ccdeck 3.29.11 → 3.31.0

package/src/server/quota-oauth.mjs

@@ -0,0 +1,190 @@
+// Claude Code's OAuth token, as quota.mjs borrows it: where it is kept, whether
+// this machine has one at all, how a request made with it introduces itself,
+// and the two limits every such request is under — the floor between two the
+// deck pays for, and the 429 cooldown they all share.
+//
+// Source 2 of the chain lives here too — one GET of the usage endpoint, mapped
+// by quota-shape.mjs — because it is nothing more than a request with this
+// token. Whether to make it is quota.mjs's decision, taken against the
+// self-poll floor; this module knows only how, and when a 429 says to stop.
+import { claudeConfigDir } from "./claude-dir.mjs";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { mapOAuthUsage } from "./quota-shape.mjs";
+
+export const USAGE_URL   = "https://api.anthropic.com/api/oauth/usage";
+const BETA_HEADER = "oauth-2025-04-20";
+
+// Source 2's request, asking for the reset inventory as well as the windows.
+const USAGE_WITH_RESETS_URL = `${USAGE_URL}?cedar_ember=1`;
+
+/**
+ * How these requests introduce themselves, in the format Claude Code uses for
+ * its own.
+ *
+ * The endpoint decides whether to send the reset inventory by client surface:
+ * a User-Agent it does not recognise as Claude Code's CLI gets `eligible:
+ * false, ineligible_reason: "surface"` and no grants, and a CLI version it
+ * considers too old gets `"cli_version"`. This deck used to send
+ * `claude-code/2.1.0`: written to look like Claude Code, in a format the
+ * endpoint does not take for it. The windows do not depend on any of this —
+ * claude-swap reads the same ones as `claude-swap/1.0`.
+ *
+ * Pinned rather than read off the installed binary: the version lives in a
+ * different place under every install method, and a pin that ages out fails
+ * closed — the endpoint stops sending grants, the row disappears, and no number
+ * on the panel is wrong. Raising it is the fix when that happens.
+ */
+const USER_AGENT  = "claude-cli/2.1.283 (external, cli)";
+
+// Floor between two polls WE pay for. Twelve an hour against a budget of
+// ~28-30 leaves claude-swap room to collect for every account, which is what
+// the accounts panel is made of. Only reached when the store cannot answer.
+export const SELF_POLL_MS = 5 * 60_000;
+
+// 429 cooldown gate — after a rate-limit, skip the API until this passes.
+let _rateLimitedUntil = 0;
+
+/** When the cooldown ends, or 0 when there is none. For the budget rules,
+ *  which take it as an argument so they stay pure. */
+export function cooldownUntil() { return _rateLimitedUntil; }
+
+/** Whether a 429 is still being waited out at `now`. */
+export function coolingDown(now) { return now < _rateLimitedUntil; }
+
+/** A 429 arrived: hold every request this token makes off for as long as its
+ *  `retry-after` says, within the limits cooldownFromHeader keeps. One token,
+ *  one budget, so both requests that can be refused back off the same way. */
+export function startCooldown(res) {
+  _rateLimitedUntil = Date.now() + cooldownFromHeader(res.headers.get("retry-after"), 5 * 60_000);
+}
+
+/** The cooldown, forgotten — for resetQuotaPollFloor. */
+export function clearCooldown() { _rateLimitedUntil = 0; }
+
+/**
+ * Where Claude Code keeps the OAuth credentials this module borrows a token
+ * from.
+ *
+ * It is `.credentials.json` inside the Claude config dir, and that dir moves:
+ * CLAUDE_CONFIG_DIR replaces ~/.claude wholesale rather than overlaying it, so
+ * on a machine where it is set there is no ~/.claude to read at all. Hardcoding
+ * ~/.claude here did not fail loudly — it made readOAuthToken() return null
+ * forever, which reads exactly like "this machine keeps its credentials in the
+ * Keychain", and the quota chain quietly fell through to source 3 on every poll
+ * it was allowed to make. See src/server/claude-dir.mjs, which owns the rule
+ * and is the only place it is spelled.
