@cortexkit/opencode-antigravity-auth 1.1.0 → 2.0.1

package/dist/src/plugin/storage.js

@@ -1,38 +1,53 @@
-import { promises as fs } from "node:fs";
-import { existsSync, readFileSync, writeFileSync, appendFileSync, mkdirSync, renameSync, copyFileSync, unlinkSync, } from "node:fs";
-import { dirname, join } from "node:path";
-import { homedir } from "node:os";
-import { randomBytes } from "node:crypto";
-let _cachedLock;
-async function getLockFunction() {
-    if (_cachedLock)
-        return _cachedLock;
-    const mod = await import("proper-lockfile");
-    const fn = (typeof mod.lock === "function" ? mod.lock : undefined)
-        || (mod.default && typeof mod.default.lock === "function"
-            ? mod.default.lock : undefined);
-    if (typeof fn !== "function") {
-        // Never silently degrade to a no-op lock — that would let concurrent
-        // processes corrupt the account file. Fail loudly so the caller's
-        // try/catch surfaces it instead of writing unlocked.
-        throw new Error("proper-lockfile did not expose a lock() function; cannot acquire account file lock");
-    }
-    _cachedLock = fn;
-    return _cachedLock;
-}
-const lockfile = { lock: (path, options) => getLockFunction().then(fn => fn(path, options)) };
-import { createLogger } from "./logger";
-const log = createLogger("storage");
+/**
+ * Host-path adapter for account storage.
+ *
+ * Resolves the on-disk path for the OpenCode config directory, handles
+ * the legacy Windows migration, and keeps the .gitignore in sync. All
+ * data operations are delegated to `@cortexkit/antigravity-auth-core`'s
+ * lock-held account-storage engine.
+ *
+ * The split keeps this module harness-specific (it knows about
+ * `OPENCODE_CONFIG_DIR`, `%APPDATA%`, and OpenCode-specific gitignore
+ * entries) while the schema, migrations, and lock semantics live in
+ * core.
+ */
+import { appendFileSync, copyFileSync, existsSync, promises as fs, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { AccountStorageUnreadableError, clearAccountStorage as coreClearAccountStorage, deduplicateAccountsByEmail as coreDeduplicateAccountsByEmail, loadAccountStorage as coreLoadAccountStorage, mergeAccountStorage as coreMergeAccountStorage, migrateV2ToV3 as coreMigrateV2ToV3, mutateAccountStorage as coreMutateAccountStorage, saveAccountStorage as coreSaveAccountStorage, saveAccountStorageReplace as coreSaveAccountStorageReplace, } from '@cortexkit/antigravity-auth-core';
+import { createLogger } from './logger';
+const log = createLogger('storage');
+/**
+ * Re-export the typed unreadable-storage error so consumers can
+ * `instanceof`-check without pulling core into their own dependency
+ * graph. When the on-disk accounts file exists but cannot be parsed
+ * as a valid v4 (corrupt JSON, schema mismatch, unknown version, or
+ * an I/O error other than ENOENT), every read/write here throws this
+ * — never silently overwrites the user's data.
+ */
+export { AccountStorageUnreadableError };
+/**
+ * Backward-compat re-exports for harnesses still importing
+ * `deduplicateAccountsByEmail` / `mergeAccountStorage` / `migrateV2ToV3`
+ * from `./storage`. The definitions live in core; the adapter exposes
+ * them so legacy test files compile without modification.
+ */
+export const deduplicateAccountsByEmail = coreDeduplicateAccountsByEmail;
+export const mergeAccountStorage = coreMergeAccountStorage;
+export const migrateV2ToV3 = coreMigrateV2ToV3;
+export const mutateAccountStorage = coreMutateAccountStorage;
 /**
  * Files/directories that should be gitignored in the config directory.
  * These contain sensitive data or machine-specific state.
  */
+// NOTE: deliberately no ".gitignore" self-ignore entry — users who track their
+// config dir as a git repo (with .gitignore committed) get endless working-tree
+// drift from re-appending it, and for a tracked file the entry is a no-op anyway.
 export const GITIGNORE_ENTRIES = [
-    ".gitignore",
-    "antigravity-accounts.json",
-    "antigravity-accounts.json.*.tmp",
-    "antigravity-signature-cache.json",
-    "antigravity-logs/",
+    'antigravity-accounts.json',
+    'antigravity-accounts.json.*.tmp',
+    'antigravity-signature-cache.json',
+    'antigravity-logs/',
 ];
 /**
  * Ensures a .gitignore file exists in the config directory with entries
@@ -40,38 +55,38 @@ export const GITIGNORE_ENTRIES = [
  * entries if it already exists.
