@cortexkit/opencode-openai-auth 1.1.0 → 1.3.0

package/src/tui-compiled/runtime/shared/0332701351b3eeec-format.js

@@ -63,8 +63,12 @@ export function quotaWindowName(limit) {
 function clampPercent(remaining) {
     return Math.min(100, Math.max(0, remaining));
 }
+/** A remaining percentage as the whole number every form shows. */
+function wholePercent(remaining) {
+    return Math.round(clampPercent(remaining));
+}
 function percentLeft(remaining) {
-    return `${Math.round(clampPercent(remaining))}% left`;
+    return `${wholePercent(remaining)}% left`;
 }
 function resetDetails(resetsAt, checkedAt, now) {
     const at = resetsAt === undefined ? Number.NaN : Date.parse(resetsAt);
@@ -98,6 +102,16 @@ function displayOrder(left, right) {
  * and the optional age keep the shared formatter's wording.
  */
 export function quotaWindowParts(quota, options) {
+    const { windows, age } = scopedWindowParts(quota, options);
+    const parts = windows.map(({ part }) => part);
+    return age === undefined ? { windows: parts } : { windows: parts, age };
+}
+/**
+ * `quotaWindowParts` with each window's scope kept beside it. The narrow form
+ * needs the scope to name and pick model-scoped windows; the public parts do
+ * not carry it, so their shape stays as it was.
+ */
+function scopedWindowParts(quota, options) {
     if (!quota)
         return { windows: [] };
     const { now } = options;
@@ -107,12 +121,18 @@ export function quotaWindowParts(quota, options) {
     const windows = readings.map((limit) => {
         const remainingPercent = clampPercent(limit.remainingPercent ?? 0);
         return {
-            kind: 'window',
-            name: quotaWindowName(limit),
-            figure: percentLeft(limit.remainingPercent ?? 0),
-            remainingPercent,
-            checkedAt: limit.checkedAt,
-            ...resetDetails(limit.resetsAt, limit.checkedAt, now),
+            scope: limit.scope,
+            ...(limit.windowMinutes === undefined
+                ? {}
+                : { windowMinutes: limit.windowMinutes }),
+            part: {
+                kind: 'window',
+                name: quotaWindowName(limit),
+                figure: percentLeft(limit.remainingPercent ?? 0),
+                remainingPercent,
+                checkedAt: limit.checkedAt,
+                ...resetDetails(limit.resetsAt, limit.checkedAt, now),
+            },
         };
     });
     const budget = quota.budget;
@@ -124,32 +144,196 @@ export function quotaWindowParts(quota, options) {
                 ? `credits ${percentLeft(remainingPercent)}`
                 : 'credits available';
         windows.push({
-            kind: 'budget',
-            name: 'credits',
-            figure,
-            ...(remainingPercent === undefined
-                ? {}
-                : { remainingPercent: clampPercent(remainingPercent) }),
-            checkedAt: budget.checkedAt,
-            ...resetDetails(budget.resetsAt, budget.checkedAt, now),
+            scope: ALL_SCOPE,
+            spent: budget.reached,
+            part: {
+                kind: 'budget',
+                name: 'credits',
+                figure,
+                ...(remainingPercent === undefined
+                    ? {}
+                    : { remainingPercent: clampPercent(remainingPercent) }),
+                checkedAt: budget.checkedAt,
+                ...resetDetails(budget.resetsAt, budget.checkedAt, now),
+            },
         });
     }
     if (windows.length > 0) {
-        const age = now - Math.min(...windows.map((part) => part.checkedAt));
+        const age = now - Math.min(...windows.map(({ part }) => part.checkedAt));
         if (age > (options.staleAfterMs ?? QUOTA_STALE_AFTER_MS)) {
             return { windows, age: `checked ${shortSpan(age)} ago` };
         }
     }
     return { windows };
 }
+/**
+ * Whether the reading is stale: true exactly when the compact and full forms
+ * would end with `checked … ago`. The narrow form leaves that age out to stay
+ * short, so a caller drawing a narrow line uses this to dim it instead.
