opencode-auth-load-balancer 0.8.0 → 0.9.0

package/dist/index.js

@@ -12680,6 +12680,15 @@ var init_tool = __esm(() => {
   tool.schema = exports_external;
 });
 
+// src/login-rev.ts
+function bumpLoginRev(row, now = Date.now()) {
+  row.loginRev = (row.loginRev ?? 1) + 1;
+  row.loginAt = now;
+}
+function loginVersion(row) {
+  return { rev: row.loginRev ?? 1, at: row.loginAt ?? 0 };
+}
+
 // src/types.ts
 function emptyUsage() {
   return { hourly: null, weekly: null, capturedAt: 0 };
@@ -13110,6 +13119,10 @@ function normalizeAccounts(rows) {
       delete row.orgId;
     if (!isFiniteNumber(row.refreshExpires) || row.refreshExpires <= 0)
       delete row.refreshExpires;
+    if (typeof row.loginRev !== "number" || !Number.isSafeInteger(row.loginRev) || row.loginRev < 1)
+      delete row.loginRev;
+    if (!isFiniteNumber(row.loginAt) || row.loginAt < 0)
+      delete row.loginAt;
     if (row.inferenceToken === undefined || !isFiniteNumber(row.inferenceExpires) || row.inferenceExpires <= 0)
       delete row.inferenceExpires;
     if (row.lostLogins !== undefined) {
@@ -13417,6 +13430,10 @@ function makeAccount(providerID, label, tokens) {
     account.orgId = tokens.orgId;
   if (tokens.refreshExpires)
     account.refreshExpires = tokens.refreshExpires;
+  if (tokens.refresh && !tokens.inferenceOnly) {
+    account.loginRev = 1;
+    account.loginAt = Date.now();
+  }
   return account;
 }
 function recordLostLogin(row, login, reason) {
@@ -13439,8 +13456,10 @@ function mergeLoginUsage(row, usage) {
   };
 }
 function applyTokens(row, tokens) {
-  if (tokens.refresh)
+  if (tokens.refresh) {
     row.refresh = tokens.refresh;
+    bumpLoginRev(row);
+  }
   row.access = tokens.access;
   row.expires = tokens.expires;
   row.disabledReason = null;
@@ -13650,6 +13669,15 @@ function mergeHeaders(input, init) {
   return headers;
 }
 
+// src/refresh-hooks.ts
+function setRefreshHooks(hooks) {
+  current = hooks;
+}
+function getRefreshHooks() {
+  return current;
+}
+var current = null;
+
 // src/refresh.ts
 function needsRefresh(account, now) {
   return !account.access || account.expires - REFRESH_SKEW_MS <= now;
@@ -13708,6 +13736,7 @@ async function commitRefresh(accountId, attempt, next) {
     if (!sameGeneration(stored, attempt))
       return tokensOf(stored);
     applyTokensTo(stored, next);
+    bumpLoginRev(stored);
     stored.tokenGen = attempt.gen + 1;
     if (stored.disabledReason !== MANUAL_DISABLED_REASON)
       stored.disabledReason = null;
@@ -13734,11 +13763,31 @@ async function resolveInvalidGrant(adapter, accountId, attempt, reason) {
     return null;
   });
 }
+async function pullNewer(account, recovery) {
+  try {
+    const adopted = await getRefreshHooks()?.pull?.(account, recovery);
+    return adopted ? await readPoolAccount(account.id) : undefined;
+  } catch {
+    return;
+  }
+}
+function announceRefresh() {
+  try {
+    getRefreshHooks()?.afterRefresh?.();
+  } catch {
+    ignore();
+  }
+}
 async function runRefresh(adapter, account, now, rejectedAccess) {
   return withLock(refreshLockDir(adapter.id, account.id), REFRESH_LOCK, async () => {
-    const latest = await readPoolAccount(account.id) ?? account;
-    if (latest.access !== rejectedAccess && !needsRefresh(latest, Math.max(now, Date.now())))
-      return tokensOf(latest);
+    const read = await readPoolAccount(account.id) ?? account;
+    const usable = (row) => row.access !== rejectedAccess && !needsRefresh(row, Math.max(now, Date.now()));
+    if (usable(read))
+      return tokensOf(read);
+    const pulled = await pullNewer(read, false);
+    if (pulled && usable(pulled))
+      return tokensOf(pulled);
+    const latest = pulled ?? read;
     const attempt = {
       refresh: latest.refresh,
       gen: genOf(latest)
@@ -13749,6 +13798,9 @@ async function runRefresh(adapter, account, now, rejectedAccess) {
     } catch (error) {
       if (!(error instanceof Error) || !isInvalidGrant(error))
         throw error;
+      const recovered = await pullNewer(latest, true);
+      if (recovered)
+        return tokensOf(recovered);