+ *
+ * Resolved per call rather than frozen into a module-level constant, for the
+ * same reason claudeConfigDir() is a function: a constant captured at import
+ * time is a value nothing can observe or correct afterwards, and this module is
+ * imported lazily by the /api/quota route rather than at a point in startup
+ * anyone here controls.
+ *
+ * Exported for tests — it is the whole of the bug, and it is pure.
+ */
+export function credentialsPath() {
+  return join(claudeConfigDir(), ".credentials.json");
+}
+
+export async function readOAuthToken() {
+  try {
+    const raw  = await readFile(credentialsPath(), "utf8");
+    const auth = JSON.parse(raw)?.claudeAiOauth;
+    if (!auth?.accessToken) return null;
+    // expiresAt is epoch milliseconds. If expired, the CLI fallback handles it.
+    if (auth.expiresAt && Date.now() >= auth.expiresAt) return null;
+    return auth.accessToken;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * A cooldown from a `retry-after`, kept inside limits the deck can live with.
+ *
+ * Unclamped, the header decided the poller's fate in both directions: `0` (or a
+ * value the server rounds down to it) defeats the cooldown entirely and the
+ * next tick asks again immediately, which is the loop a 429 exists to stop; a
+ * large one — a day is a legal value — freezes the reader for the life of the
+ * process, and nothing here re-reads it. Both are the remote side deciding how
+ * this deck behaves, which a header is not entitled to do.
+ *
+ * The floor is the deck's own minimum backoff and the ceiling is an hour: long
+ * enough to be a real retreat, short enough that a quota panel is not dead for
+ * the rest of the day because one reply said so.
+ */
+export function cooldownFromHeader(raw, fallbackMs, minMs = 30_000, maxMs = 3600_000) {
+  const seconds = parseInt(String(raw ?? ""), 10);
+  if (!Number.isFinite(seconds)) return fallbackMs;
+  return Math.min(Math.max(seconds * 1000, minMs), maxMs);
+}
+
+/**
+ * WHETHER THIS MACHINE HAS A SUBSCRIPTION TO REPORT ON AT ALL.
+ *
+ * Every source here needs a Claude.ai OAuth credential: the claude-swap store
+ * holds one, `claudeAiOauth` in the credentials file is one, and
+ * `claude --print /usage` prints windows only for a session signed in with one.
+ * An API-key, Bedrock or Vertex install has none — and there is no quota to
+ * read, because those are billed per token rather than in five-hour windows.
+ *
+ * That mattered because of what the CLI does on such a machine: it RUNS, prints
+ * no quota lines, and the no-numbers branch of quota.mjs's _doFetch used to
+ * read that as "genuine <1%" and publish `ok: true` with two zeroes. The panel
+ * then drew empty bars, which is a measurement nobody took. Codex already
+ * answers this properly, with `api_key_mode` as its own reason and its own
+ * sentence.
+ *
+ * Cheap and synchronous: environment first, because a machine configured for
+ * Bedrock or Vertex says so there, then the presence of the OAuth block in the
+ * credentials file. `readOAuthToken` above answers a different question — it
+ * also rejects an EXPIRED token, and an expired subscription is still a
+ * subscription.
+ */
+export async function hasSubscriptionCredential(env = process.env) {
+  if (env.CLAUDE_CODE_USE_BEDROCK === "1" || env.CLAUDE_CODE_USE_VERTEX === "1") return false;
+  try {
+    const raw = await readFile(credentialsPath(), "utf8");
+    if (JSON.parse(raw)?.claudeAiOauth?.accessToken) return true;
+  } catch { /* absent or unreadable, decided below */ }
+  // A key in the environment and no OAuth block beside it is the API-key
+  // install. Without either, this deck simply has not been signed in yet, and
+  // "sign in" is the right thing to say — which is the `waiting` branch, not
+  // this one.
