@north-light/crouter 0.3.311 → 0.3.313

package/dist/core/subscription-state.js

@@ -1,729 +1,193 @@
-import { existsSync, readFileSync } from 'node:fs';
-import { createHash } from 'node:crypto';
-import { homedir } from 'node:os';
+import { createHash, randomUUID } from 'node:crypto';
 import { join } from 'node:path';
-import { atomicWriteJson } from './fs-utils.js';
 import { LockedJsonFile } from './locked-file.js';
-export const ANTHROPIC_PROVIDER_ID = "anthropic";
-export const OPENAI_CODEX_PROVIDER_ID = "openai-codex";
+import { piAgentDir } from './runtime/package-health.js';
+import { openScopedStore } from './scoped-state/db.js';
+import { providerStore } from './scoped-state/paths.js';
+import { providerRowByReference, providerRows, providerWrite } from './scoped-state/providers.js';
+export const ANTHROPIC_PROVIDER_ID = 'anthropic';
+export const OPENAI_CODEX_PROVIDER_ID = 'openai-codex';
 export const INVALID_REFRESH_TOKEN_BACKOFF_MS = 30 * 24 * 60 * 60 * 1000;
-/**
- * Select the first viable model from an explicitly ordered set. Callers own ordering
- * (requested model first, then their configured fallback order) and side effects;
- * this policy owns the shared viability rules so launch and rotation cannot diverge.
- *
- * `pinnedToFirst` marks the FIRST candidate as an explicit provider pin: the caller
- * demanded that exact provider, so an unregistered or unauthenticated first candidate
- * forbids cross-provider fallback (selection stops, reporting only that one rejection).
- * A merely COOLING pin is transient, so fallback to a viable alternative is still
- * allowed. When false, every candidate is considered in order.
- */
-export function resolveProviderCandidates(candidates, now = Date.now(), options = {}) {
-    const viable = [];
-    const rejected = [];
-    const pinnedToFirst = options.pinnedToFirst === true;
-    for (let i = 0; i < candidates.length; i++) {
-        const candidate = candidates[i];
-        let reason;
-        if (!candidate.registered)
-            reason = "unregistered";
-        else if (candidate.automaticFallback === false)
-            reason = "non-managed-fallback";
-        else if (!candidate.authenticated)
-            reason = "unauthenticated";
-        else if ((candidate.coolingUntil ?? 0) > now)
-            reason = "cooling";
-        if (reason === undefined) {
-            viable.push(candidate);
-            continue;
-        }
+const DEFAULT_FALLBACK_STRENGTH = 'strong';
+const PROVIDERS = { anthropic: { label: 'Claude', credentials: 'anthropic-credentials.json' }, 'openai-codex': { label: 'OpenAI Codex', credentials: 'openai-codex-credentials.json' } };
+function agentDir() { return piAgentDir(); }
+function credentialFile(provider) { return join(agentDir(), PROVIDERS[provider].credentials); }
+function normalizeStrength(value) { return value === 'ultra' || value === 'strong' || value === 'medium' || value === 'light' ? value : undefined; }
+function key(label) { return label.toLowerCase(); }
+function credential(input) { const label = typeof input.label === 'string' ? input.label.trim() : ''; const refresh = typeof input.refresh === 'string' ? input.refresh.trim() : ''; const access = typeof input.access === 'string' ? input.access.trim() : ''; const expires = Number(input.expires); if (!label || !refresh || !access || !Number.isFinite(expires))
+    return undefined; const accountId = typeof input.accountId === 'string' && input.accountId.trim() ? input.accountId.trim() : undefined; return { label, refresh, access, expires, rateLimitedUntil: Number.isFinite(Number(input.rateLimitedUntil)) ? Number(input.rateLimitedUntil) : 0, lastAttemptAt: Number.isFinite(Number(input.lastAttemptAt)) ? Number(input.lastAttemptAt) : 0, lastRateLimitedAt: Number.isFinite(Number(input.lastRateLimitedAt)) ? Number(input.lastRateLimitedAt) : 0, ...(input.authFailure === 'invalid_grant' ? { authFailure: 'invalid_grant' } : {}), ...(accountId ? { accountId } : {}) }; }
+function assertCredential(provider, entry) { if (!entry.label?.trim())
+    throw new Error(`${getProviderLabel(provider)} subscription label cannot be empty`); const result = credential(entry); if (!result)
+    throw new Error(`Refusing to persist incomplete ${getProviderLabel(provider)} subscription "${entry.label.trim()}"; pool rows require both OAuth tokens.`); return result; }
+function parseCredentials(path, current) { if (!current || current.trim() === '')
+    return { version: 1, accounts: {} }; let parsed; try {
+    parsed = JSON.parse(current);
+}
+catch (error) {
+    throw new Error(`managed credential file ${path} is corrupt: ${error instanceof Error ? error.message : String(error)}`);
+} if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed) || parsed.version !== 1 || typeof parsed.accounts !== 'object' || parsed.accounts === null || Array.isArray(parsed.accounts))
+    throw new Error(`managed credential file ${path} is corrupt`); return parsed; }
+function toPublic(row, file) { const stored = file.accounts[row.id]; if (!stored || typeof stored.refresh !== 'string' || typeof stored.access !== 'string' || !Number.isFinite(stored.expires))
+    throw new Error(`managed ${row.providerId} account ${row.id} has no credential record`); return { label: row.label, refresh: stored.refresh, access: stored.access, expires: stored.expires, rateLimitedUntil: row.rateLimitedUntil, lastAttemptAt: row.lastAttemptAt, lastRateLimitedAt: row.lastRateLimitedAt, ...(row.authFailure ? { authFailure: row.authFailure } : {}), ...(stored.accountId ? { accountId: stored.accountId } : {}) }; }
+function rowsWithCredentials(provider, file) { return providerRows(agentDir(), provider).map((row) => ({ row, entry: toPublic(row, file) })); }
+function managedCredentialFile(provider) { return new LockedJsonFile(credentialFile(provider), true, '{"version":1,"accounts":{}}\n'); }
+function readFile(provider) { return parseCredentials(credentialFile(provider), managedCredentialFile(provider).readUnlocked()); }
+function identity(entry) { return entry.accountId?.trim() || (entry.refresh.trim() ? `refresh:${createHash('sha256').update(entry.refresh.trim()).digest('hex')}` : undefined); }
+function assertTokens(provider, label, value) { const refresh = value.refresh?.trim() ?? ''; const access = value.access?.trim() ?? ''; const expires = Number(value.expires); if (!refresh || !access || !Number.isFinite(expires))
+    throw new Error(`${getProviderLabel(provider)} subscription "${label}" returned an incomplete credential; the stored credential was left unchanged.`); return { refresh, access, expires }; }
+export function isManagedProvider(providerId) { return providerId === ANTHROPIC_PROVIDER_ID || providerId === OPENAI_CODEX_PROVIDER_ID; }
+export function getProviderLabel(providerId) { return PROVIDERS[providerId].label; }
+export function resolveProviderCandidates(candidates, now = Date.now(), options = {}) { const viable = []; const rejected = []; for (let i = 0; i < candidates.length; i++) {
+    const candidate = candidates[i];
+    const reason = !candidate.registered ? 'unregistered' : candidate.automaticFallback === false ? 'non-managed-fallback' : !candidate.authenticated ? 'unauthenticated' : (candidate.coolingUntil ?? 0) > now ? 'cooling' : undefined;
+    if (!reason)
+        viable.push(candidate);
+    else {
         rejected.push({ candidate, reason });
-        // A hard provider pin on the requested (first) candidate forbids alternatives
-        // — unless the pin is merely cooling, a transient managed cooldown that still
-        // prefers a viable fallback over stalling.
