@cortexkit/anthropic-auth-core 2.4.0 → 2.4.2

package/dist/layout-fence.d.ts

@@ -0,0 +1,65 @@
+import { type HolderLiveness } from './holder-registry.ts';
+/**
+ * Environment variables that name anthropic-auth files. A process with any of
+ * them set never moves a dataset or writes `layout.json`.
+ */
+export declare const STATE_PATH_OVERRIDE_VARIABLES: readonly ['OPENCODE_ANTHROPIC_AUTH_FILE', 'OPENCODE_ANTHROPIC_AUTH_STATE_FILE', 'OPENCODE_ANTHROPIC_AUTH_ROUTING_STATE_FILE', 'OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_ENROLLMENT_FILE', 'OPENCODE_TUI_PREFERENCES_FILE'];
+/** The path overrides set in `env`. */
+export declare function statePathOverrides(env: NodeJS.ProcessEnv): string[];
+/** Something that keeps a dataset where it is. */
+export type FenceBlocker = {
+    readonly kind: 'holder';
+    readonly holderFile: string;
+    readonly pid: number | null;
+    readonly role: string | null;
+    readonly file: string | null;
+} | {
+    readonly kind: 'holder-file';
+    readonly holderFile: string;
+    readonly reason: string;
+} | {
+    readonly kind: 'pre-n-artifact';
+    readonly artifact: string;
+    readonly pid: number;
+} | {
+    readonly kind: 'artifact-scan';
+    readonly path: string;
+    readonly reason: string;
+} | {
+    readonly kind: 'override';
+    readonly variable: string;
+};
+/**
+ * The fence's holder check: every live entry, in the holder file of each
+ * directory, that lists one of `files` blocks; so does a holder file that
+ * can't be read or parsed (an absent one is fine). An entry this version
+ * can't read blocks too, because it may belong to a live process. Nothing is
+ * excused by pid, not even this process's own: the mover registers nothing
+ * before it has decided, so any entry of its pid belongs to another copy of
+ * the code.
+ */
+export declare function holderFenceBlockers(input: {
+    directories: readonly string[];
+    files: readonly string[];
+    liveness?: HolderLiveness;
+}): Promise<FenceBlocker[]>;
+/** Where pid artifacts of older versions may be found. */
+export interface PreNArtifactLocations {
+    /** Folders whose every subfolder holds RPC port files (`<root>/rpc`). */
+    readonly rpcRoots: readonly string[];
+    /** Folders that hold RPC port files directly (an overridden RPC folder). */
+    readonly rpcDirs: readonly string[];
+    /** CacheKeep registry folders (`<pid>-<uuid>.json` records). */
+    readonly cacheKeepDirs: readonly string[];
+}
+/** The artifact folders this process can find for `env`. */
+export declare function defaultPreNArtifactLocations(env?: NodeJS.ProcessEnv, home?: string): PreNArtifactLocations;
+/**
+ * The fence's check for older versions: an RPC port file or CacheKeep record without the
+ * `writer` stamp, whose pid is alive, belongs to a version that registers
+ * nothing and blocks. Every entry is read; a folder or file that can't be
+ * read or parsed blocks too. No timestamp ever clears a live pid.
+ */
+export declare function preNArtifactBlockers(locations: PreNArtifactLocations, pidAlive?: (pid: number) => boolean): Promise<FenceBlocker[]>;
+/** One line naming a blocker, for the log. */
+export declare function describeFenceBlocker(blocker: FenceBlocker): string;

package/dist/native-local-runtime-readers.d.ts

@@ -1,5 +1,5 @@
 import type { NativeRefreshHooks, NativeRefreshRestriction, NativeRefreshSubject } from './native-refresh-coordinator.ts';
-import type { NativePoolPaths } from './pool-paths.ts';
+import { type NativePoolPaths } from './pool-paths.ts';
 /** Host adapters supply mode, account and quota policy for local OAuth authorization and refresh. */
 export type NativeLocalExternalPolicy = Exclude<NativeRefreshRestriction, {
     credentialFingerprint: string;

