codex-multi-auth 2.3.0-beta.2 → 2.3.0-beta.3

package/dist/lib/schemas.js

@@ -85,7 +85,7 @@ export const PluginConfigSchema = z.object({
 /**
  * Source of the accountId used for ChatGPT requests.
  */
-export const AccountIdSourceSchema = z.enum([
+const AccountIdSourceSchema = z.enum([
     "token",
     "id_token",
     "org",
@@ -94,7 +94,7 @@ export const AccountIdSourceSchema = z.enum([
 /**
  * Cooldown reason for temporary account suspension.
  */
-export const CooldownReasonSchema = z.enum([
+const CooldownReasonSchema = z.enum([
     "auth-failure",
     "network-error",
     "server-error",
@@ -103,7 +103,7 @@ export const CooldownReasonSchema = z.enum([
 /**
  * Last switch reason for account rotation tracking.
  */
-export const SwitchReasonSchema = z.enum([
+const SwitchReasonSchema = z.enum([
     "rate-limit",
     "initial",
     "rotation",
@@ -125,14 +125,14 @@ export const PersistedSwitchReasonSchema = z.enum([
 /**
  * Rate limit state - maps model family to reset timestamp.
  */
-export const RateLimitStateV3Schema = z.record(z.string(), z.number().optional());
+const RateLimitStateV3Schema = z.record(z.string(), z.number().optional());
 /**
  * Workspace entry within an account. Supports a single OpenAI/Google account
  * that belongs to multiple ChatGPT workspaces (e.g. personal Plus + a
  * business/team workspace), each a distinct quota pool keyed by its org_id
  * (`id`). Mirrors the `Workspace` TS interface in `lib/accounts.ts`. See #491.
  */
-export const WorkspaceSchema = z.object({
+const WorkspaceSchema = z.object({
     id: z.string(),
     name: z.string().optional(),
     enabled: z.boolean(),
@@ -170,7 +170,7 @@ const modelFamilyEntries = MODEL_FAMILIES.map((family) => [
     family,
     z.number().optional(),
 ]);
-export const ActiveIndexByFamilySchema = z
+const ActiveIndexByFamilySchema = z
     .object(Object.fromEntries(modelFamilyEntries))
     .partial();
 /**
@@ -187,7 +187,7 @@ export const AccountStorageV3Schema = z.object({
 /**
  * Legacy V1 account metadata for migration support.
  */
-export const AccountMetadataV1Schema = z.object({
+const AccountMetadataV1Schema = z.object({
     accountId: z.string().optional(),
     accountIdSource: AccountIdSourceSchema.optional(),
     accountLabel: z.string().optional(),
@@ -259,7 +259,7 @@ export const AccountsJournalEntrySchema = z.object({
 /**
  * Token failure reason codes.
  */
-export const TokenFailureReasonSchema = z.enum([
+const TokenFailureReasonSchema = z.enum([
     "http_error",
     "invalid_response",
     "network_error",

package/dist/lib/storage/file-paths.d.ts

@@ -1,5 +1,5 @@
-import { ACCOUNTS_BACKUP_SUFFIX, ACCOUNTS_WAL_SUFFIX, getAccountsBackupPath, getAccountsBackupPathAtIndex, getAccountsWalPath, getIntentionalResetMarkerPath, RESET_MARKER_SUFFIX } from "./backup-paths.js";
-export { ACCOUNTS_BACKUP_SUFFIX, ACCOUNTS_WAL_SUFFIX, getAccountsBackupPath, getAccountsBackupPathAtIndex, getAccountsWalPath, getIntentionalResetMarkerPath, RESET_MARKER_SUFFIX, };
+import { ACCOUNTS_BACKUP_SUFFIX, ACCOUNTS_WAL_SUFFIX, getAccountsBackupPath, getAccountsWalPath, getIntentionalResetMarkerPath, RESET_MARKER_SUFFIX } from "./backup-paths.js";
+export { ACCOUNTS_BACKUP_SUFFIX, ACCOUNTS_WAL_SUFFIX, getAccountsBackupPath, getAccountsWalPath, getIntentionalResetMarkerPath, RESET_MARKER_SUFFIX, };
 export declare function getAccountsBackupRecoveryCandidates(path: string): string[];
 export declare function getFlaggedAccountsPath(storagePath: string, fileName: string): string;
 export declare function getLegacyFlaggedAccountsPath(storagePath: string, legacyFileName: string): string;

