@pure01fx/dsh-openai-codex-auth 0.7.3 → 0.9.0

package/lib/index.js

@@ -39,6 +39,10 @@ const TOKEN_REF = credentialRef('DSH_OPENAI_CODEX_TOKEN');
 const USAGE_URL = 'https://chatgpt.com/backend-api/wham/usage';
 const MAX_ERROR_BODY_LENGTH = 1_024;
 const MAX_REQUEST_BODY_LENGTH = 8_192;
+const ACCOUNT_USAGE_REQUEST_TIMEOUT_MS = 10_000;
+const TOKEN_REFRESH_REQUEST_TIMEOUT_MS = 30_000;
+const ACCOUNT_REFRESH_LOCK_WAIT_MS = 35_000;
+const CREDENTIAL_REFRESH_PERSIST_WAIT_MS = 500;
 class DeviceCodeUnavailableError extends Error {
     code = 'device_code_unavailable';
 }
@@ -46,12 +50,32 @@ class LoginConflictError extends Error {
 }
 class CredentialNotWritableError extends Error {
 }
+class AccountNotFoundError extends Error {
+}
+class CredentialRefreshUncertainError extends Error {
+    constructor(cause) {
+        super('OpenAI credential refresh outcome is uncertain; sign in to this account again', { cause });
+    }
+}
 const PERMANENT_REFRESH_CODES = new Set([
     'refresh_token_expired',
     'refresh_token_reused',
     'refresh_token_invalidated',
     'invalid_grant',
 ]);
+const DEFINITIVE_OAUTH_REFRESH_CODES = new Set([
+    ...PERMANENT_REFRESH_CODES,
+    'access_denied',
+    'invalid_client',
+    'invalid_request',
+    'invalid_scope',
+    'server_error',
+    'slow_down',
+    'temporarily_unavailable',
+    'temporary_failure',
+    'unauthorized_client',
+    'unsupported_grant_type',
+]);
 class OAuthEndpointError extends Error {
     status;
     oauthCode;
@@ -68,6 +92,33 @@ function base64Url(value) {
 function messageOf(error) {
     return error instanceof Error ? error.message : String(error);
 }
+function isTimeoutAbort(signal) {
+    return signal?.aborted === true
+        && signal.reason instanceof DOMException
+        && signal.reason.name === 'TimeoutError';
+}
+function boundedAccountUsageSignal(signal) {
+    const timeout = AbortSignal.timeout(ACCOUNT_USAGE_REQUEST_TIMEOUT_MS);
+    return signal === undefined ? timeout : AbortSignal.any([signal, timeout]);
+}
+function isFileLockTimeout(error) {
+    return error instanceof Error
+        && error.message.startsWith('atomic-write: timed out waiting for the writer lock at ');
+}
+function waitForSignal(promise, signal) {
+    if (signal === undefined)
+        return promise;
+    if (signal.aborted)
+        return Promise.reject(signal.reason instanceof Error ? signal.reason : new Error('Request cancelled'));
+    return new Promise((resolveWait, rejectWait) => {
+        const onAbort = () => {
+            signal.removeEventListener('abort', onAbort);
+            rejectWait(signal.reason instanceof Error ? signal.reason : new Error('Request cancelled'));
+        };
+        signal.addEventListener('abort', onAbort, { once: true });
+        promise.then((value) => { signal.removeEventListener('abort', onAbort); resolveWait(value); }, (error) => { signal.removeEventListener('abort', onAbort); rejectWait(error); });
+    });
+}
 function throwIfCancelled(signal) {
     if (!signal?.aborted)
         return;
@@ -124,28 +175,76 @@ function parseTokenResponse(value, previous) {
         : chatGptAccountId(idToken, 'ID token');
     if (resolvedAccountId === undefined)
         throw new Error('OpenAI token response has no ID token');
-    return { access: value.access_token, refresh, expires, accountId: resolvedAccountId };
+    const emailClaim = idToken === undefined ? undefined : jwtPayload(idToken, 'ID token').email;
+    const email = typeof emailClaim === 'string' && emailClaim.trim() !== ''
+        ? emailClaim.trim()
+        : previous?.email;
+    return {
+        access: value.access_token,
+        refresh,
+        expires,
+        accountId: resolvedAccountId,
+        ...email === undefined ? {} : { email },
+    };
 }
 function isPermanentRefreshError(error) {
     return error instanceof OAuthEndpointError
         && (error.status === 401
             || (error.oauthCode !== undefined && PERMANENT_REFRESH_CODES.has(error.oauthCode.toLowerCase())));
 }
-function parseCredential(text, filename) {
-    const value = JSON.parse(text);
-    const credential = value.credential;
-    if (value.version !== 1 || credential === undefined
+function isDefinitiveOAuthRefreshError(error) {
+    return error instanceof OAuthEndpointError
+        && (error.status === 400 || error.status === 401)
+        && error.oauthCode !== undefined
+        && DEFINITIVE_OAUTH_REFRESH_CODES.has(error.oauthCode.toLowerCase());
+}
+function validateCredential(value, filename) {
+    const credential = value;
+    if (credential === null || typeof credential !== 'object'
         || typeof credential.access !== 'string' || credential.access.length === 0
         || typeof credential.refresh !== 'string' || credential.refresh.length === 0
         || typeof credential.expires !== 'number' || !Number.isFinite(credential.expires)
-        || typeof credential.accountId !== 'string' || credential.accountId.length === 0) {
+        || typeof credential.accountId !== 'string' || credential.accountId.length === 0
+        || credential.accountId.length > 512
+        || (credential.email !== undefined && (typeof credential.email !== 'string' || credential.email.length > 512))) {
         throw new Error(`openai-codex-auth: invalid credential document ${filename}`);
     }
-    return credential;
+    return {
+        access: credential.access,
+        refresh: credential.refresh,
+        expires: credential.expires,
+        accountId: credential.accountId,
+        ...credential.email === undefined ? {} : { email: credential.email },
+    };
 }
-async function readCredential(filename) {
+function parseCredentialDocument(text, filename) {
+    const value = JSON.parse(text);
+    if (value.version === 1) {
+        const credential = validateCredential(value.credential, filename);
+        return {
+            document: { version: 2, currentAccountId: credential.accountId, accounts: [credential] },
+            migrated: true,
+        };
+    }
+    if (value.version !== 2 || !Array.isArray(value.accounts)
+        || (value.currentAccountId !== null && typeof value.currentAccountId !== 'string')) {
+        throw new Error(`openai-codex-auth: invalid credential document ${filename}`);
+    }
+    const accounts = value.accounts.map(account => validateCredential(account, filename));
+    const ids = new Set(accounts.map(account => account.accountId));
+    if (ids.size !== accounts.length
+        || (accounts.length === 0 && value.currentAccountId !== null)
+        || (accounts.length > 0 && (value.currentAccountId === null || !ids.has(value.currentAccountId)))) {
+        throw new Error(`openai-codex-auth: invalid credential document ${filename}`);
+    }
+    return {
+        document: { version: 2, currentAccountId: value.currentAccountId, accounts },
+        migrated: false,
+    };
+}
+async function readCredentialDocument(filename) {