package/dist/native-vault-paths.d.ts

@@ -1,4 +1,4 @@
-import type { NativePoolPaths } from './pool-paths.ts';
+import { type NativePoolPaths } from './pool-paths.ts';
 import { type StateLayout } from './state-layout-paths.ts';
 /** Vault files have no migration journal: enrollment alone authorizes their use. */
 export interface NativeVaultPaths {
@@ -13,10 +13,9 @@ export interface NativeVaultPaths {
 /**
  * Keep vault settings, metadata and affinity outside every local recovery file.
  *
- * `layout` must be the one `local` was resolved in: the local paths don't say
- * where the vault's state files are. It defaults to this process's layout
- * decision. Vault settings stay beside the account file in every layout, and
- * the storage id is always computed from the vault store state's
- * legacy-layout path.
+ * `layout` must be the one `local` was resolved in. It defaults to the layout
+ * `local` itself shows (see `stateLayoutOfPaths`). Vault settings stay beside
+ * the account file in every layout, and the storage id is always computed
+ * from the vault store state's legacy-layout path.
  */
 export declare function nativeVaultPaths(local: NativePoolPaths, layout?: StateLayout): NativeVaultPaths;

package/dist/pool-paths.d.ts

@@ -9,6 +9,12 @@ export interface NativePoolPaths {
     roster: string;
     storageId: string;
 }
+/**
+ * The layout `paths` were resolved in. In the legacy and explicit layouts the
+ * runtime file sits beside the account state file; only the state-home layout
+ * puts it in another folder, which is then the state-home folder.
+ */
+export declare function stateLayoutOfPaths(paths: Pick<NativePoolPaths, 'legacyState' | 'runtime'>): StateLayout;
 /** Local hosts share the native pool's routing file unless explicitly overridden. */
 export declare function resolveLocalRoutingDestination(host: 'opencode' | 'pi', paths: NativePoolPaths, env: NodeJS.ProcessEnv): string;
 /**

package/dist/pool-store.d.ts

@@ -26,6 +26,13 @@ export declare function nativePoolStoreLocks(paths: NativePoolStorePaths): reado
     readonly path: string;
     readonly name: 'pool-state';
 }];
+/**
+ * Close every store this process opened on one of `statePaths`. Closing
+ * drains the store's coalesced quota writes (bounded by common-auth's drain
+ * time) and makes later quota readings on it refuse. Returns how many were
+ * closed; a failed close rejects.
+ */
+export declare function drainNativePoolStores(statePaths: readonly string[]): Promise<number>;
 /**
  * Storage machinery only. Callers must separately establish local migration
  * authority or vault enrollment authority before using these files.

package/dist/relocation-guard.d.ts

@@ -1,4 +1,4 @@
-import type { NativePoolPaths } from './pool-paths.ts';
+import { type NativePoolPaths } from './pool-paths.ts';
 import { type RelocationPointer } from './state-layout-paths.ts';
 /**
  * Fixed text of the refusal a process gives once a newer version has moved
@@ -33,6 +33,11 @@ export interface RelocationGuard {
     isRelocated(): Promise<boolean>;
 }
 /** The first tombstone among `runtimePaths`, with the path that holds it. */
+/**
+ * Forget every runtime file observation, so the next check reads each file
+ * again. A move calls it after replacing files in this process.
+ */
+export declare function forgetRelocationObservations(): void;
 export declare function findRelocationTombstone(runtimePaths: readonly string[]): Promise<{
     path: string;
     pointer: RelocationPointer;
@@ -44,5 +49,11 @@ export declare function createRelocationGuard(runtimePaths: readonly string[]):
  * runtime. A move replaces both with tombstones before it commits.
  */
 export declare function nativeRelocationRuntimePaths(paths: NativePoolPaths): [string, string];
-/** A guard over a dataset's two legacy runtime files. */
+/**
+ * The guard for a dataset's locked write callbacks. In the legacy layout it
+ * refuses once a newer version has moved the dataset (a tombstone over either
+ * legacy runtime file). In the state-home layout the tombstones are expected,
+ * and the same callbacks instead refuse once the dataset is in conflict: an
+ * old copy of the credentials or journal is back beside the moved one.
+ */
 export declare function nativeRelocationGuard(paths: NativePoolPaths): RelocationGuard;

