oc-codex-multi-auth 6.0.0 → 6.1.1

package/dist/lib/accounts.js

@@ -1,771 +1,193 @@
-import { existsSync, promises as fs } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { createLogger } from "./logger.js";
-import { loadAccounts, saveAccounts, } from "./storage.js";
-import { MODEL_FAMILIES } from "./prompts/codex.js";
-import { getHealthTracker, getTokenTracker, selectHybridAccount, } from "./rotation.js";
-import { isRecord, nowMs } from "./utils.js";
-import { decodeJWT } from "./auth/auth.js";
+/**
+ * AccountManager — slim orchestrator that composes four domain services:
+ *
+ *  - {@link AccountState}       — in-memory account registry + per-family indices
+ *  - {@link AccountPersistence} — debounced disk saves, shutdown-flush lifecycle
+ *  - {@link AccountRotation}    — selection, rate-limit and cooldown management
+ *  - {@link AccountRecovery}    — auth-failure tracking, Codex CLI hydration,
+ *                                  merge-safe removal
+ *
+ * This module preserves the public API that existed before the RC-7 split so
+ * that `new AccountManager(...)` and every instance method keeps working for
+ * external callers (`index.ts`, `lib/tools/*`, `lib/parallel-probe.ts`, etc.).
+ */
+import { loadAccounts } from "./storage.js";
+import { AccountPersistence, } from "./accounts/persistence.js";
+import { AccountRecovery } from "./accounts/recovery.js";
+import { AccountRotation } from "./accounts/rotation.js";
+import { AccountState, } from "./accounts/state.js";
+import { formatWaitTime } from "./accounts/rate-limits.js";
+import { nowMs } from "./utils.js";
 export { extractAccountId, extractAccountEmail, getAccountIdCandidates, selectBestAccountCandidate, shouldUpdateAccountIdFromToken, resolveRequestAccountId, sanitizeEmail, } from "./auth/token-utils.js";
 export { parseRateLimitReason, getQuotaKey, clampNonNegativeInt, clearExpiredRateLimits, isRateLimitedForQuotaKey, isRateLimitedForFamily, formatWaitTime, } from "./accounts/rate-limits.js";
-import { extractAccountId, extractAccountEmail, shouldUpdateAccountIdFromToken, sanitizeEmail, } from "./auth/token-utils.js";
-import { clampNonNegativeInt, getQuotaKey, clearExpiredRateLimits, isRateLimitedForFamily, formatWaitTime, } from "./accounts/rate-limits.js";
-const log = createLogger("accounts");
-const CODEX_CLI_ACCOUNTS_PATH = join(homedir(), ".codex", "accounts.json");
-const CODEX_CLI_CACHE_TTL_MS = 5_000;
-let codexCliTokenCache = null;
-let codexCliTokenCacheLoadedAt = 0;
-function extractExpiresAtFromAccessToken(accessToken) {
-    const decoded = decodeJWT(accessToken);
-    const exp = decoded?.exp;
-    if (typeof exp === "number" && Number.isFinite(exp)) {
-        // JWT exp is in seconds since epoch.
-        return exp * 1000;
-    }
-    return undefined;
-}
-async function getCodexCliTokenCache() {
-    const syncEnabled = process.env.CODEX_AUTH_SYNC_CODEX_CLI !== "0";
-    const skip = !syncEnabled ||
-        process.env.VITEST_WORKER_ID !== undefined ||
-        process.env.NODE_ENV === "test";
-    if (skip)
-        return null;
-    const now = nowMs();
-    if (codexCliTokenCache && now - codexCliTokenCacheLoadedAt < CODEX_CLI_CACHE_TTL_MS) {
-        return codexCliTokenCache;
-    }
-    codexCliTokenCacheLoadedAt = now;
-    if (!existsSync(CODEX_CLI_ACCOUNTS_PATH)) {
-        codexCliTokenCache = null;
-        return null;
+export { lookupCodexCliTokensByEmail, } from "./accounts/recovery.js";
+export class AccountManager {
+    state;
+    persistence;
+    rotation;
+    recovery;
+    /**
+     * Alias to `state.authFailuresByRefreshToken`. Preserved as a property on
+     * the orchestrator so that pre-split tests and diagnostics that reach in
+     * via `Reflect.get(manager, "authFailuresByRefreshToken")` continue to see
+     * the live map without edits. Internal use only.
