@byokit/accounts 0.2.0 → 0.2.2

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,7 +1,8 @@
 # @byokit/accounts
 
-Sign in with the AI plan you already pay for (ChatGPT, OpenRouter; Grok and GitHub Copilot on request), inside your
-own app, into your app's own store: on a computer (Node, Electron), in a browser (a PWA, Electron's renderer) and on a
+Sign in with the AI plan you already pay for (ChatGPT on every platform; OpenRouter on computers; Grok and GitHub
+Copilot hidden by default), inside your own app, into your app's own store: on a computer (Node, Electron), in a browser
+(a PWA, Electron's renderer) and on a
 phone (React Native and Expo, iOS and Android). One import; your bundler picks the platform's side
 (`package.json`'s `react-native` and `browser` conditions).
 
@@ -30,8 +31,8 @@ const accounts = new Accounts({ store: (member) => secureStore(SecureStore, `byo
 const shown = await accounts.login(1, 'chatgpt'); // { state: 'waiting', via: 'code', code, url }: open url, show code
 ```
 
-Examples that sign in end to end: [`examples/expo`](../../examples/expo) (iOS and Android) and
-[`examples/pwa`](../../examples/pwa).
+Examples: [`examples/expo`](../../examples/expo) (iOS and Android bundles; Android emulator sign-in) and
+[`examples/pwa`](../../examples/pwa) (browser sign-in).
 
 ## Which sign-in works where
 
@@ -48,25 +49,30 @@ listener on the computer the browser runs on, so it is desktop only: ChatGPT sen
 doesn't answer other web pages), so a PWA's model calls go through the app's own server or relay.
 
 - **Catalogue** (`catalogue.json`): each provider with its terms status (`allowed`, `grey`, `partner`), a one-line reason
-  and a source. The kit labels; your app decides what to offer (`new Accounts({ offer: ['chatgpt', 'grok'] })`).
-  Claude plan sign-in is never offered: Anthropic reserves it for its own apps.
-- **Sign-in**: the provider's own page by default. For ChatGPT, whose page returns to this computer's port 1455, the kit
-  listens there itself, so the tab shows your app's words (`new Accounts({ app: 'My App' })`) and only once they are
+  and a source. The kit labels; your app decides what to offer (`new Accounts({ offer: ['chatgpt'] })`). Without an
+  explicit `offer`, only sign-ins supported on this platform are shown; an explicit list is not platform-filtered, so
+  choose from the table above. Claude plan sign-in is never offered: Anthropic reserves it for its own apps.
+- **Sign-in**: on computers, the provider's own page by default. For ChatGPT, whose page returns to this computer's
+  port 1455, the kit listens there itself, so the tab shows your app's words (`new Accounts({ app: 'My App' })`) and only once they are
   true. A code takes over when asked ("Having trouble?"), when the page never comes back, or when the port is taken by
   another sign-in. A 15-minute cap, nothing kept unless the engine can use it, and every failure is one plain sentence
   (`words.json`) with a `why` for apps that word it themselves. `plan(member)` tells a work ChatGPT from a personal one.
-- **Sign-out**: `logout(member, key)` also ends a ChatGPT sign-in at OpenAI (`POST auth.openai.com/oauth/revoke`, as
-  Codex's own sign-out does), then deletes it here whatever OpenAI answers. It runs in the store's own turn, so a refresh
-  under way finishes first and the token it rotated to is the one ended.
+- **Sign-out**: `logout(member, key)` attempts to revoke a ChatGPT token at OpenAI (`POST auth.openai.com/oauth/revoke`),
+  then deletes the local sign-in even if the revoke fails. A failed revoke rejects after local deletion; report it because
+  the remote sign-in may remain active. Within one store instance, a refresh already in progress finishes first, so
+  sign-out uses its rotated token. If a cancelled sign-in finishes late, `onSignOutError` reports a failed revoke of its
+  discarded credential (or it is logged when no handler is set).
