oc-codex-multi-auth 6.0.0 → 6.1.0

package/dist/lib/storage/worktree-lock.js

@@ -0,0 +1,265 @@
+/**
+ * Multi-worktree collision detection for per-project account storage.
+ *
+ * Problem: when multiple OpenCode sessions (tabs, IDE windows, detached
+ * worktrees, or CI runs) point at the same per-project accounts file, their
+ * writes can interleave and lose rotation updates, health-score changes, or
+ * rate-limit state. The in-process `withStorageLock` mutex solves intra-process
+ * races but cannot see another Node process mutating the same file.
+ *
+ * Strategy: sidecar lock file at `<storage>.lock`. Every `loadAccounts` /
+ * `saveAccounts` call verifies ownership:
+ *
+ *   - No lock on disk -> write our own, proceed.
+ *   - Lock owned by us (same pid + hostname) -> refresh `lastActive`, proceed.
+ *   - Foreign lock with dead owner (same host, pid gone) -> take over.
+ *   - Foreign lock stale (`lastActive` older than STALE_THRESHOLD_MS) -> take
+ *     over. Required because a prior process that SIGKILL'd never released
+ *     its lock, so "dead pid" detection alone leaks locks on long-lived hosts.
+ *   - Foreign lock live -> surface a WARNING to the logger identifying both
+ *     worktrees and proceed anyway. The locking contract here is advisory
+ *     (Phase 4 F2 audit recommendation): blocking would strand the user when
+ *     two legitimate sessions share a project, so we prefer visibility over
+ *     enforcement.
+ *
+ * Cross-host note: we cannot probe a PID on a different machine, so a lock
+ * written from another hostname is always treated as live until its
+ * `lastActive` timestamp ages past STALE_THRESHOLD_MS. This is conservative
+ * but matches the audit requirement to "not block" — the worst case is a
+ * warning the user can dismiss.
+ *
+ * See `docs/audits/08-feature-recommendations.md` and
+ * `docs/audits/13-phased-roadmap.md#phase-4-f2` for background.
+ */
+import { promises as fs } from "node:fs";
+import os from "node:os";
+import { createLogger } from "../logger.js";
+import { registerCleanup } from "../shutdown.js";
+const log = createLogger("storage.worktree-lock");
+/**
+ * Time after which a lock whose owner never refreshed it is considered
+ * abandoned, regardless of PID liveness. One hour matches the roadmap spec
+ * and is long enough to avoid stealing a lock from a session that is merely
+ * idle between saves.
+ */
+export const STALE_THRESHOLD_MS = 60 * 60 * 1000;
+/**
+ * Tracks lock-file paths this process has written so a single shutdown
+ * cleanup can release all of them. Keyed by lock path, not storage path,
+ * to avoid double-registering cleanup if the same path is acquired twice.
+ */
+const ownedLockPaths = new Set();
+let shutdownCleanupRegistered = false;
+function lockPath(storagePath) {
+    return `${storagePath}.lock`;
+}
+/**
+ * Probes whether a PID is still running. Returns `true` conservatively for
+ * cross-host locks: we cannot signal a remote PID, so the safe default is
+ * "assume alive" and let the stale-timestamp branch reclaim it instead.
+ *
+ * Intentionally synchronous: `process.kill` is non-blocking and making this
+ * async buys nothing while incurring a useless microtask per lock check.
+ */
+function processAlive(pid, hostname) {
+    if (hostname !== os.hostname()) {
+        return true;
+    }
+    // Guard against invalid PIDs that would make `process.kill` throw
+    // EINVAL (treated as "alive" by the catch below) and leak the lock.
+    if (!Number.isInteger(pid) || pid <= 0) {
+        return false;
+    }
+    try {
+        // Signal 0 performs the permission + existence check without
+        // actually delivering a signal. ESRCH means "no such process".
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        const code = err.code;
+        // EPERM means the process exists but we cannot signal it (different
+        // user). Treat as alive to avoid stealing a lock we can't verify.
+        if (code === "EPERM")
+            return true;
+        return false;
+    }
+}
+function buildOwnLockInfo(existingStartedAt) {
+    const now = new Date().toISOString();
+    return {
+        pid: process.pid,
+        hostname: os.hostname(),
+        cwd: process.cwd(),
+        startedAt: existingStartedAt ?? now,
+        lastActive: now,
+    };
+}
+async function writeOurLock(lockFile, existingStartedAt) {
+    const info = buildOwnLockInfo(existingStartedAt);
+    // mode 0o600: lock discloses pid/cwd, so restrict to owner like the
+    // storage file itself.
