAt = existingEntry.lastRefreshedAt ?? 0;
-        const incomingRefreshAt = effectiveIncoming.lastRefreshedAt ?? 0;
-        if (tokenChanged && incomingRefreshAt <= existingRefreshAt) {
-            const merged = { ...existingEntry };
-            if (typeof effectiveIncoming.lastUsed === 'number' &&
-                (!(typeof existingEntry.lastUsed === 'number') ||
-                    effectiveIncoming.lastUsed > existingEntry.lastUsed)) {
-                merged.lastUsed = effectiveIncoming.lastUsed;
-            }
-            return merged;
-        }
-        const merged = {
-            ...existingEntry,
-            ...effectiveIncoming,
-        };
-        if (tokenChanged) {
-            if (!('profile' in effectiveIncoming))
-                delete merged.profile;
-            if (effectiveIncoming.quota?.source) {
-                merged.quota = effectiveIncoming.quota;
-            }
-            else {
-                delete merged.quota;
-            }
-            if (!('lastQuotaRefreshError' in effectiveIncoming)) {
-                delete merged.lastQuotaRefreshError;
-            }
-            merged.lastRefreshError = preferredRefreshError;
-            return merged;
-        }
-        return {
-            ...merged,
-            quota: existingEntry.quota,
-            lastQuotaRefreshError: existingEntry.lastQuotaRefreshError,
-            lastRefreshError: preferredRefreshError,
-        };
-    }
-    const merged = {
-        ...existingEntry,
-        ...effectiveIncoming,
-    };
-    if (tokenChanged) {
-        if (!('profile' in effectiveIncoming))
-            delete merged.profile;
-        if (!effectiveIncoming.quota?.source)
-            delete merged.quota;
-    }
-    if (!('lastQuotaRefreshError' in effectiveIncoming)) {
-        delete merged.lastQuotaRefreshError;
-    }
-    merged.lastRefreshError = preferredRefreshError;
-    return merged;
-}
-function configFromStorage(storage) {
-    const refresh = storage.refresh
-        ? objectWithDefinedEntries({
-            enabled: storage.refresh.enabled,
-            intervalMinutes: storage.refresh.intervalMinutes,
-            refreshBeforeExpiryMinutes: storage.refresh.refreshBeforeExpiryMinutes,
-        })
-        : undefined;
-    const quota = storage.quota
-        ? objectWithDefinedEntries({
-            enabled: storage.quota.enabled,
-            checkIntervalMinutes: storage.quota.checkIntervalMinutes,
-            refreshEveryNRequests: storage.quota.refreshEveryNRequests,
-            minimumRemaining: storage.quota.minimumRemaining,
-            failClosedOnUnknownQuota: storage.quota.failClosedOnUnknownQuota,
-            showToasts: storage.quota.showToasts,
-        })
-        : undefined;
-    return omitUndefinedTopLevel({
-        version: 1,
-        mainAccountId: storage.mainAccountId,
-        main: { type: 'opencode', provider: 'anthropic' },
-        routing: storage.routing,
-        fallbackOn: storage.fallbackOn,
-        refresh,
-        quota,
-        quotaHeaderFeed: storage.quotaHeaderFeed,
-        claudeCache: storage.claudeCache,
-        dump: storage.dump,
-        logging: storage.logging,
-        claudeFast: storage.claudeFast,
-        thinkingBinding: storage.thinkingBinding,
-        costZeroing: storage.costZeroing,
-        cacheKeep: storage.cacheKeep,
-        relay: storage.relay,
-        claustrum: storage.claustrum,
-        killswitch: storage.killswitch,
-        prime: (() => {
-            // Config side carries ONLY the `enabled` flag — runtime counters and
-            // lineage bindings stay on the state file. Write `enabled` whenever it was explicitly set so a
-            // toggle off persists `{ enabled: false }` and is visible to a stale
-            // reader that only inspects the config.
-            if (typeof storage.prime?.enabled !== 'boolean')
-                return undefined;
-            return { enabled: storage.prime.enabled };
-        })(),
-        accounts: storage.accounts.map(accountConfig),
-    });
-}
-export function getClaustrumMode(storage) {
-    return storage?.claustrum?.mode === 'claustrum' ? 'claustrum' : 'local';
-}
-export function isOAuthAccountVaultOwned(storage, account, binding) {
-    return (getClaustrumMode(storage) === 'claustrum' &&
-        isOAuthAccount(account) &&
-        account.enabled !== false &&
-        // Source is provenance, not authorization; the resolver owns the binding decision.
-        (binding?.status === 'resolved' ||
-            Boolean(storage?.claustrum?.scopedRoster && account.claustrumScopedCredentialId)));
-}
-export async function setClaustrumModePersistent(mode, path = getAccountStoragePath()) {
-    return enqueueSave(async () => {
-        const lock = await acquireAccountConfigWriteLock(path);
-        try {
-            const existing = await loadAccounts(path);
-            const storage = existing ?? createEmptyStorage();
-            if (existing && getClaustrumMode(storage) === mode)
-                return 'unchanged';
-            storage.claustrum = { ...storage.claustrum, mode };
-            await saveAccountsWithConfigLock(storage, path, {
-                [WRITE_CLAUSTRUM_MODE]: true,
-            });
-            return 'changed';
-        }
-        finally {
-            await lock.release();
-        }
-    });
-}
-export async function clearClaustrumHandlePersistent(input) {
-    const path = input.path ?? getAccountStoragePath();
-    return enqueueSave(async () => {
-        const configLock = await acquireAccountConfigWriteLock(path);
-        try {
-            const stateLock = await acquireAccountStateWriteLock(path);
-            try {
-                const storage = await loadAccounts(path);
-                if (!storage)
-                    return 'missing';
-                const statePath = getAccountStatePath(path);
-                const state = (await readJsonIfPresent(statePath)).value;
-                const stateAccounts = isRecord(state) && isRecord(state.accounts)
-                    ? state.accounts
-                    : undefined;
-                const matchingStateKeys = Object.keys(stateAccounts ?? {}).filter((key) => key.trim() === input.id.trim());
-                const account = storage.accounts.find((candidate) => candidate.id === input.id);
-                if (!account) {
-                    if (matchingStateKeys.length === 0)
-                        return 'missing';
-                    for (const key of matchingStateKeys) {
-                        const stateAccount = stateAccounts?.[key];
-                        if (isRecord(stateAccount))
-                            delete stateAccount.claustrumHandle;
-                    }
-                    await writeJsonAtomic(statePath, pruneUndefined(state));
-                    return 'updated';
-                }
-                if (!isOAuthAccount(account))
-                    return 'ineligible';
-                if (!account.claustrumHandle)
-                    return 'updated';
-                delete account.claustrumHandle;
-                const existing = await loadExistingTopLevelFields(path);
-                await writeJsonAtomic(path, {
-                    ...existing,
-                    ...configFromStorage(storage),
-                });
-                if (matchingStateKeys.length > 0) {
-                    for (const key of matchingStateKeys) {
-                        const stateAccount = stateAccounts?.[key];
-                        if (isRecord(stateAccount))
-                            delete stateAccount.claustrumHandle;
-                    }
-                    await writeJsonAtomic(statePath, pruneUndefined(state));
-                }
-                return 'updated';
-            }
-            finally {
-                await stateLock.release();
-            }
-        }
-        finally {
-            await configLock.release();
-        }
-    });
-}
-// ---------------------------------------------------------------------------
-// In-process save mutex — serializes all account-store writes so concurrent
-// read-modify-write callers (background timers that call saveAccountState with
-// different section flags) don't lose each other's updates (#9).
-// ---------------------------------------------------------------------------
-let saveChain = Promise.resolve();
-function enqueueSave(fn) {
-    return new Promise((resolve, reject) => {
-        saveChain = saveChain.then(() => fn().then(resolve, reject), () => fn().then(resolve, reject));
-    });
-}
-async function writeJsonAtomic(path, value) {
-    await mkdir(dirname(path), { recursive: true });
-    const tempPath = `${path}.${randomUUID()}.tmp`;
-    await writeFile(tempPath, `${JSON.stringify(value, null, 2)}\n`, {
-        encoding: 'utf8',
-        mode: 0o600,
-    });
-    try {
-        await rename(tempPath, path);
-    }
-    catch (error) {
-        await rm(tempPath, { force: true }).catch(() => { });
-        throw error;
-    }
-}
-const WRITE_CLAUSTRUM_MODE = Symbol('writeClaustrumMode');
-const MUTATE_ACCOUNT_ROSTER = Symbol('mutateAccountRoster');
-function sameAccountIdentity(left, right) {
-    return (left.id === right.id ||
-        Boolean(left.label && right.label && left.label === right.label));
-}
-function mergeAccountsForSave(existing, incoming, options) {
-    const removedIds = new Set(options.removedAccountIds ?? []);
-    const current = existing.filter((account) => !removedIds.has(account.id));
-    const next = incoming.filter((account) => !removedIds.has(account.id));
-    const missing = current.filter((account) => !next.some((candidate) => sameAccountIdentity(candidate, account)));
-    if (!missing.length)
-        return [...next];
-    if (options.preserveExistingAccountOrder === false) {
-        return [...next, ...missing];
-    }
-    const usedIncoming = new Set();
-    const merged = current.map((account) => {
-        const index = next.findIndex((candidate, candidateIndex) => !usedIncoming.has(candidateIndex) &&
-            sameAccountIdentity(candidate, account));
-        const candidate = next[index];
-        if (!candidate)
-            return account;
-        usedIncoming.add(index);
-        return candidate;
-    });
-    for (let index = 0; index < next.length; index++) {
-        const candidate = next[index];
-        if (!usedIncoming.has(index) && candidate)
-            merged.push(candidate);
-    }
-    return merged;
-}
-function preserveScopedAccountsOnSave(current, incoming, options) {
-    const apiRoutes = mergeAccountsForSave(current.filter(isApiKeyAccount), incoming.filter(isApiKeyAccount), options);
-    const byId = new Map(apiRoutes.map((account) => [account.id, account]));
-    const result = current.flatMap((account) => {
-        if (isOAuthAccount(account))
-            return [account];
-        const replacement = byId.get(account.id);
-        if (!replacement)
-            return [];
-        byId.delete(account.id);
-        return [replacement];
-    });
-    result.push(...byId.values());
-    return result;
-}
-const ACCOUNT_CONFIG_LOCK_TTL_MS = 10_000;
-const ACCOUNT_CONFIG_LOCK_WAIT_MS = 12_000;
-const ACCOUNT_STATE_LOCK_TTL_MS = 10_000;
-const ACCOUNT_STATE_LOCK_WAIT_MS = 12_000;
-async function acquireAccountWriteLock(input) {
-    const { path, name, ttlMs, waitMs, description } = input;
-    await mkdir(dirname(path), { recursive: true });
-    const deadline = Date.now() + waitMs;
-    while (true) {
-        const lock = await acquireRefreshFileLock({
-            name,
-            ttlMs,
-            path,
-            renew: true,
-        });
-        if (lock)
-            return lock;
-        if (Date.now() >= deadline) {
-            throw new Error(`Timed out waiting for the account ${description} lock`);
-        }
-        await new Promise((resolve) => setTimeout(resolve, 25));
-    }
-}
-function acquireAccountConfigWriteLock(path) {
-    return acquireAccountWriteLock({
-        path,
-        name: 'config-write',
-        ttlMs: ACCOUNT_CONFIG_LOCK_TTL_MS,
-        waitMs: ACCOUNT_CONFIG_LOCK_WAIT_MS,
-        description: 'configuration write',
-    });
-}
-function acquireAccountStateWriteLock(path) {
-    return acquireAccountWriteLock({
-        path,
-        name: 'state-write',
-        ttlMs: ACCOUNT_STATE_LOCK_TTL_MS,
-        waitMs: ACCOUNT_STATE_LOCK_WAIT_MS,
-        description: 'state write',
-    });
-}
-export function saveAccounts(storage, path = getAccountStoragePath(), options = {}) {
-    const resolvedPath = path;
-    return enqueueSave(() => saveAccountsLocked(storage, resolvedPath, options));
-}
-/** Read-modify-write account configuration under the existing config/state lock order.
- * The callback is synchronous: network discovery must happen under its own outer
- * lease, never while holding the config lock. Do not call another persistence API
- * from the callback.
- */
-export function mutateAccountsPersistent(path, mutate, options = {}) {
-    const resolvedPath = resolve(path);
-    return enqueueSave(async () => {
-        const lock = await acquireAccountConfigWriteLock(resolvedPath);
-        try {
-            const current = (await loadAccounts(resolvedPath)) ?? createEmptyStorage();
-            const mutation = mutate(current);
-            if (mutation.save !== false) {
-                await options.assertAuthority?.();
-                await saveAccountsWithConfigLock(mutation.storage, resolvedPath, {
-                    ...mutation.options,
-                    [MUTATE_ACCOUNT_ROSTER]: true,
-                });
-            }
-            return mutation.result;
-        }
-        finally {
-            await lock.release();
-        }
-    });
-}
-export async function getOrCreateMainAccountId(path = getAccountStoragePath(), createId = randomUUID) {
-    return enqueueSave(async () => {
-        const lock = await acquireAccountConfigWriteLock(path);
-        try {
-            const storage = (await loadAccounts(path)) ?? createEmptyStorage();
-            if (storage.mainAccountId)
-                return storage.mainAccountId;
-            const mainAccountId = createId();
-            const nextStorage = { ...storage, mainAccountId };
-            const existing = await loadExistingTopLevelFields(path);
-            await writeJsonAtomic(path, {
-                ...existing,
-                ...configFromStorage(nextStorage),
-            });
-            return mainAccountId;
-        }
-        finally {
-            await lock.release();
-        }
-    });
-}
-async function saveAccountsLocked(storage, path, options) {
-    const lock = await acquireAccountConfigWriteLock(path);
-    try {
-        await saveAccountsWithConfigLock(storage, path, options);
-    }
-    finally {
-        await lock.release();
-    }
-}
-async function saveAccountsWithConfigLock(storage, path, options) {
-    const current = await loadAccounts(path);
-    // A config-only writer may hold a pre-discovery snapshot. It must not
-    // resurrect departed OAuth members or overwrite scoped exclusions.
