@cortexkit/antigravity-auth-core 3.0.10 → 3.0.12

package/dist/common-auth-embedded/commands/builtins.js

@@ -4,7 +4,7 @@
 // the same locks as any other writer of those files.
 import { formatQuota, isQuotaMap, projectQuota, quotaWindowName, } from '../quota/index.js';
 import { DEFAULT_FORMER_MAIN_ID, orderForPlacement, resolveRoutingMode, } from '../routing/index.js';
-import { projectFailure, } from './seam.js';
+import { CommandError, projectFailure, } from './seam.js';
 /** `disabledReason` recorded when the user disables an account from the menu. */
 export const MENU_DISABLED_REASON = 'disabled from the command menu';
 function isRecord(value) {
@@ -65,13 +65,16 @@ function addedText(name, result) {
 function failureMessage(error) {
     return projectFailure(error).text;
 }
-async function snapshot(store) {
+async function snapshot(options) {
+    const { store } = options;
     const load = await store.read();
     const read = await store.readSettings();
+    const vault = await options.routing?.vaultOrder?.();
     return {
         load,
         rows: distinctRows(load),
         settings: read.status === 'error' ? {} : read.settings,
+        ...(vault ? { vault } : {}),
     };
 }
 function accountView(row, options) {
@@ -323,6 +326,73 @@ function quotaSection(options, snap) {
         },
     };
 }
+/**
+ * Sets the vault order. The roster's own refusal of the list (`invalid-order`:
+ * an account left out, which it counts without naming) is shown with its own
+ * message; any other failure is projected as usual. The kind is read from
+ * the error object so the menu does not import the vault client.
+ */
+async function reorderVault(vault, order) {
+    try {
+        return await vault.reorder(order);
+    }
+    catch (error) {
+        if (error instanceof Error &&
+            error.name === 'ClaustrumConsumerError' &&
+            error.kind === 'invalid-order')
+            throw new CommandError('vault-invalid-order', error.message, {
+                cause: error,
+            });
+        throw error;
+    }
+}
+function invalidVaultOrder(message) {
+    return new CommandError('vault-invalid-order', message);
+}
+/**
+ * How the Routing section names vault accounts: by label, since route ids
+ * are long and opaque. A typed entry may be a label or a route id, and must
+ * name exactly one account. Refusals quote only the entry the user typed.
+ */
+function vaultNames(vault) {
+    const rows = vault.rows.map((row) => ({
+        id: row.id,
+        label: row.label.trim() || row.id,
+    }));
+    const matches = (entry) => rows.filter((row) => row.id === entry || row.label === entry);
+    return {
+        ids: rows.map((row) => row.id),
+        nameOf: (id) => rows.find((row) => row.id === id)?.label ?? id,
+        /**
+         * What the order input starts with for an account: its label when
+         * typing that label back names this account alone, else its route id
+         * (two accounts sharing a label, or a label with a comma or line break
+         * in it, either of which would split it into two entries).
+         */
+        entryOf: (id) => {
+            const row = rows.find((entry) => entry.id === id);
+            return row && !/[,\n]/.test(row.label) && matches(row.label).length === 1
+                ? row.label
+                : id;
+        },
+        /** The route ids the typed entries name, in order; refuses before any write. */
+        resolve: (entries) => {
+            const ids = [];
+            for (const entry of entries) {
+                const found = matches(entry);
+                if (found.length === 0)
+                    throw invalidVaultOrder(`"${entry}" is not a vault account.`);
+                if (found.length > 1)
+                    throw invalidVaultOrder(`"${entry}" matches more than one vault account; enter those accounts by route id.`);
+                const id = found[0].id;
+                if (ids.includes(id))
+                    throw invalidVaultOrder(`"${entry}" names an account already in the order.`);
+                ids.push(id);
+            }
+            return ids;
+        },
+    };
+}
 function routingSection(options, snap) {
     const { store, extraLocks } = options;
     const locks = extraLocks ? { extraLocks } : {};
@@ -336,14 +406,18 @@ function routingSection(options, snap) {
         ? raw
         : 'ordered';
     const resolved = resolveRoutingMode(current);
-    const ids = snap.rows.map((row) => row.id);
+    // In vault mode routing tries the vault accounts, so their order is the
+    // one shown and set here; the pool roster's order is not used.
