@sunerpy/opencode-kiro-auth 0.1.0

package/dist/plugin/storage/migrations.js

@@ -0,0 +1,155 @@
+export function runMigrations(db) {
+    migrateToUniqueRefreshToken(db);
+    migrateRealEmailColumn(db);
+    migrateUsageTable(db);
+    migrateStartUrlColumn(db);
+    migrateOidcRegionColumn(db);
+    migrateDropRefreshTokenUniqueIndex(db);
+}
+function migrateToUniqueRefreshToken(db) {
+    const hasIndex = db
+        .prepare("SELECT name FROM sqlite_master WHERE type='index' AND name='idx_refresh_token_unique'")
+        .get();
+    if (hasIndex)
+        return;
+    db.exec('BEGIN TRANSACTION');
+    try {
+        const duplicates = db
+            .prepare(`
+        SELECT refresh_token, COUNT(*) as count 
+        FROM accounts 
+        GROUP BY refresh_token 
+        HAVING count > 1
+      `)
+            .all();
+        for (const dup of duplicates) {
+            const accounts = db
+                .prepare('SELECT * FROM accounts WHERE refresh_token = ? ORDER BY last_used DESC, expires_at DESC')
+                .all(dup.refresh_token);
+            if (accounts.length > 1) {
+                const keep = accounts[0];
+                const remove = accounts.slice(1);
+                const mergedUsedCount = Math.max(...accounts.map((a) => a.used_count || 0));
+                const mergedLimitCount = Math.max(...accounts.map((a) => a.limit_count || 0));
+                const mergedLastUsed = Math.max(...accounts.map((a) => a.last_used || 0));
+                const mergedFailCount = Math.max(...accounts.map((a) => a.fail_count || 0));
+                db.prepare(`
+            UPDATE accounts SET 
+              used_count = ?, 
+              limit_count = ?, 
+              last_used = ?,
+              fail_count = ?
+            WHERE id = ?
+          `).run(mergedUsedCount, mergedLimitCount, mergedLastUsed, mergedFailCount, keep.id);
+                for (const acc of remove) {
+                    db.prepare('DELETE FROM accounts WHERE id = ?').run(acc.id);
+                }
+            }
+        }
+        db.exec('CREATE UNIQUE INDEX idx_refresh_token_unique ON accounts(refresh_token)');
+        db.exec('COMMIT');
+    }
+    catch (e) {
+        db.exec('ROLLBACK');
+        throw e;
+    }
+}
+function migrateRealEmailColumn(db) {
+    const columns = db.prepare('PRAGMA table_info(accounts)').all();
+    const names = new Set(columns.map((c) => c.name));
+    if (names.has('real_email')) {
+        db.exec('BEGIN TRANSACTION');
+        try {
+            db.exec("UPDATE accounts SET email = real_email WHERE real_email IS NOT NULL AND real_email != '' AND email LIKE 'builder-id@aws.amazon.com%'");
+            db.exec(`
+          CREATE TABLE accounts_new (
+            id TEXT PRIMARY KEY, email TEXT NOT NULL, auth_method TEXT NOT NULL,
+            region TEXT NOT NULL, oidc_region TEXT, client_id TEXT, client_secret TEXT, profile_arn TEXT,
+            start_url TEXT,
+            refresh_token TEXT NOT NULL, access_token TEXT NOT NULL, expires_at INTEGER NOT NULL,
+            rate_limit_reset INTEGER DEFAULT 0, is_healthy INTEGER DEFAULT 1, unhealthy_reason TEXT,
+            recovery_time INTEGER, fail_count INTEGER DEFAULT 0, last_used INTEGER DEFAULT 0,
+            used_count INTEGER DEFAULT 0, limit_count INTEGER DEFAULT 0, last_sync INTEGER DEFAULT 0
+          )
+        `);
+            db.exec(`
+          INSERT INTO accounts_new (id, email, auth_method, region, oidc_region, client_id, client_secret, profile_arn, start_url, refresh_token, access_token, expires_at, rate_limit_reset, is_healthy, unhealthy_reason, recovery_time, fail_count, last_used, used_count, limit_count, last_sync)