+     */
+    get authFailuresByRefreshToken() {
+        return this.state.authFailuresByRefreshToken;
     }
-    try {
-        const raw = await fs.readFile(CODEX_CLI_ACCOUNTS_PATH, "utf-8");
-        const parsed = JSON.parse(raw);
-        if (!isRecord(parsed) || !Array.isArray(parsed.accounts)) {
-            codexCliTokenCache = null;
-            return null;
-        }
-        const next = new Map();
-        for (const entry of parsed.accounts) {
-            if (!isRecord(entry))
-                continue;
-            const email = sanitizeEmail(typeof entry.email === "string" ? entry.email : undefined);
-            if (!email)
-                continue;
-            const accountId = typeof entry.accountId === "string" && entry.accountId.trim() ? entry.accountId.trim() : undefined;
-            const auth = entry.auth;
-            const tokens = isRecord(auth) ? auth.tokens : undefined;
-            const accessToken = isRecord(tokens) && typeof tokens.access_token === "string" && tokens.access_token.trim()
-                ? tokens.access_token.trim()
-                : undefined;
-            const refreshToken = isRecord(tokens) && typeof tokens.refresh_token === "string" && tokens.refresh_token.trim()
-                ? tokens.refresh_token.trim()
-                : undefined;
-            if (!accessToken)
-                continue;
-            next.set(email, {
-                accessToken,
-                expiresAt: extractExpiresAtFromAccessToken(accessToken),
-                refreshToken,
-                accountId,
-            });
-        }
-        codexCliTokenCache = next;
-        return codexCliTokenCache;
-    }
-    catch (error) {
-        log.debug("Failed to read Codex CLI accounts cache", { error: String(error) });
-        codexCliTokenCache = null;
-        return null;
+    constructor(authFallback, stored) {
+        this.state = new AccountState();
+        this.persistence = new AccountPersistence(this.state);
+        this.rotation = new AccountRotation(this.state);
+        this.recovery = new AccountRecovery(this.state, this.persistence);
+        this.state.initializeFromStorage(authFallback, stored);
     }
-}
-export async function lookupCodexCliTokensByEmail(email) {
-    const normalized = sanitizeEmail(email);
-    if (!normalized)
-        return null;
-    const cache = await getCodexCliTokenCache();
-    const cached = cache?.get(normalized);
-    return cached ? { ...cached } : null;
-}
-function initFamilyState(defaultValue) {
-    return Object.fromEntries(MODEL_FAMILIES.map((family) => [family, defaultValue]));
-}
-export class AccountManager {
-    accounts = [];
-    cursorByFamily = initFamilyState(0);
-    currentAccountIndexByFamily = initFamilyState(-1);
-    lastToastAccountIndex = -1;
-    lastToastTime = 0;
-    saveDebounceTimer = null;
-    pendingSave = null;
-    authFailuresByRefreshToken = new Map();
     static async loadFromDisk(authFallback) {
         const stored = await loadAccounts();
         const manager = new AccountManager(authFallback, stored);
-        await manager.hydrateFromCodexCli();
+        await manager.recovery.hydrateFromCodexCli();
         return manager;
     }
+    // ----- state delegations -----
     hasRefreshToken(refreshToken) {
-        return this.accounts.some((account) => account.refreshToken === refreshToken);
-    }
-    async hydrateFromCodexCli() {
-        const cache = await getCodexCliTokenCache();
-        if (!cache || cache.size === 0)
-            return;
-        const now = nowMs();
-        let changed = false;
-        for (const account of this.accounts) {
-            const email = sanitizeEmail(account.email);
-            if (!email)
-                continue;
-            const cached = cache.get(email);
-            if (!cached)
-                continue;
-            if (typeof cached.expiresAt === "number" && cached.expiresAt <= now) {
-                continue;
-            }
-            const missingOrExpired = !account.access || account.expires === undefined || account.expires <= now;
-            if (missingOrExpired) {
-                account.access = cached.accessToken;
-                if (typeof cached.expiresAt === "number") {
-                    account.expires = cached.expiresAt;
-                }
-                changed = true;
-            }
-            if (!account.accountId &&
-                cached.accountId &&
-                shouldUpdateAccountIdFromToken(account.accountIdSource, account.accountId)) {
-                account.accountId = cached.accountId;
-                account.accountIdSource = account.accountIdSource ?? "token";
-                changed = true;
-            }
-        }
-        if (!changed)
-            return;
-        try {
-            await this.saveToDisk();
-        }
-        catch (error) {
-            log.debug("Failed to persist Codex CLI cache hydration", { error: String(error) });
-        }
-    }
-    constructor(authFallback, stored) {
-        const fallbackAccountId = extractAccountId(authFallback?.access);
-        const fallbackAccountEmail = sanitizeEmail(extractAccountEmail(authFallback?.access));
-        if (stored && stored.accounts.length > 0) {
-            const baseNow = nowMs();
-            this.accounts = stored.accounts
-                .map((account, index) => {
-                if (!account.refreshToken || typeof account.refreshToken !== "string") {
