@cortexkit/antigravity-auth-core 3.0.11 → 3.0.13

package/dist/common-auth-embedded/claustrum/roster.js

@@ -1,12 +1,36 @@
 import { createHash } from 'node:crypto';
+import { stat } from 'node:fs/promises';
 import { resolve } from 'node:path';
-import { acquireRefreshFileLock, LockContentionError, withLock, writeJsonAtomic, } from '../fs/index.js';
+import { acquireRefreshFileLock, LockContentionError, LockOwnershipError, lockPathFor, PrivateFileError, withLock, writeJsonAtomic, } from '../fs/index.js';
 import { readPrivateText, windowsPrivateFiles } from '../fs/private-files.js';
 import { decodeQuotaMap, isQuotaObservation, mergeQuotaObservation, } from '../quota/index.js';
 import { ClaustrumConsumerError } from './errors.js';
 import { acceptAccount, declineAccount, isDeclined, } from './interlock.js';
-import { enqueueVaultQuota, pendingVaultQuota, } from './quota-writer.js';
+import { enqueueVaultQuota, hasPendingVaultQuota, pendingVaultQuota, } from './quota-writer.js';
 export { drainVaultQuota } from './quota-writer.js';
+/** Declines and account order of `roster`, and nothing else of it. */
+export function vaultRosterSeed(roster) {
+    return {
+        declined: roster.declined.map((entry) => ({ ...entry })),
+        order: roster.rows.flatMap((row) => memberIds(row).map((credentialId) => ({
+            credentialId,
+            ...(row.accountIdentity !== undefined && {
+                accountIdentity: row.accountIdentity,
+            }),
+        }))),
+    };
+}
+/** Where a projected row falls in the seed's order; unknown rows go last. */
+function seedIndex(seed, row) {
+    const ids = memberIds(row);
+    const byAccount = row.accountIdentity === undefined
+        ? -1
+        : seed.order.findIndex((entry) => entry.accountIdentity === row.accountIdentity);
+    const index = byAccount >= 0
+        ? byAccount
+        : seed.order.findIndex((entry) => ids.includes(entry.credentialId));
+    return index >= 0 ? index : Infinity;
+}
 export const DEFAULT_ROUTE_PREFIX = 'vault:';
 function hash(value) {
     return createHash('sha256').update(value).digest('hex');
@@ -47,8 +71,9 @@ export function projectVaultRoster(previous, inventory, options = {}) {
     const prefix = options.routePrefix ?? DEFAULT_ROUTE_PREFIX;
     const reserved = options.reservedRouteIds ?? new Set();
     const previousRows = previous?.rows ?? [];
+    const seed = previous ? undefined : options.seed;
     // Declines follow the account and outlive its records, so none is pruned.
-    const declined = [...(previous?.declined ?? [])];
+    const declined = [...(previous?.declined ?? seed?.declined ?? [])];
     const complete = inventory.skipped.length === 0;
     const listed = new Set(inventory.credentials.map((credential) => credential.credentialId));
     const rejectedIds = new Set(inventory.skipped.flatMap((record) => record.credentialId === undefined ? [] : [record.credentialId]));
@@ -146,6 +171,11 @@ export function projectVaultRoster(previous, inventory, options = {}) {
                 ...(!chosen.claimed && identity !== undefined && { unclaimed: true }),
             },
         });
+        // With no previous roster every row is new; a seed from another key
+        // sorts them by that key's order instead of by credential id.
+        const pushed = projected.at(-1);
+        if (seed && pushed)
+            pushed.previousIndex = seedIndex(seed, pushed.row);
     }
     // An account the reply does not account for keeps its last good projection:
     // a rejected record must not read as the account having been removed. A
@@ -293,6 +323,14 @@ function decodeRoster(value) {
         declined,
     };
 }
+/**
+ * `roster` as `readVaultRoster` decodes it from the file that holds it, so a
+ * committed roster and a later read of its file compare equal. Package
+ * internal: not exported from `/claustrum`.