+          SELECT id, email, auth_method, region, NULL, client_id, client_secret, profile_arn, NULL, refresh_token, access_token, expires_at, COALESCE(rate_limit_reset, 0), COALESCE(is_healthy, 1), unhealthy_reason, recovery_time, COALESCE(fail_count, 0), COALESCE(last_used, 0), 0, 0, 0 FROM accounts
+        `);
+            db.exec('DROP TABLE accounts');
+            db.exec('ALTER TABLE accounts_new RENAME TO accounts');
+            db.exec('COMMIT');
+        }
+        catch (e) {
+            db.exec('ROLLBACK');
+        }
+    }
+    else {
+        const needed = {
+            fail_count: 'INTEGER DEFAULT 0',
+            used_count: 'INTEGER DEFAULT 0',
+            limit_count: 'INTEGER DEFAULT 0',
+            last_sync: 'INTEGER DEFAULT 0'
+        };
+        for (const [n, d] of Object.entries(needed)) {
+            if (!names.has(n))
+                db.exec(`ALTER TABLE accounts ADD COLUMN ${n} ${d}`);
+        }
+    }
+}
+function migrateUsageTable(db) {
+    const hasUsageTable = db
+        .prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='usage'")
+        .get();
+    if (hasUsageTable) {
+        db.exec(`
+        UPDATE accounts SET 
+          used_count = COALESCE((SELECT used_count FROM usage WHERE usage.account_id = accounts.id), used_count),
+          limit_count = COALESCE((SELECT limit_count FROM usage WHERE usage.account_id = accounts.id), limit_count),
+          last_sync = COALESCE((SELECT last_sync FROM usage WHERE usage.account_id = accounts.id), last_sync)
+      `);
+        db.exec('DROP TABLE usage');
+    }
+}
+function migrateStartUrlColumn(db) {
+    const columns = db.prepare('PRAGMA table_info(accounts)').all();
+    const names = new Set(columns.map((c) => c.name));
+    if (!names.has('start_url')) {
+        db.exec('ALTER TABLE accounts ADD COLUMN start_url TEXT');
+    }
+}
+function migrateOidcRegionColumn(db) {
+    const columns = db.prepare('PRAGMA table_info(accounts)').all();
+    const names = new Set(columns.map((c) => c.name));
+    if (!names.has('oidc_region')) {
+        db.exec('ALTER TABLE accounts ADD COLUMN oidc_region TEXT');
+    }
+    // Backfill: historically `region` was used for both service + OIDC.
+    db.exec("UPDATE accounts SET oidc_region = region WHERE oidc_region IS NULL OR oidc_region = ''");
+}
+function migrateDropRefreshTokenUniqueIndex(db) {
+    // Drop the UNIQUE index on refresh_token — it was only needed for ON CONFLICT(refresh_token)
+    // upsert mechanics. Now that we use ON CONFLICT(id), this index is unnecessary and actively
+    // harmful: duplicate rows (same account, different legacy vs hash id) share the same
+    // refresh_token, causing UNIQUE constraint violations on every upsert.
+    db.exec('DROP INDEX IF EXISTS idx_refresh_token_unique');
+    // Clean up duplicate rows: same email + same refresh_token but different ids.
+    // Keep the deterministic hash id (64-char hex), delete legacy kiro-cli-sync-* rows.
+    const duplicates = db
+        .prepare(`SELECT email, refresh_token FROM accounts
+       GROUP BY email, refresh_token
+       HAVING COUNT(*) > 1`)
+        .all();
+    for (const dup of duplicates) {
+        const rows = db
+            .prepare(`SELECT id FROM accounts WHERE email = ? AND refresh_token = ?
+         ORDER BY
+           CASE WHEN id LIKE 'kiro-cli-sync-%' THEN 1 ELSE 0 END ASC,
+           last_used DESC, expires_at DESC`)
+            .all(dup.email, dup.refresh_token);
+        // Keep the first row (deterministic hash id preferred), delete the rest
+        for (const row of rows.slice(1)) {
+            db.prepare('DELETE FROM accounts WHERE id = ?').run(row.id);
+        }
+    }
+}