  */
 export async function ensureGitignore(configDir) {
-    const gitignorePath = join(configDir, ".gitignore");
+    const gitignorePath = join(configDir, '.gitignore');
     try {
         let content;
         let existingLines = [];
         try {
-            content = await fs.readFile(gitignorePath, "utf-8");
-            existingLines = content.split("\n").map((line) => line.trim());
+            content = await fs.readFile(gitignorePath, 'utf-8');
+            existingLines = content.split('\n').map((line) => line.trim());
         }
         catch (error) {
-            if (error.code !== "ENOENT") {
+            if (error.code !== 'ENOENT') {
                 return;
             }
-            content = "";
+            content = '';
         }
         const missingEntries = GITIGNORE_ENTRIES.filter((entry) => !existingLines.includes(entry));
         if (missingEntries.length === 0) {
             return;
         }
-        if (content === "") {
-            await fs.writeFile(gitignorePath, missingEntries.join("\n") + "\n", "utf-8");
-            log.info("Created .gitignore in config directory");
+        if (content === '') {
+            await fs.writeFile(gitignorePath, `${missingEntries.join('\n')}\n`, 'utf-8');
+            log.info('Created .gitignore in config directory');
         }
         else {
-            const suffix = content.endsWith("\n") ? "" : "\n";
-            await fs.appendFile(gitignorePath, suffix + missingEntries.join("\n") + "\n", "utf-8");
-            log.info("Updated .gitignore with missing entries", {
+            const suffix = content.endsWith('\n') ? '' : '\n';
+            await fs.appendFile(gitignorePath, `${suffix + missingEntries.join('\n')}\n`, 'utf-8');
+            log.info('Updated .gitignore with missing entries', {
                 added: missingEntries,
             });
         }
     }
     catch (error) {
-        log.warn("Failed to update .gitignore with account storage entries", {
+        log.warn('Failed to update .gitignore with account storage entries', {
             error: String(error),
         });
     }
@@ -80,35 +95,35 @@ export async function ensureGitignore(configDir) {
  * Synchronous version of ensureGitignore for use in sync code paths.
  */
 export function ensureGitignoreSync(configDir) {
-    const gitignorePath = join(configDir, ".gitignore");
+    const gitignorePath = join(configDir, '.gitignore');
     try {
         let content;
         let existingLines = [];
         if (existsSync(gitignorePath)) {
-            content = readFileSync(gitignorePath, "utf-8");
-            existingLines = content.split("\n").map((line) => line.trim());
+            content = readFileSync(gitignorePath, 'utf-8');
+            existingLines = content.split('\n').map((line) => line.trim());
         }
         else {
-            content = "";
+            content = '';
         }
         const missingEntries = GITIGNORE_ENTRIES.filter((entry) => !existingLines.includes(entry));
         if (missingEntries.length === 0) {
             return;
         }
-        if (content === "") {
-            writeFileSync(gitignorePath, missingEntries.join("\n") + "\n", "utf-8");
-            log.info("Created .gitignore in config directory");
+        if (content === '') {
+            writeFileSync(gitignorePath, `${missingEntries.join('\n')}\n`, 'utf-8');
+            log.info('Created .gitignore in config directory');
         }
         else {
-            const suffix = content.endsWith("\n") ? "" : "\n";
-            appendFileSync(gitignorePath, suffix + missingEntries.join("\n") + "\n", "utf-8");
-            log.info("Updated .gitignore with missing entries", {
+            const suffix = content.endsWith('\n') ? '' : '\n';
+            appendFileSync(gitignorePath, `${suffix + missingEntries.join('\n')}\n`, 'utf-8');
+            log.info('Updated .gitignore with missing entries', {
                 added: missingEntries,
             });
         }
     }
     catch (error) {
-        log.warn("Failed to update .gitignore with account storage entries", {
+        log.warn('Failed to update .gitignore with account storage entries', {
             error: String(error),
         });
     }
@@ -118,7 +133,7 @@ export function ensureGitignoreSync(configDir) {
  * Used for migration from older plugin versions.
