switchroom 0.19.2 → 0.19.3

package/telegram-plugin/dist/gateway/gateway.js

@@ -7196,6 +7196,67 @@ var init_format = __esm(() => {
   ];
 });
 
+// ../src/auth/quota.ts
+function isProbeThin(q) {
+  return q.fiveHourUtilPresent === false && q.sevenDayUtilPresent === false;
+}
+function refillNormalizedUtils(q, now) {
+  const nowMs = now.getTime();
+  const fiveHourRefilled = q.fiveHourResetAt != null && q.fiveHourResetAt.getTime() <= nowMs;
+  const sevenDayRefilled = q.sevenDayResetAt != null && q.sevenDayResetAt.getTime() <= nowMs;
+  return {
+    fiveHourUtilizationPct: fiveHourRefilled ? 0 : q.fiveHourUtilizationPct,
+    sevenDayUtilizationPct: sevenDayRefilled ? 0 : q.sevenDayUtilizationPct,
+    fiveHourRefilled,
+    sevenDayRefilled
+  };
+}
+
+// demo-mask.ts
+function stableAssign(input, cache, pool, overflow) {
+  const existing = cache.get(input);
+  if (existing !== undefined)
+    return existing;
+  const index = cache.size;
+  const value = index < pool.length ? pool[index] : overflow(index);
+  cache.set(input, value);
+  return value;
+}
+function maskEmail(label) {
+  return stableAssign(label, emailCache, EMAIL_POOL, (i) => `demo${i + 1}@example.com`);
+}
+function maskUsername(tag) {
+  return stableAssign(tag, usernameCache, USERNAME_POOL, (i) => `@demo_user${i + 1}`);
+}
+function maskVaultKey(name) {
+  return stableAssign(name, vaultKeyCache, [], (i) => `demo/secret-${i + 1}`);
+}
+var EMAIL_POOL, emailCache, USERNAME_POOL, usernameCache, vaultKeyCache;
+var init_demo_mask = __esm(() => {
+  EMAIL_POOL = [
+    "ada@example.com",
+    "grace@example.com",
+    "linus@example.com",
+    "hopper@example.com",
+    "turing@example.com",
+    "lovelace@example.com",
+    "dijkstra@example.com",
+    "knuth@example.com",
+    "ritchie@example.com",
+    "torvalds@example.com"
+  ];
+  emailCache = new Map;
+  USERNAME_POOL = [
+    "@demo_user",
+    "@demo_user2",
+    "@demo_user3",
+    "@demo_user4",
+    "@demo_user5"
+  ];
+  usernameCache = new Map;
+  vaultKeyCache = new Map;
+});
+
 // text-voice-scrub.ts
 function enabled() {
   const v = process.env.SWITCHROOM_DISABLE_VOICE_SCRUB;
@@ -7383,6 +7444,533 @@ var init_card_format = __esm(() => {
   init_text_voice_scrub();
 });
 
