@cortexkit/anthropic-auth-core 2.4.9 → 2.4.11

package/dist/holder-registry.d.ts

@@ -105,22 +105,34 @@ export interface HolderLiveness {
     pidAlive(pid: number): boolean;
     /** Undefined or null when it can't be read. */
     incarnation(pid: number): Promise<string | null>;
+    /** Wall clock and OS uptime; tests replace both. */
+    now?(): number;
+    uptime?(): number;
 }
 /** The OS's fixed per-process value for `pid`, or null when none is read. */
 export declare function processIncarnation(pid: number): Promise<string | null>;
 /**
- * Whether an entry's process may still be running. A dead pid is stale. A
- * live pid is stale only when the entry recorded an incarnation and the OS
- * now reports a different one; an unreadable incarnation counts as alive.
- * So pid reuse can keep a stale entry, but never clears a live one.
+ * A process recorded before this boot cannot still be running, even if its
+ * pid is alive again. Keep a five-minute margin for clock imprecision, and
+ * keep blocking when the timestamp is missing, invalid or in the future.
  */
-export declare function holderEntryIsLive(entry: Pick<HolderEntry, 'pid' | 'incarnation'>, liveness?: HolderLiveness): Promise<boolean>;
+export declare function recordPredatesBoot(startedAt: unknown, clock?: Pick<HolderLiveness, 'now' | 'uptime'>): boolean;
+/**
+ * Whether an entry's process may still be running. An entry from before
+ * this boot or a dead pid is stale. Otherwise an unreadable incarnation
+ * counts as alive; only a different incarnation clears a live pid.
+ */
+export declare function holderEntryIsLive(entry: Pick<HolderEntry, 'pid' | 'incarnation'> & {
+    registeredAt?: unknown;
+}, liveness?: HolderLiveness): Promise<boolean>;
 export interface HolderFileContents {
     /** Entries as found, including any this version doesn't understand. */
     entries: unknown[];
 }
-/** An entry's pid and incarnation when it has a usable shape. */
-export declare function holderEntryLiveness(value: unknown): Pick<HolderEntry, 'pid' | 'incarnation'> | undefined;
+/** An entry's liveness fields when its pid and incarnation have a usable shape. */
+export declare function holderEntryLiveness(value: unknown): (Pick<HolderEntry, 'pid' | 'incarnation'> & {
+    registeredAt?: unknown;
+}) | undefined;
 /**
  * Read a holder file. Undefined when it is absent. A file that exists but
  * doesn't parse throws: rewriting it would erase other processes' entries.
@@ -185,10 +197,10 @@ export interface NativeHolderRegistration {
  */
 export declare function ensureHolderDirectory(dir: string, ownerOnly?: OwnerOnlyOptions): Promise<void>;
 /**
- * Add `entry` to `holderFile`, pruning entries of dead processes, while the
- * caller holds that file's `holders` lock. Writes nothing when a live entry
- * for this process, kind and files is already there. A holder file that
- * doesn't parse throws and is never overwritten.
+ * Add `entry` to `holderFile`, pruning stale entries, while the caller holds
+ * that file's `holders` lock. Writes nothing when nothing was pruned and a
+ * live entry for this process, kind and files is already there. A holder
+ * file that doesn't parse throws and is never overwritten.
  */
 export declare function publishHolderEntryLocked(holderFile: string, entry: HolderEntry, options: {
     liveness?: HolderLiveness;

package/dist/index.d.ts

@@ -87,6 +87,7 @@ export * from './quota-manager.ts';
 export * from './quotas.ts';
 export * from './relay.ts';
 export * from './relocation-guard.ts';
+export * from './request-abort.ts';
 export * from './request-gzip.ts';
 export * from './request-history.ts';
 export * from './routing.ts';

