@modelprofile.com/authswitch 5.2.0 → 6.1.0

package/dist_ts/classes.opencodeharness.js

@@ -2,10 +2,18 @@ import * as plugins from './plugins.js';
 import { FileHarness } from './classes.fileharness.js';
 import { CredentialStore, credentialHash, credentialRecord, credentialText, readCredentialDocument, readCredentialRaw } from './classes.credentialstore.js';
 import { HarnessProcesses } from './classes.harnessprocesses.js';
+import { ClaudeAccountStatus } from './classes.claudestatus.js';
+import { CLAUDE_REFRESH_MARGIN_MS } from './classes.claudetokenrefresh.js';
+import { ClaudeLoginRejectedError, ClaudeRateLimitError } from './claudehttp.js';
 import { CodexAccountStatus } from './classes.codexstatus.js';
+import { OpenCodeAnthropicRefresh } from './classes.opencodeanthropicrefresh.js';
 import { writeSecretFileAtomically } from './helpers.js';
 import { beginSavedOpenAiLogin, openCodeCredentialFromLogin } from './classes.login.js';
 import { plainText } from './formatting.js';
+/** Anthropic refused the grant OpenCode's entry holds; no retry and no other account changes that answer. */
+const ANTHROPIC_LOGIN_REJECTED = 'Login expired or was rejected. Log in again with opencode auth login.';
+/** A saved copy is not the login OpenCode uses, so renewing it would rotate a token OpenCode's own entry still holds. */
+const SAVED_ANTHROPIC_EXPIRED = 'This saved Anthropic login\'s access token has expired. authswitch renews the Anthropic login OpenCode has active; activate this one to have it renewed, or log in again with opencode auth login.';
 /** OpenCode owns one login per provider. Replacing a slot never replaces the whole provider set. */
 export class OpenCodeHarness extends FileHarness {
     id = 'opencode';
@@ -15,20 +23,30 @@ export class OpenCodeHarness extends FileHarness {
     liveSwap = false;
     /** Only its OpenAI login reports usage, and a supervisor (AGL) restarts it around a switch, so a watch leaves it alone. */
     autoSwitch = false;
+    /** OpenCode re-reads its credential file on every request; only a request already in flight still holds the previous login. */
+    runningRetention() {
+        return 'They re-read the credential file on every request, but a request already in flight still holds the previous login, and its token refresh can ';
+    }
     loginProviders = [{ providerId: 'openai', label: 'OpenAI', flows: ['device'] }];
     store;
     file;
     env;
     status;
+    claudeStatus;
+    anthropicRefresh;
     processes;
     fetcher;
+    now;
     constructor(options = {}) {
         super();
         this.env = options.env ?? process.env;
         this.file = plugins.path.join(options.dataHome ?? (this.env.XDG_DATA_HOME || plugins.path.join(plugins.os.homedir(), '.local', 'share')), 'opencode', 'auth.json');
         this.store = new CredentialStore(this.id, options.stashRoot);
         this.status = new CodexAccountStatus(options.fetch);
+        this.claudeStatus = new ClaudeAccountStatus(options.fetch, options.now);
+        this.anthropicRefresh = new OpenCodeAnthropicRefresh(options.fetch, options.now);
         this.fetcher = options.fetch;
+        this.now = options.now ?? Date.now;
         this.processes = options.processes ?? new HarnessProcesses('opencode');
     }
     /** Every provider entry lives in one file, so its bytes are the whole stability proof. */
@@ -113,14 +131,93 @@ export class OpenCodeHarness extends FileHarness {
         if (readCredentialDocument(this.file).raw !== raw)
             throw new Error('Active login verification failed. The outgoing login remains saved.');
     }
-    async readAccountStatus(id, optionsArg) {
-        const account = this.readCredential(id);
+    /** The login OpenCode has in a provider slot, read from its file; undefined where the file holds none it can read. */
+    activeSlot(slotIdArg) {
+        return this.snapshot().accounts.find(account => account.slotId === slotIdArg);
+    }
+    /** Whether this login's access token is inside Claude Code's five-minute margin, the margin Claude's own logins use. */
+    renewalDue(credentialArg) {
+        const expires = credentialArg.expires;
+        return typeof expires === 'number' && Number.isFinite(expires) && this.now() + CLAUDE_REFRESH_MARGIN_MS >= expires;
+    }
+    /**
+     * Renews OpenCode's active Anthropic login and writes the rotated pair back into OpenCode's own credential file.
+     *
+     * Nothing is stranded by that write. OpenCode's auth service reads `auth.json` on every `Auth.all()`, `Auth.get()`
+     * is that read (1.18.15 @99100961, 1.18.31 @103733929), and its Anthropic provider -- `opencode-anthropic-auth`
+     * 0.0.13, since the binary carries no Anthropic OAuth code -- calls the `getAuth()` it was initialised with
+     * (@98017331) inside the `fetch` wrapper of every single request. A running OpenCode therefore holds no refresh
+     * token in memory and picks up this rotation on its next request, exactly as it picks up its own.
+     *
+     * The renewal is the only authswitch operation on the store while it runs, and the rotated pair replaces the
+     * entry only while OpenCode still holds the refresh token that was sent: a login OpenCode renewed meanwhile is
+     * returned as it now stands. The write itself is `apply`'s verified compare-and-swap, which preserves every other
+     * provider and replaces the file atomically -- OpenCode writes the same file in place. The slot's switch record
+     * follows that write, because an `anthropic` login's identity is its refresh token and this rotation is
+     * authswitch's own: without that, the next read would report this write as a different account.
+     */
+    renewAnthropic(accountArg, signalArg) {
+        return this.store.locked(async () => {
+            const current = this.activeSlot(accountArg.slotId) ?? accountArg;
+            if (!this.renewalDue(current.credential))
+                return current;
+            const refreshToken = credentialText(current.credential.refresh);
+            if (refreshToken === undefined)
+                throw new Error('This Anthropic login holds no refresh token; log in again with opencode auth login.');
+            signalArg?.throwIfAborted();
+            const tokens = await this.anthropicRefresh.refresh(refreshToken);
+            const latest = this.activeSlot(accountArg.slotId);
+            if (!latest || credentialText(latest.credential.refresh) !== refreshToken)
+                return latest ?? current;
+            const renewed = this.inspect({ ...latest.credential, access: tokens.access, refresh: tokens.refresh, expires: tokens.expires }, latest.slotId);
+            this.apply(latest.slotId, latest, renewed);
+            this.recordRenewal(latest.slotId);
+            return renewed;
+        }, { signal: signalArg });
+    }
+    /**
+     * The subscription and usage of an OpenCode `anthropic` OAuth login.
+     *
+     * That entry holds the same Claude subscriber grant Claude Code stores, so Claude's own account endpoints answer
+     * for it and the account reports real windows instead of no quota API at all. OpenCode keeps no scopes and no
+     * account identity with it, so the service decides both. A due access token is renewed first, with OpenCode's own
+     * request; a refusal is reported and nothing is written, so the entry OpenCode owns is left exactly as it was.
+     *
+     * A saved copy is never renewed: OpenCode's entry holds the same refresh token, and rotating it here would leave
+     * the login OpenCode actually uses holding a token the service has replaced.
+     */
+    async anthropicStatus(accountArg, isActiveArg, optionsArg) {
+        let account = accountArg;
+        if (this.renewalDue(account.credential)) {
+            if (!isActiveArg)
+                return this.claudeStatus.unavailable({}, SAVED_ANTHROPIC_EXPIRED);
+            try {
+                account = await this.renewAnthropic(account, optionsArg.signal);
+            }
+            catch (error) {
+                if (optionsArg.signal?.aborted)
+                    throw error;
+                const problem = error instanceof ClaudeLoginRejectedError ? ANTHROPIC_LOGIN_REJECTED
+                    : error instanceof Error ? error.message : 'the login could not be renewed.';