package/dist/state-home-serving-guard.d.ts

@@ -0,0 +1,84 @@
+import type { NativePoolPaths } from './pool-paths.ts';
+import type { RelocationGuard } from './relocation-guard.ts';
+import { StateLayoutRefusalError } from './state-layout-errors.ts';
+import { type StateLayoutRecord } from './state-layout-record.ts';
+/** The files a state-home process watches for a conflict with its own copies. */
+export interface StateHomeServingFiles {
+    /** The state-home folder, holding `layout.json`. */
+    readonly sub: string;
+    readonly oldPoolState: string;
+    readonly newPoolState: string;
+    readonly oldJournal: string;
+    readonly newJournal: string;
+    /**
+     * The old custody roster and vault store state, roster and routing files.
+     * They hold no credential, so one back in the old folder is only warned
+     * about.
+     */
+    readonly oldMetadata: readonly string[];
+}
+/**
+ * The serving files of a state-home dataset. Only OpenCode's default dataset
+ * can be in the state-home layout, so the old copies have the default names
+ * beside the account state file.
+ */
+export declare function stateHomeServingFiles(paths: Pick<NativePoolPaths, 'legacyState' | 'state' | 'journal' | 'runtime'>): StateHomeServingFiles;
+/** Old files that hold no credential and are back in the old folder after a move. */
+export declare function reappearedMetadataFiles(record: StateLayoutRecord): Promise<string[]>;
+/**
+ * Warn, once per file and process, about old metadata files back in the old
+ * folder. Serving goes on: they hold no credential and nothing reads them.
+ */
+export declare function warnReappearedMetadata(record: StateLayoutRecord): Promise<void>;
+/**
+ * What an old file holds: absent, the hash of a regular file, or `other` for
+ * anything that isn't a plain file (a symlink, a folder), which can never be
+ * proven to be the verified copy.
+ */
+type Observed = string | 'absent' | 'other';
+/** What the serving check saw of the old files. */
+export interface StateHomeObservation {
+    readonly oldJournal: boolean;
+    readonly oldPoolState: Observed;
+    /**
+     * The journal under the name the move set it aside as
+     * (`<journal>.moving-<attempt>`). Cleanup removes it; until then it must
+     * still hold the verified bytes.
+     */
+    readonly movingJournal: Observed;
+}
+/**
+ * Why a state-home dataset must not be served now, or undefined when it may.
+ * An old pool state or journal back at the legacy path after the move, or an
+ * old pool state or set-aside journal whose bytes differ from the verified
+ * copy while cleanup is still pending, is a fatal conflict: two
+ * usable-looking copies of a single-use refresh token.
+ */
+export declare function stateHomeConflictFrom(record: StateLayoutRecord, files: StateHomeServingFiles, observed: StateHomeObservation): StateLayoutRefusalError | undefined;
+/** Read the marker and old files and report a conflict, without caching. */
+export declare function checkStateHomeServing(files: StateHomeServingFiles): Promise<StateLayoutRefusalError | undefined>;
+/** What a test observes of the guard's file access. */
+export type StateHomeServingProbe = (event: {
+    type: 'lstat';
+    paths: number;
+} | {
+    type: 'read';
+}) => void;
+/** Observe the guard's `lstat` calls and its full reads; tests only. */
+export declare function probeStateHomeServingForTests(next: StateHomeServingProbe | undefined): void;
+/**
+ * A guard that stops an already serving state-home process once its dataset
+ * is in conflict. It has the relocation guard's shape so every locked write
+ * callback that checks for a move (vault store, roster, routing, authorize)
+ * checks for a conflict instead. It also warns once about an old metadata
+ * file back in the old folder. It takes no lock, and reads files again only
+ * when the `lstat` identity of the marker, an old file or the set-aside
+ * journal changed, so a check costs a few parallel `lstat`s while nothing
+ * changes.
+ */
+export declare function createStateHomeServingGuard(files: StateHomeServingFiles): RelocationGuard & {
+    check(): Promise<StateLayoutRefusalError | undefined>;
+};
+/** Forget logged conflicts and shared observations; tests only. */
+export declare function resetStateHomeServingGuardForTests(): void;
+export {};

