@cortexkit/antigravity-auth-core 3.0.11 → 3.0.13

package/dist/common-auth-embedded/claustrum/index.d.ts

@@ -2,21 +2,31 @@ import { type ClaustrumClientOptions } from '@cortexkit/claustrum-client';
 import type { ClaustrumScopedClient } from './custody.js';
 export { ClaustrumCredentialError, type ClaustrumReporterSource, type EnrollmentTokenFile, } from '@cortexkit/claustrum-client';
 export { ClaustrumUnreachableError, classifyVaultFailure, VAULT_FAILURE_CLASSES, type VaultFailureClass, } from './availability.js';
-export { ClaustrumConsumer, type ClaustrumConsumerOptions, type ClaustrumWatchState, type SendOptions, } from './consumer.js';
-export { type AccountIdentitySource, type ClaustrumFamily, type ClaustrumRosterWatch, type ClaustrumRosterWatchOptions, type ClaustrumScopedAttempt, type ClaustrumScopedClient, ClaustrumScopedCustody, type ClaustrumScopedIdentity, decideScopedRetryAfter401, type IdentityParser, isScopedCredentialRotation, KEPT_RECEIPT_MARGIN_MS, type KeptReceiptState, type ScopedRetryReason, SERVING_MARGIN_MS, type SkippedVaultReason, type SkippedVaultRecord, type VaultCredential, type VaultCredentialType, type VaultGrantReach, type VaultGrantTuple, type VaultInventory, } from './custody.js';
+export { ClaustrumConsumer, type ClaustrumConsumerOptions, type ClaustrumWatchState, DEFAULT_CONNECT_TIMEOUT_MS, type SendOptions, } from './consumer.js';
+export { type AccountIdentitySource, type ClassifyingClaustrumFamily, type ClaustrumFamily, type ClaustrumFamilyInput, type ClaustrumRosterWatch, type ClaustrumRosterWatchOptions, type ClaustrumScopedAttempt, type ClaustrumScopedClient, ClaustrumScopedCustody, type ClaustrumScopedIdentity, decideScopedRetryAfter401, type IdentityParser, isScopedCredentialRotation, KEPT_RECEIPT_MARGIN_MS, type KeptReceiptState, type ScopedRetryReason, SERVING_MARGIN_MS, type SkippedVaultReason, type SkippedVaultRecord, type VaultCredential, type VaultCredentialType, type VaultGrantReach, type VaultGrantTuple, type VaultInventory, type VaultRowFacts, } from './custody.js';
 export { type ClaustrumEnrollmentClient, type ClaustrumEnrollmentConnection, type ClaustrumEnrollmentDisconnectResult, ClaustrumEnrollmentManager, type ClaustrumEnrollmentPaths, type ClaustrumEnrollmentResetResult, type ClaustrumEnrollmentStatus, classifyEnrollmentError, connectClaustrumEnrollmentClient, disconnectClaustrumEnrollment, type EnrollmentDisposition, enrollmentAuthority, enrollmentName, getClaustrumEnrollmentPaths, hostEnrollmentPaths, RETRYABLE_ENROLLMENT_CODES, readClaustrumEnrollmentStatus, readClaustrumEnrollmentToken, resetClaustrumEnrollmentState, TERMINAL_ENROLLMENT_CODES, } from './enrollment.js';
 export { ClaustrumConsumerError, type ClaustrumConsumerFailureKind, type ClaustrumLogger, } from './errors.js';
 export { assertHostSlotMatchesMode, assertNotCustodyPlaceholder, CUSTODY_PLACEHOLDER_PREFIX, classifyHostSlot, custodyPlaceholder, custodyPlaceholderKey, type HostSlotContent, isCustodyPlaceholder, isCustodyPlaceholderValue, } from './host-slot.js';
