oh-my-opencode 5.1.51 → 5.1.55

package/dist/cli/service-auth/credential-lock.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The one per-origin lock and desktop generation record (account-transport-api v7 section 4.1). The CLI, desktop main
+ * and the engine pin boundary all derive these paths here or with the same inputs; never pass a path around instead.
+ */
+export declare function credentialLockPaths(api: string, home?: string): {
+    readonly directory: string;
+    readonly lock: string;
+    readonly desktopRecord: string;
+};
+/** Writers and effect boundaries share one origin lock; nested session writes retain ownership. */
+export declare function withCredentialLock<T>(api: string, action: () => Promise<T>, home?: string, ownerTag?: string): Promise<T>;

package/dist/cli/service-auth/credential-owner.d.ts

@@ -0,0 +1,10 @@
+import { z } from "zod";
+export declare const credentialOwnerSchema: z.ZodObject<{
+    accountId: z.ZodString;
+    deviceId: z.ZodString;
+    familyId: z.ZodString;
+    generation: z.ZodNumber;
+    ownerHandle: z.ZodString;
+}, z.core.$strip>;
+export type CredentialOwner = z.infer<typeof credentialOwnerSchema>;
+export declare const sameStableOwner: (left: CredentialOwner, right: CredentialOwner) => boolean;

package/dist/cli/service-auth/index.d.ts

@@ -1,3 +1,5 @@
-export { type CredentialStore, createCredentialStore, KeychainApprovalPendingError, quietNotice } from "./keystore";
+export { credentialLockPaths, withCredentialLock } from "./credential-lock";
+export { currentServiceDevice } from "./protocol";
+export { CredentialIdentityChanged, type CredentialStore, createCredentialStore, KeychainApprovalPendingError, quietNotice } from "./keystore";
 export { type Credentials, SignInError, serviceOrigin } from "./protocol";
 export { createSession, type Session } from "./session";

package/dist/cli/service-auth/keystore.d.ts

@@ -14,6 +14,8 @@ export type SecretApi = {
 };
 export type SealedStore<T> = {
     readonly read: () => Promise<T | null>;
+    /** A read started now that never joins a coalesced read begun earlier; credential transactions use it under the lock. */
+    readonly readAuthoritative: () => Promise<T | null>;
     readonly write: (value: T) => Promise<void>;
     readonly clear: () => Promise<void>;
 };
@@ -26,6 +28,10 @@ export declare class SecretServiceUnavailableError extends CredentialStoreError
 }
 export declare class InvalidCredentialState extends SignInError {
 }
+/** The stored credential is no longer the identity and generation a caller captured. */
+export declare class CredentialIdentityChanged extends Error {
+    constructor();
+}
 /** The OS store has not answered a read in time: it is waiting on a person (a keychain approval dialog, #11262). */
 export declare class KeychainApprovalPendingError extends CredentialStoreError {
 }
@@ -52,6 +58,7 @@ export declare function createCredentialStore(api: string, options?: {
     readonly lockProbe?: SecretServiceLockProbe;
     readonly notice?: (message: string) => void;
     readonly wait?: CredentialReadWait;
+    readonly home?: string;
 }): CredentialStore;
-export declare function createSealedStore<T>(api: string, namespace: "omo-cli" | "omo-cli-v2" | "omo-cli-revocations-v2", schema: z.ZodType<T>, secrets?: SecretApi | null, platform?: NodeJS.Platform, lockProbe?: SecretServiceLockProbe, notice?: (message: string) => void, wait?: CredentialReadWait): SealedStore<T>;
+export declare function createSealedStore<T>(api: string, namespace: "omo-cli" | "omo-cli-v2" | "omo-cli-revocations-v2", schema: z.ZodType<T>, secrets?: SecretApi | null, platform?: NodeJS.Platform, lockProbe?: SecretServiceLockProbe, notice?: (message: string) => void, wait?: CredentialReadWait, amendWrite?: (previous: T | null, next: T) => T): SealedStore<T>;
 export {};

package/dist/cli/service-auth/owned-refresh.d.ts

@@ -0,0 +1,21 @@
+import { SignInError } from "./protocol";
+import { type RefreshAttempt } from "./refresh-attempt";
+import { type RecoveryClock } from "./recovery-clock";
+import type { OwnedCredential } from "./protocol-v2";
+export type { OwnedCredential } from "./protocol-v2";
+export declare class RecoveryExhausted extends SignInError {
+    readonly code = "refresh_recovery_expired";
+    readonly deviceRevoked = false;
+    constructor();
+}
+export declare class RecoveryPending extends SignInError {
+    readonly deadline: number;
+    constructor(deadline: number);
+}
+export declare function refreshOwnedCredential(options: {
+    readonly origin: string;
+    readonly current: OwnedCredential;
+    readonly clock?: RecoveryClock;
+    readonly write: (credential: OwnedCredential) => Promise<void>;
+    readonly rotate: (credential: OwnedCredential, attempt: RefreshAttempt) => Promise<OwnedCredential>;
+}): Promise<OwnedCredential>;

