@indigoai-us/hq-cli 5.345.202 → 5.345.204

package/dist/commands/integrations.js

@@ -53,7 +53,7 @@
 import { randomUUID } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import chalk from "chalk";
-import { ensureCognitoIdToken } from "../utils/cognito-session.js";
+import { ensureIntegrationIdToken } from "./integrations-core.js";
 import { getCompanyUid, vaultApiFetch } from "../utils/vault-api.js";
 import { redactSensitiveUrl, redactSensitiveUrls, redactUrlsInText } from "../utils/redact-url.js";
 import { IntegrationsCliError, bareProvider, callGateway, parseCallTimeoutMs, fetchConnections, fetchUsableApps, isBuiltInGatewayProvider, isClientError, printHealthNotice, printJson, printIntegrationCallResultJson, connectionAccountLabel, connectionOwnerLabel, selectAccountConnections, raiseIfUnauthorized, raiseIfUpstreamUnavailable, gatewayResultIsError, selectConnection, revokedConnectionDetails, toolPrefixForProvider, unwrapGatewayResult, queuedOutcome, accountCandidateFor, accountSelectionMessage, ACCOUNT_REQUIRED_CODE, } from "./integrations-core.js";
@@ -361,7 +361,7 @@ export function registerIntegrationsCommand(program) {
         .option("--usable", "Only apps you can use right now (connected and shared with you), with the --provider value to call them")
         .option("--no-login", "Fail instead of opening a browser sign-in when there is no HQ session")
         .action(async (opts) => {
-        const token = await ensureCognitoIdToken(opts.login === false ? { interactive: false } : {});
+        const token = await ensureIntegrationIdToken(opts.login === false ? { interactive: false } : {});
         const companyUid = await getCompanyUid(token, opts.company);
         if (opts.usable) {
             const result = await fetchUsableApps(token, companyUid);
@@ -424,7 +424,7 @@ export function registerIntegrationsCommand(program) {
         .option("--describe <tool>", "Print the full input schema for one tool")
         .option("--json", "Machine-readable output")
         .action(async (opts) => {
-        const token = await ensureCognitoIdToken();
+        const token = await ensureIntegrationIdToken();
         const companyUid = await getCompanyUid(token, opts.company);
         const connections = await fetchConnections(token, companyUid);
         const { connection, accountMatches } = selectToolConnection(connections, opts);
@@ -516,7 +516,7 @@ export function registerIntegrationsCommand(program) {
         .action(async (tool, opts) => {
         const waitMs = parseCallTimeoutMs(opts.timeout);
         const parsedArgs = await resolveCallArgs(opts);
-        const token = await ensureCognitoIdToken();
+        const token = await ensureIntegrationIdToken();
         const companyUid = await getCompanyUid(token, opts.company);
         const { connection, accountMatches } = selectToolConnection(await fetchConnections(token, companyUid), opts);
         if (reportRevokedConnection(connection, { ...opts, fail: true }))
@@ -605,7 +605,7 @@ export function registerIntegrationsCommand(program) {
             .option("--company <slug>", "Company slug, e.g. indigo")
             .option("--json", "Machine-readable output")
             .action(async (queueId, opts) => {
-            const token = await ensureCognitoIdToken();
+            const token = await ensureIntegrationIdToken();
             const companyUid = await getCompanyUid(token, opts.company);
             const connection = selectConnection(await fetchConnections(token, companyUid), opts);
             const res = await vaultApiFetch({

package/dist/commands/sync-core.js

@@ -1,7 +1,7 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { ensureSyncCoreBinary } from "../lib/sync-core/release.js";
+import { ensureSyncCoreBinary, readSyncCorePin } from "../lib/sync-core/release.js";
 import { readCompanyRolloutFlag } from "../lib/sync-core/flag.js";
 import { reconcileSyncCore } from "../lib/sync-core/reconcile.js";
 import { engineOwnedManifestScopes, manifestScopeArg } from "../lib/sync-core/manifest-scopes.js";
@@ -59,6 +59,9 @@ export async function runSyncCoreReconcile(opts, d = defaultDeps()) {
         }),
         readRolloutFlag: (companyUid) => readCompanyRolloutFlag(companyUid, token, { env: d.env }),
         ensureBinary: (release) => ensureSyncCoreBinary({ home: d.home, platform: d.platform, arch: d.arch, release, env: d.env }),
+        platform: d.platform,
+        env: d.env,
+        readPin: () => readSyncCorePin({ env: d.env }),
         log: opts.json ? () => { } : d.out,
     });
     if (opts.json)

