@swimmingliu/autovpn 2.2.1 → 2.2.2

package/dist/pipeline/credential-source.js

@@ -89,6 +89,22 @@ function siteHost(site) {
         return '';
     }
 }
+/**
+ * Archive prefix for any spelling of a brand: its English key, its Chinese
+ * label, a known storefront host, or a name that normalizes to one of them.
+ */
+function credentialPrefixFor(value) {
+    const raw = String(value ?? '').trim();
+    if (!raw) {
+        return null;
+    }
+    const direct = BRAND_APK_PREFIXES[raw] ?? BRAND_APK_PREFIXES[raw.toLowerCase()];
+    if (direct) {
+        return direct;
+    }
+    const brand = normalizeBrand(raw);
+    return brand ? (BRAND_APK_PREFIXES[brand] ?? null) : null;
+}
 /**
  * Stable key for a brand's fingerprint.
  *
@@ -100,14 +116,82 @@ function siteHost(site) {
  * be established, which keeps custom entries working.
  */
 export function credentialBrandKey(sourceName, source) {
-    const site = String(source.official_site ?? '').trim();
-    const host = siteHost(site);
+    // Brand first, host second. A row's own name identifies the APK even when the
+    // operator points it at an alternate storefront (`www.leitingku.com`,
+    // `www.heidongm.com`, …), and hosting the file under that host split one
+    // brand across several cache entries — so a redirected row keyed by prefix
+    // never saw the entry the native row had just written.
+    const name = String(sourceName ?? '').trim();
+    const byName = credentialPrefixFor(name);
+    if (byName) {
+        return byName;
+    }
+    const host = siteHost(String(source.official_site ?? '').trim());
+    const byHost = credentialPrefixFor(host);
+    if (byHost) {
+        return byHost;
+    }
+    const lowered = name.toLowerCase();
+    return host || lowered || 'unknown';
+}
+/**
+ * Fingerprint key for the data plane a row actually reads.
+ *
+ * A redirected row carries the backend's canonical brand key (`leiting`), not
+ * the short archive prefix its cache file is named with (`lt`). Using the
+ * canonical key straight away produced `brand-leiting.json`, which never
+ * exists: every run missed the cache, fell back to downloading the APK from the
+ * storefront, and on a host that cannot reach that storefront failed with
+ * "APK could not be located" — while `brand-lt.json` sat on disk, unused.
+ */
+export function fingerprintKeyFor(sourceName, source) {
+    if (!String(source.brand_override ?? '').trim()) {
+        return credentialBrandKey(sourceName, source);
+    }
+    return credentialPrefixFor(String(source.brand_override))
+        ?? String(source.brand_override).trim().toLowerCase();
+}
+/**
+ * What to do with a pooled account after its login was refused.
+ *
+ * Retirement and rotation are separate decisions. Only a *classified* rejection
+ * — the vendor said the password or the account is wrong, or that the
+ * membership lapsed — is evidence the row is dead, so only that retires it.
+ * Any rejection at all, though, means this account cannot be used right now and
+ * the pool holds more.
+ *
+ * Conflating the two ended the source at zero rounds: 雷霆 refuses most of this
+ * pool with a bare `code=128` and no message, which matches neither classifier,
+ * so the loop gave up on the first account while 159 active rows went unread.
+ */
+export function accountFollowUp(state) {
+    if (state.membershipExpired) {
+        return { act: true, retire: 'expired', rotate: true };
+    }
+    if (state.credentialRejected) {
+        return { act: true, retire: 'invalid', rotate: true };
+    }
+    if (state.loginRejected) {
+        // Usable by nobody right now, but nothing proves it is dead: keep the row.
+        return { act: true, retire: null, rotate: true };
+    }
+    return { act: false, retire: null, rotate: false };
+}
+/**
+ * Cache files an earlier build may have written for this row.
+ *
+ * Before brand-first keying, the key was the official-site host, so a row
+ * pointed at an alternate storefront wrote `brand-www.leitingku.com.json`
+ * instead of `brand-lt.json`. Those files hold a valid fingerprint — often the
+ * only verified one on a host that cannot reach the vendor's site — so a read
+ * falls back to them and migrates the entry to the canonical key.
