dsh-coding-subscription-oauth 0.6.4 → 0.7.0

package/lib/bin.js

@@ -25620,7 +25620,7 @@ import { readFile, stat } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 
-// node_modules/.pnpm/dsh-coding-oauth-core@0.1.1/node_modules/dsh-coding-oauth-core/lib/proxy.js
+// node_modules/.pnpm/dsh-coding-oauth-core@0.1.2_@deepseek-ai+dsh-llm@0.1.1-rc.2_@deepseek-ai+cordis@4.0.1_@_82bbdc1424db474a5d3f648945c0fadb/node_modules/dsh-coding-oauth-core/lib/proxy.js
 var import_undici = __toESM(require_undici(), 1);
 var DEFAULT_PROXIED_HOSTS = [
   "auth.x.ai",
@@ -25749,7 +25749,7 @@ function codingOAuthProxyUnreachableHint() {
   return codingOAuthProxyInEffect() === void 0 ? "" : "; check that CODING_OAUTH_PROXY is reachable";
 }
 
-// node_modules/.pnpm/dsh-coding-oauth-core@0.1.1/node_modules/dsh-coding-oauth-core/lib/ids.js
+// node_modules/.pnpm/dsh-coding-oauth-core@0.1.2_@deepseek-ai+dsh-llm@0.1.1-rc.2_@deepseek-ai+cordis@4.0.1_@_82bbdc1424db474a5d3f648945c0fadb/node_modules/dsh-coding-oauth-core/lib/ids.js
 var XAI_PI_PROVIDER = "xai";
 var CODEX_PI_PROVIDER = "openai-codex";
 var KIMI_PI_PROVIDER = "kimi-coding";
@@ -25768,7 +25768,7 @@ var KIMI_CODE_OAUTH_MODELS_CACHE_FILENAME = ".kimi-code-oauth-models.json";
 var CLAUDE_CODE_OAUTH_MODELS_CACHE_FILENAME = ".claude-code-oauth-models.json";
 var DEFAULT_GROK_BUILD_MODEL = "grok-4.6";
 
-// node_modules/.pnpm/dsh-coding-oauth-core@0.1.1/node_modules/dsh-coding-oauth-core/lib/state-contract.js
+// node_modules/.pnpm/dsh-coding-oauth-core@0.1.2_@deepseek-ai+dsh-llm@0.1.1-rc.2_@deepseek-ai+cordis@4.0.1_@_82bbdc1424db474a5d3f648945c0fadb/node_modules/dsh-coding-oauth-core/lib/state-contract.js
 var GROK_BUILD_AUTH_STATUS_PATH = "/plugins/dsh-grok-build/auth/status";
 var GROK_BUILD_AUTH_LOGIN_PATH = "/plugins/dsh-grok-build/auth/login";
 var GROK_BUILD_AUTH_LOGIN_CODE_PATH = "/plugins/dsh-grok-build/auth/login/code";
@@ -25818,6 +25818,17 @@ var CODING_OAUTH_MANAGEMENT_PATHS = Object.freeze([
   GATEWAY_ROTATE_PATH
 ]);
 
+// node_modules/.pnpm/dsh-coding-oauth-core@0.1.2_@deepseek-ai+dsh-llm@0.1.1-rc.2_@deepseek-ai+cordis@4.0.1_@_82bbdc1424db474a5d3f648945c0fadb/node_modules/dsh-coding-oauth-core/lib/http-json.js
+var JSON_BODY_LIMIT_BYTES = 64 * 1024;
+
+// node_modules/.pnpm/dsh-coding-oauth-core@0.1.2_@deepseek-ai+dsh-llm@0.1.1-rc.2_@deepseek-ai+cordis@4.0.1_@_82bbdc1424db474a5d3f648945c0fadb/node_modules/dsh-coding-oauth-core/lib/kimi-errors.js
+import { CONTEXT_WINDOW_EXCEEDED_CODE, isContextWindowExceededError } from "@deepseek-ai/dsh-llm";
+
+// src/ids.ts
+var CODING_OAUTH_API_BASE = "/plugins/dsh-grok-build";
+var CODING_OAUTH_ACCOUNTS_SET_ACTIVE_PATH = `${CODING_OAUTH_API_BASE}/oauth/accounts/set-active`;
+var CODING_OAUTH_ACCOUNTS_REMOVE_PATH = `${CODING_OAUTH_API_BASE}/oauth/accounts/remove`;
+
 // src/grok-import.ts
 var DEFAULT_TOKEN_LIFETIME_MS = 60 * 60 * 1e3;
 function isENOENT(error) {
@@ -25919,6 +25930,7 @@ async function importGrokAuth(store, filename = grokAuthPath()) {
 }
 
 // src/store.ts
+import { randomBytes } from "node:crypto";
 import { mkdir, rm } from "node:fs/promises";
 import { dirname, join as join3, resolve as resolve3 } from "node:path";
 import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
@@ -26078,25 +26090,17 @@ function currentUid() {
 }
 
 // src/store.ts
-var AUTH_FORMAT_VERSION = 1;
-function parseDocument(text, filename, label) {
-  let value;
-  try {
-    value = JSON.parse(text);
-  } catch {
-    throw new Error(`${label}: ${filename} is not valid JSON`);
-  }
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    throw new Error(`${label}: ${filename} must contain an object`);
-  }
-  const document = value;
-  if (document["version"] !== AUTH_FORMAT_VERSION) {
-    throw new Error(`${label}: ${filename} has unsupported auth format version ${String(document["version"])}`);
-  }
-  if (Object.keys(document).some((key) => key !== "version" && key !== "credential")) {