+    const vault = snap.vault ? vaultNames(snap.vault) : undefined;
+    const ids = vault ? vault.ids : snap.rows.map((row) => row.id);
+    const nameOf = (id) => (vault ? vault.nameOf(id) : id);
     const tried = orderForPlacement(ids, resolved.placement, options.routing?.formerMainId ?? DEFAULT_FORMER_MAIN_ID);
     const label = choices.find((choice) => choice.value === current)?.label ?? current;
     const lines = [`Mode: ${label}`];
     if (ids.length > 0)
-        lines.push(`Roster order: ${ids.join(', ')}`);
+        lines.push(`${vault ? 'Vault account order' : 'Roster order'}: ${ids.map(nameOf).join(', ')}`);
     if (resolved.mode === 'ordered' && tried.join() !== ids.join())
-        lines.push(`Tried in order: ${tried.join(', ')}`);
+        lines.push(`Tried in order: ${tried.map(nameOf).join(', ')}`);
     const actions = [
         {
             id: 'mode',
@@ -371,19 +445,27 @@ function routingSection(options, snap) {
                 {
                     kind: 'text',
                     id: 'order',
-                    label: 'Account ids, first to last',
-                    value: ids.join(', '),
+                    label: vault
+                        ? 'Vault accounts, first to last, separated by commas'
+                        : 'Account ids, first to last',
+                    value: vault ? ids.map(vault.entryOf).join(', ') : ids.join(', '),
                     required: true,
                 },
             ],
             run: async ({ values }) => {
-                const order = String(values.order)
-                    .split(/[\s,]+/)
-                    .filter((id) => id.length > 0);
-                const result = await store.reorder(order, locks);
+                const text = String(values.order);
+                // A vault label may contain spaces, so vault entries are separated by
+                // commas or line breaks, not spaces; pool ids never contain spaces.
+                const entries = text
+                    .split(vault ? /[,\n]+/ : /[\s,]+/)
+                    .map((entry) => entry.trim())
+                    .filter((entry) => entry.length > 0);
+                const result = snap.vault && vault
+                    ? await reorderVault(snap.vault, vault.resolve(entries))
+                    : await store.reorder(entries, locks);
                 return result.outcome === 'unchanged'
                     ? 'The order is unchanged.'
-                    : `Order set to ${result.ids.join(', ')}.`;
+                    : `Order set to ${result.ids.map(nameOf).join(', ')}.`;
             },
         });
     return {
@@ -524,7 +606,7 @@ function limitsSection(options, snap) {
 }
 /** The four built-in sections, in their fixed order, from one read of the store. */
 export async function builtinSections(options) {
-    const snap = await snapshot(options.store);
+    const snap = await snapshot(options);
     return [
         accountsSection(options, snap),
         quotaSection(options, snap),

package/dist/common-auth-embedded/commands/index.d.ts

@@ -1,4 +1,4 @@
-export type { AccountsSectionOptions, LimitsSectionOptions, LoginOutcome, QuotaSectionOptions, RoutingSectionOptions, } from './builtins.js';
+export type { AccountsSectionOptions, LimitsSectionOptions, LoginOutcome, QuotaSectionOptions, RoutingSectionOptions, VaultRoutingOrder, } from './builtins.js';
 export { MENU_DISABLED_REASON } from './builtins.js';
 export type { CommandMenu, CommandMenuOptions, StoreSectionSlot, } from './menu.js';
 export { createCommandMenu, parseApplyRequest } from './menu.js';

package/dist/common-auth-embedded/fs/private-files.d.ts

@@ -5,6 +5,8 @@ type Backend = typeof import('@cortexkit/private-files');
 type Kind = 'file' | 'directory';
 /** Tests inject a backend here; production always imports the private-files package. */
 export declare function setPrivateFilesBackendForTest(api?: Backend): void;
+/** The fixed `reason` of a refusal because the Windows native addon did not load. */
+export declare const PRIVATE_FILES_UNAVAILABLE_REASON = "native-addon-unavailable";
 export declare class PrivateFileError extends Error {
     readonly path: string;
     readonly stage: string;

package/dist/common-auth-embedded/fs/private-files.js

@@ -1,6 +1,7 @@
 import { randomUUID } from 'node:crypto';