+ */
+export function decodedVaultRoster(roster) {
+    return decodeRoster(JSON.parse(JSON.stringify(roster)));
+}
 export async function readVaultRoster(path) {
     let text;
     try {
@@ -378,6 +416,78 @@ export function acceptVaultRoute(path, routeId) {
         };
     });
 }
+function invalidOrder(message) {
+    return new ClaustrumConsumerError('invalid-order', message);
+}
+/**
+ * Why `routeIds` is not an order of these rows: it must name every distinct
+ * route id exactly once and nothing else. The message quotes only ids the
+ * caller supplied; route ids it left out are counted, not named.
+ */
+function vaultOrderProblem(rows, routeIds) {
+    if (!Array.isArray(routeIds))
+        return 'route ids must be an array of route ids';
+    const rosterIds = new Set(rows.map((row) => row.routeId));
+    const given = new Set();
+    for (const id of routeIds) {
+        if (typeof id !== 'string')
+            return 'route ids must be an array of route ids';
+        if (given.has(id))
+            return `route id ${id} appears more than once`;
+        if (!rosterIds.has(id))
+            return `route id ${id} is not in the roster`;
+        given.add(id);
+    }
+    const missing = [...rosterIds].filter((id) => !given.has(id)).length;
+    if (missing > 0)
+        return `the order leaves out ${missing} roster route id${missing === 1 ? '' : 's'}`;
+    return undefined;
+}
+/**
+ * Set the order vault accounts are tried in. Routing reads that order from
+ * the roster's row order (`vaultRoutingRows`), and a later discovery keeps
+ * each account at its position, so the order lasts until the next reorder.
+ * The order is this host's routing preference: the vault has no order of its
+ * own, and this never contacts it.
+ *
+ * `routeIds` must name every roster route id exactly once; anything else
+ * (an unknown, missing or repeated id) refuses with `invalid-order` and
+ * writes nothing. It runs under the roster's write lock, like every other
+ * roster write, so a quota reading or decline committed meanwhile is kept.
+ * Each row is kept as the same object, so only the positions change: every
+ * row's fields and the rest of the file stay as they were. An order equal to
+ * the current one writes nothing. A host with no roster file yet has no
+ * routes, so only the empty order is accepted.
+ *
+ * A `ClaustrumConsumer` in the same process does not see the new order until
+ * it re-reads the file: call `consumer.reorder` instead to update both.
+ */
+export function reorderVaultRoster(path, routeIds, options = {}) {
+    return mutateVaultRoster(path, (current) => {
+        const rows = current?.rows ?? [];
+        const problem = vaultOrderProblem(rows, routeIds);
+        if (problem)
+            throw invalidOrder(problem);
+        // Group by route id so a hand-edited file that repeats one keeps every
+        // copy: the later copies travel right after the first.
+        const byId = new Map();
+        for (const row of rows) {
+            const group = byId.get(row.routeId);
+            if (group)
+                group.push(row);
+            else
+                byId.set(row.routeId, [row]);
+        }
+        const ids = [...routeIds];
+        const next = ids.flatMap((id) => byId.get(id) ?? []);
+        if (!current || next.every((row, index) => row === rows[index]))
+            return { result: { ids, outcome: 'unchanged' } };
+        return {
+            next: { ...current, rows: next },
+            result: { ids, outcome: 'reordered' },
+        };
+    }, { ...(options.signal && { signal: options.signal }) });
+}
 /**
  * What a receipt may do to a row's quota: `hold` (the row holds the receipt's
  * credential and account), `bind` (the row has never had a known account and
@@ -488,6 +598,102 @@ const pendingDiscoveries = new Map();
 export function forgetPendingVaultDiscovery(path) {
     pendingDiscoveries.delete(resolve(path));
 }
+/**
+ * Whether `error` from a roster commit at `path` means another writer had the
+ * roster at that moment, not that the commit itself failed: the discovery
+ * lease was busy before any roster existed, the write lock stayed busy, or a
+ * lock this commit held was lost. On Windows the same lock steps can reject
+ * with a PrivateFileError instead (a lock file that could not be read or
+ * replaced while another process held it), so a PrivateFileError naming one
+ * of this roster's lock files counts the same on every OS.