+ */
+function legacyFingerprintKey(sourceName, source) {
+    const host = siteHost(String(source.official_site ?? '').trim());
     if (host) {
-        return BRAND_APK_PREFIXES[host] ?? host;
+        return host;
     }
-    const name = String(sourceName ?? '').trim().toLowerCase();
-    const prefix = BRAND_APK_PREFIXES[sourceName] ?? BRAND_APK_PREFIXES[name];
-    return prefix ?? (name || 'unknown');
+    return String(sourceName ?? '').trim().toLowerCase() || 'unknown';
 }
 export function createFingerprintMemo(store, brand) {
     let value = store?.read(brand) ?? null;
@@ -195,6 +279,59 @@ export const MAX_EMPTY_ROUNDS = 5;
  * node is stopped explicitly and reported.
  */
 export const PLACEHOLDER_ONLY_ROUNDS = 8;
+/**
+ * Lap-mode defaults. A lap is one full pass over the frozen area list, so
+ * these numbers mean what they say: 50 laps × N areas is the request ceiling,
+ * 13 empty laps × N areas is the give-up point. The legacy round defaults
+ * above stay untouched for rows that never set a lap key.
+ */
+export const DEFAULT_MAX_LAPS = 50;
+export const DEFAULT_DRY_LAPS = 13;
+function finiteLapValue(value, min) {
+    const parsed = Number(value);
+    return Number.isFinite(parsed) && parsed >= min;
+}
+/**
+ * Resolve the lap policy, or null when the row never opted in.
+ *
+ * Null is the compatibility contract: the caller then runs the legacy round
+ * path with the same arguments as before, so an untouched profile produces
+ * the same request sequence after an upgrade.
+ */
+export function resolveLapRoundPolicy(source, areaCount) {
+    const optedIn = finiteLapValue(source.max_laps, 1) || finiteLapValue(source.dry_laps, 1) || finiteLapValue(source.min_laps, 0);
+    if (!optedIn) {
+        return null;
+    }
+    const areas = Math.max(1, Math.trunc(numberOrDefault(areaCount, 1)));
+    const cap = Math.max(1, Math.trunc(numberOrDefault(source.max_laps, DEFAULT_MAX_LAPS)));
+    const plateau = Math.max(1, Math.trunc(numberOrDefault(source.dry_laps, DEFAULT_DRY_LAPS)));
+    const floor = Math.min(Math.max(0, Math.trunc(numberOrDefault(source.min_laps, 0))), cap);
+    return {
+        policy: {
+            max_iterations: cap,
+            min_iterations: floor,
+            plateau_limit: plateau,
+            max_runtime_seconds: Math.max(0, numberOrDefault(source.max_runtime_seconds, 0))
+        },
+        areas_per_round: areas,
+        // The guards were tuned in rounds of 8 areas; keep their request volume
+        // when the unit becomes a lap of N areas, never below two laps.
+        empty_round_limit: Math.max(2, Math.ceil((MAX_EMPTY_ROUNDS * DEFAULT_AREAS_PER_ROUND) / areas)),
+        placeholder_round_limit: Math.max(2, Math.ceil((PLACEHOLDER_ONLY_ROUNDS * DEFAULT_AREAS_PER_ROUND) / areas)),
+        round_unit: 'lap'
+    };
+}
+/**
+ * The budget to advertise before the area list is known. Pre-flight events
+ * fire before login, so they must report the unit the loop will run in.
+ */
+export function resolveAdvertisedMaxIterations(source) {
+    if (finiteLapValue(source.max_laps, 1) || finiteLapValue(source.dry_laps, 1) || finiteLapValue(source.min_laps, 0)) {
+        return Math.max(1, Math.trunc(numberOrDefault(source.max_laps, DEFAULT_MAX_LAPS)));
+    }
+    return resolveRoundPolicy(source).max_iterations;
+}
 /** How many areas one round takes from the immutable list. */
 export function resolveAreasPerRound(value, areaCount) {
     const parsed = Math.trunc(Number(value));
@@ -838,7 +975,10 @@ async function fetchCredentialSourceLinksWithTransport(input, options) {
     // and the caller's config object must not carry that into later stages.
     const source = { ...input.source };
     const platforms = resolveCredentialPlatforms(source);
-    const policy = resolveRoundPolicy(source);
+    // Pre-flight events fire before the area list exists, so the budget is
+    // advertised in the unit the loop will run in: laps or legacy rounds.