+export { ClaustrumDiscoveryHub, type ClaustrumDiscoveryHubOptions, type ClaustrumHubMemberOptions, type ClaustrumHubRefusals, type ClaustrumLeasedCustody, type CustodyLease, } from './hub.js';
 export { acquireInsulaQuotaSource, type InsulaQuotaContext, type InsulaQuotaLookup, type InsulaQuotaMiss, type InsulaQuotaOptions, type InsulaQuotaReading, type InsulaQuotaResult, type InsulaQuotaSource, type InsulaUsageEntry, type InsulaUsageTransport, type InsulaUsageWatch, type InsulaUsageWindow, type InsulaWatchOptions, } from './insula.js';
 export { acceptAccount, type DeclinedAccount, declineAccount, isDeclined, } from './interlock.js';
 export { drainVaultQuota } from './quota-writer.js';
-export { type AccountMapper, acceptVaultRoute, DEFAULT_ROUTE_PREFIX, declineVaultRoute, type MutateVaultRosterOptions, mutateVaultRoster, type ProjectionOptions, projectVaultRoster, type QuotaReceipt, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, resolveVaultPrimary, type VaultPrimary, type VaultPrimaryBinding, type VaultPrimaryUnavailableReason, type VaultRosterFile, type VaultRosterLockContext, type VaultRosterRow, vaultRoutingRows, } from './roster.js';
+export { type AccountMapper, acceptVaultRoute, DEFAULT_ROUTE_PREFIX, declineVaultRoute, type MutateVaultRosterOptions, mutateVaultRoster, type ProjectionOptions, projectVaultRoster, type QuotaReceipt, type ReorderVaultRosterOptions, type ReorderVaultRosterResult, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, reorderVaultRoster, resolveVaultPrimary, type VaultPrimary, type VaultPrimaryBinding, type VaultPrimaryUnavailableReason, type VaultRosterFile, type VaultRosterLockContext, type VaultRosterRow, type VaultRosterSeed, vaultRosterSeed, vaultRoutingRows, } from './roster.js';
 export { type ChangeNotice, ChangeNoticeReader, RESUBSCRIBE_BACKOFF_MS, SAFETY_POLL_MS, ScopedRosterWatch, type ScopedRosterWatchOptions, type ScopedWatchEnd, type ScopedWatchHandle, type ScopedWatchNoticeShape, type ScopedWatchSource, WATCH_RETRY_MS, type WatchMode, } from './watch.js';
+/** How long `connectClaustrumScopedClient` waits by default. */
+export declare const SCOPED_CONNECT_TIMEOUT_MS = 10000;
 /**
  * Connect the client that lists and fetches this consumer's vault credentials
  * on the request path. `connectionFile` is required: this library
  * reads no environment, so the plugin resolves the vault's connection file.
+ *
+ * The wait is bounded by `connectTimeoutMs` (default 10 s) so a connect that
+ * never settles cannot leave a consumer with a pending connection forever; the
+ * caller then gets an unreachable error and may try again. A socket handshake
+ * has its own limit, but local reads before it (the connection file) do not,
+ * and a client that arrives after this deadline is closed, not returned.
  */
 export declare function connectClaustrumScopedClient(options: ClaustrumClientOptions & {
     connectionFile: string;
+    connectTimeoutMs?: number;
 }): Promise<ClaustrumScopedClient>;

package/dist/common-auth-embedded/claustrum/index.js

@@ -4,25 +4,58 @@
 // declined-account interlock and the host-slot guard. Needs the optional
 // peer `@cortexkit/claustrum-client`.
