instar 1.3.431 → 1.3.432

package/dashboard/subscriptions.js

@@ -90,6 +90,20 @@ export function countdown(iso, now = Date.now(), { expiredWord = 'expired' } = {
   return `${sec}s`;
 }
 
+/** A coarse "N ago" for a PAST ISO timestamp (token-refresh recency). '' if invalid. */
+export function relativeAge(iso, now = Date.now()) {
+  const t = typeof iso === 'string' ? Date.parse(iso) : NaN;
+  if (Number.isNaN(t)) return '';
+  const sec = Math.floor((now - t) / 1000);
+  if (sec < 0) return 'just now';
+  if (sec < 60) return 'just now';
+  const min = Math.floor(sec / 60);
+  if (min < 60) return `${min}m ago`;
+  const hr = Math.floor(min / 60);
+  if (hr < 24) return `${hr}h ago`;
+  return `${Math.floor(hr / 24)}d ago`;
+}
+
 // ── DOM helpers (textContent ONLY — never innerHTML) ────────────────────────
 function el(doc, tag, cls, text) {
   const node = doc.createElement(tag);
@@ -142,6 +156,13 @@ export function renderAccounts(doc, target, accounts, now = Date.now()) {
     } else {
       card.appendChild(el(doc, 'div', 'sub-account-noquota', 'No quota reading yet.'));
     }
+    // Token health: when the poller silently refreshed the access token from the
+    // refresh token, show it — so a routine access-token expiry reads as healthy
+    // (auto-handled) rather than looking like a re-auth event.
+    const refAge = a && a.lastRefreshAt ? relativeAge(a.lastRefreshAt, now) : null;
+    if (refAge) {
+      card.appendChild(el(doc, 'div', 'sub-account-refresh', `Token auto-refreshed ${refAge}`));
+    }
     target.appendChild(card);
   }
 }

package/dist/core/OAuthRefresher.d.ts

@@ -0,0 +1,112 @@
+/**
+ * OAuthRefresher — mint a fresh Claude Code OAuth access token from its stored
+ * refresh token, so the QuotaPoller never falsely flags a still-valid login as
+ * `needs-reauth` (P1.2 hardening of the Subscription & Auth Standard).
+ *
+ * ── Why this exists (the bug it fixes) ──
+ * A Claude Code login holds TWO tokens in its config home's credential store:
+ *   - a short-lived ACCESS token (`sk-ant-oat…`, ~8–12h), and
+ *   - a long-lived REFRESH token (`sk-ant-ort…`, weeks→months).
+ * The `claude` client silently exchanges the refresh token for a new access
+ * token on every real use. The QuotaPoller reads the access token out-of-band
+ * and calls the usage endpoint directly — so when the access token has expired
+ * (which is routine, daily) but the refresh token is still perfectly valid, the
+ * usage read returns 401 and the poller wrongly marks the account `needs-reauth`.
+ * That cried wolf: the login is intact, only the access token lapsed. This module
+ * performs the same refresh-token exchange the client does, so a routine expiry
+ * recovers silently and `needs-reauth` is reserved for a genuinely dead login
+ * (refresh token revoked / password change) — exactly what SubscriptionPool's
+ * status comment already promises.
+ *
+ * ── Corruption safety (the load-bearing invariant) ──
+ * The ONLY way this module could harm a working login is by writing a bad
+ * credential back. So the write is gated three ways:
+ *   1. it happens ONLY on a fully-validated 200 response (new access token shaped
+ *      `sk-ant-oat…`, a positive numeric `expires_in`);
+ *   2. it is a READ-MERGE-WRITE — the existing credential JSON is re-read and only
+ *      the access token / refresh token / expiry are overwritten, so scopes,
+ *      subscriptionType, rateLimitTier and any unknown fields are preserved; and
+ *   3. if the server rotates the refresh token, the NEW one is persisted; if the
+ *      response omits a refresh token (non-rotating server), the existing one is
+ *      kept — never dropped.
+ * A wrong endpoint / client id / network failure can therefore only ever make the
+ * exchange FAIL (→ the caller's existing `needs-reauth` path), never corrupt.
+ *
+ * Token values are NEVER logged or returned to any persisted surface. The OAuth
+ * token endpoint + client id are the public Claude Code values, extracted from
+ * the official client binary (verified 2026-06-08).
+ *
+ * Testability: the credential store, the fetch surface, and the clock are all
+ * injectable, so the whole refresh runs hermetically with zero keychain, zero
+ * network, and a deterministic clock in tests.
+ */
+/** Public Claude Code OAuth token endpoint (from the official client binary). */
+export declare const CLAUDE_TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
+/** Public Claude Code OAuth client id (from the official client binary). */
+export declare const CLAUDE_CODE_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+export type RefreshFailReason = 'unsupported-account' | 'read-failed' | 'no-refresh-token' | 'exchange-failed' | 'malformed-response' | 'write-failed';
+export type RefreshResult = {
+    ok: true;
+    accessToken: string;
+    expiresAt: number;
+    rotated: boolean;
+} | {
+    ok: false;
+    reason: RefreshFailReason;
+    status?: number;
+};
+/** The OAuth access + refresh tokens parsed out of a credential store entry. */
+export interface ClaudeOauth {
+    accessToken?: string;
+    refreshToken?: string;
+    expiresAt?: number;
+    [k: string]: unknown;
+}
+/**
+ * A credential store for one config home. `read` returns the RAW JSON string of
+ * the stored entry (so the refresher can merge-preserve every field); `write`
+ * persists a replacement raw JSON string. Injectable so tests use a fake.
+ */
+export interface CredentialStore {
+    read(configHome: string): string | null;
+    write(configHome: string, rawJson: string): boolean;
+}
+/** POST-capable fetch surface (distinct from QuotaPoller's GET-only FetchImpl). */
+export type RefreshFetch = (url: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    body: string;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    json: () => Promise<unknown>;
+}>;
+export interface RefreshDeps {
+    store?: CredentialStore;
+    fetchImpl?: RefreshFetch;
+    now?: () => number;
+    tokenUrl?: string;
+    clientId?: string;
+}
+export declare function expandHome(p: string): string;
+/**
+ * macOS keychain service name for a config home's Claude Code credentials.
+ * The default home (`~/.claude`) has no hash suffix; every other config home is
+ * suffixed with the first 8 hex of sha256(configHome) — verified empirically and
+ * matched by the official client.
+ */
+export declare function claudeCredentialService(configHome: string): string;
+/** Non-darwin credential file for a config home. */
+export declare function claudeCredentialFilePath(configHome: string): string;
+/** Default store: macOS keychain, else a per-config-home credentials file. */
+export declare const defaultCredentialStore: CredentialStore;
+/** Parse the `claudeAiOauth` block out of a config home's credential store. */
+export declare function readClaudeOauth(configHome: string, store?: CredentialStore): ClaudeOauth | null;
+/**
+ * Refresh a config home's Claude Code access token from its stored refresh token.
+ * Returns the new access token + expiry on success; otherwise a typed failure
+ * reason the caller maps to its `needs-reauth` decision. Writes NOTHING on any
+ * failure — a working login is never put at risk by an unsuccessful refresh.
+ */
+export declare function refreshClaudeToken(configHome: string, deps?: RefreshDeps): Promise<RefreshResult>;
+//# sourceMappingURL=OAuthRefresher.d.ts.map

package/dist/core/OAuthRefresher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthRefresher.d.ts","sourceRoot":"","sources":["../../src/core/OAuthRefresher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAQH,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,+CAA+C,CAAC;AAC7E,4EAA4E;AAC5E,eAAO,MAAM,qBAAqB,yCAAyC,CAAC;AAK5E,MAAM,MAAM,iBAAiB,GACzB,qBAAqB,GACrB,aAAa,GACb,kBAAkB,GAClB,iBAAiB,GACjB,oBAAoB,GACpB,cAAc,CAAC;AAEnB,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GACtE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9D,gFAAgF;AAChF,MAAM,WAAW,WAAW;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACxC,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;CACrD;AAED,mFAAmF;AACnF,MAAM,MAAM,YAAY,GAAG,CACzB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,KACpE,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,CAAC;AAE5E,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAK5C;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAMlE;AAED,oDAAoD;AACpD,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,8EAA8E;AAC9E,eAAO,MAAM,sBAAsB,EAAE,eAoDpC,CAAC;AAEF,+EAA+E;AAC/E,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,eAAwC,GAC9C,WAAW,GAAG,IAAI,CAUpB;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC,aAAa,CAAC,CA+ExB"}

