codex-multi-auth 2.17.0 → 2.17.3

package/dist/lib/runtime-rotation-proxy.js

@@ -54,6 +54,7 @@ import { isRecord, sleep } from "./utils.js";
 export { buildPinnedUnavailableErrorBody, buildTokenInvalidationBody, } from "./request/rate-limit-decision.js";
 export { chooseAccount } from "./runtime/rotation-account-selection.js";
 export { maybeInvalidateAffinityFromDisk, readPinnedAccountIndexFromDisk, readStorageMetaFromDisk, resetPinCacheForTesting, } from "./runtime/rotation-storage-meta.js";
+export { resetRuntimePolicyCacheForTests } from "./policy/runtime-policy-cache.js";
 const DEFAULT_HOST = "127.0.0.1";
 function isLoopbackHost(host) {
     const normalized = host.trim().toLowerCase();
@@ -87,6 +88,102 @@ function toUrlHost(host) {
     const bare = stripIpv6Brackets(host);
     return bare.includes(":") ? `[${bare}]` : bare;
 }
+/**
+ * True only for a NUMERIC loopback literal, as `new URL().hostname` reports it.
+ *
+ * Duplicates the wrapper's predicate (scripts/codex.js) at library level — a
+ * hostname like "localhost" is deliberately NOT enough: it is resolved by the
+ * OS at connect time, so an /etc/hosts or Windows hosts entry can point it at
+ * a routable address, and the upstream request carries the managed OAuth
+ * bearer token and the request body. WHATWG URL always reports an IPv6 host in
+ * its bracketed form, so `::1` is only ever seen here as `[::1]`.
+ */
+function isNumericLoopbackUrlHostname(hostname) {
+    if (hostname === "[::1]") {
+        return true;
+    }
+    const ipv4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
+    if (!ipv4) {
+        return false;
+    }
+    const octets = ipv4.slice(1).map((part) => Number(part));
+    if (octets.some((octet) => !Number.isInteger(octet) || octet > 255)) {
+        return false;
+    }
+    // The whole 127.0.0.0/8 block is loopback, not just 127.0.0.1.
+    return octets[0] === 127;
+}
+/**
+ * Whether the raw URL text carries an explicit `:port` (mirrors the wrapper).
+ *
+ * `new URL()` erases a port that matches the scheme default, so
+ * `http://127.0.0.1:80/x` reports `parsed.port === ""` and a `!parsed.port`
+ * check would reject a perfectly valid, explicitly-ported loopback URL.
+ */
+function urlHasExplicitPort(raw) {
+    const withoutScheme = raw.replace(/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//, "");
+    const authority = withoutScheme.split(/[/?#]/, 1)[0] ?? "";
+    // Strip userinfo first, or a password containing ':' reads as a port.
+    const hostAndPort = authority.slice(authority.lastIndexOf("@") + 1);
+    if (hostAndPort.startsWith("[")) {
+        const close = hostAndPort.indexOf("]");
+        return close !== -1 && /^:\d+$/.test(hostAndPort.slice(close + 1));
+    }
+    const colon = hostAndPort.indexOf(":");
+    return colon !== -1 && /^:\d+$/.test(hostAndPort.slice(colon));
+}
+/**
+ * Library-boundary enforcement for the upstream the proxy forwards managed
+ * OAuth Bearer tokens to (runtime-proxy trust boundary).
+ *
+ * `options.upstreamBaseUrl` is a library input: callers are not all the
+ * wrapper, so the env-var validation in scripts/codex.js does not protect this
+ * boundary. A non-https or non-loopback value would exfiltrate account tokens
+ * to whatever host it names. The policy mirrors the wrapper exactly: https is
+ * always allowed, while http is accepted only for the documented dev path — a
+ * NUMERIC loopback host (127.0.0.0/8 or [::1], never a name) with an explicit
+ * port — and no URL may carry credentials, a query, or a fragment.
+ */
+function assertAllowedUpstreamBaseUrl(raw) {
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw new CodexValidationError(`Runtime rotation proxy upstreamBaseUrl is not a valid absolute URL.`, { field: "upstreamBaseUrl", expected: "an https URL, or an http URL on a numeric loopback host with an explicit port" });
+    }
+    const isDevLoopback = parsed.protocol === "http:" &&
+        isNumericLoopbackUrlHostname(parsed.hostname.toLowerCase()) &&
+        Boolean(parsed.port || urlHasExplicitPort(raw));
+    if ((parsed.protocol !== "https:" && !isDevLoopback) ||
+        parsed.username ||
+        parsed.password ||
+        parsed.search ||
+        parsed.hash) {
+        throw new CodexValidationError(`Runtime rotation proxy refuses upstreamBaseUrl "${raw}". ` +
+            "It forwards managed OAuth tokens: use https, or http only on a " +
+            "numeric loopback host (127.0.0.0/8 or [::1]; a name such as " +
+            '"localhost" can resolve off-host) with an explicit port, and no ' +
+            "credentials, query, or fragment.", {
+            field: "upstreamBaseUrl",
+            expected: "an https URL, or an http URL on a numeric loopback host with an explicit port",
+            context: { upstreamBaseUrl: raw },
+        });
+    }
+}
+/**
+ * Whether a fetch rejection is undici refusing to follow a redirect.
+ *
+ * The upstream fetch runs `redirect: "error"` so a 3xx can never re-send the
+ * managed Bearer token to an arbitrary host. Instead of a Response, fetch
+ * rejects with `TypeError("fetch failed")` whose `cause` is the network error
+ * `unexpected redirect` (see undici's httpNetworkOrCacheFetch). Check the cause
+ * level and the bare message so a custom fetchImpl delivering the same network
+ * error unwrapped classifies identically.
+ */
+function isRedirectRejection(error) {
+    return [error, error?.cause].some((candidate) => candidate instanceof Error && candidate.message === "unexpected redirect");
+}
 // Structured logger for the default-on runtime proxy (errors-logging-01,
 // runtime-proxy-04). Previously the 1900-LOC proxy had zero logger integration;
 // failures surfaced only as a last-write-wins status.lastError string. Logs are
