@cortexkit/anthropic-auth-core 2.4.0 → 2.4.2

package/dist/state-layout-move.d.ts

@@ -0,0 +1,253 @@
+import { type NativeVaultPaths } from './native-vault-paths.ts';
+import { type NativePoolPaths } from './pool-paths.ts';
+import { publishOwned, type StateLayoutFs, type StateLayoutLockSpec, type StateLayoutLockStack } from './state-layout-io.ts';
+import { type RelocationRole, type StateLayoutRecord } from './state-layout-record.ts';
+export { movingJournalPath } from './state-layout-record.ts';
+/** Lock name of the layout lock on `<sub>/layout.json`. */
+export declare const LAYOUT_LOCK_NAME = "runtime-layout";
+/** How long a process waits for the layout lock: a whole move at 15 s per contended lock. */
+export declare const LAYOUT_LOCK_TIMEOUT_MS = 120000;
+/** One file slot of a dataset in both layouts. */
+export interface RelocationSlot {
+    readonly role: RelocationRole;
+    /** The canonical legacy-layout path, in the config folder. */
+    readonly from: string;
+    /**
+     * The legacy-layout path as configured: the config folder as given joined
+     * with the role's fixed file name. `from` follows a symlink at the leaf, so
+     * only this path shows whether the configured file is a link.
+     */
+    readonly configured: string;
+    /** The state-home path, in `<sub>`. */
+    readonly to: string;
+}
+/**
+ * OpenCode's default dataset of one config folder, resolved in both layouts.
+ * Only that dataset ever moves.
+ */
+export interface RelocationDataset {
+    /** The config folder as configured (not canonicalized). */
+    readonly configDir: string;
+    readonly identity: string;
+    readonly stateRoot: string;
+    /** The canonical state-home folder. */
+    readonly sub: string;
+    /** The canonical config folder holding the legacy files. */
+    readonly oldDir: string;
+    readonly oldPaths: NativePoolPaths;
+    readonly oldVault: NativeVaultPaths;
+    readonly newPaths: NativePoolPaths;
+    readonly newVault: NativeVaultPaths;
+    readonly slots: readonly RelocationSlot[];
+    readonly storageIds: {
+        readonly local: string;
+        readonly vault: string;
+    };
+}
+/** The legacy-layout files of OpenCode's default dataset of one config folder. */
+export interface LegacyDatasetFiles {
+    /** The canonical config folder holding the legacy files. */
+    readonly oldDir: string;
+    readonly oldPaths: NativePoolPaths;
+    readonly oldVault: NativeVaultPaths;
+}
+/**
+ * Resolve only the config folder's side of the dataset. Nothing under the
+ * state folder is resolved or read, so a start that stays legacy does not
+ * depend on the state folder being readable.
+ */
+export declare function resolveLegacyDatasetFiles(configDir: string): Promise<LegacyDatasetFiles>;
+export declare function resolveRelocationDataset(input: {
+    configDir: string;
+    identity: string;
+    stateRoot: string;
+    /** The canonical state-home folder. */
+    sub: string;
+}): Promise<RelocationDataset>;
+/** The named points of a transition; the step hook runs at each. */
+export type StateLayoutStep = 'old-holders-locking' | 'locks-held' | 'fence-checked' | 'config-dir-written' | 'preparing-written' | `copied:${RelocationRole}` | 'copies-flushed' | 'artifacts-checked' | 'journal-set-aside' | 'local-runtime-tombstoned' | 'vault-runtime-tombstoned' | 'old-dir-flushed' | 'verified' | 'committed' | `cleanup:${RelocationRole}` | 'cleanup-recorded' | 'rollback:journal' | 'rollback:localRuntime' | 'rollback:vaultRuntime' | 'rollback:old-dir-flushed' | 'rollback:destination-removed' | 'rollback:sub-flushed' | 'rolled-back' | 'restore:locks-held' | 'restore:discarded' | 'restore:restoring-written' | `restore:staged:${RelocationRole}` | 'restore:staging-flushed' | 'restore:staged-written' | `restore:placed:${RelocationRole}` | 'restore:data-flushed' | 'restore:barriers-flushed' | 'restore:restored-written' | `restore:retired:${RelocationRole}` | 'restore:sub-flushed' | 'restore:done';
+/**
+ * Thrown by a step hook to stop a transition exactly there, with no rollback
+ * and nothing else written, as a crash of the process would. Tests use it to
+ * leave every intermediate state on disk; the transition releases its locks
+ * so the next start needn't wait for their leases to expire.