package/dist/core/OAuthRefresher.js

@@ -0,0 +1,222 @@
+/**
+ * OAuthRefresher — mint a fresh Claude Code OAuth access token from its stored
+ * refresh token, so the QuotaPoller never falsely flags a still-valid login as
+ * `needs-reauth` (P1.2 hardening of the Subscription & Auth Standard).
+ *
+ * ── Why this exists (the bug it fixes) ──
+ * A Claude Code login holds TWO tokens in its config home's credential store:
+ *   - a short-lived ACCESS token (`sk-ant-oat…`, ~8–12h), and
+ *   - a long-lived REFRESH token (`sk-ant-ort…`, weeks→months).
+ * The `claude` client silently exchanges the refresh token for a new access
+ * token on every real use. The QuotaPoller reads the access token out-of-band
+ * and calls the usage endpoint directly — so when the access token has expired
+ * (which is routine, daily) but the refresh token is still perfectly valid, the
+ * usage read returns 401 and the poller wrongly marks the account `needs-reauth`.
+ * That cried wolf: the login is intact, only the access token lapsed. This module
+ * performs the same refresh-token exchange the client does, so a routine expiry
+ * recovers silently and `needs-reauth` is reserved for a genuinely dead login
+ * (refresh token revoked / password change) — exactly what SubscriptionPool's
+ * status comment already promises.
+ *
+ * ── Corruption safety (the load-bearing invariant) ──
+ * The ONLY way this module could harm a working login is by writing a bad
+ * credential back. So the write is gated three ways:
+ *   1. it happens ONLY on a fully-validated 200 response (new access token shaped
+ *      `sk-ant-oat…`, a positive numeric `expires_in`);
+ *   2. it is a READ-MERGE-WRITE — the existing credential JSON is re-read and only
+ *      the access token / refresh token / expiry are overwritten, so scopes,
+ *      subscriptionType, rateLimitTier and any unknown fields are preserved; and
+ *   3. if the server rotates the refresh token, the NEW one is persisted; if the
+ *      response omits a refresh token (non-rotating server), the existing one is
+ *      kept — never dropped.
+ * A wrong endpoint / client id / network failure can therefore only ever make the
+ * exchange FAIL (→ the caller's existing `needs-reauth` path), never corrupt.
+ *
+ * Token values are NEVER logged or returned to any persisted surface. The OAuth
+ * token endpoint + client id are the public Claude Code values, extracted from
+ * the official client binary (verified 2026-06-08).
+ *
+ * Testability: the credential store, the fetch surface, and the clock are all
+ * injectable, so the whole refresh runs hermetically with zero keychain, zero
+ * network, and a deterministic clock in tests.
+ */
+import { execFileSync } from 'node:child_process';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+/** Public Claude Code OAuth token endpoint (from the official client binary). */
+export const CLAUDE_TOKEN_URL = 'https://platform.claude.com/v1/oauth/token';
+/** Public Claude Code OAuth client id (from the official client binary). */
+export const CLAUDE_CODE_CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e';
+const ACCESS_PREFIX = 'sk-ant-oat';
+const REFRESH_PREFIX = 'sk-ant-ort';
+export function expandHome(p) {
+    if (p === '~' || p.startsWith('~/')) {
+        return path.join(process.env.HOME ?? '', p.slice(1));
+    }
+    return p;
+}
+/**
+ * macOS keychain service name for a config home's Claude Code credentials.
+ * The default home (`~/.claude`) has no hash suffix; every other config home is
+ * suffixed with the first 8 hex of sha256(configHome) — verified empirically and
+ * matched by the official client.
+ */
+export function claudeCredentialService(configHome) {
+    const home = expandHome(configHome);
+    const defaultHome = expandHome('~/.claude');
+    return home === defaultHome
+        ? 'Claude Code-credentials'
+        : `Claude Code-credentials-${crypto.createHash('sha256').update(home).digest('hex').slice(0, 8)}`;
+}
+/** Non-darwin credential file for a config home. */
+export function claudeCredentialFilePath(configHome) {
+    return path.join(expandHome(configHome), '.credentials.json');
+}
+/** Default store: macOS keychain, else a per-config-home credentials file. */
+export const defaultCredentialStore = {
+    read(configHome) {
+        if (process.platform === 'darwin') {
+            try {
+                const raw = execFileSync('security', ['find-generic-password', '-s', claudeCredentialService(configHome), '-w'], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+                return raw || null;
+            }
+            catch {
+                return null; // @silent-fallback-ok: no keychain entry → unreadable
+            }
+        }
+        try {
+            const p = claudeCredentialFilePath(configHome);
+            return fs.existsSync(p) ? fs.readFileSync(p, 'utf-8') : null;
+        }
+        catch {
+            return null; // @silent-fallback-ok: missing/unreadable creds file
+        }
+    },
+    write(configHome, rawJson) {
+        if (process.platform === 'darwin') {
+            try {
+                execFileSync('security', [
+                    'add-generic-password',
+                    '-U', // update the existing entry in place
+                    '-a',
+                    os.userInfo().username,
+                    '-s',
+                    claudeCredentialService(configHome),
+                    '-w',
+                    rawJson,
+                ], { stdio: ['ignore', 'ignore', 'ignore'] });
+                return true;
+            }
+            catch {
+                return false; // @silent-fallback-ok: keychain write failed → caller falls to needs-reauth
+            }
+        }
+        try {
+            const p = claudeCredentialFilePath(configHome);
+            fs.mkdirSync(path.dirname(p), { recursive: true });
+            fs.writeFileSync(p, rawJson, { mode: 0o600 });
+            return true;
+        }
+        catch {
+            return false; // @silent-fallback-ok: file write failed
+        }
+    },
+};
+/** Parse the `claudeAiOauth` block out of a config home's credential store. */
+export function readClaudeOauth(configHome, store = defaultCredentialStore) {
+    const raw = store.read(configHome);
+    if (!raw)
+        return null;
+    try {
+        const parsed = JSON.parse(raw);
+        const oauth = parsed?.claudeAiOauth;
+        return oauth && typeof oauth === 'object' ? oauth : null;
+    }
+    catch {
+        return null; // @silent-fallback-ok: unparseable entry
+    }
+}
+/**
+ * Refresh a config home's Claude Code access token from its stored refresh token.
+ * Returns the new access token + expiry on success; otherwise a typed failure
+ * reason the caller maps to its `needs-reauth` decision. Writes NOTHING on any
+ * failure — a working login is never put at risk by an unsuccessful refresh.
+ */
+export async function refreshClaudeToken(configHome, deps = {}) {
+    const store = deps.store ?? defaultCredentialStore;
+    const fetchImpl = deps.fetchImpl ??
+        ((url, init) => fetch(url, init));
+    const now = deps.now ?? (() => Date.now());
+    const tokenUrl = deps.tokenUrl ?? CLAUDE_TOKEN_URL;
+    const clientId = deps.clientId ?? CLAUDE_CODE_CLIENT_ID;
+    const raw = store.read(configHome);
+    if (!raw)
+        return { ok: false, reason: 'read-failed' };
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return { ok: false, reason: 'read-failed' };
+    }
+    const oauth = (parsed?.claudeAiOauth ?? null);
+    const refreshToken = oauth?.refreshToken;
+    if (typeof refreshToken !== 'string' || !refreshToken) {
+        return { ok: false, reason: 'no-refresh-token' };
+    }
+    let res;
+    try {
+        res = await fetchImpl(tokenUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                grant_type: 'refresh_token',
+                refresh_token: refreshToken,
+                client_id: clientId,
+            }),
+        });
+    }
+    catch {
+        return { ok: false, reason: 'exchange-failed' };
+    }
+    if (!res.ok)
+        return { ok: false, reason: 'exchange-failed', status: res.status };
+    let data;
+    try {
+        data = (await res.json());
+    }
+    catch {
+        return { ok: false, reason: 'malformed-response' };
+    }
+    const newAccess = data?.access_token;
+    const expiresIn = data?.expires_in;
+    if (typeof newAccess !== 'string' || !newAccess.startsWith(ACCESS_PREFIX)) {
+        return { ok: false, reason: 'malformed-response' };
+    }
+    if (typeof expiresIn !== 'number' || !Number.isFinite(expiresIn) || expiresIn <= 0) {
+        return { ok: false, reason: 'malformed-response' };
+    }
+    const newRefresh = data?.refresh_token;
+    const rotated = typeof newRefresh === 'string' &&
+        newRefresh.startsWith(REFRESH_PREFIX) &&
+        newRefresh !== refreshToken;
+    const expiresAt = now() + expiresIn * 1000;
+    // READ-MERGE-WRITE: preserve every existing field, overwrite only the tokens
+    // + expiry. Keep the old refresh token if the server didn't rotate.
+    const updatedOauth = {
+        ...oauth,
+        accessToken: newAccess,
+        refreshToken: typeof newRefresh === 'string' && newRefresh.startsWith(REFRESH_PREFIX)
+            ? newRefresh
+            : refreshToken,
+        expiresAt,
+    };
+    const updatedRaw = { ...parsed, claudeAiOauth: updatedOauth };
+    if (!store.write(configHome, JSON.stringify(updatedRaw))) {
+        return { ok: false, reason: 'write-failed' };
+    }
+    return { ok: true, accessToken: newAccess, expiresAt, rotated };
+}
+//# sourceMappingURL=OAuthRefresher.js.map

