oc-codex-multi-auth 6.0.0 → 6.1.0

package/dist/lib/storage.js

@@ -1,1169 +1,26 @@
-import { promises as fs, existsSync } from "node:fs";
-import { randomBytes } from "node:crypto";
-import { basename, dirname, join } from "node:path";
-import { ACCOUNT_LIMITS, ACCOUNTS_FILE_NAME, FLAGGED_ACCOUNTS_FILE_NAME, LEGACY_ACCOUNTS_FILE_NAME, LEGACY_BLOCKED_ACCOUNTS_FILE_NAME, LEGACY_FLAGGED_ACCOUNTS_FILE_NAME, } from "./constants.js";
-import { createLogger } from "./logger.js";
-import { MODEL_FAMILIES } from "./prompts/codex.js";
-import { AnyAccountStorageSchema, getValidationErrors } from "./schemas.js";
-import { getConfigDir, getProjectConfigDir, getProjectGlobalConfigDir, findProjectRoot, resolvePath } from "./storage/paths.js";
-import { migrateV1ToV3, } from "./storage/migrations.js";
-const log = createLogger("storage");
-const normalizeWorkspaceIdentityPart = (value) => typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
-export function getWorkspaceIdentityKey(account) {
-    const organizationId = normalizeWorkspaceIdentityPart(account.organizationId);
-    const accountId = normalizeWorkspaceIdentityPart(account.accountId);
-    const refreshToken = normalizeWorkspaceIdentityPart(account.refreshToken) ?? "";
-    if (organizationId) {
-        return accountId
-            ? `organizationId:${organizationId}|accountId:${accountId}`
-            : `organizationId:${organizationId}`;
-    }
-    if (accountId) {
-        return `accountId:${accountId}`;
-    }
-    return `refreshToken:${refreshToken}`;
-}
 /**
- * Custom error class for storage operations with platform-aware hints.
- */
-export class StorageError extends Error {
-    code;
-    path;
-    hint;
-    constructor(message, code, path, hint, cause) {
-        super(message, { cause });
-        this.name = "StorageError";
-        this.code = code;
-        this.path = path;
-        this.hint = hint;
-    }
-}
-/**
- * Generate platform-aware troubleshooting hint based on error code.
- */
-export function formatStorageErrorHint(error, path) {
-    const err = error;
-    const code = err?.code || "UNKNOWN";
-    const isWindows = process.platform === "win32";
-    switch (code) {
-        case "EACCES":
-        case "EPERM":
-            return isWindows
-                ? `Permission denied writing to ${path}. Check antivirus exclusions for this folder. Ensure you have write permissions.`
-                : `Permission denied writing to ${path}. Check folder permissions. Try: chmod 755 ~/.opencode`;
-        case "EBUSY":
-            return `File is locked at ${path}. The file may be open in another program. Close any editors or processes accessing it.`;
-        case "ENOSPC":
-            return `Disk is full. Free up space and try again. Path: ${path}`;
-        case "EEMPTY":
-            return `File written but is empty. This may indicate a disk or filesystem issue. Path: ${path}`;
-        default:
-            return isWindows
-                ? `Failed to write to ${path}. Check folder permissions and ensure path contains no special characters.`
-                : `Failed to write to ${path}. Check folder permissions and disk space.`;
-    }
-}
-let storageMutex = Promise.resolve();
-/**
- * Serializes storage I/O to keep account file reads/writes lock-step and avoid
- * cross-request races during migration/seeding flows.
- */
-function withStorageLock(fn) {
-    const previousMutex = storageMutex;
-    let releaseLock;
-    storageMutex = new Promise((resolve) => {
-        releaseLock = resolve;
-    });
-    return previousMutex.then(fn).finally(() => releaseLock());
-}
-const WINDOWS_RENAME_RETRY_ATTEMPTS = 5;
-const WINDOWS_RENAME_RETRY_BASE_DELAY_MS = 10;
-const PRE_IMPORT_BACKUP_WRITE_TIMEOUT_MS = 3_000;
-function isWindowsLockError(error) {
-    const code = error?.code;
-    return code === "EPERM" || code === "EBUSY";
-}
-async function renameWithWindowsRetry(sourcePath, destinationPath) {
-    let lastError = null;
-    for (let attempt = 0; attempt < WINDOWS_RENAME_RETRY_ATTEMPTS; attempt += 1) {
-        try {
-            await fs.rename(sourcePath, destinationPath);
-            return;
-        }
-        catch (error) {
-            if (isWindowsLockError(error)) {
-                lastError = error;
-                await new Promise((resolve) => setTimeout(resolve, WINDOWS_RENAME_RETRY_BASE_DELAY_MS * 2 ** attempt));
-                continue;
-            }
-            throw error;
-        }
-    }
-    if (lastError) {
-        throw lastError;
-    }
-}
-async function writeFileWithTimeout(filePath, content, timeoutMs) {
-    const controller = new AbortController();
-    const timeoutHandle = setTimeout(() => controller.abort(), timeoutMs);
-    try {
-        await fs.writeFile(filePath, content, {
-            encoding: "utf-8",
-            mode: 0o600,
-            signal: controller.signal,
-        });
-    }
-    catch (error) {
-        if (error instanceof Error && error.name === "AbortError") {
-            const timeoutError = Object.assign(new Error(`Timed out writing file after ${timeoutMs}ms`), { code: "ETIMEDOUT" });
-            throw timeoutError;
-        }
-        throw error;
-    }
-    finally {
-        clearTimeout(timeoutHandle);
-    }
-}
-async function writePreImportBackupFile(backupPath, snapshot) {
-    const uniqueSuffix = `${Date.now()}.${Math.random().toString(36).slice(2, 8)}`;
-    const tempPath = `${backupPath}.${uniqueSuffix}.tmp`;
-    try {
-        await fs.mkdir(dirname(backupPath), { recursive: true });
-        const backupContent = JSON.stringify(snapshot, null, 2);
-        await writeFileWithTimeout(tempPath, backupContent, PRE_IMPORT_BACKUP_WRITE_TIMEOUT_MS);
-        await renameWithWindowsRetry(tempPath, backupPath);
-    }
-    catch (error) {
-        try {
-            await fs.unlink(tempPath);
-        }
-        catch {
-            // Best effort temp-file cleanup.