+                return this.claudeStatus.unavailable({}, `Login refresh: ${problem}`, error instanceof ClaudeRateLimitError ? { retryAt: error.retryAt } : undefined);
+            }
+        }
+        const accessToken = credentialText(account.credential.access);
+        if (accessToken === undefined)
+            return this.claudeStatus.unavailable({}, 'This Anthropic login holds no usable access token; log in again with opencode auth login.');
+        return this.claudeStatus.read({ accessToken, scopes: [] }, optionsArg);
+    }
+    async readAccountStatus(id, optionsArg = {}) {
+        const active = this.activeCredential(id);
+        const account = active ?? this.savedCredential(id);
         if (account.slotId === 'openai' && account.credential.type === 'oauth') {
             const info = this.openAiInfo(account.credential);
             if (!info.accountId)
                 return { facts: [], problems: ['The OpenAI login has no account ID for a status lookup.'] };
             return this.status.readCredential(credentialText(account.credential.access), info.accountId, info.plan, optionsArg);
         }
+        if (account.slotId === 'anthropic' && account.credential.type === 'oauth')
+            return this.anthropicStatus(account, active !== undefined, optionsArg);
         return { facts: [
                 { section: 'Authentication', label: 'Provider', value: account.slotId },
                 { section: 'Authentication', label: 'Login type', value: String(account.credential.type) },
@@ -128,4 +225,4 @@ export class OpenCodeHarness extends FileHarness {
             ], problems: [] };
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5vcGVuY29kZWhhcm5lc3MuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9jbGFzc2VzLm9wZW5jb2RlaGFybmVzcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUN4QyxPQUFPLEVBQUUsV0FBVyxFQUFnRCxNQUFNLDBCQUEwQixDQUFDO0FBQ3JHLE9BQU8sRUFBRSxlQUFlLEVBQUUsY0FBYyxFQUFFLGdCQUFnQixFQUFFLGNBQWMsRUFBRSxzQkFBc0IsRUFBRSxpQkFBaUIsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBQzVKLE9BQU8sRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBQ2pFLE9BQU8sRUFBRSxrQkFBa0IsRUFBRSxNQUFNLDBCQUEwQixDQUFDO0FBQzlELE9BQU8sRUFBRSx5QkFBeUIsRUFBRSxNQUFNLGNBQWMsQ0FBQztBQUV6RCxPQUFPLEVBQUUscUJBQXFCLEVBQUUsMkJBQTJCLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUN4RixPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0saUJBQWlCLENBQUM7QUFXNUMsb0dBQW9HO0FBQ3BHLE1BQU0sT0FBTyxlQUFnQixTQUFRLFdBQVc7SUFDOUIsRUFBRSxHQUFHLFVBQVUsQ0FBQztJQUNoQixLQUFLLEdBQUcsVUFBVSxDQUFDO0lBQ25CLFNBQVMsR0FBRyx3RkFBd0YsQ0FBQztJQUNySCx1SEFBdUg7SUFDdkcsUUFBUSxHQUFHLEtBQUssQ0FBQztJQUNqQywySEFBMkg7SUFDM0csVUFBVSxHQUFHLEtBQUssQ0FBQztJQUNuQixjQUFjLEdBQTRCLENBQUMsRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ3RHLEtBQUssQ0FBa0I7SUFDekIsSUFBSSxDQUFTO0lBQ2IsR0FBRyxDQUFvQjtJQUN2QixNQUFNLENBQXFCO0lBQzVCLFNBQVMsQ0FBeUI7SUFDakMsT0FBTyxDQUFnQjtJQUV4QyxZQUFZLFVBQW1DLEVBQUU7UUFDL0MsS0FBSyxFQUFFLENBQUM7UUFDUixJQUFJLENBQUMsR0FBRyxHQUFHLE9BQU8sQ0FBQyxHQUFHLElBQUksT0FBTyxDQUFDLEdBQUcsQ0FBQztRQUN0QyxJQUFJLENBQUMsSUFBSSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLGFBQWEsSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLE9BQU8sRUFBRSxFQUFFLFFBQVEsRUFBRSxPQUFPLENBQUMsQ0FBQyxFQUFFLFVBQVUsRUFBRSxXQUFXLENBQUMsQ0FBQztRQUNuSyxJQUFJLENBQUMsS0FBSyxHQUFHLElBQUksZUFBZSxDQUFDLElBQUksQ0FBQyxFQUFFLEVBQUUsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQzdELElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSxrQkFBa0IsQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDcEQsSUFBSSxDQUFDLE9BQU8sR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDO1FBQzdCLElBQUksQ0FBQyxTQUFTLEdBQUcsT0FBTyxDQUFDLFNBQVMsSUFBSSxJQUFJLGdCQUFnQixDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3pFLENBQUM7SUFDRCwwRkFBMEY7SUFDaEYsYUFBYSxLQUF3QixPQUFPLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3ZGLHNHQUFzRztJQUMvRixxQkFBcUI7UUFDMUIsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsTUFBTSxLQUFLLFFBQVEsQ0FBQyxDQUFDO1FBQ2hGLE9BQU8sT0FBTyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztJQUM3RSxDQUFDO0lBQ00sVUFBVSxDQUFDLFVBQWdDLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFO1FBQ3hGLE9BQU8scUJBQXFCLENBQUMsS0FBSyxFQUFDLE1BQU0sRUFBQyxFQUFFO1lBQzFDLE1BQU0sS0FBSyxHQUFHLE1BQU0sSUFBSSxDQUFDLGdCQUFnQixDQUFDLFFBQVEsRUFBRSwyQkFBMkIsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQztZQUNwRyxNQUFNLE9BQU8sR0FBRyxDQUFDLE1BQU0sSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLE9BQU8sQ0FBQyxFQUFFLEtBQUssS0FBSyxDQUFDLFNBQVMsQ0FBRSxDQUFDO1lBQ25HLE9BQU8sRUFBRSxPQUFPLEVBQUUsRUFBRSxLQUFLLEVBQUUsQ0FBQywwQkFBMEIsU0FBUyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsaUNBQWlDLENBQUMsRUFBRSxRQUFRLEVBQUUsRUFBRSxFQUFFLEVBQUUsT0FBTyxFQUFFLEVBQUUsRUFBRSxFQUFFLE9BQU8sQ0FBQyxFQUFFLEVBQUUsS0FBSyxFQUFFLE9BQU8sQ0FBQyxLQUFLLEVBQUUsTUFBTSxFQUFFLE9BQU8sQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDO1FBQ2hOLENBQUMsRUFBRSxPQUFPLEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQzVCLENBQUM7SUFDTyxVQUFVLENBQUMsS0FBOEI7UUFDL0MsSUFBSSxLQUFLLENBQUMsSUFBSSxLQUFLLE9BQU87WUFBRSxPQUFPLEVBQUUsQ0FBQztRQUN0QyxJQUFJLE1BQTRELENBQUM7UUFDakUsSUFBSSxDQUFDO1lBQUMsTUFBTSxHQUFHLE9BQU8sQ0FBQyxRQUFRLENBQUMsMkJBQTJCLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUUsQ0FBQyxDQUFDO1FBQUMsQ0FBQztRQUFDLE1BQU0sQ0FBQyxDQUFDLDJDQUEyQyxDQUFDLENBQUM7UUFDbkosTUFBTSxTQUFTLEdBQUcsY0FBYyxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsSUFBSSxNQUFNLEVBQUUsZ0JBQWdCLENBQUM7UUFDOUUsSUFBSSxLQUFLLENBQUMsU0FBUyxJQUFJLE1BQU0sRUFBRSxnQkFBZ0IsSUFBSSxLQUFLLENBQUMsU0FBUyxLQUFLLE1BQU0sQ0FBQyxnQkFBZ0I7WUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLDJEQUEyRCxDQUFDLENBQUM7UUFDN0ssT0FBTyxFQUFFLFNBQVMsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFLEtBQUssRUFBRSxXQUFXLEVBQUUsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLGVBQWUsRUFBRSxDQUFDO0lBQzNGLENBQUM7SUFDUyxPQUFPLENBQUMsVUFBbUMsRUFBRSxNQUFjO1FBQ25FLElBQUksQ0FBQyxNQUFNLElBQUksTUFBTSxDQUFDLE1BQU0sR0FBRyxHQUFHO1lBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxtQ0FBbUMsQ0FBQyxDQUFDO1FBQ3pGLE1BQU0sSUFBSSxHQUFHLFVBQVUsQ0FBQyxJQUFJLENBQUM7UUFDN0IsSUFBSSxNQUEwQixDQUFDO1FBQy9CLElBQUksSUFBSSxLQUFLLE9BQU8sRUFBRSxDQUFDO1lBQ3JCLElBQUksQ0FBQyxjQUFjLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsSUFBSSxPQUFPLFVBQVUsQ0FBQyxPQUFPLEtBQUssUUFBUSxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDO2dCQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsd0NBQXdDLENBQUMsQ0FBQztZQUMzTixNQUFNLEdBQUcsY0FBYyxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUM5QyxDQUFDO2FBQU0sSUFBSSxJQUFJLEtBQUssS0FBSztZQUFFLE1BQU0sR0FBRyxjQUFjLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFDO2FBQzlELElBQUksSUFBSSxLQUFLLFdBQVcsSUFBSSxjQUFjLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQztZQUFFLE1BQU0sR0FBRyxjQUFjLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQzNHLElBQUksQ0FBQyxNQUFNO1lBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxvRUFBb0UsQ0FBQyxDQUFDO1FBQ25HLE1BQU0sSUFBSSxHQUFHLE1BQU0sS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNwRSxNQUFNLFdBQVcsR0FBRyxjQUFjLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDM0MsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsU0FBUyxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQyxDQUFDLEdBQUcsSUFBSSxJQUFJLFdBQVcsRUFBRSxDQUFDO1FBQ3ZGLE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxLQUFLLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxVQUFVLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQyxDQUFDLENBQUMsR0FBRyxNQUFNLElBQUksSUFBSSxLQUFLLEtBQUssQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxJQUFJLElBQUksV0FBVyxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ3pKLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUUsQ0FBQztJQUNqRCxDQUFDO0lBQ1MsUUFBUTtRQUNoQixJQUFJLElBQUksQ0FBQyxHQUFHLENBQUMscUJBQXFCLEtBQUssU0FBUztZQUFFLE9BQU8sRUFBRSxRQUFRLEVBQUUsRUFBRSxFQUFFLFdBQVcsRUFBRSw0RkFBNEYsRUFBRSxDQUFDO1FBQ3JMLE1BQU0sSUFBSSxHQUFHLHNCQUFzQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxJQUFJLENBQUM7UUFDcEQsTUFBTSxRQUFRLEdBQW1CLEVBQUUsQ0FBQztRQUNwQyxNQUFNLFdBQVcsR0FBYSxFQUFFLENBQUM7UUFDakMsS0FBSyxNQUFNLENBQUMsUUFBUSxFQUFFLEtBQUssQ0FBQyxJQUFJLE1BQU0sQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUNyRCxJQUFJLENBQUM7Z0JBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLGdCQUFnQixDQUFDLEtBQUssQ0FBQyxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7WUFBQyxDQUFDO1lBQ3ZFLE1BQU0sQ0FBQztnQkFBQyxXQUFXLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1lBQUMsQ0FBQztRQUN2QyxDQUFDO1FBQ0QsT