tokenmaxxing 1.34.0 → 1.38.0

package/src/lib/codexauth.ts

@@ -3,18 +3,14 @@ import { join } from "node:path";
 import { z } from "zod";
 import { writeFileAtomic } from "./atomic.ts";
 import { codexPaths } from "./paths.ts";
-import { CodexAuthJsonSchema, type CodexAuthJson } from "./types.ts";
-
-function isEnoent(e: unknown): boolean {
-  return e instanceof Error && "code" in e && e.code === "ENOENT";
-}
+import { CodexAuthJsonSchema, ErrnoSchema, type CodexAuthJson } from "./types.ts";
 
 export function readCodexAuthAt(input: { path: string }): CodexAuthJson | null {
   let raw: string;
   try {
     raw = readFileSync(input.path, "utf8");
   } catch (e) {
-    if (isEnoent(e)) return null;
+    if (ErrnoSchema.safeParse(e).data?.code === "ENOENT") return null;
     throw e;
   }
   const parsed = JSON.parse(raw);
@@ -27,6 +23,12 @@ export function readLiveCodexAuth(): CodexAuthJson | null {
   return readCodexAuthAt({ path: codexPaths.authJson });
 }
 
+export function liveCodexAccountId(): string | null {
+  const live = readLiveCodexAuth();
+  if (!live) return null;
+  return codexIdentityOf({ auth: live }).accountId;
+}
+
 export function writeLiveCodexAuth(input: { auth: CodexAuthJson }): void {
   writeFileAtomic(codexPaths.authJson, JSON.stringify(CodexAuthJsonSchema.parse(input.auth), null, 2), 0o600);
 }
@@ -40,7 +42,7 @@ export function readParkedCodexAuth(input: { credFile: string }): CodexAuthJson
   try {
     raw = readFileSync(parkedPath(input), "utf8");
   } catch (e) {
-    if (isEnoent(e)) return null;
+    if (ErrnoSchema.safeParse(e).data?.code === "ENOENT") return null;
     throw e;
   }
   return CodexAuthJsonSchema.parse(JSON.parse(raw));

package/src/lib/codexoauth.ts

@@ -1,10 +1,10 @@
 import { z } from "zod";
 import { http, oauthErrorCode, safeErrorDetail } from "./http.ts";
-import { CodexAuthJsonSchema, type CodexAuthJson } from "./types.ts";
+import { env } from "./paths.ts";
+import { CodexAuthJsonSchema, JsonTextSchema, type CodexAuthJson } from "./types.ts";
 
-const EnvOverrideSchema = z.string().min(1).optional().catch(undefined);
-const TOKEN_URL = EnvOverrideSchema.parse(process.env.TOKENMAXXING_CODEX_TOKEN_URL) ?? "https://auth.openai.com/oauth/token";
-const CLIENT_ID = EnvOverrideSchema.parse(process.env.TOKENMAXXING_CODEX_CLIENT_ID) ?? "app_EMoamEEZ73f0CkXaXp7hrann";
+const TOKEN_URL = env("TOKENMAXXING_CODEX_TOKEN_URL", "https://auth.openai.com/oauth/token");
+const CLIENT_ID = env("TOKENMAXXING_CODEX_CLIENT_ID", "app_EMoamEEZ73f0CkXaXp7hrann");
 
 export class CodexInvalidGrantError extends Error {
   constructor(detail: string) {
@@ -60,13 +60,7 @@ export async function refreshCodexAuth(input: { auth: CodexAuthJson; now?: numbe
     throw new CodexRefreshFailedError(`HTTP ${res.status}: ${detail}`);
   }
 
-  const parsed = CodexRefreshResponseSchema.safeParse((() => {
-    try {
-      return JSON.parse(text);
-    } catch {
-      return null;
-    }
-  })());
+  const parsed = CodexRefreshResponseSchema.safeParse(JsonTextSchema.safeParse(text).data);
   if (!parsed.success) {
     throw new CodexRefreshFailedError("endpoint returned an unexpected body shape (withheld: may carry tokens)");
   }

package/src/lib/codexpresence.ts

@@ -4,6 +4,7 @@ import { z } from "zod";
 import { codexPaths } from "./paths.ts";
 import { writeFileAtomic } from "./atomic.ts";
 import { pidExists, pidStartTime } from "./proc.ts";
+import { ErrnoSchema, JsonTextSchema } from "./types.ts";
 