package/dist/state-layout-decision.d.ts

@@ -0,0 +1,126 @@
+import { type HolderLiveness, type HolderRole, type NativeHolderRegistration } from './holder-registry.ts';
+import { type PreNArtifactLocations } from './layout-fence.ts';
+import type { NativeLockEvent } from './native-lock-observer.ts';
+import { type NativePoolPaths } from './pool-paths.ts';
+import { type StateLayoutFs } from './state-layout-io.ts';
+import { type RelocationDataset, type StateLayoutStep } from './state-layout-move.ts';
+import { type StateLayout } from './state-layout-paths.ts';
+import { type StateLayoutRecord } from './state-layout-record.ts';
+/**
+ * Whether a start may move OpenCode's dataset out of its config folder into
+ * the state folder. While it is false, a start the fence would let move keeps
+ * the legacy layout instead, and registration of a dataset that has not
+ * moved is best-effort, as in 2.4.x (see `unmovedRegistrationPolicy`).
+ * Everything else the decision does still runs: serving a dataset already
+ * moved, recovering an unfinished move or restore, the conflict and refusal
+ * checks, and the mandatory state-home registration. The release that ships
+ * the move turns it on.
+ */
+export declare const RELOCATION_MOVE_ENABLED = false;
+/** Turn the move on or off for this process, or back to the default; tests only. */
+export declare function setRelocationMoveEnabledForTests(enabled: boolean | undefined): void;
+/**
+ * How a dataset that has not moved (OpenCode's legacy or explicit dataset,
+ * or Pi's) is registered, from the same switch as the move itself.
+ *
+ * While moving is off this code ships in ordinary releases before the move
+ * release, and must serve every install that 2.4.x serves. So, as in 2.4.x,
+ * a failed registration is logged once at WARN and retried in the
+ * background (`undefined`, the ordinary policy of `registerNativePoolHolder`).
+ * Once moving is on, an unregistered process could have its files moved from
+ * under it, so registration is `mandatory`. Either way a state-home
+ * admission must register, and a relocation tombstone or an override into a
+ * managed folder refuses.
+ */
+export declare function unmovedRegistrationPolicy(options?: {
+    moveEnabled?: boolean;
+}): 'mandatory' | undefined;
+/** Why a start the fence would let move stays legacy while moving is off. */
+export declare const RELOCATION_MOVE_DISABLED_REASON = "moving state out of the config folder is not enabled in this release";
+export interface DecideStateLayoutOptions {
+    role: HolderRole;
+    env?: NodeJS.ProcessEnv;
+    home?: string;
+    /** Filesystem seam; `node:fs` for this platform otherwise. */
+    fs?: StateLayoutFs;
+    liveness?: HolderLiveness;
+    /** Where pid artifacts of older versions are looked for. */
+    artifacts?: PreNArtifactLocations;
+    onLockEvent?: (event: NativeLockEvent) => void;
+    /** Runs at each named step of a move, rollback or cleanup; tests inject faults here. */
+    onStep?: (step: StateLayoutStep) => void | Promise<void>;
+    now?: () => number;
+    /** Tests shorten the waits; production uses the defaults. */
+    timeouts?: {
+        layoutMs?: number;