0FBTyxFQUFFLFFBQVEsRUFBRSxXQUFXLEVBQUUsV0FBVyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsNEdBQTRHLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO0lBQzdLLENBQUM7SUFDUyxLQUFLLENBQUMsTUFBYyxFQUFFLFFBQWtDLEVBQUUsTUFBZ0M7UUFDbEcsTUFBTSxRQUFRLEdBQUcsc0JBQXNCLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ25ELElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxRQUFRLEVBQUUsVUFBVSxDQUFDO1lBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQywwRUFBMEUsQ0FBQyxDQUFDO1FBQ2hMLE1BQU0sSUFBSSxHQUFHLEVBQUUsR0FBRyxRQUFRLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDbEMsSUFBSSxNQUFNO1lBQUUsTUFBTSxDQUFDLGNBQWMsQ0FBQyxJQUFJLEVBQUUsTUFBTSxFQUFFLEVBQUUsS0FBSyxFQUFFLE1BQU0sQ0FBQyxVQUFVLEVBQUUsVUFBVSxFQUFFLElBQUksRUFBRSxZQUFZLEVBQUUsSUFBSSxFQUFFLFFBQVEsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDOztZQUMvSCxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUN6QixNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLEdBQUcsSUFBSSxDQUFDO1FBQ2pELElBQUksc0JBQXNCLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLEdBQUcsS0FBSyxRQUFRLENBQUMsR0FBRztZQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsd0ZBQXdGLENBQUMsQ0FBQztRQUN0SyxPQUFPLENBQUMsRUFBRSxDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO1FBQ3hGLHlCQUF5QixDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsR0FBRyxDQUFDLENBQUM7UUFDMUMsSUFBSSxzQkFBc0IsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsR0FBRyxLQUFLLEdBQUc7WUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLHFFQUFxRSxDQUFDLENBQUM7SUFDNUksQ0FBQztJQUNNLEtBQUssQ0FBQyxpQkFBaUIsQ0FBQyxFQUFVLEVBQUUsVUFBa0M7UUFDM0UsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLGNBQWMsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN4QyxJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssUUFBUSxJQUFJLE9BQU8sQ0FBQyxVQUFVLENBQUMsSUFBSSxLQUFLLE9BQU8sRUFBRSxDQUFDO1lBQ3ZFLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1lBQ2pELElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUztnQkFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxRQUFRLEVBQUUsQ0FBQyx5REFBeUQsQ0FBQyxFQUFFLENBQUM7WUFDakgsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLGNBQWMsQ0FBQyxjQUFjLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUUsRUFBRSxJQUFJLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxJQUFJLEVBQUUsVUFBVSxDQUFDLENBQUM7UUFDdkgsQ0FBQztRQUNELE9BQU8sRUFBRSxLQUFLLEVBQUU7Z0JBQ2QsRUFBRSxPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRSxLQUFLLEVBQUUsT0FBTyxDQUFDLE1BQU0sRUFBRTtnQkFDdkUsRUFBRSxPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsS0FBSyxFQUFFLFlBQVksRUFBRSxLQUFLLEVBQUUsTUFBTSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLEVBQUU7Z0JBQzFGLEVBQUUsT0FBTyxFQUFFLGNBQWMsRUFBRSxLQUFLLEVBQUUsMkJBQTJCLEVBQUUsS0FBSyxFQUFFLDRFQUE0RSxFQUFFO2FBQ3JKLEVBQUUsUUFBUSxFQUFFLEVBQUUsRUFBRSxDQUFDO0lBQ3BCLENBQUM7Q0FDRiJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5vcGVuY29kZWhhcm5lc3MuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9jbGFzc2VzLm9wZW5jb2RlaGFybmVzcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUN4QyxPQUFPLEVBQUUsV0FBVyxFQUFnRCxNQUFNLDBCQUEwQixDQUFDO0FBQ3JHLE9BQU8sRUFBRSxlQUFlLEVBQUUsY0FBYyxFQUFFLGdCQUFnQixFQUFFLGNBQWMsRUFBRSxzQkFBc0IsRUFBRSxpQkFBaUIsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBQzVKLE9BQU8sRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBQ2pFLE9BQU8sRUFBRSxtQkFBbUIsRUFBRSxNQUFNLDJCQUEyQixDQUFDO0FBQ2hFLE9BQU8sRUFBRSx3QkFBd0IsRUFBRSxNQUFNLGlDQUFpQyxDQUFDO0FBQzNFLE9BQU8sRUFBRSx3QkFBd0IsRUFBRSxvQkFBb0IsRUFBRSxNQUFNLGlCQUFpQixDQUFDO0FBQ2pGLE9BQU8sRUFBRSxrQkFBa0IsRUFBRSxNQUFNLDBCQUEwQixDQUFDO0FBQzlELE9BQU8sRUFBRSx3QkFBd0IsRUFBRSxNQUFNLHVDQUF1QyxDQUFDO0FBQ2pGLE9BQU8sRUFBRSx5QkFBeUIsRUFBRSxNQUFNLGNBQWMsQ0FBQztBQUV6RCxPQUFPLEVBQUUscUJBQXFCLEVBQUUsMkJBQTJCLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUN4RixPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0saUJBQWlCLENBQUM7QUFhNUMsNkdBQTZHO0FBQzdHLE1BQU0sd0JBQXdCLEdBQUcsdUVBQXVFLENBQUM7QUFDekcseUhBQXlIO0FBQ3pILE1BQU0sdUJBQXVCLEdBQUcsb01BQW9NLENBQUM7QUFFck8sb0dBQW9HO0FBQ3BHLE1BQU0sT0FBTyxlQUFnQixTQUFRLFdBQVc7SUFDOUIsRUFBRSxHQUFHLFVBQVUsQ0FBQztJQUNoQixLQUFLLEdBQUcsVUFBVSxDQUFDO0lBQ25CLFNBQVMsR0FBRyx3RkFBd0YsQ0FBQztJQUNySCx1SEFBdUg7SUFDdkcsUUFBUSxHQUFHLEtBQUssQ0FBQztJQUNqQywySEFBMkg7SUFDM0csVUFBVSxHQUFHLEtBQUssQ0FBQztJQUNuQywrSEFBK0g7SUFDNUcsZ0JBQWdCO1FBQ2pDLE9BQU8sK0lBQStJLENBQUM7SUFDekosQ0FBQztJQUNlLGNBQWMsR0FBNEIsQ0FBQyxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRSxLQUFLLEVBQUUsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDdEcsS0FBSyxDQUFrQjtJQUN6QixJQUFJLENBQVM7SUFDYixHQUFHLENBQW9CO0lBQ3ZCLE1BQU0sQ0FBcUI7SUFDM0IsWUFBWSxDQUFzQjtJQUNsQyxnQkFBZ0IsQ0FBMkI7SUFDNUMsU0FBUyxDQUF5QjtJQUNqQyxPQUFPLENBQWdCO0lBQ3ZCLEdBQUcsQ0FBZTtJQUVuQyxZQUFZLFVBQW1DLEVBQUU7UUFDL0MsS0FBSyxFQUFFLENBQUM7UUFDUixJQUFJLENBQUMsR0FBRyxHQUFHLE9BQU8sQ0FBQyxHQUFHLElBQUksT0FBTyxDQUFDLEdBQUcsQ0FBQztRQUN0QyxJQUFJLENBQUMsSUFBSSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLGFBQWEsSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLE9BQU8sRUFBRSxFQUFFLFFBQVEsRUFBRSxPQUFPLENBQUMsQ0FBQyxFQUFFLFVBQVUsRUFBRSxXQUFXLENBQUMsQ0FBQztRQUNuSyxJQUFJLENBQUMsS0FBSyxHQUFHLElBQUksZUFBZSxDQUFDLElBQUksQ0FBQyxFQUFFLEVBQUUsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQzdELElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSxrQkFBa0IsQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDcEQsSUFBSSxDQUFDLFlBQVksR0FBRyxJQUFJLG1CQUFtQixDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ3hFLElBQUksQ0FBQyxnQkFBZ0IsR0FBRyxJQUFJLHdCQUF3QixDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ2pGLElBQUksQ0FBQyxPQUFPLEdBQUcsT0FBTyxDQUFDLEtBQUssQ0FBQztRQUM3QixJQUFJLENBQUMsR0FBRyxHQUFHLE9BQU8sQ0FBQyxHQUFHLElBQUksSUFBSSxDQUFDLEdBQUcsQ0FBQztRQUNuQyxJQUFJLENBQUMsU0FBUyxHQUFHLE9BQU8sQ0FBQyxTQUFTLElBQUksSUFBSSxnQkFBZ0IsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBQ0QsMEZBQTBGO0lBQ2hGLGFBQWEsS0FBd0IsT0FBTyxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUN2RixzR0FBc0c7SUFDL0YscUJBQXFCO1FBQzFCLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLE1BQU0sS0FBSyxRQUFRLENBQUMsQ0FBQztRQUNoRixPQUFPLE9BQU8sQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDN0UsQ0FBQztJQUNNLFVBQVUsQ0FBQyxVQUFnQyxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsSUFBSSxFQUFFLFFBQVEsRUFBRTtRQUN4RixPQUFPLHFCQUFxQixDQUFDLEtBQUssRUFBQyxNQUFNLEVBQUMsRUFBRTtZQUMxQyxNQUFNLEtBQUssR0FBRyxNQUFNLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxRQUFRLEVBQUUsMkJBQTJCLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUM7WUFDcEcsTUFBTSxPQUFPLEdBQUcsQ0FBQyxNQUFNLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLEtBQUssQ0FBQyxTQUFTLENBQUUsQ0FBQztZQUNuRyxPQUFPLEVBQUUsT0FBTyxFQUFFLEVBQUUsS0FBSyxFQUFFLENBQUMsMEJBQTBCLFNBQVMsQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLGlDQUFpQyxDQUFDLEVBQUUsUUFBUSxFQUFFLEVBQUUsRUFBRSxFQUFFLE9BQU8sRUFBRSxFQUFFLEVBQUUsRUFBRSxPQUFPLENBQUMsRUFBRSxFQUFFLEtBQUssRUFBRSxPQUFPLENBQUMsS0FBSyxFQUFFLE1BQU0sRUFBRSxPQUFPLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQztRQUNoTixDQUFDLEVBQUUsT0FBTyxFQUFFLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUM1QixDQUFDO0lBQ08sVUFBVSxDQUFDLEtBQThCO1FBQy9DLElBQUksS0FBSyxDQUFDLElBQUksS0FBSyxPQUFPO1lBQUUsT0FBTyxFQUFFLENBQUM7UUFDdEMsSUFBSSxNQUE0RCxDQUFDO1FBQ2pFLElBQUksQ0FBQztZQUFDLE1BQU0sR0FBRyxPQUFPLENBQUMsUUFBUSxDQUFDLDJCQUEyQixDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFFLENBQUMsQ0FBQztRQUFDLENBQUM7UUFBQyxNQUFNLENBQUMsQ0FBQywyQ0FBMkMsQ0FBQyxDQUFDO1FBQ25KLE1BQU0sU0FBUyxHQUFHLGNBQWMsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLElBQUksTUFBTSxFQUFFLGdCQUFnQixDQUFDO1FBQzlFLElBQUksS0FBSyxDQUFDLFNBQVMsSUFBSSxNQUFNLEVBQUUsZ0JBQWdCLElBQUksS0FBSyxDQUFDLFNBQVMsS0FBSyxNQUFNLENBQUMsZ0JBQWdCO1lBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQywyREFBMkQsQ0FBQyxDQUFDO1FBQzdLLE9BQU8sRUFBRSxTQUFTLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsV0FBVyxFQUFFLEVBQUUsSUFBSSxFQUFFLE1BQU0sRUFBRSxlQUFlLEVBQUUsQ0FBQztJQUMzRixDQUFDO0lBQ1MsT0FBTyxDQUFDLFVBQW1DLEVBQUUsTUFBYztRQUNuRSxJQUFJLENBQUMsTUFBTSxJQUFJLE1BQU0sQ0FBQyxNQUFNLEdBQUcsR0FBRztZQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsbUNBQW1DLENBQUMsQ0FBQztRQUN6RixNQUFNLElBQUksR0FBRyxVQUFVLENBQUMsSUFBSSxDQUFDO1FBQzdCLElBQUksTUFBMEIsQ0FBQztRQUMvQixJQUFJLElBQUksS0FBSyxPQUFPLEVBQUUsQ0FBQztZQUNyQixJQUFJLENBQUMsY0FBYyxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLElBQUksT0FBTyxVQUFVLENBQUMsT0FBTyxLQUFLLFFBQVEsSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQztnQkFBRSxNQUFNLElBQUksS0FBSyxDQUFDLHdDQUF3QyxDQUFDLENBQUM7WUFDM04sTUFBTSxHQUFHLGNBQWMsQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDOUMsQ0FBQzthQUFNLElBQUksSUFBSSxLQUFLLEtBQUs7WUFBRSxNQUFNLEdBQUcsY0FBYyxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsQ0FBQzthQUM5RCxJQUFJLElBQUksS0FBSyxXQUFXLElBQUksY0FBYyxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUM7WUFBRSxNQUFNLEdBQUcsY0FBYyxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMzRyxJQUFJLENBQUMsTUFBTTtZQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsb0VBQW9FLENBQUMsQ0FBQztRQUNuRyxNQUFNLElBQUksR0FBRyxNQUFNLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDcEUsTUFBTSxXQUFXLEdBQUcsY0FBYyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQzNDLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLFNBQVMsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDLENBQUMsQ0FBQyxHQUFHLElBQUksSUFBSSxXQUFXLEVBQUUsQ0FBQztRQUN2RixNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsS0FBSyxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsVUFBVSxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQyxDQUFDLEdBQUcsTUFBTSxJQUFJLElBQUksS0FBSyxLQUFLLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsSUFBSSxJQUFJLFdBQVcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN6SixPQUFPLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFLENBQUM7SUFDakQsQ0FBQztJQUNTLFFBQVE7UUFDaEIsSUFBSSxJQUFJLENBQUMsR0FBRyxDQUFDLHFCQUFxQixLQUFLLFNBQVM7WUFBRSxPQUFPLEVBQUUsUUFBUSxFQUFFLEVBQUUsRUFBRSxXQUFXLEVBQUUsNEZBQTRGLEVBQUUsQ0FBQztRQUNyTCxNQUFNLElBQUksR0FBRyxzQkFBc0IsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsSUFBSSxDQUFDO1FBQ3BELE1BQU0sUUFBUSxHQUFtQixFQUFFLENBQUM7UUFDcEMsTUFBTSxXQUFXLEdBQWEsRUFBRSxDQUFDO1FBQ2pDLEtBQUssTUFBTSxDQUFDLFFBQVEsRUFBRSxLQUFLLENBQUMsSUFBSSxNQUFNLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7WUFDckQsSUFBSSxDQUFDO2dCQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxLQUFLLENBQUMsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO1lBQUMsQ0FBQztZQUN2RSxNQUFNLENBQUM7Z0JBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUFDLENBQUM7UUFDdkMsQ0FBQztRQUNELE9BQU8sRUFBRSxRQUFRLEVBQUUsV0FBVyxFQUFFLFdBQVcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLDRHQUE0RyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUM3SyxDQUFDO0lBQ1MsS0FBSyxDQUFDLE1BQWMsRUFBRSxRQUFrQyxFQUFFLE1BQWdDO1FBQ2xHLE1BQU0sUUFBUSxHQUFHLHNCQUFzQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNuRCxJQUFJLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxFQUFFLFVBQVUsQ0FBQztZQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsMEVBQTBFLENBQUMsQ0FBQztRQUNoTCxNQUFNLElBQUksR0FBRyxFQUFFLEdBQUcsUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ2xDLElBQUksTUFBTTtZQUFFLE1BQU0sQ0FBQyxjQUFjLENBQUMsSUFBSSxFQUFFLE1BQU0sRUFBRSxFQUFFLEtBQUssRUFBRSxNQUFNLENBQUMsVUFBVSxFQUFFLFVBQVUsRUFBRSxJQUFJLEVBQUUsWUFBWSxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQzs7WUFDL0gsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDekIsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxHQUFHLElBQUksQ0FBQztRQUNqRCxJQUFJLHNCQUFzQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxHQUFHLEtBQUssUUFBUSxDQUFDLEdBQUc7WUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLHdGQUF3RixDQUFDLENBQUM7UUFDdEssT0FBTyxDQUFDLEVBQUUsQ0FBQyxTQUFTLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztRQUN4Rix5QkFBeUIsQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLEdBQUcsQ0FBQyxDQUFDO1FBQzFDLElBQUksc0JBQXNCLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLEdBQUcsS0FBSyxHQUFHO1lBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxxRUFBcUUsQ0FBQyxDQUFDO0lBQzVJLENBQUM7SUFDRCxzSEFBc0g7SUFDOUcsVUFBVSxDQUFDLFNBQWlCO1FBQ2xDLE9BQU8sSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQyxPQUFPLENBQUMsTUFBTSxLQUFLLFNBQVMsQ0FBQyxDQUFDO0lBQ2hGLENBQUM7SUFDRCx3SEFBd0g7SUFDaEgsVUFBVSxDQUFDLGFBQXNDO1FBQ3ZELE1BQU0sT0FBTyxHQUFHLGFBQWEsQ0FBQyxPQUFPLENBQUM7UUFDdEMsT0FBTyxPQUFPLE9BQU8sS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsSUFBSSxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsd0JBQXdCLElBQUksT0FBTyxDQUFDO0lBQ3JILENBQUM7SUFFRDs7Ozs7Ozs7Ozs7Ozs7O09BZUc7SUFDSyxjQUFjLENBQUMsVUFBd0IsRUFBRSxTQUF1QjtRQUN0RSxPQUFPLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLEtBQUssSUFBSSxFQUFFO1lBQ2xDLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxJQUFJLFVBQVUsQ0FBQztZQUNqRSxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDO2dCQUFFLE9BQU8sT0FBTyxDQUFDO1lBQ3pELE1BQU0sWUFBWSxHQUFHLGNBQWMsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1lBQ2hFLElBQUksWUFBWSxLQUFLLFNBQVM7Z0JBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxxRkFBcUYsQ0FBQyxDQUFDO1lBQ3ZJLFNBQVMsRUFBRSxjQUFjLEVBQUUsQ0FBQztZQUM1QixNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDLENBQUM7WUFDakUsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLENBQUM7WUFDbEQsSUFBSSxDQUFDLE1BQU0sSUFBSSxjQUFjLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsS0FBSyxZQUFZO2dCQUFFLE9BQU8sTUFBTSxJQUFJLE9BQU8sQ0FBQztZQUNwRyxNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsR0FBRyxNQUFNLENBQUMsVUFBVSxFQUFFLE1BQU0sRUFBRSxNQUFNLENBQUMsTUFBTSxFQUFFLE9BQU8sRUFBRSxNQUFNLENBQUMsT0FBTyxFQUFFLE9BQU8sRUFBRSxNQUFNLENBQUMsT0FBTyxFQUFFLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQy9JLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxNQUFNLEVBQUUsT0FBTyxDQUFDLENBQUM7WUFDM0MsSUFBSSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUM7WUFDbEMsT0FBTyxPQUFPLENBQUM7UUFDakIsQ0FBQyxFQUFFLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUM7SUFDNUIsQ0FBQztJQUVEOzs7Ozs7Ozs7O09BVUc7SUFDSyxLQUFLLENBQUMsZUFBZSxDQUFDLFVBQXdCLEVBQUUsV0FBb0IsRUFBRSxVQUFpQztRQUM3RyxJQUFJLE9BQU8sR0FBRyxVQUFVLENBQUM7UUFDekIsSUFBSSxJQUFJLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1lBQ3hDLElBQUksQ0FBQyxXQUFXO2dCQUFFLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsRUFBRSxFQUFFLHVCQUF1QixDQUFDLENBQUM7WUFDcEYsSUFBSSxDQUFDO2dCQUFDLE9BQU8sR0FBRyxNQUFNLElBQUksQ0FBQyxjQUFjLENBQUMsT0FBTyxFQUFFLFVBQVUsQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUFDLENBQUM7WUFDeEUsT0FBTyxLQUFLLEVBQUUsQ0FBQztnQkFDYixJQUFJLFVBQVUsQ0FBQyxNQUFNLEVBQUUsT0FBTztvQkFBRSxNQUFNLEtBQUssQ0FBQztnQkFDNUMsTUFBTSxPQUFPLEdBQUcsS0FBSyxZQUFZLHdCQUF3QixDQUFDLENBQUMsQ0FBQyx3QkFBd0I7b0JBQ2xGLENBQUMsQ0FBQyxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxpQ0FBaUMsQ0FBQztnQkFDL0UsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxFQUFFLEVBQUUsa0JBQWtCLE9BQU8sRUFBRSxFQUNsRSxLQUFLLFlBQVksb0JBQW9CLENBQUMsQ0FBQyxDQUFDLEVBQUUsT0FBTyxFQUFFLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDcEYsQ0FBQztRQUNILENBQUM7UUFDRCxNQUFNLFdBQVcsR0FBRyxjQUFjLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUM5RCxJQUFJLFdBQVcsS0FBSyxTQUFTO1lBQUUsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxFQUFFLEVBQUUsMkZBQTJGLENBQUMsQ0FBQztRQUNySyxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsSUFBSSxDQUFDLEVBQUUsV0FBVyxFQUFFLE1BQU0sRUFBRSxFQUFFLEVBQUUsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBRU0sS0FBSyxDQUFDLGlCQUFpQixDQUFDLEVBQVUsRUFBRSxhQUFvQyxFQUFFO1FBQy9FLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN6QyxNQUFNLE9BQU8sR0FBRyxNQUFNLElBQUksSUFBSSxDQUFDLGVBQWUsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUNuRCxJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssUUFBUSxJQUFJLE9BQU8sQ0FBQyxVQUFVLENBQUMsSUFBSSxLQUFLLE9BQU8sRUFBRSxDQUFDO1lBQ3ZFLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1lBQ2pELElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUztnQkFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxRQUFRLEVBQUUsQ0FBQyx5REFBeUQsQ0FBQyxFQUFFLENBQUM7WUFDakgsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLGNBQWMsQ0FBQyxjQUFjLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUUsRUFBRSxJQUFJLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxJQUFJLEVBQUUsVUFBVSxDQUFDLENBQUM7UUFDdkgsQ0FBQztRQUNELElBQUksT0FBTyxDQUFDLE1BQU0sS0FBSyxXQUFXLElBQUksT0FBTyxDQUFDLFVBQVUsQ0FBQyxJQUFJLEtBQUssT0FBTztZQUFFLE9BQU8sSUFBSSxDQUFDLGVBQWUsQ0FBQyxPQUFPLEVBQUUsTUFBTSxLQUFLLFNBQVMsRUFBRSxVQUFVLENBQUMsQ0FBQztRQUNsSixPQUFPLEVBQUUsS0FBSyxFQUFFO2dCQUNkLEVBQUUsT0FBTyxFQUFFLGdCQUFnQixFQUFFLEtBQUssRUFBRSxVQUFVLEVBQUUsS0FBSyxFQUFFLE9BQU8sQ0FBQyxNQUFNLEVBQUU7Z0JBQ3ZFLEVBQUUsT0FBTyxFQUFFLGdCQUFnQixFQUFFLEtBQUssRUFBRSxZQUFZLEVBQUUsS0FBSyxFQUFFLE1BQU0sQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxFQUFFO2dCQUMxRixFQUFFLE9BQU8sRUFBRSxjQUFjLEVBQUUsS0FBSyxFQUFFLDJCQUEyQixFQUFFLEtBQUssRUFBRSw0RUFBNEUsRUFBRTthQUNySixFQUFFLFFBQVEsRUFBRSxFQUFFLEVBQUUsQ0FBQztJQUNwQixDQUFDO0NBQ0YifQ==