+ */
+export function isVaultRosterLockRefusal(path, error) {
+    const target = resolve(path);
+    if (error instanceof ClaustrumConsumerError)
+        return error.kind === 'roster-busy';
+    if (error instanceof LockContentionError ||
+        error instanceof LockOwnershipError)
+        return resolve(error.details.target) === target;
+    if (error instanceof PrivateFileError) {
+        const failed = resolve(error.path);
+        return [WRITE_LOCK.name, DISCOVERY_LEASE.name].some((name) => {
+            const lock = lockPathFor(target, name);
+            // The lock file itself, its eviction marker and the temporary files
+            // its owner record is staged in all start with the lock path.
+            return failed === lock || failed.startsWith(`${lock}.`);
+        });
+    }
+    return false;
+}
+const UNLOCKED_READ_ATTEMPTS = 4;
+/**
+ * What identifies one version of the file at `path`: the roster is always
+ * replaced by a rename, so any write gives it a different inode, and an
+ * in-place rewrite a different size or modification time. Undefined when it
+ * cannot be inspected, which callers must read as 'may have changed'.
+ */
+async function fileStamp(path) {
+    try {
+        const { dev, ino, size, mtimeMs } = await stat(path);
+        return { dev, ino, size, mtimeMs };
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Whether two `fileStamp` readings are of the same file version. */
+function sameFileStamp(left, right) {
+    return (left !== undefined &&
+        right !== undefined &&
+        left.dev === right.dev &&
+        left.ino === right.ino &&
+        left.size === right.size &&
+        left.mtimeMs === right.mtimeMs);
+}
+/**
+ * Whether a roster list that lands unlocked would write exactly the file at
+ * `path`. `overlay` names what this process holds besides the file: `target` is
+ * the file's own roster, which the locked commit compares against, and `local`,
+ * when different, is that roster plus unwritten quota readings, which must
+ * equal the commit's result too. Both must equal `next(target)`'s bytes, which
+ * is the write the commit would make; any difference, a missing or unreadable
+ * file, or a read that a concurrent reader keeps changing all mean 'commit'.
+ */
+async function readUnlockedCommitTarget(path, overlay, next) {
+    for (let attempt = 0; attempt < UNLOCKED_READ_ATTEMPTS; attempt++) {
+        // Roster files are replaced by rename, so each attempt reads one whole
+        // file either way.
+        const before = await fileStamp(path);
+        const current = await readVaultRoster(path);
+        let target;
+        let local;
+        let changed;
+        try {
+            ;
+            ({ target, local } = overlay(current));
+            const written = JSON.stringify(next(target));
+            changed =
+                JSON.stringify(target) !== written ||
+                    (local !== undefined && JSON.stringify(local) !== written);
+        }
+        catch {
+            return 'commit';
+        }
+        // No lock was taken, so another writer may have replaced the file while
+        // it was being projected. The answer must describe the file as it is now,
+        // otherwise a later list of the same roster would find it changed again.
+        if (!sameFileStamp(before, await fileStamp(path)))
+            continue;
+        if (changed)
+            return 'commit';
+        // Quota readings this process enqueued while the file was being projected
+        // are not part of `current`, and a list that returns unchanged while they
+        // wait would be the only chance to serve them as this list's roster. They
+        // keep their own commit either way, so this path takes the locked one.
+        return hasPendingVaultQuota(path) ? 'commit' : 'unchanged';
+    }
+    return 'commit';
+}
 /**
  * Discover and commit the roster. The lease covers the list call and the
  * commit, not just the write: an opaque view cannot tell a delayed old reply
@@ -495,7 +701,8 @@ export function forgetPendingVaultDiscovery(path) {
  * failed list, or custody switching off mid-run, never writes anything; a
  * peer holding the lease means its last committed roster is served instead.
  * A write-lock timeout keeps the discovered inventory for the next poll,
- * unless a peer has superseded its base view in the meantime.
+ * unless a peer has superseded its base view in the meantime. A list that
+ * would write the file the roster already holds takes no write lock at all.