+        holderMs?: number;
+        dataMs?: number;
+        /** Between background retries of a failed registration. */
+        retryMs?: number;
+    };
+    /** Overrides `RELOCATION_MOVE_ENABLED`; tests only. */
+    moveEnabled?: boolean;
+}
+/** The layout a process uses for OpenCode's dataset, decided once at start. */
+export type StateLayoutDecision = {
+    readonly kind: 'explicit';
+    readonly layout: StateLayout;
+    readonly registration: NativeHolderRegistration;
+} | {
+    readonly kind: 'legacy';
+    readonly layout: StateLayout;
+    /** Why the dataset was not moved, when a move was considered. */
+    readonly reasons: readonly string[];
+    readonly registration?: NativeHolderRegistration;
+} | {
+    readonly kind: 'state-home';
+    readonly layout: StateLayout;
+    readonly dataset: RelocationDataset;
+    readonly record: StateLayoutRecord;
+    /** True when this process made the move. */
+    readonly moved: boolean;
+};
+/**
+ * Decide, once at start and before any pool path is resolved, where this
+ * process keeps OpenCode's dataset, moving it into the state
+ * folder when nothing can still be using the old files. The
+ * result is recorded for the process, so every later resolution of the
+ * dataset uses it; it never changes.
+ *
+ * Refuses with `StateLayoutRefusalError` or `HolderRegistrationError` when
+ * neither copy may be served safely; the process must then do no pool I/O
+ * for the dataset. `RelocatedError` is never thrown here: a dataset moved by
+ * a newer version of the same layout rules is served from its new folder.
+ */
+export declare function decideOpenCodeStateLayout(options: DecideStateLayoutOptions): Promise<StateLayoutDecision>;
+/**
+ * `decideOpenCodeStateLayout`, once per process for each dataset: every
+ * later call with the same config folder, state root and overrides gets the
+ * same decision. A refusal is not kept, so a later start in the same
+ * process (for example after "start again in a minute") decides afresh.
+ */
+export declare function decideOpenCodeStateLayoutOnce(options: DecideStateLayoutOptions): Promise<StateLayoutDecision>;
+/** Forget the decisions this process made; tests only. */
+export declare function resetStateLayoutDecisionsForTests(): void;
+/**
+ * Pi's part of the decision. Pi never moves: OpenCode doesn't watch its
+ * folder, so its dataset stays in the legacy layout. It still registers
+ * beside its files before any pool I/O, by `unmovedRegistrationPolicy`, so a
+ * move of a dataset it aliases waits for it and an alias into a moved or
+ * managed folder refuses.
+ */
+export declare function decidePiStateLayout(options: {
+    paths: NativePoolPaths;
+    role: HolderRole;
+    onLockEvent?: (event: NativeLockEvent) => void;
+    liveness?: HolderLiveness;
+    lockTimeoutMs?: number;
+    /** Between background retries of a failed registration; tests only. */
+    retryIntervalMs?: number;
+    /** Overrides `RELOCATION_MOVE_ENABLED`; tests only. */
+    moveEnabled?: boolean;
+}): Promise<{
+    readonly kind: 'pi';
+    readonly layout: StateLayout;
+    readonly registration: NativeHolderRegistration;
+}>;

