@cortexkit/anthropic-auth-core 2.2.3 → 2.2.4

package/dist/index.d.ts

@@ -66,7 +66,7 @@ export * from './oauth-profile.ts';
 export { createWindowsOwnerOnly, ensureWindowsOwnerOnlyDirectory, isOwnerOnly, type OwnerOnlyOptions, } from './owner-only.ts';
 export * from './pkce.ts';
 export type { NativeEmptyInitJournal, NativeLegacyMigrationJournal, NativeMigrationJournal, } from './pool-authority.ts';
-export { nativeMigrationAuthorityPhase, readNativeMigrationJournal, } from './pool-authority.ts';
+export { nativeJournalMayAdoptLaterHostLogin, nativeMigrationAuthorityPhase, readNativeMigrationJournal, } from './pool-authority.ts';
 export type { NativeLocalPoolBinding } from './pool-binding.ts';
 export { captureNativeLocalPoolBinding } from './pool-binding.ts';
 export * from './pool-paths.ts';

package/dist/index.js

@@ -9558,7 +9558,7 @@ function formatEnrollmentStatus(status, scopedServing = false) {
       return ["- Enrollment: setup is busy"];
     case "unavailable":
       return [
-        "- Enrollment: this Claustrum vault does not support connecting plugins"
+        '- Enrollment: this Claustrum vault is too old to connect plugins. Run `ck upgrade` to move to Claustrum v0.2.0 or newer (read "Upgrading from v0.1.3" in its release notes first).'
       ];
     case "pending":
       return status.requestId && /^[A-Za-z0-9_-]{1,128}$/.test(status.requestId) ? [`- Enrollment: pending approval (${status.requestId})`, setup] : [
@@ -20908,6 +20908,9 @@ function nativeMigrationAuthorityPhase(journal) {
     return;
   return journal.phase;
 }
+function nativeJournalMayAdoptLaterHostLogin(journal, host) {
+  return host === "opencode" && journal !== undefined && journal.kind !== "empty-init" && journal.host === "opencode" && journal.phase === "retired" && journal.activation === null;
+}
 async function requireNativePoolAuthority(paths) {
   const journal = await readNativeMigrationJournal(paths);
   if (!journal)
@@ -20947,7 +20950,7 @@ async function writeJournal(paths, journal, assertOwned, hooks) {
   });
   await hooks.onWriteStep?.("after-write", snapshot);
 }
-async function beginNativeMigration(paths, input, hooks = {}) {
+async function beginNativeMigration(paths, input, hooks = {}, replaces) {
   try {
     requireNativeMigrationDataObject(input);
   } catch {
@@ -20980,6 +20983,12 @@ async function beginNativeMigration(paths, input, hooks = {}) {
     renew: true
   }, async (lock) => {
     const current = await readNativeMigrationJournal(paths);
+    if (replaces) {
+      if (initial.version !== 5 || !nativeJournalMayAdoptLaterHostLogin(replaces, initial.host) || !current || nativeMigrationCanonicalJson(current) !== nativeMigrationCanonicalJson(replaces))
+        throw new NativeAuthorityError("journal-conflict");
+      await writeJournal(paths, initial, () => lock.assertOwned(), hooks);
+      return initial;
+    }
     if (current?.kind === "empty-init") {
       if (current.host !== initial.host)
         throw new NativeAuthorityError("journal-conflict");
@@ -27511,7 +27520,7 @@ async function capture2(input, checkPool = false) {
       refuse3();
   const current = await readNativeMigrationJournal(input.paths);
   const emptyInit = current?.kind === "empty-init";
-  const journal = current?.kind === "empty-init" ? undefined : current;
+  let journal = current?.kind === "empty-init" ? undefined : current;
   if (emptyInit) {
     if (current.host !== input.host || input.routingDestinationPath !== resolveLocalRoutingDestination(input.host, input.paths, input.env))
       refuse3();
@@ -27541,6 +27550,11 @@ async function capture2(input, checkPool = false) {
     refuse3();
   if (journal && (journal.host !== input.host || journal.hostAuthPath !== hostAuthPath || journal.routingPaths.source !== routingSourcePath || journal.routingPaths.destination !== routingDestinationPath))
     refuse3();
+  let replaces;
+  if (nativeJournalMayAdoptLaterHostLogin(journal, input.host) && entry2.kind === "oauth" && !await nativePoolHoldsAccountData({ paths: input.paths })) {
+    replaces = journal;
+    journal = undefined;
+  }
   if (journal?.phase === "committed" || journal?.phase === "retired") {
     const missing2 = (role, path2) => ({
       role,
@@ -27575,7 +27589,7 @@ async function capture2(input, checkPool = false) {
   const config = await readNativeMigrationSource("config", input.legacyConfigPath ?? input.paths.legacyConfig);
   const state = await readNativeMigrationSource("state", input.legacyStatePath ?? input.paths.legacyState);
   const routing = await readNativeMigrationSource("routing", input.routingSourcePath);
-  const routingDestination = emptyInit || journal?.kind === "legacy-import" ? await readNativeMigrationSource("routing", input.routingDestinationPath) : undefined;
+  const routingDestination = emptyInit || replaces || journal?.kind === "legacy-import" ? await readNativeMigrationSource("routing", input.routingDestinationPath) : undefined;
   if (routingDestination)
     owned(routingDestination);
   for (const source2 of [config, state, routing])
@@ -27634,6 +27648,7 @@ async function capture2(input, checkPool = false) {
     routing,
     auth,
     journal: current,
+    ...replaces ? { replaces } : {},
     routingDestination,
     projection,
     seedInput,
@@ -27838,11 +27853,11 @@ async function runNativeMigration(input, hooks = {}) {
       const captured = await capture2(operation, true);
       if (operation.preflight) {
         const previous = preflights.get(operation.preflight);
-        if (!previous || operation.preflight.storageId !== paths.storageId || operation.preflight.host !== operation.host || previous.config.digest !== captured.config.digest || previous.state.digest !== captured.state.digest || previous.routing.digest !== captured.routing.digest || previous.routingDestination?.digest !== captured.routingDestination?.digest || inspectNativeHostAuthEntry(operation.host, previous.auth.data).digest !== inspectNativeHostAuthEntry(operation.host, captured.auth.data).digest || previous.hostAuthPath !== captured.hostAuthPath || previous.routingSourcePath !== captured.routingSourcePath || previous.routingDestinationPath !== captured.routingDestinationPath)
+        if (!previous || operation.preflight.storageId !== paths.storageId || operation.preflight.host !== operation.host || previous.config.digest !== captured.config.digest || previous.state.digest !== captured.state.digest || previous.routing.digest !== captured.routing.digest || previous.routingDestination?.digest !== captured.routingDestination?.digest || inspectNativeHostAuthEntry(operation.host, previous.auth.data).digest !== inspectNativeHostAuthEntry(operation.host, captured.auth.data).digest || previous.hostAuthPath !== captured.hostAuthPath || previous.routingSourcePath !== captured.routingSourcePath || previous.routingDestinationPath !== captured.routingDestinationPath || previous.replaces === undefined !== (captured.replaces === undefined))
           refuse3();
       }
-      const emptyInit = captured.journal?.kind === "empty-init";
-      let journal = captured.journal?.kind === "empty-init" ? undefined : captured.journal;
+      const emptyInit = captured.journal?.kind === "empty-init" || captured.replaces !== undefined;
+      let journal = captured.journal?.kind === "empty-init" || captured.replaces ? undefined : captured.journal;
       const store = createNativePoolStore({
         paths,
         quota: nativeQuotaCodec,
@@ -27910,7 +27925,7 @@ async function runNativeMigration(input, hooks = {}) {
             destination: captured.routingDestinationPath
           },
           ...operation.requestVaultActivation ? { activation: "requested" } : {}
-        }, journalHooks);
+        }, journalHooks, captured.replaces);
       }
       let bytes;
       let seed;
@@ -32916,6 +32931,7 @@ export {
   nativeMigrationAuthorityPhase,
   nativeLocalQuotaLineage,
   nativeLocalCredentialValidationMatches,
+  nativeJournalMayAdoptLaterHostLogin,
   nativeCacheKeepAlways,
   nativeAccountPolicy,
   nativeAccountCanServe,

