@cortexkit/antigravity-auth-core 3.0.29 → 3.0.30

package/dist/common-auth-embedded/claustrum/consumer.d.ts

@@ -6,6 +6,7 @@ import { type ClaustrumLogger } from './errors.js';
 import type { CustodyLease } from './hub.js';
 import { type InsulaQuotaOptions, type InsulaQuotaResult } from './insula.js';
 import { type AccountMapper, type ProjectionOptions, type QuotaReceipt, type ReorderVaultRosterResult, type VaultRosterFile } from './roster.js';
+import type { ClaustrumUsageReading, ClaustrumUsageReportState } from './usage.js';
 import { type WatchMode } from './watch.js';
 export interface ClaustrumConsumerOptions<Q = QuotaObservation> {
     /**
@@ -229,6 +230,17 @@ export declare class ClaustrumConsumer<Q = QuotaObservation> {
      * poll, and a route whose credential or account changed is refused.
      */
     authorize(routeId: string, signal?: AbortSignal): Promise<ClaustrumScopedAttempt>;
+    /**
+     * Queue reply quota metadata without waiting or throwing. Pass rate-limit
+     * headers only, never tokens: the library does not filter header names.
+     * The credential must have been served by this host and still belong to the route.
+     */
+    reportUsage(input: {
+        routeId: string;
+        credentialId: string;
+        reading: ClaustrumUsageReading;
+    }): void;
+    usageReportState(): ClaustrumUsageReportState;
     reportFailure(attempt: ClaustrumScopedAttempt, status: number, source: ClaustrumReporterSource): Promise<void>;
     /**
      * Send on a vault route. `dispatch` builds and sends the request with the

package/dist/common-auth-embedded/claustrum/consumer.js

@@ -738,6 +738,42 @@ export class ClaustrumConsumer {
             combined.dispose();
         }
     }
+    /**
+     * Queue reply quota metadata without waiting or throwing. Pass rate-limit
+     * headers only, never tokens: the library does not filter header names.
+     * The credential must have been served by this host and still belong to the route.
+     */
+    reportUsage(input) {
+        if (this.#shutdown.signal.aborted)
+            return;
+        try {
+            const row = this.#roster?.rows.find((row) => row.routeId === input.routeId);
+            if (!row?.enabled ||
+                row.state !== 'active' ||
+                (row.credentialId !== input.credentialId &&
+                    !row.aliases?.includes(input.credentialId)))
+                return;
+            if (this.#hub) {
+                if (this.#lease && this.#hub.leaseLive(this.#lease))
+                    this.#lease.custody.reportUsage(input);
+            }
+            else
+                this.#custody?.reportUsage(input);
+        }
+        catch {
+            // Quota bookkeeping must never reject a provider request.
+        }
+    }
+    usageReportState() {
+        try {
+            return ((this.#hub
+                ? this.#lease?.custody
+                : this.#custody)?.usageReportState() ?? { pending: 0, inFlight: false, dropped: 0 });
+        }
+        catch {
+            return { pending: 0, inFlight: false, dropped: 0 };
+        }
+    }
     async reportFailure(attempt, status, source) {
         this.#assertOpen();
         if (this.#hub) {

package/dist/common-auth-embedded/claustrum/custody.d.ts

@@ -1,14 +1,15 @@
 import { type ClaustrumClient, type ClaustrumReporterSource, type EnrollmentTokenFile } from '@cortexkit/claustrum-client';
 import { type ClaustrumLogger } from './errors.js';
 import type { InsulaUsageTransport } from './insula.js';
+import { type ClaustrumUsageReading, type ClaustrumUsageReportState, type ScopedUsageSource } from './usage.js';
 import { type ScopedWatchSource, type WatchMode } from './watch.js';
 /**
- * `watchScoped` is present from claustrum-client 0.12.0. Hosts detect it at
- * run time and keep polling without it.
+ * claustrum-client adds watchScoped in 0.12.0 and reportUsageScoped in 0.14.0.
+ * Older clients keep polling and simply do not send reply quota readings.
  */
 export type ClaustrumScopedClient = Pick<ClaustrumClient, 'listScoped' | 'getScoped' | 'reportAuthFailureScoped' | 'close'> & {
     insula?: InsulaUsageTransport;
-} & ScopedWatchSource;
+} & ScopedWatchSource & ScopedUsageSource;
 /** The two credential types a plugin's family can hold; routing differs by type. */
 export type VaultCredentialType = 'oauth' | 'api_key';
 /**
@@ -332,7 +333,18 @@ export declare class ClaustrumScopedCustody {
      * other mode the host keeps its usual list timer.
      */
     watchRoster(options: ClaustrumRosterWatchOptions): ClaustrumRosterWatch;
+    /**
+     * Queue reply quota metadata and return synchronously. Pass rate-limit
+     * headers only, never tokens: the library does not filter header names.
+     * Only credentials served by this custody and retained in its roster report.
+     * Hosts managing their own roster must call retain() when that roster changes.
+     */
+    reportUsage(input: {
+        credentialId: string;
+        reading: ClaustrumUsageReading;
+    }): void;
+    usageReportState(): ClaustrumUsageReportState;
     close(): void;
-    /** Stop immediately; allow token reads 2 s and share an owner's timeout warning. */
+    /** Stop accepting work; give token reads and reply reports one shared 2 s drain. */
     dispose(onTimeout?: (pendingOperations: number) => void): Promise<void>;
 }