package/dist/index.js

@@ -4327,6 +4327,73 @@ async function generatePKCE() {
   };
 }
 
+// src/request-abort.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+function raceWithSignal(signal, operation) {
+  if (!signal)
+    return operation();
+  if (signal.aborted)
+    return Promise.reject(signal.reason);
+  return new Promise((resolve5, reject) => {
+    const aborted = () => reject(signal.reason);
+    signal.addEventListener("abort", aborted, { once: true });
+    const finish = () => signal.removeEventListener("abort", aborted);
+    Promise.resolve().then(() => {
+      signal.throwIfAborted();
+      return operation();
+    }).then((value) => {
+      finish();
+      if (signal.aborted)
+        reject(signal.reason);
+      else
+        resolve5(value);
+    }, (error) => {
+      finish();
+      reject(signal.aborted ? signal.reason : error);
+    });
+  });
+}
+function abortableFetch(send) {
+  return (input, init) => {
+    const signal = init?.signal !== undefined ? init.signal : input instanceof Request ? input.signal : undefined;
+    return runWithRequestSignal(signal, () => send(input, init));
+  };
+}
+function withAbortableFetch(options) {
+  return { ...options, fetch: abortableFetch(options.fetch) };
+}
+var AUXILIARY_REQUEST_TIMEOUT_MS = 30000;
+function auxiliaryRequestSignal(signal) {
+  const deadline = AbortSignal.timeout(AUXILIARY_REQUEST_TIMEOUT_MS);
+  return signal ? AbortSignal.any([signal, deadline]) : deadline;
+}
+var requests = new AsyncLocalStorage;
+function requestSignal() {
+  return requests.getStore()?.signal;
+}
+function commitRequestChange(commit) {
+  const request = requests.getStore();
+  request?.signal?.throwIfAborted();
+  if (request)
+    request.commits.push(commit);
+  else
+    commit();
+}
+function runWithRequestSignal(signal, operation) {
+  const request = { signal, commits: [] };
+  return raceWithSignal(signal, () => requests.run(request, async () => {
+    try {
+      const result = await operation();
+      signal?.throwIfAborted();
+      for (const commit of request.commits)
+        commit();
+      return result;
+    } finally {
+      request.commits.length = 0;
+    }
+  }));
+}
+
 // src/auth.ts
 function parseRetryAfterHeader(value) {
   if (!value)
@@ -4370,7 +4437,9 @@ async function refreshClaudeOAuthToken(input) {
         const delay3 = baseDelayMs * 2 ** (attempt - 1);
         await new Promise((resolve5) => setTimeoutImpl(resolve5, delay3));
       }
-      const response = await fetchImpl(TOKEN_URL, {
+      const signal = auxiliaryRequestSignal();
+      const response = await raceWithSignal(signal, () => fetchImpl(TOKEN_URL, {
+        signal,
         method: "POST",
         redirect: "error",
         headers: {
@@ -4384,16 +4453,16 @@ async function refreshClaudeOAuthToken(input) {
           client_id: CLIENT_ID,
           scope: REFRESH_SCOPE
         })
-      });
+      }));
       if (!response.ok) {
         if (response.status >= 500 && attempt < maxRetries) {
-          await response.body?.cancel().catch(() => {});
+          await raceWithSignal(signal, async () => response.body?.cancel()).catch(() => {});
           continue;
         }
-        const body = await response.text().catch(() => "");
+        const body = await raceWithSignal(signal, () => response.text()).catch(() => "");
         throw new ClaudeOAuthRefreshError(response.status, body, response.headers.get("retry-after"));
       }
-      const json = await response.json();
+      const json = await raceWithSignal(signal, () => response.json());
       const refreshedAt = input.now?.() ?? Date.now();
       return {
         access: json.access_token,
@@ -5368,8 +5437,10 @@ function mapUsageWindow(window, checkedAt) {
 async function fetchOAuthQuotaSnapshot(input) {
   assertNotCustodyTombstone(input.accessToken, "anthropic");
   const fetchImpl = input.fetchImpl ?? fetch;
-  const response = await fetchImpl(QUOTA_URL, {
+  const signal = auxiliaryRequestSignal();
+  const response = await raceWithSignal(signal, () => fetchImpl(QUOTA_URL, {
     method: "GET",
+    signal,
     redirect: "error",
     headers: {
       Authorization: `Bearer ${input.accessToken}`,
@@ -5378,9 +5449,9 @@ async function fetchOAuthQuotaSnapshot(input) {
       "anthropic-beta": "oauth-2025-04-20",
       "User-Agent": `claude-code/${CLAUDE_CODE_VERSION}`
     }
-  });
+  }));
   if (!response.ok) {
-    const body = await response.text().catch(() => "");
+    const body = await raceWithSignal(signal, () => response.text()).catch(() => "");
     const error = Object.assign(new Error(`Claude quota check failed: ${response.status} — ${body}`), {
       status: response.status,
       retryAfter: parseRetryAfterHeader(response.headers.get("Retry-After"))
@@ -5388,7 +5459,7 @@ async function fetchOAuthQuotaSnapshot(input) {
     throw error;
   }
   const checkedAt = input.now?.() ?? Date.now();
-  const usage = await response.json();
+  const usage = await raceWithSignal(signal, () => response.json());
   const bindingWindow = mapBindingWindow(usage.limits);
   const snapshot = {
     five_hour: mapUsageWindow(usage.five_hour, checkedAt),
@@ -15013,11 +15084,12 @@ import { execFile } from "node:child_process";
 import { randomUUID as randomUUID14 } from "node:crypto";
 import { readFileSync as readFileSync2 } from "node:fs";
 import { lstat as lstat12, mkdir as mkdir10, readFile as readFile11 } from "node:fs/promises";
+import { uptime } from "node:os";
 import { basename as basename9, dirname as dirname17, join as join20 } from "node:path";
 
