@velum-labs/routekit-accounts 1.3.2 → 1.5.0

package/README.md

@@ -10,11 +10,10 @@ runs against every healthy account; the provider publishes the union of models
 and tracks which accounts are eligible for each model.
 
 The first-launch RouteKit subscription kinds are `claude-code` and `codex`.
-They run the official provider login in isolated temporary state
-(`captureLoginCredential`) before enrolling. Any number of named accounts may
-join a provider; the first enrollment enables that provider in the effective
-router config. The RouteKit tool command is still `routekit claude`; tool names
-and subscription kinds are separate contracts.
+They run first-party OAuth (`captureLoginCredential`) before enrolling. Any
+number of named accounts may join a provider; the first enrollment enables that
+provider in the effective router config. The RouteKit tool command is still
+`routekit claude`; tool names and subscription kinds are separate contracts.
 
 Other registry entries and exported connector APIs are internal, unqualified,
 and non-contractual; they are not RouteKit onboarding or support.

package/dist/account-set/reset-credits.d.ts

@@ -2,15 +2,15 @@ import type { SubscriptionMode } from "@velum-labs/routekit-registry";
 import { type RouteKitPlatform } from "@velum-labs/routekit-runtime/effect";
 import { Effect } from "effect";
 import type { SubscriptionProvider } from "../provider.js";
-import type { RateLimitTracker } from "../rate-limit-tracker.js";
+import type { PoolStateStore } from "../pool-state-store.js";
 import type { SubscriptionPoolMember } from "../subscription-pool-selection.js";
 import type { AccountLimits } from "../types.js";
 import type { RedeemResetCreditInput } from "./types.js";
 export declare class ResetCreditService<M extends SubscriptionMode> {
     private readonly provider;
     private readonly tracker;
-    constructor(provider: SubscriptionProvider<M>, tracker: RateLimitTracker);
-    list(member: SubscriptionPoolMember, signal?: AbortSignal): Effect.Effect<import("../types.js").ResetCreditSnapshot, import("effect/PlatformError").PlatformError | Error, import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/HttpClient").HttpClient>;
+    constructor(provider: SubscriptionProvider<M>, tracker: PoolStateStore);
+    list(member: SubscriptionPoolMember, signal?: AbortSignal): Effect.Effect<import("../types.js").ResetCreditSnapshot, Error, import("effect/unstable/http/HttpClient").HttpClient | import("@effect/platform-node/NodeServices").NodeServices>;
     attach(member: SubscriptionPoolMember, limits: AccountLimits, signal?: AbortSignal): Effect.Effect<AccountLimits, never, import("effect/unstable/http/HttpClient").HttpClient>;
     redeem(input: RedeemResetCreditInput, member: SubscriptionPoolMember, fetchUsage: (member: SubscriptionPoolMember, signal?: AbortSignal) => Effect.Effect<AccountLimits, Error, RouteKitPlatform>, signal?: AbortSignal): Effect.Effect<{
         creditId?: string;
@@ -20,5 +20,5 @@ export declare class ResetCreditService<M extends SubscriptionMode> {
         code: string;
         redeemRequestId: string;
         windowsReset?: number;
-    }, import("effect/PlatformError").PlatformError | Error, import("effect/unstable/http/HttpClient").HttpClient | import("@effect/platform-node/NodeServices").NodeServices>;
+    }, Error, import("effect/unstable/http/HttpClient").HttpClient | import("@effect/platform-node/NodeServices").NodeServices>;
 }

package/dist/account-set/status-service.d.ts

@@ -1,7 +1,7 @@
 import type { SubscriptionMode } from "@velum-labs/routekit-registry";
 import type { AccountActivityService } from "../activity.js";
 import type { AccountAuthService } from "../auth-health.js";
-import type { RateLimitTracker } from "../rate-limit-tracker.js";
+import type { PoolStateStore } from "../pool-state-store.js";
 import type { SubscriptionPoolMember, SubscriptionPoolSelector } from "../subscription-pool-selection.js";
 import type { SubscriptionAccountSetSnapshot, SubscriptionSelectionStrategy } from "../types.js";
 export declare class AccountSetStatusService<M extends SubscriptionMode> {
@@ -14,7 +14,7 @@ export declare class AccountSetStatusService<M extends SubscriptionMode> {
     private readonly authHealth;
     private readonly selector;
     private readonly catalogReady;
-    constructor(mode: M, strategy: SubscriptionSelectionStrategy, switchThreshold: number, members: SubscriptionPoolMember[], tracker: RateLimitTracker, activity: AccountActivityService, authHealth: AccountAuthService, selector: SubscriptionPoolSelector, catalogReady: () => boolean);
+    constructor(mode: M, strategy: SubscriptionSelectionStrategy, switchThreshold: number, members: SubscriptionPoolMember[], tracker: PoolStateStore, activity: AccountActivityService, authHealth: AccountAuthService, selector: SubscriptionPoolSelector, catalogReady: () => boolean);
     snapshot(): SubscriptionAccountSetSnapshot;
     statusSnapshot(): SubscriptionAccountSetSnapshot;
     private memberStatus;