+ */
+export function isQuotaStale(quota, options) {
+    return scopedWindowParts(quota, options).age !== undefined;
+}
+/**
+ * The model a scope names, as a display name: any namespace before a colon
+ * is dropped (`model:claude-opus-4` → `claude-opus-4`) and the first letter is
+ * capitalized (`fable` → `Fable`); the rest stays as written.
+ */
+function scopeDisplayName(scope) {
+    const model = scope.slice(scope.indexOf(':') + 1);
+    return model.charAt(0).toUpperCase() + model.slice(1);
+}
+/**
+ * Short names for the model scopes in one row: the first two letters of each
+ * display name. Names that would read the same for different models are each
+ * extended one letter at a time until they differ (`Fable` and `Fabric` read
+ * `Fabl` and `Fabr`); a name that runs out of letters stays whole.
+ */
+function scopeAbbreviations(scopes) {
+    const names = [...new Set(scopes.map(scopeDisplayName))];
+    const lengths = new Map(names.map((name) => [name, 2]));
+    const short = (name) => name.slice(0, lengths.get(name));
+    for (;;) {
+        const byShort = new Map();
+        for (const name of names) {
+            byShort.set(short(name), [...(byShort.get(short(name)) ?? []), name]);
+        }
+        let extended = false;
+        for (const group of byShort.values()) {
+            if (group.length < 2)
+                continue;
+            for (const name of group) {
+                const length = lengths.get(name) ?? 2;
+                if (length < name.length) {
+                    lengths.set(name, length + 1);
+                    extended = true;
+                }
+            }
+        }
+        if (!extended)
+            break;
+    }
+    return new Map(scopes.map((scope) => [scope, short(scopeDisplayName(scope))]));
+}
+/** The most groups a grouped narrow line shows. */
+const NARROW_GROUP_LIMIT = 2;
+/**
+ * The names the groups read under in the narrow line, one per listed group:
+ * each label's short name, derived exactly as a model window's is (`Gemini`
+ * → `Ge`, `Other models` → `Ot`, colliding names extended until they
+ * differ), computed over every listed group so a group keeps its name
+ * whichever groups show. A blank label falls back to the group's scope.
+ */
+function groupShortNames(groups) {
+    const labels = groups.map((group) => group.label.trim() || group.scope);
+    const short = scopeAbbreviations(labels);
+    return labels.map((label) => short.get(label) ?? label);
+}
+/**
+ * The narrow line of a reading whose windows belong to named groups and that
+ * has no account-wide window: for each group, its tightest window as
+ * `Ge 7d 62%`, with ` left` once at the end. The tightest window is the
+ * one with least left, compared before rounding; on a tie the first in
+ * display order (the shorter window) wins. At most two groups show: the two
+ * with least left, earlier-listed first on a tie, and always in the order
+ * the reading lists them, so the line does not reorder as the figures move.
+ * A group with no reported window is skipped. Windows outside the listed
+ * groups and the credit budget are left out. Undefined when the rule does
+ * not apply, so the caller uses the ordinary narrow rule.
+ */
+function groupedNarrowPieces(groups, windows) {
+    if (!groups || groups.length === 0)
+        return undefined;
+    const reported = windows.filter(({ part }) => part.kind === 'window');
+    if (reported.some(({ scope }) => scope === ALL_SCOPE))
+        return undefined;
+    const candidates = groups.flatMap((group, listed) => {
+        const inGroup = reported.filter(({ scope }) => scope === group.scope);
+        // `windows` is already in display order, and strictly lower wins, so on
+        // a tie the shorter window keeps the place.
