chore: merge dev

packages/core/package.json

@@ -97,9 +97,9 @@
     "effect": "catalog:",
     "fuzzysort": "3.1.0",
     "gitlab-ai-provider": "6.8.0",
+    "gray-matter": "4.0.3",
     "glob": "13.0.5",
     "google-auth-library": "10.5.0",
-    "gray-matter": "4.0.3",
     "htmlparser2": "8.0.2",
     "immer": "11.1.4",
     "ignore": "7.0.5",

packages/core/src/account.ts

@@ -1,7 +1,17 @@
 export * as AccountV2 from "./account"
 
-import { Schema } from "effect"
-import type * as HttpClientError from "effect/unstable/http/HttpClientError"
+import { Cache, Clock, Context, Duration, Effect, Layer, Option, Schedule, Schema, SchemaGetter } from "effect"
+import { eq } from "drizzle-orm"
+import {
+  FetchHttpClient,
+  HttpClient,
+  HttpClientError,
+  HttpClientRequest,
+  HttpClientResponse,
+} from "effect/unstable/http"
+import { AccountStateTable, AccountTable } from "./account/sql"
+import { Database } from "./database/database"
+import { serviceUse } from "./effect/service-use"
 
 export const ID = Schema.String.pipe(Schema.brand("AccountID"))
 export type ID = Schema.Schema.Type<typeof ID>
@@ -99,3 +109,441 @@ export class PollError extends Schema.TaggedClass<PollError>()("PollError", {
 
 export const PollResult = Schema.Union([PollSuccess, PollPending, PollSlow, PollExpired, PollDenied, PollError])
 export type PollResult = Schema.Schema.Type<typeof PollResult>
+
+export type AccountOrgs = {
+  account: Info
+  orgs: readonly Org[]
+}
+
+export type ActiveOrg = {
+  account: Info
+  org: Org
+}
+
+class RemoteConfig extends Schema.Class<RemoteConfig>("RemoteConfig")({
+  config: Schema.Record(Schema.String, Schema.Json),
+}) {}
+
+const DurationFromSeconds = Schema.Number.pipe(
+  Schema.decodeTo(Schema.Duration, {
+    decode: SchemaGetter.transform((n) => Duration.seconds(n)),
+    encode: SchemaGetter.transform((d) => Duration.toSeconds(d)),
+  }),
+)
+
+class TokenRefresh extends Schema.Class<TokenRefresh>("TokenRefresh")({
+  access_token: AccessToken,
+  refresh_token: RefreshToken,
+  expires_in: DurationFromSeconds,
+}) {}
+
+class DeviceAuth extends Schema.Class<DeviceAuth>("DeviceAuth")({
+  device_code: DeviceCode,
+  user_code: UserCode,
+  verification_uri_complete: Schema.String,
+  expires_in: DurationFromSeconds,
+  interval: DurationFromSeconds,
+}) {}
+
+class DeviceTokenSuccess extends Schema.Class<DeviceTokenSuccess>("DeviceTokenSuccess")({
+  access_token: AccessToken,
+  refresh_token: RefreshToken,
+  token_type: Schema.Literal("Bearer"),
+  expires_in: DurationFromSeconds,
+}) {}
+
+class DeviceTokenError extends Schema.Class<DeviceTokenError>("DeviceTokenError")({
+  error: Schema.String,
+  error_description: Schema.String,
+}) {
+  toPollResult(): PollResult {
+    if (this.error === "authorization_pending") return new PollPending()
+    if (this.error === "slow_down") return new PollSlow()
+    if (this.error === "expired_token") return new PollExpired()
+    if (this.error === "access_denied") return new PollDenied()
+    return new PollError({ cause: this.error })
+  }
+}
+
+const DeviceToken = Schema.Union([DeviceTokenSuccess, DeviceTokenError])
+
+class User extends Schema.Class<User>("User")({
+  id: ID,
+  email: Schema.String,
+}) {}
+
+class ClientId extends Schema.Class<ClientId>("ClientId")({ client_id: Schema.String }) {}
+
+class DeviceTokenRequest extends Schema.Class<DeviceTokenRequest>("DeviceTokenRequest")({
+  grant_type: Schema.String,
+  device_code: DeviceCode,
+  client_id: Schema.String,
+}) {}
+
+class TokenRefreshRequest extends Schema.Class<TokenRefreshRequest>("TokenRefreshRequest")({
+  grant_type: Schema.String,
+  refresh_token: RefreshToken,
+  client_id: Schema.String,
+}) {}
+
+type AccountRow = typeof AccountTable.$inferSelect
+const ACCOUNT_STATE_ID = 1
+const clientId = "opencode-cli"
+const eagerRefreshThresholdMs = Duration.toMillis(Duration.minutes(5))
+
+function normalizeServerUrl(input: string) {
+  const url = new URL(input)
+  url.search = ""
+  url.hash = ""
+  const pathname = url.pathname.replace(/\/+$/, "")
+  return pathname.length === 0 ? url.origin : `${url.origin}${pathname}`
+}
+
+const isTokenFresh = (tokenExpiry: number | null, now: number) =>
+  tokenExpiry != null && tokenExpiry > now + eagerRefreshThresholdMs
+
+const mapAccountServiceError =
+  (message = "Account service operation failed") =>
+  <A, E, R>(effect: Effect.Effect<A, E, R>): Effect.Effect<A, AccountError, R> =>
+    effect.pipe(Effect.mapError((cause) => accountErrorFromCause(cause, message)))
+
+function accountErrorFromCause(cause: unknown, message: string): AccountError {
+  if (cause instanceof AccountServiceError || cause instanceof AccountTransportError) return cause
+  if (HttpClientError.isHttpClientError(cause)) {
+    if (cause.reason._tag === "TransportError") return AccountTransportError.fromHttpClientError(cause.reason)
+    return new AccountServiceError({ message, cause })
+  }
+  return new AccountServiceError({ message, cause })
+}
+
+export interface Interface {
+  readonly active: () => Effect.Effect<Option.Option<Info>, AccountError>
+  readonly activeOrg: () => Effect.Effect<Option.Option<ActiveOrg>, AccountError>
+  readonly list: () => Effect.Effect<Info[], AccountError>
+  readonly orgsByAccount: () => Effect.Effect<readonly AccountOrgs[], AccountError>
+  readonly remove: (accountID: ID) => Effect.Effect<void, AccountError>
+  readonly use: (accountID: ID, orgID: Option.Option<OrgID>) => Effect.Effect<void, AccountError>
+  readonly orgs: (accountID: ID) => Effect.Effect<readonly Org[], AccountError>
+  readonly config: (accountID: ID, orgID: OrgID) => Effect.Effect<Option.Option<Record<string, unknown>>, AccountError>
+  readonly token: (accountID: ID) => Effect.Effect<Option.Option<AccessToken>, AccountError>
+  readonly login: (url: string) => Effect.Effect<Login, AccountError>
+  readonly poll: (input: Login) => Effect.Effect<PollResult, AccountError>
+}
+
+export class Service extends Context.Service<Service, Interface>()("@opencode/v2/Account") {}
+
+export const use = serviceUse(Service)
+
+export const layer = Layer.effect(
+  Service,
+  Effect.gen(function* () {
+    const { db } = yield* Database.Service
+    const http = yield* HttpClient.HttpClient
+    const httpRead = http.pipe(
+      HttpClient.retryTransient({
+        retryOn: "errors-and-responses",
+        times: 2,
+        schedule: Schedule.exponential(200).pipe(Schedule.jittered),
+      }),
+    )
+    const httpOk = HttpClient.filterStatusOk(http)
+    const httpReadOk = HttpClient.filterStatusOk(httpRead)
+    const decode = Schema.decodeUnknownSync(Info)
+
+    const query = <A, E>(effect: Effect.Effect<A, E>) =>
+      effect.pipe(Effect.mapError((cause) => new AccountRepoError({ message: "Database operation failed", cause })))
+
+    const current = Effect.fnUntraced(function* () {
+      const state = yield* db.select().from(AccountStateTable).where(eq(AccountStateTable.id, ACCOUNT_STATE_ID)).get()
+      if (!state?.active_account_id) return
+      const account = yield* db.select().from(AccountTable).where(eq(AccountTable.id, state.active_account_id)).get()
+      if (!account) return
+      return { ...account, active_org_id: state.active_org_id ?? null }
+    })
+
+    const state = (accountID: ID, orgID: Option.Option<OrgID>) =>
+      db
+        .insert(AccountStateTable)
+        .values({ id: ACCOUNT_STATE_ID, active_account_id: accountID, active_org_id: Option.getOrNull(orgID) })
+        .onConflictDoUpdate({
+          target: AccountStateTable.id,
+          set: { active_account_id: accountID, active_org_id: Option.getOrNull(orgID) },
+        })
+        .run()
+
+    const active = Effect.fn("AccountV2.active")(() =>
+      query(current()).pipe(Effect.map((row) => (row ? Option.some(decode(row)) : Option.none()))),
+    )
+    const list = Effect.fn("AccountV2.list")(() =>
+      query(
+        db
+          .select()
+          .from(AccountTable)
+          .all()
+          .pipe(Effect.map((rows) => rows.map((row) => decode({ ...row, active_org_id: null })))),
+      ),
+    )
+    const remove = Effect.fn("AccountV2.remove")((accountID: ID) =>
+      query(
+        db.transaction((tx) =>
+          Effect.gen(function* () {
+            yield* tx
+              .update(AccountStateTable)
+              .set({ active_account_id: null, active_org_id: null })
+              .where(eq(AccountStateTable.active_account_id, accountID))
+              .run()
+            yield* tx.delete(AccountTable).where(eq(AccountTable.id, accountID)).run()
+          }),
+        ),
+      ).pipe(Effect.asVoid),
+    )
+    const select = Effect.fn("AccountV2.use")((accountID: ID, orgID: Option.Option<OrgID>) =>
+      query(state(accountID, orgID)).pipe(Effect.asVoid),
+    )
+    const getRow = (accountID: ID) =>
+      query(db.select().from(AccountTable).where(eq(AccountTable.id, accountID)).get()).pipe(
+        Effect.map(Option.fromNullishOr),
+      )
+
+    const persistToken = Effect.fnUntraced(function* (input: {
+      accountID: ID
+      accessToken: AccessToken
+      refreshToken: RefreshToken
+      expiry: Option.Option<number>
+    }) {
+      yield* query(
+        db
+          .update(AccountTable)
+          .set({
+            access_token: input.accessToken,
+            refresh_token: input.refreshToken,
+            token_expiry: Option.getOrNull(input.expiry),
+          })
+          .where(eq(AccountTable.id, input.accountID))
+          .run(),
+      )
+    })
+    const persistAccount = Effect.fnUntraced(function* (input: {
+      id: ID
+      email: string
+      url: string
+      accessToken: AccessToken
+      refreshToken: RefreshToken
+      expiry: number
+      orgID: Option.Option<OrgID>
+    }) {
+      const url = normalizeServerUrl(input.url)
+      yield* query(
+        db.transaction((tx) =>
+          Effect.gen(function* () {
+            yield* tx
+              .insert(AccountTable)
+              .values({
+                id: input.id,
+                email: input.email,
+                url,
+                access_token: input.accessToken,
+                refresh_token: input.refreshToken,
+                token_expiry: input.expiry,
+              })
+              .onConflictDoUpdate({
+                target: AccountTable.id,
+                set: {
+                  email: input.email,
+                  url,
+                  access_token: input.accessToken,
+                  refresh_token: input.refreshToken,
+                  token_expiry: input.expiry,
+                },
+              })
+              .run()
+            yield* state(input.id, input.orgID)
+          }),
+        ),
+      )
+    })
+    const executeRead = (request: HttpClientRequest.HttpClientRequest) =>
+      httpRead.execute(request).pipe(mapAccountServiceError("HTTP request failed"))
+    const executeReadOk = (request: HttpClientRequest.HttpClientRequest) =>
+      httpReadOk.execute(request).pipe(mapAccountServiceError("HTTP request failed"))
+    const executeEffectOk = <E>(request: Effect.Effect<HttpClientRequest.HttpClientRequest, E>) =>
+      request.pipe(
+        Effect.flatMap((req) => httpOk.execute(req)),
+        mapAccountServiceError("HTTP request failed"),
+      )
+    const executeEffect = <E>(request: Effect.Effect<HttpClientRequest.HttpClientRequest, E>) =>
+      request.pipe(
+        Effect.flatMap((req) => http.execute(req)),
+        mapAccountServiceError("HTTP request failed"),
+      )
+
+    const refreshToken = Effect.fnUntraced(function* (row: AccountRow) {
+      const now = yield* Clock.currentTimeMillis
+      const response = yield* executeEffectOk(
+        HttpClientRequest.post(`${row.url}/auth/device/token`).pipe(
+          HttpClientRequest.acceptJson,
+          HttpClientRequest.schemaBodyJson(TokenRefreshRequest)(
+            new TokenRefreshRequest({
+              grant_type: "refresh_token",
+              refresh_token: row.refresh_token,
+              client_id: clientId,
+            }),
+          ),
+        ),
+      )
+      const parsed = yield* HttpClientResponse.schemaBodyJson(TokenRefresh)(response).pipe(
+        mapAccountServiceError("Failed to decode response"),
+      )
+      yield* persistToken({
+        accountID: row.id,
+        accessToken: parsed.access_token,
+        refreshToken: parsed.refresh_token,
+        expiry: Option.some(now + Duration.toMillis(parsed.expires_in)),
+      })
+      return parsed.access_token
+    })
+    const refreshTokenCache = yield* Cache.make<ID, AccessToken, AccountError>({
+      capacity: Number.POSITIVE_INFINITY,
+      timeToLive: Duration.zero,
+      lookup: Effect.fnUntraced(function* (accountID) {
+        const maybeAccount = yield* getRow(accountID)
+        if (Option.isNone(maybeAccount))
+          return yield* new AccountServiceError({ message: "Account not found during token refresh" })
+        const now = yield* Clock.currentTimeMillis
+        if (isTokenFresh(maybeAccount.value.token_expiry, now)) return maybeAccount.value.access_token
+        return yield* refreshToken(maybeAccount.value)
+      }),
+    })
+    const resolveToken = Effect.fnUntraced(function* (row: AccountRow) {
+      const now = yield* Clock.currentTimeMillis
+      if (isTokenFresh(row.token_expiry, now)) return row.access_token
+      return yield* Cache.get(refreshTokenCache, row.id)
+    })
+    const resolveAccess = Effect.fnUntraced(function* (accountID: ID) {
+      const maybeAccount = yield* getRow(accountID)
+      if (Option.isNone(maybeAccount)) return Option.none()
+      return Option.some({ account: maybeAccount.value, accessToken: yield* resolveToken(maybeAccount.value) })
+    })
+    const fetchOrgs = Effect.fnUntraced(function* (url: string, accessToken: AccessToken) {
+      const response = yield* executeReadOk(
+        HttpClientRequest.get(`${url}/api/orgs`).pipe(
+          HttpClientRequest.acceptJson,
+          HttpClientRequest.bearerToken(accessToken),
+        ),
+      )
+      return yield* HttpClientResponse.schemaBodyJson(Schema.Array(Org))(response).pipe(
+        mapAccountServiceError("Failed to decode response"),
+      )
+    })
+    const fetchUser = Effect.fnUntraced(function* (url: string, accessToken: AccessToken) {
+      const response = yield* executeReadOk(
+        HttpClientRequest.get(`${url}/api/user`).pipe(
+          HttpClientRequest.acceptJson,
+          HttpClientRequest.bearerToken(accessToken),
+        ),
+      )
+      return yield* HttpClientResponse.schemaBodyJson(User)(response).pipe(
+        mapAccountServiceError("Failed to decode response"),
+      )
+    })
+    const token = Effect.fn("AccountV2.token")((accountID: ID) =>
+      resolveAccess(accountID).pipe(Effect.map(Option.map((item) => item.accessToken))),
+    )
+    const orgs = Effect.fn("AccountV2.orgs")(function* (accountID: ID) {
+      const resolved = yield* resolveAccess(accountID)
+      if (Option.isNone(resolved)) return []
+      return yield* fetchOrgs(resolved.value.account.url, resolved.value.accessToken)
+    })
+    const activeOrg = Effect.fn("AccountV2.activeOrg")(function* () {
+      const value = yield* active()
+      if (Option.isNone(value) || !value.value.active_org_id) return Option.none<ActiveOrg>()
+      const org = (yield* orgs(value.value.id)).find((item) => item.id === value.value.active_org_id)
+      return org ? Option.some({ account: value.value, org }) : Option.none<ActiveOrg>()
+    })
+    const orgsByAccount = Effect.fn("AccountV2.orgsByAccount")(function* () {
+      return yield* Effect.forEach(
+        yield* list(),
+        (account) =>
+          orgs(account.id).pipe(
+            Effect.catch(() => Effect.succeed([] as readonly Org[])),
+            Effect.map((orgs) => ({ account, orgs })),
+          ),
+        { concurrency: 3 },
+      )
+    })
+    const config = Effect.fn("AccountV2.config")(function* (accountID: ID, orgID: OrgID) {
+      const resolved = yield* resolveAccess(accountID)
+      if (Option.isNone(resolved)) return Option.none()
+      const response = yield* executeRead(
+        HttpClientRequest.get(`${resolved.value.account.url}/api/config`).pipe(
+          HttpClientRequest.acceptJson,
+          HttpClientRequest.bearerToken(resolved.value.accessToken),
+          HttpClientRequest.setHeaders({ "x-org-id": orgID }),
+        ),
+      )
+      if (response.status === 404) return Option.none()
+      const ok = yield* HttpClientResponse.filterStatusOk(response).pipe(mapAccountServiceError())
+      const parsed = yield* HttpClientResponse.schemaBodyJson(RemoteConfig)(ok).pipe(
+        mapAccountServiceError("Failed to decode response"),
+      )
+      return Option.some(parsed.config)
+    })
+    const login = Effect.fn("AccountV2.login")(function* (server: string) {
+      const normalizedServer = normalizeServerUrl(server)
+      const response = yield* executeEffectOk(
+        HttpClientRequest.post(`${normalizedServer}/auth/device/code`).pipe(
+          HttpClientRequest.acceptJson,
+          HttpClientRequest.schemaBodyJson(ClientId)(new ClientId({ client_id: clientId })),
+        ),
+      )
+      const parsed = yield* HttpClientResponse.schemaBodyJson(DeviceAuth)(response).pipe(
+        mapAccountServiceError("Failed to decode response"),
+      )
+      return new Login({
+        code: parsed.device_code,
+        user: parsed.user_code,
+        url: `${normalizedServer}${parsed.verification_uri_complete}`,
+        server: normalizedServer,
+        expiry: parsed.expires_in,
+        interval: parsed.interval,
+      })
+    })
+    const poll = Effect.fn("AccountV2.poll")(function* (input: Login) {
+      const response = yield* executeEffect(
+        HttpClientRequest.post(`${input.server}/auth/device/token`).pipe(
+          HttpClientRequest.acceptJson,
+          HttpClientRequest.schemaBodyJson(DeviceTokenRequest)(
+            new DeviceTokenRequest({
+              grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+              device_code: input.code,
+              client_id: clientId,
+            }),
+          ),
+        ),
+      )
+      const parsed = yield* HttpClientResponse.schemaBodyJson(DeviceToken)(response).pipe(
+        mapAccountServiceError("Failed to decode response"),
+      )
+      if (parsed instanceof DeviceTokenError) return parsed.toPollResult()
+      const [account, remoteOrgs] = yield* Effect.all(
+        [fetchUser(input.server, parsed.access_token), fetchOrgs(input.server, parsed.access_token)],
+        { concurrency: 2 },
+      )
+      const now = yield* Clock.currentTimeMillis
+      yield* persistAccount({
+        id: account.id,
+        email: account.email,
+        url: input.server,
+        accessToken: parsed.access_token,
+        refreshToken: parsed.refresh_token,
+        expiry: now + Duration.toMillis(parsed.expires_in),
+        orgID: remoteOrgs.length ? Option.some(remoteOrgs[0].id) : Option.none(),
+      })
+      return new PollSuccess({ email: account.email })
+    })
+
+    return Service.of({ active, activeOrg, list, orgsByAccount, remove, use: select, orgs, config, token, login, poll })
+  }),
+)
+
+export const defaultLayer = layer.pipe(Layer.provide(Database.defaultLayer), Layer.provide(FetchHttpClient.layer))