-                    return null;
-                }
-                const matchesFallback = !!authFallback &&
-                    ((fallbackAccountId && account.accountId === fallbackAccountId) ||
-                        account.refreshToken === authFallback.refresh ||
-                        (!!fallbackAccountEmail &&
-                            sanitizeEmail(account.email) === fallbackAccountEmail));
-                const refreshToken = matchesFallback && authFallback ? authFallback.refresh : account.refreshToken;
-                return {
-                    index,
-                    accountId: matchesFallback ? fallbackAccountId ?? account.accountId : account.accountId,
-                    organizationId: account.organizationId,
-                    accountIdSource: account.accountIdSource,
-                    accountLabel: account.accountLabel,
-                    accountTags: account.accountTags,
-                    accountNote: account.accountNote,
-                    email: matchesFallback
-                        ? fallbackAccountEmail ?? sanitizeEmail(account.email)
-                        : sanitizeEmail(account.email),
-                    refreshToken,
-                    enabled: account.enabled !== false,
-                    access: matchesFallback && authFallback ? authFallback.access : account.accessToken,
-                    expires: matchesFallback && authFallback ? authFallback.expires : account.expiresAt,
-                    addedAt: clampNonNegativeInt(account.addedAt, baseNow),
-                    lastUsed: clampNonNegativeInt(account.lastUsed, 0),
-                    lastSwitchReason: account.lastSwitchReason,
-                    rateLimitResetTimes: account.rateLimitResetTimes ?? {},
-                    coolingDownUntil: account.coolingDownUntil,
-                    cooldownReason: account.cooldownReason,
-                };
-            })
-                .filter((account) => account !== null);
-            const hasMatchingFallback = !!authFallback &&
-                this.accounts.some((account) => account.refreshToken === authFallback.refresh ||
-                    (fallbackAccountId && account.accountId === fallbackAccountId) ||
-                    (!!fallbackAccountEmail && account.email === fallbackAccountEmail));
-            if (authFallback && !hasMatchingFallback) {
-                const now = nowMs();
-                this.accounts.push({
-                    index: this.accounts.length,
-                    accountId: fallbackAccountId,
-                    organizationId: undefined,
-                    accountIdSource: fallbackAccountId ? "token" : undefined,
-                    email: fallbackAccountEmail,
-                    refreshToken: authFallback.refresh,
-                    enabled: true,
-                    access: authFallback.access,
-                    expires: authFallback.expires,
-                    addedAt: now,
-                    lastUsed: now,
-                    lastSwitchReason: "initial",
-                    rateLimitResetTimes: {},
-                });
-            }
-            if (this.accounts.length > 0) {
-                const defaultIndex = clampNonNegativeInt(stored.activeIndex, 0) % this.accounts.length;
-                for (const family of MODEL_FAMILIES) {
-                    const rawIndex = stored.activeIndexByFamily?.[family];
-                    const nextIndex = clampNonNegativeInt(rawIndex, defaultIndex) % this.accounts.length;
-                    this.currentAccountIndexByFamily[family] = nextIndex;
-                    this.cursorByFamily[family] = nextIndex;
-                }
-            }
-            return;
-        }
-        if (authFallback) {
-            const now = nowMs();
-            this.accounts = [
-                {
-                    index: 0,
-                    accountId: fallbackAccountId,
-                    organizationId: undefined,
-                    accountIdSource: fallbackAccountId ? "token" : undefined,
-                    email: fallbackAccountEmail,
-                    refreshToken: authFallback.refresh,
-                    enabled: true,
-                    access: authFallback.access,
-                    expires: authFallback.expires,
-                    addedAt: now,
-                    lastUsed: 0,
-                    lastSwitchReason: "initial",
-                    rateLimitResetTimes: {},
-                },
-            ];
-            for (const family of MODEL_FAMILIES) {
-                this.currentAccountIndexByFamily[family] = 0;
-                this.cursorByFamily[family] = 0;
-            }
-        }
+        return this.state.hasRefreshToken(refreshToken);
     }
     getAccountCount() {
-        return this.accounts.length;
+        return this.state.getAccountCount();
     }
     getActiveIndex() {
-        return this.getActiveIndexForFamily("codex");
+        return this.state.getActiveIndexForFamily("codex");
     }
     getActiveIndexForFamily(family) {
-        const index = this.currentAccountIndexByFamily[family];
-        if (index < 0 || index >= this.accounts.length) {
-            return this.accounts.length > 0 ? 0 : -1;
-        }
-        return index;
+        return this.state.getActiveIndexForFamily(family);
     }
     getAccountsSnapshot() {
-        return this.accounts.map((account) => ({
-            ...account,