package/dist/plugin/storage/sqlite.d.ts

@@ -0,0 +1,18 @@
+import type { ManagedAccount } from '../types.js';
+export declare const DB_PATH: string;
+export declare class KiroDatabase {
+    private db;
+    private path;
+    constructor(path?: string);
+    private init;
+    getAccounts(): any[];
+    private upsertAccountInternal;
+    upsertAccount(acc: ManagedAccount): Promise<void>;
+    batchUpsertAccounts(accounts: ManagedAccount[]): Promise<void>;
+    deleteAccount(id: string): Promise<void>;
+    markAccountsUnhealthy(ids: string[], reason: string): Promise<void>;
+    private rowToAccount;
+    close(): void;
+}
+export declare function createDatabase(path?: string): KiroDatabase;
+export declare const kiroDb: KiroDatabase;

package/dist/plugin/storage/sqlite.js

@@ -0,0 +1,166 @@
+import Database from 'libsql';
+import { existsSync, mkdirSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { deduplicateAccounts, mergeAccounts, withDatabaseLock } from './locked-operations.js';
+import { runMigrations } from './migrations.js';
+function getBaseDir() {
+    const p = process.platform;
+    if (p === 'win32')
+        return join(process.env.APPDATA || join(homedir(), 'AppData', 'Roaming'), 'opencode');
+    return join(process.env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'opencode');
+}
+export const DB_PATH = join(getBaseDir(), 'kiro.db');
+export class KiroDatabase {
+    db;
+    path;
+    constructor(path = DB_PATH) {
+        this.path = path;
+        const dir = join(path, '..');
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true });
+        this.db = new Database(path);
+        this.db.pragma('busy_timeout = 5000');
+        this.init();
+    }
+    init() {
+        this.db.pragma('journal_mode = WAL');
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS accounts (
+        id TEXT PRIMARY KEY, email TEXT NOT NULL, auth_method TEXT NOT NULL,
+        region TEXT NOT NULL, oidc_region TEXT, client_id TEXT, client_secret TEXT, profile_arn TEXT,
+        start_url TEXT,
+        refresh_token TEXT NOT NULL, access_token TEXT NOT NULL, expires_at INTEGER NOT NULL,
+        rate_limit_reset INTEGER DEFAULT 0, is_healthy INTEGER DEFAULT 1, unhealthy_reason TEXT,
+        recovery_time INTEGER, fail_count INTEGER DEFAULT 0, last_used INTEGER DEFAULT 0,
+        used_count INTEGER DEFAULT 0, limit_count INTEGER DEFAULT 0, last_sync INTEGER DEFAULT 0
+      )
+    `);
+        runMigrations(this.db);
+    }
+    getAccounts() {
+        return this.db.prepare('SELECT * FROM accounts').all();
+    }
+    upsertAccountInternal(acc) {
+        this.db
+            .prepare(`
+      INSERT INTO accounts (
+        id, email, auth_method, region, oidc_region, client_id, client_secret,
+        profile_arn, start_url, refresh_token, access_token, expires_at, rate_limit_reset,
+        is_healthy, unhealthy_reason, recovery_time, fail_count, last_used,
+        used_count, limit_count, last_sync
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET
+        id=excluded.id, email=excluded.email, auth_method=excluded.auth_method,
+        region=excluded.region, oidc_region=excluded.oidc_region, client_id=excluded.client_id, client_secret=excluded.client_secret,
+        profile_arn=excluded.profile_arn, start_url=excluded.start_url, refresh_token=excluded.refresh_token,
+        access_token=excluded.access_token, expires_at=excluded.expires_at,
+        rate_limit_reset=excluded.rate_limit_reset, is_healthy=excluded.is_healthy,
+        unhealthy_reason=excluded.unhealthy_reason, recovery_time=excluded.recovery_time,
+        fail_count=excluded.fail_count, last_used=excluded.last_used,
+        used_count=excluded.used_count, limit_count=excluded.limit_count, last_sync=excluded.last_sync
+    `)