       const adopted = await resolveInvalidGrant(adapter, account.id, attempt, refusalReason(error));
       if (adopted)
         return adopted;
@@ -13776,7 +13828,9 @@ async function ensureAccessToken(adapter, account, now, rejectedAccess) {
   const job = runRefresh(adapter, account, now, rejectedAccess);
   inflight.set(account.id, job);
   try {
-    return await settleRefresh(adapter, account, job);
+    const access = await settleRefresh(adapter, account, job);
+    announceRefresh();
+    return access;
   } finally {
     inflight.delete(account.id);
   }
@@ -13975,7 +14029,7 @@ var init_session = __esm(() => {
 // src/token-mint.ts
 function autoTokenEnabled(env = process.env) {
   const raw = env.OPENCODE_AUTH_LB_ANTHROPIC_AUTO_TOKEN?.trim().toLowerCase();
-  return raw !== "0" && raw !== "false" && raw !== "no" && raw !== "off";
+  return raw === "1" || raw === "true" || raw === "yes" || raw === "on";
 }
 function tokenDue(account, now) {
   if (!account.refresh || account.disabledReason)
@@ -14004,6 +14058,7 @@ async function mintToken(adapter, accountId) {
       if (minted.refresh !== row.refresh) {
         row.refresh = minted.refresh;
         row.tokenGen = attempt.gen + 1;
+        bumpLoginRev(row);
       }
       if (minted.refreshExpires)
         row.refreshExpires = minted.refreshExpires;
@@ -14469,16 +14524,16 @@ function adopt(candidate) {
   const trimmed = candidate.trim();
   if (!VERSION_RE.test(trimmed))
     return;
-  if (compareVersions2(trimmed, current) <= 0)
+  if (compareVersions2(trimmed, current2) <= 0)
     return;
-  current = trimmed;
+  current2 = trimmed;
 }
 function envOverride() {
   const raw = process.env[CLAUDE_CODE_VERSION_ENV]?.trim();
   return raw && VERSION_RE.test(raw) ? raw : undefined;
 }
 function claudeCodeVersion() {
-  return envOverride() ?? current;
+  return envOverride() ?? current2;
 }
 function userAgent() {
   return `claude-cli/${claudeCodeVersion()} (external, cli)`;
@@ -14513,7 +14568,7 @@ async function refreshClaudeCodeVersion(now) {
   await persist(now);
 }
 async function persist(now) {
-  await writeJsonAtomic(versionCacheFilePath(), JSON.stringify({ version: current, fetchedAt: now })).catch(ignore);
+  await writeJsonAtomic(versionCacheFilePath(), JSON.stringify({ version: current2, fetchedAt: now })).catch(ignore);
 }
 async function recoverClaudeCodeVersion(res, now) {
   if (envOverride())
@@ -14526,12 +14581,12 @@ async function recoverClaudeCodeVersion(res, now) {
   }
   if (!text.includes(CLAUDE_CODE_VERSION_GATE_CODE))
     return false;
-  const before = current;
+  const before = current2;
   const required = CLAUDE_CODE_REQUIRED_VERSION_RE.exec(text)?.[1];
   if (required !== undefined)
     adopt(required);
   await refreshClaudeCodeVersion(now).catch(ignore);
-  if (current === before)
+  if (current2 === before)
     return false;
   await persist(now);
   return true;
@@ -14547,7 +14602,7 @@ async function primeClaudeCodeVersion(now) {
   }
   refreshClaudeCodeVersion(now).catch(ignore);
 }
-var VERSION_RE, current;
+var VERSION_RE, current2;
 var init_version = __esm(() => {
   init_paths();
   init_store();
@@ -14555,7 +14610,7 @@ var init_version = __esm(() => {
   init_usage_http();
   init_constants();
   VERSION_RE = /^\d+\.\d+\.\d+$/;
-  current = FALLBACK_CLAUDE_CODE_VERSION;
+  current2 = FALLBACK_CLAUDE_CODE_VERSION;
 });
 
 // src/providers/anthropic/cch.ts
@@ -16867,6 +16922,12 @@ var init_prime = __esm(() => {
   init_select();
 });
 
+// src/sync/enabled.ts
+function syncEnabled(env = process.env) {
+  const raw = env.OPENCODE_AUTH_LB_SYNC?.trim().toLowerCase();
+  return raw !== "0" && raw !== "false" && raw !== "no" && raw !== "off";
+}
+
 // src/sync/errors.ts
 function describeSyncError(error) {
   return error instanceof SyncError ? error.message : "Sync failed.";
@@ -16974,10 +17035,7 @@ var init_crypto = __esm(() => {
   B64URL_RE = /^[\w-]+$/;
 });
 
-// src/sync/payload.ts
-function entryKey(entry) {
-  return `${entry.origin}/${entry.id}`;
-}
+// src/sync/text.ts
 function isControl(code) {
   return code < 32 || code >= 127 && code <= 159 || code === 1564 || code >= 8203 && code <= 8207 || code >= 8232 && code <= 8238 || code >= 8288 && code <= 8297 || code === 65279;
