oc-codex-multi-auth 6.1.2 → 6.1.6

package/dist/lib/auth/server.js

@@ -1,15 +1,30 @@
 import http from "node:http";
 import { logError, logWarn } from "../logger.js";
 import { oauthSuccessHtml } from "../oauth-success.js";
-import { OAUTH_CALLBACK_BIND_URL, OAUTH_CALLBACK_LOOPBACK_HOST, OAUTH_CALLBACK_PATH, OAUTH_CALLBACK_PORT, } from "../oauth-constants.js";
+import { OAUTH_CALLBACK_BIND_HOSTS, OAUTH_CALLBACK_BIND_URL, OAUTH_CALLBACK_PATH, OAUTH_CALLBACK_PORT, } from "../oauth-constants.js";
+function closeServer(server) {
+    try {
+        server.close();
+    }
+    catch (err) {
+        logError(`Failed to close OAuth server: ${err?.message ?? String(err)}`);
+    }
+}
 /**
- * Start a small local HTTP server that waits for /auth/callback and returns the code
+ * Start a small local HTTP server that waits for /auth/callback and returns the code.
+ *
+ * The public redirect URI uses localhost because that is what the Codex OAuth
+ * client registration expects. Bind both concrete loopback interfaces so
+ * Windows dual-stack localhost resolution can reach either 127.0.0.1 or ::1.
+ *
  * @param options - OAuth state for validation
  * @returns Promise that resolves to server info
  */
-export function startLocalOAuthServer({ state }) {
+export async function startLocalOAuthServer({ state }) {
     let pollAborted = false;
-    const server = http.createServer((req, res) => {
+    let lastCode;
+    const allServers = [];
+    const handler = (req, res) => {
         try {
             const url = new URL(req.url || "", "http://localhost");
             if (url.pathname !== OAUTH_CALLBACK_PATH) {
@@ -34,60 +49,89 @@ export function startLocalOAuthServer({ state }) {
             res.setHeader("X-Content-Type-Options", "nosniff");
             res.setHeader("Content-Security-Policy", "default-src 'self'; script-src 'none'");
             res.end(oauthSuccessHtml);
-            server._lastCode = code;
+            lastCode = code;
+            for (const server of allServers) {
+                server._lastCode = code;
+            }
         }
         catch (err) {
             logError(`Request handler error: ${err?.message ?? String(err)}`);
             res.statusCode = 500;
             res.end("Internal error");
         }
-    });
-    server.unref();
-    return new Promise((resolve) => {
-        server
-            .listen(OAUTH_CALLBACK_PORT, OAUTH_CALLBACK_LOOPBACK_HOST, () => {
-            resolve({
-                port: OAUTH_CALLBACK_PORT,
-                ready: true,
-                close: () => {
-                    pollAborted = true;
-                    server.close();
-                },
-                waitForCode: async () => {
-                    const POLL_INTERVAL_MS = 100;
-                    const TIMEOUT_MS = 5 * 60 * 1000;
-                    const maxIterations = Math.floor(TIMEOUT_MS / POLL_INTERVAL_MS);
-                    const poll = () => new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
-                    for (let i = 0; i < maxIterations; i++) {
-                        if (pollAborted)
-                            return null;
-                        const lastCode = server._lastCode;
-                        if (lastCode)
-                            return { code: lastCode };
-                        await poll();
-                    }
-                    logWarn("OAuth poll timeout after 5 minutes");
-                    return null;
-                },
-            });
-        })
-            .on("error", (err) => {
-            logError(`Failed to bind ${OAUTH_CALLBACK_BIND_URL} (${err?.code}). Suggest device code or manual URL paste.`);
-            resolve({
-                port: OAUTH_CALLBACK_PORT,
-                ready: false,
-                close: () => {
-                    pollAborted = true;
-                    try {
-                        server.close();
-                    }
-                    catch (err) {
-                        logError(`Failed to close OAuth server: ${err?.message ?? String(err)}`);
-                    }
-                },
-                waitForCode: () => Promise.resolve(null),
+    };
+    const bindServer = (host) => {