-            rateLimitResetTimes: { ...account.rateLimitResetTimes },
-        }));
+        return this.state.getAccountsSnapshot();
     }
     getSelectionExplainability(family, model, now = nowMs()) {
-        const quotaKey = model ? `${family}:${model}` : family;
-        const baseQuotaKey = getQuotaKey(family);
-        const modelQuotaKey = model ? getQuotaKey(family, model) : null;
-        const currentIndex = this.currentAccountIndexByFamily[family];
-        const healthTracker = getHealthTracker();
-        const tokenTracker = getTokenTracker();
-        return this.accounts.map((account) => {
-            clearExpiredRateLimits(account);
-            const enabled = account.enabled !== false;
-            const reasons = [];
-            let rateLimitedUntil;
-            const baseRateLimit = account.rateLimitResetTimes[baseQuotaKey];
-            const modelRateLimit = modelQuotaKey ? account.rateLimitResetTimes[modelQuotaKey] : undefined;
-            if (typeof baseRateLimit === "number" && baseRateLimit > now) {
-                rateLimitedUntil = baseRateLimit;
-            }
-            if (typeof modelRateLimit === "number" &&
-                modelRateLimit > now &&
-                (rateLimitedUntil === undefined || modelRateLimit > rateLimitedUntil)) {
-                rateLimitedUntil = modelRateLimit;
-            }
-            const coolingDownUntil = typeof account.coolingDownUntil === "number" && account.coolingDownUntil > now
-                ? account.coolingDownUntil
-                : undefined;
-            if (!enabled)
-                reasons.push("disabled");
-            if (rateLimitedUntil !== undefined)
-                reasons.push("rate-limited");
-            if (coolingDownUntil !== undefined) {
-                reasons.push(account.cooldownReason ? `cooldown:${account.cooldownReason}` : "cooldown");
-            }
-            const tokensAvailable = tokenTracker.getTokens(account.index, quotaKey);
-            if (tokensAvailable < 1)
-                reasons.push("token-bucket-empty");
-            const eligible = enabled &&
-                rateLimitedUntil === undefined &&
-                coolingDownUntil === undefined &&
-                tokensAvailable >= 1;
-            if (reasons.length === 0)
-                reasons.push("eligible");
-            return {
-                index: account.index,
-                enabled,
-                isCurrentForFamily: currentIndex === account.index,
-                eligible,
-                reasons,
-                healthScore: healthTracker.getScore(account.index, quotaKey),
-                tokensAvailable,
-                rateLimitedUntil,
-                coolingDownUntil,
-                cooldownReason: coolingDownUntil !== undefined ? account.cooldownReason : undefined,
-                lastUsed: account.lastUsed,
-            };
-        });
+        return this.state.getSelectionExplainability(family, model, now);
     }
     setActiveIndex(index) {
-        if (!Number.isFinite(index))
-            return null;
-        if (index < 0 || index >= this.accounts.length)
-            return null;
-        const account = this.accounts[index];
-        if (!account)
-            return null;
-        if (account.enabled === false)
-            return null;
-        for (const family of MODEL_FAMILIES) {
-            this.currentAccountIndexByFamily[family] = index;
-            this.cursorByFamily[family] = index;
-        }
-        account.lastUsed = nowMs();
-        account.lastSwitchReason = "rotation";
-        return account;
+        return this.state.setActiveIndex(index);
     }
     getCurrentAccount() {
-        return this.getCurrentAccountForFamily("codex");
+        return this.state.getCurrentAccountForFamily("codex");
     }
     getCurrentAccountForFamily(family) {
-        const index = this.currentAccountIndexByFamily[family];
-        if (index < 0 || index >= this.accounts.length) {
-            return null;
-        }
-        const account = this.accounts[index];
-        if (!account || account.enabled === false) {
-            return null;
-        }
-        return account;
+        return this.state.getCurrentAccountForFamily(family);
+    }
+    shouldShowAccountToast(accountIndex, debounceMs = 30000) {
+        return this.state.shouldShowAccountToast(accountIndex, debounceMs);
+    }
+    markToastShown(accountIndex) {
+        this.state.markToastShown(accountIndex);
+    }
+    updateFromAuth(account, auth) {
+        this.state.updateFromAuth(account, auth);
+    }
+    toAuthDetails(account) {
+        return this.state.toAuthDetails(account);
     }
+    markSwitched(account, reason, family) {
+        this.state.markSwitched(account, reason, family);
+    }
+    removeAccount(account) {
+        return this.state.removeAccount(account);
+    }
+    removeAccountByIndex(index) {
+        return this.state.removeAccountByIndex(index);
+    }
+    setAccountEnabled(index, enabled) {
+        return this.state.setAccountEnabled(index, enabled);
+    }
+    isAccountCoolingDown(account) {
+        return this.state.isAccountCoolingDown(account);
+    }
+    clearAccountCooldown(account) {
+        this.state.clearAccountCooldown(account);
+    }
+    // ----- rotation delegations -----
     getCurrentOrNext() {
-        return this.getCurrentOrNextForFamily("codex");
+        return this.rotation.getCurrentOrNextForFamily("codex");
     }