 }
@@ -16987,6 +17045,106 @@ function printable(text) {
 function boundedString(value, max) {
   return typeof value === "string" && value.length > 0 && value.length <= max ? value : undefined;
 }
+var MAX_LABEL = 80;
+
+// src/sync/login-payload.ts
+function loginKey(providerID, accountId) {
+  return `${providerID}:${accountId}`;
+}
+function word(value, max) {
+  const text = boundedString(value, max);
+  return text !== undefined && NO_SPACE_RE.test(text) ? text : undefined;
+}
+function positive(value) {
+  return isFiniteNumber(value) && value > 0 ? value : undefined;
+}
+function parseLogin(raw) {
+  if (!isPlainObject2(raw))
+    return null;
+  const providerID = word(raw.providerID, MAX_ID);
+  const accountId = word(raw.accountId, MAX_ID);
+  const label = printable(boundedString(raw.label, MAX_LABEL) ?? "");
+  const [access, refresh] = [
+    word(raw.access, MAX_TOKEN),
+    word(raw.refresh, MAX_TOKEN)
+  ];
+  const { rev, at } = raw;
+  if (!providerID || !LOGIN_PROVIDERS.has(providerID) || !accountId)
+    return null;
+  if (raw.key !== loginKey(providerID, accountId))
+    return null;
+  const expires = positive(raw.expires);
+  if (!label || !access || !refresh || !expires)
+    return null;
+  if (typeof rev !== "number" || !Number.isSafeInteger(rev) || rev < 1)
+    return null;
+  if (!isFiniteNumber(at) || at < 0)
+    return null;
+  const orgId = word(raw.orgId, MAX_ID);
+  const refreshExpires = positive(raw.refreshExpires);
+  return {
+    key: loginKey(providerID, accountId),
+    providerID,
+    label,
+    access,
+    refresh,
+    expires,
+    accountId,
+    ...orgId ? { orgId } : {},
+    ...refreshExpires ? { refreshExpires } : {},
+    rev,
+    at
+  };
+}
+function sortLogins(logins) {
+  return [...logins].sort((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0);
+}
+function loginsDigest(logins) {
+  return fingerprint(JSON.stringify(sortLogins(logins)));
+}
+function compareLogins(a, b) {
+  if (a.rev !== b.rev)
+    return a.rev < b.rev ? -1 : 1;
+  if (a.at !== b.at)
+    return a.at < b.at ? -1 : 1;
+  const [x, y] = [fingerprint(a.refresh), fingerprint(b.refresh)];
+  return x < y ? -1 : x > y ? 1 : 0;
+}
+function parseLoginList(rawList) {
+  const parsed = {
+    logins: [],
+    loginsListed: new Set,
+    loginsUnreadable: 0
+  };
+  for (const raw of rawList) {
+    const key = isPlainObject2(raw) ? boundedString(raw.key, MAX_KEY) : undefined;
+    if (key)
+      parsed.loginsListed.add(key);
+    const login = parseLogin(raw);
+    if (!login)
+      parsed.loginsUnreadable += 1;
+    else if (!parsed.logins.some((l) => l.key === login.key))
+      parsed.logins.push(login);
+  }
+  return parsed;
+}
+var MAX_LOGINS = 64, MAX_TOKEN = 8192, MAX_ID = 128, MAX_KEY = 300, NO_SPACE_RE, LOGIN_PROVIDERS;
+var init_login_payload = __esm(() => {
+  init_util2();
+  init_crypto();
+  NO_SPACE_RE = /^\S+$/;
+  LOGIN_PROVIDERS = new Set([
+    "anthropic",
+    "openai",
+    "kimi-code-plan-cn",
+    "kimi-code-plan-global"
+  ]);
+});
+
+// src/sync/payload.ts
+function entryKey(entry) {
+  return `${entry.origin}/${entry.id}`;
+}
 function keyOf(raw) {
   if (!isPlainObject2(raw))
     return null;
@@ -17027,11 +17185,12 @@ function sortEntries(entries) {
 function entriesDigest(entries) {
   return fingerprint(JSON.stringify(sortEntries(entries)));
 }
-function buildPayload(entries, at) {
+function buildPayload(entries, at, logins = []) {
   return JSON.stringify({
     v: PAYLOAD_VERSION,
     at,
-    entries: sortEntries(entries)
+    entries: sortEntries(entries),
+    logins: sortLogins(logins)
   });
 }
 function parsePayload(text) {
@@ -17043,11 +17202,12 @@ function parsePayload(text) {
   }
   if (!isPlainObject2(json) || !Array.isArray(json.entries))
     throw new SyncError("bad-blob");
-  if (json.v !== PAYLOAD_VERSION)
+  if (json.v !== PAYLOAD_VERSION && json.v !== ENTRIES_ONLY_VERSION)
     throw new SyncError("bad-version");
-  if (!isFiniteNumber(json.at))
+  const rawLogins = json.v === PAYLOAD_VERSION ? json.logins ?? [] : [];