package/dist/account-set/status-service.js

@@ -30,12 +30,13 @@ export class AccountSetStatusService {
         };
     }
     statusSnapshot() {
-        const snapshot = this.snapshot();
         const now = Date.now() / 1000;
         return {
-            ...snapshot,
-            members: snapshot.members.map((status) => {
-                const member = this.members.find((candidate) => candidate.id === status.id);
+            mode: this.mode,
+            strategy: this.strategy,
+            switchThreshold: this.switchThreshold,
+            members: this.members.map((member) => {
+                const status = this.memberStatus(member);
                 const credentialValid = member.credential.accessToken.length > 0 &&
                     (member.credential.expiresAt === undefined ||
                         member.credential.expiresAt > now ||
@@ -51,24 +52,23 @@ export class AccountSetStatusService {
                     catalogReady: this.catalogReady(),
                     models: [...member.models],
                     now,
-                    isWindowRelevant: (key, limitName) => this.selector.windowRelevant(key, limitName, undefined)
+                    isWindowRelevant: (key, limitName) => this.selector.windowRelevant(key, limitName, undefined),
+                    isDiscoveredLimitRelevant: (limit) => this.selector.discoveredLimitRelevant(limit, undefined)
                 });
                 const auth = this.authHealth.snapshot(subscriptionAccountIdentity(this.mode, member.label), member.credentialFingerprint);
                 const upstreamAuthState = auth.kind === "superseded" ? "unknown" : auth.kind;
-                const readinessReasons = credentialValid
-                    ? [
-                        ...(auth.kind === "refreshing"
-                            ? [{ code: "provider_auth_refreshing" }]
-                            : auth.kind === "backoff" && auth.retryAt !== undefined
-                                ? [{ code: "provider_auth_backoff", until: auth.retryAt / 1000 }]
-                                : auth.kind === "rejected"
-                                    ? [{ code: "provider_auth_rejected", status: auth.status ?? 401 }]
-                                    : []),
-                        ...readiness.reasons
-                    ]
-                    : member.credential.expiresAt !== undefined && member.credential.expiresAt <= now
-                        ? readiness.reasons
-                        : [{ code: "credential_invalid" }, ...readiness.reasons];
+                const readinessReasons = [...readiness.reasons];
+                if (credentialValid) {
+                    if (auth.kind === "refreshing")
+                        readinessReasons.unshift({ code: "provider_auth_refreshing" });
+                    else if (auth.kind === "backoff" && auth.retryAt !== undefined)
+                        readinessReasons.unshift({ code: "provider_auth_backoff", until: auth.retryAt / 1000 });
+                    else if (auth.kind === "rejected")
+                        readinessReasons.unshift({ code: "provider_auth_rejected", status: auth.status ?? 401 });
+                }
+                else if (member.credential.expiresAt === undefined || member.credential.expiresAt > now) {
+                    readinessReasons.unshift({ code: "credential_invalid" });
+                }
                 const poolEligible = readiness.eligible &&
                     (auth.kind === "unknown" ||
                         auth.kind === "accepted" ||

package/dist/account-set/types.d.ts

@@ -5,7 +5,10 @@ import type { Effect } from "effect";
 import type { SubscriptionAccountSource } from "../account-source.js";
 import type { AccountActivityCoordinator, AccountActivityService } from "../activity.js";
 import type { AccountAuthCoordinator, AccountAuthService } from "../auth-health.js";
+import type { CredentialStore } from "../credential-store.js";
+import type { PoolStateStore } from "../pool-state-store.js";
 import type { ConsumeResetCreditResult } from "../provider.js";
+import type { RefreshLock } from "../refresh-lock.js";
 import type { SubscriptionExecutionObserver } from "../subscription-request-executor.js";
 import type { SubscriptionAccountSetSnapshot, SubscriptionCredential, SubscriptionSelectionStrategy } from "../types.js";
 export type CoordinatorResource<T> = {
@@ -16,11 +19,24 @@ export type SubscriptionAccountSetOptions = {
     activity?: CoordinatorResource<AccountActivityCoordinator | AccountActivityService>;
     authHealth?: CoordinatorResource<AccountAuthCoordinator | AccountAuthService>;
     source?: SubscriptionAccountSource;
+    store?: CredentialStore;
+    refreshLock?: RefreshLock;
+    poolStateStore?: PoolStateStore;
     strategy?: SubscriptionSelectionStrategy;
     switchThreshold?: number;
     probeIntervalMs?: number;
     refreshSkewSeconds?: number;
     fallbackCooldownSeconds?: number;
+    /**
+     * Catalog inventory published by an external owner. When present, account
+     * selection is initialized from this inventory without live discovery.
+     */
+    publishedModels?: readonly string[];
+    /**
+     * Account-specific published model inventory keyed by credential-store ID.
+     * When present, selection only offers a model to members that advertised it.
+     */
+    publishedModelsByCredentialId?: Readonly<Record<string, readonly string[]>>;
     beforeAcquisitionRevalidation?: (member: {
         label: string;
     }) => Effect.Effect<void, Error, RouteKitPlatform>;