@@ -746,6 +843,13 @@ export async function startRuntimeRotationProxy(options) {
     const bindHost = toBindHost(host);
     const urlHost = toUrlHost(host);
     const port = options.port ?? 0;
+    // Library-boundary trust enforcement: the wrapper validates the env override,
+    // but options.upstreamBaseUrl reaches here from any caller — and Bearer
+    // tokens are forwarded to whatever host it names. https always passes; http
+    // is allowed only for the documented numeric-loopback dev path.
+    if (options.upstreamBaseUrl !== undefined) {
+        assertAllowedUpstreamBaseUrl(options.upstreamBaseUrl);
+    }
     const upstreamBaseUrl = options.upstreamBaseUrl ?? CODEX_BASE_URL;
     const clientApiKey = typeof options.clientApiKey === "string" &&
         options.clientApiKey.trim().length > 0
@@ -1366,8 +1470,8 @@ async function handleRequestInner(state, req, res, traceId) {
         const subscriptionQuotaByAccount = {};
         const resetCreditState = state.nativeOpenai && isResponsesRequest ? await cachedRead(state, "reset-credits", loadResetCreditState).catch(() => null) : null;
         const quotaForScope = (account, scope) => {
-            // Cached checks describe only the stored account binding, never its sibling workspaces.
-            const cached = scope.bound ? findQuotaCacheEntryForAccount(subscriptionQuotaCache, account, accountManager.getAccountsSnapshot()) : null;
+            // Scoped observations belong to this credential and workspace; legacy entries only describe the binding.
+            const cached = findQuotaCacheEntryForAccount(subscriptionQuotaCache, account, accountManager.getAccountsSnapshot(), undefined, scope.accountId);
             const observed = state.subscriptionQuotaObservations?.get(JSON.stringify([scope.id, context.model]));
             const reset = resetCreditState?.snapshots[scope.id];
             if (reset && reset.updatedAt > Math.max(cached?.updatedAt ?? 0, observed?.updatedAt ?? 0) && reset.updatedAt <= state.now() && state.now() - reset.updatedAt <= 60000)
@@ -1616,7 +1720,7 @@ async function handleRequestInner(state, req, res, traceId) {
                     continue;
                 for (const scope of scopes)
                     applyConfirmedReset({ account, scope, model: context.model, family: context.family, manager: accountManager, snapshot: resetCreditState.snapshots[scope.id], lastRedemptionAt: resetCreditState.lastRedemptionAt,
-                        previous: state.subscriptionQuotaObservations?.get(JSON.stringify([scope.id, context.model])) ?? (scope.bound ? findQuotaCacheEntryForAccount(subscriptionQuotaCache, account, accountManager.getAccountsSnapshot()) : null),
+                        previous: state.subscriptionQuotaObservations?.get(JSON.stringify([scope.id, context.model])) ?? findQuotaCacheEntryForAccount(subscriptionQuotaCache, account, accountManager.getAccountsSnapshot(), undefined, scope.accountId),
                         observations: state.subscriptionQuotaObservations ??= new Map(), now: state.now(), clearQuotaScheduler: a => state.preemptiveQuotaScheduler.clear(buildQuotaScheduleKey(a, context.family, context.model)) });
             }
         }
@@ -2030,6 +2134,11 @@ async function handleRequestInner(state, req, res, traceId) {
                     method: context.method,
                     headers: outboundHeaders,
                     signal: fetchAbortController.signal,
+                    // Redirect pinning: never follow an upstream redirect — a 3xx from
+                    // a compromised or misconfigured endpoint would re-send the
+                    // managed Bearer token to an arbitrary host. Matches the model
+                    // catalog fetch above.
+                    redirect: "error",
                 };
                 if (context.method === "POST") {
                     upstreamRequestInit.body = context.body;
@@ -2062,6 +2171,30 @@ async function handleRequestInner(state, req, res, traceId) {
                     error: transportError,
                 });
                 refundConsumedPoolToken(refreshed.account);
+                // A redirect rejection is upstream configuration, not a transport
+                // outage or an account-health signal: the 3xx arrived (so the path
+                // works and no generation started), the Bearer token never reached
+                // the redirect target, and every managed account would hit the
+                // same redirect — cooling + rotating here would drain the pool on
+                // one endpoint fault. This also covers the WebSocket httpFetch
+                // fallback: SocketSession preserves init, so a refused-upgrade
+                // turn on API/ZDR credentials can reject this way. Fail the
+                // request in place and leave account state untouched.
+                if (isRedirectRejection(error)) {
+                    writeJson(res, 502, {
+                        error: {
+                            code: "upstream_redirect_rejected",
+                            message: "Upstream endpoint attempted a redirect; redirects are never followed.",
+                        },
+                    });
+                    await usageRecorder.record({
+                        outcome: "failure",
+                        statusCode: 502,
+                        errorCode: "upstream_redirect_rejected",
+                        account: refreshed.account,
+                    });
+                    return;
+                }
                 // A timeout may occur after generation; do not retry within this request.
                 if (isImageRequest) {
                     writeJson(res, 502, {

