tokenmaxxing 1.33.0 → 1.35.0

package/src/lib/sample.ts

@@ -3,12 +3,12 @@ import { join } from "node:path";
 import { minBy } from "es-toolkit";
 import { z } from "zod";
 import { readItem, writeItem, deleteItem, liveTarget, parkedTarget, isolatedTarget, claudeAiOauthOnly, mergeIntoLive } from "./credstore.ts";
-import { credItemFor, paths } from "./paths.ts";
+import { claudePool, credItemFor, paths } from "./paths.ts";
 import { withClaudeRefreshLock } from "./claudelock.ts";
 import { withLock } from "./lock.ts";
 import { readOAuthAccount } from "./claudejson.ts";
-import { refreshCredential, isAccessTokenExpiring, isDeadCredential, fetchTokenIdentity, describeIdentity, IdentityUnavailableError, InvalidGrantError } from "./oauth.ts";
-import { keepRows, probeUsage } from "./usage.ts";
+import { claudeTierLabel, refreshCredential, isAccessTokenExpiring, isDeadCredential, fetchTokenIdentity, describeIdentity, IdentityUnavailableError, InvalidGrantError } from "./oauth.ts";
+import { mergeWindows, probeUsage, windowsOf } from "./usage.ts";
 import { POST_SWAP_COOLDOWN_MS, loadAccounts, loadLastSwapAt, saveAccounts } from "./state.ts";
 import { keepRotatedPair } from "./swap.ts";
 import { log } from "./log.ts";
@@ -38,13 +38,12 @@ async function checkIdentity(creds: OAuthCreds, account: Account, signal?: Abort
       stale: e instanceof IdentityUnavailableError && e.status === 401,
     };
   }
-  if (identity.accountUuid === account.accountUuid) return { status: "match" };
+  if (identity.accountUuid === account.id) return { status: "match" };
   return { status: "mismatch", reason: `credential actually belongs to ${describeIdentity(identity)}`, owner: identity };
 }
 
-function refreshPlanFields(account: Account, creds: OAuthCreds): void {
-  if (creds.subscriptionType != null) account.subscriptionType = creds.subscriptionType;
-  if (creds.rateLimitTier != null) account.rateLimitTier = creds.rateLimitTier;
+function refreshTier(account: Account, creds: OAuthCreds): void {
+  account.tier = claudeTierLabel(creds) ?? account.tier;
 }
 
 const ProbeFailureSchema = z.object({ ok: z.literal(false), reason: z.string() });
@@ -53,9 +52,10 @@ const PreparedProbeSchema = z.discriminatedUnion("ok", [z.object({ ok: z.literal
 type PreparedProbe = z.infer<typeof PreparedProbeSchema>;
 
 async function prepareParkedProbe(account: Account, dir: string, signal?: AbortSignal): Promise<PreparedProbe> {
-  const backup = parkedTarget(account.keychainItem);
+  const backup = parkedTarget(credItemFor(account.id));
   const parkedRaw = await readItem(backup);
   if (!parkedRaw) return { ok: false, reason: "no parked credential - run `tokenmaxxing auth`" };
+  if (!account.oauthAccount) return { ok: false, reason: "account record has no oauthAccount - run `tokenmaxxing auth`" };
 
   let creds: OAuthCreds;
   try {
@@ -87,17 +87,17 @@ async function prepareParkedProbe(account: Account, dir: string, signal?: AbortS
       } catch (e) {
         return { ok: false, reason: `cannot verify the live credential's owner (${(e instanceof Error ? e.message : String(e)).slice(0, 80)}) - refusing to sample a possibly-live account` };
       }
-      if (liveAccount === account.accountUuid) {
+      if (liveAccount === account.id) {
         return { ok: false, reason: "this account holds the LIVE login (active label drifted) - run `tokenmaxxing switch` to reconcile" };
       }
     }
   }
 
   const relocate = async (owner: TokenIdentity): Promise<string> => {
-    const pooled = loadAccounts().accounts.find((a) => a.accountUuid === owner.accountUuid) ?? null;
-    if (pooled == null || pooled.accountUuid === liveAccount) return "was left in place";
-    await writeItem(parkedTarget(pooled.keychainItem), JSON.stringify({ claudeAiOauth: creds }));
-    log("swap.parked_relocated", { account: pooled.accountUuid.slice(0, 8) });
+    const pooled = loadAccounts(claudePool).accounts.find((a) => a.id === owner.accountUuid) ?? null;
+    if (pooled == null || pooled.id === liveAccount) return "was left in place";
+    await writeItem(parkedTarget(credItemFor(pooled.id)), JSON.stringify({ claudeAiOauth: creds }));
+    log("swap.parked_relocated", { account: pooled.id.slice(0, 8) });
     return "was copied to that account's slot";
   };
 