-    const preserveScopedRoster = current?.claustrum?.scopedRoster === true && !options[MUTATE_ACCOUNT_ROSTER];
-    const mergeOptions = preserveScopedRoster
-        ? {
-            ...options,
-            removedAccountIds: options.removedAccountIds?.filter((id) => current?.accounts.some((account) => account.id === id && isApiKeyAccount(account))),
-        }
-        : options;
-    const nextStorage = {
-        ...storage,
-        ...(storage.claustrum && {
-            claustrum: {
-                ...current?.claustrum,
-                ...storage.claustrum,
-                ...(preserveScopedRoster && current?.claustrum),
-                ...(options[WRITE_CLAUSTRUM_MODE]
-                    ? { mode: storage.claustrum.mode }
-                    : current?.claustrum?.mode
-                        ? { mode: current.claustrum.mode }
-                        : {}),
-            },
-        }),
-        ...(!storage.claustrum &&
-            current?.claustrum && {
-            claustrum: current.claustrum,
-        }),
-        accounts: preserveScopedRoster
-            ? preserveScopedAccountsOnSave(current?.accounts ?? [], storage.accounts, mergeOptions)
-            : mergeAccountsForSave(current?.accounts ?? [], storage.accounts, mergeOptions),
-    };
-    const existing = await loadExistingTopLevelFields(path);
-    const nextConfig = { ...existing, ...configFromStorage(nextStorage) };
-    if (!nextStorage.claustrum)
-        delete nextConfig.claustrum;
-    await writeJsonAtomic(path, nextConfig);
-    // Config precedes state everywhere both locks are needed; reversing this
-    // order can deadlock profile mutations against full account saves.
-    const stateLock = await acquireAccountStateWriteLock(path);
-    try {
-        await saveAccountStateUnlocked(nextStorage, path, {
-            mainQuota: true,
-            mainRefresh: true,
-            accounts: true,
-            setClaustrumHandleAccountIds: options.setClaustrumHandleAccountIds,
-        });
-    }
-    finally {
-        await stateLock.release();
-    }
-}
-function applyMainProfileStatePatch(state, storage) {
-    state.main = state.main ?? {};
-    state.main.profile = storage.main?.profile;
-}
-function applyMainQuotaStatePatch(state, storage) {
-    state.main = state.main ?? {};
-    const incomingError = storage.quota?.mainLastQuotaApiError;
-    const incomingGeneration = typeof storage.quota?.mainQuotaErrorGeneration === 'number' &&
-        Number.isSafeInteger(storage.quota.mainQuotaErrorGeneration) &&
-        storage.quota.mainQuotaErrorGeneration >= 0
-        ? storage.quota.mainQuotaErrorGeneration
-        : undefined;
-    const incomingClearedAt = typeof storage.quota?.mainQuotaErrorClearedAt === 'number' &&
-        Number.isFinite(storage.quota.mainQuotaErrorClearedAt) &&
-        storage.quota.mainQuotaErrorClearedAt >= 0
-        ? storage.quota.mainQuotaErrorClearedAt
-        : undefined;
-    const existingGeneration = typeof state.main.quotaErrorGeneration === 'number' &&
-        Number.isSafeInteger(state.main.quotaErrorGeneration) &&
-        state.main.quotaErrorGeneration >= 0
-        ? state.main.quotaErrorGeneration
-        : 0;
-    const existingErrorObservedAt = typeof state.main.lastQuotaApiError?.checkedAt === 'number' &&
-        Number.isFinite(state.main.lastQuotaApiError.checkedAt) &&
-        state.main.lastQuotaApiError.checkedAt >= 0
-        ? state.main.lastQuotaApiError.checkedAt
-        : undefined;
-    const existingClearedAt = typeof state.main.quotaErrorClearedAt === 'number' &&
-        Number.isFinite(state.main.quotaErrorClearedAt) &&
-        state.main.quotaErrorClearedAt >= 0
-        ? state.main.quotaErrorClearedAt
-        : undefined;
-    const existingObservedAt = Math.max(existingErrorObservedAt ?? 0, existingClearedAt ?? 0);
-    const incomingErrorObservedAt = typeof incomingError?.checkedAt === 'number' &&
-        Number.isFinite(incomingError.checkedAt) &&
-        incomingError.checkedAt >= 0
-        ? incomingError.checkedAt
-        : undefined;
-    // Error transitions are ordered by observation time, not write order. All
-    // instances share one host clock, so an error observed before a clear cannot
-    // resurrect that clear even when both processes allocated the same generation.
-    if (incomingError === undefined &&
-        incomingClearedAt !== undefined &&
-        incomingClearedAt >= existingObservedAt) {
-        state.main.lastQuotaApiError = undefined;
-        state.main.quotaErrorClearedAt = mergeMainQuotaErrorClearedAt(existingClearedAt, incomingClearedAt);
-        if (incomingGeneration !== undefined &&
-            incomingGeneration >= existingGeneration) {
-            state.main.quotaErrorGeneration = incomingGeneration;
-        }
-    }
-    else if (incomingError &&
-        typeof incomingError.checkedAt === 'number' &&
-        Number.isFinite(incomingError.checkedAt) &&
-        incomingError.checkedAt > existingObservedAt) {
-        const acceptsByObservation = incomingErrorObservedAt !== undefined &&
-            incomingErrorObservedAt > existingObservedAt;
-        const acceptsEqualObservation = incomingErrorObservedAt !== undefined &&
-            incomingErrorObservedAt === existingObservedAt &&
-            existingErrorObservedAt !== undefined &&
-            existingClearedAt === undefined &&
-            incomingGeneration !== undefined &&
-            incomingGeneration >= existingGeneration;
-        const acceptsLegacyGeneration = incomingErrorObservedAt === undefined &&
-            incomingClearedAt === undefined &&
-            incomingGeneration !== undefined &&
-            incomingGeneration >= existingGeneration &&
-            existingClearedAt === undefined;
-        if (acceptsByObservation ||
-            acceptsEqualObservation ||
-            acceptsLegacyGeneration) {
-            state.main.lastQuotaApiError = incomingError;
-            if (incomingGeneration !== undefined) {
-                state.main.quotaErrorGeneration = Math.max(existingGeneration, incomingGeneration);
-            }
-        }
-    }
-    const incomingQuota = storage.quota?.mainQuota;
-    const sameToken = Boolean(state.main.quotaToken &&
-        storage.quota?.mainQuotaToken &&
-        state.main.quotaToken === storage.quota.mainQuotaToken);
-    const effectiveIncomingQuota = sameToken && incomingQuota?.source === 'headers'
-        ? mergeHeaderQuotaForPersistence(state.main.quota, incomingQuota)
-        : incomingQuota;
-    const mergesHeaderQuota = Boolean(sameToken && incomingQuota?.source === 'headers');
-    // Ordering authority must travel inside the account-bound snapshot. The
-    // legacy top-level quotaCheckedAt/mainQuotaCheckedAt fields carry no account
-    // identity and can form a mixed pair under concurrent cross-account writes.
-    const existingCheckedAt = quotaSnapshotCheckedAt(state.main.quota);
-    const incomingCheckedAt = quotaSnapshotCheckedAt(effectiveIncomingQuota);
-    if (!mergesHeaderQuota &&
-        (existingCheckedAt > incomingCheckedAt ||
-            (existingCheckedAt === incomingCheckedAt &&
-                quotaSourcePrecedence(state.main.quota) >
-                    quotaSourcePrecedence(effectiveIncomingQuota)))) {
-        return;
-    }
-    state.main.quota = effectiveIncomingQuota;
-    const boundCheckedAt = quotaSnapshotCheckedAt(effectiveIncomingQuota);
-    state.main.quotaCheckedAt = boundCheckedAt > 0 ? boundCheckedAt : undefined;
-    state.main.quotaToken = storage.quota?.mainQuotaToken;
-}
-function applyMainRefreshStatePatch(state, storage) {
-    state.main = state.main ?? {};
-    const incomingError = storage.refresh?.mainLastRefreshError;
-    const incomingClearedAt = storage.refresh?.mainRefreshErrorClearedAt;
-    const existingErrorObservedAt = state.main.lastRefreshError?.checkedAt;
-    const existingClearedAt = state.main.refreshErrorClearedAt;
-    const existingObservedAt = Math.max(existingErrorObservedAt ?? 0, existingClearedAt ?? 0);
-    if (incomingError === undefined &&
-        incomingClearedAt !== undefined &&
-        incomingClearedAt >= existingObservedAt) {
-        state.main.lastRefreshError = undefined;
-        state.main.refreshErrorClearedAt = mergeMainRefreshErrorClearedAt(existingClearedAt, incomingClearedAt);
-    }
-    else if (incomingError &&
-        typeof incomingError.checkedAt === 'number' &&
-        Number.isFinite(incomingError.checkedAt) &&
-        incomingError.checkedAt > existingObservedAt) {
-        state.main.lastRefreshError = incomingError;
-    }
-    state.main.refreshLeaseId = storage.refresh?.mainRefreshLeaseId;
-    state.main.refreshLeaseUntil = storage.refresh?.mainRefreshLeaseUntil;
-    state.main.refreshLeaseTokenHash = storage.refresh?.mainRefreshLeaseTokenHash;
-}
-function applyMainPrimeStatePatch(state, storage) {
-    const incoming = storage.prime?.main;
-    const incomingAuthLineageId = storage.prime?.mainAuthLineageId;
-    const incomingAuthLineageRefreshTokenFingerprint = storage.prime?.mainAuthLineageRefreshTokenFingerprint;
-    if (!incoming &&
-        !incomingAuthLineageId &&
-        !incomingAuthLineageRefreshTokenFingerprint)
-        return;
-    state.main = state.main ?? {};
-    // Last-writer-wins on prime counters — the only writer is the prime manager
-    // itself, monotonically accumulating per success, so there is no race for an
-    // older write to overwrite a newer one within this process. Across processes
-    // the cross-process claim marker (#1247) keeps the fire exclusive.
-    if (incoming)
-        state.main.prime = incoming;
-    if (incomingAuthLineageId) {
-        state.main.primeAuthLineageId = incomingAuthLineageId;
-    }
-    if (incomingAuthLineageRefreshTokenFingerprint) {
-        state.main.primeAuthLineageRefreshTokenFingerprint =
-            incomingAuthLineageRefreshTokenFingerprint;
-    }
-}
-function pruneUndefined(value) {
-    if (Array.isArray(value))
-        return value.map(pruneUndefined);
-    if (!isRecord(value))
-        return value;
-    return Object.fromEntries(Object.entries(value)
-        .filter(([, entry]) => entry !== undefined)
-        .map(([key, entry]) => [key, pruneUndefined(entry)]));
-}
-export function saveAccountState(storage, path = getAccountStoragePath(), scope = {
-    mainProfile: true,
-    mainQuota: true,
-    mainRefresh: true,
-    accounts: true,
-}) {
-    const resolvedPath = path;
-    return enqueueSave(async () => {
-        const lock = await acquireAccountStateWriteLock(resolvedPath);
-        try {
-            await saveAccountStateUnlocked(storage, resolvedPath, scope);
-        }
-        finally {
-            await lock.release();
-        }
-    });
-}
-export function saveOAuthProfileState(input, path = getAccountStoragePath()) {
-    const resolvedPath = path;
-    return enqueueSave(async () => {
-        const configLock = await acquireAccountConfigWriteLock(resolvedPath);
-        try {
-            const stateLock = await acquireAccountStateWriteLock(resolvedPath);
-            try {
-                const current = await loadAccounts(resolvedPath);
-                const statePath = getAccountStatePath(resolvedPath);
-                const existing = (await readJsonIfPresent(statePath)).value;
-                const next = isRecord(existing)
-                    ? { ...existing, version: 1 }
-                    : { version: 1 };
-                const { accountId, accountIdentity, profile } = input;
-                if (current?.claustrum?.scopedRoster &&
-                    getClaustrumMode(current) === 'claustrum') {
-                    const account = current.accounts.find((entry) => entry.id === accountId);
-                    const expected = accountId === 'main'
-                        ? current.claustrum.primaryAccount?.accountId
-                        : account && isOAuthAccount(account)
-                            ? account.anthropicAccountUuid
-                            : undefined;
-                    if (!expected ||
-                        accountIdentity !== expected ||
-                        (profile?.accountIdentity !== undefined &&
-                            profile.accountIdentity !== expected) ||
-                        (profile?.providerAccountUuid !== undefined &&
-                            profile.providerAccountUuid !== expected))
-                        return false;
-                }
-                if (accountId === 'main') {
-                    next.main = { ...(next.main ?? {}) };
-                    const existingProfile = normalizeOAuthAccountProfile(next.main.profile);
-                    if (!profile) {
-                        if (existingProfile &&
-                            (accountIdentity === undefined ||
-                                existingProfile.accountIdentity === undefined ||
-                                existingProfile.accountIdentity === accountIdentity)) {
-                            return false;
-                        }
-                        next.main.profile = undefined;
-                        return await writeJsonAtomic(statePath, pruneUndefined(next)).then(() => true);
-                    }
-                    if (profile.accountIdentity !== undefined &&
-                        profile.accountIdentity !== accountIdentity) {
-                        return false;
-                    }
-                    const persistedProfile = accountIdentity === undefined ||
-                        profile.accountIdentity === accountIdentity
-                        ? profile
-                        : { ...profile, accountIdentity };
-                    if (existingProfile &&
-                        (accountIdentity === undefined ||
-                            existingProfile.accountIdentity === undefined ||
-                            existingProfile.accountIdentity === accountIdentity) &&
-                        existingProfile.checkedAt > persistedProfile.checkedAt) {
-                        return false;
-                    }
-                    next.main.profile = persistedProfile;
-                }
-                else {
-                    const account = current?.accounts.find((candidate) => candidate.id === accountId && isOAuthAccount(candidate));
-                    if (!account)
-                        return false;
-                    next.accounts = {
-                        ...(isRecord(next.accounts) ? next.accounts : {}),
-                    };
-                    const existingEntry = isRecord(next.accounts[accountId])
-                        ? { ...next.accounts[accountId] }
-                        : {};
-                    const existingProfile = normalizeOAuthAccountProfile(existingEntry.profile);
-                    if (!profile) {
-                        if (existingProfile &&
-                            (accountIdentity === undefined ||
-                                existingProfile.accountIdentity === undefined ||
-                                existingProfile.accountIdentity === accountIdentity)) {
-                            return false;
-                        }
-                        existingEntry.profile = undefined;
-                    }
-                    else {
-                        if (profile.accountIdentity !== undefined &&
-                            profile.accountIdentity !== accountIdentity) {
-                            return false;
-                        }
-                        const persistedProfile = accountIdentity === undefined ||
-                            profile.accountIdentity === accountIdentity
-                            ? profile
-                            : { ...profile, accountIdentity };
-                        if (existingProfile &&
-                            (accountIdentity === undefined ||
-                                existingProfile.accountIdentity === undefined ||
-                                existingProfile.accountIdentity === accountIdentity) &&
-                            existingProfile.checkedAt > persistedProfile.checkedAt) {
-                            return false;
-                        }
-                        existingEntry.profile = persistedProfile;
-                    }
-                    next.accounts[accountId] = existingEntry;
-                }
-                await writeJsonAtomic(statePath, pruneUndefined(next));
-                return true;
-            }
-            finally {
-                await stateLock.release();
-            }
-        }
-        finally {
-            await configLock.release();
-        }
-    });
-}
-export function clearClaustrumRefreshErrorPersistent(accountId, handle, path = getAccountStoragePath()) {
-    return enqueueSave(async () => {
-        const configLock = await acquireAccountConfigWriteLock(path);
-        try {
-            const stateLock = await acquireAccountStateWriteLock(path);
-            try {
-                // Re-read under both locks so this field-scoped clear cannot write a stale credential or config snapshot.