+        const server = http.createServer(handler);
+        allServers.push(server);
+        server.unref();
+        return new Promise((resolve) => {
+            let settled = false;
+            const settle = (value) => {
+                if (settled)
+                    return;
+                settled = true;
+                resolve(value);
+            };
+            server
+                .on("error", (err) => {
+                const message = host === OAUTH_CALLBACK_BIND_HOSTS[0]
+                    ? `Failed to bind ${OAUTH_CALLBACK_BIND_URL} (${err?.code}). Suggest device code or manual URL paste.`
+                    : `Failed to bind http://[::1]:${OAUTH_CALLBACK_PORT} (${err?.code}); continuing if IPv4 loopback is available.`;
+                if (host === OAUTH_CALLBACK_BIND_HOSTS[0]) {
+                    logError(message);
+                }
+                else {
+                    logWarn(message);
+                }
+                settle(null);
+            })
+                .listen(OAUTH_CALLBACK_PORT, host, () => {
+                settle(server);
             });
         });
-    });
+    };
+    const boundServers = (await Promise.all(OAUTH_CALLBACK_BIND_HOSTS.map((host) => bindServer(host)))).filter((server) => server !== null);
+    if (boundServers.length === 0) {
+        return {
+            port: OAUTH_CALLBACK_PORT,
+            ready: false,
+            close: () => {
+                pollAborted = true;
+                for (const server of allServers) {
+                    closeServer(server);
+                }
+            },
+            waitForCode: () => Promise.resolve(null),
+        };
+    }
+    return {
+        port: OAUTH_CALLBACK_PORT,
+        ready: true,
+        close: () => {
+            pollAborted = true;
+            for (const server of boundServers) {
+                closeServer(server);
+            }
+        },
+        waitForCode: async () => {
+            const POLL_INTERVAL_MS = 100;
+            const TIMEOUT_MS = 5 * 60 * 1000;
+            const maxIterations = Math.floor(TIMEOUT_MS / POLL_INTERVAL_MS);
+            const poll = () => new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
+            for (let i = 0; i < maxIterations; i++) {
+                if (pollAborted)
+                    return null;
+                const serverCode = allServers
+                    .map((server) => server._lastCode)
+                    .find((code) => typeof code === "string" && code.length > 0);
+                const code = lastCode ?? serverCode;
+                if (code)
+                    return { code };
+                await poll();
+            }
+            logWarn("OAuth poll timeout after 5 minutes");
+            return null;
+        },
+    };
 }
 //# sourceMappingURL=server.js.map

package/dist/lib/auth/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../lib/auth/server.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EACN,uBAAuB,EACvB,4BAA4B,EAC5B,mBAAmB,EACnB,mBAAmB,GACnB,MAAM,uBAAuB,CAAC;AAE/B;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,EAAE,KAAK,EAAqB;IACjE,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC;YACvD,IAAI,GAAG,CAAC,QAAQ,KAAK,mBAAmB,EAAE,CAAC;gBAC1C,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACR,CAAC;YACD,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC7C,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBAC1B,OAAO;YACR,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;gBACtC,OAAO;YACR,CAAC;YACD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;YAC1D,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;YACzC,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;YACnD,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,uCAAuC,CAAC,CAAC;YAClF,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YACzB,MAA+C,CAAC,SAAS,GAAG,IAAI,CAAC;QACpE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,QAAQ,CAAC,0BAA2B,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7E,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC3B,CAAC;IACD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,EAAE,CAAC;IAEf,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM;aACJ,MAAM,CAAC,mBAAmB,EAAE,4BAA4B,EAAE,GAAG,EAAE;YAC/D,OAAO,CAAC;gBACP,IAAI,EAAE,mBAAmB;gBACzB,KAAK,EAAE,IAAI;gBACX,KAAK,EAAE,GAAG,EAAE;oBACX,WAAW,GAAG,IAAI,CAAC;oBACnB,MAAM,CAAC,KAAK,EAAE,CAAC;gBAChB,CAAC;gBACF,WAAW,EAAE,KAAK,IAAI,EAAE;oBACvB,MAAM,gBAAgB,GAAG,GAAG,CAAC;oBAC7B,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;oBACjC,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,gBAAgB,CAAC,CAAC;oBAChE,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC;oBAC7E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;wBACxC,IAAI,WAAW;4BAAE,OAAO,IAAI,CAAC;wBAC7B,MAAM,QAAQ,GAAI,MAA+C,CAAC,SAAS,CAAC;wBAC5E,IAAI,QAAQ;4BAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;wBACxC,MAAM,IAAI,EAAE,CAAC;oBACd,CAAC;oBACD,OAAO,CAAC,oCAAoC,CAAC,CAAC;oBAC9C,OAAO,IAAI,CAAC;gBACb,CAAC;aACA,CAAC,CAAC;QACJ,CAAC,CAAC;aACD,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YAC3C,QAAQ,CACP,kBAAkB,uBAAuB,KAAK,GAAG,EAAE,IAAI,6CAA6C,CACpG,CAAC;YACF,OAAO,CAAC;gBACP,IAAI,EAAE,mBAAmB;gBACzB,KAAK,EAAE,KAAK;gBACb,KAAK,EAAE,GAAG,EAAE;oBACX,WAAW,GAAG,IAAI,CAAC;oBACnB,IAAI,CAAC;wBACJ,MAAM,CAAC,KAAK,EAAE,CAAC;oBAChB,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACf,QAAQ,CAAC,iCAAkC,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACpF,CAAC;gBACF,CAAC;gBACA,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;aACxC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../lib/auth/server.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EACN,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,GACnB,MAAM,uBAAuB,CAAC;AAI/B,SAAS,WAAW,CAAC,MAAmB;IACvC,IAAI,CAAC;QACJ,MAAM,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,CAAC,iCAAkC,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;AACF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAAE,KAAK,EAAqB;IACvE,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,QAA4B,CAAC;IACjC,MAAM,UAAU,GAAyB,EAAE,CAAC;IAE5C,MAAM,OAAO,GAAG,CAAC,GAAyB,EAAE,GAAwB,EAAQ,EAAE;QAC7E,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC;YACvD,IAAI,GAAG,CAAC,QAAQ,KAAK,mBAAmB,EAAE,CAAC;gBAC1C,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACR,CAAC;YACD,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC7C,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBAC1B,OAAO;YACR,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;gBACtC,OAAO;YACR,CAAC;YACD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;YAC1D,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;YACzC,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;YACnD,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,uCAAuC,CAAC,CAAC;YAClF,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC1B,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;gBACjC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;YACzB,CAAC;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,QAAQ,CAAC,0BAA2B,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7E,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC3B,CAAC;IACF,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,CAAC,IAAY,EAA+B,EAAE;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAuB,CAAC;QAChE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,MAAM,CAAC,KAAK,EAAE,CAAC;QAEf,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC9B,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,MAAM,GAAG,CAAC,KAAyB,EAAQ,EAAE;gBAClD,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC,CAAC;YAEF,MAAM;iBACJ,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;gBAC3C,MAAM,OAAO,GACZ,IAAI,KAAK,yBAAyB,CAAC,CAAC,CAAC;oBACpC,CAAC,CAAC,kBAAkB,uBAAuB,KAAK,GAAG,EAAE,IAAI,6CAA6C;oBACtG,CAAC,CAAC,+BAA+B,mBAAmB,KAAK,GAAG,EAAE,IAAI,8CAA8C,CAAC;gBACnH,IAAI,IAAI,KAAK,yBAAyB,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3C,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACnB,CAAC;qBAAM,CAAC;oBACP,OAAO,CAAC,OAAO,CAAC,CAAC;gBAClB,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,CAAC;YACd,CAAC,CAAC;iBACD,MAAM,CAAC,mBAAmB,EAAE,IAAI,EAAE,GAAG,EAAE;gBACvC,MAAM,CAAC,MAAM,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CACtC,yBAAyB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CACzD,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAyB,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