-    throw new Error(`${label}: ${filename} contains an unknown top-level field`);
-  }
-  const raw = document["credential"];
+var AUTH_FORMAT_VERSION = 2;
+var AUTH_FORMAT_VERSION_V1 = 1;
+var OAUTH_MAX_ACCOUNTS = 8;
+var MAX_ACCOUNTS = OAUTH_MAX_ACCOUNTS;
+var LEGACY_ACCOUNT_ID = "legacy";
+var ACCOUNT_ID_PATTERN = /^[A-Za-z0-9._:@+-]+$/u;
+var UNCHANGED = /* @__PURE__ */ Symbol("unchanged");
+function isValidAccountId(value) {
+  return typeof value === "string" && value.length > 0 && value.length <= 128 && ACCOUNT_ID_PATTERN.test(value);
+}
+function parseOAuthCredential(raw, filename, label) {
   if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
     throw new Error(`${label}: ${filename} credential must be an object`);
   }
@@ -26105,23 +26109,178 @@ function parseDocument(text, filename, label) {
   if (Object.keys(credential).some((key) => !allowed.has(key))) {
     throw new Error(`${label}: ${filename} credential contains an unknown field`);
   }
-  if (credential["type"] !== "oauth") throw new Error(`${label}: ${filename} credential type must be oauth`);
+  if (credential.type !== "oauth") throw new Error(`${label}: ${filename} credential type must be oauth`);
   for (const key of ["access", "refresh"]) {
     if (typeof credential[key] !== "string" || credential[key].length === 0) {
       throw new Error(`${label}: ${filename} credential ${key} must be a non-empty string`);
     }
   }
-  if (credential["accountId"] !== void 0 && (typeof credential["accountId"] !== "string" || credential["accountId"].length === 0)) {
+  if (credential.accountId !== void 0 && (typeof credential.accountId !== "string" || credential.accountId.length === 0)) {
     throw new Error(`${label}: ${filename} credential accountId must be a non-empty string when present`);
   }
-  if (typeof credential["expires"] !== "number" || !Number.isFinite(credential["expires"]) || credential["expires"] <= 0) {
+  if (typeof credential.expires !== "number" || !Number.isFinite(credential.expires) || credential.expires <= 0) {
     throw new Error(`${label}: ${filename} credential expires must be a positive finite number`);
   }
-  return { version: AUTH_FORMAT_VERSION, credential };
+  return credential;
+}
+function parseAccountRecord(raw, filename, label, index) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw new Error(`${label}: ${filename} accounts[${String(index)}] must be an object`);
+  }
+  const record = raw;
+  const allowed = /* @__PURE__ */ new Set(["id", "label", "credential", "createdAt"]);
+  if (Object.keys(record).some((key) => !allowed.has(key))) {
+    throw new Error(`${label}: ${filename} accounts[${String(index)}] contains an unknown field`);
+  }
+  if (!isValidAccountId(record.id)) {
+    throw new Error(`${label}: ${filename} accounts[${String(index)}].id is not a valid account id`);
+  }
+  if (record.label !== void 0 && (typeof record.label !== "string" || record.label.length === 0)) {
+    throw new Error(`${label}: ${filename} accounts[${String(index)}].label must be a non-empty string when present`);
+  }
+  if (typeof record.createdAt !== "number" || !Number.isFinite(record.createdAt) || record.createdAt <= 0) {
+    throw new Error(`${label}: ${filename} accounts[${String(index)}].createdAt must be a positive finite number`);
+  }
+  const credential = parseOAuthCredential(record.credential, filename, label);
+  return {
+    id: record.id,
+    ...record.label === void 0 ? {} : { label: record.label },
+    credential,
+    createdAt: record.createdAt
+  };
+}
+function parseDocumentV2(document, filename, label) {
+  if (Object.keys(document).some((key) => key !== "version" && key !== "activeAccountId" && key !== "accounts")) {
+    throw new Error(`${label}: ${filename} contains an unknown top-level field`);
+  }
+  if (!isValidAccountId(document.activeAccountId)) {
+    throw new Error(`${label}: ${filename} activeAccountId is not a valid account id`);