-                const storage = await loadAccounts(path);
-                const account = storage?.accounts.find((candidate) => candidate.id === accountId && isOAuthAccount(candidate));
-                if (!storage ||
-                    !account ||
-                    account.claustrumHandle !== handle ||
-                    !account.lastRefreshError) {
-                    return false;
-                }
-                account.lastRefreshError = undefined;
-                await saveAccountStateUnlocked(storage, path, { accounts: [accountId] });
-                const statePath = getAccountStatePath(path);
-                const state = (await readJsonIfPresent(statePath)).value;
-                if (isRecord(state) && isRecord(state.accounts)) {
-                    const entry = state.accounts[accountId];
-                    if (isRecord(entry)) {
-                        delete entry.lastRefreshError;
-                        await writeJsonAtomic(statePath, pruneUndefined(state));
-                    }
-                }
-                return true;
-            }
-            finally {
-                await stateLock.release();
-            }
-        }
-        finally {
-            await configLock.release();
-        }
-    });
-}
-function fenceScopedPrimaryState(state, primaryId) {
-    if (!isRecord(state.main))
-        state.main = {};
-    const main = state.main;
-    if (!primaryId || main.scopedAccountIdentity !== primaryId) {
-        delete main.prime;
-        delete main.primeAuthLineageId;
-        delete main.primeAuthLineageRefreshTokenFingerprint;
-        delete main.quotaErrorGeneration;
-        delete main.quotaErrorClearedAt;
-    }
-    main.scopedAccountIdentity = primaryId;
-    if (!primaryId || main.quota?.accountIdentity !== primaryId) {
-        delete main.quota;
-        delete main.quotaCheckedAt;
-        delete main.quotaToken;
-    }
-    if (!primaryId || main.lastQuotaApiError?.accountIdentity !== primaryId)
-        delete main.lastQuotaApiError;
-    if (!primaryId ||
-        (main.profile?.providerAccountUuid ?? main.profile?.accountIdentity) !==
-            primaryId) {
-        delete main.profile;
-        delete main.profileToken;
-    }
-    delete main.lastRefreshError;
-    delete main.refreshErrorClearedAt;
-    delete main.refreshLeaseId;
-    delete main.refreshLeaseUntil;
-    delete main.refreshLeaseTokenHash;
-}
-async function saveAccountStateUnlocked(storage, path, scope) {
-    const statePath = getAccountStatePath(path);
-    const existing = (await readJsonIfPresent(statePath)).value;
-    const next = isRecord(existing)
-        ? { ...existing, version: 1 }
-        : { version: 1 };
-    const persistedConfig = (await readJsonIfPresent(path)).value;
-    const authority = isRecord(persistedConfig)
-        ? normalizeClaustrumConfig(persistedConfig.claustrum)
-        : undefined;
-    const scoped = authority?.mode === 'claustrum' && authority.scopedRoster === true;
-    const primaryId = authority?.primaryAccount?.accountId;
-    const samePrimary = Boolean(primaryId && storage.claustrum?.primaryAccount?.accountId === primaryId);
-    if (scoped)
-        fenceScopedPrimaryState(next, primaryId);
-    const incomingProfileId = storage.main?.profile?.providerAccountUuid ??
-        storage.main?.profile?.accountIdentity;
-    if (scope.mainProfile &&
-        (!scoped ||
-            (samePrimary &&
-                (!storage.main?.profile || incomingProfileId === primaryId))))
-        applyMainProfileStatePatch(next, storage);
-    const quotaMatches = samePrimary &&
-        (!storage.quota?.mainQuota ||
-            storage.quota.mainQuota.accountIdentity === primaryId) &&
-        (!storage.quota?.mainLastQuotaApiError ||
-            storage.quota.mainLastQuotaApiError.accountIdentity === primaryId);
-    if (scope.mainQuota && (!scoped || quotaMatches)) {
-        applyMainQuotaStatePatch(next, scoped
-            ? { ...storage, quota: { ...storage.quota, mainQuotaToken: primaryId } }
-            : storage);
-    }
-    if (scope.mainRefresh && !scoped)
-        applyMainRefreshStatePatch(next, storage);
-    if (scope.mainPrime && (!scoped || samePrimary))
-        applyMainPrimeStatePatch(next, storage);
-    if (scope.accounts) {
-        const ids = scope.accounts === true ? null : new Set(scope.accounts);
-        const setClaustrumHandleAccountIds = new Set(scope.setClaustrumHandleAccountIds ?? []);
-        const config = persistedConfig;
-        const configAccounts = isRecord(config) && Array.isArray(config.accounts)
-            ? new Map(config.accounts
-                .filter(isRecord)
-                .map((entry) => [String(entry.id ?? '').trim(), entry]))
-            : new Map();
-        const configuredIds = (() => {
-            if (!isRecord(config) || !Array.isArray(config.accounts))
-                return null;
-            if (config.accounts.length === 0)
-                return new Set();
-            const stateAccounts = isRecord(next.accounts) ? next.accounts : {};
-            const incomingAccounts = Object.fromEntries(storage.accounts.map((account) => [
-                account.id.trim(),
-                accountRuntimeState(account),
-            ]));
-            // Keep both forms because legacy state may still use either key while
-            // scoped saves must preserve entries not superseded by an incoming account.
-            const memberships = config.accounts.map((account) => {
-                if (!isRecord(account) || typeof account.id !== 'string')
-                    return null;
-                const id = account.id.trim();
-                if (!id)
-                    return null;
-                if (configAccountHasInvalidShape(account))
-                    return null;
-                const stateValue = stateAccounts[account.id] ?? stateAccounts[id];
-                const stateAccount = isRecord(stateValue)
-                    ? stateValue
-                    : {};
-                const incomingAccount = incomingAccounts[id];
-                return normalizeAccount(mergeConfigAccountAndState(account, incomingAccount ?? stateAccount))
-                    ? [account.id, id]
-                    : null;
-            });
-            // A populated config with any unparseable entry cannot establish safe membership.
-            return memberships.every((membership) => membership !== null)
-                ? new Set(memberships.flatMap((membership) => membership ?? []))
-                : null;
-        })();
-        next.accounts = { ...(isRecord(next.accounts) ? next.accounts : {}) };
-        for (const account of storage.accounts) {
-            const accountId = account.id.trim();
-            if (ids && !ids.has(account.id) && !ids.has(accountId))
-                continue;
-            if (configuredIds &&
-                !configuredIds.has(account.id) &&
-                !configuredIds.has(accountId))
-                continue;
-            const legacyKeys = Object.keys(next.accounts).filter((key) => key !== accountId && key.trim() === accountId);
-            const legacyKey = legacyKeys[0];
-            const existingAccount = next.accounts[accountId] ??
-                (legacyKey ? next.accounts[legacyKey] : undefined);
-            for (const key of legacyKeys)
-                delete next.accounts[key];
-            const configured = configAccounts.get(accountId);
-            if (configured &&
-                typeof configured.claustrumScopedCredentialId === 'string' &&
-                typeof configured.anthropicAccountUuid === 'string') {
-                const matches = (value) => isRecord(value) &&
-                    value.claustrumScopedCredentialId ===
-                        configured.claustrumScopedCredentialId &&
-                    value.anthropicAccountUuid === configured.anthropicAccountUuid;
-                const incoming = accountRuntimeState(account);
-                const merged = mergeAccountRuntimeState(matches(existingAccount) ? existingAccount : undefined, matches(incoming) ? incoming : {});
-                // The current config owns identity. Older local writers cannot restore
-                // credentials, handles or another account's observations after cutover.
-                next.accounts[accountId] = {
-                    ...merged,
-                    claustrumScopedCredentialId: configured.claustrumScopedCredentialId,
-                    anthropicAccountUuid: configured.anthropicAccountUuid,
-                    refresh: '',
-                };
-                const scoped = next.accounts[accountId];
-                delete scoped.access;
-                delete scoped.expires;
-                delete scoped.lastRefreshedAt;
-                delete scoped.lastRefreshError;
-                delete scoped.claustrumHandle;
-            }
-            else {
-                const merged = mergeAccountRuntimeState(existingAccount, accountRuntimeState(account), setClaustrumHandleAccountIds.has(account.id) ||
-                    setClaustrumHandleAccountIds.has(accountId));
-                if (configured) {
-                    delete merged.claustrumScopedCredentialId;
-                    delete merged.claustrumScopedState;
-                }
-                next.accounts[accountId] = merged;
-            }
-        }
-        if (configuredIds) {
-            // Config membership is authoritative for scoped writes too; otherwise a
-            // stale writer can preserve state for an account removed out of band.
-            for (const id of Object.keys(next.accounts)) {
-                if (!configuredIds.has(id))
-                    delete next.accounts[id];
-            }
-        }
-        if (ids) {
-            for (const id of ids) {
-                if (!storage.accounts.some((account) => account.id === id)) {
-                    delete next.accounts[id];
-                }
-            }
-        }
-    }
-    await writeJsonAtomic(statePath, pruneUndefined(next));
-}
-export async function acquireRefreshFileLock(options) {
-    const accountPath = options.path ?? getAccountStoragePath();
-    const lockPath = `${accountPath}.${options.name}.lock`;
-    const legacyOwnerPath = join(lockPath, 'owner.json');
-    const ownerId = randomUUID();
-    const now = options.now ?? Date.now;
-    let renewTimer = null;
-    let released = false;
-    async function readOwner() {
-        try {
-            return JSON.parse(await readFile(lockPath, 'utf8'));
-        }
-        catch (error) {
-            const code = error.code;
-            if (code !== 'EISDIR')
-                throw error;
-            return JSON.parse(await readFile(legacyOwnerPath, 'utf8'));
-        }
-    }
-    async function writeOwner() {
-        await writeFile(lockPath, `${JSON.stringify({ ownerId, expiresAt: now() + options.ttlMs })}\n`, { encoding: 'utf8', mode: 0o600 });
-    }
-    async function tryAcquire() {
-        try {
-            await writeFile(lockPath, `${JSON.stringify({ ownerId, expiresAt: now() + options.ttlMs })}\n`, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
-            return true;
-        }
-        catch (error) {
-            const code = error.code;
-            if (code === 'EEXIST' || code === 'EISDIR')
-                return false;
-            throw error;
-        }
-    }
-    function scheduleRenewal() {
-        if (!options.renew || released)
-            return;
-        const intervalMs = options.renewIntervalMs ?? Math.max(1_000, Math.floor(options.ttlMs / 3));
-        renewTimer = setRefreshLockRenewalTimeout(() => {
-            void (async () => {
-                try {
-                    const owner = await readOwner();
-                    const currentNow = now();
-                    if (released ||
-                        owner?.ownerId !== ownerId ||
-                        Number(owner?.expiresAt) <= currentNow) {
-                        return;
-                    }
-                    await writeOwner();
-                    scheduleRenewal();
-                }
-                catch {
-                    // If renewal fails, contenders will wait until the last written expiry.
-                }
-            })();
-        }, intervalMs);
-        if ('unref' in renewTimer)
-            renewTimer.unref();
-    }
-    let acquired = await tryAcquire();
-    if (!acquired) {
-        const evictPath = `${lockPath}.evicting`;
-        const evictOwnerPath = join(evictPath, 'owner.json');
-        const evictOwnerId = randomUUID();
-        const EVICT_TTL = 5_000;
-        const MAX_STEAL_ATTEMPTS = 8;
-        async function backoff() {
-            await new Promise((resolve) => setTimeout(resolve, Math.floor(Math.random() * 4)));
-        }
-        async function lockIsLive() {
-            try {
-                const currentOwner = await readOwner();
-                return Number(currentOwner?.expiresAt) > now();
-            }
-            catch {
-                try {
-                    const current = await stat(lockPath);
-                    return current.mtimeMs + options.ttlMs > now();
-                }
-                catch {
-                    // Lock doesn't exist — safe to acquire.
-                    return false;
-                }
-            }
-        }
-        async function ownsEvictionMarker() {
-            try {
-                const owner = JSON.parse(await readFile(evictOwnerPath, 'utf8'));
-                return owner?.ownerId === evictOwnerId;
-            }
-            catch {
-                return false;
-            }
-        }
-        async function tryAcquireEvictionMarker() {
-            await mkdir(evictPath);
-            try {
-                await writeFile(evictOwnerPath, `${JSON.stringify({ ownerId: evictOwnerId, createdAt: now() })}\n`, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
-            }
-            catch (error) {
-                const code = error.code;
-                // Another contender can rename the marker directory between mkdir and
-                // this exclusive create. Darwin/Bun reports that lost-parent race as
-                // either ENOENT or EINVAL; both mean this contender lost the marker.
