@cortexkit/antigravity-auth-core 3.0.28 → 3.0.30

package/dist/common-auth-embedded/store/limits-namespace.js

@@ -0,0 +1,34 @@
+import { writeJsonAtomic } from '../fs/atomic-write.js';
+import { assertLimitsWriteAllowed, runInsideHook } from './hooks.js';
+import { notReadyError, readPool, runOperation } from './mutate.js';
+/** A namespace merge and its check of current row bindings share one locked config snapshot. */
+export async function updatePoolLimitsNamespace(rt, mutator) {
+    assertLimitsWriteAllowed();
+    const { ctx } = rt;
+    await runOperation(ctx, 'updateLimitsNamespace', undefined, undefined, async (locks, progress) => {
+        for (const spec of ctx.storeLocks)
+            await locks.acquire(spec);
+        const result = await readPool(ctx);
+        if (result.status !== 'ready')
+            throw notReadyError(result, 'updateLimitsNamespace', undefined);
+        const rows = result.rows.map(({ id, credentialEpoch, identity }) => ({
+            id,
+            credentialEpoch,
+            identity,
+        }));
+        const envelope = await runInsideHook('updateLimitsNamespace', () => mutator(structuredClone(result.config.commonAuthLimits), rows));
+        const config = { ...result.config, commonAuthLimits: envelope };
+        const info = {
+            operation: 'updateLimitsNamespace',
+            rowId: undefined,
+        };
+        await writeJsonAtomic(ctx.configPath, config, {
+            beforeRename: async () => {
+                await ctx.onStep?.('before-config-write', info);
+                await locks.assertAll();
+            },
+        });
+        progress.writes++;
+        await ctx.onStep?.('after-config-write', info);
+    });
+}

package/dist/common-auth-embedded/store/pool.d.ts

@@ -2,6 +2,7 @@ import type { QuotaCommitTimer } from '../quota/commit-interval.js';
 import { type Attribution } from './attribution.js';
 import type { PoolOperationError } from './errors.js';
 import type { PoolLogger } from './hooks.js';
+import { type PoolLimitsMutator } from './limits-namespace.js';
 import { type HoldPoint, type InitializeOutcome, type StoreContext } from './mutate.js';
 import { type ProviderStateMutator, type UpdateProviderStateResult } from './provider-state.js';
 import { type PublicationReceipt, type PublishOptions, type PublishPlan, type PublishResult } from './publication.js';
@@ -191,9 +192,17 @@ export interface PoolStore {
     /**
      * One locked write of the plugin's settings (since 0.2.6) beside the pool,
      * in the config file. Refuses a result that sets a pool-owned key
-     * (`invalid-input`). Takes `extraLocks`, then the store locks.
+     * (`invalid-input`). Carries commonAuthLimits through unchanged and refuses
+     * an explicit alteration to it. Takes `extraLocks`, then the store locks.
      */
     updateSettings(mutator: SettingsMutator, options?: UpdateSettingsOptions): Promise<UpdateSettingsResult>;
+    /**
+     * Merges commonAuthLimits with current row bindings in one config write.
+     * Requires a ready pool and takes only the store locks. May run in an
+     * onPersisted/onFailure hook or a pull, but not in a lock-held mutator.
+     * Optional so existing structural implementations remain compatible.
+     */
+    updateLimitsNamespace?(mutator: PoolLimitsMutator): Promise<void>;
     /**
      * Records the identity a lookup found for the row's credential. Since
      * 0.3.1 it takes the credential epoch the lookup was issued for, and

package/dist/common-auth-embedded/store/pool.js

@@ -1,4 +1,5 @@
 import { recordQuota } from './attribution.js';
+import { updatePoolLimitsNamespace, } from './limits-namespace.js';
 import { initializePool, readPool, } from './mutate.js';
 import { updateProviderStateRow, } from './provider-state.js';
 import { publication, publishRoster, } from './publication.js';
@@ -126,6 +127,7 @@ export function openPoolStore(options) {
         reorder: (ids, callOptions) => reorderRows(rt, ids, callOptions),
         readSettings: () => readPoolSettings(rt),
         updateSettings: (mutator, callOptions) => updatePoolSettings(rt, mutator, callOptions),
+        updateLimitsNamespace: (mutator) => updatePoolLimitsNamespace(rt, mutator),
         recordIdentity: (id, identity, attribution, callOptions) => recordRowIdentity(rt, id, identity, attribution, callOptions),
         refresh: (id, provider, callOptions) => refreshRow(rt, id, provider, callOptions),
         recordQuota: record,