     getCurrentOrNextForFamily(family, model) {
-        const count = this.accounts.length;
-        if (count === 0)
-            return null;
-        const cursor = this.cursorByFamily[family];
-        for (let i = 0; i < count; i++) {
-            const idx = (cursor + i) % count;
-            const account = this.accounts[idx];
-            if (!account)
-                continue;
-            if (account.enabled === false)
-                continue;
-            clearExpiredRateLimits(account);
-            if (isRateLimitedForFamily(account, family, model) || this.isAccountCoolingDown(account)) {
-                continue;
-            }
-            this.cursorByFamily[family] = (idx + 1) % count;
-            this.currentAccountIndexByFamily[family] = idx;
-            account.lastUsed = nowMs();
-            return account;
-        }
-        return null;
+        return this.rotation.getCurrentOrNextForFamily(family, model);
     }
     getNextForFamily(family, model) {
-        const count = this.accounts.length;
-        if (count === 0)
-            return null;
-        const cursor = this.cursorByFamily[family];
-        for (let i = 0; i < count; i++) {
-            const idx = (cursor + i) % count;
-            const account = this.accounts[idx];
-            if (!account)
-                continue;
-            if (account.enabled === false)
-                continue;
-            clearExpiredRateLimits(account);
-            if (isRateLimitedForFamily(account, family, model) || this.isAccountCoolingDown(account)) {
-                continue;
-            }
-            this.cursorByFamily[family] = (idx + 1) % count;
-            account.lastUsed = nowMs();
-            return account;
-        }
-        return null;
+        return this.rotation.getNextForFamily(family, model);
     }
     getCurrentOrNextForFamilyHybrid(family, model, options) {
-        const count = this.accounts.length;
-        if (count === 0)
-            return null;
-        const currentIndex = this.currentAccountIndexByFamily[family];
-        if (currentIndex >= 0 && currentIndex < count) {
-            const currentAccount = this.accounts[currentIndex];
-            if (currentAccount) {
-                if (currentAccount.enabled === false) {
-                    // Fall through to hybrid selection.
-                }
-                else {
-                    clearExpiredRateLimits(currentAccount);
-                    if (!isRateLimitedForFamily(currentAccount, family, model) &&
-                        !this.isAccountCoolingDown(currentAccount)) {
-                        currentAccount.lastUsed = nowMs();
-                        return currentAccount;
-                    }
-                }
-            }
-        }
-        const quotaKey = model ? `${family}:${model}` : family;
-        const healthTracker = getHealthTracker();
-        const tokenTracker = getTokenTracker();
-        const accountsWithMetrics = this.accounts
-            .map((account) => {
-            if (!account)
-                return null;
-            if (account.enabled === false)
-                return null;
-            clearExpiredRateLimits(account);
-            const isAvailable = !isRateLimitedForFamily(account, family, model) && !this.isAccountCoolingDown(account);
-            return {
-                index: account.index,
-                isAvailable,
-                lastUsed: account.lastUsed,
-            };
-        })
-            .filter((a) => a !== null);
-        const selected = selectHybridAccount(accountsWithMetrics, healthTracker, tokenTracker, quotaKey, {}, options);
-        if (!selected)
-            return null;
-        const account = this.accounts[selected.index];
-        if (!account)
-            return null;
-        this.currentAccountIndexByFamily[family] = account.index;
-        this.cursorByFamily[family] = (account.index + 1) % count;
-        account.lastUsed = nowMs();
-        return account;
+        return this.rotation.getCurrentOrNextForFamilyHybrid(family, model, options);
     }
     recordSuccess(account, family, model) {
-        const quotaKey = model ? `${family}:${model}` : family;
-        const healthTracker = getHealthTracker();
-        healthTracker.recordSuccess(account.index, quotaKey);
+        this.rotation.recordSuccess(account, family, model);
     }
     recordRateLimit(account, family, model) {
-        const quotaKey = model ? `${family}:${model}` : family;
-        const healthTracker = getHealthTracker();
-        const tokenTracker = getTokenTracker();
-        healthTracker.recordRateLimit(account.index, quotaKey);
-        tokenTracker.drain(account.index, quotaKey);
+        this.rotation.recordRateLimit(account, family, model);
     }
     recordFailure(account, family, model) {
-        const quotaKey = model ? `${family}:${model}` : family;
-        const healthTracker = getHealthTracker();
-        healthTracker.recordFailure(account.index, quotaKey);
+        this.rotation.recordFailure(account, family, model);
     }
     consumeToken(account, family, model) {
-        const quotaKey = model ? `${family}:${model}` : family;
-        const tokenTracker = getTokenTracker();
-        return tokenTracker.tryConsume(account.index, quotaKey);
+        return this.rotation.consumeToken(account, family, model);
     }
-    /**
-     * Refund a token consumed within the refund window (30 seconds).