-        if (pinnedToFirst && i === 0 && reason !== "cooling")
-            break;
-    }
-    return { candidates: viable, rejected };
-}
-// pi's agent dir, resolved PER ACCESS. Deliberately mirrors pi's own `getAgentDir()`
-// (PI_CODING_AGENT_DIR, tilde-expanded, else ~/.pi/agent) rather than importing it: a
-// value import from @earendil-works/pi-coding-agent would drag the whole pi SDK into
-// every CLI leaf that touches subscriptions. Resolving per access (never once at module
-// load) is what makes PI_CODING_AGENT_DIR and a per-process HOME actually take effect.
-function agentDir() {
-    const configured = process.env["PI_CODING_AGENT_DIR"];
-    if (configured) {
-        return configured === "~" || configured.startsWith("~/") ? join(homedir(), configured.slice(1)) : configured;
-    }
-    return join(homedir(), ".pi", "agent");
-}
-function rotationConfigFile() {
-    return join(agentDir(), "provider-rotation.json");
-}
-const DEFAULT_FALLBACK_STRENGTH = "strong";
-const PROVIDERS = {
-    [ANTHROPIC_PROVIDER_ID]: {
-        label: "Claude",
-        poolFileName: "anthropic-subscriptions.json",
-    },
-    [OPENAI_CODEX_PROVIDER_ID]: {
-        label: "OpenAI Codex",
-        poolFileName: "openai-codex-subscriptions.json",
-    },
-};
-/** The pool file backing one managed provider's accounts, in the CURRENT agent dir. */
-function poolFileFor(providerId) {
-    return join(agentDir(), PROVIDERS[providerId].poolFileName);
-}
-function readJsonFile(path) {
-    if (!existsSync(path))
-        return undefined;
-    try {
-        const raw = readFileSync(path, "utf8").trim();
-        if (!raw)
-            return undefined;
-        return JSON.parse(raw);
-    }
-    catch {
-        return undefined;
-    }
-}
-/**
- * The pool file is read strictly: an absent or empty file represents no accounts, while a
- * present file that cannot be read or parsed is an operational error. Treating the latter as
- * an empty pool would incorrectly report an authenticated provider as unconfigured.
- */
-function readPoolFile(path) {
-    if (!existsSync(path))
-        return undefined;
-    try {
-        const raw = readFileSync(path, "utf8").trim();
-        if (!raw)
-            return undefined;
-        return JSON.parse(raw);
-    }
-    catch (error) {
-        throw new Error(`Subscription pool ${path} is unreadable: ${error instanceof Error ? error.message : String(error)}`);
-    }
-}
-/**
- * The pool contents a locked transaction is about to act on. An empty file is genuinely no
- * accounts; a non-empty file that will not parse is CORRUPT, and treating it as an empty pool
- * is what let `modifyElectedSubscription` answer pi's refresh with `undefined` -- the exact
- * shape pi reports as `Provider is not configured: <id>`, a fatal fault no agent can clear
- * from inside its own turn. Raise instead, so the failure names itself.
- */
-function parsePoolUnderLock(path, current) {
-    if (!current || current.trim() === "")
-        return undefined;
-    try {
-        return JSON.parse(current);
-    }
-    catch (error) {
-        throw new Error(`Subscription pool ${path} is corrupt: ${error instanceof Error ? error.message : String(error)}`);
-    }
-}
-function normalizeStrength(value) {
-    return value === "ultra" || value === "strong" || value === "medium" || value === "light" ? value : undefined;
-}
-function normalizeTiming(value) {
-    const numeric = Number(value);
-    return Number.isFinite(numeric) ? numeric : 0;
-}
-// A pool row IS a credential: an account whose OAuth token pair is missing cannot service a
-// turn and cannot be refreshed, so it is not a lesser row, it is not a row at all. Normalization
-// drops it here, which is what lets every consumer treat pool occupancy as authentication.
-function normalizeCredential(value) {
-    const label = typeof value.label === "string" ? value.label.trim() : "";
-    if (!label)
-        return undefined;
-    const refresh = typeof value.refresh === "string" ? value.refresh.trim() : "";
-    const access = typeof value.access === "string" ? value.access.trim() : "";
-    if (!refresh || !access)
-        return undefined;
-    const accountId = typeof value.accountId === "string" ? value.accountId.trim() : "";
-    const expires = Number(value.expires);
-    const rateLimitedUntil = Number(value.rateLimitedUntil);
-    return {
-        label,
-        refresh,
-        access,
-        expires: Number.isFinite(expires) ? expires : 0,
-        ...(accountId ? { accountId } : {}),
-        rateLimitedUntil: Number.isFinite(rateLimitedUntil) ? rateLimitedUntil : 0,
-        ...(value.authFailure === "invalid_grant" ? { authFailure: "invalid_grant" } : {}),
-        lastAttemptAt: normalizeTiming(value.lastAttemptAt),
-        lastRateLimitedAt: normalizeTiming(value.lastRateLimitedAt),
-    };
-}
-function normalizeCredentials(values) {
-    if (!Array.isArray(values))
-        return [];
-    return values.map((entry) => normalizeCredential(entry)).filter((entry) => Boolean(entry));
-}
-// Announced only where the drop is about to be PERSISTED. Normalization also runs on the
-// lock-free read path, which discards nothing from storage, so tracing inside it reports a
-// loss that has not happened and repeats on every read. The account-set log compares
-// normalized state on both sides and so can never see this row; say it here instead.
-function traceDroppedRows(providerId, stored, normalized) {
-    if (!Array.isArray(stored) || stored.length === normalized.length)
-        return;
-    process.stderr.write(`[subscription-pool] ${getProviderLabel(providerId)}: dropping ${stored.length - normalized.length} stored row(s) with no label or no token pair\n`);
-}
-// A refreshed/modified token set is only storable when it carries BOTH halves and a usable
-// expiry. Persisting a partial one is silently destructive: `JSON.stringify` drops the missing
-// key, and `normalizeCredential` (which requires refresh AND access together) then discards the
-// whole row on the very next read — silently logging that account out until the user logs in
-// again, at which point the next refresh repeats it. Providers do not all validate their own refresh response
-// (pi's Anthropic flow forwards `data.refresh_token` verbatim, absent or not), so the storage
-// layer refuses the write instead: the previous credential stays intact and the caller sees a
-// real error it can classify (cooldown -> reauth -> fallback).
-function assertStorableTokens(providerId, label, value) {
-    const refresh = typeof value.refresh === "string" ? value.refresh.trim() : "";
-    const access = typeof value.access === "string" ? value.access.trim() : "";
-    const expires = Number(value.expires);
-    if (!refresh || !access || !Number.isFinite(expires)) {
-        const missing = [!refresh ? "refresh token" : undefined, !access ? "access token" : undefined, Number.isFinite(expires) ? undefined : "expiry"]
-            .filter((part) => part !== undefined)
-            .join(", ");
-        throw new Error(`${getProviderLabel(providerId)} subscription "${label}" returned an incomplete credential (missing ${missing}); the stored credential was left unchanged.`);
-    }
-    return { refresh, access, expires };
-}
-// Every candidate row must survive normalization before it can reach disk. Existing on-disk
-// rows remain tolerant of malformed historical data during reads, but a new transform cannot
-// acknowledge a row that persistence would silently discard.
-function assertCandidateRowsStorable(providerId, candidate) {
-    for (const entry of candidate) {
-        if (normalizeCredential(entry) !== undefined)
-            continue;
-        const label = typeof entry.label === "string" && entry.label.trim() ? ` "${entry.label.trim()}"` : "";
-        throw new Error(`Refusing to persist incomplete ${getProviderLabel(providerId)} subscription${label}; pool rows require a label and both OAuth tokens.`);
-    }
-}
-// The ONE door every write to a pool file goes through. Both pool invariants -- one account
-// identity per pool, and every candidate row carrying a storable credential -- are properties
-// of the FILE, not of whichever code path happens to be writing, so they are asserted here
-// against the state this write replaces, under the caller's already-held lock. `atomicWriteJson`
-// is reached for the pool NOWHERE ELSE in this file: that makes the invariants unbypassable.