packages/core/src/account/sql.ts

@@ -1,6 +1,6 @@
 import { sqliteTable, text, integer, primaryKey } from "drizzle-orm/sqlite-core"
 
-import { AccountV2 } from "../account"
+import type { AccountV2 } from "../account"
 import { Timestamps } from "../database/schema.sql"
 
 export const AccountTable = sqliteTable("account", {

packages/core/test/account.test.ts

@@ -1,284 +1,489 @@
-import path from "path"
-import { describe, expect } from "bun:test"
-import { produce } from "immer"
-import { Effect, Fiber, Layer, Option, Stream } from "effect"
-import { Auth } from "@opencode-ai/core/auth"
-import { Catalog } from "@opencode-ai/core/catalog"
-import { EventV2 } from "@opencode-ai/core/event"
-import { FSUtil } from "@opencode-ai/core/fs-util"
-import { Global } from "@opencode-ai/core/global"
-import { PluginV2 } from "@opencode-ai/core/plugin"
-import { AccountPlugin } from "@opencode-ai/core/plugin/account"
-import { ModelV2 } from "@opencode-ai/core/model"
-import { ProviderV2 } from "@opencode-ai/core/provider"
-import { tmpdir } from "./fixture/tmpdir"
+import { expect } from "bun:test"
+import { Duration, Effect, Layer, Option, Schema } from "effect"
+import { eq, sql } from "drizzle-orm"
+import { HttpClient, HttpClientError, HttpClientResponse } from "effect/unstable/http"
+
+import { AccountV2 } from "@opencode-ai/core/account"
+import { AccountStateTable, AccountTable } from "@opencode-ai/core/account/sql"
+import { Database } from "@opencode-ai/core/database/database"
 import { testEffect } from "./lib/effect"
 
-const it = testEffect(PluginV2.locationLayer.pipe(Layer.provide(EventV2.defaultLayer)))
+const database = Database.layerFromPath(":memory:")
 
-function context(
-  records: { provider: ProviderV2.Info; models: Map<ModelV2.ID, ModelV2.Info> }[],
-  updates: Array<{ id: ProviderV2.ID; enabled: ProviderV2.Info["enabled"]; apiKey?: string }>,
-): Catalog.Editor {
-  return {
-    provider: {
-      list: () => records,
-      get: (providerID) => records.find((item) => item.provider.id === providerID),
-      update: (providerID, fn) => {
-        const record = records.find((item) => item.provider.id === providerID)
-        const provider = produce(record?.provider ?? ProviderV2.Info.empty(providerID), fn)
-        if (record) record.provider = provider
-        else records.push({ provider, models: new Map<ModelV2.ID, ModelV2.Info>() })
-        updates.push({
-          id: providerID,
-          enabled: provider.enabled,
-          apiKey: typeof provider.request.body.apiKey === "string" ? provider.request.body.apiKey : undefined,
-        })
-      },
-      remove: (providerID) => {
-        const index = records.findIndex((item) => item.provider.id === providerID)
-        if (index !== -1) records.splice(index, 1)
-      },
-    },
-    model: {
-      get: () => undefined,
-      update: () => {},
-      remove: () => {},
-      default: {
-        get: () => undefined,
-        set: () => {},
-      },
-    },
-  }
-}
+const truncate = Layer.effectDiscard(
+  Effect.gen(function* () {
+    const { db } = yield* Database.Service
+    yield* db.run(sql`DELETE FROM account_state`)
+    yield* db.run(sql`DELETE FROM account`)
+  }),
+).pipe(Layer.provide(database))
 
-function testLayer(dir: string) {
-  return Auth.layer.pipe(
-    Layer.provide(FSUtil.defaultLayer),
-    Layer.provideMerge(EventV2.defaultLayer),
-    Layer.provide(
-      Global.layerWith({
-        data: dir,
-        cache: path.join(dir, "cache"),
-        config: path.join(dir, "config"),
-        state: path.join(dir, "state"),
-        tmp: path.join(dir, "tmp"),
-        bin: path.join(dir, "bin"),
-        log: path.join(dir, "log"),
-        repos: path.join(dir, "repos"),
-      }),
-    ),
-  )
-}
+const it = testEffect(Layer.mergeAll(database, truncate))
 
-describe("Auth", () => {
-  it.live("emits account lifecycle events", () =>
-    Effect.acquireRelease(
-      Effect.promise(() => tmpdir()),
-      (tmp) => Effect.promise(() => tmp[Symbol.asyncDispose]()),
-    ).pipe(
-      Effect.flatMap((tmp) =>
-        Effect.gen(function* () {
-          const accounts = yield* Auth.Service
-          const eventSvc = yield* EventV2.Service
-          const addedFiber = yield* eventSvc
-            .subscribe(Auth.Event.Added)
-            .pipe(Stream.take(2), Stream.runCollect, Effect.forkScoped)
-          const switchedFiber = yield* eventSvc
-            .subscribe(Auth.Event.Switched)
-            .pipe(Stream.take(3), Stream.runCollect, Effect.forkScoped)
-          const removedFiber = yield* eventSvc
-            .subscribe(Auth.Event.Removed)
-            .pipe(Stream.take(1), Stream.runCollect, Effect.forkScoped)
+const insideEagerRefreshWindow = Duration.toMillis(Duration.minutes(1))
+const outsideEagerRefreshWindow = Duration.toMillis(Duration.minutes(10))
 
-          yield* Effect.yieldNow
+const live = (client: HttpClient.HttpClient) =>
+  AccountV2.layer.pipe(Layer.provide(database), Layer.provide(Layer.succeed(HttpClient.HttpClient, client)))
 
-          const first = yield* accounts.create({
-            serviceID: Auth.ServiceID.make("provider"),
-            credential: new Auth.ApiKeyCredential({ type: "api", key: "raw-key" }),
-          })
-          expect(first).toBeDefined()
-          if (!first) return
-          expect(first.description).toBe("default")
-          expect(first.credential.type).toBe("api")
-          if (first.credential.type === "api") expect(first.credential.key).toBe("raw-key")
+const persist = (input: {
+  id: AccountV2.ID
+  email: string
+  url: string
+  accessToken: AccountV2.AccessToken
+  refreshToken: AccountV2.RefreshToken
+  expiry: number
+  orgID: Option.Option<AccountV2.OrgID>
+}) =>
+  Effect.gen(function* () {
+    const { db } = yield* Database.Service
+    yield* db
+      .insert(AccountTable)
+      .values({
+        id: input.id,
+        email: input.email,
+        url: input.url,
+        access_token: input.accessToken,
+        refresh_token: input.refreshToken,
+        token_expiry: input.expiry,
+      })
+      .onConflictDoUpdate({
+        target: AccountTable.id,
+        set: { access_token: input.accessToken, refresh_token: input.refreshToken, token_expiry: input.expiry },
+      })
+      .run()
+      .pipe(Effect.orDie)
+    yield* db
+      .insert(AccountStateTable)
+      .values({ id: 1, active_account_id: input.id, active_org_id: Option.getOrNull(input.orgID) })
+      .onConflictDoUpdate({
+        target: AccountStateTable.id,
+        set: { active_account_id: input.id, active_org_id: Option.getOrNull(input.orgID) },
+      })
+      .run()
+      .pipe(Effect.orDie)
+  })
 
-          yield* accounts.update(first.id, { description: "keep" })
-          const updated = yield* accounts.get(first.id)
-          expect(updated?.description).toBe("keep")
-          expect(updated?.credential.type).toBe("api")
-          if (updated?.credential.type === "api") expect(updated.credential.key).toBe("raw-key")
+const row = (id: AccountV2.ID) =>
+  Effect.gen(function* () {
+    const { db } = yield* Database.Service
+    return yield* db.select().from(AccountTable).where(eq(AccountTable.id, id)).get().pipe(Effect.orDie)
+  })
 
