@cortexkit/anthropic-auth-core 2.2.5 → 2.2.6

package/dist/index.js

@@ -21380,6 +21380,77 @@ function createNativeLocalCredentialService(options) {
   return Object.freeze({ authorize: authorize2 });
 }
 
+// src/native-local-publication.ts
+var publishers = new Map;
+function acquireNativeLocalPublisher(key) {
+  let owned = publishers.get(key);
+  if (!owned) {
+    owned = { writer: createPublisher(), leases: 0 };
+    publishers.set(key, owned);
+  }
+  owned.leases++;
+  let released = false;
+  return {
+    ...owned.writer,
+    release() {
+      if (released)
+        return;
+      released = true;
+      if (--owned.leases === 0)
+        publishers.delete(key);
+    }
+  };
+}
+function createPublisher() {
+  let tail = Promise.resolve();
+  const pending = new Map;
+  const run = (write) => {
+    const result = tail.then(write);
+    tail = result.catch(() => {});
+    return result;
+  };
+  return {
+    run,
+    enqueue(key, patch, write) {
+      const queued = pending.get(key);
+      if (queued) {
+        const previous = queued.patch;
+        if (previous.quota && patch.quota && patch.quota.source !== "headers" && quotaSnapshotCheckedAt(previous.quota) > quotaSnapshotCheckedAt(patch.quota))
+          return Promise.resolve(false);
+        queued.patch = { ...previous, ...patch };
+        if (previous.quota && patch.quota)
+          queued.patch.quota = fromNativeQuotaMap(nativeQuotaCodec.merge(toNativeQuotaMap(previous.quota), toNativeQuotaMap(patch.quota)));
+        if (previous.lastUsed !== undefined || patch.lastUsed !== undefined)
+          queued.patch.lastUsed = Math.max(previous.lastUsed ?? 0, patch.lastUsed ?? 0);
+        for (const field of [
+          "quotaErrorClearedAt",
+          "quotaErrorGeneration"
+        ])
+          if (previous[field] !== undefined || patch[field] !== undefined)
+            queued.patch[field] = Math.max(previous[field] ?? 0, patch[field] ?? 0);
+        if (previous.lastQuotaRefreshError && patch.lastQuotaRefreshError && previous.lastQuotaRefreshError.checkedAt > patch.lastQuotaRefreshError.checkedAt)
+          queued.patch.lastQuotaRefreshError = previous.lastQuotaRefreshError;
+        return queued.result;
+      }
+      const batch = { patch, result: Promise.resolve(false) };
+      pending.set(key, batch);
+      batch.result = run(async () => {
+        await new Promise((resolve10) => setTimeout(resolve10, 0));
+        pending.delete(key);
+        return write(batch.patch);
+      });
+      return batch.result;
+    },
+    async drain() {
+      let observed;
+      do {
+        observed = tail;
+        await observed;
+      } while (observed !== tail);
+    }
+  };
+}
+
 // src/native-usage-publication.ts
 import { types as types3 } from "node:util";
 function usagePublicationRefusalIsFatal(error) {
@@ -21526,7 +21597,7 @@ class NativeQuotaObservations extends Map {
     let clearAt;
     let matched = false;
     for (const observation of this.values()) {
-      if (observation.entry.quota.source === "headers")
+      if (observation.entry.quota.source === "headers" && observation.routeBeforeSave !== true)
         continue;
       if (observation.lineage !== lineage || observation.accountUuid !== accountUuid2 || getQuotaNextRefreshAt(observation.entry.quota, storage, observation.entry.checkedAt) <= now)
         continue;
@@ -21556,6 +21627,17 @@ class NativeQuotaObservations extends Map {
       }
     }));
   }
+  hold(accountId, observation) {
+    const current = this.get(accountId);
+    if (current && current.lineage === observation.lineage && quotaSnapshotCheckedAt(current.entry.quota) > quotaSnapshotCheckedAt(observation.entry.quota))
+      return false;
+    this.set(accountId, observation);
+    return true;
+  }
+  forget(accountId, observation) {
+    if (this.get(accountId) === observation)
+      this.delete(accountId);
+  }
   drain() {
     return this.publications.drain();
   }
@@ -26265,11 +26347,12 @@ function acquireNativeAccountRuntime(options) {
   const quotaObservations = use().quotaObservations;
   const onLockEvent = use().onLockEvent;
   const drainRoutingPublications = use().drainRoutingPublications;
+  const drainQuotaPublications = use().drainQuotaPublications;
   return {
     onLockEvent,
     vault,
     quotaObservations,
-    drainQuotaPublications: () => quotaObservations.drain(),
+    drainQuotaPublications,
     drainRoutingPublications,
     getRelayConfig: () => use().getRelayConfig(),
     getSettingsPath: () => use().getSettingsPath(),
@@ -26297,7 +26380,10 @@ function acquireNativeAccountRuntime(options) {
     fetchProfileForDisplay: (id2, transport, signal) => use().fetchProfileForDisplay(id2, transport, signal),
