claude-multiacc 1.0.4 → 1.0.5

package/README.md

@@ -74,9 +74,16 @@ code cannot read at all degrades that one account (fail open), never the run.
 Telemetry failures never block work: no fresh data ⇒ account treated as available. The
 endpoint rate-limits per account, so the refresher skips accounts fetched in the last 45s
 and backs off exponentially (honoring `Retry-After`) on a 429 — `limits --force` overrides
-both. If an account's OAuth access token has expired (quiet machine, nothing ran claude for
-hours), the refresher first runs a zero-cost `claude auth status` under that account to let
-the app refresh its own credentials, then fetches; if that fails it logs and fails open.
+both. If an account's OAuth access token has been expired for a while (idle account,
+nothing ran claude under it for hours), the refresher renews it directly via the OAuth
+**refresh-token grant** — the same endpoint and public client id Claude Code itself uses —
+and atomically persists the rotated credential (0600) back to that account's
+`.credentials.json`. This is what keeps idle accounts' telemetry fresh so they win
+selection over busy accounts; without it, stale telemetry ranks neutral and a truly-idle
+account would lose to a busy-but-fresh one. Refresh failures fail open and back off via
+`<acct>/.oauth-refresh.json` (10 min transient, 6 h when the grant looks revoked — the log
+then says re-login is needed). Overrides: `CLAUDE_MULTIACC_TOKEN_URL`,
+`CLAUDE_MULTIACC_CLIENT_ID` (used by the sandboxed tests; defaults are correct for real use).
 
 **Auto-retry** (`-p`/`--print` only, default on, `CLAUDE_SHIM_RETRY=0` disables): on an
 auth/rate-limit-looking failure the shim marks the account with a 10-minute error

package/bin/claude-accounts

@@ -47,8 +47,11 @@ USAGE
   claude-accounts sync                      push manifest+tokens to the server (Mac only)
   claude-accounts verify [--quick]          auth matrix; full mode runs `-p "reply OK"` per account
   claude-accounts limits [--quiet] [--force]
-      refresh usage buckets, apply >=90% markers. Skips accounts fetched in the
-      last 45s and honors 429 backoff; --force ignores both.
+      refresh usage buckets, apply >=90% markers. Auto-refreshes long-expired
+      OAuth access tokens via the refresh-token grant (rotated credential is
+      persisted), so idle accounts keep fresh telemetry and stay selectable.
+      Skips accounts fetched in the last 45s and honors 429/refresh backoff;
+      --force ignores all three.
   claude-accounts health                    limits + full verify; logs to health.log
   claude-accounts self-update               update the addon (npm i -g @latest, or git
                                             pull + reinstall); logs to update.log
@@ -740,24 +743,9 @@ cmd_limits() {
   # shellcheck disable=SC2064
   trap "rm -rf '$lock'" EXIT
   rotate_log limits.log
-  # Expired-bearer self-heal: on a quiet machine nothing refreshes OAuth creds,
-  # which would silently stall limits telemetry (fail-open keeps selection working,
-  # but data goes stale). `claude auth status` refreshes creds without inference.
-  local real="" d
-  real="$(find_real_claude "$_self" 2>/dev/null)" || real=""
-  if [ -n "$real" ]; then
-    for d in "$ACC_ROOT"/acct-*; do
-      [ -d "$d" ] || continue
-      [ -f "$d/.credentials.json" ] || continue
-      [ -s "$d/server.token" ] && continue
-      if "$PYBIN" -c '
-import json, sys, time
-c = json.load(open(sys.argv[1])).get("claudeAiOauth", {})
-sys.exit(0 if c.get("expiresAt", 0) / 1000.0 <= time.time() + 60 else 1)' "$d/.credentials.json" 2>/dev/null; then
-        CLAUDE_CONFIG_DIR="$d" CLAUDE_SHIM_ACTIVE=1 "$real" auth status >/dev/null 2>&1 || true
-      fi
-    done
-  fi
+  # NB: expired OAuth access tokens are refreshed inside the Python below via the
+  # refresh-token grant. (`claude auth status` was tried for this and does NOT
+  # refresh credentials — it only reports the on-disk state.)
   # The >=90% exclusion rule is a hard requirement: the manifest may tighten it but
   # never loosen it, or an account could sit at 95% and still be selected.
   local threshold
@@ -773,6 +761,21 @@ now = time.time()
 # Don't re-fetch an account whose data is younger than this (endpoint rate-limits).
 MIN_FETCH_INTERVAL = int(os.environ.get('CLAUDE_MULTIACC_MIN_FETCH', '45'))
 