-          const second = yield* accounts.create({
-            serviceID: Auth.ServiceID.make("provider"),
-            credential: new Auth.ApiKeyCredential({ type: "api", key: "second-key" }),
-          })
-          expect(second).toBeDefined()
-          if (!second) return
-
-          yield* accounts.remove(second.id)
-          const added = Array.from(yield* Fiber.join(addedFiber))
-          const switched = Array.from(yield* Fiber.join(switchedFiber))
-          const removed = Array.from(yield* Fiber.join(removedFiber))
-          expect(added.map((event) => event.data.account.id)).toEqual([first.id, second.id])
-          expect(switched.map((event) => event.data)).toEqual([
-            { serviceID: Auth.ServiceID.make("provider"), from: undefined, to: first.id },
-            { serviceID: Auth.ServiceID.make("provider"), from: first.id, to: second.id },
-            { serviceID: Auth.ServiceID.make("provider"), from: second.id, to: first.id },
-          ])
-          expect(removed[0]?.data.account.id).toBe(second.id)
-        }).pipe(Effect.provide(testLayer(tmp.path))),
-      ),
-    ),
-  )
-
-  it.live("always switches to newly created accounts", () =>
-    Effect.acquireRelease(
-      Effect.promise(() => tmpdir()),
-      (tmp) => Effect.promise(() => tmp[Symbol.asyncDispose]()),
-    ).pipe(
-      Effect.flatMap((tmp) =>
-        Effect.gen(function* () {
-          const accounts = yield* Auth.Service
-          const eventSvc = yield* EventV2.Service
-          const switchedFiber = yield* eventSvc
-            .subscribe(Auth.Event.Switched)
-            .pipe(Stream.take(3), Stream.runCollect, Effect.forkScoped)
-
-          yield* Effect.yieldNow
-
-          const first = yield* accounts.create({
-            serviceID: Auth.ServiceID.make("provider"),
-            credential: new Auth.ApiKeyCredential({ type: "api", key: "first-key" }),
-          })
-          const second = yield* accounts.create({
-            serviceID: Auth.ServiceID.make("provider"),
-            credential: new Auth.ApiKeyCredential({ type: "api", key: "second-key" }),
-          })
-          const third = yield* accounts.create({
-            serviceID: Auth.ServiceID.make("provider"),
-            credential: new Auth.ApiKeyCredential({ type: "api", key: "third-key" }),
-          })
-
-          expect(first).toBeDefined()
-          expect(second).toBeDefined()
-          expect(third).toBeDefined()
-          if (!first || !second || !third) return
-
-          expect((yield* accounts.active(Auth.ServiceID.make("provider")))?.id).toBe(third.id)
-          expect(Array.from(yield* Fiber.join(switchedFiber)).map((event) => event.data)).toEqual([
-            { serviceID: Auth.ServiceID.make("provider"), from: undefined, to: first.id },
-            { serviceID: Auth.ServiceID.make("provider"), from: first.id, to: second.id },
-            { serviceID: Auth.ServiceID.make("provider"), from: second.id, to: third.id },
-          ])
-        }).pipe(Effect.provide(testLayer(tmp.path))),
-      ),
-    ),
-  )
-
-  it.live("account plugin refreshes providers on account lifecycle events", () =>
-    Effect.acquireRelease(
-      Effect.promise(() => tmpdir()),
-      (tmp) => Effect.promise(() => tmp[Symbol.asyncDispose]()),
-    ).pipe(
-      Effect.flatMap((tmp) =>
-        Effect.gen(function* () {
-          const accounts = yield* Auth.Service
-          const plugin = yield* PluginV2.Service
-          const records = [
-            {
-              provider: ProviderV2.Info.empty(ProviderV2.ID.make("provider")),
-              models: new Map<ModelV2.ID, ModelV2.Info>(),
-            },
-          ]
-          const updates: Array<{ id: ProviderV2.ID; enabled: ProviderV2.Info["enabled"]; apiKey?: string }> = []
-          const catalog = Catalog.Service.of({
-            transform: () => Effect.die("unexpected catalog.transform"),
-            provider: {
-              get: () => Effect.die("unexpected provider.get"),
-              all: () => Effect.succeed([]),
-              available: () => Effect.succeed([]),
-            },
-            model: {
-              get: () => Effect.die("unexpected model.get"),
-              all: () => Effect.succeed([]),
-              available: () => Effect.succeed([]),
-              default: () => Effect.succeed(Option.none<ModelV2.Info>()),
-              small: () => Effect.succeed(Option.none<ModelV2.Info>()),
-            },
-          })
-
-          const eventSvc = yield* EventV2.Service
-          yield* plugin.add({
-            ...AccountPlugin,
-            effect: AccountPlugin.effect.pipe(
-              Effect.provideService(Auth.Service, accounts),
-              Effect.provideService(Catalog.Service, catalog),
-              Effect.provideService(EventV2.Service, eventSvc),
-              Effect.provideService(PluginV2.Service, plugin),
-            ),
-          })
-          yield* Effect.yieldNow
-
-          const first = yield* accounts.create({
-            serviceID: Auth.ServiceID.make("provider"),
-            credential: new Auth.ApiKeyCredential({ type: "api", key: "first-key" }),
-          })
-          expect(first).toBeDefined()
-          if (!first) return
-          yield* plugin.trigger("catalog.transform", context(records, updates), {})
-          expect(updates).toEqual([
-            {
-              id: ProviderV2.ID.make("provider"),
-              enabled: { via: "account", service: Auth.ServiceID.make("provider") },
-              apiKey: "first-key",
-            },
-          ])
-
-          updates.length = 0
-          const second = yield* accounts.create({
-            serviceID: Auth.ServiceID.make("provider"),
-            credential: new Auth.ApiKeyCredential({ type: "api", key: "second-key" }),
-          })
-          expect(second).toBeDefined()
-          if (!second) return
-          yield* plugin.trigger("catalog.transform", context(records, updates), {})
-          expect(updates).toEqual([
-            {
-              id: ProviderV2.ID.make("provider"),
-              enabled: { via: "account", service: Auth.ServiceID.make("provider") },
-              apiKey: "second-key",
-            },
-          ])
-
-          updates.length = 0
-          yield* accounts.activate(first.id)
-          yield* plugin.trigger("catalog.transform", context(records, updates), {})
-          expect(updates).toEqual([
-            {
-              id: ProviderV2.ID.make("provider"),
-              enabled: { via: "account", service: Auth.ServiceID.make("provider") },
-              apiKey: "first-key",
-            },
-          ])
-
-          updates.length = 0
-          yield* accounts.remove(first.id)
-          yield* plugin.trigger("catalog.transform", context(records, updates), {})
-          expect(updates).toEqual([
-            {
-              id: ProviderV2.ID.make("provider"),
-              enabled: { via: "account", service: Auth.ServiceID.make("provider") },
-              apiKey: "second-key",
-            },
-          ])
-
-          updates.length = 0
-          yield* accounts.remove(second.id)
-          yield* plugin.trigger("catalog.transform", context(records, updates), {})
-          expect(updates).toEqual([])
-        }).pipe(Effect.provide(testLayer(tmp.path))),
-      ),
-    ),
-  )
+const active = Effect.gen(function* () {
+  const { db } = yield* Database.Service
+  const state = yield* db.select().from(AccountStateTable).where(eq(AccountStateTable.id, 1)).get().pipe(Effect.orDie)
+  if (!state?.active_account_id) return undefined
+  const account = yield* row(state.active_account_id)
+  return account ? { ...account, active_org_id: state.active_org_id } : undefined
 })
+
+const json = (req: Parameters<typeof HttpClientResponse.fromWeb>[0], body: unknown, status = 200) =>
+  HttpClientResponse.fromWeb(
+    req,
+    new Response(JSON.stringify(body), {
+      status,
+      headers: { "content-type": "application/json" },
+    }),
+  )
+
+const encodeOrg = Schema.encodeSync(AccountV2.Org)
+
+const org = (id: string, name: string) => encodeOrg(new AccountV2.Org({ id: AccountV2.OrgID.make(id), name }))
+
+const login = () =>
+  new AccountV2.Login({
+    code: AccountV2.DeviceCode.make("device-code"),
+    user: AccountV2.UserCode.make("user-code"),
+    url: "https://one.example.com/verify",
+    server: "https://one.example.com",
+    expiry: Duration.seconds(600),
+    interval: Duration.seconds(5),
+  })
+
+const deviceTokenClient = (body: unknown, status = 400) =>
+  HttpClient.make((req) =>
+    Effect.succeed(
+      req.url === "https://one.example.com/auth/device/token" ? json(req, body, status) : json(req, {}, 404),
+    ),
+  )
+
+const poll = (body: unknown, status = 400) =>
+  AccountV2.Service.use((s) => s.poll(login())).pipe(Effect.provide(live(deviceTokenClient(body, status))))
+
+it.live("login normalizes trailing slashes in the provided server URL", () =>
+  Effect.gen(function* () {
+    const seen: Array<string> = []
+    const client = HttpClient.make((req) =>
+      Effect.gen(function* () {
+        seen.push(`${req.method} ${req.url}`)
+
+        if (req.url === "https://one.example.com/auth/device/code") {
+          return json(req, {
+            device_code: "device-code",
+            user_code: "user-code",
+            verification_uri_complete: "/device?user_code=user-code",
+            expires_in: 600,
+            interval: 5,
+          })
+        }
+
+        return json(req, {}, 404)
+      }),
+    )
+
+    const result = yield* AccountV2.use.login("https://one.example.com/").pipe(Effect.provide(live(client)))
+
+    expect(seen).toEqual(["POST https://one.example.com/auth/device/code"])
+    expect(result.server).toBe("https://one.example.com")
+    expect(result.url).toBe("https://one.example.com/device?user_code=user-code")
+  }),
+)
+
+it.live("login maps transport failures to account transport errors", () =>
+  Effect.gen(function* () {
+    const client = HttpClient.make((req) =>
+      Effect.fail(
+        new HttpClientError.HttpClientError({
+          reason: new HttpClientError.TransportError({ request: req }),
+        }),
+      ),
+    )
+
+    const error = yield* Effect.flip(AccountV2.use.login("https://one.example.com").pipe(Effect.provide(live(client))))
+
+    expect(error).toBeInstanceOf(AccountV2.AccountTransportError)
+    if (error instanceof AccountV2.AccountTransportError) {
+      expect(error.method).toBe("POST")
+      expect(error.url).toBe("https://one.example.com/auth/device/code")
+    }
+  }),
+)
+
+it.live("orgsByAccount groups orgs per account", () =>
+  Effect.gen(function* () {
+    yield* persist({
+      id: AccountV2.ID.make("user-1"),
+      email: "one@example.com",
+      url: "https://one.example.com",
+      accessToken: AccountV2.AccessToken.make("at_1"),
+      refreshToken: AccountV2.RefreshToken.make("rt_1"),
+      expiry: Date.now() + outsideEagerRefreshWindow,
+      orgID: Option.none(),
+    })
+
+    yield* persist({
+      id: AccountV2.ID.make("user-2"),
+      email: "two@example.com",
+      url: "https://two.example.com",
+      accessToken: AccountV2.AccessToken.make("at_2"),
+      refreshToken: AccountV2.RefreshToken.make("rt_2"),
+      expiry: Date.now() + outsideEagerRefreshWindow,
+      orgID: Option.none(),
+    })
+
+    const seen: Array<string> = []
+    const client = HttpClient.make((req) =>
+      Effect.gen(function* () {
+        seen.push(`${req.method} ${req.url}`)
+
+        if (req.url === "https://one.example.com/api/orgs") {
+          return json(req, [org("org-1", "One")])
+        }
+
+        if (req.url === "https://two.example.com/api/orgs") {
+          return json(req, [org("org-2", "Two A"), org("org-3", "Two B")])
+        }
+
+        return json(req, [], 404)
+      }),
+    )
+
+    const rows = yield* AccountV2.use.orgsByAccount().pipe(Effect.provide(live(client)))
+
+    expect(rows.map((row) => [row.account.id, row.orgs.map((org) => org.id)]).map(([id, orgs]) => [id, orgs])).toEqual([
+      [AccountV2.ID.make("user-1"), [AccountV2.OrgID.make("org-1")]],
+      [AccountV2.ID.make("user-2"), [AccountV2.OrgID.make("org-2"), AccountV2.OrgID.make("org-3")]],
+    ])
+    expect(seen).toEqual(["GET https://one.example.com/api/orgs", "GET https://two.example.com/api/orgs"])
+  }),
+)
+
+it.live("token refresh persists the new token", () =>
+  Effect.gen(function* () {
+    const id = AccountV2.ID.make("user-1")
+
+    yield* persist({
+      id,
+      email: "user@example.com",
+      url: "https://one.example.com",
+      accessToken: AccountV2.AccessToken.make("at_old"),
+      refreshToken: AccountV2.RefreshToken.make("rt_old"),
+      expiry: Date.now() - 1_000,
+      orgID: Option.none(),
+    })
+
+    const client = HttpClient.make((req) =>
+      Effect.succeed(
+        req.url === "https://one.example.com/auth/device/token"
+          ? json(req, {
+              access_token: "at_new",
+              refresh_token: "rt_new",
+              expires_in: 60,
+            })
+          : json(req, {}, 404),
+      ),
+    )
+
+    const token = yield* AccountV2.use.token(id).pipe(Effect.provide(live(client)))
+
+    expect(Option.getOrThrow(token)).toBeDefined()
+    expect(String(Option.getOrThrow(token))).toBe("at_new")
+
+    const value = yield* row(id)
+    expect(value).toBeDefined()
+    if (!value) return
+    expect(value.access_token).toBe(AccountV2.AccessToken.make("at_new"))
+    expect(value.refresh_token).toBe(AccountV2.RefreshToken.make("rt_new"))
+    expect(value.token_expiry).toBeGreaterThan(Date.now())
+  }),
+)
+
+it.live("token refreshes before expiry when inside the eager refresh window", () =>
+  Effect.gen(function* () {
+    const id = AccountV2.ID.make("user-1")
+
+    yield* persist({
+      id,
+      email: "user@example.com",
+      url: "https://one.example.com",
+      accessToken: AccountV2.AccessToken.make("at_old"),
+      refreshToken: AccountV2.RefreshToken.make("rt_old"),
+      expiry: Date.now() + insideEagerRefreshWindow,
+      orgID: Option.none(),
+    })
+
+    let refreshCalls = 0
+    const client = HttpClient.make((req) =>
+      Effect.promise(async () => {
+        if (req.url === "https://one.example.com/auth/device/token") {
+          refreshCalls += 1
+          return json(req, {
+            access_token: "at_new",
+            refresh_token: "rt_new",
+            expires_in: 60,
+          })
+        }
+
+        return json(req, {}, 404)
+      }),
+    )
+
+    const token = yield* AccountV2.use.token(id).pipe(Effect.provide(live(client)))
+
+    expect(String(Option.getOrThrow(token))).toBe("at_new")
+    expect(refreshCalls).toBe(1)
+
+    const value = yield* row(id)
+    expect(value).toBeDefined()
+    if (!value) return
+    expect(value.access_token).toBe(AccountV2.AccessToken.make("at_new"))
+    expect(value.refresh_token).toBe(AccountV2.RefreshToken.make("rt_new"))
+  }),
+)
+
+it.live("concurrent config and token requests coalesce token refresh", () =>
+  Effect.gen(function* () {
+    const id = AccountV2.ID.make("user-1")
+
+    yield* persist({
+      id,
+      email: "user@example.com",
+      url: "https://one.example.com",
+      accessToken: AccountV2.AccessToken.make("at_old"),
+      refreshToken: AccountV2.RefreshToken.make("rt_old"),
+      expiry: Date.now() - 1_000,
+      orgID: Option.some(AccountV2.OrgID.make("org-9")),
+    })
+
+    let refreshCalls = 0
+    const client = HttpClient.make((req) =>
+      Effect.promise(async () => {
+        if (req.url === "https://one.example.com/auth/device/token") {
+          refreshCalls += 1
+
+          if (refreshCalls === 1) {
+            await new Promise((resolve) => setTimeout(resolve, 25))
+            return json(req, {
+              access_token: "at_new",
+              refresh_token: "rt_new",
+              expires_in: 60,
+            })
+          }
+
+          return json(
+            req,
+            {
+              error: "invalid_grant",
+              error_description: "refresh token already used",
+            },
+            400,
+          )
+        }
+
+        if (req.url === "https://one.example.com/api/config") {
+          return json(req, { config: { theme: "light", seats: 5 } })
+        }
+
+        return json(req, {}, 404)
+      }),
+    )
+
+    const [cfg, token] = yield* AccountV2.Service.use((s) =>
+      Effect.all([s.config(id, AccountV2.OrgID.make("org-9")), s.token(id)], { concurrency: 2 }),
+    ).pipe(Effect.provide(live(client)))
+
+    expect(Option.getOrThrow(cfg)).toEqual({ theme: "light", seats: 5 })
+    expect(String(Option.getOrThrow(token))).toBe("at_new")
+    expect(refreshCalls).toBe(1)
+
+    const value = yield* row(id)
+    expect(value).toBeDefined()
+    if (!value) return
+    expect(value.access_token).toBe(AccountV2.AccessToken.make("at_new"))
+    expect(value.refresh_token).toBe(AccountV2.RefreshToken.make("rt_new"))
+  }),
+)
+
+it.live("config sends the selected org header", () =>
+  Effect.gen(function* () {
+    const id = AccountV2.ID.make("user-1")
+
+    yield* persist({
+      id,
+      email: "user@example.com",
+      url: "https://one.example.com",
+      accessToken: AccountV2.AccessToken.make("at_1"),
+      refreshToken: AccountV2.RefreshToken.make("rt_1"),
+      expiry: Date.now() + outsideEagerRefreshWindow,
+      orgID: Option.none(),
+    })
+
+    const seen: { auth?: string; org?: string } = {}
+    const client = HttpClient.make((req) =>
+      Effect.gen(function* () {
+        seen.auth = req.headers.authorization
+        seen.org = req.headers["x-org-id"]
+
+        if (req.url === "https://one.example.com/api/config") {
+          return json(req, { config: { theme: "light", seats: 5 } })
+        }
+
+        return json(req, {}, 404)
+      }),
+    )
+
+    const cfg = yield* AccountV2.Service.use((s) => s.config(id, AccountV2.OrgID.make("org-9"))).pipe(
+      Effect.provide(live(client)),
+    )
+
+    expect(Option.getOrThrow(cfg)).toEqual({ theme: "light", seats: 5 })
+    expect(seen).toEqual({
+      auth: "Bearer at_1",
+      org: "org-9",
+    })
+  }),
+)
+
+it.live("poll stores the account and first org on success", () =>
+  Effect.gen(function* () {
+    const client = HttpClient.make((req) =>
+      Effect.succeed(
+        req.url === "https://one.example.com/auth/device/token"
+          ? json(req, {
+              access_token: "at_1",
+              refresh_token: "rt_1",
+              token_type: "Bearer",
+              expires_in: 60,
+            })
+          : req.url === "https://one.example.com/api/user"
+            ? json(req, { id: "user-1", email: "user@example.com" })
+            : req.url === "https://one.example.com/api/orgs"
+              ? json(req, [org("org-1", "One")])
+              : json(req, {}, 404),
+      ),
+    )
+
+    const res = yield* AccountV2.Service.use((s) => s.poll(login())).pipe(Effect.provide(live(client)))
+
+    expect(res._tag).toBe("PollSuccess")
+    if (res._tag === "PollSuccess") {
+      expect(res.email).toBe("user@example.com")
+    }
+
+    const current = yield* active
+    expect(current).toEqual(
+      expect.objectContaining({
+        id: "user-1",
+        email: "user@example.com",
+        active_org_id: "org-1",
+      }),
+    )
+  }),
+)
+
+for (const [name, body, expectedTag] of [
+  [
+    "pending",
+    {
+      error: "authorization_pending",
+      error_description: "The authorization request is still pending",
+    },
+    "PollPending",
+  ],
+  [
+    "slow",
+    {
+      error: "slow_down",
+      error_description: "Polling too frequently, please slow down",
+    },
+    "PollSlow",
+  ],
+  [
+    "denied",
+    {
+      error: "access_denied",
+      error_description: "The authorization request was denied",
+    },
+    "PollDenied",
+  ],
+  [
+    "expired",
+    {
+      error: "expired_token",
+      error_description: "The device code has expired",
+    },
+    "PollExpired",
+  ],
+] as const) {
+  it.live(`poll returns ${name} for ${body.error}`, () =>
+    Effect.gen(function* () {
+      const result = yield* poll(body)
+      expect(result._tag).toBe(expectedTag)
+    }),
+  )
+}
+
+it.live("poll returns poll error for other OAuth errors", () =>
+  Effect.gen(function* () {
+    const result = yield* poll({
+      error: "server_error",
+      error_description: "An unexpected error occurred",
+    })
+
+    expect(result._tag).toBe("PollError")
+    if (result._tag === "PollError") {
+      expect(String(result.cause)).toContain("server_error")
+    }
+  }),
+)