 import { ClaustrumClient, } from '@cortexkit/claustrum-client';
+import { ClaustrumUnreachableError } from './availability.js';
 import { insulaUsageTransport } from './insula.js';
 export { ClaustrumCredentialError, } from '@cortexkit/claustrum-client';
 export { ClaustrumUnreachableError, classifyVaultFailure, VAULT_FAILURE_CLASSES, } from './availability.js';
-export { ClaustrumConsumer, } from './consumer.js';
+export { ClaustrumConsumer, DEFAULT_CONNECT_TIMEOUT_MS, } from './consumer.js';
 export { ClaustrumScopedCustody, decideScopedRetryAfter401, isScopedCredentialRotation, KEPT_RECEIPT_MARGIN_MS, SERVING_MARGIN_MS, } from './custody.js';
 export { ClaustrumEnrollmentManager, classifyEnrollmentError, connectClaustrumEnrollmentClient, disconnectClaustrumEnrollment, enrollmentAuthority, enrollmentName, getClaustrumEnrollmentPaths, hostEnrollmentPaths, RETRYABLE_ENROLLMENT_CODES, readClaustrumEnrollmentStatus, readClaustrumEnrollmentToken, resetClaustrumEnrollmentState, TERMINAL_ENROLLMENT_CODES, } from './enrollment.js';
 export { ClaustrumConsumerError, } from './errors.js';
 export { assertHostSlotMatchesMode, assertNotCustodyPlaceholder, CUSTODY_PLACEHOLDER_PREFIX, classifyHostSlot, custodyPlaceholder, custodyPlaceholderKey, isCustodyPlaceholder, isCustodyPlaceholderValue, } from './host-slot.js';
+export { ClaustrumDiscoveryHub, } from './hub.js';
 export { acquireInsulaQuotaSource, } from './insula.js';
 export { acceptAccount, declineAccount, isDeclined, } from './interlock.js';
 export { drainVaultQuota } from './quota-writer.js';
-export { acceptVaultRoute, DEFAULT_ROUTE_PREFIX, declineVaultRoute, mutateVaultRoster, projectVaultRoster, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, resolveVaultPrimary, vaultRoutingRows, } from './roster.js';
+export { acceptVaultRoute, DEFAULT_ROUTE_PREFIX, declineVaultRoute, mutateVaultRoster, projectVaultRoster, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, reorderVaultRoster, resolveVaultPrimary, vaultRosterSeed, vaultRoutingRows, } from './roster.js';
 export { ChangeNoticeReader, RESUBSCRIBE_BACKOFF_MS, SAFETY_POLL_MS, ScopedRosterWatch, WATCH_RETRY_MS, } from './watch.js';
+/** How long `connectClaustrumScopedClient` waits by default. */
+export const SCOPED_CONNECT_TIMEOUT_MS = 10_000;
 /**
  * Connect the client that lists and fetches this consumer's vault credentials
  * on the request path. `connectionFile` is required: this library
  * reads no environment, so the plugin resolves the vault's connection file.
+ *
+ * The wait is bounded by `connectTimeoutMs` (default 10 s) so a connect that
+ * never settles cannot leave a consumer with a pending connection forever; the
+ * caller then gets an unreachable error and may try again. A socket handshake
+ * has its own limit, but local reads before it (the connection file) do not,
+ * and a client that arrives after this deadline is closed, not returned.
  */
 export async function connectClaustrumScopedClient(options) {
-    const client = await ClaustrumClient.connect(options);
-    return Object.assign(client, { insula: insulaUsageTransport(options) });
+    const { connectTimeoutMs, ...client } = options;
+    const limit = connectTimeoutMs ?? SCOPED_CONNECT_TIMEOUT_MS;
+    const connecting = ClaustrumClient.connect(client);
+    let expired = false;
+    let timer;
+    const deadline = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => {
+            expired = true;
+            reject(new ClaustrumUnreachableError());
+        }, limit);
+        timer.unref?.();
+    });
+    try {
+        const client = await Promise.race([connecting, deadline]);
+        return Object.assign(client, { insula: insulaUsageTransport(options) });
+    }
+    catch (error) {
+        // A connection that arrives after the deadline still owns a socket.
