codex-multi-auth 2.12.0 → 2.14.0

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-multi-auth",
-	"version": "2.12.0",
+	"version": "2.14.0",
   "description": "Install and operate codex-multi-auth for the official @openai/codex CLI with multi-account OAuth rotation, switching, health checks, and recovery tools.",
   "interface": {
     "composerIcon": "./assets/codex-multi-auth-icon.svg"

package/README.md

@@ -214,6 +214,7 @@ which would rebind the row to a different workspace.
 | Command | What it answers |
 | --- | --- |
 | `codex-multi-auth report --live --json` | How do I get the full machine-readable health report? |
+| `codex-multi-auth limits --json [--refresh]` | How do I read account quota windows without parsing internal cache files or terminal text? |
 | `codex-multi-auth fix --live --model gpt-5.5` | How do I run live repair probes with a chosen model? |
 | `codex-multi-auth why-selected --json` | Which account does the selector pick now, and why? |
 | `codex-multi-auth usage --since 24h --by project` | What local usage has been recorded recently? |
@@ -296,6 +297,8 @@ Selected runtime/environment overrides:
 | `CODEX_MULTI_AUTH_FORCE_ACCOUNT=<index\|email\|id>` | Force one account for a single `codex-multi-auth-codex` run (ephemeral; requires rotation proxy) |
 | `CODEX_MULTI_AUTH_BYPASS=1` | Skip multi-auth intercept and forward straight to official Codex |
 | `CODEX_MULTI_AUTH_RUNTIME_ROTATION_PROXY=0/1` | Opt out/in of live Responses proxy rotation for forwarded Codex CLI/app sessions |
+| `CODEX_MULTI_AUTH_RUNTIME_PROXY_UPSTREAM_BASE_URL=http://127.0.0.1:<port>/<path>` | Route the runtime rotation proxy through an explicit loopback HTTP upstream; requires an explicit port and a numeric loopback host (`127.0.0.0/8` or `[::1]`), and rejects credentials, query strings, fragments, HTTPS, and every other host |
+| `CODEX_MULTI_AUTH_MODEL_CAPACITY_RETRY_MS=<ms>` | Wall-clock ceiling on how long one request waits out a "selected model is at capacity" response before giving up (default 600000, max 3600000, `0` disables) |
 | `CODEX_MULTI_AUTH_APP_ROTATION_IDLE_MS=<ms>` | Override automatic Codex app helper idle shutdown |
 | `CODEX_MULTI_AUTH_APP_BIND_INSTALL=0/1` | Opt out/in of packaged Codex app bind self-heal on first CLI run or rotation enable |
 | `CODEX_MULTI_AUTH_APP_LAUNCHER_INSTALL=0/1` | Opt out/in of routing supported app shortcuts on first CLI run or rotation enable |
@@ -318,6 +321,12 @@ Responses background mode stays opt-in. Enable `backgroundResponses` in settings
 
 Runtime rotation is enabled by default for request-bearing wrapper-launched Codex sessions. Package install scripts stay side-effect-free: npm postinstall only prints a short notice (and stays silent in CI or non-interactive installs). The first CLI run after an install self-heals supported packaged Codex app binds and user-level launcher routing when possible (recorded once in a `first-run-setup.json` marker under the multi-auth runtime root), while `codex-multi-auth rotation enable` remains the explicit repair command. `codex-multi-auth rotation disable` turns the setting off and removes the persistent app bind. Set `CODEX_MULTI_AUTH_RUNTIME_ROTATION_PROXY=0`, `CODEX_MULTI_AUTH_APP_BIND_INSTALL=0`, or `CODEX_MULTI_AUTH_APP_LAUNCHER_INSTALL=0` to opt out of the matching default behavior.
 
+Advanced local proxy chains can set `CODEX_MULTI_AUTH_RUNTIME_PROXY_UPSTREAM_BASE_URL` for one wrapper process. The wrapper passes that URL to both the shadow-runtime and interactive-helper rotation paths and fails closed if the configured upstream is invalid or unavailable; it never falls back silently to the direct backend while an explicit upstream is required. Because the request that reaches the upstream carries the managed OAuth bearer token, the host must be a numeric loopback literal: a name such as `localhost` is rejected, since a hosts-file entry can point it at a routable address. "Fails closed" also covers the case where runtime rotation itself is off (`CODEX_MULTI_AUTH_RUNTIME_ROTATION_PROXY=0`, `CODEX_MULTI_AUTH_BYPASS=1`, or the setting disabled): a request-bearing invocation exits non-zero rather than bypassing the configured upstream. Subcommands that make no backend requests still run normally.
+
+When the backend answers that the selected model is at capacity, the runtime proxy waits and re-sends the request instead of burning the pool. Capacity is a property of the model, not of an account, so rotating spends the transient budget against accounts that all fail identically and the request ends as a 503 within seconds. The wait backs off (2s, 5s, 15s, 30s, then 60s), honors an upstream `retry-after` when one is sent, and stops at a wall-clock deadline set by `CODEX_MULTI_AUTH_MODEL_CAPACITY_RETRY_MS` (10 minutes by default, 1 hour maximum). Set that variable to `0` to restore the previous rotate-and-fail behavior. The responding account is left completely unpenalized: its pool token is refunded and it is never marked rate limited or cooled down, so selection runs normally on the next pass and may pick any healthy account. The wait is abandoned if the client disconnects, so no further upstream request is sent for a response nobody is reading. See [#689](https://github.com/ndycode/codex-multi-auth/issues/689).
+
+Trust boundary: the loopback check bounds exposure to the local machine, and nothing more. It does not authenticate the process listening on that port, and plaintext HTTP is what a local inspection proxy needs, so any process that can bind the port you name receives the managed bearer token in cleartext. Set this variable only on a machine where you trust every local process that can bind a loopback port, and only for as long as you need the chain.
+
 Installed wrappers may perform a best-effort daily npm version check during normal forwarded Codex startup. When a newer package is detected, the wrapper only prints a manual notice on an interactive TTY or when `CODEX_MULTI_AUTH_DEBUG=1`: `npm install -g codex-multi-auth@latest`. It never runs npm install or update commands for you.
 