+  if (!isFiniteNumber(json.at) || !Array.isArray(rawLogins))
     throw new SyncError("bad-blob");
-  if (json.entries.length > MAX_ENTRIES)
+  if (json.entries.length > MAX_ENTRIES || rawLogins.length > MAX_LOGINS)
     throw new SyncError("too-large");
   const listed = new Set;
   const entries = [];
@@ -17066,13 +17226,20 @@ function parsePayload(text) {
     else
       unreadable += 1;
   }
-  return { at: json.at, entries, listed, unreadable };
+  return {
+    at: json.at,
+    entries,
+    listed,
+    unreadable,
+    ...parseLoginList(rawLogins)
+  };
 }
-var PAYLOAD_VERSION = 2, MAX_ENTRIES = 64, MAX_LABEL = 80, MAX_SECRET = 512, MAX_FIELD = 128, ID_RE, ORIGIN_RE, CLAUDE_TOKEN_RE, API_KEY_RE, SECRET_SHAPES;
+var PAYLOAD_VERSION = 3, ENTRIES_ONLY_VERSION = 2, MAX_ENTRIES = 64, MAX_SECRET = 512, MAX_FIELD = 128, ID_RE, ORIGIN_RE, CLAUDE_TOKEN_RE, API_KEY_RE, SECRET_SHAPES;
 var init_payload = __esm(() => {
   init_util2();
   init_crypto();
   init_errors3();
+  init_login_payload();
   ID_RE = /^[\w-]{1,64}$/;
   ORIGIN_RE = /^[\da-f]{32}$/;
   CLAUDE_TOKEN_RE = /^sk-ant-oat\d+-[\w-]+$/;
@@ -17318,6 +17485,12 @@ function isRef(value) {
 function isSkip(value) {
   return isPlainObject2(value) && typeof value.fingerprint === "string" && typeof value.blocker === "string" && typeof value.holds === "string";
 }
+function isMark(value) {
+  return value === true;
+}
+function marks(from) {
+  return from && Object.keys(from).length > 0 ? newMap(from) : undefined;
+}
 function readMap(raw, accept) {
   const map = newMap();
   if (isPlainObject2(raw)) {
@@ -17341,6 +17514,8 @@ function parseState(text) {
     return null;
   const { owner, etag, syncedAt, uploadedDigest, write } = json;
   const { uploadedAt, appliedAt, retryAt, pollAt, writeCheckAt } = json;
+  const loginKnown = marks(readMap(json.loginKnown, isMark));
+  const loginSuppressed = marks(readMap(json.loginSuppressed, isMark));
   return {
     v: 1,
     gistId: json.gistId,
@@ -17348,6 +17523,8 @@ function parseState(text) {
     creator: json.creator === true,
     imported: readMap(json.imported, isRef),
     skipped: readMap(json.skipped, isSkip),
+    ...loginKnown ? { loginKnown } : {},
+    ...loginSuppressed ? { loginSuppressed } : {},
     ...typeof owner === "string" ? { owner } : {},
     ...isWrite(write) ? { write } : {},
     ...typeof etag === "string" ? { etag } : {},
@@ -17577,6 +17754,179 @@ async function discoverGithubToken(run = ghAuthToken, env = process.env) {
 var GH_TIMEOUT_MS = 5000;
 var init_github_auth = () => {};
 
+// src/sync/logins.ts
+function loginsSyncEnabled(env = process.env) {
+  const raw = env.OPENCODE_AUTH_LB_SYNC_LOGINS?.trim().toLowerCase();
+  return raw !== "0" && raw !== "false" && raw !== "no" && raw !== "off";
+}
+function rowKey(row) {
+  const live = row.refresh !== "" || row.inferenceToken !== undefined && row.lostLogins?.oauth !== undefined;
+  return LOGIN_PROVIDERS.has(row.providerID) && row.accountId && live ? loginKey(row.providerID, row.accountId) : null;
+}
+function heldMarks(accounts) {
+  const held = newMap();
+  for (const row of accounts) {
+    const key = rowKey(row);
+    if (key)
+      held[key] = true;
+  }
+  return held;
+}
+function ownLogins(pool) {
+  const best = new Map;
+  for (const row of pool.accounts) {
+    if (!row.refresh || !row.accountId)
+      continue;
+    if (row.disabledReason || row.lostLogins?.oauth)
+      continue;
+    const login = parseLogin({
+      key: loginKey(row.providerID, row.accountId),
+      providerID: row.providerID,
+      label: printable(row.label).slice(0, MAX_LABEL).trim() || row.providerID,
+      access: row.access,
+      refresh: row.refresh,
+      expires: row.expires,
+      accountId: row.accountId,
+      orgId: row.orgId,
+      refreshExpires: row.refreshExpires,
+      ...loginVersion(row)
+    });
+    const prior = login ? best.get(login.key) : undefined;
+    if (login && (!prior || compareLogins(login, prior) > 0))
+      best.set(login.key, login);
+  }
+  return sortLogins([...best.values()]).slice(0, MAX_LOGINS);
+}
+function mergeLogins(gist, own) {