package/dist/account-set.d.ts

@@ -1,22 +1,35 @@
 import type { ModelCapabilityMetadata, ModelReasoningCapabilities, ModelSelectionSignals } from "@velum-labs/routekit-contracts";
 import type { SubscriptionMode } from "@velum-labs/routekit-registry";
 import { RouteKitFailure } from "@velum-labs/routekit-runtime/effect";
+import { ResourceScope } from "@velum-labs/routekit-runtime/lifecycle";
 import { Effect } from "effect";
+import { AccountActivityCoordinator, type AccountActivityService } from "./activity.js";
+import { AccountAuthCoordinator, type AccountAuthService } from "./auth-health.js";
 import { type SubscriptionProvider } from "./provider.js";
 import { type SubscriptionExecutionObserver, type SubscriptionRequestOperation } from "./subscription-request-executor.js";
 export { SubscriptionAccountSetAuthError, SubscriptionAccountSetAuthRecoveryError, SubscriptionAccountSetExhaustedError } from "./subscription-pool-selection.js";
 export type { SubscriptionExecutionObserver, SubscriptionRequestOperation } from "./subscription-request-executor.js";
-export { SUBSCRIPTION_SSE_BUFFER_CAP_BYTES } from "./subscription-stream.js";
+export { SUBSCRIPTION_BUFFERED_RESPONSE_CAP_BYTES, SUBSCRIPTION_SSE_BUFFER_CAP_BYTES } from "./subscription-stream.js";
 import type { SubscriptionAccountSetSnapshot } from "./types.js";
 export type { CoordinatorResource, RedeemResetCreditInput, RedeemResetCreditResult, SubscriptionAccountSetOptions } from "./account-set/types.js";
 import type { RedeemResetCreditInput, SubscriptionAccountSetOptions } from "./account-set/types.js";
+export declare function ownCoordinatorResource<T extends AccountActivityCoordinator | AccountActivityService | AccountAuthCoordinator | AccountAuthService>(resources: ResourceScope, resource: T): T;
 export declare class SubscriptionAccountSet<M extends SubscriptionMode = SubscriptionMode> {
     #private;
     private constructor();
     static open<M extends SubscriptionMode>(provider: SubscriptionProvider<M>, options: SubscriptionAccountSetOptions): Effect.Effect<SubscriptionAccountSet<M>, import("effect/PlatformError").PlatformError | Error, import("effect/unstable/http/HttpClient").HttpClient | import("@effect/platform-node/NodeServices").NodeServices>;
     get mode(): SubscriptionMode;
+    /** Provider behavior injected by the daemon/provider package composition root. */
+    get provider(): SubscriptionProvider<M>;
     get size(): number;
     get enrolledSize(): number;
+    /**
+     * Authentication-only fingerprints for credentials owned by this set.
+     *
+     * This keeps daemon auth-health coordination independent of whether the
+     * CredentialStore is backed by files, PostgreSQL, or another durable store.
+     */
+    credentialFingerprints(): ReadonlyMap<string, string>;
     snapshot(): SubscriptionAccountSetSnapshot;
     statusSnapshot(): SubscriptionAccountSetSnapshot;
     discoverModels(signal?: AbortSignal): Effect.Effect<readonly string[], Error, import("effect/unstable/http/HttpClient").HttpClient | import("@effect/platform-node/NodeServices").NodeServices>;
@@ -26,9 +39,9 @@ export declare class SubscriptionAccountSet<M extends SubscriptionMode = Subscri
     modelSelectionSignals(model: string): ModelSelectionSignals | undefined;
     close(): Effect.Effect<void, RouteKitFailure, never>;
     [Symbol.asyncDispose](): Promise<void>;
-    probe(signal?: AbortSignal): Effect.Effect<void, never, import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/HttpClient").HttpClient>;
+    probe(signal?: AbortSignal): Effect.Effect<void, never, import("effect/unstable/http/HttpClient").HttpClient | import("@effect/platform-node/NodeServices").NodeServices>;
     /** List banked rate-limit reset credits for one enrolled member. */
-    listResetCredits(label: string, signal?: AbortSignal): Effect.Effect<import("./types.js").ResetCreditSnapshot, import("effect/PlatformError").PlatformError | Error, import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/HttpClient").HttpClient>;
+    listResetCredits(label: string, signal?: AbortSignal): Effect.Effect<import("./types.js").ResetCreditSnapshot, import("effect/PlatformError").PlatformError | Error, import("effect/unstable/http/HttpClient").HttpClient | import("@effect/platform-node/NodeServices").NodeServices>;
     /** Redeem one banked rate-limit reset for an enrolled member. */
     redeemResetCredit(input: RedeemResetCreditInput, signal?: AbortSignal): Effect.Effect<{
         creditId?: string;
@@ -43,6 +56,6 @@ export declare class SubscriptionAccountSet<M extends SubscriptionMode = Subscri
      * Refresh stale or missing usage without allowing rapid callers to hammer
      * provider quota endpoints. Failed attempts are throttled as well.
      */
-    refreshUsage(maxAgeMs?: number, signal?: AbortSignal): Effect.Effect<void, Error, import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("effect/unstable/http/HttpClient").HttpClient>;
+    refreshUsage(maxAgeMs?: number, signal?: AbortSignal): Effect.Effect<void, Error, import("effect/unstable/http/HttpClient").HttpClient | import("@effect/platform-node/NodeServices").NodeServices>;
     execute(model: string | undefined, operation: SubscriptionRequestOperation, signal?: AbortSignal, observer?: SubscriptionExecutionObserver): Effect.Effect<Response, import("effect/PlatformError").PlatformError | Error, import("effect/unstable/http/HttpClient").HttpClient | import("@effect/platform-node/NodeServices").NodeServices>;
 }