 ---
@@ -406,7 +415,7 @@ codex-multi-auth doctor --json
 
 ## Release Notes
 
-- Current stable: [docs/releases/v2.12.0.md](docs/releases/v2.12.0.md) — install via `npm i -g codex-multi-auth`
+- Current stable: [docs/releases/v2.14.0.md](docs/releases/v2.14.0.md) — install via `npm i -g codex-multi-auth`
 - Previous stable: [docs/releases/v2.8.3.md](docs/releases/v2.8.3.md)
 - Previous stable: [docs/releases/v2.8.2.md](docs/releases/v2.8.2.md)
 - Previous stable: [docs/releases/v2.7.1.md](docs/releases/v2.7.1.md)

package/dist/lib/accounts.d.ts

@@ -16,6 +16,26 @@ type AccountIdentityCandidate = Pick<ManagedAccount, "accountId" | "email" | "re
 export type { Workspace } from "./storage/public-types.js";
 /** Stable operator-facing marker for an explicitly invalidated OAuth token. */
 export declare const AUTH_INVALIDATION_MARKER = "token-invalid \u2014 re-login needed";
+/**
+ * How long a 429 recorded while the selection metadata was unreadable stays
+ * eligible to be replayed over a `switch` that clears the account's markers.
+ *
+ * The window only has to cover the gap between the CLI's atomic storage write
+ * and this process observing it, which is a single filesystem read away and in
+ * practice sub-second. 30s is generous for a stalled Windows volume while still
+ * guaranteeing that a 429 from minutes or hours earlier can never be
+ * resurrected by a later, unrelated switch.
+ */
+export declare const UNSEQUENCED_RATE_LIMIT_TTL_MS = 30000;
+/**
+ * How many times a debounced save re-arms itself after a failure before giving
+ * up. A save can fail because the selection metadata was momentarily
+ * unreadable, and dropping it loses every rate-limit window, cooldown and
+ * rotated refresh token accumulated since the last successful save.
+ */
+export declare const MAX_DEBOUNCED_SAVE_RETRIES = 5;
+/** Ceiling for the debounced-save retry backoff. */
+export declare const MAX_SAVE_RETRY_DELAY_MS = 8000;
 export interface ManagedAccount {
     index: number;
     recordId?: string;
@@ -50,6 +70,8 @@ export declare class AccountManager {
     private lastToastTime;
     private saveDebounceTimer;
     private pendingSave;
+    /** Consecutive debounced-save failures; reset by the next success. */
+    private saveRetryCount;
     private readonly storagePathState;
     /**
      * Manual pin set by the `switch` CLI command, hydrated from disk at
@@ -65,6 +87,7 @@ export declare class AccountManager {
      * as `pinnedAccountIndex`. See #474.
      */
     private affinityGeneration;
+    private readonly unsequencedRateLimits;
     /**
      * PR-N / R4: feature-flagged routing mutex mode.
      * Defaults to `"legacy"` to preserve pre-PR-N behaviour for one release
@@ -92,6 +115,21 @@ export declare class AccountManager {
      */
     getManagedAccountRuntimeSkipReason(account: ManagedAccount, family: ModelFamily, model?: string | null): string | null;
     static resetVolatileRuntimeState(): void;
+    /**
+     * Apply each explicit selection once without erasing a subsequent 429.
+     *
+     * A `switch` asks for a fresh upstream attempt, so the selected account's
+     * rate-limit markers are cleared. The only markers that survive that clear
+     * are ones recorded while the selection metadata was unreadable AND recent
+     * enough to have raced this switch (see UNSEQUENCED_RATE_LIMIT_TTL_MS); an
+     * older unsequenced entry provably predates the switch and is discarded.
+     *
+     * @param meta Latest successfully read selection generation and pin.
+     */
+    applyManualSelection(meta: {
+        pinnedAccountIndex?: number | null;
+        affinityGeneration: number;
+    }): void;
     /**
      * Wipe per-account transient state — active cooldowns and all rate-limit
      * reset windows — across every managed account, then schedule a debounced
@@ -213,6 +251,14 @@ export declare class AccountManager {
     setActiveIndexLocked(index: number): Promise<ManagedAccount | null>;
     markRateLimited(account: ManagedAccount, retryAfterMs: number, family: ModelFamily, model?: string | null): void;
     markRateLimitedWithReason(account: ManagedAccount, retryAfterMs: number, family: ModelFamily, reason: RateLimitReason, model?: string | null): void;
+    /**
+     * Storage file this manager owns, resolved through the path state captured
+     * at construction. Reading the ambient `getStoragePath()` instead would
+     * point a project-scoped pool at whichever storage file happens to be
+     * current on the calling async context. See `saveToDisk`, which wraps
+     * `runWithStoragePathState(this.storagePathState, ...)` for the same reason.
+     */
+    private resolveSelectionStoragePath;
     markAccountCoolingDown(account: ManagedAccount, cooldownMs: number, reason: CooldownReason): void;
     isAccountCoolingDown(account: ManagedAccount): boolean;
     clearAccountCooldown(account: ManagedAccount): void;
@@ -247,6 +293,29 @@ export declare class AccountManager {
      * never undoes a refresh we just performed.
      */
     private reconcileTokensFromDisk;
+    /**
+     * Re-read the on-disk selection and fold it into this manager's state.
+     *
+     * Race protection: a CLI `switch`/`unpin`/`best` may have written a NEW
+     * pin/gen between proxy startup (or the last save) and now. If we persisted
+     * our stale instance values, we'd silently clobber the CLI update on every
+     * routine save (rate-limit, cooldown, near-quota refund, etc.). See #474.
+     *
+     * This MUTATES `pinnedAccountIndex`, `affinityGeneration` and, when the
+     * generation advanced, the selected account's rate-limit markers, so it is a
+     * separate step from the pure `buildStorageSnapshot` serializer below rather
+     * than a hidden side effect of it. Callers must run it immediately before a
+     * snapshot they intend to persist. Applying it twice is a no-op.
+     *
+     * @throws when the metadata exists but cannot be observed (see
+     * `readPinAndGenFromDisk`), which is the one case where persisting would
+     * risk overwriting a newer pin.
+     */
+    private reconcileSelectionFromDisk;
+    /**
+     * Serialize the live pool. Pure: it reads no files and mutates no state.
+     * Persisting callers must call `reconcileSelectionFromDisk()` first.
+     */
     private buildStorageSnapshot;
     commitRefreshedAuth(source: Pick<ManagedAccount, "index" | "accountId" | "email" | "refreshToken">, auth: OAuthAuthDetails): Promise<ManagedAccount | null>;
     toAuthDetails(account: ManagedAccount): Auth;
@@ -263,6 +332,12 @@ export declare class AccountManager {
     setAccountEnabled(index: number, enabled: boolean): ManagedAccount | null;
     saveToDisk(): Promise<void>;
     saveToDiskDebounced(delayMs?: number): void;
+    /**
+     * Flush any debounced save. Never rejects: this runs on the proxy shutdown
+     * path (`RuntimeRotationProxy.close`), and a rejection there aborts the rest
+     * of the teardown. A failure is logged at error level instead, because the
+     * process is exiting and there is no later attempt to fall back to.
+     */
     flushPendingSave(): Promise<void>;
     private resetWorkspaces;
     getCurrentWorkspace(account: ManagedAccount): Workspace | null;