packages/opencode/src/account/account.ts

@@ -1,459 +0,0 @@
-import { Cache, Clock, Duration, Effect, Layer, Option, Schema, SchemaGetter, Context } from "effect"
-import { serviceUse } from "@opencode-ai/core/effect/service-use"
-import {
-  FetchHttpClient,
-  HttpClient,
-  HttpClientError,
-  HttpClientRequest,
-  HttpClientResponse,
-} from "effect/unstable/http"
-
-import { withTransientReadRetry } from "@/util/effect-http-client"
-import { AccountRepo, type AccountRow } from "./repo"
-import { normalizeServerUrl } from "./url"
-import {
-  type AccountError,
-  AccessToken,
-  AccountID,
-  DeviceCode,
-  Info,
-  RefreshToken,
-  AccountServiceError,
-  AccountTransportError,
-  Login,
-  Org,
-  OrgID,
-  PollDenied,
-  PollError,
-  PollExpired,
-  PollPending,
-  type PollResult,
-  PollSlow,
-  PollSuccess,
-  UserCode,
-} from "./schema"
-
-export {
-  AccountID,
-  type AccountError,
-  AccountRepoError,
-  AccountServiceError,
-  AccountTransportError,
-  AccessToken,
-  RefreshToken,
-  DeviceCode,
-  UserCode,
-  Info,
-  Org,
-  OrgID,
-  Login,
-  PollSuccess,
-  PollPending,
-  PollSlow,
-  PollExpired,
-  PollDenied,
-  PollError,
-  PollResult,
-} from "./schema"
-
-export type AccountOrgs = {
-  account: Info
-  orgs: readonly Org[]
-}
-
-export type ActiveOrg = {
-  account: Info
-  org: Org
-}
-
-class RemoteConfig extends Schema.Class<RemoteConfig>("RemoteConfig")({
-  config: Schema.Record(Schema.String, Schema.Json),
-}) {}
-
-const DurationFromSeconds = Schema.Number.pipe(
-  Schema.decodeTo(Schema.Duration, {
-    decode: SchemaGetter.transform((n) => Duration.seconds(n)),
-    encode: SchemaGetter.transform((d) => Duration.toSeconds(d)),
-  }),
-)
-
-class TokenRefresh extends Schema.Class<TokenRefresh>("TokenRefresh")({
-  access_token: AccessToken,
-  refresh_token: RefreshToken,
-  expires_in: DurationFromSeconds,
-}) {}
-
-class DeviceAuth extends Schema.Class<DeviceAuth>("DeviceAuth")({
-  device_code: DeviceCode,
-  user_code: UserCode,
-  verification_uri_complete: Schema.String,
-  expires_in: DurationFromSeconds,
-  interval: DurationFromSeconds,
-}) {}
-
-class DeviceTokenSuccess extends Schema.Class<DeviceTokenSuccess>("DeviceTokenSuccess")({
-  access_token: AccessToken,
-  refresh_token: RefreshToken,
-  token_type: Schema.Literal("Bearer"),
-  expires_in: DurationFromSeconds,
-}) {}
-
-class DeviceTokenError extends Schema.Class<DeviceTokenError>("DeviceTokenError")({
-  error: Schema.String,
-  error_description: Schema.String,
-}) {
-  toPollResult(): PollResult {
-    if (this.error === "authorization_pending") return new PollPending()
-    if (this.error === "slow_down") return new PollSlow()
-    if (this.error === "expired_token") return new PollExpired()
-    if (this.error === "access_denied") return new PollDenied()
-    return new PollError({ cause: this.error })
-  }
-}
-
-const DeviceToken = Schema.Union([DeviceTokenSuccess, DeviceTokenError])
-
-class User extends Schema.Class<User>("User")({
-  id: AccountID,
-  email: Schema.String,
-}) {}
-
-class ClientId extends Schema.Class<ClientId>("ClientId")({ client_id: Schema.String }) {}
-
-class DeviceTokenRequest extends Schema.Class<DeviceTokenRequest>("DeviceTokenRequest")({
-  grant_type: Schema.String,
-  device_code: DeviceCode,
-  client_id: Schema.String,
-}) {}
-
-class TokenRefreshRequest extends Schema.Class<TokenRefreshRequest>("TokenRefreshRequest")({
-  grant_type: Schema.String,
-  refresh_token: RefreshToken,
-  client_id: Schema.String,
-}) {}
-
-const clientId = "opencode-cli"
-const eagerRefreshThreshold = Duration.minutes(5)
-const eagerRefreshThresholdMs = Duration.toMillis(eagerRefreshThreshold)
-
-const isTokenFresh = (tokenExpiry: number | null, now: number) =>
-  tokenExpiry != null && tokenExpiry > now + eagerRefreshThresholdMs
-
-const mapAccountServiceError =
-  (message = "Account service operation failed") =>
-  <A, E, R>(effect: Effect.Effect<A, E, R>): Effect.Effect<A, AccountError, R> =>
-    effect.pipe(Effect.mapError((cause) => accountErrorFromCause(cause, message)))
-
-const accountErrorFromCause = (cause: unknown, message: string): AccountError => {
-  if (cause instanceof AccountServiceError || cause instanceof AccountTransportError) {
-    return cause
-  }
-
-  if (HttpClientError.isHttpClientError(cause)) {
-    switch (cause.reason._tag) {
-      case "TransportError": {
-        return AccountTransportError.fromHttpClientError(cause.reason)
-      }
-      default: {
-        return new AccountServiceError({ message, cause })
-      }
-    }
-  }
-
-  return new AccountServiceError({ message, cause })
-}
-
-export interface Interface {
-  readonly active: () => Effect.Effect<Option.Option<Info>, AccountError>
-  readonly activeOrg: () => Effect.Effect<Option.Option<ActiveOrg>, AccountError>
-  readonly list: () => Effect.Effect<Info[], AccountError>
-  readonly orgsByAccount: () => Effect.Effect<readonly AccountOrgs[], AccountError>
-  readonly remove: (accountID: AccountID) => Effect.Effect<void, AccountError>
-  readonly use: (accountID: AccountID, orgID: Option.Option<OrgID>) => Effect.Effect<void, AccountError>
-  readonly orgs: (accountID: AccountID) => Effect.Effect<readonly Org[], AccountError>
-  readonly config: (
-    accountID: AccountID,
-    orgID: OrgID,
-  ) => Effect.Effect<Option.Option<Record<string, unknown>>, AccountError>
-  readonly token: (accountID: AccountID) => Effect.Effect<Option.Option<AccessToken>, AccountError>
-  readonly login: (url: string) => Effect.Effect<Login, AccountError>
-  readonly poll: (input: Login) => Effect.Effect<PollResult, AccountError>
-}
-
-export class Service extends Context.Service<Service, Interface>()("@opencode/Account") {}
-
-export const use = serviceUse(Service)
-
-export const layer: Layer.Layer<Service, never, AccountRepo.Service | HttpClient.HttpClient> = Layer.effect(
-  Service,
-  Effect.gen(function* () {
-    const repo = yield* AccountRepo.Service
-    const http = yield* HttpClient.HttpClient
-    const httpRead = withTransientReadRetry(http)
-    const httpOk = HttpClient.filterStatusOk(http)
-    const httpReadOk = HttpClient.filterStatusOk(httpRead)
-
-    const executeRead = (request: HttpClientRequest.HttpClientRequest) =>
-      httpRead.execute(request).pipe(mapAccountServiceError("HTTP request failed"))
-
-    const executeReadOk = (request: HttpClientRequest.HttpClientRequest) =>
-      httpReadOk.execute(request).pipe(mapAccountServiceError("HTTP request failed"))
-
-    const executeEffectOk = <E>(request: Effect.Effect<HttpClientRequest.HttpClientRequest, E>) =>
-      request.pipe(
-        Effect.flatMap((req) => httpOk.execute(req)),
-        mapAccountServiceError("HTTP request failed"),
-      )
-
-    const executeEffect = <E>(request: Effect.Effect<HttpClientRequest.HttpClientRequest, E>) =>
-      request.pipe(
-        Effect.flatMap((req) => http.execute(req)),
-        mapAccountServiceError("HTTP request failed"),
-      )
-
-    const refreshToken = Effect.fnUntraced(function* (row: AccountRow) {
-      const now = yield* Clock.currentTimeMillis
-
-      const response = yield* executeEffectOk(
-        HttpClientRequest.post(`${row.url}/auth/device/token`).pipe(
-          HttpClientRequest.acceptJson,
-          HttpClientRequest.schemaBodyJson(TokenRefreshRequest)(
-            new TokenRefreshRequest({
-              grant_type: "refresh_token",
-              refresh_token: row.refresh_token,
-              client_id: clientId,
-            }),
-          ),
-        ),
-      )
-
-      const parsed = yield* HttpClientResponse.schemaBodyJson(TokenRefresh)(response).pipe(
-        mapAccountServiceError("Failed to decode response"),
-      )
-
-      const expiry = Option.some(now + Duration.toMillis(parsed.expires_in))
-
-      yield* repo.persistToken({
-        accountID: row.id,
-        accessToken: parsed.access_token,
-        refreshToken: parsed.refresh_token,
-        expiry,
-      })
-
-      return parsed.access_token
-    })
-
-    const refreshTokenCache = yield* Cache.make<AccountID, AccessToken, AccountError>({
-      capacity: Number.POSITIVE_INFINITY,
-      timeToLive: Duration.zero,
-      lookup: Effect.fnUntraced(function* (accountID) {
-        const maybeAccount = yield* repo.getRow(accountID)
-        if (Option.isNone(maybeAccount)) {
-          return yield* Effect.fail(new AccountServiceError({ message: "Account not found during token refresh" }))
-        }
-
-        const account = maybeAccount.value
-        const now = yield* Clock.currentTimeMillis
-        if (isTokenFresh(account.token_expiry, now)) {
-          return account.access_token
-        }
-
-        return yield* refreshToken(account)
-      }),
-    })
-
-    const resolveToken = Effect.fnUntraced(function* (row: AccountRow) {
-      const now = yield* Clock.currentTimeMillis
-      if (isTokenFresh(row.token_expiry, now)) {
-        return row.access_token
-      }
-
-      return yield* Cache.get(refreshTokenCache, row.id)
-    })
-
-    const resolveAccess = Effect.fnUntraced(function* (accountID: AccountID) {
-      const maybeAccount = yield* repo.getRow(accountID)
-      if (Option.isNone(maybeAccount)) return Option.none()
-
-      const account = maybeAccount.value
-      const accessToken = yield* resolveToken(account)
-      return Option.some({ account, accessToken })
-    })
-
-    const fetchOrgs = Effect.fnUntraced(function* (url: string, accessToken: AccessToken) {
-      const response = yield* executeReadOk(
-        HttpClientRequest.get(`${url}/api/orgs`).pipe(
-          HttpClientRequest.acceptJson,
-          HttpClientRequest.bearerToken(accessToken),
-        ),
-      )
-
-      return yield* HttpClientResponse.schemaBodyJson(Schema.Array(Org))(response).pipe(
-        mapAccountServiceError("Failed to decode response"),
-      )
-    })
-
-    const fetchUser = Effect.fnUntraced(function* (url: string, accessToken: AccessToken) {
-      const response = yield* executeReadOk(
-        HttpClientRequest.get(`${url}/api/user`).pipe(
-          HttpClientRequest.acceptJson,
-          HttpClientRequest.bearerToken(accessToken),
-        ),
-      )
-
-      return yield* HttpClientResponse.schemaBodyJson(User)(response).pipe(
-        mapAccountServiceError("Failed to decode response"),
-      )
-    })
-
-    const token = Effect.fn("Account.token")((accountID: AccountID) =>
-      resolveAccess(accountID).pipe(Effect.map(Option.map((r) => r.accessToken))),
-    )
-
-    const activeOrg = Effect.fn("Account.activeOrg")(function* () {
-      const activeAccount = yield* repo.active()
-      if (Option.isNone(activeAccount)) return Option.none<ActiveOrg>()
-
-      const account = activeAccount.value
-      if (!account.active_org_id) return Option.none<ActiveOrg>()
-
-      const accountOrgs = yield* orgs(account.id)
-      const org = accountOrgs.find((item) => item.id === account.active_org_id)
-      if (!org) return Option.none<ActiveOrg>()
-
-      return Option.some({ account, org })
-    })
-
-    const orgsByAccount = Effect.fn("Account.orgsByAccount")(function* () {
-      const accounts = yield* repo.list()
-      return yield* Effect.forEach(
-        accounts,
-        (account) =>
-          orgs(account.id).pipe(
-            Effect.catch(() => Effect.succeed([] as readonly Org[])),
-            Effect.map((orgs) => ({ account, orgs })),
-          ),
-        { concurrency: 3 },
-      )
-    })
-
-    const orgs = Effect.fn("Account.orgs")(function* (accountID: AccountID) {
-      const resolved = yield* resolveAccess(accountID)
-      if (Option.isNone(resolved)) return []
-
-      const { account, accessToken } = resolved.value
-
-      return yield* fetchOrgs(account.url, accessToken)
-    })
-
-    const config = Effect.fn("Account.config")(function* (accountID: AccountID, orgID: OrgID) {
-      const resolved = yield* resolveAccess(accountID)
-      if (Option.isNone(resolved)) return Option.none()
-
-      const { account, accessToken } = resolved.value
-
-      const response = yield* executeRead(
-        HttpClientRequest.get(`${account.url}/api/config`).pipe(
-          HttpClientRequest.acceptJson,
-          HttpClientRequest.bearerToken(accessToken),
-          HttpClientRequest.setHeaders({ "x-org-id": orgID }),
-        ),
-      )
-
-      if (response.status === 404) return Option.none()
-
-      const ok = yield* HttpClientResponse.filterStatusOk(response).pipe(mapAccountServiceError())
-
-      const parsed = yield* HttpClientResponse.schemaBodyJson(RemoteConfig)(ok).pipe(
-        mapAccountServiceError("Failed to decode response"),
-      )
-      return Option.some(parsed.config)
-    })
-
-    const login = Effect.fn("Account.login")(function* (server: string) {
-      const normalizedServer = normalizeServerUrl(server)
-      const response = yield* executeEffectOk(
-        HttpClientRequest.post(`${normalizedServer}/auth/device/code`).pipe(
-          HttpClientRequest.acceptJson,
-          HttpClientRequest.schemaBodyJson(ClientId)(new ClientId({ client_id: clientId })),
-        ),
-      )
-
-      const parsed = yield* HttpClientResponse.schemaBodyJson(DeviceAuth)(response).pipe(
-        mapAccountServiceError("Failed to decode response"),
-      )
-      return new Login({
-        code: parsed.device_code,
-        user: parsed.user_code,
-        url: `${normalizedServer}${parsed.verification_uri_complete}`,
-        server: normalizedServer,
-        expiry: parsed.expires_in,
-        interval: parsed.interval,
-      })
-    })
-
-    const poll = Effect.fn("Account.poll")(function* (input: Login) {
-      const response = yield* executeEffect(
-        HttpClientRequest.post(`${input.server}/auth/device/token`).pipe(
-          HttpClientRequest.acceptJson,
-          HttpClientRequest.schemaBodyJson(DeviceTokenRequest)(
-            new DeviceTokenRequest({
-              grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-              device_code: input.code,
-              client_id: clientId,
-            }),
-          ),
-        ),
-      )
-
-      const parsed = yield* HttpClientResponse.schemaBodyJson(DeviceToken)(response).pipe(
-        mapAccountServiceError("Failed to decode response"),
-      )
-
-      if (parsed instanceof DeviceTokenError) return parsed.toPollResult()
-      const accessToken = parsed.access_token
-
-      const user = fetchUser(input.server, accessToken)
-      const orgs = fetchOrgs(input.server, accessToken)
-
-      const [account, remoteOrgs] = yield* Effect.all([user, orgs], { concurrency: 2 })
-
-      // TODO: When there are multiple orgs, let the user choose
-      const firstOrgID = remoteOrgs.length > 0 ? Option.some(remoteOrgs[0].id) : Option.none<OrgID>()
-
-      const now = yield* Clock.currentTimeMillis
-      const expiry = now + Duration.toMillis(parsed.expires_in)
-      const refreshToken = parsed.refresh_token
-
-      yield* repo.persistAccount({
-        id: account.id,
-        email: account.email,
-        url: input.server,
-        accessToken,
-        refreshToken,
-        expiry,
-        orgID: firstOrgID,
-      })
-
-      return new PollSuccess({ email: account.email })
-    })
-
-    return Service.of({
-      active: repo.active,
-      activeOrg,
-      list: repo.list,
-      orgsByAccount,
-      remove: repo.remove,
-      use: repo.use,
-      orgs,
-      config,
-      token,
-      login,
-      poll,
-    })
-  }),
-)
-
-export const defaultLayer = layer.pipe(Layer.provide(AccountRepo.defaultLayer), Layer.provide(FetchHttpClient.layer))
-
-export * as Account from "./account"