-        }
-        throw error;
-    }
-}
-async function ensureGitignore(storagePath) {
-    if (!currentStoragePath)
-        return;
-    const configDir = dirname(storagePath);
-    const inferredProjectRoot = dirname(configDir);
-    const candidateRoots = [currentProjectRoot, inferredProjectRoot].filter((root) => typeof root === "string" && root.length > 0);
-    const projectRoot = candidateRoots.find((root) => existsSync(join(root, ".git")));
-    if (!projectRoot)
-        return;
-    const gitignorePath = join(projectRoot, ".gitignore");
-    try {
-        let content = "";
-        if (existsSync(gitignorePath)) {
-            content = await fs.readFile(gitignorePath, "utf-8");
-            const lines = content.split("\n").map((l) => l.trim());
-            if (lines.includes(".opencode") || lines.includes(".opencode/") || lines.includes("/.opencode") || lines.includes("/.opencode/")) {
-                return;
-            }
-        }
-        const newContent = content.endsWith("\n") || content === "" ? content : content + "\n";
-        await fs.writeFile(gitignorePath, newContent + ".opencode/\n", "utf-8");
-        log.debug("Added .opencode to .gitignore", { path: gitignorePath });
-    }
-    catch (error) {
-        log.warn("Failed to update .gitignore", { error: String(error) });
-    }
-}
-let currentStoragePath = null;
-let currentLegacyProjectStoragePath = null;
-let currentProjectRoot = null;
-export function setStoragePath(projectPath) {
-    if (!projectPath) {
-        currentStoragePath = null;
-        currentLegacyProjectStoragePath = null;
-        currentProjectRoot = null;
-        return;
-    }
-    const projectRoot = findProjectRoot(projectPath);
-    if (projectRoot) {
-        currentProjectRoot = projectRoot;
-        currentStoragePath = join(getProjectGlobalConfigDir(projectRoot), ACCOUNTS_FILE_NAME);
-        currentLegacyProjectStoragePath = join(getProjectConfigDir(projectRoot), LEGACY_ACCOUNTS_FILE_NAME);
-    }
-    else {
-        currentStoragePath = null;
-        currentLegacyProjectStoragePath = null;
-        currentProjectRoot = null;
-    }
-}
-export function setStoragePathDirect(path) {
-    currentStoragePath = path;
-    currentLegacyProjectStoragePath = null;
-    currentProjectRoot = null;
-}
-/**
- * Returns the file path for the account storage JSON file.
- * @returns Absolute path to the accounts.json file
- */
-export function getStoragePath() {
-    if (currentStoragePath) {
-        return currentStoragePath;
-    }
-    return join(getConfigDir(), ACCOUNTS_FILE_NAME);
-}
-export function getFlaggedAccountsPath() {
-    return join(dirname(getStoragePath()), FLAGGED_ACCOUNTS_FILE_NAME);
-}
-function getLegacyFlaggedAccountsPath() {
-    return join(dirname(getStoragePath()), LEGACY_FLAGGED_ACCOUNTS_FILE_NAME);
-}
-function getLegacyBlockedAccountsPath() {
-    return join(dirname(getStoragePath()), LEGACY_BLOCKED_ACCOUNTS_FILE_NAME);
-}
-async function migrateStorageFileIfNeeded(legacyPath, nextPath, persist, label) {
-    if (!legacyPath || legacyPath === nextPath || !existsSync(legacyPath)) {
-        return null;
-    }
-    try {
-        const legacyContent = await fs.readFile(legacyPath, "utf-8");
-        const legacyData = JSON.parse(legacyContent);
-        const normalized = normalizeAccountStorage(legacyData);
-        if (!normalized)
-            return null;
-        await persist(normalized);
-        try {
-            await fs.unlink(legacyPath);
-            log.info(`Removed legacy ${label} after migration`, { path: legacyPath });
-        }
-        catch (unlinkError) {
-            const code = unlinkError.code;
-            if (code !== "ENOENT") {
-                log.warn(`Failed to remove legacy ${label} after migration`, {
-                    path: legacyPath,
-                    error: String(unlinkError),
-                });
-            }
-        }
-        log.info(`Migrated legacy ${label}`, {
-            from: legacyPath,
-            to: nextPath,
-            accounts: normalized.accounts.length,
-        });
-        return normalized;
-    }
-    catch (error) {
-        log.warn(`Failed to migrate legacy ${label}`, {
-            from: legacyPath,
-            to: nextPath,
-            error: String(error),
-        });
-        return null;
-    }
-}
-async function migrateLegacyProjectStorageIfNeeded(persist = saveAccounts) {
-    return migrateStorageFileIfNeeded(currentLegacyProjectStoragePath, getStoragePath(), persist, "project account storage");
-}
-function selectNewestAccount(current, candidate) {
-    if (!current)
-        return candidate;
-    const currentLastUsed = current.lastUsed || 0;
-    const candidateLastUsed = candidate.lastUsed || 0;
-    if (candidateLastUsed > currentLastUsed)
-        return candidate;
-    if (candidateLastUsed < currentLastUsed)
-        return current;
-    const currentAddedAt = current.addedAt || 0;
-    const candidateAddedAt = candidate.addedAt || 0;
-    return candidateAddedAt >= currentAddedAt ? candidate : current;
-}
-function deduplicateAccountsByKey(accounts) {
-    const working = [...accounts];
-    const keyToIndex = new Map();
-    const indicesToRemove = new Set();
-    for (let i = 0; i < working.length; i += 1) {
-        const account = working[i];
-        if (!account)
-            continue;
-        const key = toAccountIdentityKey(account);
-        if (!key)
-            continue;
-        const existingIndex = keyToIndex.get(key);
-        if (existingIndex === undefined) {
-            keyToIndex.set(key, i);
-            continue;
-        }
-        const newestIndex = pickNewestAccountIndex(working, existingIndex, i);
-        const obsoleteIndex = newestIndex === existingIndex ? i : existingIndex;
-        const target = working[newestIndex];
-        const source = working[obsoleteIndex];
-        if (target && source) {
-            working[newestIndex] = mergeAccountRecords(target, source);
-        }
-        indicesToRemove.add(obsoleteIndex);
-        keyToIndex.set(key, newestIndex);
-    }
-    const result = [];
-    for (let i = 0; i < working.length; i += 1) {
-        if (indicesToRemove.has(i))
-            continue;
-        const account = working[i];
-        if (account)
-            result.push(account);
-    }
-    return result;
-}
-function pickNewestAccountIndex(accounts, existingIndex, candidateIndex) {
-    const existing = accounts[existingIndex];
-    const candidate = accounts[candidateIndex];
-    if (!existing)
-        return candidateIndex;
-    if (!candidate)
-        return existingIndex;
-    const newest = selectNewestAccount(existing, candidate);
-    return newest === candidate ? candidateIndex : existingIndex;
-}
-function mergeAccountRecords(target, source) {
-    const newest = selectNewestAccount(target, source);
-    const older = newest === target ? source : target;
-    return {
-        ...older,
-        ...newest,
-        organizationId: target.organizationId ?? source.organizationId,
-        accountId: target.accountId ?? source.accountId,
-        accountIdSource: target.accountIdSource ?? source.accountIdSource,
-        accountLabel: target.accountLabel ?? source.accountLabel,
-        email: target.email ?? source.email,
-    };
-}
-/**
- * Removes duplicate accounts, keeping the most recently used entry for each unique key.