-     * Use this when a request fails due to network errors (not rate limits).
-     * @returns true if refund was successful, false if no valid consumption found
-     */
     refundToken(account, family, model) {
-        const quotaKey = model ? `${family}:${model}` : family;
-        const tokenTracker = getTokenTracker();
-        return tokenTracker.refundToken(account.index, quotaKey);
-    }
-    markSwitched(account, reason, family) {
-        account.lastSwitchReason = reason;
-        this.currentAccountIndexByFamily[family] = account.index;
+        return this.rotation.refundToken(account, family, model);
     }
     markRateLimited(account, retryAfterMs, family, model) {
-        this.markRateLimitedWithReason(account, retryAfterMs, family, "unknown", model);
+        this.rotation.markRateLimited(account, retryAfterMs, family, model);
     }
     markRateLimitedWithReason(account, retryAfterMs, family, reason, model) {
-        const retryMs = Math.max(0, Math.floor(retryAfterMs));
-        const resetAt = nowMs() + retryMs;
-        const baseKey = getQuotaKey(family);
-        account.rateLimitResetTimes[baseKey] = resetAt;
-        if (model) {
-            const modelKey = getQuotaKey(family, model);
-            account.rateLimitResetTimes[modelKey] = resetAt;
-        }
-        account.lastRateLimitReason = reason;
+        this.rotation.markRateLimitedWithReason(account, retryAfterMs, family, reason, model);
     }
     markAccountCoolingDown(account, cooldownMs, reason) {
-        const ms = Math.max(0, Math.floor(cooldownMs));
-        account.coolingDownUntil = nowMs() + ms;
-        account.cooldownReason = reason;
+        this.rotation.markAccountCoolingDown(account, cooldownMs, reason);
     }
-    /**
-     * Mark every in-memory account sharing a refresh token as cooling down.
-     * @returns Number of live accounts updated.
-     */
     markAccountsWithRefreshTokenCoolingDown(refreshToken, cooldownMs, reason) {
-        const matches = this.accounts.filter((account) => account.refreshToken === refreshToken);
-        for (const account of matches) {
-            this.markAccountCoolingDown(account, cooldownMs, reason);
-        }
-        return matches.length;
-    }
-    isAccountCoolingDown(account) {
-        if (account.coolingDownUntil === undefined)
-            return false;
-        if (nowMs() >= account.coolingDownUntil) {
-            this.clearAccountCooldown(account);
-            return false;
-        }
-        return true;
-    }
-    clearAccountCooldown(account) {
-        delete account.coolingDownUntil;
-        delete account.cooldownReason;
-    }
-    incrementAuthFailures(account) {
-        const currentFailures = this.authFailuresByRefreshToken.get(account.refreshToken) ?? 0;
-        const newFailures = currentFailures + 1;
-        this.authFailuresByRefreshToken.set(account.refreshToken, newFailures);
-        return newFailures;
-    }
-    /**
-     * Clear the authentication failure counter for the given account's refresh token.
-     *
-     * Notes:
-     * - Failure counts are tracked per refresh token (not per account), so this clears
-     *   shared failure state for all org variants that reuse the same token.
-     * - Failure counts are in-memory only for the current AccountManager instance.