 import { lstat, readFile, rename, unlink } from 'node:fs/promises';
-import { dirname, resolve } from 'node:path';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
 export const windowsPrivateFiles = process.platform === 'win32';
 const migrationNotices = new Set();
 function ioCode(detail) {
@@ -20,8 +21,51 @@ let backend;
 export function setPrivateFilesBackendForTest(api) {
     backend = api ? Promise.resolve(api) : undefined;
 }
+/** The fixed `reason` of a refusal because the Windows native addon did not load. */
+export const PRIVATE_FILES_UNAVAILABLE_REASON = 'native-addon-unavailable';
+function privateFilesUnavailable(cause) {
+    return Object.assign(new Error('Windows private-files native addon is unavailable', { cause }), {
+        code: 'ERR_PRIVATE_FILES_UNAVAILABLE',
+        reason: PRIVATE_FILES_UNAVAILABLE_REASON,
+    });
+}
+function isUnavailable(api, error) {
+    return (error instanceof api.PrivateFilesUnavailableError ||
+        error?.code ===
+            'ERR_PRIVATE_FILES_UNAVAILABLE');
+}
+/**
+ * Importing @cortexkit/private-files succeeds even when its Windows addon
+ * cannot load: the package loads the addon on first use, and some of its
+ * checks then report the failure as an ordinary refusal such as
+ * `unsupported-filesystem`. So prove the addon loads before handing the
+ * package out. Verifying a path that does not exist loads the addon first and
+ * then fails harmlessly; only the package's own "unavailable" error means the
+ * addon is missing.
+ */
+async function assertNativeAddonLoads(api) {
+    try {
+        await api.verifyPrivatePath(join(tmpdir(), `.common-auth-private-files-probe-${randomUUID()}`), 'file');
+    }
+    catch (error) {
+        if (isUnavailable(api, error))
+            throw privateFilesUnavailable(error);
+    }
+}
+/**
+ * Load the package once per process. On Windows a failed import or addon load
+ * is kept, so every later private-file operation refuses at once with
+ * ERR_PRIVATE_FILES_UNAVAILABLE. There is no fallback to permission bits:
+ * they do not protect files on Windows.
+ */
 function loadBackend() {
-    backend ??= import('@cortexkit/private-files');
+    backend ??= import('@cortexkit/private-files').then(async (api) => {
+        if (windowsPrivateFiles)
+            await assertNativeAddonLoads(api);
+        return api;
+    }, (cause) => {
+        throw windowsPrivateFiles ? privateFilesUnavailable(cause) : cause;
+    });
     return backend;
 }
 export class PrivateFileError extends Error {
@@ -38,7 +82,9 @@ export class PrivateFileError extends Error {
     orphanPath;
     constructor(path, stage, cause) {
         const detail = cause;
-        super(`Private file refused at ${stage}: ${path} (${detail?.reason ?? detail?.code ?? 'io-error'}). Use a safe parent directory. Repair only a named secret file in safe ancestry whose owner the published policy trusts, without changing its owner or any existing directory. Previously exposed credentials may need rotation. Windows requires the private-files native prebuild and an ACL-persisting local filesystem such as NTFS.`, { cause });
+        super(detail?.code === 'ERR_PRIVATE_FILES_UNAVAILABLE'
+            ? `Private file refused at ${stage}: ${path} (${PRIVATE_FILES_UNAVAILABLE_REASON}). The Windows native addon of @cortexkit/private-files could not be loaded, so owner-only access cannot be enforced and nothing was read or written. Reinstall the plugin so the private-files Windows prebuild for this architecture is present; Windows has no safe fallback to permission bits.`
+            : `Private file refused at ${stage}: ${path} (${detail?.reason ?? detail?.code ?? 'io-error'}). Keep this file in a folder that only you, the system or administrators can change, such as a folder in your home directory. If other users could read the file before, sign in again to replace the credentials it held. On Windows the file must also be on a local drive that keeps Windows file permissions, such as NTFS.`, { cause });
         this.path = path;
         this.stage = stage;
         this.name = 'PrivateFileError';

package/dist/common-auth-embedded/quota/pending.js

@@ -0,0 +1,48 @@
+// Use the same independently dated parts as mergeQuotaObservation. A header
+// reading cannot erase a poll-only window, counter, credits record or budget.