     close: () => {
       vault.close();
-      return drainRoutingPublications();
+      return Promise.all([
+        drainQuotaPublications(),
+        drainRoutingPublications()
+      ]).then(() => {});
     }
   };
 }
@@ -26337,6 +26423,9 @@ function createNativeAccountRuntime(options) {
     }
   });
   const shutdown = new AbortController;
+  let closing;
+  const quotaPublications = acquireNativeLocalPublisher(paths.config);
+  const metadataPublications = acquireNativeLocalPublisher(paths.runtime);
   const store = createNativePoolStore({
     paths,
     quota: nativeQuotaCodec,
@@ -26459,6 +26548,51 @@ function createNativeAccountRuntime(options) {
       throw error;
     }
   }
+  async function localMetadataMatches(subject) {
+    const binding2 = subject.binding;
+    const row = await poolRow(binding2.rowId);
+    if (row?.stamp !== "bound" || !row.credential || !nativeLocalPoolBindingMatches(binding2, paths, row))
+      return false;
+    if ("kind" in subject)
+      return row.credential.type === "api" && fingerprintOf(row.credential) === subject.credentialFingerprint && row.credential.baseURL === subject.baseURL && row.credential.authHeader === subject.authHeader;
+    return row.credential.type === "oauth" && fingerprintOf(row.credential) === subject.credentialFingerprint && nativeLocalCredentialValidationMatches(subject, binding2, row.credential);
+  }
+  async function localMetadataWrite(subject, change) {
+    const binding2 = subject.binding;
+    if (await authority() !== "local")
+      return false;
+    const matches2 = await localMetadataMatches(subject);
+    await localAuthority();
+    if (!matches2)
+      return false;
+    try {
+      await updateNativeRuntime(paths.runtime, paths.storageId, (current) => {
+        const old = current.accounts[binding2.rowId];
+        const previous = old?.binding;
+        const same = previous?.kind === "local" && previous.rowId === binding2.rowId && previous.identity === binding2.identity && previous.credentialEpoch === binding2.credentialEpoch;
+        current.accounts[binding2.rowId] = change(same && old ? old : { binding: binding2 });
+        return current;
+      }, {
+        onLockEvent: options.local?.onLockEvent,
+        beforeRename: async () => {
+          if (!await localMetadataMatches(subject))
+            throw new NativeRuntimeError("publication-refused");
+          await localAuthority();
+        },
+        beforePublish: () => localAuthority()
+      });
+      if (await authority() !== "local")
+        throw new NativeRuntimeError("publication-refused");
+      return true;
+    } catch (error) {
+      if (error instanceof NativeRuntimeError && (error.code === "runtime-conflict" || error.code === "publication-refused")) {
+        if (await authority() !== "local")
+          throw error;
+        return false;
+      }
+      throw error;
+    }
+  }
   async function initializeCredentialEpoch(id2) {
     const row = await poolRow(id2);
     if (!row?.credential || row.credentialEpoch === undefined)
@@ -26594,7 +26728,13 @@ function createNativeAccountRuntime(options) {
     onLockEvent,
     vault,
     quotaObservations: vault.quotaObservations,
-    drainQuotaPublications: () => vault.quotaObservations.drain(),
+    drainQuotaPublications: async () => {
+      await vault.quotaObservations.drain();
+      await Promise.all([
+        quotaPublications.drain(),
+        metadataPublications.drain()
+      ]);
+    },
     drainRoutingPublications: () => vaultRouter.drain(),
     async getRelayConfig() {
       const { mode, paths: paths2, store: store2 } = await selectedStorage();
@@ -27052,30 +27192,45 @@ function createNativeAccountRuntime(options) {
       };
     },
     async publishLocal(subject, rawPatch) {
-      const patch = captureNativeMetadataPatch(rawPatch);
-      if (await authority() !== "local")
-        return false;
-      const { quota: quota2, ...metadata2 } = patch;
-      const quotaOnly = quota2 !== undefined && Object.keys(metadata2).length === 0;
-      const row = await poolRow(subject.binding.rowId);
-      if (row?.stamp !== "bound" || row.credential?.type !== "oauth" || !nativeLocalPoolBindingMatches(subject.binding, paths, row) || !quotaOnly && !nativeLocalCredentialValidationMatches(subject, subject.binding, row.credential))
-        return false;
-      if (quota2) {
-        if (quota2.source !== "headers" && row.quota && quotaSnapshotCheckedAt(fromNativeQuotaMap(row.quota)) > quotaSnapshotCheckedAt(quota2))
+      const captured = captureNativeMetadataPatch(rawPatch);
+      const { quota: _quota, ...metadata2 } = captured;
+      const mixed = captured.quota !== undefined && Object.keys(metadata2).length > 0;