+        void connecting.then((client) => client.close(), () => { });
+        throw error;
+    }
+    finally {
+        if (!expired && timer)
+            clearTimeout(timer);
+    }
 }

package/dist/common-auth-embedded/claustrum/quota-writer.d.ts

@@ -1,3 +1,4 @@
+import { type QuotaCommitTimer } from '../quota/commit-interval.js';
 import { type QuotaObservation } from '../quota/index.js';
 import { type QuotaReceipt, type VaultRosterFile } from './roster.js';
 export type VaultQuotaPublication = {
@@ -8,11 +9,17 @@ export type VaultQuotaPublication = {
 };
 type Listener = (publication: VaultQuotaPublication) => void;
 /** Retain the shared writer; the last consumer's close drains it. */
-export declare function retainVaultQuotaWriter(path: string, listener: Listener): () => Promise<void>;
+export declare function retainVaultQuotaWriter(path: string, listener: Listener, clock?: QuotaCommitTimer): () => Promise<void>;
 /** Enqueue without filesystem work; each quota field retains its own receipt fence. */
 export declare function enqueueVaultQuota(path: string, publication: VaultQuotaPublication): Promise<boolean>;
 /** Overlay uncommitted observations when a consumer reloads the durable roster. */
 export declare function pendingVaultQuota(path: string, roster: VaultRosterFile | undefined): VaultRosterFile | undefined;
+/**
+ * Whether this process holds quota readings for `path` that no commit of the
+ * durable roster has written yet, so a reader of the file alone is not seeing
+ * everything this process would publish.
+ */
+export declare function hasPendingVaultQuota(path: string): boolean;
 /** Wait at most timeoutMs for detached publication; shutdown loss is acceptable. */
 export declare function drainVaultQuota(path: string, timeoutMs?: number): Promise<void>;
 export {};

package/dist/common-auth-embedded/claustrum/quota-writer.js

@@ -1,12 +1,14 @@
 import { resolve } from 'node:path';
 import { createLogger } from '../logger/index.js';
+import { QUOTA_COMMIT_INTERVAL_MS, quotaCommitTimer, } from '../quota/commit-interval.js';
 import { isQuotaObservation } from '../quota/index.js';
+import { quotaFields } from '../quota/pending.js';
 import { applyVaultQuota, mutateVaultRoster, } from './roster.js';
 // Every consumer of the same file shares one mailbox and one lock waiter.
 const writers = new Map();
 const logger = createLogger('claustrum');
 const COALESCE_MS = 100;
-function writerFor(path) {
+function writerFor(path, clock = quotaCommitTimer) {
     const key = resolve(path);
     let writer = writers.get(key);
     if (!writer) {
@@ -16,6 +18,7 @@ function writerFor(path) {
             listeners: new Set(),
             wake: new Set(),
             abort: new AbortController(),
+            clock,
             failures: 0,
             draining: false,
             order: 0,
@@ -25,8 +28,8 @@ function writerFor(path) {
     return writer;
 }
 /** Retain the shared writer; the last consumer's close drains it. */
-export function retainVaultQuotaWriter(path, listener) {
-    const writer = writerFor(path);
+export function retainVaultQuotaWriter(path, listener, clock) {
+    const writer = writerFor(path, clock);
     writer.listeners.add(listener);
     let released;
     return () => (released ??= (() => {
@@ -34,65 +37,14 @@ export function retainVaultQuotaWriter(path, listener) {
         return writer.listeners.size ? Promise.resolve() : drainVaultQuota(path);
     })());
 }
-// Split one observation into its independently dated parts: each rate-limit
-// window (scope and label), each covered-but-unread window, the budget, each
-// counter and the credits record. The mailbox keeps the newest of each part on
-// its own, so a later observation that carries only some parts can't erase an
-// older but still newest reading of another part, which is how
-// mergeQuotaObservation treats them on disk. Each key also carries the
-// receipt's identity, so the identity fence still applies to every part.