packages/opencode/src/account/repo.ts

@@ -1,170 +0,0 @@
-import { eq } from "drizzle-orm"
-import { serviceUse } from "@opencode-ai/core/effect/service-use"
-import { Effect, Layer, Option, Schema, Context } from "effect"
-
-import { Database } from "@opencode-ai/core/database/database"
-import { AccountStateTable, AccountTable } from "@opencode-ai/core/account/sql"
-import { AccessToken, AccountID, AccountRepoError, Info, OrgID, RefreshToken } from "./schema"
-import { normalizeServerUrl } from "./url"
-
-export type AccountRow = (typeof AccountTable)["$inferSelect"]
-
-const ACCOUNT_STATE_ID = 1
-
-export interface Interface {
-  readonly active: () => Effect.Effect<Option.Option<Info>, AccountRepoError>
-  readonly list: () => Effect.Effect<Info[], AccountRepoError>
-  readonly remove: (accountID: AccountID) => Effect.Effect<void, AccountRepoError>
-  readonly use: (accountID: AccountID, orgID: Option.Option<OrgID>) => Effect.Effect<void, AccountRepoError>
-  readonly getRow: (accountID: AccountID) => Effect.Effect<Option.Option<AccountRow>, AccountRepoError>
-  readonly persistToken: (input: {
-    accountID: AccountID
-    accessToken: AccessToken
-    refreshToken: RefreshToken
-    expiry: Option.Option<number>
-  }) => Effect.Effect<void, AccountRepoError>
-  readonly persistAccount: (input: {
-    id: AccountID
-    email: string
-    url: string
-    accessToken: AccessToken
-    refreshToken: RefreshToken
-    expiry: number
-    orgID: Option.Option<OrgID>
-  }) => Effect.Effect<void, AccountRepoError>
-}
-
-export class Service extends Context.Service<Service, Interface>()("@opencode/AccountRepo") {}
-
-export const use = serviceUse(Service)
-
-export const layer = Layer.effect(
-  Service,
-  Effect.gen(function* () {
-    const { db } = yield* Database.Service
-    const decode = Schema.decodeUnknownSync(Info)
-
-    const query = <A, E>(effect: Effect.Effect<A, E>) =>
-      effect.pipe(Effect.mapError((cause) => new AccountRepoError({ message: "Database operation failed", cause })))
-
-    const current = Effect.fnUntraced(function* () {
-      const state = yield* db.select().from(AccountStateTable).where(eq(AccountStateTable.id, ACCOUNT_STATE_ID)).get()
-      if (!state?.active_account_id) return
-      const account = yield* db.select().from(AccountTable).where(eq(AccountTable.id, state.active_account_id)).get()
-      if (!account) return
-      return { ...account, active_org_id: state.active_org_id ?? null }
-    })
-
-    const state = (accountID: AccountID, orgID: Option.Option<OrgID>) => {
-      const id = Option.getOrNull(orgID)
-      return db
-        .insert(AccountStateTable)
-        .values({ id: ACCOUNT_STATE_ID, active_account_id: accountID, active_org_id: id })
-        .onConflictDoUpdate({
-          target: AccountStateTable.id,
-          set: { active_account_id: accountID, active_org_id: id },
-        })
-        .run()
-    }
-
-    const active = Effect.fn("AccountRepo.active")(() =>
-      query(current()).pipe(Effect.map((row) => (row ? Option.some(decode(row)) : Option.none()))),
-    )
-
-    const list = Effect.fn("AccountRepo.list")(() =>
-      query(
-        db
-          .select()
-          .from(AccountTable)
-          .all()
-          .pipe(Effect.map((rows) => rows.map((row: AccountRow) => decode({ ...row, active_org_id: null })))),
-      ),
-    )
-
-    const remove = Effect.fn("AccountRepo.remove")((accountID: AccountID) =>
-      query(
-        db.transaction((tx) =>
-          Effect.gen(function* () {
-            yield* tx
-              .update(AccountStateTable)
-              .set({ active_account_id: null, active_org_id: null })
-              .where(eq(AccountStateTable.active_account_id, accountID))
-              .run()
-            yield* tx.delete(AccountTable).where(eq(AccountTable.id, accountID)).run()
-          }),
-        ),
-      ).pipe(Effect.asVoid),
-    )
-
-    const use = Effect.fn("AccountRepo.use")((accountID: AccountID, orgID: Option.Option<OrgID>) =>
-      query(state(accountID, orgID)).pipe(Effect.asVoid),
-    )
-
-    const getRow = Effect.fn("AccountRepo.getRow")((accountID: AccountID) =>
-      query(db.select().from(AccountTable).where(eq(AccountTable.id, accountID)).get()).pipe(
-        Effect.map(Option.fromNullishOr),
-      ),
-    )
-
-    const persistToken = Effect.fn("AccountRepo.persistToken")((input) =>
-      query(
-        db
-          .update(AccountTable)
-          .set({
-            access_token: input.accessToken,
-            refresh_token: input.refreshToken,
-            token_expiry: Option.getOrNull(input.expiry),
-          })
-          .where(eq(AccountTable.id, input.accountID))
-          .run(),
-      ).pipe(Effect.asVoid),
-    )
-
-    const persistAccount = Effect.fn("AccountRepo.persistAccount")((input) =>
-      query(
-        db.transaction((tx) =>
-          Effect.gen(function* () {
-            const url = normalizeServerUrl(input.url)
-
-            yield* tx
-              .insert(AccountTable)
-              .values({
-                id: input.id,
-                email: input.email,
-                url,
-                access_token: input.accessToken,
-                refresh_token: input.refreshToken,
-                token_expiry: input.expiry,
-              })
-              .onConflictDoUpdate({
-                target: AccountTable.id,
-                set: {
-                  email: input.email,
-                  url,
-                  access_token: input.accessToken,
-                  refresh_token: input.refreshToken,
-                  token_expiry: input.expiry,
-                },
-              })
-              .run()
-            yield* state(input.id, input.orgID)
-          }),
-        ),
-      ).pipe(Effect.asVoid),
-    )
-
-    return Service.of({
-      active,
-      list,
-      remove,
-      use,
-      getRow,
-      persistToken,
-      persistAccount,
-    })
-  }),
-)
-
-export const defaultLayer = layer.pipe(Layer.provide(Database.defaultLayer))
-
-export * as AccountRepo from "./repo"

packages/opencode/src/account/schema.ts

@@ -1,99 +0,0 @@
-import { Schema } from "effect"
-import type * as HttpClientError from "effect/unstable/http/HttpClientError"
-
-export const AccountID = Schema.String.pipe(Schema.brand("AccountID"))
-export type AccountID = Schema.Schema.Type<typeof AccountID>
-
-export const OrgID = Schema.String.pipe(Schema.brand("OrgID"))
-export type OrgID = Schema.Schema.Type<typeof OrgID>
-
-export const AccessToken = Schema.String.pipe(Schema.brand("AccessToken"))
-export type AccessToken = Schema.Schema.Type<typeof AccessToken>
-
-export const RefreshToken = Schema.String.pipe(Schema.brand("RefreshToken"))
-export type RefreshToken = Schema.Schema.Type<typeof RefreshToken>
-
-export const DeviceCode = Schema.String.pipe(Schema.brand("DeviceCode"))
-export type DeviceCode = Schema.Schema.Type<typeof DeviceCode>
-
-export const UserCode = Schema.String.pipe(Schema.brand("UserCode"))
-export type UserCode = Schema.Schema.Type<typeof UserCode>
-
-export class Info extends Schema.Class<Info>("Account")({
-  id: AccountID,
-  email: Schema.String,
-  url: Schema.String,
-  active_org_id: Schema.NullOr(OrgID),
-}) {}
-
-export class Org extends Schema.Class<Org>("Org")({
-  id: OrgID,
-  name: Schema.String,
-}) {}
-
-export class AccountRepoError extends Schema.TaggedErrorClass<AccountRepoError>()("AccountRepoError", {
-  message: Schema.String,
-  cause: Schema.optional(Schema.Defect),
-}) {}
-
-export class AccountServiceError extends Schema.TaggedErrorClass<AccountServiceError>()("AccountServiceError", {
-  message: Schema.String,
-  cause: Schema.optional(Schema.Defect),
-}) {}
-
-export class AccountTransportError extends Schema.TaggedErrorClass<AccountTransportError>()("AccountTransportError", {
-  method: Schema.String,
-  url: Schema.String,
-  description: Schema.optional(Schema.String),
-  cause: Schema.optional(Schema.Defect),
-}) {
-  static fromHttpClientError(error: HttpClientError.TransportError): AccountTransportError {
-    return new AccountTransportError({
-      method: error.request.method,
-      url: error.request.url,
-      description: error.description,
-      cause: error.cause,
-    })
-  }
-
-  override get message(): string {
-    return [
-      `Could not reach ${this.method} ${this.url}.`,
-      `This failed before the server returned an HTTP response.`,
-      this.description,
-      `Check your network, proxy, or VPN configuration and try again.`,
-    ]
-      .filter(Boolean)
-      .join("\n")
-  }
-}
-
-export type AccountError = AccountRepoError | AccountServiceError | AccountTransportError
-
-export class Login extends Schema.Class<Login>("Login")({
-  code: DeviceCode,
-  user: UserCode,
-  url: Schema.String,
-  server: Schema.String,
-  expiry: Schema.Duration,
-  interval: Schema.Duration,
-}) {}
-
-export class PollSuccess extends Schema.TaggedClass<PollSuccess>()("PollSuccess", {
-  email: Schema.String,
-}) {}
-
-export class PollPending extends Schema.TaggedClass<PollPending>()("PollPending", {}) {}
-
-export class PollSlow extends Schema.TaggedClass<PollSlow>()("PollSlow", {}) {}
-
-export class PollExpired extends Schema.TaggedClass<PollExpired>()("PollExpired", {}) {}
-
-export class PollDenied extends Schema.TaggedClass<PollDenied>()("PollDenied", {}) {}
-
-export class PollError extends Schema.TaggedClass<PollError>()("PollError", {
-  cause: Schema.Defect,
-}) {}
-
-export const PollResult = Schema.Union([PollSuccess, PollPending, PollSlow, PollExpired, PollDenied, PollError])
-export type PollResult = Schema.Schema.Type<typeof PollResult>

packages/opencode/src/account/url.ts

@@ -1,8 +0,0 @@
-export const normalizeServerUrl = (input: string): string => {
-  const url = new URL(input)
-  url.search = ""
-  url.hash = ""
-
-  const pathname = url.pathname.replace(/\/+$/, "")
-  return pathname.length === 0 ? url.origin : `${url.origin}${pathname}`
-}

packages/opencode/src/cli/cmd/account.ts

@@ -1,8 +1,7 @@
 import { cmd } from "./cmd"
 import { Duration, Effect, Match, Option } from "effect"
 import { UI } from "../ui"
-import { Account } from "@/account/account"
-import { AccountID, OrgID, PollExpired, type PollResult, type AccountError } from "@/account/schema"
+import { AccountV2 } from "@opencode-ai/core/account"
 import { effectCmd } from "../effect-cmd"
 import * as Prompt from "../effect/prompt"
 import open from "open"
@@ -34,12 +33,12 @@ export const formatOrgLine = (
 }
 
 const isActiveOrgChoice = (
-  active: Option.Option<{ id: AccountID; active_org_id: OrgID | null }>,
-  choice: { accountID: AccountID; orgID: OrgID },
+  active: Option.Option<{ id: AccountV2.ID; active_org_id: AccountV2.OrgID | null }>,
+  choice: { accountID: AccountV2.ID; orgID: AccountV2.OrgID },
 ) => Option.isSome(active) && active.value.id === choice.accountID && active.value.active_org_id === choice.orgID
 
 const loginEffect = Effect.fn("login")(function* (url: string) {
-  const service = yield* Account.Service
+  const service = yield* AccountV2.Service
 
   yield* Prompt.intro("Log in")
   const login = yield* service.login(url)
@@ -51,7 +50,7 @@ const loginEffect = Effect.fn("login")(function* (url: string) {
   const s = Prompt.spinner()
   yield* s.start("Waiting for authorization...")
 