package/dist/core/OAuthRefresher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuthRefresher.js","sourceRoot":"","sources":["../../src/core/OAuthRefresher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,4CAA4C,CAAC;AAC7E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,qBAAqB,GAAG,sCAAsC,CAAC;AAE5E,MAAM,aAAa,GAAG,YAAY,CAAC;AACnC,MAAM,cAAc,GAAG,YAAY,CAAC;AA8CpC,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAkB;IACxD,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACpC,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IAC5C,OAAO,IAAI,KAAK,WAAW;QACzB,CAAC,CAAC,yBAAyB;QAC3B,CAAC,CAAC,2BAA2B,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AACtG,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,wBAAwB,CAAC,UAAkB;IACzD,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC,CAAC;AAChE,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,sBAAsB,GAAoB;IACrD,IAAI,CAAC,UAAkB;QACrB,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,YAAY,CACtB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,uBAAuB,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,EAC1E,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAC3D,CAAC,IAAI,EAAE,CAAC;gBACT,OAAO,GAAG,IAAI,IAAI,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,CAAC,sDAAsD;YACrE,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;YAC/C,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,qDAAqD;QACpE,CAAC;IACH,CAAC;IACD,KAAK,CAAC,UAAkB,EAAE,OAAe;QACvC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,YAAY,CACV,UAAU,EACV;oBACE,sBAAsB;oBACtB,IAAI,EAAE,qCAAqC;oBAC3C,IAAI;oBACJ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ;oBACtB,IAAI;oBACJ,uBAAuB,CAAC,UAAU,CAAC;oBACnC,IAAI;oBACJ,OAAO;iBACR,EACD,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAC1C,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC,CAAC,4EAA4E;YAC5F,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;YAC/C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,CAAC,yCAAyC;QACzD,CAAC;IACH,CAAC;CACF,CAAC;AAEF,+EAA+E;AAC/E,MAAM,UAAU,eAAe,CAC7B,UAAkB,EAClB,QAAyB,sBAAsB;IAE/C,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QAC1D,MAAM,KAAK,GAAG,MAAM,EAAE,aAAa,CAAC;QACpC,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAqB,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,yCAAyC;IACxD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAkB,EAClB,OAAoB,EAAE;IAEtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,sBAAsB,CAAC;IACnD,MAAM,SAAS,GACb,IAAI,CAAC,SAAS;QACd,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAmB,CAAwC,CAAC,CAAC;IAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,gBAAgB,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,qBAAqB,CAAC;IAExD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACtD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,IAAI,CAAuB,CAAC;IACpE,MAAM,YAAY,GAAG,KAAK,EAAE,YAAY,CAAC;IACzC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;QACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IAED,IAAI,GAAkE,CAAC;IACvE,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE;YAC9B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,YAAY;gBAC3B,SAAS,EAAE,QAAQ;aACpB,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IAEjF,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,EAAE,YAAY,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,EAAE,UAAU,CAAC;IACnC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,EAAE,aAAa,CAAC;IACvC,MAAM,OAAO,GACX,OAAO,UAAU,KAAK,QAAQ;QAC9B,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC;QACrC,UAAU,KAAK,YAAY,CAAC;IAE9B,MAAM,SAAS,GAAG,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;IAC3C,6EAA6E;IAC7E,oEAAoE;IACpE,MAAM,YAAY,GAAgB;QAChC,GAAG,KAAK;QACR,WAAW,EAAE,SAAS;QACtB,YAAY,EACV,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC;YACrE,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,YAAY;QAClB,SAAS;KACV,CAAC;IACF,MAAM,UAAU,GAAG,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;IAE9D,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAClE,CAAC"}

package/dist/core/QuotaPoller.d.ts

@@ -32,8 +32,15 @@
  * poller runs hermetically with zero credentials and zero network in tests.
  */
 import type { SubscriptionPool, SubscriptionAccount, AccountQuotaSnapshot } from './SubscriptionPool.js';
+import { type RefreshResult } from './OAuthRefresher.js';
 /** Injectable token resolver — returns an account's OAuth access token or null. */
 export type TokenResolver = (account: SubscriptionAccount) => string | null;
+/**
+ * Injectable account refresher — exchanges a config home's stored refresh token
+ * for a fresh access token (see OAuthRefresher). Defaults to the real keychain/
+ * file-backed refresh; tests inject a stub so the poller runs hermetically.
+ */
+export type AccountRefresher = (account: SubscriptionAccount) => Promise<RefreshResult>;
 /** Minimal fetch surface so tests inject a stub (no global fetch dependency). */
 export type FetchImpl = (url: string, init: {
     headers: Record<string, string>;
@@ -50,6 +57,12 @@ export interface QuotaPollerConfig {
     fetchImpl?: FetchImpl;
     /** Injected for tests; defaults to the config-home credential resolver. */
     tokenResolver?: TokenResolver;
+    /**
+     * Injected for tests; defaults to the real OAuth refresh-token exchange. On a
+     * usage-read auth failure the poller calls this BEFORE declaring needs-reauth,
+     * so a routine access-token expiry recovers silently instead of crying wolf.
+     */
+    refresher?: AccountRefresher;
     /** Logger (defaults to console). */
     logger?: {
         log: (m: string) => void;
@@ -66,10 +79,12 @@ export interface BurnRate {
 }
 /**
  * Resolve a claude-code account's OAuth access token from its config home,
- * TRANSIENTLY. Never persisted, never logged. macOS: the per-config-home
- * keychain entry `Claude Code-credentials-<sha256(configHome)[0:8]>` (verified
- * empirically). Linux/other: `<configHome>/.credentials.json`. The default
- * (`~/.claude`) keychain entry has no hash suffix.
+ * TRANSIENTLY. Never persisted, never logged. Reads via the shared OAuthRefresher
+ * locator (macOS keychain `Claude Code-credentials-<sha256(configHome)[0:8]>`,
+ * else `<configHome>/.credentials.json`) so the resolver and the refresher always
+ * agree on WHERE a config home's credentials live. NOTE: an EXPIRED access token
+ * is still returned here (it's a valid string) — expiry is detected by the usage
+ * read's 401 and recovered by the refresher, not by this resolver.
  */
 export declare function defaultTokenResolver(account: SubscriptionAccount): string | null;
 /**
@@ -92,6 +107,7 @@ export declare class QuotaPoller {
     private readonly pollIntervalMs;
     private readonly fetchImpl;
     private readonly tokenResolver;
+    private readonly refresher;
     private readonly logger;
     private interval;
     /** Most-recent snapshot per account id. */
@@ -101,10 +117,21 @@ export declare class QuotaPoller {
     constructor(config: QuotaPollerConfig);
     start(): void;
     stop(): void;
+    /**
+     * One usage read. Returns the parsed body (or null body on a non-auth non-ok),
+     * an auth-failed marker (401/403), or null on a network failure. NEVER logs the
+     * token.
+     */
+    private readUsage;
+    private markNeedsReauth;
     /**
      * Poll one account: resolve token transiently, read usage, map to snapshot.
-     * Returns null when the token is unresolvable or the read fails. NEVER logs
-     * or returns the token.
+     * On a usage-read auth failure (401/403) the access token may simply have
+     * EXPIRED while the refresh token is still valid — so the poller attempts a
+     * refresh-token exchange and ONE retry BEFORE declaring needs-reauth. Only a
+     * genuinely dead login (no refresh token / refresh rejected / still 401 after
+     * a fresh token) yields needs-reauth. Returns null when the token is
+     * unresolvable or the read fails. NEVER logs or returns the token.
      */
     pollAccount(account: SubscriptionAccount): Promise<AccountQuotaSnapshot | null>;
     /**