 const PresenceSchema = z.object({
   accountId: z.string(),
@@ -38,17 +39,10 @@ export function livingCodexPresences(): LivingPresence[] {
     try {
       raw = readFileSync(file, "utf8");
     } catch (e) {
-      const errno = z.object({ code: z.string() }).safeParse(e);
-      if (errno.success && errno.data.code === "ENOENT") continue;
+      if (ErrnoSchema.safeParse(e).data?.code === "ENOENT") continue;
       throw e;
     }
-    const parsed = PresenceSchema.safeParse((() => {
-      try {
-        return JSON.parse(raw);
-      } catch {
-        return null;
-      }
-    })());
+    const parsed = PresenceSchema.safeParse(JsonTextSchema.safeParse(raw).data);
     if (!parsed.success) {
       throw new Error(`${file} is not a readable presence record - it may belong to a RUNNING codex session, refusing to treat it as absent; remove the file (or respawn that session) to proceed`);
     }
@@ -68,13 +62,3 @@ export function livingCodexPresences(): LivingPresence[] {
 export function presentCodexAccountIds(): Set<string> {
   return new Set(livingCodexPresences().map((presence) => presence.accountId));
 }
-
-export function targetableCodexAccounts<T extends { accountId: string }>(input: {
-  accounts: T[];
-  activeAccountId: string | null;
-}): T[] {
-  const present = presentCodexAccountIds();
-  return input.accounts.filter(
-    (account) => account.accountId === input.activeAccountId || !present.has(account.accountId),
-  );
-}

package/src/lib/codexusage.ts

@@ -1,11 +1,11 @@
 import { z } from "zod";
 import { http, safeErrorDetail } from "./http.ts";
-import { CodexUsageSchema, type CodexAuthJson, type CodexUsage, type CodexWindow } from "./types.ts";
+import { env } from "./paths.ts";
+import { CodexUsageSchema, JsonTextSchema, type CodexAuthJson, type CodexUsage, type Window } from "./types.ts";
 import { codexIdentityOf } from "./codexauth.ts";
 import { familyTokens } from "./usage.ts";
 
-const EnvOverrideSchema = z.string().min(1).optional().catch(undefined);
-const USAGE_URL = EnvOverrideSchema.parse(process.env.TOKENMAXXING_CODEX_USAGE_URL) ?? "https://chatgpt.com/backend-api/wham/usage";
+const USAGE_URL = env("TOKENMAXXING_CODEX_USAGE_URL", "https://chatgpt.com/backend-api/wham/usage");
 
 export class CodexUsageReadError extends Error {
   constructor(detail: string) {
@@ -35,21 +35,23 @@ const WireUsageSchema = z.looseObject({
     .nullish(),
 });
 
-function toWindows(rateLimit: z.infer<typeof WireRateLimitSchema> | null | undefined): CodexWindow[] {
-  const out: CodexWindow[] = [];
+function toWindows(rateLimit: z.infer<typeof WireRateLimitSchema> | null | undefined, name: string | null, at: number): Window[] {
+  const out: Window[] = [];
   for (const wire of [rateLimit?.primary_window, rateLimit?.secondary_window]) {
     if (wire == null) continue;
     out.push({
+      name,
       usedPercentage: wire.used_percent,
       resetsAt: wire.reset_at != null ? wire.reset_at * 1000 : null,
       windowSeconds: wire.limit_window_seconds ?? null,
+      sampledAt: at,
     });
   }
   return out;
 }
 
-export async function fetchCodexUsage(input: { auth: CodexAuthJson }): Promise<CodexUsage> {
-  const { auth } = input;
+export async function fetchCodexUsage(input: { auth: CodexAuthJson; at: number }): Promise<CodexUsage> {
+  const { auth, at } = input;
   const identity = codexIdentityOf({ auth });
   let res: Response;
   try {
@@ -68,53 +70,27 @@ export async function fetchCodexUsage(input: { auth: CodexAuthJson }): Promise<C
   if (!res.ok) {
     throw new CodexUsageReadError(`HTTP ${res.status}: ${safeErrorDetail({ text })}`);
   }
-  const parsed = WireUsageSchema.safeParse((() => {
-    try {
-      return JSON.parse(text);
-    } catch {
-      return null;
-    }
-  })());
+  const parsed = WireUsageSchema.safeParse(JsonTextSchema.safeParse(text).data);
   if (!parsed.success) {
     throw new CodexUsageReadError("endpoint returned an unexpected body shape (withheld)");
   }
   const wire = parsed.data;
 