+  }
+  if (!Array.isArray(document.accounts)) {
+    throw new Error(`${label}: ${filename} accounts must be an array`);
+  }
+  if (document.accounts.length < 1 || document.accounts.length > MAX_ACCOUNTS) {
+    throw new Error(`${label}: ${filename} accounts must contain between 1 and ${String(MAX_ACCOUNTS)} entries`);
+  }
+  const accounts = document.accounts.map((entry, index) => parseAccountRecord(entry, filename, label, index));
+  const ids = /* @__PURE__ */ new Set();
+  for (const account of accounts) {
+    if (ids.has(account.id)) {
+      throw new Error(`${label}: ${filename} accounts contains a duplicate id`);
+    }
+    ids.add(account.id);
+  }
+  if (!ids.has(document.activeAccountId)) {
+    throw new Error(`${label}: ${filename} activeAccountId does not match any account`);
+  }
+  return {
+    version: AUTH_FORMAT_VERSION,
+    activeAccountId: document.activeAccountId,
+    accounts
+  };
+}
+function parseDocumentV1(document, filename, label) {
+  if (Object.keys(document).some((key) => key !== "version" && key !== "credential")) {
+    throw new Error(`${label}: ${filename} contains an unknown top-level field`);
+  }
+  return parseOAuthCredential(document.credential, filename, label);
+}
+function parseDocument(text, filename, label) {
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    throw new Error(`${label}: ${filename} is not valid JSON`);
+  }
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new Error(`${label}: ${filename} must contain an object`);
+  }
+  const document = value;
+  if (document.version === AUTH_FORMAT_VERSION_V1) {
+    return { document: migrateV1Credential(parseDocumentV1(document, filename, label)), migratedFromV1: true };
+  }
+  if (document.version === AUTH_FORMAT_VERSION) {
+    return { document: parseDocumentV2(document, filename, label), migratedFromV1: false };
+  }
+  throw new Error(`${label}: ${filename} has unsupported auth format version ${String(document.version)}`);
+}
+function migrateV1Credential(credential) {
+  const accountIdField = credential.accountId;
+  const id = isValidAccountId(accountIdField) ? accountIdField : LEGACY_ACCOUNT_ID;
+  return {
+    version: AUTH_FORMAT_VERSION,
+    activeAccountId: id,
+    accounts: [
+      {
+        id,
+        credential: cloneCredential(credential),
+        createdAt: Date.now()
+      }
+    ]
+  };
 }
 function cloneCredential(credential) {
   return structuredClone(credential);
 }
+function cloneDocument(document) {
+  return structuredClone(document);
+}
+function activeCredential(document) {
+  const active = document.accounts.find((account) => account.id === document.activeAccountId);
+  if (active === void 0) {
+    throw new Error("active account missing from document");
+  }
+  return cloneCredential(active.credential);
+}
+function resolveAccountIdForCredential(credential) {
+  const accountIdField = credential.accountId;
+  if (isValidAccountId(accountIdField)) return accountIdField;
+  return `acct-${randomBytes(8).toString("hex")}`;
+}
+function documentFromCredential(credential) {
+  const id = resolveAccountIdForCredential(credential);
+  return {
+    version: AUTH_FORMAT_VERSION,
+    activeAccountId: id,
+    accounts: [
+      {
+        id,
+        credential: cloneCredential(credential),
+        createdAt: Date.now()
+      }
+    ]
+  };
+}
+function withUpdatedActiveCredential(document, credential) {
+  const accounts = document.accounts.map(
+    (account) => account.id === document.activeAccountId ? { ...account, credential: cloneCredential(credential) } : cloneAccount(account)
+  );
+  return {
+    version: AUTH_FORMAT_VERSION,
+    activeAccountId: document.activeAccountId,
+    accounts
+  };
+}
+function cloneAccount(account) {
+  return {
+    id: account.id,
+    ...account.label === void 0 ? {} : { label: account.label },
+    credential: cloneCredential(account.credential),