-function persistPool(providerId, poolFile, base, candidate) {
-    assertCandidateRowsStorable(providerId, candidate);
-    const next = normalizeCredentials(candidate);
-    logCredentialSetChange(providerId, base, next);
-    atomicWriteJson(poolFile, next, { mode: 0o600 });
-    return next;
-}
-// Accounts vanishing from a pool is the failure users actually feel ("I keep having to log in
-// again"), and a shrinking file says nothing about which process shrank it. Every write that
-// CHANGES the set of accounts announces itself on stderr -- which lands in the broker log next to the rotation lines -- with the pid
-// and argv of whoever did it. Unchanged sets (the constant cooldown/timestamp bookkeeping) stay
-// silent, so this is a rare, high-signal line, not a log firehose.
-function logCredentialSetChange(providerId, base, next) {
-    const labels = (pool) => pool.map((entry) => entry.label).sort();
-    const before = labels(base);
-    const after = labels(next);
-    if (before.length === after.length && before.every((label, index) => label === after[index]))
-        return;
-    const who = `pid ${process.pid} ${process.argv.slice(1).join(" ")}`;
-    process.stderr.write(`[subscription-pool] ${getProviderLabel(providerId)} accounts changed: [${before.join(", ")}] -> [${after.join(", ")}] (${who})\n`);
-}
-export function isManagedProvider(providerId) {
-    return providerId === ANTHROPIC_PROVIDER_ID || providerId === OPENAI_CODEX_PROVIDER_ID;
-}
-export function getProviderLabel(providerId) {
-    return PROVIDERS[providerId].label;
-}
-// The ONE locked read/modify/write primitive for a provider pool file. It acquires a
-// cross-process lock on the pool file, re-reads + normalizes the pool under that lock, awaits
-// the caller's transform, and persists atomically through `persistPool` before releasing.
-// Every pool mutation goes through this door, so causal cooldown guards compare against
-// fresh-under-lock state and all pool invariants share one write path.
-//
-// `fn` returning `undefined` means "no change, skip the write" (used by timestamp guards and
-// refreshes that find a fresh credential). `withLockAsync` seeds a missing file with `{}`;
-// `normalizeCredentials` coerces that first-lock seed to an empty pool. Pool writes happen via
-// the callback's atomic tmp+rename and return no backend `next`, so lock-free readers always see
-// a whole snapshot. Throws (rather than proceeding unlocked) if lock acquisition is exhausted.
-export async function mutateSubscriptionPool(providerId, fn) {
-    const poolFile = poolFileFor(providerId);
-    return new LockedJsonFile(poolFile).withLockAsync(async (current, assertLockHeld) => {
-        const parsed = parsePoolUnderLock(poolFile, current);
-        const base = normalizeCredentials(parsed);
-        const transformed = await fn(base, assertLockHeld);
-        if (transformed !== undefined)
-            traceDroppedRows(providerId, parsed, base);
-        if (transformed === undefined)
-            return { result: base };
-        return { result: persistPool(providerId, poolFile, base, transformed) };
-    });
-}
-// The token exchange for ONE account, serialized across processes on the pool file's own lock.
-// A refresh token is single-use: without this, two brokers holding the same expired credential
-// both call the provider, and the loser gets a genuine `invalid_grant` that bricks its turn. The
-// whole read -> check-expiry -> exchange -> write transaction therefore happens under the lock,
-// so a second refresher that arrives after a winner observes the rotated value and never makes
-// its own (now doomed) call. Every account stores its value in this shared pool.
-//
-// The exchange is awaited while the shared pool transaction holds the lock.
-export async function refreshSubscriptionCredential(providerId, label, exchange) {
-    const committed = await mutateSubscriptionPool(providerId, async (pool, assertLockHeld) => {
-        const index = pool.findIndex((entry) => entry.label === label);
-        if (index === -1)
-            throw new Error(`${getProviderLabel(providerId)} subscription "${label}" no longer exists`);
-        const entry = pool[index];
-        if (entry.expires > Date.now())
-            return undefined;
-        const refreshed = assertStorableTokens(providerId, label, await exchange(entry.refresh));
-        const next = [...pool];
-        next[index] = { ...entry, refresh: refreshed.refresh, access: refreshed.access, expires: refreshed.expires };
-        assertLockHeld();
-        return next;
-    });
-    const result = committed.find((entry) => entry.label === label);
-    if (result === undefined)
-        throw new Error(`${getProviderLabel(providerId)} subscription "${label}" did not survive the write`);
-    return result;
-}
-// The serialized read-modify-write pi's `CredentialStore.modify` contract demands. Pi's OAuth
-// refresh runs inside `apply`, and refresh tokens are single-use, so election, exchange, and
-// persistence remain under one pool lock. A credential whose provider rejects its refresh token
-// is marked auth-failed before the next eligible pool account is tried; this lets pi's eager
-// credential resolution recover through the same account pool as turn-time rotation. If every
-// candidate fails, those auth-failure marks are persisted before the final error is rethrown.
-//
-// `apply` returning `undefined` means "no token change". Only the token triple is replaced on a
-// successful refresh; account identity and rotation bookkeeping remain attached to their row.
-export function isInvalidRefreshTokenError(error) {
-    const value = error;
-    const typedStatus = typeof value?.status === "number" ? value.status : undefined;
-    const message = [value?.errorMessage, value?.message, error instanceof Error ? error.message : ""]
-        .filter((part) => typeof part === "string" && part.length > 0)
-        .join(" ");
-    const messageStatusMatch = message.match(/\bstatus[=:]\s*(\d+)/i);
-    const status = typedStatus ?? (messageStatusMatch ? Number(messageStatusMatch[1]) : Number.NaN);
-    return status === 400 && /invalid_grant|refresh token .*invalid|refresh token .*not found/i.test(message);
-}
-export async function modifyElectedSubscription(providerId, elect, apply) {
-    let label;
-    let pendingError;
-    const committed = await mutateSubscriptionPool(providerId, async (pool, assertLockHeld) => {
-        const next = [...pool];
-        const attempted = new Set();
-        let changed = false;
-        while (attempted.size < next.length) {
-            const elected = elect(next.filter((entry) => !attempted.has(entry.label)));
-            if (elected === undefined)
-                break;
-            const index = next.findIndex((entry) => entry.label === elected.label);
-            if (index === -1)
-                break;
-            attempted.add(next[index].label);
-            let applied;
-            try {
-                applied = await apply(next[index]);
-            }
-            catch (error) {
-                if (!isInvalidRefreshTokenError(error)) {
-                    pendingError = error;
-                    break;
-                }
-                const attemptAt = Date.now();
-                next[index] = {
-                    ...next[index],
-                    authFailure: "invalid_grant",
-                    lastAttemptAt: Math.max(next[index].lastAttemptAt, attemptAt),
-                    rateLimitedUntil: Math.max(next[index].rateLimitedUntil, attemptAt + INVALID_REFRESH_TOKEN_BACKOFF_MS),
-                };
-                changed = true;
-                pendingError = error;
-                continue;
-            }
-            label = next[index].label;
-            pendingError = undefined;
-            if (applied !== undefined) {
-                const stored = assertStorableTokens(providerId, next[index].label, applied);
-                next[index] = { ...next[index], refresh: stored.refresh, access: stored.access, expires: stored.expires };
-                changed = true;
-            }
+        if (options.pinnedToFirst && i === 0 && reason !== 'cooling')
             break;
-        }
-        if (!changed)
-            return undefined;
-        assertLockHeld();
-        return next;
-    });
-    if (pendingError !== undefined)
-        throw pendingError;
-    return label === undefined ? undefined : committed.find((entry) => entry.label === label);
-}
-export function readSubscriptionPool(providerId) {
-    // Reads are lock-free: whole-file tmp+rename persistence means a reader always sees a complete
-    // snapshot.