@@ -140,8 +140,8 @@ async function prepareParkedProbe(account: Account, dir: string, signal?: AbortS
             await writeItem(backup, JSON.stringify({ claudeAiOauth: rotated.fresh }));
             return { failed: { ok: false, reason: `${verified.reason} - the rotated pair stays in this slot unverified until the next pass` } };
           }
-          const trueOwner = loadAccounts().accounts.find((a) => a.accountUuid === verified.owner.accountUuid) ?? null;
-          const kept = await keepRotatedPair({ fresh: rotated.fresh, owner: trueOwner, fallback: account, liveOwnerUuid: liveAccount, expectedLiveToken: liveToken, lock });
+          const trueOwner = loadAccounts(claudePool).accounts.find((a) => a.id === verified.owner.accountUuid) ?? null;
+          const kept = await keepRotatedPair({ fresh: rotated.fresh, owner: trueOwner, fallback: account, liveOwnerId: liveAccount, expectedLiveToken: liveToken, lock });
           account.needsReauth = true;
           return { failed: { ok: false, reason: `${verified.reason}, whose grant this refresh rotated - the rotated token ${kept}; re-auth with \`tokenmaxxing auth\`` } };
         });
@@ -163,7 +163,7 @@ async function prepareParkedProbe(account: Account, dir: string, signal?: AbortS
   if (identity.status === "unavailable") {
     return { ok: false, reason: identity.reason };
   }
-  refreshPlanFields(account, creds);
+  refreshTier(account, creds);
 
   rmSync(dir, { recursive: true, force: true });
   mkdirSync(dir, { recursive: true });
@@ -185,7 +185,7 @@ async function runParkedProbe(dir: string, opts: { retries?: number }): Promise<
 
 async function finishParkedProbe(account: Account, prepared: { dir: string; installed: string }): Promise<void> {
   const isoTarget = isolatedTarget(prepared.dir);
-  const backup = parkedTarget(account.keychainItem);
+  const backup = parkedTarget(credItemFor(account.id));
   try {
     const afterIso = await readItem(isoTarget);
     if (afterIso && afterIso !== prepared.installed) {
@@ -193,7 +193,7 @@ async function finishParkedProbe(account: Account, prepared: { dir: string; inst
       const installedToken = CredentialBlobSchema.parse(JSON.parse(prepared.installed)).claudeAiOauth.accessToken;
       const parkedToken = parkedNow == null ? null : CredentialBlobSchema.parse(JSON.parse(parkedNow)).claudeAiOauth.accessToken;
       if (parkedToken === installedToken) await writeItem(backup, claudeAiOauthOnly(afterIso));
-      else log("sample.harvest_skipped", { account: account.accountUuid.slice(0, 8) });
+      else log("sample.harvest_skipped", { account: account.id.slice(0, 8) });
     }
   } finally {
     await deleteItem(isoTarget);
@@ -202,7 +202,7 @@ async function finishParkedProbe(account: Account, prepared: { dir: string; inst
 }
 
 export async function probeParkedUsage(account: Account): Promise<SampleOutcome> {
-  const prepared = await prepareParkedProbe(account, join(paths.sampleDir, credItemFor(account.accountUuid)));
+  const prepared = await prepareParkedProbe(account, join(paths.sampleDir, credItemFor(account.id)));
   if (!prepared.ok) return prepared;
   try {
     return await runParkedProbe(prepared.dir, {});
@@ -214,21 +214,21 @@ export async function probeParkedUsage(account: Account): Promise<SampleOutcome>
 const PREPARE_DEADLINE_MS = 20_000;
 