+    createdAt: account.createdAt
+  };
+}
+function summarizeAccount(account) {
+  const accountIdField = account.credential.accountId;
+  return {
+    id: account.id,
+    ...account.label === void 0 ? {} : { label: account.label },
+    expires: account.credential.expires,
+    ...typeof accountIdField === "string" && accountIdField.length > 0 ? { accountId: accountIdField } : {}
+  };
+}
+function validatedDocument(document, filename, label) {
+  return parseDocument(JSON.stringify(document), filename, label).document;
+}
 function oauthCredentialPath(basename, dshHome) {
   if (basename.length === 0 || basename.length > 128 || basename === "." || basename === ".." || !/^\.?[A-Za-z0-9][A-Za-z0-9._-]*$/u.test(basename)) {
     throw new TypeError("OAuth credential basename must be a safe local filename");
@@ -26140,6 +26299,7 @@ var OAuthCredentialFileStore = class {
   providerId;
   label;
   filename;
+  loginPersist;
   async readCurrent() {
     return this.loadCurrent({ allowUnreadable: false });
   }
@@ -26149,6 +26309,10 @@ var OAuthCredentialFileStore = class {
    * Unsafe/symlink/wrong-owner/too-large files still throw.
    */
   async loadCurrent(options) {
+    const loaded = await this.loadDocument({ allowUnreadable: options.allowUnreadable, persistMigration: false });
+    return loaded === void 0 ? void 0 : activeCredential(loaded.document);
+  }
+  async loadDocument(options) {
     let text;
     try {
       text = (await readHardenedOAuthSourceFile(this.filename)).text;
@@ -26160,7 +26324,11 @@ var OAuthCredentialFileStore = class {
       throw error;
     }
     try {
-      return cloneCredential(parseDocument(text, this.filename, this.label).credential);
+      const parsed = parseDocument(text, this.filename, this.label);
+      if (options.persistMigration && parsed.migratedFromV1) {
+        await this.writeDocument(parsed.document);
+      }
+      return parsed;
     } catch (error) {
       if (options.allowUnreadable) return void 0;
       throw error;
@@ -26178,6 +26346,91 @@ var OAuthCredentialFileStore = class {
       throw error;
     }
   }
+  async writeDocument(document) {
+    const validated = validatedDocument(document, this.filename, this.label);
+    await this.assertDestinationReplaceable();
+    await writeFileAtomic(this.filename, `${JSON.stringify(validated, null, 2)}
+`, {
+      mode: 384,
+      dirMode: 448
+    });
+    return cloneDocument(validated);
+  }
+  nextDocumentAfterLogin(current, credential, options) {
+    const parsed = parseOAuthCredential(credential, this.filename, this.label);
+    if (options.mode === "overwrite-active") {
+      if (current === void 0) return documentFromCredential(parsed);
+      if (options.confirmOverwrite !== true) {
+        throw new Error(`${this.label}: confirmOverwrite is required to replace the active account`);
+      }
+      return withUpdatedActiveCredential(current, parsed);
+    }
+    const id = resolveAccountIdForCredential(parsed);
+    if (current === void 0) {
+      return {
+        version: AUTH_FORMAT_VERSION,
+        activeAccountId: id,
+        accounts: [
+          {
+            id,
+            credential: cloneCredential(parsed),
+            createdAt: Date.now()
+          }
+        ]
+      };
+    }
+    const existingIndex = current.accounts.findIndex((account) => account.id === id);
+    if (existingIndex < 0 && current.accounts.length >= MAX_ACCOUNTS) {
+      throw new Error(`${this.label}: at most ${String(MAX_ACCOUNTS)} accounts may be stored`);
+    }
+    const accounts = current.accounts.map(cloneAccount);
+    if (existingIndex >= 0) {
+      const existing = accounts[existingIndex];
+      if (existing === void 0) {
+        throw new Error(`${this.label}: account "${id}" is not stored`);
+      }
+      accounts[existingIndex] = {
+        id,
+        ...existing.label === void 0 ? {} : { label: existing.label },