+  const merged = new Map(gist.map((login) => [login.key, login]));
+  for (const login of own) {
+    const prior = merged.get(login.key);
+    if (prior ? compareLogins(login, prior) > 0 : merged.size < MAX_LOGINS)
+      merged.set(login.key, login);
+  }
+  return sortLogins([...merged.values()]);
+}
+function ownCopies(next, own) {
+  return own.filter((login) => next.some((n) => n.key === login.key && n.refresh === login.refresh)).length;
+}
+function publishDigest(entries, logins) {
+  return logins.length === 0 ? entriesDigest(entries) : fingerprint(`${entriesDigest(entries)}/${loginsDigest(logins)}`);
+}
+function sameLogin(row, login) {
+  return rowKey(row) === login.key && (row.orgId === undefined || login.orgId === undefined || row.orgId === login.orgId);
+}
+function versionOf(row) {
+  return { ...loginVersion(row), refresh: row.refresh };
+}
+function overwriteLocked(row, login) {
+  const attempt = { refresh: row.refresh, gen: genOf(row) };
+  return mutatePool((pool) => {
+    const cur = findAccount(pool, row.id);
+    if (!cur || !sameGeneration(cur, attempt))
+      return false;
+    cur.access = login.access;
+    cur.refresh = login.refresh;
+    cur.expires = login.expires;
+    if (login.refreshExpires)
+      cur.refreshExpires = login.refreshExpires;
+    else
+      delete cur.refreshExpires;
+    if (login.orgId)
+      cur.orgId = login.orgId;
+    cur.loginRev = login.rev;
+    cur.loginAt = login.at;
+    cur.tokenGen = genOf(cur) + 1;
+    clearLostLogin(cur, "oauth");
+    if (cur.disabledReason?.startsWith(AUTO_DISABLED_PREFIX))
+      cur.disabledReason = null;
+    return true;
+  });
+}
+function overwrite(row, login) {
+  return withRefreshLock(row.providerID, row.id, () => overwriteLocked(row, login));
+}
+async function create(login) {
+  const tokens = {
+    access: login.access,
+    refresh: login.refresh,
+    expires: login.expires,
+    accountId: login.accountId,
+    ...login.orgId ? { orgId: login.orgId } : {},
+    ...login.refreshExpires ? { refreshExpires: login.refreshExpires } : {}
+  };
+  return mutatePool((pool) => {
+    if (pool.accounts.some((row) => sameLogin(row, login)))
+      return false;
+    const manual = new Set(pool.accounts.filter((row) => row.disabledReason === MANUAL_DISABLED_REASON).map((row) => row.id));
+    const row = placeTokens(pool, login.providerID, tokens, uniqueLabel(pool, login.label), undefined);
+    row.loginRev = login.rev;
+    row.loginAt = login.at;
+    row.tokenGen = genOf(row) + 1;
+    if (manual.has(row.id))
+      row.disabledReason = MANUAL_DISABLED_REASON;
+    return true;
+  });
+}
+async function adopt2(login) {
+  const row = (await readPool()).accounts.find((a) => sameLogin(a, login));
+  if (!row)
+    return create(login);
+  return compareLogins(login, versionOf(row)) > 0 ? overwrite(row, login) : false;
+}
+async function outrank(login, now) {
+  const row = (await readPool()).accounts.find((a) => sameLogin(a, login));
+  if (!row || compareLogins(versionOf(row), login) > 0)
+    return;
+  const attempt = { refresh: row.refresh, gen: genOf(row) };
+  await mutatePool((pool) => {
+    const cur = findAccount(pool, row.id);
+    if (!cur || !sameGeneration(cur, attempt))
+      return;
+    cur.loginRev = login.rev + 1;
+    cur.loginAt = now;
+  });
+}
+async function applyLogins(gist, marks, now) {
+  const known = newMap(marks.known);
+  const suppressed = newMap(marks.suppressed);
+  const held = heldMarks((await readPool()).accounts);
+  for (const key of Object.keys(known)) {
+    if (held[key])
+      continue;
+    suppressed[key] = true;
+    delete known[key];
+  }
+  for (const key of Object.keys(suppressed)) {
+    if (!held[key])
+      continue;
+    delete suppressed[key];
+    const login = gist.find((l) => l.key === key);
+    if (login)
+      await outrank(login, now);
+  }
+  let adopted = 0;
+  for (const login of gist)
+    if (!suppressed[login.key] && await adopt2(login))
+      adopted += 1;
+  return {
+    adopted,
+    known: heldMarks((await readPool()).accounts),
+    suppressed
+  };
+}
+var AUTO_DISABLED_PREFIX = "invalid_grant: re-login required";