IAE9D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,GAAG,EAAE;gBACX,WAAW,GAAG,IAAI,CAAC;gBACnB,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;oBACjC,WAAW,CAAC,MAAM,CAAC,CAAC;gBACrB,CAAC;YACF,CAAC;YACD,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;SACxC,CAAC;IACH,CAAC;IAED,OAAO;QACN,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,GAAG,EAAE;YACX,WAAW,GAAG,IAAI,CAAC;YACnB,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;gBACnC,WAAW,CAAC,MAAM,CAAC,CAAC;YACrB,CAAC;QACF,CAAC;QACD,WAAW,EAAE,KAAK,IAAI,EAAE;YACvB,MAAM,gBAAgB,GAAG,GAAG,CAAC;YAC7B,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YACjC,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,gBAAgB,CAAC,CAAC;YAChE,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC;YAC7E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;gBACxC,IAAI,WAAW;oBAAE,OAAO,IAAI,CAAC;gBAC7B,MAAM,UAAU,GAAG,UAAU;qBAC3B,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;qBACjC,IAAI,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAC9E,MAAM,IAAI,GAAG,QAAQ,IAAI,UAAU,CAAC;gBACpC,IAAI,IAAI;oBAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAC1B,MAAM,IAAI,EAAE,CAAC;YACd,CAAC;YACD,OAAO,CAAC,oCAAoC,CAAC,CAAC;YAC9C,OAAO,IAAI,CAAC;QACb,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/lib/codex-usage.d.ts

@@ -0,0 +1,91 @@
+import { type AccountMetadataV3, type AccountStorageV3 } from "./storage.js";
+export type UsageWindow = {
+    used_percent?: number;
+    limit_window_seconds?: number;
+    reset_at?: number;
+    reset_after_seconds?: number;
+} | null;
+export type LimitWindow = {
+    usedPercent?: number;
+    windowMinutes?: number;
+    resetAtMs?: number;
+};
+export type UsageRateLimit = {
+    primary_window?: UsageWindow;
+    secondary_window?: UsageWindow;
+} | null;
+export type UsageCredits = {
+    has_credits?: boolean;
+    unlimited?: boolean;
+    balance?: string | null;
+} | null;
+export type UsagePayload = {
+    plan_type?: string;
+    rate_limit?: UsageRateLimit;
+    code_review_rate_limit?: UsageRateLimit;
+    additional_rate_limits?: Array<{
+        limit_name?: string;
+        metered_feature?: string;
+        rate_limit?: UsageRateLimit;
+    }> | null;
+    credits?: UsageCredits;
+};
+export type UsageLimitPayload = {
+    name: string;
+    windowMinutes: number | null;
+    usedPercent: number | null;
+    leftPercent: number | null;
+    resetAtMs: number | null;
+    summary: string;
+};
+export type AdditionalUsageLimit = {
+    name: string;
+    window: LimitWindow;
+};
+export type CodexUsageSummary = {
+    planType: string | null;
+    credits: string | null;
+    primary: LimitWindow;
+    secondary: LimitWindow;
+    codeReview: LimitWindow;
+    additionalLimits: AdditionalUsageLimit[];
+    limits: UsageLimitPayload[];
+};
+export type EnsureCodexUsageAccessTokenResult = {
+    accessToken: string;
+    refreshed: boolean;
+    persisted: boolean;
+};
+export type UsageAccountSelection = {
+    index: number;
+    account: AccountMetadataV3;
+};
+export declare function getUsageLeftPercent(usedPercent: number | undefined): number | undefined;
+export declare function formatUsageWindowLabel(windowMinutes: number | undefined): string;
+export declare function formatUsageReset(resetAtMs: number | undefined): string | undefined;
+export declare function mapUsageWindow(window: UsageWindow): LimitWindow;
+export declare function formatUsageLimitTitle(windowMinutes: number | undefined, fallback?: string): string;
+export declare function formatUsageLimitSummary(window: LimitWindow): string;
+export declare function toUsageLimitPayload(name: string, window: LimitWindow): UsageLimitPayload;
+export declare function formatUsageCredits(credits: UsageCredits): string | undefined;
+export declare function formatAdditionalUsageLimitName(name: string | undefined): string;
+export declare function hasUsageWindow(window: LimitWindow): boolean;
+export declare function parseCodexUsagePayload(payload: UsagePayload): CodexUsageSummary;
+export declare function fetchCodexUsage(params: {
+    accountId: string;
+    accessToken: string;
+    organizationId: string | undefined;
+    timeoutMs?: number;
+}): Promise<UsagePayload>;
