@goodandready/dsh-subscriptions 0.6.72 → 0.6.82

package/lib/index.js

@@ -2,6 +2,7 @@ import { plainConfig } from './config-schema.js'
 export { plainConfig } from './config-schema.js'
 import { readFileSync } from 'node:fs'
 import { bestEffort } from './utils.js'
+import { sweepExpiredPending } from './oauth-pending.js'
 export { Config, publicConfig, Slot, defaultSlots } from './config-schema.js'
 import { Config } from './config-schema.js'
 import { registerRoutes } from './routes.js'
@@ -21,8 +22,10 @@ import { proxyFetch } from './proxy.js'
 import { HistoryStore, resolveHistoryDir } from './history.js'
 import { createDiagnosticsReport } from './diagnostics.js'
 import { createAccountsView } from './accounts-view.js'
+import { inspectScopes } from './scope-inspector.js'
 import { createAdapterManager } from './adapter-manager.js'
-import { pickAccount } from './rotate.js'
+import { pickAccount, isAuthError } from './rotate.js'
+import { notifySessionExpired } from './alerts.js'
 
 export { observeForecast, estimateForecast } from './forecast.js'
 export { formatRelativeReset } from './relative-time.js'
@@ -31,6 +34,9 @@ export { exportVault, importVault } from './vault.js'
 export { recordAlert, getRecentAlerts, checkQuotaThresholds, notifySessionExpired } from './alerts.js'
 export { calculateBurnRatePerHour, computePacingRisk } from './forecast.js'
 export { needsWarmupProbe, enterProbing, resolveWarmupSuccess, resolveWarmupFailure } from './quarantine.js'
+export { encodeQrMatrix, renderAsciiQr, renderSvgQr, renderSvgDataUrl, generateSshTunnelCommand, getHeadlessAuthInfo, handleHeadlessRedirect } from './headless-auth.js'
+export { pushToWebdav, pullFromWebdav, pushToGist, pullFromGist, buildS3SigV4Headers, pushToS3, pullFromS3, syncVaultPush, syncVaultPull, getVaultSyncStatus, resetVaultSyncStatus } from './vault-sync.js'
+import { syncVaultPush, syncVaultPull, getVaultSyncStatus } from './vault-sync.js'
 
 export const name = '@goodandready/dsh-subscriptions'
 export const inject = ['llm', 'credentials', 'webServer', 'settings']
@@ -380,11 +386,15 @@ export function apply(ctx, rawConfig) {
   const pending = new Map()
 
   function sweepPending(now) {
-    for (const [stateKey, row] of pending) {
-      if (now - row.createdAt > PENDING_TTL_MS) pending.delete(stateKey)
-    }
+    sweepExpiredPending(pending, now, PENDING_TTL_MS)
   }
 
+  ctx.effect(() => {
+    const id = setInterval(() => sweepPending(Date.now()), 60 * 1000)
+    if (id && typeof id.unref === 'function') id.unref()
+    return () => clearInterval(id)
+  }, 'dsh-subscriptions: pending oauth sweep')
+
   async function completeOAuth({ provider, index, code, state }) {
     if (!state) throw new Error('missing oauth state')
     sweepPending(Date.now())
@@ -401,14 +411,26 @@ export function apply(ctx, rawConfig) {
       challenge: row.challenge,
       state: row.state,
     }, code, fetchForRef(ref) || fetch)
+    const inspection = inspectScopes(actualProvider, blob.scopes)
+    blob.scopes = inspection.scopes
+    blob.scopeWarning = inspection.scopeWarning || ""
     const slots = normalizeSlots(live().slots)
     const slot = slots.find((s) => s.ref === ref)
     if (slot && slot.label) blob.label = slot.label
-    await store.saveBlob(ref, blob)
+    let existing = {}
+    try { existing = await store.loadBlob(ref) } catch { /* no existing blob on fresh auth */ }
+    const merged = { ...existing, ...blob }
+    await store.saveBlob(ref, merged)
+    store.recordSuccess(ref)
+    store.clearRefreshFailure(ref)
+    store.clearCooldown(ref)
     pending.delete(row.state)
     await syncAdapter()
     refreshModels().catch(() => {})
-    return { ref, label: pmL(blob.label || blob.email) || displayName(actualProvider) }
+    if (live().vaultSyncEnabled && live().vaultSyncAutoPush) {
+      syncVaultPush({ live: live(), store }).catch(() => {})
+    }
+    return { ref, label: pmL(merged.label || merged.email) || displayName(actualProvider) }
   }
 