-    return normalizeCredentials(readPoolFile(poolFileFor(providerId)));
-}
-// Seed/replace the entire pool under the lock. Production mutation goes through the specific
-// mutators below (each a thin transform over `mutateSubscriptionPool`); this whole-array replace
-// exists for test seeding and is still locked, never an unlocked write surface.
-export async function writeSubscriptionPool(providerId, next) {
-    return mutateSubscriptionPool(providerId, () => next);
-}
-function resolveCredentialIndex(pool, ref) {
-    const needle = ref.trim().toLowerCase();
-    const numeric = Number.parseInt(needle, 10);
-    if (Number.isFinite(numeric) && String(numeric) === needle && numeric >= 1 && numeric <= pool.length) {
-        return numeric - 1;
     }
-    return pool.findIndex((entry) => entry.label.toLowerCase() === needle);
-}
-// Merge an incoming upsert onto an existing same-label entry (design §1). Credential VALUE
-// fields always come from the incoming entry (that is the point of the upsert); timing/cooldown
-// state is reconciled causally so a refresh/reauth upsert built from a snapshot taken before a
-// concurrent 429 can never erase that newer cooldown. The `>=` on `lastRateLimitedAt` is
-// deliberate: reauth clears a cooldown after a successful re-login while preserving
-// `lastRateLimitedAt`, so its equal-timestamp write wins and clears -- but a 429 that landed
-// AFTER the reauth snapshot has a strictly greater `lastRateLimitedAt` and survives.
-function mergeUpsert(existing, incoming) {
-    const cooldownFromIncoming = incoming.lastRateLimitedAt >= existing.lastRateLimitedAt;
-    const accountId = incoming.accountId ?? existing.accountId;
-    return {
-        ...incoming,
-        ...(accountId ? { accountId } : {}),
-        lastAttemptAt: Math.max(existing.lastAttemptAt, incoming.lastAttemptAt),
-        lastRateLimitedAt: cooldownFromIncoming ? incoming.lastRateLimitedAt : existing.lastRateLimitedAt,
-        rateLimitedUntil: cooldownFromIncoming ? incoming.rateLimitedUntil : existing.rateLimitedUntil,
-    };
-}
-export async function upsertSubscription(providerId, next) {
-    return mutateSubscriptionPool(providerId, (pool) => {
-        const index = pool.findIndex((entry) => entry.label.toLowerCase() === next.label.toLowerCase());
-        if (index === -1)
-            return [...pool, next];
-        const merged = [...pool];
-        merged[index] = mergeUpsert(pool[index], next);
-        return merged;
-    });
-}
-// Thrown from inside the locked add transform when a label or Codex account already exists. A
-// typed error so the /provider-sub handler surfaces a precise, user-facing message while the
-// uniqueness decision itself stays atomic under the pool lock.
+} return { candidates: viable, rejected }; }
 export class DuplicateSubscriptionError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = "DuplicateSubscriptionError";
-    }
-}
-// The identity an account dedupes on. Codex logins carry the provider's own account claim, which
-// is a true account identity. Anthropic's OAuth token carries none, so the CREDENTIAL stands in
-// for one -- a one-way digest of the refresh token, never logged and never persisted (derived on
-// demand, compared in memory). That catches the same stored credential landing under a second
-// label; it does NOT catch two independent logins to one Anthropic account, which mint different
-// refresh tokens. Tightening that needs an account claim Anthropic does not currently supply.
-function accountIdentity(entry) {
-    const accountId = entry.accountId?.trim();
-    if (accountId)
-        return accountId;
-    const refresh = entry.refresh?.trim();
-    return refresh ? `refresh:${createHash("sha256").update(refresh).digest("hex")}` : undefined;
-}
-// The one account-uniqueness gate, shared by every identity write. Called inside a
-// `mutateSubscriptionPool` transform so it sees
-// fresh-under-lock state. `exceptLabel` is the slot being updated -- excluded from the scan so
-// a reauth/relogin of a slot into the SAME account it already holds is not a self-collision.
-// An undefined `identity` makes no dedupe claim, so it is a no-op. Throws the typed error the
-// handler surfaces to the user.
-function findAccountCollision(pool, identity, exceptLabel) {
-    if (!identity)
-        return undefined;
-    return pool.find((entry) => entry.label.toLowerCase() !== exceptLabel.toLowerCase() && accountIdentity(entry) === identity);
-}
-function assertAccountAvailable(pool, providerId, identity, exceptLabel) {
-    const collision = findAccountCollision(pool, identity, exceptLabel);
-    if (collision) {
-        throw new DuplicateSubscriptionError(`This ${getProviderLabel(providerId)} account is already added as “${collision.label}” — it shares the same quota, so a second slot adds no redundancy.`);
-    }
-}
-// Atomically append a new subscription, enforcing label and account uniqueness inside the pool
-// lock. The long OAuth flow stays outside the lock; only this final validate-then-append is
-// serialized, so two brokers that both finish OAuth for the same account cannot add two labels.
-export async function addSubscription(providerId, entry) {
-    return mutateSubscriptionPool(providerId, (pool) => {
-        // Normalize the candidate label BEFORE the locked uniqueness check: `normalizeCredentials`
-        // trims on persist, so a raw " work " that passed an untrimmed check would land as a
-        // duplicate "work". Reject an empty/whitespace label here too -- the storage primitive
-        // stays defensive regardless of what the handler validated.
-        const label = entry.label.trim();
-        if (!label)
-            throw new Error(`${getProviderLabel(providerId)} subscription label cannot be empty`);
-        if (pool.some((existing) => existing.label.toLowerCase() === label.toLowerCase())) {
-            throw new DuplicateSubscriptionError(`${getProviderLabel(providerId)} subscription already exists: ${label}`);
-        }
-        assertAccountAvailable(pool, providerId, accountIdentity(entry), label);
-        return [...pool, { ...entry, label }];
-    });
-}
-// Identity-checked upsert for reauthentication. Same merge semantics as `upsertSubscription`
-// (append-or-`mergeUpsert`, preserving cooldown causality), but gated by `assertAccountAvailable`
-// first: reauthenticating a row into an account held by another row throws instead of creating a
-// duplicate quota entry. `next.label` is excluded so reauth into its own row passes.
-export async function upsertSubscriptionWithUniqueAccount(providerId, next) {
-    return mutateSubscriptionPool(providerId, (pool) => {
-        assertAccountAvailable(pool, providerId, accountIdentity(next), next.label);
-        const index = pool.findIndex((entry) => entry.label.toLowerCase() === next.label.toLowerCase());
-        if (index === -1)
-            return [...pool, next];
-        const merged = [...pool];
-        const value = mergeUpsert(pool[index], next);
-        // A reauthentication without a stable identity must not attach the old account's identity to
-        // newly issued tokens. Refreshes use `modifyElectedSubscription`, which preserves identity.