  */
 function getLegacyWindowsConfigDir() {
-    return join(process.env.APPDATA || join(homedir(), "AppData", "Roaming"), "opencode");
+    return join(process.env.APPDATA || join(homedir(), 'AppData', 'Roaming'), 'opencode');
 }
 /**
  * Gets the config directory path, with the following precedence:
@@ -128,13 +143,11 @@ function getLegacyWindowsConfigDir() {
  * On Windows, also checks for legacy %APPDATA%\opencode path for migration.
  */
 function getConfigDir() {
-    // 1. Check for explicit override via env var
     if (process.env.OPENCODE_CONFIG_DIR) {
         return process.env.OPENCODE_CONFIG_DIR;
     }
-    // 2. Use ~/.config/opencode on all platforms (including Windows)
-    const xdgConfig = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
-    return join(xdgConfig, "opencode");
+    const xdgConfig = process.env.XDG_CONFIG_HOME || join(homedir(), '.config');
+    return join(xdgConfig, 'opencode');
 }
 /**
  * Migrates config from legacy Windows location to the new path.
@@ -142,34 +155,36 @@ function getConfigDir() {
  * Returns true if migration was performed.
  */
 function migrateLegacyWindowsConfig() {
-    if (process.platform !== "win32") {
+    if (process.platform !== 'win32') {
         return false;
     }
-    const newPath = join(getConfigDir(), "antigravity-accounts.json");
-    const legacyPath = join(getLegacyWindowsConfigDir(), "antigravity-accounts.json");
-    // Only migrate if legacy exists and new doesn't
+    const newPath = join(getConfigDir(), 'antigravity-accounts.json');
+    const legacyPath = join(getLegacyWindowsConfigDir(), 'antigravity-accounts.json');
     if (!existsSync(legacyPath) || existsSync(newPath)) {
         return false;
     }
     try {
-        // Ensure new config directory exists
         const newConfigDir = getConfigDir();
         mkdirSync(newConfigDir, { recursive: true });
-        // Try rename first (atomic, but fails across filesystems)
         try {
             renameSync(legacyPath, newPath);
-            log.info("Migrated Windows config via rename", { from: legacyPath, to: newPath });
+            log.info('Migrated Windows config via rename', {
+                from: legacyPath,
+                to: newPath,
+            });
         }
         catch {
-            // Fallback: copy then delete (for cross-filesystem moves)
             copyFileSync(legacyPath, newPath);
             unlinkSync(legacyPath);
-            log.info("Migrated Windows config via copy+delete", { from: legacyPath, to: newPath });
+            log.info('Migrated Windows config via copy+delete', {
+                from: legacyPath,
+                to: newPath,
+            });
         }
         return true;
     }
     catch (error) {
-        log.warn("Failed to migrate legacy Windows config, will use legacy path", {
+        log.warn('Failed to migrate legacy Windows config, will use legacy path', {
             legacyPath,
             newPath,
             error: String(error),
@@ -182,15 +197,13 @@ function migrateLegacyWindowsConfig() {
  * On Windows, attempts to move legacy config to new path for alignment.
  */
 function getStoragePathWithMigration() {
-    const newPath = join(getConfigDir(), "antigravity-accounts.json");
-    // On Windows, attempt to migrate legacy config to new location
-    if (process.platform === "win32") {
+    const newPath = join(getConfigDir(), 'antigravity-accounts.json');
+    if (process.platform === 'win32') {
         migrateLegacyWindowsConfig();
-        // If migration failed and legacy still exists, fall back to it
         if (!existsSync(newPath)) {
-            const legacyPath = join(getLegacyWindowsConfigDir(), "antigravity-accounts.json");
+            const legacyPath = join(getLegacyWindowsConfigDir(), 'antigravity-accounts.json');
             if (existsSync(legacyPath)) {
-                log.info("Using legacy Windows config path (migration failed)", {
+                log.info('Using legacy Windows config path (migration failed)', {
                     legacyPath,
                     newPath,
                 });
@@ -207,443 +220,85 @@ export function getStoragePath() {
  * Gets the config directory path. Exported for use by other modules.
  */
 export { getConfigDir };
-const LOCK_OPTIONS = {
-    stale: 10000,
-    retries: {
-        retries: 5,
-        minTimeout: 100,
-        maxTimeout: 1000,
-        factor: 2,
-    },
-};
-/**
- * Ensures the file has secure permissions (0600) on POSIX systems.