-                if (code === 'ENOENT' || code === 'EINVAL')
-                    return false;
-                await releaseEvictionMarker();
-                throw error;
-            }
-            await options.onStep?.('eviction-marker-acquired');
-            return true;
-        }
-        async function releaseEvictionMarker() {
-            if (await ownsEvictionMarker()) {
-                await rm(evictPath, { recursive: true, force: true }).catch(() => { });
-            }
-        }
-        for (let attempt = 0; attempt < MAX_STEAL_ATTEMPTS; attempt++) {
-            acquired = await tryAcquire();
-            if (acquired)
-                break;
-            if (await lockIsLive())
-                return null;
-            try {
-                if (!(await tryAcquireEvictionMarker())) {
-                    await backoff();
-                    continue;
-                }
-            }
-            catch (evictError) {
-                const code = evictError.code;
-                if (code !== 'EEXIST')
-                    throw evictError;
-                let evictStat;
-                try {
-                    evictStat = await stat(evictPath);
-                }
-                catch (statError) {
-                    if (statError.code === 'ENOENT') {
-                        await backoff();
-                        continue;
-                    }
-                    throw statError;
-                }
-                if (evictStat.mtimeMs + EVICT_TTL > now())
-                    return null;
-                await options.onStep?.('stale-marker-stat');
-                const claimedPath = `${evictPath}.${randomUUID()}`;
-                try {
-                    await rename(evictPath, claimedPath);
-                }
-                catch (renameError) {
-                    if (renameError.code === 'ENOENT') {
-                        await backoff();
-                        continue;
-                    }
-                    throw renameError;
-                }
-                await options.onStep?.('stale-marker-claimed');
-                await rm(claimedPath, { recursive: true, force: true }).catch(() => { });
-                await backoff();
-                continue;
-            }
-            try {
-                if (await lockIsLive())
-                    return null;
-                if (!(await ownsEvictionMarker()))
-                    return null;
-                await options.onStep?.('stale-lock-confirmed');
-                if (!(await ownsEvictionMarker()))
-                    return null;
-                await rm(lockPath, { recursive: true, force: true }).catch(() => { });
-                if (!(await ownsEvictionMarker()))
-                    return null;
-                acquired = await tryAcquire();
-                if (!acquired)
-                    return null;
-                if (!(await ownsEvictionMarker())) {
-                    await rm(lockPath, { recursive: true, force: true }).catch(() => { });
-                    acquired = false;
-                    return null;
-                }
-                break;
-            }
-            finally {
-                await releaseEvictionMarker();
-            }
-        }
-    }
-    if (!acquired)
-        return null;
-    scheduleRenewal();
-    return {
-        assertOwned: async () => {
-            const owner = await readOwner().catch(() => undefined);
-            if (released || owner?.ownerId !== ownerId) {
-                throw new Error('Account file lock ownership was lost');
-            }
-        },
-        release: async () => {
-            released = true;
-            if (renewTimer) {
-                clearRefreshLockRenewalTimeout(renewTimer);
-                renewTimer = null;
-            }
-            try {
-                const owner = await readOwner();
-                if (owner?.ownerId !== ownerId)
-                    return;
-            }
-            catch {
-                return;
-            }
-            await rm(lockPath, { recursive: true, force: true }).catch(() => { });
-        },
-    };
-}
-export function isCache1hPersistentlyEnabled(storage) {
-    return storage?.claudeCache?.enabled === true;
-}
-function normalizeCache1hMode(value) {
-    return typeof value === 'string' &&
-        CACHE_1H_MODES.includes(value)
-        ? value
-        : DEFAULT_CACHE_1H_MODE;
-}
-export function getCache1hPersistentMode(storage) {
-    return normalizeCache1hMode(storage?.claudeCache?.mode);
-}
-export async function setCache1hPersistentEnabled(enabled, mode, path = getAccountStoragePath()) {
-    const storage = (await loadAccounts(path)) ?? createEmptyStorage();
-    storage.claudeCache = {
-        ...(storage.claudeCache ?? {}),
-        enabled,
-        mode: mode ?? getCache1hPersistentMode(storage),
-    };
-    await saveAccounts(storage, path);
-    return storage;
-}
-export async function setCache1hPersistentMode(mode, path = getAccountStoragePath()) {
-    const storage = (await loadAccounts(path)) ?? createEmptyStorage();
-    storage.claudeCache = {
-        ...(storage.claudeCache ?? {}),
-        enabled: storage.claudeCache?.enabled === true,
-        mode,
-    };
-    await saveAccounts(storage, path);
-    return storage;
-}
-export function isDumpPersistentlyEnabled(storage) {
-    return storage?.dump?.enabled === true;
-}
-export async function setDumpPersistentEnabled(enabled, path = getAccountStoragePath()) {
-    const storage = (await loadAccounts(path)) ?? createEmptyStorage();
-    storage.dump = {
-        ...(storage.dump ?? {}),
-        enabled,
-    };
-    await saveAccounts(storage, path);
-    return storage;
-}
-export function isFastModePersistentlyEnabled(storage) {
-    return storage?.claudeFast?.enabled === true;
-}
-export async function setFastModePersistentEnabled(enabled, path = getAccountStoragePath()) {
-    const storage = (await loadAccounts(path)) ?? createEmptyStorage();
-    storage.claudeFast = {
-        ...(storage.claudeFast ?? {}),
-        enabled,
-    };
-    await saveAccounts(storage, path);
-    return storage;
-}
-export async function setCacheKeepPersistentWindow(startHour, endHour, path = getAccountStoragePath()) {
-    const storage = (await loadAccounts(path)) ?? createEmptyStorage();
-    storage.cacheKeep = {
-        ...(storage.cacheKeep ?? {}),
-        enabled: true,
-        always: false,
-        startHour,
-        endHour,
-    };
-    await saveAccounts(storage, path);
-    return storage;
-}
-export async function setCacheKeepPersistentAlways(path = getAccountStoragePath()) {
-    const storage = (await loadAccounts(path)) ?? createEmptyStorage();
-    storage.cacheKeep = {
-        ...(storage.cacheKeep ?? {}),
-        enabled: true,
-        always: true,
-    };
-    delete storage.cacheKeep.startHour;
-    delete storage.cacheKeep.endHour;
-    await saveAccounts(storage, path);
-    return storage;
-}
-export async function setCacheKeepPersistentEnabled(enabled, path = getAccountStoragePath()) {
-    const storage = (await loadAccounts(path)) ?? createEmptyStorage();
-    storage.cacheKeep = {
-        ...(storage.cacheKeep ?? {}),
-        enabled,
-    };
-    await saveAccounts(storage, path);
-    return storage;
-}
-export function isCacheKeepSubagentsEnabled(storage) {
-    return storage?.cacheKeep?.subagents === true;
-}
-export async function setCacheKeepSubagentsEnabled(enabled, path = getAccountStoragePath()) {
-    const storage = (await loadAccounts(path)) ?? createEmptyStorage();
-    storage.cacheKeep = {
-        ...(storage.cacheKeep ?? {}),
-        subagents: enabled,
-    };
-    await saveAccounts(storage, path);
-    return storage;
-}
-export function isPrimePersistentlyEnabled(storage) {
-    return storage?.prime?.enabled === true;
-}
-export async function setPrimePersistentEnabled(enabled, path = getAccountStoragePath()) {
-    const storage = (await loadAccounts(path)) ?? createEmptyStorage();
-    storage.prime = {
-        ...(storage.prime ?? {}),
-        enabled,
-    };
-    await saveAccounts(storage, path);
-    return storage;
-}
-/** Return the stable prime marker identity for an OAuth account. */
-export async function getOrCreatePrimeAuthLineageId(accountId, path = getAccountStoragePath()) {
-    return enqueueSave(async () => {
-        const configLock = await acquireAccountConfigWriteLock(path);
-        try {
-            const stateLock = await acquireAccountStateWriteLock(path);
-            try {
-                const storage = (await loadAccounts(path)) ?? createEmptyStorage();
-                if (accountId === 'main') {
-                    const existing = storage.prime?.mainAuthLineageId;
-                    if (existing)
-                        return existing;
-                    const mainAccountId = storage.mainAccountId ?? randomUUID();
-                    if (!storage.mainAccountId) {
-                        const existingConfig = await loadExistingTopLevelFields(path);
-                        await writeJsonAtomic(path, {
-                            ...existingConfig,
-                            ...configFromStorage({ ...storage, mainAccountId }),
-                        });
-                        storage.mainAccountId = mainAccountId;
-                    }
-                    storage.prime = {
-                        ...(storage.prime ?? {}),
-                        mainAuthLineageId: mainAccountId,
-                    };
-                    await saveAccountStateUnlocked(storage, path, { mainPrime: true });
-                    return mainAccountId;
-                }
-                const account = storage.accounts.find((candidate) => candidate.id === accountId && isOAuthAccount(candidate));
-                if (!account) {
-                    throw new Error(`getOrCreatePrimeAuthLineageId: OAuth account "${accountId}" not found`);
-                }
-                if (account.authLineageId)
-                    return account.authLineageId;
-                // Upgrading changes the marker namespace once, so an already-primed
-                // window may fire again; persisting the seed prevents every later token
-                // rotation from repeating that migration cost.
-                const authLineageId = randomUUID();
-                account.authLineageId = authLineageId;
-                await saveAccountStateUnlocked(storage, path, {
-                    accounts: [accountId],
-                });
-                return authLineageId;
-            }
-            finally {
-                await stateLock.release();
-            }
-        }
-        finally {
-            await configLock.release();
-        }
-    });
-}
-/**
- * Atomically increment an account's cumulative prime counters and persist via
- * the scoped runtime-state path. The `main` account lives at state.main.prime;
- * every other account lives at state.accounts[id].prime. Config-side writes
- * are intentionally NOT triggered so prime counters cannot leak into
- * `anthropic-auth.json`. Callers should not depend on this function to mutate
- * the caller's storage object.
- */
-export async function incrementPrimeUsagePersistent(accountId, usage, path = getAccountStoragePath(), now = Date.now()) {
-    const inputTokens = Number.isFinite(usage?.inputTokens)
-        ? Math.max(0, Math.floor(usage.inputTokens))
-        : 0;
-    const outputTokens = Number.isFinite(usage?.outputTokens)
-        ? Math.max(0, Math.floor(usage.outputTokens))
-        : 0;
-    return enqueueSave(async () => {
-        // The config-write lock is the repository-wide outer lock for config and
-        // runtime-state RMW operations; taking it before the state write preserves
-        // saveAccountsLocked's config → state ordering across processes.
-        const lock = await acquireAccountConfigWriteLock(path);
-        try {
-            const stateLock = await acquireAccountStateWriteLock(path);
-            try {
-                const storage = (await loadAccounts(path)) ?? createEmptyStorage();
-                if (accountId === 'main') {
-                    const existing = storage.prime?.main;
-                    const next = {
-                        count: (existing?.count ?? 0) + 1,
-                        inputTokens: (existing?.inputTokens ?? 0) + inputTokens,
-                        outputTokens: (existing?.outputTokens ?? 0) + outputTokens,
-                        since: existing?.since ?? Math.floor(now),
-                    };
-                    storage.prime = { ...(storage.prime ?? {}), main: next };
-                    await saveAccountStateUnlocked(storage, path, { mainPrime: true });
-                    return next;
-                }
-                const index = storage.accounts.findIndex((account) => account.id === accountId);
-                if (index < 0) {
-                    throw new Error(`incrementPrimeUsagePersistent: account "${accountId}" not found`);
-                }
-                const account = storage.accounts[index];
-                const existing = account.prime;
-                const next = {
-                    count: (existing?.count ?? 0) + 1,
-                    inputTokens: (existing?.inputTokens ?? 0) + inputTokens,
-                    outputTokens: (existing?.outputTokens ?? 0) + outputTokens,
-                    since: existing?.since ?? Math.floor(now),
-                };
-                storage.accounts[index] = { ...account, prime: next };
-                await saveAccountStateUnlocked(storage, path, {
-                    accounts: [accountId],
-                });
-                return next;
-            }
-            finally {
-                await stateLock.release();
-            }
-        }
-        finally {
-            await lock.release();
-        }
-    });
-}
-function getFallbackStatuses(storage) {
-    return storage?.fallbackOn?.length ? storage.fallbackOn : DEFAULT_FALLBACK_ON;
-}
-export function shouldFallbackStatus(status, storage) {
-    return getFallbackStatuses(storage).includes(status);
-}
-export function getQuotaMinimumRemainingThresholds(storage) {
-    const configured = storage?.quota?.minimumRemaining || {};
-    return {
-        five_hour: configured.five_hour ??
-            configured['5h'] ??
-            DEFAULT_MINIMUM_REMAINING.five_hour,
-        seven_day: configured.seven_day ??
-            configured['1w'] ??
-            DEFAULT_MINIMUM_REMAINING.seven_day,
-    };
-}
-function quotaEnabled(storage) {
-    return storage?.quota?.enabled !== false;
-}
-function refreshEnabled(storage) {
-    return storage?.refresh?.enabled !== false;
-}
-function jitterMs(maxMs) {
-    return Math.floor(Math.random() * Math.max(0, maxMs));
-}
-function refreshBeforeExpiryMs(storage) {
-    const minutes = storage?.refresh?.refreshBeforeExpiryMinutes ??
-        DEFAULT_REFRESH_BEFORE_EXPIRY_MINUTES;
-    return Math.max(MIN_REFRESH_BEFORE_EXPIRY_MINUTES, minutes) * 60_000;
-}
-export function getRefreshBeforeExpiryMs(storage) {
-    return refreshBeforeExpiryMs(storage);
-}
-export function getRefreshIntervalMs(storage) {
-    const minutes = storage?.refresh?.intervalMinutes ?? DEFAULT_REFRESH_INTERVAL_MINUTES;
-    return Math.max(1, minutes) * 60_000;
-}
-export function hashRefreshToken(refreshToken) {
-    return createHash('sha256').update(refreshToken).digest('hex');
-}
-function isTransientRefreshError(error) {
-    const status = error.status;
-    if (typeof status === 'number' && Number.isFinite(status)) {
-        return status === 429 || status >= 500;
-    }
-    return isTransientNetworkError(error);
-}
-export function buildRefreshOperationError(input) {
-    const previousRetryCount = input.previous?.accountIdentity === input.accountIdentity &&
-        input.previous?.refreshTokenFingerprint === input.refreshTokenFingerprint
-        ? (input.previous?.retryCount ?? 0)
-        : 0;
-    const retryCount = previousRetryCount + 1;
-    const retryAfterFromError = input.error
-        .retryAfter;
-    let delay;
-    if (typeof retryAfterFromError === 'number' && retryAfterFromError > 0) {
-        delay = retryAfterFromError * 1000;
-    }
-    else if (isTransientNetworkError(input.error)) {
-        delay = MIN_REFRESH_RETRY_DELAY_MS;
-    }
-    else if (isTransientRefreshError(input.error)) {
-        delay = Math.min(MAX_REFRESH_RETRY_DELAY_MS, MIN_REFRESH_RETRY_DELAY_MS * 2 ** Math.min(retryCount - 1, 6));
-    }
-    else {
-        delay = NON_TRANSIENT_REFRESH_RETRY_DELAY_MS;
-    }
-    const statusFromError = input.error.status;
-    const status = typeof statusFromError === 'number' && Number.isFinite(statusFromError)
-        ? statusFromError
-        : undefined;
-    const message = formatErrorMessage(input.error);
-    // A token is permanently dead ONLY on 400 invalid_grant. The OAuth spec allows
-    // other 400s (invalid_client / invalid_request / unsupported_grant_type) that
-    // re-login does NOT fix — those must stay permanent=false so they are not
-    // falsely flagged "needs re-login". Network failures use a fixed five-minute
-    // retry interval so connectivity recovery cannot inherit an hour-long backoff.