+  return !(env.ANTHROPIC_API_KEY || env.ANTHROPIC_AUTH_TOKEN);
+}
+
+/** The headers every request made with the Claude Code token sends. */
+export function oauthHeaders(token) {
+  return {
+    "Authorization":  `Bearer ${token}`,
+    "anthropic-beta": BETA_HEADER,
+    "Accept":         "application/json",
+    "Content-Type":   "application/json",
+    "User-Agent":     USER_AGENT,
+  };
+}
+
+export async function fetchOAuthUsage() {
+  if (coolingDown(Date.now())) return null;
+  const token = await readOAuthToken();
+  if (!token) return null;
+
+  try {
+    const res = await fetch(USAGE_WITH_RESETS_URL, {
+      headers: oauthHeaders(token),
+      signal: AbortSignal.timeout(15_000),
+    });
+
+    if (res.status === 429) {
+      startCooldown(res);
+      return null;
+    }
+    if (!res.ok) return null;
+
+    return mapOAuthUsage(await res.json());
+  } catch {
+    return null;
+  }
+}

package/src/server/quota-shape.mjs

@@ -0,0 +1,229 @@
+// What each of quota.mjs's three sources answers, in the shape the panel
+// speaks.
+//
+// A claude-swap row, an OAuth usage body and the text `claude --print /usage`
+// prints go in; the same `{ session5hPct, week7dPct, … }` comes out, whichever
+// of the three it was. Nothing here reads a file, asks the network or holds
+// anything between calls, and that is why it is a module of its own: quota.mjs
+// decides which source to ask and when, which is state and budget, while a
+// wrong number on the panel comes from one of these mappings — and a test can
+// hand one a body without driving the chain that fetched it.
+import { resetLabelIso } from "./reset-label.mjs";
+import { resetCreditsFrom } from "./claude-reset-credits.mjs";
+// One ANSI stripper for the whole deck. The private copy that used to live
+// here accepted only the BEL terminator for an OSC sequence, while term.mjs's
+// also accepts ESC \\ — so a hyperlink written the other legal way survived
+// into text this module then parsed for quota lines.
+import { stripAnsi } from "./term.mjs";
+
+// The two windows' lengths. Every reading carries them, whichever source it
+// came from — including the CLI's, which prints no length at all, and the
+// zero reading quota.mjs publishes for a window that has just reset.
+export const WIN_5H_SEC  = 18000;
+export const WIN_7D_SEC  = 604800;
+
+/**
+ * A reported utilisation as the whole percentage the panel draws: rounded, and
+ * held inside 0–100 whatever the source said.
+ *
+ * The OAuth body and the claude-swap row each carried this as a private arrow
+ * inside their mapping, the same one character for character. One rule written
+ * twice is a rule that can drift, and a clamp is where a drift prints 140% on
+ * a bar. The CLI's parse is not a third copy: it reads at most three digits
+ * off a line, so there is nothing below zero or between integers to handle.
+ *
+ * Exported for its test.
+ */
+export function clampPct(v) {
+  return Math.min(100, Math.max(0, Math.round(v)));
+}
+
+// ISO-8601 → "Jun 19, 1:19pm" (local time, matching the CLI display format).
+//
+// The body moved to reset-label.mjs in #374: codex-quota.mjs had a copy that
+// claimed in its own comment to match this one and did not, so the Codex lanes
+// and the Claude lanes printed the same instant two different ways in the same
+// panel. This rendering is the one both surfaces use now. The alias stays so
+// the four call sites below read the way they always have.
+const fmtResetIso = resetLabelIso;
+
+function isoToSec(iso) {
+  if (!iso) return null;
+  const t = new Date(iso).getTime();
+  return isNaN(t) ? null : Math.floor(t / 1000);
+}
+
+// Map the OAuth usage JSON to our quota result shape.
+// utilization is already a 0–100 percentage. 5h falls back to 7d if absent.
+//
+// A 7d window that is absent is UNKNOWN, and published as null (#1627). The
+// endpoint can send `seven_day: null`, and this used to fill in a zero there —
+// which the bar prints as "< 1%", a week nobody measured and a reader takes as
+// almost all of it left. The same kind of zero #765 removed; the CLI's parse
+// below already leaves the field out for a week line it did not see.