  */
 export async function refreshVaultRoster(options) {
     options.signal?.throwIfAborted();
@@ -517,10 +724,11 @@ export async function refreshVaultRoster(options) {
         return persisted;
     }
     const key = resolve(options.path);
+    const listedOver = options.listedOver;
     let discovered;
     try {
         const previous = await readVaultRoster(options.path);
-        const pending = pendingDiscoveries.get(key);
+        const pending = listedOver ? undefined : pendingDiscoveries.get(key);
         // Opaque view cursors cannot be ordered. Reuse a discovery only while no
         // peer has committed a different view since it was read.
         discovered =
@@ -534,20 +742,58 @@ export async function refreshVaultRoster(options) {
                 };
         pendingDiscoveries.delete(key);
         const { inventory } = discovered;
-        options.onInventory?.(inventory);
+        // Called, not awaited: a caller noting the list here may wait for this
+        // roster's write lock, and this refresh decides below whether it needs it.
+        void options.onInventory?.(inventory);
         options.signal?.throwIfAborted();
+        const projection = typeof options.projection === 'function'
+            ? options.projection()
+            : options.projection;
+        const next = (current) => projectVaultRoster(current, inventory, projection);
+        const isActive = async () => {
+            options.signal?.throwIfAborted();
+            await lease.assertOwned();
+            return active();
+        };
+        // The write lock costs a lock file, an eviction marker and staging files in
+        // the roster's directory on every poll, so it is skipped when the list
+        // would write the file that is already there. The read deciding that takes
+        // no lock: a writer that commits between the read and this decision only
+        // makes our comparison stale, and a stale comparison never writes (the
+        // commit below judges the file again under the lock). Only equality with
+        // every byte the commit would write skips; every other answer commits.
+        const decision = await readUnlockedCommitTarget(options.path, (current) => {
+            // A hub member listed over a base view of its file: the file's own view
+            // is what the commit compares, so the overlay is the plain file. The
+            // locked commit below still applies the base-view rule.
+            if (listedOver)
+                return { target: current };
+            // This process's unwritten quota readings are part of the roster it
+            // serves, so a list that matches everything but them still commits.
+            const local = pendingVaultQuota(options.path, current);
+            return { target: current, ...(local !== current && { local }) };
+        }, next);
+        if (decision === 'unchanged') {
+            if (!(await isActive()))
+                return undefined;
+            // Returned as a later read of the file: that is what today's locked
+            // unchanged commit returns, and memory keeps only what was committed.
+            return await readVaultRoster(options.path);
+        }
         return await mutateVaultRoster(options.path, async (current) => {
             if (!(await active()))
                 return { result: undefined };
             options.signal?.throwIfAborted();
             await lease.assertOwned();
-            const projection = typeof options.projection === 'function'
-                ? options.projection()
-                : options.projection;
-            const next = projectVaultRoster(current, inventory, projection);
-            const changed = JSON.stringify(current) !== JSON.stringify(next);
-            return { ...(changed && { next }), result: next };
+            if (listedOver &&
+                current?.view !== listedOver.view &&
+                current?.view !== inventory.view)
+                return { result: current };
+            const projected = next(current);
+            const changed = JSON.stringify(current) !== JSON.stringify(projected);
+            return { ...(changed && { next: projected }), result: projected };
         }, {
+            signal: options.signal,
             beforePublish: async () => {
                 options.signal?.throwIfAborted();
                 await lease.assertOwned();
@@ -557,6 +803,7 @@ export async function refreshVaultRoster(options) {
     catch (error) {
         if (error instanceof LockContentionError &&
             discovered &&
+            !listedOver &&
             !options.signal?.aborted &&
             (await active()))
             pendingDiscoveries.set(key, discovered);

package/dist/common-auth-embedded/claustrum/shutdown.js

@@ -0,0 +1,42 @@
+/** Retired generations report separately until their owner closes and shares one warning. */
+export function shutdownWarning(logger, shutdown) {
+    let warned = false;
+    return (pendingOperations) => {
+        if (warned)
+            return;
+        if (!shutdown || shutdown.aborted)
+            warned = true;
+        logger.warn('claustrum shutdown drain timed out', { pendingOperations });
+    };
+}
+/**
+ * Give cancelled background work two seconds to release its handles without letting
+ * an unresponsive connector or disk hold the host's shutdown indefinitely.