- * This is a best-effort operation and ignores errors on Windows/unsupported FS.
- */
-async function ensureSecurePermissions(path) {
-    try {
-        await fs.chmod(path, 0o600);
-    }
-    catch {
-        // Ignore errors (e.g. Windows, file doesn't exist, FS doesn't support chmod)
-    }
-}
-async function ensureFileExists(path) {
-    try {
-        await fs.access(path);
-    }
-    catch {
-        await fs.mkdir(dirname(path), { recursive: true });
-        await fs.writeFile(path, JSON.stringify({ version: 4, accounts: [], activeIndex: 0 }, null, 2), { encoding: "utf-8", mode: 0o600 });
-    }
-}
-async function withFileLock(path, fn) {
-    await ensureFileExists(path);
-    let release = null;
-    try {
-        release = await lockfile.lock(path, LOCK_OPTIONS);
-        return await fn();
-    }
-    finally {
-        if (release) {
-            try {
-                await release();
-            }
-            catch (unlockError) {
-                log.warn("Failed to release lock", { error: String(unlockError) });
-            }
-        }
-    }
-}
-export function mergeAccountStorage(existing, incoming) {
-    const accountMap = new Map();
-    for (const acc of existing.accounts) {
-        if (acc.refreshToken) {
-            accountMap.set(acc.refreshToken, acc);
-        }
-    }
-    for (const acc of incoming.accounts) {
-        if (acc.refreshToken) {
-            const existingAcc = accountMap.get(acc.refreshToken);
-            if (existingAcc) {
-                const eligibilitySource = (acc.eligibilityStateUpdatedAt ?? 0) >= (existingAcc.eligibilityStateUpdatedAt ?? 0)
-                    ? acc
-                    : existingAcc;
-                const merged = {
-                    ...existingAcc,
-                    ...acc,
-                    // Preserve manually configured projectId/managedProjectId if not in incoming
-                    projectId: acc.projectId ?? existingAcc.projectId,
-                    managedProjectId: acc.managedProjectId ?? existingAcc.managedProjectId,
-                    rateLimitResetTimes: {
-                        ...existingAcc.rateLimitResetTimes,
-                        ...acc.rateLimitResetTimes,
-                    },
-                    lastUsed: Math.max(existingAcc.lastUsed || 0, acc.lastUsed || 0),
-                    accountIneligible: eligibilitySource.accountIneligible,
-                    accountIneligibleAt: eligibilitySource.accountIneligibleAt,
-                    accountIneligibleReason: eligibilitySource.accountIneligibleReason,
-                    eligibilityStateUpdatedAt: eligibilitySource.eligibilityStateUpdatedAt,
-                };
-                if (merged.accountIneligible) {
-                    merged.enabled = false;
-                }
-                accountMap.set(acc.refreshToken, merged);
-            }
-            else {
-                accountMap.set(acc.refreshToken, acc);
-            }
-        }
-    }
-    return {
-        version: 4,
-        accounts: Array.from(accountMap.values()),
-        activeIndex: incoming.activeIndex,
-        activeIndexByFamily: incoming.activeIndexByFamily,
-    };
-}
-export function deduplicateAccountsByEmail(accounts) {
-    const emailToNewestIndex = new Map();
-    const indicesToKeep = new Set();
-    // First pass: find the newest account for each email (by lastUsed, then addedAt)
-    for (let i = 0; i < accounts.length; i++) {
-        const acc = accounts[i];
-        if (!acc)
-            continue;
-        if (!acc.email) {
-            // No email - keep this account (can't deduplicate without email)
-            indicesToKeep.add(i);
-            continue;
-        }
-        const existingIndex = emailToNewestIndex.get(acc.email);
-        if (existingIndex === undefined) {
-            emailToNewestIndex.set(acc.email, i);
-            continue;
-        }
-        // Compare to find which is newer
-        const existing = accounts[existingIndex];
-        if (!existing) {
-            emailToNewestIndex.set(acc.email, i);