+        credential: cloneCredential(parsed),
+        createdAt: existing.createdAt
+      };
+    } else {
+      accounts.push({
+        id,
+        credential: cloneCredential(parsed),
+        createdAt: Date.now()
+      });
+    }
+    return {
+      version: AUTH_FORMAT_VERSION,
+      activeAccountId: id,
+      accounts
+    };
+  }
+  async mutateDocument(options, fn) {
+    await mkdir(dirname(this.filename), { recursive: true, mode: 448 });
+    return withFileLock(this.filename, async () => {
+      const loaded = await this.loadDocument({
+        allowUnreadable: options.allowUnreadable,
+        persistMigration: false
+      });
+      const current = loaded === void 0 ? void 0 : loaded.document;
+      const migratedFromV1 = loaded?.migratedFromV1 === true;
+      const next = await fn(current === void 0 ? void 0 : cloneDocument(current));
+      if (next === UNCHANGED) {
+        if (migratedFromV1 && current !== void 0) {
+          return this.writeDocument(current);
+        }
+        return current === void 0 ? void 0 : cloneDocument(current);
+      }
+      if (next === void 0) {
+        await rm(this.filename, { force: true });
+        return void 0;
+      }
+      return this.writeDocument(next);
+    });
+  }
   async read(providerId) {
     return providerId === this.providerId ? this.readCurrent() : void 0;
   }
@@ -26188,27 +26441,42 @@ var OAuthCredentialFileStore = class {
     if (providerId !== this.providerId) {
       throw new Error(`${this.label}: credential store does not own provider "${providerId}"`);
     }
-    await mkdir(dirname(this.filename), { recursive: true, mode: 448 });
-    return withFileLock(this.filename, async () => {
-      const current = await this.loadCurrent({ allowUnreadable: true });
-      const candidate = await fn(current);
-      if (candidate === void 0) return current;
-      const document = parseDocument(
-        JSON.stringify({
-          version: AUTH_FORMAT_VERSION,
-          credential: candidate
-        }),
-        this.filename,
-        this.label
-      );
-      await this.assertDestinationReplaceable();
-      await writeFileAtomic(this.filename, `${JSON.stringify(document, null, 2)}
-`, {
-        mode: 384,
-        dirMode: 448
-      });
-      return cloneCredential(document.credential);
+    const document = await this.mutateDocument({ allowUnreadable: true }, async (current) => {
+      const active = current === void 0 ? void 0 : activeCredential(current);
+      const candidate = await fn(active);
+      if (candidate === void 0) return UNCHANGED;
+      if (candidate.type !== "oauth") {
+        throw new Error(`${this.label}: ${this.filename} credential type must be oauth`);
+      }
+      if (this.loginPersist !== void 0) {
+        return this.nextDocumentAfterLogin(current, candidate, this.loginPersist);
+      }
+      if (current === void 0) return documentFromCredential(candidate);
+      return withUpdatedActiveCredential(current, candidate);
     });
+    return document === void 0 ? void 0 : activeCredential(document);
+  }
+  /**
+   * Redirect `modify` writes (pi-ai `models.login`) through multi-account upsert
+   * semantics for the duration of `fn`.
+   */
+  async runLoginPersist(options, fn) {
+    if (this.loginPersist !== void 0) {
+      throw new Error(`${this.label}: login persist already in progress`);
+    }
+    this.loginPersist = options;
+    try {
+      return await fn();
+    } finally {
+      this.loginPersist = void 0;
+    }
+  }
+  /** Persist a login/import credential without going through pi-ai `modify`. */
+  async persistLoginCredential(credential, options) {
+    await this.mutateDocument(
+      { allowUnreadable: true },
+      async (current) => this.nextDocumentAfterLogin(current, credential, options)
+    );
   }
   /**
    * Force the next `getAuth()` to refresh by backdating `expires` into the past.