 export async function sampleOldestParked(cfg: Config): Promise<void> {
-  const reserved = await withLock(paths.lockFile, async () => {
+  const reserved = await withLock(claudePool.lockFile, async () => {
     const now = Date.now();
-    const lastSwapAt = loadLastSwapAt();
+    const lastSwapAt = loadLastSwapAt(claudePool);
     if (lastSwapAt != null && now - lastSwapAt < POST_SWAP_COOLDOWN_MS) return null;
-    const idx = loadAccounts();
+    const idx = loadAccounts(claudePool);
     const live = readOAuthAccount()?.accountUuid ?? null;
     const sampledAt = (a: Account) => Math.max(a.lastUsageAt ?? 0, a.lastProbeAt ?? 0);
-    const stale = idx.accounts.filter((a) => a.accountUuid !== live && a.needsReauth !== true && now - sampledAt(a) > cfg.policy.usagePollTtlMs);
+    const stale = idx.accounts.filter((a) => a.id !== live && a.needsReauth !== true && now - sampledAt(a) > cfg.policy.usagePollTtlMs);
     const target = minBy(stale, sampledAt);
     if (!target) return null;
     target.lastProbeAt = now;
-    const prepared = await prepareParkedProbe(target, join(paths.sampleDir, `${credItemFor(target.accountUuid)}-tick`), AbortSignal.timeout(PREPARE_DEADLINE_MS));
-    saveAccounts(idx);
+    const prepared = await prepareParkedProbe(target, join(paths.sampleDir, `${credItemFor(target.id)}-tick`), AbortSignal.timeout(PREPARE_DEADLINE_MS));
+    saveAccounts(claudePool, idx);
     if (!prepared.ok) {
-      log("sample.parked_failed", { account: target.accountUuid.slice(0, 8), reason: prepared.reason.slice(0, 200) });
+      log("sample.parked_failed", { account: target.id.slice(0, 8), reason: prepared.reason.slice(0, 200) });
       return null;
     }
     return { account: target, prepared };
@@ -240,18 +240,18 @@ export async function sampleOldestParked(cfg: Config): Promise<void> {
   try {
     outcome = await runParkedProbe(prepared.dir, { retries: 0 });
   } finally {
-    await withLock(paths.lockFile, async () => {
+    await withLock(claudePool.lockFile, async () => {
       await finishParkedProbe(account, prepared);
       if (outcome == null) return;
-      const idx = loadAccounts();
-      const stored = idx.accounts.find((a) => a.accountUuid === account.accountUuid);
+      const idx = loadAccounts(claudePool);
+      const stored = idx.accounts.find((a) => a.id === account.id);
       if (stored && outcome.ok && (stored.lastUsageAt == null || startedAt > stored.lastUsageAt)) {
-        stored.lastUsage = keepRows(outcome.usage, stored.lastUsage, startedAt);
+        stored.windows = mergeWindows(windowsOf(outcome.usage, startedAt), stored.windows);
         stored.lastUsageAt = startedAt;
-        saveAccounts(idx);
+        saveAccounts(claudePool, idx);
       }
       log(outcome.ok ? "sample.parked_ok" : "sample.parked_failed", {
-        account: account.accountUuid.slice(0, 8),
+        account: account.id.slice(0, 8),
         ...(outcome.ok ? {} : { reason: outcome.reason.slice(0, 200) }),
       });
     });
@@ -300,7 +300,7 @@ export async function probeActiveUsage(account: Account): Promise<SampleOutcome>
   const identity = await checkIdentity(creds, account);
   if (identity.status === "mismatch") return { ok: false, reason: `live ${identity.reason} - active label drifted; run \`tokenmaxxing switch\`` };
   if (identity.status === "unavailable") return { ok: false, reason: identity.reason };
-  refreshPlanFields(account, creds);
+  refreshTier(account, creds);
 
   const usage = await probeUsage();
   return usage ? { ok: true, usage } : { ok: false, reason: "`/usage` returned no limit data (see log)" };

package/src/lib/state.ts

@@ -1,16 +1,18 @@
 import { closeSync, existsSync, fstatSync, openSync, readFileSync, rmSync, utimesSync } from "node:fs";
 import { isEqual } from "es-toolkit";
 import { z } from "zod";
-import { paths, realClaudeBinFromEnv, realCodexBinFromEnv } from "./paths.ts";
+import { paths, realClaudeBinFromEnv, realCodexBinFromEnv, type PoolPaths } from "./paths.ts";
 import { writeFileAtomic } from "./atomic.ts";
 import {
   AccountsIndexSchema,
   ConfigSchema,
   LastSwapSchema,
   UsageStateSchema,
+  type Account,
   type AccountsIndex,
   type Config,
   type UsageState,
+  type Window,
 } from "./types.ts";
 
 export function loadConfig(): Config {
@@ -44,25 +46,56 @@ export function pinBinOverride(input: { key: "claudeBin" | "codexBin"; bin: stri
   writeFileAtomic(paths.configJson, JSON.stringify(raw, null, 2) + "\n");
 }
 
-const emptyIndex = (): AccountsIndex => ({ version: 1, activeAccountUuid: null, accounts: [] });
+const emptyIndex = (): AccountsIndex => ({ version: 2, activeId: null, accounts: [] });
 