+export function quotaFields(publication, witness = '') {
+    const result = new Map();
+    const { observation } = publication;
+    const add = (key, at, part) => result.set(`${witness}:${key}`, {
+        at,
+        order: 0,
+        publication: { ...publication, observation: part },
+    });
+    const keyFor = (scope, label) => JSON.stringify([scope ?? 'all', label]);
+    const read = new Set();
+    for (const reading of observation.readings ?? []) {
+        const key = keyFor(reading.scope, reading.label);
+        read.add(key);
+        add(key, observation.checkedAt, {
+            checkedAt: observation.checkedAt,
+            readings: [{ ...reading }],
+        });
+    }
+    for (const pair of observation.coverage ?? []) {
+        const key = keyFor(pair.scope, pair.label);
+        if (!read.has(key))
+            add(key, observation.checkedAt, {
+                checkedAt: observation.checkedAt,
+                coverage: [{ ...pair }],
+            });
+    }
+    if (observation.budget)
+        add('budget', observation.checkedAt, {
+            checkedAt: observation.checkedAt,
+            budget: { ...observation.budget },
+        });
+    for (const [name, counter] of Object.entries(observation.counters ?? {})) {
+        add(`counter:${name}`, counter.checkedAt, {
+            checkedAt: observation.checkedAt,
+            counters: { [name]: { ...counter } },
+        });
+    }
+    if (observation.credits)
+        add('credits', observation.credits.checkedAt, {
+            checkedAt: observation.checkedAt,
+            credits: { ...observation.credits },
+        });
+    if (!result.size)
+        add('empty', observation.checkedAt, { checkedAt: observation.checkedAt });
+    return result;
+}

package/dist/common-auth-embedded/source-output.json

@@ -1,7 +1,7 @@
 {
   "schema": 1,
   "package": "@cortexkit/common-auth",
-  "version": "0.23.0",
+  "version": "0.26.0",
   "artifactStatus": "published",
   "publicRoots": {
     "./store": {
@@ -37,15 +37,15 @@
       "import": "./dist/pi-slot/index.js"
     }
   },
-  "input": "tools/common-auth-build/inputs/cortexkit-common-auth-0.23.0.tgz",
-  "tarballSha256": "8a2cd4a5df7c056c4f815c8cd59b109ceb02135eb7b7b0e14a1b3d9891af2cfb",
-  "sri": "sha512-WwCjPwOhbZBomCAPxEooCiSDgvcaIsEn5yjTqmEy0PU0ZJUKSr3cE8Il0AsW7xU2h2Wo267rsciZhV3rPlUPCA==",
-  "canonicalFiles": 139,
-  "canonicalBytes": 857682,
+  "input": "tools/common-auth-build/inputs/cortexkit-common-auth-0.26.0.tgz",
+  "tarballSha256": "a5a6cb7051ee8c45e86e19cf7a918d0e28ce1b6a80301e982efbc7bb4b98208d",
+  "sri": "sha512-qTmQ9aMG+HcyDbhKie8Nq9wxKMRQ6GXH2hKq8Fab9kHqFfzswdp2NpXofGY52RhQ2VxuyMOQr5T6lUrkbny5VQ==",
+  "canonicalFiles": 141,
+  "canonicalBytes": 888503,
   "generator": {
     "path": "packages/opencode/scripts/embed-common-auth.ts",
     "version": 3,
-    "sha256": "886385f4eedd9fcd82bcb3e7751e0c7193fbb6c59238fa35be82909635955dbf"
+    "sha256": "89dbeb07d77e0657abeb72a40fcc03a900e98292956865252349a01a15999ed0"
   },
   "files": [
     {
@@ -227,17 +227,17 @@
     {
       "source": "package/dist/claustrum/consumer.d.ts",
       "output": "claustrum/consumer.d.ts",
-      "bytes": 9548,
-      "sourceSha256": "150eac9038881740a78e5664501a6ef0aa5e177a6dd46854cbeaf38513463e90",
-      "outputSha256": "150eac9038881740a78e5664501a6ef0aa5e177a6dd46854cbeaf38513463e90",