-  const perLimit: Record<string, CodexWindow[]> = {};
-  for (const row of wire.additional_rate_limits ?? []) {
-    const windows = toWindows(row.rate_limit);
-    if (windows.length > 0) perLimit[row.limit_name] = windows;
-  }
-
   return CodexUsageSchema.parse({
     accountId: wire.account_id,
     email: wire.email ?? null,
     planType: wire.plan_type ?? null,
-    aggregate: toWindows(wire.rate_limit),
-    perLimit,
+    windows: [
+      ...toWindows(wire.rate_limit, null, at),
+      ...(wire.additional_rate_limits ?? []).flatMap((row) => toWindows(row.rate_limit, row.limit_name, at)),
+    ],
   });
 }
 
 const LIMIT_LABEL_ABBREVIATIONS = new Map([["reserve", "rsrv"]]);
 
-export function codexLimitLabel(input: { limitName: string }): string {
-  const tokens = familyTokens(input.limitName).filter((t) => Number.isNaN(Number(t)));
-  const label = tokens.at(-1) ?? input.limitName.trim().toLowerCase();
+export function codexLimitLabel(limitName: string): string {
+  const tokens = familyTokens(limitName).filter((t) => Number.isNaN(Number(t)));
+  const label = tokens.at(-1) ?? limitName.trim().toLowerCase();
   return LIMIT_LABEL_ABBREVIATIONS.get(label) ?? label;
 }
-
-const SESSION_WINDOW_MAX_S = 6 * 3600;
-
-export function isSessionWindow(input: { window: CodexWindow }): boolean {
-  const seconds = input.window.windowSeconds;
-  return seconds != null && seconds <= SESSION_WINDOW_MAX_S;
-}
-
-export function weeklyWindowOf(input: { aggregate: CodexWindow[] }): CodexWindow | null {
-  let best: CodexWindow | null = null;
-  for (const window of input.aggregate) {
-    if (isSessionWindow({ window })) continue;
-    if (best == null || (window.windowSeconds ?? 0) > (best.windowSeconds ?? 0)) best = window;
-  }
-  return best;
-}

package/src/lib/credstore.ts

@@ -4,7 +4,7 @@ import { z } from "zod";
 import { writeFileAtomic } from "./atomic.ts";
 import * as kc from "./keychain.ts";
 import { credDir, keychain as kcNames, namespacedCredService, paths } from "./paths.ts";
-import { CredentialBlobSchema } from "./types.ts";
+import { CredentialBlobSchema, ErrnoSchema } from "./types.ts";
 
 const CredTargetSchema = z.discriminatedUnion("kind", [
   z.object({ kind: z.literal("keychain"), service: z.string(), account: z.string() }),
@@ -16,16 +16,12 @@ const darwin = process.platform === "darwin";
 
 const BlobRecordSchema = z.record(z.string(), z.unknown());
 
-function isEnoent(e: unknown): boolean {
-  return e instanceof Error && "code" in e && e.code === "ENOENT";
-}
-
 export async function readItem(t: CredTarget): Promise<string | null> {
   if (t.kind === "keychain") return kc.readItem(t);
   try {
     return readFileSync(t.path, "utf8");
   } catch (e) {
-    if (isEnoent(e)) return null;
+    if (ErrnoSchema.safeParse(e).data?.code === "ENOENT") return null;
     throw e;
   }
 }
@@ -42,7 +38,7 @@ export async function deleteItem(t: CredTarget): Promise<boolean> {
     unlinkSync(t.path);
     return true;
   } catch (e) {
-    if (isEnoent(e)) return false;
+    if (ErrnoSchema.safeParse(e).data?.code === "ENOENT") return false;
     throw e;
   }
 }