-            continue;
-        }
-        // Prefer higher lastUsed, then higher addedAt
-        // Compare fields separately to avoid integer overflow with large timestamps
-        const currLastUsed = acc.lastUsed || 0;
-        const existLastUsed = existing.lastUsed || 0;
-        const currAddedAt = acc.addedAt || 0;
-        const existAddedAt = existing.addedAt || 0;
-        const isNewer = currLastUsed > existLastUsed ||
-            (currLastUsed === existLastUsed && currAddedAt > existAddedAt);
-        if (isNewer) {
-            emailToNewestIndex.set(acc.email, i);
-        }
-    }
-    // Add all the newest email-based indices to the keep set
-    for (const idx of emailToNewestIndex.values()) {
-        indicesToKeep.add(idx);
-    }
-    // Build the deduplicated list, preserving original order for kept items
-    const result = [];
-    for (let i = 0; i < accounts.length; i++) {
-        if (indicesToKeep.has(i)) {
-            const acc = accounts[i];
-            if (acc) {
-                result.push(acc);
-            }
-        }
-    }
-    return result;
-}
-function migrateV1ToV2(v1) {
-    return {
-        version: 2,
-        accounts: v1.accounts.map((acc) => {
-            const rateLimitResetTimes = {};
-            if (acc.isRateLimited &&
-                acc.rateLimitResetTime &&
-                acc.rateLimitResetTime > Date.now()) {
-                rateLimitResetTimes.claude = acc.rateLimitResetTime;
-                rateLimitResetTimes.gemini = acc.rateLimitResetTime;
-            }
-            return {
-                email: acc.email,
-                refreshToken: acc.refreshToken,
-                projectId: acc.projectId,
-                managedProjectId: acc.managedProjectId,
-                addedAt: acc.addedAt,
-                lastUsed: acc.lastUsed,
-                lastSwitchReason: acc.lastSwitchReason,
-                rateLimitResetTimes: Object.keys(rateLimitResetTimes).length > 0
-                    ? rateLimitResetTimes
-                    : undefined,
-            };
-        }),
-        activeIndex: v1.activeIndex,
-    };
-}
-export function migrateV2ToV3(v2) {
-    return {
-        version: 3,
-        accounts: v2.accounts.map((acc) => {
-            const rateLimitResetTimes = {};
-            if (acc.rateLimitResetTimes?.claude &&
-                acc.rateLimitResetTimes.claude > Date.now()) {
-                rateLimitResetTimes.claude = acc.rateLimitResetTimes.claude;
-            }
-            if (acc.rateLimitResetTimes?.gemini &&
-                acc.rateLimitResetTimes.gemini > Date.now()) {
-                rateLimitResetTimes["gemini-antigravity"] =
-                    acc.rateLimitResetTimes.gemini;
-            }
-            return {
-                email: acc.email,
-                refreshToken: acc.refreshToken,
-                projectId: acc.projectId,
-                managedProjectId: acc.managedProjectId,
-                addedAt: acc.addedAt,
-                lastUsed: acc.lastUsed,
-                lastSwitchReason: acc.lastSwitchReason,
-                rateLimitResetTimes: Object.keys(rateLimitResetTimes).length > 0
-                    ? rateLimitResetTimes
-                    : undefined,
-            };
-        }),
-        activeIndex: v2.activeIndex,
-    };
-}
-export function migrateV3ToV4(v3) {
-    return {
-        version: 4,
-        accounts: v3.accounts.map((acc) => ({
-            ...acc,
-            fingerprint: undefined,
-            fingerprintHistory: undefined,
-        })),
-        activeIndex: v3.activeIndex,
-        activeIndexByFamily: v3.activeIndexByFamily,
-    };
-}
+// ============================================================================
+// Host path delegation. Each of these resolves the on-disk path via the
+// adapter above and hands it to the core lock-held engine. Callers that
+// want to run their own mutator (e.g. persist-account-pool) should
+// import from `@cortexkit/antigravity-auth-core` directly and pass
+// `getStoragePath()` as the path argument.