+    const advertisedIterations = resolveAdvertisedMaxIterations(source);
+    const legacyPolicy = resolveRoundPolicy(source);
     const errors = [];
     const diagnostics = {
         brand: input.source_name,
@@ -858,7 +998,7 @@ async function fetchCredentialSourceLinksWithTransport(input, options) {
     };
     const empty = {
         source_name: input.source_name,
-        requested_iterations: policy.max_iterations,
+        requested_iterations: advertisedIterations,
         successful_iterations: 0,
         failed_iterations: 0,
         links: [],
@@ -866,8 +1006,8 @@ async function fetchCredentialSourceLinksWithTransport(input, options) {
     };
     event(options, 'extract_source_started', {
         source_name: input.source_name,
-        requested_iterations: policy.max_iterations,
-        min_iterations: policy.min_iterations,
+        requested_iterations: advertisedIterations,
+        min_iterations: legacyPolicy.min_iterations,
         resume_from_iteration: 1,
         platforms
     });
@@ -926,7 +1066,7 @@ async function fetchCredentialSourceLinksWithTransport(input, options) {
             store?.close();
         event(options, 'extract_source_completed', {
             source_name: input.source_name,
-            requested_iterations: policy.max_iterations,
+            requested_iterations: advertisedIterations,
             successful_iterations: 0,
             failed_iterations: 1,
             raw_links: 0
@@ -943,7 +1083,7 @@ async function fetchCredentialSourceLinksWithTransport(input, options) {
     // backend on a cached run, and it hides the 雷霆 entry the next run should
     // reuse. A redirect therefore always gets a memo of its own key; the shared
     // one is used only when the two brands agree.
-    const memoBrandKey = source.brand_override ?? credentialBrandKey(input.source_name, source);
+    const memoBrandKey = fingerprintKeyFor(input.source_name, source);
     const memo = source.brand_override
         ? createFingerprintMemo(options.fingerprintStore ?? null, memoBrandKey)
         : (options.memo ?? createFingerprintMemo(options.fingerprintStore ?? null, memoBrandKey));
@@ -981,8 +1121,8 @@ async function fetchCredentialSourceLinksWithTransport(input, options) {
                             event(options, 'extract_platform_started', {
                                 ...payload,
                                 platform,
-                                requested_iterations: policy.max_iterations,
-                                min_iterations: policy.min_iterations
+                                requested_iterations: advertisedIterations,
+                                min_iterations: legacyPolicy.min_iterations
                             });
                             return;
                         }
@@ -1008,7 +1148,7 @@ async function fetchCredentialSourceLinksWithTransport(input, options) {
                                 // counter.