 - **One person, one store**: `memoryStore()`, `fileStore(path)` (0600, the same shape as Pi's `auth.json`),
-  `secureStore(SecureStore, name)` or `browserStore(name)`; any other storage with `recordStore(load, save)`. Every one
-  serializes its writes, so a refresh and a sign-out never interleave. Never a shared fallback. Using another engine
-  with the same seam (Pi's coding-agent `ModelRuntime`)? Override `open(member)`.
+  `secureStore(SecureStore, name)` or `browserStore(name)`; any other storage with `recordStore(load, save)`. Writes are
+  serialized within a store instance; `browserStore` also uses Web Locks across tabs for the same provider when available.
+  Never a shared fallback. Browser storage is readable by scripts on your page: avoid untrusted scripts. Using another
+  engine with the same seam (Pi's coding-agent `ModelRuntime`)? Override `open(member)` with an engine whose
+  `credentialStore` is made with `boundStore(member, engineStore)` and whose `readCredential(id)` reads that store.
 - **Limits**: `failed(member, key, error)` rests an account until the provider said (or a default), marks a plan that
   doesn't include this use, and signs out only a sign-in that no longer refreshes. `ladder()` picks the next usable
   account; `keepFresh()` refreshes ahead of expiry. Limits come from errors only; no undocumented usage endpoint is read.
 - **Isolation**: ambient discovery is off (no environment variable or credential file is ever consulted), and
   `@byokit/accounts/testing` has the decoy-HOME harness and fs tracer to prove it in your own tests.
-- **A stand-in OpenAI**: `mockOpenAI()` from `@byokit/accounts/testing` (or `node .../testing/mock-openai.ts 1455`)
+- **A stand-in OpenAI**: `mockOpenAI()` from `@byokit/accounts/testing` (or `node .../testing/mock-openai.ts [port]`)
   answers device code, its page where a person types the code, token exchange, refresh and revoke, so tests and demos
   sign in end to end with no account. Point the kit at it with `new Accounts({ authBase })`.

package/dist/accounts.d.ts

@@ -1,9 +1,16 @@
 import type { CredentialStore, Models } from '@earendil-works/pi-ai';
 import { type Provider } from './catalogue.ts';
 import { type Kind } from './limits.ts';
+import { type EndingStore } from './stores.ts';
 import { type Why } from './words.ts';
 /** What signing in needs from an engine: Pi's `Models`, or anything shaped like it (the coding agent's `ModelRuntime`). */
-export type AuthHost = Pick<Models, 'login' | 'logout' | 'checkAuth' | 'getAuth'>;
+type BoundStore = CredentialStore & {
+    signOut: (id: string, p: Provider) => Promise<void>;
+};
+export type AuthHost = Pick<Models, 'login' | 'logout' | 'checkAuth' | 'getAuth'> & {
+    readCredential: CredentialStore['read'];
+    credentialStore: BoundStore;
+};
 export type Member = string | number;
 /** What the person sees while signing in: the provider's own page to open (`via: 'browser'`), or a code to type there
  *  (`via: 'code'`), never the engine's own prompts. `why` names how a failed one failed, for apps that word it themselves. */
@@ -67,6 +74,10 @@ export declare class Accounts<R extends AuthHost = AuthHost, M extends Member =
     private opts;
     private runtimes;
     private stores;
+    private generations;
+    private signals;
+    private chains;
+    private signingOut;
     private flows;
     private ready;
     private lapsed;
@@ -79,11 +90,15 @@ export declare class Accounts<R extends AuthHost = AuthHost, M extends Member =
     onSignedIn?: (member: M, key: string) => void;
     /** Said once when a sign-in can no longer be refreshed. */
     onExpired?: (member: M, key: string) => void;
+    onSignOutError?: (member: M, key: string, error: Error) => void;
     private platform;
     /** Offered: the providers named in `offer`, else every provider not hidden that this platform can sign in to. */
     constructor(opts?: AccountsOptions<M>, platform?: Platform);
     /** A member's own store. */
-    protected store(member: M): CredentialStore;
+    protected store(member: M): EndingStore;
+    private serial;
+    protected boundStore(member: M, raw: CredentialStore): BoundStore;
+    protected engine(member: M, raw: CredentialStore): Promise<R>;
     /** A member's engine, holding only their own sign-ins (`store(member)`). Override to use another engine with the same seam. */
     protected open(member: M): Promise<R>;
     runtime(member: M): Promise<R>;
@@ -136,15 +151,16 @@ export declare class Accounts<R extends AuthHost = AuthHost, M extends Member =
     paste(member: M, key: string, text: string): void;