+ */
+export declare class StateLayoutCrash extends Error {
+    readonly step: StateLayoutStep;
+    constructor(step: StateLayoutStep);
+}
+/** Everything a transition needs besides the dataset. */
+export interface StateLayoutTransitionContext {
+    readonly fs: StateLayoutFs;
+    readonly stack: StateLayoutLockStack;
+    readonly release: string;
+    readonly now: () => number;
+    readonly onStep?: (step: StateLayoutStep) => void | Promise<void>;
+    /** The longest wait for one data lock; the pool store's default otherwise. */
+    readonly dataLockTimeoutMs?: number;
+    /** The longest wait for a holder lock. */
+    readonly holderLockTimeoutMs?: number;
+}
+export declare function stateLayoutStep(ctx: StateLayoutTransitionContext, step: StateLayoutStep): Promise<void>;
+/** The two holder files a transition locks, in the order it locks them. */
+export declare function transitionHolderFiles(dataset: RelocationDataset): string[];
+/**
+ * Take the `holders` lock on `holderFile`. Waiting too long throws
+ * `LockContentionError`, which callers report as busy. Any other failure to
+ * take it (the lock file can't be created: EACCES, EROFS, ENOSPC) throws
+ * `HolderRegistrationError('unavailable')`, whose fixed message names no
+ * file, so a host never shows the lock file's path. `timeoutMs` undefined
+ * waits the lock stack's default.
+ */
+export declare function acquireHolderLock(ctx: Pick<StateLayoutTransitionContext, 'stack'>, holderFile: string, timeoutMs: number | undefined): Promise<void>;
+/** Take the `holders` lock on both holder files, in sorted path order. */
+export declare function acquireHolderLocks(dataset: RelocationDataset, ctx: StateLayoutTransitionContext): Promise<void>;
+/** A pool's rows changed between the unlocked snapshot and its locks. */
+export declare class PoolSnapshotChanged extends Error {
+    readonly statePath: string;
+    constructor(statePath: string);
+}
+/** A pool can't be read, so its row locks can't be named. */
+export declare class PoolUnreadable extends Error {
+    readonly statePath: string;
+    readonly reason: string;
+    constructor(statePath: string, reason: string);
+}
+/**
+ * The refresh locks of one pool: every row lock (by id and by identity, since
+ * a refresh that started before the row learned its identity holds the id
+ * lock) and every per-identity provider lock, each list in the order it is
+ * taken. With the default provider lock between them, these are the locks
+ * common-auth's refresh holds from before the token exchange until the
+ * successor is written, so once they are held no refresh of this pool is
+ * between its exchange and its write.
+ */
+export interface PoolRefreshLocks {
+    readonly rows: readonly string[];
+    readonly providers: readonly string[];
+    readonly identities: readonly string[];
+}
+/**
+ * The one order in which every layout transition takes the data locks of a
+ * dataset's old files, each lock once: `native-migration`, the local pool's
+ * locks, the custody roster and local runtime, the vault pool's locks, the
+ * vault roster, the vault runtime and the vault routing file.
+ *
+ * A move passes `refresh`, which adds each pool's row and provider locks
+ * before its store locks, so that no refresh is in flight while it copies.
+ * A restore passes none: the old pool states are absent after a move's
+ * cleanup and the old-layout barriers stop every refresh before its provider
+ * call, while no process may use the moved copy without a live registration,
+ * which restore refuses. The restore order is therefore a subsequence of the
+ * move order, and the two can't wait on each other in opposite orders.