-    // ClaudeOAuthRefreshError carries the raw
-    // OAuth body, and its message embeds it (`...: 400 — <body>`), so check both.
-    const body = typeof input.error.body === 'string'
-        ? input.error.body
-        : '';
-    const isInvalidGrant = body.includes('invalid_grant') || message.includes('invalid_grant');
-    return {
-        message,
-        checkedAt: input.now,
-        nextRetryAt: input.now + delay,
-        retryCount,
-        accountIdentity: input.accountIdentity,
-        refreshTokenFingerprint: input.refreshTokenFingerprint,
-        status,
-        permanent: status === 400 && isInvalidGrant,
-    };
-}
-/**
- * True when a refresh error means the token is permanently dead and the account
- * needs a re-login (vs a transient failure that recovers).
- *
- * Precedence:
- *  1. the explicit `permanent` flag (set at construction from 400 invalid_grant)
- *     — the authoritative signal; correctly classifies a retry-exhausted/network
- *     error (long backoff, but NOT dead) as non-permanent;
- *  2. else the captured HTTP `status` — 400 (for errors built before `permanent`
- *     existed but after `status`);
- *  3. else the legacy 24h-delay heuristic — back-compat ONLY for errors persisted
- *     before either field existed (e.g. an operator's already-dead token: no
- *     status, ~24h backoff). It still flags those until the next refresh restamps
- *     the error with the explicit field.
- */
-export function isPermanentRefreshError(error) {
-    if (!error)
-        return false;
-    if (typeof error.permanent === 'boolean')
-        return error.permanent;
-    if (typeof error.status === 'number')
-        return error.status === 400;
-    if (isTransientNetworkError(error))
-        return false;
-    if (typeof error.nextRetryAt === 'number') {
-        return (error.nextRetryAt - error.checkedAt >=
-            NON_TRANSIENT_REFRESH_RETRY_DELAY_MS);
-    }
-    return false;
-}
-function effectiveRefreshRetryAt(error) {
-    const persistedRetryAt = error.nextRetryAt;
-    if (!persistedRetryAt || !isTransientNetworkError(error)) {
-        return persistedRetryAt;
-    }
-    return Math.min(persistedRetryAt, error.checkedAt + MIN_REFRESH_RETRY_DELAY_MS);
-}
-export function refreshBackoffActive(error, accountIdentity, now, currentRefreshTokenFingerprint) {
-    if (!error)
-        return false;
-    const retryAt = effectiveRefreshRetryAt(error);
-    if (!retryAt || retryAt <= now)
-        return false;
-    if (error.refreshTokenFingerprint &&
-        currentRefreshTokenFingerprint &&
-        error.refreshTokenFingerprint !== currentRefreshTokenFingerprint) {
-        return false;
-    }
-    if (!error.accountIdentity)
-        return true;
-    if (!accountIdentity)
-        return true;
-    return error.accountIdentity === accountIdentity;
-}
-export function formatRefreshBackoffMessage(error, now) {
-    const seconds = Math.max(1, Math.ceil(((effectiveRefreshRetryAt(error) ?? now) - now) / 1000));
-    return `Claude OAuth refresh is backed off for ${seconds}s after: ${error.message}`;
-}
-function createRefreshBackoffActiveError(error, now) {
-    return Object.assign(new Error(formatRefreshBackoffMessage(error, now)), {
-        refreshBackoffError: error,
-    });
-}
-function existingRefreshBackoffError(error) {
-    if (!error || typeof error !== 'object')
-        return undefined;
-    const existing = error
-        .refreshBackoffError;
-    return existing && typeof existing.message === 'string' ? existing : undefined;
-}
-export function getFallbackReauthLabels(storage) {
-    if (!storage)
-        return [];
-    return storage.accounts
-        .filter((account) => account.enabled !== false &&
-        isOAuthAccount(account) &&
-        isPermanentRefreshError(account.lastRefreshError))
-        .map((account) => account.label?.trim() || account.id);
-}
-export function isQuotaPolicyAuthError(error) {
-    const status = error.status;
-    if (status === 403)
-        return true;
-    return /Claude quota check failed: 403\b/.test(formatErrorMessage(error));
-}
-export function buildQuotaOperationError(input) {
-    const previousRetryCount = input.previous?.accountIdentity === input.accountIdentity
-        ? (input.previous?.retryCount ?? 0)
-        : 0;
-    const retryCount = previousRetryCount + 1;
-    const delay = isTransientQuotaError(input.error)
-        ? Math.min(MAX_QUOTA_RETRY_DELAY_MS, MIN_QUOTA_RETRY_DELAY_MS * 2 ** Math.min(retryCount - 1, 6))
-        : NON_TRANSIENT_QUOTA_RETRY_DELAY_MS;
-    return {
-        message: formatErrorMessage(input.error),
-        checkedAt: input.now,
-        nextRetryAt: input.now + delay,
-        retryCount,
-        ...(input.accountIdentity !== undefined && {
-            accountIdentity: input.accountIdentity,
-        }),
-    };
-}
-export function quotaBackoffActive(error, now) {
-    if (!error?.nextRetryAt || error.nextRetryAt <= now)
-        return false;
-    return true;
-}
-export function formatQuotaBackoffMessage(error, now) {
-    const seconds = Math.max(1, Math.ceil(((error.nextRetryAt ?? now) - now) / 1000));
-    return `Quota API backed off for ${seconds}s after: ${error.message}`;
-}
-export function getQuotaCheckIntervalMs(storage) {
-    const minutes = storage?.quota?.checkIntervalMinutes ?? DEFAULT_QUOTA_CHECK_INTERVAL_MINUTES;
-    return Math.max(1, minutes) * 60_000;
-}
-export function getPersistedLogLevel(storage) {
-    return storage?.logging?.level;
-}
-export async function setLogLevelPersistent(level, path = getAccountStoragePath()) {
-    const { setLogLevel } = await import('./logger.js');
-    const storage = (await loadAccounts(path)) ?? createEmptyStorage();
-    storage.logging = {
-        ...(storage.logging ?? {}),
-        level,
-    };
-    await saveAccounts(storage, path);
-    setLogLevel(level);
-}
-export function getPersistedMainQuota(storage) {
-    const quota = storage?.quota?.mainQuota;
-    if (!quota)
-        return null;
-    return {
-        quota,
-        checkedAt: quotaSnapshotCheckedAt(quota),
-        tokenFingerprint: storage.quota?.mainQuotaToken,
-        accountIdentity: quota.accountIdentity,
-    };
-}
-/**
- * How often (in requests) to force a quota refresh, independent of the timer.
- * Returns 0 when disabled (default).
- */
-export function getQuotaRefreshEveryNRequests(storage) {
-    const n = storage?.quota?.refreshEveryNRequests;
-    return typeof n === 'number' && Number.isFinite(n) && n > 0
-        ? Math.floor(n)
-        : 0;
-}
-function failClosedOnUnknownQuota(storage) {
-    return (storage?.quota?.failClosedOnUnknownQuota ??
-        DEFAULT_FAIL_CLOSED_ON_UNKNOWN_QUOTA);
-}
-function normalizeScopedQuotaModel(value) {
-    return value.toLowerCase().replace(/[^a-z0-9]/g, '');
-}
-function scopedQuotaModelKey(model) {
-    if (typeof model !== 'string')
-        return null;
-    const normalized = normalizeScopedQuotaModel(model);
-    if (normalized.includes('fable'))
-        return 'fable';
-    if (normalized.includes('mythos'))
-        return 'mythos';
-    return normalized;
-}
-export function getScopedQuotaWindowForModel(quota, model) {
-    const key = scopedQuotaModelKey(model);
-    if (!key)
-        return undefined;
-    return quota?.scoped?.find((window) => {
-        const haystack = [window.modelId, window.modelName, window.title]
-            .filter((value) => typeof value === 'string')
-            .map(normalizeScopedQuotaModel)
-            .join(' ');
-        return haystack.includes(key);
-    });
-}
-export function quotaSnapshotModelScopeIsExhausted(quota, model) {
-    const window = getScopedQuotaWindowForModel(quota, model);
-    return Boolean(window &&
-        Number.isFinite(window.remainingPercent) &&
-        window.remainingPercent <= 0);
-}
-export function quotaSnapshotPassesModelScope(quota, model) {
-    return !quotaSnapshotModelScopeIsExhausted(quota, model);
-}
-export function quotaSnapshotPassesPolicy(quota, storage) {
-    if (!quotaEnabled(storage))
-        return true;
-    const thresholds = getQuotaMinimumRemainingThresholds(storage);
-    for (const key of ['five_hour', 'seven_day']) {
-        const window = quota?.[key];
-        if (!window)
-            return !failClosedOnUnknownQuota(storage);
-        if (!Number.isFinite(window.remainingPercent)) {
-            return !failClosedOnUnknownQuota(storage);
-        }
-        if (window.remainingPercent < thresholds[key])
-            return false;
-    }
-    return true;
-}
-export function quotaSnapshotHasStandardWindows(quota) {
-    return Boolean(quota?.five_hour && quota.seven_day);
-}
-// ---------------------------------------------------------------------------
-// Killswitch — hard-block requests when remaining quota drops below per-account
-// thresholds, even if the API would still accept them.
-// ---------------------------------------------------------------------------
-export const DEFAULT_KILLSWITCH_THRESHOLDS = {
-    five_hour: 5,
-    seven_day: 10,
-    scoped: 0,
-};
-export function normalizeKillswitchThresholds(thresholds) {
-    const fiveHour = thresholds?.five_hour ?? thresholds?.['5h'];
-    const sevenDay = thresholds?.seven_day ?? thresholds?.['1w'];
-    const scoped = thresholds?.scoped;
-    return {
-        five_hour: typeof fiveHour === 'number' && Number.isFinite(fiveHour)
-            ? fiveHour
-            : DEFAULT_KILLSWITCH_THRESHOLDS.five_hour,
-        seven_day: typeof sevenDay === 'number' && Number.isFinite(sevenDay)
-            ? sevenDay
-            : DEFAULT_KILLSWITCH_THRESHOLDS.seven_day,
-        scoped: typeof scoped === 'number' && Number.isFinite(scoped)
-            ? scoped
-            : DEFAULT_KILLSWITCH_THRESHOLDS.scoped,
-    };
-}
-export function isKillswitchEnabled(storage) {
-    return storage?.killswitch?.enabled === true;
-}
-export function getKillswitchThresholdsForAccount(storage, accountId) {
-    if (!storage?.killswitch)
-        return DEFAULT_KILLSWITCH_THRESHOLDS;
-    if (accountId && storage.killswitch.accounts?.[accountId]) {
-        return normalizeKillswitchThresholds(storage.killswitch.accounts[accountId]);
-    }
-    return normalizeKillswitchThresholds(storage.killswitch.main);
-}
-/**
- * Returns true if the account's quota is above its killswitch threshold.
- * When killswitch is disabled, always returns true.
- *
- * When `modelId` is provided, the per-account `scoped` threshold is also
- * evaluated against the quota window matching that model — additive to the
- * 5h/7d check. A model with no matching scoped window is unaffected.
- */
-export function killswitchPassesPolicy(quota, storage, accountId, modelId) {
-    if (!isKillswitchEnabled(storage))
-        return true;
-    const thresholds = getKillswitchThresholdsForAccount(storage, accountId);
-    let sawUnknownWindow = false;
-    for (const key of ['five_hour', 'seven_day']) {
-        const window = quota?.[key];
-        // Defer the unknown-window decision: a quota snapshot can legally carry
-        // only one window, and a present window below its threshold must still
-        // block even if the other window is missing.
-        if (!window) {
-            sawUnknownWindow = true;
-            continue;
-        }
-        if (!Number.isFinite(window.remainingPercent)) {
-            sawUnknownWindow = true;
-            continue;
-        }
-        if (window.remainingPercent < thresholds[key])
-            return false;
-    }
-    // Scoped check is additive to the 5h/7d evaluation above and is an
-    // INDEPENDENT block reason — it must run before the unknown-window
-    // fail-closed decision, so an exhausted scoped window blocks even when
-    // 5h/7d is missing/non-finite (the latter only changes the fall-through
-    // for accounts that did not already block on scoped). A missing scoped
-    // window (no carve-out for this model) is not "unknown quota" — only a
-    // PRESENT window at/below threshold blocks. The comparison is inclusive
-    // (`<=`) so the default 0 fires at exhaustion.
-    if (modelId) {
-        const scopedWindow = getScopedQuotaWindowForModel(quota, modelId);
-        if (scopedWindow &&
-            Number.isFinite(scopedWindow.remainingPercent) &&
-            scopedWindow.remainingPercent <= thresholds.scoped) {
-            return false;
-        }
-    }
-    if (sawUnknownWindow)
-        return !failClosedOnUnknownQuota(storage);
-    return true;
-}
-/**
- * Find the earliest reset time across all accounts' quota windows.
- * Returns seconds from `now` until that reset, or 300 as a fallback.
- *
- * When `scopedModelId` is provided, ONLY the matched scoped window's
- * `resetsAt` is considered — the 5h/7d resets are intentionally ignored
- * so the retry hint reflects the weekly reset, not the sooner 5h reset
- * (which would cause a retry-storm against a block that won't clear for
- * days). With `scopedModelId` undefined, the 5h/7d behavior is unchanged.