package/dist/lib/accounts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"accounts.d.ts","sourceRoot":"","sources":["../../lib/accounts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAI1C,OAAO,EAKN,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EAGrB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAClF,OAAO,EAMN,KAAK,sBAAsB,EAC3B,MAAM,eAAe,CAAC;AACvB,OAAO,EAEN,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,MAAM,oBAAoB,CAAC;AAqB5B,OAAO,EACN,gBAAgB,EAChB,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,6BAA6B,EAC7B,8BAA8B,EAC9B,uBAAuB,EACvB,aAAa,EACb,KAAK,kBAAkB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACN,oBAAoB,EACpB,WAAW,EACX,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,cAAc,EACd,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,iBAAiB,GACtB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACN,2BAA2B,EAC3B,qBAAqB,EACrB,KAAK,uBAAuB,GAC5B,MAAM,sBAAsB,CAAC;AAQ9B,OAAO,EAON,KAAK,eAAe,EACpB,MAAM,2BAA2B,CAAC;AA2CnC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,GAAG,MAAM,CAQ7E;AAQD,KAAK,wBAAwB,GAAG,IAAI,CACnC,cAAc,EACd,WAAW,GAAG,OAAO,GAAG,cAAc,CACtC,GAAG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AA2GF,YAAY,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAE3D,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,yCAAoC,CAAC;AAE1E,MAAM,WAAW,cAAc;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kBAAkB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EACd,YAAY,GACZ,SAAS,GACT,UAAU,GACV,MAAM,GACN,SAAS,GACT,QAAQ,CAAC;IACZ,mBAAmB,CAAC,EAAE,eAAe,CAAC;IACtC,mBAAmB,EAAE,gBAAgB,CAAC;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,qBAAa,cAAc;IAC1B,OAAO,CAAC,QAAQ,CAAwB;IACxC,OAAO,CAAC,cAAc,CAAmD;IACzE,OAAO,CAAC,2BAA2B,CACd;IACrB,OAAO,CAAC,qBAAqB,CAAM;IACnC,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,iBAAiB,CAA8C;IACvE,OAAO,CAAC,WAAW,CAA8B;IACjD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;IACpD;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB,CAAqB;IAC/C;;;;OAIG;IACH,OAAO,CAAC,kBAAkB,CAAS;IACnC;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB,CAA8B;WAEzC,YAAY,CACxB,YAAY,CAAC,EAAE,gBAAgB,GAC7B,OAAO,CAAC,cAAc,CAAC;IAmB1B,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;YAMhC,mBAAmB;gBAqEhC,YAAY,CAAC,EAAE,gBAAgB,EAC/B,MAAM,CAAC,EAAE,gBAAgB,GAAG,IAAI;IAyMjC,eAAe,IAAI,MAAM;IAIzB,cAAc,IAAI,MAAM;IAIxB,uBAAuB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM;IAqBpD,mBAAmB,IAAI,cAAc,EAAE;IAavC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAOvD,2BAA2B,CAC1B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,OAAO;IAcV,2BAA2B,CAC1B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,MAAM,GAAG,IAAI;IAMhB;;;;;OAKG;IACH,kCAAkC,CACjC,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,MAAM,GAAG,IAAI;IAehB,MAAM,CAAC,yBAAyB,IAAI,IAAI;IAKxC;;;;;;;;;;;;;;;;OAgBG;IACH,0BAA0B,IAAI,IAAI;IAYlC,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAkB9C,mCAAmC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcvE,iBAAiB,IAAI,cAAc,GAAG,IAAI;IAI1C,0BAA0B,CAAC,MAAM,EAAE,WAAW,GAAG,cAAc,GAAG,IAAI;IAYtE,gBAAgB,IAAI,cAAc,GAAG,IAAI;IAIzC,yBAAyB,CACxB,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,cAAc,GAAG,IAAI;IAgCxB,gBAAgB,CACf,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,cAAc,GAAG,IAAI;IA+BxB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,mCAAmC,CAClC,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,EACrB,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAClC,cAAc,GAAG,IAAI;IAmDxB,+BAA+B,CAC9B,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,EACrB,OAAO,CAAC,EAAE,sBAAsB,GAC9B,cAAc,GAAG,IAAI;IA+CxB,aAAa,CACZ,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,IAAI;IA2BP,eAAe,CACd,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,IAAI;IASP,aAAa,CACZ,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,IAAI;IAOP,YAAY,CACX,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,EACrB,OAAO,GAAE;QAAE,iBAAiB,CAAC,EAAE,OAAO,CAAA;KAAO,GAC3C,OAAO;IAIV;;;;;;;;;;;;;OAaG;IACH,sBAAsB,CACrB,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,EACrB,OAAO,GAAE;QAAE,iBAAiB,CAAC,EAAE,OAAO,CAAA;KAAO,GAC3C;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,iBAAiB,GAAG,cAAc,CAAA;KAAE;IAoB3E;;;;OAIG;IACH,WAAW,CACV,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,OAAO;IAMV,YAAY,CACX,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,EACxD,MAAM,EAAE,WAAW,GACjB,IAAI;IAeP;;;;;OAKG;IACH,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI;IAIjD,2EAA2E;IAC3E,mBAAmB,IAAI,gBAAgB;IAIvC;;;;;;;OAOG;IACG,kBAAkB,CACvB,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,EACxD,MAAM,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GACpD,OAAO,CAAC,eAAe,CAAC;IA4B3B;;;OAGG;IACG,4BAA4B,CACjC,OAAO,EAAE,cAAc,EACvB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,cAAc,GACpB,OAAO,CAAC,IAAI,CAAC;IAQhB;;;;OAIG;IACG,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAMzE,eAAe,CACd,OAAO,EAAE,cAAc,EACvB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,IAAI;IAUP,yBAAyB,CACxB,OAAO,EAAE,cAAc,EACvB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,eAAe,EACvB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,IAAI;IA2BP,sBAAsB,CACrB,OAAO,EAAE,cAAc,EACvB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,cAAc,GACpB,IAAI;IAMP,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO;IAStD,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI;IAKnD,OAAO,CAAC,kBAAkB;IAI1B;;;;;OAKG;IACH,sBAAsB,CACrB,OAAO,EAAE,cAAc,EACvB,