package/dist/lib/schemas.d.ts

@@ -138,10 +138,10 @@ export declare const AccountMetadataV3Schema: z.ZodObject<{
     rateLimitResetTimes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodOptional<z.ZodNumber>>>;
     coolingDownUntil: z.ZodOptional<z.ZodNumber>;
     cooldownReason: z.ZodOptional<z.ZodEnum<{
+        "rate-limit": "rate-limit";
         "auth-failure": "auth-failure";
         "network-error": "network-error";
         "server-error": "server-error";
-        "rate-limit": "rate-limit";
     }>>;
     authInvalidatedAt: z.ZodOptional<z.ZodNumber>;
     authInvalidationErrorCode: z.ZodOptional<z.ZodString>;
@@ -191,10 +191,10 @@ export declare const AccountStorageV3Schema: z.ZodObject<{
         rateLimitResetTimes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodOptional<z.ZodNumber>>>;
         coolingDownUntil: z.ZodOptional<z.ZodNumber>;
         cooldownReason: z.ZodOptional<z.ZodEnum<{
+            "rate-limit": "rate-limit";
             "auth-failure": "auth-failure";
             "network-error": "network-error";
             "server-error": "server-error";
-            "rate-limit": "rate-limit";
         }>>;
         authInvalidatedAt: z.ZodOptional<z.ZodNumber>;
         authInvalidationErrorCode: z.ZodOptional<z.ZodString>;
@@ -225,6 +225,11 @@ export declare const AccountStorageV3Schema: z.ZodObject<{
 export type AccountStorageV3FromSchema = z.infer<typeof AccountStorageV3Schema>;
 /**
  * Legacy V1 storage format for migration support.
+ *
+ * The V3-era top-level fields are accepted too: a hybrid file (version:1 but
+ * written by newer code) must not lose `activeIndexByFamily` /
+ * `pinnedAccountIndex` / `affinityGeneration` at the schema boundary before
+ * normalizeAccountStorage can consume them.
  */
 export declare const AccountStorageV1Schema: z.ZodObject<{
     version: z.ZodLiteral<1>;
@@ -255,13 +260,22 @@ export declare const AccountStorageV1Schema: z.ZodObject<{
         rateLimitResetTime: z.ZodOptional<z.ZodNumber>;
         coolingDownUntil: z.ZodOptional<z.ZodNumber>;
         cooldownReason: z.ZodOptional<z.ZodEnum<{
+            "rate-limit": "rate-limit";
             "auth-failure": "auth-failure";
             "network-error": "network-error";
             "server-error": "server-error";
-            "rate-limit": "rate-limit";
         }>>;
-    }, z.core.$strip>>;
+    }, z.core.$loose>>;
     activeIndex: z.ZodNumber;
+    activeIndexByFamily: z.ZodOptional<z.ZodObject<{
+        "gpt-5-codex": z.ZodOptional<z.ZodOptional<z.ZodNumber>>;
+        "codex-max": z.ZodOptional<z.ZodOptional<z.ZodNumber>>;
+        codex: z.ZodOptional<z.ZodOptional<z.ZodNumber>>;
+        "gpt-5.2": z.ZodOptional<z.ZodOptional<z.ZodNumber>>;
+        "gpt-5.1": z.ZodOptional<z.ZodOptional<z.ZodNumber>>;
+    }, z.core.$strip>>;
+    pinnedAccountIndex: z.ZodOptional<z.ZodNumber>;
+    affinityGeneration: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
 /**
  * Union of V1 and V3 storage formats for migration detection.
@@ -295,13 +309,22 @@ export declare const AnyAccountStorageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
         rateLimitResetTime: z.ZodOptional<z.ZodNumber>;
         coolingDownUntil: z.ZodOptional<z.ZodNumber>;
         cooldownReason: z.ZodOptional<z.ZodEnum<{
+            "rate-limit": "rate-limit";
             "auth-failure": "auth-failure";
             "network-error": "network-error";
             "server-error": "server-error";
-            "rate-limit": "rate-limit";
         }>>;
-    }, z.core.$strip>>;
+    }, z.core.$loose>>;
     activeIndex: z.ZodNumber;
+    activeIndexByFamily: z.ZodOptional<z.ZodObject<{
+        "gpt-5-codex": z.ZodOptional<z.ZodOptional<z.ZodNumber>>;
+        "codex-max": z.ZodOptional<z.ZodOptional<z.ZodNumber>>;
+        codex: z.ZodOptional<z.ZodOptional<z.ZodNumber>>;
+        "gpt-5.2": z.ZodOptional<z.ZodOptional<z.ZodNumber>>;
+        "gpt-5.1": z.ZodOptional<z.ZodOptional<z.ZodNumber>>;
+    }, z.core.$strip>>;