package/dist/lib/storage/file-paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-paths.d.ts","sourceRoot":"","sources":["../../../lib/storage/file-paths.ts"],"names":[],"mappings":"AACA,OAAO,EACN,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,4BAA4B,EAE5B,kBAAkB,EAClB,6BAA6B,EAC7B,mBAAmB,EACnB,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EACN,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,4BAA4B,EAC5B,kBAAkB,EAClB,6BAA6B,EAC7B,mBAAmB,GACnB,CAAC;AAEF,wBAAgB,mCAAmC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAE1E;AAED,wBAAgB,sBAAsB,CACrC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACd,MAAM,CAER;AAMD,wBAAgB,4BAA4B,CAC3C,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,GACpB,MAAM,CAER"}
+{"version":3,"file":"file-paths.d.ts","sourceRoot":"","sources":["../../../lib/storage/file-paths.ts"],"names":[],"mappings":"AACA,OAAO,EACN,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EAErB,kBAAkB,EAClB,6BAA6B,EAC7B,mBAAmB,EACnB,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EACN,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,6BAA6B,EAC7B,mBAAmB,GACnB,CAAC;AAEF,wBAAgB,mCAAmC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAE1E;AAED,wBAAgB,sBAAsB,CACrC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACd,MAAM,CAER;AAMD,wBAAgB,4BAA4B,CAC3C,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,GACpB,MAAM,CAER"}

package/dist/lib/storage/file-paths.js

@@ -1,7 +1,7 @@
 import { dirname, join } from "node:path";
-import { ACCOUNTS_BACKUP_SUFFIX, ACCOUNTS_WAL_SUFFIX, getAccountsBackupPath, getAccountsBackupPathAtIndex, getAccountsBackupRecoveryCandidates as getBackupRecoveryCandidates, getAccountsWalPath, getIntentionalResetMarkerPath, RESET_MARKER_SUFFIX, } from "./backup-paths.js";
+import { ACCOUNTS_BACKUP_SUFFIX, ACCOUNTS_WAL_SUFFIX, getAccountsBackupPath, getAccountsBackupRecoveryCandidates as getBackupRecoveryCandidates, getAccountsWalPath, getIntentionalResetMarkerPath, RESET_MARKER_SUFFIX, } from "./backup-paths.js";
 const ACCOUNTS_BACKUP_HISTORY_DEPTH = 3;
-export { ACCOUNTS_BACKUP_SUFFIX, ACCOUNTS_WAL_SUFFIX, getAccountsBackupPath, getAccountsBackupPathAtIndex, getAccountsWalPath, getIntentionalResetMarkerPath, RESET_MARKER_SUFFIX, };
+export { ACCOUNTS_BACKUP_SUFFIX, ACCOUNTS_WAL_SUFFIX, getAccountsBackupPath, getAccountsWalPath, getIntentionalResetMarkerPath, RESET_MARKER_SUFFIX, };
 export function getAccountsBackupRecoveryCandidates(path) {
     return getBackupRecoveryCandidates(path, ACCOUNTS_BACKUP_HISTORY_DEPTH);
 }

package/dist/lib/storage/flagged-storage-io.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flagged-storage-io.d.ts","sourceRoot":"","sources":["../../../lib/storage/flagged-storage-io.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AA2EjE,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,uBAAuB,CAAC;IACpE,sBAAsB,EAAE,CACvB,OAAO,EAAE,uBAAuB,EAChC,eAAe,EAAE,MAAM,KACnB,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB,mBAAmB,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACtE,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACrE,GAAG,OAAO,CAAC,uBAAuB,CAAC,CA0InC;AAED,wBAAsB,iCAAiC,CACtD,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE;IACP,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,uBAAuB,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,uBAAuB,CAAC;IACpE,iBAAiB,EAAE,CAClB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE;QAAE,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,KACtC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,mBAAmB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACrE,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACtE,GACC,OAAO,CAAC,IAAI,CAAC,CA0Cf;AAED,wBAAsB,0BAA0B,CAAC,MAAM,EAAE;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACtE,GAAG,OAAO,CAAC,IAAI,CAAC,CA8ChB"}
+{"version":3,"file":"flagged-storage-io.d.ts","sourceRoot":"","sources":["../../../lib/storage/flagged-storage-io.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AA4EjE,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,uBAAuB,CAAC;IACpE,sBAAsB,EAAE,CACvB,OAAO,EAAE,uBAAuB,EAChC,eAAe,EAAE,MAAM,KACnB,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB,mBAAmB,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACtE,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACrE,GAAG,OAAO,CAAC,uBAAuB,CAAC,CA0InC;AAED,wBAAsB,iCAAiC,CACtD,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE;IACP,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,uBAAuB,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,uBAAuB,CAAC;IACpE,iBAAiB,EAAE,CAClB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE;QAAE,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,KACtC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,mBAAmB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACrE,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACtE,GACC,OAAO,CAAC,IAAI,CAAC,CAyCf;AAED,wBAAsB,0BAA0B,CAAC,MAAM,EAAE;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACtE,GAAG,OAAO,CAAC,IAAI,CAAC,CA8ChB"}