package/dist/lib/bot/claude-login.d.ts

@@ -21,7 +21,13 @@ export interface ClaudeLoginDeps {
     env?: NodeJS.ProcessEnv;
     home?: string;
     platform?: NodeJS.Platform;
-    readKeychain?: () => KeychainRead;
+    /**
+     * Reads the Keychain item; `account` scopes the read to one account name.
+     * Omitted account means "any item for the service" (the first one found).
+     */
+    readKeychain?: (account?: string) => KeychainRead;
+    /** The login user's account name; null when unknown. */
+    username?: string | null;
     now?: () => number;
 }
 export declare function checkClaudeCodeLogin(deps?: ClaudeLoginDeps): ClaudeLoginCheck;

package/dist/lib/bot/claude-login.js

@@ -17,9 +17,20 @@ import * as path from "node:path";
 import { fleetHome } from "./fleet-local.js";
 export const CLAUDE_KEYCHAIN_SERVICE = "Claude Code-credentials";
 export const CLAUDE_LOGIN_ENV_VARS = ["ANTHROPIC_TOKEN", "CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY"];
-function readKeychainWithSecurity() {
+function safeUsername() {
     try {
-        const stdout = execFileSync("security", ["find-generic-password", "-s", CLAUDE_KEYCHAIN_SERVICE, "-w"], {
+        return os.userInfo().username || null;
+    }
+    catch {
+        return null;
+    }
+}
+function readKeychainWithSecurity(account) {
+    const args = account
+        ? ["find-generic-password", "-s", CLAUDE_KEYCHAIN_SERVICE, "-a", account, "-w"]
+        : ["find-generic-password", "-s", CLAUDE_KEYCHAIN_SERVICE, "-w"];
+    try {
+        const stdout = execFileSync("security", args, {
             encoding: "utf8",
             stdio: ["ignore", "pipe", "pipe"],
             timeout: 5000,
@@ -113,30 +124,59 @@ export function checkClaudeCodeLogin(deps = {}) {
         sources.push({ source: "macos_keychain", status: "skipped", reason: "not macOS" });
     }
     else {
-        const read = (deps.readKeychain ?? readKeychainWithSecurity)();
-        if (read.code !== 0) {
-            const detail = read.stderr.replace(/\s+/g, " ").trim().slice(0, 200) || `exit ${read.code}`;
-            sources.push({ source: "macos_keychain", status: "missing", reason: `no readable '${CLAUDE_KEYCHAIN_SERVICE}' item (${detail})` });
-        }
-        else {
+        // Claude Code (and the HQ desktop sign-in, which runs `claude auth login`)
+        // writes its login under the login user's account name. Another item with
+        // the same service can exist under a different account (an old one written
+        // as "unknown", or one holding only MCP OAuth), and an unscoped read
+        // returns whichever the Keychain finds first. Ask for the user's item
+        // first, then fall back to any item for the service.
+        const readKeychain = deps.readKeychain ?? readKeychainWithSecurity;
+        const username = deps.username === undefined ? safeUsername() : deps.username;
+        const recordOf = (result) => {
+            if (result.code !== 0)
+                return null;
             let payload;
             try {
-                payload = JSON.parse(read.stdout.trim());
+                payload = JSON.parse(result.stdout.trim());
             }
             catch {
                 payload = null;
             }
-            const record = payload && typeof payload === "object" ? oauthRecord(payload.claudeAiOauth) : null;
-            if (record) {
-                const described = describeRecord(record, now);
-                sources.push({ source: "macos_keychain", status: described.status, reason: described.reason });
-                if (described.usable)
-                    found("macos_keychain");
+            return payload && typeof payload === "object" ? oauthRecord(payload.claudeAiOauth) : null;
+        };
+        const scoped = username ? readKeychain(username) : null;
+        const scopedRecord = scoped ? recordOf(scoped) : null;
+        let read;
+        let record;
+        if (scoped && scopedRecord) {
+            read = scoped;
+            record = scopedRecord;
+        }
+        else {
+            const any = readKeychain();
+            const anyRecord = recordOf(any);
+            if (anyRecord || !scoped || scoped.code !== 0) {
+                read = any;
+                record = anyRecord;
             }
             else {
-                sources.push({ source: "macos_keychain", status: "missing", reason: "keychain item has no claudeAiOauth access token" });
+                read = scoped;
+                record = null;
             }
         }
+        if (read.code !== 0) {
+            const detail = read.stderr.replace(/\s+/g, " ").trim().slice(0, 200) || `exit ${read.code}`;
+            sources.push({ source: "macos_keychain", status: "missing", reason: `no readable '${CLAUDE_KEYCHAIN_SERVICE}' item (${detail})` });
+        }
+        else if (record) {
+            const described = describeRecord(record, now);
+            sources.push({ source: "macos_keychain", status: described.status, reason: described.reason });
+            if (described.usable)
+                found("macos_keychain");
+        }
+        else {
+            sources.push({ source: "macos_keychain", status: "missing", reason: "keychain item has no claudeAiOauth access token" });
+        }
     }
     return { signedIn: via !== null, via, sources };
 }