+ */
+export declare function stateLayoutDataLockOrder(dataset: RelocationDataset, options?: {
+    timeoutMs?: number;
+    refresh?: {
+        readonly local: PoolRefreshLocks;
+        readonly vault: PoolRefreshLocks;
+    };
+}): StateLayoutLockSpec[];
+/**
+ * Take every data lock of the dataset's old files in
+ * `stateLayoutDataLockOrder`. A move (`drainRefreshes`, the default) first
+ * reads each pool's rows without a lock to name their row and provider locks,
+ * then reads them again under the store locks: if a row changed while the
+ * locks were taken, everything is released and taken once more, and a second
+ * change throws `PoolSnapshotChanged`. A restore takes no row or provider
+ * lock.
+ */
+export declare function acquireDataLocks(dataset: RelocationDataset, ctx: StateLayoutTransitionContext, options?: {
+    drainRefreshes?: boolean;
+}): Promise<void>;
+/**
+ * Commit the coalesced writes this process has queued for the dataset before
+ * any lock is taken: close every pool store open on the old pool states (a
+ * bounded drain of their quota readings) and drain the vault roster's quota
+ * writer. Both commit under locks the mover is about to hold, so they must
+ * finish first. Afterwards forget every cached file observation, so nothing
+ * this process cached about the old files answers for them after the move.
+ */
+export declare function drainCoalescedWrites(dataset: RelocationDataset): Promise<void>;
+/** A relocation tombstone as written over an old runtime file. */
+export declare function relocationTombstone(record: Pick<StateLayoutRecord, 'sub' | 'stateRoot' | 'identity' | 'attempt' | 'by'>): string;
+export declare function tombstoneAttempt(path: string): Promise<string | undefined>;
+export declare function exists(path: string): Promise<boolean>;
+export declare function removeOwnStaging(path: string): Promise<void>;
+/**
+ * Why `record` doesn't list exactly the files of `dataset`, each role with the
+ * paths this start resolved, or undefined when it does. Recovery deletes and
+ * renames only files a record names, so a record naming any other file is
+ * never acted on.
+ */
+export declare function recordFilesProblem(record: Pick<StateLayoutRecord, 'files' | 'restore'>, dataset: Pick<RelocationDataset, 'slots'>): string | undefined;
+/** Why a move may not start, or undefined when it may. */
+export declare function movePreconditionFailure(dataset: RelocationDataset, platform: NodeJS.Platform): Promise<string | undefined>;
+/** A rollback met a state no supported writer produces; it changed nothing more. */
+export declare class StateLayoutRollbackRefused extends Error {
+    readonly path: string;
+    constructor(path: string, detail: string);
+}
+/** Expect `path` to hold bytes hashing to `sha256`, or to be absent for null. */
+export declare function expectDigest(path: string, sha256: string | null): () => Promise<string | undefined>;
+export declare function expectTombstone(path: string, attempt: string): () => Promise<string | undefined>;
+export declare function expectAbsent(path: string): () => Promise<string | undefined>;
+/**
+ * Rename `from` to `to` (or unlink `from` when `to` is undefined) through
+ * `publishOwned`, treating a skipped retry as a failure.
+ */
+export declare function owned(ctx: StateLayoutTransitionContext, step: Parameters<typeof publishOwned>[0], expect: () => Promise<string | undefined>): Promise<void>;
+/**
+ * Undo a `preparing` record, under the mover's full lock set. Only this
+ * attempt's own artifacts are undone; any other state is left alone because
+ * the old layout is still authoritative. Every step is a no-op once done, so
+ * recovery may run again from any point. Throws `StateLayoutRollbackRefused`
+ * when a slot is in a state no supported writer produces.
+ */
+export declare function rollbackPreparing(record: StateLayoutRecord, dataset: RelocationDataset, ctx: StateLayoutTransitionContext): Promise<StateLayoutRecord>;
+/**
+ * Remove the verified old copies, local pool state first, while
+ * every data lock is still held. A file is unlinked only if it still hashes
+ * to the recorded value. A changed or reappeared old pool state or journal is
+ * a conflict: both copies are kept and the record says `conflict`, which
+ * stops every state-home process. Any other changed file is kept and listed.