 // src/native-lock-observer.ts
-import { AsyncLocalStorage } from "node:async_hooks";
-var detachedLocks = new AsyncLocalStorage;
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
+var detachedLocks = new AsyncLocalStorage2;
 function withDetachedNativeLocks(work) {
   return detachedLocks.run(true, work);
 }
@@ -15149,8 +15221,8 @@ function recordIdentityIn(tx, id, identity2) {
 import { setTimeout as snapshotDelay } from "node:timers/promises";
 
 // ../../node_modules/@cortexkit/common-auth/dist/store/hooks.js
-import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
-var insideHook = new AsyncLocalStorage2;
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "node:async_hooks";
+var insideHook = new AsyncLocalStorage3;
 function assertNotInsideHook(operation) {
   if (insideHook.getStore() !== undefined)
     throw new PoolReentryError(operation);
@@ -21408,11 +21480,13 @@ class StickySessionRouter {
     })).sort((left, right) => left.score - right.score || left.candidate.order - right.candidate.order || left.candidate.accountId.localeCompare(right.candidate.accountId))[0]?.candidate;
   }
   async resolve(input) {
+    requestSignal()?.throwIfAborted();
     if (!input.sessionId)
       return null;
     this.recoverLocalPins();
     await this.prepareLegacySeed();
     await this.refreshStateIfChanged().catch(() => {});
+    requestSignal()?.throwIfAborted();
     const key = sessionKey(input.sessionId);
     const affinityModelId = input.affinityModelId ?? input.modelId;
     const matchesAffinity = (assignment2) => affinityModelId !== undefined ? assignment2.affinityModelId === affinityModelId : assignment2.family === input.family;
@@ -21429,10 +21503,12 @@ class StickySessionRouter {
     const cached = this.state.assignments[key];
     if (cached && this.assignmentIsActive(cached) && matchesAffinity(cached) && matchesAccountIdentity(cached) && input.retainAccountIds.has(this.logicalAccountId(cached)) && !input.excludeAccountIds?.has(this.logicalAccountId(cached))) {
       if (this.now() - cached.lastSeenAt >= STICKY_ROUTING_TOUCH_INTERVAL_MS) {
-        cached.lastSeenAt = this.now();
-        this.scheduleTouch(key);
+        commitRequestChange(() => {
+          cached.lastSeenAt = this.now();
+          this.scheduleTouch(key);
+        });
       }
-      this.retryChange(key);
+      commitRequestChange(() => this.retryChange(key));
       return {
         accountId: this.logicalAccountId(cached),
         assignment: { ...cached },
@@ -21442,7 +21518,7 @@ class StickySessionRouter {
     }
     const state = structuredClone(this.state);
     const save = (operation) => {
-      this.scheduleChange(key, state.assignments[key], operation);
+      commitRequestChange(() => this.scheduleChange(key, state.assignments[key], operation));
     };
     this.prune(state);
     const current = state.assignments[key];
@@ -22502,7 +22578,16 @@ var defaultLiveness = {
   pidAlive,
   incarnation: processIncarnation
 };
+function recordPredatesBoot(startedAt, clock = {}) {
+  if (typeof startedAt !== "number" || !Number.isFinite(startedAt) || startedAt < 0)
+    return false;
+  const now = (clock.now ?? Date.now)();
+  const uptimeSeconds = (clock.uptime ?? uptime)();
+  return Number.isFinite(now) && Number.isFinite(uptimeSeconds) && uptimeSeconds >= 0 && startedAt <= now && startedAt < now - uptimeSeconds * 1000 - 5 * 60000;
+}
 async function holderEntryIsLive(entry2, liveness = defaultLiveness) {
+  if (recordPredatesBoot(entry2.registeredAt, liveness))
+    return false;
   if (!liveness.pidAlive(entry2.pid))
     return false;
   if (entry2.incarnation === null)
@@ -22526,7 +22611,7 @@ function holderEntryLiveness(value) {
     return;
   if (incarnation !== null && typeof incarnation !== "string")
     return;
-  return { pid, incarnation };
+  return { pid, incarnation, registeredAt: value.registeredAt };
 }
 function sameRegistration(value, entry2) {
   if (!isRecord13(value))
@@ -22645,8 +22730,12 @@ async function publishHolderEntryLocked(holderFile, entry2, options) {
     if (!life || await holderEntryIsLive(life, liveness))
       kept.push(value);
   }
+  let changed = kept.length !== (current?.entries.length ?? 0);
   if (!kept.some((value) => sameRegistration(value, entry2))) {
     kept.push(entry2);
+    changed = true;
+  }
+  if (changed) {
     await writeJsonAtomic(holderFile, { version: 1, entries: kept }, { beforeRename: () => options.assertOwned() });
   }
   published.add(registrationKey(holderFile, entry2));
@@ -22989,20 +23078,21 @@ var PROFILE_URL = "https://api.anthropic.com/api/oauth/profile";
 var PROFILE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 async function fetchOAuthAccountProfile(input) {
   assertNotCustodyTombstone(input.accessToken, "anthropic");
-  const response = await (input.fetchImpl ?? fetch)(PROFILE_URL, {
+  const signal = auxiliaryRequestSignal(input.signal);
+  const response = await raceWithSignal(signal, () => (input.fetchImpl ?? fetch)(PROFILE_URL, {
     method: "GET",
     redirect: "error",
-    signal: input.signal,
+    signal,
     headers: {
       Authorization: `Bearer ${input.accessToken}`,
       Accept: "application/json",
       "anthropic-beta": "oauth-2025-04-20"
     }
-  });
+  }));
   if (!response.ok) {
     throw new Error(`Claude profile check failed: ${response.status}`);
   }
-  const value = await response.json();
+  const value = await raceWithSignal(signal, () => response.json());
   const tier = value.organization?.rate_limit_tier;
   const orgType = value.organization?.organization_type;
   if (typeof tier !== "string" || tier.trim() === "" || typeof orgType !== "string" || orgType.trim() === "") {
@@ -28633,7 +28723,10 @@ function createNativeVaultRuntime(options) {
     const combined = signalFor(signal);
     let served = await runtime2.authorize(routeId, combined);
     const send = (input, init) => {
-      const physical = () => fetchImpl(input, { ...init, signal: combined });
+      const physical = () => fetchImpl(input, {
+        ...init,
+        signal: init?.signal ? AbortSignal.any([combined, init.signal]) : combined
+      });
       if (!dispatch)
         return physical();
       return dispatch(physical, async () => {
@@ -29013,6 +29106,7 @@ function jsonHeaders(headers) {
   return result;
 }
 async function postRelay(config, payload, signal) {
+  signal?.throwIfAborted();
   const stringifyStart = perfNowMs();
   const body = JSON.stringify(payload);
   relayPerfLog("http_payload_stringify", {
@@ -29266,10 +29360,11 @@ class PersistentRelaySession {
     this.serverState = undefined;
     this.connecting = undefined;
   }
-  send(payload, bodyText, optimisticResponse, onResponseHeaders, authorizeAttempt, responseMode) {
+  send(payload, bodyText, optimisticResponse, onResponseHeaders, authorizeAttempt, responseMode, signal) {
+    signal?.throwIfAborted();
     this.touch();
     const enqueuedAt = perfNowMs();
-    const start = this.queue.catch(() => {}).then(() => this.startQueued(payload, bodyText, enqueuedAt, optimisticResponse, onResponseHeaders, authorizeAttempt, responseMode));