GAAG,SAAa,GACd,MAAM,GAAG,IAAI;IAOhB,qBAAqB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM;IAMtD,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI;IAIhD,mBAAmB,CAClB,OAAO,EAAE,cAAc,EACvB,SAAS,SAAsB,EAC/B,aAAa,SAAU,GACrB,IAAI;IAKP,qBAAqB,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI;IAKpD,wBAAwB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO;IAQ1D,oBAAoB,CACnB,SAAS,EAAE,wBAAwB,EACnC,IAAI,CAAC,EAAE,gBAAgB,GACrB,cAAc,GAAG,IAAI;IAQxB,sBAAsB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,SAAQ,GAAG,OAAO;IAWzE,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI;IAK1C,cAAc,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,gBAAgB,GAAG,IAAI;IAiBrE;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,uBAAuB;IAuD/B,OAAO,CAAC,oBAAoB;IAyFtB,mBAAmB,CACxB,MAAM,EAAE,IAAI,CACX,cAAc,EACd,OAAO,GAAG,WAAW,GAAG,OAAO,GAAG,cAAc,CAChD,EACD,IAAI,EAAE,gBAAgB,GACpB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAmIjC,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI;IAS5C,cAAc,IAAI,MAAM;IAIxB,uBAAuB,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM;IAsD3E;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAcvB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO;IAmJ/C,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAQ5C,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,cAAc,GAAG,IAAI;IA6CnE,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAajC,mBAAmB,CAAC,OAAO,SAAM,GAAG,IAAI;IAyBlC,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAYvC,OAAO,CAAC,eAAe;IAiBvB,mBAAmB,CAAC,OAAO,EAAE,cAAc,GAAG,SAAS,GAAG,IAAI;IAQ9D,uBAAuB,CACtB,OAAO,EAAE,cAAc,EACvB,mBAAmB,CAAC,EAAE,MAAM,GAC1B,OAAO;IAqBV,qBAAqB,CAAC,OAAO,EAAE,cAAc,GAAG,SAAS,GAAG,IAAI;IAoBhE;;;OAGG;IACH,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO;IAOtD,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM;IAIlD,wBAAwB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM;CAIzD;AAmBD,wBAAgB,kBAAkB,CACjC,OAAO,EACJ;IACA,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAC9B,GACD,SAAS,EACZ,KAAK,EAAE,MAAM,GACX,MAAM,CA4BR;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CACnC,OAAO,EACJ;IAAE,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IAAC,qBAAqB,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5D,SAAS,EACZ,MAAM,SAAQ,GACZ,MAAM,EAAE,CAgBV;AAED,wBAAgB,cAAc,CAC7B,OAAO,EAAE;IAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,EAC/D,GAAG,SAAU,GACX,MAAM,GAAG,IAAI,CAMf"}
+{"version":3,"file":"accounts.d.ts","sourceRoot":"","sources":["../../lib/accounts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAI1C,OAAO,EAKN,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EAGrB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAClF,OAAO,EAMN,KAAK,sBAAsB,EAC3B,MAAM,eAAe,CAAC;AACvB,OAAO,EAEN,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,MAAM,oBAAoB,CAAC;AAqB5B,OAAO,EACN,gBAAgB,EAChB,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,6BAA6B,EAC7B,8BAA8B,EAC9B,uBAAuB,EACvB,aAAa,EACb,KAAK,kBAAkB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACN,oBAAoB,EACpB,WAAW,EACX,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,cAAc,EACd,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,iBAAiB,GACtB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACN,2BAA2B,EAC3B,qBAAqB,EACrB,KAAK,uBAAuB,GAC5B,MAAM,sBAAsB,CAAC;AAQ9B,OAAO,EAON,KAAK,eAAe,EACpB,MAAM,2BAA2B,CAAC;AA2CnC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,GAAG,MAAM,CAQ7E;AAQD,KAAK,wBAAwB,GAAG,IAAI,CACnC,cAAc,EACd,WAAW,GAAG,OAAO,GAAG,cAAc,CACtC,GAAG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AA2GF,YAAY,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAE3D,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,yCAAoC,CAAC;AAE1E;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,QAAS,CAAC;AAEpD;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C,oDAAoD;AACpD,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAE7C,MAAM,WAAW,cAAc;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kBAAkB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EACd,YAAY,GACZ,SAAS,GACT,UAAU,GACV,MAAM,GACN,SAAS,GACT,QAAQ,CAAC;IACZ,mBAAmB,CAAC,EAAE,eAAe,CAAC;IACtC,mBAAmB,EAAE,gBAAgB,CAAC;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,qBAAa,cAAc;IAC1B,OAAO,CAAC,QAAQ,CAAwB;IACxC,OAAO,CAAC,cAAc,CAAmD;IACzE,OAAO,CAAC,2BAA2B,CACd;IACrB,OAAO,CAAC,qBAAqB,CAAM;IACnC,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,iBAAiB,CAA8C;IACvE,OAAO,CAAC,WAAW,CAA8B;IACjD,sEAAsE;IACtE,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;IACpD;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB,CAAqB;IAC/C;;;;OAIG;IACH,OAAO,CAAC,kBAAkB,CAAS;IAWnC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAIjC;IACL;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB,CAA8B;WAEzC,YAAY,CACxB,YAAY,CAAC,EAAE,gBAAgB,GAC7B,OAAO,CAAC,cAAc,CAAC;IAmB1B,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;YAMhC,mBAAmB;gBAqEhC,YAAY,CAAC,EAAE,gBAAgB,EAC/B,MAAM,CAAC,EAAE,gBAAgB,GAAG,IAAI;IA0MjC,eAAe,IAAI,MAAM;IAIzB,cAAc,IAAI,MAAM;IAIxB,uBAAuB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM;IAqBpD,mBAAmB,IAAI,cAAc,EAAE;IAavC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAOvD,2BAA2B,CAC1B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,OAAO;IAcV,2BAA2B,CAC1B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,MAAM,GAAG,IAAI;IAMhB;;;;;OAKG;IACH,kCAAkC,CACjC,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,MAAM,GAAG,IAAI;IAehB,MAAM,CAAC,yBAAyB,IAAI,IAAI;