+    pinnedAccountIndex: z.ZodOptional<z.ZodNumber>;
+    affinityGeneration: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>, z.ZodObject<{
     version: z.ZodLiteral<3>;
     accounts: z.ZodArray<z.ZodObject<{
@@ -332,10 +355,10 @@ export declare const AnyAccountStorageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
         rateLimitResetTimes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodOptional<z.ZodNumber>>>;
         coolingDownUntil: z.ZodOptional<z.ZodNumber>;
         cooldownReason: z.ZodOptional<z.ZodEnum<{
+            "rate-limit": "rate-limit";
             "auth-failure": "auth-failure";
             "network-error": "network-error";
             "server-error": "server-error";
-            "rate-limit": "rate-limit";
         }>>;
         authInvalidatedAt: z.ZodOptional<z.ZodNumber>;
         authInvalidationErrorCode: z.ZodOptional<z.ZodString>;
@@ -397,10 +420,10 @@ export declare const FlaggedAccountMetadataV1Schema: z.ZodObject<{
     rateLimitResetTimes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodOptional<z.ZodNumber>>>;
     coolingDownUntil: z.ZodOptional<z.ZodNumber>;
     cooldownReason: z.ZodOptional<z.ZodEnum<{
+        "rate-limit": "rate-limit";
         "auth-failure": "auth-failure";
         "network-error": "network-error";
         "server-error": "server-error";
-        "rate-limit": "rate-limit";
     }>>;
     authInvalidatedAt: z.ZodOptional<z.ZodNumber>;
     authInvalidationErrorCode: z.ZodOptional<z.ZodString>;
@@ -453,10 +476,10 @@ export declare const FlaggedAccountStorageV1Schema: z.ZodObject<{
         rateLimitResetTimes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodOptional<z.ZodNumber>>>;
         coolingDownUntil: z.ZodOptional<z.ZodNumber>;
         cooldownReason: z.ZodOptional<z.ZodEnum<{
+            "rate-limit": "rate-limit";
             "auth-failure": "auth-failure";
             "network-error": "network-error";
             "server-error": "server-error";
-            "rate-limit": "rate-limit";
         }>>;
         authInvalidatedAt: z.ZodOptional<z.ZodNumber>;
         authInvalidationErrorCode: z.ZodOptional<z.ZodString>;
@@ -495,12 +518,12 @@ export type AccountsJournalEntryFromSchema = z.infer<typeof AccountsJournalEntry
  * Token failure reason codes.
  */
 declare const TokenFailureReasonSchema: z.ZodEnum<{
-    unknown: "unknown";
     http_error: "http_error";
     invalid_response: "invalid_response";
     network_error: "network_error";
     missing_refresh: "missing_refresh";
     timeout: "timeout";
+    unknown: "unknown";
 }>;
 export type TokenFailureReasonFromSchema = z.infer<typeof TokenFailureReasonSchema>;
 /**
@@ -521,12 +544,12 @@ export type TokenSuccessFromSchema = z.infer<typeof TokenSuccessSchema>;
 export declare const TokenFailureSchema: z.ZodObject<{
     type: z.ZodLiteral<"failed">;
     reason: z.ZodOptional<z.ZodEnum<{
-        unknown: "unknown";
         http_error: "http_error";
         invalid_response: "invalid_response";
         network_error: "network_error";
         missing_refresh: "missing_refresh";
         timeout: "timeout";
+        unknown: "unknown";
     }>>;
     statusCode: z.ZodOptional<z.ZodNumber>;
     message: z.ZodOptional<z.ZodString>;
@@ -545,12 +568,12 @@ export declare const TokenResultSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"failed">;
     reason: z.ZodOptional<z.ZodEnum<{
-        unknown: "unknown";
         http_error: "http_error";
         invalid_response: "invalid_response";
         network_error: "network_error";
         missing_refresh: "missing_refresh";
         timeout: "timeout";
+        unknown: "unknown";
     }>>;
     statusCode: z.ZodOptional<z.ZodNumber>;
     message: z.ZodOptional<z.ZodString>;
@@ -624,4 +647,3 @@ export declare function safeParseJson<T>(raw: unknown, schema: z.ZodType<T>, con
  */
 export declare function getValidationErrors(schema: z.ZodType, data: unknown): string[];
 export {};
-//# sourceMappingURL=schemas.d.ts.map