package/dist/pool-authority.d.ts

@@ -142,6 +142,16 @@ export declare function readNativeMigrationJournal(paths: NativePoolPaths, owner
  * that admits requests from the journal uses this one predicate.
  */
 export declare function nativeMigrationAuthorityPhase(journal: NativeMigrationJournal | undefined): 'committed' | 'retired' | undefined;
+/**
+ * Whether a finished legacy import may be replaced by a fresh import of a
+ * later OpenCode login. A first OpenCode 1 setup with no login finishes a
+ * legacy import of nothing instead of recording empty-init (only OpenCode 2
+ * setup records empty-init). Such a journal stands in for empty-init only when
+ * it is retired with no requested or completed vault switch; callers must still
+ * prove the pool holds no account data, so a pool with accounts is never
+ * re-imported.
+ */
+export declare function nativeJournalMayAdoptLaterHostLogin(journal: NativeMigrationJournal | undefined, host: 'opencode' | 'pi'): journal is NativeLegacyMigrationJournal;
 /** An empty or readable store is not proof that the offline authority flip completed. */
 export declare function requireNativePoolAuthority(paths: NativePoolPaths): Promise<NativeMigrationJournal>;
 interface JournalHooks {
@@ -154,7 +164,12 @@ interface JournalHooks {
     onWriteStep?: (step: 'before-write' | 'after-write', journal: NativeMigrationJournal) => Promise<void>;
 }
 /** Migration resume retains the original digests and resolved paths so a retry cannot adopt changed inputs or redirect writes. */
-export declare function beginNativeMigration(paths: NativePoolPaths, input: NativeMigrationInput, hooks?: JournalHooks): Promise<NativeLegacyMigrationJournal>;
+export declare function beginNativeMigration(paths: NativePoolPaths, input: NativeMigrationInput, hooks?: JournalHooks, 
+/**
+ * The retired journal a fresh v5 import replaces, as read by the caller.
+ * The write refuses unless the journal on disk still equals it exactly.
+ */
+replaces?: NativeLegacyMigrationJournal): Promise<NativeLegacyMigrationJournal>;
 /** Save the expected host-auth entry and routing digests together before changing files, so recovery can recognize completed writes. */
 export declare function recordNativeMigrationExpectations(paths: NativePoolPaths, expectations: NativeMigrationExpectations, hooks?: JournalHooks): Promise<NativeLegacyMigrationJournal>;
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/anthropic-auth-core",
-  "version": "2.2.3",
+  "version": "2.2.4",
   "type": "module",
   "repository": {
     "type": "git",