package/dist/cli/service-auth/protocol-v2.d.ts

@@ -0,0 +1,27 @@
+import { z } from "zod";
+export type { CredentialOwner } from "./credential-owner";
+declare const ownedCredentialSchema: z.ZodObject<{
+    accessToken: z.ZodString;
+    accessTokenExpiresAt: z.ZodString;
+    refreshToken: z.ZodString;
+    device: z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+    }, z.core.$strip>;
+    offlineGrant: z.ZodOptional<z.ZodString>;
+    signingPrivateKey: z.ZodString;
+    sealingPrivateKey: z.ZodString;
+    refreshState: z.ZodOptional<z.ZodLiteral<"uncertain">>;
+    credentialGeneration: z.ZodOptional<z.ZodString>;
+    accountId: z.ZodOptional<z.ZodString>;
+    owner: z.ZodObject<{
+        accountId: z.ZodString;
+        deviceId: z.ZodString;
+        familyId: z.ZodString;
+        generation: z.ZodNumber;
+        ownerHandle: z.ZodString;
+    }, z.core.$strip>;
+    writerFloor: z.ZodLiteral<2>;
+    refreshAttempt: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$strip>;
+export type OwnedCredential = z.infer<typeof ownedCredentialSchema>;

package/dist/cli/service-auth/protocol.d.ts

@@ -6,7 +6,8 @@ export declare class SignInError extends Error {
 }
 export declare class RequestFailure extends SignInError {
     readonly notSent: boolean;
-    constructor(notSent: boolean);
+    readonly responseStatus?: number | undefined;
+    constructor(notSent: boolean, responseStatus?: number | undefined);
 }
 export declare const platformSchema: z.ZodEnum<{
     linux: "linux";
@@ -28,6 +29,15 @@ export declare const grantSchema: z.ZodObject<{
         name: z.ZodString;
     }, z.core.$strip>;
     offlineGrant: z.ZodOptional<z.ZodString>;
+    owner: z.ZodOptional<z.ZodObject<{
+        accountId: z.ZodString;
+        deviceId: z.ZodString;
+        familyId: z.ZodString;
+        generation: z.ZodNumber;
+        ownerHandle: z.ZodString;
+    }, z.core.$strip>>;
+    writerFloor: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>]>>;
+    freshAuthorizationProof: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export declare const credentialSchema: z.ZodObject<{
     accessToken: z.ZodString;
@@ -38,9 +48,21 @@ export declare const credentialSchema: z.ZodObject<{
         name: z.ZodString;
     }, z.core.$strip>;
     offlineGrant: z.ZodOptional<z.ZodString>;
+    owner: z.ZodOptional<z.ZodObject<{
+        accountId: z.ZodString;
+        deviceId: z.ZodString;
+        familyId: z.ZodString;
+        generation: z.ZodNumber;
+        ownerHandle: z.ZodString;
+    }, z.core.$strip>>;
+    writerFloor: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>]>>;
+    freshAuthorizationProof: z.ZodOptional<z.ZodString>;
     signingPrivateKey: z.ZodString;
     sealingPrivateKey: z.ZodString;
     refreshState: z.ZodOptional<z.ZodLiteral<"uncertain">>;
+    credentialGeneration: z.ZodOptional<z.ZodString>;
+    accountId: z.ZodOptional<z.ZodString>;
+    refreshAttempt: z.ZodOptional<z.ZodUnknown>;
 }, z.core.$strip>;
 export type Credentials = z.infer<typeof credentialSchema>;
 export declare const deviceCodeSchema: z.ZodObject<{
@@ -65,8 +87,10 @@ export declare const deviceListSchema: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type ListedDevice = z.infer<typeof deviceListSchema>["devices"][number];
+/** The one unrevoked device the calling token authenticates, or null when the list does not name exactly one. */
+export declare function currentServiceDevice(body: unknown): string | null;
 export type ChooseDevice = (devices: readonly ListedDevice[]) => Promise<string | null>;
-declare const REFUSAL_CODES: readonly ["unauthorized", "account_deleted", "reauth_required", "invalid_grant", "device_revoked", "entitlement_required", "authorization_pending", "slow_down", "access_denied", "expired_token", "rate_limited", "internal", "unavailable", "forbidden", "invalid_request", "not_found"];
+declare const REFUSAL_CODES: readonly ["unauthorized", "account_deleted", "reauth_required", "invalid_grant", "device_revoked", "entitlement_required", "authorization_pending", "slow_down", "access_denied", "expired_token", "rate_limited", "internal", "unavailable", "forbidden", "invalid_request", "not_found", "client_upgrade_required", "writer_floor_mismatch", "service_upgrade_required", "refresh_recovery_expired"];
 export type RefusalCode = (typeof REFUSAL_CODES)[number] | "unknown";
 /** What a refused request asks of the person; the message keys on this, never on the server's text. */
 export type RefusalGuidance = "sign_in_again" | "wait" | "service_trouble" | "update_omo" | "account_deleted" | "account_refused";