     try {
-        return parseCredential(await readFile(filename, 'utf8'), filename);
+        return parseCredentialDocument(await readFile(filename, 'utf8'), filename);
     }
     catch (error) {
         if (error.code === 'ENOENT')
@@ -153,6 +252,11 @@ async function readCredential(filename) {
         throw error;
     }
 }
+function currentCredential(document) {
+    if (document?.currentAccountId === null || document === undefined)
+        return undefined;
+    return document.accounts.find(account => account.accountId === document.currentAccountId);
+}
 async function responseText(response) {
     return (await response.text().catch(() => '')).slice(0, MAX_ERROR_BODY_LENGTH);
 }
@@ -209,7 +313,7 @@ async function tokenRequest(init, previous, signal) {
     }
     catch (error) {
         if (signal?.aborted)
-            throw new Error('OpenAI login cancelled');
+            throw new Error(isTimeoutAbort(signal) ? 'OpenAI token request timed out' : 'OpenAI login cancelled');
         throw error;
     }
     if (!response.ok) {
@@ -573,6 +677,8 @@ function resolveCodexRouteStatus(config, llm) {
 }
 export const internals = {
     parseTokenResponse,
+    parseCredentialDocument,
+    currentCredential,
     parseAuthority,
     isLoopbackHostname,
     isTrustedHost,
@@ -604,6 +710,8 @@ export class OpenAICodexAuth extends Service {
     usageError;
     usageRefresh;
     usageGeneration = 0;
+    accountUsageRequestGeneration = 0;
+    accountUsageCredentialRefreshes = new Map();
     directUsageSequence = 0;
     directUsageAccountId;
     usageHasDirectDefault = false;
@@ -703,6 +811,9 @@ export class OpenAICodexAuth extends Service {
                 register('/openai-codex/browser/prepare', (req, res) => this.handleBrowserPrepare(req, res));
                 register('/openai-codex/browser/complete', (req, res) => this.handleBrowserComplete(req, res));
                 register('/openai-codex/cancel', (req, res) => this.handleCancel(req, res));
+                register('/openai-codex/accounts/current', (req, res) => this.handleSetCurrentAccount(req, res));
+                register('/openai-codex/accounts/usage', (req, res) => this.handleAccountUsage(req, res));
+                register('/openai-codex/accounts/logout', (req, res) => this.handleAccountLogout(req, res));
                 register('/openai-codex/logout', (req, res) => this.handleLogout(req, res));
             }
             catch (error) {
@@ -747,7 +858,7 @@ export class OpenAICodexAuth extends Service {
             return;
         this.responseUsage = {
             accountId: observation.accountId,
-            amount: observation.metadata.amount,
+            metadata: observation.metadata,
             observedAt: Date.now(),
         };
     }
@@ -768,8 +879,7 @@ export class OpenAICodexAuth extends Service {
         const sameUsageAccount = this.usageAccountId === accountId;
         if (!sameUsageAccount)
             this.usageHasDirectDefault = false;
-        if (hasDefaultQuota)
-            this.usageGeneration += 1;
+        this.usageGeneration += 1;
         this.usageCache = mergeDirectUsage(sameUsageAccount ? this.usageCache : undefined, accepted);
         this.usageAccountId = accountId;
         this.usageError = undefined;
@@ -802,7 +912,7 @@ export class OpenAICodexAuth extends Service {
     }
     async performUsageRefresh(generation) {
         try {
-            const credential = await readCredential(this.filename);
+            const credential = await this.managedCredential();
             if (credential === undefined) {
                 if (this.usageGeneration === generation) {
                     this.usageCache = undefined;
@@ -900,72 +1010,124 @@ export class OpenAICodexAuth extends Service {
         }
         throw failure;
     }
-    async commitCredential(credential) {
+    async commitDocument(document, signal) {
+        const nextToken = currentCredential(document)?.access;
         const previous = await this.ctx.credentials.resolve(TOKEN_REF);
-        try {
-            await this.ctx.credentials.set(TOKEN_REF, credential.access);
-        }
-        catch (error) {
-            let current;
+        throwIfCancelled(signal);
+        if (previous?.value !== nextToken) {
             try {
-                current = await this.ctx.credentials.resolve(TOKEN_REF);
-            }
-            catch {
-                return this.failAfterPublicationRollback(previous, credential.access, error);
+                if (nextToken === undefined)
+                    await this.ctx.credentials.unset(TOKEN_REF);
+                else
+                    await this.ctx.credentials.set(TOKEN_REF, nextToken);
             }
-            if (current?.value === credential.access) {
-                return this.failAfterPublicationRollback(previous, credential.access, error);
+            catch (error) {
+                let current;
+                try {
+                    current = await this.ctx.credentials.resolve(TOKEN_REF);
+                }
+                catch {
+                    return this.failAfterPublicationRollback(previous, nextToken, error);
+                }
+                if (current?.value === nextToken) {
+                    return this.failAfterPublicationRollback(previous, nextToken, error);
+                }
+                if (current?.value !== previous?.value)
+                    throw this.publicationChangedError(error);
+                throw error;
             }
-            if (current?.value !== previous?.value)
-                throw this.publicationChangedError(error);
-            throw error;
         }
         try {
-            await this.write(credential);
+            await this.write(document);
         }
         catch (error) {
-            return this.failAfterPublicationRollback(previous, credential.access, error);
+            if (previous?.value === nextToken)
+                throw error;
+            return this.failAfterPublicationRollback(previous, nextToken, error);
         }
     }
-    async resolveManagedCredentialLocked(signal) {
-        throwIfCancelled(signal);
-        const current = await readCredential(this.filename);
+    upsertCurrentCredential(document, credential, replacedAccountId = credential.accountId) {
+        const existingIndex = document.accounts.findIndex(account => account.accountId === replacedAccountId);
+        const accounts = document.accounts.filter(account => account.accountId !== credential.accountId);
+        const filteredIndex = accounts.findIndex(account => account.accountId === replacedAccountId);
+        if (filteredIndex >= 0)
+            accounts.splice(filteredIndex, 1);
+        const insertion = existingIndex < 0 ? accounts.length : Math.min(existingIndex, accounts.length);
+        accounts.splice(insertion, 0, credential);
+        return { version: 2, currentAccountId: credential.accountId, accounts };