package/dist/core/QuotaPoller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"QuotaPoller.d.ts","sourceRoot":"","sources":["../../src/core/QuotaPoller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAMH,OAAO,KAAK,EACV,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACrB,MAAM,uBAAuB,CAAC;AAE/B,mFAAmF;AACnF,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,mBAAmB,KAAK,MAAM,GAAG,IAAI,CAAC;AAE5E,iFAAiF;AACjF,MAAM,MAAM,SAAS,GAAG,CACtB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,KACtC,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,CAAC;AAE5E,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,gBAAgB,CAAC;IACvB,wFAAwF;IACxF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,2EAA2E;IAC3E,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,oCAAoC;IACpC,MAAM,CAAC,EAAE;QAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CAClE;AAED,MAAM,WAAW,QAAQ;IACvB,iEAAiE;IACjE,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,wDAAwD;IACxD,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;CAChB;AAID;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAyChF;AASD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBlE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EACtC,MAAM,EAAE,MAAM,GACb,oBAAoB,CA0CtB;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAmB;IACxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0D;IACjF,OAAO,CAAC,QAAQ,CAA+C;IAC/D,2CAA2C;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2C;IACzE,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2C;gBAE7D,MAAM,EAAE,iBAAiB;IAUrC,KAAK,IAAI,IAAI;IAQb,IAAI,IAAI,IAAI;IAOZ;;;;OAIG;IACG,WAAW,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IA6CrF;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IA6B5D;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI;IAqB5C,2EAA2E;IAC3E,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI;CAG7D"}
+{"version":3,"file":"QuotaPoller.d.ts","sourceRoot":"","sources":["../../src/core/QuotaPoller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAIH,OAAO,KAAK,EACV,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAE7B,mFAAmF;AACnF,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,mBAAmB,KAAK,MAAM,GAAG,IAAI,CAAC;AAE5E;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAExF,iFAAiF;AACjF,MAAM,MAAM,SAAS,GAAG,CACtB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,KACtC,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,CAAC;AAE5E,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,gBAAgB,CAAC;IACvB,wFAAwF;IACxF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,2EAA2E;IAC3E,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;OAIG;IACH,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,oCAAoC;IACpC,MAAM,CAAC,EAAE;QAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CAClE;AAOD,MAAM,WAAW,QAAQ;IACvB,iEAAiE;IACjE,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,wDAAwD;IACxD,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;CAChB;AAID;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAOhF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBlE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EACtC,MAAM,EAAE,MAAM,GACb,oBAAoB,CA0CtB;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAmB;IACxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0D;IACjF,OAAO,CAAC,QAAQ,CAA+C;IAC/D,2CAA2C;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2C;IACzE,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2C;gBAE7D,MAAM,EAAE,iBAAiB;IAYrC,KAAK,IAAI,IAAI;IAQb,IAAI,IAAI,IAAI;IAOZ;;;;OAIG;YACW,SAAS;IAoBvB,OAAO,CAAC,eAAe;IASvB;;;;;;;;OAQG;IACG,WAAW,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAiDrF;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IA6B5D;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI;IAqB5C,2EAA2E;IAC3E,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI;CAG7D"}

package/dist/core/QuotaPoller.js

@@ -31,61 +31,26 @@
  * Testability: `fetchImpl` and `tokenResolver` are injectable so the whole
  * poller runs hermetically with zero credentials and zero network in tests.
  */
-import { execFileSync } from 'node:child_process';
-import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
+import { readClaudeOauth, refreshClaudeToken, expandHome, } from './OAuthRefresher.js';
 const USAGE_URL = 'https://api.anthropic.com/api/oauth/usage';
 /**
  * Resolve a claude-code account's OAuth access token from its config home,
- * TRANSIENTLY. Never persisted, never logged. macOS: the per-config-home
- * keychain entry `Claude Code-credentials-<sha256(configHome)[0:8]>` (verified
- * empirically). Linux/other: `<configHome>/.credentials.json`. The default
- * (`~/.claude`) keychain entry has no hash suffix.
+ * TRANSIENTLY. Never persisted, never logged. Reads via the shared OAuthRefresher
+ * locator (macOS keychain `Claude Code-credentials-<sha256(configHome)[0:8]>`,
+ * else `<configHome>/.credentials.json`) so the resolver and the refresher always
+ * agree on WHERE a config home's credentials live. NOTE: an EXPIRED access token
+ * is still returned here (it's a valid string) — expiry is detected by the usage
+ * read's 401 and recovered by the refresher, not by this resolver.
  */
 export function defaultTokenResolver(account) {
     if (account.provider !== 'anthropic' || account.framework !== 'claude-code') {
         return null;
     }
-    const configHome = expandHome(account.configHome);
-    // Linux / non-darwin: per-config-home credentials file.
-    if (process.platform !== 'darwin') {
-        try {
-            const credPath = path.join(configHome, '.credentials.json');
-            if (fs.existsSync(credPath)) {
-                const data = JSON.parse(fs.readFileSync(credPath, 'utf-8'));
-                const tok = data?.claudeAiOauth?.accessToken;
-                return typeof tok === 'string' && tok.startsWith('sk-ant-oat') ? tok : null;
-            }
-        }
-        catch {
-            // @silent-fallback-ok: missing/unreadable creds → unresolvable token (null)
-        }
-        return null;
-    }
-    // macOS: keychain service name, hash-suffixed by config-home path.
-    const defaultHome = expandHome('~/.claude');
-    const service = configHome === defaultHome
-        ? 'Claude Code-credentials'
-        : `Claude Code-credentials-${crypto.createHash('sha256').update(configHome).digest('hex').slice(0, 8)}`;
-    try {
-        const raw = execFileSync('security', ['find-generic-password', '-s', service, '-w'], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
-        if (!raw)
-            return null;
-        const data = JSON.parse(raw);
-        const tok = data?.claudeAiOauth?.accessToken;
-        return typeof tok === 'string' && tok.startsWith('sk-ant-oat') ? tok : null;
-    }
-    catch {
-        // @silent-fallback-ok: no keychain entry for this config home → null
-        return null;
-    }
-}
-function expandHome(p) {
-    if (p === '~' || p.startsWith('~/')) {
-        return path.join(process.env.HOME ?? '', p.slice(1));
-    }
-    return p;
+    const oauth = readClaudeOauth(account.configHome);
+    const tok = oauth?.accessToken;
+    return typeof tok === 'string' && tok.startsWith('sk-ant-oat') ? tok : null;
 }
 /**
  * Read the account email (`oauthAccount.emailAddress`) Claude Code records for a
@@ -169,6 +134,7 @@ export class QuotaPoller {
     pollIntervalMs;
     fetchImpl;
     tokenResolver;
+    refresher;
     logger;
     interval = null;
     /** Most-recent snapshot per account id. */
@@ -182,6 +148,8 @@ export class QuotaPoller {
             config.fetchImpl ??
                 ((url, init) => fetch(url, init));
         this.tokenResolver = config.tokenResolver ?? defaultTokenResolver;
+        this.refresher =
+            config.refresher ?? ((account) => refreshClaudeToken(expandHome(account.configHome)));
         this.logger = config.logger ?? { log: () => { }, warn: () => { } };
     }
     start() {
@@ -199,18 +167,11 @@ export class QuotaPoller {
         }
     }
     /**
-     * Poll one account: resolve token transiently, read usage, map to snapshot.
-     * Returns null when the token is unresolvable or the read fails. NEVER logs
-     * or returns the token.
+     * One usage read. Returns the parsed body (or null body on a non-auth non-ok),
+     * an auth-failed marker (401/403), or null on a network failure. NEVER logs the
+     * token.
      */
-    async pollAccount(account) {
-        const token = this.tokenResolver(account);
-        if (!token) {
-            this.logger.warn(`[QuotaPoller] no resolvable token for account ${account.id} — skipping`);
-            return null;
-        }
-        let body = null;
-        let authFailed = false;
+    async readUsage(token) {
         try {
             const res = await this.fetchImpl(USAGE_URL, {
                 headers: {
@@ -220,26 +181,72 @@ export class QuotaPoller {
                 },
             });
             if (res.ok) {
-                body = (await res.json());
-            }
-            else if (res.status === 401 || res.status === 403) {
-                authFailed = true;
+                return { authFailed: false, body: (await res.json()) };
             }
+            if (res.status === 401 || res.status === 403)
+                return { authFailed: true };
+            return { authFailed: false, body: null }; // 5xx etc. → no snapshot, not auth
         }
         catch {
             // @silent-fallback-ok: network failure → no snapshot this cycle (retry next)
             return null;
         }
-        if (authFailed) {
-            // Genuine auth failure (revoked / password change) — surface for re-auth.
+    }
+    markNeedsReauth(account, reason) {
+        try {
+            this.pool.update(account.id, { status: 'needs-reauth' });
+        }
+        catch {
+            // @silent-fallback-ok: pool update best-effort; status reflects next read
+        }
+        this.logger.warn(`[QuotaPoller] account ${account.id} → needs-reauth (${reason})`);
+    }
+    /**
+     * Poll one account: resolve token transiently, read usage, map to snapshot.
+     * On a usage-read auth failure (401/403) the access token may simply have
+     * EXPIRED while the refresh token is still valid — so the poller attempts a
+     * refresh-token exchange and ONE retry BEFORE declaring needs-reauth. Only a
+     * genuinely dead login (no refresh token / refresh rejected / still 401 after
+     * a fresh token) yields needs-reauth. Returns null when the token is
+     * unresolvable or the read fails. NEVER logs or returns the token.
+     */
+    async pollAccount(account) {
+        const token = this.tokenResolver(account);
+        if (!token) {
+            this.logger.warn(`[QuotaPoller] no resolvable token for account ${account.id} — skipping`);
+            return null;
+        }
+        const read = await this.readUsage(token);
+        if (read === null)
+            return null; // network failure
+        let body;
+        if (read.authFailed) {
+            const refreshed = await this.refresher(account);
+            if (!refreshed.ok) {
+                // No refresh token, or the exchange was rejected — genuine re-auth.
+                this.markNeedsReauth(account, refreshed.reason);
+                return null;
+            }
+            const retry = await this.readUsage(refreshed.accessToken);
+            if (retry === null)
+                return null; // network blip on the retry → next cycle
+            if (retry.authFailed) {
+                // Fresh token still rejected — treat as genuinely failed.
+                this.markNeedsReauth(account, 'usage still auth-failed after refresh');
+                return null;
+            }
+            // Recovered silently — no operator action needed. Record for visibility.
             try {
-                this.pool.update(account.id, { status: 'needs-reauth' });
+                this.pool.update(account.id, { lastRefreshAt: new Date().toISOString() });
             }
             catch {
-                // @silent-fallback-ok: pool update best-effort; status reflects next read
+                // @silent-fallback-ok: visibility-only write
             }
-            this.logger.warn(`[QuotaPoller] account ${account.id} usage read returned auth error → needs-reauth`);
-            return null;
+            this.logger.log(`[QuotaPoller] account ${account.id} access token refreshed silently (no re-auth needed)`);
+            body = retry.body;
+        }
+        else {
+            body = read.body;
         }
         if (!body)
             return null;