package/dist/lib/bot/executive-settings.d.ts

@@ -1,5 +1,5 @@
 import { type BotConfig } from "./config.js";
-export declare function executiveRiderEnabled(home?: string): boolean;
+export declare function executiveEnabled(home?: string): boolean;
 export declare function isExecutiveBot(config: Pick<BotConfig, "name" | "kind" | "workerId">, home?: string): boolean;
 export declare function executiveStatus(config: Pick<BotConfig, "name" | "kind" | "workerId">, dir: string, home?: string): {
     is_executive: boolean;

package/dist/lib/bot/executive-settings.js

@@ -2,18 +2,20 @@
  * Shared Executive identity and its opt-in switch.
  *
  * The Executive (meeting rider, signal-to-lane, source report DMs) is off
- * unless ~/.hq/menubar.json sets executiveMeetingRider.enabled to true. It
- * stays internal until the live end-to-end proof passes.
+ * unless ~/.hq/menubar.json sets executive.enabled to true. It
+ * stays internal until the live end-to-end proof passes. The older
+ * executiveMeetingRider key is ignored whatever its value: the desktop beta
+ * saved executiveMeetingRider.enabled: true for users who never chose it.
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
 import * as os from "node:os";
 import { effectiveBotKind } from "./config.js";
 import { tailBotEvents } from "./events.js";
-export function executiveRiderEnabled(home = os.homedir()) {
+export function executiveEnabled(home = os.homedir()) {
     try {
         const settings = JSON.parse(fs.readFileSync(path.join(home, ".hq/menubar.json"), "utf8"));
-        return settings?.executiveMeetingRider?.enabled === true;
+        return settings?.executive?.enabled === true;
     }
     catch {
         return false;
@@ -22,7 +24,7 @@ export function executiveRiderEnabled(home = os.homedir()) {
 export function isExecutiveBot(config, home = os.homedir()) {
     if (effectiveBotKind(config) !== "personal")
         return false;
-    if (!executiveRiderEnabled(home))
+    if (!executiveEnabled(home))
         return false;
     let name = "setup";
     try {
@@ -42,7 +44,7 @@ export function isExecutiveBot(config, home = os.homedir()) {
 export function executiveStatus(config, dir, home = os.homedir()) {
     const last = tailBotEvents(dir, (event) => event.event === "meeting.detected").at(-1);
     return {
-        is_executive: isExecutiveBot(config, home), rider_enabled: executiveRiderEnabled(home),
+        is_executive: isExecutiveBot(config, home), rider_enabled: executiveEnabled(home),
         // The first desktop producer did not set source.
         detect_source_last: last ? (last.payload.source === "poll" ? "poll" : "desktop") : null,
         last_detected_at: last?.at ?? null,