package/src/lib/decide.ts

@@ -1,14 +1,11 @@
-import { maxBy } from "es-toolkit";
 import { z } from "zod";
 import { withLock } from "./lock.ts";
-import { paths } from "./paths.ts";
-import { POST_SWAP_COOLDOWN_MS, loadAccounts, loadConfig, loadDepletedWait, loadLastSwapAt, loadUsageSnapshot, saveAccounts, saveDepletedWait, writeUsage } from "./state.ts";
-import { readOAuthAccount } from "./claudejson.ts";
-import { isSkippableSwapError, performSwap } from "./swap.ts";
-import { isExhausted, nextWeeklyReset, pickBest, pickEarliestReset, thresholdBars, usableAt } from "./picker.ts";
-import { familyTokens, gatedFamilies, keepRows, probeUsage } from "./usage.ts";
+import { POST_SWAP_COOLDOWN_MS, loadAccounts, loadConfig, loadDepletedWait, loadLastSwapAt, saveAccounts, saveDepletedWait } from "./state.ts";
+import { isExhausted, limitWindows, nextWeeklyReset, pickBest, pickEarliestReset, sessionWindow, thresholdBars, usableAt, weeklyWindow, type PickCtx } from "./picker.ts";
+import { familyTokens } from "./usage.ts";
 import { log } from "./log.ts";
-import { AccountSchema, UsageStateSchema, type Account, type Config, type EnforcedLimit, type Thresholds, type UsageState, type UsageWindow } from "./types.ts";
+import type { Observation, Provider } from "./provider.ts";
+import { AccountSchema, type Account, type EnforcedLimit } from "./types.ts";
 
 const SwapDecisionSchema = z.object({
   swapped: z.boolean(),
@@ -21,201 +18,132 @@ export type SwapDecision = z.infer<typeof SwapDecisionSchema>;
 const WEEK_MS = 7 * 24 * 60 * 60 * 1000;
 const FIVE_HOURS_MS = 5 * 60 * 60 * 1000;
 
-function liveUsed(input: { window: UsageWindow; windowMs: number; sampledAt: number; now: number }): number {
-  const { window: w, windowMs, sampledAt, now } = input;
-  if (w.resetsAt != null) return w.resetsAt <= now ? 0 : w.usedPercentage;
-  if (now >= sampledAt + windowMs) return 0;
-  return w.usedPercentage;
-}
-
-function rowsSampledAt(account: Account, now: number): number {
-  return account.lastUsage?.rowsAt ?? account.lastUsageAt ?? now;
-}
-
-function capForFamily(account: Account, family: string, now: number): UsageWindow | undefined {
-  const rows = Object.entries(account.lastUsage?.perModel ?? {})
-    .filter(([k]) => familyTokens(k).includes(family))
-    .map(([, w]) => w);
-  return maxBy(rows, (w) => liveUsed({ window: w, windowMs: WEEK_MS, sampledAt: rowsSampledAt(account, now), now }));
-}
-
-function isOver(u: UsageState | null, account: Account | undefined, bars: Thresholds, cfg: Config, now: number): boolean {
+function isOver(account: Account | undefined, observed: Observation | null, ctx: PickCtx): boolean {
   if (!account) return false;
-  if (account.enforcedUntil != null && account.enforcedUntil > now) return true;
-  if (!u || u.account !== account.accountUuid) return false;
-  if (
-    liveUsed({ window: u.fiveHour, windowMs: FIVE_HOURS_MS, sampledAt: u.ts, now }) >= bars.session ||
-    liveUsed({ window: u.sevenDay, windowMs: WEEK_MS, sampledAt: u.ts, now }) >= bars.weekly
-  ) return true;
-  for (const family of gatedFamilies(u.model, cfg.policy.switchModels)) {
-    const cap = capForFamily(account, family, now);
-    if (cap && liveUsed({ window: cap, windowMs: WEEK_MS, sampledAt: rowsSampledAt(account, now), now }) >= bars.weekly) return true;
-  }
-  return false;
-}
-
-function needsPerModel(u: UsageState | null, cfg: Config): boolean {
-  return u != null && gatedFamilies(u.model, cfg.policy.switchModels).length > 0;
-}
-
-const SnapshotsSchema = z.object({
-  u: UsageStateSchema.nullable(),
-  uAt: z.number().nullable(),
-});
-type Snapshots = z.infer<typeof SnapshotsSchema>;
-
-function usageFresh(u: UsageState | null, uAt: number | null, account: string | null, ttl: number, now: number): boolean {
-  return u != null && u.account === account && uAt != null && now - uAt <= ttl;
-}
-
-function freshest(u: UsageState | null, uAt: number | null, account: Account | undefined): UsageState | null {
-  if (!u || uAt == null) return u;
-  const stored = account?.lastUsage;
-  if (stored && account.lastUsageAt != null && u.account === account.accountUuid && uAt < account.lastUsageAt) {
-    return { ...u, fiveHour: stored.fiveHour, sevenDay: stored.sevenDay, ts: account.lastUsageAt };
-  }
-  return { ...u, ts: uAt };
+  if (account.needsReauth === true) return true;
+  if (account.enforcedUntil != null && account.enforcedUntil > ctx.now) return true;
+  if (!observed) return false;
+  return isExhausted({ ...account, windows: observed.windows }, ctx);
 }
 