+# OAuth refresh-token grant — the same endpoint + public client id Claude Code
+# itself uses to keep .credentials.json alive. An account that sits idle past its
+# access-token TTL would otherwise drop out of telemetry forever (stale data ranks
+# neutral, so truly-idle accounts lose selection to busy-but-fresh ones).
+TOKEN_URL = os.environ.get('CLAUDE_MULTIACC_TOKEN_URL',
+                           'https://console.anthropic.com/v1/oauth/token')
+CLIENT_ID = os.environ.get('CLAUDE_MULTIACC_CLIENT_ID',
+                           '9d1c250a-e61b-44d9-88ed-5944d1962f5e')
+# Only refresh a token that has been expired for a while: a LIVE session refreshes
+# its own credential within moments of expiry, so a long-expired one proves no
+# other writer is active (refresh tokens rotate; two racing refreshers strand one).
+REFRESH_MIN_EXPIRED = 300
+REFRESH_FAIL_BACKOFF = 600     # transient (network/5xx/429): retry in 10 min
+REFRESH_DENIED_BACKOFF = 21600  # 4xx = grant likely revoked: 6h; re-login needed anyway
+
 def say(msg):
     if not quiet:
         print(msg)
@@ -793,34 +796,108 @@ try:
 except Exception as e:
     sys.exit(f'cannot read manifest: {e}')
 