package/dist/lib/bot/jobs/meeting-detect.js

@@ -9,7 +9,7 @@ import { getCompanyUid } from "../../../utils/vault-api.js";
 import { assertSafeSegment } from "../../hot-channels/landing.js";
 import { readManifestCompanies } from "../company-bind.js";
 import { emitBotEvent } from "../events.js";
-import { executiveRiderEnabled, isExecutiveBot } from "../executive-settings.js";
+import { executiveEnabled, isExecutiveBot } from "../executive-settings.js";
 const RETENTION_MS = 24 * 60 * 60 * 1000;
 const ACTIVE = new Set(["joining", "recording", "in_call"]);
 export function detectIntervalSeconds(hqRoot) {
@@ -161,7 +161,7 @@ async function untilAborted(signal, work) {
 export function defaultMeetingDetectDeps(config, dir, log) {
     return {
         hqRoot: config.hqRoot, dir, log,
-        enabled: () => isExecutiveBot(config) && executiveRiderEnabled(),
+        enabled: () => isExecutiveBot(config) && executiveEnabled(),
         companies: () => config.companySlug ? [config.companySlug] : readManifestCompanies(config.hqRoot),
         intervalSeconds: () => detectIntervalSeconds(config.hqRoot),
         list: async (company, signal) => {

package/dist/lib/bot/jobs/meeting-rider.js

@@ -12,7 +12,7 @@ import { meetingSignalSourceRef, cursorPath } from "../../signals/incremental.js
 import { readAllLanes } from "../../lanes/store.js";
 import { runSignals } from "../../signals/engine.js";
 import { emitBotEvent, EVENT_PAYLOAD_BYTES } from "../events.js";
-import { executiveRiderEnabled } from "../executive-settings.js";
+import { executiveEnabled } from "../executive-settings.js";
 export { isExecutiveBot } from "../executive-settings.js";
 import { readLocalJobsStrict, withJobsLock, writeLocalJobs } from "../local-jobs.js";
 import { readBuiltinJobsMarker, writeBuiltinJobsMarker } from "./hot-signal-sync.js";
@@ -56,7 +56,7 @@ export function ensureMeetingRiderJob(dir) {
     });
 }
 export function meetingRiderSettings(hqRoot, home = os.homedir()) {
-    const enabled = executiveRiderEnabled(home);
+    const enabled = executiveEnabled(home);
     let interval = 20;
     try {
         const settings = yaml.load(fs.readFileSync(path.join(hqRoot, "core/settings/signals.yaml"), "utf8"));

package/dist/lib/bot/run.js

@@ -50,7 +50,7 @@ import { ensureSignalToLaneJobs, runSignalToLane, SIGNAL_TO_LANE_JOB_KIND } from
  * Everything with a side effect is injectable so the loop is unit-testable.
  */
 import { createMeetingRider, defaultMeetingRiderDeps, ensureMeetingRiderJob, MEETING_RIDER_JOB_KIND } from "./jobs/meeting-rider.js";
-import { executiveRiderEnabled, isExecutiveBot } from "./executive-settings.js";
+import { executiveEnabled, isExecutiveBot } from "./executive-settings.js";
 import { createMeetingDetect, defaultMeetingDetectDeps, resolveDetectedMeeting } from "./jobs/meeting-detect.js";
 import { botAuthEnv, describeBotAuth, formatBotAuth } from "./runtime-auth.js";
 import { ownerContextBlock } from "./owner-context.js";
@@ -435,7 +435,7 @@ export async function runBot(deps) {
     eventHandlers[MEETING_RIDER_JOB_KIND] = async ({ item }) => {
         if (!isExecutiveBot(config))
             return { status: "skipped-precondition", output: "Not the Executive" };
-        if (!executiveRiderEnabled())
+        if (!executiveEnabled())
             return { status: "skipped-precondition", output: "rider disabled" };
         meetingRider.start(await resolveDetectedMeeting(config.hqRoot, typeof item.context === "object" ? item.context?.payload : undefined, meetingDetectDeps.list));
         return { status: "succeeded", output: "Meeting rider accepted" };
@@ -2905,7 +2905,7 @@ export async function runBot(deps) {
     }
     if (isExecutiveBot(config)) {
         try {
-            if (ensureMeetingRiderJob(dir) && executiveRiderEnabled())
+            if (ensureMeetingRiderJob(dir) && executiveEnabled())
                 meetingRider.resume();
         }
         catch {