-async function loadFreshSnapshots(cfg: Config, account: string | null, now: number, probe: boolean): Promise<Snapshots> {
-  const snap = loadUsageSnapshot();
-  let u = snap?.state ?? null;
-  let uAt = snap?.at ?? null;
-  const ttl = cfg.policy.usagePollTtlMs;
-  const stored = loadAccounts().accounts.find((a) => a.accountUuid === account);
-  const probeAttempted = stored?.lastProbeAt != null && now - stored.lastProbeAt <= ttl;
-  const walled = stored?.enforcedUntil != null && stored.enforcedUntil > now;
-  if (probe && account && stored && !walled && !probeAttempted && (!usageFresh(u, uAt, account, ttl, now) || needsPerModel(u, cfg))) {
-    const startedAt = Date.now();
-    const full = await probeUsage();
-    const ts = Date.now();
-    if (readOAuthAccount()?.accountUuid === account) {
-      if (full) {
-        const teed = loadUsageSnapshot();
-        if (teed && usageFresh(teed.state, teed.at, account, ttl, ts)) {
-          u = teed.state;
-          uAt = teed.at;
-        } else {
-          u = { fiveHour: full.fiveHour, sevenDay: full.sevenDay, account, ts, model: null };
-          writeUsage(u);
-          uAt = ts;
-        }
-        const expected = gatedFamilies(u?.model ?? null, cfg.policy.switchModels);
-        const rows = Object.keys(full.perModel);
-        if (expected.length > 0 && !expected.some((f) => rows.some((k) => familyTokens(k).includes(f)))) {
-          log("usage.no_permodel_row", { families: expected.join(","), rows: rows.join(",") });
-        }
-      }
-      await withLock(paths.lockFile, () => {
-        const idx = loadAccounts();
-        const a = idx.accounts.find((x) => x.accountUuid === account);
-        if (!a) return;
-        a.lastProbeAt = startedAt;
-        if (full) {
-          if (!a.lastUsage) a.lastUsageAt = startedAt;
-          a.lastUsage = keepRows({ ...(a.lastUsage ?? full), perModel: full.perModel }, a.lastUsage, startedAt);
-        }
-        saveAccounts(idx);
-      });
-    }
-  }
-  return { u, uAt };
+function enforcedWall(limit: EnforcedLimit, account: Account, now: number): number {
+  const { family } = limit;
+  const familyReset =
+    family == null
+      ? null
+      : limitWindows(account)
+          .filter((w) => familyTokens(w.name ?? "").includes(family))
+          .map((w) => w.resetsAt)
+          .find((r): r is number => r != null) ?? null;
+  const session = sessionWindow(account)?.resetsAt ?? null;
+  const cachedReset =
+    limit.kind === "session"
+      ? session != null && session > now ? session : null
+      : nextWeeklyReset(familyReset ?? weeklyWindow(account)?.resetsAt ?? null, now);
+  return limit.resetsAt ?? cachedReset ?? now + (limit.kind === "session" ? FIVE_HOURS_MS : WEEK_MS);
 }
 
-export async function evaluateAndMaybeSwap(now = Date.now(), anticipatory = false, enforced: EnforcedLimit | null = null): Promise<SwapDecision> {
-  const activeAccount = readOAuthAccount()?.accountUuid ?? null;
+export async function evaluateAndMaybeSwap(p: Provider, now = Date.now(), anticipatory = false, enforced: EnforcedLimit | null = null): Promise<SwapDecision> {
+  const activeId = p.liveId();
 