+    const start = this.queue.catch(() => {}).then(() => raceWithSignal(signal, () => this.startQueued(payload, bodyText, enqueuedAt, optimisticResponse, onResponseHeaders, authorizeAttempt, responseMode, signal)));
     const result = start.then(async ({ response, getPayload }) => ({
       response: await response,
       payload: getPayload(),
@@ -29278,12 +29373,14 @@ class PersistentRelaySession {
       usedRelay: true
     }));
     this.queue = start.then(({ done }) => done.catch(() => {}), () => {});
-    return result;
+    return raceWithSignal(signal, () => result);
   }
-  async startQueued(payload, bodyText, enqueuedAt, optimisticResponse, onResponseHeaders, authorizeAttempt, responseMode) {
+  async startQueued(payload, bodyText, enqueuedAt, optimisticResponse, onResponseHeaders, authorizeAttempt, responseMode, signal) {
+    signal?.throwIfAborted();
     const createScopes = (secrets) => createWebSocketAttemptScopes(secrets, responseMode);
     const connectStart = perfNowMs();
     await this.ensureConnected();
+    signal?.throwIfAborted();
     const connectedAt = perfNowMs();
     const localState = sessionState.get(this.affinity);
     const serverHash = this.serverState?.hash;
@@ -29304,8 +29401,12 @@ class PersistentRelaySession {
     }
     relayLog(`perf websocket send_start session=${shortAffinity2(this.affinity)} request=${requestPayload.id} mode=${requestPayload.mode} queueMs=${formatMs(connectedAt - enqueuedAt)} connectMs=${formatMs(connectedAt - connectStart)} bodyBytes=${bodyText.length} relayBytes=${JSON.stringify(requestPayload).length}`);
     const firstAttempt = await authorizePhysicalAttempt(this.config, requestPayload, authorizeAttempt, createScopes);
+    if (signal?.aborted) {
+      disposeWebSocketAttemptScopes(firstAttempt.scope);
+      signal.throwIfAborted();
+    }
     let activePayload = requestPayload;
-    const first = this.sendPayload(requestPayload, bodyText, optimisticResponse, onResponseHeaders, authorizeAttempt, firstAttempt, responseMode);
+    const first = this.sendPayload(requestPayload, bodyText, optimisticResponse, onResponseHeaders, authorizeAttempt, firstAttempt, responseMode, signal);
     first.done.catch(() => {});
     let activeDone = first.done;
     const response = first.response.catch(async (error) => {
@@ -29317,13 +29418,18 @@ class PersistentRelaySession {
       fullSync.id = createRequestId();
       fullSync.revision = (this.serverState?.revision ?? 0) + 1;
       const retryAttempt = await authorizePhysicalAttempt(this.config, fullSync, authorizeAttempt, createScopes);
+      if (signal?.aborted) {
+        disposeWebSocketAttemptScopes(retryAttempt.scope);
+        signal.throwIfAborted();
+      }
       activePayload = fullSync;
-      const retry = this.sendPayload(fullSync, bodyText, optimisticResponse, onResponseHeaders, authorizeAttempt, retryAttempt, responseMode);
+      const retry = this.sendPayload(fullSync, bodyText, optimisticResponse, onResponseHeaders, authorizeAttempt, retryAttempt, responseMode, signal);
       retry.done.catch(() => {});
       activeDone = retry.done;
       return retry.response;
     });
     const done = response.then(() => activeDone, () => activeDone.catch(() => {}));
+    done.catch(() => {});
     return { response, done, getPayload: () => activePayload };
   }
   async ensureConnected() {
@@ -29396,7 +29502,7 @@ class PersistentRelaySession {
     });
     await this.connecting;
   }
-  sendPayload(payload, bodyText, optimisticResponse, onResponseHeaders, authorizeAttempt, attempt, responseMode) {
+  sendPayload(payload, bodyText, optimisticResponse, onResponseHeaders, authorizeAttempt, attempt, responseMode, signal) {
     const socket = this.socket;
     if (!socket || socket.readyState !== WebSocket.OPEN) {
       disposeWebSocketAttemptScopes(attempt.scope);
@@ -29438,6 +29544,24 @@ class PersistentRelaySession {
         responseHeadersDelivered: false
       };
       this.pending = pending;
+      if (signal) {
+        const abort = () => {
+          if (this.pending !== pending)
+            return;
+          this.failPending(signal.reason, false);
+          const socket2 = this.socket;
+          this.socket = undefined;
+          this.serverState = undefined;
+          this.connecting = undefined;
+          socket2?.close();
+        };
+        pending.abortCleanup = () => signal.removeEventListener("abort", abort);
+        signal.addEventListener("abort", abort, { once: true });
+        if (signal.aborted) {
+          abort();
+          return;
+        }
+      }
       this.resetPendingTimeout(pending);
       socket.send(JSON.stringify(payload));
       if (optimisticResponse) {
@@ -29540,6 +29664,8 @@ class PersistentRelaySession {
   }
   retireAttempt(pending) {
     pending.retired = true;
+    pending.abortCleanup?.();
+    pending.abortCleanup = undefined;
     pending.scope?.dispose();
     pending.scope = undefined;
     pending.responseScope?.dispose();
@@ -29936,8 +30062,9 @@ async function sendViaRelay(options) {
           clearTimeout: clearTimeoutImpl
         });
         const optimistic = optimisticResponse === true && requestMode() === "event-stream";
-        result = await session.send(payload, bodyText, optimistic, onResponseHeaders, authorizeAttempt, requestMode());
+        result = await session.send(payload, bodyText, optimistic, onResponseHeaders, authorizeAttempt, requestMode(), init?.signal);
       } catch (error) {
+        init?.signal?.throwIfAborted();
         if (error instanceof RelayAuthorizationError || error instanceof RelayResponseMetadataError)
           throw error;
         relayLog(`websocket relay failed session=${shortAffinity2(affinity)}; trying http relay code=relay_transport_error`);
@@ -30013,6 +30140,7 @@ async function sendViaRelay(options) {
     });
     return result.response;
   } catch (error) {
+    init?.signal?.throwIfAborted();
     if (error instanceof RelayAuthorizationError)
       throw error.failure;
     if (error instanceof RelayResponseMetadataError)
@@ -31470,7 +31598,10 @@ function createNativeAccountRuntime(options) {
       throw new NativeCustodyError("route-unavailable");
     let served = first;
     const send = (input, init) => {
-      const physical = () => fetchImpl(input, { ...init, signal: combined });
+      const physical = () => fetchImpl(input, {
+        ...init,
+        signal: init?.signal ? AbortSignal.any([combined, init.signal]) : combined
+      });
       if (!dispatch)
         return physical();
       return dispatch(physical, async () => {
@@ -35561,6 +35692,8 @@ function fetchInputUrl(input) {
 function createAnthropicOAuthFetch(options = {}) {
   const current = () => typeof options === "function" ? options() : options;
   return Object.assign(async (input, init) => {
+    const signal = init?.signal !== undefined ? init.signal : input instanceof Request ? input.signal : undefined;
+    signal?.throwIfAborted();
     requireAnthropicOAuthOrigin(fetchInputUrl(input), current());
     return fetch(input, { ...init, redirect: "error" });
   }, {
@@ -37167,7 +37300,7 @@ import { homedir as homedir7 } from "node:os";
 import { basename as basename13, dirname as dirname24, join as join30 } from "node:path";
 