     /** Stop a sign-in and forget it; nothing it started is kept. */
     cancel(member: M, key: string): void;
+    private refreshed;
     /** Refresh every signed-in account an hour ahead of expiry (call it now and then), so a sign-in never lapses while
      *  nobody is looking. Only the provider refusing signs it out, and `onExpired` says so once; a network hiccup doesn't. */
     keepFresh(members: readonly M[]): Promise<void>;
     /** After the account turned a request away: true if its sign-in still refreshes; if not, it is signed out for good. */
     recheck(member: M, key: string): Promise<boolean>;
     /** Signs out here, and at the provider too where it can end a sign-in (ChatGPT), best effort: the sign-in is deleted
-     *  here whatever the provider answers. The revoke runs in the store's own turn, so a refresh under way finishes first
-     *  and the token it rotated to is the one ended; a refresh after it is refused. */
+     *  here whatever the provider answers. */
     logout(member: M, key: string): Promise<void>;
     view(member: M, key: string): SignIn | null;
     stop(): void;
 }
+export {};

package/dist/accounts.js

@@ -20,20 +20,19 @@ const offline = (e) => failure(String(e?.message)) === 'offline';
  *  access token, never retried (fixtures/conformance/revoke.json). */
 async function revoke(url, clientId, c) {
     const body = c.refresh ? { token: c.refresh, token_type_hint: 'refresh_token', client_id: clientId } : { token: c.access, token_type_hint: 'access_token' };
-    const stop = new AbortController();
-    const t = setTimeout(() => stop.abort(), 10_000);
-    try {
-        await fetch(url, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body), signal: stop.signal });
-    }
-    finally {
-        clearTimeout(t);
-    }
+    const response = await fetch(url, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body), signal: AbortSignal.timeout(10_000) });
+    if (!response.ok)
+        throw new Error(`ChatGPT sign-out failed (${response.status})`);
 }
 export class Accounts {
     providers;
     opts;
     runtimes = new Map();
     stores = new Map();
+    generations = new Map();
+    signals = new WeakMap();
+    chains = new Map();
+    signingOut = new Map();
     flows = new Map();
     ready = new Map();
     lapsed = new Set();
@@ -46,6 +45,7 @@ export class Accounts {
     onSignedIn;
     /** Said once when a sign-in can no longer be refreshed. */
     onExpired;
+    onSignOutError;
     platform;
     /** Offered: the providers named in `offer`, else every provider not hidden that this platform can sign in to. */
     constructor(opts = {}, platform = portable) {
@@ -56,14 +56,115 @@ export class Accounts {
     /** A member's own store. */
     store(member) {
         let s = this.stores.get(String(member));
-        if (!s)
-            this.stores.set(String(member), s = (this.opts.store ?? memoryStore)(member));
+        if (!s) {
+            const base = (this.opts.store ?? memoryStore)(member);
+            let chain = Promise.resolve();
+            const serial = (fn) => { const result = chain.then(fn); chain = result.catch(() => { }); return result; };
+            s = {
+                read: (id) => base.read(id),
+                list: () => base.list(),
+                modify: (id, fn, options) => serial(() => base.modify(id, fn, options)),
+                delete: (id, options) => serial(() => base.delete(id, options)),
+                end: (id, fn) => serial(async () => {
+                    if (typeof base.end === 'function')
+                        return base.end(id, fn);
+                    try {
+                        await fn(await base.read(id));
+                    }
+                    finally {
+                        await base.delete(id);
+                    }
+                }),
+            };
+            this.stores.set(String(member), s);
+        }
         return s;
     }
-    /** A member's engine, holding only their own sign-ins (`store(member)`). Override to use another engine with the same seam. */
-    open(member) {
-        return Promise.resolve(this.platform.engine(this.store(member), this.opts.authBase));
+    async serial(id, fn) {
+        const previous = this.chains.get(id) ?? Promise.resolve();
+        const work = previous.then(fn, fn);
+        const tail = work.then(() => { }, () => { });
+        this.chains.set(id, tail);
+        try {
+            return await work;
+        }
+        finally {
+            if (this.chains.get(id) === tail)
+                this.chains.delete(id);
+        }
+    }
+    boundStore(member, raw) {