+// ============================================================================
 export async function loadAccounts() {
-    try {
-        const path = getStoragePath();
-        // Ensure permissions are correct on load (fixes existing files)
-        await ensureSecurePermissions(path);
-        const content = await fs.readFile(path, "utf-8");
-        const data = JSON.parse(content);
-        if (!Array.isArray(data.accounts)) {
-            log.warn("Invalid storage format, ignoring");
-            return null;
-        }
-        let storage;
-        if (data.version === 1) {
-            log.info("Migrating account storage from v1 to v4");
-            const v2 = migrateV1ToV2(data);
-            const v3 = migrateV2ToV3(v2);
-            storage = migrateV3ToV4(v3);
-            try {
-                await saveAccounts(storage);
-                log.info("Migration to v4 complete");
-            }
-            catch (saveError) {
-                log.warn("Failed to persist migrated storage", {
-                    error: String(saveError),
-                });
-            }
-        }
-        else if (data.version === 2) {
-            log.info("Migrating account storage from v2 to v4");
-            const v3 = migrateV2ToV3(data);
-            storage = migrateV3ToV4(v3);
-            try {
-                await saveAccounts(storage);
-                log.info("Migration to v4 complete");
-            }
-            catch (saveError) {
-                log.warn("Failed to persist migrated storage", {
-                    error: String(saveError),
-                });
-            }
-        }
-        else if (data.version === 3) {
-            log.info("Migrating account storage from v3 to v4");
-            storage = migrateV3ToV4(data);
-            try {
-                await saveAccounts(storage);
-                log.info("Migration to v4 complete");
-            }
-            catch (saveError) {
-                log.warn("Failed to persist migrated storage", {
-                    error: String(saveError),
-                });
-            }
-        }
-        else if (data.version === 4) {
-            storage = data;
-        }
-        else {
-            log.warn("Unknown storage version, ignoring", {
-                version: data.version,
-            });
-            return null;
-        }
-        // Validate accounts have required fields
-        const validAccounts = storage.accounts.filter((a) => {
-            return (!!a &&
-                typeof a === "object" &&
-                typeof a.refreshToken === "string");
-        });
-        // Deduplicate accounts by email (keeps newest entry for each email)
-        const deduplicatedAccounts = deduplicateAccountsByEmail(validAccounts);
-        // Clamp activeIndex to valid range after deduplication
-        let activeIndex = typeof storage.activeIndex === "number" &&
-            Number.isFinite(storage.activeIndex)
-            ? storage.activeIndex
-            : 0;
-        if (deduplicatedAccounts.length > 0) {
-            activeIndex = Math.min(activeIndex, deduplicatedAccounts.length - 1);
-            activeIndex = Math.max(activeIndex, 0);
-        }
-        else {
-            activeIndex = 0;
-        }
-        return {
-            version: 4,
-            accounts: deduplicatedAccounts,
-            activeIndex,
-            activeIndexByFamily: storage.activeIndexByFamily,
-        };
-    }
-    catch (error) {
-        const code = error.code;
-        if (code === "ENOENT") {
-            return null;
-        }
-        log.error("Failed to load account storage", { error: String(error) });
-        return null;
-    }
+    const path = getStoragePath();
+    await ensureGitignore(dirname(path));
+    return coreLoadAccountStorage(path);
 }
 /**
- * Atomically write content to a file using temp-file + rename.
- * Retries the rename up to 3 times with exponential backoff to handle
- * transient Windows EPERM errors (antivirus, file indexer, watchers).
- * Falls back to copyFile + unlink if all rename attempts fail.
+ * Merge `storage` into the persisted pool. Use this for non-destructive
+ * writes (quota cache, eligibility, last-used) so concurrent writers
+ * do not silently drop each other's data.
  */
-async function atomicWriteFile(targetPath, content) {
-    const tempPath = `${targetPath}.${randomBytes(6).toString("hex")}.tmp`;
-    await fs.writeFile(tempPath, content, { encoding: "utf-8", mode: 0o600 });
-    const RETRY_DELAYS = [50, 100, 200];
-    let lastError;
-    for (let attempt = 0; attempt <= RETRY_DELAYS.length; attempt++) {
-        try {
-            await fs.rename(tempPath, targetPath);
-            return;
-        }
-        catch (error) {
-            lastError = error;
-            const code = error.code;
-            if (code !== "EPERM" && code !== "EACCES") {
-                break; // Non-transient error, skip retries
-            }
-            if (attempt < RETRY_DELAYS.length) {
-                await new Promise((r) => setTimeout(r, RETRY_DELAYS[attempt]));
-            }
-        }
-    }
-    // All rename attempts failed — fall back to copy + delete
-    try {
-        await fs.copyFile(tempPath, targetPath);
-        try {
-            await fs.unlink(tempPath);
-        }
-        catch {
-            // Ignore temp cleanup errors
-        }
-    }
-    catch {
-        // Copy also failed — clean up temp and throw original rename error
-        try {
-            await fs.unlink(tempPath);
-        }
-        catch {
-            // Ignore cleanup errors
-        }
-        throw lastError;
-    }
-}
 export async function saveAccounts(storage) {
     const path = getStoragePath();
     const configDir = dirname(path);
     await fs.mkdir(configDir, { recursive: true });
     await ensureGitignore(configDir);
-    await withFileLock(path, async () => {
-        const existing = await loadAccountsUnsafe();
-        const merged = existing ? mergeAccountStorage(existing, storage) : storage;
-        const content = JSON.stringify(merged, null, 2);
-        await atomicWriteFile(path, content);
-    });
+    await coreSaveAccountStorage(path, storage);
 }
 /**
  * Save accounts storage by replacing the entire file (no merge).