package/dist_ts/claudehttp.d.ts

@@ -7,6 +7,20 @@ export declare const CLAUDE_LOGIN_REJECTED = "Login expired or was rejected. Log
 export declare class ClaudeLoginRejectedError extends ClaudeRequestError {
     constructor();
 }
+/**
+ * Where Claude Code 2.1.273 sends an account the service put on hold (`T5e`, bundle offset @190070402). A hold is
+ * not a dead login: the service refuses the grant while it lasts and accepts it again once it is lifted.
+ */
+export declare const CLAUDE_ACCOUNT_ON_HOLD_URL = "https://claude.ai/restricted";
+/** The service put this account on hold. The login itself is intact, so it is never remembered as refused. */
+export declare class ClaudeAccountOnHoldError extends ClaudeRequestError {
+    constructor();
+}
+/**
+ * The OAuth error code a response names, read as Claude Code 2.1.273 reads it (`xc`, @191165290): the `error` field
+ * as a string, or the `type` of the object some Anthropic endpoints send it as.
+ */
+export declare const oauthErrorCode: (bodyArg: Record<string, unknown> | null) => string | undefined;
 /** The service refused a request for too many requests. That says nothing about the account's usage or login. */
 export declare class ClaudeRateLimitError extends ClaudeRequestError {
     readonly retryAt: string | null;