package/dist/lib/capacity/codex-availability.d.ts

@@ -0,0 +1,6 @@
+import type { NowLimit } from "./ledger.js";
+/** A newer snapshot supersedes omitted windows within the same account. */
+export declare function codexSnapshotStale(limit: NowLimit, limits: readonly NowLimit[]): boolean;
+/** Credits can keep Codex serving after a plan window runs out. */
+export declare function hasCodexCreditRoom(limits: readonly NowLimit[], nowMs: number): boolean;
+//# sourceMappingURL=codex-availability.d.ts.map

package/dist/lib/capacity/codex-availability.js

@@ -0,0 +1,33 @@
+const MAX_CREDIT_AGE_MS = 24 * 36e5;
+/** A newer snapshot supersedes omitted windows within the same account. */
+export function codexSnapshotStale(limit, limits) {
+    if (limit.source !== "codex-jsonl" && limit.source !== "codex-app-server" && limit.source !== "refusal")
+        return false;
+    const at = Date.parse(limit.observedAt);
+    return limits.some((other) => other.accountId === limit.accountId
+        && (other.source === "codex-jsonl" || other.source === "codex-app-server")
+        && Date.parse(other.observedAt) > at);
+}
+/** Credits can keep Codex serving after a plan window runs out. */
+export function hasCodexCreditRoom(limits, nowMs) {
+    return limits.some((credit) => {
+        if (credit.kind !== "credits" || !credit.limitId.endsWith(":credits"))
+            return false;
+        const at = Date.parse(credit.observedAt);
+        if (!Number.isFinite(at) || at > nowMs || nowMs - at > MAX_CREDIT_AGE_MS)
+            return false;
+        if (codexSnapshotStale(credit, limits) || credit.state !== "ok")
+            return false;
+        if (credit.resetsAt && Date.parse(credit.resetsAt) <= nowMs)
+            return false;
+        if (credit.hasCredits !== true || credit.spendControlReached === true)
+            return false;
+        const sameAccount = limits.filter((limit) => limit.accountId === credit.accountId);
+        if (sameAccount.some((limit) => !codexSnapshotStale(limit, limits)
+            && limit.spendControlReached === true))
+            return false;
+        const balance = credit.balance === null ? NaN : Number(credit.balance);
+        return credit.unlimited === true || (Number.isFinite(balance) && balance > 0);
+    });
+}
+//# sourceMappingURL=codex-availability.js.map