+// auth-snapshot-format.ts
+var exports_auth_snapshot_format = {};
+__export(exports_auth_snapshot_format, {
+  zipProbeResults: () => zipProbeResults,
+  reviveLastQuota: () => reviveLastQuota,
+  renderFallbackAnnouncement: () => renderFallbackAnnouncement,
+  renderAuthSnapshotFormat2: () => renderAuthSnapshotFormat2,
+  recommendation: () => recommendation,
+  formatStatusTime: () => formatStatusTime,
+  formatRelative: () => formatRelative,
+  formatAbsolute: () => formatAbsolute,
+  fmtPct: () => fmtPct,
+  deriveUsageFooterFreshness: () => deriveUsageFooterFreshness,
+  classifyHealth: () => classifyHealth,
+  buildSnapshotsFromState: () => buildSnapshotsFromState,
+  buildSnapshotsFromCachedState: () => buildSnapshotsFromCachedState,
+  buildSnapshotKeyboard: () => buildSnapshotKeyboard,
+  blockedReason: () => blockedReason,
+  bindingWindow: () => bindingWindow,
+  THROTTLING_THRESHOLD_PCT: () => THROTTLING_THRESHOLD_PCT
+});
+function classifyHealth(snap, now = new Date) {
+  if (!snap.isActive) {
+    if (snap.entitlementBlocked === true)
+      return "org-blocked";
+    if (snap.inService === false)
+      return "retired";
+  }
+  if (!snap.quota)
+    return "unknown";
+  const q = snap.quota;
+  if (isProbeThin(q))
+    return "unknown";
+  const norm = refillNormalizedUtils(q, now);
+  const max = Math.max(norm.fiveHourUtilizationPct, norm.sevenDayUtilizationPct);
+  if (max >= 99.5)
+    return "blocked";
+  if (max >= THROTTLING_THRESHOLD_PCT)
+    return "throttling";
+  return "healthy";
+}
+function blockedReason(snap, now = new Date) {
+  if (classifyHealth(snap, now) !== "blocked")
+    return null;
+  return "quota-exhausted";
+}
+function bindingWindow(q) {
+  if (q.representativeClaim === "seven_day")
+    return "7d";
+  if (q.representativeClaim === "five_hour")
+    return "5h";
+  return q.sevenDayUtilizationPct >= q.fiveHourUtilizationPct ? "7d" : "5h";
+}
+function formatRelative(target, now = new Date) {
+  if (!target)
+    return "\u2014";
+  const deltaMs = target.getTime() - now.getTime();
+  if (deltaMs <= 0)
+    return "now";
+  const totalMin = Math.round(deltaMs / 60000);
+  if (totalMin < 60)
+    return `${totalMin}m`;
+  const h = Math.floor(totalMin / 60);
+  const m = totalMin % 60;
+  if (h < 24)
+    return m > 0 ? `${h}h ${m}m` : `${h}h`;
+  const d = Math.floor(h / 24);
+  const rh = h % 24;
+  return rh > 0 ? `${d}d ${rh}h` : `${d}d`;
+}
+function formatAbsolute(target, tz = "UTC") {
+  if (!target)
+    return "\u2014";
+  return target.toLocaleString("en-US", {
+    timeZone: tz,
+    weekday: "short",
+    hour: "numeric",
+    minute: "2-digit",
+    hour12: true
+  });
+}
+function formatStatusTime(target, now = new Date, tz = "UTC") {
+  if (!target)
+    return "\u2014";
+  const dayFmt = new Intl.DateTimeFormat("en-CA", {
+    timeZone: tz,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit"
+  });
+  const timeFmt = new Intl.DateTimeFormat("en-US", {
+    timeZone: tz,
+    hour: "numeric",
+    minute: "2-digit",
+    hour12: true
+  });
+  const timeStr = timeFmt.format(target);
+  if (dayFmt.format(target) === dayFmt.format(now)) {
+    return timeStr;
+  }
+  const withinWeek = target.getTime() - now.getTime() < 7 * 24 * 60 * 60 * 1000;
+  const dateFmt = new Intl.DateTimeFormat("en-US", {
+    timeZone: tz,
+    weekday: "short",
+    ...withinWeek ? {} : { day: "numeric", month: "short" }
+  });
+  return `${dateFmt.format(target)} ${timeStr}`;
+}
+function fmtPct(pct) {
+  return `${Math.min(100, Math.round(pct))}%`;
+}
+function displayLabel(label, opts) {
+  return opts.demo ? maskEmail(label) : label;
+}
+function renderAccountRow(snap, opts) {
+  const now = opts.now ?? new Date;
+  const tz = opts.tz ?? "UTC";
+  const lines = [];
+  const marker = snap.isActive ? "\u25cf " : "";
+  const label = displayLabel(snap.label, opts);
+  const health = classifyHealth(snap, now);
+  if (health === "org-blocked" || health === "retired") {
+    const note = health === "org-blocked" ? "DISABLED (org) \u2014 no fleet routing" : "retired \u2014 removed from fleet rotation";
+    lines.push(`${marker}\`${codeSpanSafe(label)}\`  _${note}_`);
+    return lines;
+  }
+  if (!snap.quota) {
+    lines.push(`${marker}\`${codeSpanSafe(label)}\`  _quota probe failed_`);
+    if (snap.quotaError) {
+      lines.push(`  _${escapeMarkdown(snap.quotaError)}_`);
+    }
+    return lines;
+  }
+  const q = snap.quota;
+  if (isProbeThin(q)) {
+    lines.push(`${marker}\`${codeSpanSafe(label)}\`  _quota unknown (thin probe)_`);
+    return lines;
+  }
+  const norm = refillNormalizedUtils(q, now);
+  const fiveStr = fmtPct(norm.fiveHourUtilizationPct);
+  const sevenStr = fmtPct(norm.sevenDayUtilizationPct);
+  lines.push(`${marker}\`${codeSpanSafe(label)}\`  ${fiveStr} / ${sevenStr}`);
+  if (health === "blocked") {
+    const win = bindingWindow(q);
+    const reset = win === "5h" ? q.fiveHourResetAt : q.sevenDayResetAt;
+    const winLabel = win === "5h" ? "5-hour" : "7-day";
+    lines.push(reset ? `  _quota exhausted \u2014 back ${formatAbsolute(reset, tz)} (\`in ${formatRelative(reset, now)}\`, ${winLabel} cap)_` : `  _quota exhausted \u2014 ${winLabel} cap, reset time unknown_`);
+    return lines;
+  }
+  const fiveResetIn = q.fiveHourResetAt ? q.fiveHourResetAt.getTime() - now.getTime() : Infinity;
+  const sevenResetIn = q.sevenDayResetAt ? q.sevenDayResetAt.getTime() - now.getTime() : Infinity;
+  const fiveFirst = fiveResetIn <= sevenResetIn;
+  const fiveSeg = q.fiveHourResetAt ? `5h refills ${formatAbsolute(q.fiveHourResetAt, tz)} (\`in ${formatRelative(q.fiveHourResetAt, now)}\`)` : "5h refills \u2014";
+  const sevenSeg = q.sevenDayResetAt ? `7d resets ${formatAbsolute(q.sevenDayResetAt, tz)} (\`in ${formatRelative(q.sevenDayResetAt, now)}\`)` : "7d resets \u2014";
+  lines.push(`  _${fiveFirst ? fiveSeg : sevenSeg}_`);
+  lines.push(`  _${fiveFirst ? sevenSeg : fiveSeg}_`);
+  if (q.overageDisabledReason != null && OVERAGE_EXHAUSTED_REASONS.has(q.overageDisabledReason)) {
+    lines.push(`  _overage off (${escapeMarkdown(q.overageDisabledReason)}) \u2014 serving from quota_`);
+  }
+  return lines;
+}
+function formatAgeStamp(atMs, now = new Date) {
+  const ageSec = Math.max(0, Math.round((now.getTime() - atMs) / 1000));
+  return ageSec < 60 ? `${ageSec}s ago` : `${Math.round(ageSec / 60)}m ago`;
+}
+function tableCell(s) {
+  return s.replace(/\\/g, "\\\\").replace(/\|/g, "\\|").replace(/\r?\n/g, " ");
+}
+function pctCells(snap, now) {
+  if (!snap.quota)
+    return { five: "\u2014", seven: "\u2014" };
+  if (isProbeThin(snap.quota))
+    return { five: "?", seven: "?" };
+  const norm = refillNormalizedUtils(snap.quota, now);
+  return { five: fmtPct(norm.fiveHourUtilizationPct), seven: fmtPct(norm.sevenDayUtilizationPct) };
+}
+function windowResetCell(snap, now, tz, win) {
+  if (!snap.quota) {
+    return snap.quotaError ? `probe failed (${snap.quotaError})` : "\u2014";
+  }
+  if (isProbeThin(snap.quota))
+    return "quota unknown";
+  const reset = win === "5h" ? snap.quota.fiveHourResetAt : snap.quota.sevenDayResetAt;
+  if (!reset)
+    return "\u2014";
+  return `${formatStatusTime(reset, now, tz)} (in ${formatRelative(reset, now)})`;
+}
+function renderAuthSnapshotFormat2(snapshots, opts = {}) {
+  const now = opts.now ?? new Date;
+  const tz = opts.tz ?? "UTC";
+  const lines = [];
+  lines.push("\uD83D\uDD0B **Auth \u2014 fleet status**");
+  const ordered = [...snapshots].sort((a, b) => {
+    if (a.isActive !== b.isActive)
+      return a.isActive ? -1 : 1;
+    const r = TABLE_HEALTH_RANK[classifyHealth(a, now)] - TABLE_HEALTH_RANK[classifyHealth(b, now)];
+    if (r !== 0)
+      return r;
+    return a.label.localeCompare(b.label);
+  });
+  if (ordered.length > 0) {
+    lines.push("");
+    lines.push("| State | Account | 5h | 5h resets | 7d | 7d resets |");
+    lines.push("| --- | --- | --- | --- | --- | --- |");
+    for (const s of ordered) {
+      const emoji = HEALTH_EMOJI[classifyHealth(s, now)];
+      const label = displayLabel(s.label, opts);
+      const accountCell = `\`${codeSpanSafe(s.isActive ? `${label} (active)` : label)}\``;
+      const { five, seven } = pctCells(s, now);
+      const fiveReset = windowResetCell(s, now, tz, "5h");
+      const sevenReset = windowResetCell(s, now, tz, "7d");
+      lines.push(`| ${emoji} | ${tableCell(accountCell)} | ${five} | ${tableCell(fiveReset)} | ${seven} | ${tableCell(sevenReset)} |`);
+    }
+  }
+  lines.push("");
+  lines.push(`_${recommendation(snapshots, now, opts.demo ?? false)}_`);
+  if (opts.staleCachedAtMs != null) {
+    lines.push(`_\u26a0 cached ${formatAgeStamp(opts.staleCachedAtMs, now)}_`);
+  } else if (opts.liveProbedAtMs != null) {
+    lines.push(`_Live \u00b7 refreshed ${formatAgeStamp(opts.liveProbedAtMs, now)}_`);
+  } else if (opts.probeFailed) {
+    lines.push("_\u26a0 probe failed \u2014 no live data_");
+  } else {
+    lines.push("_Live_");
+  }
+  return lines.join(`
+`);
+}
+function recommendation(snapshots, now = new Date, demo = false) {
+  const active = snapshots.find((s) => s.isActive);
+  if (!active)
+    return "No active account set.";
+  const activeHealth = classifyHealth(active, now);
+  const inServiceFleet = snapshots.filter((s) => {
+    const h = classifyHealth(s, now);
+    return h !== "retired" && h !== "org-blocked";
+  });
+  const others = inServiceFleet.filter((s) => !s.isActive);
+  const healthyAlt = others.find((s) => classifyHealth(s, now) === "healthy");
+  const lbl = (s) => demo ? maskEmail(s.label) : s.label;
+  const activeLabel = lbl(active);
+  if (activeHealth === "healthy") {
+    return `Recommendation: stay on ${activeLabel}.`;
+  }
+  if (activeHealth === "throttling") {
+    if (healthyAlt) {
+      return `Recommendation: active ${activeLabel} is throttling. Switch to ${lbl(healthyAlt)} for headroom.`;
+    }
+    return `Recommendation: active ${activeLabel} is throttling; no healthy alternative \u2014 wait for refill.`;
+  }
+  if (activeHealth === "blocked") {
+    if (healthyAlt) {
+      return `Recommendation: active ${activeLabel} is BLOCKED \u2014 switch to ${lbl(healthyAlt)} now.`;
+    }
+    return summarizeNoHealthyAlt(inServiceFleet, now, demo);
+  }
+  return `Active ${activeLabel}: quota probe failed; broker last_seen unknown.`;
+}
+function summarizeNoHealthyAlt(snapshots, now, demo = false) {
+  const mask = (label) => demo ? maskEmail(label) : label;
+  let throttlingLabel = null;
+  let allTrulyBlocked = true;
+  for (const s of snapshots) {
+    const h = classifyHealth(s, now);
+    if (h === "throttling") {
+      if (!throttlingLabel)
+        throttlingLabel = s.label;
+      allTrulyBlocked = false;
+    } else if (h === "healthy" || h === "unknown") {
+      allTrulyBlocked = false;
+    } else if (h === "blocked" && blockedReason(s, now) === "quota-exhausted") {
+      if (s.quota) {
+        const win = bindingWindow(s.quota);
+        const at = win === "5h" ? s.quota.fiveHourResetAt : s.quota.sevenDayResetAt;
+        if (at && at.getTime() > now.getTime())
+          allTrulyBlocked = false;
+      }
+    }
+  }
+  const earliestRecovery = pickEarliestRecovery(snapshots, now);
+  if (throttlingLabel) {
+    const eta = earliestRecovery ? ` Soonest full refill: ${mask(earliestRecovery.label)} in ${formatRelative(earliestRecovery.at, now)}.` : "";
+    return `No fully-healthy account; ${mask(throttlingLabel)} is throttling but still usable.${eta}`;
+  }
+  if (!allTrulyBlocked) {
+    if (earliestRecovery) {
+      return `All accounts at capacity; soonest refill: ${mask(earliestRecovery.label)} in ${formatRelative(earliestRecovery.at, now)}.`;
+    }
+    return `All accounts at capacity \u2014 waiting on a window refill.`;
+  }
+  if (earliestRecovery) {
+    return `All accounts blocked. Earliest recovery: ${mask(earliestRecovery.label)} in ${formatRelative(earliestRecovery.at, now)}.`;
+  }
+  return `All accounts blocked. Run /auth add to attach another subscription.`;
+}
+function pickEarliestRecovery(snapshots, now) {
+  let best = null;
+  for (const s of snapshots) {
+    if (!s.quota)
+      continue;
+    if (isProbeThin(s.quota))
+      continue;
+    const win = bindingWindow(s.quota);
+    const at = win === "5h" ? s.quota.fiveHourResetAt : s.quota.sevenDayResetAt;
+    if (!at || at.getTime() <= now.getTime())
+      continue;
+    if (!best || at.getTime() < best.at.getTime()) {
+      best = { label: s.label, at };
+    }
+  }
+  return best;
+}
+function renderFallbackAnnouncement(input) {
+  const now = input.now ?? new Date;
+  const tz = input.tz ?? "UTC";
+  const lines = [];
+  const limitWord = input.oldQuota ? limitWordFor(input.oldQuota) : "quota";
+  const headerLimit = input.cause === "rate-limit" ? "rate limit" : limitWord === "quota" ? "quota cap" : `${limitWord} limit`;
+  if (!input.newLabel) {
+    lines.push(`\uD83D\uDD34 **All accounts blocked \u00b7 ${headerLimit} on ${escapeMarkdown(input.oldLabel)}**`);
+    lines.push("");
+    lines.push(`Triggered by: agent **${escapeMarkdown(input.triggerAgent)}**`);
+    const fleet = input.fleetSnapshots ?? [];
+    if (fleet.length > 0) {
+      lines.push("");
+      const rowOpts = { now, tz };
+      const healthOrder = [
+        "org-blocked",
+        "blocked",
+        "throttling",
+        "healthy",
+        "unknown",
+        "retired"
+      ];
+      const rank = (s) => healthOrder.indexOf(classifyHealth(s, now));
+      const ordered = [...fleet].sort((a, b) => rank(a) - rank(b) || Number(b.isActive) - Number(a.isActive));
+      for (const snap of ordered) {
+        for (const ln of renderAccountRow(snap, rowOpts))
+          lines.push(ln);
+      }
+      const earliest = pickEarliestRecovery(fleet, now);
+      if (earliest) {
+        lines.push("");
+        lines.push(`Earliest recovery: \`${codeSpanSafe(earliest.label)}\` ` + `${formatAbsolute(earliest.at, tz)} (in ${formatRelative(earliest.at, now)})`);
+      }
+    } else {
+      const recovery = (input.oldQuota ? recoveryAtFor(input.oldQuota) : null) ?? input.parsedResetAt ?? null;
+      if (recovery) {
+        lines.push(`${escapeMarkdown(input.oldLabel)} recovers ${formatAbsolute(recovery, tz)} ` + `(in ${formatRelative(recovery, now)})`);
+      }
+    }
+    lines.push("");
+    lines.push(`Run \`/auth add <label>\` to attach another subscription, ` + `or \`/auth refresh\` to re-probe.`);
+    return lines.join(`
+`);
+  }
+  lines.push(`\u2713 **Switched fleet \u00b7 ${headerLimit} on ${escapeMarkdown(input.oldLabel)}**`);
+  lines.push("");
+  lines.push(`\`${codeSpanSafe(input.oldLabel)}\` \u2192 \`${codeSpanSafe(input.newLabel)}\``);
+  lines.push(`Triggered by: agent **${escapeMarkdown(input.triggerAgent)}**`);
+  lines.push("");
+  {
+    const recovery = (input.oldQuota ? recoveryAtFor(input.oldQuota) : null) ?? input.parsedResetAt ?? null;
+    if (recovery) {
+      lines.push(`\`${codeSpanSafe(input.oldLabel)}\` recovers ` + `${formatAbsolute(recovery, tz)} (in ${formatRelative(recovery, now)})`);
+    }
+  }
+  if (input.newQuota) {
+    const fiveStr = fmtPct(input.newQuota.fiveHourUtilizationPct);
+    const sevenStr = fmtPct(input.newQuota.sevenDayUtilizationPct);
+    const hasHeadroom = input.newQuota.fiveHourUtilizationPct < THROTTLING_THRESHOLD_PCT && input.newQuota.sevenDayUtilizationPct < THROTTLING_THRESHOLD_PCT;
+    const headroomStr = hasHeadroom ? "_(plenty of headroom)_" : "_(near limit \u2014 watch this)_";
+    lines.push(`\`${codeSpanSafe(input.newLabel)}\` now: ${fiveStr} of 5h \u00b7 ${sevenStr} of 7d ${headroomStr}`);
+  } else {
+    lines.push(`_(quota probe for new account is pending \u2014 will reflect on next /auth)_`);
+  }
+  return lines.join(`
+`);
+}
+function limitWordFor(q) {
+  if (q.representativeClaim === "seven_day" && q.sevenDayUtilizationPct >= 99)
+    return "7-day";
+  if (q.representativeClaim === "five_hour" && q.fiveHourUtilizationPct >= 99)
+    return "5-hour";
+  if (q.sevenDayUtilizationPct >= 99)
+    return "7-day";
+  if (q.fiveHourUtilizationPct >= 99)
+    return "5-hour";
+  return q.sevenDayUtilizationPct >= q.fiveHourUtilizationPct ? "7-day" : "5-hour";
+}
+function recoveryAtFor(q) {
+  const word = limitWordFor(q);
+  if (word === "7-day")
+    return q.sevenDayResetAt;
+  if (word === "5-hour")
+    return q.fiveHourResetAt;
+  if (!q.fiveHourResetAt)
+    return q.sevenDayResetAt;
+  if (!q.sevenDayResetAt)
+    return q.fiveHourResetAt;
+  return q.fiveHourResetAt.getTime() < q.sevenDayResetAt.getTime() ? q.fiveHourResetAt : q.sevenDayResetAt;
+}
+function buildSnapshotKeyboard(snapshots, opts = {}) {
+  const max = opts.maxSwitchButtons ?? 3;
+  const now = opts.now ?? new Date;
+  const rows = [];
+  const switchTargets = snapshots.filter((s) => !s.isActive).sort((a, b) => switchPriority(a, now) - switchPriority(b, now)).filter((s) => {
+    const h = classifyHealth(s, now);
+    return h !== "blocked" && h !== "unknown" && h !== "retired" && h !== "org-blocked";
+  }).slice(0, max);
+  for (const t of switchTargets) {
+    rows.push([
+      {
+        text: `Switch fleet \u2192 ${opts.demo ? maskEmail(t.label) : t.label}`,
+        callbackData: `auth:use:${t.label}`
+      }
+    ]);
+  }
+  rows.push([
+    { text: "\u21bb Refresh", callbackData: opts.demo ? "auth:refresh:demo" : "auth:refresh" },
+    { text: "/usage", insertText: "/usage" },
+    { text: "+ Add", insertText: "/auth add " }
+  ]);
+  return rows;
+}
+function switchPriority(s, now = new Date) {
+  const h = classifyHealth(s, now);
+  if (h === "healthy")
+    return 0;
+  if (h === "throttling")
+    return 1;
+  if (h === "unknown")
+    return 2;
+  if (h === "blocked")
+    return 3;
+  return 4;
+}
+function zipProbeResults(labels, results) {
+  let staleCachedAtMs;
+  const quotas = labels.map((label) => {
+    const hit = results.find((r) => r.label === label);
+    if (!hit)
+      return { ok: false, reason: "broker returned no result for account" };
+    if (hit.served === "cache" && hit.capturedAt != null) {
+      staleCachedAtMs = staleCachedAtMs == null ? hit.capturedAt : Math.min(staleCachedAtMs, hit.capturedAt);
+    }
+    return hit.result;
+  });
+  return staleCachedAtMs != null ? { quotas, staleCachedAtMs } : { quotas };
+}
+function deriveUsageFooterFreshness(results, staleCachedAtMs, liveProbedAtMs) {
+  if (staleCachedAtMs != null)
+    return { staleCachedAtMs };
+  if (results.some((r) => r.result.ok))
+    return { liveProbedAtMs };
+  return { probeFailed: true };
+}
+function buildSnapshotsFromState(state, quotas) {
+  const out = [];
+  for (let i = 0;i < state.accounts.length; i++) {
+    const acc = state.accounts[i];
+    const q = quotas[i];
+    out.push({
+      label: acc.label,
+      isActive: acc.label === state.active,
+      quota: q && q.ok ? q.data : null,
+      quotaError: q && !q.ok ? q.reason : undefined,
+      expiresAtMs: acc.expiresAt,
+      inService: acc.in_service,
+      entitlementBlocked: acc.entitlement_blocked
+    });
+  }
+  return out;
+}
+function reviveLastQuota(snap) {
+  if (!snap)
+    return null;
+  return {
+    fiveHourUtilizationPct: snap.fiveHourUtilizationPct,
+    sevenDayUtilizationPct: snap.sevenDayUtilizationPct,
+    fiveHourResetAt: snap.fiveHourResetAt ? new Date(snap.fiveHourResetAt) : null,
+    sevenDayResetAt: snap.sevenDayResetAt ? new Date(snap.sevenDayResetAt) : null,
+    representativeClaim: snap.representativeClaim,
+    overageStatus: snap.overageStatus,
+    overageDisabledReason: snap.overageDisabledReason,
+    fiveHourUtilPresent: snap.fiveHourUtilPresent,
+    sevenDayUtilPresent: snap.sevenDayUtilPresent
+  };
+}
+function buildSnapshotsFromCachedState(state) {
+  return state.accounts.map((acc) => {
+    const lq = acc.last_quota ?? null;
+    return {
+      label: acc.label,
+      isActive: acc.label === state.active,
+      quota: reviveLastQuota(lq),
+      quotaError: lq ? undefined : "no cached quota (no probe since broker start)",
+      expiresAtMs: acc.expiresAt,
+      capturedAtMs: lq?.capturedAt,
+      inService: acc.in_service,
+      entitlementBlocked: acc.entitlement_blocked
+    };
+  });
+}
+var THROTTLING_THRESHOLD_PCT = 80, OVERAGE_EXHAUSTED_REASONS, HEALTH_EMOJI, TABLE_HEALTH_RANK;
+var init_auth_snapshot_format = __esm(() => {
+  init_demo_mask();
+  init_card_format();
+  OVERAGE_EXHAUSTED_REASONS = new Set(["out_of_credits"]);
+  HEALTH_EMOJI = {
+    healthy: "\uD83D\uDFE2",
+    throttling: "\uD83D\uDFE1",
+    blocked: "\uD83D\uDD34",
+    unknown: "\u26aa",
+    "org-blocked": "\u26d4",
+    retired: "\u26ab"
+  };
+  TABLE_HEALTH_RANK = {
+    "org-blocked": 0,
+    blocked: 1,
+    throttling: 2,
+    unknown: 3,
+    healthy: 4,
+    retired: 5
+  };
+});
+
 // secret-detect/patterns.ts
 var ANCHORED_PATTERNS, STRUCTURED_PATTERNS, PROVIDER_PATTERNS, ALL_PATTERNS;
 var init_patterns = __esm(() => {
@@ -13034,51 +13622,6 @@ var init_tmux = __esm(() => {
   MAX_BYTES = 10 * 1024 * 1024;
 });
 