package/dist_ts/claudehttp.js

@@ -10,6 +10,26 @@ export const CLAUDE_LOGIN_REJECTED = 'Login expired or was rejected. Log in agai
 export class ClaudeLoginRejectedError extends ClaudeRequestError {
     constructor() { super(CLAUDE_LOGIN_REJECTED); }
 }
+/**
+ * Where Claude Code 2.1.273 sends an account the service put on hold (`T5e`, bundle offset @190070402). A hold is
+ * not a dead login: the service refuses the grant while it lasts and accepts it again once it is lifted.
+ */
+export const CLAUDE_ACCOUNT_ON_HOLD_URL = 'https://claude.ai/restricted';
+/** The service put this account on hold. The login itself is intact, so it is never remembered as refused. */
+export class ClaudeAccountOnHoldError extends ClaudeRequestError {
+    constructor() { super(`This Claude account is on hold and cannot sign in. View details or appeal: ${CLAUDE_ACCOUNT_ON_HOLD_URL}`); }
+}
+/**
+ * The OAuth error code a response names, read as Claude Code 2.1.273 reads it (`xc`, @191165290): the `error` field
+ * as a string, or the `type` of the object some Anthropic endpoints send it as.
+ */
+export const oauthErrorCode = (bodyArg) => {
+    const error = bodyArg?.error;
+    if (typeof error === 'string')
+        return error;
+    const type = typeof error === 'object' && error !== null ? error.type : undefined;
+    return typeof type === 'string' ? type : undefined;
+};
 /** The service refused a request for too many requests. That says nothing about the account's usage or login. */
 export class ClaudeRateLimitError extends ClaudeRequestError {
     retryAt;
@@ -80,4 +100,4 @@ export const claudeRequest = async (fetcherArg, requestArg) => {
         throw new ClaudeRequestError(`The ${requestArg.subject} service could not be reached.`);
     }
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhdWRlaHR0cC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL2NsYXVkZWh0dHAudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLHlCQUF5QixDQUFDO0FBQ3JELE9BQU8sRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBQ2hFLE9BQU8sRUFBRSxXQUFXLEVBQUUsTUFBTSxnQkFBZ0IsQ0FBQztBQUU3QyxtSEFBbUg7QUFDbkgsTUFBTSxPQUFPLGtCQUFtQixTQUFRLEtBQUs7Q0FBRztBQUVoRCxzSEFBc0g7QUFDdEgsTUFBTSxDQUFDLE1BQU0scUJBQXFCLEdBQUcsMkVBQTJFLENBQUM7QUFFakgsNENBQTRDO0FBQzVDLE1BQU0sT0FBTyx3QkFBeUIsU0FBUSxrQkFBa0I7SUFDOUQsZ0JBQWdCLEtBQUssQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDLENBQUMsQ0FBQztDQUNoRDtBQUVELGlIQUFpSDtBQUNqSCxNQUFNLE9BQU8sb0JBQXFCLFNBQVEsa0JBQWtCO0lBQ1Y7SUFBaEQsWUFBWSxVQUFrQixFQUFrQixPQUFzQjtRQUNwRSxLQUFLLENBQUMsT0FBTyxVQUFVLGlFQUFpRSxDQUFDLENBQUM7UUFENUMsWUFBTyxHQUFQLE9BQU8sQ0FBZTtJQUV0RSxDQUFDO0NBQ0Y7QUF1QkQsTUFBTSxrQkFBa0IsR0FBRyxJQUFJLEdBQUcsSUFBSSxDQUFDO0FBRXZDLG9HQUFvRztBQUNwRyxNQUFNLFFBQVEsR0FBRyxLQUFLLEVBQUUsV0FBcUIsRUFBRSxVQUFrQixFQUEyQyxFQUFFO0lBQzVHLE1BQU0sTUFBTSxHQUFHLFdBQVcsQ0FBQyxJQUFJLEVBQUUsU0FBUyxFQUFFLENBQUM7SUFDN0MsSUFBSSxDQUFDLE1BQU07UUFBRSxPQUFPLElBQUksQ0FBQztJQUN6QixNQUFNLE1BQU0sR0FBaUIsRUFBRSxDQUFDO0lBQ2hDLElBQUksSUFBSSxHQUFHLENBQUMsQ0FBQztJQUNiLElBQUksQ0FBQztRQUNILE9BQU8sSUFBSSxFQUFFLENBQUM7WUFDWixNQUFNLElBQUksR0FBRyxNQUFNLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUNqQyxJQUFJLElBQUksQ0FBQyxJQUFJO2dCQUFFLE1BQU07WUFDckIsSUFBSSxJQUFJLElBQUksQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDO1lBQzlCLElBQUksSUFBSSxHQUFHLGtCQUFrQixFQUFFLENBQUM7Z0JBQUMsTUFBTSxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUM7Z0JBQUMsTUFBTSxJQUFJLGtCQUFrQixDQUFDLE9BQU8sVUFBVSx5QkFBeUIsQ0FBQyxDQUFDO1lBQUMsQ0FBQztZQUNuSSxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMxQixDQUFDO0lBQ0gsQ0FBQztZQUFTLENBQUM7UUFBQyxNQUFNLENBQUMsV0FBVyxFQUFFLENBQUM7SUFBQyxDQUFDO0lBQ25DLElBQUksQ0FBQztRQUFDLE9BQU8sZ0JBQWdCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFBQyxDQUFDO0lBQ3BGLE1BQU0sQ0FBQztRQUFDLE9BQU8sSUFBSSxDQUFDO0lBQUMsQ0FBQztBQUN4QixDQUFDLENBQUM7QUFFRjs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sYUFBYSxHQUFHLEtBQUssRUFBRSxVQUF3QixFQUFFLFVBQTBCLEVBQTRCLEVBQUU7SUFDcEgsTUFBTSxPQUFPLEdBQUcsV0FBVyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDMUQsTUFBTSxNQUFNLEdBQUcsVUFBVSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDO0lBQzNGLElBQUksQ0FBQztRQUNILE1BQU0sUUFBUSxHQUFHLE1BQU0sVUFBVSxDQUFDLFVBQVUsQ0FBQyxHQUFHLEVBQUU7WUFDaEQsTUFBTSxFQUFFLFVBQVUsQ0FBQyxNQUFNLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsSUFBSSxFQUFFLFVBQVUsQ0FBQyxJQUFJO1lBQzNFLE9BQU8sRUFBRSxFQUFFLEdBQUcsVUFBVSxDQUFDLE9BQU8sRUFBRSxZQUFZLEVBQUUsY0FBYyxVQUFVLENBQUMsT0FBTyxFQUFFLEVBQUU7U0FDckYsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxRQUFRLENBQUMsTUFBTSxLQUFLLEdBQUcsRUFBRSxDQUFDO1lBQzVCLE1BQU0sUUFBUSxDQUFDLElBQUksRUFBRSxNQUFNLEVBQUUsQ0FBQztZQUM5QixNQUFNLElBQUksb0JBQW9CLENBQUMsVUFBVSxDQUFDLE9BQU8sRUFBRSxXQUFXLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsYUFBYSxDQUFDLEVBQUUsVUFBVSxDQUFDLEdBQUcsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUN6SCxDQUFDO1FBQ0QsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLElBQUksQ0FBQyxVQUFVLENBQUMsYUFBYSxFQUFFLENBQUM7WUFDOUMsTUFBTSxRQUFRLENBQUMsSUFBSSxFQUFFLE1BQU0sRUFBRSxDQUFDO1lBQzlCLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxDQUFDLE1BQU0sRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLENBQUM7UUFDakQsQ0FBQztRQUNELE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxDQUFDLE1BQU0sRUFBRSxJQUFJLEVBQUUsTUFBTSxRQUFRLENBQUMsUUFBUSxFQUFFLFVBQVUsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO0lBQ3pGLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsSUFBSSxNQUFNLENBQUMsT0FBTztZQUFFLE1BQU0sSUFBSSxrQkFBa0IsQ0FBQyxPQUFPLFVBQVUsQ0FBQyxPQUFPLFlBQVksT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxlQUFlLEdBQUcsQ0FBQyxDQUFDO1FBQzFJLElBQUksS0FBSyxZQUFZLGtCQUFrQjtZQUFFLE1BQU0sS0FBSyxDQUFDO1FBQ3JELE1BQU0sSUFBSSxrQkFBa0IsQ0FBQyxPQUFPLFVBQVUsQ0FBQyxPQUFPLGdDQUFnQyxDQUFDLENBQUM7SUFDMUYsQ0FBQztBQUNILENBQUMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhdWRlaHR0cC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL2NsYXVkZWh0dHAudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLHlCQUF5QixDQUFDO0FBQ3JELE9BQU8sRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBQ2hFLE9BQU8sRUFBRSxXQUFXLEVBQUUsTUFBTSxnQkFBZ0IsQ0FBQztBQUU3QyxtSEFBbUg7QUFDbkgsTUFBTSxPQUFPLGtCQUFtQixTQUFRLEtBQUs7Q0FBRztBQUVoRCxzSEFBc0g7QUFDdEgsTUFBTSxDQUFDLE1BQU0scUJBQXFCLEdBQUcsMkVBQTJFLENBQUM7QUFFakgsNENBQTRDO0FBQzVDLE1BQU0sT0FBTyx3QkFBeUIsU0FBUSxrQkFBa0I7SUFDOUQsZ0JBQWdCLEtBQUssQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDLENBQUMsQ0FBQztDQUNoRDtBQUVEOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLDBCQUEwQixHQUFHLDhCQUE4QixDQUFDO0FBRXpFLDhHQUE4RztBQUM5RyxNQUFNLE9BQU8sd0JBQXlCLFNBQVEsa0JBQWtCO0lBQzlELGdCQUFnQixLQUFLLENBQUMsOEVBQThFLDBCQUEwQixFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7Q0FDckk7QUFFRDs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSxjQUFjLEdBQUcsQ0FBQyxPQUF1QyxFQUFzQixFQUFFO0lBQzVGLE1BQU0sS0FBSyxHQUFHLE9BQU8sRUFBRSxLQUFLLENBQUM7SUFDN0IsSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDNUMsTUFBTSxJQUFJLEdBQUcsT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLEtBQUssS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFFLEtBQWlDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDL0csT0FBTyxPQUFPLElBQUksS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO0FBQ3JELENBQUMsQ0FBQztBQUVGLGlIQUFpSDtBQUNqSCxNQUFNLE9BQU8sb0JBQXFCLFNBQVEsa0JBQWtCO0lBQ1Y7SUFBaEQsWUFBWSxVQUFrQixFQUFrQixPQUFzQjtRQUNwRSxLQUFLLENBQUMsT0FBTyxVQUFVLGlFQUFpRSxDQUFDLENBQUM7UUFENUMsWUFBTyxHQUFQLE9BQU8sQ0FBZTtJQUV0RSxDQUFDO0NBQ0Y7QUF1QkQsTUFBTSxrQkFBa0IsR0FBRyxJQUFJLEdBQUcsSUFBSSxDQUFDO0FBRXZDLG9HQUFvRztBQUNwRyxNQUFNLFFBQVEsR0FBRyxLQUFLLEVBQUUsV0FBcUIsRUFBRSxVQUFrQixFQUEyQyxFQUFFO0lBQzVHLE1BQU0sTUFBTSxHQUFHLFdBQVcsQ0FBQyxJQUFJLEVBQUUsU0FBUyxFQUFFLENBQUM7SUFDN0MsSUFBSSxDQUFDLE1BQU07UUFBRSxPQUFPLElBQUksQ0FBQztJQUN6QixNQUFNLE1BQU0sR0FBaUIsRUFBRSxDQUFDO0lBQ2hDLElBQUksSUFBSSxHQUFHLENBQUMsQ0FBQztJQUNiLElBQUksQ0FBQztRQUNILE9BQU8sSUFBSSxFQUFFLENBQUM7WUFDWixNQUFNLElBQUksR0FBRyxNQUFNLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUNqQyxJQUFJLElBQUksQ0FBQyxJQUFJO2dCQUFFLE1BQU07WUFDckIsSUFBSSxJQUFJLElBQUksQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDO1lBQzlCLElBQUksSUFBSSxHQUFHLGtCQUFrQixFQUFFLENBQUM7Z0JBQUMsTUFBTSxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUM7Z0JBQUMsTUFBTSxJQUFJLGtCQUFrQixDQUFDLE9BQU8sVUFBVSx5QkFBeUIsQ0FBQyxDQUFDO1lBQUMsQ0FBQztZQUNuSSxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMxQixDQUFDO0lBQ0gsQ0FBQztZQUFTLENBQUM7UUFBQyxNQUFNLENBQUMsV0FBVyxFQUFFLENBQUM7SUFBQyxDQUFDO0lBQ25DLElBQUksQ0FBQztRQUFDLE9BQU8sZ0JBQWdCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFBQyxDQUFDO0lBQ3BGLE1BQU0sQ0FBQztRQUFDLE9BQU8sSUFBSSxDQUFDO0lBQUMsQ0FBQztBQUN4QixDQUFDLENBQUM7QUFFRjs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sYUFBYSxHQUFHLEtBQUssRUFBRSxVQUF3QixFQUFFLFVBQTBCLEVBQTRCLEVBQUU7SUFDcEgsTUFBTSxPQUFPLEdBQUcsV0FBVyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDMUQsTUFBTSxNQUFNLEdBQUcsVUFBVSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDO0lBQzNGLElBQUksQ0FBQztRQUNILE1BQU0sUUFBUSxHQUFHLE1BQU0sVUFBVSxDQUFDLFVBQVUsQ0FBQyxHQUFHLEVBQUU7WUFDaEQsTUFBTSxFQUFFLFVBQVUsQ0FBQyxNQUFNLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsSUFBSSxFQUFFLFVBQVUsQ0FBQyxJQUFJO1lBQzNFLE9BQU8sRUFBRSxFQUFFLEdBQUcsVUFBVSxDQUFDLE9BQU8sRUFBRSxZQUFZLEVBQUUsY0FBYyxVQUFVLENBQUMsT0FBTyxFQUFFLEVBQUU7U0FDckYsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxRQUFRLENBQUMsTUFBTSxLQUFLLEdBQUcsRUFBRSxDQUFDO1lBQzVCLE1BQU0sUUFBUSxDQUFDLElBQUksRUFBRSxNQUFNLEVBQUUsQ0FBQztZQUM5QixNQUFNLElBQUksb0JBQW9CLENBQUMsVUFBVSxDQUFDLE9BQU8sRUFBRSxXQUFXLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsYUFBYSxDQUFDLEVBQUUsVUFBVSxDQUFDLEdBQUcsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUN6SCxDQUFDO1FBQ0QsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLElBQUksQ0FBQyxVQUFVLENBQUMsYUFBYSxFQUFFLENBQUM7WUFDOUMsTUFBTSxRQUFRLENBQUMsSUFBSSxFQUFFLE1BQU0sRUFBRSxDQUFDO1lBQzlCLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxDQUFDLE1BQU0sRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLENBQUM7UUFDakQsQ0FBQztRQUNELE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxDQUFDLE1BQU0sRUFBRSxJQUFJLEVBQUUsTUFBTSxRQUFRLENBQUMsUUFBUSxFQUFFLFVBQVUsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO0lBQ3pGLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsSUFBSSxNQUFNLENBQUMsT0FBTztZQUFFLE1BQU0sSUFBSSxrQkFBa0IsQ0FBQyxPQUFPLFVBQVUsQ0FBQyxPQUFPLFlBQVksT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxlQUFlLEdBQUcsQ0FBQyxDQUFDO1FBQzFJLElBQUksS0FBSyxZQUFZLGtCQUFrQjtZQUFFLE1BQU0sS0FBSyxDQUFDO1FBQ3JELE1BQU0sSUFBSSxrQkFBa0IsQ0FBQyxPQUFPLFVBQVUsQ0FBQyxPQUFPLGdDQUFnQyxDQUFDLENBQUM7SUFDMUYsQ0FBQztBQUNILENBQUMsQ0FBQyJ9