package/dist/core/QuotaPoller.js.map

@@ -1 +1 @@
-{"version":3,"file":"QuotaPoller.js","sourceRoot":"","sources":["../../src/core/QuotaPoller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAqC7B,MAAM,SAAS,GAAG,2CAA2C,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA4B;IAC/D,IAAI,OAAO,CAAC,QAAQ,KAAK,WAAW,IAAI,OAAO,CAAC,SAAS,KAAK,aAAa,EAAE,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAElD,wDAAwD;IACxD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;YAC5D,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC5D,MAAM,GAAG,GAAG,IAAI,EAAE,aAAa,EAAE,WAAW,CAAC;gBAC7C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9E,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;QAC9E,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mEAAmE;IACnE,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,OAAO,GACX,UAAU,KAAK,WAAW;QACxB,CAAC,CAAC,yBAAyB;QAC3B,CAAC,CAAC,2BAA2B,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC5G,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CACtB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAC9C,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAC3D,CAAC,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,EAAE,aAAa,EAAE,WAAW,CAAC;QAC7C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IACrD,IAAI,IAAI,KAAK,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACrC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;gBAAE,SAAS;YAChC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,CAAC,EAAE,YAAY,EAAE,YAAY,CAAC;YAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;QACrE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAA6B,EAC7B,MAAsC,EACtC,MAAc;IAEd,MAAM,IAAI,GAAyB,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAElE,MAAM,GAAG,GAAG,CAAC,CAAU,EAA4D,EAAE;QACnF,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAClD,MAAM,CAAC,GAAG,CAA4B,CAAC;QACvC,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC/E,OAAO;YACL,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC;YAC1C,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;SACpC,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IACpC,IAAI,IAAI;QAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IACrC,IAAI,KAAK;QAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;IAEjC,MAAM,QAAQ,GAAkC,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI;QACzB,CAAC,kBAAkB,EAAE,QAAQ,CAAC;QAC9B,CAAC,gBAAgB,EAAE,MAAM,CAAC;KAClB,EAAE,CAAC;QACX,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAI,CAA6B,CAAC,WAAW,CAAC;YACrD,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAE/D,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;IAClC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG;YAChB,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;YAChC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC;YACxC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC;SAC3C,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,WAAW;IACL,IAAI,CAAmB;IACvB,cAAc,CAAS;IACvB,SAAS,CAAY;IACrB,aAAa,CAAgB;IAC7B,MAAM,CAA0D;IACzE,QAAQ,GAA0C,IAAI,CAAC;IAC/D,2CAA2C;IAC1B,aAAa,GAAG,IAAI,GAAG,EAAgC,CAAC;IACzE,iFAAiF;IAChE,aAAa,GAAG,IAAI,GAAG,EAAgC,CAAC;IAEzE,YAAY,MAAyB;QACnC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE,GAAG,MAAM,CAAC;QAC3D,IAAI,CAAC,SAAS;YACZ,MAAM,CAAC,SAAS;gBAChB,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAmB,CAAqC,CAAC,CAAC;QACvF,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,oBAAoB,CAAC;QAClE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC;IACnE,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,IAAI,CAAC,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;YAC/B,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACtB,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;IAC1B,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,OAA4B;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iDAAiD,OAAO,CAAC,EAAE,aAAa,CAAC,CAAC;YAC3F,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAI,GAAmC,IAAI,CAAC;QAChD,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE;gBAC1C,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,KAAK,EAAE;oBAChC,gBAAgB,EAAE,kBAAkB;oBACpC,mBAAmB,EAAE,YAAY;iBAClC;aACF,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YACvD,CAAC;iBAAM,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACpD,UAAU,GAAG,IAAI,CAAC;YACpB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6EAA6E;YAC7E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,UAAU,EAAE,CAAC;YACf,0EAA0E;YAC1E,IAAI,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAC3D,CAAC;YAAC,MAAM,CAAC;gBACP,0EAA0E;YAC5E,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,OAAO,CAAC,EAAE,gDAAgD,CAAC,CAAC;YACtG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,EAAE,+BAA+B,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/F,6EAA6E;QAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,SAAS;YAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACvC,IAAI,OAAO,CAAC,QAAQ,KAAK,WAAW,IAAI,OAAO,CAAC,SAAS,KAAK,aAAa;gBAAE,SAAS;YACtF,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU;gBAAE,SAAS;YAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,EAAE,CAAC;gBACT,SAAS;YACX,CAAC;YACD,MAAM,EAAE,CAAC;YACT,MAAM,KAAK,GAA8C,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAC7E,0EAA0E;YAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,cAAc;gBAAE,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC;YAC/D,2EAA2E;YAC3E,2EAA2E;YAC3E,oEAAoE;YACpE,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACnD,IAAI,KAAK,IAAI,KAAK,KAAK,OAAO,CAAC,KAAK;gBAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;YAC1D,IAAI,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,4EAA4E;YAC9E,CAAC;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,SAAiB;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAC7E,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1E,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;QACjC,MAAM,KAAK,GAAG,CACZ,CAA8B,EAC9B,CAA8B,EACf,EAAE,CACjB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,OAAO;YACL,kBAAkB,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC;YAC1D,kBAAkB,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC;YAC1D,MAAM;SACP,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,YAAY,CAAC,SAAiB;QAC5B,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;IACnD,CAAC;CACF"}
+{"version":3,"file":"QuotaPoller.js","sourceRoot":"","sources":["../../src/core/QuotaPoller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAM7B,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,UAAU,GAEX,MAAM,qBAAqB,CAAC;AAkD7B,MAAM,SAAS,GAAG,2CAA2C,CAAC;AAE9D;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA4B;IAC/D,IAAI,OAAO,CAAC,QAAQ,KAAK,WAAW,IAAI,OAAO,CAAC,SAAS,KAAK,aAAa,EAAE,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,KAAK,EAAE,WAAW,CAAC;IAC/B,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IACrD,IAAI,IAAI,KAAK,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACrC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;gBAAE,SAAS;YAChC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,CAAC,EAAE,YAAY,EAAE,YAAY,CAAC;YAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;QACrE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAA6B,EAC7B,MAAsC,EACtC,MAAc;IAEd,MAAM,IAAI,GAAyB,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAElE,MAAM,GAAG,GAAG,CAAC,CAAU,EAA4D,EAAE;QACnF,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAClD,MAAM,CAAC,GAAG,CAA4B,CAAC;QACvC,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC/E,OAAO;YACL,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC;YAC1C,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;SACpC,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IACpC,IAAI,IAAI;QAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IACrC,IAAI,KAAK;QAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;IAEjC,MAAM,QAAQ,GAAkC,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI;QACzB,CAAC,kBAAkB,EAAE,QAAQ,CAAC;QAC9B,CAAC,gBAAgB,EAAE,MAAM,CAAC;KAClB,EAAE,CAAC;QACX,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAI,CAA6B,CAAC,WAAW,CAAC;YACrD,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAE/D,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;IAClC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG;YAChB,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;YAChC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC;YACxC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC;SAC3C,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,WAAW;IACL,IAAI,CAAmB;IACvB,cAAc,CAAS;IACvB,SAAS,CAAY;IACrB,aAAa,CAAgB;IAC7B,SAAS,CAAmB;IAC5B,MAAM,CAA0D;IACzE,QAAQ,GAA0C,IAAI,CAAC;IAC/D,2CAA2C;IAC1B,aAAa,GAAG,IAAI,GAAG,EAAgC,CAAC;IACzE,iFAAiF;IAChE,aAAa,GAAG,IAAI,GAAG,EAAgC,CAAC;IAEzE,YAAY,MAAyB;QACnC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE,GAAG,MAAM,CAAC;QAC3D,IAAI,CAAC,SAAS;YACZ,MAAM,CAAC,SAAS;gBAChB,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAmB,CAAqC,CAAC,CAAC;QACvF,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,oBAAoB,CAAC;QAClE,IAAI,CAAC,SAAS;YACZ,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACxF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC;IACnE,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,IAAI,CAAC,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;YAC/B,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACtB,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;IAC1B,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,SAAS,CAAC,KAAa;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE;gBAC1C,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,KAAK,EAAE;oBAChC,gBAAgB,EAAE,kBAAkB;oBACpC,mBAAmB,EAAE,YAAY;iBAClC;aACF,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,EAAE,CAAC;YACpF,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YAC1E,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,mCAAmC;QAC/E,CAAC;QAAC,MAAM,CAAC;YACP,6EAA6E;YAC7E,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,OAA4B,EAAE,MAAc;QAClE,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,OAAO,CAAC,EAAE,oBAAoB,MAAM,GAAG,CAAC,CAAC;IACrF,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CAAC,OAA4B;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iDAAiD,OAAO,CAAC,EAAE,aAAa,CAAC,CAAC;YAC3F,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB;QAElD,IAAI,IAAoC,CAAC;QACzC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAChD,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;gBAClB,oEAAoE;gBACpE,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;gBAChD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YAC1D,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC,CAAC,yCAAyC;YAC1E,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;gBACrB,0DAA0D;gBAC1D,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,uCAAuC,CAAC,CAAC;gBACvE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,yEAAyE;YACzE,IAAI,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC5E,CAAC;YAAC,MAAM,CAAC;gBACP,6CAA6C;YAC/C,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,yBAAyB,OAAO,CAAC,EAAE,sDAAsD,CAC1F,CAAC;YACF,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,EAAE,+BAA+B,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/F,6EAA6E;QAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,SAAS;YAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACvC,IAAI,OAAO,CAAC,QAAQ,KAAK,WAAW,IAAI,OAAO,CAAC,SAAS,KAAK,aAAa;gBAAE,SAAS;YACtF,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU;gBAAE,SAAS;YAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,EAAE,CAAC;gBACT,SAAS;YACX,CAAC;YACD,MAAM,EAAE,CAAC;YACT,MAAM,KAAK,GAA8C,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAC7E,0EAA0E;YAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,cAAc;gBAAE,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC;YAC/D,2EAA2E;YAC3E,2EAA2E;YAC3E,oEAAoE;YACpE,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACnD,IAAI,KAAK,IAAI,KAAK,KAAK,OAAO,CAAC,KAAK;gBAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;YAC1D,IAAI,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,4EAA4E;YAC9E,CAAC;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,SAAiB;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAC7E,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1E,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;QACjC,MAAM,KAAK,GAAG,CACZ,CAA8B,EAC9B,CAA8B,EACf,EAAE,CACjB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,OAAO;YACL,kBAAkB,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC;YAC1D,kBAAkB,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC;YAC1D,MAAM;SACP,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,YAAY,CAAC,SAAiB;QAC5B,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;IACnD,CAAC;CACF"}