+ * Running it again after a conflict was resolved by hand finishes the
+ * cleanup.
+ *
+ * Once a credential conflict is found it outlives any later failure: if a
+ * later step or the final record write fails, the conflict is still recorded
+ * when possible, and the call throws a `conflict` refusal rather than the
+ * failure, so no caller can mistake it for an ordinary pending cleanup.
+ */
+export declare function cleanupOldCopies(record: StateLayoutRecord, dataset: RelocationDataset, ctx: StateLayoutTransitionContext): Promise<StateLayoutRecord>;
+/** How a move ended. */
+export type StateLayoutMoveOutcome = {
+    readonly status: 'committed';
+    readonly record: StateLayoutRecord;
+} | {
+    readonly status: 'rolled-back';
+    readonly reason: string;
+    readonly record?: StateLayoutRecord;
+};
+/**
+ * The move itself, under the layout lock, both holder locks and every data
+ * lock, all held by `ctx.stack`. `checkArtifacts` repeats the fence's check
+ * for pid artifacts of older versions and returns a blocker description or
+ * undefined.
+ *
+ * Before the commit any failure rolls back and resolves `rolled-back`; a
+ * rollback that refuses throws `StateLayoutRollbackRefused`. A failure of the
+ * commit write itself is resolved from the record on disk. After the commit
+ * nothing goes back to legacy: a cleanup failure leaves cleanup `pending` and
+ * still resolves `committed`.
+ */
+export declare function moveDataset(dataset: RelocationDataset, ctx: StateLayoutTransitionContext, checkArtifacts: () => Promise<string | undefined>): Promise<StateLayoutMoveOutcome>;
+/**
+ * Flush `<sub>/layout.json` and `<sub>`. A process that died after renaming
+ * a new record into place but before flushing `<sub>` leaves a record that
+ * power loss can still revert, so a process that acts on a record it found
+ * makes it durable first.
+ */
+export declare function syncLayoutRecord(dataset: Pick<RelocationDataset, 'sub'>, ctx: Pick<StateLayoutTransitionContext, 'fs'>): Promise<void>;
+/** Flush a committed record and `<sub>`. */
+export declare function syncCommitted(dataset: RelocationDataset, ctx: Pick<StateLayoutTransitionContext, 'fs'>): Promise<void>;

package/dist/state-layout-paths.d.ts

@@ -23,10 +23,19 @@ export declare const LEGACY_STATE_LAYOUT: StateLayout;
  * The layout a resolver uses when its caller passes none. A process decides it
  * once, before it resolves any pool path, and never switches: every
  * re-resolution must use the same layout as the first, or comparisons between
- * them fail. No process can choose the state-home layout yet, so this is
- * always the legacy layout.
+ * them fail. `legacyConfig` is the canonical account file the resolver works
+ * from. A dataset with no recorded decision, and every call without
+ * `legacyConfig`, uses the legacy layout.
  */
-export declare function processStateLayout(): StateLayout;
+export declare function processStateLayout(legacyConfig?: string): StateLayout;
+/**
+ * Record the layout decided for the dataset whose canonical account file is
+ * `legacyConfig`. A decision is final for the process: recording a different
+ * layout for the same dataset throws.
+ */
+export declare function recordProcessStateLayout(legacyConfig: string, layout: StateLayout): void;
+/** Forget every recorded layout decision; tests only. */
+export declare function resetProcessStateLayoutsForTests(): void;
 /** The `node:path` functions the pure helpers use; tests pass `path.win32`. */
 export type StatePathApi = Pick<typeof nodePath, 'join' | 'isAbsolute'>;
 export interface StateRootInputs {
@@ -86,6 +95,16 @@ export declare function resolveStateHomeTarget(options?: {
     env?: NodeJS.ProcessEnv;
     home?: string;
 }): StateHomeTarget | undefined;
+/**
+ * `resolveStateHomeTarget` for a config folder whose identity is already
+ * known. Naming the subfolder resolves the home directory's default config
+ * folder, which may be a different folder from the one in use, so a start
+ * that never looks at the state folder never calls this.