- * Deduplication identity hierarchy: organizationId -> accountId -> refreshToken.
- * @param accounts - Array of accounts to deduplicate
- * @returns New array with duplicates removed
- */
-export function deduplicateAccounts(accounts) {
-    return deduplicateAccountsByKey(accounts);
-}
-/**
- * Applies storage deduplication semantics used by normalize/import paths.
- * 1) Dedupe only exact identity duplicates (organizationId -> accountId -> refreshToken),
- *    preserving distinct workspace variants that share a refresh token.
- * 2) Then apply legacy email dedupe only for entries that still do not have organizationId/accountId.
- */
-function deduplicateAccountsForStorage(accounts) {
-    return deduplicateAccountsByEmail(deduplicateAccountsByKey(accounts));
-}
-/**
- * Removes duplicate legacy accounts by email, keeping the most recently used entry.
- * Accounts with organizationId/accountId are never merged by email to avoid collapsing workspace variants.
- * Accounts without email are always preserved.
- * @param accounts - Array of accounts to deduplicate
- * @returns New array with email duplicates removed
- */
-export function deduplicateAccountsByEmail(accounts) {
-    const emailToNewestIndex = new Map();
-    const indicesToKeep = new Set();
-    for (let i = 0; i < accounts.length; i += 1) {
-        const account = accounts[i];
-        if (!account)
-            continue;
-        const organizationId = account.organizationId?.trim();
-        if (organizationId) {
-            indicesToKeep.add(i);
-            continue;
-        }
-        const accountId = account.accountId?.trim();
-        if (accountId) {
-            indicesToKeep.add(i);
-            continue;
-        }
-        const email = account.email?.trim();
-        if (!email) {
-            indicesToKeep.add(i);
-            continue;
-        }
-        const existingIndex = emailToNewestIndex.get(email);
-        if (existingIndex === undefined) {
-            emailToNewestIndex.set(email, i);
-            continue;
-        }
-        const existing = accounts[existingIndex];
-        // istanbul ignore next -- defensive code: existingIndex always refers to valid account
-        if (!existing) {
-            emailToNewestIndex.set(email, i);
-            continue;
-        }
-        const existingLastUsed = existing.lastUsed || 0;
-        const candidateLastUsed = account.lastUsed || 0;
-        const existingAddedAt = existing.addedAt || 0;
-        const candidateAddedAt = account.addedAt || 0;
-        const isNewer = candidateLastUsed > existingLastUsed ||
-            (candidateLastUsed === existingLastUsed && candidateAddedAt > existingAddedAt);
-        if (isNewer) {
-            emailToNewestIndex.set(email, i);
-        }
-    }
-    for (const idx of emailToNewestIndex.values()) {
-        indicesToKeep.add(idx);
-    }
-    const result = [];
-    for (let i = 0; i < accounts.length; i += 1) {
-        if (indicesToKeep.has(i)) {
-            const account = accounts[i];
-            if (account)
-                result.push(account);
-        }
-    }
-    return result;
-}
-function isRecord(value) {
-    return !!value && typeof value === "object" && !Array.isArray(value);
-}
-function clampIndex(index, length) {
-    if (length <= 0)
-        return 0;
-    return Math.max(0, Math.min(index, length - 1));
-}
-function toAccountIdentityKeys(account) {
-    const keys = [];
-    const organizationId = typeof account.organizationId === "string" ? account.organizationId.trim() : "";
-    if (organizationId) {
-        keys.push(`organizationId:${organizationId}`);
-    }
-    const accountId = typeof account.accountId === "string" ? account.accountId.trim() : "";
-    if (accountId) {
-        keys.push(`accountId:${accountId}`);
-    }
-    const refreshToken = typeof account.refreshToken === "string" ? account.refreshToken.trim() : "";
-    if (refreshToken) {
-        keys.push(`refreshToken:${refreshToken}`);
-    }
-    return keys;
-}
-function toAccountIdentityKey(account) {
-    return toAccountIdentityKeys(account)[0];
-}
-function extractActiveKeys(accounts, activeIndex) {
-    const candidate = accounts[activeIndex];
-    if (!isRecord(candidate))
-        return [];
-    return toAccountIdentityKeys({
-        organizationId: typeof candidate.organizationId === "string" ? candidate.organizationId : undefined,
-        accountId: typeof candidate.accountId === "string" ? candidate.accountId : undefined,
-        refreshToken: typeof candidate.refreshToken === "string" ? candidate.refreshToken : "",
-    });
-}
-function findAccountIndexByIdentityKeys(accounts, identityKeys) {
-    if (identityKeys.length === 0)
-        return -1;
-    for (const identityKey of identityKeys) {
-        const idx = accounts.findIndex((account) => toAccountIdentityKeys(account).includes(identityKey));
-        if (idx >= 0) {
-            return idx;
-        }
-    }
-    return -1;
-}
-/**
- * Normalizes and validates account storage data, migrating from v1 to v3 if needed.