-export function loadAccounts(): AccountsIndex {
-  if (!existsSync(paths.accountsJson)) return emptyIndex();
+export function loadAccounts(pool: PoolPaths): AccountsIndex {
+  if (!existsSync(pool.accountsJson)) return emptyIndex();
   let json: unknown;
   try {
-    json = JSON.parse(readFileSync(paths.accountsJson, "utf8"));
+    json = JSON.parse(readFileSync(pool.accountsJson, "utf8"));
   } catch {
-    throw new Error(`${paths.accountsJson} is corrupt (unparsable JSON) - refusing to treat a damaged pool as empty; repair or remove the file`);
+    throw new Error(`${pool.accountsJson} is corrupt (unparsable JSON) - refusing to treat a damaged pool as empty; repair or remove the file`);
   }
   const parsed = AccountsIndexSchema.safeParse(json);
   if (!parsed.success) {
-    throw new Error(`${paths.accountsJson} does not match the accounts schema - refusing to treat a damaged pool as empty; repair or remove the file`);
+    throw new Error(`${pool.accountsJson} does not match the accounts schema - refusing to treat a damaged pool as empty; repair or remove the file`);
   }
   return parsed.data;
 }
 
-export function saveAccounts(idx: AccountsIndex): void {
-  writeFileAtomic(paths.accountsJson, JSON.stringify(AccountsIndexSchema.parse(idx), null, 2) + "\n");
+export function saveAccounts(pool: PoolPaths, idx: AccountsIndex): void {
+  writeFileAtomic(pool.accountsJson, JSON.stringify(AccountsIndexSchema.parse(idx), null, 2) + "\n");
+}
+
+export type Harvest = {
+  id: string;
+  email: string | null;
+  tier: string | null;
+  oauthAccount?: Account["oauthAccount"];
+  sample: { windows: Window[]; at: number } | null;
+  park: () => Promise<void>;
+};
+
+export function upsertAccount(
+  idx: AccountsIndex,
+  h: Harvest,
+  mergeWindows: (next: Window[], prev: Window[]) => Window[],
+): Account {
+  const existing = idx.accounts.find((a) => a.id === h.id);
+  const fresh: Account = {
+    id: h.id,
+    label: existing?.label ?? h.email ?? h.id.slice(0, 8),
+    email: h.email,
+    tier: h.tier,
+    addedAt: existing?.addedAt ?? new Date().toISOString(),
+    windows: h.sample ? mergeWindows(h.sample.windows, existing?.windows ?? []) : (existing?.windows ?? []),
+    lastUsageAt: h.sample ? h.sample.at : existing?.lastUsageAt,
+    needsReauth: false,
+    ...(h.oauthAccount ? { oauthAccount: h.oauthAccount } : {}),
+  };
+  if (existing) Object.assign(existing, fresh);
+  else idx.accounts.push(fresh);
+  return existing ?? fresh;
 }
 
 export function loadUsageSnapshot(): { state: UsageState; at: number } | null {
@@ -91,22 +124,22 @@ export function clearUsageSnapshots(): void {
   rmSync(paths.usageJson, { force: true });
 }
 
-export function loadLastSwapAt(): number | null {
-  if (!existsSync(paths.lastSwapJson)) return null;
+export function loadLastSwapAt(pool: PoolPaths): number | null {
+  if (!existsSync(pool.lastSwapJson)) return null;
   let json: unknown;
   try {
-    json = JSON.parse(readFileSync(paths.lastSwapJson, "utf8"));
+    json = JSON.parse(readFileSync(pool.lastSwapJson, "utf8"));
   } catch {
-    throw new Error(`${paths.lastSwapJson} is corrupt (unparsable JSON) - refusing to treat a damaged swap clock as never-swapped; repair or remove the file`);
+    throw new Error(`${pool.lastSwapJson} is corrupt (unparsable JSON) - refusing to treat a damaged swap clock as never-swapped; repair or remove the file`);
   }
   return LastSwapSchema.parse(json).ts;
 }
 
-export function saveLastSwapAt(ts: number): void {
-  writeFileAtomic(paths.lastSwapJson, JSON.stringify(LastSwapSchema.parse({ ts })));
+export function saveLastSwapAt(pool: PoolPaths, ts: number): void {
+  writeFileAtomic(pool.lastSwapJson, JSON.stringify(LastSwapSchema.parse({ ts })));
 }
 