+export function mapOAuthUsage(data) {
+  const fh = data?.five_hour;
+  const sd = data?.seven_day;
+  const son = data?.seven_day_sonnet;
+  const opus = data?.seven_day_opus;
+
+  const primary = (fh?.utilization != null) ? fh : sd;
+  if (!primary || primary.utilization == null) return null;
+
+  const result = {
+    session5hPct:       clampPct(primary.utilization),
+    session5hWindowSec: WIN_5H_SEC,
+    session5hReset:     fmtResetIso(primary.resets_at),
+    session5hResetAt:   isoToSec(primary.resets_at),
+    week7dWindowSec:    WIN_7D_SEC,
+  };
+  if (sd?.utilization != null) {
+    result.week7dPct     = clampPct(sd.utilization);
+    result.week7dReset   = fmtResetIso(sd.resets_at);
+    result.week7dResetAt = isoToSec(sd.resets_at);
+  } else {
+    result.week7dPct = null;
+  }
+  if (son?.utilization != null)  result.weekSonnetPct = clampPct(son.utilization);
+  if (opus?.utilization != null) result.weekOpusPct   = clampPct(opus.utilization);
+
+  // extra usage credits (pay-as-you-go top-up), if enabled
+  const extra = data?.extra_usage;
+  if (extra?.is_enabled) {
+    result.extraEnabled = true;
+    if (extra.used_credits != null)  result.extraUsedCredits  = extra.used_credits;
+    if (extra.monthly_limit != null) result.extraMonthlyLimit = extra.monthly_limit;
+    if (extra.currency)              result.extraCurrency     = extra.currency;
+  }
+
+  // Saved limit resets, from the same response and so from the same account as
+  // the windows above. Absent rather than null when the block says nothing
+  // readable, so a response without one maps exactly as it always has.
+  const credits = resetCreditsFrom(data?.cedar_ember, Date.now());
+  if (credits) result.resetCredits = credits;
+  return result;
+}
+
+/**
+ * claude-swap's row for the active account, in the shape the panel speaks.
+ *
+ * Exported for quota.mjs, which reads the store through it, and pinned by
+ * tests: the mapping is where a wrong number would come from, and it is pure.
+ */
+export function quotaFromStore(entry) {
+  const good = entry?.lastGood;
+  const fh = good?.five_hour;
+  const sd = good?.seven_day;
+  const primary = (typeof fh?.pct === "number") ? fh : sd;
+  if (typeof primary?.pct !== "number") return null;
+
+  const out = {
+    ok: true,
+    source: "claude-swap",
+    session5hPct:       clampPct(primary.pct),
+    session5hWindowSec: WIN_5H_SEC,
+    session5hReset:     fmtResetIso(primary.resets_at),
+    session5hResetAt:   isoToSec(primary.resets_at),
+    week7dWindowSec:    WIN_7D_SEC,
+    // Unknown rather than 0 when the row has no 7d window, as mapOAuthUsage
+    // publishes it (#1627): claude-swap writes no `seven_day` at all when the
+    // endpoint sent none.
+    week7dPct:          typeof sd?.pct === "number" ? clampPct(sd.pct) : null,
+    week7dReset:        fmtResetIso(sd?.resets_at),
+    week7dResetAt:      isoToSec(sd?.resets_at),
+    // The age of the DATA, not of our read of it. The panel prints this, and
+    // "30s ago" over numbers claude-swap collected twenty minutes back is the
+    // kind of true-looking lie this whole change exists to remove.
+    fetchedAt: entry.fetchedAt,
+  };
+  // claude-swap keeps per-model windows in a named list rather than fixed
+  // fields, because which ones an account has depends on its plan.
+  for (const s of Array.isArray(good.scoped) ? good.scoped : []) {
+    if (typeof s?.pct !== "number") continue;
+    if (/sonnet/i.test(s.name ?? "")) out.weekSonnetPct = clampPct(s.pct);
+    else if (/opus/i.test(s.name ?? "")) out.weekOpusPct = clampPct(s.pct);
+  }
+  return out;
+}
+
+// Parse "Jun 18, 4:09pm" (local time, no tz) into unix seconds.
+// Claude shows times in the user's local timezone, so parsing as local is correct.
+// `now` is injectable so the year-boundary case is testable.
+export function parseResetToSec(resetStr, now = Date.now()) {
+  if (!resetStr) return null;
+  try {
+    // "4:09pm" → "4:09 PM" so Date.parse handles it. Minutes are optional in
+    // the CLI's output ("9am"); Date.parse rejects "9 AM", so supply ":00".