+def refresh_oauth(aid, d, cpath):
+    """Refresh a long-expired OAuth access token via the refresh-token grant and
+    persist the ROTATED credential atomically (0600). Returns the new bearer, or
+    None (fail open: the on-disk credential is never touched on failure).
+    Failures back off via <dir>/.oauth-refresh.json — a side file, NOT limits.json,
+    because telemetry state must only ever reflect real usage fetches."""
+    spath = os.path.join(d, '.oauth-refresh.json')
+    try:
+        doc = json.load(open(cpath))
+        o = doc.get('claudeAiOauth', {})
+        # Present-but-null/non-object claudeAiOauth (interrupted or reset credential
+        # write) must degrade THIS account only, like every other malformed input.
+        if not isinstance(doc, dict) or not isinstance(o, dict):
+            return None
+    except Exception:
+        return None
+    if not o.get('refreshToken') or not o.get('accessToken'):
+        return None
+    if o.get('expiresAt', 0) / 1000.0 > now - REFRESH_MIN_EXPIRED:
+        return None  # not expired long enough to prove no live session owns it
+    if o.get('refreshTokenExpiresAt', 0) / 1000.0 <= now:
+        say(f'{aid}: refresh token expired — re-login needed (claude-accounts login {aid})')
+        return None
+    if not force:
+        try:
+            if json.load(open(spath)).get('retry_after', 0) > now:
+                return None  # earlier refresh failure still backing off
+        except Exception:
+            pass
+
+    def back_off(wait, why):
+        try:
+            with open(spath + '.tmp', 'w') as f:
+                json.dump({'retry_after': int(now + wait), 'error': why,
+                           'at': time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime())}, f)
+            os.replace(spath + '.tmp', spath)
+        except Exception:
+            pass
+        say(f'{aid}: oauth refresh failed ({why}); backing off {wait}s; limits left as-is')
+
+    body = json.dumps({'grant_type': 'refresh_token',
+                       'refresh_token': o['refreshToken'],
+                       'client_id': CLIENT_ID}).encode()
+    req = urllib.request.Request(TOKEN_URL, data=body, headers={
+        'Content-Type': 'application/json',
+        'User-Agent': 'claude-multiacc/1.0',
+    })
+    try:
+        data = json.loads(urllib.request.urlopen(req, timeout=30).read().decode())
+    except urllib.error.HTTPError as e:
+        if e.code in (400, 401, 403):
+            back_off(REFRESH_DENIED_BACKOFF,
+                     f'HTTP {e.code} — refresh token may be revoked; re-login needed')
+        else:
+            back_off(REFRESH_FAIL_BACKOFF, f'HTTP {e.code}')
+        return None
+    except Exception as e:
+        back_off(REFRESH_FAIL_BACKOFF, str(e)[:200])
+        return None
+    tok = data.get('access_token') if isinstance(data, dict) else None
+    if not tok:
+        back_off(REFRESH_DENIED_BACKOFF, 'no access_token in response')
+        return None
+    o['accessToken'] = tok
+    # The grant ROTATES the refresh token: persist it (and both expiries) or the
+    # account is stranded — hence atomic write, and a loud message if it fails.
+    if data.get('refresh_token'):
+        o['refreshToken'] = data['refresh_token']
+    if data.get('expires_in'):
+        o['expiresAt'] = int((now + float(data['expires_in'])) * 1000)
+    else:
+        # No expires_in in the response: assume a conservative 1h. Leaving the old
+        # (past) expiresAt would make every later pass re-run the grant in a loop.
+        o['expiresAt'] = int((now + 3600) * 1000)
+    if data.get('refresh_token_expires_in'):
+        o['refreshTokenExpiresAt'] = int((now + float(data['refresh_token_expires_in'])) * 1000)
+    doc['claudeAiOauth'] = o
+    try:
+        fd = os.open(cpath + '.tmp', os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+        with os.fdopen(fd, 'w') as f:
+            json.dump(doc, f)
+        os.replace(cpath + '.tmp', cpath)
+    except Exception as e:
+        say(f'{aid}: token refreshed but credentials NOT persisted ({e}) — re-login may be needed')
+        return None
+    try:
+        os.remove(spath)
+    except OSError:
+        pass
+    say(f'{aid}: oauth access token refreshed via refresh-token grant')
+    return tok
+
 for acct in manifest.get('accounts', []):
     aid = acct['id']
     d = os.path.join(root, aid)
     if not os.path.isdir(d):
         continue
-    bearer = None
-    source = None
-    cpath = os.path.join(d, '.credentials.json')
-    if os.path.isfile(cpath):
-        try:
-            c = json.load(open(cpath)).get('claudeAiOauth', {})
-            if c.get('accessToken') and c.get('expiresAt', 0) / 1000.0 > now + 60:
-                bearer, source = c['accessToken'], 'oauth'
-        except Exception:
-            pass
-    tpath = os.path.join(d, 'server.token')
-    if not bearer and os.path.isfile(tpath):
-        t = open(tpath).read().strip()
-        if t:
-            bearer, source = t, 'token'
-    if not bearer:
-        # Fail OPEN: no usable bearer => leave existing state; never block work on telemetry.
-        say(f'{aid}: no fresh bearer (expired oauth and/or no token); limits left as-is')
-        continue
 
     # The usage endpoint rate-limits per account. Several callers can fire at once
     # (60s cron + the shim's opportunistic kick + a manual run), so skip a fetch when
     # this account's data is already fresh, and honor any backoff a 429 set earlier.
+    # Checked FIRST so a skipped account never burns an oauth refresh for nothing.
     lpath = os.path.join(d, 'limits.json')
     prev = {}
     if os.path.isfile(lpath):
@@ -837,6 +914,36 @@ for acct in manifest.get('accounts', []):
             say(f'{aid}: backing off after 429 ({int(retry_at - now)}s left); limits left as-is')
             continue
 