package/dist/common-auth-embedded/claustrum/custody.js

@@ -6,6 +6,7 @@ import { readClaustrumEnrollmentToken } from './enrollment.js';
 import { ClaustrumConsumerError } from './errors.js';
 import { CUSTODY_PLACEHOLDER_PREFIX } from './host-slot.js';
 import { drainShutdown, shutdownWarning } from './shutdown.js';
+import { ScopedUsageReporter, } from './usage.js';
 import { ScopedRosterWatch, } from './watch.js';
 /** Only a new version of the same account may replace an in-flight 401. */
 export function isScopedCredentialRotation(served, current) {
@@ -28,6 +29,14 @@ function scopedRetryReason(served, current) {
     return 'rotated';
 }
 const defaultLogger = createLogger('claustrum');
+function checkedEnrollmentToken(value) {
+    if (!/^[0-9a-f]{64}$/.test(value.token) ||
+        !Number.isSafeInteger(value.token_generation) ||
+        value.token_generation < 1) {
+        throw new ClaustrumConsumerError('invalid-token', 'Invalid Claustrum enrollment token');
+    }
+    return value.token;
+}
 // Opt-in diagnostics let tests retain wait phases without logging each vault read.
 const phaseDiagnostics = channel('common-auth.claustrum.phases');
 /**
@@ -183,6 +192,8 @@ export class ClaustrumScopedCustody {
     #reports = new WeakMap();
     #kept = new Map();
     #keptAttempts = new WeakMap();
+    #usage;
+    #usageServed = new Map();
     #setTimeout;
     #clearTimeout;
     #outage = false;
@@ -197,6 +208,7 @@ export class ClaustrumScopedCustody {
     #watches = new Set();
     #tokenReads = new Set();
     #warnShutdown;
+    #onDrainTimeout;
     #disposing;
     constructor(options) {
         const tokenPath = options.tokenPath;
@@ -218,6 +230,14 @@ export class ClaustrumScopedCustody {
         this.#warnShutdown = shutdownWarning(this.#logger);
         this.#setTimeout = options.setTimeoutImpl ?? setTimeout;
         this.#clearTimeout = options.clearTimeoutImpl ?? clearTimeout;
+        this.#usage = new ScopedUsageReporter({
+            client: this.#client,
+            owns: (id) => this.#usageServed.has(id),
+            token: async () => checkedEnrollmentToken(await this.#readToken()),
+            logger: this.#logger,
+            setTimeout: this.#setTimeout,
+            clearTimeout: this.#clearTimeout,
+        });
     }
     /** A watch losing its transport is the same outage as an unreachable read. */
     transportLost(error) {
@@ -303,12 +323,7 @@ export class ClaustrumScopedCustody {
                 });
         }
         this.#check(signal);
-        if (!/^[0-9a-f]{64}$/.test(value.token) ||
-            !Number.isSafeInteger(value.token_generation) ||
-            value.token_generation < 1) {
-            throw new ClaustrumConsumerError('invalid-token', 'Invalid Claustrum enrollment token');
-        }
-        return value.token;
+        return checkedEnrollmentToken(value);
     }
     async #call(operation, signal) {
         this.#check(signal);
@@ -370,6 +385,7 @@ export class ClaustrumScopedCustody {
         }
         catch (error) {
             this.#kept.clear();
+            this.#clearUsageOwnership();
             throw error;
         }
         if (phaseDiagnostics.hasSubscribers)
@@ -473,11 +489,19 @@ export class ClaustrumScopedCustody {
         else {
             this.reachable();
             this.#kept.clear();
+            this.#clearUsageOwnership();
         }
     }
     /** Discard bearer material when a route is removed, declined or rebound. */
     forget(credentialId) {
         this.#kept.delete(credentialId);
+        this.#usageServed.delete(credentialId);