   // Privacy masking
@@ -449,7 +471,7 @@ export function apply(ctx, rawConfig) {
   }
 
   const diagnosticsReport = () => createDiagnosticsReport({ live, store, history, NS, pkgVersion, heartbeatStats })
-  const accountsView = () => createAccountsView({ live, store, fetch, pmL })
+  const accountsView = () => createAccountsView({ live, store, fetch, pmL, pmE, history })
 
   // Ponytail: background refresh ahead of expiry, single timer
   ctx.effect(() => {
@@ -473,15 +495,51 @@ export function apply(ctx, rawConfig) {
           if (!raw) continue
           const blob = await store.loadBlob(ref).catch(() => null)
           if (!blob || !blob.refreshToken) continue
-          const fresh = await store.ensureFresh(slot.provider, blob, ref).catch(() => null)
+          let fresh
+          try {
+            fresh = await store.ensureFresh(slot.provider, blob, ref)
+          } catch (refreshErr) {
+            if (isAuthError(refreshErr)) {
+              store.recordBroken(ref)
+              store.rememberQuarantine(ref, "SESSION_REVOKED", Date.now() + 86400000, 1)
+              try {
+                notifySessionExpired({
+                  ref,
+                  provider: slot.provider,
+                  message: refreshErr && refreshErr.message,
+                  webhookUrl: cfg.webhookUrl,
+                  fetchImpl: fetch,
+                  nowMs: Date.now(),
+                })
+              } catch { /* alert best-effort */ }
+            }
+            continue
+          }
           if (!fresh) continue
           const vendor = getVendor(slot.provider)
           if (typeof vendor.check !== 'function') continue
           const cfg2 = vendorConfig(slot.provider, live())
           const probeFetch = async (u, i) => ((typeof fetchForRef === 'function' && fetchForRef(ref)) || fetch)(u, i)
-          await vendor.check(fresh, cfg2, probeFetch).catch((e) => {
-            if (logger && logger.warn) logger.warn('[dsh-subscriptions] probe ' + ref + ': ' + String(e && e.message || e).slice(0, 200))
-          })
+          try {
+            await vendor.check(fresh, cfg2, probeFetch)
+            if (typeof store.rememberDoctorVerdict === 'function') store.rememberDoctorVerdict(ref, null)
+          } catch (checkErr) {
+            if (isAuthError(checkErr)) {
+              store.recordBroken(ref)
+              store.rememberQuarantine(ref, "SESSION_REVOKED", Date.now() + 86400000, 1)
+              try {
+                notifySessionExpired({
+                  ref,
+                  provider: slot.provider,
+                  message: checkErr && checkErr.message,
+                  webhookUrl: cfg.webhookUrl,
+                  fetchImpl: fetch,
+                  nowMs: Date.now(),
+                })
+              } catch { /* alert best-effort */ }
+            }
+            if (logger && logger.warn) logger.warn('[dsh-subscriptions] probe ' + ref + ': ' + String(checkErr && checkErr.message || checkErr).slice(0, 200))
+          }
         } catch { /* best-effort */ }
       }
     }
@@ -499,6 +557,35 @@ export function apply(ctx, rawConfig) {
     return () => clearInterval(timer)
   }, 'dsh-subscriptions: probe loop')
 