+        const key = (id) => `${member}:${this.providers.find((p) => p.pi === id)?.key ?? id}`;
+        return {
+            read: (id, options) => raw.read(id, options),
+            list: (options) => raw.list(options),
+            modify: (id, fn, options) => {
+                const account = key(id);
+                const stale = Symbol();
+                const started = options?.signal ? this.signals.get(options.signal) ?? this.generations.get(account) ?? 0 : this.generations.get(account) ?? 0;
+                const discard = async (next) => {
+                    const p = this.providers.find((p) => p.pi === id);
+                    if (next?.type === 'oauth' && p?.revoke) {
+                        try {
+                            await revoke(this.opts.authBase ? `${this.opts.authBase}/oauth/revoke` : p.revoke, p.clientId, next);
+                        }
+                        catch (e) {
+                            const error = e instanceof Error ? e : new Error(String(e));
+                            if (this.onSignOutError)
+                                this.onSignOutError(member, p.key, error);
+                            else
+                                console.error(`sign-out ${p.key} for member ${member}:`, error);
+                            throw error;
+                        }
+                    }
+                };
+                return this.serial(account, async () => {
+                    if (started !== (this.generations.get(account) ?? 0)) {
+                        await discard(await fn(undefined));
+                        return undefined;
+                    }
+                    try {
+                        return await raw.modify(id, async (current) => {
+                            const next = await fn(current);
+                            if (started !== (this.generations.get(account) ?? 0)) {
+                                await discard(next);
+                                throw stale;
+                            }
+                            return next;
+                        }, options);
+                    }
+                    catch (e) {
+                        if (e === stale)
+                            return undefined;
+                        throw e;
+                    }
+                });
+            },
+            delete: (id, options) => this.serial(key(id), () => raw.delete(id, options)),
+            signOut: (id, p) => this.serial(key(id), async () => {
+                let error;
+                try {
+                    const c = await raw.read(id);
+                    if (c?.type === 'oauth')
+                        await revoke(this.opts.authBase ? `${this.opts.authBase}/oauth/revoke` : p.revoke, p.clientId, c);
+                }
+                catch (e) {
+                    error = e;
+                }
+                await raw.delete(id);
+                if (error)
+                    throw error;
+            }),
+        };
+    }
+    engine(member, raw) {
+        const credentials = this.boundStore(member, raw);
+        return Promise.resolve(Object.assign(this.platform.engine(credentials, this.opts.authBase), {
+            credentialStore: credentials, readCredential: (id) => credentials.read(id),
+        }));
     }
+    /** A member's engine, holding only their own sign-ins (`store(member)`). Override to use another engine with the same seam. */
+    open(member) { return this.engine(member, this.store(member)); }
     runtime(member) {
         let r = this.runtimes.get(String(member));
         if (!r)
@@ -86,7 +187,7 @@ export class Accounts {
     }
     /** Which ChatGPT the member signed in with: its plan, email, and whether it is a work account. Null when not signed in. */
     async plan(member) {
-        const c = await this.store(member).read(this.offer('chatgpt').pi).catch(() => undefined);
+        const c = await (await this.runtime(member)).readCredential(this.offer('chatgpt').pi).catch(() => undefined);
         return c?.type === 'oauth' ? planOf(c.access) : null;
     }
     /** Whether the member's plan lacks this use; `on` records what the provider said, or that the person changed plans. */
@@ -160,6 +261,9 @@ export class Accounts {
     async login(member, key, body = {}) {
         this.offer(key);
         const id = `${member}:${key}`;
+        const pending = this.signingOut.get(id);
+        if (pending)
+            await pending.catch(() => { });
         const now = this.flows.get(id);
         if (now?.state === 'waiting' && body.via === 'code' && now.via === 'browser') {
             // "Having trouble?": the same sign-in carries on with a code instead.