+        this.#usage.forget(credentialId);
+    }
+    #clearUsageOwnership() {
+        for (const id of this.#usageServed.keys())
+            this.#usage.forget(id);
+        this.#usageServed.clear();
     }
     /** Apply an already-held roster; this never fetches credentials or writes it. */
     retain(identities) {
@@ -490,6 +514,14 @@ export class ClaustrumScopedCustody {
                 identity.accountIdentity !== kept.attempt.expectedAccountIdentity)
                 this.forget(id);
         }
+        for (const [id, served] of this.#usageServed) {
+            const identity = current.get(id);
+            if (!identity?.enabled ||
+                identity.state !== 'active' ||
+                identity.credentialType !== served.credentialType ||
+                identity.accountIdentity !== served.accountIdentity)
+                this.forget(id);
+        }
     }
     /** A frozen, non-secret summary for a plugin's status display. */
     keptReceiptState() {
@@ -527,6 +559,7 @@ export class ClaustrumScopedCustody {
         }
         catch (error) {
             this.#kept.clear();
+            this.#clearUsageOwnership();
             throw error;
         }
         if (this.#outage && kept) {
@@ -536,6 +569,7 @@ export class ClaustrumScopedCustody {
         try {
             const attempt = await this.#authorizeFresh({ credentialId, credentialType, accountIdentity }, token, signal);
             this.#kept.set(credentialId, { attempt, routeId, since: null });
+            this.#usageServed.set(credentialId, { ...identity });
             return attempt;
         }
         catch (error) {
@@ -750,6 +784,25 @@ export class ClaustrumScopedCustody {
             },
         };
     }
+    /**
+     * Queue reply quota metadata and return synchronously. Pass rate-limit
+     * headers only, never tokens: the library does not filter header names.
+     * Only credentials served by this custody and retained in its roster report.
+     * Hosts managing their own roster must call retain() when that roster changes.
+     */
+    reportUsage(input) {
+        if (this.#closed)
+            return;
+        try {
+            this.#usage.report(input.credentialId, input.reading);
+        }
+        catch {
+            // Quota bookkeeping must never reject a provider request.
+        }
+    }
+    usageReportState() {
+        return this.#usage.state();
+    }
     close() {
         if (this.#closed)
             return;
@@ -761,12 +814,24 @@ export class ClaustrumScopedCustody {
             watch.stop();
         this.#watches.clear();
         this.#kept.clear();
-        this.#client.close();
+        const usage = this.#usage.close();
+        if (usage) {
+            this.#tokenReads.add(usage);
+            void usage.then(() => this.#tokenReads.delete(usage));
+        }
+        else
+            this.#client.close();
+        this.#disposing = drainShutdown(this.#tokenReads, (count) => (this.#onDrainTimeout ?? this.#warnShutdown)(count)).finally(() => {
+            this.#usage.drop();
+            this.#usageServed.clear();
+            if (usage)
+                this.#client.close();
+        });
     }
-    /** Stop immediately; allow token reads 2 s and share an owner's timeout warning. */
+    /** Stop accepting work; give token reads and reply reports one shared 2 s drain. */
     async dispose(onTimeout = this.#warnShutdown) {
+        this.#onDrainTimeout = onTimeout;
         this.close();
-        this.#disposing ??= drainShutdown(this.#tokenReads, onTimeout);
         await this.#disposing;
     }
 }