package/dist/lib/storage/flagged-storage-io.js

@@ -3,6 +3,7 @@ import { dirname } from "node:path";
 import { FlaggedAccountStorageV1Schema, safeParseJson } from "../schemas.js";
 import { readFileWithRetry } from "./flagged-storage-file.js";
 import { FILE_RETRY_CODES } from "../fs-retry.js";
+import { tempPathFor } from "../temp-path.js";
 // storage-07: align with the single shared retryable-code set (adds ENOTEMPTY/
 // EACCES) instead of a local subset.
 const RETRYABLE_UNLINK_CODES = FILE_RETRY_CODES;
@@ -183,8 +184,7 @@ export async function loadFlaggedAccountsState(params) {
     }
 }
 export async function saveFlaggedAccountsUnlockedToDisk(storage, params) {
-    const uniqueSuffix = `${Date.now()}.${Math.random().toString(36).slice(2, 8)}`;
-    const tempPath = `${params.path}.${uniqueSuffix}.tmp`;
+    const tempPath = tempPathFor(params.path);
     try {
         await fs.mkdir(dirname(params.path), { recursive: true });
         if (existsSync(params.path)) {

package/dist/lib/storage/import-export.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"import-export.d.ts","sourceRoot":"","sources":["../../../lib/storage/import-export.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAsD1D,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IAClD,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjC,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC9D,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACrE,GAAG,OAAO,CAAC,IAAI,CAAC,CAwChB;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE;IAC5C,YAAY,EAAE,MAAM,CAAC;IACrB,uBAAuB,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,gBAAgB,GAAG,IAAI,CAAC;CACrE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA8C5B;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE;IAC7C,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAClC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,CACpB,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC,KAClC,gBAAgB,CAAC,UAAU,CAAC,CAAC;CAClC,GAAG;IACH,UAAU,EAAE,gBAAgB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CAChB,CAgCA"}
+{"version":3,"file":"import-export.d.ts","sourceRoot":"","sources":["../../../lib/storage/import-export.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAsD1D,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IAClD,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjC,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC9D,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACrE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuChB;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE;IAC5C,YAAY,EAAE,MAAM,CAAC;IACrB,uBAAuB,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,gBAAgB,GAAG,IAAI,CAAC;CACrE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA8C5B;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE;IAC7C,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAClC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,CACpB,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC,KAClC,gBAAgB,CAAC,UAAU,CAAC,CAAC;CAClC,GAAG;IACH,UAAU,EAAE,gBAAgB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CAChB,CAgCA"}

package/dist/lib/storage/import-export.js

@@ -2,6 +2,7 @@ import { existsSync, promises as fs } from "node:fs";
 import { dirname } from "node:path";
 import { AnyAccountStorageSchema, safeParseJson } from "../schemas.js";
 import { shouldRetryFileOperation } from "../fs-retry.js";
+import { tempPathFor } from "../temp-path.js";
 const EXPORT_RENAME_MAX_ATTEMPTS = 4;
 const EXPORT_RENAME_BASE_DELAY_MS = 25;
 const MAX_IMPORT_BYTES = 4 * 1024 * 1024;
@@ -64,8 +65,7 @@ export async function exportAccountsToFile(params) {
         activeIndex: params.storage.activeIndex,
         activeIndexByFamily: params.storage.activeIndexByFamily,
     }, null, 2);
-    const uniqueSuffix = `${Date.now()}.${Math.random().toString(36).slice(2, 8)}`;
-    const tempPath = `${params.resolvedPath}.${uniqueSuffix}.tmp`;
+    const tempPath = tempPathFor(params.resolvedPath);
     try {
         await fs.writeFile(tempPath, content, {
             encoding: "utf-8",

package/dist/lib/storage/migrations.d.ts

@@ -8,7 +8,7 @@
  */
 import type { AccountIdSource } from "../types.js";
 import type { AccountStorageV3, CooldownReason } from "./public-types.js";
-export interface AccountMetadataV1 {
+interface AccountMetadataV1 {
     accountId?: string;
     accountIdSource?: AccountIdSource;
     accountLabel?: string;
@@ -32,4 +32,5 @@ export interface AccountStorageV1 {
     activeIndex: number;
 }
 export declare function migrateV1ToV3(v1: AccountStorageV1): AccountStorageV3;
+export {};
 //# sourceMappingURL=migrations.d.ts.map