- * Handles deduplication, index clamping, and per-family active index mapping.
- * @param data - Raw storage data (unknown format)
- * @returns Normalized AccountStorageV3 or null if invalid
- */
-export function normalizeAccountStorage(data) {
-    if (!isRecord(data)) {
-        log.warn("Invalid storage format, ignoring");
-        return null;
-    }
-    if (data.version !== 1 && data.version !== 3) {
-        log.warn("Unknown storage version, ignoring", {
-            version: data.version,
-        });
-        return null;
-    }
-    const rawAccounts = data.accounts;
-    if (!Array.isArray(rawAccounts)) {
-        log.warn("Invalid storage format, ignoring");
-        return null;
-    }
-    const activeIndexValue = typeof data.activeIndex === "number" && Number.isFinite(data.activeIndex)
-        ? data.activeIndex
-        : 0;
-    const rawActiveIndex = clampIndex(activeIndexValue, rawAccounts.length);
-    const activeKeys = extractActiveKeys(rawAccounts, rawActiveIndex);
-    const fromVersion = data.version;
-    const baseStorage = fromVersion === 1
-        ? migrateV1ToV3(data)
-        : data;
-    const validAccounts = rawAccounts.filter((account) => isRecord(account) && typeof account.refreshToken === "string" && !!account.refreshToken.trim());
-    const deduplicatedAccounts = deduplicateAccountsForStorage(validAccounts);
-    const activeIndex = (() => {
-        if (deduplicatedAccounts.length === 0)
-            return 0;
-        if (activeKeys.length > 0) {
-            const mappedIndex = findAccountIndexByIdentityKeys(deduplicatedAccounts, activeKeys);
-            if (mappedIndex >= 0)
-                return mappedIndex;
-        }
-        return clampIndex(rawActiveIndex, deduplicatedAccounts.length);
-    })();
-    const activeIndexByFamily = {};
-    const rawFamilyIndices = isRecord(baseStorage.activeIndexByFamily)
-        ? baseStorage.activeIndexByFamily
-        : {};
-    for (const family of MODEL_FAMILIES) {
-        const rawIndexValue = rawFamilyIndices[family];
-        const rawIndex = typeof rawIndexValue === "number" && Number.isFinite(rawIndexValue)
-            ? rawIndexValue
-            : rawActiveIndex;
-        const clampedRawIndex = clampIndex(rawIndex, rawAccounts.length);
-        const familyKeys = extractActiveKeys(rawAccounts, clampedRawIndex);
-        let mappedIndex = clampIndex(rawIndex, deduplicatedAccounts.length);
-        if (familyKeys.length > 0 && deduplicatedAccounts.length > 0) {
-            const idx = findAccountIndexByIdentityKeys(deduplicatedAccounts, familyKeys);
-            if (idx >= 0) {
-                mappedIndex = idx;
-            }
-        }
-        activeIndexByFamily[family] = mappedIndex;
-    }
-    return {
-        version: 3,
-        accounts: deduplicatedAccounts,
-        activeIndex,
-        activeIndexByFamily,
-    };
-}
-/**
- * Loads OAuth accounts from disk storage.
- * Automatically migrates v1 storage to v3 format if needed.
- * @returns AccountStorageV3 if file exists and is valid, null otherwise
- */
-export async function loadAccounts() {
-    return withStorageLock(async () => loadAccountsInternal(saveAccountsUnlocked));
-}
-/**
- * Resolves the global (non-project) account storage path.
- */
-function getGlobalAccountsStoragePath() {
-    return join(getConfigDir(), ACCOUNTS_FILE_NAME);
-}
-function getLegacyGlobalAccountsStoragePath() {
-    return join(getConfigDir(), LEGACY_ACCOUNTS_FILE_NAME);
-}
-async function migrateLegacyGlobalStorageIfNeeded() {
-    const nextPath = getGlobalAccountsStoragePath();
-    const persistGlobalStorage = async (storage) => {
-        await writeAccountsToPathUnlocked(nextPath, storage);
-    };
-    return migrateStorageFileIfNeeded(getLegacyGlobalAccountsStoragePath(), nextPath, persistGlobalStorage, "global account storage");
-}
-/**
- * Returns true when project-scoped storage is active and a global fallback is meaningful.
- */
-function shouldUseProjectGlobalFallback() {
-    return Boolean(currentStoragePath && currentProjectRoot);
-}
-/**
- * Loads account data from global storage as a fallback when project storage is missing.
- * Returns null for missing/unusable global storage and never throws to callers.
- */
-async function loadGlobalAccountsFallback() {
-    if (!shouldUseProjectGlobalFallback() || !currentStoragePath) {
-        return null;
-    }
-    const migrated = await migrateLegacyGlobalStorageIfNeeded();
-    if (migrated) {
-        return migrated;
-    }
-    const globalStoragePath = getGlobalAccountsStoragePath();
-    if (globalStoragePath === currentStoragePath) {
-        return null;
-    }
-    try {
-        const content = await fs.readFile(globalStoragePath, "utf-8");
-        const data = JSON.parse(content);
-        const schemaErrors = getValidationErrors(AnyAccountStorageSchema, data);
-        if (schemaErrors.length > 0) {
-            log.warn("Global account storage schema validation warnings", {
-                path: globalStoragePath,
-                errors: schemaErrors.slice(0, 5),
-            });
-        }
-        const normalized = normalizeAccountStorage(data);
-        if (!normalized)
-            return null;
-        log.info("Loaded global account storage as project fallback", {
-            from: globalStoragePath,
-            to: currentStoragePath,
-            accounts: normalized.accounts.length,
-        });
-        return normalized;
-    }
-    catch (error) {
-        const code = error.code;
-        if (code !== "ENOENT") {
-            log.warn("Failed to load global fallback account storage", {
-                from: globalStoragePath,
-                to: currentStoragePath,
-                error: String(error),
-            });
-        }
-        return null;
-    }
-}
-/**
- * Core account-loading routine shared by normal reads and transactional storage handlers.