package/dist/common-auth-embedded/claustrum/hub.d.ts

@@ -107,11 +107,12 @@ export interface ClaustrumHubMemberOptions<_Q = QuotaObservation> {
     logger?: ClaustrumLogger;
 }
 /** What a lease may do with the shared custody. */
-export type ClaustrumLeasedCustody = Pick<ClaustrumScopedCustody, 'authorize' | 'reportFailure' | 'forget' | 'keptReceiptState'>;
+export type ClaustrumLeasedCustody = Pick<ClaustrumScopedCustody, 'authorize' | 'reportFailure' | 'reportUsage' | 'usageReportState' | 'forget' | 'keptReceiptState'>;
 /**
  * One acquisition of the hub's shared custody. `custody` throws `closed`
  * after `release()`, and once the connection it belongs to ended for any
- * reason, vault mode going off included. `release()` is idempotent.
+ * reason, vault mode going off included. Best-effort `reportUsage` instead
+ * ignores reports through an ended lease. `release()` is idempotent.
  */
 export interface CustodyLease {
     readonly custody: ClaustrumLeasedCustody;

package/dist/common-auth-embedded/claustrum/hub.js

@@ -523,6 +523,14 @@ export class ClaustrumDiscoveryHub {
                 check();
                 return custody.reportFailure(attempt, status, source);
             },
+            reportUsage: (input) => {
+                if (!state.released && !generation.ended)
+                    custody.reportUsage(input);
+            },
+            usageReportState: () => {
+                check();
+                return custody.usageReportState();
+            },
             forget: (credentialId) => {
                 check();
                 custody.forget(credentialId);

package/dist/common-auth-embedded/claustrum/index.d.ts

@@ -12,6 +12,7 @@ export { acquireInsulaQuotaSource, type InsulaQuotaContext, type InsulaQuotaLook
 export { acceptAccount, type DeclinedAccount, declineAccount, isDeclined, } from './interlock.js';
 export { drainVaultQuota } from './quota-writer.js';
 export { type AccountMapper, acceptVaultRoute, DEFAULT_ROUTE_PREFIX, declineVaultRoute, type MutateVaultRosterOptions, mutateVaultRoster, type ProjectionOptions, projectVaultRoster, type QuotaReceipt, type ReorderVaultRosterOptions, type ReorderVaultRosterResult, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, reorderVaultRoster, resolveVaultPrimary, type VaultPrimary, type VaultPrimaryBinding, type VaultPrimaryUnavailableReason, type VaultRosterFile, type VaultRosterLockContext, type VaultRosterRow, type VaultRosterSeed, vaultRosterSeed, vaultRoutingRows, } from './roster.js';
+export type { ClaustrumUsageReading, ClaustrumUsageReportState, } from './usage.js';
 export { type ChangeNotice, ChangeNoticeReader, RESUBSCRIBE_BACKOFF_MS, SAFETY_POLL_MS, ScopedRosterWatch, type ScopedRosterWatchOptions, type ScopedWatchEnd, type ScopedWatchHandle, type ScopedWatchNoticeShape, type ScopedWatchSource, WATCH_RETRY_MS, type WatchMode, } from './watch.js';
 /** How long `connectClaustrumScopedClient` waits by default. */
 export declare const SCOPED_CONNECT_TIMEOUT_MS = 10000;

package/dist/common-auth-embedded/claustrum/roster.d.ts

@@ -48,6 +48,8 @@ export interface VaultRosterFile {
     complete: boolean;
     /** The unusable records of an incomplete reply: a safe id and a fixed reason. */
     rejected?: SkippedVaultRecord[];
+    /** Opaque limits data; roster-only writers preserve even newer schemas. */
+    limits?: unknown;
     rows: VaultRosterRow[];
     declined: DeclinedAccount[];
 }

package/dist/common-auth-embedded/claustrum/roster.js

@@ -209,6 +209,7 @@ export function projectVaultRoster(previous, inventory, options = {}) {
     return {
         version: 1,
         view: inventory.view,
+        ...(previous?.limits !== undefined && { limits: previous.limits }),
         complete,
         ...(!complete && {
             rejected: inventory.skipped.map((record) => ({
@@ -319,6 +320,7 @@ function decodeRoster(value) {
         // that was used whole, so it reads as complete.
         complete: value.complete !== false,
         ...(rejected && { rejected }),
+        ...(value.limits !== undefined && { limits: value.limits }),
         rows,
         declined,
     };