+    }
+    async commitCredential(credential) {
+        const parsed = await readCredentialDocument(this.filename);
+        const document = parsed?.document ?? { version: 2, currentAccountId: null, accounts: [] };
+        await this.commitDocument(this.upsertCurrentCredential(document, credential));
+    }
+    /** Return the current managed bearer token, refreshing and migrating it when needed. */
+    async bearerToken(signal) {
         throwIfCancelled(signal);
-        if (current === undefined) {
-            this.setCredentialAccount(undefined);
-            return undefined;
-        }
-        if (current.expires > Date.now() + TOKEN_REFRESH_PREEMPT_MS) {
-            await this.publishCredentialToken(current.access, signal);
-            this.setCredentialAccount(current.accountId);
-            return current;
-        }
-        await this.assertCredentialWritable();
-        let next;
-        try {
-            next = await refreshToken(current, signal);
-        }
-        catch (error) {
-            throwIfCancelled(signal);
-            if (!isPermanentRefreshError(error) && current.expires > Date.now()) {
-                await this.publishCredentialToken(current.access, signal);
-                this.setCredentialAccount(current.accountId);
-                return current;
+        while (true) {
+            const prepared = await withFileLock(this.filename, async () => {
+                throwIfCancelled(signal);
+                const parsed = await readCredentialDocument(this.filename);
+                const document = parsed?.document;
+                const current = currentCredential(document);
+                if (current === undefined) {
+                    this.setCredentialAccount(undefined);
+                    return undefined;
+                }
+                if (current.expires > Date.now() + TOKEN_REFRESH_PREEMPT_MS) {
+                    if (parsed?.migrated)
+                        await this.commitDocument(document, signal);
+                    else
+                        await this.publishCredentialToken(current.access, signal);
+                    this.setCredentialAccount(current.accountId);
+                    return { credential: current, ready: true };
+                }
+                return { credential: current, ready: false };
+            });
+            if (prepared === undefined)
+                return undefined;
+            if (prepared.ready)
+                return prepared.credential.access;
+            let refreshed;
+            try {
+                refreshed = await waitForSignal(this.refreshManagedAccount(prepared.credential, true), signal);
             }
-            throw error;
+            catch (error) {
+                throwIfCancelled(signal);
+                throw error;
+            }
+            if (refreshed === undefined)
+                continue;
+            const access = await withFileLock(this.filename, async () => {
+                throwIfCancelled(signal);
+                const parsed = await readCredentialDocument(this.filename);
+                const document = parsed?.document;
+                const current = currentCredential(document);
+                if (current === undefined || current.accountId !== prepared.credential.accountId)
+                    return undefined;
+                if (current.expires <= Date.now())
+                    throw new Error('OpenAI Codex access token has expired');
+                if (parsed?.migrated)
+                    await this.commitDocument(document, signal);
+                else
+                    await this.publishCredentialToken(current.access, signal);
+                this.setCredentialAccount(current.accountId);
+                return current.access;
+            });
+            if (access !== undefined)
+                return access;
         }
-        throwIfCancelled(signal);
-        await this.commitCredential(next);
-        this.setCredentialAccount(next.accountId);
-        return next;
     }
-    /** Return a valid managed bearer token, refreshing and persisting it when near expiry. */
-    async bearerToken(signal) {
-        throwIfCancelled(signal);
-        return withFileLock(this.filename, async () => {
-            const credential = await this.resolveManagedCredentialLocked(signal);
-            return credential?.access;
-        });
+    async managedCredential(signal) {
+        while (true) {
+            const access = await this.bearerToken(signal);
+            if (access === undefined)
+                return undefined;
+            const current = currentCredential((await readCredentialDocument(this.filename))?.document);
+            if (current?.access === access)
+                return current;
+            throwIfCancelled(signal);
+        }
     }
     externalNativeCredential(accessToken) {
         let accountId;
@@ -985,23 +1147,20 @@ export class OpenAICodexAuth extends Service {
     async resolveNativeCredential(signal) {
         try {
             throwIfCancelled(signal);
-            return await withFileLock(this.filename, async () => {
+            const managed = await this.managedCredential(signal);
+            if (managed !== undefined) {
                 throwIfCancelled(signal);
-                const managed = await this.resolveManagedCredentialLocked(signal);
-                if (managed !== undefined) {
-                    throwIfCancelled(signal);
-                    return { accessToken: managed.access, accountId: managed.accountId };
-                }
-                const external = await this.ctx.credentials.resolve(TOKEN_REF);
-                throwIfCancelled(signal);
-                if (external === undefined) {
-                    throw new LlmError('native Codex credential is not configured', 'MISSING_CREDENTIAL');
-                }
-                const credential = this.externalNativeCredential(external.value);
-                throwIfCancelled(signal);
-                this.setCredentialAccount(credential.accountId);
-                return credential;
-            });
+                return { accessToken: managed.access, accountId: managed.accountId };
+            }
+            const external = await this.ctx.credentials.resolve(TOKEN_REF);
+            throwIfCancelled(signal);
+            if (external === undefined) {
+                throw new LlmError('native Codex credential is not configured', 'MISSING_CREDENTIAL');
+            }
+            const credential = this.externalNativeCredential(external.value);
+            throwIfCancelled(signal);
+            this.setCredentialAccount(credential.accountId);
+            return credential;
         }
         catch (error) {
             if (error instanceof LlmError)
@@ -1013,9 +1172,12 @@ export class OpenAICodexAuth extends Service {
         }
     }
     nativeRecoveryError(error) {