@@ -168,7 +272,8 @@ export class Accounts {
             await Promise.race([visible, now.done]);
         }
         else if (now?.state !== 'waiting') {
-            const flow = { state: 'waiting', abort: new AbortController() };
+            const flow = { state: 'waiting', abort: new AbortController(), generation: this.generations.get(id) ?? 0 };
+            this.signals.set(flow.abort.signal, flow.generation);
             this.flows.set(id, flow);
             const visible = new Promise((r) => (flow.shown = r));
             flow.done = this.signIn(member, key, body, flow);
@@ -238,11 +343,14 @@ export class Accounts {
                 catcher?.close();
                 await attempt('code');
             }
-            // Never half signed in: only a sign-in the engine can use counts.
+            if (flow.generation !== (this.generations.get(id) ?? 0) || flow.state !== 'waiting')
+                return;
             if (!(await rt.checkAuth(p.pi).catch(() => undefined))) {
                 await rt.logout(p.pi).catch(() => { });
                 throw new Error('no usable credential');
             }
+            if (flow.generation !== (this.generations.get(id) ?? 0) || flow.state !== 'waiting')
+                return;
             flow.state = 'done';
             this.ready.set(id, true);
             for (const s of [this.lapsed, this.without])
@@ -307,6 +415,17 @@ export class Accounts {
         this.flows.delete(`${member}:${key}`);
         this.onChange?.(member, key);
     }
+    async refreshed(member, key, minOAuthValidityMs) {
+        const pi = this.offer(key).pi;
+        return (await this.runtime(member)).getAuth(pi, { minOAuthValidityMs }).then(Boolean, async (e) => {
+            if (offline(e))
+                return true;
+            if (e?.message !== `OAuth refresh returned a token that expires too soon for ${pi}`)
+                return false;
+            const c = await this.store(member).read(pi);
+            return c?.type === 'oauth' && c.expires > Date.now();
+        });
+    }
     /** Refresh every signed-in account an hour ahead of expiry (call it now and then), so a sign-in never lapses while
      *  nobody is looking. Only the provider refusing signs it out, and `onExpired` says so once; a network hiccup doesn't. */
     async keepFresh(members) {
@@ -314,7 +433,7 @@ export class Accounts {
             for (const p of this.providers) {
                 if (this.ready.get(`${m}:${p.key}`) !== true)
                     continue;
-                const ok = await (await this.runtime(m)).getAuth(p.pi, { minOAuthValidityMs: 60 * 60_000 }).then(Boolean, offline);
+                const ok = await this.refreshed(m, p.key, 60 * 60_000);
                 if (!ok) {
                     this.forget(m, p.key);
                     this.onExpired?.(m, p.key);
@@ -323,9 +442,7 @@ export class Accounts {
     }
     /** After the account turned a request away: true if its sign-in still refreshes; if not, it is signed out for good. */
     async recheck(member, key) {
-        // Asking for a year's validity forces a refresh; the fresh token then "expires too soon" for that year, which is fine.