package/dist_ts/interfaces.harness.d.ts

@@ -236,9 +236,13 @@ export interface IAuthHarness {
      */
     readonly autoSwitch?: boolean;
     /**
-     * The account's live status. It must never activate, switch or clear a login. It may renew the tokens of the
-     * saved copy it reads when the provider leaves it no other way to answer -- the Claude Code adapter does, for
-     * saved and inactive logins only, under its store's lock -- and must leave the active login's credential alone.
+     * The account's live status. It must never activate, switch or clear a login.
+     *
+     * It may renew the tokens of the credential it reads when the provider leaves it no other way to answer, under
+     * its store's lock and with a compare-and-swap on the refresh token it sent. A saved copy is always its own to
+     * renew -- the Claude Code adapter renews one, because Claude Code's active login is Claude Code's. The active
+     * login may only be renewed where the owning harness re-reads its credential file on every request, so that the
+     * rotation strands nothing: OpenCode's Anthropic provider does, and authswitch renews that entry.
      */
     readAccountStatus(accountIdArg: string, optionsArg?: IHarnessStatusOptions): Promise<IHarnessAccountStatus>;
     readonly loginProviders?: IHarnessLoginProvider[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelprofile.com/authswitch",
-  "version": "5.2.0",
+  "version": "6.1.0",
   "private": false,
   "description": "Manage Codex, OpenCode and Claude Code accounts with guided switching and live usage status",
   "main": "dist_ts/index.js",

package/readme.md

@@ -109,8 +109,11 @@ never blocked by a waiting switch; after that the operation fails with nothing
 changed. A lock left behind by a Claude Code that died goes stale after its own
 threshold and is taken over, as Claude Code itself would.
 
-**OpenCode keeps the previous login until it restarts.** It holds that login in
-memory and can write it back at its next OAuth token refresh. So before `use` and
+**A running OpenCode can still overwrite a switch.** Not by holding the previous login:
+its auth service caches nothing and re-reads `auth.json` on every lookup. The window is a
+request already in flight, which read the previous login before the switch and can write
+that login's own rotation back afterwards -- and OpenCode replaces the whole provider map
+in place rather than atomically. So before `use` and
 before `stash` without `--keep`, authswitch lists OpenCode's own running instances --
 pid, start time and command line -- and offers to stop them:
 
@@ -214,8 +217,20 @@ every other provider, and `stash openai` without `--keep` clears only OpenAI.
 When several logins are active, the guide asks which to save; scripts must name
 the provider or account. In the TUI, select an active row before pressing `a` or `c`.
 ChatGPT OAuth accounts display their email and use the same direct status APIs as
-Codex. API keys and opaque provider tokens have no reliable email, so their labels
-contain the provider and a SHA-256 fingerprint. Their quota/billing information is
+Codex. An `anthropic` OAuth login holds the same Claude subscriber grant Claude Code
+stores, so it reports Claude's own plan, organization and usage windows through the
+account endpoints described under **Claude Code**; OpenCode keeps no scopes and no
+account identity with that entry, so both are left to the service. An access token inside
+Claude Code's five-minute margin is renewed first, with the request OpenCode's own
+Anthropic provider sends (`opencode-anthropic-auth`: `console.anthropic.com`, Claude
+Code's public client, no scope), and the rotated pair is written back into `auth.json`
+atomically, preserving every other provider. Nothing is stranded by that write: OpenCode's
+auth service re-reads `auth.json` on every lookup and its Anthropic provider asks for the
+credential again inside every request, so a running instance picks up the rotation exactly
+as it picks up its own. A refusal is reported and nothing is written, and a saved copy is
+never renewed, because OpenCode's own entry holds the same refresh token.
+API keys and opaque provider tokens have no reliable email, so their
+labels contain the provider and a SHA-256 fingerprint. Their quota/billing information is
 explicitly unavailable. `OPENCODE_AUTH_CONTENT` overrides the file and blocks file
 management. Provider configuration and environment credentials remain managed by OpenCode.
 
@@ -254,19 +269,27 @@ authswitch does not infer them from account creation or token expiry dates. The
 Claude Code adapter declares that, so `limits` explains it once for the provider
 instead of per account.
 
-Nothing but Claude Code refreshes a Claude login, so a saved one stops being readable
-a few hours after it was saved. Reading a **saved, inactive** account's status therefore
+Nothing but Claude Code refreshes a Claude login, so a saved one stops being readable a
+few hours after it was saved. Reading a **saved, inactive** account's status therefore
 refreshes it first, exactly as Claude Code would: when its access token expires within
 five minutes, authswitch exchanges the stored refresh token at Claude's token endpoint,
 keeps every other field of the login, and writes the result only while the saved record
-still holds the refresh token it sent. The refresh holds the account store's lock, so a
-switch started at the same time waits for it and then activates the refreshed login. The
-**active** login is never refreshed -- Claude Code owns it, and two parties refreshing one
-login can invalidate the grant. A refusal is reported, never worked around -- a rejected
-grant says so and says what fixes it (below), and a service failure, an unreachable service
-or an unsupported response leave the saved login untouched. Requests carry `User-Agent:
-authswitch/<version>`, and HTTP 429 is reported as rate limiting with the service's retry
-time -- never as an exhausted or expired account.
+still holds the refresh token it sent. The request is the one Claude Code sends, down to
+the scopes: a login of Claude Code's own OAuth client is renewed with Claude Code's
+current scope set plus the project scopes the login carries -- not with the set the
+login happens to be stored under, which can be an older or wider one the service no
+longer accepts -- and a set the service refuses as `invalid_scope` is sent once more
+with the stored scopes. A login that names its own OAuth client keeps its stored scopes,
+because only that client's grant knows them. A login that is neither one of Claude
+Code's subscriber logins nor stored with a plan is not sent at all. The refresh holds
+the account store's lock, so a switch started at the same time waits for it and then
+activates the refreshed login. The **active** login is never refreshed -- Claude Code
+owns it, and two parties refreshing one login can invalidate the grant. A refusal is
+reported, never worked around -- a rejected grant says so and says what fixes it
+(below), and a service failure, an unreachable service or an unsupported response leave
+the saved login untouched. Requests carry `User-Agent: authswitch/<version>`, and HTTP
+429 is reported as rate limiting with the service's retry time -- never as an exhausted
+or expired account.
 
 Claude Code also rotates the refresh token of the login it **is** running on, so reading the
 accounts (`list`, `limits`, `active`, `current`, `watch`, the dashboard) mirrors that login
@@ -279,14 +302,57 @@ saved implicitly; `stash` is what saves a login. An installation whose native lo
 authswitch cannot read mirrors nothing, and a read waits at most a second for a lock a
 switch or Claude Code holds before leaving the saved copy to the next read.
 
-A grant the sign-in service refused is remembered in the saved record itself, as a hash of
-the refresh token -- never the token -- so a new authswitch run, a restarted watch or a
-second dashboard does not replay a dead login. Saving that login again clears it, as does
-any refresh that replaces the saved credential. Such a login reports `Login expired or was
-rejected. Log in again with Claude Code and save it. Claude Code rotates a login's refresh
-token as it uses it, and the service can refuse the older one a saved copy still holds once
-that login has been replaced outside authswitch; authswitch claude stash --keep saves the
-new one.`
+An account the service has put **on hold** is not a dead login: the hold refuses the grant
+while it lasts and the same login works again once it is lifted, so such an account keeps
+its stored plan, says that it is on hold and where to appeal, and is asked again on the
+next read.
+
+A grant the sign-in service refused is remembered in the saved record itself, as a hash
+of the request that was refused -- the refresh token, the client and the scopes, never
+the token itself -- so a new authswitch run, a restarted watch or a second dashboard
+does not replay a dead login. Because the hash covers the request and not only the
+token, a release that changes how authswitch asks gives every such login one honest
+attempt under the new derivation, while a refusal of the request authswitch still sends
+stays remembered. Saving that login again clears it, as does any refresh that replaces
+the saved credential. Such a login reports `Login expired or was rejected. Log in again
+with Claude Code and save it. Claude Code rotates a login's refresh token as it uses it,
+and the service can refuse the older one a saved copy still holds once that login has
+been replaced outside authswitch; authswitch claude stash --keep saves the new one.`
+
+Each `n/a` in a Claude row has a reason in the footnote under the table, and each
+reason names what to do:
+
+- `Login refresh: Login expired or was rejected.` -- the sign-in service refused the
+  saved refresh token itself. Log in again in Claude Code for that account and run
+  `authswitch claude stash --keep`; nothing else fixes it.
+- `Login refresh: This Claude account is on hold and cannot sign in.` -- the account,
+  not the login. Appeal at the address in the message; the saved login is kept and is
+  asked again on the next read.
+- `Login refresh: This saved login has no refresh token, and no subscriber scope or
+  plan to refresh with.` -- the saved record is missing what a refresh is made of.
+  Save the login again.
+- `Login refresh: this saved login's access token has expired and cannot be renewed
+  for this installation.` -- authswitch cannot read Claude Code's own files here (the
+  macOS Keychain, or an incomplete native login), so it cannot prove this login is not
+  the active one, and never refreshes a login that might be.
+- `Login refresh: The Claude sign-in service returned HTTP ...`, `... could not be
+  reached.`, `... timed out.`, `... is rate limiting requests (HTTP 429)` -- the
+  service, not the login. The saved login is untouched; read again later.
+- `Profile: ...` or `Usage: ...` -- the account endpoints, asked with a token the
+  refresh had just accepted. `Profile: Login expired or was rejected.` means the access
+  token itself was refused; the other wordings are the service, as above.
+- `Claude returned a different account or organization` -- the answer was about another
+  account and was discarded whole, rather than shown under this account's name.
+- `Claude profile response is unsupported` or `Claude usage response is unsupported` --
+  the service answered in a shape authswitch does not read. Nothing is guessed from a
+  response it does not understand.
+
+An OpenCode `anthropic` row reads the same endpoints and so shows the same reasons. Its
+renewal adds `Login refresh: Login expired or was rejected. Log in again with opencode
+auth login.`, which is Anthropic refusing the refresh token OpenCode's entry holds -- no
+retry changes that, and the refusal is never remembered, because OpenCode owns that entry.
+`This saved Anthropic login's access token has expired.` is a stashed copy, which is left
+alone so that the login OpenCode uses keeps a refresh token the service still accepts.
 