package/dist/state-layout-errors.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Why a process refuses to use a dataset while deciding or serving the
+ * state-home layout. Each code has one fixed message; where a person must act
+ * on a file, the message names it.
+ */
+export type StateLayoutRefusalCode = 
+/** An old copy of the credentials or journal is back beside a moved copy. */
+'conflict'
+/** The dataset was moved under another state root (`XDG_STATE_HOME`). */
+ | 'moved-elsewhere'
+/** A marker or tombstone belongs to a different config folder or dataset. */
+ | 'other-dataset'
+/** `layout.json` exists but can't be read or parsed, or is missing after a move. */
+ | 'marker-unreadable'
+/** A restore to the legacy layout stopped part way. */
+ | 'restore-unfinished'
+/** Another process holds the layout for longer than this process waits. */
+ | 'busy'
+/** The move could not be made durable or undone; serving either copy is unsafe. */
+ | 'unsafe'
+/** The state folder holds data this process can't prove it wrote. */
+ | 'unexpected-data'
+/** A restore to the legacy layout can't start; the message names what to fix. */
+ | 'restore-refused'
+/**
+ * A folder or file that decides where the state is (the config folder, the
+ * state folder, or a lock beside them) could not be read or written.
+ */
+ | 'io-failed';
+/** The command that restores the legacy layout, as users run it. */
+export declare const RESTORE_LEGACY_COMMAND = "npx @cortexkit/opencode-anthropic-auth setup --restore-legacy";
+/** Every refusal code, for readers that check a code they were handed. */
+export declare const STATE_LAYOUT_REFUSAL_CODES: readonly StateLayoutRefusalCode[];
+/** Whether `value` is one of `STATE_LAYOUT_REFUSAL_CODES`. */
+export declare function isStateLayoutRefusalCode(value: unknown): value is StateLayoutRefusalCode;
+/** Every fixed message `stateLayoutRefusalPublicMessage` can return. */
+export declare const STATE_LAYOUT_REFUSAL_PUBLIC_MESSAGES: readonly string[];
+/** The fixed message, naming no file, for a refusal with `code`. */
+export declare function stateLayoutRefusalPublicMessage(code: StateLayoutRefusalCode): string;
+/**
+ * A refusal to serve a dataset from either layout. The process must not do
+ * any pool I/O for the dataset after it.
+ */
+export declare class StateLayoutRefusalError extends Error {
+    readonly code: StateLayoutRefusalCode;
+    /** The files the message names, for logs and diagnostics. */
+    readonly paths: readonly string[];
+    constructor(code: StateLayoutRefusalCode, message: string, paths?: readonly string[], cause?: unknown);
+}
+/**
+ * Two copies of the local credentials (or of the migration journal) exist:
+ * the moved one in the state folder and an old one in the config folder that
+ * changed or reappeared after the move was verified. Using either could spend
+ * a single-use refresh token twice, so every process stops serving the
+ * dataset until a person keeps one copy.
+ */
+export declare function stateLayoutConflict(oldPath: string, newPath: string, cause?: unknown): StateLayoutRefusalError;
+/**
+ * A file system failure while deciding or changing where the state is, such
+ * as a lock file that can't be created or a folder that can't be resolved.
+ * `what` says what was being done, for the log; the public text is fixed.
+ */
+export declare function stateLayoutIoFailure(what: string, paths: readonly string[], cause: unknown): StateLayoutRefusalError;
+/** The dataset was moved to a state root other than the one this process uses. */
+export declare function stateLayoutMovedElsewhere(configDir: string, relocatedTo: string, stateRoot: string): StateLayoutRefusalError;