-        if (next.accountId === undefined) {
-            const { accountId: _accountId, ...withoutAccountId } = value;
-            merged[index] = withoutAccountId;
-        }
-        else {
-            merged[index] = value;
-        }
-        return merged;
-    });
-}
-export async function renameSubscription(providerId, ref, nextLabel) {
-    return mutateSubscriptionPool(providerId, (pool) => {
-        const index = resolveCredentialIndex(pool, ref);
-        if (index === -1)
-            throw new Error(`Unknown ${getProviderLabel(providerId)} subscription: ${ref}`);
-        const label = nextLabel.trim();
-        if (!label)
-            throw new Error(`${getProviderLabel(providerId)} subscription label cannot be empty`);
-        if (pool.some((entry, entryIndex) => entryIndex !== index && entry.label.toLowerCase() === label.toLowerCase())) {
-            throw new DuplicateSubscriptionError(`${getProviderLabel(providerId)} subscription already exists: ${label}`);
+    constructor(message) { super(message); this.name = 'DuplicateSubscriptionError'; }
+}
+export function readSubscriptionPool(provider) { return rowsWithCredentials(provider, readFile(provider)).map(({ entry }) => entry); }
+async function locked(provider, run) { const path = credentialFile(provider); return managedCredentialFile(provider).withLockAsync(async (current, _held, publish) => { const file = parseCredentials(path, current); return { result: await run(file, rowsWithCredentials(provider, file), (next) => publish(`${JSON.stringify(next)}\n`)) }; }); }
+function insert(db, provider, row) { db.prepare('INSERT INTO managed_accounts(provider_id,id,label,label_key,position,last_attempt_at,last_rate_limited_at,rate_limited_until,auth_failure) VALUES(?,?,?,?,?,?,?,?,?)').run(provider, row.id, row.label, row.labelKey, row.position, row.lastAttemptAt, row.lastRateLimitedAt, row.rateLimitedUntil, row.authFailure ?? null); }
+function update(db, row) { db.prepare('UPDATE managed_accounts SET label=?,label_key=?,position=?,last_attempt_at=?,last_rate_limited_at=?,rate_limited_until=?,auth_failure=? WHERE provider_id=? AND id=?').run(row.label, row.labelKey, row.position, row.lastAttemptAt, row.lastRateLimitedAt, row.rateLimitedUntil, row.authFailure ?? null, row.providerId, row.id); }
+function publicPool(provider, file) { return rowsWithCredentials(provider, file).map(({ entry }) => entry); }
+function writeMembershipAfterCredentialPublish(provider, write) { try {
+    write();
+}
+catch (error) {
+    throw new Error(`managed ${getProviderLabel(provider)} credential file was published, but its SQL membership update failed; SQL membership remains authoritative: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+} }
+export async function writeSubscriptionPool(provider, next) { return locked(provider, async (file, rows, publish) => { const normalized = next.map((entry) => assertCredential(provider, entry)); const ids = normalized.map((entry, index) => ({ entry, id: rows[index]?.row.id ?? randomUUID() })); const accounts = {}; for (const { entry, id } of ids)
+    accounts[id] = { refresh: entry.refresh, access: entry.access, expires: entry.expires, ...(entry.accountId ? { accountId: entry.accountId } : {}) }; publish({ version: 1, accounts }); writeMembershipAfterCredentialPublish(provider, () => providerWrite(agentDir(), (db) => { db.prepare('DELETE FROM managed_accounts WHERE provider_id=?').run(provider); ids.forEach(({ entry, id }, position) => insert(db, provider, { providerId: provider, id, label: entry.label, labelKey: key(entry.label), position, lastAttemptAt: entry.lastAttemptAt, lastRateLimitedAt: entry.lastRateLimitedAt, rateLimitedUntil: entry.rateLimitedUntil, ...(entry.authFailure ? { authFailure: entry.authFailure } : {}) })); })); return normalized; }); }
+function resolve(rows, ref) { const needle = ref.trim().toLowerCase(); const number = Number.parseInt(needle, 10); if (Number.isFinite(number) && String(number) === needle && number >= 1 && number <= rows.length)
+    return number - 1; return rows.findIndex(({ entry }) => key(entry.label) === needle); }
+export async function addSubscription(provider, entry) { const checked = assertCredential(provider, entry); return locked(provider, async (file, rows, publish) => { if (rows.some(({ entry: existing }) => key(existing.label) === key(checked.label)))
+    throw new DuplicateSubscriptionError(`${getProviderLabel(provider)} subscription already exists: ${checked.label}`); const same = identity(checked); const collision = rows.find(({ entry: existing }) => identity(existing) === same); if (same && collision)
+    throw new DuplicateSubscriptionError(`This ${getProviderLabel(provider)} account is already added as “${collision.entry.label}” — it shares the same quota, so a second slot adds no redundancy.`); const id = randomUUID(); file.accounts[id] = { refresh: checked.refresh, access: checked.access, expires: checked.expires, ...(checked.accountId ? { accountId: checked.accountId } : {}) }; publish(file); writeMembershipAfterCredentialPublish(provider, () => providerWrite(agentDir(), (db) => insert(db, provider, { providerId: provider, id, label: checked.label, labelKey: key(checked.label), position: rows.length, lastAttemptAt: checked.lastAttemptAt, lastRateLimitedAt: checked.lastRateLimitedAt, rateLimitedUntil: checked.rateLimitedUntil, ...(checked.authFailure ? { authFailure: checked.authFailure } : {}) }))); return publicPool(provider, file); }); }
+export async function upsertSubscription(provider, entry) { const checked = assertCredential(provider, entry); const existing = readSubscriptionPool(provider).find((x) => key(x.label) === key(checked.label)); return existing ? upsertSubscriptionWithUniqueAccount(provider, checked) : addSubscription(provider, checked); }
+export async function upsertSubscriptionWithUniqueAccount(provider, entry) {
+    const checked = assertCredential(provider, entry);
+    return locked(provider, async (file, rows, publish) => {
+        const index = rows.findIndex(({ entry: existing }) => key(existing.label) === key(checked.label));
+        const existing = rows[index];
+        const duplicate = rows.find(({ entry: other }, i) => i !== index && identity(other) === identity(checked));
+        if (identity(checked) && duplicate)
+            throw new DuplicateSubscriptionError(`This ${getProviderLabel(provider)} account is already added as “${duplicate.entry.label}” — it shares the same quota, so a second slot adds no redundancy.`);
+        if (!existing) {
+            const id = randomUUID();
+            file.accounts[id] = { refresh: checked.refresh, access: checked.access, expires: checked.expires, ...(checked.accountId ? { accountId: checked.accountId } : {}) };
+            publish(file);
+            writeMembershipAfterCredentialPublish(provider, () => providerWrite(agentDir(), (db) => insert(db, provider, { providerId: provider, id, label: checked.label, labelKey: key(checked.label), position: rows.length, lastAttemptAt: checked.lastAttemptAt, lastRateLimitedAt: checked.lastRateLimitedAt, rateLimitedUntil: checked.rateLimitedUntil })));
+            return publicPool(provider, file);
         }
-        const next = [...pool];
-        next[index] = { ...next[index], label };
-        return next;
-    });
-}
-// Remove one account under the pool lock. The pool is the only home a managed credential has.