+ */
+export async function drainShutdown(pending, onTimeout) {
+    if (!pending.size)
+        return;
+    let timer;
+    let expired = false;
+    const drained = (async () => {
+        while (!expired && pending.size)
+            await Promise.allSettled([...pending]);
+    })();
+    try {
+        await Promise.race([
+            drained,
+            new Promise((resolve) => {
+                timer = setTimeout(() => {
+                    expired = true;
+                    resolve();
+                }, 2_000);
+            }),
+        ]);
+        if (expired && pending.size)
+            onTimeout(pending.size);
+    }
+    finally {
+        expired = true;
+        clearTimeout(timer);
+    }
+}

package/dist/common-auth-embedded/commands/builtins.d.ts

@@ -48,6 +48,43 @@ export interface RoutingSectionOptions {
      */
     orderedVariants?: MenuChoice[];
     formerMainId?: string;
+    /**
+     * The vault accounts' routing order, for a plugin that can run in vault
+     * mode. Called on each build; return the order while the plugin routes
+     * through vault accounts and undefined otherwise. While it returns one, the
+     * section shows and sets the vault accounts' order (by the name the menu
+     * shows for each account) instead of the pool roster's. Wire it to
+     * `ClaustrumConsumer.snapshot()` and `ClaustrumConsumer.reorder`, or to
+     * `readVaultRoster` and `reorderVaultRoster` for a plugin without a
+     * consumer.
+     */
+    vaultOrder?: () => VaultRoutingOrder | undefined | Promise<VaultRoutingOrder | undefined>;
+}
+/**
+ * The order vault accounts are tried in, as the Routing section reads and
+ * sets it in vault mode. Shaped after `/claustrum`'s roster, without
+ * importing it, so the menu does not need the vault client.
+ */
+export interface VaultRoutingOrder {
+    /**
+     * Every vault roster row, in roster (routing) order: its route id and the
+     * name the plugin shows for that account (the roster row's `label`, or its
+     * email). Route ids are long and opaque, so the section shows and accepts
+     * labels; a route id is still accepted wherever a label is.
+     */
+    rows: readonly {
+        id: string;
+        label: string;
+    }[];
+    /**
+     * Sets the order. `ids` are route ids, every one exactly once. Wire it to
+     * `ClaustrumConsumer.reorder` or `reorderVaultRoster`, which refuse any
+     * other list without writing.
+     */
+    reorder(ids: readonly string[]): Promise<{
+        ids: readonly string[];
+        outcome: 'reordered' | 'unchanged';
+    }>;
 }
 export interface LimitsSectionOptions {
     /**

package/dist/common-auth-embedded/commands/builtins.js

@@ -4,7 +4,7 @@
 // the same locks as any other writer of those files.
 import { formatQuota, isQuotaMap, projectQuota, quotaWindowName, } from '../quota/index.js';
 import { DEFAULT_FORMER_MAIN_ID, orderForPlacement, resolveRoutingMode, } from '../routing/index.js';
-import { projectFailure, } from './seam.js';
+import { CommandError, projectFailure, } from './seam.js';
 /** `disabledReason` recorded when the user disables an account from the menu. */
 export const MENU_DISABLED_REASON = 'disabled from the command menu';
 function isRecord(value) {
@@ -65,13 +65,16 @@ function addedText(name, result) {
 function failureMessage(error) {
     return projectFailure(error).text;
 }
-async function snapshot(store) {
+async function snapshot(options) {
+    const { store } = options;
     const load = await store.read();
     const read = await store.readSettings();
+    const vault = await options.routing?.vaultOrder?.();
     return {
         load,
         rows: distinctRows(load),
         settings: read.status === 'error' ? {} : read.settings,
+        ...(vault ? { vault } : {}),
     };
 }
 function accountView(row, options) {
@@ -323,6 +326,73 @@ function quotaSection(options, snap) {
         },
     };
 }
+/**
+ * Sets the vault order. The roster's own refusal of the list (`invalid-order`:
+ * an account left out, which it counts without naming) is shown with its own
+ * message; any other failure is projected as usual. The kind is read from
+ * the error object so the menu does not import the vault client.