+export declare function ensureCodexUsageAccessToken(params: {
+    storage: AccountStorageV3;
+    account: AccountMetadataV3;
+}): Promise<EnsureCodexUsageAccessTokenResult>;
+export declare function deduplicateUsageAccountIndices(storage: AccountStorageV3): number[];
+export declare function resolveCodexUsageActiveAccount(storage: AccountStorageV3): UsageAccountSelection | null;
+export declare function resolveCodexUsageAccountId(params: {
+    account: AccountMetadataV3;
+    accessToken: string;
+}): string | undefined;
+export declare function createUsageAccountFingerprint(account: AccountMetadataV3): string;
+//# sourceMappingURL=codex-usage.d.ts.map

package/dist/lib/codex-usage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-usage.d.ts","sourceRoot":"","sources":["../../lib/codex-usage.ts"],"names":[],"mappings":"AASA,OAAO,EAEN,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,MAAM,cAAc,CAAC;AAEtB,MAAM,MAAM,WAAW,GAAG;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC7B,GAAG,IAAI,CAAC;AAET,MAAM,MAAM,WAAW,GAAG;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC5B,cAAc,CAAC,EAAE,WAAW,CAAC;IAC7B,gBAAgB,CAAC,EAAE,WAAW,CAAC;CAC/B,GAAG,IAAI,CAAC;AAET,MAAM,MAAM,YAAY,GAAG;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,GAAG,IAAI,CAAC;AAET,MAAM,MAAM,YAAY,GAAG;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,sBAAsB,CAAC,EAAE,cAAc,CAAC;IACxC,sBAAsB,CAAC,EAAE,KAAK,CAAC;QAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,UAAU,CAAC,EAAE,cAAc,CAAC;KAC5B,CAAC,GAAG,IAAI,CAAC;IACV,OAAO,CAAC,EAAE,YAAY,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC/B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,WAAW,CAAC;IACrB,SAAS,EAAE,WAAW,CAAC;IACvB,UAAU,EAAE,WAAW,CAAC;IACxB,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;IACzC,MAAM,EAAE,iBAAiB,EAAE,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,iBAAiB,CAAC;CAC3B,CAAC;AAIF,wBAAgB,mBAAmB,CAClC,WAAW,EAAE,MAAM,GAAG,SAAS,GAC7B,MAAM,GAAG,SAAS,CAIpB;AAED,wBAAgB,sBAAsB,CACrC,aAAa,EAAE,MAAM,GAAG,SAAS,GAC/B,MAAM,CAWR;AAED,wBAAgB,gBAAgB,CAC/B,SAAS,EAAE,MAAM,GAAG,SAAS,GAC3B,MAAM,GAAG,SAAS,CAuBpB;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,CAqB/D;AAED,wBAAgB,qBAAqB,CACpC,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,QAAQ,SAAU,GAChB,MAAM,CAKR;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAOnE;AAED,wBAAgB,mBAAmB,CAClC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,WAAW,GACjB,iBAAiB,CAUnB;AAED,wBAAgB,kBAAkB,CACjC,OAAO,EAAE,YAAY,GACnB,MAAM,GAAG,SAAS,CAQpB;AAED,wBAAgB,8BAA8B,CAC7C,IAAI,EAAE,MAAM,GAAG,SAAS,GACtB,MAAM,CAMR;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAM3D;AAED,wBAAgB,sBAAsB,CACrC,OAAO,EAAE,YAAY,GACnB,iBAAiB,CAuCnB;AAwBD,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,YAAY,CAAC,CA8CxB;AAyGD,wBAAsB,2BAA2B,CAAC,MAAM,EAAE;IACzD,OAAO,EAAE,gBAAgB,CAAC;IAC1B,OAAO,EAAE,iBAAiB,CAAC;CAC3B,GAAG,OAAO,CAAC,iCAAiC,CAAC,CAyC7C;AAED,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAelF;AAED,wBAAgB,8BAA8B,CAC7C,OAAO,EAAE,gBAAgB,GACvB,qBAAqB,GAAG,IAAI,CAgC9B;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IAClD,OAAO,EAAE,iBAAiB,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,GAAG,SAAS,CAErB;AAED,wBAAgB,6BAA6B,CAC5C,OAAO,EAAE,iBAAiB,GACxB,MAAM,CAOR"}

package/dist/lib/codex-usage.js

@@ -0,0 +1,368 @@
+import { createHash } from "node:crypto";
+import { extractAccountId } from "./accounts.js";
+import { getFetchTimeoutMs, loadPluginConfig } from "./config.js";
+import { CODEX_BASE_URL, PLUGIN_NAME } from "./constants.js";
+import { createUsageRequestTimeoutError } from "./error-sentinels.js";
+import { logWarn } from "./logger.js";
+import { queuedRefresh } from "./refresh-queue.js";
+import { createCodexHeaders } from "./request/fetch-helpers.js";
+import { withAccountStorageTransaction, } from "./storage.js";
+const usageErrorBodyMaxChars = 4096;
+export function getUsageLeftPercent(usedPercent) {
+    return typeof usedPercent === "number" && Number.isFinite(usedPercent)
+        ? Math.max(0, Math.min(100, Math.round(100 - usedPercent)))
+        : undefined;
+}
+export function formatUsageWindowLabel(windowMinutes) {
+    if (!windowMinutes ||
+        !Number.isFinite(windowMinutes) ||