package/dist/account-set.js

@@ -1,36 +1,34 @@
 import { join } from "node:path";
-import { ResourceScope } from "@velum-labs/routekit-runtime/lifecycle";
 import { RouteKitFailure, routeKitError, runRouteKitEffect, toRouteKitFailure, withAbortSignal } from "@velum-labs/routekit-runtime/effect";
+import { ResourceScope } from "@velum-labs/routekit-runtime/lifecycle";
 import { Cause, Deferred, Effect, Exit, Fiber } from "effect";
 import { AccountCatalogService } from "./account-set/catalog-service.js";
 import { ResetCreditService } from "./account-set/reset-credits.js";
 import { AccountSetStatusService } from "./account-set/status-service.js";
-import { resolveSubscriptionAccounts } from "./account-source.js";
-import { AccountActivityCoordinator, accountActivityService, isAccountActivityService, subscriptionAccountIdentity } from "./activity.js";
+import { AccountActivityCoordinator, accountActivityService, subscriptionAccountIdentity } from "./activity.js";
 import { quotaAdmissionReasons } from "./admission.js";
-import { AccountAuthCoordinator, accountAuthService, isAccountAuthService } from "./auth-health.js";
-import { subscriptionCredentialFingerprint, subscriptionCredentialLabel } from "./credentials.js";
+import { AccountAuthCoordinator, accountAuthService } from "./auth-health.js";
+import { openDirectoryCredentialStore } from "./directory-credential-store.js";
 import { SubscriptionProviderRequestError, SubscriptionRefreshError } from "./provider.js";
 import { RateLimitTracker } from "./rate-limit-tracker.js";
+import { makeInProcessRefreshLock } from "./refresh-lock.js";
 import { SubscriptionPoolSelector } from "./subscription-pool-selection.js";
 import { SubscriptionRequestExecutor } from "./subscription-request-executor.js";
 export { SubscriptionAccountSetAuthError, SubscriptionAccountSetAuthRecoveryError, SubscriptionAccountSetExhaustedError } from "./subscription-pool-selection.js";
-export { SUBSCRIPTION_SSE_BUFFER_CAP_BYTES } from "./subscription-stream.js";
+export { SUBSCRIPTION_BUFFERED_RESPONSE_CAP_BYTES, SUBSCRIPTION_SSE_BUFFER_CAP_BYTES } from "./subscription-stream.js";
 const DEFAULT_SWITCH_THRESHOLD = 0.9;
 const DEFAULT_REFRESH_SKEW_SECONDS = 300;
 const DEFAULT_FALLBACK_COOLDOWN_SECONDS = 300;
 const RAMP_WINDOW_MS = 30_000;
 const RAMP_STEP_MS = 250;
-function ownActivityResource(resources, resource) {
-    if (!isAccountActivityService(resource))
-        return resources.own(resource);
-    resources.defer(() => runRouteKitEffect(resource.close));
-    return resource;
-}
-function ownAuthResource(resources, resource) {
-    if (!isAccountAuthService(resource))
-        return resources.own(resource);
-    resources.defer(() => runRouteKitEffect(resource.close));
+export function ownCoordinatorResource(resources, resource) {
+    const close = resource.close;
+    if (Effect.isEffect(close)) {
+        resources.defer(() => runRouteKitEffect(close));
+    }
+    else {
+        resources.own(resource);
+    }
     return resource;
 }
 function credentialLoadFailure(mode, label, sourcePath, cause) {
@@ -61,6 +59,8 @@ export class SubscriptionAccountSet {
     #selector;
     #executor;
     #tracker;
+    #store;
+    #refreshLock;
     #activity;
     #metadata = new Map();
     #selectionSignals = new Map();
@@ -76,7 +76,7 @@ export class SubscriptionAccountSet {
     #credentialLoadFailuresReported = false;
     #probeFiber;
     #closed = false;
-    constructor(provider, options, members, tracker, enrolledSize, credentialLoadFailures) {
+    constructor(provider, options, members, tracker, store, refreshLock, enrolledSize, credentialLoadFailures) {
         this.#provider = provider;
         this.#enrolledSize = enrolledSize;
         this.#credentialLoadFailures = credentialLoadFailures;
@@ -88,7 +88,21 @@ export class SubscriptionAccountSet {
             fallbackCooldownSeconds: options.fallbackCooldownSeconds ?? DEFAULT_FALLBACK_COOLDOWN_SECONDS
         };
         this.#members = members;
+        if (options.publishedModelsByCredentialId !== undefined) {
+            for (const member of this.#members) {
+                member.models = new Set(options.publishedModelsByCredentialId[member.credentialId] ?? []);
+            }
+            this.#catalogReady = true;
+        }
+        else if (options.publishedModels !== undefined) {
+            const publishedModels = new Set(options.publishedModels);
+            for (const member of this.#members)
+                member.models = new Set(publishedModels);
+            this.#catalogReady = true;
+        }
         this.#tracker = tracker;
+        this.#store = store;
+        this.#refreshLock = refreshLock;
         this.#resetCredits = new ResetCreditService(provider, tracker);