+    await fs.writeFile(lockFile, JSON.stringify(info, null, 2), {
+        encoding: "utf-8",
+        mode: 0o600,
+    });
+    ownedLockPaths.add(lockFile);
+    ensureShutdownReleaseRegistered();
+}
+/**
+ * Best-effort shutdown hook that removes every lock we still own. Failures
+ * are swallowed so one bad unlink cannot stall process exit.
+ */
+function ensureShutdownReleaseRegistered() {
+    if (shutdownCleanupRegistered)
+        return;
+    shutdownCleanupRegistered = true;
+    registerCleanup(async () => {
+        const paths = Array.from(ownedLockPaths);
+        ownedLockPaths.clear();
+        await Promise.all(paths.map(async (lp) => {
+            try {
+                await releaseLockFile(lp);
+            }
+            catch {
+                // Swallow: shutdown path must not throw.
+            }
+        }));
+    });
+}
+function isOwnLock(info) {
+    return info.pid === process.pid && info.hostname === os.hostname();
+}
+/**
+ * Parse a lock file. Returns `null` if the file is missing, unreadable, or
+ * structurally invalid. Callers treat `null` the same as "no lock" so a
+ * corrupt sidecar never wedges storage access.
+ */
+async function readLock(lockFile) {
+    let raw;
+    try {
+        raw = await fs.readFile(lockFile, "utf-8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT") {
+            return null;
+        }
+        throw err;
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object")
+            return null;
+        const obj = parsed;
+        if (typeof obj.pid !== "number" ||
+            typeof obj.hostname !== "string" ||
+            typeof obj.cwd !== "string" ||
+            typeof obj.startedAt !== "string" ||
+            typeof obj.lastActive !== "string") {
+            return null;
+        }
+        return obj;
+    }
+    catch {
+        // Corrupt JSON: treat as absent rather than crashing the storage
+        // pipeline. `writeOurLock` will overwrite it on the next acquire.
+        return null;
+    }
+}
+/**
+ * Checks ownership of the worktree lock and acquires it when possible.
+ *
+ * Contract:
+ *   - Never throws on lock I/O errors *other than* propagating read/write
+ *     failures the caller needs to know about (disk full, EACCES).
+ *   - Always returns a discriminated result: either `acquired: true` (we
+ *     now own or refreshed the lock) or `acquired: false` with `foreign`
+ *     populated (another live worktree owns it; caller should warn).
+ *   - Never blocks. This is advisory locking by design.
+ */
+export async function acquireOrDetectLock(storagePath) {
+    const lockFile = lockPath(storagePath);
+    const existing = await readLock(lockFile);
+    if (!existing) {
+        await writeOurLock(lockFile);
+        return { acquired: true };
+    }
+    // Own lock: refresh timestamp so stale-detection on a long-running
+    // process never accidentally reclaims its own lock from itself.
+    if (isOwnLock(existing)) {
+        await writeOurLock(lockFile, existing.startedAt);
+        return { acquired: true };
+    }
+    // Stale timestamp takes priority over liveness probe: on the same host
+    // a fresh-looking PID that was reused by the OS would otherwise mask a
+    // dead session that never released its lock. Timestamp age is the
+    // authoritative abandonment signal.
+    const lastActiveMs = Date.parse(existing.lastActive);
+    if (Number.isFinite(lastActiveMs) &&
+        Date.now() - lastActiveMs > STALE_THRESHOLD_MS) {
+        log.info("Replacing stale worktree lock", {
+            staleCwd: existing.cwd,
+            stalePid: existing.pid,
+            staleHost: existing.hostname,
+            ageMs: Date.now() - lastActiveMs,
+        });
+        await writeOurLock(lockFile);
+        return { acquired: true };
+    }
+    // Non-stale foreign lock. If the owner pid is gone (same host), the
+    // previous process crashed without cleanup and we can take over.