-// demo-mask.ts
-function stableAssign(input, cache, pool, overflow) {
-  const existing = cache.get(input);
-  if (existing !== undefined)
-    return existing;
-  const index = cache.size;
-  const value = index < pool.length ? pool[index] : overflow(index);
-  cache.set(input, value);
-  return value;
-}
-function maskEmail(label) {
-  return stableAssign(label, emailCache, EMAIL_POOL, (i) => `demo${i + 1}@example.com`);
-}
-function maskUsername(tag) {
-  return stableAssign(tag, usernameCache, USERNAME_POOL, (i) => `@demo_user${i + 1}`);
-}
-function maskVaultKey(name) {
-  return stableAssign(name, vaultKeyCache, [], (i) => `demo/secret-${i + 1}`);
-}
-var EMAIL_POOL, emailCache, USERNAME_POOL, usernameCache, vaultKeyCache;
-var init_demo_mask = __esm(() => {
-  EMAIL_POOL = [
-    "ada@example.com",
-    "grace@example.com",
-    "linus@example.com",
-    "hopper@example.com",
-    "turing@example.com",
-    "lovelace@example.com",
-    "dijkstra@example.com",
-    "knuth@example.com",
-    "ritchie@example.com",
-    "torvalds@example.com"
-  ];
-  emailCache = new Map;
-  USERNAME_POOL = [
-    "@demo_user",
-    "@demo_user2",
-    "@demo_user3",
-    "@demo_user4",
-    "@demo_user5"
-  ];
-  usernameCache = new Map;
-  vaultKeyCache = new Map;
-});
-
 // ../node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/identity.js
 var require_identity = __commonJS((exports) => {
   var ALIAS = Symbol.for("yaml.alias");
@@ -21894,647 +22437,139 @@ function materializeFilesEntry(key, files) {
   }
   mkdirSync9(dir, { recursive: true, mode: 448 });
   chmodSync3(dir, 448);
-  const st = statSync6(dir);
-  if (typeof process.getuid === "function" && st.uid !== process.getuid()) {
-    throw new Error(`Refusing to materialize vault entry: ${dir} not owned by caller`);
-  }
-  for (const [filename, { encoding, value }] of Object.entries(files)) {
-    if (filename.includes("/") || filename.includes("\\") || filename === ".." || filename === "." || filename.includes("\x00")) {
-      throw new Error(`Refusing to materialize vault file with unsafe name: ${filename}`);
-    }
-    const filePath = join5(dir, filename);
-    const content = encoding === "base64" ? Buffer.from(value, "base64") : value;
-    writeFileExclusive(filePath, content);
-  }
-  materializedDirs.add(dir);
-  registerCleanupHook();
-  return dir;
-}
-function resolveSingleReference(ref, secrets) {
-  const entry = secrets[ref.key];
-  if (entry === undefined) {
-    throw new Error(`Vault secret not found: ${ref.key}`);
-  }
-  if (ref.filename !== undefined) {
-    if (entry.kind !== "files") {
-      throw new Error(`Vault reference "vault:${ref.key}#${ref.filename}" expected kind="files", got kind="${entry.kind}".`);
-    }
-    const file = entry.files[ref.filename];
-    if (!file) {
-      throw new Error(`Vault secret "${ref.key}" has no file named "${ref.filename}". Available: ${Object.keys(entry.files).join(", ")}`);
-    }
-    return file.encoding === "base64" ? Buffer.from(file.value, "base64").toString("utf8") : file.value;
-  }
-  if (entry.kind === "string" || entry.kind === "binary") {
-    return entry.value;
-  }
-  return materializeFilesEntry(ref.key, entry.files);
-}
-function resolveValue(value, secrets) {
-  if (typeof value === "string" && isVaultReference(value)) {
-    const ref = parseVaultReferenceDetailed(value);
-    return resolveSingleReference(ref, secrets);
-  }
-  if (Array.isArray(value)) {
-    return value.map((item) => resolveValue(item, secrets));
-  }
-  if (value !== null && typeof value === "object") {
-    const resolved = {};
-    for (const [k, v] of Object.entries(value)) {
-      resolved[k] = resolveValue(v, secrets);
-    }
-    return resolved;
-  }
-  return value;
-}
-async function resolveVaultReferencesViaBroker(config, brokerOpts) {
-  const socketPath = resolveBrokerSocketPath({
-    ...brokerOpts,
-    vaultBrokerSocket: config.vault?.broker?.socket ? resolvePath(config.vault.broker.socket) : undefined
-  });
-  const opts = { ...brokerOpts, socket: socketPath };
-  const refs = collectVaultRefs(config);
-  if (refs.size === 0) {
-    return { ok: true, config };
-  }
-  const brokerSecrets = {};
-  let sawDenied = false;
-  let sawUnreachable = false;
-  let sawLocked = false;
-  let sawNotFound = false;
-  const resolverAgentSlug = process.env.SWITCHROOM_AGENT_NAME;
-  const resolverToken = resolverAgentSlug ? readVaultTokenFile(resolverAgentSlug) ?? undefined : undefined;
-  const optsWithToken = resolverToken ? { ...opts, token: resolverToken } : opts;
-  for (const key of refs) {
-    const result = await getViaBrokerStructured(key, optsWithToken);
-    if (result.kind === "ok") {
-      brokerSecrets[key] = result.entry;
-    } else if (result.kind === "unreachable") {
-      sawUnreachable = true;
-      break;
-    } else if (result.kind === "denied") {
-      if (result.code === "LOCKED") {
-        sawLocked = true;
-      } else {
-        sawDenied = true;
-      }
-    } else if (result.kind === "not_found") {
-      sawNotFound = true;
-    }
-  }
-  const resolvedCount = Object.keys(brokerSecrets).length;
-  const allResolved = resolvedCount === refs.size;
-  if (allResolved) {
-    return { ok: true, config: resolveValue(config, brokerSecrets) };
-  }
-  if (sawUnreachable && !sawDenied && !sawLocked && !sawNotFound) {
-    return { ok: false, reason: "unreachable" };
-  }
-  if (sawLocked && !sawDenied && !sawUnreachable && !sawNotFound) {
-    return { ok: false, reason: "locked" };
-  }
-  if (sawDenied && !sawUnreachable && !sawLocked && !sawNotFound) {
-    return { ok: false, reason: "denied" };
-  }
-  if (sawNotFound && !sawDenied && !sawUnreachable && !sawLocked && resolvedCount > 0) {
-    return { ok: true, config: resolveValue(config, brokerSecrets) };
-  }
-  if (sawNotFound && !sawDenied && !sawUnreachable && !sawLocked && resolvedCount === 0) {
-    return { ok: false, reason: "not_found" };
-  }
-  return { ok: false, reason: "unknown" };
-}
-function collectVaultRefs(value) {
-  const keys = new Set;
-  function walk(v) {
-    if (typeof v === "string" && isVaultReference(v)) {
-      const ref = parseVaultReferenceDetailed(v);
-      keys.add(ref.key);
-    } else if (Array.isArray(v)) {
-      for (const item of v)
-        walk(item);
-    } else if (v !== null && typeof v === "object") {
-      for (const val of Object.values(v))
-        walk(val);
-    }
-  }
-  walk(value);
-  return keys;
-}
-var materializedDirs, cleanupRegistered = false, cachedRoot = null;
-var init_resolver = __esm(() => {
-  init_vault();
-  init_loader();
-  init_client();
-  materializedDirs = new Set;
-});
-
-// ../src/auth/quota.ts
-function isProbeThin(q) {
-  return q.fiveHourUtilPresent === false && q.sevenDayUtilPresent === false;
-}
-function refillNormalizedUtils(q, now) {
-  const nowMs = now.getTime();
-  const fiveHourRefilled = q.fiveHourResetAt != null && q.fiveHourResetAt.getTime() <= nowMs;
-  const sevenDayRefilled = q.sevenDayResetAt != null && q.sevenDayResetAt.getTime() <= nowMs;
-  return {
-    fiveHourUtilizationPct: fiveHourRefilled ? 0 : q.fiveHourUtilizationPct,
-    sevenDayUtilizationPct: sevenDayRefilled ? 0 : q.sevenDayUtilizationPct,
-    fiveHourRefilled,
-    sevenDayRefilled
-  };
-}
-
-// auth-snapshot-format.ts
-var exports_auth_snapshot_format = {};
-__export(exports_auth_snapshot_format, {
-  zipProbeResults: () => zipProbeResults,
-  reviveLastQuota: () => reviveLastQuota,
-  renderFallbackAnnouncement: () => renderFallbackAnnouncement,
-  renderAuthSnapshotFormat2: () => renderAuthSnapshotFormat2,
-  recommendation: () => recommendation,
-  formatStatusTime: () => formatStatusTime,
-  formatRelative: () => formatRelative,
-  formatAbsolute: () => formatAbsolute,
-  fmtPct: () => fmtPct,
-  deriveUsageFooterFreshness: () => deriveUsageFooterFreshness,
-  classifyHealth: () => classifyHealth,
-  buildSnapshotsFromState: () => buildSnapshotsFromState,
-  buildSnapshotsFromCachedState: () => buildSnapshotsFromCachedState,
-  buildSnapshotKeyboard: () => buildSnapshotKeyboard,
-  blockedReason: () => blockedReason,
-  bindingWindow: () => bindingWindow,
-  THROTTLING_THRESHOLD_PCT: () => THROTTLING_THRESHOLD_PCT
-});
-function classifyHealth(snap, now = new Date) {
-  if (!snap.quota)
-    return "unknown";
-  const q = snap.quota;
-  if (isProbeThin(q))
-    return "unknown";
-  const norm = refillNormalizedUtils(q, now);
-  const max = Math.max(norm.fiveHourUtilizationPct, norm.sevenDayUtilizationPct);
-  if (max >= 99.5)
-    return "blocked";
-  if (max >= THROTTLING_THRESHOLD_PCT)
-    return "throttling";
-  return "healthy";
-}
-function blockedReason(snap, now = new Date) {
-  if (classifyHealth(snap, now) !== "blocked")
-    return null;
-  return "quota-exhausted";
-}
-function bindingWindow(q) {
-  if (q.representativeClaim === "seven_day")
-    return "7d";
-  if (q.representativeClaim === "five_hour")
-    return "5h";
-  return q.sevenDayUtilizationPct >= q.fiveHourUtilizationPct ? "7d" : "5h";
-}
-function formatRelative(target, now = new Date) {
-  if (!target)
-    return "\u2014";
-  const deltaMs = target.getTime() - now.getTime();
-  if (deltaMs <= 0)
-    return "now";
-  const totalMin = Math.round(deltaMs / 60000);
-  if (totalMin < 60)
-    return `${totalMin}m`;
-  const h = Math.floor(totalMin / 60);
-  const m = totalMin % 60;
-  if (h < 24)
-    return m > 0 ? `${h}h ${m}m` : `${h}h`;
-  const d = Math.floor(h / 24);
-  const rh = h % 24;
-  return rh > 0 ? `${d}d ${rh}h` : `${d}d`;
-}
-function formatAbsolute(target, tz = "UTC") {
-  if (!target)
-    return "\u2014";
-  return target.toLocaleString("en-US", {
-    timeZone: tz,
-    weekday: "short",
-    hour: "numeric",
-    minute: "2-digit",
-    hour12: true
-  });
-}
-function formatStatusTime(target, now = new Date, tz = "UTC") {
-  if (!target)
-    return "\u2014";
-  const dayFmt = new Intl.DateTimeFormat("en-CA", {
-    timeZone: tz,
-    year: "numeric",
-    month: "2-digit",
-    day: "2-digit"
-  });
-  const timeFmt = new Intl.DateTimeFormat("en-US", {
-    timeZone: tz,
-    hour: "numeric",
-    minute: "2-digit",
-    hour12: true
-  });
-  const timeStr = timeFmt.format(target);
-  if (dayFmt.format(target) === dayFmt.format(now)) {
-    return timeStr;
-  }
-  const withinWeek = target.getTime() - now.getTime() < 7 * 24 * 60 * 60 * 1000;
-  const dateFmt = new Intl.DateTimeFormat("en-US", {
-    timeZone: tz,
-    weekday: "short",
-    ...withinWeek ? {} : { day: "numeric", month: "short" }
-  });
-  return `${dateFmt.format(target)} ${timeStr}`;
-}
-function fmtPct(pct) {
-  return `${Math.min(100, Math.round(pct))}%`;
-}
-function displayLabel(label, opts) {
-  return opts.demo ? maskEmail(label) : label;
-}
-function renderAccountRow(snap, opts) {
-  const now = opts.now ?? new Date;
-  const tz = opts.tz ?? "UTC";
-  const lines = [];
-  const marker = snap.isActive ? "\u25cf " : "";
-  const label = displayLabel(snap.label, opts);
-  if (!snap.quota) {
-    lines.push(`${marker}\`${codeSpanSafe(label)}\`  _quota probe failed_`);
-    if (snap.quotaError) {
-      lines.push(`  _${escapeMarkdown(snap.quotaError)}_`);
-    }
-    return lines;
-  }
-  const q = snap.quota;
-  if (isProbeThin(q)) {
-    lines.push(`${marker}\`${codeSpanSafe(label)}\`  _quota unknown (thin probe)_`);
-    return lines;
-  }
-  const norm = refillNormalizedUtils(q, now);
-  const fiveStr = fmtPct(norm.fiveHourUtilizationPct);
-  const sevenStr = fmtPct(norm.sevenDayUtilizationPct);
-  lines.push(`${marker}\`${codeSpanSafe(label)}\`  ${fiveStr} / ${sevenStr}`);
-  const health = classifyHealth(snap, now);
-  if (health === "blocked") {
-    const win = bindingWindow(q);
-    const reset = win === "5h" ? q.fiveHourResetAt : q.sevenDayResetAt;
-    const winLabel = win === "5h" ? "5-hour" : "7-day";
-    lines.push(reset ? `  _quota exhausted \u2014 back ${formatAbsolute(reset, tz)} (\`in ${formatRelative(reset, now)}\`, ${winLabel} cap)_` : `  _quota exhausted \u2014 ${winLabel} cap, reset time unknown_`);
-    return lines;
-  }
-  const fiveResetIn = q.fiveHourResetAt ? q.fiveHourResetAt.getTime() - now.getTime() : Infinity;
-  const sevenResetIn = q.sevenDayResetAt ? q.sevenDayResetAt.getTime() - now.getTime() : Infinity;
-  const fiveFirst = fiveResetIn <= sevenResetIn;
-  const fiveSeg = q.fiveHourResetAt ? `5h refills ${formatAbsolute(q.fiveHourResetAt, tz)} (\`in ${formatRelative(q.fiveHourResetAt, now)}\`)` : "5h refills \u2014";
-  const sevenSeg = q.sevenDayResetAt ? `7d resets ${formatAbsolute(q.sevenDayResetAt, tz)} (\`in ${formatRelative(q.sevenDayResetAt, now)}\`)` : "7d resets \u2014";
-  lines.push(`  _${fiveFirst ? fiveSeg : sevenSeg}_`);
-  lines.push(`  _${fiveFirst ? sevenSeg : fiveSeg}_`);
-  if (q.overageDisabledReason != null && OVERAGE_EXHAUSTED_REASONS.has(q.overageDisabledReason)) {
-    lines.push(`  _overage off (${escapeMarkdown(q.overageDisabledReason)}) \u2014 serving from quota_`);
-  }
-  return lines;
-}
-function formatAgeStamp(atMs, now = new Date) {
-  const ageSec = Math.max(0, Math.round((now.getTime() - atMs) / 1000));
-  return ageSec < 60 ? `${ageSec}s ago` : `${Math.round(ageSec / 60)}m ago`;
-}
-function tableCell(s) {
-  return s.replace(/\\/g, "\\\\").replace(/\|/g, "\\|").replace(/\r?\n/g, " ");
-}
-function pctCells(snap, now) {
-  if (!snap.quota)
-    return { five: "\u2014", seven: "\u2014" };
-  if (isProbeThin(snap.quota))
-    return { five: "?", seven: "?" };
-  const norm = refillNormalizedUtils(snap.quota, now);
-  return { five: fmtPct(norm.fiveHourUtilizationPct), seven: fmtPct(norm.sevenDayUtilizationPct) };
-}
-function windowResetCell(snap, now, tz, win) {
-  if (!snap.quota) {
-    return snap.quotaError ? `probe failed (${snap.quotaError})` : "\u2014";
-  }
-  if (isProbeThin(snap.quota))
-    return "quota unknown";
-  const reset = win === "5h" ? snap.quota.fiveHourResetAt : snap.quota.sevenDayResetAt;
-  if (!reset)
-    return "\u2014";
-  return `${formatStatusTime(reset, now, tz)} (in ${formatRelative(reset, now)})`;
-}
-function renderAuthSnapshotFormat2(snapshots, opts = {}) {
-  const now = opts.now ?? new Date;
-  const tz = opts.tz ?? "UTC";
-  const lines = [];
-  lines.push("\uD83D\uDD0B **Auth \u2014 fleet status**");
-  const ordered = [...snapshots].sort((a, b) => {
-    if (a.isActive !== b.isActive)
-      return a.isActive ? -1 : 1;
-    const r = TABLE_HEALTH_RANK[classifyHealth(a, now)] - TABLE_HEALTH_RANK[classifyHealth(b, now)];
-    if (r !== 0)
-      return r;
-    return a.label.localeCompare(b.label);
-  });
-  if (ordered.length > 0) {
-    lines.push("");
-    lines.push("| State | Account | 5h | 5h resets | 7d | 7d resets |");
-    lines.push("| --- | --- | --- | --- | --- | --- |");
-    for (const s of ordered) {
-      const emoji = HEALTH_EMOJI[classifyHealth(s, now)];
-      const label = displayLabel(s.label, opts);
-      const accountCell = `\`${codeSpanSafe(s.isActive ? `${label} (active)` : label)}\``;
-      const { five, seven } = pctCells(s, now);
-      const fiveReset = windowResetCell(s, now, tz, "5h");
-      const sevenReset = windowResetCell(s, now, tz, "7d");
-      lines.push(`| ${emoji} | ${tableCell(accountCell)} | ${five} | ${tableCell(fiveReset)} | ${seven} | ${tableCell(sevenReset)} |`);
-    }
-  }
-  lines.push("");
-  lines.push(`_${recommendation(snapshots, now, opts.demo ?? false)}_`);
-  if (opts.staleCachedAtMs != null) {
-    lines.push(`_\u26a0 cached ${formatAgeStamp(opts.staleCachedAtMs, now)}_`);
-  } else if (opts.liveProbedAtMs != null) {
-    lines.push(`_Live \u00b7 refreshed ${formatAgeStamp(opts.liveProbedAtMs, now)}_`);
-  } else if (opts.probeFailed) {
-    lines.push("_\u26a0 probe failed \u2014 no live data_");
-  } else {
-    lines.push("_Live_");
-  }
-  return lines.join(`
-`);
-}
-function recommendation(snapshots, now = new Date, demo = false) {
-  const active = snapshots.find((s) => s.isActive);
-  if (!active)
-    return "No active account set.";
-  const activeHealth = classifyHealth(active, now);
-  const others = snapshots.filter((s) => !s.isActive);
-  const healthyAlt = others.find((s) => classifyHealth(s, now) === "healthy");
-  const lbl = (s) => demo ? maskEmail(s.label) : s.label;
-  const activeLabel = lbl(active);
-  if (activeHealth === "healthy") {
-    return `Recommendation: stay on ${activeLabel}.`;
-  }
-  if (activeHealth === "throttling") {
-    if (healthyAlt) {
-      return `Recommendation: active ${activeLabel} is throttling. Switch to ${lbl(healthyAlt)} for headroom.`;
-    }
-    return `Recommendation: active ${activeLabel} is throttling; no healthy alternative \u2014 wait for refill.`;
+  const st = statSync6(dir);
+  if (typeof process.getuid === "function" && st.uid !== process.getuid()) {
+    throw new Error(`Refusing to materialize vault entry: ${dir} not owned by caller`);
   }
-  if (activeHealth === "blocked") {
-    if (healthyAlt) {
-      return `Recommendation: active ${activeLabel} is BLOCKED \u2014 switch to ${lbl(healthyAlt)} now.`;
+  for (const [filename, { encoding, value }] of Object.entries(files)) {
+    if (filename.includes("/") || filename.includes("\\") || filename === ".." || filename === "." || filename.includes("\x00")) {
+      throw new Error(`Refusing to materialize vault file with unsafe name: ${filename}`);
     }
-    return summarizeNoHealthyAlt(snapshots, now, demo);
+    const filePath = join5(dir, filename);
+    const content = encoding === "base64" ? Buffer.from(value, "base64") : value;
+    writeFileExclusive(filePath, content);
   }
-  return `Active ${activeLabel}: quota probe failed; broker last_seen unknown.`;
+  materializedDirs.add(dir);
+  registerCleanupHook();
+  return dir;
 }
-function summarizeNoHealthyAlt(snapshots, now, demo = false) {
-  const mask = (label) => demo ? maskEmail(label) : label;
-  let throttlingLabel = null;
-  let allTrulyBlocked = true;
-  for (const s of snapshots) {
-    const h = classifyHealth(s, now);
-    if (h === "throttling") {
-      if (!throttlingLabel)
-        throttlingLabel = s.label;
-      allTrulyBlocked = false;
-    } else if (h === "healthy" || h === "unknown") {
-      allTrulyBlocked = false;
-    } else if (h === "blocked" && blockedReason(s, now) === "quota-exhausted") {
-      if (s.quota) {
-        const win = bindingWindow(s.quota);
-        const at = win === "5h" ? s.quota.fiveHourResetAt : s.quota.sevenDayResetAt;
-        if (at && at.getTime() > now.getTime())
-          allTrulyBlocked = false;
-      }
-    }
-  }
-  const earliestRecovery = pickEarliestRecovery(snapshots, now);
-  if (throttlingLabel) {
-    const eta = earliestRecovery ? ` Soonest full refill: ${mask(earliestRecovery.label)} in ${formatRelative(earliestRecovery.at, now)}.` : "";
-    return `No fully-healthy account; ${mask(throttlingLabel)} is throttling but still usable.${eta}`;
+function resolveSingleReference(ref, secrets) {
+  const entry = secrets[ref.key];
+  if (entry === undefined) {
+    throw new Error(`Vault secret not found: ${ref.key}`);
   }
-  if (!allTrulyBlocked) {
-    if (earliestRecovery) {
-      return `All accounts at capacity; soonest refill: ${mask(earliestRecovery.label)} in ${formatRelative(earliestRecovery.at, now)}.`;
+  if (ref.filename !== undefined) {
+    if (entry.kind !== "files") {
+      throw new Error(`Vault reference "vault:${ref.key}#${ref.filename}" expected kind="files", got kind="${entry.kind}".`);
     }
-    return `All accounts at capacity \u2014 waiting on a window refill.`;
+    const file = entry.files[ref.filename];
+    if (!file) {
+      throw new Error(`Vault secret "${ref.key}" has no file named "${ref.filename}". Available: ${Object.keys(entry.files).join(", ")}`);
+    }
+    return file.encoding === "base64" ? Buffer.from(file.value, "base64").toString("utf8") : file.value;
   }
-  if (earliestRecovery) {
-    return `All accounts blocked. Earliest recovery: ${mask(earliestRecovery.label)} in ${formatRelative(earliestRecovery.at, now)}.`;
+  if (entry.kind === "string" || entry.kind === "binary") {
+    return entry.value;
   }
-  return `All accounts blocked. Run /auth add to attach another subscription.`;
+  return materializeFilesEntry(ref.key, entry.files);
 }
-function pickEarliestRecovery(snapshots, now) {
-  let best = null;
-  for (const s of snapshots) {
-    if (!s.quota)
-      continue;
-    if (isProbeThin(s.quota))
-      continue;
-    const win = bindingWindow(s.quota);
-    const at = win === "5h" ? s.quota.fiveHourResetAt : s.quota.sevenDayResetAt;
-    if (!at || at.getTime() <= now.getTime())
-      continue;
-    if (!best || at.getTime() < best.at.getTime()) {
-      best = { label: s.label, at };
+function resolveValue(value, secrets) {
+  if (typeof value === "string" && isVaultReference(value)) {
+    const ref = parseVaultReferenceDetailed(value);
+    return resolveSingleReference(ref, secrets);
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => resolveValue(item, secrets));
+  }
+  if (value !== null && typeof value === "object") {
+    const resolved = {};
+    for (const [k, v] of Object.entries(value)) {
+      resolved[k] = resolveValue(v, secrets);
     }
+    return resolved;
   }
-  return best;
+  return value;
 }
-function renderFallbackAnnouncement(input) {
-  const now = input.now ?? new Date;
-  const tz = input.tz ?? "UTC";
-  const lines = [];
-  const limitWord = input.oldQuota ? limitWordFor(input.oldQuota) : "quota";
-  const headerLimit = input.cause === "rate-limit" ? "rate limit" : limitWord === "quota" ? "quota cap" : `${limitWord} limit`;
-  if (!input.newLabel) {
-    lines.push(`\uD83D\uDD34 **All accounts blocked \u00b7 ${headerLimit} on ${escapeMarkdown(input.oldLabel)}**`);
-    lines.push("");
-    lines.push(`Triggered by: agent **${escapeMarkdown(input.triggerAgent)}**`);
-    const fleet = input.fleetSnapshots ?? [];
-    if (fleet.length > 0) {
-      lines.push("");
-      const rowOpts = { now, tz };
-      const healthOrder = ["blocked", "throttling", "healthy", "unknown"];
-      const rank = (s) => healthOrder.indexOf(classifyHealth(s, now));
-      const ordered = [...fleet].sort((a, b) => rank(a) - rank(b) || Number(b.isActive) - Number(a.isActive));
-      for (const snap of ordered) {
-        for (const ln of renderAccountRow(snap, rowOpts))
-          lines.push(ln);
-      }
-      const earliest = pickEarliestRecovery(fleet, now);
-      if (earliest) {
-        lines.push("");
-        lines.push(`Earliest recovery: \`${codeSpanSafe(earliest.label)}\` ` + `${formatAbsolute(earliest.at, tz)} (in ${formatRelative(earliest.at, now)})`);
-      }
-    } else {
-      const recovery = (input.oldQuota ? recoveryAtFor(input.oldQuota) : null) ?? input.parsedResetAt ?? null;
-      if (recovery) {
-        lines.push(`${escapeMarkdown(input.oldLabel)} recovers ${formatAbsolute(recovery, tz)} ` + `(in ${formatRelative(recovery, now)})`);
+async function resolveVaultReferencesViaBroker(config, brokerOpts) {
+  const socketPath = resolveBrokerSocketPath({
+    ...brokerOpts,
+    vaultBrokerSocket: config.vault?.broker?.socket ? resolvePath(config.vault.broker.socket) : undefined
+  });
+  const opts = { ...brokerOpts, socket: socketPath };
+  const refs = collectVaultRefs(config);
+  if (refs.size === 0) {
+    return { ok: true, config };
+  }
+  const brokerSecrets = {};
+  let sawDenied = false;
+  let sawUnreachable = false;
+  let sawLocked = false;
+  let sawNotFound = false;
+  const resolverAgentSlug = process.env.SWITCHROOM_AGENT_NAME;
+  const resolverToken = resolverAgentSlug ? readVaultTokenFile(resolverAgentSlug) ?? undefined : undefined;
+  const optsWithToken = resolverToken ? { ...opts, token: resolverToken } : opts;
+  for (const key of refs) {
+    const result = await getViaBrokerStructured(key, optsWithToken);
+    if (result.kind === "ok") {
+      brokerSecrets[key] = result.entry;
+    } else if (result.kind === "unreachable") {
+      sawUnreachable = true;
+      break;
+    } else if (result.kind === "denied") {
+      if (result.code === "LOCKED") {
+        sawLocked = true;
+      } else {
+        sawDenied = true;
       }
+    } else if (result.kind === "not_found") {
+      sawNotFound = true;
     }
-    lines.push("");
-    lines.push(`Run \`/auth add <label>\` to attach another subscription, ` + `or \`/auth refresh\` to re-probe.`);
-    return lines.join(`
-`);
   }
-  lines.push(`\u2713 **Switched fleet \u00b7 ${headerLimit} on ${escapeMarkdown(input.oldLabel)}**`);
-  lines.push("");
-  lines.push(`\`${codeSpanSafe(input.oldLabel)}\` \u2192 \`${codeSpanSafe(input.newLabel)}\``);
-  lines.push(`Triggered by: agent **${escapeMarkdown(input.triggerAgent)}**`);
-  lines.push("");
-  {
-    const recovery = (input.oldQuota ? recoveryAtFor(input.oldQuota) : null) ?? input.parsedResetAt ?? null;
-    if (recovery) {
-      lines.push(`\`${codeSpanSafe(input.oldLabel)}\` recovers ` + `${formatAbsolute(recovery, tz)} (in ${formatRelative(recovery, now)})`);
-    }
+  const resolvedCount = Object.keys(brokerSecrets).length;
+  const allResolved = resolvedCount === refs.size;
+  if (allResolved) {
+    return { ok: true, config: resolveValue(config, brokerSecrets) };
   }
-  if (input.newQuota) {
-    const fiveStr = fmtPct(input.newQuota.fiveHourUtilizationPct);
-    const sevenStr = fmtPct(input.newQuota.sevenDayUtilizationPct);
-    const hasHeadroom = input.newQuota.fiveHourUtilizationPct < THROTTLING_THRESHOLD_PCT && input.newQuota.sevenDayUtilizationPct < THROTTLING_THRESHOLD_PCT;
-    const headroomStr = hasHeadroom ? "_(plenty of headroom)_" : "_(near limit \u2014 watch this)_";
-    lines.push(`\`${codeSpanSafe(input.newLabel)}\` now: ${fiveStr} of 5h \u00b7 ${sevenStr} of 7d ${headroomStr}`);
-  } else {
-    lines.push(`_(quota probe for new account is pending \u2014 will reflect on next /auth)_`);
+  if (sawUnreachable && !sawDenied && !sawLocked && !sawNotFound) {
+    return { ok: false, reason: "unreachable" };
   }
-  return lines.join(`
-`);
-}
-function limitWordFor(q) {
-  if (q.representativeClaim === "seven_day" && q.sevenDayUtilizationPct >= 99)
-    return "7-day";
-  if (q.representativeClaim === "five_hour" && q.fiveHourUtilizationPct >= 99)
-    return "5-hour";
-  if (q.sevenDayUtilizationPct >= 99)
-    return "7-day";
-  if (q.fiveHourUtilizationPct >= 99)
-    return "5-hour";
-  return q.sevenDayUtilizationPct >= q.fiveHourUtilizationPct ? "7-day" : "5-hour";
-}
-function recoveryAtFor(q) {
-  const word = limitWordFor(q);
-  if (word === "7-day")
-    return q.sevenDayResetAt;
-  if (word === "5-hour")
-    return q.fiveHourResetAt;
-  if (!q.fiveHourResetAt)
-    return q.sevenDayResetAt;
-  if (!q.sevenDayResetAt)
-    return q.fiveHourResetAt;
-  return q.fiveHourResetAt.getTime() < q.sevenDayResetAt.getTime() ? q.fiveHourResetAt : q.sevenDayResetAt;
-}
-function buildSnapshotKeyboard(snapshots, opts = {}) {
-  const max = opts.maxSwitchButtons ?? 3;
-  const now = opts.now ?? new Date;
-  const rows = [];
-  const switchTargets = snapshots.filter((s) => !s.isActive).sort((a, b) => switchPriority(a, now) - switchPriority(b, now)).filter((s) => classifyHealth(s, now) !== "blocked" && classifyHealth(s, now) !== "unknown").slice(0, max);
-  for (const t of switchTargets) {
-    rows.push([
-      {
-        text: `Switch fleet \u2192 ${opts.demo ? maskEmail(t.label) : t.label}`,
-        callbackData: `auth:use:${t.label}`
-      }
-    ]);
+  if (sawLocked && !sawDenied && !sawUnreachable && !sawNotFound) {
+    return { ok: false, reason: "locked" };
   }
-  rows.push([
-    { text: "\u21bb Refresh", callbackData: opts.demo ? "auth:refresh:demo" : "auth:refresh" },
-    { text: "/usage", insertText: "/usage" },
-    { text: "+ Add", insertText: "/auth add " }
-  ]);
-  return rows;
-}
-function switchPriority(s, now = new Date) {
-  const h = classifyHealth(s, now);
-  if (h === "healthy")
-    return 0;
-  if (h === "throttling")
-    return 1;
-  if (h === "unknown")
-    return 2;
-  return 3;
+  if (sawDenied && !sawUnreachable && !sawLocked && !sawNotFound) {
+    return { ok: false, reason: "denied" };
+  }
+  if (sawNotFound && !sawDenied && !sawUnreachable && !sawLocked && resolvedCount > 0) {
+    return { ok: true, config: resolveValue(config, brokerSecrets) };
+  }
+  if (sawNotFound && !sawDenied && !sawUnreachable && !sawLocked && resolvedCount === 0) {
+    return { ok: false, reason: "not_found" };
+  }
+  return { ok: false, reason: "unknown" };
 }
-function zipProbeResults(labels, results) {
-  let staleCachedAtMs;
-  const quotas = labels.map((label) => {
-    const hit = results.find((r) => r.label === label);
-    if (!hit)
-      return { ok: false, reason: "broker returned no result for account" };
-    if (hit.served === "cache" && hit.capturedAt != null) {
-      staleCachedAtMs = staleCachedAtMs == null ? hit.capturedAt : Math.min(staleCachedAtMs, hit.capturedAt);
+function collectVaultRefs(value) {
+  const keys = new Set;
+  function walk(v) {
+    if (typeof v === "string" && isVaultReference(v)) {
+      const ref = parseVaultReferenceDetailed(v);
+      keys.add(ref.key);
+    } else if (Array.isArray(v)) {
+      for (const item of v)
+        walk(item);
+    } else if (v !== null && typeof v === "object") {
+      for (const val of Object.values(v))
+        walk(val);
     }
-    return hit.result;
-  });
-  return staleCachedAtMs != null ? { quotas, staleCachedAtMs } : { quotas };
-}
-function deriveUsageFooterFreshness(results, staleCachedAtMs, liveProbedAtMs) {
-  if (staleCachedAtMs != null)
-    return { staleCachedAtMs };
-  if (results.some((r) => r.result.ok))
-    return { liveProbedAtMs };
-  return { probeFailed: true };
-}
-function buildSnapshotsFromState(state, quotas) {
-  const out = [];
-  for (let i = 0;i < state.accounts.length; i++) {
-    const acc = state.accounts[i];
-    const q = quotas[i];
-    out.push({
-      label: acc.label,
-      isActive: acc.label === state.active,
-      quota: q && q.ok ? q.data : null,
-      quotaError: q && !q.ok ? q.reason : undefined,
-      expiresAtMs: acc.expiresAt
-    });
   }
-  return out;
-}
-function reviveLastQuota(snap) {
-  if (!snap)
-    return null;
-  return {
-    fiveHourUtilizationPct: snap.fiveHourUtilizationPct,
-    sevenDayUtilizationPct: snap.sevenDayUtilizationPct,
-    fiveHourResetAt: snap.fiveHourResetAt ? new Date(snap.fiveHourResetAt) : null,
-    sevenDayResetAt: snap.sevenDayResetAt ? new Date(snap.sevenDayResetAt) : null,
-    representativeClaim: snap.representativeClaim,
-    overageStatus: snap.overageStatus,
-    overageDisabledReason: snap.overageDisabledReason,
-    fiveHourUtilPresent: snap.fiveHourUtilPresent,
-    sevenDayUtilPresent: snap.sevenDayUtilPresent
-  };
-}
-function buildSnapshotsFromCachedState(state) {
-  return state.accounts.map((acc) => {
-    const lq = acc.last_quota ?? null;
-    return {
-      label: acc.label,
-      isActive: acc.label === state.active,
-      quota: reviveLastQuota(lq),
-      quotaError: lq ? undefined : "no cached quota (no probe since broker start)",
-      expiresAtMs: acc.expiresAt,
-      capturedAtMs: lq?.capturedAt
-    };
-  });
+  walk(value);
+  return keys;
 }
-var THROTTLING_THRESHOLD_PCT = 80, OVERAGE_EXHAUSTED_REASONS, HEALTH_EMOJI, TABLE_HEALTH_RANK;
-var init_auth_snapshot_format = __esm(() => {
-  init_demo_mask();
-  init_card_format();
-  OVERAGE_EXHAUSTED_REASONS = new Set(["out_of_credits"]);
-  HEALTH_EMOJI = {
-    healthy: "\uD83D\uDFE2",
-    throttling: "\uD83D\uDFE1",
-    blocked: "\uD83D\uDD34",
-    unknown: "\u26aa"
-  };
-  TABLE_HEALTH_RANK = {
-    blocked: 0,
-    throttling: 1,
-    unknown: 2,
-    healthy: 3
-  };
+var materializedDirs, cleanupRegistered = false, cachedRoot = null;
+var init_resolver = __esm(() => {
+  init_vault();
+  init_loader();
+  init_client();
+  materializedDirs = new Set;
 });
 