package/dist/lib/schemas.js

@@ -202,8 +202,16 @@ export const AccountStorageV3Schema = z.object({
 });
 /**
  * Legacy V1 account metadata for migration support.
+ *
+ * Uses `passthrough` so V3-compatible extra fields (workspaces,
+ * rateLimitResetTimes, authInvalidatedAt, …) survive the schema boundary:
+ * version:1 files with V3-era rows are real (the flagged-accounts store is
+ * `version: 1` with full V3 rows) and migrateV1ToV3 now carries unknown
+ * fields forward — stripping them here would make that preservation a no-op
+ * for every schema-valid file. Same rationale as FlaggedAccountMetadataV1Schema.
  */
-const AccountMetadataV1Schema = z.object({
+const AccountMetadataV1Schema = z
+    .object({
     accountId: z.string().optional(),
     accountIdSource: AccountIdSourceSchema.optional(),
     accountLabel: z.string().optional(),
@@ -218,14 +226,23 @@ const AccountMetadataV1Schema = z.object({
     rateLimitResetTime: z.number().optional(), // V1 used single value
     coolingDownUntil: z.number().optional(),
     cooldownReason: CooldownReasonSchema.optional(),
-});
+})
+    .passthrough();
 /**
  * Legacy V1 storage format for migration support.
+ *
+ * The V3-era top-level fields are accepted too: a hybrid file (version:1 but
+ * written by newer code) must not lose `activeIndexByFamily` /
+ * `pinnedAccountIndex` / `affinityGeneration` at the schema boundary before
+ * normalizeAccountStorage can consume them.
  */
 export const AccountStorageV1Schema = z.object({
     version: z.literal(1),
     accounts: z.array(AccountMetadataV1Schema),
     activeIndex: z.number().min(0),
+    activeIndexByFamily: ActiveIndexByFamilySchema.optional(),
+    pinnedAccountIndex: z.number().int().min(0).optional(),
+    affinityGeneration: z.number().int().min(0).optional(),
 });
 /**
  * Union of V1 and V3 storage formats for migration detection.