+  // #562: Background automated remote vault sync loop
+  ctx.effect(() => {
+    const checkSync = async () => {
+      const cfg = live()
+      if (!cfg.vaultSyncEnabled || !cfg.vaultSyncIntervalHours || cfg.vaultSyncIntervalHours <= 0) return
+      const status = getVaultSyncStatus()
+      const now = Date.now()
+      const intervalMs = cfg.vaultSyncIntervalHours * 3600 * 1000
+      const lastPull = status.lastPullAt ? new Date(status.lastPullAt).getTime() : 0
+      if (now - lastPull >= intervalMs) {
+        try {
+          await syncVaultPull({
+            live: cfg,
+            store,
+            settingsApi: getSettingsApi(),
+            syncAdapter,
+            refreshModels,
+          })
+        } catch { /* status captures error */ }
+      }
+    }
+    const intervalId = setInterval(() => { checkSync().catch(() => {}) }, 60 * 60 * 1000)
+    const initialTimer = setTimeout(() => { checkSync().catch(() => {}) }, 30 * 1000)
+    return () => {
+      clearInterval(intervalId)
+      clearTimeout(initialTimer)
+    }
+  }, 'dsh-subscriptions: vault-sync-loop')
+
   registerRoutes(ctx, {
     NS,
     live,

package/lib/jwt.js

@@ -1,9 +1,9 @@
-function decodeJwtPayload(token) {
-  const raw = String(token || '')
-  const parts = raw.split('.')
+export function decodeJwtPayload(token) {
+  const raw = String(token || "")
+  const parts = raw.split(".")
   if (parts.length < 2) return null
   try {
-    const json = Buffer.from(parts[1], 'base64url').toString('utf8')
+    const json = Buffer.from(parts[1], "base64url").toString("utf8")
     return JSON.parse(json)
   } catch {
     return null
@@ -12,42 +12,84 @@ function decodeJwtPayload(token) {
 
 export function chatgptAccountId(token) {
   const payload = decodeJwtPayload(token)
-  if (!payload || typeof payload !== 'object') return ''
+  if (!payload || typeof payload !== "object") return ""
   if (payload.chatgpt_account_id) return String(payload.chatgpt_account_id)
-  const nested = payload['https://api.openai.com/auth']
+  const nested = payload["https://api.openai.com/auth"]
   if (nested && nested.chatgpt_account_id) return String(nested.chatgpt_account_id)
+  if (nested && nested.user_id) return String(nested.user_id)
   const orgs = payload.organizations
   if (Array.isArray(orgs) && orgs[0] && orgs[0].id) return String(orgs[0].id)
-  return ''
+  if (payload.sub) return String(payload.sub)
+  return ""
 }
 
 export function emailFromToken(token) {
   const payload = decodeJwtPayload(token)
-  if (!payload) return ''
-  return String(payload.email || payload.preferred_username || '')
+  if (!payload || typeof payload !== "object") return ""
+  if (payload.email) return String(payload.email)
+  const openaiProf = payload["https://api.openai.com/profile"]
+  if (openaiProf && openaiProf.email) return String(openaiProf.email)
+  if (payload.preferred_username) return String(payload.preferred_username)
+  if (payload.upn) return String(payload.upn)
+  return ""
+}
+
+export function planFromToken(token) {
+  const payload = decodeJwtPayload(token)
+  if (!payload || typeof payload !== "object") return ""
+  const nested = payload["https://api.openai.com/auth"]
+  if (nested && nested.chatgpt_plan_type) return String(nested.chatgpt_plan_type)
+  const anthropic = payload["https://api.anthropic.com"]
+  if (anthropic && anthropic.plan) return String(anthropic.plan)
+  if (payload.plan_type) return String(payload.plan_type)
+  if (payload.plan) return typeof payload.plan === "string" ? payload.plan : (payload.plan.name || "")
+  if (payload.subscription && payload.subscription.tier) return String(payload.subscription.tier)
+  if (payload.subscription_tier) return String(payload.subscription_tier)
+  if (payload.paidTierName) return String(payload.paidTierName)
+  return ""
+}
+
+export function avatarFromToken(token) {
+  const payload = decodeJwtPayload(token)
+  if (!payload || typeof payload !== "object") return ""
+  if (payload.picture && typeof payload.picture === "string") return payload.picture
+  if (payload.avatar_url && typeof payload.avatar_url === "string") return payload.avatar_url
+  if (payload.avatar && typeof payload.avatar === "string") return payload.avatar
+  const openaiProf = payload["https://api.openai.com/profile"]
+  if (openaiProf && openaiProf.picture && typeof openaiProf.picture === "string") return openaiProf.picture
+  return ""
+}
+
+export function scopesFromToken(token) {
+  const payload = decodeJwtPayload(token)
+  if (!payload || typeof payload !== "object") return []
+  const raw = payload.scope || payload.scp || ""
+  if (Array.isArray(raw)) return raw.map(String).filter(Boolean)
+  if (typeof raw === "string") return raw.split(/[\s,]+/).filter(Boolean)
+  return []
 }
 