                                 platform,
                                 iteration: Number(payload.iteration ?? 0),
-                                requested_iterations: policy.max_iterations,
+                                requested_iterations: advertisedIterations,
                                 new_items: Number(payload.new_items ?? 0),
                                 new_meaningful_items: Number(payload.new_meaningful_items ?? 0),
                                 extracted_links: Number(payload.extracted_links ?? 0),
@@ -1107,16 +1247,19 @@ async function fetchCredentialSourceLinksWithTransport(input, options) {
                 && results.every((result) => result.diagnostics.login_rejected)
                 && results.some((result) => result.diagnostics.membership_expired);
             const credentialRejected = results.length > 0 && results.every((result) => result.diagnostics.credential_rejected);
-            if (store && leased && (membershipExpired || credentialRejected)) {
-                if (membershipExpired)
+            const loginRejected = results.length > 0 && results.every((result) => result.diagnostics.login_rejected);
+            const followUp = accountFollowUp({ membershipExpired, credentialRejected, loginRejected });
+            if (store && leased && followUp.act) {
+                if (followUp.retire === 'expired')
                     store.markExpired(leased.id, 'membership expired');
-                else
+                else if (followUp.retire === 'invalid')
                     store.markInvalid(leased.id, 'login rejected');
-                if (attempt < attempts && brand) {
-                    leased = store.lease(brand);
-                    if (leased) {
-                        account = leased.account;
-                        password = leased.password;
+                if (followUp.rotate && attempt < attempts && brand) {
+                    const next = store.lease(brand);
+                    if (next) {
+                        leased = next;
+                        account = next.account;
+                        password = next.password;
                         continue;
                     }
                 }
@@ -1197,15 +1340,19 @@ async function fetchCredentialSourceLinksWithTransport(input, options) {
     }
     event(options, 'extract_source_completed', {
         source_name: input.source_name,
-        requested_iterations: policy.max_iterations,
+        requested_iterations: advertisedIterations,
         successful_iterations: successful,
         failed_iterations: failed,
         raw_links: links.length,
-        platforms
+        platforms,
+        // route_count is the max across platforms; both channels freeze the same
+        // vendor list, so this is the drawer's per-row area count.
+        area_count: diagnostics.route_count,
+        round_unit: resolveLapRoundPolicy(source, diagnostics.route_count) ? 'lap' : 'round'
     });
     return {
         source_name: input.source_name,
-        requested_iterations: policy.max_iterations,
+        requested_iterations: advertisedIterations,
         successful_iterations: successful,
         failed_iterations: failed,
         links,
@@ -1278,11 +1425,13 @@ async function runCredentialPlatform(input, options) {
         errors.push('account and password are required');
         return empty;
     }
+    // Advertised before the area list is known: lap rows report their lap cap.
+    const startLap = resolveLapRoundPolicy(source, 0);
     const startPolicy = resolveRoundPolicy(source);
     event(options, 'extract_source_started', {
         source_name: input.source_name,
-        requested_iterations: startPolicy.max_iterations,
-        min_iterations: startPolicy.min_iterations,
+        requested_iterations: resolveAdvertisedMaxIterations(source),
+        min_iterations: startLap ? startLap.policy.min_iterations : startPolicy.min_iterations,
         resume_from_iteration: 1,
         platform
     });
@@ -1293,7 +1442,7 @@ async function runCredentialPlatform(input, options) {
     // answering. That keeps a normal run to a handful of HTTP calls.
     // Keyed by the data plane, not the storefront: a redirected row downloads and
     // inspects the backend's APK, so it must share that brand's cached entry.
-    const brandKey = source.brand_override ?? credentialBrandKey(input.source_name, source);
+    const brandKey = fingerprintKeyFor(input.source_name, source);
     const store = options.fingerprintStore ?? null;
     // Same rule as the outer memo: a caller-supplied memo is keyed by the row
     // name, so a redirected row must not read or write through it.
@@ -1305,7 +1454,24 @@ async function runCredentialPlatform(input, options) {
     // vendor can rotate the signing certificate while the old seeds still serve
     // `/api/eversion`, and then every login fails on a stale certificate.
     const fresh = store?.readFresh(brandKey) ?? null;
-    const storedEntry = store?.read(brandKey) ?? null;
+    let storedEntry = store?.read(brandKey) ?? null;
+    if (!storedEntry && store && !source.brand_override) {
+        // An older build keyed this row by its official-site host. Reuse that entry
+        // instead of forcing an APK download the host may not be able to make, and
+        // move it to the canonical key so the next run reads it directly.
+        const legacyKey = legacyFingerprintKey(input.source_name, source);
+        if (legacyKey !== brandKey) {
+            const legacy = store.readFresh(legacyKey) ?? store.read(legacyKey);
+            if (legacy) {
+                log(`[extract] adopting fingerprint cached under ${legacyKey}`);
+                // Copies the entry under the canonical key while keeping the original
+                // `verified_at`: stamping a new one would promote an entry that is
+                // genuinely past its window into a trusted one.