-     */
-    clearAuthFailures(account) {
-        this.authFailuresByRefreshToken.delete(account.refreshToken);
-    }
-    shouldShowAccountToast(accountIndex, debounceMs = 30000) {
-        const now = nowMs();
-        if (accountIndex === this.lastToastAccountIndex && now - this.lastToastTime < debounceMs) {
-            return false;
-        }
-        return true;
-    }
-    markToastShown(accountIndex) {
-        this.lastToastAccountIndex = accountIndex;
-        this.lastToastTime = nowMs();
-    }
-    updateFromAuth(account, auth) {
-        const previousRefreshToken = account.refreshToken;
-        account.refreshToken = auth.refresh;
-        account.access = auth.access;
-        account.expires = auth.expires;
-        if (previousRefreshToken !== account.refreshToken) {
-            this.authFailuresByRefreshToken.delete(previousRefreshToken);
-        }
-        const tokenAccountId = extractAccountId(auth.access);
-        if (tokenAccountId &&
-            (shouldUpdateAccountIdFromToken(account.accountIdSource, account.accountId))) {
-            account.accountId = tokenAccountId;
-            account.accountIdSource = "token";
-        }
-        account.email = sanitizeEmail(extractAccountEmail(auth.access)) ?? account.email;
-    }
-    toAuthDetails(account) {
-        return {
-            type: "oauth",
-            access: account.access ?? "",
-            refresh: account.refreshToken,
-            expires: account.expires ?? 0,
-        };
+        return this.rotation.markAccountsWithRefreshTokenCoolingDown(refreshToken, cooldownMs, reason);
     }
     getMinWaitTime() {
-        return this.getMinWaitTimeForFamily("codex");
+        return this.rotation.getMinWaitTimeForFamily("codex");
     }
     getMinWaitTimeForFamily(family, model) {
-        const now = nowMs();
-        const enabledAccounts = this.accounts.filter((account) => account.enabled !== false);
-        const available = enabledAccounts.filter((account) => {
-            clearExpiredRateLimits(account);
-            return !isRateLimitedForFamily(account, family, model) && !this.isAccountCoolingDown(account);
-        });
-        if (available.length > 0)
-            return 0;
-        if (enabledAccounts.length === 0)
-            return 0;
-        const waitTimes = [];
-        const baseKey = getQuotaKey(family);
-        const modelKey = model ? getQuotaKey(family, model) : null;
-        for (const account of enabledAccounts) {
-            const baseResetAt = account.rateLimitResetTimes[baseKey];
-            if (typeof baseResetAt === "number") {
-                waitTimes.push(Math.max(0, baseResetAt - now));
-            }
-            if (modelKey) {
-                const modelResetAt = account.rateLimitResetTimes[modelKey];
-                if (typeof modelResetAt === "number") {
-                    waitTimes.push(Math.max(0, modelResetAt - now));
-                }
-            }
-            if (typeof account.coolingDownUntil === "number") {
-                waitTimes.push(Math.max(0, account.coolingDownUntil - now));
-            }
-        }
-        return waitTimes.length > 0 ? Math.min(...waitTimes) : 0;
+        return this.rotation.getMinWaitTimeForFamily(family, model);
     }
-    removeAccount(account) {
-        const idx = this.accounts.indexOf(account);
-        if (idx < 0) {
-            return false;
-        }
-        this.accounts.splice(idx, 1);
-        this.accounts.forEach((acc, index) => {
-            acc.index = index;
-        });
-        if (this.accounts.length === 0) {
-            for (const family of MODEL_FAMILIES) {
-                this.cursorByFamily[family] = 0;
-                this.currentAccountIndexByFamily[family] = -1;
-            }
-            return true;
-        }
-        for (const family of MODEL_FAMILIES) {
-            if (this.cursorByFamily[family] > idx) {
-                this.cursorByFamily[family] = Math.max(0, this.cursorByFamily[family] - 1);
-            }
-        }
-        for (const family of MODEL_FAMILIES) {
-            this.cursorByFamily[family] = this.cursorByFamily[family] % this.accounts.length;
-        }
-        for (const family of MODEL_FAMILIES) {
-            if (this.currentAccountIndexByFamily[family] > idx) {
-                this.currentAccountIndexByFamily[family] -= 1;
-            }
-            if (this.currentAccountIndexByFamily[family] >= this.accounts.length) {
-                this.currentAccountIndexByFamily[family] = -1;
-            }
-        }
-        return true;
+    // ----- persistence delegations -----
+    async saveToDisk() {
+        await this.persistence.saveToDisk();
     }
-    removeAccountByIndex(index) {
-        if (!Number.isFinite(index))
-            return false;
-        if (index < 0 || index >= this.accounts.length)
-            return false;
-        const account = this.accounts[index];
-        if (!account)
-            return false;
-        return this.removeAccount(account);
+    saveToDiskDebounced(delayMs = 500) {
+        this.persistence.saveToDiskDebounced(delayMs);
     }
-    /**
-     * Remove all accounts that share the same refreshToken as the given account.
-     * This is used when auth refresh fails to remove all org variants together.