 export function isGoogleClientId(str) {
-  if (typeof str !== 'string') return false
+  if (typeof str !== "string") return false
   const trimmed = str.trim()
   return /^[0-9]+-[a-zA-Z0-9_-]+\.apps\.googleusercontent\.com$/.test(trimmed)
 }
 
 export function extractGoogleClientIdFromJwt(token) {
   const payload = decodeJwtPayload(token)
-  if (!payload || typeof payload !== 'object') return ''
+  if (!payload || typeof payload !== "object") return ""
 
-  const azp = typeof payload.azp === 'string' ? payload.azp.trim() : ''
+  const azp = typeof payload.azp === "string" ? payload.azp.trim() : ""
   const rawAud = payload.aud
 
   const audiences = Array.isArray(rawAud)
-    ? rawAud.filter(a => typeof a === 'string').map(a => a.trim())
-    : (typeof rawAud === 'string' && rawAud.trim() ? [rawAud.trim()] : [])
+    ? rawAud.filter(a => typeof a === "string").map(a => a.trim())
+    : (typeof rawAud === "string" && rawAud.trim() ? [rawAud.trim()] : [])
 
   if (azp) {
-    if (!isGoogleClientId(azp)) return ''
+    if (!isGoogleClientId(azp)) return ""
     if (audiences.length > 0 && !audiences.includes(azp)) {
-      return ''
+      return ""
     }
     return azp
   }
@@ -57,5 +99,30 @@ export function extractGoogleClientIdFromJwt(token) {
     return validAuds[0]
   }
 
-  return ''
+  return ""
+}
+
+export function organizationsFromToken(token) {
+  const payload = decodeJwtPayload(token)
+  if (!payload || typeof payload !== "object") return []
+  const raw = payload.organizations ||
+    (payload["https://api.openai.com/auth"] && payload["https://api.openai.com/auth"].organizations) ||
+    payload.orgs ||
+    (payload["https://api.anthropic.com/auth"] && payload["https://api.anthropic.com/auth"].organizations) ||
+    []
+  if (!Array.isArray(raw)) return []
+  const out = []
+  for (const item of raw) {
+    if (typeof item === "string" && item.trim()) {
+      out.push({ id: item.trim(), name: item.trim() })
+    } else if (item && typeof item === "object") {
+      const id = String(item.id || item.org_id || item.uuid || "").trim()
+      const name = String(item.title || item.name || item.org_name || id).trim()
+      const role = item.role ? String(item.role).trim() : undefined
+      if (id) {
+        out.push({ id, name: name || id, ...(role ? { role } : {}) })
+      }
+    }
+  }
+  return out
 }

package/lib/loopback.js

@@ -30,8 +30,9 @@ export function startLoopback({ redirectUri, timeoutMs = 10 * 60 * 1000, onCode
   const promise = new Promise((resolve, reject) => {
     const server = http.createServer((req, res) => {
       const url = new URL(req.url || '/', `http://127.0.0.1:${port}`)
-      // The provider may redirect to a suffixed path (e.g. /auth/callback/extra)
-      if (!url.pathname.startsWith(path)) {
+      // The provider may redirect to a suffixed path (e.g. /auth/callback/extra) (#545)
+      const matchesPath = url.pathname === path || (path.endsWith("/") ? url.pathname.startsWith(path) : url.pathname.startsWith(path + "/"));
+      if (!matchesPath) {
         res.writeHead(404, { 'Content-Type': 'text/html; charset=utf-8' })
         res.end(ERR_HTML)
         return

package/lib/mask.js

@@ -20,6 +20,22 @@ export function maskText(value) {
   return String(value || '').replace(EMAIL_RE, (m) => maskEmail(m))
 }
 