+    const alive = processAlive(existing.pid, existing.hostname);
+    if (!alive) {
+        log.info("Replacing lock from dead worktree", {
+            deadCwd: existing.cwd,
+            deadPid: existing.pid,
+            deadHost: existing.hostname,
+        });
+        await writeOurLock(lockFile);
+        return { acquired: true };
+    }
+    // Foreign live lock. Advisory protocol: surface but do not block.
+    return { acquired: false, foreign: existing };
+}
+/**
+ * Release a lock file, but only if we currently own it. This guards against
+ * a late shutdown hook racing a newer process that re-acquired the lock.
+ */
+async function releaseLockFile(lockFile) {
+    ownedLockPaths.delete(lockFile);
+    const existing = await readLock(lockFile);
+    if (!existing)
+        return;
+    if (!isOwnLock(existing))
+        return;
+    try {
+        await fs.unlink(lockFile);
+    }
+    catch (err) {
+        if (err.code !== "ENOENT") {
+            // Degrade to warn; a leftover lock file is recoverable via the
+            // stale-timestamp branch on the next acquire.
+            log.warn("Failed to release worktree lock", {
+                lockFile,
+                error: String(err),
+            });
+        }
+    }
+}
+export async function releaseLock(storagePath) {
+    await releaseLockFile(lockPath(storagePath));
+}
+/**
+ * Test-only reset hook. Vitest reuses a single Node process across files,
+ * so `ownedLockPaths` state would leak between suites and confuse the
+ * "no lock on disk" acquire branch. Not re-exported from the barrel.
+ */
+export function __resetWorktreeLockForTests() {
+    ownedLockPaths.clear();
+    shutdownCleanupRegistered = false;
+}
+/** Test-only: inspect owned paths without exposing the internal Set. */
+export function __getOwnedLockPathsForTests() {
+    return Array.from(ownedLockPaths);
+}
+//# sourceMappingURL=worktree-lock.js.map

package/dist/lib/storage/worktree-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree-lock.js","sourceRoot":"","sources":["../../../lib/storage/worktree-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,MAAM,GAAG,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAC;AAElD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAqBjD;;;;GAIG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;AACzC,IAAI,yBAAyB,GAAG,KAAK,CAAC;AAEtC,SAAS,QAAQ,CAAC,WAAmB;IACpC,OAAO,GAAG,WAAW,OAAO,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,GAAW,EAAE,QAAgB;IAClD,IAAI,QAAQ,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACb,CAAC;IACD,kEAAkE;IAClE,oEAAoE;IACpE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACJ,6DAA6D;QAC7D,+DAA+D;QAC/D,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;QACjD,oEAAoE;QACpE,kEAAkE;QAClE,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QAClC,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,iBAA0B;IACnD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO;QACN,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE;QACvB,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;QAClB,SAAS,EAAE,iBAAiB,IAAI,GAAG;QACnC,UAAU,EAAE,GAAG;KACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAC1B,QAAgB,EAChB,iBAA0B;IAE1B,MAAM,IAAI,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IACjD,oEAAoE;IACpE,uBAAuB;IACvB,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QAC3D,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,KAAK;KACX,CAAC,CAAC;IACH,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7B,+BAA+B,EAAE,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,SAAS,+BAA+B;IACvC,IAAI,yBAAyB;QAAE,OAAO;IACtC,yBAAyB,GAAG,IAAI,CAAC;IACjC,eAAe,CAAC,KAAK,IAAI,EAAE;QAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACzC,cAAc,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,GAAG,CAChB,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACtB,IAAI,CAAC;gBACJ,MAAM,eAAe,CAAC,EAAE,CAAC,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACR,yCAAyC;YAC1C,CAAC;QACF,CAAC,CAAC,CACF,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,IAAsB;IACxC,OAAO,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,QAAQ,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,QAAQ,CAAC,QAAgB;IACvC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACJ,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtD,OAAO,IAAI,CAAC;QACb,CAAC;QACD,MAAM,GAAG,CAAC;IACX,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACvD,MAAM,GAAG,GAAG,MAAmC,CAAC;QAChD,IACC,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;YAC3B,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAChC,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;YAC3B,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;YACjC,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,EACjC,CAAC;YACF,