-  const lastSwapAt = loadLastSwapAt();
+  const lastSwapAt = loadLastSwapAt(p.pool);
   if (!enforced && lastSwapAt != null && now - lastSwapAt < POST_SWAP_COOLDOWN_MS) {
-    return depletedReplay(now) ?? { swapped: false, account: null, reason: "post-swap-cooldown" };
+    return depletedReplay(p, now) ?? { swapped: false, account: null, reason: "post-swap-cooldown" };
   }
 
   const cfg = loadConfig();
   const bars = thresholdBars(cfg);
-
-  const { u: teeUsage, uAt } = await loadFreshSnapshots(cfg, activeAccount, now, enforced == null);
-  const stored = loadAccounts().accounts.find((a) => a.accountUuid === activeAccount);
-  const usage = freshest(teeUsage, uAt, stored);
-
-  if (!enforced && !isOver(usage, stored, bars, cfg, now)) {
-    const measured = usage != null && activeAccount != null && usage.account === activeAccount;
-    if (!measured) {
-      const replay = depletedReplay(now);
+  const stored0 = loadAccounts(p.pool).accounts.find((a) => a.id === activeId);
+  const walled0 = stored0?.enforcedUntil != null && stored0.enforcedUntil > now;
+  const observed = stored0 ? await p.observeLive(stored0, cfg, now, { probe: enforced == null && !walled0 }) : null;
+  const stored = loadAccounts(p.pool).accounts.find((a) => a.id === activeId);
+
+  if (!enforced && !isOver(stored, observed, { now, thresholds: bars, currentId: activeId, families: p.gatedFamilies(cfg) })) {
+    if (!observed) {
+      const replay = depletedReplay(p, now);
       if (replay) return replay;
     }
     return { swapped: false, account: null, reason: "under-threshold-or-stale" };
   }
 
-  return withLock(paths.lockFile, async () => {
-    const idx = loadAccounts();
-    const account2 = readOAuthAccount()?.accountUuid ?? null;
-    const tee = loadUsageSnapshot();
-    const active = account2 ? idx.accounts.find((a) => a.accountUuid === account2) : undefined;
-    const u2 = tee ? freshest(tee.state, tee.at, active) : usage;
+  return withLock(p.pool.lockFile, async () => {
+    const lastSwapAt2 = loadLastSwapAt(p.pool);
+    if (!enforced && lastSwapAt2 != null && now - lastSwapAt2 < POST_SWAP_COOLDOWN_MS) {
+      return { swapped: false, account: null, reason: "raced-already-swapped" };
+    }
+    const idx = loadAccounts(p.pool);
+    const id2 = p.liveId();
+    const active = id2 ? idx.accounts.find((a) => a.id === id2) : undefined;
 
-    const origin = enforced ? idx.accounts.find((a) => a.accountUuid === enforced.account) : undefined;
+    const origin = enforced ? idx.accounts.find((a) => a.id === enforced.account) : undefined;
     const prior = origin?.enforcedUntil != null && origin.enforcedUntil > now;
     if (enforced && origin) {
       origin.enforcedUntil = Math.max(origin.enforcedUntil ?? 0, enforcedWall(enforced, origin, now));
       origin.lastProbeAt = now;
-      saveAccounts(idx);
+      saveAccounts(p.pool, idx);
       log("usage.enforced_limit", { kind: enforced.kind, family: enforced.family ?? undefined, resetsAt: origin.enforcedUntil, blind: prior || enforced.blind, live: origin === active });
     }
     const enforced2 = enforced && origin && origin === active ? enforced : null;
 
-    if (account2 != null && !active) {
+    if (id2 != null && !active) {
       return { swapped: false, account: null, reason: "live-credential-not-in-pool" };
     }
 
-    if (active && tee && tee.state.account === account2 && (active.lastUsageAt == null || tee.at >= active.lastUsageAt)) {
-      active.lastUsageAt = tee.state.sampledAt ?? tee.at;
-      active.lastUsage = keepRows({ fiveHour: tee.state.fiveHour, sevenDay: tee.state.sevenDay, perModel: {} }, active.lastUsage, active.lastUsageAt);
-      saveAccounts(idx);
+    const obs2 = active ? await p.observeLive(active, cfg, now, { probe: false }) : null;
+    if (active && obs2 && (active.lastUsageAt == null || obs2.at > active.lastUsageAt)) {
+      active.windows = p.mergeWindows(obs2.windows, active.windows);
+      active.lastUsageAt = obs2.at;
+      saveAccounts(p.pool, idx);
     }
 