-export async function removeManagedAccount(providerId, ref) {
-    return mutateSubscriptionPool(providerId, (pool) => {
-        const index = resolveCredentialIndex(pool, ref);
-        if (index === -1)
-            throw new Error(`Unknown ${getProviderLabel(providerId)} subscription: ${ref}`);
-        const next = [...pool];
-        next.splice(index, 1);
-        return next;
-    });
-}
-/** Fetch Anthropic's stable OAuth account identity without making login depend on it. */
-export async function enrichManagedLoginIdentity(providerId, credential) {
-    const supplied = credential.accountId?.trim();
-    if (providerId !== ANTHROPIC_PROVIDER_ID)
-        return supplied ? { accountId: supplied } : {};
+        const row = existing.row;
+        const cooldownIncoming = checked.lastRateLimitedAt >= row.lastRateLimitedAt;
+        file.accounts[row.id] = { refresh: checked.refresh, access: checked.access, expires: checked.expires, ...(checked.accountId ? { accountId: checked.accountId } : {}) };
+        publish(file);
+        writeMembershipAfterCredentialPublish(provider, () => providerWrite(agentDir(), (db) => update(db, { ...row, label: checked.label, labelKey: key(checked.label), lastAttemptAt: Math.max(row.lastAttemptAt, checked.lastAttemptAt), lastRateLimitedAt: cooldownIncoming ? checked.lastRateLimitedAt : row.lastRateLimitedAt, rateLimitedUntil: cooldownIncoming ? checked.rateLimitedUntil : row.rateLimitedUntil })));
+        return publicPool(provider, file);
+    });
+}
+export async function renameSubscription(provider, ref, nextLabel) { return locked(provider, async (file, rows) => { const index = resolve(rows, ref); if (index < 0)
+    throw new Error(`Unknown ${getProviderLabel(provider)} subscription: ${ref}`); const label = nextLabel.trim(); if (!label)
+    throw new Error(`${getProviderLabel(provider)} subscription label cannot be empty`); if (rows.some((value, i) => i !== index && key(value.entry.label) === key(label)))
+    throw new DuplicateSubscriptionError(`${getProviderLabel(provider)} subscription already exists: ${label}`); providerWrite(agentDir(), (db) => update(db, { ...rows[index].row, label, labelKey: key(label) })); return publicPool(provider, file); }); }
+async function remove(provider, ref) { return locked(provider, async (file, rows, publish) => { const index = resolve(rows, ref); if (index < 0)
+    throw new Error(`Unknown ${getProviderLabel(provider)} subscription: ${ref}`); const removed = rows[index].row; providerWrite(agentDir(), (db) => db.prepare('DELETE FROM managed_accounts WHERE provider_id=? AND id=?').run(provider, removed.id)); delete file.accounts[removed.id]; publish(file); return publicPool(provider, file); }); }
+export async function removeManagedAccount(provider, ref) { return remove(provider, ref); }
+export async function removeSubscription(provider, ref) { return remove(provider, ref); }
+export async function removeAllManagedAccounts(provider) { return locked(provider, async (file, rows, publish) => { providerWrite(agentDir(), (db) => db.prepare('DELETE FROM managed_accounts WHERE provider_id=?').run(provider)); for (const { row } of rows)
+    delete file.accounts[row.id]; publish(file); return rows.length; }); }
+export async function removeManagedProvider(provider, label) { if (label === undefined) {
+    await removeAllManagedAccounts(provider);
+    return [];
+} return remove(provider, label); }
+export async function promoteSubscription(provider, ref) { return locked(provider, async (file, rows) => { const index = resolve(rows, ref); if (index < 0)
+    throw new Error(`Unknown ${getProviderLabel(provider)} subscription: ${ref}`); providerWrite(agentDir(), (db) => { const reordered = [rows[index], ...rows.filter((_, i) => i !== index)]; reordered.forEach((item, position) => update(db, { ...item.row, position })); }); return publicPool(provider, file); }); }
+async function mutateHealth(provider, ref, mutate) { providerWrite(agentDir(), (db) => { const row = providerRowByReference(db, provider, ref); if (!row)
+    throw new Error(`Unknown ${getProviderLabel(provider)} subscription: ${ref}`); const next = mutate(row); if (next)
+    update(db, next); }); return readSubscriptionPool(provider); }
+export async function markSubscriptionAttempt(provider, ref, attemptAt = Date.now()) { return mutateHealth(provider, ref, (row) => ({ ...row, lastAttemptAt: Math.max(row.lastAttemptAt, attemptAt) })); }
+export async function markSubscriptionAuthenticationFailed(provider, ref, retryAfterMs, attemptAt = Date.now()) { return mutateHealth(provider, ref, (row) => ({ ...row, authFailure: 'invalid_grant', lastAttemptAt: Math.max(row.lastAttemptAt, attemptAt), rateLimitedUntil: Math.max(row.rateLimitedUntil, attemptAt + Math.max(0, retryAfterMs)) })); }
+export async function markSubscriptionRateLimited(provider, ref, retryAfterMs, attemptAt = Date.now(), rateLimitedAt = Date.now()) { return mutateHealth(provider, ref, (row) => rateLimitedAt < row.lastRateLimitedAt ? null : { ...row, lastAttemptAt: Math.max(row.lastAttemptAt, attemptAt), lastRateLimitedAt: rateLimitedAt, rateLimitedUntil: rateLimitedAt + Math.max(0, retryAfterMs) }); }
+export async function markSubscriptionSuccess(provider, ref, attemptAt = Date.now()) { return mutateHealth(provider, ref, (row) => attemptAt < row.lastRateLimitedAt ? null : { ...row, authFailure: undefined, lastAttemptAt: Math.max(row.lastAttemptAt, attemptAt), rateLimitedUntil: 0 }); }
+export async function refreshSubscriptionCredential(provider, label, exchange) { return locked(provider, async (file, rows, publish) => { const index = resolve(rows, label); if (index < 0)
+    throw new Error(`${getProviderLabel(provider)} subscription "${label}" no longer exists`); const current = rows[index]; if (current.entry.expires > Date.now())
+    return current.entry; const tokens = assertTokens(provider, current.entry.label, await exchange(current.entry.refresh)); file.accounts[current.row.id] = { ...file.accounts[current.row.id], ...tokens }; publish(file); return { ...current.entry, ...tokens }; }); }
+export function isInvalidRefreshTokenError(error) { const value = error; const message = [value?.errorMessage, value?.message, error instanceof Error ? error.message : ''].filter((part) => typeof part === 'string').join(' '); const status = typeof value?.status === 'number' ? value.status : Number(message.match(/\bstatus[=:]\s*(\d+)/i)?.[1]); return status === 400 && /invalid_grant|refresh token .*invalid|refresh token .*not found/i.test(message); }
+export async function modifyElectedSubscription(provider, elect, apply) { return locked(provider, async (file, rows, publish) => { const attempted = new Set(); let lastError; while (attempted.size < rows.length) {
+    const chosen = elect(rows.filter(({ entry }) => !attempted.has(entry.label)).map(({ entry }) => entry));
+    if (!chosen)
+        break;
+    const current = rows.find(({ entry }) => entry.label === chosen.label);
+    attempted.add(current.entry.label);
     try {
-        const response = await fetch("https://api.anthropic.com/api/oauth/profile", {
-            headers: { Authorization: `Bearer ${credential.access}`, Accept: "application/json" },
-            signal: AbortSignal.timeout(3_000),
-        });
-        if (!response.ok)
-            return supplied ? { accountId: supplied } : {};
-        const body = await response.json();
-        const accountId = typeof body.account?.uuid === "string" && body.account.uuid.trim() ? body.account.uuid.trim() : undefined;
-        const email = typeof body.account?.email === "string" && body.account.email.trim() ? body.account.email.trim() : undefined;
-        return { ...(accountId ? { accountId } : {}), ...(email ? { email } : {}) };
-    }
-    catch {
-        return supplied ? { accountId: supplied } : {};
-    }
-}
-function nextAutomaticLabel(pool, email, fallback) {
-    const base = email || fallback?.trim() || `Account ${pool.length + 1}`;
-    const used = new Set(pool.map((entry) => entry.label.toLowerCase()));
-    if (!used.has(base.toLowerCase()))
-        return base;
-    for (let index = 2;; index++) {
-        const candidate = `${base} (${index})`;
-        if (!used.has(candidate.toLowerCase()))
-            return candidate;
-    }
-}
-// Coordinated persistence for a freshly acquired managed OAuth credential. An explicit label
-// selects that row for reauthentication; otherwise a matching identity updates its row, and a new
-// identity receives an automatic email-derived label. UI must never persist managed OAuth into
-// auth.json because the pool owns refresh and account uniqueness.
-export async function commitManagedLogin(providerId, label, credential) {
-    const identity = await enrichManagedLoginIdentity(providerId, credential);
-    return mutateSubscriptionPool(providerId, (pool) => {
-        const accountId = identity.accountId;
-        const selectedLabel = credential.autoLabel ? undefined : label?.trim();
-        const existing = (selectedLabel ? pool.find((entry) => entry.label.toLowerCase() === selectedLabel.toLowerCase()) : undefined) ??