+        const cause = error instanceof CredentialRefreshUncertainError && error.cause !== undefined
+            ? error.cause
+            : error;
         const options = {
-            cause: error,
-            ...(error instanceof OAuthEndpointError ? { status: error.status } : {}),
+            cause,
+            ...(cause instanceof OAuthEndpointError ? { status: cause.status } : {}),
         };
         if (error instanceof CredentialNotWritableError || isPermanentRefreshError(error)) {
             return new LlmError('native Codex managed credential cannot be refreshed', INVALID_CREDENTIAL_CODE, options);
@@ -1025,35 +1187,46 @@ export class OpenAICodexAuth extends Service {
     async recoverNativeCredential(previous, signal) {
         try {
             throwIfCancelled(signal);
-            return await withFileLock(this.filename, async () => {
-                throwIfCancelled(signal);
-                const current = await readCredential(this.filename);
+            const prepared = await withFileLock(this.filename, async () => {
                 throwIfCancelled(signal);
+                const current = currentCredential((await readCredentialDocument(this.filename))?.document);
                 if (current === undefined) {
                     const external = await this.ctx.credentials.resolve(TOKEN_REF);
                     throwIfCancelled(signal);
                     if (external === undefined)
-                        return false;
+                        return { result: false };
                     const credential = this.externalNativeCredential(external.value);
                     throwIfCancelled(signal);
+                    if (credential.accountId !== previous.accountId)
+                        return { result: false };
                     this.setCredentialAccount(credential.accountId);
-                    return credential.accessToken !== previous.accessToken
-                        || credential.accountId !== previous.accountId;
+                    return { result: credential.accessToken !== previous.accessToken };
                 }
-                if (current.access !== previous.accessToken || current.accountId !== previous.accountId) {
+                // A request that started under A must never recover by replaying under B.
+                if (current.accountId !== previous.accountId)
+                    return { result: false };
+                if (current.access !== previous.accessToken) {
                     await this.publishCredentialToken(current.access, signal);
                     throwIfCancelled(signal);
                     this.setCredentialAccount(current.accountId);
-                    return true;
+                    return { result: true };
                 }
-                await this.assertCredentialWritable();
-                throwIfCancelled(signal);
-                const next = await refreshToken(current, signal);
+                return { credential: current };
+            });
+            if (prepared.result !== undefined)
+                return prepared.result;
+            const refreshed = await waitForSignal(this.refreshManagedAccount(prepared.credential, true, true), signal);
+            if (refreshed === undefined)
+                return false;
+            return withFileLock(this.filename, async () => {
                 throwIfCancelled(signal);
-                await this.commitCredential(next);
+                const current = currentCredential((await readCredentialDocument(this.filename))?.document);
+                if (current === undefined || current.accountId !== previous.accountId)
+                    return false;
+                await this.publishCredentialToken(current.access, signal);
                 throwIfCancelled(signal);
-                this.setCredentialAccount(next.accountId);
-                return next.access !== previous.accessToken || next.accountId !== previous.accountId;
+                this.setCredentialAccount(current.accountId);
+                return current.access !== previous.accessToken;
             });
         }
         catch (error) {
@@ -1068,18 +1241,22 @@ export class OpenAICodexAuth extends Service {
     async finishCredential(credential, signal) {
         await this.assertCredentialWritable();
         throwIfCancelled(signal);
-        await withFileLock(this.filename, async () => {
+        await this.withAccountRefreshLock(credential.accountId, async () => {
             throwIfCancelled(signal);
-            await this.commitCredential(credential);
-            this.setCredentialAccount(credential.accountId);
-            this.usageGeneration += 1;
-            if (this.usageRefresh !== undefined)
-                this.usageRefresh.queued = true;
-            this.usageCache = undefined;
-            this.usageAccountId = undefined;
-            this.directUsageAccountId = undefined;
-            this.usageHasDirectDefault = false;
-            this.usageError = undefined;
+            await withFileLock(this.filename, async () => {
+                throwIfCancelled(signal);
+                await this.commitCredential(credential);
+                this.setCredentialAccount(credential.accountId);
+                this.usageGeneration += 1;
+                if (this.usageRefresh !== undefined)
+                    this.usageRefresh.queued = true;
+                this.usageCache = undefined;
+                this.usageAccountId = undefined;
+                this.directUsageAccountId = undefined;
+                this.usageHasDirectDefault = false;
+                this.usageError = undefined;
+            });
+            await this.clearAccountRefreshJournal(credential.accountId);
         });
         this.lastLoginError = undefined;
     }
@@ -1296,53 +1473,116 @@ export class OpenAICodexAuth extends Service {
         if (clearError)
             this.lastLoginError = undefined;
     }
-    async logout() {
-        await this.cancelLogin(true);
-        await withFileLock(this.filename, async () => {
-            const previous = await this.ctx.credentials.resolve(TOKEN_REF);
+    resetCurrentAccountState(accountId) {
+        this.setCredentialAccount(accountId);
+        this.usageGeneration += 1;
+        if (this.usageRefresh !== undefined)
+            this.usageRefresh.queued = accountId !== undefined;
+        this.usageCache = undefined;
+        this.usageAccountId = undefined;
+        this.directUsageAccountId = undefined;
+        this.usageHasDirectDefault = false;
+        this.usageError = undefined;
+        this.lastLoginError = undefined;
+    }
+    async setCurrentAccount(accountId) {
+        await this.withAccountRefreshLock(accountId, async () => {
+            await this.reconcileAccountRefreshJournal(accountId);
+            await withFileLock(this.filename, async () => {
+                const document = (await readCredentialDocument(this.filename))?.document;