package/dist/lib/storage/migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../../lib/storage/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EACX,gBAAgB,EAChB,cAAc,EAEd,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,iBAAiB;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EACd,YAAY,GACZ,SAAS,GACT,UAAU,GACV,MAAM,GACN,SAAS,GACT,QAAQ,CAAC;IACZ,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAChC,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;CACpB;AAMD,wBAAgB,aAAa,CAAC,EAAE,EAAE,gBAAgB,GAAG,gBAAgB,CAiCpE"}
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../../lib/storage/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EACX,gBAAgB,EAChB,cAAc,EAEd,MAAM,mBAAmB,CAAC;AAE3B,UAAU,iBAAiB;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EACd,YAAY,GACZ,SAAS,GACT,UAAU,GACV,MAAM,GACN,SAAS,GACT,QAAQ,CAAC;IACZ,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAChC,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;CACpB;AAMD,wBAAgB,aAAa,CAAC,EAAE,EAAE,gBAAgB,GAAG,gBAAgB,CAiCpE"}

package/dist/lib/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../lib/storage.ts"],"names":[],"mappings":"AA+BA,OAAO,EACN,KAAK,cAAc,EAGnB,KAAK,iBAAiB,EAEtB,MAAM,8BAA8B,CAAC;AAkBtC,OAAO,EAEN,KAAK,oBAAoB,EACzB,MAAM,qBAAqB,CAAC;AAc7B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACN,sBAAsB,EACtB,cAAc,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACN,qBAAqB,EACrB,iBAAiB,GACjB,MAAM,uBAAuB,CAAC;AAa/B,OAAO,KAAK,EACX,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAChB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAEN,KAAK,kBAAkB,EACvB,MAAM,4BAA4B,CAAC;AA0CpC,YAAY,EACX,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,kBAAkB,GAClB,CAAC;AAcF,KAAK,WAAW,GAAG;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAiBF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAE9D;AAuWD,wBAAgB,4BAA4B,IAAI,MAAM,CAErD;AAED,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CA4C/D;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAO9D;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAarE;AAED,wBAAsB,yBAAyB,CAC9C,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7B,OAAO,CAAC,gBAAgB,CAAC,CAe3B;AAED,wBAAsB,iBAAiB,CACtC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3B,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AA4LD,KAAK,mBAAmB,GAAG;IAC1B,wCAAwC,CAAC,EAAE,OAAO,CAAC;CACnD,CAAC;AA8IF,wBAAgB,wBAAwB,CACvC,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EAEnE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EACpE,OAAO,GAAE,mBAAwB,GAC/B,MAAM,GAAG,SAAS,CAkBpB;AAED,wBAAgB,4BAA4B,CAC3C,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EAEnE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EACpE,aAAa,SAAI,GACf,MAAM,CAOR;AAqBD;;;GAGG;AACH,wBAAgB,mBAAmB,CAClC,CAAC,SAAS;IACT,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,EACA,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAEpB;AAED,wBAAgB,0BAA0B,CACzC,CAAC,SAAS;IACT,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,EACA,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAEpB;AAoBD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACtC,IAAI,EAAE,OAAO,GACX,gBAAgB,GAAG,IAAI,CAgIzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAoBnE;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG;IACpD,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,kBAAkB,EAAE,MAAM,CAAC;CAC3B,CA8BA;AAED;;;;GAIG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAErE;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,cAAc,CAAC,CAajE;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CASvE;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAiG1E;AAibD,wBAAsB,6BAA6B,CAAC,CAAC,EACpD,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,KACjD,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAMZ;AAED,wBAAsB,uCAAuC,CAAC,CAAC,EAC9D,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CACR,cAAc,EAAE,gBAAgB,EAChC,cAAc,EAAE,uBAAuB,KACnC,OAAO,CAAC,IAAI,CAAC,EAClB,cAAc,EAAE,uBAAuB,KACnC,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAgDZ;AAED,wBAAsB,6BAA6B,CAAC,CAAC,EACpD,OAAO,EAAE,CACR,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,KACxD,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAiCZ;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAM3E;AAED;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAcnD;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAgD5E;AAyBD,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,uBAAuB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAa1D;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,MAAM,EAChB,KAAK,UAAO,EACZ,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAC3D,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAc/D"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../lib/storage.ts"],"names":[],"mappings":"AA+BA,OAAO,EACN,KAAK,cAAc,EAGnB,KAAK,iBAAiB,EAEtB,MAAM,8BAA8B,CAAC;AAkBtC,OAAO,EAEN,KAAK,oBAAoB,EACzB,MAAM,qBAAqB,CAAC;AAe7B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACN,sBAAsB,EACtB,cAAc,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACN,qBAAqB,EACrB,iBAAiB,GACjB,MAAM,uBAAuB,CAAC;AAa/B,OAAO,KAAK,EACX,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAChB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAEN,KAAK,kBAAkB,EACvB,MAAM,4BAA4B,CAAC;AA0CpC,YAAY,EACX,oBAAoB,EACpB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,EACxB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,kBAAkB,GAClB,CAAC;AAcF,KAAK,WAAW,GAAG;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAiBF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAE9D;AAuWD,wBAAgB,4BAA4B,IAAI,MAAM,CAErD;AAED,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CA4C/D;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAO9D;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAarE;AAED,wBAAsB,yBAAyB,CAC9C,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7B,OAAO,CAAC,gBAAgB,CAAC,CAe3B;AAED,wBAAsB,iBAAiB,CACtC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3B,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AA4LD,KAAK,mBAAmB,GAAG;IAC1B,wCAAwC,CAAC,EAAE,OAAO,CAAC;CACnD,CAAC;AA8IF,wBAAgB,wBAAwB,CACvC,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EAEnE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EACpE,OAAO,GAAE,mBAAwB,GAC/B,MAAM,GAAG,SAAS,CAkBpB;AAED,wBAAgB,4BAA4B,CAC3C,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EAEnE,QAAQ,EAAE,SAAS,CAAC,EAAE,EACtB,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,GAAG,cAAc,CAAC,EACpE,aAAa,SAAI,GACf,MAAM,CAOR;AAsCD;;;GAGG;AACH,wBAAgB,mBAAmB,CAClC,CAAC,SAAS;IACT,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,EACA,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAEpB;AAED,wBAAgB,0BAA0B,CACzC,CAAC,SAAS;IACT,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,EACA,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAEpB;AAoBD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACtC,IAAI,EAAE,OAAO,GACX,gBAAgB,GAAG,IAAI,CAgIzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAoBnE;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG;IACpD,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,kBAAkB,EAAE,MAAM,CAAC;CAC3B,CA8BA;AAED;;;;GAIG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAErE;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,cAAc,CAAC,CAajE;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CASvE;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAiG1E;AAyaD,wBAAsB,6BAA6B,CAAC,CAAC,EACpD,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,KACjD,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAMZ;AAED,wBAAsB,uCAAuC,CAAC,CAAC,EAC9D,OAAO,EAAE,CACR,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CACR,cAAc,EAAE,gBAAgB,EAChC,cAAc,EAAE,uBAAuB,KACnC,OAAO,CAAC,IAAI,CAAC,EAClB,cAAc,EAAE,uBAAuB,KACnC,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAgDZ;AAED,wBAAsB,6BAA6B,CAAC,CAAC,EACpD,OAAO,EAAE,CACR,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,KACxD,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAiCZ;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAM3E;AAED;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAcnD;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAgD5E;AAyBD,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,uBAAuB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAa1D;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,MAAM,EAChB,KAAK,UAAO,EACZ,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAC3D,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAc/D"}