+    const norm = resetStr
+      .replace(/(\d{1,2})(?::(\d{2}))?\s*(am|pm)/i,
+               (_all, h, mm, ampm) => `${h}:${mm ?? "00"} ${ampm}`)
+      .trim();
+    // The CLI prints no year, so we have to supply one. Stamping the current
+    // year blindly puts a "Jan 2" reset read on Dec 30 eleven months in the
+    // past, which hides the countdown and pins the pace marker at 100%. A
+    // reset is never more than a week away, so the neighbouring year that
+    // lands nearest to `now` is the one Claude meant.
+    const thisYear = new Date(now).getFullYear();
+    let best = null;
+    for (const year of [thisYear - 1, thisYear, thisYear + 1]) {
+      const t = new Date(`${norm} ${year}`).getTime();
+      if (isNaN(t)) continue;
+      if (best === null || Math.abs(t - now) < Math.abs(best - now)) best = t;
+    }
+    return best === null ? null : Math.floor(best / 1000);
+  } catch { return null; }
+}
+
+/**
+ * Parse `claude --print /usage` output.
+ *
+ * Observed format (Claude Code ≥ 1.x):
+ *   "Current session: 84% used · resets Jun 18, 4:09pm (Europe/Chisinau)"
+ *   "Current week (all models): 85% used · resets Jun 21, 8:59am (Europe/Chisinau)"
+ *   "Current week (Sonnet only): 48% used · resets Jun 21, 9am (Europe/Chisinau)"
+ *   "Current week (Opus only): ..."   (if present)
+ */
+export function parseUsageText(raw) {
+  const text = stripAnsi(raw);
+  const result = {};
+
+  // Helper: find "X% used · resets <rest>" on a line matching a label.
+  const extract = (labelRe) => {
+    const line = text.split("\n").find(l => labelRe.test(l));
+    if (!line) return null;
+    const pctM = line.match(/(\d{1,3})\s*%/);
+    const resetM = line.match(/resets\s+(.+)/i);
+    const resetFull = resetM
+      ? resetM[1].replace(/\(.*?\)/g, "").replace(/·/g, "").trim()
+      : null;
+    return {
+      pct:     pctM ? Math.min(100, parseInt(pctM[1], 10)) : null,
+      reset:   resetFull,
+      resetAt: parseResetToSec(resetFull),
+    };
+  };
+
+  const session = extract(/current session/i);
+  if (session?.pct != null) {
+    result.session5hPct       = session.pct;
+    result.session5hWindowSec = WIN_5H_SEC;
+    if (session.reset)   result.session5hReset   = session.reset;
+    if (session.resetAt) result.session5hResetAt  = session.resetAt;
+  }
+
+  const weekAll = extract(/current week\s*\(all models\)/i) || extract(/current week\s*[:·]/i);
+  if (weekAll?.pct != null) {
+    result.week7dPct       = weekAll.pct;
+    result.week7dWindowSec = WIN_7D_SEC;
+    if (weekAll.reset)   result.week7dReset   = weekAll.reset;
+    if (weekAll.resetAt) result.week7dResetAt  = weekAll.resetAt;
+  }
+
+  const weekSon = extract(/current week\s*\(sonnet/i);
+  if (weekSon?.pct != null) result.weekSonnetPct = weekSon.pct;
+
+  const weekOpus = extract(/current week\s*\(opus/i);
+  if (weekOpus?.pct != null) result.weekOpusPct = weekOpus.pct;
+
+  return Object.keys(result).length > 0 ? result : null;
+}

package/src/server/quota-store-resets.mjs

@@ -0,0 +1,206 @@
+// Claude's saved limit resets, on the store path (#1308).
+//
+// When claude-swap's store supplies the windows, nothing in its row says how
+// many resets the account has saved, so the inventory is a read of its own
+// with Claude Code's token: on a floor of its own, behind the quota read that
+// starts it, and published only once the token's owner has been checked
+// against the account claude-swap says is active. quota.mjs's header says why
+// the other two sources need none of this; what is here is that check, the
+// inventory it guards, and the floor it is read on.
+import { availableResetCredits, readResetGrants } from "./claude-reset-credits.mjs";
+import {
+  SELF_POLL_MS, USAGE_URL, cooldownUntil, oauthHeaders, readOAuthToken, startCooldown,
+} from "./quota-oauth.mjs";
+import { createHash } from "node:crypto";
+
+// The store path's inventory read. `skip_spend=1` is what Claude Code adds to
+// the same request, because the spend breakdown is not what it is asking for;
+// neither is it here, where the windows come from claude-swap instead.