+    const families = p.gatedFamilies(cfg);
     const walled = active?.enforcedUntil != null && active.enforcedUntil > now;
     const blindScreen = (enforced != null && (prior || enforced.blind)) || (walled && !enforced2);
-    const gated = blindScreen ? cfg.policy.switchModels : gatedFamilies(u2?.model ?? null, cfg.policy.switchModels);
+    const screened = blindScreen && families != null ? cfg.policy.switchModels : families;
     const family = enforced?.family ?? null;
-    const switchFamilies = family != null && !gated.includes(family) ? [...gated, family] : gated;
+    const switchFamilies = screened == null ? null : family != null && !screened.includes(family) ? [...screened, family] : screened;
 
-    const seatExhausted = active != null && isExhausted(active, { now, thresholds: bars, currentAccountUuid: account2, switchFamilies });
-    if (!enforced2 && !isOver(u2, active, bars, cfg, now) && !(enforced && seatExhausted)) {
-      return depletedReplay(now) ?? { swapped: false, account: null, reason: "raced-already-swapped" };
+    const seatExhausted = active != null && isExhausted(active, { now, thresholds: bars, currentId: id2, families: switchFamilies });
+    if (!enforced2 && !isOver(active, obs2, { now, thresholds: bars, currentId: id2, families }) && !(enforced && seatExhausted)) {
+      return depletedReplay(p, now) ?? { swapped: false, account: null, reason: "raced-already-swapped" };
     }
 
-    const seatOf = (idx2: { activeAccountUuid: string | null; accounts: Account[] }): Account | null =>
-      idx2.accounts.find((a) => a.accountUuid === account2) ??
-      idx2.accounts.find((a) => a.accountUuid === idx2.activeAccountUuid) ??
-      null;
+    const seatOf = (cur: { activeId: string | null; accounts: Account[] }): Account | null =>
+      cur.accounts.find((a) => a.id === id2) ?? cur.accounts.find((a) => a.id === cur.activeId) ?? null;
 
+    const present = p.presentIds();
     const rejected = new Set<string>();
-    const usable = (accounts: Account[]): Account[] => accounts.filter((a) => !rejected.has(a.accountUuid));
+    const usable = (accounts: Account[]): Account[] => accounts.filter((a) => !rejected.has(a.id) && (a.id === id2 || !present.has(a.id)));
     const skipOrThrow = (e: unknown, candidate: Account): void => {
-      if (!isSkippableSwapError(e)) throw e;
-      rejected.add(candidate.accountUuid);
-      log("decide.candidate_rejected", { account: candidate.accountUuid.slice(0, 8), error: e instanceof Error ? e.message : String(e) });
+      if (p.classifySwapError(e) === "fatal") throw e;
+      rejected.add(candidate.id);
+      log("decide.candidate_rejected", { account: candidate.id.slice(0, 8), error: e instanceof Error ? e.message : String(e) });
     };
     while (true) {
-      const cur = loadAccounts();
+      const cur = loadAccounts(p.pool);
       const seat = seatOf(cur);
-      const ctx = { now, thresholds: bars, currentAccountUuid: seat?.accountUuid ?? null, switchFamilies };
+      const ctx: PickCtx = { now, thresholds: bars, currentId: seat?.id ?? null, families: switchFamilies };
       const best = pickBest(usable(cur.accounts), ctx);
       if (!best) break;
       try {
-        await performSwap(best);
+        await p.swap(best);
       } catch (e) {
         skipOrThrow(e, best);
         continue;
       }
-      log("decide.swap", { account: best.accountUuid.slice(0, 8), enforced: enforced2 != null });
+      log("decide.swap", { account: best.id.slice(0, 8), enforced: enforced2 != null });
       return { swapped: true, account: best, reason: "swapped" };
     }
 
+    if (!p.waitsWhenDepleted) {
+      log("decide.depleted", { waitUntil: 0 });
+      return { swapped: false, account: null, reason: "all-depleted" };
+    }
+
     while (true) {
-      const fresh = loadAccounts();
+      const fresh = loadAccounts(p.pool);
       const current = seatOf(fresh);
-      const ctx = { now, thresholds: bars, currentAccountUuid: current?.accountUuid ?? null, switchFamilies };
+      const ctx: PickCtx = { now, thresholds: bars, currentId: current?.id ?? null, families: switchFamilies };
       const currentAt = current ? usableAt(current, ctx) : Number.POSITIVE_INFINITY;
       const other = pickEarliestReset(usable(fresh.accounts), ctx);
 