package/dist/core/SubscriptionPool.d.ts

@@ -92,6 +92,13 @@ export interface SubscriptionAccount {
     enrolledAt: string;
     /** ISO timestamp the account was last selected for a session. */
     lastUsedAt?: string;
+    /**
+     * ISO timestamp the poller last silently refreshed this account's access token
+     * from its refresh token (P1.2 hardening). Visibility only — lets the dashboard
+     * show "token auto-refreshed" so a routine access-token expiry reads as healthy
+     * rather than a re-auth event.
+     */
+    lastRefreshAt?: string;
     /** Monotonic version for optimistic CAS in update(). */
     version: number;
 }
@@ -117,6 +124,7 @@ export interface UpdateAccountInput {
     status?: SubscriptionAccountStatus;
     lastQuota?: AccountQuotaSnapshot | null;
     lastUsedAt?: string;
+    lastRefreshAt?: string;
     email?: string;
 }
 export declare class ValidationError extends Error {

package/dist/core/SubscriptionPool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SubscriptionPool.d.ts","sourceRoot":"","sources":["../../src/core/SubscriptionPool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAIlD,uEAAuE;AACvE,MAAM,MAAM,oBAAoB,GAC5B,WAAW,GACX,QAAQ,GACR,gBAAgB,GAChB,QAAQ,CAAC;AAEb,gDAAgD;AAChD,MAAM,MAAM,qBAAqB,GAC7B,aAAa,GACb,WAAW,GACX,YAAY,GACZ,QAAQ,CAAC;AAEb;;;;;;;GAOG;AACH,MAAM,MAAM,yBAAyB,GACjC,QAAQ,GACR,SAAS,GACT,cAAc,GACd,cAAc,GACd,UAAU,CAAC;AAEf;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,QAAQ,CAAC,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,UAAU,CAAC,EAAE;QACX,SAAS,EAAE,OAAO,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,sEAAsE;IACtE,MAAM,CAAC,EAAE,0BAA0B,GAAG,+BAA+B,CAAC;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB;;;gFAG4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wBAAwB;IACxB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,iDAAiD;IACjD,SAAS,EAAE,qBAAqB,CAAC;IACjC;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,wBAAwB;IACxB,MAAM,EAAE,yBAAyB,CAAC;IAClC,mEAAmE;IACnE,SAAS,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACxC,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC;CACjB;AAQD,MAAM,WAAW,sBAAsB;IACrC,6FAA6F;IAC7F,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,yBAAyB,CAAC;IACnC,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,uFAAuF;AACvF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,yBAAyB,CAAC;IACnC,SAAS,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAyCD,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,KAAK,CAAwB;gBAEzB,MAAM,EAAE,sBAAsB;IAO1C,sEAAsE;IACtE,IAAI,IAAI,mBAAmB,EAAE;IAI7B,kCAAkC;IAClC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI;IAK3C,gEAAgE;IAChE,IAAI,IAAI,MAAM;IAMd;;;;OAIG;IACH,GAAG,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,mBAAmB;IA4CpF;;;;OAIG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,mBAAmB,GAAG,IAAI;IA6C7G,0DAA0D;IAC1D,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAU3B,SAAS,IAAI,eAAe;IAc5B,OAAO,CAAC,wBAAwB;IAWhC,OAAO,CAAC,IAAI;IAoBZ,OAAO,CAAC,IAAI;CAab"}
+{"version":3,"file":"SubscriptionPool.d.ts","sourceRoot":"","sources":["../../src/core/SubscriptionPool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAIlD,uEAAuE;AACvE,MAAM,MAAM,oBAAoB,GAC5B,WAAW,GACX,QAAQ,GACR,gBAAgB,GAChB,QAAQ,CAAC;AAEb,gDAAgD;AAChD,MAAM,MAAM,qBAAqB,GAC7B,aAAa,GACb,WAAW,GACX,YAAY,GACZ,QAAQ,CAAC;AAEb;;;;;;;GAOG;AACH,MAAM,MAAM,yBAAyB,GACjC,QAAQ,GACR,SAAS,GACT,cAAc,GACd,cAAc,GACd,UAAU,CAAC;AAEf;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,QAAQ,CAAC,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,UAAU,CAAC,EAAE;QACX,SAAS,EAAE,OAAO,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,sEAAsE;IACtE,MAAM,CAAC,EAAE,0BAA0B,GAAG,+BAA+B,CAAC;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB;;;gFAG4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wBAAwB;IACxB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,iDAAiD;IACjD,SAAS,EAAE,qBAAqB,CAAC;IACjC;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,wBAAwB;IACxB,MAAM,EAAE,yBAAyB,CAAC;IAClC,mEAAmE;IACnE,SAAS,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACxC,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC;CACjB;AAQD,MAAM,WAAW,sBAAsB;IACrC,6FAA6F;IAC7F,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,qBAAqB,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,yBAAyB,CAAC;IACnC,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,uFAAuF;AACvF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,yBAAyB,CAAC;IACnC,SAAS,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAyCD,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,KAAK,CAAwB;gBAEzB,MAAM,EAAE,sBAAsB;IAO1C,sEAAsE;IACtE,IAAI,IAAI,mBAAmB,EAAE;IAI7B,kCAAkC;IAClC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI;IAK3C,gEAAgE;IAChE,IAAI,IAAI,MAAM;IAMd;;;;OAIG;IACH,GAAG,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,mBAAmB;IA4CpF;;;;OAIG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,mBAAmB,GAAG,IAAI;IAgD7G,0DAA0D;IAC1D,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAU3B,SAAS,IAAI,eAAe;IAc5B,OAAO,CAAC,wBAAwB;IAWhC,OAAO,CAAC,IAAI;IAoBZ,OAAO,CAAC,IAAI;CAab"}