 // src/layout-fence.ts
-import { readdir as readdir6, readFile as readFile15 } from "node:fs/promises";
+import { open as open13, readdir as readdir6 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
 import { basename as basename11, join as join27, resolve as resolve18 } from "node:path";
 var STATE_PATH_OVERRIDE_VARIABLES = [
@@ -37285,8 +37418,15 @@ function stamped(value) {
 }
 async function readArtifact(path2, blockers) {
   let text6;
+  let mtimeMs;
   try {
-    text6 = await readFile15(path2, "utf8");
+    const file = await open13(path2, "r");
+    try {
+      text6 = await file.readFile("utf8");
+      mtimeMs = (await file.stat()).mtimeMs;
+    } finally {
+      await file.close();
+    }
   } catch (error) {
     if (errorCode5(error) === "ENOENT")
       return;
@@ -37294,13 +37434,15 @@ async function readArtifact(path2, blockers) {
     return;
   }
   try {
-    return JSON.parse(text6);
+    const value = JSON.parse(text6);
+    const startedAt = typeof value === "object" && value !== null ? "startedAt" in value ? value.startedAt : ("registeredAt" in value) ? value.registeredAt : mtimeMs : mtimeMs;
+    return { value, startedAt };
   } catch {
     blockers.push({ kind: "artifact-scan", path: path2, reason: "invalid" });
     return;
   }
 }
-async function preNArtifactBlockers(locations, pidAlive2 = defaultLiveness2.pidAlive) {
+async function preNArtifactBlockers(locations, pidAlive2 = defaultLiveness2.pidAlive, clock = {}) {
   const blockers = [];
   const portDirs = [...locations.rpcDirs];
   for (const root of locations.rpcRoots)
@@ -37311,15 +37453,16 @@ async function preNArtifactBlockers(locations, pidAlive2 = defaultLiveness2.pidA
       if (!/^port-\d+\.json$/.test(name))
         continue;
       const path2 = join27(dir, name);
-      const value = await readArtifact(path2, blockers);
-      if (value === undefined || stamped(value))
+      const record9 = await readArtifact(path2, blockers);
+      if (record9 === undefined || stamped(record9.value))
         continue;
+      const { value, startedAt } = record9;
       const pid = value.pid;
       if (typeof pid !== "number" || !Number.isSafeInteger(pid) || pid <= 0) {
         blockers.push({ kind: "artifact-scan", path: path2, reason: "invalid" });
         continue;
       }
-      if (pidAlive2(pid))
+      if (!recordPredatesBoot(startedAt, clock) && pidAlive2(pid))
         blockers.push({ kind: "pre-n-artifact", artifact: path2, pid });
     }
   }
@@ -37329,11 +37472,11 @@ async function preNArtifactBlockers(locations, pidAlive2 = defaultLiveness2.pidA
       if (!match)
         continue;
       const path2 = join27(dir, name);
-      const value = await readArtifact(path2, blockers);
-      if (value === undefined || stamped(value))
+      const record9 = await readArtifact(path2, blockers);
+      if (record9 === undefined || stamped(record9.value))
         continue;
       const pid = Number(match[1]);
-      if (pidAlive2(pid))
+      if (!recordPredatesBoot(record9.startedAt, clock) && pidAlive2(pid))
         blockers.push({ kind: "pre-n-artifact", artifact: path2, pid });
     }
   }
@@ -37356,7 +37499,7 @@ function describeFenceBlocker(blocker) {
 