+ */
+export declare function stateHomeTargetFor(identity: string, options?: {
+    env?: NodeJS.ProcessEnv;
+    home?: string;
+}): StateHomeTarget;
 /**
  * Names of the files kept in a state-home subfolder. Data files keep their
  * default legacy names so the folder stays readable for manual recovery.
@@ -143,7 +162,12 @@ export interface ConfigDirMarker {
 export declare function readConfigDirMarker(dir: string): Promise<ConfigDirMarker | undefined>;
 export declare const STATE_LAYOUT_PHASES: readonly ['preparing', 'committed', 'rolled-back', 'restoring', 'restore-staged', 'restored'];
 export type StateLayoutPhase = (typeof STATE_LAYOUT_PHASES)[number];
-declare const CLEANUP_STATES: readonly ['pending', 'done', 'kept'];
+/**
+ * `conflict`: cleanup found that an old copy of the local pool state or the
+ * journal changed after the move was verified, so both copies are kept and no
+ * process serves the dataset until a person removes one of them.
+ */
+declare const CLEANUP_STATES: readonly ['pending', 'done', 'kept', 'conflict'];
 declare const RESTORE_CLEANUP_STATES: readonly ['pending', 'done'];
 /** The fields of `layout.json` that decide whether a process may use a layout. */
 export interface StateLayoutMarker {

package/dist/state-layout-record.d.ts

@@ -0,0 +1,120 @@
+import { publishOwned, type StateLayoutFs } from './state-layout-io.ts';
+import { type StateLayoutPhase } from './state-layout-paths.ts';
+/**
+ * The data files a move copies, in the order cleanup removes the old copies:
+ * the local pool state (refresh tokens) first.
+ */
+export declare const RELOCATION_ROLES: readonly ['localPoolState', 'journal', 'localRoster', 'vaultStoreState', 'vaultRoster', 'vaultRouting', 'localRuntime', 'vaultRuntime'];
+export type RelocationRole = (typeof RELOCATION_ROLES)[number];
+/** Old files whose change or reappearance after a move is a fatal conflict. */
+export declare const CREDENTIAL_AUTHORITY_ROLES: readonly RelocationRole[];
+/** One file of a move: where it was, where it goes, and its bytes' hash. */
+export interface RelocationFileRecord {
+    readonly role: RelocationRole;
+    readonly from: string;
+    readonly to: string;
+    /** Null when the file was absent at the move. */
+    readonly sha256: string | null;
+}
+export interface RelocationBarriers {
+    /** Whether the old journal existed and was set aside. */
+    readonly journal: 'present' | 'absent';
+    /** The hash of each old runtime before its tombstone, or null when absent. */
+    readonly localRuntime: {
+        readonly original: string | null;
+    };
+    readonly vaultRuntime: {
+        readonly original: string | null;
+    };
+}
+/** One file a restore copies back: from `to` (state folder) to `from` (config folder). */
+export interface RestoreFileRecord {
+    readonly role: RelocationRole;
+    /** The legacy-layout path the file goes back to. */
+    readonly from: string;
+    /** The state-home copy it is read from. */
+    readonly to: string;
+    readonly sha256: string;
+    /** `<from>.restoring-<restore attempt>`: the name it is staged under. */
+    readonly staging: string;
+}
+/**
+ * What a restore to the legacy layout records in `layout.json`. A restore
+ * done by hand (the documented manual procedure) writes only
+ * `{ cleanup: 'done' }` with phase `restored`; every restore made by the
+ * command records all fields.
+ */
+export interface StateLayoutRestoreRecord {
+    readonly attempt?: string;
+    readonly startedAt?: number;
+    readonly files?: readonly RestoreFileRecord[];
+    /**
+     * For each runtime: `copy` when the state folder holds one, which goes
+     * back over the tombstone; `unlink` when it holds none, so the tombstone
+     * is only removed.