         this.#catalog = new AccountCatalogService(provider.mode, members, this.#metadata, this.#selectionSignals, this.#reasoning, (member, signal) => Effect.asVoid(this.#ensureFresh(member, signal)), (member, signal) => this.#discoverMemberModels(member, signal), () => {
             this.#catalogReady = true;
@@ -128,37 +142,69 @@ export class SubscriptionAccountSet {
         return Effect.suspend(() => {
             const resources = new ResourceScope();
             return Effect.gen(function* () {
-                const source = options.source ?? { kind: "auto" };
-                const accounts = yield* resolveSubscriptionAccounts(provider.mode, source);
-                const tracker = yield* RateLimitTracker.open(join(accounts.stateDirectory, ".state.json"), provider.mode);
+                if (options.source !== undefined && options.store !== undefined) {
+                    return yield* new RouteKitFailure({
+                        message: "subscription account set accepts either source or store, not both"
+                    });
+                }
+                const directoryStore = options.store === undefined
+                    ? yield* openDirectoryCredentialStore(provider.mode, options.source ?? { kind: "auto" }, {
+                        load: (id) => provider.loadCredential(id),
+                        ...(provider.persistCredential === undefined
+                            ? {}
+                            : {
+                                persist: (previous, next) => provider.persistCredential(previous, next)
+                            })
+                    })
+                    : undefined;
+                const store = options.store ?? directoryStore;
+                const refreshLock = options.refreshLock ??
+                    (directoryStore === undefined ? undefined : makeInProcessRefreshLock());
+                if (refreshLock === undefined) {
+                    return yield* new RouteKitFailure({
+                        message: "store-backed subscription account sets require refreshLock"
+                    });
+                }
+                const tracker = options.poolStateStore ??
+                    (directoryStore === undefined
+                        ? undefined
+                        : yield* RateLimitTracker.open(join(directoryStore.stateDirectory, ".state.json"), provider.mode));
+                if (tracker === undefined) {
+                    return yield* new RouteKitFailure({
+                        message: "store-backed subscription account sets require poolStateStore"
+                    });
+                }
                 const activityResource = options.activity === undefined
                     ? resources.own(yield* AccountActivityCoordinator.open())
                     : options.activity.ownership === "owned"
-                        ? ownActivityResource(resources, options.activity.resource)
+                        ? ownCoordinatorResource(resources, options.activity.resource)
                         : resources.borrow(options.activity.resource);
                 const activity = accountActivityService(activityResource);
                 const authHealthResource = options.authHealth === undefined
                     ? resources.own(yield* AccountAuthCoordinator.open())
                     : options.authHealth.ownership === "owned"
-                        ? ownAuthResource(resources, options.authHealth.resource)
+                        ? ownCoordinatorResource(resources, options.authHealth.resource)
                         : resources.borrow(options.authHealth.resource);
                 const authHealth = accountAuthService(authHealthResource);
                 const members = [];
                 const credentialLoadFailures = [];
-                for (const sourcePath of accounts.paths) {
-                    const id = subscriptionCredentialLabel(sourcePath);
-                    const loaded = yield* Effect.exit(provider.loadCredential(sourcePath));
+                const grants = yield* store.list(provider.mode);
+                for (const grant of grants) {
+                    const id = grant.label;
+                    const loaded = yield* Effect.exit(store.get(grant.id));
                     if (Exit.isFailure(loaded)) {
-                        credentialLoadFailures.push(credentialLoadFailure(provider.mode, id, sourcePath, Cause.squash(loaded.cause)));
+                        credentialLoadFailures.push(credentialLoadFailure(provider.mode, grant.label, grant.id, Cause.squash(loaded.cause)));
                         continue;
                     }
-                    const credential = loaded.value;
-                    const credentialFingerprint = subscriptionCredentialFingerprint(sourcePath);