+                if (document === undefined || !document.accounts.some(account => account.accountId === accountId)) {
+                    throw new AccountNotFoundError('OpenAI Codex account was not found');
+                }
+                if (document.currentAccountId !== accountId) {
+                    await this.assertCredentialWritable();
+                    await this.commitDocument({ ...document, currentAccountId: accountId });
+                }
+                this.resetCurrentAccountState(accountId);
+            });
+        });
+    }
+    async logoutAttempt(accountId, expectedPromotion) {
+        return withFileLock(this.filename, async () => {
+            let parsed;
             try {
-                await this.ctx.credentials.unset(TOKEN_REF);
+                parsed = await readCredentialDocument(this.filename);
             }
             catch (error) {
-                let current;
+                if (accountId !== undefined)
+                    throw error;
+                const previous = await this.ctx.credentials.resolve(TOKEN_REF);
                 try {
-                    current = await this.ctx.credentials.resolve(TOKEN_REF);
+                    if (previous !== undefined)
+                        await this.ctx.credentials.unset(TOKEN_REF);
+                    await unlink(this.filename);
                 }
-                catch {
-                    return this.failAfterPublicationRollback(previous, undefined, error);
+                catch (failure) {
+                    return this.failAfterPublicationRollback(previous, undefined, failure);
                 }
-                if (current === undefined) {
-                    return this.failAfterPublicationRollback(previous, undefined, error);
-                }
-                if (current.value !== previous?.value)
-                    throw this.publicationChangedError(error);
-                throw error;
+                this.resetCurrentAccountState(undefined);
+                return true;
             }
-            try {
-                await unlink(this.filename);
+            const document = parsed?.document;
+            const target = accountId ?? document?.currentAccountId ?? undefined;
+            if (document === undefined || target === undefined
+                || !document.accounts.some(account => account.accountId === target)) {
+                if (accountId !== undefined)
+                    throw new AccountNotFoundError('OpenAI Codex account was not found');
+                return true;
             }
-            catch (error) {
-                if (error.code !== 'ENOENT') {
-                    return this.failAfterPublicationRollback(previous, undefined, error);
+            const removedCurrent = document.currentAccountId === target;
+            const targetIndex = document.accounts.findIndex(account => account.accountId === target);
+            const accounts = document.accounts.filter(account => account.accountId !== target);
+            const currentAccountId = removedCurrent
+                ? accounts[targetIndex]?.accountId ?? accounts[0]?.accountId ?? null
+                : document.currentAccountId;
+            const promotion = removedCurrent ? currentAccountId ?? undefined : undefined;
+            if (promotion !== expectedPromotion)
+                return false;
+            if (removedCurrent)
+                await this.assertCredentialWritable();
+            await this.commitDocument({ version: 2, currentAccountId, accounts });
+            await this.clearAccountRefreshJournal(target);
+            if (removedCurrent)
+                this.resetCurrentAccountState(currentAccountId ?? undefined);
+            return true;
+        });
+    }
+    async logout(accountId) {
+        if (accountId === undefined)
+            await this.cancelLogin(true);
+        while (true) {
+            let target;
+            let expectedPromotion;
+            try {
+                const document = (await readCredentialDocument(this.filename))?.document;
+                target = accountId ?? document?.currentAccountId ?? undefined;
+                if (document !== undefined && target !== undefined && document.currentAccountId === target) {
+                    const targetIndex = document.accounts.findIndex(account => account.accountId === target);
+                    const accounts = document.accounts.filter(account => account.accountId !== target);
+                    expectedPromotion = accounts[targetIndex]?.accountId ?? accounts[0]?.accountId;
                 }
             }
-        });
-        this.setCredentialAccount(undefined);
-        this.usageGeneration += 1;
-        if (this.usageRefresh !== undefined)
-            this.usageRefresh.queued = false;
-        this.usageCache = undefined;
-        this.usageAccountId = undefined;
-        this.directUsageAccountId = undefined;
-        this.usageHasDirectDefault = false;
-        this.usageError = undefined;
-        this.lastLoginError = undefined;
+            catch { }
+            const lockIds = [target, expectedPromotion].filter((value) => value !== undefined);
+            const done = lockIds.length === 0
+                ? await this.logoutAttempt(accountId, undefined)
+                : await this.withAccountRefreshLocks(lockIds, async () => {
+                    if (expectedPromotion !== undefined)
+                        await this.reconcileAccountRefreshJournal(expectedPromotion);
+                    return this.logoutAttempt(accountId, expectedPromotion);
+                });
+            if (done)
+                return;
+        }
     }
     async status(refresh, callbackUrl) {
+        let document;
         let credential;
         let credentialError;
         try {
-            credential = await readCredential(this.filename);
+            document = (await readCredentialDocument(this.filename))?.document;
+            credential = currentCredential(document);
         }
         catch (error) {
             credentialError = messageOf(error);
@@ -1350,7 +1590,8 @@ export class OpenAICodexAuth extends Service {
         if (credential !== undefined) {
             try {
                 await this.bearerToken();
-                credential = await readCredential(this.filename) ?? credential;
+                document = (await readCredentialDocument(this.filename))?.document ?? document;
+                credential = currentCredential(document) ?? credential;
             }
             catch (error) {
                 this.usageError = messageOf(error);
@@ -1379,6 +1620,13 @@ export class OpenAICodexAuth extends Service {
         return {
             route: resolveCodexRouteStatus(this.routeConfig, this.ctx.get('llm')),
             loggedIn: credential !== undefined,
+            currentAccountId: document?.currentAccountId ?? null,
+            accounts: (document?.accounts ?? []).map(account => ({