 // ../src/auth/broker/protocol.ts
@@ -22719,6 +22754,8 @@ var init_protocol2 = __esm(() => {
     label: exports_external.string(),
     expiresAt: exports_external.number().optional(),
     exhausted: exports_external.boolean(),
+    in_service: exports_external.boolean().optional(),
+    entitlement_blocked: exports_external.boolean().optional(),
     exhausted_until: exports_external.number().optional(),
     throttled_until: exports_external.number().optional(),
     threshold_violations: exports_external.number().int().nonnegative().optional(),
@@ -36788,6 +36825,12 @@ __export(exports_auth_snapshot_format2, {
   THROTTLING_THRESHOLD_PCT: () => THROTTLING_THRESHOLD_PCT2
 });
 function classifyHealth2(snap, now = new Date) {
+  if (!snap.isActive) {
+    if (snap.entitlementBlocked === true)
+      return "org-blocked";
+    if (snap.inService === false)
+      return "retired";
+  }
   if (!snap.quota)
     return "unknown";
   const q = snap.quota;
@@ -36880,6 +36923,12 @@ function renderAccountRow2(snap, opts) {
   const lines = [];
   const marker = snap.isActive ? "\u25cf " : "";
   const label = displayLabel2(snap.label, opts);
+  const health = classifyHealth2(snap, now);
+  if (health === "org-blocked" || health === "retired") {
+    const note = health === "org-blocked" ? "DISABLED (org) \u2014 no fleet routing" : "retired \u2014 removed from fleet rotation";
+    lines.push(`${marker}\`${codeSpanSafe(label)}\`  _${note}_`);
+    return lines;
+  }
   if (!snap.quota) {
     lines.push(`${marker}\`${codeSpanSafe(label)}\`  _quota probe failed_`);
     if (snap.quotaError) {
@@ -36896,7 +36945,6 @@ function renderAccountRow2(snap, opts) {
   const fiveStr = fmtPct2(norm.fiveHourUtilizationPct);
   const sevenStr = fmtPct2(norm.sevenDayUtilizationPct);
   lines.push(`${marker}\`${codeSpanSafe(label)}\`  ${fiveStr} / ${sevenStr}`);
-  const health = classifyHealth2(snap, now);
   if (health === "blocked") {
     const win = bindingWindow3(q);
     const reset2 = win === "5h" ? q.fiveHourResetAt : q.sevenDayResetAt;
@@ -36988,7 +37036,11 @@ function recommendation2(snapshots, now = new Date, demo = false) {
   if (!active)
     return "No active account set.";
   const activeHealth = classifyHealth2(active, now);
-  const others = snapshots.filter((s) => !s.isActive);
+  const inServiceFleet = snapshots.filter((s) => {
+    const h = classifyHealth2(s, now);
+    return h !== "retired" && h !== "org-blocked";
+  });
+  const others = inServiceFleet.filter((s) => !s.isActive);
   const healthyAlt = others.find((s) => classifyHealth2(s, now) === "healthy");
   const lbl = (s) => demo ? maskEmail(s.label) : s.label;
   const activeLabel = lbl(active);
@@ -37005,7 +37057,7 @@ function recommendation2(snapshots, now = new Date, demo = false) {
     if (healthyAlt) {
       return `Recommendation: active ${activeLabel} is BLOCKED \u2014 switch to ${lbl(healthyAlt)} now.`;
     }
-    return summarizeNoHealthyAlt2(snapshots, now, demo);
+    return summarizeNoHealthyAlt2(inServiceFleet, now, demo);
   }
   return `Active ${activeLabel}: quota probe failed; broker last_seen unknown.`;
 }
@@ -37077,7 +37129,14 @@ function renderFallbackAnnouncement2(input) {
     if (fleet.length > 0) {
       lines.push("");
       const rowOpts = { now, tz };
-      const healthOrder = ["blocked", "throttling", "healthy", "unknown"];
+      const healthOrder = [
+        "org-blocked",
+        "blocked",
+        "throttling",
+        "healthy",
+        "unknown",
+        "retired"
+      ];
       const rank = (s) => healthOrder.indexOf(classifyHealth2(s, now));
       const ordered = [...fleet].sort((a, b) => rank(a) - rank(b) || Number(b.isActive) - Number(a.isActive));
       for (const snap of ordered) {
@@ -37150,7 +37209,10 @@ function buildSnapshotKeyboard2(snapshots, opts = {}) {
   const max = opts.maxSwitchButtons ?? 3;
   const now = opts.now ?? new Date;
   const rows = [];
-  const switchTargets = snapshots.filter((s) => !s.isActive).sort((a, b) => switchPriority2(a, now) - switchPriority2(b, now)).filter((s) => classifyHealth2(s, now) !== "blocked" && classifyHealth2(s, now) !== "unknown").slice(0, max);
+  const switchTargets = snapshots.filter((s) => !s.isActive).sort((a, b) => switchPriority2(a, now) - switchPriority2(b, now)).filter((s) => {
+    const h = classifyHealth2(s, now);
+    return h !== "blocked" && h !== "unknown" && h !== "retired" && h !== "org-blocked";
+  }).slice(0, max);
   for (const t of switchTargets) {
     rows.push([
       {
@@ -37174,7 +37236,9 @@ function switchPriority2(s, now = new Date) {
     return 1;
   if (h === "unknown")
     return 2;
-  return 3;
+  if (h === "blocked")
+    return 3;
+  return 4;
 }
 function zipProbeResults2(labels, results) {
   let staleCachedAtMs;
@@ -37206,7 +37270,9 @@ function buildSnapshotsFromState2(state7, quotas) {
       isActive: acc.label === state7.active,
       quota: q && q.ok ? q.data : null,
       quotaError: q && !q.ok ? q.reason : undefined,
-      expiresAtMs: acc.expiresAt
+      expiresAtMs: acc.expiresAt,
+      inService: acc.in_service,
+      entitlementBlocked: acc.entitlement_blocked
     });
   }
   return out;
@@ -37235,7 +37301,9 @@ function buildSnapshotsFromCachedState2(state7) {
       quota: reviveLastQuota2(lq),
       quotaError: lq ? undefined : "no cached quota (no probe since broker start)",
       expiresAtMs: acc.expiresAt,
-      capturedAtMs: lq?.capturedAt
+      capturedAtMs: lq?.capturedAt,
+      inService: acc.in_service,
+      entitlementBlocked: acc.entitlement_blocked
     };
   });
 }
@@ -37248,13 +37316,17 @@ var init_auth_snapshot_format2 = __esm(() => {
     healthy: "\uD83D\uDFE2",
     throttling: "\uD83D\uDFE1",
     blocked: "\uD83D\uDD34",
-    unknown: "\u26aa"
+    unknown: "\u26aa",
+    "org-blocked": "\u26d4",
+    retired: "\u26ab"
   };
   TABLE_HEALTH_RANK2 = {
-    blocked: 0,
-    throttling: 1,
-    unknown: 2,
-    healthy: 3
+    "org-blocked": 0,
+    blocked: 1,
+    throttling: 2,
+    unknown: 3,
+    healthy: 4,
+    retired: 5
   };
 });
 