+const RESETS_ONLY_URL = `${USAGE_URL}?cedar_ember=1&skip_spend=1`;
+// Whose token this is. claude-swap asks the same endpoint the same question
+// before it trusts a credential with an account; see tokenOwner.
+const PROFILE_URL = "https://api.anthropic.com/api/oauth/profile";
+
+// Floor between two inventory reads while claude-swap supplies the windows. A
+// grant is issued for a launch and lasts weeks, so this is two requests an hour
+// out of a budget claude-swap plans to leave eight to ten of unspent. A forced
+// refresh, or an account not tried yet, waits SELF_POLL_MS.
+const CREDITS_POLL_MS = 30 * 60_000;
+
+// How long an inventory is shown after the last read that succeeded. Expiry is
+// worked out at every read, but a reset redeemed in Claude only leaves the
+// inventory when a read says so, and a read that keeps failing must not keep
+// promising it.
+const CREDITS_TRUSTED_MS = 3 * CREDITS_POLL_MS;
+
+// What the last successful read found, and for whom: `{ account, grants, at }`,
+// where `grants` is readResetGrants's answer — a list, or null for a block that
+// said nothing readable. Never an id: the parser does not keep one.
+let _credits = null;
+// When the store path last tried, successful or not, and for which account,
+// so a failing read is on the same floor as a working one.
+let _creditsTriedAt = 0;
+let _creditsTriedFor = null;
+let _creditsInflight = null;
+// The last token whose owner was looked up, by hash, and the answer. A token
+// belongs to one account for its whole life, so this is asked once per token
+// rather than once per read. The token itself is not kept.
+let _owner = null;
+
+/**
+ * A Claude account as the two halves claude-swap keys one on, or null when
+ * either is missing, because half an identity cannot be matched against
+ * anything.
+ */
+export function accountOf(email, org) {
+  const e = typeof email === "string" ? email.trim() : "";
+  const o = typeof org === "string" ? org.trim() : "";
+  return e && o ? { email: e, organizationUuid: o } : null;
+}
+
+/**
+ * Whether two identities are the same Claude account.
+ *
+ * Both halves, because claude-swap treats one address under two organizations
+ * as two accounts on purpose, and those two have separate inventories. The
+ * address is compared without case — it is the same mailbox either way — and
+ * the organization exactly.
+ *
+ * Exported for tests: this comparison is the whole of what keeps one account's
+ * resets off another account's card.
+ */
+export function sameAccount(a, b) {
+  if (!a || !b) return false;
+  return a.email.toLowerCase() === b.email.toLowerCase() && a.organizationUuid === b.organizationUuid;
+}
+
+/** The held inventory, if it was read for `account` and recently enough. */
+export function heldResetCredits(account, now) {
+  if (!_credits || !sameAccount(_credits.account, account)) return null;
+  if (now - _credits.at > CREDITS_TRUSTED_MS) return null;
+  return availableResetCredits(_credits.grants, now);
+}
+
+/**
+ * Whether the store path may spend a request on the inventory now.
+ *
+ * The long floor once this account has been tried, whether that worked or not
+ * — a profile lookup that keeps failing is not a reason to ask twelve times an
+ * hour. The short one for an account not tried yet, which is what an account
+ * switch produces, and for the refresh button.
+ *
+ * Exported for tests, like maySelfPoll, and for the same reason: it is a
+ * budget rule, and it is pure. The 429 cooldown is maySelfPoll's own — one
+ * token, one budget — so a 429 here holds source 2 off as well, and the other
+ * way round.
+ */
+export function resetCreditsDue({ now, force, triedAt, rateLimitedUntil, triedThisAccount }) {
+  if (now < rateLimitedUntil) return false;
+  return now - triedAt >= (triedThisAccount && !force ? CREDITS_POLL_MS : SELF_POLL_MS);
+}
+
+/**
+ * The account a token belongs to, as `{ email, organizationUuid }`, or null
+ * when that cannot be established.