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,GAAuB,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACR,iEAAiE;QACjE,kEAAkE;QAClE,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,WAAmB;IAEnB,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAE1C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,mEAAmE;IACnE,gEAAgE;IAChE,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,MAAM,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QACjD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,kEAAkE;IAClE,oCAAoC;IACpC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACrD,IACC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC7B,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,kBAAkB,EAC7C,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,+BAA+B,EAAE;YACzC,QAAQ,EAAE,QAAQ,CAAC,GAAG;YACtB,QAAQ,EAAE,QAAQ,CAAC,GAAG;YACtB,SAAS,EAAE,QAAQ,CAAC,QAAQ;YAC5B,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY;SAChC,CAAC,CAAC;QACH,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,oEAAoE;IACpE,iEAAiE;IACjE,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,GAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE;YAC7C,OAAO,EAAE,QAAQ,CAAC,GAAG;YACrB,OAAO,EAAE,QAAQ,CAAC,GAAG;YACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC3B,CAAC,CAAC;QACH,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,kEAAkE;IAClE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAAC,QAAgB;IAC9C,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;QAAE,OAAO;IACjC,IAAI,CAAC;QACJ,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtD,+DAA+D;YAC/D,8CAA8C;YAC9C,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE;gBAC3C,QAAQ;gBACR,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;aAClB,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,WAAmB;IACpD,MAAM,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B;IAC1C,cAAc,CAAC,KAAK,EAAE,CAAC;IACvB,yBAAyB,GAAG,KAAK,CAAC;AACnC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,2BAA2B;IAC1C,OAAO,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AACnC,CAAC"}

package/dist/lib/storage.d.ts

@@ -1,157 +1,23 @@
-import { type CooldownReason, type RateLimitStateV3, type AccountMetadataV1, type AccountStorageV1, type AccountMetadataV3, type AccountStorageV3 } from "./storage/migrations.js";
-export type { CooldownReason, RateLimitStateV3, AccountMetadataV1, AccountStorageV1, AccountMetadataV3, AccountStorageV3 };
-export interface FlaggedAccountMetadataV1 extends AccountMetadataV3 {
-    flaggedAt: number;
-    flaggedReason?: string;
-    lastError?: string;
-}
-export interface FlaggedAccountStorageV1 {
-    version: 1;
-    accounts: FlaggedAccountMetadataV1[];
-}
-export declare function getWorkspaceIdentityKey(account: {
-    organizationId?: string;
-    accountId?: string;
-    refreshToken: string;
-}): string;
-export type ImportBackupMode = "none" | "best-effort" | "required";
-export interface ImportAccountsOptions {
-    /**
-     * Optional prefix used for pre-import backup file names.
-     * Only applied when backupMode is not "none".
-     */
-    preImportBackupPrefix?: string;
-    /**
-     * Backup policy before import apply:
-     * - none: do not create a pre-import backup
-     * - best-effort: attempt backup, continue on failure
-     * - required: backup must succeed or import aborts
-     */
-    backupMode?: ImportBackupMode;
-}
-export type ImportBackupStatus = "created" | "skipped" | "failed";
-export interface ImportAccountsResult {
-    imported: number;
-    total: number;
-    skipped: number;
-    backupStatus: ImportBackupStatus;
-    backupPath?: string;
-    backupError?: string;
-}
-export interface ImportPreviewResult {
-    imported: number;
-    total: number;
-    skipped: number;
-}
 /**
- * Custom error class for storage operations with platform-aware hints.
- */
-export declare class StorageError extends Error {
-    readonly code: string;
-    readonly path: string;
-    readonly hint: string;
-    constructor(message: string, code: string, path: string, hint: string, cause?: Error);
-}
-/**
- * Generate platform-aware troubleshooting hint based on error code.
- */
-export declare function formatStorageErrorHint(error: unknown, path: string): string;
-export declare function setStoragePath(projectPath: string | null): void;
-export declare function setStoragePathDirect(path: string | null): void;
-/**
- * Returns the file path for the account storage JSON file.
- * @returns Absolute path to the accounts.json file
- */
-export declare function getStoragePath(): string;
-export declare function getFlaggedAccountsPath(): string;
-/**
- * Removes duplicate accounts, keeping the most recently used entry for each unique key.
- * Deduplication identity hierarchy: organizationId -> accountId -> refreshToken.
