oh-my-opencode 5.1.47 → 5.1.51

package/dist/cli/service-auth/accounts-gate.d.ts

@@ -0,0 +1,11 @@
+/** The one switch for OmO service accounts (#10262): set to true when accounts open to everyone. */
+export declare const SERVICE_ACCOUNTS_OPEN: boolean;
+export declare function serviceAccountsOpen(): boolean;
+/**
+ * Where this computer signs in to OmO: `omo login` once accounts open, until then the desktop app,
+ * whose sign-in the CLI shares through `omo account adopt`. Every sign-in hint keys on this, so no
+ * message sends a person to a command that refuses (#11379).
+ */
+export type SignInRoute = "cli" | "desktop";
+export declare function signInRoute(open?: boolean): SignInRoute;
+export declare function signInHint(when: "first" | "again", route?: SignInRoute): string;

package/dist/cli/service-auth/commands.d.ts

@@ -14,9 +14,7 @@ export declare function deviceChoices(devices: readonly ListedDevice[]): {
 export declare const DEFAULT_ACCOUNTS_ORIGIN = "https://signin.omo.dev";
 /** The sign-in origin: the `--accounts` flag, then `OMO_SERVICE_ACCOUNTS_URL`, then the default. */
 export declare function accountsOrigin(options: Pick<Options, "accounts">, env: Record<string, string | undefined>): string;
-/** The one switch for OmO service accounts (#10262): set to true when accounts open to everyone. */
-export declare const SERVICE_ACCOUNTS_OPEN: boolean;
-export declare const SERVICE_ACCOUNTS_CLOSED_MESSAGE = "OmO accounts aren't available yet.";
+export { SERVICE_ACCOUNTS_OPEN } from "./accounts-gate";
+export declare const SERVICE_ACCOUNTS_CLOSED_MESSAGE = "Signing in from the terminal isn't available yet. Sign in from the OmO desktop app on this computer; omo uses that sign-in.";
 export declare function configureServiceAuthCommands(program: Command, open?: boolean): void;
 export declare function runServiceAuthCommand(args: readonly string[]): Promise<void>;
-export {};

package/dist/cli/service-auth/index.d.ts

@@ -1,3 +1,3 @@
-export { type CredentialStore, createCredentialStore, quietNotice } from "./keystore";
+export { type CredentialStore, createCredentialStore, KeychainApprovalPendingError, quietNotice } from "./keystore";
 export { type Credentials, SignInError, serviceOrigin } from "./protocol";
 export { createSession, type Session } from "./session";

package/dist/cli/service-auth/keystore.d.ts

@@ -26,8 +26,32 @@ export declare class SecretServiceUnavailableError extends CredentialStoreError
 }
 export declare class InvalidCredentialState extends SignInError {
 }
+/** The OS store has not answered a read in time: it is waiting on a person (a keychain approval dialog, #11262). */
+export declare class KeychainApprovalPendingError extends CredentialStoreError {
+}
+/**
+ * How long a read waits for an OS store that has not answered. An unanswered approval dialog blocks the native read
+ * with no end, so a session path (memory sync, the memory tool, a host's token) gives up at a deadline and an
+ * interactive command keeps waiting but says why.
+ */
+export type CredentialReadWait = {
+    readonly kind: "bounded";
+    readonly deadlineMs: number;
+} | {
+    readonly kind: "interactive";
+    readonly noticeAfterMs: number;
+    readonly notice: (message: string) => void;
+};
+export declare const SESSION_READ_WAIT: CredentialReadWait;
+export declare const INTERACTIVE_READ_WAIT: CredentialReadWait;
 export declare const quietNotice: (_message: string) => void;
 export declare function credentialId(api: string): string;
-export declare function createCredentialStore(api: string, secrets?: SecretApi | null, platform?: NodeJS.Platform, lockProbe?: SecretServiceLockProbe, notice?: (message: string) => void): CredentialStore;
-export declare function createSealedStore<T>(api: string, namespace: "omo-cli" | "omo-cli-v2" | "omo-cli-revocations-v2", schema: z.ZodType<T>, secrets?: SecretApi | null, platform?: NodeJS.Platform, lockProbe?: SecretServiceLockProbe, notice?: (message: string) => void): SealedStore<T>;
+export declare function createCredentialStore(api: string, options?: {
+    readonly secrets?: SecretApi | null;
+    readonly platform?: NodeJS.Platform;
+    readonly lockProbe?: SecretServiceLockProbe;
+    readonly notice?: (message: string) => void;
+    readonly wait?: CredentialReadWait;
+}): CredentialStore;
+export declare function createSealedStore<T>(api: string, namespace: "omo-cli" | "omo-cli-v2" | "omo-cli-revocations-v2", schema: z.ZodType<T>, secrets?: SecretApi | null, platform?: NodeJS.Platform, lockProbe?: SecretServiceLockProbe, notice?: (message: string) => void, wait?: CredentialReadWait): SealedStore<T>;
 export {};