- * Handles schema normalization, legacy migration, and optional fallback seeding.
- */
-async function loadAccountsInternal(persistMigration) {
-    try {
-        const path = getStoragePath();
-        const content = await fs.readFile(path, "utf-8");
-        const data = JSON.parse(content);
-        const schemaErrors = getValidationErrors(AnyAccountStorageSchema, data);
-        if (schemaErrors.length > 0) {
-            log.warn("Account storage schema validation warnings", { errors: schemaErrors.slice(0, 5) });
-        }
-        const normalized = normalizeAccountStorage(data);
-        const storedVersion = isRecord(data) ? data.version : undefined;
-        if (normalized && storedVersion !== normalized.version) {
-            log.info("Migrating account storage to v3", { from: storedVersion, to: normalized.version });
-            if (persistMigration) {
-                try {
-                    await persistMigration(normalized);
-                }
-                catch (saveError) {
-                    log.warn("Failed to persist migrated storage", { error: String(saveError) });
-                }
-            }
-        }
-        return normalized;
-    }
-    catch (error) {
-        const code = error.code;
-        if (code === "ENOENT") {
-            const migrated = persistMigration
-                ? await migrateLegacyProjectStorageIfNeeded(persistMigration)
-                : null;
-            if (migrated)
-                return migrated;
-            if (!shouldUseProjectGlobalFallback()) {
-                const migratedGlobal = persistMigration
-                    ? await migrateLegacyGlobalStorageIfNeeded()
-                    : null;
-                if (migratedGlobal)
-                    return migratedGlobal;
-                return null;
-            }
-            const globalFallback = await loadGlobalAccountsFallback();
-            if (!globalFallback)
-                return null;
-            if (persistMigration) {
-                const seedPath = getStoragePath();
-                try {
-                    await fs.access(seedPath);
-                    return globalFallback;
-                }
-                catch (accessError) {
-                    const accessCode = accessError.code;
-                    if (accessCode !== "ENOENT") {
-                        log.warn("Failed to inspect project seed path before fallback seeding", {
-                            path: seedPath,
-                            error: String(accessError),
-                        });
-                        return globalFallback;
-                    }
-                    // File is missing; proceed with seed write.
-                }
-                try {
-                    await persistMigration(globalFallback);
-                    log.info("Seeded project account storage from global fallback", {
-                        path: seedPath,
-                        accounts: globalFallback.accounts.length,
-                    });
-                }
-                catch (persistError) {
-                    log.warn("Failed to seed project storage from global fallback", {
-                        path: seedPath,
-                        error: String(persistError),
-                    });
-                }
-            }
-            return globalFallback;
-        }
-        log.error("Failed to load account storage", { error: String(error) });
-        return null;
-    }
-}
-/**
- * Writes account storage without acquiring the outer storage mutex.
- * Callers must already be inside withStorageLock when using this helper directly.
- */
-async function writeAccountsToPathUnlocked(path, storage) {
-    const uniqueSuffix = `${Date.now()}.${Math.random().toString(36).slice(2, 8)}`;
-    const tempPath = `${path}.${uniqueSuffix}.tmp`;
-    try {
-        await fs.mkdir(dirname(path), { recursive: true });
-        await ensureGitignore(path);
-        // Normalize before persisting so every write path enforces dedup semantics
-        // (exact identity dedupe plus legacy email dedupe for identity-less records).
-        const normalizedStorage = normalizeAccountStorage(storage) ?? storage;
-        const content = JSON.stringify(normalizedStorage, null, 2);
-        await fs.writeFile(tempPath, content, { encoding: "utf-8", mode: 0o600 });
-        const stats = await fs.stat(tempPath);
-        if (stats.size === 0) {
-            const emptyError = Object.assign(new Error("File written but size is 0"), { code: "EEMPTY" });
-            throw emptyError;
-        }
-        await renameWithWindowsRetry(tempPath, path);
-    }
-    catch (error) {
-        try {
-            await fs.unlink(tempPath);
-        }
-        catch {
-            // Ignore cleanup failure.
-        }
-        const err = error;
-        const code = err?.code || "UNKNOWN";
-        const hint = formatStorageErrorHint(error, path);
-        log.error("Failed to save accounts", {
-            path,
-            code,
-            message: err?.message,
-            hint,
-        });
-        throw new StorageError(`Failed to save accounts: ${err?.message || "Unknown error"}`, code, path, hint, err instanceof Error ? err : undefined);
-    }
-}
-async function saveAccountsUnlocked(storage) {
-    await writeAccountsToPathUnlocked(getStoragePath(), storage);
-}
-/**
- * Executes a read-modify-write transaction under the storage lock and exposes
- * an unlocked persist callback so nested save operations do not deadlock.
- */
-export async function withAccountStorageTransaction(handler) {
-    return withStorageLock(async () => {
-        const current = await loadAccountsInternal(saveAccountsUnlocked);
-        return handler(current, saveAccountsUnlocked);
-    });
-}
-/**
- * Persists account storage to disk using atomic write (temp file + rename).
- * Creates the .opencode directory if it doesn't exist.
- * Verifies file was written correctly and provides detailed error messages.
- * @param storage - Account storage data to save
- * @throws StorageError with platform-aware hints on failure
- */
-export async function saveAccounts(storage) {
-    return withStorageLock(async () => {
-        await saveAccountsUnlocked(storage);
-    });
-}
-/**
- * Deletes the account storage file from disk.
- * Silently ignores if file doesn't exist.