+var init_logins = __esm(() => {
+  init_accounts();
+  init_store();
+  init_refresh();
+  init_types();
+  init_apply();
+  init_crypto();
+  init_login_payload();
+  init_payload();
+  init_state();
+});
+
 // src/sync/origin.ts
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { readFile as readFile6 } from "node:fs/promises";
@@ -17677,6 +18027,10 @@ var init_timing = __esm(() => {
 function count(n, one, many) {
   return `${n} ${n === 1 ? one : many}`;
 }
+function uploadedMessage(entries, logins) {
+  const credentials = count(entries, "credential", "credentials");
+  return logins === 0 ? `Uploaded ${credentials}.` : `Uploaded ${credentials} and ${count(logins, "login", "logins")}.`;
+}
 function recordApplied(gistId, at, applied, syncedAt) {
   return updateSyncState((cur) => cur?.gistId === gistId ? {
     ...cur,
@@ -17700,7 +18054,8 @@ async function runCycle(deps, force, report) {
   const pool = await readPool();
   const backedOff = state.write === "denied" && !force && now() < (state.writeCheckAt ?? 0);
   const mayWrite = token !== null && !backedOff;
-  const before = entriesDigest(ownEntries(pool, origin, state.imported));
+  const sharing = loginsSyncEnabled();
+  const before = publishDigest(ownEntries(pool, origin, state.imported), sharing ? ownLogins(pool) : []);
   const dirty = mayWrite && before !== state.uploadedDigest;
   report.retryMs = dirty ? PUBLISH_RETRY_MS : POLL_MS;
   const reread = force || dirty || hasFreedSkips(pool.accounts, state.skipped);
@@ -17722,8 +18077,17 @@ async function runCycle(deps, force, report) {
     ...deps.adapters ? { adapters: deps.adapters } : {},
     afterPass: (soFar) => recordApplied(state.gistId, snapshot.at, soFar, now())
   });
-  const own = ownEntries(await readPool(), origin, applied?.imported ?? state.imported);
-  const unreadable = snapshot.unreadable > 0;
+  const adoptedLogins = stale || !sharing ? null : await applyLogins(snapshot.logins, { known: state.loginKnown, suppressed: state.loginSuppressed }, now());
+  if (adoptedLogins)
+    await updateSyncState((cur) => cur?.gistId === state.gistId ? {
+      ...cur,
+      loginKnown: marks(adoptedLogins.known),
+      loginSuppressed: marks(adoptedLogins.suppressed)
+    } : cur);
+  const settled = await readPool();
+  const own = ownEntries(settled, origin, applied?.imported ?? state.imported);
+  const ownShared = sharing ? ownLogins(settled) : [];
+  const unreadable = snapshot.unreadable > 0 || snapshot.loginsUnreadable > 0;
   let write = standing;
   let wrote = null;
   let stamped = 0;
@@ -17733,12 +18097,16 @@ async function runCycle(deps, force, report) {
   if (mayWrite && !unreadable) {
     const others = snapshot.entries.filter((e) => e.origin !== origin);
     const next = sortEntries([...others, ...listable(own, others, origin)]);
-    const same = JSON.stringify(next) === JSON.stringify(sortEntries(snapshot.entries));
+    const nextLogins = sharing ? mergeLogins(snapshot.logins, ownShared) : snapshot.logins;
+    const same = JSON.stringify(next) === JSON.stringify(sortEntries(snapshot.entries)) && loginsDigest(nextLogins) === loginsDigest(snapshot.logins);
     if (!same || stale) {
       stamped = Math.max(now(), snapshot.at + 1, (state.uploadedAt ?? 0) + 1, (state.appliedAt ?? 0) + 1);
       try {
-        await updateGist(token, state.gistId, seal(buildPayload(next, stamped), key), now());
-        wrote = next.filter((e) => e.origin === origin);
+        await updateGist(token, state.gistId, seal(buildPayload(next, stamped, nextLogins), key), now());
+        wrote = {
+          entries: next.filter((e) => e.origin === origin).length,
+          logins: ownCopies(nextLogins, ownShared)
+        };
       } catch (error) {
         if (!(error instanceof SyncError) || error.code !== "write-denied")
           throw error;
@@ -17754,18 +18122,22 @@ async function runCycle(deps, force, report) {
     etag: wrote || stale || deferred > 0 || denied ? undefined : read.etag,
     write,
     writeCheckAt: denied ? now() + WRITE_BACKOFF_MS : backedOff ? cur.writeCheckAt : undefined,
-    uploadedDigest: mayWrite && !unreadable && !denied ? entriesDigest(own) : cur.uploadedDigest,