- */
-export function killswitchRetryAfterSeconds(mainQuota, fallbackAccounts, now, scopedModelId) {
-    const resetTimes = [];
-    const allQuotas = [mainQuota, ...fallbackAccounts.map((a) => a.quota)];
-    for (const quota of allQuotas) {
-        if (scopedModelId) {
-            const scopedWindow = getScopedQuotaWindowForModel(quota, scopedModelId);
-            const resetStr = scopedWindow?.resetsAt;
-            if (!resetStr)
-                continue;
-            const resetTime = Date.parse(resetStr);
-            if (Number.isFinite(resetTime) && resetTime > now) {
-                resetTimes.push(resetTime);
-            }
-        }
-        else {
-            for (const key of ['five_hour', 'seven_day']) {
-                const resetStr = quota?.[key]?.resetsAt;
-                if (!resetStr)
-                    continue;
-                const resetTime = Date.parse(resetStr);
-                if (Number.isFinite(resetTime) && resetTime > now) {
-                    resetTimes.push(resetTime);
-                }
-            }
-        }
-    }
-    if (!resetTimes.length)
-        return 300;
-    return Math.max(1, Math.ceil((Math.min(...resetTimes) - now) / 1000)) + 60;
-}
-export function getKillswitchConfig(storage) {
-    return storage?.killswitch ?? { enabled: false };
-}
-export async function setKillswitchPersistent(config, path = getAccountStoragePath()) {
-    const storage = (await loadAccounts(path)) ?? createEmptyStorage();
-    storage.killswitch = config;
-    await saveAccounts(storage, path);
-    return storage;
-}
-export async function removeAccountPersistent(id, path = getAccountStoragePath()) {
-    return mutateAccountsPersistent(path, (storage) => {
-        const account = storage.accounts.find((entry) => entry.id === id);
-        if (account &&
-            isOAuthAccount(account) &&
-            account.claustrumScopedCredentialId &&
-            getClaustrumMode(storage) === 'claustrum') {
-            throw new Error('Disable this account or remove it from Claustrum; scoped membership is managed by the vault');
-        }
-        const existed = removeAccount(storage, id);
-        return {
-            storage,
-            result: existed,
-            save: existed,
-            options: { removedAccountIds: [id] },
-        };
-    });
-}
-export async function reorderAccountsPersistent(orderedIds, path = getAccountStoragePath()) {
-    await mutateAccountsPersistent(path, (storage) => {
-        reorderAccounts(storage, orderedIds);
-        return {
-            storage,
-            result: undefined,
-            options: { preserveExistingAccountOrder: false },
-        };
-    });
-}
-export async function setAccountEnabledPersistent(id, enabled, path = getAccountStoragePath()) {
-    return mutateAccountsPersistent(path, (storage) => {
-        const found = setAccountEnabled(storage, id, enabled);
-        const account = storage.accounts.find((candidate) => candidate.id === id);
-        if (account &&
-            isOAuthAccount(account) &&
-            (account.claustrumScopedCredentialId ||
-                storage.claustrum?.scopedRoster) &&
-            account.anthropicAccountUuid) {
-            const disabled = new Set(storage.claustrum?.disabledAccountIdentities ?? []);
-            if (enabled)
-                disabled.delete(account.anthropicAccountUuid);
-            else
-                disabled.add(account.anthropicAccountUuid);
-            storage.claustrum = {
-                ...storage.claustrum,
-                disabledAccountIdentities: [...disabled],
-            };
-        }
-        return { storage, result: found, save: found };
-    });
-}
-export async function addAccountPersistent(account, path = getAccountStoragePath()) {
-    await mutateAccountsPersistent(path, (storage) => {
-        if (storage.claustrum?.scopedRoster &&
-            getClaustrumMode(storage) === 'claustrum' &&
-            isOAuthAccount(account)) {
-            throw new Error('Claustrum account membership is managed by the vault; add accounts with ck auth login');
-        }
-        upsertAccount(storage, account);
-        if (isOAuthAccount(account) &&
-            getClaustrumMode(storage) === 'local' &&
-            account.refresh &&
-            !isCustodyTombstoneValue(account.refresh)) {
-            const updated = storage.accounts.find((entry) => entry.id === account.id ||
-                (account.label && entry.label === account.label));
-            if (updated && isOAuthAccount(updated)) {
-                delete updated.claustrumScopedCredentialId;
-                delete updated.claustrumScopedState;
-            }
-        }
-        return {
-            storage,
-            result: undefined,
-            options: {
-                setClaustrumHandleAccountIds: account.type === 'oauth' && account.claustrumHandle
-                    ? [account.id]
-                    : undefined,
-            },
-        };
-    });
-}
-export function getQuotaNextRefreshAt(quota, storage, now) {
-    const intervalMs = getQuotaCheckIntervalMs(storage);
-    if (!quotaEnabled(storage))
-        return now + intervalMs;
-    const windowFreshnessDeadline = Math.min(...[
-        ...['five_hour', 'seven_day'].map((key) => quota?.[key]?.checkedAt),
-        ...(quota?.scoped ?? []).map((window) => window.checkedAt),
-    ]
-        .filter((checkedAt) => Number.isFinite(checkedAt))
-        .map((checkedAt) => checkedAt + intervalMs));
-    const capAtOldestWindow = (candidate) => Number.isFinite(windowFreshnessDeadline)
-        ? Math.min(candidate, windowFreshnessDeadline)
-        : candidate;
-    const thresholds = getQuotaMinimumRemainingThresholds(storage);
-    const blockedResetTimes = [];
-    for (const key of ['five_hour', 'seven_day']) {
-        const window = quota?.[key];
-        if (!window)
-            return capAtOldestWindow(now + intervalMs);
-        if (window.remainingPercent >= thresholds[key])
-            continue;
-        const resetTime = window.resetsAt ? Date.parse(window.resetsAt) : Number.NaN;
-        if (!Number.isFinite(resetTime) || resetTime <= now) {
-            return capAtOldestWindow(now + intervalMs);
-        }
-        blockedResetTimes.push(resetTime);
-    }
-    if (!blockedResetTimes.length)
-        return capAtOldestWindow(now + intervalMs);
-    return capAtOldestWindow(Math.min(...blockedResetTimes) + 60_000);
-}
-function tokenNeedsRefresh(account, storage, now) {
-    return (!account.access ||
-        !account.expires ||
-        account.expires - now <= refreshBeforeExpiryMs(storage));
-}
-function quotaSnapshotIsFresh(quota, storage, now) {
-    if (!quotaEnabled(storage))
-        return true;
-    const maxAge = getQuotaCheckIntervalMs(storage);
-    return ['five_hour', 'seven_day'].every((key) => {
-        const window = quota?.[key];
-        return Boolean(window && now - window.checkedAt < maxAge);
-    });
-}
-function quotaIsStale(account, storage, now, modelId) {
-    if (!quotaSnapshotIsFresh(account.quota, storage, now))
-        return true;
-    const scoped = getScopedQuotaWindowForModel(account.quota, modelId);
-    return Boolean(scoped && now - scoped.checkedAt >= getQuotaCheckIntervalMs(storage));
-}
-function cachedQuotaWindowStillRelevant(window, now) {
-    if (!window)
-        return false;
-    if (!window.resetsAt)
-        return true;
-    const resetTime = Date.parse(window.resetsAt);
-    return !Number.isFinite(resetTime) || resetTime > now;
-}
-function cachedQuotaSnapshotStillRelevant(quota, now) {
-    return ['five_hour', 'seven_day'].every((key) => cachedQuotaWindowStillRelevant(quota?.[key], now));
-}
-function isTransientQuotaError(error) {
-    const status = error.status;
-    if (typeof status === 'number' && Number.isFinite(status)) {
-        if (status === 429 || status >= 500)
-            return true;
-    }
-    const formattedMessage = formatErrorMessage(error);
-    if (/Claude quota check failed: (429|5\d\d)\b/.test(formattedMessage)) {
-        return true;
-    }
-    if (formattedMessage.includes('Quota refresh is already in progress')) {
-        return true;
-    }
-    return isTransientNetworkError(error);
-}
-function canUseCachedQuotaAfterRefreshError(account, storage, error, now) {
-    return (Boolean(account.access && account.expires && account.expires > now) &&
-        isTransientQuotaError(error) &&
-        quotaSnapshotPassesPolicy(account.quota, storage) &&
-        cachedQuotaSnapshotStillRelevant(account.quota, now));
-}
-function clampPercent(value) {
-    if (!Number.isFinite(value))
-        return 0;
-    if (value < 0)
-        return 0;
-    if (value > 100)
-        return 100;
-    return value;
-}
-function nonEmptyString(value) {
-    return typeof value === 'string' && value.trim() ? value.trim() : undefined;
-}
-function slugForQuotaIdentity(value) {
-    return value
-        .toLowerCase()
-        .replace(/[^a-z0-9]+/g, '-')
-        .replace(/^-+|-+$/g, '');
-}
-function mapScopedWeeklyLimits(limits, checkedAt) {
-    if (!Array.isArray(limits))
-        return [];
-    const seen = new Set();
-    const scoped = [];
-    for (const limit of limits) {
-        if (limit?.kind !== 'weekly_scoped' || limit.group !== 'weekly')
-            continue;
-        if (typeof limit.percent !== 'number' || !Number.isFinite(limit.percent)) {
-            continue;
-        }
-        const modelName = nonEmptyString(limit.scope?.model?.display_name);
-        if (!modelName)
-            continue;
-        const identity = nonEmptyString(limit.scope?.model?.id) ?? modelName;
-        const slug = slugForQuotaIdentity(identity);
-        if (!slug)
-            continue;
-        const id = `claude-weekly-scoped-${slug}`;
-        if (seen.has(id))
-            continue;
-        seen.add(id);
-        const usedPercent = clampPercent(limit.percent);
-        const modelId = nonEmptyString(limit.scope?.model?.id);
-        scoped.push({
-            id,
-            title: `${modelName} only`,
-            ...(modelId && { modelId }),
-            modelName,
-            usedPercent,
-            remainingPercent: clampPercent(100 - usedPercent),
-            resetsAt: limit.resets_at,
-            checkedAt,
-        });
-    }
-    return scoped;
-}
-function mapExtraUsage(usage) {
-    if (usage.extra_usage?.is_enabled !== true)
-        return undefined;
-    const usedAmount = usage.extra_usage.used_credits;
-    const limitAmount = usage.extra_usage.monthly_limit;
-    if (typeof usedAmount !== 'number' ||
-        !Number.isFinite(usedAmount) ||
-        typeof limitAmount !== 'number' ||
-        !Number.isFinite(limitAmount)) {
-        return undefined;
-    }
-    const rawCurrency = usage.spend?.limit?.currency;
-    const currency = rawCurrency == null ? 'USD' : nonEmptyString(rawCurrency);
-    const rawExponent = usage.spend?.limit?.exponent;
-    const moneyExponent = rawExponent == null ? 2 : rawExponent;
-    if (!currency ||
-        !/^[A-Za-z]{3}$/.test(currency) ||
-        !Number.isInteger(moneyExponent) ||
-        moneyExponent < 0 ||
-        moneyExponent > 20) {
-        return undefined;
-    }
-    return {
-        used: { amountMinor: usedAmount, currency, exponent: moneyExponent },
-        limit: { amountMinor: limitAmount, currency, exponent: moneyExponent },
-        ...(typeof usage.extra_usage.utilization === 'number' &&
-            Number.isFinite(usage.extra_usage.utilization) && {
-            utilizationPercent: usage.extra_usage.utilization,
-        }),
-        ...(nonEmptyString(usage.spend?.severity) && {
-            severity: nonEmptyString(usage.spend?.severity),
-        }),
-        exhausted: usedAmount >= limitAmount,
-    };
-}
-function mapBindingWindow(limits) {
-    if (!Array.isArray(limits))
-        return undefined;
-    const active = limits.find((limit) => limit?.is_active === true);
-    if (!active)
-        return undefined;
-    if (active.kind === 'session')
-        return 'five_hour';
-    if (active.kind === 'weekly_all')
-        return 'seven_day';
-    if (active.kind !== 'weekly_scoped' || active.group !== 'weekly') {
-        return undefined;
-    }
-    const modelName = nonEmptyString(active.scope?.model?.display_name);
-    if (!modelName)
-        return undefined;
-    const identity = nonEmptyString(active.scope?.model?.id) ?? modelName;
-    const slug = slugForQuotaIdentity(identity);
-    return slug ? `claude-weekly-scoped-${slug}` : undefined;
-}
-function mapUsageWindow(window, checkedAt) {
-    if (typeof window?.utilization !== 'number')
-        return undefined;
-    if (!Number.isFinite(window.utilization))
-        return undefined;
-    const usedPercent = clampPercent(window.utilization);
-    return {
-        usedPercent,
-        remainingPercent: clampPercent(100 - usedPercent),
-        resetsAt: window.resets_at,
-        checkedAt,
-    };
-}
-export async function fetchOAuthQuotaSnapshot(input) {
-    assertNotCustodyTombstone(input.accessToken, 'anthropic');
-    const fetchImpl = input.fetchImpl ?? fetch;
-    const response = await fetchImpl(QUOTA_URL, {
-        method: 'GET',
-        headers: {
-            Authorization: `Bearer ${input.accessToken}`,
-            Accept: 'application/json',
-            'Content-Type': 'application/json',
-            'anthropic-beta': 'oauth-2025-04-20',
-            'User-Agent': `claude-code/${CLAUDE_CODE_VERSION}`,
-        },
-    });
-    if (!response.ok) {
-        const body = await response.text().catch(() => '');
-        const error = Object.assign(new Error(`Claude quota check failed: ${response.status} — ${body}`), {
-            status: response.status,
-            retryAfter: parseRetryAfterHeader(response.headers.get('Retry-After')),
-        });
-        throw error;
-    }
-    const checkedAt = input.now?.() ?? Date.now();
-    const usage = (await response.json());
-    const bindingWindow = mapBindingWindow(usage.limits);
-    const snapshot = {
-        five_hour: mapUsageWindow(usage.five_hour, checkedAt),
-        seven_day: mapUsageWindow(usage.seven_day, checkedAt),
-        scoped: mapScopedWeeklyLimits(usage.limits, checkedAt),
-        extraUsage: mapExtraUsage(usage),
-        ...(bindingWindow && {
-            bindingWindow,
-            bindingWindowSource: 'poll',
-        }),
-        source: 'poll',
-        checkedAt,
-    };
-    const fieldSources = {
-        ...(snapshot.five_hour && { five_hour: 'poll' }),
-        ...(snapshot.seven_day && { seven_day: 'poll' }),
-        ...(snapshot.scoped && { scoped: 'poll' }),
-        ...(snapshot.extraUsage && { extraUsage: 'poll' }),
-        ...(snapshot.bindingWindow && { bindingWindow: 'poll' }),
-    };
-    return {
-        ...snapshot,
-        ...(Object.keys(fieldSources).length > 0 && { fieldSources }),
-    };
-}
-function updateStoredAccount(storage, account) {
-    const index = storage.accounts.findIndex((candidate) => candidate.id === account.id);
-    if (index >= 0)
-        storage.accounts[index] = account;
-}
-export function upsertAccount(storage, account) {
-    const index = storage.accounts.findIndex((candidate) => candidate.id === account.id ||
-        (account.label && candidate.label === account.label));
-    if (index >= 0) {
-        const existing = storage.accounts[index];
-        if (!existing)
-            return;
-        const lineageChanged = existing.type === 'oauth' &&
-            account.type === 'oauth' &&
-            existing.authLineageId !== account.authLineageId;
-        const updated = {
-            ...existing,
-            ...account,
-            addedAt: existing.addedAt ?? account.addedAt,
-            ...(account.type === 'oauth' && {
-                quota: account.quota,
-                profile: account.profile,
-                lastRefreshedAt: account.lastRefreshedAt,
-                lastRefreshError: account.lastRefreshError,