+        windowMinutes <= 0) {
+        return "quota";
+    }
+    if (windowMinutes % 1440 === 0)
+        return `${windowMinutes / 1440}d`;
+    if (windowMinutes % 60 === 0)
+        return `${windowMinutes / 60}h`;
+    return `${windowMinutes}m`;
+}
+export function formatUsageReset(resetAtMs) {
+    if (!resetAtMs || !Number.isFinite(resetAtMs) || resetAtMs <= 0) {
+        return undefined;
+    }
+    const date = new Date(resetAtMs);
+    if (!Number.isFinite(date.getTime()))
+        return undefined;
+    const now = new Date();
+    const sameDay = now.getFullYear() === date.getFullYear() &&
+        now.getMonth() === date.getMonth() &&
+        now.getDate() === date.getDate();
+    const time = date.toLocaleTimeString(undefined, {
+        hour: "2-digit",
+        minute: "2-digit",
+        hour12: false,
+    });
+    if (sameDay)
+        return time;
+    const day = date.toLocaleDateString(undefined, {
+        month: "short",
+        day: "2-digit",
+    });
+    return `${time} on ${day}`;
+}
+export function mapUsageWindow(window) {
+    if (!window)
+        return {};
+    return {
+        usedPercent: typeof window.used_percent === "number" &&
+            Number.isFinite(window.used_percent)
+            ? window.used_percent
+            : undefined,
+        windowMinutes: typeof window.limit_window_seconds === "number" &&
+            Number.isFinite(window.limit_window_seconds)
+            ? Math.max(1, Math.ceil(window.limit_window_seconds / 60))
+            : undefined,
+        resetAtMs: typeof window.reset_at === "number" && window.reset_at > 0
+            ? window.reset_at * 1000
+            : typeof window.reset_after_seconds === "number" &&
+                window.reset_after_seconds > 0
+                ? Date.now() + window.reset_after_seconds * 1000
+                : undefined,
+    };
+}
+export function formatUsageLimitTitle(windowMinutes, fallback = "quota") {
+    if (windowMinutes === 300)
+        return "5h limit";
+    if (windowMinutes === 10080)
+        return "Weekly limit";
+    if (fallback !== "quota")
+        return fallback;
+    return `${formatUsageWindowLabel(windowMinutes)} limit`;
+}
+export function formatUsageLimitSummary(window) {
+    const left = getUsageLeftPercent(window.usedPercent);
+    const reset = formatUsageReset(window.resetAtMs);
+    if (left !== undefined && reset)
+        return `${left}% left (resets ${reset})`;
+    if (left !== undefined)
+        return `${left}% left`;
+    if (reset)
+        return `resets ${reset}`;
+    return "unavailable";
+}
+export function toUsageLimitPayload(name, window) {
+    return {
+        name,
+        windowMinutes: window.windowMinutes ?? null,
+        usedPercent: typeof window.usedPercent === "number" ? window.usedPercent : null,
+        leftPercent: getUsageLeftPercent(window.usedPercent) ?? null,
+        resetAtMs: window.resetAtMs ?? null,
+        summary: formatUsageLimitSummary(window),
+    };
+}
+export function formatUsageCredits(credits) {
+    if (!credits)
+        return undefined;
+    if (credits.unlimited)
+        return "unlimited";
+    if (typeof credits.balance === "string" && credits.balance.trim()) {
+        return credits.balance.trim();
+    }
+    if (credits.has_credits)
+        return "available";
+    return undefined;
+}
+export function formatAdditionalUsageLimitName(name) {
+    if (!name)
+        return "Additional limit";
+    if (name === "code_review_rate_limit")
+        return "Code review";
+    return name
+        .replace(/[_-]+/g, " ")
+        .replace(/\b\w/g, (match) => match.toUpperCase());
+}
+export function hasUsageWindow(window) {
+    return Boolean(window.windowMinutes ||
+        typeof window.usedPercent === "number" ||
+        window.resetAtMs);
+}
+export function parseCodexUsagePayload(payload) {
+    const primary = mapUsageWindow(payload.rate_limit?.primary_window ?? null);
+    const secondary = mapUsageWindow(payload.rate_limit?.secondary_window ?? null);
+    const codeReviewRateLimit = payload.code_review_rate_limit ??
+        payload.additional_rate_limits?.find((entry) => entry.limit_name === "code_review_rate_limit")?.rate_limit ??