-            pool.find((entry) => accountIdentity(entry) === accountIdentity({ accountId, refresh: credential.refresh }));
-        const resolvedLabel = existing?.label ?? (credential.autoLabel ? nextAutomaticLabel(pool, identity.email, label) : selectedLabel);
-        if (!resolvedLabel)
-            throw new Error(`${getProviderLabel(providerId)} subscription label cannot be empty`);
-        if (!existing && pool.some((entry) => entry.label.toLowerCase() === resolvedLabel.toLowerCase())) {
-            throw new DuplicateSubscriptionError(`${getProviderLabel(providerId)} subscription already exists: ${resolvedLabel}`);
+        const next = await apply(current.entry);
+        if (next) {
+            const tokens = assertTokens(provider, current.entry.label, next);
+            file.accounts[current.row.id] = { ...file.accounts[current.row.id], ...tokens };
+            publish(file);
+            return { ...current.entry, ...tokens };
         }
-        assertAccountAvailable(pool, providerId, accountIdentity({ accountId, refresh: credential.refresh }), resolvedLabel);
-        const next = {
-            label: resolvedLabel,
-            refresh: credential.refresh,
-            access: credential.access,
-            expires: credential.expires,
-            ...(accountId ? { accountId } : {}),
-            rateLimitedUntil: 0,
-            lastAttemptAt: Date.now(),
-            lastRateLimitedAt: credential.lastRateLimitedAt,
-        };
-        if (!existing)
-            return [...pool, next];
-        const index = pool.indexOf(existing);
-        const merged = [...pool];
-        merged[index] = mergeUpsert(existing, next);
-        return merged;
-    });
-}
-// Remove every account for one managed provider through a single locked transform. The
-// returned count belongs to that locked snapshot, so callers do not race a concurrent login.
-export async function removeAllManagedAccounts(providerId) {
-    let removed = 0;
-    await mutateSubscriptionPool(providerId, (pool) => {
-        removed = pool.length;
-        return [];
-    });
-    return removed;
-}
-// Coordinated removal for the human UI. Removes a single account when `label` is given; the ENTIRE
-// provider (every pool account) when `label` is omitted — always through a pool transform. UI
-// must NEVER reach for a raw auth.json delete on a managed provider: that strips a file pi no
-// longer reads for managed providers and orphans the whole pool.
-export async function removeManagedProvider(providerId, label) {
-    if (label === undefined) {
-        await removeAllManagedAccounts(providerId);
-        return [];
+        return current.entry;
     }
-    return mutateSubscriptionPool(providerId, (pool) => {
-        const index = resolveCredentialIndex(pool, label);
-        if (index === -1)
-            throw new Error(`Unknown ${getProviderLabel(providerId)} subscription: ${label}`);
-        const next = [...pool];
-        next.splice(index, 1);
-        return next;
-    });
-}
-export async function removeSubscription(providerId, ref) {
-    return mutateSubscriptionPool(providerId, (pool) => {
-        const index = resolveCredentialIndex(pool, ref);
-        if (index === -1)
-            throw new Error(`Unknown ${getProviderLabel(providerId)} subscription: ${ref}`);
-        const next = [...pool];
-        next.splice(index, 1);
-        return next;
-    });
-}
-export async function promoteSubscription(providerId, ref) {
-    return mutateSubscriptionPool(providerId, (pool) => {
-        const index = resolveCredentialIndex(pool, ref);
-        if (index === -1)
-            throw new Error(`Unknown ${getProviderLabel(providerId)} subscription: ${ref}`);
-        if (index === 0)
-            return pool;
-        const next = [...pool];
-        next.unshift(next.splice(index, 1)[0]);
-        return next;
-    });
-}
-export async function markSubscriptionAttempt(providerId, ref, attemptAt = Date.now()) {
-    return mutateSubscriptionPool(providerId, (pool) => {
-        const index = resolveCredentialIndex(pool, ref);
-        if (index === -1)
-            throw new Error(`Unknown ${getProviderLabel(providerId)} subscription: ${ref}`);
-        const next = [...pool];
-        next[index] = { ...pool[index], lastAttemptAt: Math.max(pool[index].lastAttemptAt, attemptAt) };
-        return next;
-    });
-}
-export async function markSubscriptionAuthenticationFailed(providerId, ref, retryAfterMs, attemptAt = Date.now()) {
-    return mutateSubscriptionPool(providerId, (pool) => {
-        const index = resolveCredentialIndex(pool, ref);
-        if (index === -1)
-            throw new Error(`Unknown ${getProviderLabel(providerId)} subscription: ${ref}`);
-        const next = [...pool];
-        next[index] = {
-            ...pool[index],
-            authFailure: "invalid_grant",
-            lastAttemptAt: Math.max(pool[index].lastAttemptAt, attemptAt),
-            // This is only an exclusion backoff, never a rate-limit observation.
-            rateLimitedUntil: Math.max(pool[index].rateLimitedUntil, attemptAt + Math.max(0, retryAfterMs)),
-        };
-        return next;
-    });
-}
-export async function markSubscriptionRateLimited(providerId, ref, retryAfterMs, attemptAt = Date.now(), rateLimitedAt = Date.now()) {
-    return mutateSubscriptionPool(providerId, (pool) => {
-        const index = resolveCredentialIndex(pool, ref);
-        if (index === -1)
-            throw new Error(`Unknown ${getProviderLabel(providerId)} subscription: ${ref}`);
-        // A later rate-limit is authoritative until it expires: an out-of-order (stale) 429 whose
-        // basis predates the slot's newest cooldown must not reopen or shorten it.
-        if (rateLimitedAt < pool[index].lastRateLimitedAt)
-            return undefined;
-        const next = [...pool];
-        next[index] = {
-            ...pool[index],
-            lastAttemptAt: Math.max(pool[index].lastAttemptAt, attemptAt),
-            lastRateLimitedAt: Math.max(pool[index].lastRateLimitedAt, rateLimitedAt),
-            rateLimitedUntil: rateLimitedAt + Math.max(0, retryAfterMs),
-        };
-        return next;
-    });
-}
-export async function markSubscriptionSuccess(providerId, ref, attemptAt = Date.now()) {
-    return mutateSubscriptionPool(providerId, (pool) => {
-        const index = resolveCredentialIndex(pool, ref);
-        if (index === -1)
-            throw new Error(`Unknown ${getProviderLabel(providerId)} subscription: ${ref}`);
-        // A success whose attempt started before the slot's newest 429 must not clear that cooldown
-        // (the memory rule): treat the later rate-limit as authoritative until it expires.