package/dist/lib/storage.js

@@ -31,6 +31,7 @@ import { computeSha256 } from "./storage/hash.js";
 import { ensureCodexGitignoreEntry } from "./storage/gitignore.js";
 import { exportAccountsToFile, mergeImportedAccounts, readImportFile, } from "./storage/import-export.js";
 import { formatStorageErrorHint } from "./storage/error-hints.js";
+import { tempFileNonce, tempPathFor } from "./temp-path.js";
 export { StorageError } from "./errors.js";
 export { formatStorageErrorHint, toStorageError, } from "./storage/error-hints.js";
 export { getAccountIdentityKey, normalizeEmailKey, } from "./storage/identity.js";
@@ -143,7 +144,7 @@ function renameFileWithRetry(sourcePath, destinationPath) {
 }
 async function createRotatingAccountsBackup(path) {
     const candidates = getAccountsBackupRecoveryCandidates(path, ACCOUNTS_BACKUP_HISTORY_DEPTH);
-    const rotationNonce = `${Date.now()}.${Math.random().toString(36).slice(2, 8)}`;
+    const rotationNonce = tempFileNonce();
     const stagedWrites = [];
     const buildStagedPath = (targetPath, label) => `${targetPath}.rotate.${rotationNonce}.${label}.tmp`;
     try {
@@ -731,7 +732,7 @@ export function resolveAccountSelectionIndex(accounts, candidate, fallbackIndex
         return matchedIndex;
     return clampIndex(fallbackIndex, accounts.length);
 }
-function deduplicateAccountsByIdentity(accounts) {
+function deduplicateAccountsByIdentityPass(accounts) {
     const deduplicated = [];
     for (const account of accounts) {
         if (!account)
@@ -745,6 +746,21 @@ function deduplicateAccountsByIdentity(accounts) {
     }
     return deduplicated;
 }
+function deduplicateAccountsByIdentity(accounts) {
+    // A single pass is not a fixpoint: a newest-wins merge can replace a kept
+    // entry with an account that itself duplicates an earlier survivor through
+    // a different matching tier (e.g. an email-tier merge installs an account
+    // whose accountId + refresh token already match a record that carried no
+    // email). Re-run until stable; every merge strictly shrinks the array, so
+    // this terminates after at most accounts.length passes.
+    let current = deduplicateAccountsByIdentityPass(accounts);
+    for (;;) {
+        const next = deduplicateAccountsByIdentityPass(current);
+        if (next.length === current.length)
+            return next;
+        current = next;
+    }
+}
 /**
  * Removes duplicate accounts, keeping the most recently used entry for each
  * safely matched identity.
@@ -1390,26 +1406,17 @@ async function saveAccountsUnlocked(storage) {
         },
         writeTemp: (tempPath, content) => withFileOperationRetry(() => fs.writeFile(tempPath, content, { encoding: "utf-8", mode: 0o600 })),
         statTemp: (tempPath) => fs.stat(tempPath),
-        renameTempToPath: async (tempPath) => {
-            let lastError = null;
-            for (let attempt = 0; attempt < 5; attempt++) {
-                try {
-                    await fs.rename(tempPath, path);
-                    return;
-                }
-                catch (renameError) {
-                    const code = renameError.code;
-                    if (code === "EPERM" || code === "EBUSY") {
-                        lastError = renameError;
-                        await new Promise((r) => setTimeout(r, 10 * 2 ** attempt));
-                        continue;
-                    }
-                    throw renameError;
-                }
-            }
-            if (lastError)
-                throw lastError;
-        },
+        renameTempToPath: (tempPath) => 
+        // Windows can hold the destination briefly (AV/indexer); retry only the
+        // lock codes rename actually surfaces there, on the original
+        // 10ms-doubling schedule. (The hand-rolled loop this replaces also
+        // slept once more after the final failure; withRetry rethrows
+        // immediately instead.)
+        withRetry(() => fs.rename(tempPath, path), {
+            maxAttempts: 5,
+            backoffMs: (attempt) => 10 * 2 ** (attempt - 1),
+            retryableCodes: ["EPERM", "EBUSY"],
+        }),
         cleanupResetMarker: async () => {
             try {
                 await fs.unlink(resetMarkerPath);
@@ -1453,7 +1460,7 @@ async function saveAccountsUnlocked(storage) {
             return new StorageError(`Failed to save accounts: ${err?.message || "Unknown error"}`, code, path, hint, err instanceof Error ? err : undefined);
         },
         backupPath: getAccountsBackupPath(path),
-        createTempPath: () => `${path}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`,
+        createTempPath: () => tempPathFor(path),
     });
 }
 function cloneFlaggedStorageForPersistence(storage) {

package/dist/lib/temp-path.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Unpredictable nonce for temp/staging file names: `<pid>.<epochMs>.<hex8>`.
+ *
+ * The random component comes from `crypto.randomBytes` instead of
+ * `Math.random()`. `Math.random()` output is predictable once its internal
+ * state is known, so a local attacker who can observe one staged path could
+ * predict the next one and pre-create (or symlink) it before the atomic
+ * write-then-rename lands. An 8-hex-char CSPRNG suffix removes that
+ * predictability while keeping names short and `endsWith(".tmp")`-sweepable.
+ *
+ * Assumes the process CSPRNG is available: `randomBytes` throws on entropy
+ * failure (e.g. misconfigured FIPS builds), which is the correct outcome here —
+ * the same crypto primitives back the OAuth flow itself, so staging a token
+ * file with weaker randomness instead would be strictly worse.
+ */
+export declare function tempFileNonce(): string;
+/**
+ * Staging path for an atomic write-then-rename of `targetPath`:
+ * `<targetPath>.<pid>.<epochMs>.<hex8>.tmp`.
+ *
+ * Keeps the trailing `.tmp` extension so existing stale-artifact sweepers
+ * (`entry.name.endsWith(".tmp")` in lib/storage.ts, lib/runtime-paths.ts,
+ * lib/oc-chatgpt-target-detection.ts) continue to skip/collect staged files.
+ */
+export declare function tempPathFor(targetPath: string): string;
+//# sourceMappingURL=temp-path.d.ts.map

package/dist/lib/temp-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"temp-path.d.ts","sourceRoot":"","sources":["../../lib/temp-path.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEtD"}