+     */
+    readonly runtimes?: {
+        readonly local: 'copy' | 'unlink';
+        readonly vault: 'copy' | 'unlink';
+    };
+    /** Set from phase `restored` on: whether the state-folder copies are removed. */
+    readonly cleanup?: 'pending' | 'done';
+    /** State-folder copies that changed after they were staged; left in place. */
+    readonly kept?: readonly string[];
+}
+/** The staging name a restore uses for `from`. */
+export declare function restoreStagingPath(from: string, attempt: string): string;
+/** The full `layout.json` a move writes. */
+export interface StateLayoutRecord {
+    readonly version: 1;
+    readonly phase: StateLayoutPhase;
+    readonly attempt: string;
+    readonly identity: string;
+    readonly stateRoot: string;
+    readonly sub: string;
+    readonly oldDir: string;
+    readonly storageIds: {
+        readonly local: string;
+        readonly vault: string;
+    };
+    readonly by: string;
+    readonly startedAt: number;
+    readonly files: readonly RelocationFileRecord[];
+    readonly barriers: RelocationBarriers;
+    readonly committedAt?: number;
+    readonly cleanup?: 'pending' | 'done' | 'kept' | 'conflict';
+    /** Old non-credential files whose bytes changed after the move; left in place. */
+    readonly kept?: readonly string[];
+    /** Old credential or journal files found changed or back after the move. */
+    readonly conflict?: readonly {
+        readonly old: string;
+        readonly new: string;
+    }[];
+    readonly rolledBackAt?: number;
+    /** Present while a restore is under way or finished; written by restore. */
+    readonly restore?: StateLayoutRestoreRecord;
+}
+/**
+ * Whether `name` is exactly the name a move sets the journal named
+ * `journalName` aside under: `<journalName>.moving-<attempt>`, with a valid
+ * attempt id and nothing after it.
+ */
+export declare function isMovingJournalName(journalName: string, name: string): boolean;
+export declare function layoutRecordPath(sub: string): string;
+/** The name the journal is set aside under during a move. */
+export declare function movingJournalPath(journal: string, attempt: string): string;
+/**
+ * Read `<sub>/layout.json` in full. Undefined only when it is absent; any other
+ * read error, and any content that isn't a complete record, throws
+ * `StateLayoutFileError`. An unreadable marker never counts as "no move".
+ */
+export declare function readStateLayoutRecord(sub: string): Promise<StateLayoutRecord | undefined>;
+/**
+ * Publish `record` as `<sub>/layout.json` durably: stage it owner-only as
+ * `layout.json.<attempt>.<nonce>.tmp`, flush it, rename it into place through
+ * `publishOwned`, then flush `<sub>`. `expect` is the ownership check for the
+ * slot (for example "still this attempt's preparing record").
+ */
+export declare function publishStateLayoutRecord(record: StateLayoutRecord, guard: Parameters<typeof publishOwned>[1], fs: StateLayoutFs): Promise<void>;
+/** Whether `name` in `<sub>` is a staging file of a layout record. */
+export declare function isLayoutRecordStage(name: string, attempt?: string): boolean;

package/dist/state-layout-restore.d.ts

@@ -0,0 +1,83 @@
+import { type HolderLiveness } from './holder-registry.ts';
+import { type PreNArtifactLocations } from './layout-fence.ts';
+import type { NativeLockEvent } from './native-lock-observer.ts';
+import { type StateLayoutFs } from './state-layout-io.ts';
+import { type RelocationDataset, type StateLayoutStep, type StateLayoutTransitionContext } from './state-layout-move.ts';
+import { type StateLayoutRecord } from './state-layout-record.ts';
+export interface RestoreLegacyOptions {
+    env?: NodeJS.ProcessEnv;
+    home?: string;
+    /** Filesystem seam; `node:fs` for this platform otherwise. */
+    fs?: StateLayoutFs;
+    liveness?: HolderLiveness;
+    /** Where pid artifacts of older versions are looked for. */
+    artifacts?: PreNArtifactLocations;
+    onLockEvent?: (event: NativeLockEvent) => void;
+    /** Runs at each named step; tests inject faults here. */
+    onStep?: (step: StateLayoutStep) => void | Promise<void>;
+    now?: () => number;
+    /** Tests shorten the waits; production uses the defaults. */
+    timeouts?: {
+        layoutMs?: number;
+        holderMs?: number;
+        dataMs?: number;
+    };
+}
+/** How a restore ended. */
+export type RestoreLegacyOutcome = {
+    readonly status: 'restored';
+    /** The config folder that holds the dataset again. */
+    readonly oldDir: string;
+    /** The state folder it came from. */
+    readonly sub: string;
+    /** State-folder copies that changed after staging and were left in place. */
+    readonly kept: readonly string[];
+} | {
+    /** The dataset is already in the legacy layout; nothing was written. */
+    readonly status: 'not-moved';
+    readonly reason: string;
+};
+/**
+ * Make the record this run found durable, under the locks, before acting on
+ * it. The run that published it may have died after renaming it into place
+ * but before flushing `<sub>`: R3 or R5 acting on a record that power loss
+ * can still revert would leave legacy names or state-folder copies changed
+ * under an older phase, whose recovery goes the other way.