+                store.adopt(brandKey, legacy);
+                storedEntry = store.read(brandKey);
+            }
+        }
+    }
     const staleButUsable = Boolean(storedEntry) && !fresh;
     const cached = staleButUsable ? storedEntry : memo.get();
     const session = options.egressSession;
@@ -1316,7 +1482,7 @@ async function runCredentialPlatform(input, options) {
     // Report real extraction work instead of making the UI infer APK/domain
     // activity from text logs. Cache reuse remains distinct from executed work.
     const substage = (name, status) => event(options, 'extract_substage', { source_name: input.source_name, platform, substage: name, status });
-    const inspectApk = async () => {
+    const inspectApk = async (recordFailure = true) => {
         substage('apk_download', 'running');
         let apkBytes = null;
         try {
@@ -1331,11 +1497,15 @@ async function runCredentialPlatform(input, options) {
                 source.brand_override ?? input.source_name, egress);
         }
         catch (error) {
-            errors.push(`apk: ${error instanceof Error ? error.message : String(error)}`);
+            if (recordFailure) {
+                errors.push(`apk: ${error instanceof Error ? error.message : String(error)}`);
+            }
         }
         if (!apkBytes) {
             substage('apk_download', 'failed');
-            errors.push('APK could not be located');
+            if (recordFailure) {
+                errors.push('APK could not be located');
+            }
             return null;
         }
         substage('apk_download', 'success');
@@ -1352,7 +1522,7 @@ async function runCredentialPlatform(input, options) {
         log(`[extract] ${discovered.package_name} ${discovered.version_name} seeds=${discovered.seed_domains.length}`);
         return discovered.seed_domains.length > 0 ? discovered : null;
     };
-    const inspectSharedApk = () => (memo.resolve ? memo.resolve(inspectApk) : inspectApk());
+    const inspectSharedApk = (recordFailure = true) => (memo.resolve ? memo.resolve(() => inspectApk(recordFailure)) : inspectApk(recordFailure));
     // `apk_url` / `apk_path` are an explicit override: when either is set the
     // caller is asserting a specific build, so a cached fingerprint must not
     // shadow it. Otherwise the cache would make the override a no-op.
@@ -1373,7 +1543,11 @@ async function runCredentialPlatform(input, options) {
             // stale certificate fails every login with no other signal.
             if (staleButUsable) {
                 log('[extract] cached fingerprint is past its trust window; re-inspecting the APK');
-                const refreshed = await inspectSharedApk();
+                // The refresh is opportunistic: the cached entry already answered
+                // `/api/eversion`, so an unreachable storefront must not also append
+                // "APK could not be located" to a run that is about to work. That line
+                // was the whole error text of a run whose nodes came through fine.
+                const refreshed = await inspectSharedApk(false);
                 if (refreshed) {
                     const refreshedEversion = await tryEversion(refreshed, credentialKeyCandidates(source, refreshed));
                     if (refreshedEversion) {
@@ -1491,10 +1665,15 @@ async function runCredentialPlatform(input, options) {
             diagnostics.membership_expired = isMembershipExpiredMessage(message);
             diagnostics.credential_rejected = !diagnostics.membership_expired && isCredentialLoginRejection(message);
             errors.push(`login rejected: code=${String(payload.code)}`);
-            // A cached fingerprint whose seeds answer eversion but whose signing
-            // cert the vendor rotated keeps failing here on every run. Drop the
-            // cache so the next run re-inspects the APK instead of repeating this.
-            if (cachedInUse) {
+            // A cached fingerprint whose signing cert the vendor rotated fails here,
+            // so the cache must not outlive the failure. Only a real credential
+            // rejection is evidence of that: a throttled or free-tier account is
+            // rejected too, and dropping the brand's fingerprint for it made the next
+            // run re-download the APK from a storefront this host cannot reach —
+            // turning one bad account into a source that never runs again. On a
+            // redirected row that rejection is the norm (most accounts are unknown to
+            // the backend), so there the cache is never dropped on a login result.
