getRefreshSpacingMs (services/refreshSerializer.ts)

* Global OAuth refresh serialization, keyed by rotation group. Why this exists (Front 1 of the Codex multi-account cascade fix): Providers that share a single Auth0 client_id — notably OpenAI Codex and the `openai` provider — enforce "single active session per client_id". When tw

// Source: https://github.com/iskyewinter-collab/Omniroute | License: MIT | Copyright 2026 diegosouzapw
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * Global OAuth refresh serialization, keyed by rotation group.
 *
 * Why this exists (Front 1 of the Codex multi-account cascade fix):
 * Providers that share a single Auth0 client_id — notably OpenAI Codex and the
 * `openai` provider — enforce "single active session per client_id". When two
 * *sibling* accounts under that client refresh their `refresh_token` at nearly
 * the same time, Auth0 treats it as token reuse and revokes the WHOLE
 * refresh_token family, so previously-healthy accounts suddenly fail with
 * `refresh_token_invalidated` / `refresh_token_reused` (openai/codex#9648).
 *
 * The per-connection mute

... (truncated -- full source via MCP)