+ *
+ * `/api/oauth/profile` answers about the token it is sent, which makes it the
+ * one source that cannot describe a different account than the token will be
+ * used for. The Claude config's `oauthAccount` block would have been free, but
+ * it is a separate file from the credential, written at a separate moment, and
+ * "usually agrees" is not the bar for publishing an account's data.
+ */
+async function tokenOwner(token) {
+  const key = createHash("sha256").update(token).digest("hex");
+  if (_owner?.key === key) return _owner.identity;
+  let identity = null;
+  try {
+    const res = await fetch(PROFILE_URL, {
+      headers: oauthHeaders(token),
+      cache: "no-store",
+      signal: AbortSignal.timeout(5_000),
+    });
+    if (res.ok) {
+      const body = await res.json();
+      identity = accountOf(body?.account?.email, body?.organization?.uuid);
+    }
+  } catch { /* unreachable or unreadable: no identity, so nothing is published */ }
+  if (identity) _owner = { key, identity };
+  return identity;
+}
+
+/**
+ * The inventory for `token`: readResetGrants's answer, or undefined when the
+ * request did not produce one — in which case whatever is held stays held.
+ */
+async function fetchResetGrants(token) {
+  try {
+    const res = await fetch(RESETS_ONLY_URL, {
+      headers: oauthHeaders(token),
+      cache: "no-store",
+      signal: AbortSignal.timeout(5_000),
+    });
+    if (res.status === 429) {
+      startCooldown(res);
+      return undefined;
+    }
+    if (!res.ok) return undefined;
+    return readResetGrants((await res.json())?.cedar_ember);
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Read the reset inventory for the account claude-swap says is active, when
+ * the store is what the panel's windows came from.
+ *
+ * Best-effort in every direction, and never awaited by a quota read: it runs
+ * behind the read that started it, and the next read picks the answer up. It
+ * cannot delay, fail or change the windows, and nothing it catches is logged —
+ * there is nothing in a failure here the user can act on, and the one thing
+ * the error path must never do is print a request that carried a token.
+ *
+ * THE ACCOUNT CHECK IS THE POINT. The token is Claude Code's, from the Claude
+ * config dir; the windows are claude-swap's, for whichever slot it has marked
+ * active. Those are the same account after a `cswap switch`, and need not be
+ * after a `claude auth login` done in a terminal. So the token's owner is looked
+ * up first, and when it is not the store's active account the inventory
+ * request is never made. What is kept is stamped with the account it was
+ * checked against, and heldResetCredits compares that stamp with the store's
+ * active account again at every read — so a switch made anywhere, by the deck,
+ * by `cswap` in a terminal or by claude-swap's auto-switch, cannot carry one
+ * account's resets onto the next account's card.
+ */
+export function refreshStoreResetCredits({ now, force = false, account }) {
+  if (_creditsInflight || !account) return;
+  const triedThisAccount = sameAccount(_creditsTriedFor, account);
+  if (!resetCreditsDue({ now, force, triedAt: _creditsTriedAt, rateLimitedUntil: cooldownUntil(), triedThisAccount })) return;
+  _creditsTriedAt = now;
+  _creditsTriedFor = account;
+  const run = (async () => {
+    const token = await readOAuthToken();
+    if (!token) return;
+    const owner = await tokenOwner(token);
+    if (!sameAccount(owner, account)) return;
+    const grants = await fetchResetGrants(token);
+    if (grants !== undefined) _credits = { account, grants, at: now };
+  })();
+  // Settles rather than rejects: nothing in here is news to anyone.
+  _creditsInflight = run.catch(() => {}).finally(() => { _creditsInflight = null; });
+}
+
+/** Exported for tests: the inventory read runs behind the quota read that
+ *  started it, and a test has to be able to wait for it to land. */
+export function resetCreditsSettled() {
+  return _creditsInflight ?? Promise.resolve();
+}
+
+/** The held inventory, forgotten — for invalidateQuotaCache. */
+export function forgetResetCredits() { _credits = null; }
+
+/** The inventory floor, cleared — for resetQuotaPollFloor, beside the
+ *  self-poll floor it clears. */
+export function clearResetCreditsFloor() {
+  _creditsTriedAt = 0;
+  _creditsTriedFor = null;
+}