package/dist/core/SubscriptionPool.js

@@ -186,6 +186,9 @@ export class SubscriptionPool {
         if (patch.lastUsedAt !== undefined) {
             acct.lastUsedAt = patch.lastUsedAt;
         }
+        if (patch.lastRefreshAt !== undefined) {
+            acct.lastRefreshAt = patch.lastRefreshAt;
+        }
         if (patch.email !== undefined) {
             const em = patch.email.trim();
             acct.email = em || undefined;

package/dist/core/SubscriptionPool.js.map

@@ -1 +1 @@
-{"version":3,"file":"SubscriptionPool.js","sourceRoot":"","sources":["../../src/core/SubscriptionPool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAqH7B,MAAM,KAAK,GAAG,cAAc,CAAC;AAC7B,MAAM,SAAS,GAAoC;IACjD,WAAW;IACX,QAAQ;IACR,gBAAgB;IAChB,QAAQ;CACT,CAAC;AACF,MAAM,UAAU,GAAqC;IACnD,aAAa;IACb,WAAW;IACX,YAAY;IACZ,QAAQ;CACT,CAAC;AACF,MAAM,QAAQ,GAAyC;IACrD,QAAQ;IACR,SAAS;IACT,cAAc;IACd,cAAc;IACd,UAAU;CACX,CAAC;AAEF;;;;GAIG;AACH,MAAM,2BAA2B,GAAG;IAClC,aAAa;IACb,cAAc;IACd,OAAO;IACP,QAAQ;IACR,SAAS;IACT,YAAY;IACZ,aAAa;IACb,QAAQ;IACR,UAAU;IACV,OAAO;CACR,CAAC;AAEF,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,OAAO,gBAAgB;IACnB,SAAS,CAAS;IAClB,KAAK,CAAwB;IAErC,YAAY,MAA8B;QACxC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAC;QACtE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,oEAAoE;IAEpE,sEAAsE;IACtE,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,kCAAkC;IAClC,GAAG,CAAC,EAAU;QACZ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACrC,CAAC;IAED,gEAAgE;IAChE,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;IACpC,CAAC;IAED,oEAAoE;IAEpE;;;;OAIG;IACH,GAAG,CAAC,KAAsB,EAAE,QAAkC;QAC5D,IAAI,CAAC,wBAAwB,CAAC,KAA2C,CAAC,CAAC;QAC3E,IAAI,QAAQ;YAAE,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QAEtD,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,eAAe,CAAC,gBAAgB,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,eAAe,CAAC,4BAA4B,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,eAAe,CAAC,sBAAsB,CAAC,CAAC;QACjE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,eAAe,CAAC,4BAA4B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,eAAe,CAAC,6BAA6B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,eAAe,CAAC,wBAAwB,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,eAAe,CAAC,0BAA0B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,OAAO,GAAwB;YACnC,EAAE;YACF,QAAQ;YACR,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU;YACV,MAAM;YACN,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,OAAO,EAAE,CAAC;SACX,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;IACxB,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,EAAU,EAAE,KAAyB,EAAE,QAAkC;QAC9E,IAAI,CAAC,wBAAwB,CAAC,KAA2C,CAAC,CAAC;QAC3E,IAAI,QAAQ;YAAE,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QAEtD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,eAAe,CAAC,0BAA0B,CAAC,CAAC;YAC/D,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;QACrB,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,eAAe,CAAC,6BAA6B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QACnC,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,eAAe,CAAC,4BAA4B,CAAC,CAAC;YACjE,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACvB,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,eAAe,CAAC,0BAA0B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC7B,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QACnC,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACnC,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACrC,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,CAAC,KAAK,GAAG,EAAE,IAAI,SAAS,CAAC;QAC/B,CAAC;QAED,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;QAClB,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IACrB,CAAC;IAED,0DAA0D;IAC1D,MAAM,CAAC,EAAU;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC1C,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;QACpD,IAAI,OAAO;YAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,oEAAoE;IAEpE,SAAS;QACP,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CACvC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CACvD,CAAC,MAAM,CAAC;QACT,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,GAAG,KAAK,gBAAgB,MAAM,SAAS;YAChD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC;IAED,oEAAoE;IAE5D,wBAAwB,CAAC,GAA4B;QAC3D,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO;QAC5C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,IAAI,2BAA2B,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,eAAe,CACvB,kEAAkE,GAAG,kBAAkB,CACxF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAEO,IAAI;QACV,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;gBAClE,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC/D,4DAA4D;oBAC5D,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;wBAC9B,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;4BAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;oBACnD,CAAC;oBACD,OAAO,IAA6B,CAAC;gBACvC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,uEAAuE;YACvE,wEAAwE;QAC1E,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAC9E,CAAC;IAEO,IAAI;QACV,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;YACvD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACtE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,qEAAqE;QACvE,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"SubscriptionPool.js","sourceRoot":"","sources":["../../src/core/SubscriptionPool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AA6H7B,MAAM,KAAK,GAAG,cAAc,CAAC;AAC7B,MAAM,SAAS,GAAoC;IACjD,WAAW;IACX,QAAQ;IACR,gBAAgB;IAChB,QAAQ;CACT,CAAC;AACF,MAAM,UAAU,GAAqC;IACnD,aAAa;IACb,WAAW;IACX,YAAY;IACZ,QAAQ;CACT,CAAC;AACF,MAAM,QAAQ,GAAyC;IACrD,QAAQ;IACR,SAAS;IACT,cAAc;IACd,cAAc;IACd,UAAU;CACX,CAAC;AAEF;;;;GAIG;AACH,MAAM,2BAA2B,GAAG;IAClC,aAAa;IACb,cAAc;IACd,OAAO;IACP,QAAQ;IACR,SAAS;IACT,YAAY;IACZ,aAAa;IACb,QAAQ;IACR,UAAU;IACV,OAAO;CACR,CAAC;AAEF,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,OAAO,gBAAgB;IACnB,SAAS,CAAS;IAClB,KAAK,CAAwB;IAErC,YAAY,MAA8B;QACxC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAC;QACtE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,oEAAoE;IAEpE,sEAAsE;IACtE,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,kCAAkC;IAClC,GAAG,CAAC,EAAU;QACZ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACrC,CAAC;IAED,gEAAgE;IAChE,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;IACpC,CAAC;IAED,oEAAoE;IAEpE;;;;OAIG;IACH,GAAG,CAAC,KAAsB,EAAE,QAAkC;QAC5D,IAAI,CAAC,wBAAwB,CAAC,KAA2C,CAAC,CAAC;QAC3E,IAAI,QAAQ;YAAE,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QAEtD,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,eAAe,CAAC,gBAAgB,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,eAAe,CAAC,4BAA4B,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,eAAe,CAAC,sBAAsB,CAAC,CAAC;QACjE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,eAAe,CAAC,4BAA4B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,eAAe,CAAC,6BAA6B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,eAAe,CAAC,wBAAwB,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,eAAe,CAAC,0BAA0B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,OAAO,GAAwB;YACnC,EAAE;YACF,QAAQ;YACR,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU;YACV,MAAM;YACN,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,OAAO,EAAE,CAAC;SACX,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;IACxB,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,EAAU,EAAE,KAAyB,EAAE,QAAkC;QAC9E,IAAI,CAAC,wBAAwB,CAAC,KAA2C,CAAC,CAAC;QAC3E,IAAI,QAAQ;YAAE,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QAEtD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,eAAe,CAAC,0BAA0B,CAAC,CAAC;YAC/D,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;QACrB,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,eAAe,CAAC,6BAA6B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QACnC,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,eAAe,CAAC,4BAA4B,CAAC,CAAC;YACjE,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACvB,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,eAAe,CAAC,0BAA0B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC7B,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QACnC,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACnC,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACrC,CAAC;QACD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;QAC3C,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,CAAC,KAAK,GAAG,EAAE,IAAI,SAAS,CAAC;QAC/B,CAAC;QAED,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;QAClB,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IACrB,CAAC;IAED,0DAA0D;IAC1D,MAAM,CAAC,EAAU;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC1C,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;QACpD,IAAI,OAAO;YAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,oEAAoE;IAEpE,SAAS;QACP,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CACvC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CACvD,CAAC,MAAM,CAAC;QACT,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,GAAG,KAAK,gBAAgB,MAAM,SAAS;YAChD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC;IAED,oEAAoE;IAE5D,wBAAwB,CAAC,GAA4B;QAC3D,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO;QAC5C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,IAAI,2BAA2B,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,eAAe,CACvB,kEAAkE,GAAG,kBAAkB,CACxF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAEO,IAAI;QACV,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;gBAClE,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC/D,4DAA4D;oBAC5D,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;wBAC9B,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;4BAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;oBACnD,CAAC;oBACD,OAAO,IAA6B,CAAC;gBACvC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,uEAAuE;YACvE,wEAAwE;QAC1E,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAC9E,CAAC;IAEO,IAAI;QACV,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;YACvD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACtE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,qEAAqE;QACvE,CAAC;IACH,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.431",
+  "version": "1.3.432",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-08T08:31:50.678Z",
-  "instarVersion": "1.3.431",
+  "generatedAt": "2026-06-08T20:59:17.649Z",
+  "instarVersion": "1.3.432",
   "entryCount": 199,
   "entries": {
     "hook:session-start": {