-  const poll = (wait: Duration.Duration): Effect.Effect<PollResult, AccountError> =>
+  const poll = (wait: Duration.Duration): Effect.Effect<AccountV2.PollResult, AccountV2.AccountError> =>
     Effect.gen(function* () {
       yield* Effect.sleep(wait)
       const result = yield* service.poll(login)
@@ -62,7 +61,7 @@ const loginEffect = Effect.fn("login")(function* (url: string) {
 
   const result = yield* poll(login.interval).pipe(
     Effect.timeout(login.expiry),
-    Effect.catchTag("TimeoutError", () => Effect.succeed(new PollExpired())),
+    Effect.catchTag("TimeoutError", () => Effect.succeed(new AccountV2.PollExpired())),
   )
 
   yield* Match.valueTags(result, {
@@ -80,7 +79,7 @@ const loginEffect = Effect.fn("login")(function* (url: string) {
 })
 
 const logoutEffect = Effect.fn("logout")(function* (email?: string) {
-  const service = yield* Account.Service
+  const service = yield* AccountV2.Service
   const accounts = yield* service.list()
   if (accounts.length === 0) return yield* println("Not logged in")
 
@@ -113,13 +112,13 @@ const logoutEffect = Effect.fn("logout")(function* (email?: string) {
 })
 
 interface OrgChoice {
-  orgID: OrgID
-  accountID: AccountID
+  orgID: AccountV2.OrgID
+  accountID: AccountV2.ID
   label: string
 }
 
 const switchEffect = Effect.fn("switch")(function* () {
-  const service = yield* Account.Service
+  const service = yield* AccountV2.Service
 
   const groups = yield* service.orgsByAccount()
   if (groups.length === 0) return yield* println("Not logged in")
@@ -148,7 +147,7 @@ const switchEffect = Effect.fn("switch")(function* () {
 })
 
 const orgsEffect = Effect.fn("orgs")(function* () {
-  const service = yield* Account.Service
+  const service = yield* AccountV2.Service
 
   const groups = yield* service.orgsByAccount()
   if (groups.length === 0) return yield* println("No accounts found")
@@ -165,7 +164,7 @@ const orgsEffect = Effect.fn("orgs")(function* () {
 })
 
 const openEffect = Effect.fn("open")(function* () {
-  const service = yield* Account.Service
+  const service = yield* AccountV2.Service
   const active = yield* service.active()
   if (Option.isNone(active)) return yield* println("No active account")
 

packages/opencode/src/config/config.ts

@@ -12,7 +12,7 @@ import { Env } from "../env"
 import { applyEdits, modify } from "jsonc-parser"
 import { InstallationLocal, InstallationVersion } from "@opencode-ai/core/installation/version"
 import { existsSync } from "fs"
-import { Account } from "@/account/account"
+import { AccountV2 } from "@opencode-ai/core/account"
 import { isRecord } from "@/util/record"
 import type { ConsoleState } from "@opencode-ai/core/v1/config/console-state"
 import { FSUtil } from "@opencode-ai/core/fs-util"
@@ -178,7 +178,7 @@ export const layer = Layer.effect(
   Effect.gen(function* () {
     const fs = yield* FSUtil.Service
     const authSvc = yield* Auth.Service
-    const accountSvc = yield* Account.Service
+    const accountSvc = yield* AccountV2.Service
     const env = yield* Env.Service
     const npmSvc = yield* Npm.Service
     const http = yield* HttpClient.HttpClient
@@ -671,7 +671,7 @@ export const defaultLayer = layer.pipe(
   Layer.provide(FSUtil.defaultLayer),
   Layer.provide(Env.defaultLayer),
   Layer.provide(Auth.defaultLayer),
-  Layer.provide(Account.defaultLayer),
+  Layer.provide(AccountV2.defaultLayer),
   Layer.provide(Npm.defaultLayer),
   Layer.provide(FetchHttpClient.layer),
 )

packages/opencode/src/effect/app-runtime.ts

@@ -5,7 +5,7 @@ import * as Observability from "@opencode-ai/core/effect/observability"
 import { FSUtil } from "@opencode-ai/core/fs-util"
 import { Database } from "@opencode-ai/core/database/database"
 import { Auth } from "@/auth"
-import { Account } from "@/account/account"
+import { AccountV2 } from "@opencode-ai/core/account"
 import { Config } from "@/config/config"
 import { Git } from "@/git"
 import { Ripgrep } from "@opencode-ai/core/filesystem/ripgrep"
@@ -58,7 +58,7 @@ export const AppLayer = Layer.mergeAll(
   FSUtil.defaultLayer,
   Database.defaultLayer,
   Auth.defaultLayer,
-  Account.defaultLayer,
+  AccountV2.defaultLayer,
   Config.defaultLayer,
   Git.defaultLayer,
   Ripgrep.defaultLayer,

packages/opencode/src/server/routes/instance/httpapi/groups/experimental.ts

@@ -1,4 +1,4 @@
-import { AccountID, OrgID } from "@/account/schema"
+import { AccountV2 } from "@opencode-ai/core/account"
 import { MCP } from "@/mcp"
 
 import { Session } from "@/session/session"
@@ -38,8 +38,8 @@ const ConsoleOrgList = Schema.Struct({
 })
 
 export const ConsoleSwitchPayload = Schema.Struct({
-  accountID: AccountID,
-  orgID: OrgID,
+  accountID: AccountV2.ID,
+  orgID: AccountV2.OrgID,
 })
 
 const ToolIDs = Schema.Array(Schema.String).annotate({ identifier: "ToolIDs" })

packages/opencode/src/server/routes/instance/httpapi/handlers/experimental.ts

@@ -1,4 +1,4 @@
-import { Account } from "@/account/account"
+import { AccountV2 } from "@opencode-ai/core/account"
 import { Agent } from "@/agent/agent"
 import { Config } from "@/config/config"
 import { InstanceState } from "@/effect/instance-state"
@@ -22,7 +22,7 @@ function mapWorktreeError<A, R>(self: Effect.Effect<A, Worktree.Error, R>) {
 
 export const experimentalHandlers = HttpApiBuilder.group(InstanceHttpApi, "experimental", (handlers) =>
   Effect.gen(function* () {
-    const account = yield* Account.Service
+    const account = yield* AccountV2.Service
     const agents = yield* Agent.Service
     const config = yield* Config.Service
     const mcp = yield* MCP.Service

packages/opencode/src/server/routes/instance/httpapi/server.ts

@@ -9,8 +9,8 @@ import {
   HttpServerResponse,
 } from "effect/unstable/http"
 import * as Socket from "effect/unstable/socket/Socket"
+import { AccountV2 } from "@opencode-ai/core/account"
 import { FSUtil } from "@opencode-ai/core/fs-util"
-import { Account } from "@/account/account"
 import { Agent } from "@/agent/agent"
 import { Auth } from "@/auth"
 import { Config } from "@/config/config"
@@ -208,7 +208,7 @@ export function createRoutes(
       fenceLayer.pipe(Layer.provide(Database.defaultLayer)),
       cors(corsOptions),
       Database.defaultLayer,
-      Account.defaultLayer,
+      AccountV2.defaultLayer,
       Agent.defaultLayer,
       Auth.defaultLayer,
       Command.defaultLayer,

packages/opencode/src/share/share-next.ts

@@ -2,7 +2,7 @@ import type * as SDK from "@opencode-ai/sdk/v2"
 import { serviceUse } from "@opencode-ai/core/effect/service-use"
 import { Effect, Exit, Layer, Option, Schema, Scope, Context, Stream } from "effect"
 import { FetchHttpClient, HttpClient, HttpClientRequest, HttpClientResponse } from "effect/unstable/http"
-import { Account } from "@/account/account"
+import { AccountV2 } from "@opencode-ai/core/account"
 import { EventV2Bridge } from "@/event-v2-bridge"
 import { InstanceState } from "@/effect/instance-state"
 import { Provider } from "@/provider/provider"
@@ -112,7 +112,7 @@ function key(item: Data) {
 export const layer = Layer.effect(
   Service,
   Effect.gen(function* () {
-    const account = yield* Account.Service
+    const account = yield* AccountV2.Service
     const events = yield* EventV2Bridge.Service
     const cfg = yield* Config.Service
     const { db } = yield* Database.Service
@@ -368,7 +368,7 @@ export const layer = Layer.effect(
 
 export const defaultLayer = layer.pipe(
   Layer.provide(EventV2Bridge.defaultLayer),
-  Layer.provide(Account.defaultLayer),
+  Layer.provide(AccountV2.defaultLayer),
   Layer.provide(Config.defaultLayer),
   Layer.provide(Database.defaultLayer),
   Layer.provide(FetchHttpClient.layer),