package/dist/lib/temp-path.js

@@ -0,0 +1,30 @@
+import { randomBytes } from "node:crypto";
+/**
+ * Unpredictable nonce for temp/staging file names: `<pid>.<epochMs>.<hex8>`.
+ *
+ * The random component comes from `crypto.randomBytes` instead of
+ * `Math.random()`. `Math.random()` output is predictable once its internal
+ * state is known, so a local attacker who can observe one staged path could
+ * predict the next one and pre-create (or symlink) it before the atomic
+ * write-then-rename lands. An 8-hex-char CSPRNG suffix removes that
+ * predictability while keeping names short and `endsWith(".tmp")`-sweepable.
+ *
+ * Assumes the process CSPRNG is available: `randomBytes` throws on entropy
+ * failure (e.g. misconfigured FIPS builds), which is the correct outcome here —
+ * the same crypto primitives back the OAuth flow itself, so staging a token
+ * file with weaker randomness instead would be strictly worse.
+ */
+export function tempFileNonce() {
+    return `${process.pid}.${Date.now()}.${randomBytes(4).toString("hex")}`;
+}
+/**
+ * Staging path for an atomic write-then-rename of `targetPath`:
+ * `<targetPath>.<pid>.<epochMs>.<hex8>.tmp`.
+ *
+ * Keeps the trailing `.tmp` extension so existing stale-artifact sweepers
+ * (`entry.name.endsWith(".tmp")` in lib/storage.ts, lib/runtime-paths.ts,
+ * lib/oc-chatgpt-target-detection.ts) continue to skip/collect staged files.
+ */
+export function tempPathFor(targetPath) {
+    return `${targetPath}.${tempFileNonce()}.tmp`;
+}

package/dist/lib/ui/theme.d.ts

@@ -5,14 +5,14 @@ export type UiColorProfile = "ansi16" | "ansi256" | "truecolor";
 export type UiGlyphMode = "ascii" | "unicode" | "auto";
 export type UiPalette = "green" | "blue";
 export type UiAccent = "green" | "cyan" | "blue" | "yellow";
-export interface UiGlyphSet {
+interface UiGlyphSet {
     selected: string;
     unselected: string;
     bullet: string;
     check: string;
     cross: string;
 }
-export interface UiThemeColors {
+interface UiThemeColors {
     reset: string;
     dim: string;
     muted: string;
@@ -66,4 +66,5 @@ export declare function createUiTheme(options?: {
     accent?: UiAccent;
     disableColor?: boolean;
 }): UiTheme;
+export {};
 //# sourceMappingURL=theme.d.ts.map

package/dist/lib/ui/theme.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"theme.d.ts","sourceRoot":"","sources":["../../../lib/ui/theme.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;AAChE,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AACvD,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,MAAM,CAAC;AACzC,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE5D,MAAM,WAAW,UAAU;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,OAAO;IACvB,OAAO,EAAE,cAAc,CAAC;IACxB,SAAS,EAAE,WAAW,CAAC;IACvB,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,aAAa,CAAC;CACtB;AAiKD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CACjC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,KAAK,GAAE,OAAwC,GAC7C,OAAO,CAMT;AAWD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,OAAO,CAAC,EAAE;IACvC,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,OAAO,CAgBV"}
+{"version":3,"file":"theme.d.ts","sourceRoot":"","sources":["../../../lib/ui/theme.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;AAChE,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AACvD,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,MAAM,CAAC;AACzC,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE5D,UAAU,UAAU;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACd;AAED,UAAU,aAAa;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,OAAO;IACvB,OAAO,EAAE,cAAc,CAAC;IACxB,SAAS,EAAE,WAAW,CAAC;IACvB,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,aAAa,CAAC;CACtB;AAiKD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CACjC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,KAAK,GAAE,OAAwC,GAC7C,OAAO,CAMT;AAWD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,OAAO,CAAC,EAAE;IACvC,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,OAAO,CAgBV"}

package/dist/lib/unified-settings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unified-settings.d.ts","sourceRoot":"","sources":["../../lib/unified-settings.ts"],"names":[],"mappings":"AAcA,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1C,eAAO,MAAM,wBAAwB,EAAG,CAAU,CAAC;AA2bnD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,IAAI,UAAU,GAAG,IAAI,CAQ/D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CAAC,YAAY,EAAE,UAAU,GAAG,IAAI,CAO1E;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAAC,YAAY,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBrF;AAED;;;;;;;;GAQG;AACH,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAQ/E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,4BAA4B,CACjD,wBAAwB,EAAE,UAAU,GAClC,OAAO,CAAC,IAAI,CAAC,CAsBf"}
+{"version":3,"file":"unified-settings.d.ts","sourceRoot":"","sources":["../../lib/unified-settings.ts"],"names":[],"mappings":"AAeA,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1C,eAAO,MAAM,wBAAwB,EAAG,CAAU,CAAC;AA2bnD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,IAAI,UAAU,GAAG,IAAI,CAQ/D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CAAC,YAAY,EAAE,UAAU,GAAG,IAAI,CAO1E;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAAC,YAAY,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBrF;AAED;;;;;;;;GAQG;AACH,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAQ/E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,4BAA4B,CACjD,wBAAwB,EAAE,UAAU,GAClC,OAAO,CAAC,IAAI,CAAC,CAsBf"}