IAKxC;;;;;;;;;;OAUG;IACH,oBAAoB,CAAC,IAAI,EAAE;QAC1B,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACnC,kBAAkB,EAAE,MAAM,CAAC;KAC3B,GAAG,IAAI;IAsBR;;;;;;;;;;;;;;;;OAgBG;IACH,0BAA0B,IAAI,IAAI;IAYlC,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAkB9C,mCAAmC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcvE,iBAAiB,IAAI,cAAc,GAAG,IAAI;IAI1C,0BAA0B,CAAC,MAAM,EAAE,WAAW,GAAG,cAAc,GAAG,IAAI;IAYtE,gBAAgB,IAAI,cAAc,GAAG,IAAI;IAIzC,yBAAyB,CACxB,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,cAAc,GAAG,IAAI;IAgCxB,gBAAgB,CACf,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,cAAc,GAAG,IAAI;IA+BxB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,mCAAmC,CAClC,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,EACrB,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAClC,cAAc,GAAG,IAAI;IAmDxB,+BAA+B,CAC9B,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,EACrB,OAAO,CAAC,EAAE,sBAAsB,GAC9B,cAAc,GAAG,IAAI;IA+CxB,aAAa,CACZ,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,IAAI;IA2BP,eAAe,CACd,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,IAAI;IASP,aAAa,CACZ,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,IAAI;IAOP,YAAY,CACX,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,EACrB,OAAO,GAAE;QAAE,iBAAiB,CAAC,EAAE,OAAO,CAAA;KAAO,GAC3C,OAAO;IAIV;;;;;;;;;;;;;OAaG;IACH,sBAAsB,CACrB,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,EACrB,OAAO,GAAE;QAAE,iBAAiB,CAAC,EAAE,OAAO,CAAA;KAAO,GAC3C;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,iBAAiB,GAAG,cAAc,CAAA;KAAE;IAoB3E;;;;OAIG;IACH,WAAW,CACV,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,OAAO;IAMV,YAAY,CACX,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,EACxD,MAAM,EAAE,WAAW,GACjB,IAAI;IAeP;;;;;OAKG;IACH,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI;IAIjD,2EAA2E;IAC3E,mBAAmB,IAAI,gBAAgB;IAIvC;;;;;;;OAOG;IACG,kBAAkB,CACvB,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,EACxD,MAAM,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GACpD,OAAO,CAAC,eAAe,CAAC;IA4B3B;;;OAGG;IACG,4BAA4B,CACjC,OAAO,EAAE,cAAc,EACvB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,cAAc,GACpB,OAAO,CAAC,IAAI,CAAC;IAQhB;;;;OAIG;IACG,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAMzE,eAAe,CACd,OAAO,EAAE,cAAc,EACvB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,WAAW,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,IAAI;IAUP,yBAAyB,CACxB,OAAO,EAAE,cAAc,EACvB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,eAAe,EACvB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,IAAI;IAoEP;;;;;;OAMG;IACH,OAAO,CAAC,2BAA2B;IAInC,sBAAsB,CACrB,OAAO,EAAE,cAAc,EACvB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,cAAc,GACpB,IAAI;IAMP,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO;IAStD,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI;IAKnD,OAAO,CAAC,kBAAkB;IAI1B;;;;;OAKG;IACH,sBAAsB,CACrB,OAAO,EAAE,cAAc,EACvB,GAAG,SAAa,GACd,MAAM,GAAG,IAAI;IAOhB,qBAAqB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM;IAMtD,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI;IAIhD,mBAAmB,CAClB,OAAO,EAAE,cAAc,EACvB,SAAS,SAAsB,EAC/B,aAAa,SAAU,GACrB,IAAI;IAKP,qBAAqB,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI;IAKpD,wBAAwB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO;IAQ1D,oBAAoB,CACnB,SAAS,EAAE,wBAAwB,EACnC,IAAI,CAAC,EAAE,gBAAgB,GACrB,cAAc,GAAG,IAAI;IAQxB,sBAAsB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,SAAQ,GAAG,OAAO;IAWzE,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI;IAK1C,cAAc,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,gBAAgB,GAAG,IAAI;IAiBrE;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,uBAAuB;IAuD/B;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,0BAA0B;IA6BlC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAyDtB,mBAAmB,CACxB,MAAM,EAAE,IAAI,CACX,cAAc,EACd,OAAO,GAAG,WAAW,GAAG,OAAO,GAAG,cAAc,CAChD,EACD,IAAI,EAAE,gBAAgB,GACpB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAuIjC,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI;IAS5C,cAAc,IAAI,MAAM;IAIxB,uBAAuB,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM;IAsD3E;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAcvB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO;IAmJ/C,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAQ5C,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,cAAc,GAAG,IAAI;IA6CnE,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAcjC,mBAAmB,CAAC,OAAO,SAAM,GAAG,IAAI;IA6CxC;;;;;OAKG;IACG,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAkBvC,OAAO,CAAC,eAAe;IAiBvB,mBAAmB,CAAC,OAAO,EAAE,cAAc,GAAG,SAAS,GAAG,IAAI;IAQ9D,uBAAuB,CACtB,OAAO,EAAE,cAAc,EACvB,mBAAmB,CAAC,EAAE,MAAM,GAC1B,OAAO;IAqBV,qBAAqB,CAAC,OAAO,EAAE,cAAc,GAAG,SAAS,GAAG,IAAI;IAoBhE;;;OAGG;IACH,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO;IAOtD,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM;IAIlD,wBAAwB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM;CAIzD;AAmBD,wBAAgB,kBAAkB,CACjC,OAAO,EACJ;IACA,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAC9B,GACD,SAAS,EACZ,KAAK,EAAE,MAAM,GACX,MAAM,CA4BR;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CACnC,OAAO,EACJ;IAAE,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IAAC,qBAAqB,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5D,SAAS,EACZ,MAAM,SAAQ,GACZ,MAAM,EAAE,CAgBV;AAED,wBAAgB,cAAc,CAC7B,OAAO,EAAE;IAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,EAC/D,GAAG,SAAU,GACX,MAAM,GAAG,IAAI,CAMf"}