-        const ok = await (await this.runtime(member)).getAuth(this.offer(key).pi, { minOAuthValidityMs: 365 * 86_400_000 })
-            .then(Boolean, (e) => offline(e) || /expires too soon/.test(String(e?.message)));
+        const ok = await this.refreshed(member, key, 365 * 86_400_000);
         if (!ok) {
             await this.logout(member, key).catch(() => { });
             this.forget(member, key);
@@ -333,17 +450,37 @@ export class Accounts {
         return ok;
     }
     /** Signs out here, and at the provider too where it can end a sign-in (ChatGPT), best effort: the sign-in is deleted
-     *  here whatever the provider answers. The revoke runs in the store's own turn, so a refresh under way finishes first
-     *  and the token it rotated to is the one ended; a refresh after it is refused. */
+     *  here whatever the provider answers. */
     async logout(member, key) {
         const p = this.offer(key);
-        const url = p.revoke && (this.opts.authBase ? `${this.opts.authBase}/oauth/revoke` : p.revoke);
-        if (url)
-            await this.store(member).modify(p.pi, async (c) => { if (c?.type === 'oauth')
-                await revoke(url, p.clientId, c).catch(() => { }); return undefined; }).catch(() => { });
-        await (await this.runtime(member)).logout(p.pi);
-        this.ready.set(`${member}:${key}`, false);
-        this.onChange?.(member, key);
+        const id = `${member}:${key}`;
+        this.generations.set(id, (this.generations.get(id) ?? 0) + 1);
+        this.cancel(member, key);
+        const work = (async () => {
+            const rt = await this.runtime(member);
+            let error;
+            try {
+                if (p.revoke)
+                    await rt.credentialStore.signOut(p.pi, p);
+                else
+                    await rt.logout(p.pi);
+            }
+            catch (e) {
+                error = e;
+            }
+            this.ready.set(id, false);
+            this.onChange?.(member, key);
+            if (error)
+                throw error;
+        })();
+        this.signingOut.set(id, work);
+        try {
+            await work;
+        }
+        finally {
+            if (this.signingOut.get(id) === work)
+                this.signingOut.delete(id);
+        }
     }
     view(member, key) {
         const f = this.flows.get(`${member}:${key}`);

package/dist/engine.js

@@ -17,11 +17,11 @@ export function deviceStart(status, body) {
     if (status === 404)
         throw new Error('OpenAI Codex device code login is not enabled for this server. Use browser login or verify the server URL.');
     if (status < 200 || status > 299)
-        throw new Error(`OpenAI Codex device code request failed with status ${status}${body ? `: ${body}` : ''}`);
+        throw new Error(`OpenAI Codex device code request failed with status ${status}`);
     const j = json(body);
     const intervalSeconds = typeof j?.interval === 'string' ? Number(j.interval.trim()) : j?.interval;
     if (!j?.device_auth_id || !j.user_code || typeof intervalSeconds !== 'number' || !Number.isFinite(intervalSeconds) || intervalSeconds < 0)
-        throw new Error(`Invalid OpenAI Codex device code response: ${body}`);
+        throw new Error('Invalid OpenAI Codex device code response');
     return { deviceAuthId: String(j.device_auth_id), userCode: String(j.user_code), intervalSeconds };
 }
 export function devicePoll(status, body) {
@@ -29,7 +29,7 @@ export function devicePoll(status, body) {
         const j = json(body);
         return j?.authorization_code && j.code_verifier
             ? { status: 'complete', authorizationCode: j.authorization_code, codeVerifier: j.code_verifier }
-            : { status: 'failed', message: `Invalid OpenAI Codex device auth token response: ${body}` };
+            : { status: 'failed', message: 'Invalid OpenAI Codex device auth token response' };
     }
     if (status === 403 || status === 404)
         return { status: 'pending' };
@@ -39,12 +39,13 @@ export function devicePoll(status, body) {
         return { status: 'pending' };
     if (code === 'slow_down')
         return { status: 'slow_down' };