packages/opencode/test/account/repo.test.ts

@@ -1,353 +0,0 @@
-import { expect } from "bun:test"
-import { Effect, Layer, Option } from "effect"
-import { sql } from "drizzle-orm"
-
-import { AccountRepo } from "../../src/account/repo"
-import { AccessToken, AccountID, OrgID, RefreshToken } from "../../src/account/schema"
-import { Database } from "@opencode-ai/core/database/database"
-import { testEffect } from "../lib/effect"
-
-const truncate = Layer.effectDiscard(
-  Effect.gen(function* () {
-    const { db } = yield* Database.Service
-    yield* db.run(sql`DELETE FROM account_state`)
-    yield* db.run(sql`DELETE FROM account`)
-  }),
-).pipe(Layer.provide(Database.defaultLayer))
-
-const it = testEffect(Layer.merge(AccountRepo.defaultLayer, truncate))
-
-it.live("list returns empty when no accounts exist", () =>
-  Effect.gen(function* () {
-    const accounts = yield* AccountRepo.use.list()
-    expect(accounts).toEqual([])
-  }),
-)
-
-it.live("active returns none when no accounts exist", () =>
-  Effect.gen(function* () {
-    const active = yield* AccountRepo.use.active()
-    expect(Option.isNone(active)).toBe(true)
-  }),
-)
-
-it.live("persistAccount inserts and getRow retrieves", () =>
-  Effect.gen(function* () {
-    const id = AccountID.make("user-1")
-    yield* AccountRepo.Service.use((r) =>
-      r.persistAccount({
-        id,
-        email: "test@example.com",
-        url: "https://control.example.com",
-        accessToken: AccessToken.make("at_123"),
-        refreshToken: RefreshToken.make("rt_456"),
-        expiry: Date.now() + 3600_000,
-        orgID: Option.some(OrgID.make("org-1")),
-      }),
-    )
-
-    const row = yield* AccountRepo.use.getRow(id)
-    expect(Option.isSome(row)).toBe(true)
-    const value = Option.getOrThrow(row)
-    expect(value.id).toBe(AccountID.make("user-1"))
-    expect(value.email).toBe("test@example.com")
-
-    const active = yield* AccountRepo.use.active()
-    expect(Option.getOrThrow(active).active_org_id).toBe(OrgID.make("org-1"))
-  }),
-)
-
-it.live("persistAccount normalizes trailing slashes in stored server URLs", () =>
-  Effect.gen(function* () {
-    const id = AccountID.make("user-1")
-
-    yield* AccountRepo.Service.use((r) =>
-      r.persistAccount({
-        id,
-        email: "test@example.com",
-        url: "https://control.example.com/",
-        accessToken: AccessToken.make("at_123"),
-        refreshToken: RefreshToken.make("rt_456"),
-        expiry: Date.now() + 3600_000,
-        orgID: Option.none(),
-      }),
-    )
-
-    const row = yield* AccountRepo.use.getRow(id)
-    const active = yield* AccountRepo.use.active()
-    const list = yield* AccountRepo.use.list()
-
-    expect(Option.getOrThrow(row).url).toBe("https://control.example.com")
-    expect(Option.getOrThrow(active).url).toBe("https://control.example.com")
-    expect(list[0]?.url).toBe("https://control.example.com")
-  }),
-)
-
-it.live("persistAccount sets the active account and org", () =>
-  Effect.gen(function* () {
-    const id1 = AccountID.make("user-1")
-    const id2 = AccountID.make("user-2")
-
-    yield* AccountRepo.Service.use((r) =>
-      r.persistAccount({
-        id: id1,
-        email: "first@example.com",
-        url: "https://control.example.com",
-        accessToken: AccessToken.make("at_1"),
-        refreshToken: RefreshToken.make("rt_1"),
-        expiry: Date.now() + 3600_000,
-        orgID: Option.some(OrgID.make("org-1")),
-      }),
-    )
-
-    yield* AccountRepo.Service.use((r) =>
-      r.persistAccount({
-        id: id2,
-        email: "second@example.com",
-        url: "https://control.example.com",
-        accessToken: AccessToken.make("at_2"),
-        refreshToken: RefreshToken.make("rt_2"),
-        expiry: Date.now() + 3600_000,
-        orgID: Option.some(OrgID.make("org-2")),
-      }),
-    )
-
-    // Last persisted account is active with its org
-    const active = yield* AccountRepo.use.active()
-    expect(Option.isSome(active)).toBe(true)
-    expect(Option.getOrThrow(active).id).toBe(AccountID.make("user-2"))
-    expect(Option.getOrThrow(active).active_org_id).toBe(OrgID.make("org-2"))
-  }),
-)
-
-it.live("list returns all accounts", () =>
-  Effect.gen(function* () {
-    const id1 = AccountID.make("user-1")
-    const id2 = AccountID.make("user-2")
-
-    yield* AccountRepo.Service.use((r) =>
-      r.persistAccount({
-        id: id1,
-        email: "a@example.com",
-        url: "https://control.example.com",
-        accessToken: AccessToken.make("at_1"),
-        refreshToken: RefreshToken.make("rt_1"),
-        expiry: Date.now() + 3600_000,
-        orgID: Option.none(),
-      }),
-    )
-
-    yield* AccountRepo.Service.use((r) =>
-      r.persistAccount({
-        id: id2,
-        email: "b@example.com",
-        url: "https://control.example.com",
-        accessToken: AccessToken.make("at_2"),
-        refreshToken: RefreshToken.make("rt_2"),
-        expiry: Date.now() + 3600_000,
-        orgID: Option.some(OrgID.make("org-1")),
-      }),
-    )
-
-    const accounts = yield* AccountRepo.use.list()
-    expect(accounts.length).toBe(2)
-    expect(accounts.map((a) => a.email).sort()).toEqual(["a@example.com", "b@example.com"])
-  }),
-)
-
-it.live("remove deletes an account", () =>
-  Effect.gen(function* () {
-    const id = AccountID.make("user-1")
-
-    yield* AccountRepo.Service.use((r) =>
-      r.persistAccount({
-        id,
-        email: "test@example.com",
-        url: "https://control.example.com",
-        accessToken: AccessToken.make("at_1"),
-        refreshToken: RefreshToken.make("rt_1"),
-        expiry: Date.now() + 3600_000,
-        orgID: Option.none(),
-      }),
-    )
-
-    yield* AccountRepo.use.remove(id)
-
-    const row = yield* AccountRepo.use.getRow(id)
-    expect(Option.isNone(row)).toBe(true)
-  }),
-)
-
-it.live("use stores the selected org and marks the account active", () =>
-  Effect.gen(function* () {
-    const id1 = AccountID.make("user-1")
-    const id2 = AccountID.make("user-2")
-
-    yield* AccountRepo.Service.use((r) =>
-      r.persistAccount({
-        id: id1,
-        email: "first@example.com",
-        url: "https://control.example.com",
-        accessToken: AccessToken.make("at_1"),
-        refreshToken: RefreshToken.make("rt_1"),
-        expiry: Date.now() + 3600_000,
-        orgID: Option.none(),
-      }),
-    )
-
-    yield* AccountRepo.Service.use((r) =>
-      r.persistAccount({
-        id: id2,
-        email: "second@example.com",
-        url: "https://control.example.com",
-        accessToken: AccessToken.make("at_2"),
-        refreshToken: RefreshToken.make("rt_2"),
-        expiry: Date.now() + 3600_000,
-        orgID: Option.none(),
-      }),
-    )
-
-    yield* AccountRepo.Service.use((r) => r.use(id1, Option.some(OrgID.make("org-99"))))
-    const active1 = yield* AccountRepo.use.active()
-    expect(Option.getOrThrow(active1).id).toBe(id1)
-    expect(Option.getOrThrow(active1).active_org_id).toBe(OrgID.make("org-99"))
-
-    yield* AccountRepo.Service.use((r) => r.use(id1, Option.none()))
-    const active2 = yield* AccountRepo.use.active()
-    expect(Option.getOrThrow(active2).active_org_id).toBeNull()
-  }),
-)
-
-it.live("persistToken updates token fields", () =>
-  Effect.gen(function* () {
-    const id = AccountID.make("user-1")
-
-    yield* AccountRepo.Service.use((r) =>
-      r.persistAccount({
-        id,
-        email: "test@example.com",
-        url: "https://control.example.com",
-        accessToken: AccessToken.make("old_token"),
-        refreshToken: RefreshToken.make("old_refresh"),
-        expiry: 1000,
-        orgID: Option.none(),
-      }),
-    )
-
-    const expiry = Date.now() + 7200_000
-    yield* AccountRepo.Service.use((r) =>
-      r.persistToken({
-        accountID: id,
-        accessToken: AccessToken.make("new_token"),
-        refreshToken: RefreshToken.make("new_refresh"),
-        expiry: Option.some(expiry),
-      }),
-    )
-
-    const row = yield* AccountRepo.use.getRow(id)
-    const value = Option.getOrThrow(row)
-    expect(value.access_token).toBe(AccessToken.make("new_token"))
-    expect(value.refresh_token).toBe(RefreshToken.make("new_refresh"))
-    expect(value.token_expiry).toBe(expiry)
-  }),
-)
-
-it.live("persistToken with no expiry sets token_expiry to null", () =>
-  Effect.gen(function* () {
-    const id = AccountID.make("user-1")
-
-    yield* AccountRepo.Service.use((r) =>
-      r.persistAccount({
-        id,
-        email: "test@example.com",
-        url: "https://control.example.com",
-        accessToken: AccessToken.make("old_token"),
-        refreshToken: RefreshToken.make("old_refresh"),
-        expiry: 1000,
-        orgID: Option.none(),
-      }),
-    )
-
-    yield* AccountRepo.Service.use((r) =>
-      r.persistToken({
-        accountID: id,
-        accessToken: AccessToken.make("new_token"),
-        refreshToken: RefreshToken.make("new_refresh"),
-        expiry: Option.none(),
-      }),
-    )
-
-    const row = yield* AccountRepo.use.getRow(id)
-    expect(Option.getOrThrow(row).token_expiry).toBeNull()
-  }),
-)
-
-it.live("persistAccount upserts on conflict", () =>
-  Effect.gen(function* () {
-    const id = AccountID.make("user-1")
-
-    yield* AccountRepo.Service.use((r) =>
-      r.persistAccount({
-        id,
-        email: "test@example.com",
-        url: "https://control.example.com",
-        accessToken: AccessToken.make("at_v1"),
-        refreshToken: RefreshToken.make("rt_v1"),
-        expiry: 1000,
-        orgID: Option.some(OrgID.make("org-1")),
-      }),
-    )
-
-    yield* AccountRepo.Service.use((r) =>
-      r.persistAccount({
-        id,
-        email: "test@example.com",
-        url: "https://control.example.com",
-        accessToken: AccessToken.make("at_v2"),
-        refreshToken: RefreshToken.make("rt_v2"),
-        expiry: 2000,
-        orgID: Option.some(OrgID.make("org-2")),
-      }),
-    )
-
-    const accounts = yield* AccountRepo.use.list()
-    expect(accounts.length).toBe(1)
-
-    const row = yield* AccountRepo.use.getRow(id)
-    const value = Option.getOrThrow(row)
-    expect(value.access_token).toBe(AccessToken.make("at_v2"))
-
-    const active = yield* AccountRepo.use.active()
-    expect(Option.getOrThrow(active).active_org_id).toBe(OrgID.make("org-2"))
-  }),
-)
-
-it.live("remove clears active state when deleting the active account", () =>
-  Effect.gen(function* () {
-    const id = AccountID.make("user-1")
-
-    yield* AccountRepo.Service.use((r) =>
-      r.persistAccount({
-        id,
-        email: "test@example.com",
-        url: "https://control.example.com",
-        accessToken: AccessToken.make("at_1"),
-        refreshToken: RefreshToken.make("rt_1"),
-        expiry: Date.now() + 3600_000,
-        orgID: Option.some(OrgID.make("org-1")),
-      }),
-    )
-
-    yield* AccountRepo.use.remove(id)
-
-    const active = yield* AccountRepo.use.active()
-    expect(Option.isNone(active)).toBe(true)
-  }),
-)
-
-it.live("getRow returns none for nonexistent account", () =>
-  Effect.gen(function* () {
-    const row = yield* AccountRepo.Service.use((r) => r.getRow(AccountID.make("nope")))
-    expect(Option.isNone(row)).toBe(true)
-  }),
-)

packages/opencode/test/account/service.test.ts

@@ -1,453 +0,0 @@
-import { expect } from "bun:test"
-import { Duration, Effect, Layer, Option, Schema } from "effect"
-import { sql } from "drizzle-orm"
-import { HttpClient, HttpClientError, HttpClientResponse } from "effect/unstable/http"
-
-import { AccountRepo } from "../../src/account/repo"
-import { Account } from "../../src/account/account"
-import {
-  AccessToken,
-  AccountID,
-  AccountTransportError,
-  DeviceCode,
-  Login,
-  Org,
-  OrgID,
-  RefreshToken,
-  UserCode,
-} from "../../src/account/schema"
-import { Database } from "@opencode-ai/core/database/database"
-import { testEffect } from "../lib/effect"
-
-const truncate = Layer.effectDiscard(
-  Effect.gen(function* () {
-    const { db } = yield* Database.Service
-    yield* db.run(sql`DELETE FROM account_state`)
-    yield* db.run(sql`DELETE FROM account`)
-  }),
-).pipe(Layer.provide(Database.defaultLayer))
-
-const it = testEffect(Layer.merge(AccountRepo.defaultLayer, truncate))
-
-const insideEagerRefreshWindow = Duration.toMillis(Duration.minutes(1))
-const outsideEagerRefreshWindow = Duration.toMillis(Duration.minutes(10))
-
-const live = (client: HttpClient.HttpClient) =>
-  Account.layer.pipe(Layer.provide(Layer.succeed(HttpClient.HttpClient, client)))
-
-const json = (req: Parameters<typeof HttpClientResponse.fromWeb>[0], body: unknown, status = 200) =>
-  HttpClientResponse.fromWeb(
-    req,
-    new Response(JSON.stringify(body), {
-      status,
-      headers: { "content-type": "application/json" },
-    }),
-  )
-
-const encodeOrg = Schema.encodeSync(Org)
-
-const org = (id: string, name: string) => encodeOrg(new Org({ id: OrgID.make(id), name }))
-
-const login = () =>
-  new Login({
-    code: DeviceCode.make("device-code"),
-    user: UserCode.make("user-code"),
-    url: "https://one.example.com/verify",
-    server: "https://one.example.com",
-    expiry: Duration.seconds(600),
-    interval: Duration.seconds(5),
-  })
-
-const deviceTokenClient = (body: unknown, status = 400) =>
-  HttpClient.make((req) =>
-    Effect.succeed(
-      req.url === "https://one.example.com/auth/device/token" ? json(req, body, status) : json(req, {}, 404),
-    ),
-  )
-
-const poll = (body: unknown, status = 400) =>
-  Account.Service.use((s) => s.poll(login())).pipe(Effect.provide(live(deviceTokenClient(body, status))))
-
-it.live("login normalizes trailing slashes in the provided server URL", () =>
-  Effect.gen(function* () {
-    const seen: Array<string> = []
-    const client = HttpClient.make((req) =>
-      Effect.gen(function* () {
-        seen.push(`${req.method} ${req.url}`)
-
-        if (req.url === "https://one.example.com/auth/device/code") {
-          return json(req, {
-            device_code: "device-code",
-            user_code: "user-code",
-            verification_uri_complete: "/device?user_code=user-code",
-            expires_in: 600,
-            interval: 5,
-          })
-        }
-
-        return json(req, {}, 404)
-      }),
-    )
-
-    const result = yield* Account.use.login("https://one.example.com/").pipe(Effect.provide(live(client)))
-
-    expect(seen).toEqual(["POST https://one.example.com/auth/device/code"])
-    expect(result.server).toBe("https://one.example.com")
-    expect(result.url).toBe("https://one.example.com/device?user_code=user-code")
-  }),
-)
-
-it.live("login maps transport failures to account transport errors", () =>
-  Effect.gen(function* () {
-    const client = HttpClient.make((req) =>
-      Effect.fail(
-        new HttpClientError.HttpClientError({
-          reason: new HttpClientError.TransportError({ request: req }),
-        }),
-      ),
-    )
-
-    const error = yield* Effect.flip(Account.use.login("https://one.example.com").pipe(Effect.provide(live(client))))
-
-    expect(error).toBeInstanceOf(AccountTransportError)
-    if (error instanceof AccountTransportError) {
-      expect(error.method).toBe("POST")
-      expect(error.url).toBe("https://one.example.com/auth/device/code")
-    }
-  }),
-)
-
-it.live("orgsByAccount groups orgs per account", () =>
-  Effect.gen(function* () {
-    yield* AccountRepo.Service.use((r) =>
-      r.persistAccount({
-        id: AccountID.make("user-1"),
-        email: "one@example.com",
-        url: "https://one.example.com",
-        accessToken: AccessToken.make("at_1"),
-        refreshToken: RefreshToken.make("rt_1"),
-        expiry: Date.now() + outsideEagerRefreshWindow,
-        orgID: Option.none(),
-      }),
-    )
-
-    yield* AccountRepo.Service.use((r) =>
-      r.persistAccount({
-        id: AccountID.make("user-2"),
-        email: "two@example.com",
-        url: "https://two.example.com",
-        accessToken: AccessToken.make("at_2"),
-        refreshToken: RefreshToken.make("rt_2"),
-        expiry: Date.now() + outsideEagerRefreshWindow,
-        orgID: Option.none(),
-      }),
-    )
-
-    const seen: Array<string> = []
-    const client = HttpClient.make((req) =>
-      Effect.gen(function* () {
-        seen.push(`${req.method} ${req.url}`)
-
-        if (req.url === "https://one.example.com/api/orgs") {
-          return json(req, [org("org-1", "One")])
-        }
-
-        if (req.url === "https://two.example.com/api/orgs") {
-          return json(req, [org("org-2", "Two A"), org("org-3", "Two B")])
-        }
-
-        return json(req, [], 404)
-      }),
-    )
-
-    const rows = yield* Account.use.orgsByAccount().pipe(Effect.provide(live(client)))
-
-    expect(rows.map((row) => [row.account.id, row.orgs.map((org) => org.id)]).map(([id, orgs]) => [id, orgs])).toEqual([
-      [AccountID.make("user-1"), [OrgID.make("org-1")]],
-      [AccountID.make("user-2"), [OrgID.make("org-2"), OrgID.make("org-3")]],
-    ])
-    expect(seen).toEqual(["GET https://one.example.com/api/orgs", "GET https://two.example.com/api/orgs"])
-  }),
-)
-
-it.live("token refresh persists the new token", () =>
-  Effect.gen(function* () {
-    const id = AccountID.make("user-1")
-
-    yield* AccountRepo.Service.use((r) =>
-      r.persistAccount({
-        id,
-        email: "user@example.com",
-        url: "https://one.example.com",
-        accessToken: AccessToken.make("at_old"),
-        refreshToken: RefreshToken.make("rt_old"),
-        expiry: Date.now() - 1_000,
-        orgID: Option.none(),
-      }),
-    )
-
-    const client = HttpClient.make((req) =>
-      Effect.succeed(
-        req.url === "https://one.example.com/auth/device/token"
-          ? json(req, {
-              access_token: "at_new",
-              refresh_token: "rt_new",
-              expires_in: 60,
-            })
-          : json(req, {}, 404),
-      ),
-    )
-
-    const token = yield* Account.use.token(id).pipe(Effect.provide(live(client)))
-
-    expect(Option.getOrThrow(token)).toBeDefined()
-    expect(String(Option.getOrThrow(token))).toBe("at_new")
-
-    const row = yield* AccountRepo.use.getRow(id)
-    const value = Option.getOrThrow(row)
-    expect(value.access_token).toBe(AccessToken.make("at_new"))
-    expect(value.refresh_token).toBe(RefreshToken.make("rt_new"))
-    expect(value.token_expiry).toBeGreaterThan(Date.now())
-  }),
-)
-
-it.live("token refreshes before expiry when inside the eager refresh window", () =>
-  Effect.gen(function* () {
-    const id = AccountID.make("user-1")
-
-    yield* AccountRepo.Service.use((r) =>
-      r.persistAccount({
-        id,
-        email: "user@example.com",
-        url: "https://one.example.com",
-        accessToken: AccessToken.make("at_old"),
-        refreshToken: RefreshToken.make("rt_old"),
-        expiry: Date.now() + insideEagerRefreshWindow,
-        orgID: Option.none(),
-      }),
-    )
-
-    let refreshCalls = 0
-    const client = HttpClient.make((req) =>
-      Effect.promise(async () => {
-        if (req.url === "https://one.example.com/auth/device/token") {
-          refreshCalls += 1
-          return json(req, {
-            access_token: "at_new",
-            refresh_token: "rt_new",
-            expires_in: 60,
-          })
-        }
-
-        return json(req, {}, 404)
-      }),
-    )
-
-    const token = yield* Account.use.token(id).pipe(Effect.provide(live(client)))
-
-    expect(String(Option.getOrThrow(token))).toBe("at_new")
-    expect(refreshCalls).toBe(1)
-
-    const row = yield* AccountRepo.use.getRow(id)
-    const value = Option.getOrThrow(row)
-    expect(value.access_token).toBe(AccessToken.make("at_new"))
-    expect(value.refresh_token).toBe(RefreshToken.make("rt_new"))
-  }),
-)
-
-it.live("concurrent config and token requests coalesce token refresh", () =>
-  Effect.gen(function* () {
-    const id = AccountID.make("user-1")
-
-    yield* AccountRepo.Service.use((r) =>
-      r.persistAccount({
-        id,
-        email: "user@example.com",
-        url: "https://one.example.com",
-        accessToken: AccessToken.make("at_old"),
-        refreshToken: RefreshToken.make("rt_old"),
-        expiry: Date.now() - 1_000,
-        orgID: Option.some(OrgID.make("org-9")),
-      }),
-    )
-
-    let refreshCalls = 0
-    const client = HttpClient.make((req) =>
-      Effect.promise(async () => {
-        if (req.url === "https://one.example.com/auth/device/token") {
-          refreshCalls += 1
-
-          if (refreshCalls === 1) {
-            await new Promise((resolve) => setTimeout(resolve, 25))
-            return json(req, {
-              access_token: "at_new",
-              refresh_token: "rt_new",
-              expires_in: 60,
-            })
-          }
-
-          return json(
-            req,
-            {
-              error: "invalid_grant",
-              error_description: "refresh token already used",
-            },
-            400,
-          )
-        }
-
-        if (req.url === "https://one.example.com/api/config") {
-          return json(req, { config: { theme: "light", seats: 5 } })
-        }
-
-        return json(req, {}, 404)
-      }),
-    )
-
-    const [cfg, token] = yield* Account.Service.use((s) =>
-      Effect.all([s.config(id, OrgID.make("org-9")), s.token(id)], { concurrency: 2 }),
-    ).pipe(Effect.provide(live(client)))
-
-    expect(Option.getOrThrow(cfg)).toEqual({ theme: "light", seats: 5 })
-    expect(String(Option.getOrThrow(token))).toBe("at_new")
-    expect(refreshCalls).toBe(1)
-
-    const row = yield* AccountRepo.use.getRow(id)
-    const value = Option.getOrThrow(row)
-    expect(value.access_token).toBe(AccessToken.make("at_new"))
-    expect(value.refresh_token).toBe(RefreshToken.make("rt_new"))
-  }),
-)
-
-it.live("config sends the selected org header", () =>
-  Effect.gen(function* () {
-    const id = AccountID.make("user-1")
-
-    yield* AccountRepo.Service.use((r) =>
-      r.persistAccount({
-        id,
-        email: "user@example.com",
-        url: "https://one.example.com",
-        accessToken: AccessToken.make("at_1"),
-        refreshToken: RefreshToken.make("rt_1"),
-        expiry: Date.now() + outsideEagerRefreshWindow,
-        orgID: Option.none(),
-      }),
-    )
-
-    const seen: { auth?: string; org?: string } = {}
-    const client = HttpClient.make((req) =>
-      Effect.gen(function* () {
-        seen.auth = req.headers.authorization
-        seen.org = req.headers["x-org-id"]
-
-        if (req.url === "https://one.example.com/api/config") {
-          return json(req, { config: { theme: "light", seats: 5 } })
-        }
-
-        return json(req, {}, 404)
-      }),
-    )
-
-    const cfg = yield* Account.Service.use((s) => s.config(id, OrgID.make("org-9"))).pipe(Effect.provide(live(client)))
-
-    expect(Option.getOrThrow(cfg)).toEqual({ theme: "light", seats: 5 })
-    expect(seen).toEqual({
-      auth: "Bearer at_1",
-      org: "org-9",
-    })
-  }),
-)
-
-it.live("poll stores the account and first org on success", () =>
-  Effect.gen(function* () {
-    const client = HttpClient.make((req) =>
-      Effect.succeed(
-        req.url === "https://one.example.com/auth/device/token"
-          ? json(req, {
-              access_token: "at_1",
-              refresh_token: "rt_1",
-              token_type: "Bearer",
-              expires_in: 60,
-            })
-          : req.url === "https://one.example.com/api/user"
-            ? json(req, { id: "user-1", email: "user@example.com" })
-            : req.url === "https://one.example.com/api/orgs"
-              ? json(req, [org("org-1", "One")])
-              : json(req, {}, 404),
-      ),
-    )
-
-    const res = yield* Account.Service.use((s) => s.poll(login())).pipe(Effect.provide(live(client)))
-
-    expect(res._tag).toBe("PollSuccess")
-    if (res._tag === "PollSuccess") {
-      expect(res.email).toBe("user@example.com")
-    }
-
-    const active = yield* AccountRepo.use.active()
-    expect(Option.getOrThrow(active)).toEqual(
-      expect.objectContaining({
-        id: "user-1",
-        email: "user@example.com",
-        active_org_id: "org-1",
-      }),
-    )
-  }),
-)
-
-for (const [name, body, expectedTag] of [
-  [
-    "pending",
-    {
-      error: "authorization_pending",
-      error_description: "The authorization request is still pending",
-    },
-    "PollPending",
-  ],
-  [
-    "slow",
-    {
-      error: "slow_down",
-      error_description: "Polling too frequently, please slow down",
-    },
-    "PollSlow",
-  ],
-  [
-    "denied",
-    {
-      error: "access_denied",
-      error_description: "The authorization request was denied",
-    },
-    "PollDenied",
-  ],
-  [
-    "expired",
-    {
-      error: "expired_token",
-      error_description: "The device code has expired",
-    },
-    "PollExpired",
-  ],
-] as const) {
-  it.live(`poll returns ${name} for ${body.error}`, () =>
-    Effect.gen(function* () {
-      const result = yield* poll(body)
-      expect(result._tag).toBe(expectedTag)
-    }),
-  )
-}
-
-it.live("poll returns poll error for other OAuth errors", () =>
-  Effect.gen(function* () {
-    const result = yield* poll({
-      error: "server_error",
-      error_description: "An unexpected error occurred",
-    })
-
-    expect(result._tag).toBe("PollError")
-    if (result._tag === "PollError") {
-      expect(String(result.cause)).toContain("server_error")
-    }
-  }),
-)