 OpenCode and Claude saved records are separate owner-only files under
 `~/.authswitch/opencode` and `~/.authswitch/claude`. Emails are accepted as account
@@ -982,7 +1048,7 @@ Account identity comes from the `id_token` inside the credential — the email c
 
 **Other Codex clients keep running.** Stopping the managed app-server does not stop an editor extension that spawned its own. Close it, or expect it to keep using the credential it already loaded.
 
-**A running OpenCode can undo a switch.** It holds the previous login in memory and rewrites the credential file at its next token refresh. Authswitch lists those instances, offers to stop them, warns when any keep running, and detects the overwrite afterwards — but it cannot prevent it while they run. Restart them after a switch. A running Claude Code picks the switch up instead; its guarantee rests on the behaviour and lock protocol verified against Claude Code 2.1.273, and `authswitch claude active` still reports a login that changed outside authswitch.
+**A running OpenCode can undo a switch.** Its auth service keeps no login in memory -- every lookup re-reads `auth.json` -- but a request already in flight, which read the previous login before the switch, can write that login's own rotation back afterwards, over a provider map OpenCode replaces in place. Authswitch lists those instances, offers to stop them, warns when any keep running, and detects the overwrite afterwards — but it cannot prevent it while they run. Restart them after a switch. A running Claude Code picks the switch up instead; its guarantee rests on the behaviour and lock protocol verified against Claude Code 2.1.273, and `authswitch claude active` still reports a login that changed outside authswitch.
 
 **The Codex stash is keyed by email.** Two Codex workspaces with the same email
 cannot both be saved under that key. Their account IDs are distinguished during

package/ts/00_commitinfo_data.ts

@@ -2,7 +2,7 @@
  * autocreated commitinfo by @push.rocks/commitinfo
  */
 export const commitinfo = {
-  name: "@modelprofile.com/authswitch",
-  version: "5.2.0",
-  description: "Manage Codex, OpenCode and Claude Code accounts with guided switching and live usage status"
+  name: '@modelprofile.com/authswitch',
+  version: '6.1.0',
+  description: 'Manage Codex, OpenCode and Claude Code accounts with guided switching and live usage status'
 }

package/ts/accounts.ts

@@ -239,7 +239,8 @@ const STATUS_LOOKUP_CONCURRENCY = 4;
  * Bounded status lookups: at most four accounts at a time, started in order, each handed the caller's signal.
  * A lookup that fails reports undefined; once the signal aborts, no further lookup starts. A callback that throws
  * rejects the call, and no other lookup starts after it. No lookup activates, switches or clears a login, though an
- * adapter may renew the tokens of the saved copy it reads (`IAuthHarness.readAccountStatus`).
+ * adapter may renew the tokens of the credential it reads, saved or active, on that method's terms
+ * (`IAuthHarness.readAccountStatus`).
  */
 const lookupStatuses = async (
   harnessArg: IAuthHarness,

package/ts/classes.claudecodeharness.ts

@@ -2,9 +2,9 @@ import * as plugins from './plugins.js';
 import { FileHarness, type IFileAccount, type IFileHarnessSnapshot } from './classes.fileharness.js';
 import { CredentialStore, credentialHash, credentialRecord, credentialText, readCredentialDocument, readCredentialRaw, type IStoredCredential } from './classes.credentialstore.js';
 import { HarnessProcesses } from './classes.harnessprocesses.js';
-import { ClaudeAccountStatus } from './classes.claudestatus.js';
+import { ClaudeAccountStatus, type IClaudeLogin } from './classes.claudestatus.js';
 import { ClaudeCodeLocks } from './classes.claudecodelocks.js';
-import { ClaudeTokenRefresh, type IClaudeTokens } from './classes.claudetokenrefresh.js';
+import { claudeGrant, ClaudeTokenRefresh, grantScope, type IClaudeTokens } from './classes.claudetokenrefresh.js';
 import { CLAUDE_LOGIN_REJECTED, ClaudeLoginRejectedError, ClaudeRateLimitError } from './claudehttp.js';
 import { writeSecretFileAtomically } from './helpers.js';
 import type { IHarnessAccountStatus, IHarnessProcessControl, IHarnessState, IHarnessStatusOptions } from './interfaces.harness.js';
@@ -160,8 +160,33 @@ export class ClaudeCodeHarness extends FileHarness {
       throw new Error('Claude Code switch failed while updating account metadata and was rolled back. The outgoing login remains saved; check authswitch claude doctor.');
     }
   }
-  /** The hash that identifies a saved login's refresh token, so a rejected grant is remembered without keeping it. */
-  private grantKey(oauthArg: Record<string, unknown>): string { return credentialHash(credentialText(oauthArg.refreshToken) ?? ''); }
+  /**
+   * The hash that identifies a refused sign-in, so it is remembered without keeping anything of the login.
+   *
+   * A refusal is about one request: the refresh token it carried, and the client and scopes authswitch derived for
+   * it. Binding all three means a login keeps its refusal for as long as authswitch would send the same request
+   * again, and that a release which changes the derivation -- adopting a scope set Claude Code changed, say -- gives
+   * every such login one honest attempt under the new one instead of repeating a verdict its request no longer earns.
+   */
+  private grantKey(oauthArg: Record<string, unknown>): string {
+    const grant = claudeGrant(oauthArg);
+    return credentialHash(JSON.stringify([credentialText(oauthArg.refreshToken) ?? '', grant?.clientId ?? '', grant === null ? '' : grantScope(grant.scopes)]));
+  }
+
+  /** The login a status lookup asks with: its token, and what this store knows about it. */
+  private login(accountArg: IFileAccount): IClaudeLogin {
+    const oauth = credentialRecord(accountArg.credential.claudeAiOauth);
+    const account = credentialRecord(accountArg.credential.oauthAccount);
+    const accountUuid = credentialText(account.accountUuid);
+    const organizationUuid = credentialText(account.organizationUuid);
+    const plan = credentialText(oauth.subscriptionType);
+    return {
+      accessToken: credentialText(oauth.accessToken) ?? '',
+      scopes: Array.isArray(oauth.scopes) ? oauth.scopes.filter((scope): scope is string => typeof scope === 'string') : [],
+      ...(accountUuid !== undefined && organizationUuid !== undefined ? { identity: { accountUuid, organizationUuid } } : {}),
+      ...(plan === undefined ? {} : { plan }),
+    };
+  }
 
   /**
    * The harness's accounts, with the saved copy of the active login brought up to date first.
@@ -226,28 +251,28 @@ export class ClaudeCodeHarness extends FileHarness {
    * is due is refreshed first; when that fails, the status says why and keeps the stored plan, and the saved login is
    * left exactly as it was.
    *
-   * A refresh is only ever sent for a login the native files prove is not the active one (`nativeView`), and a grant
-   * the service already rejected is not sent again while the saved record still holds it.
+   * A refresh is only ever sent for a login the native files prove is not the active one (`nativeView`), and a request
+   * the service already refused is not sent again while the saved record would produce the same one (`grantKey`).
    */
   public async readAccountStatus(id: string, optionsArg: IHarnessStatusOptions = {}): Promise<IHarnessAccountStatus> {
-    const read = (accountArg: IFileAccount) =>
-      this.status.read(credentialRecord(accountArg.credential.claudeAiOauth), credentialRecord(accountArg.credential.oauthAccount), optionsArg);
+    const read = (accountArg: IFileAccount) => this.status.read(this.login(accountArg), optionsArg);
     const view = this.nativeView(id);
     if (view.active) return read(view.active);
     const saved = this.savedCredential(id);
+    const login = this.login(saved);
     const oauth = credentialRecord(saved.credential.claudeAiOauth);
     if (!this.tokens.due(oauth)) return read(saved);
     if (view.unavailable !== null) {
-      return this.status.unavailable(oauth, `Login refresh: this saved login's access token has expired and cannot be renewed for this installation. ${view.unavailable}`);
+      return this.status.unavailable(login, `Login refresh: this saved login's access token has expired and cannot be renewed for this installation. ${view.unavailable}`);
     }
-    if (this.store.read(id).rejectedGrant === this.grantKey(oauth)) return this.status.unavailable(oauth, `Login refresh: ${SAVED_LOGIN_REJECTED}`);
+    if (this.store.read(id).rejectedGrant === this.grantKey(oauth)) return this.status.unavailable(login, `Login refresh: ${SAVED_LOGIN_REJECTED}`);
     let refreshed: IFileAccount;
     try { refreshed = await this.refreshSaved(id, optionsArg.signal); }
     catch (error) {
       if (optionsArg.signal?.aborted) throw error;
       const problem = error instanceof ClaudeLoginRejectedError ? SAVED_LOGIN_REJECTED
         : error instanceof Error ? error.message : 'the saved login could not be refreshed.';
-      return this.status.unavailable(oauth, `Login refresh: ${problem}`,
+      return this.status.unavailable(login, `Login refresh: ${problem}`,
         error instanceof ClaudeRateLimitError ? { retryAt: error.retryAt } : undefined);
     }
     return read(refreshed);
@@ -260,7 +285,7 @@ export class ClaudeCodeHarness extends FileHarness {
    * became active meanwhile belongs to Claude Code and is returned as it is, one in an installation that can no
    * longer be read is returned unrefreshed, and one another refresh already renewed is not refreshed twice. The new
    * tokens replace the saved ones only while the record still holds the refresh token that was sent, the
-   * compare-and-swap Claude Code 2.1.273 applies to its own store (`$fn`, @15410824).
+   * compare-and-swap Claude Code 2.1.273 applies to its own store (`$fn`, @191212749).
    */
   private refreshSaved(id: string, signal?: AbortSignal): Promise<IFileAccount> {
     return this.store.locked(async () => {