package/dist/lib/accounts.js

@@ -126,6 +126,26 @@ function isRetryableAuthPersistenceError(error) {
 }
 /** Stable operator-facing marker for an explicitly invalidated OAuth token. */
 export const AUTH_INVALIDATION_MARKER = "token-invalid — re-login needed";
+/**
+ * How long a 429 recorded while the selection metadata was unreadable stays
+ * eligible to be replayed over a `switch` that clears the account's markers.
+ *
+ * The window only has to cover the gap between the CLI's atomic storage write
+ * and this process observing it, which is a single filesystem read away and in
+ * practice sub-second. 30s is generous for a stalled Windows volume while still
+ * guaranteeing that a 429 from minutes or hours earlier can never be
+ * resurrected by a later, unrelated switch.
+ */
+export const UNSEQUENCED_RATE_LIMIT_TTL_MS = 30_000;
+/**
+ * How many times a debounced save re-arms itself after a failure before giving
+ * up. A save can fail because the selection metadata was momentarily
+ * unreadable, and dropping it loses every rate-limit window, cooldown and
+ * rotated refresh token accumulated since the last successful save.
+ */
+export const MAX_DEBOUNCED_SAVE_RETRIES = 5;
+/** Ceiling for the debounced-save retry backoff. */
+export const MAX_SAVE_RETRY_DELAY_MS = 8_000;
 export class AccountManager {
     accounts = [];
     cursorByFamily = initFamilyState(0);
@@ -134,6 +154,8 @@ export class AccountManager {
     lastToastTime = 0;
     saveDebounceTimer = null;
     pendingSave = null;
+    /** Consecutive debounced-save failures; reset by the next success. */
+    saveRetryCount = 0;
     storagePathState;
     /**
      * Manual pin set by the `switch` CLI command, hydrated from disk at
@@ -149,6 +171,17 @@ export class AccountManager {
      * as `pinnedAccountIndex`. See #474.
      */
     affinityGeneration;
+    // A 429 observed while the selection metadata was unreadable must survive
+    // the next reconciliation, because we cannot tell whether it landed before
+    // or after the `switch` that reconciliation is about to apply. Keep only
+    // those new markers, not the stale account map.
+    //
+    // `recordedAtMs` bounds that ambiguity. Only a 429 recorded within
+    // UNSEQUENCED_RATE_LIMIT_TTL_MS of the reconciliation could have raced the
+    // switch we are applying; an older entry provably predates it and must NOT
+    // be replayed, or an arbitrarily stale 429 would be resurrected by the very
+    // command meant to revalidate the account.
+    unsequencedRateLimits = new WeakMap();
     /**
      * PR-N / R4: feature-flagged routing mutex mode.
      * Defaults to `"legacy"` to preserve pre-PR-N behaviour for one release
@@ -248,7 +281,8 @@ export class AccountManager {
         this.affinityGeneration =
             typeof rawStoredGen === "number" &&
                 Number.isFinite(rawStoredGen) &&
-                Number.isInteger(rawStoredGen) &&
+                // See readAffinityGenerationFromDisk: an unsafe integer wedges the bump.
+                Number.isSafeInteger(rawStoredGen) &&
                 rawStoredGen >= 0
                 ? rawStoredGen
                 : 0;
@@ -492,6 +526,38 @@ export class AccountManager {
         resetTrackers();
         resetAllCircuitBreakers();
     }
+    /**
+     * Apply each explicit selection once without erasing a subsequent 429.
+     *
+     * A `switch` asks for a fresh upstream attempt, so the selected account's
+     * rate-limit markers are cleared. The only markers that survive that clear
+     * are ones recorded while the selection metadata was unreadable AND recent
+     * enough to have raced this switch (see UNSEQUENCED_RATE_LIMIT_TTL_MS); an
+     * older unsequenced entry provably predates the switch and is discarded.
+     *
+     * @param meta Latest successfully read selection generation and pin.
+     */
+    applyManualSelection(meta) {
+        if (meta.affinityGeneration <= this.affinityGeneration)
+            return;
+        const index = meta.pinnedAccountIndex;
+        const account = typeof index === "number"
+            ? this.getAccountByIndex(index)
+            : null;
+        if (account) {
+            clearAllRateLimits(account);
+            const pending = this.unsequencedRateLimits.get(account);
+            const replayable = pending !== undefined &&
+                nowMs() - pending.recordedAtMs <= UNSEQUENCED_RATE_LIMIT_TTL_MS
+                ? pending
+                : undefined;
+            Object.assign(account.rateLimitResetTimes, replayable?.limits);
+            account.lastRateLimitReason = replayable?.reason;
+            this.unsequencedRateLimits.delete(account);
+        }
+        this.pinnedAccountIndex = account ? index ?? undefined : undefined;
+        this.affinityGeneration = meta.affinityGeneration;
+    }
     /**
      * Wipe per-account transient state — active cooldowns and all rate-limit
      * reset windows — across every managed account, then schedule a debounced
@@ -908,22 +974,74 @@ export class AccountManager {
         this.markRateLimitedWithReason(account, retryAfterMs, family, "unknown", model);
     }
     markRateLimitedWithReason(account, retryAfterMs, family, reason, model) {
+        let selectionReadable = false;
+        try {
+            // Deliberately a fresh strict read rather than the proxy's cached
+            // `readStorageMetaFromDisk`: that reader falls back to its last good
+            // snapshot on failure, so it cannot tell this call site the one thing
+            // it needs to know, namely whether the selection was observable at all.
+            const meta = readPinAndGenFromDisk(this.resolveSelectionStoragePath(), {
+                strict: true,
+            });
+            // Observe a switch BEFORE recording this response, not at the later
+            // debounced save where it would erase a genuine post-switch 429.
+            this.applyManualSelection(meta);
+            selectionReadable = true;
+        }
+        catch {
+            // Fail closed: retain this new limit if the selection cannot be read.
+            log.warn("Rate limit recorded while account selection metadata is unavailable");
+        }
         // Clamp to MAX_RATE_LIMIT_DELAY_MS so a bogus upstream retry-after value
         // cannot wedge this account unavailable for years (see stress audit H1).
         const retryMs = Math.min(Math.max(0, Math.floor(retryAfterMs)), MAX_RATE_LIMIT_DELAY_MS);
-        const resetAt = nowMs() + retryMs;
+        const observedAtMs = nowMs();
+        const resetAt = observedAtMs + retryMs;
+        // Only carry forward an unsequenced entry that is still replayable.
+        // Merging an expired one would give it a fresh `recordedAtMs` below and
+        // keep resurrecting it indefinitely.
+        const pending = this.unsequencedRateLimits.get(account);
+        const carried = pending !== undefined &&
+            observedAtMs - pending.recordedAtMs <= UNSEQUENCED_RATE_LIMIT_TTL_MS
+            ? pending
+            : undefined;
+        const newLimits = { ...carried?.limits };
         const baseKey = getQuotaKey(family);
         if (!model || reason === "quota" || reason === "unknown") {
             const currentResetAt = account.rateLimitResetTimes[baseKey] ?? 0;
             account.rateLimitResetTimes[baseKey] = Math.max(currentResetAt, resetAt);
+            newLimits[baseKey] = Math.max(newLimits[baseKey] ?? 0, resetAt);
         }
         if (model &&
             (reason === "tokens" || reason === "concurrent" || reason === "unknown")) {
             const modelKey = getQuotaKey(family, model);
             const currentResetAt = account.rateLimitResetTimes[modelKey] ?? 0;
             account.rateLimitResetTimes[modelKey] = Math.max(currentResetAt, resetAt);
+            newLimits[modelKey] = Math.max(newLimits[modelKey] ?? 0, resetAt);
         }
         account.lastRateLimitReason = reason;
+        if (!selectionReadable) {
+            this.unsequencedRateLimits.set(account, {
+                limits: newLimits,
+                reason,
+                recordedAtMs: observedAtMs,
+            });
+        }
+        else {
+            // The selection was observable, so this 429 is unambiguously ordered
+            // against the current generation and needs no replay backup.
+            this.unsequencedRateLimits.delete(account);
+        }
+    }
+    /**
+     * Storage file this manager owns, resolved through the path state captured
+     * at construction. Reading the ambient `getStoragePath()` instead would
+     * point a project-scoped pool at whichever storage file happens to be
+     * current on the calling async context. See `saveToDisk`, which wraps
+     * `runWithStoragePathState(this.storagePathState, ...)` for the same reason.
+     */
+    resolveSelectionStoragePath() {
+        return this.storagePathState.currentStoragePath ?? getStoragePath();
     }
     markAccountCoolingDown(account, cooldownMs, reason) {
         const ms = Math.max(0, Math.floor(cooldownMs));
@@ -1076,6 +1194,54 @@ export class AccountManager {
         }
         return snapshot;
     }
+    /**
+     * Re-read the on-disk selection and fold it into this manager's state.
+     *
+     * Race protection: a CLI `switch`/`unpin`/`best` may have written a NEW