+        const groupTightest = inGroup.reduce((least, window) => least === undefined ||
+            (window.part.remainingPercent ?? 0) < (least.part.remainingPercent ?? 0)
+            ? window
+            : least, undefined);
+        return groupTightest ? [{ group, listed, window: groupTightest }] : [];
+    });
+    if (candidates.length === 0)
+        return undefined;
+    const names = groupShortNames(groups);
+    const left = (candidate) => candidate.window.part.remainingPercent ?? 0;
+    const shown = [...candidates]
+        .sort((a, b) => left(a) - left(b) || a.listed - b.listed)
+        .slice(0, NARROW_GROUP_LIMIT)
+        .sort((a, b) => a.listed - b.listed);
+    return shown.map((candidate, index) => {
+        const { windowMinutes } = candidate.window;
+        const piece = [
+            names[candidate.listed] ?? candidate.group.scope,
+            ...(windowMinutes === undefined ? [] : [lengthName(windowMinutes)]),
+            `${wholePercent(left(candidate))}%`,
+        ].join(' ');
+        return index === shown.length - 1 ? `${piece} left` : piece;
+    });
+}
+/**
+ * The narrow form's pieces: every account-wide window as `5h 92%`, then at
+ * most one more item, with ` left` added once to the last piece. That item is
+ * the tightest (least remaining) of the model-scoped windows and the credit
+ * budget, so the line stays bounded whatever the account carries: a scoped
+ * window reads under its short model name (`Fa 98%`), the budget as `cr 75%`
+ * (`cr 0%` when spent). On a tie a scoped window wins over the budget, and
+ * among scoped windows the first in display order wins. The choice depends
+ * only on the reading, never on a width. A budget without a percentage cannot
+ * be chosen; when nothing at all is shown it keeps its compact wording
+ * (`credits available`). No age is added; `isQuotaStale` says whether the
+ * reading is stale. A window whose reset arrived after the reading keeps its
+ * figure, as in the other forms. A reading that lists named groups and has no
+ * account-wide window reads one item per group instead (see
+ * `groupedNarrowPieces`).
+ */
+function narrowTextParts(quota, options) {
+    const { windows } = scopedWindowParts(quota, options);
+    const grouped = groupedNarrowPieces(quota?.groups, windows);
+    if (grouped)
+        return grouped;
+    const general = windows.filter(({ part, scope }) => part.kind === 'window' && scope === ALL_SCOPE);
+    const scoped = windows.filter(({ part, scope }) => part.kind === 'window' && scope !== ALL_SCOPE);
+    const abbreviations = scopeAbbreviations(scoped.map(({ scope }) => scope));
+    // The items competing for the one slot after the account-wide windows, in
+    // tie-break order: scoped windows in display order, then the budget. A
+    // spent budget counts as 0% left; one without a percentage cannot compete.
+    const budget = windows.find(({ part }) => part.kind === 'budget');
+    const budgetLeft = budget?.spent ? 0 : budget?.part.remainingPercent;
+    const extras = [
+        ...scoped.map(({ scope, part }) => ({
+            label: abbreviations.get(scope) ?? scope,
+            remaining: part.remainingPercent ?? 0,
+        })),
+        ...(budgetLeft === undefined
+            ? []
+            : [{ label: 'cr', remaining: budgetLeft }]),
+    ];
+    // Strictly lower wins, so on a tie the earlier item keeps the slot.
+    const tightest = extras.reduce((best, item) => best === undefined || item.remaining < best.remaining ? item : best, undefined);
+    const pieces = general.map(({ part }) => `${part.name} ${wholePercent(part.remainingPercent ?? 0)}%`);
+    if (tightest) {
+        pieces.push(`${tightest.label} ${wholePercent(tightest.remaining)}%`);
+    }
+    if (pieces.length === 0)
+        return windows.map(({ part }) => part.figure);
+    return pieces.map((piece, index) => index === pieces.length - 1 ? `${piece} left` : piece);
+}
 /**
  * The pieces of a quota text, in order: one per reported window
  * (`5h 58% left, resets 2h`), then the credit budget when there is one, then
  * `checked 3h ago` when the oldest piece shown is stale. Empty when nothing
  * was reported; `formatQuota` turns that into a sentence. A caller printing
- * one line per window (the terminal auth menu) uses these directly.