+ */
+export declare function syncObservedRestoreRecord(dataset: RelocationDataset, ctx: StateLayoutTransitionContext): Promise<void>;
+/**
+ * R5, under the restore's locks (or a start's layout and holder locks): remove
+ * each state-folder copy that still holds the bytes that were staged, then
+ * record the cleanup as done. A copy that changed, can't be read, or can't be
+ * removed is kept and listed: no process was admitted to the state folder
+ * since R1, so only a person can have changed it, and the legacy copy is
+ * already durable. Only the record write itself can fail this step.
+ */
+export declare function finishRestoreRetirement(record: StateLayoutRecord, dataset: RelocationDataset, ctx: StateLayoutTransitionContext): Promise<StateLayoutRecord>;
+/**
+ * Undo a restore that stopped before its boundary (phase `restoring`), under
+ * the layout lock and both holder locks: unlink this attempt's staging files,
+ * flush the config folder, then publish the move's record again as
+ * `committed`, as it was before the restore began. Nothing at a legacy name
+ * was touched before the boundary and the barriers stayed up, so no version
+ * served from the config folder, and the state-folder files were only read.
+ */
+export declare function discardAbandonedRestore(record: StateLayoutRecord, dataset: RelocationDataset, ctx: StateLayoutTransitionContext): Promise<StateLayoutRecord>;
+/**
+ * R3 to R5 of a restore whose staging is durable (phase `restore-staged`):
+ * classify every slot afresh, refuse before writing anything if one is in a
+ * state no supported writer produces, then put the data files in place, flush,
+ * remove the barriers, flush, publish `restored` and retire the state-folder
+ * copies. Running it again after a crash at any point converges.
+ */
+export declare function finishStagedRestore(record: StateLayoutRecord, dataset: RelocationDataset, ctx: StateLayoutTransitionContext): Promise<StateLayoutRecord>;
+/**
+ * Restore OpenCode's dataset from the state folder to the legacy layout in
+ * its config folder, or finish a restore that stopped. Run it only with every
+ * host stopped, behind setup's process fence; it also refuses while any
+ * process is registered beside either copy. Refuses with
+ * `StateLayoutRefusalError` (code `restore-refused` with a message naming
+ * what to fix, or a marker problem); resolves `not-moved` when there is
+ * nothing to restore.
+ */
+export declare function restoreLegacyLayout(options?: RestoreLegacyOptions): Promise<RestoreLegacyOutcome>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/anthropic-auth-core",
-  "version": "2.4.0",
+  "version": "2.4.2",
   "type": "module",
   "repository": {
     "type": "git",
@@ -33,9 +33,9 @@
     "@cortexkit/common-auth": "0.28.0"
   },
   "dependencies": {
-    "@cortexkit/claustrum-client": "0.12.0",
+    "@cortexkit/claustrum-client": "0.13.0",
     "@cortexkit/private-files": "0.2.1",
-    "@cortexkit/subc-client": "^0.22.0",
+    "@cortexkit/subc-client": "^0.22.10",
     "jsonc-parser": "^3.3.1",
     "xxhash-wasm": "^1.1.0"
   }