+      "bytes": 9907,
+      "sourceSha256": "8001ce3f928af1bc9124223071eb9c85ea3273436cd7be073c588217f942b248",
+      "outputSha256": "8001ce3f928af1bc9124223071eb9c85ea3273436cd7be073c588217f942b248",
       "transform": "verbatim"
     },
     {
       "source": "package/dist/claustrum/consumer.js",
       "output": "claustrum/consumer.js",
-      "bytes": 25698,
-      "sourceSha256": "ec47dc016bf4d95655c17093a78d9c214b623214c821d352f73ea60f830c0d83",
-      "outputSha256": "ec47dc016bf4d95655c17093a78d9c214b623214c821d352f73ea60f830c0d83",
+      "bytes": 26470,
+      "sourceSha256": "b2087accd6e8759fb49173dc744243ed703520d5011386ef514672be8fe79fbe",
+      "outputSha256": "b2087accd6e8759fb49173dc744243ed703520d5011386ef514672be8fe79fbe",
       "transform": "verbatim"
     },
     {
@@ -259,25 +259,25 @@
     {
       "source": "package/dist/claustrum/enrollment.d.ts",
       "output": "claustrum/enrollment.d.ts",
-      "bytes": 7743,
-      "sourceSha256": "7503e56a09f94e77a94a7ae15fd616f149ec9f675ec7c79bdea4a014ca014143",
-      "outputSha256": "7503e56a09f94e77a94a7ae15fd616f149ec9f675ec7c79bdea4a014ca014143",
+      "bytes": 7976,
+      "sourceSha256": "d6b4e8561ccc0ff2f9b4386856c5fe3dc7c475e13f98314a0666d0b20458d43b",
+      "outputSha256": "d6b4e8561ccc0ff2f9b4386856c5fe3dc7c475e13f98314a0666d0b20458d43b",
       "transform": "verbatim"
     },
     {
       "source": "package/dist/claustrum/enrollment.js",
       "output": "claustrum/enrollment.js",
-      "bytes": 33520,
-      "sourceSha256": "eeac604495c093503007478ab803c05b6e0bce8bf281f8bf9bbfee44c8ff85f1",
-      "outputSha256": "eeac604495c093503007478ab803c05b6e0bce8bf281f8bf9bbfee44c8ff85f1",
+      "bytes": 35060,
+      "sourceSha256": "a9ca3a23778cc86ab9798051ba19dcb3b2b8e3dc4c4fda356cbd56eca50097db",
+      "outputSha256": "a9ca3a23778cc86ab9798051ba19dcb3b2b8e3dc4c4fda356cbd56eca50097db",
       "transform": "verbatim"
     },
     {
       "source": "package/dist/claustrum/errors.d.ts",
       "output": "claustrum/errors.d.ts",
-      "bytes": 1145,
-      "sourceSha256": "b7533d4c281807224d6d05f4bb7a596006862a6c05dc4462fae02af388054bce",
-      "outputSha256": "b7533d4c281807224d6d05f4bb7a596006862a6c05dc4462fae02af388054bce",
+      "bytes": 1163,
+      "sourceSha256": "a6e5ec8be3ae7160b78456e642b440494604c2e2cdc987550744521dc873fb40",
+      "outputSha256": "a6e5ec8be3ae7160b78456e642b440494604c2e2cdc987550744521dc873fb40",
       "transform": "verbatim"
     },
     {
@@ -307,17 +307,17 @@
     {
       "source": "package/dist/claustrum/index.d.ts",
       "output": "claustrum/index.d.ts",
-      "bytes": 3761,
-      "sourceSha256": "f2c1b8d99048666c068805b08b430492b2632be08e2beda466ee56b871572847",
-      "outputSha256": "f2c1b8d99048666c068805b08b430492b2632be08e2beda466ee56b871572847",
+      "bytes": 3844,
+      "sourceSha256": "36c0b94c5e18972463f48bfd7e1506d9655372aa8df065786b3a47d199cdb5e0",
+      "outputSha256": "36c0b94c5e18972463f48bfd7e1506d9655372aa8df065786b3a47d199cdb5e0",
       "transform": "verbatim"
     },
     {
       "source": "package/dist/claustrum/index.js",
       "output": "claustrum/index.js",
-      "bytes": 2509,
-      "sourceSha256": "5f8b4bebfc2dec055b69769adcd1ce48ad7acc2c26256edbe4a2e984dc788147",
-      "outputSha256": "5f8b4bebfc2dec055b69769adcd1ce48ad7acc2c26256edbe4a2e984dc788147",