@@ -26233,6 +26501,163 @@ var OAuthCredentialFileStore = class {
     await mkdir(dirname(this.filename), { recursive: true, mode: 448 });
     await withFileLock(this.filename, () => rm(this.filename, { force: true }));
   }
+  /** Read-only account list for Settings / API. Never includes tokens. */
+  async listAccounts() {
+    const document = await this.mutateDocument({ allowUnreadable: false }, async (current) => {
+      if (current === void 0) return UNCHANGED;
+      return UNCHANGED;
+    });
+    if (document === void 0) return [];
+    return document.accounts.map(summarizeAccount);
+  }
+  async getActiveAccountId() {
+    const document = await this.mutateDocument({ allowUnreadable: false }, async (current) => {
+      if (current === void 0) return UNCHANGED;
+      return UNCHANGED;
+    });
+    return document?.activeAccountId;
+  }
+  /**
+   * Read one account's credential without changing activeAccountId.
+   * Used by the optional quota-aware pool proxy for sticky per-request routing.
+   */
+  async readAccount(id) {
+    if (!isValidAccountId(id)) return void 0;
+    const document = await this.mutateDocument({ allowUnreadable: false }, async (current) => {
+      if (current === void 0) return UNCHANGED;
+      return UNCHANGED;
+    });
+    const account = document?.accounts.find((entry) => entry.id === id);
+    return account === void 0 ? void 0 : cloneCredential(account.credential);
+  }
+  /**
+   * Serialized refresh/write for one account id. Does not move activeAccountId.
+   * Returns undefined when the account is absent (caller treats as missing credential).
+   */
+  async modifyAccount(id, fn) {
+    if (!isValidAccountId(id)) {
+      throw new TypeError(`${this.label}: account id is invalid`);
+    }
+    const document = await this.mutateDocument({ allowUnreadable: true }, async (current) => {
+      if (current === void 0) return UNCHANGED;
+      const index = current.accounts.findIndex((account2) => account2.id === id);
+      if (index < 0) return UNCHANGED;
+      const existing = current.accounts[index];
+      if (existing === void 0) return UNCHANGED;
+      const candidate = await fn(cloneCredential(existing.credential));
+      if (candidate === void 0) return UNCHANGED;
+      if (candidate.type !== "oauth") {
+        throw new Error(`${this.label}: ${this.filename} credential type must be oauth`);
+      }
+      const accounts = current.accounts.map(cloneAccount);
+      const target = accounts[index];
+      if (target === void 0) return UNCHANGED;
+      accounts[index] = {
+        ...target,
+        credential: cloneCredential(candidate)
+      };
+      return {
+        version: AUTH_FORMAT_VERSION,
+        activeAccountId: current.activeAccountId,
+        accounts
+      };
+    });
+    if (document === void 0) return void 0;
+    const account = document.accounts.find((entry) => entry.id === id);
+    return account === void 0 ? void 0 : cloneCredential(account.credential);
+  }
+  async setActiveAccount(id) {
+    if (!isValidAccountId(id)) {
+      throw new TypeError(`${this.label}: account id is invalid`);
+    }
+    await this.mutateDocument({ allowUnreadable: false }, async (current) => {
+      if (current === void 0) {
+        throw new Error(`${this.label}: no credential accounts are stored`);
+      }
+      if (!current.accounts.some((account) => account.id === id)) {
+        throw new Error(`${this.label}: account "${id}" is not stored`);
+      }
+      if (current.activeAccountId === id) return UNCHANGED;
+      return {
+        version: AUTH_FORMAT_VERSION,
+        activeAccountId: id,
+        accounts: current.accounts.map(cloneAccount)
+      };
+    });
+  }
+  async upsertAccount(input) {
+    if (!isValidAccountId(input.id)) {
+      throw new TypeError(`${this.label}: account id is invalid`);
+    }
+    if (input.label !== void 0 && (typeof input.label !== "string" || input.label.length === 0)) {
+      throw new TypeError(`${this.label}: account label must be a non-empty string when present`);
+    }
+    const credential = parseOAuthCredential(input.credential, this.filename, this.label);
+    await this.mutateDocument({ allowUnreadable: false }, async (current) => {
+      if (current === void 0) {
+        return {
+          version: AUTH_FORMAT_VERSION,
+          activeAccountId: input.id,
+          accounts: [
+            {