+            if (cachedInUse && diagnostics.credential_rejected && !source.brand_override) {
                 store?.clear(brandKey);
             }
             return { ...empty, failed_iterations: 1 };
@@ -1618,9 +1797,13 @@ async function runCredentialPlatform(input, options) {
     // Raw totals use the exact-string identity the pipeline dedupes with, so the
     // live number and `extract_source_completed.raw_links` agree.
     const linkIds = new Set();
-    const policy = resolveRoundPolicy(source);
+    // Lap mode: one round is one full sweep of the frozen list, so the cap and
+    // the plateau are laps with no conversion factor. A row with no lap key
+    // keeps the legacy round policy with identical arguments.
+    const lap = resolveLapRoundPolicy(source, activeRoutes.length);
+    const policy = lap ? lap.policy : resolveRoundPolicy(source);
     const maxIterations = policy.max_iterations;
-    const areasPerRound = resolveAreasPerRound(source.areas_per_round, activeRoutes.length);
+    const areasPerRound = lap ? lap.areas_per_round : resolveAreasPerRound(source.areas_per_round, activeRoutes.length);
     const areaConcurrency = resolveConcurrency(source.area_concurrency, DEFAULT_AREA_CONCURRENCY);
     const cursor = new AreaCursor(activeRoutes);
     const startedAt = Date.now();
@@ -1633,8 +1816,11 @@ async function runCredentialPlatform(input, options) {
     diagnostics.route_count = activeRoutes.length;
     diagnostics.areas_per_round = areasPerRound;
     diagnostics.area_concurrency = areaConcurrency;
-    log(`[extract] area list frozen: ${activeRoutes.length} areas,` +
-        ` ${areasPerRound}/round, concurrency ${areaConcurrency}, egress ${session.transport}`);
+    log(lap
+        ? `[extract] area list frozen: ${activeRoutes.length} areas, ${maxIterations} 遍 (1 遍 = 全部区域各一次),` +
+            ` concurrency ${areaConcurrency}, egress ${session.transport}`
+        : `[extract] area list frozen: ${activeRoutes.length} areas,` +
+            ` ${areasPerRound}/round, concurrency ${areaConcurrency}, egress ${session.transport}`);
     for (let round = 1; round <= maxIterations; round += 1) {
         if (!shouldStartRound(round, policy, (Date.now() - startedAt) / 1000)) {
             break;
@@ -1720,8 +1906,8 @@ async function runCredentialPlatform(input, options) {
             if (session.reportEmptySweep()) {
                 log('[extract] no route answered; switching to the upstream proxy');
             }
-            if (emptySweep >= MAX_EMPTY_ROUNDS) {
-                errors.push(`no route answered for ${emptySweep} consecutive rounds`);
+            if (emptySweep >= (lap?.empty_round_limit ?? MAX_EMPTY_ROUNDS)) {
+                errors.push(`no route answered for ${emptySweep} consecutive ${lap ? 'laps' : 'rounds'}`);
                 break;
             }
         }
@@ -1744,17 +1930,19 @@ async function runCredentialPlatform(input, options) {
             new_item_fingerprints: newFingerprints,
             new_item_link_ids: newLinkIds
         });
-        log(`[extract] round ${round}/${maxIterations} area=${batch.map((route) => route.area).join(',')}` +
+        log((lap
+            ? `[extract] 遍 ${round}/${maxIterations} area=${batch.map((route) => route.area).join(',')}`
+            : `[extract] round ${round}/${maxIterations} area=${batch.map((route) => route.area).join(',')}`) +
             ` +${appendedInRound} new (+${meaningfulInRound} meaningful, total ${links.length},` +
-            ` plateau ${plateau}/${policy.plateau_limit})`);
+            ` plateau ${plateau}/${policy.plateau_limit}${lap ? ' 遍' : ''})`);
         if (shouldStopOnPlateau(round, plateau, policy)) {
-            log(`[extract] early stop: ${plateau} consecutive rounds without a meaningful new node`);
+            log(`[extract] early stop: ${plateau} consecutive ${lap ? 'laps' : 'rounds'} without a meaningful new node`);
             break;
         }
-        if (placeholderStreak >= PLACEHOLDER_ONLY_ROUNDS) {
-            errors.push(`channel produced only placeholder nodes for ${placeholderStreak} rounds; stopping it` +
+        if (placeholderStreak >= (lap?.placeholder_round_limit ?? PLACEHOLDER_ONLY_ROUNDS)) {
+            errors.push(`channel produced only placeholder nodes for ${placeholderStreak} ${lap ? 'laps' : 'rounds'}; stopping it` +
                 ' (this brand does not serve real nodes on this platform)');