+        null;
+    const codeReview = mapUsageWindow(codeReviewRateLimit?.primary_window ?? null);
+    const credits = formatUsageCredits(payload.credits ?? null);
+    const additionalLimits = (payload.additional_rate_limits ?? [])
+        .filter((entry) => entry.limit_name !== "code_review_rate_limit")
+        .map((entry) => ({
+        name: formatAdditionalUsageLimitName(entry.limit_name ?? entry.metered_feature),
+        window: mapUsageWindow(entry.rate_limit?.primary_window ?? null),
+    }));
+    const limits = [
+        toUsageLimitPayload(formatUsageLimitTitle(primary.windowMinutes), primary),
+        toUsageLimitPayload(formatUsageLimitTitle(secondary.windowMinutes), secondary),
+    ];
+    if (hasUsageWindow(codeReview)) {
+        limits.push(toUsageLimitPayload("Code review", codeReview));
+    }
+    for (const limit of additionalLimits) {
+        limits.push(toUsageLimitPayload(limit.name, limit.window));
+    }
+    return {
+        planType: payload.plan_type ?? null,
+        credits: credits ?? null,
+        primary,
+        secondary,
+        codeReview,
+        additionalLimits,
+        limits,
+    };
+}
+function sanitizeUsageErrorMessage(status, bodyText) {
+    const normalized = bodyText.replace(/\s+/g, " ").trim();
+    const redacted = normalized
+        .replace(/Bearer\s+\S+/gi, "Bearer [redacted]")
+        .replace(/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, "[redacted-token]")
+        .replace(/\bsk-[A-Za-z0-9][A-Za-z0-9._:-]{19,}\b/gi, "[redacted-token]")
+        .replace(/\b[a-f0-9]{40,}\b/gi, "[redacted-token]");
+    return redacted ? `HTTP ${status}: ${redacted.slice(0, 200)}` : `HTTP ${status}`;
+}
+function isAbortError(error) {
+    return ((error instanceof Error && error.name === "AbortError") ||
+        (typeof DOMException !== "undefined" &&
+            error instanceof DOMException &&
+            error.name === "AbortError"));
+}
+export async function fetchCodexUsage(params) {
+    const headers = createCodexHeaders(undefined, params.accountId, params.accessToken, {
+        organizationId: params.organizationId,
+    });
+    headers.set("accept", "application/json");
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), params.timeoutMs ?? getFetchTimeoutMs(loadPluginConfig()));
+    try {
+        const response = await fetch(`${CODEX_BASE_URL}/wham/usage`, {
+            method: "GET",
+            headers,
+            signal: controller.signal,
+        });
+        if (!response.ok) {
+            let bodyText = "";
+            try {
+                bodyText = (await response.text()).slice(0, usageErrorBodyMaxChars);
+            }
+            catch (error) {
+                if (isAbortError(error) || controller.signal.aborted) {
+                    throw createUsageRequestTimeoutError();
+                }
+                throw error;
+            }
+            if (controller.signal.aborted) {
+                throw createUsageRequestTimeoutError();
+            }
+            throw new Error(sanitizeUsageErrorMessage(response.status, bodyText));
+        }
+        return (await response.json());
+    }
+    catch (error) {
+        if (isAbortError(error)) {
+            throw createUsageRequestTimeoutError();
+        }
+        throw error;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+function applyRefreshedCredentials(target, result) {
+    target.refreshToken = result.refresh;
+    target.accessToken = result.access;
+    target.expiresAt = result.expires;
+}
+async function persistRefreshedCredentials(params) {
+    return await withAccountStorageTransaction(async (current, persist) => {
+        const latestStorage = current ??
+            {
+                version: 3,
+                accounts: [],
+                activeIndex: 0,
+                activeIndexByFamily: {},
+            };
+        const uniqueMatch = (matches) => matches.length === 1 ? matches[0] : undefined;
+        let updated = false;
+        if (params.previousRefreshToken) {
+            for (const storedAccount of latestStorage.accounts) {
+                if (storedAccount.refreshToken === params.previousRefreshToken) {
+                    applyRefreshedCredentials(storedAccount, params.refreshResult);
+                    updated = true;
+                }
+            }
+        }
+        if (!updated) {
+            const normalizedOrganizationId = params.organizationId?.trim() ?? "";
+            const normalizedEmail = params.email?.trim().toLowerCase();
+            const orgScopedMatches = params.accountId
+                ? latestStorage.accounts.filter((storedAccount) => storedAccount.accountId === params.accountId &&
+                    (storedAccount.organizationId?.trim() ?? "") ===
+                        normalizedOrganizationId)
+                : [];
+            const accountIdMatches = params.accountId
+                ? latestStorage.accounts.filter((storedAccount) => storedAccount.accountId === params.accountId)
+                : [];
+            const emailMatches = normalizedEmail && !params.accountId
+                ? latestStorage.accounts.filter((storedAccount) => storedAccount.email?.trim().toLowerCase() === normalizedEmail)
+                : [];
+            const fallbackTarget = uniqueMatch(orgScopedMatches) ??