@@ -37861,9 +37933,13 @@ function buildBar(pct, elapsedFrac) {
   cells[tickIndex] = "\u2503";
   return cells.join("");
 }
-function accountStatus(isActive, exhausted) {
+function accountStatus(isActive, exhausted, opts = {}) {
   if (isActive)
     return "active";
+  if (opts.entitlementBlocked === true)
+    return "org-disabled";
+  if (opts.inService === false)
+    return "retired";
   if (exhausted)
     return "exhausted";
   return "idle";
@@ -37876,10 +37952,15 @@ function formatWindowRow(window2, pct, resetAt, now = new Date) {
   const timeLeft = formatTimeLeft(resetAt, now);
   return `- ${dot} ${window2} \`[${bar}] ${pctStr} / ${timeLeft}\``;
 }
-function renderQuotaBarAccount(label, isActive, exhausted, quota, now = new Date, demo = false) {
-  const status = accountStatus(isActive, exhausted);
+function renderQuotaBarAccount(label, isActive, exhausted, quota, now = new Date, demo = false, service = {}) {
+  const status = accountStatus(isActive, exhausted, service);
   const displayLabel3 = demo ? maskEmail(label) : label;
-  const lines = [`- **${escapeMarkdown(displayLabel3)}** (${status})`];
+  const lines = [`- **${escapeMarkdown(displayLabel3)}** (${STATUS_LABEL[status]})`];
+  if (status === "retired" || status === "org-disabled") {
+    const note = status === "org-disabled" ? "disabled by org \u2014 no fleet routing" : "retired \u2014 removed from fleet rotation";
+    lines.push(`- \u26ab \`${note}\``);
+    return lines;
+  }
   if (!quota || isProbeThin(quota)) {
     const reason = !quota ? "no data \u2014 probe failed" : "no data \u2014 thin probe";
     lines.push(`- \u26a0\ufe0f 5h \`${reason}\``);
@@ -37899,9 +37980,17 @@ function renderQuotaBarBlock(snapshots, exhaustedByLabel, opts = {}) {
   const now = opts.now ?? new Date;
   const demo = opts.demo ?? false;
   const lines = [];
-  for (const snap of snapshots) {
+  const outOfService = (s) => !s.isActive && (s.entitlementBlocked === true || s.inService === false);
+  const ordered = [
+    ...snapshots.filter((s) => !outOfService(s)),
+    ...snapshots.filter(outOfService)
+  ];
+  for (const snap of ordered) {
     const exhausted = exhaustedByLabel.get(snap.label) ?? false;
-    lines.push(...renderQuotaBarAccount(snap.label, snap.isActive, exhausted, snap.quota, now, demo));
+    lines.push(...renderQuotaBarAccount(snap.label, snap.isActive, exhausted, snap.quota, now, demo, {
+      inService: snap.inService,
+      entitlementBlocked: snap.entitlementBlocked
+    }));
   }
   return lines.join(`
 `);
@@ -37915,7 +38004,9 @@ function renderQuotaBarBlockFromListState(state7, opts = {}) {
     quota: reviveLastQuota(acc.last_quota ?? null),
     quotaError: acc.last_quota ? undefined : "no cached quota (no probe since broker start)",
     expiresAtMs: acc.expiresAt,
-    capturedAtMs: acc.last_quota?.capturedAt
+    capturedAtMs: acc.last_quota?.capturedAt,
+    inService: acc.in_service,
+    entitlementBlocked: acc.entitlement_blocked
   }));
   return renderQuotaBarBlock(snapshots, exhaustedByLabel, { now });
 }
@@ -37940,7 +38031,7 @@ function renderUsageCard(snapshots, exhaustedByLabel, opts = {}) {
   return lines.join(`
 `);
 }
-var FIVE_HOUR_MS, SEVEN_DAY_MS, BAR_WIDTH = 10;
+var FIVE_HOUR_MS, SEVEN_DAY_MS, BAR_WIDTH = 10, STATUS_LABEL;
 var init_quota_bar_format = __esm(() => {
   init_auth_snapshot_format();
   init_card_format();
@@ -37948,6 +38039,13 @@ var init_quota_bar_format = __esm(() => {
   init_external_spend2();
   FIVE_HOUR_MS = 5 * 60 * 60 * 1000;
   SEVEN_DAY_MS = 7 * 24 * 60 * 60 * 1000;
+  STATUS_LABEL = {
+    active: "active",
+    "org-disabled": "DISABLED (org)",
+    retired: "retired",
+    exhausted: "exhausted",
+    idle: "idle"
+  };
 });
 