packages/opencode/test/cli/error.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test"
-import { AccountTransportError } from "../../src/account/schema"
+import { AccountV2 } from "@opencode-ai/core/account"
 import { FormatError } from "../../src/cli/error"
 import { UI } from "../../src/cli/ui"
 
@@ -52,7 +52,7 @@ describe("cli.error", () => {
   })
 
   test("formats account transport errors clearly", () => {
-    const error = new AccountTransportError({
+    const error = new AccountV2.AccountTransportError({
       method: "POST",
       url: "https://console.opencode.ai/auth/device/code",
     })

packages/opencode/test/config/config.test.ts

@@ -11,8 +11,7 @@ import { EffectFlock } from "@opencode-ai/core/util/effect-flock"
 import { InstanceRef } from "../../src/effect/instance-ref"
 import type { InstanceContext } from "../../src/project/instance-context"
 import { Auth } from "../../src/auth"
-import { Account } from "../../src/account/account"
-import { AccessToken, AccountID, OrgID } from "../../src/account/schema"
+import { AccountV2 } from "@opencode-ai/core/account"
 import { FSUtil } from "@opencode-ai/core/fs-util"
 import { Env } from "../../src/env"
 import {
@@ -90,7 +89,7 @@ function remoteConfigClient(input: {
 const configLayer = (
   options: {
     auth?: Layer.Layer<Auth.Service>
-    account?: Layer.Layer<Account.Service>
+    account?: Layer.Layer<AccountV2.Service>
     client?: HttpClient.HttpClient
   } = {},
 ) =>
@@ -553,27 +552,27 @@ it.instance("handles file inclusion with replacement tokens", () =>
 )
 
 const accountTokenIt = configIt({
-  account: Layer.mock(Account.Service)({
+  account: Layer.mock(AccountV2.Service)({
     active: () =>
       Effect.succeed(
         Option.some({
-          id: AccountID.make("account-1"),
+          id: AccountV2.ID.make("account-1"),
           email: "user@example.com",
           url: "https://control.example.com",
-          active_org_id: OrgID.make("org-1"),
+          active_org_id: AccountV2.OrgID.make("org-1"),
         }),
       ),
     activeOrg: () =>
       Effect.succeed(
         Option.some({
           account: {
-            id: AccountID.make("account-1"),
+            id: AccountV2.ID.make("account-1"),
             email: "user@example.com",
             url: "https://control.example.com",
-            active_org_id: OrgID.make("org-1"),
+            active_org_id: AccountV2.OrgID.make("org-1"),
           },
           org: {
-            id: OrgID.make("org-1"),
+            id: AccountV2.OrgID.make("org-1"),
             name: "Example Org",
           },
         }),
@@ -584,7 +583,7 @@ const accountTokenIt = configIt({
           provider: { opencode: { options: { apiKey: "{env:OPENCODE_CONSOLE_TOKEN}" } } },
         }),
       ),
-    token: () => Effect.succeed(Option.some(AccessToken.make("st_test_token"))),
+    token: () => Effect.succeed(Option.some(AccountV2.AccessToken.make("st_test_token"))),
   }),
 })
 

packages/opencode/test/fake/account.ts

@@ -1,7 +1,7 @@
 import { Effect, Layer, Option } from "effect"
-import { Account } from "../../src/account/account"
+import { AccountV2 } from "@opencode-ai/core/account"
 
-export const empty = Layer.mock(Account.Service)({
+export const empty = Layer.mock(AccountV2.Service)({
   active: () => Effect.succeed(Option.none()),
   activeOrg: () => Effect.succeed(Option.none()),
 })

packages/opencode/test/share/share-next.test.ts

@@ -1,11 +1,10 @@
 import { NodeFileSystem } from "@effect/platform-node"
 import { beforeEach, describe, expect } from "bun:test"
-import { Effect, Exit, Layer, Option } from "effect"
+import { Effect, Exit, Layer } from "effect"
 import { HttpClient, HttpClientRequest, HttpClientResponse } from "effect/unstable/http"
 
-import { AccessToken, AccountID, OrgID, RefreshToken } from "../../src/account/schema"
-import { Account } from "../../src/account/account"
-import { AccountRepo } from "../../src/account/repo"
+import { AccountV2 } from "@opencode-ai/core/account"
+import { AccountStateTable, AccountTable } from "@opencode-ai/core/account/sql"
 import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner"
 import { EventV2Bridge } from "../../src/event-v2-bridge"
 import { Config } from "@/config/config"
@@ -22,7 +21,6 @@ import { pollWithTimeout, testEffect } from "../lib/effect"
 
 const env = Layer.mergeAll(
   Session.defaultLayer,
-  AccountRepo.defaultLayer,
   Database.defaultLayer,
   NodeFileSystem.layer,
   CrossSpawnSpawner.defaultLayer,
@@ -44,7 +42,7 @@ function live(client: HttpClient.HttpClient) {
   const http = Layer.succeed(HttpClient.HttpClient, client)
   return ShareNext.layer.pipe(
     Layer.provide(EventV2Bridge.defaultLayer),
-    Layer.provide(Account.layer.pipe(Layer.provide(AccountRepo.defaultLayer), Layer.provide(http))),
+    Layer.provide(AccountV2.defaultLayer),
     Layer.provide(Config.defaultLayer),
     Layer.provide(Database.defaultLayer),
     Layer.provide(http),
@@ -59,13 +57,12 @@ function wired(client: HttpClient.HttpClient) {
     EventV2Bridge.defaultLayer,
     ShareNext.layer,
     Session.defaultLayer,
-    AccountRepo.defaultLayer,
     Database.defaultLayer,
     NodeFileSystem.layer,
     CrossSpawnSpawner.defaultLayer,
   ).pipe(
     Layer.provide(EventV2Bridge.defaultLayer),
-    Layer.provide(Account.layer.pipe(Layer.provide(AccountRepo.defaultLayer), Layer.provide(http))),
+    Layer.provide(AccountV2.defaultLayer),
     Layer.provide(Config.defaultLayer),
     Layer.provide(http),
     Layer.provide(Provider.defaultLayer),
@@ -83,18 +80,28 @@ const share = (id: SessionID) =>
       .pipe(Effect.orDie)
   })
 
-const seed = (url: string, org?: string) =>
-  AccountRepo.Service.use((repo) =>
-    repo.persistAccount({
-      id: AccountID.make("account-1"),
-      email: "user@example.com",
-      url,
-      accessToken: AccessToken.make("st_test_token"),
-      refreshToken: RefreshToken.make("rt_test_token"),
-      expiry: Date.now() + 10 * 60_000,
-      orgID: org ? Option.some(OrgID.make(org)) : Option.none(),
-    }),
-  )
+const seed = (url: string, org?: AccountV2.OrgID) =>
+  Effect.gen(function* () {
+    const { db } = yield* Database.Service
+    yield* db
+      .insert(AccountTable)
+      .values({
+        id: AccountV2.ID.make("account-1"),
+        email: "user@example.com",
+        url,
+        access_token: AccountV2.AccessToken.make("st_test_token"),
+        refresh_token: AccountV2.RefreshToken.make("rt_test_token"),
+        token_expiry: Date.now() + 10 * 60_000,
+      })
+      .run()
+      .pipe(Effect.orDie)
+    yield* db
+      .insert(AccountStateTable)
+      .values({ id: 1, active_account_id: AccountV2.ID.make("account-1"), active_org_id: org ?? null })
+      .onConflictDoUpdate({ target: AccountStateTable.id, set: { active_org_id: org ?? null } })
+      .run()
+      .pipe(Effect.orDie)
+  })
 
 beforeEach(async () => {
   await resetDatabase()
@@ -137,7 +144,7 @@ describe("ShareNext", () => {
   it.live("request uses org share API with auth headers when account is active", () =>
     provideTmpdirInstance(() =>
       Effect.gen(function* () {
-        yield* seed("https://control.example.com", "org-1")
+        yield* seed("https://control.example.com", AccountV2.OrgID.make("org-1"))
 
         const req = yield* ShareNext.use.request().pipe(Effect.provide(live(none)))