-const DepletedWaitSchema = z.object({ waitUntil: z.number(), accountUuid: z.string(), ts: z.number() });
+const DepletedWaitSchema = z.object({ waitUntil: z.number(), id: z.string(), ts: z.number() });
 export type DepletedWait = z.infer<typeof DepletedWaitSchema>;
 
 export function loadDepletedWait(): DepletedWait | null {

package/src/lib/swap.ts

@@ -3,6 +3,7 @@ import { readItem, writeItem, liveTarget, parkedTarget, claudeAiOauthOnly, merge
 import { refreshCredential, isAccessTokenExpiring, isDeadCredential, fetchTokenIdentity, describeIdentity, IdentityUnavailableError, InvalidGrantError, RefreshRejectedError } from "./oauth.ts";
 import { swapOAuthAccount } from "./claudejson.ts";
 import { withClaudeRefreshLock } from "./claudelock.ts";
+import { claudePool, credItemFor } from "./paths.ts";
 import { log } from "./log.ts";
 import { CredentialBlobSchema, type Account, type OAuthCreds, type TokenIdentity } from "./types.ts";
 
@@ -11,7 +12,9 @@ function parseBlob(raw: string) {
 }
 
 export async function performSwap(target: Account): Promise<void> {
-  const idx = loadAccounts();
+  const idx = loadAccounts(claudePool);
+  const oauthAccount = target.oauthAccount;
+  if (!oauthAccount) throw new Error(`${target.label} has no oauthAccount on its record - re-add it with \`tokenmaxxing auth ${target.label}\``);
 
   const preLive = await readItem(liveTarget());
   let liveOwner: Account | null = null;
@@ -49,31 +52,31 @@ export async function performSwap(target: Account): Promise<void> {
       } catch (e) {
         throw new Error(`cannot resolve the live credential's owner (${e instanceof Error ? e.message : String(e)}) - refusing to swap over it; the next check retries`);
       }
-      liveOwner = idx.accounts.find((a) => a.accountUuid === identity.accountUuid) ?? null;
+      liveOwner = idx.accounts.find((a) => a.id === identity.accountUuid) ?? null;
       if (!liveOwner) {
         throw new Error(
           `live credential belongs to ${describeIdentity(identity)}, which is not in the pool - refusing to swap over it; import it first with \`tokenmaxxing add\``,
         );
       }
-      if (liveOwner.accountUuid !== idx.activeAccountUuid) {
+      if (liveOwner.id !== idx.activeId) {
         log("swap.harvest_drift", {
-          labeled: idx.activeAccountUuid?.slice(0, 8) ?? null,
-          actual: liveOwner.accountUuid.slice(0, 8),
+          labeled: idx.activeId?.slice(0, 8) ?? null,
+          actual: liveOwner.id.slice(0, 8),
         });
       }
     }
   }
 