package/dist/state-layout-io.d.ts

@@ -0,0 +1,109 @@
+import { type NativeLockEvent } from './native-lock-observer.ts';
+/**
+ * The filesystem calls a layout transition makes, so tests can fail one, drop
+ * one, or record their order. Production uses `node:fs`.
+ */
+export interface StateLayoutFs {
+    readonly platform: NodeJS.Platform;
+    rename(from: string, to: string): Promise<void>;
+    unlink(path: string): Promise<void>;
+    /**
+     * Make a directory's entries durable. On Windows Node can't flush a
+     * directory, so this does nothing there: renames rely on NTFS applying
+     * metadata changes in the order they were made.
+     */
+    syncDirectory(dir: string): Promise<void>;
+    /** Flush a file's bytes to disk. Defaults to `syncFile`. */
+    syncFile?: (path: string) => Promise<void>;
+    /**
+     * Create a file owner-only and exclusively with `bytes`, flushed. Defaults
+     * to `writeOwnerOnlyExclusive` for `platform`.
+     */
+    createOwnerOnly?: (path: string, bytes: Uint8Array) => Promise<void>;
+    /** Retry pacing for Windows sharing violations. */
+    now?: () => number;
+    sleep?: (ms: number) => Promise<void>;
+}
+/** Create a file owner-only through `fs`. */
+export declare function createOwnerOnlyFile(fs: StateLayoutFs, path: string, bytes: Uint8Array): Promise<void>;
+/** Flush a file's bytes to disk. */
+export declare function syncFile(path: string): Promise<void>;
+export declare function defaultStateLayoutFs(platform?: NodeJS.Platform): StateLayoutFs;
+/** What a path holds, by content hash. */
+export type FileDigest = {
+    readonly status: 'absent';
+} | {
+    readonly status: 'file';
+    readonly sha256: string;
+};
+export declare function sha256Hex(bytes: Uint8Array | string): string;
+/**
+ * Hash a regular file without following a symlink at the path. Anything other
+ * than an absent path or a regular file is refused: the mover only ever
+ * handles files it can prove are plain data files.
+ */
+export declare function digestFile(path: string): Promise<FileDigest>;
+/** The sha256 of a regular file, or null when the path is absent. */
+export declare function fileSha256(path: string): Promise<string | null>;
+/**
+ * Create `path` owner-only and exclusively, write `bytes`, and flush them.
+ * On POSIX the file is created `0600`; on Windows the native helper sets a
+ * protected owner-only DACL before any byte is written. The file never exists
+ * with wider permissions, so no later `chmod` is needed.
+ */
+export declare function writeOwnerOnlyExclusive(path: string, bytes: Uint8Array, platform: NodeJS.Platform): Promise<void>;
+/** A target changed between the check before a destructive step and the step. */
+export declare class StateLayoutOwnershipError extends Error {
+    readonly path: string;
+    constructor(path: string, detail: string);
+}
+/**
+ * One destructive step of a layout transition: a rename onto a final name or
+ * an unlink. Before the first attempt every lease is asserted and `expect`
+ * checks that the slot still holds what the phase recorded; a mismatch throws
+ * `StateLayoutOwnershipError` and nothing is changed. On Windows a sharing
+ * violation is retried for up to 500 ms, and each retry asserts the leases and
+ * repeats `expect` first; a mismatch there returns `skipped` without retrying.
+ */
+export declare function publishOwned(step: {
+    readonly kind: 'rename';
+    readonly from: string;
+    readonly to: string;
+} | {
+    readonly kind: 'unlink';
+    readonly path: string;
+}, guard: {
+    assertLeases(): Promise<void>;
+    /** Resolves to a reason when the slot no longer holds what is expected. */
+    expect(): Promise<string | undefined>;
+}, fs: StateLayoutFs): Promise<'published' | 'skipped'>;
+/** A lock a layout transition takes: `<path>.<name>.lock`. */
+export interface StateLayoutLockSpec {
+    readonly name: string;
+    readonly path: string;
+    readonly ttlMs?: number;
+    readonly timeoutMs?: number;
+}
+/**
+ * Locks taken in a fixed order and released in reverse. Each lock is a
+ * renewed common-auth file lease, the same kind every pool, runtime, roster
+ * and routing writer takes, so holding one excludes those writers in every
+ * process. Every acquisition re-asserts the leases already held, because a
+ * long wait is exactly when an earlier lease can be lost.
+ */
+export declare class StateLayoutLockStack {
+    private readonly held;
+    private readonly observe;
+    constructor(onLockEvent?: (event: NativeLockEvent) => void);
+    get size(): number;
+    /** The names of the held locks, oldest first; for tests and logs. */
+    heldLocks(): readonly {
+        name: string;
+        path: string;
+    }[];
+    acquire(spec: StateLayoutLockSpec): Promise<void>;
+    assertAll(): Promise<void>;
+    /** Release every lock taken after `mark` (an earlier `size`), newest first. */
+    releaseTo(mark: number): Promise<void>;
+    releaseAll(): Promise<void>;
+}