+              id: input.id,
+              ...input.label === void 0 ? {} : { label: input.label },
+              credential: cloneCredential(credential),
+              createdAt: Date.now()
+            }
+          ]
+        };
+      }
+      const existingIndex = current.accounts.findIndex((account) => account.id === input.id);
+      if (existingIndex < 0 && current.accounts.length >= MAX_ACCOUNTS) {
+        throw new Error(`${this.label}: at most ${String(MAX_ACCOUNTS)} accounts may be stored`);
+      }
+      const accounts = current.accounts.map(cloneAccount);
+      if (existingIndex >= 0) {
+        const existing = accounts[existingIndex];
+        if (existing === void 0) {
+          throw new Error(`${this.label}: account "${input.id}" is not stored`);
+        }
+        accounts[existingIndex] = {
+          id: input.id,
+          ...input.label !== void 0 ? { label: input.label } : existing.label === void 0 ? {} : { label: existing.label },
+          credential: cloneCredential(credential),
+          createdAt: existing.createdAt
+        };
+      } else {
+        accounts.push({
+          id: input.id,
+          ...input.label === void 0 ? {} : { label: input.label },
+          credential: cloneCredential(credential),
+          createdAt: Date.now()
+        });
+      }
+      return {
+        version: AUTH_FORMAT_VERSION,
+        activeAccountId: input.makeActive === true ? input.id : current.activeAccountId,
+        accounts
+      };
+    });
+  }
+  async removeAccount(id) {
+    if (!isValidAccountId(id)) {
+      throw new TypeError(`${this.label}: account id is invalid`);
+    }
+    await this.mutateDocument({ allowUnreadable: false }, async (current) => {
+      if (current === void 0) return UNCHANGED;
+      const accounts = current.accounts.filter((account) => account.id !== id).map(cloneAccount);
+      if (accounts.length === current.accounts.length) return UNCHANGED;
+      if (accounts.length === 0) return void 0;
+      const fallback = accounts[0];
+      if (fallback === void 0) return void 0;
+      const activeAccountId = current.activeAccountId === id ? fallback.id : current.activeAccountId;
+      return {
+        version: AUTH_FORMAT_VERSION,
+        activeAccountId,
+        accounts
+      };
+    });
+  }
 };
 var GrokBuildCredentialStore = class extends OAuthCredentialFileStore {
   constructor(filename = grokBuildAuthPath()) {
@@ -26325,7 +26750,7 @@ var GATEWAY_TOS_WARNING = "local API gateway is enabled; exposing a subscription
 
 // src/oauth.ts
 import { Buffer as Buffer2 } from "node:buffer";
-import { createHash, randomBytes } from "node:crypto";
+import { createHash, randomBytes as randomBytes2 } from "node:crypto";
 import { createServer } from "node:http";
 var GROK_BUILD_OAUTH_ISSUER = "https://auth.x.ai";
 var APPROVED_GROK_ISSUER_ORIGIN2 = "https://auth.x.ai";
@@ -26492,12 +26917,12 @@ async function discoverOAuthEndpoints(issuer, signal, options = {}) {
   return parsed;
 }
 function generatePkce() {
-  const verifier = randomBytes(32).toString("base64url");
+  const verifier = randomBytes2(32).toString("base64url");
   const challenge = createHash("sha256").update(verifier).digest("base64url");
   return { verifier, challenge };
 }
 function randomToken() {
-  return randomBytes(16).toString("base64url");
+  return randomBytes2(16).toString("base64url");
 }
 function buildAuthorizeUrl(endpoints, params, redirectUri, challenge, state, nonce) {
   const url = new URL(endpoints.authorization_endpoint);
@@ -26931,6 +27356,10 @@ var OAuthProviderSession = class {
   async invalidateAccessToken() {
     await this.store.invalidate(this.definition.nativeProviderId);
   }
+  /** Refresh host discovery after an account switch/remove without a full logout. */
+  notifyCredentialChange() {
+    this.onCatalogChange?.();
+  }
   async storedCredential() {
     const credential = await this.store.read(this.definition.nativeProviderId);
     return credential?.type === "oauth" ? credential : void 0;
@@ -27363,6 +27792,10 @@ var GrokBuildSession = class {
   async invalidateAccessToken() {
     await this.store.invalidate(XAI_PI_PROVIDER);
   }
+  /** Refresh host discovery after an account switch/remove without a full logout. */
+  notifyCredentialChange() {
+    this.onCatalogChange?.();
+  }
   async logout() {
     try {
       await this.store.delete(XAI_PI_PROVIDER);