-  const selfSwap = liveOwner != null && liveOwner.accountUuid === target.accountUuid;
+  const selfSwap = liveOwner != null && liveOwner.id === target.id;
   let fresh: OAuthCreds | null = null;
   if (!selfSwap) {
-    const parkedRaw = await readItem(parkedTarget(target.keychainItem));
-    if (!parkedRaw) throw new Error(`no parked credential for ${target.email}`);
+    const parkedRaw = await readItem(parkedTarget(credItemFor(target.id)));
+    if (!parkedRaw) throw new Error(`no parked credential for ${target.label}`);
     const parked = parseBlob(parkedRaw).claudeAiOauth;
     const markDead = (detail: string): InvalidGrantError => {
-      const t = idx.accounts.find((a) => a.accountUuid === target.accountUuid);
-      if (t) { t.needsReauth = true; saveAccounts(idx); }
-      log("swap.invalid_grant", { account: target.accountUuid.slice(0, 8), detail });
+      const t = idx.accounts.find((a) => a.id === target.id);
+      if (t) { t.needsReauth = true; saveAccounts(claudePool, idx); }
+      log("swap.invalid_grant", { account: target.id.slice(0, 8), detail });
       return new InvalidGrantError(detail);
     };
     if (isDeadCredential(parked)) throw markDead("parked credential was cleared after a failed refresh - re-auth with `tokenmaxxing auth`");
@@ -82,14 +85,14 @@ export async function performSwap(target: Account): Promise<void> {
       parkedOwner = await fetchTokenIdentity(parked.accessToken);
     } catch (e) {
       if (!(e instanceof IdentityUnavailableError && e.status === 401)) throw e;
-      log("swap.parked_token_stale", { account: target.accountUuid.slice(0, 8) });
+      log("swap.parked_token_stale", { account: target.id.slice(0, 8) });
     }
-    if (parkedOwner != null && parkedOwner.accountUuid !== target.accountUuid) {
-      const owner = idx.accounts.find((a) => a.accountUuid === parkedOwner.accountUuid) ?? null;
+    if (parkedOwner != null && parkedOwner.accountUuid !== target.id) {
+      const owner = idx.accounts.find((a) => a.id === parkedOwner.accountUuid) ?? null;
       let kept = "was left in place";
-      if (owner != null && owner.accountUuid !== liveOwner?.accountUuid) {
-        await writeItem(parkedTarget(owner.keychainItem), JSON.stringify({ claudeAiOauth: parked }));
-        log("swap.parked_relocated", { account: owner.accountUuid.slice(0, 8) });
+      if (owner != null && owner.id !== liveOwner?.id) {
+        await writeItem(parkedTarget(credItemFor(owner.id)), JSON.stringify({ claudeAiOauth: parked }));
+        log("swap.parked_relocated", { account: owner.id.slice(0, 8) });
         kept = "was copied to that account's slot";
       }
       throw markDead(`parked credential belongs to ${describeIdentity(parkedOwner)} - refusing to spend another account's grant; the pair ${kept}; re-auth with \`tokenmaxxing auth ${target.label}\``);
@@ -99,7 +102,7 @@ export async function performSwap(target: Account): Promise<void> {
         return await refreshCredential(parked);
       } catch (e) {
         if (e instanceof InvalidGrantError) throw markDead(e.detail);
-        if (e instanceof RefreshRejectedError) log("swap.refresh_rejected", { account: target.accountUuid.slice(0, 8), status: e.status, detail: e.detail });
+        if (e instanceof RefreshRejectedError) log("swap.refresh_rejected", { account: target.id.slice(0, 8), status: e.status, detail: e.detail });
         throw e;
       }
     };
@@ -112,18 +115,18 @@ export async function performSwap(target: Account): Promise<void> {
         try {
           freshOwner = await fetchTokenIdentity(rotated.accessToken);
         } catch (e) {
-          await writeItem(parkedTarget(target.keychainItem), JSON.stringify({ claudeAiOauth: rotated }));
+          await writeItem(parkedTarget(credItemFor(target.id)), JSON.stringify({ claudeAiOauth: rotated }));
           throw new Error(`refreshed the parked credential but cannot verify its owner (${e instanceof Error ? e.message : String(e)}) - kept the rotated token parked; the next check retries`);
         }
-        if (freshOwner.accountUuid !== target.accountUuid) {
-          const owner = idx.accounts.find((a) => a.accountUuid === freshOwner.accountUuid) ?? null;
-          const kept = await keepRotatedPair({ fresh: rotated, owner, fallback: target, liveOwnerUuid: liveOwner?.accountUuid ?? null, expectedLiveToken, lock });
+        if (freshOwner.accountUuid !== target.id) {
+          const owner = idx.accounts.find((a) => a.id === freshOwner.accountUuid) ?? null;
+          const kept = await keepRotatedPair({ fresh: rotated, owner, fallback: target, liveOwnerId: liveOwner?.id ?? null, expectedLiveToken, lock });
           throw markDead(`parked credential belongs to ${describeIdentity(freshOwner)}, whose grant this refresh rotated - the rotated token ${kept}; re-auth with \`tokenmaxxing auth ${target.label}\``);
         }
         return rotated;
       });
     }
-    await writeItem(parkedTarget(target.keychainItem), JSON.stringify({ claudeAiOauth: fresh }));
+    await writeItem(parkedTarget(credItemFor(target.id)), JSON.stringify({ claudeAiOauth: fresh }));
   }
 
   await withClaudeRefreshLock(async (lock) => {
@@ -136,44 +139,44 @@ export async function performSwap(target: Account): Promise<void> {
     }
 
     if (liveOwner && currentLive) {
-      await writeItem(parkedTarget(liveOwner.keychainItem), claudeAiOauthOnly(currentLive));
-      log("swap.harvest", { account: liveOwner.accountUuid.slice(0, 8) });
+      await writeItem(parkedTarget(credItemFor(liveOwner.id)), claudeAiOauthOnly(currentLive));
+      log("swap.harvest", { account: liveOwner.id.slice(0, 8) });
     }
 
     if (fresh != null) {
       await writeItem(liveTarget(), mergeIntoLive(currentLive, fresh));
     }
-    swapOAuthAccount(target.oauthAccount);
-    idx.activeAccountUuid = target.accountUuid;
-    const t2 = idx.accounts.find((a) => a.accountUuid === target.accountUuid);
+    swapOAuthAccount(oauthAccount);
+    idx.activeId = target.id;
+    const t2 = idx.accounts.find((a) => a.id === target.id);
     if (t2) { t2.needsReauth = false; }
-    saveAccounts(idx);
+    saveAccounts(claudePool, idx);
     clearUsageSnapshots();
     clearDepletedWait();
-    saveLastSwapAt(Date.now());
+    saveLastSwapAt(claudePool, Date.now());
   });
-  log("swap.done", { account: target.accountUuid.slice(0, 8), email: target.email });
+  log("swap.done", { account: target.id.slice(0, 8), label: target.label });
 }
 