+      let admission;
+      const admitted = () => admission ??= (async () => {
+        if (await authority() !== "local")
           return false;
-        if (quota2.accountIdentity !== subject.binding.identity)
-          throw new NativeRuntimeError("publication-refused");
-        await store.recordQuota(subject.binding.rowId, {
-          credentialEpoch: subject.binding.credentialEpoch,
-          identity: subject.binding.identity
-        }, toNativeQuotaMap(quota2));
-      }
-      return localWrite(subject, (old) => applyNativeMetadataPatch(old, metadata2), quotaOnly ? "binding" : true);
+        const matches2 = await localMetadataMatches(subject);
+        await localAuthority();
+        return matches2;
+      })();
+      const key = JSON.stringify(subject);
+      const writes = [];
+      if (captured.quota)
+        writes.push(quotaPublications.enqueue(mixed ? `${key}:mixed` : key, { quota: captured.quota }, async ({ quota: quota2 }) => {
+          if (mixed && !await admitted())
+            return false;
+          if (!quota2 || await authority() !== "local")
+            return false;
+          const row = await poolRow(subject.binding.rowId);
+          if (row?.stamp !== "bound" || row.credential?.type !== "oauth" || !nativeLocalPoolBindingMatches(subject.binding, paths, row) || quota2.accountIdentity !== subject.binding.identity)
+            return false;
+          if (quota2.source !== "headers" && row.quota && quotaSnapshotCheckedAt(fromNativeQuotaMap(row.quota)) > quotaSnapshotCheckedAt(quota2))
+            return false;
+          await store.recordQuota(subject.binding.rowId, {
+            credentialEpoch: subject.binding.credentialEpoch,
+            identity: subject.binding.identity
+          }, toNativeQuotaMap(quota2));
+          return true;
+        }));
+      if (Object.keys(metadata2).length)
+        writes.push(metadataPublications.enqueue(mixed ? `${key}:mixed` : key, metadata2, async (patch) => {
+          if (mixed && !await admitted())
+            return false;
+          return localMetadataWrite(subject, (old) => applyNativeMetadataPatch(old, patch));
+        }));
+      return (await Promise.all(writes)).every(Boolean);
     },
-    publishApi: (subject, patch) => localWrite(subject, (old) => ({
-      ...old,
-      lastUsed: Math.max(old.lastUsed ?? 0, patch.lastUsed)
-    })),
+    publishApi: (subject, patch) => metadataPublications.enqueue(JSON.stringify(subject), patch, (merged) => localMetadataWrite(subject, (old) => applyNativeMetadataPatch(old, merged))),
     async resetBackoff(routeId, fence, kind = "all") {
       if ("accessToken" in fence)
         return vault.resetBackoff(fence, kind);
@@ -27107,13 +27262,13 @@ function createNativeAccountRuntime(options) {
       if (await physicalId(routeId) !== fence.binding.rowId)
         return;
       let lineage;
-      const kept = await localWrite(fence, (old) => {
+      const kept = await metadataPublications.run(() => localMetadataWrite(fence, (old) => {
         lineage = old.authLineageId ?? randomUUID15();
         return {
           ...old,
           authLineageId: lineage
         };
-      });
+      }));
       return kept ? lineage : undefined;
     },
     async incrementPrimeUsage(routeId, fence, delta = {}) {
@@ -27124,7 +27279,7 @@ function createNativeAccountRuntime(options) {
       if (await physicalId(routeId) !== fence.binding.rowId)
         return false;
       const captured = primeDelta(delta);
-      return localWrite(fence, (old) => ({
+      return metadataPublications.run(() => localMetadataWrite(fence, (old) => ({
         ...old,
         prime: {
           count: (old.prime?.count ?? 0) + 1,
@@ -27132,7 +27287,7 @@ function createNativeAccountRuntime(options) {
           outputTokens: (old.prime?.outputTokens ?? 0) + captured.outputTokens,
           since: old.prime?.since ?? now()
         }
-      }));
+      })));
     },
     async fetchQuota(routeId, fetchImpl = fetch, signal, dispatch, purpose) {
       const snapshot = await runtime2.read();
@@ -27196,11 +27351,16 @@ function createNativeAccountRuntime(options) {
       });
     },
     close() {
-      if (!shutdown.signal.aborted) {
+      if (closing)
+        return closing;
+      const draining = runtime2.drainQuotaPublications();
+      vault.close();
+      closing = Promise.all([draining, vaultRouter.drain()]).then(() => {}).finally(() => {
         shutdown.abort(new NativeCustodyError("closed"));
-        vault.close();
-      }
-      return vaultRouter.drain();
+        quotaPublications.release();
+        metadataPublications.release();
+      });
+      return closing;
     }
   };
   function readLocalProfile(id2, fetchImpl, signal) {