+      "bytes": 2529,
+      "sourceSha256": "42c9e67bb5ec6749de488933a56fb3ee253c3b9e3588d692f171d87c59bcbd89",
+      "outputSha256": "42c9e67bb5ec6749de488933a56fb3ee253c3b9e3588d692f171d87c59bcbd89",
       "transform": "verbatim"
     },
     {
@@ -363,25 +363,25 @@
     {
       "source": "package/dist/claustrum/quota-writer.js",
       "output": "claustrum/quota-writer.js",
-      "bytes": 9694,
-      "sourceSha256": "5a7d5d1059dcadc06aa41e81e0707cc444636473822047f0ec72da7589c770f1",
-      "outputSha256": "5a7d5d1059dcadc06aa41e81e0707cc444636473822047f0ec72da7589c770f1",
+      "bytes": 7579,
+      "sourceSha256": "0054a12ca94aab2eecf50f9b5e090879ff184e7f286cc979f32d311e22011906",
+      "outputSha256": "0054a12ca94aab2eecf50f9b5e090879ff184e7f286cc979f32d311e22011906",
       "transform": "verbatim"
     },
     {
       "source": "package/dist/claustrum/roster.d.ts",
       "output": "claustrum/roster.d.ts",
-      "bytes": 10931,
-      "sourceSha256": "c394bc08c7cce4dc68fd539ac03cb200727534693600c7daf5ba7c9c4d0618ce",
-      "outputSha256": "c394bc08c7cce4dc68fd539ac03cb200727534693600c7daf5ba7c9c4d0618ce",
+      "bytes": 12574,
+      "sourceSha256": "c9ab3a89e04f72de09c5f15ccf1436b91f8a245e2253f24ec5998120058aebe7",
+      "outputSha256": "c9ab3a89e04f72de09c5f15ccf1436b91f8a245e2253f24ec5998120058aebe7",
       "transform": "verbatim"
     },
     {
       "source": "package/dist/claustrum/roster.js",
       "output": "claustrum/roster.js",
-      "bytes": 27602,
-      "sourceSha256": "45ed2d4e69fad154ce86f5ff4f839c2ae9269dd9146ce7a8b2e5b6f49476ddf8",
-      "outputSha256": "45ed2d4e69fad154ce86f5ff4f839c2ae9269dd9146ce7a8b2e5b6f49476ddf8",
+      "bytes": 30876,
+      "sourceSha256": "d02184fd4d32aa8917369919edea4c44328e7332e30f3ddc41ce350e5fd1df07",
+      "outputSha256": "d02184fd4d32aa8917369919edea4c44328e7332e30f3ddc41ce350e5fd1df07",
       "transform": "verbatim"
     },
     {
@@ -403,25 +403,25 @@
     {
       "source": "package/dist/commands/builtins.d.ts",
       "output": "commands/builtins.d.ts",
-      "bytes": 2931,
-      "sourceSha256": "b70028ea58b51d344e83ac62f36fa95499ab32af753e657ade8116491488bab9",
-      "outputSha256": "b70028ea58b51d344e83ac62f36fa95499ab32af753e657ade8116491488bab9",
+      "bytes": 4576,
+      "sourceSha256": "5ab6cbab696c91fef0fc7288d4b82803cd0bac809b68f939d73671505fc1d894",
+      "outputSha256": "5ab6cbab696c91fef0fc7288d4b82803cd0bac809b68f939d73671505fc1d894",
       "transform": "verbatim"
     },
     {
       "source": "package/dist/commands/builtins.js",
       "output": "commands/builtins.js",
-      "bytes": 21323,
-      "sourceSha256": "9b3461ace8a585dde5eff3f9b709ddc766ab3d77e680b687499efd1871a341ce",
-      "outputSha256": "9b3461ace8a585dde5eff3f9b709ddc766ab3d77e680b687499efd1871a341ce",
+      "bytes": 25155,
+      "sourceSha256": "c5f7fca0e36dc2f3253b88e7600d3dbed6a193d2b8abbf07d16913b6b46551e6",
+      "outputSha256": "c5f7fca0e36dc2f3253b88e7600d3dbed6a193d2b8abbf07d16913b6b46551e6",
       "transform": "verbatim"
     },
     {
       "source": "package/dist/commands/index.d.ts",
       "output": "commands/index.d.ts",
-      "bytes": 1081,
-      "sourceSha256": "cfe14cdf7ae83a3bf37cfc3e4199c8f80e7720b982a0e875064113b1461c2967",