- */
-export async function clearAccounts() {
-    return withStorageLock(async () => {
-        try {
-            const path = getStoragePath();
-            await fs.unlink(path);
-        }
-        catch (error) {
-            const code = error.code;
-            if (code !== "ENOENT") {
-                log.error("Failed to clear account storage", { error: String(error) });
-            }
-        }
-    });
-}
-function normalizeFlaggedStorage(data) {
-    if (!isRecord(data) || data.version !== 1 || !Array.isArray(data.accounts)) {
-        return { version: 1, accounts: [] };
-    }
-    const byIdentityKey = new Map();
-    for (const rawAccount of data.accounts) {
-        if (!isRecord(rawAccount))
-            continue;
-        const refreshToken = typeof rawAccount.refreshToken === "string" ? rawAccount.refreshToken.trim() : "";
-        if (!refreshToken)
-            continue;
-        const flaggedAt = typeof rawAccount.flaggedAt === "number" ? rawAccount.flaggedAt : Date.now();
-        const isAccountIdSource = (value) => value === "token" || value === "id_token" || value === "org" || value === "manual";
-        const isSwitchReason = (value) => value === "rate-limit" || value === "initial" || value === "rotation";
-        const isCooldownReason = (value) => value === "auth-failure" || value === "network-error";
-        const normalizeTags = (value) => {
-            if (!Array.isArray(value))
-                return undefined;
-            const normalized = value
-                .filter((entry) => typeof entry === "string")
-                .map((entry) => entry.trim().toLowerCase())
-                .filter((entry) => entry.length > 0);
-            return normalized.length > 0 ? Array.from(new Set(normalized)) : undefined;
-        };
-        let rateLimitResetTimes;
-        if (isRecord(rawAccount.rateLimitResetTimes)) {
-            const normalizedRateLimits = {};
-            for (const [key, value] of Object.entries(rawAccount.rateLimitResetTimes)) {
-                if (typeof value === "number") {
-                    normalizedRateLimits[key] = value;
-                }
-            }
-            if (Object.keys(normalizedRateLimits).length > 0) {
-                rateLimitResetTimes = normalizedRateLimits;
-            }
-        }
-        const accountIdSource = isAccountIdSource(rawAccount.accountIdSource)
-            ? rawAccount.accountIdSource
-            : undefined;
-        const lastSwitchReason = isSwitchReason(rawAccount.lastSwitchReason)
-            ? rawAccount.lastSwitchReason
-            : undefined;
-        const cooldownReason = isCooldownReason(rawAccount.cooldownReason)
-            ? rawAccount.cooldownReason
-            : undefined;
-        const accountTags = normalizeTags(rawAccount.accountTags);
-        const accountNote = typeof rawAccount.accountNote === "string" && rawAccount.accountNote.trim()
-            ? rawAccount.accountNote.trim()
-            : undefined;
-        const normalized = {
-            refreshToken,
-            addedAt: typeof rawAccount.addedAt === "number" ? rawAccount.addedAt : flaggedAt,
-            lastUsed: typeof rawAccount.lastUsed === "number" ? rawAccount.lastUsed : flaggedAt,
-            organizationId: typeof rawAccount.organizationId === "string" ? rawAccount.organizationId : undefined,
-            accountId: typeof rawAccount.accountId === "string" ? rawAccount.accountId : undefined,
-            accountIdSource,
-            accountLabel: typeof rawAccount.accountLabel === "string" ? rawAccount.accountLabel : undefined,
-            accountTags,
-            accountNote,
-            email: typeof rawAccount.email === "string" ? rawAccount.email : undefined,
-            enabled: typeof rawAccount.enabled === "boolean" ? rawAccount.enabled : undefined,
-            lastSwitchReason,
-            rateLimitResetTimes,
-            coolingDownUntil: typeof rawAccount.coolingDownUntil === "number" ? rawAccount.coolingDownUntil : undefined,
-            cooldownReason,
-            flaggedAt,
-            flaggedReason: typeof rawAccount.flaggedReason === "string" ? rawAccount.flaggedReason : undefined,
-            lastError: typeof rawAccount.lastError === "string" ? rawAccount.lastError : undefined,
-        };
-        // Keep flagged dedup aligned with active cleanup so sibling workspaces only
-        // collapse when they resolve to the same shared workspace identity.
-        byIdentityKey.set(getWorkspaceIdentityKey(normalized), normalized);
-    }
-    return {
-        version: 1,
-        accounts: Array.from(byIdentityKey.values()),
-    };
-}
-async function loadFlaggedAccountsUnlocked(saveUnlocked) {
-    const path = getFlaggedAccountsPath();
-    const empty = { version: 1, accounts: [] };
-    try {
-        const content = await fs.readFile(path, "utf-8");
-        const data = JSON.parse(content);
-        return normalizeFlaggedStorage(data);
-    }
-    catch (error) {
-        const code = error.code;
-        if (code !== "ENOENT") {
-            log.error("Failed to load flagged account storage", { path, error: String(error) });
-            return empty;
-        }
-    }
-    for (const legacyPath of [getLegacyFlaggedAccountsPath(), getLegacyBlockedAccountsPath()]) {
-        if (!existsSync(legacyPath)) {
-            continue;
-        }
-        try {
-            const legacyContent = await fs.readFile(legacyPath, "utf-8");
-            const legacyData = JSON.parse(legacyContent);
-            const migrated = normalizeFlaggedStorage(legacyData);
-            if (migrated.accounts.length > 0) {
-                await saveUnlocked(migrated);
-            }
-            try {
-                await fs.unlink(legacyPath);
-            }
-            catch {
-                // Best effort cleanup.
-            }
-            log.info("Migrated legacy flagged account storage", {
-                from: legacyPath,
-                to: path,
-                accounts: migrated.accounts.length,
-            });
-            return migrated;
-        }
-        catch (error) {
-            log.error("Failed to migrate legacy flagged account storage", {
-                from: legacyPath,
-                to: path,
-                error: String(error),
-            });
-            return empty;
-        }
-    }
-    return empty;
-}
-export async function loadFlaggedAccounts() {
-    return withStorageLock(async () => loadFlaggedAccountsUnlocked(saveFlaggedAccountsUnlocked));
-}
-async function saveFlaggedAccountsUnlocked(storage) {
-    const path = getFlaggedAccountsPath();
-    const uniqueSuffix = `${Date.now()}.${Math.random().toString(36).slice(2, 8)}`;
-    const tempPath = `${path}.${uniqueSuffix}.tmp`;
-    try {
-        await fs.mkdir(dirname(path), { recursive: true });
-        const content = JSON.stringify(normalizeFlaggedStorage(storage), null, 2);
-        await fs.writeFile(tempPath, content, { encoding: "utf-8", mode: 0o600 });
-        await renameWithWindowsRetry(tempPath, path);
-    }
-    catch (error) {
-        try {
-            await fs.unlink(tempPath);
-        }
-        catch {
-            // Ignore cleanup failures.