package/dist/lib/session-affinity.d.ts

@@ -40,4 +40,3 @@ export declare class SessionAffinityStore {
     private findOldestKey;
     private normalizeWriteVersion;
 }
-//# sourceMappingURL=session-affinity.d.ts.map

package/dist/lib/shutdown.d.ts

@@ -4,4 +4,3 @@ export declare function unregisterCleanup(fn: CleanupFn): void;
 export declare function runCleanup(): Promise<void>;
 export declare function getCleanupCount(): number;
 export {};
-//# sourceMappingURL=shutdown.d.ts.map

package/dist/lib/storage/account-clear-entry.d.ts

@@ -13,4 +13,3 @@ export declare function clearAccountsEntry(params: {
     }) => Promise<void>;
     logError: (message: string, details: Record<string, unknown>) => void;
 }): Promise<void>;
-//# sourceMappingURL=account-clear-entry.d.ts.map

package/dist/lib/storage/account-clear.d.ts

@@ -5,4 +5,3 @@ export declare function clearAccountStorageArtifacts(params: {
     backupPaths: string[];
     logError: (message: string, details: Record<string, unknown>) => void;
 }): Promise<void>;
-//# sourceMappingURL=account-clear.d.ts.map

package/dist/lib/storage/account-match-utils.d.ts

@@ -6,4 +6,3 @@ export declare function selectNewestAccount<T extends AccountLike>(current: T |
 export declare function collectDistinctIdentityValues(values: Array<string | undefined>): Set<string>;
 export declare function findNewestMatchingIndex<T, TRef>(accounts: readonly T[], toRef: (account: T) => TRef, predicate: (ref: TRef) => boolean, selectNewest: (current: T | undefined, candidate: T) => T): number | undefined;
 export {};
-//# sourceMappingURL=account-match-utils.d.ts.map

package/dist/lib/storage/account-persistence.d.ts

@@ -1,3 +1,2 @@
 import type { AccountStorageV3 } from "./public-types.js";
 export declare function cloneAccountStorageForPersistence(storage: AccountStorageV3 | null | undefined): AccountStorageV3;
-//# sourceMappingURL=account-persistence.d.ts.map

package/dist/lib/storage/account-port.d.ts

@@ -49,4 +49,3 @@ export declare function importAccountsSnapshot(params: {
     total: number;
     skipped: number;
 }>;
-//# sourceMappingURL=account-port.d.ts.map

package/dist/lib/storage/account-save-entry.d.ts

@@ -4,4 +4,3 @@ export declare function saveAccountsEntry(params: {
     withStorageLock: <T>(fn: () => Promise<T>) => Promise<T>;
     saveUnlocked: (storage: AccountStorageV3) => Promise<void>;
 }): Promise<void>;
-//# sourceMappingURL=account-save-entry.d.ts.map

package/dist/lib/storage/account-save.d.ts

@@ -15,16 +15,23 @@ export declare function saveAccountsToDisk(storage: AccountStorageV3, params: {
     writeTemp: (tempPath: string, content: string) => Promise<void>;
     statTemp: (tempPath: string) => Promise<{
         size: number;
+        mtimeMs?: number;
+        ctimeMs?: number;
+        ino?: number;
     }>;
     renameTempToPath: (tempPath: string) => Promise<void>;
     cleanupResetMarker: () => Promise<void>;
     cleanupWal: () => Promise<void>;
     cleanupTemp: (tempPath: string) => Promise<void>;
-    onSaved: () => void;
+    onSaved: (stats: {
+        size: number;
+        mtimeMs?: number;
+        ctimeMs?: number;
+        ino?: number;
+    }, contentSha256: string) => void;
     logWarn: (message: string, details: Record<string, unknown>) => void;
     logError: (message: string, details: Record<string, unknown>) => void;
     createStorageError: (error: unknown) => Error;
     backupPath: string;
     createTempPath: () => string;
 }): Promise<void>;
-//# sourceMappingURL=account-save.d.ts.map

package/dist/lib/storage/account-save.js

@@ -34,7 +34,10 @@ export async function saveAccountsToDisk(storage, params) {
         }
         await params.renameTempToPath(tempPath);
         await params.cleanupResetMarker();
-        params.onSaved();
+        // The temp file's stat fields survive the rename onto the primary path,
+        // so together with the content hash they are a free record of what this
+        // process last wrote — no extra stat of the destination is needed.
+        params.onSaved(stats, params.computeSha256(content));
         await params.cleanupWal();
     }
     catch (error) {

package/dist/lib/storage/account-snapshot.d.ts

@@ -22,4 +22,3 @@ export declare function describeAccountSnapshot(path: string, kind: BackupSnapsh
     }>;
     logWarn: (message: string, meta: Record<string, unknown>) => void;
 }): Promise<BackupSnapshotMetadata>;
-//# sourceMappingURL=account-snapshot.d.ts.map