-                lastQuotaRefreshError: account.lastQuotaRefreshError,
-            }),
-        };
-        if (lineageChanged && updated.type === 'oauth') {
-            logger.debug('accounts', 'cleared provider UUID after auth lineage change');
-            delete updated.anthropicAccountUuid;
-        }
-        storage.accounts[index] = updated;
-        return;
-    }
-    storage.accounts.push(account);
-}
-export function persistFallbackQuotaHeaderPersistent(input, path = getAccountStoragePath()) {
-    return enqueueSave(async () => {
-        const configLock = await acquireAccountConfigWriteLock(path);
-        try {
-            const stateLock = await acquireAccountStateWriteLock(path);
-            try {
-                const storage = await loadAccounts(path);
-                const account = storage?.accounts.find((candidate) => candidate.id === input.accountId && isOAuthAccount(candidate));
-                if (!storage ||
-                    !account ||
-                    account.authLineageId !== input.authLineageId) {
-                    return false;
-                }
-                account.quota = {
-                    ...input.quota,
-                    accountIdentity: account.id,
-                };
-                if (input.anthropicAccountUuid !== undefined) {
-                    account.anthropicAccountUuid = input.anthropicAccountUuid;
-                }
-                await saveAccountStateUnlocked(storage, path, {
-                    accounts: [input.accountId],
-                });
-                return true;
-            }
-            finally {
-                await stateLock.release();
-            }
-        }
-        finally {
-            await configLock.release();
-        }
-    });
-}
-export function fallbackAccountUuidForLineage(account, authLineageId) {
-    if (!account || account.authLineageId !== authLineageId)
-        return null;
-    return account.anthropicAccountUuid ?? null;
-}
-export function removeAccount(storage, id) {
-    const index = storage.accounts.findIndex((c) => c.id === id);
-    if (index < 0)
-        return false;
-    storage.accounts.splice(index, 1);
-    return true;
-}
-export function reorderAccounts(storage, orderedIds) {
-    const orderMap = new Map(orderedIds.map((id, i) => [id, i]));
-    const known = storage.accounts.filter((a) => orderMap.has(a.id));
-    const unknown = storage.accounts.filter((a) => !orderMap.has(a.id));
-    known.sort((a, b) => (orderMap.get(a.id) ?? 0) - (orderMap.get(b.id) ?? 0));
-    storage.accounts = [...known, ...unknown];
-}
-export function setAccountEnabled(storage, id, enabled) {
-    const account = storage.accounts.find((c) => c.id === id);
-    if (!account)
-        return false;
-    account.enabled = enabled;
-    return true;
-}
-function formatErrorMessage(error) {
-    return error instanceof Error ? error.message : String(error);
-}
-function recordRefreshError(account, error, now) {
-    if (error instanceof CustodyTombstoneRefreshError)
-        return;
-    const existing = existingRefreshBackoffError(error);
-    if (existing) {
-        account.lastRefreshError = existing;
-        return;
-    }
-    account.lastRefreshError = buildRefreshOperationError({
-        error,
-        now,
-        accountIdentity: account.id,
-        refreshTokenFingerprint: tokenFingerprint(account.refresh),
-        previous: account.lastRefreshError,
-    });
-}
-function recordQuotaRefreshError(account, error, now) {
-    if (error instanceof CustodyTombstoneRefreshError)
-        return;
-    if (isQuotaPolicyAuthError(error) || existingRefreshBackoffError(error))
-        return;
-    account.lastQuotaRefreshError = buildQuotaOperationError({
-        error,
-        now,
-        previous: account.lastQuotaRefreshError,
-    });
-    if (error.isRefreshError) {
-        recordRefreshError(account, error, now);
-    }
-}
-function fallbackRefreshLockName(accountId) {
-    return `fallback-oauth-refresh-${createHash('sha256')
-        .update(accountId)
-        .digest('hex')
-        .slice(0, 16)}`;
-}
-export class FallbackAccountManager {
-    now;
-    fetchImpl;
-    configPath;
-    refreshPromises = new Map();
-    custodyVerificationAccounts = new Set();
-    refreshTimer = null;
-    quotaTimer = null;
-    quotaManager;
-    isFallbackAccountVaultServed;
-    isFallbackAccountVaultEnabled;
-    resolveFallbackAccessToken;
-    onBackgroundRefresh;
-    onFallbackStorageChanged;
-    setIntervalImpl;
-    clearIntervalImpl;
-    constructor(options = {}) {
-        this.now = options.now ?? Date.now;
-        this.fetchImpl = options.fetchImpl ?? fetch;
-        this.configPath = options.configPath ?? getAccountStoragePath();
-        this.quotaManager = options.quotaManager ?? null;
-        this.isFallbackAccountVaultServed =
-            options.isFallbackAccountVaultServed ?? (() => false);
-        this.isFallbackAccountVaultEnabled =
-            options.isFallbackAccountVaultEnabled ?? (() => false);
-        this.resolveFallbackAccessToken =
-            options.resolveFallbackAccessToken ??
-                ((account) => {
-                    if (!account.access ||
-                        account.expires === undefined ||
-                        account.expires <= this.now()) {
-                        return undefined;
-                    }
-                    return { token: account.access, source: 'sidecar' };
-                });
-        this.onBackgroundRefresh = options.onBackgroundRefresh;
-        this.onFallbackStorageChanged = options.onFallbackStorageChanged;
-        this.setIntervalImpl = options.setIntervalImpl ?? globalThis.setInterval;
-        this.clearIntervalImpl =
-            options.clearIntervalImpl ?? globalThis.clearInterval;
-    }
-    /**
-     * Seed QuotaManager from persisted account.quota if no cache entry exists
-     * yet. Prevents unnecessary API calls when the on-disk snapshot is fresh.
-     */
-    seedFallbackQuota(account, storage) {
-        if (!this.quotaManager)
-            return;
-        if (!account.quota)
-            return;
-        const checkedAt = quotaSnapshotCheckedAt(account.quota);
-        if (checkedAt <= 0)
-            return;
-        const existing = this.quotaManager.getFallback(account.id, account);
-        if (existing && existing.checkedAt >= checkedAt)
-            return;
-        const checkInterval = getQuotaCheckIntervalMs(storage);
-        this.quotaManager.setFallback(account.id, {
-            quota: account.quota,
-            refreshAfter: checkedAt + checkInterval,
-            checkedAt,
-        }, account);
-    }
-    async load() {
-        return loadAccounts(this.configPath);
-    }
-    async save(storage, accountIds) {
-        await saveAccountState(storage, this.configPath, {
-            accounts: accountIds ?? true,
-        });
-    }
-    startBackgroundRefresh() {
-        const run = async (initial = false) => {
-            await this.onBackgroundRefresh?.(initial);
-            await this.refreshDueAccounts();
-            await this.refreshQuotaForDueAccounts();
-        };
-        const initialRun = run(true).catch(() => { });
-        if (!this.refreshTimer) {
-            this.refreshTimer = this.setIntervalImpl(() => run().catch(() => { }), FALLBACK_BACKGROUND_TICK_MS + jitterMs(BACKGROUND_TICK_JITTER_MS));
-            if ('unref' in this.refreshTimer)
-                this.refreshTimer.unref();
-        }
-        return initialRun;
-    }
-    stopBackgroundRefresh() {
-        if (this.refreshTimer)
-            this.clearIntervalImpl(this.refreshTimer);
-        if (this.quotaTimer)
-            this.clearIntervalImpl(this.quotaTimer);
-        this.refreshTimer = null;
-        this.quotaTimer = null;
-    }
-    async withAccountRefreshLock(accountId, fn) {
-        const lock = await acquireRefreshFileLock({
-            name: fallbackRefreshLockName(accountId),
-            ttlMs: FALLBACK_REFRESH_LOCK_TTL_MS,
-            path: this.configPath,
-            now: this.now,
-            renew: true,
-        });
-        if (!lock)
-            throw new Error('Fallback OAuth refresh is already in progress');
-        this.custodyVerificationAccounts.add(accountId);
-        try {
-            return await fn();
-        }
-        finally {
-            this.custodyVerificationAccounts.delete(accountId);
-            await lock.release();
-        }
-    }
-    async getUsableFallbackAccounts(existingStorage, options = {}) {
-        const storage = existingStorage !== undefined ? existingStorage : await this.load();
-        if (!storage)
-            return [];
-        const usable = [];
-        let changed = false;
-        for (const account of storage.accounts) {
-            if (account.enabled === false || !isOAuthAccount(account))
-                continue;
-            if (this.isFallbackAccountVaultEnabled(account.id, storage)) {
-                if (!this.isFallbackAccountVaultServed(account.id, storage))
-                    continue;
-                if (hasNoLocalCredential(account) &&
-                    !storage.quota?.minimumRemaining &&
-                    !isKillswitchEnabled(storage)) {
-                    usable.push(account);
-                    continue;
-                }
-            }
-            let next = account;
-            try {
-                if (tokenNeedsRefresh(next, storage, this.now()) &&
-                    !this.isFallbackAccountVaultEnabled(next.id, storage) &&
-                    !this.isFallbackAccountVaultServed(next.id, storage)) {
-                    const refreshError = next.lastRefreshError;
-                    if (refreshError &&
-                        refreshBackoffActive(refreshError, next.id, this.now(), tokenFingerprint(next.refresh))) {
-                        throw createRefreshBackoffActiveError(refreshError, this.now());
-                    }
-                    next = await this.refreshAccount(next, storage);
-                    changed = true;
-                }
-                this.seedFallbackQuota(next, storage);
-                const stale = this.quotaManager
-                    ? this.quotaManager.isFallbackStale(next.id, next.access, options.modelId, next)
-                    : quotaIsStale(next, storage, this.now(), options.modelId);
-                // Skip the request-time refresh when this account's quota API is
-                // backed off (recent 429/5xx). Hitting it again would extend the
-                // backoff; evaluate policy on the cached/seeded quota instead. Mirrors
-                // the background refreshQuotaForDueAccounts() guard.
-                if (stale &&
-                    !quotaBackoffActive(next.lastQuotaRefreshError, this.now())) {
-                    const result = await this.refreshAccountQuota(next, storage);
-                    next = result.account;
-                    changed ||= result.changed;
-                }
-                // Single source of truth: evaluate quota policy from the unified
-                // QuotaManager cache (the same source as the staleness check above) so
-                // an active-route refresh that updated only the cache is not ignored.
-                if (this.accountPassesQuotaPolicy(this.quotaPolicyAccount(next), storage, {
-                    modelId: options.modelId,
-                }))
-                    usable.push(next);
-            }
-            catch (error) {
-                if (canUseCachedQuotaAfterRefreshError(next, storage, error, this.now())) {
-                    log('[refresh] fallback quota using cached quota after refresh error', {
-                        accountId: next.id,
-                        error: formatErrorMessage(error),
-                    });
-                    if (this.accountPassesQuotaPolicy(this.quotaPolicyAccount(next), storage, {
-                        modelId: options.modelId,
-                    })) {
-                        usable.push(next);
-                    }
-                }
-                else if (!failClosedOnUnknownQuota(storage) &&
-                    !refreshBackoffActive(next.lastRefreshError, next.id, this.now(), tokenFingerprint(next.refresh)) &&
-                    quotaSnapshotPassesModelScope(next.quota, options.modelId)) {
-                    usable.push(next);
-                }
-            }
-        }
-        if (changed)
-            await this.save(storage);
-        return usable;
-    }
-    async markUsed(account) {
-        const storage = await this.load();
-        if (!storage)
-            return;
-        const stored = storage.accounts.find((candidate) => candidate.id === account.id);
-        if (!stored)
-            return;
-        stored.lastUsed = this.now();
-        await this.save(storage);
-    }
-    accountPassesQuotaPolicy(account, storage, options = {}) {
-        return (quotaSnapshotPassesPolicy(account.quota, storage) &&
-            quotaSnapshotPassesModelScope(account.quota, options.modelId));
-    }
-    /**
-     * Return the account with its quota overlaid from the unified QuotaManager
-     * cache (token-bound) when available, so quota-policy decisions use the same
-     * source of truth as the staleness check. Falls back to the stored
-     * account.quota when no manager is wired or the cache has no entry.
-     */
-    quotaPolicyAccount(account) {
-        if (!this.quotaManager)
-            return account;
-        const cached = this.quotaManager.getFallback(account.id, account)?.quota;
-        return cached ? { ...account, quota: cached } : account;
-    }
-    async refreshDueAccounts() {
-        const storage = await this.load();
-        if (!storage || !refreshEnabled(storage))
-            return;
-        let changed = false;
-        for (const account of storage.accounts) {
-            if (account.enabled === false || !isOAuthAccount(account))
-                continue;
-            if (this.custodyVerificationAccounts.has(account.id)) {
-                logger.debug('refresh', 'fallback OAuth background skipped vault-service verification', {
-                    accountId: account.id,
-                });
-                continue;
-            }
-            if (!tokenNeedsRefresh(account, storage, this.now()) ||
-                this.isFallbackAccountVaultEnabled(account.id, storage) ||
-                this.isFallbackAccountVaultServed(account.id, storage))
-                continue;
-            if (refreshBackoffActive(account.lastRefreshError, account.id, this.now(), tokenFingerprint(account.refresh))) {
-                // Backoff skips are steady-state while a fallback account is waiting for
-                // its next retry. Logging every background tick from every OpenCode
-                // process creates noise without adding new diagnostic signal; the
-                // failure/backoff itself is recorded when the refresh attempt fails and
-                // shown by /claude-quota.
-                continue;
-            }
-            try {
-                log('[refresh] fallback oauth background due', {
-                    accountId: account.id,
-                    expiresInMs: account.expires
-                        ? account.expires - this.now()
-                        : undefined,
-                });
-                await this.refreshAccount(account, storage);
-                changed = true;
-            }
-            catch (error) {
-                logger.warn('refresh', 'fallback oauth background failed', {
-                    accountId: account.id,
-                    error: error instanceof Error ? error.message : String(error),
-                });
-                recordRefreshError(account, error, this.now());
-                updateStoredAccount(storage, account);
-                changed = true;
-                // Background refresh must not break the plugin request path.