-            log(`[extract] ${platform} channel stopped: ${placeholderStreak} rounds of placeholder nodes only.` +
+            log(`[extract] ${platform} channel stopped: ${placeholderStreak} ${lap ? 'laps' : 'rounds'} of placeholder nodes only.` +
                 ' The other channel still runs; this platform is not serving real nodes for this brand.');
             break;
         }
@@ -1770,7 +1958,9 @@ async function runCredentialPlatform(input, options) {
         requested_iterations: maxIterations,
         successful_iterations: successfulRounds,
         failed_iterations: failedRounds,
-        raw_links: links.length
+        raw_links: links.length,
+        area_count: activeRoutes.length,
+        round_unit: lap ? 'lap' : 'round'
     });
     return {
         source_name: input.source_name,
@@ -1781,6 +1971,36 @@ async function runCredentialPlatform(input, options) {
         diagnostics
     };
 }
+/**
+ * Decide what a membership sweep does with one pooled row.
+ *
+ * The sweep logs in with explicit credentials, so the run path's own retirement
+ * (which only fires for a *leased* row) never runs for it — the same decision has
+ * to be reachable from here, or a free-tier account with a date years in the
+ * future stays in rotation forever. Kept pure so the policy can be asserted
+ * without a vendor login.
+ */
+export function classifyMembershipRefresh(facts, today) {
+    const expires = String(facts.membership_expires_at ?? '');
+    if (facts.login_ok) {
+        if (expires && expires < today)
+            return { status: 'expired', reason: 'membership expired' };
+        const level = facts.membership_level;
+        const produced = Number(facts.produced_links ?? 0) > 0 || Number(facts.route_count ?? 0) > 0;
+        // A free-tier row (level 0/1) only ever yields placeholders. Retire it only
+        // when it produced nothing, exactly as the run path does, so a paid row the
+        // vendor misreports as level 1 keeps its place.
+        if (level !== undefined && level < 2 && !produced)
+            return { status: 'retired', reason: 'no paid membership' };
+        return { status: 'updated', reason: '' };
+    }
+    if (facts.membership_expired)
+        return { status: 'expired', reason: 'membership expired' };
+    // The vendor rejected the credential itself: the row cannot log in at all.
+    if (facts.credential_rejected)
+        return { status: 'retired', reason: 'login rejected' };
+    return { status: 'failed', reason: '' };
+}
 /**
  * Learn every pooled account's real membership expiry by logging in.
  *
@@ -1801,7 +2021,7 @@ export async function refreshAccountExpiry(input = {}) {
         cacheDir: resolveFingerprintCacheDir(resolveUserRuntimeRoot(env)),
         now
     });
-    const outcome = { checked: 0, updated: 0, expired: 0, failed: 0, results: [] };
+    const outcome = { checked: 0, updated: 0, expired: 0, retired: 0, failed: 0, results: [] };
     const todayText = localDay(now());
     const requested = input.brand ? normalizeBrand(input.brand) : null;
     // Every brand the pool knows, from the registry rather than a second list.
@@ -1843,25 +2063,30 @@ export async function refreshAccountExpiry(input = {}) {
                     }, { env, now, memo, fingerprintStore });
                     const expires = result.diagnostics.membership_expires_at ?? '';
                     entry.expires_at = expires;
-                    if (result.diagnostics.login_ok && expires) {
-                        store.setExpiry(brand, leased.account, expires);
-                        if (expires < todayText) {
-                            store.markExpired(leased.id, 'membership expired');
-                            entry.status = 'expired';
-                            outcome.expired += 1;
-                        }
-                        else {
-                            entry.status = 'updated';
-                            outcome.updated += 1;
-                        }
+                    const verdict = classifyMembershipRefresh({
+                        ...result.diagnostics,
+                        produced_links: result.links.length
+                    }, todayText);
+                    entry.status = verdict.status;
+                    if (verdict.status === 'updated' || verdict.status === 'expired') {
+                        // A lapsed date is still the account's real date: keep it on the row
+                        // so the pool shows when it ran out, not an em dash.