package/dist/common-auth-embedded/store/provider-state.js

@@ -1,4 +1,4 @@
-import { assertNotInsideHook, runInsideHook } from './hooks.js';
+import { assertNotInsideHook, runInsideCodec, runInsideHook } from './hooks.js';
 import { runOperation, withTransaction } from './mutate.js';
 import { readRow, refusal, requireBound, rowLockSpec, unknownRow, } from './runtime.js';
 import { boundProviderStateDigest, CREDENTIAL_STAMP_KEY, credentialDigest, isCredentialEpoch, isRecord, PROVIDER_STATE_KEY, parseStamp, providerStateDigest, rowLockKey, } from './schema.js';
@@ -21,7 +21,7 @@ export function acceptProviderState(codec, operation, id, value, what = 'the pro
     }
     if (normalized === undefined)
         throw refusal(operation, id, 'invalid-provider-state', `${what} cannot be stored as JSON`);
-    if (!codec.validate(normalized))
+    if (!runInsideCodec(() => codec.validate(normalized)))
         throw refusal(operation, id, 'invalid-provider-state', `the provider-state codec rejected ${what}`);
     return normalized;
 }
@@ -35,7 +35,7 @@ export function mergedProviderState(codec, operation, id, onDisk, incoming) {
         return { kind: 'set', value: incoming };
     return {
         kind: 'set',
-        value: acceptProviderState(codec, operation, id, codec.merge(structuredClone(onDisk), structuredClone(incoming)), 'the merged provider state'),
+        value: acceptProviderState(codec, operation, id, runInsideCodec(() => codec.merge?.(structuredClone(onDisk), structuredClone(incoming))), 'the merged provider state'),
     };
 }
 /**
@@ -48,7 +48,7 @@ export function mergedProviderState(codec, operation, id, onDisk, incoming) {
 export function replacementProviderState(codec, row, credentialEpoch, identity, incoming) {
     const hook = codec?.onReplace;
     const next = hook
-        ? hook(row.providerState === undefined
+        ? runInsideCodec(() => hook(row.providerState === undefined
             ? undefined
             : structuredClone(row.providerState), {
             id: row.id,
@@ -60,7 +60,7 @@ export function replacementProviderState(codec, row, credentialEpoch, identity,
             ...(incoming !== undefined
                 ? { incoming: structuredClone(incoming) }
                 : {}),
-        })
+        }))
         : incoming;
     if (next === undefined)
         return { kind: 'clear' };

package/dist/common-auth-embedded/store/refresh.js

@@ -200,7 +200,7 @@ export async function refreshRow(rt, id, provider, options = {}) {
         if (options.onPersisted) {
             try {
                 const persisted = options.onPersisted;
-                await runInsideHook('refresh', () => persisted(id, commit.stored));
+                await runInsideHook('refresh', () => persisted(id, commit.stored), true);
             }
             catch (cause) {
                 throw new PoolOperationError({

package/dist/common-auth-embedded/store/schema.js

@@ -1,4 +1,5 @@
 import { createHash } from 'node:crypto';
+import { runInsideCodec } from './hooks.js';
 /** Top-level key of the config file that holds everything the pool adds. */
 export const POOL_KEY = 'commonAuthPool';
 /** The pool schema this library reads and writes. */
@@ -182,7 +183,9 @@ export function stampFor(credential, credentialEpoch, binding, options = {}) {
  * digest the store writes.
  */
 export function providerStateDigest(codec, value) {
-    const bound = codec?.credentialBound ? codec.credentialBound(value) : value;
+    const bound = codec?.credentialBound
+        ? runInsideCodec(() => codec.credentialBound?.(value))
+        : value;
     return createHash('sha256')
         .update(`provider-state\0${JSON.stringify(bound ?? null)}`)
         .digest('hex');
@@ -420,8 +423,10 @@ function parseEntry(raw, codec) {
         return undefined;
     if ('disabledReason' in raw && typeof raw.disabledReason !== 'string')
         return undefined;
-    const quota = 'quota' in raw && codec.decode ? codec.decode(raw.quota) : raw.quota;
-    if ('quota' in raw && !codec.validate(quota))
+    const quota = 'quota' in raw && codec.decode
+        ? runInsideCodec(() => codec.decode?.(raw.quota))
+        : raw.quota;
+    if ('quota' in raw && !runInsideCodec(() => codec.validate(quota)))
         return undefined;
     if ('staged' in raw && !parseReservation(raw.staged))
         return undefined;
@@ -666,7 +671,7 @@ function providerStateFields(account, credential, credentialEpoch, identity, cod
     const value = account[PROVIDER_STATE_KEY];
     // The value is validated before it is projected, so the projection only
     // ever sees a value of the shape the codec accepts.
-    if (!codec?.validate(value))
+    if (!codec || !runInsideCodec(() => codec.validate(value)))
         return { providerStateDropped: 'invalid' };
     if (providerStateDigest(codec, value) !== digest)
         return { providerStateDropped: 'uncovered' };