+                accountId: account.accountId,
+                ...account.email === undefined ? {} : { email: account.email },
+                expiresAt: account.expires,
+                current: account.accountId === document?.currentAccountId,
+            })),
             loginPending: startingMethod !== undefined || flow !== undefined,
             ...startingMethod !== undefined ? { loginMethod: startingMethod } : flow === undefined ? {} : { loginMethod: flow.kind },
             ...this.lastLoginError === undefined ? {} : { loginError: this.lastLoginError },
@@ -1388,12 +1636,13 @@ export class OpenAICodexAuth extends Service {
             ...browser === undefined ? {} : { browser },
             ...credential === undefined ? {} : {
                 accountId: credential.accountId,
+                ...credential.email === undefined ? {} : { email: credential.email },
                 expiresAt: credential.expires,
                 ...this.usageCache === undefined || this.usageAccountId !== credential.accountId
                     ? {} : { usage: this.usageCache },
                 ...this.responseUsage === undefined || this.responseUsage.accountId !== credential.accountId
                     ? {} : { responseUsage: {
-                        amount: this.responseUsage.amount,
+                        ...this.responseUsage.metadata,
                         observedAt: this.responseUsage.observedAt,
                     } },
                 ...this.usageError === undefined ? {} : { usageError: this.usageError },
@@ -1401,25 +1650,316 @@ export class OpenAICodexAuth extends Service {
             csrf: this.csrf,
         };
     }
-    async fetchUsage(credential) {
-        const access = await this.bearerToken();
-        if (access === undefined)
-            throw new Error('OpenAI login is missing');
-        const response = await fetch(USAGE_URL, {
-            redirect: 'error',
-            headers: {
-                accept: 'application/json',
-                authorization: `Bearer ${access}`,
-                'chatgpt-account-id': credential.accountId,
-                'user-agent': 'dsh-openai-codex-auth/0.5.0',
-            },
+    accountRefreshJournalFilename(accountId) {
+        const key = createHash('sha256').update(accountId).digest('hex').slice(0, 24);
+        return `${this.filename}.account-${key}-refresh.json`;
+    }
+    async readAccountRefreshJournal(accountId) {
+        const filename = this.accountRefreshJournalFilename(accountId);
+        let value;
+        try {
+            value = JSON.parse(await readFile(filename, 'utf8'));
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        }
+        const journal = value;
+        if (journal === null || typeof journal !== 'object' || journal.version !== 1
+            || journal.accountId !== accountId || typeof journal.startedAt !== 'number'
+            || !Number.isFinite(journal.startedAt)
+            || (journal.phase !== 'pending' && journal.phase !== 'uncertain' && journal.phase !== 'refreshed')) {
+            throw new Error(`openai-codex-auth: invalid credential refresh journal ${filename}`);
+        }
+        const stored = validateCredential(journal.stored, filename);
+        if (stored.accountId !== accountId)
+            throw new Error(`openai-codex-auth: invalid credential refresh journal ${filename}`);
+        if (journal.phase === 'refreshed') {
+            const refreshed = validateCredential(journal.refreshed, filename);
+            if (refreshed.accountId !== accountId)
+                throw new Error(`openai-codex-auth: invalid credential refresh journal ${filename}`);
+            return { version: 1, accountId, startedAt: journal.startedAt, phase: 'refreshed', stored, refreshed };
+        }
+        return { version: 1, accountId, startedAt: journal.startedAt, phase: journal.phase, stored };
+    }
+    writeAccountRefreshJournal(journal) {
+        return writeFileAtomic(this.accountRefreshJournalFilename(journal.accountId), JSON.stringify(journal), { mode: 0o600 });
+    }
+    async clearAccountRefreshJournal(accountId) {
+        try {
+            await unlink(this.accountRefreshJournalFilename(accountId));
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+    }
+    async removeDeadFileLock(filename) {
+        const lockFilename = `${filename}.lock`;
+        let owner;
+        try {
+            const text = (await readFile(lockFilename, 'utf8')).trim();
+            owner = Number(text);
+            if (!Number.isSafeInteger(owner) || owner <= 0)
+                return false;
+        }
+        catch (error) {
+            return error.code === 'ENOENT';
+        }
+        try {
+            process.kill(owner, 0);
+            return false;
+        }
+        catch (error) {
+            if (error.code !== 'ESRCH')
+                return false;
+            try {
+                await unlink(lockFilename);
+                return true;
+            }
+            catch (unlinkError) {
+                return unlinkError.code === 'ENOENT';
+            }
+        }
+    }
+    async withAccountRefreshLock(accountId, operation) {
+        const filename = this.accountRefreshJournalFilename(accountId);
+        await this.removeDeadFileLock(filename);
+        for (let attempt = 0; attempt < 2; attempt += 1) {
+            try {
+                return await withFileLock(filename, operation, { waitMs: ACCOUNT_REFRESH_LOCK_WAIT_MS });
+            }
+            catch (error) {
+                if (!isFileLockTimeout(error) || attempt > 0 || !await this.removeDeadFileLock(filename))
+                    throw error;
+            }
+        }
+        throw new Error('OpenAI credential refresh lock could not be acquired');
+    }
+    withAccountRefreshLocks(accountIds, operation) {
+        const ordered = [...new Set(accountIds)].sort();
+        const acquire = (index) => index === ordered.length
+            ? operation()
+            : this.withAccountRefreshLock(ordered[index], () => acquire(index + 1));
+        return acquire(0);
+    }
+    async reconcileAccountRefreshJournal(accountId) {
+        const journal = await this.readAccountRefreshJournal(accountId);
+        if (journal === undefined)
+            return undefined;
+        const latest = (await readCredentialDocument(this.filename))?.document.accounts
+            .find(account => account.accountId === accountId);
+        if (latest === undefined
+            || latest.access !== journal.stored.access
+            || latest.refresh !== journal.stored.refresh
+            || latest.expires !== journal.stored.expires) {
+            await this.clearAccountRefreshJournal(accountId);
+            return latest;
+        }
+        if (journal.phase !== 'refreshed')
+            throw new CredentialRefreshUncertainError();
+        try {