 export async function keepRotatedPair(input: {
   fresh: OAuthCreds;
   owner: Account | null;
   fallback: Account;
-  liveOwnerUuid: string | null;
+  liveOwnerId: string | null;
   expectedLiveToken: string | null;
   lock: { compromised: () => boolean };
 }): Promise<string> {
   const { fresh, owner } = input;
   if (owner == null) {
-    await writeItem(parkedTarget(input.fallback.keychainItem), JSON.stringify({ claudeAiOauth: fresh }));
-    log("swap.rotated_kept_in_stamped_slot", { account: input.fallback.accountUuid.slice(0, 8) });
+    await writeItem(parkedTarget(credItemFor(input.fallback.id)), JSON.stringify({ claudeAiOauth: fresh }));
+    log("swap.rotated_kept_in_stamped_slot", { account: input.fallback.id.slice(0, 8) });
     return "was kept in this account's stamped slot because its owner is not in the pool";
   }
   const park = async (): Promise<void> => {
-    await writeItem(parkedTarget(owner.keychainItem), JSON.stringify({ claudeAiOauth: fresh }));
-    log("swap.rotated_parked_rescued", { account: owner.accountUuid.slice(0, 8) });
+    await writeItem(parkedTarget(credItemFor(owner.id)), JSON.stringify({ claudeAiOauth: fresh }));
+    log("swap.rotated_parked_rescued", { account: owner.id.slice(0, 8) });
   };
-  if (input.liveOwnerUuid !== owner.accountUuid) {
+  if (input.liveOwnerId !== owner.id) {
     await park();
     return "was parked under that account";
   }
@@ -182,7 +185,7 @@ export async function keepRotatedPair(input: {
     if (input.lock.compromised()) throw new Error("refresh lock compromised");
     if (currentLive == null || parseBlob(currentLive).claudeAiOauth.accessToken !== input.expectedLiveToken) throw new Error("live credential changed while unlocked");
     await writeItem(liveTarget(), mergeIntoLive(currentLive, fresh));
-    log("swap.rotated_live_rescued", { account: owner.accountUuid.slice(0, 8) });
+    log("swap.rotated_live_rescued", { account: owner.id.slice(0, 8) });
     return "was installed into the live store so that account's sessions continue";
   } catch (e) {
     await park();

package/src/lib/types.ts

@@ -38,10 +38,18 @@ const AggregateWindowsSchema = z.object({
 
 export const UsageWindowsSchema = AggregateWindowsSchema.extend({
   perModel: z.record(z.string(), UsageWindowSchema).default({}),
-  rowsAt: z.number().optional(),
 });
 export type UsageWindows = z.infer<typeof UsageWindowsSchema>;
 
+export const WindowSchema = z.object({
+  name: z.string().nullable(),
+  usedPercentage: z.number(),
+  resetsAt: z.number().nullable(),
+  windowSeconds: z.number().nullable(),
+  sampledAt: z.number(),
+});
+export type Window = z.infer<typeof WindowSchema>;
+
 const ModelInfoSchema = z.object({ id: z.string(), display: z.string() });
 export type ModelInfo = z.infer<typeof ModelInfoSchema>;
 
@@ -54,26 +62,23 @@ export const UsageStateSchema = AggregateWindowsSchema.extend({
 export type UsageState = z.infer<typeof UsageStateSchema>;
 
 export const AccountSchema = z.object({
-  accountUuid: z.string(),
-  email: z.string(),
-  organizationUuid: z.string(),
+  id: z.string(),
   label: z.string(),
-  keychainItem: z.string(),
-  oauthAccount: OAuthAccountSchema,
+  email: z.string().nullable(),
+  tier: z.string().nullable(),
   addedAt: z.string(),
-  lastUsage: UsageWindowsSchema.optional(),
+  windows: z.array(WindowSchema).default([]),
   lastUsageAt: z.number().optional(),
   lastProbeAt: z.number().optional(),
   enforcedUntil: z.number().optional(),
   needsReauth: z.boolean().optional(),
-  subscriptionType: z.string().optional(),
-  rateLimitTier: z.string().optional(),
+  oauthAccount: OAuthAccountSchema.optional(),
 });
 export type Account = z.infer<typeof AccountSchema>;
 
 export const AccountsIndexSchema = z.object({
-  version: z.literal(1),
-  activeAccountUuid: z.string().nullable(),
+  version: z.literal(2),
+  activeId: z.string().nullable(),
   accounts: z.array(AccountSchema).default([]),
 });
 