+            .run(acc.id, acc.email, acc.authMethod, acc.region, acc.oidcRegion || null, acc.clientId || null, acc.clientSecret || null, acc.profileArn || null, acc.startUrl || null, acc.refreshToken, acc.accessToken, acc.expiresAt, acc.rateLimitResetTime || 0, acc.isHealthy ? 1 : 0, acc.unhealthyReason || null, acc.recoveryTime || null, acc.failCount || 0, acc.lastUsed || 0, acc.usedCount || 0, acc.limitCount || 0, acc.lastSync || 0);
+    }
+    async upsertAccount(acc) {
+        await withDatabaseLock(this.path, async () => {
+            const existing = this.getAccounts().map(this.rowToAccount);
+            const merged = mergeAccounts(existing, [acc]);
+            const deduplicated = deduplicateAccounts(merged);
+            this.db.exec('BEGIN TRANSACTION');
+            try {
+                for (const account of deduplicated) {
+                    this.upsertAccountInternal(account);
+                }
+                this.db.exec('COMMIT');
+            }
+            catch (e) {
+                this.db.exec('ROLLBACK');
+                throw e;
+            }
+        });
+    }
+    async batchUpsertAccounts(accounts) {
+        await withDatabaseLock(this.path, async () => {
+            const existing = this.getAccounts().map(this.rowToAccount);
+            const merged = mergeAccounts(existing, accounts);
+            const deduplicated = deduplicateAccounts(merged);
+            this.db.exec('BEGIN TRANSACTION');
+            try {
+                for (const account of deduplicated) {
+                    this.upsertAccountInternal(account);
+                }
+                this.db.exec('COMMIT');
+            }
+            catch (e) {
+                this.db.exec('ROLLBACK');
+                throw e;
+            }
+        });
+    }
+    async deleteAccount(id) {
+        await withDatabaseLock(this.path, async () => {
+            this.db.prepare('DELETE FROM accounts WHERE id = ?').run(id);
+        });
+    }
+    async markAccountsUnhealthy(ids, reason) {
+        if (ids.length === 0)
+            return;
+        await withDatabaseLock(this.path, async () => {
+            const now = Date.now();
+            this.db.exec('BEGIN TRANSACTION');
+            try {
+                const stmt = this.db.prepare(`
+            UPDATE accounts
+            SET is_healthy = 0,
+                unhealthy_reason = ?,
+                recovery_time = NULL,
+                fail_count = 10,
+                rate_limit_reset = 0,
+                last_sync = ?
+            WHERE id = ?
+          `);
+                for (const id of ids) {
+                    stmt.run(reason, now, id);
+                }
+                this.db.exec('COMMIT');
+            }
+            catch (e) {
+                this.db.exec('ROLLBACK');
+                throw e;
+            }
+        });
+    }
+    rowToAccount(row) {
+        return {
+            id: row.id,
+            email: row.email,
+            authMethod: row.auth_method,
+            region: row.region,
+            oidcRegion: row.oidc_region || undefined,
+            clientId: row.client_id,
+            clientSecret: row.client_secret,
+            profileArn: row.profile_arn,
+            startUrl: row.start_url || undefined,
+            refreshToken: row.refresh_token,
+            accessToken: row.access_token,
+            expiresAt: row.expires_at,
+            rateLimitResetTime: row.rate_limit_reset,
+            isHealthy: row.is_healthy === 1,
+            unhealthyReason: row.unhealthy_reason,
+            recoveryTime: row.recovery_time,
+            failCount: row.fail_count,
+            lastUsed: row.last_used,
+            usedCount: row.used_count,
+            limitCount: row.limit_count,
+            lastSync: row.last_sync
+        };
+    }
+    close() {
+        this.db.close();
+    }
+}
+export function createDatabase(path) {
+    return new KiroDatabase(path);
+}
+export const kiroDb = new KiroDatabase();