+            const credential = await this.persistAccountUsageCredential(journal.stored, journal.refreshed);
+            await this.clearAccountRefreshJournal(accountId);
+            return credential;
+        }
+        catch (error) {
+            if (error instanceof AccountNotFoundError)
+                await this.clearAccountRefreshJournal(accountId);
+            throw error;
+        }
+    }
+    async refreshManagedAccount(stored, requireCurrent, force = false) {
+        return this.withAccountRefreshLock(stored.accountId, async () => {
+            const recovered = await this.reconcileAccountRefreshJournal(stored.accountId);
+            if (recovered !== undefined)
+                return recovered;
+            const prepared = await withFileLock(this.filename, async () => {
+                const document = (await readCredentialDocument(this.filename))?.document;
+                const latest = document?.accounts.find(account => account.accountId === stored.accountId);
+                if (document === undefined || latest === undefined)
+                    return undefined;
+                if (requireCurrent && document.currentAccountId !== latest.accountId)
+                    return undefined;
+                if (latest.access !== stored.access || latest.refresh !== stored.refresh || latest.expires !== stored.expires) {
+                    return { credential: latest, changed: true };
+                }
+                if ((force || latest.expires <= Date.now() + TOKEN_REFRESH_PREEMPT_MS)
+                    && document.currentAccountId === latest.accountId)
+                    await this.assertCredentialWritable();
+                return { credential: latest, changed: false };
+            });
+            if (prepared === undefined || prepared.changed
+                || (!force && prepared.credential.expires > Date.now() + TOKEN_REFRESH_PREEMPT_MS))
+                return prepared?.credential;
+            const credential = prepared.credential;
+            const pending = {
+                version: 1,
+                accountId: credential.accountId,
+                startedAt: Date.now(),
+                phase: 'pending',
+                stored: credential,
+            };
+            await this.writeAccountRefreshJournal(pending);
+            let refreshed;
+            try {
+                refreshed = await refreshToken(credential, AbortSignal.timeout(TOKEN_REFRESH_REQUEST_TIMEOUT_MS));
+            }
+            catch (error) {
+                if (isDefinitiveOAuthRefreshError(error)) {
+                    await this.clearAccountRefreshJournal(credential.accountId);
+                    if (!force && !isPermanentRefreshError(error) && credential.expires > Date.now())
+                        return credential;
+                    throw error;
+                }
+                await this.writeAccountRefreshJournal({ ...pending, phase: 'uncertain' });
+                throw new CredentialRefreshUncertainError(error);
+            }
+            if (refreshed.accountId !== credential.accountId) {
+                await this.writeAccountRefreshJournal({ ...pending, phase: 'uncertain' });
+                throw new Error('OpenAI refresh changed the ChatGPT account identity');
+            }
+            await this.writeAccountRefreshJournal({ ...pending, phase: 'refreshed', refreshed });
+            try {
+                const persisted = await this.persistAccountUsageCredential(credential, refreshed);
+                await this.clearAccountRefreshJournal(credential.accountId);
+                return persisted;
+            }
+            catch (error) {
+                if (error instanceof AccountNotFoundError)
+                    await this.clearAccountRefreshJournal(credential.accountId);
+                throw error;
+            }
+        });
+    }
+    async persistAccountUsageCredential(stored, refreshed) {
+        await this.removeDeadFileLock(this.filename);
+        for (let attempt = 0; attempt < 2; attempt += 1) {
+            try {
+                return await withFileLock(this.filename, async () => {
+                    const document = (await readCredentialDocument(this.filename))?.document;
+                    const latest = document?.accounts.find(account => account.accountId === stored.accountId);
+                    if (document === undefined || latest === undefined) {
+                        throw new AccountNotFoundError('OpenAI Codex account was removed while its quota was refreshing');
+                    }
+                    if (latest.access !== stored.access || latest.refresh !== stored.refresh || latest.expires !== stored.expires) {
+                        return latest;
+                    }
+                    const nextDocument = {
+                        ...document,
+                        accounts: document.accounts.map(account => account.accountId === stored.accountId ? refreshed : account),
+                    };
+                    if (document.currentAccountId === stored.accountId) {
+                        await this.assertCredentialWritable();
+                        await this.commitDocument(nextDocument);
+                    }
+                    else {
+                        await this.write(nextDocument);
+                    }
+                    return refreshed;
+                }, { waitMs: CREDENTIAL_REFRESH_PERSIST_WAIT_MS });
+            }
+            catch (error) {
+                if (!isFileLockTimeout(error) || attempt > 0 || !await this.removeDeadFileLock(this.filename))
+                    throw error;
+            }
+        }
+        throw new Error('OpenAI rotated credential could not be persisted');
+    }
+    refreshAccountUsageCredential(stored) {
+        const active = this.accountUsageCredentialRefreshes.get(stored.accountId);
+        if (active !== undefined)
+            return active;
+        const operation = this.refreshManagedAccount(stored, false).then((credential) => {
+            if (credential === undefined) {
+                throw new AccountNotFoundError('OpenAI Codex account was removed while its quota was refreshing');
+            }
+            return credential;
         });
+        let tracked;
+        tracked = operation.finally(() => {
+            if (this.accountUsageCredentialRefreshes.get(stored.accountId) === tracked) {
+                this.accountUsageCredentialRefreshes.delete(stored.accountId);
+            }
+        });
+        this.accountUsageCredentialRefreshes.set(stored.accountId, tracked);
+        return tracked;
+    }
+    async accountUsageCredential(stored, signal) {
+        if (stored.expires > Date.now() + TOKEN_REFRESH_PREEMPT_MS)
+            return stored;
+        return waitForSignal(this.refreshAccountUsageCredential(stored), signal);
+    }
+    async accountUsages(signal) {
+        const prepared = await withFileLock(this.filename, async () => {