@@ -216,53 +221,14 @@ export const CodexAuthJsonSchema = z.looseObject({
 });
 export type CodexAuthJson = z.infer<typeof CodexAuthJsonSchema>;
 
-const CodexWindowSchema = z.object({
-  usedPercentage: z.number(),
-  resetsAt: z.number().nullable(),
-  windowSeconds: z.number().nullable(),
-});
-export type CodexWindow = z.infer<typeof CodexWindowSchema>;
-
 export const CodexUsageSchema = z.object({
   accountId: z.string(),
   email: z.string().nullable(),
   planType: z.string().nullable(),
-  aggregate: z.array(CodexWindowSchema),
-  perLimit: z.record(z.string(), z.array(CodexWindowSchema)),
+  windows: z.array(WindowSchema),
 });
 export type CodexUsage = z.infer<typeof CodexUsageSchema>;
 
-const BareFileNameSchema = z
-  .string()
-  .refine((s) => s.length > 0 && s !== "." && s !== ".." && !s.includes("/") && !s.includes("\\"), {
-    message: "credFile must be a bare file name, not a path",
-  });
-
-export const CodexAccountSchema = z.object({
-  accountId: z.string(),
-  email: z.string().nullable(),
-  label: z.string(),
-  planType: z.string().nullable(),
-  credFile: BareFileNameSchema,
-  addedAt: z.string(),
-  needsReauth: z.boolean().optional(),
-  lastUsage: z
-    .object({
-      aggregate: z.array(CodexWindowSchema),
-      perLimit: z.record(z.string(), z.array(CodexWindowSchema)),
-    })
-    .optional(),
-  lastUsageAt: z.number().optional(),
-});
-export type CodexAccount = z.infer<typeof CodexAccountSchema>;
-
-export const CodexAccountsIndexSchema = z.object({
-  version: z.literal(1),
-  activeAccountId: z.string().nullable(),
-  accounts: z.array(CodexAccountSchema).default([]),
-});
-export type CodexAccountsIndex = z.infer<typeof CodexAccountsIndexSchema>;
-
 export const CodexStopStdinSchema = z.looseObject({
   session_id: z.string().optional(),
   hook_event_name: z.string().optional(),

package/src/lib/usage.ts

@@ -3,7 +3,7 @@ import { delay } from "es-toolkit";
 import { z } from "zod";
 import { MAX_WRAP_DEPTH, WRAP_DEPTH_ENV, resolveRealClaude } from "./claudebin.ts";
 import { log } from "./log.ts";
-import { RateLimitsStdinSchema, type ModelInfo, type UsageWindow, type UsageWindows } from "./types.ts";
+import { RateLimitsStdinSchema, type ModelInfo, type UsageWindow, type UsageWindows, type Window } from "./types.ts";
 
 export function normalizeResetsAt(v: unknown): number | null {
   const num = z.number().finite().safeParse(v);
@@ -239,9 +239,22 @@ export function parseUsageText(text: string, now = Date.now()): UsageWindows | n
   return { fiveHour, sevenDay, perModel };
 }
 
-export function keepRows(next: UsageWindows, prev: UsageWindows | undefined, at: number): UsageWindows {
-  if (Object.keys(next.perModel).length > 0 && (prev?.rowsAt == null || prev.rowsAt <= at)) return { ...next, rowsAt: at };
-  return { ...next, perModel: prev?.perModel ?? {}, ...(prev?.rowsAt != null ? { rowsAt: prev.rowsAt } : {}) };
+const FIVE_HOURS_S = 5 * 3600;
+const WEEK_S = 7 * 24 * 3600;
+
+export function windowsOf(u: UsageWindows, at: number): Window[] {
+  return [
+    { name: null, ...u.fiveHour, windowSeconds: FIVE_HOURS_S, sampledAt: at },
+    { name: null, ...u.sevenDay, windowSeconds: WEEK_S, sampledAt: at },
+    ...Object.entries(u.perModel).map(([name, w]) => ({ name, ...w, windowSeconds: WEEK_S, sampledAt: at })),
+  ];
+}
+
+export function mergeWindows(next: Window[], prev: Window[]): Window[] {
+  const named = (ws: Window[]) => ws.filter((w) => w.name != null);
+  const newest = (ws: Window[]) => Math.max(0, ...ws.map((w) => w.sampledAt));
+  const rows = named(next).length > 0 && newest(named(prev)) <= newest(named(next)) ? named(next) : named(prev);
+  return [...next.filter((w) => w.name == null), ...rows];
 }
 
 export const CRED_ENV_OVERRIDES = [