-                    authHealth.register(subscriptionAccountIdentity(provider.mode, id), credentialFingerprint);
+                    const stored = loaded.value;
+                    const credential = stored.credential;
+                    const credentialFingerprint = stored.fingerprint;
+                    authHealth.register(subscriptionAccountIdentity(provider.mode, grant.label), credentialFingerprint);
                     members.push({
                         id,
-                        label: id,
-                        sourcePath,
+                        credentialId: grant.id,
+                        label: grant.label,
+                        sourcePath: credential.sourcePath,
                         credential,
                         models: new Set(),
                         ...(tracker.coolingUntil(id) !== undefined
@@ -168,17 +214,20 @@ export class SubscriptionAccountSet {
                         lastUsed: 0,
                         inFlight: 0,
                         switchedAt: 0,
-                        credentialFingerprint
+                        credentialFingerprint,
+                        credentialRevision: stored.revision
                     });
                 }
                 const accountSet = new SubscriptionAccountSet(provider, {
                     ...options,
                     activity: { resource: activity, ownership: "borrowed" },
                     authHealth: { resource: authHealth, ownership: "borrowed" }
-                }, members, tracker, accounts.paths.length, credentialLoadFailures);
-                resources.transferTo(accountSet.#resources);
-                yield* accountSet.#startProbe();
-                return accountSet;
+                }, members, tracker, store, refreshLock, grants.length, credentialLoadFailures);
+                return yield* Effect.uninterruptible(Effect.gen(function* () {
+                    yield* accountSet.#startProbe();
+                    resources.transferTo(accountSet.#resources);
+                    return accountSet;
+                }));
             }).pipe(Effect.ensuring(Effect.tryPromise({
                 try: () => resources.dispose(),
                 catch: toRouteKitFailure
@@ -188,12 +237,25 @@ export class SubscriptionAccountSet {
     get mode() {
         return this.#provider.mode;
     }
+    /** Provider behavior injected by the daemon/provider package composition root. */
+    get provider() {
+        return this.#provider;
+    }
     get size() {
         return this.#members.length;
     }
     get enrolledSize() {
         return this.#enrolledSize;
     }
+    /**
+     * Authentication-only fingerprints for credentials owned by this set.
+     *
+     * This keeps daemon auth-health coordination independent of whether the
+     * CredentialStore is backed by files, PostgreSQL, or another durable store.
+     */
+    credentialFingerprints() {
+        return new Map(this.#members.map((member) => [member.label, member.credentialFingerprint]));
+    }
     snapshot() {
         return this.#status.snapshot();
     }
@@ -355,14 +417,19 @@ export class SubscriptionAccountSet {
             const snapshot = self.#authHealth.snapshot(identity, member.credentialFingerprint);
             if (snapshot.kind !== "superseded")
                 return;
-            const fingerprint = subscriptionCredentialFingerprint(member.sourcePath);
-            if (fingerprint !== snapshot.currentFingerprint)
+            const stored = yield* self.#store.get(member.credentialId);
+            if (stored.fingerprint !== snapshot.currentFingerprint)
                 return;
-            member.credential = yield* self.#provider.loadCredential(member.sourcePath);
-            member.credentialFingerprint = fingerprint;
-            self.#authHealth.register(identity, fingerprint);
+            self.#adoptStoredCredential(member, stored);
+            yield* self.#authHealth.activateFingerprint(identity, stored.fingerprint);
         });
     }
+    #adoptStoredCredential(member, stored) {
+        member.credential = stored.credential;
+        member.sourcePath = stored.credential.sourcePath;
+        member.credentialRevision = stored.revision;
+        member.credentialFingerprint = stored.fingerprint;
+    }
     #recoverAuthentication(member, fingerprint, model, excluded, signal) {
         const self = this;
         return Effect.gen(function* () {
@@ -390,29 +457,9 @@ export class SubscriptionAccountSet {
                     excluded.add(member.id);
                 return undefined;
             }
-            const expectedCooldownRevision = self.#tracker.cooldownRevision(member.id);