- * Use this for destructive operations like delete where we need to
- * remove accounts that would otherwise be merged back from existing storage.
+ * Required for destructive operations like delete where the next-state
+ * must replace — never be merged with — what is on disk.
  */
 export async function saveAccountsReplace(storage) {
     const path = getStoragePath();
     const configDir = dirname(path);
     await fs.mkdir(configDir, { recursive: true });
     await ensureGitignore(configDir);
-    await withFileLock(path, async () => {
-        const content = JSON.stringify(storage, null, 2);
-        await atomicWriteFile(path, content);
-    });
-}
-async function loadAccountsUnsafe() {
-    try {
-        const path = getStoragePath();
-        // Ensure permissions are correct on load (fixes existing files)
-        await ensureSecurePermissions(path);
-        const content = await fs.readFile(path, "utf-8");
-        const parsed = JSON.parse(content);
-        if (parsed.version === 1) {
-            return migrateV3ToV4(migrateV2ToV3(migrateV1ToV2(parsed)));
-        }
-        if (parsed.version === 2) {
-            return migrateV3ToV4(migrateV2ToV3(parsed));
-        }
-        if (parsed.version === 3) {
-            return migrateV3ToV4(parsed);
-        }
-        return {
-            ...parsed,
-            accounts: deduplicateAccountsByEmail(parsed.accounts),
-        };
-    }
-    catch (error) {
-        const code = error.code;
-        if (code === "ENOENT") {
-            return null;
-        }
-        log.error("Failed to load account storage (file exists but unreadable)", {
-            error: String(error),
-            code: code ?? "unknown",
-        });
-        return null;
-    }
+    await coreSaveAccountStorageReplace(path, storage);
 }
 export async function clearAccounts() {
     const path = getStoragePath();
     try {
-        // Acquire the file lock so a concurrent debounced save can't write state
-        // back in between (which would resurrect a just-cleared pool).
-        await withFileLock(path, async () => {
-            await fs.unlink(path);
-        });
+        await coreClearAccountStorage(path);
     }
     catch (error) {
         const code = error.code;
-        if (code !== "ENOENT") {
-            log.error("Failed to clear account storage", { error: String(error) });
+        if (code !== 'ENOENT') {
+            log.error('Failed to clear account storage', { error: String(error) });
         }
     }
 }
+/**
+ * Locate a stored account by its refresh token under the lock-held
+ * mutator and apply `mutate(account)`. Returns the (possibly mutated)
+ * account, or `undefined` when the token no longer matches any stored
+ * account. Concurrent writers that add/remove accounts will not
+ * disturb the lookup — the read happens while the lock is held.
+ *
+ * `mutate` may mutate `account` in place and return `true` to commit
+ * the change; returning `false` is treated as "no change" and skips
+ * the write.
+ */
+export async function mutateAccountByRefreshToken(refreshToken, mutate) {
+    const path = getStoragePath();
+    const configDir = dirname(path);
+    await fs.mkdir(configDir, { recursive: true });
+    await ensureGitignore(configDir);
+    let result;
+    await coreMutateAccountStorage(path, (current) => {
+        const idx = current.accounts.findIndex((acc) => acc.refreshToken === refreshToken);
+        if (idx === -1)
+            return current;
+        const target = current.accounts[idx];
+        if (!target)
+            return current;
+        const changed = mutate(target);
+        if (!changed)
+            return current;
+        result = target;
+        current.accounts[idx] = target;
+        return current;
+    });
+    return result;
+}
 //# sourceMappingURL=storage.js.map