+    bearer = None
+    source = None
+    cpath = os.path.join(d, '.credentials.json')
+    if os.path.isfile(cpath):
+        try:
+            c = json.load(open(cpath)).get('claudeAiOauth', {})
+            if c.get('accessToken') and c.get('expiresAt', 0) / 1000.0 > now + 60:
+                bearer, source = c['accessToken'], 'oauth'
+        except Exception:
+            pass
+    tpath = os.path.join(d, 'server.token')
+    if not bearer and os.path.isfile(tpath):
+        t = open(tpath).read().strip()
+        if t:
+            bearer, source = t, 'token'
+    if not bearer and os.path.isfile(cpath):
+        # Hard fail-open guard: NOTHING a single account's refresh does may abort
+        # the loop — every account after it would silently starve of telemetry.
+        try:
+            tok = refresh_oauth(aid, d, cpath)
+        except Exception as e:
+            say(f'{aid}: oauth refresh failed unexpectedly ({str(e)[:200]}); failing open')
+            tok = None
+        if tok:
+            bearer, source = tok, 'oauth'
+    if not bearer:
+        # Fail OPEN: no usable bearer => leave existing state; never block work on telemetry.
+        say(f'{aid}: no fresh bearer (expired oauth and/or no token); limits left as-is')
+        continue
+
     req = urllib.request.Request(url, headers={
         'Authorization': 'Bearer ' + bearer,
         'anthropic-beta': 'oauth-2025-04-20',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-multiacc",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "Multi-account addon for Claude Code: every claude / claude -p runs under a randomly-picked subscription account with the most usage headroom. Mirrors to a deploy server. No API keys.",
   "type": "module",
   "bin": {

package/tests/run-tests.sh

@@ -75,6 +75,9 @@ export CLAUDE_MULTIACC_NO_SYNC=1
 # Fixtures are local file:// URLs with no rate limit, so the anti-429 fetch throttle
 # is off by default here; the throttle test re-enables it explicitly.
 export CLAUDE_MULTIACC_MIN_FETCH=0
+# The oauth token endpoint must NEVER be hit for real from tests: default to a missing
+# file:// fixture (refresh fails fast, offline); the refresh tests override per-case.
+export CLAUDE_MULTIACC_TOKEN_URL="file://$WORK/token-endpoint-missing.json"
 
 now="$(date +%s)"
 
@@ -618,15 +621,107 @@ d = json.load(open('$ACC/acct-01/limits.json'))
 sys.exit(0 if 'retry_after' not in d and 'backoff' not in d else 1)" \
   && t_ok "successful fetch clears backoff state" || t_fail "backoff cleared" "retry_after/backoff persisted"
 