 // external-spend.ts
@@ -40267,6 +40365,23 @@ function normalizeForDedup(text) {
 
 // flushed-turn-supersede.ts
 var DEFAULT_SUPERSEDE_TTL_MS = 60000;
+var SUPERSEDE_MATCH_MIN_CONTAINMENT_CHARS = 32;
+function normalizeForMatch(text) {
+  return text.replace(/\s+/g, " ").trim();
+}
+function flushedAnswerMatchesReply(flushedText, replyText) {
+  const flushed = normalizeForMatch(flushedText);
+  const reply = normalizeForMatch(replyText);
+  if (flushed.length === 0 || reply.length === 0)
+    return false;
+  if (flushed === reply)
+    return true;
+  if (reply.length >= SUPERSEDE_MATCH_MIN_CONTAINMENT_CHARS && flushed.includes(reply))
+    return true;
+  if (flushed.length >= SUPERSEDE_MATCH_MIN_CONTAINMENT_CHARS && reply.includes(flushed))
+    return true;
+  return false;
+}
 function decideSupersede(record, args) {
   const ttlMs = args.ttlMs ?? DEFAULT_SUPERSEDE_TTL_MS;
   if (record == null)
@@ -40278,7 +40393,15 @@ function decideSupersede(record, args) {
   if (!sameTurn) {
     return { supersede: false, deleteMessageIds: [], reason: "different-turn" };
   }
-  return { supersede: true, deleteMessageIds: [...record.messageIds], reason: "supersede" };
+  if (args.replyText != null && !flushedAnswerMatchesReply(record.text, args.replyText)) {
+    return { supersede: false, deleteMessageIds: [], reason: "new-content", recordText: record.text };
+  }
+  return {
+    supersede: true,
+    deleteMessageIds: [...record.messageIds],
+    reason: "supersede",
+    recordText: record.text
+  };
 }
 var NULL_TURN_KEY = "<<null-turn>>";
 function turnKey(turnId) {
@@ -40310,7 +40433,12 @@ class FlushedTurnSupersedeRegistry {
   }
   peek(chatId, threadId, args) {
     const rec = this.entries.get(makeKey2(chatId, threadId))?.get(turnKey(args.liveTurnId));
-    return decideSupersede(rec, { liveTurnId: args.liveTurnId, now: args.now, ttlMs: this.ttlMs });
+    return decideSupersede(rec, {
+      liveTurnId: args.liveTurnId,
+      replyText: args.replyText,
+      now: args.now,
+      ttlMs: this.ttlMs
+    });
   }
   take(chatId, threadId, args) {
     const lane = makeKey2(chatId, threadId);
@@ -40899,6 +41027,63 @@ function buildStopReply2(turnInFlight, queuedSessionCmds) {
 `) };
 }
 
+// gateway/auth-command.ts
+init_format();
+init_auth_snapshot_format();
+init_demo_mask();
+var pendingAuthRmFlows = new Map;
+function isAuthAdmin(args) {
+  return args.isAdmin === true;
+}
+var REQUIRED_USAGE_SCOPE = "user:profile";
+function readdPrecheckError(label, replace, labelExists) {
+  if (replace && !labelExists) {
+    return `**/auth readd:** no account named \`${codeSpanSafe(label)}\` to re-auth. ` + `Run \`/auth show\` for the current list, or \`/auth add ${codeSpanSafe(label)}\` to add it fresh.`;
+  }
+  if (!replace && labelExists) {
+    return `**/auth add:** \`${codeSpanSafe(label)}\` already exists. ` + `Use \`/auth readd ${codeSpanSafe(label)}\` to re-authenticate it in place (e.g. to widen scope).`;
+  }
+  return null;
+}
+async function runReaddPrecheck(getClient, label, replace) {
+  try {
+    const client = await getClient();
+    if (!client)
+      return null;
+    const state = await client.listState();
+    const exists = state.accounts.some((a) => a.label === label);
+    return readdPrecheckError(label, replace, exists);
+  } catch {
+    return null;
+  }
+}
+function formatGrantedScopesReply(scopes) {
+  const list = Array.isArray(scopes) ? scopes.filter((s) => typeof s === "string") : [];
+  const hasUsageScope = list.includes(REQUIRED_USAGE_SCOPE);
+  if (list.length === 0) {
+    return {
+      text: `
+\u26a0\ufe0f **No scopes reported** on the new token \u2014 could not confirm \`${REQUIRED_USAGE_SCOPE}\`. ` + `7-day usage reporting may not work. Re-run \`/auth readd\` if usage is missing.`,
+      hasUsageScope: false
+    };
+  }
+  const rendered = list.map((s) => `\`${codeSpanSafe(s)}\``).join(", ");
+  if (hasUsageScope) {
+    return {
+      text: `
+Granted scopes: ${rendered}
+\u2713 \`${REQUIRED_USAGE_SCOPE}\` present \u2014 7-day usage reporting is unlocked.`,
+      hasUsageScope: true
+    };
+  }
+  return {
+    text: `
+Granted scopes: ${rendered}
+` + `\u26a0\ufe0f **\`${REQUIRED_USAGE_SCOPE}\` is MISSING** \u2014 7-day usage reporting will not work for this account. ` + `This usually means the narrow \`setup-token\` minter was used. Re-run \`/auth readd <label>\` with the broad login to fix.`,
+    hasUsageScope: false
+  };
+}
+
 // gateway/interrupt-defer.ts
 class ToolFlightTracker2 {
   inFlight = new Set;
@@ -41944,11 +42129,14 @@ async function interceptAuthAdd(p, deps) {
     deps.pendingAuthAddFlows.delete(p.interceptKey);
     try {
       const credentials = await deps.submitAccountAuthCode(pendingAdd, p.text.trim());
+      const replace = pendingAdd.replace === true;
       try {
-        await deps.addAccountViaBroker(pendingAdd.label, credentials, { replace: false });
+        await deps.addAccountViaBroker(pendingAdd.label, credentials, { replace });
         deps.cleanAuthAddScratchDir(pendingAdd.scratchDir);
-        await deps.switchroomReply(p.ctx, `\u2713 Account \`${pendingAdd.label}\` added.
-The fleet's active account hasn't changed. Send \`/auth use ${deps.escapeHtmlForTg(pendingAdd.label)}\` to switch to it.`, { html: true });
+        const scopeReply = formatGrantedScopesReply(credentials.claudeAiOauth?.scopes);
+        const verb = replace ? "re-authenticated" : "added";
+        await deps.switchroomReply(p.ctx, `\u2713 Account \`${pendingAdd.label}\` ${verb}.
+The fleet's active account hasn't changed. Send \`/auth use ${deps.escapeHtmlForTg(pendingAdd.label)}\` to switch to it.` + scopeReply.text, { html: true });
       } catch (brokerErr) {
         deps.cleanAuthAddScratchDir(pendingAdd.scratchDir);
         await deps.switchroomReply(p.ctx, `**/auth add failed at broker:** ${deps.escapeHtmlForTg(brokerErr?.message ?? String(brokerErr))}`, { html: true });
@@ -42574,11 +42762,14 @@ async function interceptAuthAdd2(p, deps) {
     deps.pendingAuthAddFlows.delete(p.interceptKey);
     try {
       const credentials = await deps.submitAccountAuthCode(pendingAdd, p.text.trim());
+      const replace = pendingAdd.replace === true;
       try {
-        await deps.addAccountViaBroker(pendingAdd.label, credentials, { replace: false });
+        await deps.addAccountViaBroker(pendingAdd.label, credentials, { replace });
         deps.cleanAuthAddScratchDir(pendingAdd.scratchDir);
-        await deps.switchroomReply(p.ctx, `\u2713 Account \`${pendingAdd.label}\` added.
-The fleet's active account hasn't changed. Send \`/auth use ${deps.escapeHtmlForTg(pendingAdd.label)}\` to switch to it.`, { html: true });
+        const scopeReply = formatGrantedScopesReply(credentials.claudeAiOauth?.scopes);
+        const verb = replace ? "re-authenticated" : "added";
+        await deps.switchroomReply(p.ctx, `\u2713 Account \`${pendingAdd.label}\` ${verb}.
+The fleet's active account hasn't changed. Send \`/auth use ${deps.escapeHtmlForTg(pendingAdd.label)}\` to switch to it.` + scopeReply.text, { html: true });
       } catch (brokerErr) {
         deps.cleanAuthAddScratchDir(pendingAdd.scratchDir);
         await deps.switchroomReply(p.ctx, `**/auth add failed at broker:** ${deps.escapeHtmlForTg(brokerErr?.message ?? String(brokerErr))}`, { html: true });
@@ -43539,14 +43730,23 @@ function relaunchErrorReply(deps, model, err) {
   const msg = err instanceof Error ? err.message : String(err);
   return { text: `\u274c Could not schedule model switch: ${deps.escapeHtml(msg)}`, html: true };
 }
+function unvalidatedIdCaveat(deps, model) {
+  if (!model.trim().toLowerCase().startsWith("claude-"))
+    return null;
+  return `_\`${deps.escapeHtml(model)}\` can't be validated before launch \u2014 if it isn't a real Claude model id, claude will silently serve the configured fallback model instead. I check the first reply and will warn if that happens._`;
+}
 async function scheduleRelaunchReply(deps, model, reason) {
   try {
     await deps.scheduleModelRelaunch(model, reason);
   } catch (err) {
     return relaunchErrorReply(deps, model, err);
   }
-  return { text: [switchingLine(deps, model), PERSIST_NOTE].join(`
-`), html: true };
+  const caveat = unvalidatedIdCaveat(deps, model);
+  return {
+    text: [switchingLine(deps, model), ...caveat ? [caveat] : [], PERSIST_NOTE].join(`
+`),
+    html: true
+  };
 }
 async function scheduleDefaultRelaunchReply(deps, reason) {
   try {
@@ -50832,16 +51032,28 @@ function formatModelLabel2(model) {
 }
 
 // gateway/session-model-source.ts
-function createSessionModelSource() {
+function createSessionModelSource(options = {}) {
   let seq = 0;
   let transcript = null;
   let override = null;
+  let overrideUnverified = false;
+  let onDivergence = null;
   return {
-    noteTranscriptModel(model) {
+    noteTranscriptModel(model, opts) {
       transcript = { model, seq: ++seq };
+      if (opts?.replayed === true)
+        return;
+      if (override != null && overrideUnverified) {
+        overrideUnverified = false;
+        const matches = options.servedMatchesRequested;
+        if (matches != null && !matches(override.model, model)) {
+          onDivergence?.({ requested: override.model, served: model });
+        }
+      }
     },
-    setOverride(model) {
+    setOverride(model, opts) {
       override = model == null ? null : { model, seq: ++seq };
+      overrideUnverified = model != null && opts?.verify === true;
     },
     getOverride() {
       return override?.model ?? null;
@@ -50855,6 +51067,9 @@ function createSessionModelSource() {
         return { model: override.model, source: "override" };
       }
       return { model: transcript.model, source: "transcript" };
+    },
+    setDivergenceHandler(handler) {
+      onDivergence = handler;
     }
   };
 }
@@ -68866,7 +69081,7 @@ init_format();
 init_auth_snapshot_format();
 init_demo_mask();
 var AUTH_RM_CONFIRM_TTL_MS = 60000;
-var pendingAuthRmFlows = new Map;
+var pendingAuthRmFlows2 = new Map;
 var LABEL_RE = /^[A-Za-z0-9._@+-]+$/;
 var LABEL_MAX = 64;
 function validateAuthAddLabel(label) {
@@ -68914,14 +69129,24 @@ function parseAuthCommand(text4) {
         return { kind: "help", reason: "Usage: /auth use <label>" };
       return { kind: "use", label };
     }
-    case "add": {
-      const label = parts[1];
+    case "add":
+    case "readd": {
+      const positional = parts.slice(1).filter((t) => !t.startsWith("--"));
+      const flags = new Set(parts.slice(1).filter((t) => t.startsWith("--")).map((t) => t.toLowerCase()));
+      const label = positional[0];
+      const usage = verb === "readd" ? "Usage: /auth readd <label>" : "Usage: /auth add <label>";
       if (!label)
-        return { kind: "help", reason: "Usage: /auth add <label>" };
+        return { kind: "help", reason: usage };
       const err = validateAuthAddLabel(label);
       if (err)
         return { kind: "help", reason: err };
-      return { kind: "add", label };
+      for (const f of flags) {
+        if (f !== "--replace") {
+          return { kind: "help", reason: `Unknown flag \`${codeSpanSafe(f)}\` for \`/auth ${verb}\`.` };
+        }
+      }
+      const replace2 = verb === "readd" || flags.has("--replace");
+      return { kind: "add", label, replace: replace2 };
     }
     case "cancel":
       return { kind: "cancel" };
@@ -69041,6 +69266,7 @@ async function handleAuthCommand(parsed, ctx) {
 ` + `  \`/auth use <label>\` \u2014 admin: swap the fleet to <label>
 ` + `  \`/auth rotate\` \u2014 admin: cycle to next non-exhausted fallback
 ` + `  \`/auth add <label>\` \u2014 admin: OAuth-add a new Anthropic account from chat
+` + `  \`/auth readd <label>\` \u2014 admin: re-auth an EXISTING account in place (widen scope)
 ` + `  \`/auth google add <email>\` \u2014 admin: Telegram-native Google account add/re-auth
 ` + `  \`/auth microsoft add <email>\` \u2014 admin: Telegram-native Microsoft account add/re-auth
 ` + `  \`/auth cancel\` \u2014 abort an \`/auth add\` or provider add in progress
@@ -69195,7 +69421,7 @@ async function handleAuthCommand(parsed, ctx) {
       };
     }
     if (ctx.chatId) {
-      pendingAuthRmFlows.set(ctx.chatId, {
+      pendingAuthRmFlows2.set(ctx.chatId, {
         label: parsed.label,
         expiresAt: Date.now() + AUTH_RM_CONFIRM_TTL_MS
       });
@@ -69209,11 +69435,11 @@ async function handleAuthCommand(parsed, ctx) {
     };
   }
   if (parsed.kind === "rm-confirmed") {
-    const pending = ctx.chatId ? pendingAuthRmFlows.get(ctx.chatId) : undefined;
+    const pending = ctx.chatId ? pendingAuthRmFlows2.get(ctx.chatId) : undefined;
     const now = Date.now();
     if (!pending || pending.label !== parsed.label || pending.expiresAt <= now) {
       if (ctx.chatId && pending && pending.expiresAt <= now) {
-        pendingAuthRmFlows.delete(ctx.chatId);
+        pendingAuthRmFlows2.delete(ctx.chatId);
       }
       return {
         text: `**/auth rm:** no pending confirm for \`${codeSpanSafe(parsed.label)}\` (expired or not started). ` + `Send \`/auth rm ${codeSpanSafe(parsed.label)}\` first.`,
@@ -69221,7 +69447,7 @@ async function handleAuthCommand(parsed, ctx) {
       };
     }
     if (ctx.chatId)
-      pendingAuthRmFlows.delete(ctx.chatId);
+      pendingAuthRmFlows2.delete(ctx.chatId);
     try {
       const data = await ctx.client.rmAccount(parsed.label);
       return {
@@ -69311,7 +69537,7 @@ ${failures.map((f) => `  ${f}`).join(`
     html: true
   };
 }
-function isAuthAdmin(args) {
+function isAuthAdmin2(args) {
   return args.isAdmin === true;
 }
 function isAdmin(ctx) {
@@ -70395,6 +70621,12 @@ function readTokenFromCredentialsFile(credentialsFilePath) {
   }
 }
 