+ * one line per window (the terminal auth menu) uses these directly. In the
+ * narrow form the pieces are the narrow line's (`5h 92%`, `7d 66% left`).
  */
 export function quotaTextParts(quota, options) {
+    if (options.form === 'narrow')
+        return narrowTextParts(quota, options);
     const parts = quotaWindowParts(quota, options);
     const full = (options.form ?? 'full') === 'full';
     const text = parts.windows.map((part) => {
@@ -160,7 +344,8 @@ export function quotaTextParts(quota, options) {
 }
 /**
  * A row's quota as one line: `5h 58% left · 7d 90% left` in the compact
- * form, with `, resets 2h` after each window in the full form. With nothing
+ * form, with `, resets 2h` after each window in the full form, and
+ * `5h 58% · 7d 90% left` in the narrow form. With nothing
  * reported it is `NO_QUOTA_READING`, or `NO_LIMITS_REPORTED` when the
  * provider answered without a limit for any window.
  */

package/src/tui-compiled/runtime/shared/0f77ebc3c914c9c6-custody.js

@@ -1,11 +1,14 @@
 import { ClaustrumCredentialError, } from "@cortexkit/claustrum-client";
 import { createLogger } from "./cc9e0702a752cea7-index.js";
+import { ClaustrumUnreachableError, classifyVaultFailure, } from "./94f53cfd572ba4bb-availability.js";
 import { readClaustrumEnrollmentToken } from "./b9588ad4725c1d10-enrollment.js";
 import { ClaustrumConsumerError } from "./ca0fccaba1d87af4-errors.js";
 import { CUSTODY_PLACEHOLDER_PREFIX } from "./d9d2892a4c371301-host-slot.js";
 /** Only a new version of the same account may replace an in-flight 401. */
 export function isScopedCredentialRotation(served, current) {
     return (current !== undefined &&
+        !current.fromKeptReceipt &&
+        !served.fromKeptReceipt &&
         current.credentialId === served.credentialId &&
         current.accountIdentity === served.accountIdentity &&
         current.recordVersion !== served.recordVersion);
@@ -45,6 +48,8 @@ export function decideScopedRetryAfter401(site, served, current, logger = defaul
  * so it cannot expire while a long request is still using it.
  */
 export const SERVING_MARGIN_MS = 300_000;
+/** A kept receipt needs a minute of headroom, not the vault's refresh demand. */
+export const KEPT_RECEIPT_MARGIN_MS = 60_000;
 function invalidMaterial() {
     return new ClaustrumConsumerError('invalid-material', 'Claustrum returned invalid credential material');
 }
@@ -83,13 +88,28 @@ function credentialTypeOf(row, family) {
         return row.refreshAdapter === undefined ? 'api_key' : undefined;
     return undefined;
 }
+/**
+ * The grants named in the vault's list reply, or undefined when it names none.
+ * Both fields must be present: a reply carrying only one of them is treated as
+ * unknown rather than completed with a guess. claustrum-client already refuses
+ * a malformed value, so nothing here validates it again.
+ */
+function grantReachOf(listed) {
+    const { grants, grantTuples } = listed;
+    if (grants === undefined || grantTuples === undefined)
+        return undefined;
+    return Object.freeze({
+        grants,
+        tuples: Object.freeze(grantTuples.map(({ selectorKind, selector, operation }) => Object.freeze({ selectorKind, selector, operation }))),
+    });
+}
 /**
  * Reads this consumer's vault credentials (list, fetch, 401 report), with the
- * enrollment token as authorization. Used by every host of a plugin. There is
- * deliberately no credential cache and no single-flight of credential reads:
- * each physical send is authorized by the vault, so a revoked enrollment or a
- * changed record takes effect on the next send. The enrollment token is
- * re-read per operation so an operator's reissue on disk is picked up.
+ * enrollment token as authorization. Used by every host of a plugin. Every
+ * physical send asks the vault first while reachable. Only an unreachable vault permits
+ * reuse of the last validated receipt, in memory and bounded by its expiry.