             const refreshSignal = AbortSignal.any([self.#authHealth.signal, AbortSignal.timeout(30_000)]);
-            return yield* self.#provider.refresh(member.credential, refreshSignal).pipe(Effect.flatMap((credential) => Effect.gen(function* () {
-                const refreshedFingerprint = subscriptionCredentialFingerprint(member.sourcePath);
-                if (!(yield* self.#authHealth.markRefreshed(recovery.claim, refreshedFingerprint))) {
-                    yield* self.#synchronizeCredential(member);
-                    return undefined;
-                }
-                member.credential = credential;
-                member.credentialFingerprint = refreshedFingerprint;
-                if (yield* self.#tracker.resetAfterRefresh(member.id, expectedCooldownRevision)) {
-                    delete member.coolingUntil;
-                }
-                else {
-                    member.coolingUntil = self.#tracker.coolingUntil(member.id);
-                }
-                member.cooldownRevision = self.#tracker.cooldownRevision(member.id);
-                if (signal?.aborted === true) {
-                    yield* self.#authHealth.finishProbation(recovery.claim, { kind: "inconclusive" });
-                    signal.throwIfAborted();
-                }
-                return recovery.claim;
-            })), Effect.catch((error) => Effect.gen(function* () {
+            let pendingCommit;
+            const failRefresh = (error) => Effect.gen(function* () {
                 if (error instanceof SubscriptionRefreshError) {
                     yield* self.#authHealth.failRefresh(recovery.claim, error.failure);
                 }
@@ -426,7 +473,51 @@ export class SubscriptionAccountSet {
                     signal.throwIfAborted();
                 excluded.add(member.id);
                 return undefined;
-            })));
+            });
+            const locked = yield* Effect.uninterruptible(self.#refreshLock.withExclusive(member.credentialId, Effect.gen(function* () {
+                const stored = yield* self.#store.get(member.credentialId);
+                if (stored.revision !== member.credentialRevision ||
+                    stored.fingerprint !== member.credentialFingerprint) {
+                    return { kind: "reloaded", stored };
+                }
+                const expectedCooldownRevision = self.#tracker.cooldownRevision(member.id);
+                const refreshed = yield* self.#provider.refresh(stored.credential, refreshSignal);
+                const committed = yield* self.#store.put(member.credentialId, refreshed, stored.revision);
+                pendingCommit = {
+                    kind: "committed",
+                    stored: committed,
+                    expectedCooldownRevision
+                };
+                return pendingCommit;
+            }))).pipe(Effect.catch((error) => pendingCommit === undefined
+                ? failRefresh(error)
+                : self.#store.get(member.credentialId).pipe(Effect.flatMap((durable) => durable.revision === pendingCommit.stored.revision &&
+                    durable.fingerprint === pendingCommit.stored.fingerprint
+                    ? Effect.succeed({ ...pendingCommit, stored: durable })
+                    : failRefresh(error)), Effect.catch(() => failRefresh(error)))));
+            if (locked === undefined)
+                return undefined;
+            self.#adoptStoredCredential(member, locked.stored);
+            if (locked.kind === "reloaded") {
+                yield* self.#authHealth.activateFingerprint(identity, locked.stored.fingerprint);
+                return undefined;
+            }
+            if (!(yield* self.#authHealth.markRefreshed(recovery.claim, locked.stored.fingerprint))) {
+                yield* self.#synchronizeCredential(member);
+                return undefined;
+            }
+            if (yield* self.#tracker.resetAfterRefresh(member.id, locked.expectedCooldownRevision)) {
+                delete member.coolingUntil;
+            }
+            else {
+                member.coolingUntil = self.#tracker.coolingUntil(member.id);
+            }
+            member.cooldownRevision = self.#tracker.cooldownRevision(member.id);
+            if (signal?.aborted === true) {
+                yield* self.#authHealth.finishProbation(recovery.claim, { kind: "inconclusive" });
+                signal.throwIfAborted();
+            }
+            return recovery.claim;
         });
     }
     #finishProbationForFailure(claim, failure) {
@@ -481,7 +572,9 @@ export class SubscriptionAccountSet {
         return (quotaAdmissionReasons({
             limits,
             switchThreshold: this.#options.switchThreshold,
-            isWindowRelevant: relevant
+            isWindowRelevant: relevant,