-            }
-        }
-        if (changed)
-            await this.save(storage);
-    }
-    async refreshQuotaForDueAccounts() {
-        const storage = await this.load();
-        if (!storage || !quotaEnabled(storage))
-            return;
-        let changed = false;
-        for (const account of storage.accounts) {
-            if (account.enabled === false || !isOAuthAccount(account))
-                continue;
-            if (this.custodyVerificationAccounts.has(account.id))
-                continue;
-            let next = account;
-            try {
-                if (tokenNeedsRefresh(next, storage, this.now()) &&
-                    !this.isFallbackAccountVaultEnabled(next.id, storage) &&
-                    !this.isFallbackAccountVaultServed(next.id, storage)) {
-                    if (refreshBackoffActive(next.lastRefreshError, next.id, this.now(), tokenFingerprint(next.refresh))) {
-                        continue;
-                    }
-                    next = await this.refreshAccount(next, storage);
-                    changed = true;
-                }
-                if (quotaBackoffActive(next.lastQuotaRefreshError, this.now())) {
-                    continue;
-                }
-                this.seedFallbackQuota(next, storage);
-                // Use QuotaManager staleness when available (shared cache);
-                // fall back to per-account on-disk staleness otherwise.
-                const stale = this.quotaManager
-                    ? this.quotaManager.isFallbackStale(next.id, next.access)
-                    : quotaIsStale(next, storage, this.now());
-                if (!stale)
-                    continue;
-                const result = await this.refreshAccountQuota(next, storage);
-                changed ||= result.changed;
-            }
-            catch (error) {
-                recordQuotaRefreshError(account, error, this.now());
-                updateStoredAccount(storage, account);
-                changed = true;
-                // Quota probes are advisory; failed probes fail closed at selection time.
-            }
-        }
-        if (changed) {
-            await this.save(storage);
-            this.onFallbackStorageChanged?.();
-        }
-    }
-    async refreshQuotaForAllAccounts(options = {}) {
-        const storage = await this.load();
-        const errors = [];
-        if (!storage || !quotaEnabled(storage))
-            return { storage, errors };
-        const force = options.force ?? false;
-        let changed = false;
-        for (const account of storage.accounts) {
-            if (account.enabled === false || !isOAuthAccount(account))
-                continue;
-            let next = account;
-            try {
-                if (tokenNeedsRefresh(next, storage, this.now()) &&
-                    !this.isFallbackAccountVaultServed(next.id, storage) &&
-                    !this.isFallbackAccountVaultEnabled(next.id, storage)) {
-                    const refreshError = next.lastRefreshError;
-                    if (refreshError &&
-                        refreshBackoffActive(refreshError, next.id, this.now(), tokenFingerprint(next.refresh))) {
-                        throw createRefreshBackoffActiveError(refreshError, this.now());
-                    }
-                    next = await this.refreshAccount(next, storage);
-                    changed = true;
-                }
-                // force (manual /claude-quota) bypasses the staleness skip to fetch
-                // fresh numbers on demand. refreshAccountQuota still respects 429
-                // backoff via QuotaManager.refreshFallback.
-                if (!force && !quotaIsStale(next, storage, this.now())) {
-                    if (next.lastQuotaRefreshError) {
-                        next.lastQuotaRefreshError = undefined;
-                        updateStoredAccount(storage, next);
-                        changed = true;
-                    }
-                    continue;
-                }
-                const result = await this.refreshAccountQuota(next, storage);
-                changed ||= result.changed;
-            }
-            catch (error) {
-                recordQuotaRefreshError(account, error, this.now());
-                updateStoredAccount(storage, account);
-                changed = true;
-                errors.push({
-                    accountId: account.id,
-                    message: formatErrorMessage(error),
-                });
-            }
-        }
-        if (changed)
-            await this.save(storage);
-        return { storage, errors };
-    }
-    async refreshAccount(account, storage, options = {}) {
-        if (this.isFallbackAccountVaultServed(account.id, storage) ||
-            this.isFallbackAccountVaultEnabled(account.id, storage))
-            return account;
-        const existing = this.refreshPromises.get(account.id);
-        if (existing) {
-            const refreshed = await existing;
-            updateStoredAccount(storage, refreshed);
-            return refreshed;
-        }
-        const promise = this.refreshAccountNow(account, storage, options).finally(() => {
-            this.refreshPromises.delete(account.id);
-        });
-        this.refreshPromises.set(account.id, promise);
-        try {
-            const refreshed = await promise;
-            updateStoredAccount(storage, refreshed);
-            return refreshed;
-        }
-        catch (error) {
-            if (options.persistError) {
-                recordRefreshError(account, error, this.now());
-                updateStoredAccount(storage, account);
-                await this.save(storage);
-            }
-            throw error;
-        }
-    }
-    async waitForConcurrentFallbackRefresh(account, storage, previous, options) {
-        const deadline = Date.now() + FALLBACK_REFRESH_JOIN_WAIT_MS;
-        while (Date.now() < deadline) {
-            await new Promise((resolve) => setTimeout(resolve, FALLBACK_REFRESH_JOIN_POLL_MS));
-            const latestStorage = await this.load();
-            const latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === account.id && isOAuthAccount(candidate));
-            if (!latestAccount)
-                continue;
-            const changed = latestAccount.access !== previous.access ||
-                latestAccount.refresh !== previous.refresh ||
-                (latestAccount.expires ?? 0) > (previous.expires ?? 0) + 60_000;
-            if (changed &&
-                (options.force ||
-                    !tokenNeedsRefresh(latestAccount, latestStorage, this.now()))) {
-                updateStoredAccount(storage, latestAccount);
-                log('[refresh] fallback oauth joined concurrent refresh', {
-                    accountId: latestAccount.id,
-                    expiresInMs: latestAccount.expires
-                        ? latestAccount.expires - this.now()
-                        : undefined,
-                });
-                return latestAccount;
-            }
-            const refreshError = latestAccount.lastRefreshError;
-            if (refreshError &&
-                refreshBackoffActive(refreshError, latestAccount.id, this.now(), tokenFingerprint(latestAccount.refresh))) {
-                updateStoredAccount(storage, latestAccount);
-                throw createRefreshBackoffActiveError(refreshError, this.now());
-            }
-        }
-        return null;
-    }
-    async refreshAccountNow(account, storage, options) {
-        let latestStorage = await this.load();
-        let latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === account.id && isOAuthAccount(candidate));
-        if (latestAccount &&
-            !options.force &&
-            !tokenNeedsRefresh(latestAccount, latestStorage, this.now())) {
-            updateStoredAccount(storage, latestAccount);
-            return latestAccount;
-        }
-        let sourceAccount = latestAccount ?? account;
-        const fileLock = await acquireRefreshFileLock({
-            name: fallbackRefreshLockName(sourceAccount.id),
-            ttlMs: FALLBACK_REFRESH_LOCK_TTL_MS,
-            path: this.configPath,
-            now: this.now,
-            renew: true,
-        });
-        if (!fileLock) {
-            log('[refresh] fallback oauth refresh skipped file lock', {
-                accountId: sourceAccount.id,
-            });
-            const concurrent = await this.waitForConcurrentFallbackRefresh(account, storage, sourceAccount, options);
-            if (concurrent)
-                return concurrent;
-            throw new Error('Fallback OAuth refresh is already in progress');
-        }
-        try {
-            latestStorage = await this.load();
-            latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === account.id && isOAuthAccount(candidate));
-            if (latestAccount &&
-                !options.force &&
-                !tokenNeedsRefresh(latestAccount, latestStorage, this.now())) {
-                updateStoredAccount(storage, latestAccount);
-                return latestAccount;
-            }
-            sourceAccount = latestAccount ?? sourceAccount;
-            const refreshToken = sourceAccount.refresh;
-            log('[refresh] fallback oauth refresh request start', {
-                accountId: sourceAccount.id,
-                force: options.force === true,
-                expiresInMs: sourceAccount.expires
-                    ? sourceAccount.expires - this.now()
-                    : undefined,
-            });
-            const refreshed = await refreshClaudeOAuthToken({
-                refreshToken,
-                authLineageId: sourceAccount.authLineageId,
-                fetchImpl: this.fetchImpl,
-                now: this.now,
-            });
-            sourceAccount.access = refreshed.access;
-            sourceAccount.refresh = refreshed.refresh;
-            sourceAccount.authLineageId =
-                refreshed.authLineageId ?? sourceAccount.authLineageId;
-            sourceAccount.expires = refreshed.expires;
-            sourceAccount.lastRefreshedAt =
-                refreshed.expires - refreshed.expiresIn * 1000;
-            sourceAccount.lastRefreshError = undefined;
-            updateStoredAccount(storage, sourceAccount);
-            await this.save(storage);
-            log('[refresh] fallback oauth refresh succeeded', {
-                accountId: sourceAccount.id,
-                expiresInMs: sourceAccount.expires
-                    ? sourceAccount.expires - this.now()
-                    : undefined,
-            });
-            return sourceAccount;
-        }
-        finally {
-            await fileLock.release();
-        }
-    }
-    async refreshAccountQuota(account, storage) {
-        const initialQuotaState = JSON.stringify([
-            account.quota,
-            account.lastQuotaRefreshError,
-        ]);
-        let changed = false;
-        let target = account;
-        const vaultEnabled = this.isFallbackAccountVaultEnabled(target.id, storage);
-        let access = this.resolveFallbackAccessToken(target, storage);
-        if (!access && !vaultEnabled) {
-            target = await this.refreshAccount(account, storage, { force: true });
-            changed = true;
-            access = this.resolveFallbackAccessToken(target, storage);
-        }
-        const delegatedQuotaAuthorization = storage?.claustrum?.scopedRoster === true &&
-            this.quotaManager?.canFetchWithoutAccessToken() === true;
-        if (!access && !delegatedQuotaAuthorization) {
-            log('[quota] fallback quota poll skipped: no usable credential', {
-                accountId: target.id,
-            });
-            return {
-                account: target,
-                fetched: false,
-                changed,
-            };
-        }
-        let quotaPollLock = await acquireRefreshFileLock({
-            name: fallbackRefreshLockName(target.id),
-            ttlMs: FALLBACK_REFRESH_LOCK_TTL_MS,
-            path: this.configPath,
-            now: this.now,
-        });
-        if (!quotaPollLock) {
-            log('[quota] fallback quota poll skipped refresh lock', {
-                accountId: target.id,
-            });
-            return { account: target, fetched: false, changed };
-        }
-        await using _quotaPollLock = {
-            [Symbol.asyncDispose]: async () => quotaPollLock?.release(),
-        };
-        // Unify on the shared QuotaManager when present: it adds inflight
-        // deduplication and 429 backoff gating around the same quota API. Fall back
-        // to a direct fetch only when no QuotaManager is wired (e.g. in isolation).
-        const fetchSnapshot = (accessToken) => this.quotaManager
-            ? this.quotaManager.refreshFallbackWithMetadata(target.id, accessToken, target)
-            : fetchOAuthQuotaSnapshot({
-                accessToken,
-                fetchImpl: this.fetchImpl,
-                now: this.now,
-            }).then((quota) => ({ quota, fetched: true }));
-        const fetchStartedAt = this.now();
-        let fetched = false;
-        try {
-            const result = await fetchSnapshot(access?.token ?? '');
-            target.quota = result.quota;
-            fetched = result.fetched;
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            if (!message.includes('Claude quota check failed: 401') ||
-                vaultEnabled ||
-                access?.source !== 'sidecar') {
-                throw error;
-            }
-            await quotaPollLock.release();
-            quotaPollLock = null;
-            target = await this.refreshAccount(account, storage, {
-                force: true,
-            });
-            changed = true;
-            access = this.resolveFallbackAccessToken(target, storage);
-            if (!access) {
-                log('[quota] fallback quota poll skipped after refresh: no usable credential', {
-                    accountId: target.id,
-                });
-                return {
-                    account: target,
-                    fetched: false,
-                    changed,
-                };
-            }
-            quotaPollLock = await acquireRefreshFileLock({
-                name: fallbackRefreshLockName(target.id),
-                ttlMs: FALLBACK_REFRESH_LOCK_TTL_MS,
-                path: this.configPath,
-                now: this.now,
-            });
-            if (!quotaPollLock) {
-                log('[quota] fallback quota poll skipped refresh lock', {
-                    accountId: target.id,
-                });
-                return { account: target, fetched: false, changed };
-            }
-            // 401 does not arm QuotaManager backoff, so this retry proceeds.
-            const result = await fetchSnapshot(access.token);
-            target.quota = result.quota;
-            fetched = result.fetched;
-        }
-        const latestStorage = await this.load();
-        const latestAccount = latestStorage?.accounts.find((candidate) => candidate.id === target.id && isOAuthAccount(candidate));
-        if (latestStorage &&
-            latestAccount &&
-            latestAccount.access !== target.access) {
-            this.seedFallbackQuota(latestAccount, latestStorage);
-            updateStoredAccount(storage, latestAccount);
-            return { account: latestAccount, fetched: false, changed: false };
-        }
-        if (latestStorage &&
-            latestAccount &&
-            latestAccount.access === target.access &&
-            latestAccount.quota &&
-            quotaSnapshotCheckedAt(latestAccount.quota) >= fetchStartedAt &&
-            quotaSnapshotIsFresh(latestAccount.quota, latestStorage, this.now())) {
-            this.seedFallbackQuota(latestAccount, latestStorage);
-            updateStoredAccount(storage, latestAccount);
-            return { account: latestAccount, fetched, changed: false };
-        }
-        target.lastQuotaRefreshError = undefined;
-        updateStoredAccount(storage, target);
-        // Sync to shared QuotaManager so all consumers see the same cache. The
-        // refreshFallback path already cached the snapshot; re-set here so
-        // refreshAfter reflects this storage's check interval consistently.
-        if (this.quotaManager && target.quota) {
-            const now = this.now();
-            this.quotaManager.setFallback(target.id, {
-                quota: target.quota,
-                refreshAfter: now + getQuotaCheckIntervalMs(storage),
-                checkedAt: now,
-            }, target);
-        }
-        return {
-            account: target,
-            fetched,
-            changed: changed ||
-                JSON.stringify([target.quota, target.lastQuotaRefreshError]) !==
-                    initialQuotaState,
-        };
-    }
-}