package/dist/lib/storage/backup-metadata-builder.d.ts

@@ -29,4 +29,3 @@ export declare function buildBackupMetadata(params: {
     };
 }): Promise<BackupMetadata>;
 export {};
-//# sourceMappingURL=backup-metadata-builder.d.ts.map

package/dist/lib/storage/backup-metadata.d.ts

@@ -39,4 +39,3 @@ export type SnapshotStats = {
     mtimeMs?: number;
 };
 export {};
-//# sourceMappingURL=backup-metadata.d.ts.map

package/dist/lib/storage/backup-paths.d.ts

@@ -7,4 +7,3 @@ export declare function getAccountsBackupRecoveryCandidates(path: string, depth:
 export declare function getAccountsWalPath(path: string): string;
 export declare function getIntentionalResetMarkerPath(path: string): string;
 export { ACCOUNTS_BACKUP_SUFFIX, ACCOUNTS_WAL_SUFFIX, RESET_MARKER_SUFFIX };
-//# sourceMappingURL=backup-paths.d.ts.map

package/dist/lib/storage/backup-restore.d.ts

@@ -8,4 +8,3 @@ export declare function restoreAccountsFromBackupPath(path: string, options: {
     }>;
     saveAccounts: (storage: AccountStorageV3) => Promise<void>;
 }): Promise<AccountStorageV3>;
-//# sourceMappingURL=backup-restore.d.ts.map

package/dist/lib/storage/cache-artifacts.d.ts

@@ -1,2 +1 @@
 export declare function isCacheLikeBackupArtifactName(entryName: string): boolean;
-//# sourceMappingURL=cache-artifacts.d.ts.map

package/dist/lib/storage/credential-sidecars.d.ts

@@ -10,4 +10,3 @@ export declare function clearCredentialSidecars(): Promise<void>;
  * keys never survive a reset; the first failure is rethrown afterwards.
  */
 export declare function clearAccountsAndCredentialSidecars(clearPool: () => Promise<void>): Promise<void>;
-//# sourceMappingURL=credential-sidecars.d.ts.map

package/dist/lib/storage/error-hints.d.ts

@@ -7,4 +7,3 @@ export declare function formatStorageErrorHint(error: unknown, path: string): st
  * Wrap an arbitrary storage failure in a StorageError with a derived hint.
  */
 export declare function toStorageError(message: string, error: unknown, path: string): StorageError;
-//# sourceMappingURL=error-hints.d.ts.map

package/dist/lib/storage/file-lock.d.ts

@@ -6,4 +6,3 @@
 export declare function withFileTransactionLock<T>(path: string, action: () => Promise<T>, options?: {
     waitMs?: number;
 }): Promise<T>;
-//# sourceMappingURL=file-lock.d.ts.map

package/dist/lib/storage/file-lock.js

@@ -9,6 +9,33 @@ const abandonedOwners = new Set();
 const leases = new AsyncLocalStorage();
 const host = createHash("sha256").update(hostname()).digest("hex").slice(0, 16);
 const ownerPattern = /^([a-f0-9]{16})\.([1-9][0-9]*)\.([a-f0-9-]{36})$/;
+// Contended acquisition retries once ran on a fixed 25ms delay: every waiter
+// woke on the same cadence and re-collided on the rename (p99 ~1.8s under ~200
+// waiters). The base delay now grows mildly from 15ms toward 40ms with up to
+// 10ms of uniform jitter, so each retry lands in ~[15,50)ms and waiters
+// decorrelate instead of stampeding the lock together.
+const LOCK_RETRY_MIN_DELAY_MS = 15;
+const LOCK_RETRY_MAX_BASE_DELAY_MS = 40;
+const LOCK_RETRY_GROWTH_FACTOR = 1.2;
+const LOCK_RETRY_JITTER_MS = 10;
+function lockRetryBaseDelayMs(failedAttempt) {
+    return Math.min(LOCK_RETRY_MIN_DELAY_MS * LOCK_RETRY_GROWTH_FACTOR ** (failedAttempt - 1), LOCK_RETRY_MAX_BASE_DELAY_MS);
+}
+// Derive the attempt cap from the delay schedule itself, not a flat ~40ms
+// guess: the first retries are cheaper than steady state (15ms, 18ms, …), so
+// ceil(waitMs / expected) let a short budget expire after roughly half the
+// requested wait — a 70ms budget could return ELOCKED in ~33ms. Summing the
+// zero-jitter base delays keeps retrying until the schedule has slept at
+// least waitMs; jitter only ever extends the wait, never shortens it.
+function lockMaxAttemptsForWaitMs(waitMs) {
+    let attempts = 1;
+    let coveredMs = 0;
+    while (coveredMs < waitMs) {
+        coveredMs += lockRetryBaseDelayMs(attempts);
+        attempts += 1;
+    }
+    return attempts;
+}
 function code(error) {
     return error?.code;
 }
@@ -152,7 +179,12 @@ export async function withFileTransactionLock(path, action, options = {}) {
                 await recoverDeadOwner(lock);
                 throw Object.assign(Error("Storage is busy with another live writer; retry shortly."), { code: "ELOCKED" });
             }
-        }, { maxAttempts: Math.max(1, Math.ceil((options.waitMs ?? 10000) / 25) + 1), backoffMs: 25, retryableCodes: ["ELOCKED", "EBUSY", "EPERM", "EACCES", "EAGAIN"] });
+        }, {
+            maxAttempts: lockMaxAttemptsForWaitMs(options.waitMs ?? 10000),
+            backoffMs: lockRetryBaseDelayMs,
+            jitterMs: LOCK_RETRY_JITTER_MS,
+            retryableCodes: ["ELOCKED", "EBUSY", "EPERM", "EACCES", "EAGAIN"],
+        });
         const lease = { active: true };
         const context = new Map(leases.getStore());
         context.set(key, lease);