+                uniqueMatch(accountIdMatches) ??
+                uniqueMatch(emailMatches);
+            if (fallbackTarget) {
+                applyRefreshedCredentials(fallbackTarget, params.refreshResult);
+                updated = true;
+            }
+        }
+        if (updated) {
+            await persist(latestStorage);
+        }
+        if (!updated) {
+            logWarn(`[${PLUGIN_NAME}] persistRefreshedCredentials could not find a matching stored account. Refreshed credentials remain in-memory for this invocation only.`, {
+                accountId: params.accountId,
+                organizationId: params.organizationId,
+            });
+        }
+        return updated;
+    });
+}
+export async function ensureCodexUsageAccessToken(params) {
+    let accessToken = params.account.accessToken;
+    if (typeof accessToken === "string" &&
+        accessToken &&
+        typeof params.account.expiresAt === "number" &&
+        params.account.expiresAt > Date.now() + 30_000) {
+        return { accessToken, refreshed: false, persisted: false };
+    }
+    const previousRefreshToken = params.account.refreshToken;
+    if (!previousRefreshToken) {
+        throw new Error("Cannot refresh: account has no refresh token");
+    }
+    const refreshResult = await queuedRefresh(previousRefreshToken);
+    if (refreshResult.type !== "success") {
+        throw new Error(refreshResult.message ?? refreshResult.reason);
+    }
+    let refreshedCount = 0;
+    for (const storedAccount of params.storage.accounts) {
+        if (storedAccount.refreshToken === previousRefreshToken) {
+            applyRefreshedCredentials(storedAccount, refreshResult);
+            refreshedCount += 1;
+        }
+    }
+    if (refreshedCount === 0) {
+        applyRefreshedCredentials(params.account, refreshResult);
+    }
+    const persisted = await persistRefreshedCredentials({
+        previousRefreshToken,
+        accountId: params.account.accountId,
+        organizationId: params.account.organizationId,
+        email: params.account.email,
+        refreshResult,
+    });
+    accessToken = refreshResult.access;
+    return { accessToken, refreshed: true, persisted };
+}
+export function deduplicateUsageAccountIndices(storage) {
+    const seenTokens = new Set();
+    const uniqueIndices = [];
+    for (let i = 0; i < storage.accounts.length; i += 1) {
+        const account = storage.accounts[i];
+        if (!account)
+            continue;
+        const refreshToken = typeof account.refreshToken === "string"
+            ? account.refreshToken.trim()
+            : "";
+        if (refreshToken && seenTokens.has(refreshToken))
+            continue;
+        if (refreshToken)
+            seenTokens.add(refreshToken);
+        uniqueIndices.push(i);
+    }
+    return uniqueIndices;
+}
+export function resolveCodexUsageActiveAccount(storage) {
+    if (storage.accounts.length === 0)
+        return null;
+    const rawIndex = storage.activeIndexByFamily?.codex ?? storage.activeIndex;
+    const numericIndex = typeof rawIndex === "number" && Number.isFinite(rawIndex) ? rawIndex : 0;
+    const index = Math.max(0, Math.min(storage.accounts.length - 1, Math.trunc(numericIndex)));
+    const activeAccount = storage.accounts[index];
+    if (!activeAccount)
+        return null;
+    const activeLastUsed = typeof activeAccount.lastUsed === "number" && Number.isFinite(activeAccount.lastUsed)
+        ? activeAccount.lastUsed
+        : 0;
+    let newestIndex = index;
+    let newestLastUsed = activeLastUsed;
+    for (let i = 0; i < storage.accounts.length; i += 1) {
+        const account = storage.accounts[i];
+        const lastUsed = typeof account?.lastUsed === "number" && Number.isFinite(account.lastUsed)
+            ? account.lastUsed
+            : 0;
+        if (account && lastUsed > newestLastUsed) {
+            newestIndex = i;
+            newestLastUsed = lastUsed;
+        }
+    }
+    const account = storage.accounts[newestIndex];
+    return account ? { index: newestIndex, account } : null;
+}
+export function resolveCodexUsageAccountId(params) {
+    return params.account.accountId ?? extractAccountId(params.accessToken);
+}
+export function createUsageAccountFingerprint(account) {
+    const fingerprintSource = [
+        account.accountId ?? "",
+        account.organizationId ?? "",
+        account.refreshToken ?? "",
+    ].join("\0");
+    return createHash("sha256").update(fingerprintSource).digest("hex").slice(0, 16);
+}
+//# sourceMappingURL=codex-usage.js.map