package/dist/native-local-publication.d.ts

@@ -0,0 +1,8 @@
+import type { NativeAccountMetadataPatch } from './native-account-view.ts';
+/** Share one replaceable bookkeeping mailbox per destination in this process, never for credential writes. */
+export declare function acquireNativeLocalPublisher(key: string): {
+    release(): void;
+    run: <T>(write: () => Promise<T>) => Promise<T>;
+    enqueue(key: string, patch: NativeAccountMetadataPatch, write: (patch: NativeAccountMetadataPatch) => Promise<boolean>): Promise<boolean>;
+    drain(): Promise<void>;
+};

package/dist/native-quota-observations.d.ts

@@ -7,6 +7,14 @@ export type NativeQuotaObservation = {
     entry: QuotaEntry;
     generalExhausted: boolean;
     quotaErrorClearedAt?: number;
+    /**
+     * Set on a response-header reading from a host that routes on native
+     * snapshots (OpenCode 2). The snapshot overlay then applies it while its
+     * detached save is still pending, as it does for poll readings. Header
+     * readings without it stay host-owned: OpenCode 1 applies its own routing
+     * and display rules to them.
+     */
+    routeBeforeSave?: boolean;
 };
 export declare function nativePollQuotaGenerallyExhausted(quota: OAuthQuotaSnapshot): boolean;
 export declare function nativeLocalQuotaLineage(binding: NativeLocalPoolBinding & {
@@ -22,5 +30,14 @@ export declare class NativeQuotaObservations extends Map<string, NativeQuotaObse
         clearAt?: number;
     } | undefined;
     publish(accountId: string, observation: NativeQuotaObservation, write: () => Promise<boolean>): Promise<void>;
+    /**
+     * Registers a response-header reading before its detached save starts, so
+     * routing in this process sees it while the save waits on file locks. A
+     * reading older than the one already held for the same credential lineage
+     * is not registered, so an older reading never replaces a newer one.
+     */
+    hold(accountId: string, observation: NativeQuotaObservation): boolean;
+    /** Forgets a held reading whose save was refused, unless a later reading already replaced it. */
+    forget(accountId: string, observation: NativeQuotaObservation): void;
     drain(): Promise<void>;
 }

package/dist/native-runtime.d.ts

@@ -104,10 +104,10 @@ export interface NativeRuntimeWriteHooks {
 /** This writer alone uses `<leaf>.native-runtime.<UUID v4>.partial`. */
 export declare function isNativeRuntimeStagingName(path: string, name: string): boolean;
 /**
- * This file has its own update lock. Account publishers also hold the locks
- * protecting the pool and, for vault accounts, the roster. They verify those
- * locks immediately before replacement. A process paused beyond a lock expiry
- * can overlap a new owner even with normal renewal.
+ * This file has its own update lock. Advisory account publishers recheck the
+ * pool or roster binding without taking its lock immediately before replacement;
+ * readers reject metadata whose binding no longer matches. Credential writers
+ * retain their separate ownership and custody checks.
  */
 export declare function updateNativeRuntime(path: string, storageId: string, change: (current: NativeRuntimeState) => NativeRuntimeState | Promise<NativeRuntimeState>, hooks?: NativeRuntimeWriteHooks): Promise<NativeRuntimeState>;
 /**

package/dist/pool-store.d.ts

@@ -15,8 +15,9 @@ export interface NativePoolStoreOptions extends Pick<OpenPoolStoreOptions, 'now'
     onLockEvent?: (event: NativeLockEvent) => void;
 }
 /**
- * These config/state locks also fence local account metadata against concurrent
- * credential changes. Legacy sidecar writers use different files and locks.
+ * These locks serialize pool transactions, including credential changes and
+ * quota publication. Runtime bookkeeping has its own lock and binding checks.
+ * Legacy sidecar writers use different files and locks.
  */
 export declare function nativePoolStoreLocks(paths: NativePoolStorePaths): readonly [{
     readonly path: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/anthropic-auth-core",
-  "version": "2.2.5",
+  "version": "2.2.6",
   "type": "module",
   "repository": {
     "type": "git",