-        }
-        log.error("Failed to save flagged account storage", { path, error: String(error) });
-        throw error;
-    }
-}
-/**
- * Executes a read-modify-write transaction for flagged account storage under the
- * shared storage lock so concurrent callers cannot lose updates.
- */
-export async function withFlaggedAccountStorageTransaction(handler) {
-    return withStorageLock(async () => {
-        const current = await loadFlaggedAccountsUnlocked(saveFlaggedAccountsUnlocked);
-        return handler(current, saveFlaggedAccountsUnlocked);
-    });
-}
-export async function saveFlaggedAccounts(storage) {
-    return withStorageLock(async () => {
-        await saveFlaggedAccountsUnlocked(storage);
-    });
-}
-export async function clearFlaggedAccounts() {
-    return withStorageLock(async () => {
-        try {
-            await fs.unlink(getFlaggedAccountsPath());
-        }
-        catch (error) {
-            const code = error.code;
-            if (code !== "ENOENT") {
-                log.error("Failed to clear flagged account storage", { error: String(error) });
-            }
-        }
-    });
-}
-function formatBackupTimestamp(date = new Date()) {
-    const yyyy = String(date.getFullYear());
-    const mm = String(date.getMonth() + 1).padStart(2, "0");
-    const dd = String(date.getDate()).padStart(2, "0");
-    const hh = String(date.getHours()).padStart(2, "0");
-    const min = String(date.getMinutes()).padStart(2, "0");
-    const ss = String(date.getSeconds()).padStart(2, "0");
-    const mmm = String(date.getMilliseconds()).padStart(3, "0");
-    return `${yyyy}${mm}${dd}-${hh}${min}${ss}${mmm}`;
-}
-function sanitizeBackupPrefix(prefix) {
-    const trimmed = prefix.trim();
-    const safe = trimmed
-        .replace(/[^a-zA-Z0-9_-]+/g, "-")
-        .replace(/-+/g, "-")
-        .replace(/^-+|-+$/g, "");
-    return safe.length > 0 ? safe : "codex-backup";
-}
-export function createTimestampedBackupPath(prefix = "codex-backup") {
-    const storagePath = getStoragePath();
-    const backupDir = join(dirname(storagePath), "backups");
-    const safePrefix = sanitizeBackupPrefix(prefix);
-    const nonce = randomBytes(3).toString("hex");
-    return join(backupDir, `${safePrefix}-${formatBackupTimestamp()}-${nonce}.json`);
-}
-async function readAndNormalizeImportFile(filePath) {
-    const resolvedPath = resolvePath(filePath);
-    if (!existsSync(resolvedPath)) {
-        throw new Error(`Import file not found: ${resolvedPath}`);
-    }
-    const content = await fs.readFile(resolvedPath, "utf-8");
-    let imported;
-    try {
-        imported = JSON.parse(content);
-    }
-    catch {
-        throw new Error(`Invalid JSON in import file: ${resolvedPath}`);
-    }
-    const normalized = normalizeAccountStorage(imported);
-    if (!normalized) {
-        throw new Error("Invalid account storage format");
-    }
-    return { resolvedPath, normalized };
-}
-function analyzeImportedAccounts(existingAccounts, importedAccounts) {
-    const merged = [...existingAccounts, ...importedAccounts];
-    const accounts = deduplicateAccountsForStorage(merged);
-    if (accounts.length > ACCOUNT_LIMITS.MAX_ACCOUNTS) {
-        throw new Error(`Import would exceed maximum of ${ACCOUNT_LIMITS.MAX_ACCOUNTS} accounts (would have ${accounts.length})`);
-    }
-    const imported = Math.max(0, accounts.length - existingAccounts.length);
-    const skipped = Math.max(0, importedAccounts.length - imported);
-    return {
-        accounts,
-        imported,
-        total: accounts.length,
-        skipped,
-    };
-}
-/**
- * Import preview/apply analysis is pure in-memory work: it does not touch disk
- * and it does not log token or workspace values. The surrounding
- * `withAccountStorageTransaction` caller keeps Windows lock-retry and
- * serialized read-modify-write behavior; see `test/storage.test.ts` for the
- * overlapping transaction regression and pre-import backup lock coverage.
- */
-export async function previewImportAccounts(filePath) {
-    const { normalized } = await readAndNormalizeImportFile(filePath);
-    return withAccountStorageTransaction((existing) => {
-        const existingAccounts = existing?.accounts ?? [];
-        const analysis = analyzeImportedAccounts(existingAccounts, normalized.accounts);
-        return Promise.resolve({
-            imported: analysis.imported,
-            total: analysis.total,
-            skipped: analysis.skipped,
-        });
-    });
-}
-/**
- * Exports current accounts to a JSON file for backup/migration.
- * @param filePath - Destination file path
- * @param force - If true, overwrite existing file (default: true)
- * @throws Error if file exists and force is false, or if no accounts to export
- */
-export async function exportAccounts(filePath, force = true) {
-    const resolvedPath = resolvePath(filePath);
-    if (!force && existsSync(resolvedPath)) {
-        throw new Error(`File already exists: ${resolvedPath}`);
-    }
-    const storage = await withAccountStorageTransaction((current) => Promise.resolve(current));
-    if (!storage || storage.accounts.length === 0) {
-        throw new Error("No accounts to export");
-    }
-    await fs.mkdir(dirname(resolvedPath), { recursive: true });
-    const content = JSON.stringify(storage, null, 2);
-    await fs.writeFile(resolvedPath, content, { encoding: "utf-8", mode: 0o600 });
-    log.info("Exported accounts", { path: resolvedPath, count: storage.accounts.length });
-}
-/**
- * Imports accounts from a JSON file, merging with existing accounts.
- * Deduplicates by identity key first (organizationId -> accountId -> refreshToken),
- * then applies legacy email dedupe only to entries without organizationId/accountId.