+     * pin/gen between proxy startup (or the last save) and now. If we persisted
+     * our stale instance values, we'd silently clobber the CLI update on every
+     * routine save (rate-limit, cooldown, near-quota refund, etc.). See #474.
+     *
+     * This MUTATES `pinnedAccountIndex`, `affinityGeneration` and, when the
+     * generation advanced, the selected account's rate-limit markers, so it is a
+     * separate step from the pure `buildStorageSnapshot` serializer below rather
+     * than a hidden side effect of it. Callers must run it immediately before a
+     * snapshot they intend to persist. Applying it twice is a no-op.
+     *
+     * @throws when the metadata exists but cannot be observed (see
+     * `readPinAndGenFromDisk`), which is the one case where persisting would
+     * risk overwriting a newer pin.
+     */
+    reconcileSelectionFromDisk() {
+        const onDisk = readPinAndGenFromDisk(this.resolveSelectionStoragePath(), {
+            strict: true,
+        });
+        // A delayed save must not resurrect the markers the CLI just cleared.
+        this.applyManualSelection(onDisk);
+        let effectivePinnedAccountIndex = this.pinnedAccountIndex;
+        let effectiveAffinityGeneration = this.affinityGeneration;
+        if (onDisk.affinityGeneration > effectiveAffinityGeneration) {
+            effectiveAffinityGeneration = onDisk.affinityGeneration;
+            // The pin is part of the same atomic write the CLI performs when it
+            // bumps the generation, so a strictly-greater on-disk gen is the
+            // signal that the disk pin is the authoritative one.
+            effectivePinnedAccountIndex = onDisk.pinnedAccountIndex;
+        }
+        // Validate the refreshed pin against the live account count.
+        if (effectivePinnedAccountIndex !== undefined &&
+            (effectivePinnedAccountIndex < 0 ||
+                effectivePinnedAccountIndex >= this.accounts.length)) {
+            effectivePinnedAccountIndex = undefined;
+        }
+        // Cache the refreshed values so subsequent saves start from the freshest
+        // known state without re-reading every time.
+        this.pinnedAccountIndex = effectivePinnedAccountIndex;
+        this.affinityGeneration = effectiveAffinityGeneration;
+    }
+    /**
+     * Serialize the live pool. Pure: it reads no files and mutates no state.
+     * Persisting callers must call `reconcileSelectionFromDisk()` first.
+     */
     buildStorageSnapshot() {
         const activeIndexByFamily = {};
         for (const family of MODEL_FAMILIES) {
@@ -1083,38 +1249,8 @@ export class AccountManager {
             activeIndexByFamily[family] = clampNonNegativeInt(raw, 0);
         }
         const activeIndex = clampNonNegativeInt(activeIndexByFamily.codex, 0);
-        // Race protection: a CLI `switch`/`unpin`/`best` may have written a NEW
-        // pin/gen between proxy startup (or the last save) and now. If we
-        // persisted our stale instance values, we'd silently clobber the CLI
-        // update on every routine save (rate-limit, cooldown, near-quota refund,
-        // etc.). Re-read just before snapshotting and prefer the fresher value.
-        // See #474.
-        let effectivePinnedAccountIndex = this.pinnedAccountIndex;
-        let effectiveAffinityGeneration = this.affinityGeneration;
-        try {
-            const onDisk = readPinAndGenFromDisk(getStoragePath());
-            if (onDisk.affinityGeneration > effectiveAffinityGeneration) {
-                effectiveAffinityGeneration = onDisk.affinityGeneration;
-                // The pin is part of the same atomic write the CLI performs when
-                // it bumps the generation, so a strictly-greater on-disk gen is
-                // the signal that the disk pin is the authoritative one.
-                effectivePinnedAccountIndex = onDisk.pinnedAccountIndex;
-            }
-            // Validate the refreshed pin against the live account count.
-            if (effectivePinnedAccountIndex !== undefined &&
-                (effectivePinnedAccountIndex < 0 ||
-                    effectivePinnedAccountIndex >= this.accounts.length)) {
-                effectivePinnedAccountIndex = undefined;
-            }
-            // Cache the refreshed values so subsequent saves start from the
-            // freshest known state without re-reading every time.
-            this.pinnedAccountIndex = effectivePinnedAccountIndex;
-            this.affinityGeneration = effectiveAffinityGeneration;
-        }
-        catch {
-            // Disk read failures fall back to in-memory values; better than
-            // dropping the snapshot save entirely.
-        }
+        const effectivePinnedAccountIndex = this.pinnedAccountIndex;
+        const effectiveAffinityGeneration = this.affinityGeneration;
         const snapshot = {
             version: 3,
             accounts: this.accounts.map((account) => {
@@ -1164,7 +1300,11 @@ export class AccountManager {
         try {
             return await withAccountStorageTransaction(async (_current, persist) => {
                 // Snapshot the live in-memory pool under the storage lock so refresh
-                // persistence merges against the latest account state.
+                // persistence merges against the latest account state. Reconcile the
+                // selection first for the same reason `saveToDisk` does: this write
+                // carries `pinnedAccountIndex`/`affinityGeneration` too, so a stale
+                // pair here would clobber a `switch` that landed since the last save.
+                this.reconcileSelectionFromDisk();
                 const nextStorage = structuredClone(this.buildStorageSnapshot());
                 const storageIndex = findAccountIndexByIdentity(nextStorage.accounts, source, auth);
                 if (storageIndex === undefined) {
@@ -1536,7 +1676,8 @@ export class AccountManager {
             await withAccountStorageTransaction(async (current, persist) => {
                 // Reconcile against the disk state loaded under the storage lock so a
                 // routine save does not clobber a token another process just rotated
-                // (stress audit H3).
+                // (stress audit H3) or a pin the CLI just wrote (#474).
+                this.reconcileSelectionFromDisk();
                 await persist(this.reconcileTokensFromDisk(this.buildStorageSnapshot(), current));
             });
         });
@@ -1556,24 +1697,54 @@ export class AccountManager {
                         this.pendingSave = null;
                     });
                     await this.pendingSave;
+                    this.saveRetryCount = 0;
                 }
                 catch (error) {
                     log.warn("Debounced save failed", {
                         error: error instanceof Error ? error.message : String(error),
+                        attempt: this.saveRetryCount + 1,
                     });
+                    // The debounce timer has already fired and cleared itself, so
+                    // without re-arming this save is simply lost, and with it every
+                    // rate-limit window, cooldown and rotated refresh token recorded
+                    // since the last successful write. Saves fail for transient
+                    // reasons (a Windows AV scanner or indexer holding accounts.json,
+                    // a torn read of a concurrent atomic rename), so back off and try
+                    // again instead of dropping the state.
+                    if (this.saveRetryCount < MAX_DEBOUNCED_SAVE_RETRIES) {
+                        this.saveRetryCount += 1;
+                        this.saveToDiskDebounced(Math.min(delayMs * 2, MAX_SAVE_RETRY_DELAY_MS));
+                    }
+                    else {
+                        this.saveRetryCount = 0;
+                        log.error("Dropping account state save after repeated failures; runtime state since the last successful save is lost");
+                    }
                 }
             };
             void doSave();
         }, delayMs);
     }
+    /**
+     * Flush any debounced save. Never rejects: this runs on the proxy shutdown
+     * path (`RuntimeRotationProxy.close`), and a rejection there aborts the rest
+     * of the teardown. A failure is logged at error level instead, because the
+     * process is exiting and there is no later attempt to fall back to.
+     */
     async flushPendingSave() {
-        if (this.saveDebounceTimer) {
-            clearTimeout(this.saveDebounceTimer);
-            this.saveDebounceTimer = null;
-            await this.saveToDisk();
+        try {
+            if (this.saveDebounceTimer) {
+                clearTimeout(this.saveDebounceTimer);
+                this.saveDebounceTimer = null;
+                await this.saveToDisk();
+            }
+            if (this.pendingSave) {
+                await this.pendingSave;
+            }
         }
-        if (this.pendingSave) {
-            await this.pendingSave;
+        catch (error) {
+            log.error("Failed to flush pending account state save", {
+                error: error instanceof Error ? error.message : String(error),
+            });
         }
     }
     // Workspace management methods