+// ../src/auth/via-claude.ts
+var PRE_PASTE_RULES = [
+  { name: "theme", match: /Choose.{1,30}text.{1,30}style/, keys: ["Enter"] },
+  { name: "login-method", match: /Select login method/, keys: ["Enter"] }
+];
+
 // gateway/auth-add-flow.ts
 function makeAuthAddTmuxOps(tmuxBin = "tmux") {
   return {
@@ -70420,6 +70652,11 @@ function makeAuthAddTmuxOps(tmuxBin = "tmux") {
         stdio: ["pipe", "pipe", "pipe"]
       });
     },
+    sendKey(socket, session, key) {
+      execFileSync4(tmuxBin, ["-L", socket, "send-keys", "-t", session, key], {
+        stdio: ["pipe", "pipe", "pipe"]
+      });
+    },
     hasSession(socket, session) {
       try {
         execFileSync4(tmuxBin, ["-L", socket, "has-session", "-t", session], {
@@ -70492,10 +70729,11 @@ async function startAccountAuthSession(label, opts = {}) {
     throw new Error('tmux supervisor required for /auth add: SWITCHROOM_TMUX_SUPERVISOR is not set to "1". ' + "Legacy pipe-based setup-token is unsupported (setup-token writes to /dev/tty, not stdout/stderr).");
   }
   const home2 = opts.home ?? homedir9();
-  const urlTimeoutMs = opts.urlTimeoutMs ?? 12000;
+  const urlTimeoutMs = opts.urlTimeoutMs ?? 30000;
   const agentName3 = opts.agentName ?? process.env.SWITCHROOM_AGENT_NAME ?? "gateway";
   const tmux = opts.tmuxOps ?? makeAuthAddTmuxOps(opts.tmuxBin);
   const binary = opts.claudeBinary ?? "claude";
+  const mode = opts.mode ?? "via-claude";
   const scratchDir = pickScratchDir(label, home2);
   mkdirSync23(scratchDir, { recursive: true, mode: 448 });
   sweepOrphanSessions(home2, tmux);
@@ -70516,18 +70754,21 @@ ${tmuxSession}`, "utf8");
     sessionEnv["CLAUDE_CONFIG_DIR"] = scratchDir;
   if (process.env.XDG_CONFIG_HOME)
     sessionEnv["XDG_CONFIG_HOME"] = process.env.XDG_CONFIG_HOME;
+  const sessionCmd = mode === "via-claude" ? binary : binary + " setup-token";
+  const minterLabel = mode === "via-claude" ? "claude login" : "claude setup-token";
   try {
-    tmux.newSession(tmuxSocket, tmuxSession, sessionEnv, binary + " setup-token");
+    tmux.newSession(tmuxSocket, tmuxSession, sessionEnv, sessionCmd);
   } catch (err) {
     cleanScratchDir(scratchDir);
-    throw new Error(`Failed to start tmux session for claude setup-token: ${err.message}`);
+    throw new Error(`Failed to start tmux session for ${minterLabel}: ${err.message}`);
   }
+  const preFired = new Set;
   const loginUrl = await new Promise((resolve7, reject) => {
     const deadline = setTimeout(() => {
       clearInterval(ticker);
       tmux.killSession(tmuxSocket, tmuxSession);
       cleanScratchDir(scratchDir);
-      reject(new Error(`claude setup-token did not print an OAuth URL within ${urlTimeoutMs}ms`));
+      reject(new Error(`${minterLabel} did not print an OAuth URL within ${urlTimeoutMs}ms`));
     }, urlTimeoutMs);
     const ticker = setInterval(() => {
       const pane = tmux.capture(tmuxSocket, tmuxSession);
@@ -70535,9 +70776,20 @@ ${tmuxSession}`, "utf8");
         clearTimeout(deadline);
         clearInterval(ticker);
         cleanScratchDir(scratchDir);
-        reject(new Error("claude setup-token exited before printing OAuth URL"));
+        reject(new Error(`${minterLabel} exited before printing OAuth URL`));
         return;
       }
+      if (mode === "via-claude") {
+        for (const rule of PRE_PASTE_RULES) {
+          if (preFired.has(rule.name))
+            continue;
+          if (rule.match.test(pane)) {
+            preFired.add(rule.name);
+            for (const key of rule.keys)
+              tmux.sendKey(tmuxSocket, tmuxSession, key);
+          }
+        }
+      }
       const url = parseSetupTokenUrl(pane);
       if (url) {
         clearTimeout(deadline);
@@ -70546,12 +70798,14 @@ ${tmuxSession}`, "utf8");
       }
     }, 500);
   });
-  return { loginUrl, scratchDir, tmuxSocket, tmuxSession };
+  return { loginUrl, scratchDir, tmuxSocket, tmuxSession, mode };
 }
 async function submitAccountAuthCode(flow3, code2, opts = {}) {
   const pollIntervalMs = opts.pollIntervalMs ?? 250;
   const pollTimeoutMs = opts.pollTimeoutMs ?? 300000;
   const tmux = opts.tmuxOps ?? makeAuthAddTmuxOps();
+  const mode = flow3.mode ?? "via-claude";
+  const blindEnterDelaysMs = opts.blindEnterDelaysMs ?? (mode === "via-claude" ? [1500, 3000, 5000] : []);
   const credentialsPath = join26(flow3.scratchDir, ".credentials.json");
   try {
     tmux.send(flow3.tmuxSocket, flow3.tmuxSession, code2);
@@ -70559,9 +70813,19 @@ async function submitAccountAuthCode(flow3, code2, opts = {}) {
     cleanScratchDir(flow3.scratchDir);
     throw new Error(`Failed to submit auth code to tmux session: ${err.message}`);
   }
+  const pasteAt = Date.now();
+  const blindEnters = blindEnterDelaysMs.map((d) => ({ at: pasteAt + d, fired: false }));
   const deadline = Date.now() + pollTimeoutMs;
   while (Date.now() < deadline) {
     await new Promise((r) => setTimeout(r, pollIntervalMs));
+    for (const be of blindEnters) {
+      if (!be.fired && Date.now() >= be.at) {
+        be.fired = true;
+        try {
+          tmux.sendKey(flow3.tmuxSocket, flow3.tmuxSession, "Enter");
+        } catch {}
+      }
+    }
     if (existsSync22(credentialsPath)) {
       const token = readTokenFromCredentialsFile(credentialsPath);
       if (token) {
@@ -70591,6 +70855,59 @@ function cancelAccountAuthSession(flow3, tmuxOps) {
   tmux.killSession(flow3.tmuxSocket, flow3.tmuxSession);
   cleanScratchDir(flow3.scratchDir);
 }
+async function handleAuthAddOrCancel(opts) {
+  const { parsed, isAdmin: isAdmin2, currentAgent, chatId, threadId, reply, escapeHtml: escapeHtml5 } = opts;
+  if (!isAuthAdmin({ isAdmin: isAdmin2 })) {
+    await reply(`**Not authorized.** \`/auth ${parsed.kind}\` is admin-only.
+` + `Set \`admin: true\` on this agent in switchroom.yaml to unlock ` + `(the same flag that gates \`/agents\`, \`/restart\`, ` + `\`/update\` etc.).`);
+    return;
+  }
+  const authAddKey = chatKey(chatId, threadId);
+  if (parsed.kind === "cancel") {
+    const existing = pendingAuthAddFlows.get(authAddKey);
+    if (!existing) {
+      await reply("_No pending `/auth add` flow in this chat._");
+      return;
+    }
+    cancelAccountAuthSession(existing);
+    pendingAuthAddFlows.delete(authAddKey);
+    await reply("Cancelled.");
+    return;
+  }
+  if (pendingAuthAddFlows.has(authAddKey)) {
+    await reply("_An `/auth add` flow is already in progress for this chat. " + "Finish the paste, or send `/auth cancel` to abort._");
+    return;
+  }
+  const precheckErr = await runReaddPrecheck(() => getAuthBrokerClient(currentAgent), parsed.label, parsed.replace);
+  if (precheckErr) {
+    await reply(precheckErr);
+    return;
+  }
+  try {
+    const { loginUrl, scratchDir, tmuxSocket, tmuxSession, mode } = await startAccountAuthSession(parsed.label);
+    pendingAuthAddFlows.set(authAddKey, {
+      label: parsed.label,
+      scratchDir,
+      tmuxSocket,
+      tmuxSession,
+      startedAt: Date.now(),
+      replace: parsed.replace,
+      mode
+    });
+    const verbNoun = parsed.replace ? "Re-authenticating account" : "Adding account";
+    await reply(`**${verbNoun}** \`${parsed.label}\`
+
+` + `1. Open this URL on your phone:
+${loginUrl}
+
+` + `2. Log into Anthropic, copy the code Claude shows.
+` + `3. Paste it back here.
+
+` + `Send \`/auth cancel\` to abort.`);
+  } catch (err) {
+    await reply(`**/auth ${parsed.replace ? "readd" : "add"} failed:** ${escapeHtml5(err?.message ?? String(err))}`);
+  }
+}
 
 // gateway/auth-loopback-relay.ts
 import { spawn } from "node:child_process";
@@ -73430,6 +73747,23 @@ ${input.newReplyText}`;
 
 // flushed-turn-supersede.ts
 var DEFAULT_SUPERSEDE_TTL_MS2 = 60000;
+var SUPERSEDE_MATCH_MIN_CONTAINMENT_CHARS2 = 32;
+function normalizeForMatch2(text4) {
+  return text4.replace(/\s+/g, " ").trim();
+}
+function flushedAnswerMatchesReply2(flushedText, replyText) {
+  const flushed = normalizeForMatch2(flushedText);
+  const reply = normalizeForMatch2(replyText);
+  if (flushed.length === 0 || reply.length === 0)
+    return false;
+  if (flushed === reply)
+    return true;
+  if (reply.length >= SUPERSEDE_MATCH_MIN_CONTAINMENT_CHARS2 && flushed.includes(reply))
+    return true;
+  if (flushed.length >= SUPERSEDE_MATCH_MIN_CONTAINMENT_CHARS2 && reply.includes(flushed))
+    return true;
+  return false;
+}
 function decideSupersede2(record, args) {
   const ttlMs = args.ttlMs ?? DEFAULT_SUPERSEDE_TTL_MS2;
   if (record == null)
@@ -73441,7 +73775,15 @@ function decideSupersede2(record, args) {
   if (!sameTurn) {
     return { supersede: false, deleteMessageIds: [], reason: "different-turn" };
   }
-  return { supersede: true, deleteMessageIds: [...record.messageIds], reason: "supersede" };
+  if (args.replyText != null && !flushedAnswerMatchesReply2(record.text, args.replyText)) {
+    return { supersede: false, deleteMessageIds: [], reason: "new-content", recordText: record.text };
+  }
+  return {
+    supersede: true,
+    deleteMessageIds: [...record.messageIds],
+    reason: "supersede",
+    recordText: record.text
+  };
 }
 function decideSupersedeCorrection(input) {
   const eligible = input.flushMessageIds.length === 1 && input.chunkCount === 1 && !input.hasFiles && !input.suppressText && !input.hasOpenPreview;
@@ -73480,7 +73822,12 @@ class FlushedTurnSupersedeRegistry2 {
   }
   peek(chatId, threadId, args) {
     const rec = this.entries.get(makeKey3(chatId, threadId))?.get(turnKey2(args.liveTurnId));
-    return decideSupersede2(rec, { liveTurnId: args.liveTurnId, now: args.now, ttlMs: this.ttlMs });
+    return decideSupersede2(rec, {
+      liveTurnId: args.liveTurnId,
+      replyText: args.replyText,
+      now: args.now,
+      ttlMs: this.ttlMs
+    });
   }
   take(chatId, threadId, args) {
     const lane = makeKey3(chatId, threadId);
@@ -73529,7 +73876,9 @@ function decideAnswerLatchSuppression(input) {
     return false;
   if (!input.isLateReply)
     return false;
-  return input.ownerAnswerDelivered;
+  if (input.replyMatchesFlushedAnswer === false)
+    return false;
+  return input.ownerAnswerDelivered === "flush";
 }
 