+            const document = (await readCredentialDocument(this.filename))?.document;
+            if (document === undefined)
+                return undefined;
+            return {
+                cacheGeneration: this.usageGeneration,
+                requestGeneration: ++this.accountUsageRequestGeneration,
+                tasks: document.accounts.map(stored => ({
+                    accountId: stored.accountId,
+                    credential: this.accountUsageCredential(stored, signal),
+                })),
+            };
+        });
+        if (prepared === undefined)
+            return [];
+        const results = await Promise.all(prepared.tasks.map(async (task) => {
+            try {
+                const credential = await task.credential;
+                return {
+                    accountId: task.accountId,
+                    usage: await this.fetchUsage(credential, boundedAccountUsageSignal(signal)),
+                };
+            }
+            catch (error) {
+                return { accountId: task.accountId, error: messageOf(error) };
+            }
+        }));
+        if (!signal?.aborted) {
+            const currentAccountId = (await readCredentialDocument(this.filename))?.document.currentAccountId;
+            const current = results.find(row => row.accountId === currentAccountId);
+            if (current?.usage !== undefined
+                && this.usageGeneration === prepared.cacheGeneration
+                && this.accountUsageRequestGeneration === prepared.requestGeneration) {
+                this.usageGeneration += 1;
+                this.usageCache = current.usage;
+                this.usageAccountId = currentAccountId ?? undefined;
+                this.usageHasDirectDefault = false;
+                this.usageError = undefined;
+            }
+        }
+        return results;
+    }
+    async fetchUsage(credential, signal) {
+        let response;
+        try {
+            response = await fetch(USAGE_URL, {
+                redirect: 'error',
+                ...signal === undefined ? {} : { signal },
+                headers: {
+                    accept: 'application/json',
+                    authorization: `Bearer ${credential.access}`,
+                    'chatgpt-account-id': credential.accountId,
+                    'user-agent': 'dsh-openai-codex-auth/0.5.0',
+                },
+            });
+        }
+        catch (error) {
+            if (signal?.aborted) {
+                throw new Error(isTimeoutAbort(signal) ? 'Codex usage request timed out' : 'Codex usage request cancelled');
+            }
+            throw error;
+        }
         if (!response.ok)
             throw new Error(`Codex usage request failed (HTTP ${response.status})`);
         return normalizeUsage(await response.json());
     }
-    write(credential) {
-        return writeFileAtomic(this.filename, `${JSON.stringify({ version: 1, credential }, null, 2)}\n`, {
+    write(document) {
+        return writeFileAtomic(this.filename, `${JSON.stringify(document, null, 2)}\n`, {
             mode: 0o600, dirMode: 0o700,
         });
     }
@@ -1466,6 +2006,31 @@ export class OpenAICodexAuth extends Service {
             this.sendJson(res, 500, { error: messageOf(error) });
         }
     }
+    async handleAccountUsage(req, res) {
+        if (!this.trustedManagementRequest(req, res))
+            return;
+        if (req.method !== 'POST') {
+            this.sendJson(res, 405, { error: 'POST only' }, { allow: 'POST' });
+            return;
+        }
+        if (!this.requireCsrf(req, res))
+            return;
+        const abort = new AbortController();
+        const onAborted = () => { abort.abort(new Error('Account quota request cancelled')); };
+        const observesAbort = typeof req.once === 'function' && typeof req.off === 'function';
+        if (observesAbort)
+            req.once('aborted', onAborted);
+        try {
+            this.sendJson(res, 200, { accounts: await this.accountUsages(abort.signal) });
+        }
+        catch (error) {
+            this.sendJson(res, error instanceof CredentialNotWritableError ? 409 : 500, { error: messageOf(error) });
+        }
+        finally {
+            if (observesAbort)
+                req.off('aborted', onAborted);
+        }
+    }
     async handleDeviceStart(req, res) {
         if (!this.trustedManagementRequest(req, res))
             return;
@@ -1642,6 +2207,54 @@ export class OpenAICodexAuth extends Service {
             this.sendJson(res, 500, { error: messageOf(error) });
         }
     }
+    async accountIdBody(req) {
+        const body = await readJsonBody(req);
+        if (Object.keys(body).length !== 1 || typeof body.accountId !== 'string'
+            || body.accountId.length === 0 || body.accountId.length > 512) {
+            throw new Error('The accountId field must identify one OpenAI Codex account.');
+        }
+        return body.accountId;
+    }
+    async handleSetCurrentAccount(req, res) {
+        if (!this.trustedManagementRequest(req, res))
+            return;
+        if (req.method !== 'POST') {
+            this.sendJson(res, 405, { error: 'POST only' }, { allow: 'POST' });
+            return;
+        }
+        if (!this.requireCsrf(req, res))
+            return;
+        try {
+            await this.setCurrentAccount(await this.accountIdBody(req));
+            this.sendJson(res, 200, { ok: true });
+        }
+        catch (error) {
+            const status = error instanceof AccountNotFoundError
+                ? 404
+                : error instanceof CredentialNotWritableError ? 409 : 400;
+            this.sendJson(res, status, { error: messageOf(error) });
+        }
+    }
+    async handleAccountLogout(req, res) {
+        if (!this.trustedManagementRequest(req, res))
+            return;
+        if (req.method !== 'POST') {
+            this.sendJson(res, 405, { error: 'POST only' }, { allow: 'POST' });
+            return;
+        }
+        if (!this.requireCsrf(req, res))
+            return;
+        try {
+            await this.logout(await this.accountIdBody(req));
+            this.sendJson(res, 200, { ok: true });
+        }
+        catch (error) {
+            const status = error instanceof AccountNotFoundError
+                ? 404
+                : error instanceof CredentialNotWritableError ? 409 : 400;
+            this.sendJson(res, status, { error: messageOf(error) });
+        }
+    }
     async handleLogout(req, res) {
         if (!this.trustedManagementRequest(req, res))
             return;
@@ -1656,7 +2269,7 @@ export class OpenAICodexAuth extends Service {
             this.sendJson(res, 200, { ok: true });
         }
         catch (error) {
-            this.sendJson(res, 500, { error: messageOf(error) });
+            this.sendJson(res, error instanceof CredentialNotWritableError ? 409 : 500, { error: messageOf(error) });
         }
     }
 }