- * @param accounts - Array of accounts to deduplicate
- * @returns New array with duplicates removed
- */
-export declare function deduplicateAccounts<T extends {
-    organizationId?: string;
-    accountId?: string;
-    refreshToken: string;
-    lastUsed?: number;
-    addedAt?: number;
-}>(accounts: T[]): T[];
-/**
- * Removes duplicate legacy accounts by email, keeping the most recently used entry.
- * Accounts with organizationId/accountId are never merged by email to avoid collapsing workspace variants.
- * Accounts without email are always preserved.
- * @param accounts - Array of accounts to deduplicate
- * @returns New array with email duplicates removed
- */
-export declare function deduplicateAccountsByEmail<T extends {
-    organizationId?: string;
-    accountId?: string;
-    email?: string;
-    lastUsed?: number;
-    addedAt?: number;
-}>(accounts: T[]): T[];
-/**
- * Normalizes and validates account storage data, migrating from v1 to v3 if needed.
- * Handles deduplication, index clamping, and per-family active index mapping.
- * @param data - Raw storage data (unknown format)
- * @returns Normalized AccountStorageV3 or null if invalid
- */
-export declare function normalizeAccountStorage(data: unknown): AccountStorageV3 | null;
-/**
- * Loads OAuth accounts from disk storage.
- * Automatically migrates v1 storage to v3 format if needed.
- * @returns AccountStorageV3 if file exists and is valid, null otherwise
- */
-export declare function loadAccounts(): Promise<AccountStorageV3 | null>;
-/**
- * Executes a read-modify-write transaction under the storage lock and exposes
- * an unlocked persist callback so nested save operations do not deadlock.
- */
-export declare function withAccountStorageTransaction<T>(handler: (current: AccountStorageV3 | null, persist: (storage: AccountStorageV3) => Promise<void>) => Promise<T>): Promise<T>;
-/**
- * Persists account storage to disk using atomic write (temp file + rename).
- * Creates the .opencode directory if it doesn't exist.
- * Verifies file was written correctly and provides detailed error messages.
- * @param storage - Account storage data to save
- * @throws StorageError with platform-aware hints on failure
- */
-export declare function saveAccounts(storage: AccountStorageV3): Promise<void>;
-/**
- * Deletes the account storage file from disk.
- * Silently ignores if file doesn't exist.
- */
-export declare function clearAccounts(): Promise<void>;
-export declare function loadFlaggedAccounts(): Promise<FlaggedAccountStorageV1>;
-/**
- * Executes a read-modify-write transaction for flagged account storage under the
- * shared storage lock so concurrent callers cannot lose updates.
- */
-export declare function withFlaggedAccountStorageTransaction<T>(handler: (current: FlaggedAccountStorageV1, persist: (storage: FlaggedAccountStorageV1) => Promise<void>) => Promise<T>): Promise<T>;
-export declare function saveFlaggedAccounts(storage: FlaggedAccountStorageV1): Promise<void>;
-export declare function clearFlaggedAccounts(): Promise<void>;
-export declare function createTimestampedBackupPath(prefix?: string): string;
-/**
- * Import preview/apply analysis is pure in-memory work: it does not touch disk
- * and it does not log token or workspace values. The surrounding
- * `withAccountStorageTransaction` caller keeps Windows lock-retry and
- * serialized read-modify-write behavior; see `test/storage.test.ts` for the
- * overlapping transaction regression and pre-import backup lock coverage.
- */
-export declare function previewImportAccounts(filePath: string): Promise<ImportPreviewResult>;
-/**
- * Exports current accounts to a JSON file for backup/migration.
- * @param filePath - Destination file path
- * @param force - If true, overwrite existing file (default: true)
- * @throws Error if file exists and force is false, or if no accounts to export
- */
-export declare function exportAccounts(filePath: string, force?: boolean): Promise<void>;
-/**
- * Imports accounts from a JSON file, merging with existing accounts.
- * Deduplicates by identity key first (organizationId -> accountId -> refreshToken),
- * then applies legacy email dedupe only to entries without organizationId/accountId.
- * @param filePath - Source file path
- * @throws Error if file is invalid or would exceed MAX_ACCOUNTS
- */
-export declare function importAccounts(filePath: string, options?: ImportAccountsOptions): Promise<ImportAccountsResult>;
+ * Barrel for the account-storage layer.