- * @param filePath - Source file path
- * @throws Error if file is invalid or would exceed MAX_ACCOUNTS
- */
-export async function importAccounts(filePath, options = {}) {
-    const { resolvedPath, normalized } = await readAndNormalizeImportFile(filePath);
-    const backupMode = options.backupMode ?? "none";
-    const backupPrefix = options.preImportBackupPrefix ?? "codex-pre-import-backup";
-    const { imported: importedCount, total, skipped: skippedCount, backupStatus, backupPath, backupError, } = await withAccountStorageTransaction(async (existing, persist) => {
-        const existingStorage = existing ??
-            {
-                version: 3,
-                accounts: [],
-                activeIndex: 0,
-                activeIndexByFamily: {},
-            };
-        const existingAccounts = existingStorage.accounts;
-        const existingActiveIndex = existingStorage.activeIndex;
-        const clampedExistingActiveIndex = clampIndex(existingActiveIndex, existingAccounts.length);
-        const existingActiveKeys = extractActiveKeys(existingAccounts, clampedExistingActiveIndex);
-        const existingActiveIndexByFamily = existingStorage.activeIndexByFamily ?? {};
-        let backupStatus = "skipped";
-        let backupPath;
-        let backupError;
-        let backupLogError;
-        if (backupMode !== "none" && existingAccounts.length > 0) {
-            backupPath = createTimestampedBackupPath(backupPrefix);
-            try {
-                await writePreImportBackupFile(backupPath, existingStorage);
-                backupStatus = "created";
-            }
-            catch (error) {
-                backupStatus = "failed";
-                backupError = error instanceof Error ? error.message : String(error);
-                const backupCode = error?.code;
-                backupLogError = backupCode
-                    ? `pre-import backup failed (${backupCode})`
-                    : "pre-import backup failed";
-                if (backupMode === "required") {
-                    throw new Error(backupCode
-                        ? `Pre-import backup failed (${backupCode})`
-                        : "Pre-import backup failed");
-                }
-                log.warn("Pre-import backup failed; continuing import apply", {
-                    backupFile: backupPath ? basename(backupPath) : undefined,
-                    error: backupLogError,
-                });
-            }
-        }
-        const analysis = analyzeImportedAccounts(existingAccounts, normalized.accounts);
-        const deduplicatedAccounts = analysis.accounts;
-        const mappedActiveIndex = (() => {
-            if (deduplicatedAccounts.length === 0)
-                return 0;
-            if (existingActiveKeys.length > 0) {
-                const idx = findAccountIndexByIdentityKeys(deduplicatedAccounts, existingActiveKeys);
-                if (idx >= 0)
-                    return idx;
-            }
-            return clampIndex(clampedExistingActiveIndex, deduplicatedAccounts.length);
-        })();
-        const activeIndexByFamily = {};
-        for (const family of MODEL_FAMILIES) {
-            const rawFamilyIndex = existingActiveIndexByFamily[family];
-            const familyIndex = typeof rawFamilyIndex === "number" && Number.isFinite(rawFamilyIndex)
-                ? rawFamilyIndex
-                : clampedExistingActiveIndex;
-            const familyKeys = extractActiveKeys(existingAccounts, clampIndex(familyIndex, existingAccounts.length));
-            if (familyKeys.length > 0) {
-                const idx = findAccountIndexByIdentityKeys(deduplicatedAccounts, familyKeys);
-                activeIndexByFamily[family] = idx >= 0 ? idx : mappedActiveIndex;
-                continue;
-            }
-            activeIndexByFamily[family] = mappedActiveIndex;
-        }
-        const newStorage = {
-            version: 3,
-            accounts: deduplicatedAccounts,
-            activeIndex: mappedActiveIndex,
-            activeIndexByFamily,
-        };
-        await persist(newStorage);
-        return {
-            imported: analysis.imported,
-            total: analysis.total,
-            skipped: analysis.skipped,
-            backupStatus,
-            backupPath,
-            backupError,
-        };
-    });
-    log.info("Imported accounts", {
-        path: resolvedPath,
-        imported: importedCount,
-        skipped: skippedCount,
-        total,
-        backupStatus,
-        backupFile: backupPath ? basename(backupPath) : undefined,
-        backupError: backupError ? "available on command result" : undefined,
-    });
-    return {
-        imported: importedCount,
-        total,
-        skipped: skippedCount,
-        backupStatus,
-        backupPath,
-        backupError,
-    };
-}
+ * Barrel for the account-storage layer.
+ *
+ * RC-2 split the original 1400-line `lib/storage.ts` into focused modules
+ * under `lib/storage/`. This file exists to keep the public surface stable
+ * so every consumer that imports from `./storage` / `../storage` resolves
+ * exactly as it did before the refactor.
+ *
+ * See `docs/audits/07-refactoring-plan.md#rc-2` and
+ * `docs/audits/16-code-health.md` for the motivation.
+ */
+// --- Errors ------------------------------------------------------------------
+export { StorageError, formatStorageErrorHint } from "./storage/errors.js";
+// --- Path + state management -------------------------------------------------
+export { setStoragePath, setStoragePathDirect, getStoragePath, } from "./storage/state.js";
+// --- Identity + dedup helpers ------------------------------------------------
+export { getWorkspaceIdentityKey, deduplicateAccounts, deduplicateAccountsByEmail, } from "./storage/identity.js";
+// --- Normalization -----------------------------------------------------------
+export { normalizeAccountStorage } from "./storage/normalize.js";
+// --- Account load/save + transaction -----------------------------------------
+export { loadAccounts, saveAccounts, clearAccounts, withAccountStorageTransaction, } from "./storage/load-save.js";
+export { getFlaggedAccountsPath, loadFlaggedAccounts, saveFlaggedAccounts, clearFlaggedAccounts, withFlaggedAccountStorageTransaction, } from "./storage/flagged.js";
+// --- Backups -----------------------------------------------------------------
+export { createTimestampedBackupPath } from "./storage/backup.js";
+export { exportAccounts, importAccounts, previewImportAccounts, } from "./storage/export-import.js";
 //# sourceMappingURL=storage.js.map