+ */
+async function reorderVault(vault, order) {
+    try {
+        return await vault.reorder(order);
+    }
+    catch (error) {
+        if (error instanceof Error &&
+            error.name === 'ClaustrumConsumerError' &&
+            error.kind === 'invalid-order')
+            throw new CommandError('vault-invalid-order', error.message, {
+                cause: error,
+            });
+        throw error;
+    }
+}
+function invalidVaultOrder(message) {
+    return new CommandError('vault-invalid-order', message);
+}
+/**
+ * How the Routing section names vault accounts: by label, since route ids
+ * are long and opaque. A typed entry may be a label or a route id, and must
+ * name exactly one account. Refusals quote only the entry the user typed.
+ */
+function vaultNames(vault) {
+    const rows = vault.rows.map((row) => ({
+        id: row.id,
+        label: row.label.trim() || row.id,
+    }));
+    const matches = (entry) => rows.filter((row) => row.id === entry || row.label === entry);
+    return {
+        ids: rows.map((row) => row.id),
+        nameOf: (id) => rows.find((row) => row.id === id)?.label ?? id,
+        /**
+         * What the order input starts with for an account: its label when
+         * typing that label back names this account alone, else its route id
+         * (two accounts sharing a label, or a label with a comma or line break
+         * in it, either of which would split it into two entries).
+         */
+        entryOf: (id) => {
+            const row = rows.find((entry) => entry.id === id);
+            return row && !/[,\n]/.test(row.label) && matches(row.label).length === 1
+                ? row.label
+                : id;
+        },
+        /** The route ids the typed entries name, in order; refuses before any write. */
+        resolve: (entries) => {
+            const ids = [];
+            for (const entry of entries) {
+                const found = matches(entry);
+                if (found.length === 0)
+                    throw invalidVaultOrder(`"${entry}" is not a vault account.`);
+                if (found.length > 1)
+                    throw invalidVaultOrder(`"${entry}" matches more than one vault account; enter those accounts by route id.`);
+                const id = found[0].id;
+                if (ids.includes(id))
+                    throw invalidVaultOrder(`"${entry}" names an account already in the order.`);
+                ids.push(id);
+            }
+            return ids;
+        },
+    };
+}
 function routingSection(options, snap) {
     const { store, extraLocks } = options;
     const locks = extraLocks ? { extraLocks } : {};
@@ -336,14 +406,18 @@ function routingSection(options, snap) {
         ? raw
         : 'ordered';
     const resolved = resolveRoutingMode(current);
-    const ids = snap.rows.map((row) => row.id);
+    // In vault mode routing tries the vault accounts, so their order is the
+    // one shown and set here; the pool roster's order is not used.
+    const vault = snap.vault ? vaultNames(snap.vault) : undefined;
+    const ids = vault ? vault.ids : snap.rows.map((row) => row.id);
+    const nameOf = (id) => (vault ? vault.nameOf(id) : id);
     const tried = orderForPlacement(ids, resolved.placement, options.routing?.formerMainId ?? DEFAULT_FORMER_MAIN_ID);
     const label = choices.find((choice) => choice.value === current)?.label ?? current;
     const lines = [`Mode: ${label}`];
     if (ids.length > 0)
-        lines.push(`Roster order: ${ids.join(', ')}`);
+        lines.push(`${vault ? 'Vault account order' : 'Roster order'}: ${ids.map(nameOf).join(', ')}`);
     if (resolved.mode === 'ordered' && tried.join() !== ids.join())
-        lines.push(`Tried in order: ${tried.join(', ')}`);
+        lines.push(`Tried in order: ${tried.map(nameOf).join(', ')}`);
     const actions = [
         {
             id: 'mode',
@@ -371,19 +445,27 @@ function routingSection(options, snap) {
                 {
                     kind: 'text',
                     id: 'order',
-                    label: 'Account ids, first to last',
-                    value: ids.join(', '),
+                    label: vault
+                        ? 'Vault accounts, first to last, separated by commas'
+                        : 'Account ids, first to last',
+                    value: vault ? ids.map(vault.entryOf).join(', ') : ids.join(', '),
                     required: true,
                 },
             ],
             run: async ({ values }) => {
-                const order = String(values.order)
-                    .split(/[\s,]+/)
-                    .filter((id) => id.length > 0);
-                const result = await store.reorder(order, locks);
+                const text = String(values.order);
+                // A vault label may contain spaces, so vault entries are separated by
+                // commas or line breaks, not spaces; pool ids never contain spaces.