+ * The enrollment token is re-read per operation so revocation and disconnect
+ * still take effect without a process restart.
  */
 export class ClaustrumScopedCustody {
     #client;
@@ -101,6 +121,16 @@ export class ClaustrumScopedCustody {
     #logger;
     #provenance = new WeakMap();
     #reports = new WeakMap();
+    #kept = new Map();
+    #keptAttempts = new WeakMap();
+    #setTimeout;
+    #clearTimeout;
+    #outage = false;
+    #outageError = new ClaustrumUnreachableError();
+    #probeTimer;
+    #probing = false;
+    #lastProbeAt = -Infinity;
+    #probeDelay = 2_000;
     #closed = false;
     constructor(options) {
         const tokenPath = options.tokenPath;
@@ -119,6 +149,63 @@ export class ClaustrumScopedCustody {
         this.#requireAssertion = options.requireAssertion ?? false;
         this.#now = options.now ?? Date.now;
         this.#logger = options.logger ?? defaultLogger;
+        this.#setTimeout = options.setTimeoutImpl ?? setTimeout;
+        this.#clearTimeout = options.clearTimeoutImpl ?? clearTimeout;
+    }
+    /** A watch losing its transport is the same outage as an unreachable read. */
+    transportLost(error) {
+        if (this.#closed || this.#outage)
+            return;
+        this.#outage = true;
+        this.#outageError =
+            error instanceof ClaustrumCredentialError
+                ? error
+                : new ClaustrumUnreachableError();
+        this.#logger.warn('serving kept vault receipt', { reason: 'unreachable' });
+        this.#scheduleProbe();
+    }
+    /** Any vault answer ends transport fallback, even when it refuses access. */
+    reachable() {
+        if (this.#closed || !this.#outage)
+            return;
+        this.#outage = false;
+        if (this.#probeTimer)
+            this.#clearTimeout(this.#probeTimer);
+        this.#probeTimer = undefined;
+        this.#probeDelay = 2_000;
+        for (const kept of this.#kept.values())
+            kept.since = null;
+        (this.#logger.info ?? defaultLogger.info)('vault receipt serving resumed', { reason: 'reachable' });
+    }
+    #scheduleProbe() {
+        if (this.#closed || !this.#outage || this.#probeTimer || this.#probing)
+            return;
+        this.#probeTimer = this.#setTimeout(() => {
+            this.#probeTimer = undefined;
+            this.#probe(true);
+        }, this.#probeDelay);
+        this.#probeTimer.unref?.();
+    }
+    #probe(idle = false) {
+        if (this.#closed || !this.#outage || this.#probing)
+            return;
+        if (this.#now() - this.#lastProbeAt < 1_000) {
+            this.#scheduleProbe();
+            return;
+        }
+        this.#lastProbeAt = this.#now();
+        this.#probing = true;
+        // Both triggers share list_scoped discovery, including its receipt-drop rules.
+        // Sends never await discovery or let idle backoff delay the next send probe.
+        void this.discover()
+            .catch(() => {
+            if (idle && this.#outage)
+                this.#probeDelay = Math.min(this.#probeDelay * 2, 30_000);
+        })
+            .finally(() => {
+            this.#probing = false;
+            this.#scheduleProbe();
+        });
     }
     #check(signal) {
         if (this.#closed)
@@ -157,17 +244,24 @@ export class ClaustrumScopedCustody {
         }
         catch (error) {
             this.#check(signal);
+            if (classifyVaultFailure(error) === 'unreachable')
+                this.transportLost(error);
+            else
+                this.reachable();
             // Keep the vault's own refusals (ClaustrumCredentialError, carrying
             // code, class and action); replace any other error, whose text may echo
             // request params that include the enrollment token.
             if (error instanceof ClaustrumCredentialError)
                 throw error;
+            if (classifyVaultFailure(error) === 'unreachable')
+                throw new ClaustrumUnreachableError();
             throw new ClaustrumConsumerError('unavailable', 'Claustrum scoped operation unavailable');
         }
         finally {
             removeAbortListener?.();
         }
         this.#check(signal);
+        this.reachable();
         return result;
     }
     /**
@@ -177,8 +271,22 @@ export class ClaustrumScopedCustody {
      * skipped records: they simply are not this consumer's.