+// Each field retains the receipt fence as well as its independent timestamp.
 function fields(publication) {
-    const result = new Map();
-    const { observation } = publication;
-    const witness = JSON.stringify([
+    return quotaFields(publication, JSON.stringify([
         publication.routeId,
         publication.receipt?.credentialId,
         publication.receipt?.accountIdentitySource,
         publication.receipt?.expectedAccountIdentity,
-    ]);
-    const add = (key, at, part) => result.set(`${witness}:${key}`, {
-        at,
-        order: 0,
-        publication: { ...publication, observation: part },
-    });
-    const keyFor = (scope, label) => JSON.stringify([scope ?? 'all', label]);
-    const read = new Set();
-    for (const reading of observation.readings ?? []) {
-        const key = keyFor(reading.scope, reading.label);
-        read.add(key);
-        add(key, observation.checkedAt, {
-            checkedAt: observation.checkedAt,
-            readings: [{ ...reading }],
-        });
-    }
-    for (const pair of observation.coverage ?? []) {
-        const key = keyFor(pair.scope, pair.label);
-        if (!read.has(key))
-            add(key, observation.checkedAt, {
-                checkedAt: observation.checkedAt,
-                coverage: [{ ...pair }],
-            });
-    }
-    if (observation.budget)
-        add('budget', observation.checkedAt, {
-            checkedAt: observation.checkedAt,
-            budget: { ...observation.budget },
-        });
-    for (const [name, counter] of Object.entries(observation.counters ?? {})) {
-        add(`counter:${name}`, counter.checkedAt, {
-            checkedAt: observation.checkedAt,
-            counters: { [name]: { ...counter } },
-        });
-    }
-    if (observation.credits)
-        add('credits', observation.credits.checkedAt, {
-            checkedAt: observation.checkedAt,
-            credits: { ...observation.credits },
-        });
-    // Even an empty observation can bind an account proved by its receipt.
-    if (!result.size)
-        add('empty', observation.checkedAt, { checkedAt: observation.checkedAt });
-    return result;
+    ]));
 }
 /** Enqueue without filesystem work; each quota field retains its own receipt fence. */
 export function enqueueVaultQuota(path, publication) {
@@ -143,37 +95,57 @@ export function pendingVaultQuota(path, roster) {
     }
     return roster;
 }
+/**
+ * Whether this process holds quota readings for `path` that no commit of the
+ * durable roster has written yet, so a reader of the file alone is not seeing
+ * everything this process would publish.
+ */
+export function hasPendingVaultQuota(path) {
+    return !!writers.get(resolve(path))?.pending.size;
+}
 function schedule(writer, delay) {
     if (writer.running ||
         writer.timer ||
         !writer.pending.size ||
         writer.abort.signal.aborted)
         return;
-    writer.timer = setTimeout(() => {
+    const remaining = writer.draining
+        ? 0
+        : (writer.committedAt ?? -Infinity) +
+            QUOTA_COMMIT_INTERVAL_MS -
+            writer.clock.now();
+    writer.timer = writer.clock.schedule(Math.max(delay, remaining), () => {
         writer.timer = undefined;
-        flush(writer);
-    }, delay);
+        return flush(writer);
+    });
     if (!writer.draining)
         writer.timer.unref?.();
 }
+function cancelTimer(writer) {
+    writer.timer?.cancel();
+    writer.timer = undefined;
+}
 function flush(writer) {
     if (writer.running || writer.abort.signal.aborted)
-        return;
+        return writer.running ?? Promise.resolve();
     const batch = new Map([...writer.pending].map(([account, pending]) => [
         account,
         new Map(pending),
     ]));
     writer.running = (async () => {
         try {
-            await mutateVaultRoster(writer.path, (current) => {
+            const committed = await mutateVaultRoster(writer.path, (current) => {
                 let next = current;
                 for (const field of orderedFields(batch)) {
                     if (field.priorReading)
                         next = applyVaultQuota(next, field.priorReading).roster;
                     next = applyVaultQuota(next, field.publication).roster;
                 }
-                return { ...(next !== current && { next }), result: undefined };
+                const changed = JSON.stringify(next) !== JSON.stringify(current);