package/dist/cli/service-auth/recovery-clock.d.ts

@@ -0,0 +1,7 @@
+export interface RecoveryClockReading {
+    readonly wallTimeMs: number;
+    readonly continuousTimeMs: number;
+    readonly bootId: string;
+}
+export type RecoveryClock = () => Promise<RecoveryClockReading | null>;
+export declare const readRecoveryClock: RecoveryClock;

package/dist/cli/service-auth/refresh-attempt.d.ts

@@ -0,0 +1,34 @@
+import { z } from "zod";
+import type { RecoveryClockReading } from "./recovery-clock";
+import { sameStableOwner, type CredentialOwner } from "./credential-owner";
+export type { CredentialOwner } from "./credential-owner";
+export declare const REFRESH_SEND_BUDGET_MS: number;
+declare const refreshAttemptSchema: z.ZodObject<{
+    writerProtocol: z.ZodLiteral<2>;
+    origin: z.ZodString;
+    owner: z.ZodObject<{
+        accountId: z.ZodString;
+        deviceId: z.ZodString;
+        familyId: z.ZodString;
+        generation: z.ZodNumber;
+        ownerHandle: z.ZodString;
+    }, z.core.$strip>;
+    refreshTokenHash: z.ZodString;
+    idempotencyKey: z.ZodString;
+    firstSend: z.ZodObject<{
+        wallTimeMs: z.ZodNumber;
+        continuousTimeMs: z.ZodNumber;
+        bootId: z.ZodString;
+    }, z.core.$strip>;
+    deadline: z.ZodNumber;
+    state: z.ZodEnum<{
+        exhausted: "exhausted";
+        ready: "ready";
+        sent_unknown: "sent_unknown";
+        successor_received_uncommitted: "successor_received_uncommitted";
+    }>;
+}, z.core.$strip>;
+export type RefreshAttempt = z.infer<typeof refreshAttemptSchema>;
+export declare const sameOwner: typeof sameStableOwner;
+export declare function newRefreshAttempt(origin: string, owner: CredentialOwner, token: string, reading: RecoveryClockReading, idempotencyKey?: string): RefreshAttempt;
+export declare function eligibleAttempt(raw: unknown, origin: string, owner: CredentialOwner, token: string, reading: RecoveryClockReading | null): RefreshAttempt | null;

package/dist/cli/service-auth/session.d.ts

@@ -10,9 +10,11 @@ export declare function createSession(options: {
     readonly store: CredentialStore;
     readonly home?: string;
     readonly signal?: AbortSignal;
+    readonly now?: () => number;
 }): {
     request: (path: string, init: RequestInit) => Promise<unknown>;
     signal: AbortSignal | undefined;
+    transaction: <T>(action: () => Promise<T>) => Promise<T>;
     ready(): Promise<void>;
     save(value: Credentials): Promise<void>;
     /** The marker an explicit `omo logout` left, or null; only an empty store makes it meaningful. */
@@ -21,9 +23,14 @@ export declare function createSession(options: {
         at: string;
     } | null>;
     clearSignedOutMarker: () => Promise<void>;
-    update<T>(action: (current: Credentials | null) => Promise<T>): Promise<T>;
+    update<T>(action: (current: Credentials | null) => Promise<T>, options?: {
+        readonly replaceInvalid?: boolean;
+    }): Promise<T>;
+    forget(): Promise<void>;
+    accessSnapshot: () => Promise<Credentials | null>;
     logout(): Promise<boolean>;
-    accessToken(): Promise<string>;
+    /** `expect` rejects a stored credential that is no longer the caller's captured identity before any refresh. */
+    accessToken(expect?: (current: Credentials) => boolean): Promise<string>;
     removeForLimit(error: unknown, choose: ChooseDevice): Promise<boolean>;
 };
 export type Session = ReturnType<typeof createSession>;