package/dist/cli/service-auth/protocol.d.ts

@@ -66,10 +66,16 @@ export declare const deviceListSchema: z.ZodObject<{
 }, z.core.$strip>;
 export type ListedDevice = z.infer<typeof deviceListSchema>["devices"][number];
 export type ChooseDevice = (devices: readonly ListedDevice[]) => Promise<string | null>;
+declare const REFUSAL_CODES: readonly ["unauthorized", "account_deleted", "reauth_required", "invalid_grant", "device_revoked", "entitlement_required", "authorization_pending", "slow_down", "access_denied", "expired_token", "rate_limited", "internal", "unavailable", "forbidden", "invalid_request", "not_found"];
+export type RefusalCode = (typeof REFUSAL_CODES)[number] | "unknown";
+/** What a refused request asks of the person; the message keys on this, never on the server's text. */
+export type RefusalGuidance = "sign_in_again" | "wait" | "service_trouble" | "update_omo" | "account_deleted" | "account_refused";
+export declare function refusalGuidance(code: RefusalCode, status: number): RefusalGuidance;
+export declare function refusalMessage(guidance: RefusalGuidance): string;
 export declare class ApiRefusal extends SignInError {
     #private;
     readonly status: number;
-    readonly code: string;
+    readonly code: RefusalCode;
     constructor(code: string, status: number, detail?: z.infer<typeof limitSchema>, retryAfter?: string | null);
     get detail(): {
         reason: "device_limit";

package/dist/cli/service-auth/session.d.ts

@@ -15,6 +15,12 @@ export declare function createSession(options: {
     signal: AbortSignal | undefined;
     ready(): Promise<void>;
     save(value: Credentials): Promise<void>;
+    /** The marker an explicit `omo logout` left, or null; only an empty store makes it meaningful. */
+    signedOutMarker: () => Promise<{
+        device: string | null;
+        at: string;
+    } | null>;
+    clearSignedOutMarker: () => Promise<void>;
     update<T>(action: (current: Credentials | null) => Promise<T>): Promise<T>;
     logout(): Promise<boolean>;
     accessToken(): Promise<string>;

package/dist/cli/service-auth/signed-out-marker.d.ts

@@ -0,0 +1,11 @@
+import { z } from "zod";
+declare const markerSchema: z.ZodObject<{
+    device: z.ZodNullable<z.ZodString>;
+    at: z.ZodString;
+}, z.core.$strip>;
+export type SignedOutMarker = z.infer<typeof markerSchema>;
+export declare const signedOutMarkerPath: (home: string, credential: string) => string;
+export declare function readSignedOutMarker(path: string): Promise<SignedOutMarker | null>;
+export declare function writeSignedOutMarker(path: string, device: string | null): Promise<void>;
+export declare const clearSignedOutMarker: (path: string) => Promise<void>;
+export {};