 // src/state-layout-move.ts
 import { randomUUID as randomUUID20 } from "node:crypto";
-import { lstat as lstat18, readdir as readdir7, readFile as readFile16, stat as stat13, unlink as unlink10 } from "node:fs/promises";
+import { lstat as lstat18, readdir as readdir7, readFile as readFile15, stat as stat13, unlink as unlink10 } from "node:fs/promises";
 import { basename as basename12, dirname as dirname23, join as join28, sep as sep2 } from "node:path";
 var ACCOUNT_FILE = "anthropic-auth.json";
 var ACCOUNT_STATE_FILE = "anthropic-auth-state.json";
@@ -37826,7 +37969,7 @@ async function rollbackPreparing(record9, dataset, ctx) {
       } else {
         let copy;
         try {
-          copy = await readFile16(file.to);
+          copy = await readFile15(file.to);
         } catch {
           throw new StateLayoutRollbackRefused(file.to, `its copy, needed to undo the tombstone over ${file.from}, is missing`);
         }
@@ -38017,12 +38160,12 @@ async function moveDataset(dataset, ctx, checkArtifacts) {
     for (const file of files) {
       if (file.sha256 === null)
         continue;
-      const bytes = await readFile16(file.from);
+      const bytes = await readFile15(file.from);
       if (sha256Hex(bytes) !== file.sha256)
         throw new MoveRefused(`${file.from} changed while it was copied`);
       const stage = relocatingPath(file.to, attempt);
       await createOwnerOnlyFile(ctx.fs, stage, bytes);
-      const back = await readFile16(stage);
+      const back = await readFile15(stage);
       if (!back.equals(bytes))
         throw new MoveRefused(`the copy of ${file.from} reads back differently`);
       await owned2(ctx, { kind: "rename", from: stage, to: file.to }, expectAbsent(file.to));
@@ -38134,7 +38277,7 @@ async function rollbackAfterFailure(preparing, dataset, ctx) {
 