 // telegraph.ts
@@ -74130,31 +74479,40 @@ async function sendReply(deps, req) {
     const replyThreadId = args.message_thread_id != null ? Number(args.message_thread_id) : undefined;
     const ownerTurn = resolveReplyOwnerTurn(turn, chat_id, args);
     const resolvedTurnId = ownerTurn?.turnId ?? null;
-    const decision = flushedTurnSupersede.take(chat_id, replyThreadId, { liveTurnId: resolvedTurnId, now: Date.now() });
+    const decision = flushedTurnSupersede.take(chat_id, replyThreadId, { liveTurnId: resolvedTurnId, replyText: text4, now: Date.now() });
     if (decision.supersede) {
       process.stderr.write(`telegram gateway: reply: superseding flushed turn message(s) ` + `chatId=${chat_id} ids=${JSON.stringify(decision.deleteMessageIds)}
 `);
       supersedeFlushIds = decision.deleteMessageIds;
-      if (ownerTurn != null)
-        ownerTurn.answerDelivered = true;
+      if (ownerTurn != null) {
+        ownerTurn.answerDelivered = "flush";
+        if (decision.recordText != null)
+          ownerTurn.flushedAnswerText = decision.recordText;
+      }
     } else {
       const replySubstantive = isSubstantiveFinalReply({
         text: rawText,
         disableNotification: args.disable_notification === true
       });
+      const replyMatchesFlushedAnswer = decision.reason === "new-content" ? false : ownerTurn?.flushedAnswerText != null ? flushedAnswerMatchesReply2(ownerTurn.flushedAnswerText, text4) : null;
       const suppressByLatch = decideAnswerLatchSuppression({
         superseded: false,
         replySubstantive,
         isLateReply: turn == null,
-        ownerAnswerDelivered: ownerTurn?.answerDelivered ?? false
+        ownerAnswerDelivered: ownerTurn?.answerDelivered ?? false,
+        replyMatchesFlushedAnswer
       });
+      if (decision.reason === "new-content") {
+        process.stderr.write(`telegram gateway: reply: flush supersede declined \u2014 new content (#3429) ` + `chatId=${chat_id} ownerTurnId=${JSON.stringify(resolvedTurnId)}; sending fresh
+`);
+      }
       if (suppressByLatch) {
         process.stderr.write(`telegram gateway: reply: suppressed by answer-delivered latch ` + `(flush already delivered this turn's answer) chatId=${chat_id} ` + `ownerTurnId=${JSON.stringify(resolvedTurnId)}
 `);
         return { content: [{ type: "text", text: "sent (deduped \u2014 answer already delivered via turn-flush)" }] };
       }
       if (replySubstantive && ownerTurn != null) {
-        ownerTurn.answerDelivered = true;
+        ownerTurn.answerDelivered = "reply";
       }
     }
   }
@@ -76129,6 +76487,7 @@ function handleSessionEvent(deps, ev) {
           finalAnswerSubstantive: false,
           finalAnswerEverDelivered: false,
           answerDelivered: false,
+          flushedAnswerText: null,
           endedAt: null,
           firstPingAt: null,
           firstPingWasSubstantive: false,
@@ -76228,7 +76587,7 @@ function handleSessionEvent(deps, ev) {
       if (turn != null) {
         turn.currentModel = ev.model;
       }
-      sessionModelSource.noteTranscriptModel(ev.model);
+      sessionModelSource.noteTranscriptModel(ev.model, { replayed: ev.replayed === true });
       return;
     }
     case "usage": {
@@ -76634,7 +76993,8 @@ function handleSessionEvent(deps, ev) {
           }
           turn.finalAnswerDelivered = true;
           turn.finalAnswerSubstantive = true;
-          turn.answerDelivered = true;
+          turn.answerDelivered = "flush";
+          turn.flushedAnswerText = capturedText;
           const backstopLatchClaimed = backstopDeliveryLedger.claim(turn.turnId);
           const cardTakeover = progressDriver?.takeOverCard({
             chatId: backstopChatId,
@@ -76706,6 +77066,7 @@ function handleSessionEvent(deps, ev) {
                   backstopCtrl.finalize("error");
                 backstopDeliveryLedger.release(turn.turnId);
                 turn.answerDelivered = false;
+                turn.flushedAnswerText = null;
               } else if (backstopCtrl) {
                 backstopCtrl.finalize("done");
               }
@@ -76723,6 +77084,7 @@ function handleSessionEvent(deps, ev) {
 `);
               if (!delivered) {
                 turn.answerDelivered = false;
+                turn.flushedAnswerText = null;
                 backstopDeliveryLedger.release(turn.turnId);
                 if (backstopCtrl)
                   backstopCtrl.finalize("error");
@@ -79481,6 +79843,69 @@ function formatModelRelaunchSuppressNotAppliedLog(input) {
   return "telegram gateway: gw /model relaunch NOT-APPLIED \u2014 suppressing not-applied confirmation (a .session-model-alert is present and will be relayed) agent=" + input.agent + " target=" + input.target + `
 `;
 }
+function resolveModelSwitchBootNotice(input) {
+  const { agent, confirmation, hasSessionModelAlert } = input;
+  if (confirmation.kind === "not-applied" && hasSessionModelAlert) {
+    return {
+      kind: "suppress",
+      log: formatModelRelaunchSuppressNotAppliedLog({ agent, target: confirmation.target })
+    };
+  }
+  return { kind: "card", body: formatModelSwitchConfirmationBody(confirmation) };
+}
+function servedModelMatchesRequested(requested, served) {
+  const req = requested.trim().toLowerCase();
+  const srv = served.trim().toLowerCase();
+  if (!srv.startsWith("claude-"))
+    return true;
+  if (MODEL_ALIASES2.includes(req)) {
+    if (req === "default")
+      return true;
+    if (modelFamilyToken(srv) === req)
+      return true;
+    return srv.slice("claude-".length).split("-").includes(req);
+  }
+  if (req.startsWith("claude-")) {
+    return srv === req || srv.startsWith(req + "-");
+  }
+  return true;
+}
+function formatServedModelDivergenceLog(input) {
+  return "telegram gateway: gw /model served-model DIVERGENCE agent=" + input.agent + " requested=" + input.requested + " served=" + input.served + ` (--fallback-model substituted: requested id invalid/unknown OR model transiently unavailable)
+`;
+}
+function formatServedModelDivergenceCard(input) {
+  return "\u26a0\ufe0f The first reply was served by `" + input.served + "`, not the requested `" + input.requested + "` \u2014 claude substituted the fallback model. Either the requested id is invalid/unknown, or the model was temporarily unavailable for that call (a transient substitution self-corrects on later replies). If it persists, re-issue `/model <valid id>` or `/model default`. `/status` always shows the model actually serving calls.";
+}
+function sendModelBootCard(deps, chat, body, failLabel) {
+  deps.sendCard(chat.chatId, body, {
+    parse_mode: "Markdown",
+    ...chat.threadId != null ? { message_thread_id: chat.threadId } : {}
+  }).catch((err) => deps.log(`telegram gateway: ${failLabel} send failed: ${err?.message ?? String(err)}
+`));
+}
+function buildServedModelDivergenceHandler(deps) {
+  return (d) => {
+    deps.log(formatServedModelDivergenceLog({ agent: deps.agent, requested: d.requested, served: d.served }));
+    if (deps.chat == null)
+      return;
+    sendModelBootCard(deps, deps.chat, formatServedModelDivergenceCard(d), "served-model divergence");
+  };
+}
+function deliverModelSwitchBootNotice(deps) {
+  if (deps.chat == null)
+    return;
+  const notice = resolveModelSwitchBootNotice({
+    agent: deps.agent,
+    confirmation: deps.confirmation,
+    hasSessionModelAlert: deps.hasSessionModelAlert
+  });
+  if (notice.kind === "suppress") {
+    deps.log(notice.log);
+    return;
+  }
+  sendModelBootCard(deps, deps.chat, notice.body, "model-switch confirmation");
+}
 function resolveStaleAwareBusy(input) {
   const turnStale = input.currentTurnActive && input.turnAgeMs !== null && input.turnAgeMs > input.hardTtlMs;
   const approvalLive = input.oldestPendingApprovalAgeMs !== null && input.oldestPendingApprovalAgeMs <= input.hardTtlMs;
@@ -79549,14 +79974,23 @@ function relaunchErrorReply2(deps, model, err) {
   const msg = err instanceof Error ? err.message : String(err);
   return { text: `\u274c Could not schedule model switch: ${deps.escapeHtml(msg)}`, html: true };
 }
+function unvalidatedIdCaveat2(deps, model) {
+  if (!model.trim().toLowerCase().startsWith("claude-"))
+    return null;
+  return `_\`${deps.escapeHtml(model)}\` can't be validated before launch \u2014 if it isn't a real Claude model id, claude will silently serve the configured fallback model instead. I check the first reply and will warn if that happens._`;
+}
 async function scheduleRelaunchReply2(deps, model, reason) {
   try {
     await deps.scheduleModelRelaunch(model, reason);
   } catch (err) {
     return relaunchErrorReply2(deps, model, err);
   }
-  return { text: [switchingLine2(deps, model), PERSIST_NOTE3].join(`
-`), html: true };
+  const caveat = unvalidatedIdCaveat2(deps, model);
+  return {
+    text: [switchingLine2(deps, model), ...caveat ? [caveat] : [], PERSIST_NOTE3].join(`
+`),
+    html: true
+  };
 }
 async function scheduleDefaultRelaunchReply2(deps, reason) {
   try {
@@ -92701,10 +93135,10 @@ function effectiveTurnAgeMs(markerAgeMs, turnStartedAt, now) {
 }
 
 // ../src/build-info.ts
-var VERSION = "0.19.2";
-var COMMIT_SHA = "1fa69736";
-var COMMIT_DATE = "2026-07-19T09:11:44Z";
-var LATEST_PR = 3425;
+var VERSION = "0.19.3";
+var COMMIT_SHA = "41896be4";
+var COMMIT_DATE = "2026-07-20T10:37:39+10:00";
+var LATEST_PR = 3456;
 var COMMITS_AHEAD_OF_TAG = 0;
 
 // gateway/boot-version.ts
@@ -95522,7 +95956,7 @@ var progressUpdateLastSent = new Map;
 var progressUpdateTurnCount = new Map;
 var currentTurn = null;
 var currentTurnMap = new CurrentTurnMap;
-var sessionModelSource = createSessionModelSource();
+var sessionModelSource = createSessionModelSource({ servedMatchesRequested: servedModelMatchesRequested });
 var lastActiveTurnChatId;
 function setCurrentTurn(turn, key) {
   currentTurnMap.set(turn, key);
@@ -97314,9 +97748,9 @@ var pendingStateReaper = isGatewayMain ? setInterval(() => {
     if (now - v > 60000)
       lastAuthRefreshAtMs.delete(k);
   }
-  for (const [k, v] of pendingAuthRmFlows) {
+  for (const [k, v] of pendingAuthRmFlows2) {
     if (now >= v.expiresAt)
-      pendingAuthRmFlows.delete(k);
+      pendingAuthRmFlows2.delete(k);
   }
   pendingVaultOps.sweep(now);
   sweepPermissionTtl({
@@ -104160,7 +104594,7 @@ The gateway will restart as part of the recreate step; watch for the post-restar
       const me = cfg?.agents?.[getMyAgentName()];
       isAdmin2 = me?.admin === true || me?.root === true;
     } catch {}
-    if (!isAuthAdmin({ isAdmin: isAdmin2 })) {
+    if (!isAuthAdmin2({ isAdmin: isAdmin2 })) {
       await switchroomReply(ctx, `**Not authorized.** \`/connect\` requires this agent to have \`admin: true\` in switchroom.yaml.`, { html: true });
       return;
     }
@@ -104251,52 +104685,19 @@ ${appNote}`), {
     } catch {}
     const chatId = String(ctx.chat?.id ?? "");
     if (parsed.kind === "add" || parsed.kind === "cancel") {
-      if (!isAuthAdmin({ isAdmin: isAdmin2 })) {
-        await switchroomReply(ctx, `**Not authorized.** \`/auth ${parsed.kind}\` is admin-only.
-Set \`admin: true\` on this agent in switchroom.yaml to unlock (the same flag that gates \`/agents\`, \`/restart\`, \`/update\` etc.).`, { html: true });
-        return;
-      }
-      const authAddKey = chatKey2(chatId, ctx.message?.message_thread_id ?? null);
-      if (parsed.kind === "cancel") {
-        const existing = pendingAuthAddFlows.get(authAddKey);
-        if (!existing) {
-          await switchroomReply(ctx, "_No pending `/auth add` flow in this chat._", { html: true });
-          return;
-        }
-        cancelAccountAuthSession(existing);
-        pendingAuthAddFlows.delete(authAddKey);
-        await switchroomReply(ctx, "Cancelled.", { html: true });
-        return;
-      }
-      if (pendingAuthAddFlows.has(authAddKey)) {
-        await switchroomReply(ctx, "_An `/auth add` flow is already in progress for this chat. Finish the paste, or send `/auth cancel` to abort._", { html: true });
-        return;
-      }
-      try {
-        const { loginUrl, scratchDir, tmuxSocket, tmuxSession } = await startAccountAuthSession(parsed.label);
-        pendingAuthAddFlows.set(authAddKey, {
-          label: parsed.label,
-          scratchDir,
-          tmuxSocket,
-          tmuxSession,
-          startedAt: Date.now()
-        });
-        await switchroomReply(ctx, `**Adding account** \`${parsed.label}\`
-
-1. Open this URL on your phone:
-${loginUrl}
-
-2. Log into Anthropic, copy the code Claude shows.
-3. Paste it back here.
-
-Send \`/auth cancel\` to abort.`, { html: true });
-      } catch (err) {
-        await switchroomReply(ctx, `**/auth add failed:** ${escapeHtmlForTg2(err?.message ?? String(err))}`, { html: true });
-      }
+      await handleAuthAddOrCancel({
+        parsed,
+        isAdmin: isAdmin2,
+        currentAgent,
+        chatId,
+        threadId: ctx.message?.message_thread_id ?? null,
+        reply: (text6) => switchroomReply(ctx, text6, { html: true }),
+        escapeHtml: escapeHtmlForTg2
+      });
       return;
     }
     if (parsed.kind === "provider-add" || parsed.kind === "provider-cancel") {
-      if (!isAuthAdmin({ isAdmin: isAdmin2 })) {
+      if (!isAuthAdmin2({ isAdmin: isAdmin2 })) {
         await switchroomReply(ctx, `**Not authorized.** \`/auth ${parsed.provider}\` is admin-only.
 Set \`admin: true\` on this agent in switchroom.yaml to unlock.`, { html: true });
         return;
@@ -106080,7 +106481,16 @@ async function startGateway() {
                   return resolveMainModel(raw ?? undefined);
                 })();
                 const isApplyBoot = launched.length > 0 && launched !== configured;
-                sessionModelSource.setOverride(isApplyBoot ? launched : null);
+                sessionModelSource.setOverride(isApplyBoot ? launched : null, { verify: true });
+                const modelBootCardDeps = {
+                  agent: getMyAgentName(),
+                  chat: modelSwitchMarkerChat,
+                  log: (line) => process.stderr.write(line),
+                  sendCard: (chatId, body, opts) => lockedBot.api.sendMessage(chatId, body, opts)
+                };
+                if (isApplyBoot) {
+                  sessionModelSource.setDivergenceHandler(buildServedModelDivergenceHandler(modelBootCardDeps));
+                }
                 const confirmation = modelSwitchReason != null ? classifyModelSwitchConfirmation({
                   reason: modelSwitchReason,
                   launched,
@@ -106093,22 +106503,12 @@ async function startGateway() {
                   confirmation,
                   isApplyBoot
                 }));
-                if (confirmation != null && modelSwitchMarkerChat) {
-                  const chat = modelSwitchMarkerChat;
-                  const hasSessionModelAlert = existsSync54(join59(smAgentDir, ".session-model-alert"));
-                  if (confirmation.kind === "not-applied" && hasSessionModelAlert) {
-                    process.stderr.write(formatModelRelaunchSuppressNotAppliedLog({
-                      agent: getMyAgentName(),
-                      target: confirmation.target
-                    }));
-                  } else {
-                    const body = formatModelSwitchConfirmationBody(confirmation);
-                    lockedBot.api.sendMessage(chat.chatId, body, {
-                      parse_mode: "Markdown",
-                      ...chat.threadId != null ? { message_thread_id: chat.threadId } : {}
-                    }).catch((err) => process.stderr.write(`telegram gateway: model-switch confirmation send failed: ${err?.message ?? String(err)}
-`));
-                  }
+                if (confirmation != null) {
+                  deliverModelSwitchBootNotice({
+                    ...modelBootCardDeps,
+                    confirmation,
+                    hasSessionModelAlert: existsSync54(join59(smAgentDir, ".session-model-alert"))
+                  });
                 }
               } catch {}
             }