package/dist/plugin/streaming/index.d.ts

@@ -0,0 +1,2 @@
+export { findRealTag } from './stream-parser.js';
+export { transformKiroStream } from './stream-transformer.js';

package/dist/plugin/streaming/index.js

@@ -0,0 +1,2 @@
+export { findRealTag } from './stream-parser.js';
+export { transformKiroStream } from './stream-transformer.js';

package/dist/plugin/streaming/openai-converter.d.ts

@@ -0,0 +1,2 @@
+import { StreamEvent } from './types.js';
+export declare function convertToOpenAI(event: StreamEvent, id: string, model: string): any;

package/dist/plugin/streaming/openai-converter.js

@@ -0,0 +1,81 @@
+export function convertToOpenAI(event, id, model) {
+    const base = {
+        id,
+        object: 'chat.completion.chunk',
+        created: Math.floor(Date.now() / 1000),
+        model,
+        choices: []
+    };
+    if (event.type === 'content_block_delta') {
+        if (event.delta.type === 'text_delta') {
+            base.choices.push({
+                index: 0,
+                delta: { content: event.delta.text },
+                finish_reason: null
+            });
+        }
+        else if (event.delta.type === 'thinking_delta') {
+            // reasoning_content is supported by some OpenAI-compatible clients;
+            // emit it but also skip if empty to avoid noise.
+            if (event.delta.thinking) {
+                base.choices.push({
+                    index: 0,
+                    delta: { reasoning_content: event.delta.thinking },
+                    finish_reason: null
+                });
+            }
+        }
+        else if (event.delta.type === 'input_json_delta') {
+            base.choices.push({
+                index: 0,
+                delta: {
+                    tool_calls: [
+                        {
+                            index: event.index,
+                            function: { arguments: event.delta.partial_json }
+                        }
+                    ]
+                },
+                finish_reason: null
+            });
+        }
+    }
+    else if (event.type === 'content_block_start' && event.content_block?.type === 'tool_use') {
+        base.choices.push({
+            index: 0,
+            delta: {
+                tool_calls: [
+                    {
+                        index: event.index,
+                        id: event.content_block.id,
+                        type: 'function',
+                        function: { name: event.content_block.name, arguments: '' }
+                    }
+                ]
+            },
+            finish_reason: null
+        });
+    }
+    else if (event.type === 'message_delta') {
+        base.choices.push({
+            index: 0,
+            delta: {},
+            finish_reason: event.delta.stop_reason === 'tool_use' ? 'tool_calls' : 'stop'
+        });
+        base.usage = {
+            prompt_tokens: event.usage?.input_tokens || 0,
+            completion_tokens: event.usage?.output_tokens || 0,
+            total_tokens: (event.usage?.input_tokens || 0) + (event.usage?.output_tokens || 0)
+        };
+    }
+    else {
+        // Skip Anthropic-specific events that @ai-sdk/openai-compatible doesn't understand
+        // (content_block_start for text/thinking, content_block_stop, message_stop, etc.)
+        // Returning null signals the caller to skip this event.
+        return null;
+    }
+    // Don't emit chunks with empty choices — the SDK may mishandle them.
+    if (base.choices.length === 0)
+        return null;
+    return base;
+}

package/dist/plugin/streaming/sdk-stream-transformer.d.ts

@@ -0,0 +1 @@
+export declare function transformSdkStream(sdkResponse: any, model: string, conversationId: string): AsyncGenerator<any>;