package/dist/lib/capacity/collectors/claude-oauth.d.ts

@@ -140,8 +140,10 @@ export type WriteClaudeCredentials = (request: WriteClaudeCredentialsRequest) =>
  *   way). The gate treats this as proof the account is already signed out and
  *   records revoked without hitting the token endpoint.
  * - `home` is the resolved per-host provider home for the account; the gate
- *   compares it to the home being refreshed with `path.resolve` so symlinks
- *   do not slip through. `null` is accepted only when the row is not live.
+ *   compares it to the home being refreshed with `canonicalHomePath` (realpath,
+ *   lower case on darwin) so symlinks and case differences do not slip through;
+ *   a home that cannot be resolved blocks. `null` is accepted only when the row
+ *   is not live.
  */
 export interface LiveLane {
     home: string | null;
@@ -164,8 +166,13 @@ export type ListLiveLanes = () => Promise<readonly LiveLane[]>;
  */
 export interface ClaudeProcess {
     pid: number;
+    /**
+     * `HOME` is set when the probe read it. Claude Code resolves its default config dir as
+     * HOME/.claude, so a process with HOME set and no CLAUDE_CONFIG_DIR holds that dir.
+     */
     env: {
         CLAUDE_CONFIG_DIR?: string;
+        HOME?: string;
     };
     probe: "env" | "command-only";
 }
@@ -245,7 +252,7 @@ export declare function mapClaudeOAuthUsage(body: unknown, options: MapOptions):
     readings: ReadingInput[];
     failures: ParserFailureEvent[];
 };
-export declare function collectClaudeOAuth(options?: CollectClaudeOAuthOptions): Promise<ClaudeOAuthCollectResult>;
+export declare function collectClaudeOAuth(inputOptions?: CollectClaudeOAuthOptions): Promise<ClaudeOAuthCollectResult>;
 /**
  * Ledger account id → hashed profile account id. Rows with no captured
  * identity are omitted. The raw uuid is never returned.
@@ -349,11 +356,16 @@ export declare function resolveHqInvocation(argv?: readonly string[], execPath?:
     command: string;
     args: string[];
 };
-/** Exported for tests; `invocation` defaults to {@link resolveHqInvocation}. */
+/**
+ * Run `hq ... --json` and parse stdout. Async on purpose: the collector runs inside the mesh
+ * daemon, and a synchronous read that takes 15-30 s on a loaded machine froze the daemon's
+ * event loop (MQTT keepalive, owner heartbeat) for the whole read.
+ * Exported for tests; `invocation` defaults to {@link resolveHqInvocation}.
+ */
 export declare function execHqJson(args: readonly string[], invocation?: {
     command: string;
     args: string[];
-}, env?: NodeJS.ProcessEnv): unknown;
+}, env?: NodeJS.ProcessEnv): Promise<unknown>;
 /**
  * Parse `hq lanes list --json` payload into typed rows.
  * Exported for tests; fail-closed semantics live in defaultListLiveLanes.
@@ -369,12 +381,48 @@ export declare function parseAccountsListPayload(payload: unknown): readonly Raw
  * Exported for tests.
  */
 export declare function buildLiveLanesFromPayloads(lanes: readonly RawLaneRow[], accounts: readonly RawAccountRow[]): readonly LiveLane[];
+/**
+ * Share one lane read across every home in a collect. Without this each expired home ran its
+ * own pair of `hq lanes ... --json` reads, so one slow machine turned into N timeouts per
+ * collect. A failure is shared too: the next home fails closed without waiting again.
+ * Exported for tests.
+ */
+export declare function memoizeListLiveLanes(list: ListLiveLanes): ListLiveLanes;
 /**
  * Parse `ps -axo pid=,command=` into rows that mention the `claude` executable.
  * Exported for tests. Returned rows carry `probe: "command-only"` so the gate
  * knows it cannot read per-process CLAUDE_CONFIG_DIR on darwin.
  */
 export declare function parsePsClaudeOutput(stdout: string): readonly ClaudeProcess[];
+/** Pid to full command line, from `ps -ww -o pid=,command= -p <pids>`. Exported for tests. */
+export declare function parsePsCommandLines(stdout: string): ReadonlyMap<number, string>;
+export interface PsEnvProbeOptions {
+    isDirectory?: (dir: string) => boolean;
+    /** False only when the pid is known to be gone (ESRCH). Unknown counts as alive. */
+    isAlive?: (pid: number) => boolean;
+}
+/**
+ * Upgrade darwin command-only rows with each process's environment. `ps -wwE` prints a
+ * same-user process's command line followed by its environment, unquoted and space separated.
+ * Only the text after the exact command line (read separately with `ps -ww`) is treated as the
+ * environment, so a prompt argument that mentions CLAUDE_CONFIG_DIR= or HOME= is never read as
+ * env. A row becomes `probe: "env"` only when:
+ *   - the `-E` line starts with the command line plus a space, and the rest starts with NAME=;
+ *   - CLAUDE_CONFIG_DIR= appears at most once in that rest, and its value is absolute and
+ *     names an existing directory (the value runs to the next ` NAME=` or the end of line).
+ * Anything else stays command-only, which blocks every home. A pid missing from the output
+ * is dropped only when it is known to have exited; otherwise it stays command-only.
+ * Exported for tests.
+ */
+export declare function parsePsEnvOutput(envStdout: string, commandLines: ReadonlyMap<number, string>, rows: readonly ClaudeProcess[], options?: PsEnvProbeOptions): readonly ClaudeProcess[];
+/** Default config dir of an env-probed process with CLAUDE_CONFIG_DIR unset. Exported for tests. */
+export declare function processDefaultConfigDir(proc: ClaudeProcess): string;
+/**
+ * Canonical form of a home directory for comparison: symlinks resolved by the OS, and lower
+ * case on darwin, where APFS is case-insensitive by default. Null when the path cannot be
+ * resolved. Exported for tests.
+ */
+export declare function canonicalHomePath(dir: string, platform?: NodeJS.Platform): string | null;
 export interface ClaudeTokenRefreshResult {
     outcome: "refreshed" | "revoked" | "error" | "skipped-race" | "skipped-live" | "skipped-live-check-failed" | "skipped-process" | "skipped-process-check-failed" | "skipped-backoff" | "skipped-revoked";
     newAccessToken?: string;