-        if (attemptAt < pool[index].lastRateLimitedAt)
-            return undefined;
-        const next = [...pool];
-        const { authFailure: _authFailure, ...healthy } = pool[index];
-        next[index] = { ...healthy, lastAttemptAt: Math.max(pool[index].lastAttemptAt, attemptAt), rateLimitedUntil: 0 };
-        return next;
-    });
-}
-export function parseRetryAfterHeader(value, now = Date.now()) {
-    if (!value)
-        return undefined;
-    const trimmed = value.trim();
-    if (!trimmed)
-        return undefined;
-    const seconds = Number(trimmed);
-    if (Number.isFinite(seconds))
-        return Math.max(0, Math.round(seconds * 1000));
-    const parsed = Date.parse(trimmed);
-    return Number.isFinite(parsed) ? Math.max(0, parsed - now) : undefined;
-}
+    catch (error) {
+        if (!isInvalidRefreshTokenError(error))
+            throw error;
+        lastError = error;
+        const at = Date.now();
+        providerWrite(agentDir(), (db) => update(db, { ...current.row, authFailure: 'invalid_grant', lastAttemptAt: Math.max(current.row.lastAttemptAt, at), rateLimitedUntil: Math.max(current.row.rateLimitedUntil, at + INVALID_REFRESH_TOKEN_BACKOFF_MS) }));
+    }
+} if (lastError)
+    throw lastError; return undefined; }); }
+export async function enrichManagedLoginIdentity(provider, value) { const supplied = value.accountId?.trim(); if (provider !== ANTHROPIC_PROVIDER_ID)
+    return supplied ? { accountId: supplied } : {}; try {
+    const response = await fetch('https://api.anthropic.com/api/oauth/profile', { headers: { Authorization: `Bearer ${value.access}`, Accept: 'application/json' }, signal: AbortSignal.timeout(3_000) });
+    if (!response.ok)
+        return supplied ? { accountId: supplied } : {};
+    const body = await response.json();
+    const accountId = typeof body.account?.uuid === 'string' && body.account.uuid.trim() ? body.account.uuid.trim() : undefined;
+    const email = typeof body.account?.email === 'string' && body.account.email.trim() ? body.account.email.trim() : undefined;
+    return { ...(accountId ? { accountId } : {}), ...(email ? { email } : {}) };
+}
+catch {
+    return supplied ? { accountId: supplied } : {};
+} }
+export async function commitManagedLogin(provider, label, value) { const identityInfo = await enrichManagedLoginIdentity(provider, value); return locked(provider, async (file, rows, publish) => { const selected = value.autoLabel ? undefined : label?.trim(); const incomingIdentity = identity({ refresh: value.refresh, accountId: identityInfo.accountId }); const matching = (selected ? rows.find(({ entry }) => key(entry.label) === key(selected)) : undefined) ?? rows.find(({ entry }) => identity(entry) === incomingIdentity); let resolved = matching?.entry.label ?? selected; if (!resolved && value.autoLabel) {
+    const base = identityInfo.email || label?.trim() || `Account ${rows.length + 1}`;
+    resolved = base;
+    for (let n = 2; rows.some(({ entry }) => key(entry.label) === key(resolved)); n++)
+        resolved = `${base} (${n})`;
+} if (!resolved)
+    throw new Error(`${getProviderLabel(provider)} subscription label cannot be empty`); const entry = assertCredential(provider, { label: resolved, refresh: value.refresh, access: value.access, expires: value.expires, ...(identityInfo.accountId ? { accountId: identityInfo.accountId } : {}), rateLimitedUntil: 0, lastAttemptAt: Date.now(), lastRateLimitedAt: value.lastRateLimitedAt }); if (!matching) {
+    if (rows.some(({ entry: existing }) => key(existing.label) === key(entry.label)))
+        throw new DuplicateSubscriptionError(`${getProviderLabel(provider)} subscription already exists: ${entry.label}`);
+    const duplicate = rows.find(({ entry: existing }) => identity(existing) === identity(entry));
+    if (identity(entry) && duplicate)
+        throw new DuplicateSubscriptionError(`This ${getProviderLabel(provider)} account is already added as “${duplicate.entry.label}” — it shares the same quota, so a second slot adds no redundancy.`);
+    const id = randomUUID();
+    file.accounts[id] = { refresh: entry.refresh, access: entry.access, expires: entry.expires, ...(entry.accountId ? { accountId: entry.accountId } : {}) };
+    publish(file);
+    writeMembershipAfterCredentialPublish(provider, () => providerWrite(agentDir(), (db) => insert(db, provider, { providerId: provider, id, label: entry.label, labelKey: key(entry.label), position: rows.length, lastAttemptAt: entry.lastAttemptAt, lastRateLimitedAt: entry.lastRateLimitedAt, rateLimitedUntil: entry.rateLimitedUntil })));
+    return publicPool(provider, file);
+} const row = matching.row; const duplicate = rows.find(({ entry: other }) => other.label !== matching.entry.label && identity(other) === identity(entry)); if (identity(entry) && duplicate)
+    throw new DuplicateSubscriptionError(`This ${getProviderLabel(provider)} account is already added as “${duplicate.entry.label}” — it shares the same quota, so a second slot adds no redundancy.`); file.accounts[row.id] = { refresh: entry.refresh, access: entry.access, expires: entry.expires, ...(entry.accountId ? { accountId: entry.accountId } : {}) }; publish(file); const clear = entry.lastRateLimitedAt >= row.lastRateLimitedAt; writeMembershipAfterCredentialPublish(provider, () => providerWrite(agentDir(), (db) => update(db, { ...row, lastAttemptAt: Math.max(row.lastAttemptAt, entry.lastAttemptAt), lastRateLimitedAt: clear ? entry.lastRateLimitedAt : row.lastRateLimitedAt, rateLimitedUntil: clear ? 0 : row.rateLimitedUntil }))); return publicPool(provider, file); }); }
+export function parseRetryAfterHeader(value, now = Date.now()) { if (!value?.trim())
+    return undefined; const seconds = Number(value.trim()); if (Number.isFinite(seconds))
+    return Math.max(0, Math.round(seconds * 1000)); const parsed = Date.parse(value); return Number.isFinite(parsed) ? Math.max(0, parsed - now) : undefined; }
 export function readRotationConfig() {
-    const raw = readJsonFile(rotationConfigFile()) ?? {};
-    return {
-        defaultFallbackStrength: normalizeStrength(raw.defaultFallbackStrength) ?? DEFAULT_FALLBACK_STRENGTH,
-        revertWhenAvailable: raw.revertWhenAvailable ?? true,
-    };
+    const row = openScopedStore(providerStore(agentDir())).prepare('SELECT default_fallback_strength,revert_when_available FROM rotation_settings WHERE singleton=1').get();
+    return { defaultFallbackStrength: normalizeStrength(row?.default_fallback_strength) ?? DEFAULT_FALLBACK_STRENGTH, revertWhenAvailable: row?.revert_when_available === undefined || row.revert_when_available === null ? true : Boolean(row.revert_when_available) };
 }
 export function writeRotationConfig(next) {
     const current = readRotationConfig();
-    const merged = {
-        defaultFallbackStrength: normalizeStrength(next.defaultFallbackStrength) ?? current.defaultFallbackStrength ?? DEFAULT_FALLBACK_STRENGTH,
-        revertWhenAvailable: next.revertWhenAvailable ?? current.revertWhenAvailable ?? true,
-    };
-    atomicWriteJson(rotationConfigFile(), merged);
+    const merged = { defaultFallbackStrength: normalizeStrength(next.defaultFallbackStrength) ?? current.defaultFallbackStrength ?? DEFAULT_FALLBACK_STRENGTH, revertWhenAvailable: next.revertWhenAvailable ?? current.revertWhenAvailable ?? true };
+    providerWrite(agentDir(), (db) => db.prepare(`INSERT INTO rotation_settings(singleton,default_fallback_strength,revert_when_available) VALUES(1,?,?) ON CONFLICT(singleton) DO UPDATE SET default_fallback_strength=excluded.default_fallback_strength,revert_when_available=excluded.revert_when_available`).run(merged.defaultFallbackStrength, merged.revertWhenAvailable ? 1 : 0));
     return merged;
 }
-export function formatStatusLine(providerId, now = Date.now()) {
-    const pool = readSubscriptionPool(providerId);
-    const ready = pool.filter((entry) => entry.authFailure === undefined && (!entry.rateLimitedUntil || entry.rateLimitedUntil <= now));
-    const label = getProviderLabel(providerId);
-    return ready.length === 0
-        ? `${label} pool exhausted`
-        : `${label} ${ready[0]?.label ?? providerId} (${ready.length}/${pool.length} ready)`;
-}
+export function formatStatusLine(provider, now = Date.now()) { const pool = readSubscriptionPool(provider); const ready = pool.filter((entry) => entry.authFailure === undefined && entry.rateLimitedUntil <= now); const label = getProviderLabel(provider); return ready.length === 0 ? `${label} pool exhausted` : `${label} ${ready[0]?.label ?? provider} (${ready.length}/${pool.length} ready)`; }