package/upgrades/1.3.432.md

@@ -0,0 +1,27 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+The subscription-pool quota poller now auto-refreshes an expired OAuth access token from its stored refresh token before declaring an account `needs-reauth`. Previously any 401/403 from the usage endpoint was treated as a dead login — but a Claude Code access token expires routinely (~8–12h) while its refresh token stays valid for weeks, so the poller was wrongly flagging healthy accounts as needing re-authentication every time the short-lived token lapsed.
+
+New `OAuthRefresher` performs the `refresh_token` grant against the public Claude Code OAuth token endpoint and writes the rotated credential back corruption-safely (validated-200 only, read-merge-write preserving all fields, fail-closed on any error). `QuotaPoller` calls it on a 401 and retries once; only a genuinely dead refresh token now yields `needs-reauth`. A new optional `lastRefreshAt` field plus a dashboard "Token auto-refreshed" line make the silent refresh visible.
+
+## What to Tell Your User
+
+Your accounts no longer ask you to sign in again just because a day went by. A Claude login actually holds two keys — a short-lived one that turns over every several hours, and a long-lived one that lasts weeks. I now renew the short-lived key automatically using the long-lived one, exactly the way the Claude app does, so a routine daily expiry is invisible to you. I'll only ask you to sign in again when the real login is genuinely gone — a password change, a sign-out, or a new login elsewhere. The dashboard also shows a small "token auto-refreshed" note so you can see I'm handling it.
+
+## Summary of New Capabilities
+
+| Capability | How to Use |
+|-----------|-----------|
+| Auto-refresh of expired access tokens | automatic (subscription-pool quota poller) |
+| Token-health visibility | Subscriptions dashboard tab — "Token auto-refreshed" line |
+
+## Evidence
+
+Reproduction (live, 2026-06-08, echo's two enrolled max accounts): both showed `status: needs-reauth` and a fresh `POST /subscription-pool/poll` failed 2/2. Inspecting the macOS keychain entries (`Claude Code-credentials-5939f6c8` / `-63465191`) showed `hasRefreshToken: true` with the access token `expiresAt` ~11–12h in the past — i.e. only the short-lived token had lapsed; the login was intact. The old code path mapped that 401 straight to `needs-reauth`.
+
+After the fix: the unit/integration/e2e suites reproduce the exact sequence (usage read 401 → refresh-token exchange → retry 200) and assert the account stays `active` with a `lastRefreshAt` stamp rather than flipping to `needs-reauth`; the dead-refresh-token case still flips to `needs-reauth`. All three tiers green (`tests/unit/oauth-refresher.test.ts`, `tests/unit/quota-poller.test.ts`, `tests/integration/subscription-quota-routes.test.ts`, `tests/e2e/subscription-quota-lifecycle.test.ts`), tsc + repo lint clean.

package/upgrades/side-effects/subscription-token-autorefresh.md

@@ -0,0 +1,29 @@
+# Side-effects review — subscription-pool OAuth access-token auto-refresh
+
+## What changed
+- New `src/core/OAuthRefresher.ts`: a corruption-safe refresh-token→access-token exchange for a config home's Claude Code credential (keychain on macOS, `<configHome>/.credentials.json` elsewhere). Endpoint + client id are the public Claude Code values extracted from the official client binary.
+- `src/core/QuotaPoller.ts`: on a usage-read 401/403 the poller now attempts a refresh + one retry BEFORE marking the account `needs-reauth`. `defaultTokenResolver` refactored to share the OAuthRefresher locator (single source of truth for where a config home's credential lives).
+- `src/core/SubscriptionPool.ts`: new optional `lastRefreshAt` field (visibility only).
+- `dashboard/subscriptions.js`: a "Token auto-refreshed <ago>" line + `relativeAge()` helper.
+
+## Blast radius / who is affected
+- Only anthropic/claude-code accounts in a SubscriptionPool. A pool of zero accounts (single-account agents) is entirely unaffected — the poller only runs when accounts are enrolled.
+- Behavior change is strictly a NARROWING of when `needs-reauth` fires: it no longer fires on a recoverable access-token expiry. Genuinely dead logins still flip to `needs-reauth` exactly as before.
+
+## Corruption safety (the load-bearing concern)
+- The ONLY mutation is the credential write-back. It is gated three ways: (1) only on a fully-validated 200 (new access token shaped `sk-ant-oat…`, positive numeric `expires_in`); (2) read-merge-write that preserves every existing field (scopes, subscriptionType, rateLimitTier, unknown fields); (3) refresh-token rotation persisted when present, old token kept when the server doesn't rotate — never dropped.
+- Any failure (wrong endpoint, wrong client id, network error, malformed body, write failure) writes NOTHING and returns a typed failure → the caller's existing `needs-reauth` path. A misconfiguration can only ever fail to improve, never corrupt a working login. This is fail-CLOSED, not silent-degrade-to-heuristic (consistent with the no-silent-llm-fallback standard, though this path is auth not inference).
+
+## Secrets handling
+- Token values are never logged and never returned to any persisted surface. The pool registry's existing `assertNoCredentialFields` guard still rejects any credential-bearing field name; `lastRefreshAt` is a timestamp, not a secret.
+
+## Framework generality
+- Scoped to claude-code OAuth specifically (the refresh-token grant is provider/framework-specific). It does NOT touch the session launch/inject abstraction (frameworkSessionLaunch / MessageDelivery), so it cannot regress codex-cli / gemini-cli / pi-cli. Non-claude-code accounts are skipped by the same provider/framework guard the poller already applies.
+
+## Migration parity
+- No agent-installed files change (no settings.json hooks, no config defaults, no CLAUDE.md template, no hook scripts, no skills). This is an in-process monitoring component; existing agents pick it up on the next server update. The new `lastRefreshAt` field is optional and back-compatible with existing `subscription-pool.json` on disk.
+
+## Tests
+- Tier 1: `tests/unit/oauth-refresher.test.ts` (rotation, no-rotation, no-refresh-token, exchange-failed, malformed, read-failed, write-failed, locator, request shape) + extended `tests/unit/quota-poller.test.ts` (refresh-recovers, still-401-after-refresh, dead-refresh-token) + `tests/unit/subscriptions-render.test.ts` (token-health line + relativeAge).
+- Tier 2: `tests/integration/subscription-quota-routes.test.ts` — recovery + dead-login through the real `/subscription-pool/poll` HTTP route.
+- Tier 3: `tests/e2e/subscription-quota-lifecycle.test.ts` — expired token auto-refreshes end-to-end, account stays active, stamped to the on-disk registry.