-      "outputSha256": "cfe14cdf7ae83a3bf37cfc3e4199c8f80e7720b982a0e875064113b1461c2967",
+      "bytes": 1100,
+      "sourceSha256": "4be7eec728211b7ad707121b1f2bbe2c219574aaa4e1c5be3f8964b185d4377c",
+      "outputSha256": "4be7eec728211b7ad707121b1f2bbe2c219574aaa4e1c5be3f8964b185d4377c",
       "transform": "verbatim"
     },
     {
@@ -547,17 +547,17 @@
     {
       "source": "package/dist/fs/private-files.d.ts",
       "output": "fs/private-files.d.ts",
-      "bytes": 3228,
-      "sourceSha256": "1882d869cfebb3cebc8b9db47fb15083f8300c51c26c71666e898377fcd9a1ba",
-      "outputSha256": "1882d869cfebb3cebc8b9db47fb15083f8300c51c26c71666e898377fcd9a1ba",
+      "bytes": 3398,
+      "sourceSha256": "b344509a32fcd983f09e5814286630a53c8e577ad1b973eabe19f8e58659e8d3",
+      "outputSha256": "b344509a32fcd983f09e5814286630a53c8e577ad1b973eabe19f8e58659e8d3",
       "transform": "verbatim"
     },
     {
       "source": "package/dist/fs/private-files.js",
       "output": "fs/private-files.js",
-      "bytes": 12448,
-      "sourceSha256": "1c8f34202b535d774d8c1a53bd403255f02701760c7378e020756c02c55a97c4",
-      "outputSha256": "1c8f34202b535d774d8c1a53bd403255f02701760c7378e020756c02c55a97c4",
+      "bytes": 14779,
+      "sourceSha256": "114c06ce4c0998087878d99c5dc37425e90d5fad205f57fe0bdf9694e3c8e31d",
+      "outputSha256": "114c06ce4c0998087878d99c5dc37425e90d5fad205f57fe0bdf9694e3c8e31d",
       "transform": "verbatim"
     },
     {
@@ -776,6 +776,14 @@
       "outputSha256": "b1d76faf1fb480b97ef1886ce75dbd2156002baedc39249468559cb4eece5bbb",
       "transform": "verbatim"
     },
+    {
+      "source": "package/dist/quota/pending.js",
+      "output": "quota/pending.js",
+      "bytes": 1876,
+      "sourceSha256": "e757a3fa9f8440190668c6154468a5baec8a84e20d6c831a6d7935c3b9bebe29",
+      "outputSha256": "e757a3fa9f8440190668c6154468a5baec8a84e20d6c831a6d7935c3b9bebe29",
+      "transform": "verbatim"
+    },
     {
       "source": "package/dist/quota/projection.d.ts",
       "output": "quota/projection.d.ts",
@@ -875,17 +883,17 @@
     {
       "source": "package/dist/store/attribution.d.ts",
       "output": "store/attribution.d.ts",
-      "bytes": 1528,
-      "sourceSha256": "441dba300556a927e872597c1df3e4fbb1ac61c0a3989e98dcd3a94a773b8ed7",
-      "outputSha256": "441dba300556a927e872597c1df3e4fbb1ac61c0a3989e98dcd3a94a773b8ed7",
+      "bytes": 1951,
+      "sourceSha256": "16919a55fe944b459ff511c125ac2ba34714949d38db006c8ab047dd48ab51a6",
+      "outputSha256": "16919a55fe944b459ff511c125ac2ba34714949d38db006c8ab047dd48ab51a6",
       "transform": "verbatim"
     },
     {
       "source": "package/dist/store/attribution.js",
       "output": "store/attribution.js",
-      "bytes": 2880,
-      "sourceSha256": "4bda762db5756c0d498d987aa3bc97eeee94be1c1ad2f005ed0ed46785e242d9",
-      "outputSha256": "4bda762db5756c0d498d987aa3bc97eeee94be1c1ad2f005ed0ed46785e242d9",
+      "bytes": 3280,
+      "sourceSha256": "5b54980a4f158c9b61cd90c4a83a14e83268fe98101fc88409500bb73d1126bb",
+      "outputSha256": "5b54980a4f158c9b61cd90c4a83a14e83268fe98101fc88409500bb73d1126bb",
       "transform": "verbatim"
     },
     {
@@ -971,17 +979,17 @@
     {
       "source": "package/dist/store/pool.d.ts",
       "output": "store/pool.d.ts",
-      "bytes": 10785,
-      "sourceSha256": "192ea359d2ce746b31693cf06795a281f2e06804c567975f127ea05fa6fb4aef",