+                const entries = text
+                    .split(vault ? /[,\n]+/ : /[\s,]+/)
+                    .map((entry) => entry.trim())
+                    .filter((entry) => entry.length > 0);
+                const result = snap.vault && vault
+                    ? await reorderVault(snap.vault, vault.resolve(entries))
+                    : await store.reorder(entries, locks);
                 return result.outcome === 'unchanged'
                     ? 'The order is unchanged.'
-                    : `Order set to ${result.ids.join(', ')}.`;
+                    : `Order set to ${result.ids.map(nameOf).join(', ')}.`;
             },
         });
     return {
@@ -524,7 +606,7 @@ function limitsSection(options, snap) {
 }
 /** The four built-in sections, in their fixed order, from one read of the store. */
 export async function builtinSections(options) {
-    const snap = await snapshot(options.store);
+    const snap = await snapshot(options);
     return [
         accountsSection(options, snap),
         quotaSection(options, snap),

package/dist/common-auth-embedded/commands/index.d.ts

@@ -1,4 +1,4 @@
-export type { AccountsSectionOptions, LimitsSectionOptions, LoginOutcome, QuotaSectionOptions, RoutingSectionOptions, } from './builtins.js';
+export type { AccountsSectionOptions, LimitsSectionOptions, LoginOutcome, QuotaSectionOptions, RoutingSectionOptions, VaultRoutingOrder, } from './builtins.js';
 export { MENU_DISABLED_REASON } from './builtins.js';
 export type { CommandMenu, CommandMenuOptions, StoreSectionSlot, } from './menu.js';
 export { createCommandMenu, parseApplyRequest } from './menu.js';

package/dist/common-auth-embedded/fs/file-read-cache.js

@@ -0,0 +1,57 @@
+import { lstat } from 'node:fs/promises';
+import { resolve } from 'node:path';
+async function identity(path) {
+    try {
+        const metadata = await lstat(path);
+        // Do not follow a symlink: its target can change without changing the link.
+        return metadata.isFile() ? metadata : undefined;
+    }
+    catch (error) {
+        return error.code === 'ENOENT'
+            ? 'absent'
+            : undefined;
+    }
+}
+function sameIdentity(left, right) {
+    if (left === 'absent' || right === 'absent')
+        return left === right;
+    return (left.dev === right.dev &&
+        left.ino === right.ino &&
+        left.size === right.size &&
+        left.mtimeMs === right.mtimeMs &&
+        left.ctimeMs === right.ctimeMs);
+}
+/** Process-local reads, capped at 64 path sets with one value per resolved set. */
+export class FileReadCache {
+    #entries = new Map();
+    async read(paths, read, validateHit) {
+        const resolvedPaths = paths.map((path) => resolve(path));
+        const key = JSON.stringify(resolvedPaths);
+        const probed = await Promise.all(resolvedPaths.map(identity));
+        const identities = probed.every((entry) => entry !== undefined)
+            ? probed
+            : undefined;
+        const cached = this.#entries.get(key);
+        if (identities &&
+            cached &&
+            identities.every((entry, index) => {
+                const previous = cached.identities[index];
+                return previous !== undefined && sameIdentity(entry, previous);
+            })) {
+            validateHit?.(identities);
+            return cached.value;
+        }
+        // A failed probe or read must not leave a previous successful value reusable.
+        this.#entries.delete(key);
+        const value = await read(resolvedPaths);
+        if (identities) {
+            if (this.#entries.size >= 64) {
+                const oldest = this.#entries.keys().next().value;
+                if (oldest !== undefined)
+                    this.#entries.delete(oldest);
+            }
+            this.#entries.set(key, { identities, value });
+        }
+        return value;
+    }
+}