 // src/state-layout-restore.ts
 import { randomUUID as randomUUID21 } from "node:crypto";
-import { readFile as readFile17 } from "node:fs/promises";
+import { readFile as readFile16 } from "node:fs/promises";
 import { homedir as homedir6 } from "node:os";
 import { join as join29 } from "node:path";
 var DATA_ROLES = [
@@ -38414,7 +38557,7 @@ async function newRestoreProblems(record9, dataset, options) {
   }
   problems.push(...await holderProblems(join29(dataset.sub, HOLDER_FILE_NAME), options.liveness, true), ...await holderProblems(join29(dataset.oldDir, HOLDER_FILE_NAME), options.liveness, false));
   const artifacts = options.artifacts ?? defaultPreNArtifactLocations(options.env ?? process.env, options.home ?? homedir6());
-  for (const blocker of await preNArtifactBlockers(artifacts, options.liveness?.pidAlive))
+  for (const blocker of await preNArtifactBlockers(artifacts, options.liveness?.pidAlive, options.liveness))
     problems.push(`${describeFenceBlocker(blocker)} is still running`);
   for (const slot of dataset.slots) {
     if (slot.role === "localRuntime" || slot.role === "vaultRuntime") {
@@ -38478,12 +38621,12 @@ async function startRestore(record9, dataset, ctx, options) {
   }, ctx.fs);
   await stateLayoutStep(ctx, "restore:restoring-written");
   for (const file of files) {
-    const bytes = await readFile17(file.to);
+    const bytes = await readFile16(file.to);
     if (sha256Hex(bytes) !== file.sha256)
       throw refused2(`${file.to} changed while it was being restored; run ${RESTORE_LEGACY_COMMAND} again.`, [file.to]);
     await ctx.stack.assertAll();
     await createOwnerOnlyFile(ctx.fs, file.staging, bytes);
-    const back = await readFile17(file.staging);
+    const back = await readFile16(file.staging);
     if (!back.equals(bytes))
       throw refused2(`the restored copy of ${file.to} reads back differently; run ${RESTORE_LEGACY_COMMAND} again.`, [file.staging]);
     await stateLayoutStep(ctx, `restore:staged:${file.role}`);
@@ -39137,7 +39280,7 @@ async function underLayoutLock(dataset, options, ctx, overrides, neverMove) {
   const files = [...dataset.slots.flatMap((slot) => [slot.from, slot.to])];
   const artifacts = options.artifacts ?? defaultPreNArtifactLocations(options.env ?? process.env, options.home ?? homedir7());
   const checkArtifacts = async () => {
-    const found = await preNArtifactBlockers(artifacts, options.liveness?.pidAlive);
+    const found = await preNArtifactBlockers(artifacts, options.liveness?.pidAlive, options.liveness);
     return found.length ? found.map(describeFenceBlocker).join("; ") : undefined;
   };
   const blockers = [
@@ -39146,7 +39289,7 @@ async function underLayoutLock(dataset, options, ctx, overrides, neverMove) {
       files,
       liveness: options.liveness
     }),
-    ...await preNArtifactBlockers(artifacts, options.liveness?.pidAlive)
+    ...await preNArtifactBlockers(artifacts, options.liveness?.pidAlive, options.liveness)
   ].map(describeFenceBlocker);
   if (!blockers.length) {
     const failure2 = await movePreconditionFailure(dataset, ctx.fs.platform);
@@ -39349,6 +39492,7 @@ export {
   writerStamp,
   writeNativeHostAuth,
   writeDumpFile,
+  withAbortableFetch,
   usesPerTurnControl,
   usagePublicationRefusalIsFatal,
   unmovedRegistrationPolicy,
@@ -39396,6 +39540,7 @@ export {
   sendWithRequestGzip,
   sendViaRelay,
   selectClaudeCodeBetas,
+  runWithRequestSignal,
   runSetup,
   runPiCommandMenu,
   runNativeMigration,
@@ -39419,6 +39564,7 @@ export {
   resetBillingHeaderCCH,
   requireNoSupervisedAuthContentSnapshot,
   requireAnthropicOAuthOrigin,
+  requestSignal,
   requestGzipPadding,
   reportRouting,
   renameWithWindowsSharingRetry,
@@ -39432,6 +39578,7 @@ export {
   refreshBackoffActive,
   redactPayload,
   recordProcessStateLayout,
+  recordPredatesBoot,
   readWindowsOwnerOnly,
   readStateLayoutMarker,
   readRelocationPointer,
@@ -39443,6 +39590,7 @@ export {
   readConfigDirMarker,
   readClaustrumEnrollmentToken2 as readClaustrumEnrollmentToken,
   readClaustrumEnrollmentStatus2 as readClaustrumEnrollmentStatus,
+  raceWithSignal,
   quotaWindowParts,
   quotaTextParts,
   quotaSnapshotPassesPolicy,
@@ -39701,6 +39849,7 @@ export {
   computeXxhash64Hex,
   computeCcVersionSuffix,
   computeCCH,
+  commitRequestChange,
   claudeCodeEntrypoint,
   classifySafeErrorForLog,
   classifyGzipRejection,
@@ -39726,6 +39875,7 @@ export {
   buildCache1hStatusSummary,
   buildBillingHeaderValue,
   buildAccountList,
+  auxiliaryRequestSignal,
   authorize,
   assertUnmanagedInjectedPaths,
   assertNotCustodyTombstone,
@@ -39743,6 +39893,7 @@ export {
   acquireRefreshFileLock2 as acquireRefreshFileLock,
   acquireNativeVaultRuntime,
   acquireNativeAccountRuntime,
+  abortableFetch,
   __setLogTestSink,
   WORKER_SCRIPT,
   USER_AGENT,
@@ -39920,6 +40071,7 @@ export {
   CACHE_1H_COMMAND_NAME,
   AnthropicOAuthOriginError,
   AXIOS_USER_AGENT,
+  AUXILIARY_REQUEST_TIMEOUT_MS,
   AUTHORIZE_URLS,
   ANTHROPIC_OAUTH_ORIGIN_REFUSAL,
   ANTHROPIC_OAUTH_ORIGIN,