-      "outputSha256": "192ea359d2ce746b31693cf06795a281f2e06804c567975f127ea05fa6fb4aef",
+      "bytes": 11743,
+      "sourceSha256": "0693e165ef937c22c375a3f63d01209c844d101ddf1a6702c8acc99bb5fc2a9d",
+      "outputSha256": "0693e165ef937c22c375a3f63d01209c844d101ddf1a6702c8acc99bb5fc2a9d",
       "transform": "verbatim"
     },
     {
       "source": "package/dist/store/pool.js",
       "output": "store/pool.js",
-      "bytes": 5671,
-      "sourceSha256": "8dc0d27b37204c2c3229296e8efbbfac6bcb30538b39d8d95771267487a06292",
-      "outputSha256": "8dc0d27b37204c2c3229296e8efbbfac6bcb30538b39d8d95771267487a06292",
+      "bytes": 6332,
+      "sourceSha256": "45a696753691027dfcadd8e94b38b111ad5085ba1cb4f769225b15efc68125d7",
+      "outputSha256": "45a696753691027dfcadd8e94b38b111ad5085ba1cb4f769225b15efc68125d7",
       "transform": "verbatim"
     },
     {
@@ -1027,9 +1035,17 @@
     {
       "source": "package/dist/store/pull.js",
       "output": "store/pull.js",
-      "bytes": 5470,
-      "sourceSha256": "4db913a0d196ed634277e4f3569c275579038f948e4adf6eb4dbbae257a41c92",
-      "outputSha256": "4db913a0d196ed634277e4f3569c275579038f948e4adf6eb4dbbae257a41c92",
+      "bytes": 5602,
+      "sourceSha256": "512a723a49dae3be50aa8c67ca8f6a5c165ec72e8a991a166d8d93e33e895350",
+      "outputSha256": "512a723a49dae3be50aa8c67ca8f6a5c165ec72e8a991a166d8d93e33e895350",
+      "transform": "verbatim"
+    },
+    {
+      "source": "package/dist/store/quota-writer.js",
+      "output": "store/quota-writer.js",
+      "bytes": 12396,
+      "sourceSha256": "ade5fdda516011baf11e40f672263364cea07c45bdcbfc11107e22794e9aef21",
+      "outputSha256": "ade5fdda516011baf11e40f672263364cea07c45bdcbfc11107e22794e9aef21",
       "transform": "verbatim"
     },
     {
@@ -1091,9 +1107,9 @@
     {
       "source": "package/dist/store/runtime.d.ts",
       "output": "store/runtime.d.ts",
-      "bytes": 1949,
-      "sourceSha256": "6838abdf1de68578c8403f76d3404a86e0d286c28a99ff32cb8bd84544a718cb",
-      "outputSha256": "6838abdf1de68578c8403f76d3404a86e0d286c28a99ff32cb8bd84544a718cb",
+      "bytes": 2100,
+      "sourceSha256": "34efe7252b6c0aead222cab6164340e76e9c22202049158164c56c3b46bab91f",
+      "outputSha256": "34efe7252b6c0aead222cab6164340e76e9c22202049158164c56c3b46bab91f",
       "transform": "verbatim"
     },
     {

package/dist/common-auth-embedded/store/attribution.d.ts

@@ -1,4 +1,6 @@
+import { type StoreContext } from './mutate.js';
 import { type StoreRuntime } from './runtime.js';
+import { type PoolRow } from './schema.js';
 /**
  * What a pull or refresh captured about its row (named by id alongside) when
  * it was issued. A result applies only while the row with that id still has
@@ -20,6 +22,9 @@ export interface Attribution {
     credentialEpoch: number;
     identity?: string;
 }
+export declare function assertQuotaEpoch(id: string, attribution: Attribution): void;
+export declare function assertQuotaRow(id: string, attribution: Attribution, row: PoolRow | undefined): asserts row is PoolRow;
+export declare function mergedQuota(ctx: StoreContext, id: string, stored: unknown, observation: unknown): unknown;
 /**
  * Merges a quota observation into a row's stored map under the store locks,
  * after attribution passes. Needs no row lock, so it is permitted from