@@ -230,48 +158,32 @@ export async function evaluateAndMaybeSwap(now = Date.now(), anticipatory = fals
         return { swapped: false, account: null, reason: "all-depleted", ...(Number.isFinite(waitUntil) ? { waitUntil } : {}) };
       }
 
-      const isCurrent = target.accountUuid === (current?.accountUuid ?? null);
+      const isCurrent = target.id === (current?.id ?? null);
       if (!isCurrent && !anticipatory) {
-        log("decide.depleted_no_park", { account: target.accountUuid.slice(0, 8), waitUntil });
+        log("decide.depleted_no_park", { account: target.id.slice(0, 8), waitUntil });
         return { swapped: false, account: null, reason: "all-depleted", waitUntil };
       }
       if (!isCurrent) {
         try {
-          await performSwap(target);
+          await p.swap(target);
         } catch (e) {
           skipOrThrow(e, target);
           continue;
         }
       }
-      saveDepletedWait({ waitUntil, accountUuid: target.accountUuid, ts: now });
-      log("decide.depleted_wait", { account: target.accountUuid.slice(0, 8), waitUntil });
+      saveDepletedWait({ waitUntil, id: target.id, ts: now });
+      log("decide.depleted_wait", { account: target.id.slice(0, 8), waitUntil });
       return { swapped: !isCurrent, account: target, reason: "depleted-wait", waitUntil };
     }
   });
 }
 
-function depletedReplay(now: number): SwapDecision | null {
+function depletedReplay(p: Provider, now: number): SwapDecision | null {
+  if (!p.waitsWhenDepleted) return null;
   const rec = loadDepletedWait();
   if (!rec || rec.waitUntil <= now) return null;
-  const account = loadAccounts().accounts.find((a) => a.accountUuid === rec.accountUuid) ?? null;
+  const account = loadAccounts(p.pool).accounts.find((a) => a.id === rec.id) ?? null;
   if (!account) return null;
-  if (account.accountUuid !== (readOAuthAccount()?.accountUuid ?? null)) return null;
+  if (account.id !== p.liveId()) return null;
   return { swapped: false, account, reason: "depleted-wait", waitUntil: rec.waitUntil };
 }
-
-function enforcedWall(limit: EnforcedLimit, account: Account, now: number): number {
-  const cached = account.lastUsage;
-  const { family } = limit;
-  const familyReset =
-    family == null
-      ? null
-      : Object.entries(cached?.perModel ?? {})
-          .filter(([k]) => familyTokens(k).includes(family))
-          .map(([, w]) => w.resetsAt)
-          .find((r): r is number => r != null) ?? null;
-  const cachedReset =
-    limit.kind === "session"
-      ? cached?.fiveHour.resetsAt != null && cached.fiveHour.resetsAt > now ? cached.fiveHour.resetsAt : null
-      : nextWeeklyReset(familyReset ?? cached?.sevenDay.resetsAt ?? null, now);
-  return limit.resetsAt ?? cachedReset ?? now + (limit.kind === "session" ? FIVE_HOURS_MS : WEEK_MS);
-}

package/src/lib/http.ts

@@ -1,5 +1,6 @@
 import ky from "ky";
 import { z } from "zod";
+import { JsonTextSchema } from "./types.ts";
 
 const OAuthErrorBodySchema = z.looseObject({
   error: z.string(),
@@ -20,12 +21,8 @@ const ErrorDetailSchema = z.object({ code: z.string().nullable(), fields: z.arra
 type ErrorDetail = z.infer<typeof ErrorDetailSchema>;
 
 function parseErrorBody(text: string): ErrorDetail | null {
-  let json: unknown;
-  try {
-    json = JSON.parse(text);
-  } catch {
-    return null;
-  }
+  const json = JsonTextSchema.safeParse(text).data;
+  if (json === undefined) return null;
   const oauth = OAuthErrorBodySchema.safeParse(json);
   if (oauth.success) return { code: oauth.data.error, fields: [oauth.data.error, oauth.data.error_description ?? ""] };
   const nested = NestedErrorBodySchema.safeParse(json);