package/dist/layout-fence.d.ts

@@ -58,8 +58,9 @@ export declare function defaultPreNArtifactLocations(env?: NodeJS.ProcessEnv, ho
  * The fence's check for older versions: an RPC port file or CacheKeep record without the
  * `writer` stamp, whose pid is alive, belongs to a version that registers
  * nothing and blocks. Every entry is read; a folder or file that can't be
- * read or parsed blocks too. No timestamp ever clears a live pid.
+ * read or parsed blocks too. A record from before this boot is stale even
+ * if its pid has been reused; missing or untrustworthy times keep blocking.
  */
-export declare function preNArtifactBlockers(locations: PreNArtifactLocations, pidAlive?: (pid: number) => boolean): Promise<FenceBlocker[]>;
+export declare function preNArtifactBlockers(locations: PreNArtifactLocations, pidAlive?: (pid: number) => boolean, clock?: Pick<HolderLiveness, 'now' | 'uptime'>): Promise<FenceBlocker[]>;
 /** One line naming a blocker, for the log. */
 export declare function describeFenceBlocker(blocker: FenceBlocker): string;

package/dist/request-abort.d.ts

@@ -0,0 +1,16 @@
+/**
+ * End a caller's wait without cancelling shared work such as a token refresh.
+ * The operation still owns its cleanup and any late rejection is observed.
+ */
+export declare function raceWithSignal<T>(signal: AbortSignal | null | undefined, operation: () => Promise<T>): Promise<T>;
+export declare function abortableFetch(send: (input: string | URL | Request, init?: RequestInit) => Promise<Response>): (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+export declare function withAbortableFetch<T extends {
+    fetch: Parameters<typeof abortableFetch>[0];
+}>(options: T): T;
+export declare const AUXILIARY_REQUEST_TIMEOUT_MS = 30000;
+/** Account checks must finish even when no host request is waiting on them. */
+export declare function auxiliaryRequestSignal(signal?: AbortSignal | null): AbortSignal;
+export declare function requestSignal(): AbortSignal | null | undefined;
+/** Publish request-owned routing changes only after preparation succeeds. */
+export declare function commitRequestChange(commit: () => void): void;
+export declare function runWithRequestSignal<T>(signal: AbortSignal | null | undefined, operation: () => Promise<T>): Promise<T>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/anthropic-auth-core",
-  "version": "2.4.9",
+  "version": "2.4.11",
   "type": "module",
   "repository": {
     "type": "git",