+const SECRET_PATTERNS = [
+  [/Bearer\s+[A-Za-z0-9._~+/-]+=*/gi, 'Bearer [REDACTED]'],
+  [/\b(?:sk|ghp|gho|ghu|ghs|ghr|github_pat|xox[baprs])[-_][A-Za-z0-9._-]{8,}/g, '[REDACTED]'],
+  [/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, '[REDACTED]'],
+  [/\b(access_token|refresh_token|token|key|secret|password)=([^&\s]+)/gi, '$1=[REDACTED]'],
+]
+
+// #578: redact credentials as well as emails from free-text diagnostics.
+export function maskSecrets(value) {
+  let text = maskText(value)
+  for (const [pattern, replacement] of SECRET_PATTERNS) {
+    text = text.replace(pattern, replacement)
+  }
+  return text
+}
+
 export function cleanErrorMessage(raw) {
   if (!raw) return ''
   let text = typeof raw === 'string' ? raw : (raw.message || String(raw))

package/lib/oauth-pending.js

@@ -0,0 +1,12 @@
+// #580: shared expiry sweep for in-memory OAuth pending rows.
+export function sweepExpiredPending(pending, nowMs, ttlMs) {
+  let removed = 0
+  for (const [stateKey, row] of pending) {
+    const createdAt = Number(row && row.createdAt)
+    if (!Number.isFinite(createdAt) || Number(nowMs) - createdAt > Number(ttlMs)) {
+      pending.delete(stateKey)
+      removed += 1
+    }
+  }
+  return removed
+}