      */
     async discover(signal) {
-        const token = await this.#token(signal);
-        const inventory = await this.#call(() => this.#client.listScoped(token), signal);
+        let inventory;
+        let token;
+        try {
+            token = await this.#token(signal);
+        }
+        catch (error) {
+            this.#kept.clear();
+            throw error;
+        }
+        try {
+            inventory = await this.#call(() => this.#client.listScoped(token), signal);
+        }
+        catch (error) {
+            this.listFailed(error);
+            throw error;
+        }
         const skipped = [];
         const candidates = [];
         const counts = new Map();
@@ -217,29 +325,128 @@ export class ClaustrumScopedCustody {
         }
         for (const record of skipped)
             this.#logger.warn('skipped malformed vault record', record);
+        const grantReach = grantReachOf(inventory);
         return {
             view: inventory.view,
             credentials: Object.freeze(credentials),
             skipped: Object.freeze(skipped),
+            ...(grantReach && { grantReach }),
         };
     }
     /**
-     * Fetch the credential for one physical send and wrap it in a fresh receipt.
-     * The vault's served identity (or, without one, the plugin's parse of the
-     * token) must equal the roster's when both are present. Without
-     * `requireAssertion`, absence on either side proves nothing and does not
-     * refuse; the receipt records what the vault asserted separately from what
-     * the roster expected. With it, a reply that does not itself name the
-     * credential id and the expected account is refused.
+     * Apply a failed account listing: any answer from the vault (a refusal such
+     * as a revoked enrollment's `not_found`) drops every kept receipt, while an
+     * unreachable vault keeps them. A vault watch that ends with the same
+     * refusal calls this too, so both paths treat it alike.
      */
-    async authorize(identity, signal) {
+    listFailed(error) {
+        if (classifyVaultFailure(error) === 'unreachable')
+            this.transportLost(error);
+        else {
+            this.reachable();
+            this.#kept.clear();
+        }
+    }
+    /** Discard bearer material when a route is removed, declined or rebound. */
+    forget(credentialId) {
+        this.#kept.delete(credentialId);
+    }
+    /** Apply an already-held roster; this never fetches credentials or writes it. */
+    retain(identities) {
+        const current = new Map(identities.map((identity) => [identity.credentialId, identity]));
+        for (const [id, kept] of this.#kept) {
+            const identity = current.get(id);
+            if (!identity?.enabled ||
+                identity.state !== 'active' ||
+                identity.credentialType !== kept.attempt.credentialType ||
+                identity.accountIdentity !== kept.attempt.expectedAccountIdentity)
+                this.forget(id);
+        }
+    }
+    /** A frozen, non-secret summary for a plugin's status display. */
+    keptReceiptState() {
+        let since = null;
+        for (const [id, kept] of this.#kept) {
+            if (!this.#usable(kept.attempt)) {
+                this.forget(id);
+                continue;
+            }
+            if (kept.since !== null)
+                since = Math.min(since ?? kept.since, kept.since);
+        }
+        return Object.freeze({ active: since !== null, since });
+    }
+    #usable(attempt) {
+        return attempt.expiresAtMs === null
+            ? attempt.credentialType === 'api_key'
+            : attempt.expiresAtMs - this.#now() > KEPT_RECEIPT_MARGIN_MS;
+    }
+    /** Ask the vault while reachable; retain one validated receipt in memory only. */
+    async authorize(identity, signal, routeId = 'vault') {
+        this.#check(signal);
+        const { credentialId, credentialType, accountIdentity } = identity;
+        let kept = this.#kept.get(credentialId);
+        if (kept &&
+            (kept.attempt.credentialType !== credentialType ||
+                kept.attempt.expectedAccountIdentity !== accountIdentity)) {
+            this.forget(credentialId);
+            kept = undefined;
+        }
+        // A missing or invalid enrollment is not a transport outage.