+    uploadedDigest: mayWrite && !unreadable && !denied ? publishDigest(own, ownShared) : cur.uploadedDigest,
     ...wrote ? { uploadedAt: stamped } : {}
   } : cur);
   const parts = [];
   const moved = applied ? applied.added + applied.updated + applied.removed + deferred : 0;
+  const adopted = adoptedLogins?.adopted ?? 0;
   if (applied && moved > 0) {
     const tail = deferred > 0 ? `; ${count(deferred, "entry", "entries")} could not be verified yet` : "";
-    parts.push(`Synced: ${applied.added} added, ${applied.updated} updated, ${applied.removed} removed${tail}.`);
-  } else if (!wrote)
+    const login = adopted > 0 ? `; ${count(adopted, "login", "logins")} adopted` : "";
+    parts.push(`Synced: ${applied.added} added, ${applied.updated} updated, ${applied.removed} removed${tail}${login}.`);
+  } else if (adopted > 0)
+    parts.push(`Synced: ${count(adopted, "login", "logins")} adopted.`);
+  else if (!wrote)
     parts.push("Up to date.");
   if (wrote)
-    parts.push(`Uploaded ${count(wrote.length, "credential", "credentials")}.`);
+    parts.push(uploadedMessage(wrote.entries, wrote.logins));
   if (denied)
     parts.push(new SyncError("write-denied").message);
   if (mayWrite && unreadable && state.write !== "unreadable")
@@ -17780,6 +18152,8 @@ var init_cycle = __esm(() => {
   init_errors3();
   init_gist();
   init_github_auth();
+  init_login_payload();
+  init_logins();
   init_merge();
   init_origin();
   init_own();
@@ -17789,9 +18163,6 @@ var init_cycle = __esm(() => {
 });
 
 // src/sync/engine.ts
-function count2(n, one, many) {
-  return `${n} ${n === 1 ? one : many}`;
-}
 function createEngine(deps) {
   const { now } = deps;
   async function settle(work, reqAt, scheduled) {
@@ -17824,10 +18195,14 @@ function createEngine(deps) {
     if (!token)
       throw new SyncError("no-auth");
     const origin = await machineOrigin();
-    const own = ownEntries(await readPool(), origin, newRefs());
+    const pool = await readPool();
+    const own = ownEntries(pool, origin, newRefs());
+    const sharing = loginsSyncEnabled();
+    const shared = sharing ? ownLogins(pool) : [];
     const key = generateKey();
     const at = now();
-    const gist = await createGist(token, seal(buildPayload(own, at), key), now());
+    const gist = await createGist(token, seal(buildPayload(own, at, shared), key), now());
+    const loginKnown = sharing ? marks(heldMarks(pool.accounts)) : undefined;
     await updateSyncState(() => ({
       v: 1,
       gistId: gist.id,
@@ -17836,21 +18211,23 @@ function createEngine(deps) {
       ...gist.owner ? { owner: gist.owner } : {},
       write: "ok",
       syncedAt: now(),
-      uploadedDigest: entriesDigest(own),
+      uploadedDigest: publishDigest(own, shared),
       uploadedAt: at,
       appliedAt: at,
       pollAt: now() + POLL_MS,
       imported: newRefs(),
-      skipped: newMap()
+      skipped: newMap(),
+      ...loginKnown ? { loginKnown } : {}
     }));
-    return `Uploaded ${count2(own.length, "credential", "credentials")}.`;
+    const message = uploadedMessage(own.length, shared.length);
+    return own.length + shared.length === 0 ? `${message} ${NOTHING_TO_SHARE}` : message;
   }
   async function unpublishedDigest() {
     const state = await readSyncState();
     if (!state || state.write === "no-token" || state.write === "unreadable" || state.write === "denied" && now() < (state.writeCheckAt ?? 0))
       return null;
-    const own = ownEntries(await readPool(), await machineOrigin(), state.imported);
-    const digest = entriesDigest(own);
+    const pool = await readPool();
+    const digest = publishDigest(ownEntries(pool, await machineOrigin(), state.imported), loginsSyncEnabled() ? ownLogins(pool) : []);
     return digest === state.uploadedDigest ? null : digest;
   }
   const engine = {
@@ -17872,7 +18249,9 @@ function createEngine(deps) {
           creator: prior?.creator ?? false,
           ...prior?.owner ? { owner: prior.owner } : {},
           imported: prior?.imported ?? newRefs(),
-          skipped: prior?.skipped ?? newMap()