+                return { ...(changed && { next }), result: changed };
             }, { signal: writer.abort.signal });
+            if (committed)
+                writer.committedAt = writer.clock.now();
             for (const [account, fields] of batch) {
                 const pending = writer.pending.get(account);
                 for (const [key, field] of fields) {
@@ -205,6 +177,7 @@ function flush(writer) {
             schedule(writer, backoff);
         }
     })();
+    return writer.running;
 }
 /** Wait at most timeoutMs for detached publication; shutdown loss is acceptable. */
 export async function drainVaultQuota(path, timeoutMs = 1_000) {
@@ -213,8 +186,7 @@ export async function drainVaultQuota(path, timeoutMs = 1_000) {
     if (!writer)
         return;
     writer.draining = true;
-    clearTimeout(writer.timer);
-    writer.timer = undefined;
+    cancelTimer(writer);
     let deadline;
     let wake;
     const drained = new Promise((done) => {
@@ -244,7 +216,7 @@ export async function drainVaultQuota(path, timeoutMs = 1_000) {
         // must not discard its observations or stop its retries.
         if (!writer.listeners.size) {
             writer.abort.abort();
-            clearTimeout(writer.timer);
+            cancelTimer(writer);
             writer.pending.clear();
             if (writers.get(key) === writer)
                 writers.delete(key);

package/dist/common-auth-embedded/claustrum/roster.d.ts

@@ -62,7 +62,25 @@ export interface ProjectionOptions {
     routePrefix?: string;
     mapAccount?: AccountMapper;
     now?: number;
+    /**
+     * Preferences carried over from another roster file, used only when there
+     * is no previous roster: its declines become this roster's declines, and
+     * its account order sorts the rows this inventory produces. No row of the
+     * seed is ever projected, so a seed cannot make an account routable.
+     */
+    seed?: VaultRosterSeed;
 }
+/** The preferences one roster file can pass to a first projection elsewhere. */
+export interface VaultRosterSeed {
+    readonly declined: readonly DeclinedAccount[];
+    /** Accounts in the seed roster's order, matched by account, then by id. */
+    readonly order: readonly {
+        readonly credentialId: string;
+        readonly accountIdentity?: string;
+    }[];
+}
+/** Declines and account order of `roster`, and nothing else of it. */
+export declare function vaultRosterSeed(roster: VaultRosterFile): VaultRosterSeed;
 export declare const DEFAULT_ROUTE_PREFIX = "vault:";
 /**
  * Project the vault's list onto the previous roster. Pure: callers serialize
@@ -87,6 +105,12 @@ export declare function projectVaultRoster(previous: VaultRosterFile | undefined
  * reaches admission.
  */
 export declare function vaultRoutingRows(roster: VaultRosterFile | undefined): RoutingRow[];
+/**
+ * `roster` as `readVaultRoster` decodes it from the file that holds it, so a
+ * committed roster and a later read of its file compare equal. Package
+ * internal: not exported from `/claustrum`.
+ */
+export declare function decodedVaultRoster(roster: VaultRosterFile): VaultRosterFile;
 export declare function readVaultRoster(path: string): Promise<VaultRosterFile | undefined>;
 /** The ownership assertion available to a roster mutation callback. */
 export interface VaultRosterLockContext {
@@ -119,6 +143,37 @@ export declare function mutateVaultRoster<T>(path: string, change: (current: Vau
 export declare function declineVaultRoute(path: string, routeId: string): Promise<undefined>;
 /** Lift the user's decline for a vault account and every alias of it. */
 export declare function acceptVaultRoute(path: string, routeId: string): Promise<undefined>;
+/** Options of `reorderVaultRoster`. */
+export interface ReorderVaultRosterOptions {
+    /** Aborts the wait for the roster's write lock. */
+    signal?: AbortSignal;
+}
+export interface ReorderVaultRosterResult {
+    /** The route id order now on disk. */
+    ids: string[];
+    /** `unchanged` when the roster was already in this order; nothing was written. */
+    outcome: 'reordered' | 'unchanged';
+}
+/**
+ * Set the order vault accounts are tried in. Routing reads that order from
+ * the roster's row order (`vaultRoutingRows`), and a later discovery keeps
+ * each account at its position, so the order lasts until the next reorder.