-    return { status: 'failed', message: `OpenAI Codex device auth failed with status ${status}${body ? `: ${body}` : ''}` };
+    const detail = code === 'deviceauth_expired' || code === 'access_denied' ? `: ${code}` : '';
+    return { status: 'failed', message: `OpenAI Codex device auth failed with status ${status}${detail}` };
 }
 /** A token response as the stored credential, the same shape Pi keeps. */
 export function credentialOf(j, now = Date.now()) {
     if (typeof j?.access_token !== 'string' || typeof j.refresh_token !== 'string' || typeof j.expires_in !== 'number')
-        throw new Error(`OpenAI Codex token response missing fields: ${JSON.stringify(j)}`);
+        throw new Error('OpenAI Codex token response missing fields');
     let accountId;
     try {
         accountId = claims(j.access_token)['https://api.openai.com/auth']?.chatgpt_account_id;
@@ -81,7 +82,7 @@ export function portableEngine(credentials, { base = 'https://auth.openai.com' }
     };
     const tokens = async (what, r) => {
         if (r.status < 200 || r.status > 299)
-            throw new Error(`OpenAI Codex token ${what} failed (${r.status}): ${r.body}`);
+            throw new Error(`OpenAI Codex token ${what} failed (${r.status})`);
         return credentialOf(json(r.body));
     };
     const refresh = async (c) => {
@@ -123,7 +124,18 @@ export function portableEngine(credentials, { base = 'https://auth.openai.com' }
                     }, true, signal));
                     if (signal?.aborted)
                         throw new Error('Login cancelled');
-                    await credentials.modify(id, async () => c);
+                    let wrote = false;
+                    await credentials.modify(id, async () => {
+                        if (signal?.aborted)
+                            return undefined;
+                        wrote = true;
+                        return c;
+                    }, { signal });
+                    if (signal?.aborted) {
+                        if (wrote)
+                            await credentials.delete(id);
+                        throw new Error('Login cancelled');
+                    }
                     return c;
                 }
                 if (p.status === 'slow_down')
@@ -146,8 +158,6 @@ export function portableEngine(credentials, { base = 'https://auth.openai.com' }
                 c = await credentials.modify(id, async (now) => (now?.type === 'oauth' && soon(now) ? refresh(now) : undefined));
                 if (c?.type !== 'oauth')
                     return undefined;
-                if (minOAuthValidityMs !== undefined && soon(c))
-                    throw new Error('OAuth refresh returned a token that expires too soon for openai-codex');
             }
             return { auth: { apiKey: c.access }, source: 'OAuth' };
         },

package/dist/stores.d.ts

@@ -2,9 +2,12 @@ import type { Credential, CredentialStore } from '@earendil-works/pi-ai';
 export type Record = {
     [providerId: string]: Credential;
 };
+export type EndingStore = CredentialStore & {
+    end(id: string, fn: (c: Credential | undefined) => Promise<void>): Promise<void>;
+};
 /** A store over one whole record the platform loads and saves. Writes are serialized within this process; a write
  *  re-reads first, so a sign-in that took minutes never overwrites a provider that changed meanwhile. */
-export declare function recordStore(load: () => Promise<Record>, save: (data: Record) => Promise<void>): CredentialStore;
+export declare function recordStore(load: () => Promise<Record>, save: (data: Record) => Promise<void>): EndingStore;
 export declare function memoryStore(): CredentialStore;
 /** The parts of `expo-secure-store` this uses (Keychain on iOS, Keystore-encrypted on Android); pass the module itself. */
 export type SecureStoreLike = {
@@ -18,4 +21,4 @@ export type SecureStoreLike = {
 export declare function secureStore(secure: SecureStoreLike, name: string): CredentialStore;
 /** One person's sign-ins in the browser's IndexedDB (a PWA, or Electron's renderer), under `name`. A browser has no
  *  keychain: anything running on this page could read them, so keep the page free of scripts you don't control. */