package/dist/common-auth-embedded/store/settings.d.ts

@@ -59,5 +59,7 @@ export declare function readPoolSettings(rt: StoreRuntime): Promise<SettingsRead
  * pool-owned key refuses (`invalid-input`) with nothing written; a result
  * equal to the current settings writes nothing. The state file is never
  * touched, and the pool-owned keys are written back exactly as read.
+ * commonAuthLimits is also carried through unchanged, even when omitted by
+ * the mutator; an explicit change to it refuses before writing anything.
  */
 export declare function updatePoolSettings(rt: StoreRuntime, mutator: SettingsMutator, options?: UpdateSettingsOptions): Promise<UpdateSettingsResult>;

package/dist/common-auth-embedded/store/settings.js

@@ -36,12 +36,13 @@ function defineKey(target, key, value) {
 /**
  * The next config: the pool-owned keys exactly as read, every settings key
  * from `next` in its existing position, settings keys `next` dropped left
- * out, and new settings keys appended.
+ * out, and new settings keys appended. The limits envelope is always carried
+ * through from disk; ordinary settings mutators do not own that namespace.
  */
 function composeConfig(config, next) {
     const out = {};
     for (const [key, value] of Object.entries(config)) {
-        if (POOL_OWNED_KEYS.includes(key))
+        if (POOL_OWNED_KEYS.includes(key) || key === 'commonAuthLimits')
             defineKey(out, key, value);
         else if (Object.hasOwn(next, key))
             defineKey(out, key, next[key]);
@@ -82,6 +83,8 @@ export async function readPoolSettings(rt) {
  * pool-owned key refuses (`invalid-input`) with nothing written; a result
  * equal to the current settings writes nothing. The state file is never
  * touched, and the pool-owned keys are written back exactly as read.
+ * commonAuthLimits is also carried through unchanged, even when omitted by
+ * the mutator; an explicit change to it refuses before writing anything.
  */
 export async function updatePoolSettings(rt, mutator, options = {}) {
     assertNotInsideHook('updateSettings');
@@ -109,9 +112,13 @@ export async function updatePoolSettings(rt, mutator, options = {}) {
             const owned = POOL_OWNED_KEYS.filter((key) => Object.hasOwn(next, key));
             if (owned.length > 0)
                 throw settingsRefusal(`settings cannot set the pool-owned key(s) ${owned.join(', ')}`);
-            if (isDeepStrictEqual(next, current))
-                return { settings: current, outcome: 'unchanged' };
+            if (Object.hasOwn(next, 'commonAuthLimits') &&
+                (!Object.hasOwn(current, 'commonAuthLimits') ||
+                    !isDeepStrictEqual(next.commonAuthLimits, current.commonAuthLimits)))
+                throw settingsRefusal('settings cannot alter commonAuthLimits; use updateLimitsNamespace');
             const config = composeConfig(result.config, next);
+            if (isDeepStrictEqual(settingsOf(config), current))
+                return { settings: current, outcome: 'unchanged' };
             const info = { operation: 'updateSettings', rowId: undefined };
             await writeJsonAtomic(ctx.configPath, config, {
                 beforeRename: async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/antigravity-auth-core",
-  "version": "3.0.28",
+  "version": "3.0.30",
   "description": "Harness-agnostic core for Google Antigravity OAuth: transport, fingerprint, request transforms, accounts, quota",
   "type": "module",
   "license": "MIT",