-     * @returns Number of accounts removed
-     */
-    removeAccountsWithSameRefreshToken(account) {
-        const refreshToken = account.refreshToken;
-        // Snapshot first because removeAccount mutates this.accounts.
-        const accountsToRemove = this.accounts.filter((acc) => acc.refreshToken === refreshToken);
-        let removedCount = 0;
-        for (const accountToRemove of accountsToRemove) {
-            if (this.removeAccount(accountToRemove)) {
-                removedCount++;
-            }
-        }
-        // Clear stale auth failure state for this refresh token
-        this.authFailuresByRefreshToken.delete(refreshToken);
-        return removedCount;
+    async flushPendingSave() {
+        await this.persistence.flushPendingSave();
     }
-    setAccountEnabled(index, enabled) {
-        if (!Number.isFinite(index))
-            return null;
-        if (index < 0 || index >= this.accounts.length)
-            return null;
-        const account = this.accounts[index];
-        if (!account)
-            return null;
-        account.enabled = enabled;
-        return account;
+    disposeShutdownHandler() {
+        this.persistence.disposeShutdownHandler();
     }
-    async saveToDisk() {
-        const activeIndexByFamily = {};
-        for (const family of MODEL_FAMILIES) {
-            const raw = this.currentAccountIndexByFamily[family];
-            activeIndexByFamily[family] = clampNonNegativeInt(raw, 0);
-        }
-        const activeIndex = clampNonNegativeInt(activeIndexByFamily.codex, 0);
-        const storage = {
-            version: 3,
-            accounts: this.accounts.map((account) => ({
-                accountId: account.accountId,
-                organizationId: account.organizationId,
-                accountIdSource: account.accountIdSource,
-                accountLabel: account.accountLabel,
-                accountTags: account.accountTags,
-                accountNote: account.accountNote,
-                email: account.email,
-                refreshToken: account.refreshToken,
-                accessToken: account.access,
-                expiresAt: account.expires,
-                enabled: account.enabled === false ? false : undefined,
-                addedAt: account.addedAt,
-                lastUsed: account.lastUsed,
-                lastSwitchReason: account.lastSwitchReason,
-                rateLimitResetTimes: Object.keys(account.rateLimitResetTimes).length > 0 ? account.rateLimitResetTimes : undefined,
-                coolingDownUntil: account.coolingDownUntil,
-                cooldownReason: account.cooldownReason,
-            })),
-            activeIndex,
-            activeIndexByFamily,
-        };
-        await saveAccounts(storage);
+    // ----- recovery delegations -----
+    async incrementAuthFailures(account) {
+        return this.recovery.incrementAuthFailures(account);
     }
-    saveToDiskDebounced(delayMs = 500) {
-        if (this.saveDebounceTimer) {
-            clearTimeout(this.saveDebounceTimer);
-        }
-        this.saveDebounceTimer = setTimeout(() => {
-            this.saveDebounceTimer = null;
-            const doSave = async () => {
-                try {
-                    if (this.pendingSave) {
-                        await this.pendingSave;
-                    }
-                    this.pendingSave = this.saveToDisk().finally(() => {
-                        this.pendingSave = null;
-                    });
-                    await this.pendingSave;
-                }
-                catch (error) {
-                    log.warn("Debounced save failed", { error: error instanceof Error ? error.message : String(error) });
-                }
-            };
-            void doSave();
-        }, delayMs);
+    getAuthFailures(account) {
+        return this.recovery.getAuthFailures(account);
     }
-    async flushPendingSave() {
-        if (this.saveDebounceTimer) {
-            clearTimeout(this.saveDebounceTimer);
-            this.saveDebounceTimer = null;
-            await this.saveToDisk();
-        }
-        if (this.pendingSave) {
-            await this.pendingSave;
-        }
+    clearAuthFailures(account) {
+        this.recovery.clearAuthFailures(account);
+    }
+    removeAccountsWithSameRefreshToken(account) {
+        return this.recovery.removeAccountsWithSameRefreshToken(account);
     }
 }
 export function formatAccountLabel(account, index) {
     const accountLabel = account?.accountLabel?.trim();
     const email = account?.email?.trim();
     const accountId = account?.accountId?.trim();
-    const idSuffix = accountId ? (accountId.length > 6 ? accountId.slice(-6) : accountId) : null;
+    const idSuffix = accountId
+        ? accountId.length > 6
+            ? accountId.slice(-6)
+            : accountId
+        : null;
     if (accountLabel && email && idSuffix) {
         return `Account ${index + 1} (${accountLabel}, ${email}, id:${idSuffix})`;
     }