+ *
+ * RC-2 split the original 1400-line `lib/storage.ts` into focused modules
+ * under `lib/storage/`. This file exists to keep the public surface stable
+ * so every consumer that imports from `./storage` / `../storage` resolves
+ * exactly as it did before the refactor.
+ *
+ * See `docs/audits/07-refactoring-plan.md#rc-2` and
+ * `docs/audits/16-code-health.md` for the motivation.
+ */
+export type { CooldownReason, RateLimitStateV3, AccountMetadataV1, AccountStorageV1, AccountMetadataV3, AccountStorageV3, } from "./storage/migrations.js";
+export { StorageError, formatStorageErrorHint } from "./storage/errors.js";
+export { setStoragePath, setStoragePathDirect, getStoragePath, } from "./storage/state.js";
+export { getWorkspaceIdentityKey, deduplicateAccounts, deduplicateAccountsByEmail, } from "./storage/identity.js";
+export { normalizeAccountStorage } from "./storage/normalize.js";
+export { loadAccounts, saveAccounts, clearAccounts, withAccountStorageTransaction, } from "./storage/load-save.js";
+export type { FlaggedAccountMetadataV1, FlaggedAccountStorageV1, } from "./storage/flagged.js";
+export { getFlaggedAccountsPath, loadFlaggedAccounts, saveFlaggedAccounts, clearFlaggedAccounts, withFlaggedAccountStorageTransaction, } from "./storage/flagged.js";
+export { createTimestampedBackupPath } from "./storage/backup.js";
+export type { ImportBackupMode, ImportBackupStatus, ImportAccountsOptions, ImportAccountsResult, ImportPreviewResult, } from "./storage/export-import.js";
+export { exportAccounts, importAccounts, previewImportAccounts, } from "./storage/export-import.js";
 //# sourceMappingURL=storage.d.ts.map

package/dist/lib/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../lib/storage.ts"],"names":[],"mappings":"AAeA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AAEjC,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;AAG3H,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACvC,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,wBAAwB,EAAE,CAAC;CACrC;AAKD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACrB,GAAG,MAAM,CAaT;AAED,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,CAAC;AAEnE,MAAM,WAAW,qBAAqB;IACrC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC9B;AAED,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;AAElE,MAAM,WAAW,oBAAoB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,kBAAkB,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK;CAOrF;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAsB3E;AA2ID,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAkB/D;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAI9D;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAKvC;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAgJD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS;IAAE,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,EACtJ,QAAQ,EAAE,CAAC,EAAE,GACZ,CAAC,EAAE,CAEL;AAYD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,CAAC,SAAS;IAAE,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,EACvJ,QAAQ,EAAE,CAAC,EAAE,GACZ,CAAC,EAAE,CAiEL;AA8DD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,OAAO,GAAG,gBAAgB,GAAG,IAAI,CAmF9E;AAED;;;;GAIG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAErE;AAuOD;;;GAGG;AACH,wBAAsB,6BAA6B,CAAC,CAAC,EACnD,OAAO,EAAE,CACP,OAAO,EAAE,gBAAgB,GAAG,IAAI,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,KAClD,OAAO,CAAC,CAAC,CAAC,GACd,OAAO,CAAC,CAAC,CAAC,CAKZ;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAI3E;AAED;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAYnD;AAuJD,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAE5E;AAuBD;;;GAGG;AACH,wBAAsB,oCAAoC,CAAC,CAAC,EAC3D,OAAO,EAAE,CACR,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,KACxD,OAAO,CAAC,CAAC,CAAC,GACb,OAAO,CAAC,CAAC,CAAC,CAKZ;AAED,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAIzF;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,CAW1D;AAsBD,wBAAgB,2BAA2B,CAAC,MAAM,SAAiB,GAAG,MAAM,CAM3E;AAkDD;;;;;;GAMG;AAEH,wBAAsB,qBAAqB,CAC1C,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,mBAAmB,CAAC,CAY9B;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,UAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBlF;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,qBAA0B,GACjC,OAAO,CAAC,oBAAoB,CAAC,CA2H/B"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../lib/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAG3E,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAGjE,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC;AAGhC,YAAY,EACV,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,oCAAoC,GACrC,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAGlE,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,cAAc,EACd,cAAc,EACd,qBAAqB,GACtB,MAAM,4BAA4B,CAAC"}