+            isDiscoveredLimitRelevant: (limit) => context?.model === undefined ||
+                this.#selector.discoveredLimitRelevant(limit, context.model)
         }).length === 0);
     }
     /**
@@ -490,39 +583,14 @@ export class SubscriptionAccountSet {
      * every account dark until discovery succeeds again.
      */
     #discoverMemberModels(member, signal) {
-        const self = this;
-        return self.#provider.discoverModels(member.credential, signal).pipe(Effect.tap(() => Effect.sync(() => {
-            self.#authHealth.markAccepted(subscriptionAccountIdentity(self.mode, member.label), member.credentialFingerprint);
-        })), Effect.catch((error) => {
-            if (!(error instanceof SubscriptionProviderRequestError) ||
-                error.failure.scope !== "credential") {
-                return Effect.fail(error);
-            }
-            return Effect.gen(function* () {
-                const claim = yield* self.#recoverAuthentication(member, member.credentialFingerprint, undefined, new Set(), signal);
-                if (claim === undefined)
-                    return yield* Effect.fail(error);
-                return yield* self.#provider.discoverModels(member.credential, signal).pipe(Effect.tap(() => self.#authHealth.finishProbation(claim, { kind: "accepted" })), Effect.catch((retryError) => Effect.gen(function* () {
-                    if (retryError instanceof SubscriptionProviderRequestError &&
-                        retryError.failure.scope === "credential" &&
-                        (retryError.failure.status === 401 || retryError.failure.status === 403)) {
-                        yield* self.#authHealth.finishProbation(claim, {
-                            kind: "rejected",
-                            status: retryError.failure.status,
-                            reasonCode: self.#authReasonCode(retryError.failure)
-                        });
-                    }
-                    else {
-                        yield* self.#authHealth.finishProbation(claim, { kind: "inconclusive" });
-                    }
-                    return yield* Effect.fail(retryError);
-                })));
-            });
-        }));
+        return this.#withProviderAuthRecovery(member, (credential) => this.#provider.discoverModels(credential, signal), signal);
     }
     #fetchUsageWithAuthRecovery(member, signal) {
+        return this.#withProviderAuthRecovery(member, (credential) => this.#provider.fetchUsage(credential, signal), signal);
+    }
+    #withProviderAuthRecovery(member, request, signal) {
         const self = this;
-        return self.#provider.fetchUsage(member.credential, signal).pipe(Effect.tap(() => Effect.sync(() => {
+        return request(member.credential).pipe(Effect.tap(() => Effect.sync(() => {
             self.#authHealth.markAccepted(subscriptionAccountIdentity(self.mode, member.label), member.credentialFingerprint);
         })), Effect.catch((error) => {
             if (!(error instanceof SubscriptionProviderRequestError) ||
@@ -533,7 +601,7 @@ export class SubscriptionAccountSet {
                 const claim = yield* self.#recoverAuthentication(member, member.credentialFingerprint, undefined, new Set(), signal);
                 if (claim === undefined)
                     return yield* Effect.fail(error);
-                return yield* self.#provider.fetchUsage(member.credential, signal).pipe(Effect.tap(() => self.#authHealth.finishProbation(claim, { kind: "accepted" })), Effect.catch((retryError) => Effect.gen(function* () {
+                return yield* request(member.credential).pipe(Effect.tap(() => self.#authHealth.finishProbation(claim, { kind: "accepted" })), Effect.catch((retryError) => Effect.gen(function* () {
                     if (retryError instanceof SubscriptionProviderRequestError &&
                         retryError.failure.scope === "credential" &&
                         (retryError.failure.status === 401 || retryError.failure.status === 403)) {

package/dist/account-source.js

@@ -38,8 +38,8 @@ export function resolveSubscriptionAccounts(mode, source = { kind: "auto" }) {
                     }
                     const canonical = resolve(source.canonicalPath ?? defaultSubscriptionCredentialPath(mode));
                     return {
-                        // The credential loader owns file/keychain fallback and will report a
-                        // precise error when neither source exists.
+                        // The credential loader reports a precise error when the canonical
+                        // file does not exist.
                         paths: [canonical],
                         stateDirectory: directory
                     };