package/lib/pricing.js

@@ -0,0 +1,89 @@
+// Subscription Value Delivered & API Cost Equivalent Counter (#561)
+// Translates raw prompt, completion and cache tokens into equivalent official API pricing,
+// comparing delivered value against monthly subscription fee ($20/mo standard).
+
+export const DEFAULT_SUBSCRIPTION_MONTHLY_COST = 20.0
+
+export const TOKEN_RATES = {
+  'claude-3-7-sonnet': { prompt: 3.0, completion: 15.0, cacheRead: 0.3 },
+  'claude-3-5-sonnet': { prompt: 3.0, completion: 15.0, cacheRead: 0.3 },
+  'claude-3-5-haiku': { prompt: 0.8, completion: 4.0, cacheRead: 0.08 },
+  'claude-3-opus': { prompt: 15.0, completion: 75.0, cacheRead: 1.5 },
+  'gpt-4o': { prompt: 2.5, completion: 10.0, cacheRead: 1.25 },
+  'gpt-4o-mini': { prompt: 0.15, completion: 0.6, cacheRead: 0.075 },
+  'o1': { prompt: 15.0, completion: 60.0, cacheRead: 7.5 },
+  'o3-mini': { prompt: 1.1, completion: 4.4, cacheRead: 0.55 },
+  'grok-2': { prompt: 2.0, completion: 10.0, cacheRead: 0.2 },
+  'sonar-reasoning': { prompt: 5.0, completion: 25.0, cacheRead: 0.5 },
+  'sonar-pro': { prompt: 3.0, completion: 15.0, cacheRead: 0.3 },
+  'sonar': { prompt: 1.0, completion: 5.0, cacheRead: 0.1 },
+  'gemini-1.5-pro': { prompt: 1.25, completion: 5.0, cacheRead: 0.3 },
+  'gemini-2.0-flash': { prompt: 0.1, completion: 0.4, cacheRead: 0.025 },
+  'default': { prompt: 2.5, completion: 10.0, cacheRead: 0.5 },
+}
+
+/**
+ * Resolves standard token rates per 1M tokens for a given model identifier.
+ * @param {string} [modelId]
+ * @returns {{ prompt: number, completion: number, cacheRead: number }}
+ */
+export function lookupTokenRate(modelId = '') {
+  const m = String(modelId || '').toLowerCase()
+  for (const [key, rates] of Object.entries(TOKEN_RATES)) {
+    if (key !== 'default' && m.includes(key)) {
+      return rates
+    }
+  }
+  return TOKEN_RATES.default
+}
+
+/**
+ * Calculates dollar cost equivalent for the given token quantities.
+ * @param {number} promptTokens
+ * @param {number} completionTokens
+ * @param {number} [cacheReadTokens]
+ * @param {string} [modelId]
+ * @returns {number}
+ */
+export function calculateEquivalentCost(promptTokens = 0, completionTokens = 0, cacheReadTokens = 0, modelId = 'default') {
+  const rates = lookupTokenRate(modelId)
+  const p = (Number(promptTokens) || 0) * (rates.prompt / 1_000_000)
+  const c = (Number(completionTokens) || 0) * (rates.completion / 1_000_000)
+  const cr = (Number(cacheReadTokens) || 0) * (rates.cacheRead / 1_000_000)
+  return Math.round((p + c + cr) * 100) / 100
+}
+
+/**
+ * Computes value delivered metrics and ROI ratio for an account.
+ * @param {object} params
+ * @param {number} [params.promptTokens]
+ * @param {number} [params.completionTokens]
+ * @param {number} [params.cacheReadTokens]
+ * @param {string} [params.modelId]
+ * @param {number} [params.subscriptionCost]
+ * @returns {object}
+ */
+export function calculateValueDelivered({
+  promptTokens = 0,
+  completionTokens = 0,
+  cacheReadTokens = 0,
+  modelId = 'default',
+  subscriptionCost = DEFAULT_SUBSCRIPTION_MONTHLY_COST,
+} = {}) {
+  const equivalentCost = calculateEquivalentCost(promptTokens, completionTokens, cacheReadTokens, modelId)
+  const subCost = Number(subscriptionCost) > 0 ? Number(subscriptionCost) : DEFAULT_SUBSCRIPTION_MONTHLY_COST
+  const roiMultiplier = Math.round((equivalentCost / subCost) * 10) / 10
+  const roiLabel = `${roiMultiplier}x`
+
+  return {
+    equivalentCost,
+    formattedCost: `$${equivalentCost.toFixed(2)}`,
+    subscriptionCost: subCost,
+    formattedSubscriptionCost: `$${subCost.toFixed(2)}`,
+    roiMultiplier,
+    roiLabel,
+    promptTokens: Number(promptTokens) || 0,
+    completionTokens: Number(completionTokens) || 0,
+    cacheReadTokens: Number(cacheReadTokens) || 0,
+  }
+}

package/lib/refs.js

@@ -56,6 +56,8 @@ const DISPLAY = {
   cursor: 'Cursor',
   kiro: 'AWS Kiro',
   copilot: 'GitHub Copilot',
+  perplexity: 'Perplexity Pro',
+  jetbrains: 'JetBrains AI',
 }
 
 export function displayName(provider) {

package/lib/reset-clock.js

@@ -1,9 +1,12 @@
 import { parseHeaders } from './ratelimit.js'
+import { formatRelativeReset } from './relative-time.js'
 
 export const VENDOR_WINDOW_MS = {
   claude: 5 * 3600 * 1000,
   codex: 3 * 3600 * 1000,
   grok: 2 * 3600 * 1000,
+  copilot: 24 * 3600 * 1000,
+  antigravity: 24 * 3600 * 1000,
 }
 
 export function parseResetFromText(message, nowMs = Date.now()) {
@@ -85,3 +88,55 @@ export function resolveAccurateReset(err, account, provider, nowMs = Date.now(),
 