-# ---- 16b. expired-bearer account skipped gracefully (fail open) -----------------
+# ---- 16b. expired-bearer account: oauth refresh attempted; fail-open when it fails ----
 mkdir -p "$ACC/acct-05"
-printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-old","refreshToken":"r","expiresAt":1000,"refreshTokenExpiresAt":9999999999999}}' > "$ACC/acct-05/.credentials.json"
+printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-old","refreshToken":"sk-ant-ort01-oldrefresh","expiresAt":1000,"refreshTokenExpiresAt":9999999999999}}' > "$ACC/acct-05/.credentials.json"
 claude-accounts import e@test --id acct-05 --no-sync >/dev/null 2>&1
 out="$(CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits 2>&1)"
 rc=$?
+check "failed oauth refresh logged with backoff" "acct-05: oauth refresh failed" "$out"
 check "expired bearer logged, not fatal" "acct-05: no fresh bearer" "$out"
 [ "$rc" = "0" ] && t_ok "limits exits 0 with expired-bearer account" || t_fail "limits exit code" "rc=$rc"
 [ ! -f "$ACC/acct-05/limits.json" ] && t_ok "no limits.json fabricated for expired account" || t_fail "expired acct limits.json" "unexpectedly written"
+[ -f "$ACC/acct-05/.oauth-refresh.json" ] && t_ok "refresh failure recorded in .oauth-refresh.json" || t_fail "refresh backoff file" "missing"
+
+# ---- 16b2. refresh backoff honored: even a now-working endpoint is not retried early --
+cat > "$WORK/token-ok.json" <<'EOF'
+{"access_token":"sk-ant-oat01-refreshednew","refresh_token":"sk-ant-ort01-rotatednew","expires_in":28800,"refresh_token_expires_in":2592000}
+EOF
+out="$(CLAUDE_MULTIACC_TOKEN_URL="file://$WORK/token-ok.json" CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits 2>&1)"
+check "refresh backoff honored (no early retry)" "acct-05: no fresh bearer" "$out"
+grep -q "sk-ant-oat01-refreshednew" "$ACC/acct-05/.credentials.json" \
+  && t_fail "backoff prevented refresh" "credentials rewritten inside the backoff window" \
+  || t_ok "no refresh inside the backoff window"
+
+# ---- 16b3. --force bypasses refresh backoff: rotated credential persisted + fetch ok --
+out="$(CLAUDE_MULTIACC_TOKEN_URL="file://$WORK/token-ok.json" CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits --force 2>&1)"
+check "--force refreshes the expired oauth token" "acct-05: oauth access token refreshed" "$out"
+check "refreshed account fetches telemetry" "acct-05: ok" "$out"
+python3 - "$ACC/acct-05/.credentials.json" <<'EOF'
+import json, os, stat, sys, time
+p = sys.argv[1]
+o = json.load(open(p))['claudeAiOauth']
+assert o['accessToken'] == 'sk-ant-oat01-refreshednew', o['accessToken']
+assert o['refreshToken'] == 'sk-ant-ort01-rotatednew', 'refresh token was not rotated'
+assert o['expiresAt'] / 1000.0 > time.time() + 3600, 'expiresAt not advanced'
+assert o['refreshTokenExpiresAt'] / 1000.0 > time.time() + 86400, 'refreshTokenExpiresAt not advanced'
+mode = stat.S_IMODE(os.stat(p).st_mode)
+assert mode == 0o600, oct(mode)
+EOF
+[ $? -eq 0 ] && t_ok "rotated credential persisted with 0600" || t_fail "credential rotation" "see assertions above"
+[ ! -f "$ACC/acct-05/.oauth-refresh.json" ] && t_ok "successful refresh clears the backoff file" || t_fail "refresh backoff clear" "file still present"
+[ -f "$ACC/acct-05/limits.json" ] && t_ok "telemetry written right after refresh" || t_fail "limits.json after refresh" "missing"
+grep -qE "sk-ant-ort01|sk-ant-oat01-refreshednew" "$ACC/limits.log" \
+  && t_fail "limits.log leaks no tokens" "a token leaked into limits.log" \
+  || t_ok "limits.log leaks no tokens"
+
+# ---- 16b4. steady state: fresh data means no refresh and no fetch (quiet skip) --------
+out="$(CLAUDE_MULTIACC_MIN_FETCH=45 CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits 2>&1)"
+printf '%s' "$out" | grep -q "acct-05" \
+  && t_fail "fresh account skipped silently" "unexpected acct-05 output: $out" \
+  || t_ok "fresh account skipped silently (no refresh, no fetch)"
+
+# ---- 16b5. an EXPIRED refresh token is never sent: clear re-login message -------------
+printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-old","refreshToken":"sk-ant-ort01-dead","expiresAt":1000,"refreshTokenExpiresAt":1000}}' > "$ACC/acct-05/.credentials.json"