package/dist/lib/codex-manager/account-manager-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-manager-commands.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/account-manager-commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,aA8BnC,CAAC"}
+{"version":3,"file":"account-manager-commands.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/account-manager-commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,aA+BnC,CAAC"}

package/dist/lib/codex-manager/account-manager-commands.js

@@ -14,6 +14,7 @@ export const ACCOUNT_MANAGER_COMMANDS = new Set([
     "login",
     "list",
     "status",
+    "limits",
     "switch",
     "unpin",
     "workspace",

package/dist/lib/codex-manager/commands/limits.d.ts

@@ -0,0 +1,21 @@
+import { type ModelFamily } from "../../prompts/codex.js";
+import type { QuotaCacheData } from "../../quota-cache.js";
+import type { AccountStorageV3 } from "../../storage.js";
+export interface LimitsCommandDeps {
+    setStoragePath: (path: string | null) => void;
+    loadAccounts: () => Promise<AccountStorageV3 | null>;
+    loadQuotaCache: () => Promise<QuotaCacheData>;
+    refreshQuotaCache: (storage: AccountStorageV3, cache: QuotaCacheData, maxAgeMs: number) => Promise<QuotaCacheData>;
+    resolveActiveIndex: (storage: AccountStorageV3, family?: ModelFamily) => number;
+    getNow?: () => number;
+    logInfo?: (message: string) => void;
+    logError?: (message: string) => void;
+}
+/**
+ * Emit configured accounts joined to safe cached quota records.
+ *
+ * Cached mode performs no provider requests. Refresh mode delegates to the
+ * existing sequential, age-gated refresh path before serializing the snapshot.
+ */
+export declare function runLimitsCommand(args: string[], deps: LimitsCommandDeps): Promise<number>;
+//# sourceMappingURL=limits.d.ts.map

package/dist/lib/codex-manager/commands/limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../../../../lib/codex-manager/commands/limits.ts"],"names":[],"mappings":"AACA,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1E,OAAO,KAAK,EAAE,cAAc,EAAmB,MAAM,sBAAsB,CAAC;AAE5E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAMzD,MAAM,WAAW,iBAAiB;IACjC,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC9C,YAAY,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrD,cAAc,EAAE,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9C,iBAAiB,EAAE,CAClB,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,cAAc,EACrB,QAAQ,EAAE,MAAM,KACZ,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7B,kBAAkB,EAAE,CACnB,OAAO,EAAE,gBAAgB,EACzB,MAAM,CAAC,EAAE,WAAW,KAChB,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACrC;AAsDD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACrC,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,CAAC,CAoFjB"}