+                        if (expires)
+                            store.setExpiry(brand, leased.account, expires);
                     }
-                    else if (result.diagnostics.membership_expired) {
-                        store.markExpired(leased.id, 'membership expired');
-                        entry.status = 'expired';
+                    if (verdict.status === 'expired') {
+                        store.markExpired(leased.id, verdict.reason);
                         outcome.expired += 1;
                     }
+                    else if (verdict.status === 'retired') {
+                        store.markInvalid(leased.id, verdict.reason);
+                        entry.error = verdict.reason;
+                        outcome.retired += 1;
+                    }
+                    else if (verdict.status === 'updated') {
+                        outcome.updated += 1;
+                    }
                     else {
-                        entry.status = 'failed';
                         // The CLI prints this line, so nothing that can carry a credential
                         // or a request URL may reach it.
                         entry.error = redactText(result.diagnostics.errors.join('; ')) || 'login did not report an expiry';

package/dist/pipeline/extract.js

@@ -424,7 +424,8 @@ export async function fetchSourceLinksWithBackend(input, options = {}) {
             // so an early-stopped 1000-round run still read as 1000/1000.
             rounds: result.diagnostics.rounds,
             rounds_total: result.diagnostics.rounds_total,
-            platforms: result.diagnostics.platforms
+            platforms: result.diagnostics.platforms,
+            area_count: result.diagnostics.route_count
         };
     }
     return fetchSourceLinksInNode(input, options);

package/dist/pipeline/orchestrator.js

@@ -651,7 +651,10 @@ export async function runNodePipeline(options, context = {}) {
                 summary.source_counts[result.source_name] = {
                     raw_links: result.links.length,
                     successful_iterations: result.successful_iterations,
-                    failed_iterations: result.failed_iterations
+                    failed_iterations: result.failed_iterations,
+                    // Only credential adapters report the frozen area list; URL rows and
+                    // older adapters keep the pinned three-key object.
+                    ...(result.area_count ? { area_count: result.area_count } : {})
                 };
                 // A credential source reports its own failures (rejected login, APK not
                 // located) as zero links rather than an exception. Recording that as
@@ -1483,7 +1486,12 @@ export async function resumeNodePipeline(options, context = {}) {
                                 status: resumeFailed ? 'failed' : 'success',
                                 ...(resumeFailed ? { error: resumeErrors.join('; ') } : {})
                             });
-                            summary.source_counts[sourceName] = { raw_links: result.links.length, successful_iterations: result.successful_iterations, failed_iterations: result.failed_iterations };
+                            summary.source_counts[sourceName] = {
+                                raw_links: result.links.length,
+                                successful_iterations: result.successful_iterations,
+                                failed_iterations: result.failed_iterations,
+                                ...(result.area_count ? { area_count: result.area_count } : {})
+                            };
                         }
                         catch (error) {
                             runStore.recordSourceProgress(sourceName, { processed: 0, total: 0, status: 'failed', error: errorMessage(error) });

package/dist/server/http.js

@@ -217,6 +217,16 @@ export async function createAutoVpnServer(options) {
                 writeJson(response, result.ok === false ? 400 : 200, result);
                 return;
             }
+            if (request.method === 'POST' && url.pathname === '/api/accounts/refresh-expiry') {
+                const body = await readJsonBody(request);
+                const result = await options.runtime.refreshAccountExpiry?.({
+                    brand: String(body.brand ?? ''),
+                    limit: Number(body.limit ?? 0),
+                    concurrency: Number(body.concurrency ?? 0)
+                }) ?? { ok: false, error: 'refresh_expiry_unavailable' };
+                writeJson(response, result.ok === false ? 400 : 200, result);
+                return;
+            }
             if (request.method === 'POST' && url.pathname === '/api/qr') {
                 const body = await readJsonBody(request);
                 const text = String(body.text ?? '');