package/dist/lib/storage/file-paths.d.ts

@@ -3,4 +3,3 @@ export { ACCOUNTS_BACKUP_SUFFIX, ACCOUNTS_WAL_SUFFIX, getAccountsBackupPath, get
 export declare function getAccountsBackupRecoveryCandidates(path: string): string[];
 export declare function getFlaggedAccountsPath(storagePath: string, fileName: string): string;
 export declare function getLegacyFlaggedAccountsPath(storagePath: string, legacyFileName: string): string;
-//# sourceMappingURL=file-paths.d.ts.map

package/dist/lib/storage/fixture-guards.d.ts

@@ -1,4 +1,3 @@
 import type { AccountMetadataV3, AccountStorageV3 } from "./public-types.js";
 export declare function looksLikeSyntheticFixtureAccount(account: AccountMetadataV3): boolean;
 export declare function looksLikeSyntheticFixtureStorage(storage: AccountStorageV3 | null): boolean;
-//# sourceMappingURL=fixture-guards.d.ts.map

package/dist/lib/storage/flagged-entry.d.ts

@@ -12,4 +12,3 @@ export declare function clearFlaggedAccountsEntry(params: {
     }) => Promise<void>;
     logError: (message: string, details: Record<string, unknown>) => void;
 }): Promise<void>;
-//# sourceMappingURL=flagged-entry.d.ts.map

package/dist/lib/storage/flagged-load-entry.d.ts

@@ -19,4 +19,3 @@ export declare function loadFlaggedAccountsEntry(params: {
     logError: (message: string, details: Record<string, unknown>) => void;
     logInfo: (message: string, details: Record<string, unknown>) => void;
 }): Promise<FlaggedAccountStorageV1>;
-//# sourceMappingURL=flagged-load-entry.d.ts.map

package/dist/lib/storage/flagged-save-entry.d.ts

@@ -4,4 +4,3 @@ export declare function saveFlaggedAccountsEntry(params: {
     withStorageLock: <T>(fn: () => Promise<T>) => Promise<T>;
     saveUnlocked: (storage: FlaggedAccountStorageV1) => Promise<void>;
 }): Promise<void>;
-//# sourceMappingURL=flagged-save-entry.d.ts.map

package/dist/lib/storage/flagged-storage-file.d.ts

@@ -8,4 +8,3 @@ export declare function loadFlaggedAccountsFromFile(path: string, deps: {
     normalizeFlaggedStorage: (data: unknown) => FlaggedAccountStorageV1;
     sleep?: (ms: number) => Promise<void>;
 }): Promise<FlaggedAccountStorageV1>;
-//# sourceMappingURL=flagged-storage-file.d.ts.map

package/dist/lib/storage/flagged-storage-io.d.ts

@@ -26,4 +26,3 @@ export declare function clearFlaggedAccountsOnDisk(params: {
     backupPaths: string[];
     logError: (message: string, details: Record<string, unknown>) => void;
 }): Promise<void>;
-//# sourceMappingURL=flagged-storage-io.d.ts.map

package/dist/lib/storage/flagged-storage.d.ts

@@ -3,4 +3,3 @@ export declare function normalizeFlaggedStorage(data: unknown, deps: {
     isRecord: (value: unknown) => value is Record<string, unknown>;
     now: () => number;
 }): FlaggedAccountStorageV1;
-//# sourceMappingURL=flagged-storage.d.ts.map