package/dist/lib/unified-settings.js

@@ -2,6 +2,7 @@ import { copyFileSync, existsSync, mkdirSync, renameSync, readFileSync, unlinkSy
 import { join } from "node:path";
 import { getCodexMultiAuthDir } from "./runtime-paths.js";
 import { sleep } from "./utils.js";
+import { tempPathFor } from "./temp-path.js";
 export const UNIFIED_SETTINGS_VERSION = 1;
 const UNIFIED_SETTINGS_PATH = join(getCodexMultiAuthDir(), "settings.json");
 const UNIFIED_SETTINGS_BACKUP_PATH = `${UNIFIED_SETTINGS_PATH}.bak`;
@@ -341,7 +342,7 @@ async function writeSettingsRecordAsync(record, options) {
     await fs.mkdir(getCodexMultiAuthDir(), { recursive: true });
     const payload = normalizeForWrite(record);
     const data = `${JSON.stringify(payload, null, 2)}\n`;
-    const tempPath = `${UNIFIED_SETTINGS_PATH}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+    const tempPath = tempPathFor(UNIFIED_SETTINGS_PATH);
     await trySnapshotUnifiedSettingsBackupAsync({
         skipBecauseBackupRead: options?.skipBackupSnapshot,
     });

package/dist/lib/update-notice.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update-notice.d.ts","sourceRoot":"","sources":["../../lib/update-notice.ts"],"names":[],"mappings":"AA0CA,MAAM,WAAW,iBAAiB;IACjC,SAAS,EAAE,OAAO,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;CACtB;AA+DD,wBAAgB,+BAA+B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAmBzE;AA0JD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAM1E;AAED,wBAAsB,eAAe,CACpC,KAAK,UAAQ,EACb,cAAc,SAA0B,GACtC,OAAO,CAAC,iBAAiB,CAAC,CAwC5B;AAED,wBAAsB,cAAc,CACnC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,GACzE,OAAO,CAAC,IAAI,CAAC,CAoBf;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAUvC"}
+{"version":3,"file":"update-notice.d.ts","sourceRoot":"","sources":["../../lib/update-notice.ts"],"names":[],"mappings":"AA2CA,MAAM,WAAW,iBAAiB;IACjC,SAAS,EAAE,OAAO,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;CACtB;AA+DD,wBAAgB,+BAA+B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAmBzE;AA0JD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAM1E;AAED,wBAAsB,eAAe,CACpC,KAAK,UAAQ,EACb,cAAc,SAA0B,GACtC,OAAO,CAAC,iBAAiB,CAAC,CAwC5B;AAED,wBAAsB,cAAc,CACnC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,GACzE,OAAO,CAAC,IAAI,CAAC,CAoBf;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAUvC"}

package/dist/lib/update-notice.js

@@ -3,6 +3,7 @@ import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createLogger } from "./logger.js";
 import { getCodexCacheDir } from "./runtime-paths.js";
+import { tempPathFor } from "./temp-path.js";
 const log = createLogger("update-notice");
 const PACKAGE_NAME = "codex-multi-auth";
 const NPM_REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`;
@@ -34,7 +35,7 @@ async function writeCacheContents(serialized) {
         if (!existsSync(CACHE_DIR)) {
             mkdirSync(CACHE_DIR, { recursive: true });
         }
-        tempPath = `${CACHE_FILE}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+        tempPath = tempPathFor(CACHE_FILE);
         let lastError = null;
         for (let attempt = 0; attempt < 4; attempt++) {
             try {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "codex-multi-auth",
-	"version": "2.3.0-beta.2",
+	"version": "2.3.0-beta.3",
 	"description": "Codex CLI multi-account OAuth manager with account switching, health checks, runtime rotation, diagnostics, and recovery tools for @openai/codex",
 	"main": "./dist/index.js",
 	"types": "./dist/index.d.ts",
@@ -156,7 +156,6 @@
 		"node": ">=18.17.0"
 	},
 	"devDependencies": {
-		"@fast-check/vitest": "^0.2.4",
 		"@types/node": "^20.19.42",
 		"@typescript-eslint/eslint-plugin": "^8.56.0",
 		"@typescript-eslint/parser": "^8.56.0",