+rm -f "$ACC/acct-05/limits.json" "$ACC/acct-05/.oauth-refresh.json"
+out="$(CLAUDE_MULTIACC_TOKEN_URL="file://$WORK/token-ok.json" CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits 2>&1)"
+check "expired refresh token => re-login message" "re-login needed" "$out"
+grep -q "sk-ant-oat01-refreshednew" "$ACC/acct-05/.credentials.json" \
+  && t_fail "dead refresh token never used" "credentials rewritten from a dead refresh token" \
+  || t_ok "dead refresh token never used"
+
+# ---- 16b6. RECENTLY-expired token is left alone (a live session owns it) --------------
+# The 5-min REFRESH_MIN_EXPIRED gate is the rotation-safety core: a token that expired
+# moments ago may be mid-refresh by a live claude session; grants must not race it.
+# Not even --force may bypass this.
+recent_ms="$(python3 -c 'import time; print(int((time.time()-100)*1000))')"
+printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-recent","refreshToken":"sk-ant-ort01-live","expiresAt":%s,"refreshTokenExpiresAt":9999999999999}}' "$recent_ms" > "$ACC/acct-05/.credentials.json"
+rm -f "$ACC/acct-05/limits.json" "$ACC/acct-05/.oauth-refresh.json"
+out="$(CLAUDE_MULTIACC_TOKEN_URL="file://$WORK/token-ok.json" CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits --force 2>&1)"
+check "recently-expired token is not refreshed (even --force)" "acct-05: no fresh bearer" "$out"
+grep -q "sk-ant-oat01-recent" "$ACC/acct-05/.credentials.json" \
+  && t_ok "recently-expired credential left untouched" \
+  || t_fail "REFRESH_MIN_EXPIRED gate" "credential was rewritten within the 5-min grace window"
+[ ! -f "$ACC/acct-05/.oauth-refresh.json" ] && t_ok "no backoff recorded for a gated (skipped) refresh" \
+  || t_fail "gated refresh backoff" ".oauth-refresh.json written despite the gate"
+
+# ---- 16b7. server.token accounts are NEVER oauth-refreshed (token bearer wins) ---------
+printf '{"claudeAiOauth":{"accessToken":"sk-ant-oat01-old","refreshToken":"sk-ant-ort01-x","expiresAt":1000,"refreshTokenExpiresAt":9999999999999}}' > "$ACC/acct-05/.credentials.json"
+printf 'sk-ant-oat01-portable-token-05' > "$ACC/acct-05/server.token"
+rm -f "$ACC/acct-05/limits.json" "$ACC/acct-05/.oauth-refresh.json"
+out="$(CLAUDE_MULTIACC_TOKEN_URL="file://$WORK/token-ok.json" CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits --force 2>&1)"
+check "token-bearer account fetches without refresh" "acct-05: ok" "$out"
+grep -q "sk-ant-oat01-refreshednew" "$ACC/acct-05/.credentials.json" \
+  && t_fail "server.token exempts oauth refresh" "oauth creds were rotated despite a portable token" \
+  || t_ok "server.token account never oauth-refreshed (grant not run)"
+python3 -c "import json,sys; sys.exit(0 if json.load(open('$ACC/acct-05/limits.json'))['source']=='token' else 1)" \
+  && t_ok "telemetry fetched via the portable token" || t_fail "token bearer source" "source != token"
+rm -f "$ACC/acct-05/server.token"
+
+# ---- 16b8. malformed claudeAiOauth (null) degrades that account ONLY (fail open) -------
+# {"claudeAiOauth": null} is valid JSON from an interrupted/reset credential write; it
+# must not abort the refresher — accounts AFTER it in the manifest must still be fetched.
+# acct-01 is first in the manifest, so corrupting it exercises the loop guarantee.
+cp "$ACC/acct-01/.credentials.json" "$WORK/acct01-creds.bak"
+printf '{"claudeAiOauth": null}' > "$ACC/acct-01/.credentials.json"
+rm -f "$ACC/acct-01/limits.json" "$ACC/acct-01/.oauth-refresh.json" "$ACC/acct-02/limits.json"
+out="$(CLAUDE_MULTIACC_TOKEN_URL="file://$WORK/token-ok.json" CLAUDE_MULTIACC_USAGE_URL="file://$WORK/usage-low.json" claude-accounts limits --force 2>&1)"
+rc=$?
+[ "$rc" = "0" ] && t_ok "null claudeAiOauth exits 0 (fail open)" || t_fail "null claudeAiOauth rc" "rc=$rc: $out"
+check "null claudeAiOauth degrades only that account" "acct-01: no fresh bearer" "$out"
+[ -f "$ACC/acct-02/limits.json" ] && t_ok "accounts after a malformed one still refresh" \
+  || t_fail "fail-open loop guarantee" "acct-02 was starved by acct-01's malformed creds"
+cp "$WORK/acct01-creds.bak" "$ACC/acct-01/.credentials.json"
 claude-accounts remove acct-05 --yes >/dev/null 2>&1
 
 # ---- 16c. codex-review: security hardening -----------------------------------------