+          skipped: prior?.skipped ?? newMap(),
+          ...prior?.loginKnown ? { loginKnown: prior.loginKnown } : {},
+          ...prior?.loginSuppressed ? { loginSuppressed: prior.loginSuppressed } : {}
         };
       });
       return settle(cycle(false), reqAt, true);
@@ -17899,6 +18278,7 @@ function createEngine(deps) {
   };
   return engine;
 }
+var NOTHING_TO_SHARE = "No static credential or shareable OAuth login on this machine.";
 var init_engine = __esm(() => {
   init_store();
   init_crypto();
@@ -17906,6 +18286,7 @@ var init_engine = __esm(() => {
   init_errors3();
   init_gist();
   init_github_auth();
+  init_logins();
   init_origin();
   init_own();
   init_payload();
@@ -17913,6 +18294,47 @@ var init_engine = __esm(() => {
   init_timing();
 });
 
+// src/sync/login-hooks.ts
+function createPullLogin(runGh) {
+  return async function pullLogin(account, _recovery) {
+    const { providerID, accountId } = account;
+    if (!syncEnabled() || !loginsSyncEnabled())
+      return false;
+    if (!LOGIN_PROVIDERS.has(providerID) || !accountId || !account.refresh)
+      return false;
+    try {
+      const state = await readSyncState();
+      if (!state)
+        return false;
+      const token = await discoverGithubToken(runGh) ?? undefined;
+      const read = await readGist(state.gistId, undefined, Date.now(), token);
+      if (!read.changed)
+        return false;
+      const key = decodeKey(state.key) ?? Buffer.alloc(32);
+      const wanted = loginKey(providerID, accountId);
+      const login = parsePayload(open(read.content, key)).logins.find((l) => l.key === wanted);
+      if (!login || !sameLogin(account, login))
+        return false;
+      if (compareLogins(login, versionOf(account)) <= 0)
+        return false;
+      return await overwriteLocked(account, login);
+    } catch {
+      return false;
+    }
+  };
+}
+var pullLogin;
+var init_login_hooks = __esm(() => {
+  init_crypto();
+  init_gist();
+  init_github_auth();
+  init_login_payload();
+  init_logins();
+  init_payload();
+  init_state();
+  pullLogin = createPullLogin();
+});
+
 // src/sync/intent.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { access, readFile as readFile7, rename as rename2, rm as rm3 } from "node:fs/promises";
@@ -18114,10 +18536,6 @@ var init_loop = __esm(() => {
 });
 
 // src/sync/start.ts
-function syncEnabled(env = process.env) {
-  const raw = env.OPENCODE_AUTH_LB_SYNC?.trim().toLowerCase();
-  return raw !== "0" && raw !== "false" && raw !== "no" && raw !== "off";
-}
 function startSync() {
   if (!syncEnabled())
     return null;
@@ -18126,11 +18544,45 @@ function startSync() {
     now: Date.now
   });
   loop.start();
-  return loop;
+  if (!loginsSyncEnabled())
+    return loop;
+  setRefreshHooks({
+    pull: pullLogin,
+    afterRefresh: () => void publishAfterLogin().catch(ignore)
+  });
+  return {
+    ...loop,
+    dispose() {
+      setRefreshHooks(null);
+      return loop.dispose();
+    }
+  };
 }
+async function publishAfterLogin(options = {}) {
+  const { engine = createEngine({ now: Date.now }) } = options;
+  const { timeoutMs = LOGIN_PUBLISH_MS } = options;
+  let timer;
+  const publish = async () => {
+    if (!syncEnabled() || !loginsSyncEnabled() || !await readSyncState())
+      return;
+    await withCycleLock(() => engine.sync(), timeoutMs);
+  };
+  await Promise.race([
+    publish().catch(ignore),
+    new Promise((resolve) => {
+      timer = setTimeout(resolve, timeoutMs);
+    })
+  ]);
+  clearTimeout(timer);
+}
+var LOGIN_PUBLISH_MS = 20000;
 var init_start = __esm(() => {
+  init_util2();
   init_engine();
+  init_login_hooks();
+  init_logins();
   init_loop();
+  init_state();
 });
 
 // src/legacy.ts
@@ -18158,6 +18610,8 @@ function buildAuthHook(adapter, client, pending) {
     if (minted || account.inferenceToken !== undefined && account.refresh)
       notifyPaired(client, adapter.id, account);
     await refreshUsageInBackground(adapter, Date.now()).catch(ignore);
+    if (tokens.refresh && !tokens.inferenceOnly)
+      await publishAfterLogin();
   };
   const oauthSuccess = (tokens) => ({
     type: "success",