   return null
 }
+
+export function formatRollingCountdown(resetAt, lang = 'en', now = Date.now()) {
+  const ts = Number(resetAt)
+  if (!Number.isFinite(ts) || ts <= 0) return ''
+  const d = new Date(ts)
+  const pad = (n) => String(n).padStart(2, '0')
+  const timeStr = `${pad(d.getHours())}:${pad(d.getMinutes())}`
+  const relStr = formatRelativeReset(ts, lang, now)
+  if (lang === 'zh') {
+    return `额度重置于 ${timeStr} (${relStr})`
+  }
+  return `Window resets at ${timeStr} (${relStr})`
+}
+
+export function computeEffectiveResetAt(account, provider, now = Date.now()) {
+  if (!account) return null
+  const nowMs = Number(now) || Date.now()
+  const candidates = []
+
+  if (account.quota && account.quota.resetAt) {
+    const r = Number(account.quota.resetAt)
+    if (Number.isFinite(r) && r > nowMs) candidates.push(r)
+  }
+  if (account.cooldownUntil) {
+    const c = Number(account.cooldownUntil)
+    if (Number.isFinite(c) && c > nowMs) candidates.push(c)
+  }
+  if (account.quarantineUntil) {
+    const q = Number(account.quarantineUntil)
+    if (Number.isFinite(q) && q > nowMs) candidates.push(q)
+  }
+  if (Array.isArray(account.usage)) {
+    for (const w of account.usage) {
+      if (w && w.resetAt) {
+        const wr = Number(w.resetAt)
+        if (Number.isFinite(wr) && wr > nowMs) candidates.push(wr)
+      }
+    }
+  }
+
+  if (candidates.length > 0) {
+    return Math.min(...candidates)
+  }
+
+  const p = String(provider || (account && account.provider) || '').toLowerCase()
+  const windowDefault = VENDOR_WINDOW_MS[p]
+  if (windowDefault && account.usagePercent != null && Number(account.usagePercent) >= 100) {
+    return nowMs + windowDefault
+  }
+
+  return null
+}

package/lib/rotate.js

@@ -17,14 +17,28 @@ export function isRegionError(err) {
   return status === 400 && (/FAILED_PRECONDITION/i.test(msg) || /User location is not supported/i.test(msg))
 }
 
+export function isAuthError(err) {
+  if (!err || typeof err !== "object") return false
+  const status = Number(err.status || err.statusCode) || 0
+  if (status === 401) return true
+  const code = String(err.code || (err.failure && err.failure.code) || "").toUpperCase()
+  if (code === "AUTH" || code === "TOKEN_REVOKED" || code === "UNAUTHORIZED" || code === "INVALID_TOKEN" || code === "SESSION_EXPIRED") return true
+  const msg = String(err.message || "")
+  if (/invalid_grant/i.test(msg)) return true
+  if (/token (?:has been )?revoked/i.test(msg)) return true
+  if (/session (?:expired|revoked|invalid)/i.test(msg)) return true
+  if (/unauthorized/i.test(msg) && (status === 0 || status === 400 || status === 401)) return true
+  return false
+}
+
 export function isSwitchableError(err) {
-  if (!err || typeof err !== 'object') return false
-  if (err.name === 'TimeoutError' || err.code === 'TIMEOUT' || err.code === 'EMPTY_RESPONSE' || err.code === 'SOFT_FAILURE' || err.isSoftFailure) return true
-  if (err.name === 'AbortError' || err.code === 'ABORT_ERR' || err.code === 'ERR_ABORTED' || (err.message && /aborted/i.test(err.message))) return false
+  if (!err || typeof err !== "object") return false
+  if (err.name === "TimeoutError" || err.code === "TIMEOUT" || err.code === "EMPTY_RESPONSE" || err.code === "SOFT_FAILURE" || err.isSoftFailure) return true
+  if (err.name === "AbortError" || err.code === "ABORT_ERR" || err.code === "ERR_ABORTED" || (err.message && /aborted/i.test(err.message))) return false
   const code = err.code || (err.failure && err.failure.code)
   if (SWITCH_CODES.has(code)) return true
   if (isRegionError(err)) return true
-  const status = err.status || err.statusCode
+  const status = Number(err.status || err.statusCode) || 0
   return status === 401 || status === 403 || status === 429 || status === 500 || status === 502 || status === 503
 }