-export declare function browserStore(name: string, db?: string): CredentialStore;
+export declare function browserStore(name: string, db?: string): EndingStore;

package/dist/stores.js

@@ -6,11 +6,13 @@ export function recordStore(load, save) {
     return {
         read: async (id) => (await load())[id],
         list: async () => Object.entries(await load()).map(([providerId, c]) => ({ providerId, type: c.type })),
-        modify: (id, fn) => serial(async () => {
+        modify: (id, fn, options) => serial(async () => {
             const current = (await load())[id];
             const next = await fn(current);
             if (next === undefined)
                 return current;
+            if (options?.signal?.aborted)
+                throw new Error('Login cancelled');
             await save({ ...(await load()), [id]: next });
             return next;
         }),
@@ -18,6 +20,18 @@ export function recordStore(load, save) {
             delete data[id];
             await save(data);
         } }),
+        end: (id, fn) => serial(async () => {
+            try {
+                await fn((await load())[id]);
+            }
+            finally {
+                const data = await load();
+                if (id in data) {
+                    delete data[id];
+                    await save(data);
+                }
+            }
+        }),
     };
 }
 export function memoryStore() {
@@ -74,5 +88,12 @@ export function browserStore(name, db = 'byokit') {
             d.close();
         }
     };
-    return recordStore(async () => (await run('readonly', (s) => s.get(name))) ?? {}, (data) => run('readwrite', (s) => s.put(data, name)));
+    const store = recordStore(async () => (await run('readonly', (s) => s.get(name))) ?? {}, (data) => run('readwrite', (s) => s.put(data, name)));
+    const locked = async (id, fn) => typeof navigator !== 'undefined' && navigator.locks ? await navigator.locks.request(`byokit:${db}:${name}:${id}`, fn) : fn();
+    return {
+        ...store,
+        modify: (id, fn, options) => locked(id, () => store.modify(id, fn, options)),
+        delete: (id, options) => locked(id, () => store.delete(id, options)),
+        end: (id, fn) => locked(id, () => store.end(id, fn)),
+    };
 }

package/dist/testing/mock-openai.js

@@ -1,7 +1,7 @@
 // OpenAI's sign-in, stood in for: device code, its page where a person types the code, token exchange and refresh
 // (rotating), revoke, and the same CORS answer the real endpoints give, so a web page, a phone app or a test signs in
 // end to end with no account and no real network. Run it alone for a demo or an emulator:
-//   node packages/accounts/src/testing/mock-openai.ts [port]      (then approve on its /codex/device page)
+//   node packages/accounts/src/testing/mock-openai.ts [port]      (21455 by default, never ChatGPT's own 1455)
 import { createServer } from 'node:http';
 import { fileURLToPath } from 'node:url';
 /** An access token as OpenAI shapes it: the account, the plan and the email in its claims. */
@@ -107,6 +107,6 @@ export async function mockOpenAI({ port = 0, host = '127.0.0.1', plan = 'plus',
     };
 }
 if (process.argv[1] === fileURLToPath(import.meta.url)) {
-    const m = await mockOpenAI({ port: Number(process.argv[2] ?? 1455), host: '0.0.0.0', log: (line) => console.log(new Date().toISOString().slice(11, 19), line) });
+    const m = await mockOpenAI({ port: Number(process.argv[2] ?? 21455), host: '0.0.0.0', log: (line) => console.log(new Date().toISOString().slice(11, 19), line) });
     console.log(`stand-in OpenAI on ${m.base}; approve codes at ${m.base}/codex/device`);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@byokit/accounts",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Sign in with the AI plan you already pay for, into your app's own store.",
   "license": "Apache-2.0",
   "type": "module",
@@ -25,10 +25,6 @@
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
-    "./portable": {
-      "types": "./dist/portable.d.ts",
-      "default": "./dist/portable.js"
-    },
     "./isolate": {
       "types": "./dist/isolate.d.ts",
       "default": "./dist/isolate.js"