+        let token;
+        try {
+            token = await this.#token(signal);
+        }
+        catch (error) {
+            this.#kept.clear();
+            throw error;
+        }
+        if (this.#outage && kept) {
+            this.#probe();
+            return this.#serveKept(credentialId, kept, token, routeId);
+        }
+        try {
+            const attempt = await this.#authorizeFresh({ credentialId, credentialType, accountIdentity }, token, signal);
+            this.#kept.set(credentialId, { attempt, routeId, since: null });
+            return attempt;
+        }
+        catch (error) {
+            this.#check(signal);
+            if (classifyVaultFailure(error) !== 'unreachable') {
+                this.forget(credentialId);
+                throw error;
+            }
+            return this.#serveKept(credentialId, kept, token, routeId, error);
+        }
+    }
+    #serveKept(credentialId, kept, token, routeId, error = this.#outageError) {
+        // A concurrent refusal or 401 may already have discarded this entry.
+        if (!kept ||
+            this.#kept.get(credentialId) !== kept ||
+            !this.#usable(kept.attempt)) {
+            this.forget(credentialId);
+            throw error;
+        }
+        if (kept.since === null)
+            kept.since = this.#now();
+        const attempt = Object.freeze(Object.defineProperty({ ...kept.attempt, fromKeptReceipt: true }, 'accessToken', { value: kept.attempt.accessToken, enumerable: false }));
+        this.#provenance.set(attempt, token);
+        this.#keptAttempts.set(attempt, routeId);
+        return attempt;
+    }
+    /**
+     * Fetch and validate a fresh receipt before retaining it. The vault assertion
+     * (or the plugin's token parse) must agree with the roster when both exist.
+     * With requireAssertion, an absent assertion also refuses rather than
+     * treating the roster's expectation as proof of the served account.
+     */
+    async #authorizeFresh(identity, token, signal) {
         if (!identity.credentialId)
             throw new ClaustrumConsumerError('route-unavailable', 'Claustrum dispatch requires a credential id');
         // Capture the caller's fields before yielding so a later mutation cannot move the fence.
         const { credentialId, credentialType, accountIdentity } = identity;
         if (this.#requireAssertion && accountIdentity === undefined)
             throw new ClaustrumConsumerError('identity-unasserted', 'Claustrum dispatch requires a known account identity');
-        const token = await this.#token(signal);
         const served = await this.#call(() => this.#client.getScoped({
             credentialId,
             enrollmentToken: token,
@@ -321,6 +528,21 @@ export class ClaustrumScopedCustody {
         const token = this.#provenance.get(attempt);
         if (!token)
             throw new ClaustrumConsumerError('no-receipt', 'Claustrum failure report requires an original dispatch receipt');
+        const keptRoute = this.#keptAttempts.get(attempt);
+        if (keptRoute !== undefined) {
+            this.forget(attempt.credentialId);
+            this.#logger.debug('scoped 401 not reported', {
+                routeId: keptRoute,
+                reason: 'kept-receipt',
+            });
+            return;
+        }
+        // The provider rejected this token, so it must not come back as a kept
+        // receipt during a later outage. Drop it before reporting, so a report that
+        // fails because the vault is unreachable still drops it.
+        const kept = this.#kept.get(attempt.credentialId);
+        if (kept && kept.attempt.recordVersion === attempt.recordVersion)
+            this.forget(attempt.credentialId);
         const pending = this.#reports.get(attempt);
         if (pending)
             return pending;
@@ -349,6 +571,10 @@ export class ClaustrumScopedCustody {
         if (this.#closed)
             return;
         this.#closed = true;
+        if (this.#probeTimer)
+            this.#clearTimeout(this.#probeTimer);
+        this.#probeTimer = undefined;
+        this.#kept.clear();
         this.#client.close();
     }
 }