+ * The order is this host's routing preference: the vault has no order of its
+ * own, and this never contacts it.
+ *
+ * `routeIds` must name every roster route id exactly once; anything else
+ * (an unknown, missing or repeated id) refuses with `invalid-order` and
+ * writes nothing. It runs under the roster's write lock, like every other
+ * roster write, so a quota reading or decline committed meanwhile is kept.
+ * Each row is kept as the same object, so only the positions change: every
+ * row's fields and the rest of the file stay as they were. An order equal to
+ * the current one writes nothing. A host with no roster file yet has no
+ * routes, so only the empty order is accepted.
+ *
+ * A `ClaustrumConsumer` in the same process does not see the new order until
+ * it re-reads the file: call `consumer.reorder` instead to update both.
+ */
+export declare function reorderVaultRoster(path: string, routeIds: readonly string[], options?: ReorderVaultRosterOptions): Promise<ReorderVaultRosterResult>;
 /**
  * The receipt fields a quota or profile observation must carry to say which
  * send (credential and account) it came from. Pass the
@@ -159,6 +214,16 @@ export declare function applyVaultQuota(current: VaultRosterFile | undefined, in
     kept: boolean;
 };
 export declare function forgetPendingVaultDiscovery(path: string): void;
+/**
+ * Whether `error` from a roster commit at `path` means another writer had the
+ * roster at that moment, not that the commit itself failed: the discovery
+ * lease was busy before any roster existed, the write lock stayed busy, or a
+ * lock this commit held was lost. On Windows the same lock steps can reject
+ * with a PrivateFileError instead (a lock file that could not be read or
+ * replaced while another process held it), so a PrivateFileError naming one
+ * of this roster's lock files counts the same on every OS.
+ */
+export declare function isVaultRosterLockRefusal(path: string, error: unknown): boolean;
 /**
  * Discover and commit the roster. The lease covers the list call and the
  * commit, not just the write: an opaque view cannot tell a delayed old reply
@@ -166,7 +231,8 @@ export declare function forgetPendingVaultDiscovery(path: string): void;
  * failed list, or custody switching off mid-run, never writes anything; a
  * peer holding the lease means its last committed roster is served instead.
  * A write-lock timeout keeps the discovered inventory for the next poll,
- * unless a peer has superseded its base view in the meantime.
+ * unless a peer has superseded its base view in the meantime. A list that
+ * would write the file the roster already holds takes no write lock at all.
  */
 export declare function refreshVaultRoster(options: {
     path: string;
@@ -175,6 +241,19 @@ export declare function refreshVaultRoster(options: {
     signal?: AbortSignal;
     projection?: ProjectionOptions | (() => ProjectionOptions);
     onInventory?: (inventory: VaultInventory) => void;
+    /**
+     * For a caller that listed before taking this path's discovery lease (the
+     * discovery hub lists once for several rosters): the view this roster file
+     * held before that list. `custody.discover` then returns that list. It is
+     * held to the rule a kept discovery is held to below: it is projected only
+     * while the file still holds this view or the list's own view. Otherwise
+     * another process committed since the list, and the file is returned
+     * unchanged. No discovery is kept for a later call, because such a caller
+     * lists again.
+     */
+    listedOver?: {
+        readonly view: string | undefined;
+    };
 }): Promise<VaultRosterFile | undefined>;
 /**
  * A host-owned main account as last verified from the vault: the plugin's