package/dist/common-auth-embedded/claustrum/usage.d.ts

@@ -0,0 +1,41 @@
+import type { ClaustrumLogger } from './errors.js';
+/** Reply quota metadata, never authorization headers or bearer material. */
+export interface ClaustrumUsageReading {
+    provider: string;
+    observedAtMs: number;
+    headers?: Record<string, string>;
+    frame?: unknown;
+    account?: string;
+}
+/** Structural to also typecheck with the claustrum-client 0.6.2 peer minimum. */
+export interface ScopedUsageSource {
+    reportUsageScoped?(input: {
+        credentialId: string;
+        reading: Record<string, unknown>;
+        enrollmentToken?: string;
+    }): Promise<void>;
+}
+export interface ClaustrumUsageReportState {
+    readonly pending: number;
+    readonly inFlight: boolean;
+    readonly dropped: number;
+}
+/** One queue per custody connection, shared by every hub member on it. */
+export declare class ScopedUsageReporter {
+    #private;
+    private readonly options;
+    constructor(options: {
+        client: ScopedUsageSource;
+        owns: (credentialId: string) => boolean;
+        token: () => Promise<string>;
+        logger: ClaustrumLogger;
+        setTimeout: typeof setTimeout;
+        clearTimeout: typeof clearTimeout;
+    });
+    state(): ClaustrumUsageReportState;
+    report(credentialId: string, reading: ClaustrumUsageReading): void;
+    forget(credentialId: string): void;
+    /** Start the final flush; the custody's existing shutdown drain bounds it. */
+    close(): Promise<void> | undefined;
+    drop(): void;
+}

package/dist/common-auth-embedded/claustrum/usage.js

@@ -0,0 +1,145 @@
+import { ClaustrumCredentialError } from '@cortexkit/claustrum-client';
+function plain(value) {
+    return (value !== null &&
+        typeof value === 'object' &&
+        (Object.getPrototypeOf(value) === Object.prototype ||
+            Object.getPrototypeOf(value) === null));
+}
+/** One queue per custody connection, shared by every hub member on it. */
+export class ScopedUsageReporter {
+    options;
+    #queue = new Map();
+    #latest = new Map();
+    #errors = new Set();
+    #timer;
+    #running;
+    #closing = false;
+    #stopped = false;
+    #dropped = 0;
+    constructor(options) {
+        this.options = options;
+    }
+    state() {
+        return {
+            pending: this.#queue.size,
+            inFlight: this.#running !== undefined,
+            dropped: this.#dropped,
+        };
+    }
+    report(credentialId, reading) {
+        if (this.#closing || !this.options.client.reportUsageScoped)
+            return;
+        try {
+            if (!this.options.owns(credentialId)) {
+                this.#dropped++;
+                return;
+            }
+            if (!plain(reading) || 'credentialId' in reading || 'vouched' in reading)
+                throw new Error('invalid reading');
+            const json = JSON.stringify(reading);
+            if (Buffer.byteLength(json, 'utf8') > 15_360)
+                throw new Error('oversized reading');
+            // Snapshot now: a caller mutating its reply metadata later cannot change
+            // an already validated queued reading, including its ordering timestamp.
+            const copy = JSON.parse(json);
+            if (!plain(copy) ||
+                'credentialId' in copy ||
+                'vouched' in copy ||
+                typeof copy.observedAtMs !== 'number' ||
+                !Number.isFinite(copy.observedAtMs))
+                throw new Error('invalid reading');
+            if (copy.observedAtMs <= (this.#latest.get(credentialId) ?? -Infinity)) {
+                this.#dropped++;
+                return;
+            }
+            if (this.#queue.has(credentialId))
+                this.#dropped++;
+            this.#latest.set(credentialId, copy.observedAtMs);
+            this.#queue.set(credentialId, copy);
+            if (!this.#timer && !this.#running) {
+                this.#timer = this.options.setTimeout(() => {
+                    this.#timer = undefined;
+                    this.#flush();
+                }, 1_000);
+                this.#timer.unref?.();
+            }
+        }
+        catch {
+            this.#dropped++;
+        }
+    }
+    forget(credentialId) {
+        if (this.#queue.delete(credentialId))
+            this.#dropped++;
+        this.#latest.delete(credentialId);
+    }
+    #flush() {
+        if (this.#running || !this.#queue.size || this.#stopped)
+            return this.#running;
+        // Start on a microtask even during close, so all failures stay off the
+        // provider request path and only one send can be in flight on this client.
+        const running = Promise.resolve().then(async () => {
+            while (!this.#stopped && this.#queue.size) {
+                const entry = this.#queue.entries().next().value;
+                if (!entry)
+                    break;
+                const [credentialId, reading] = entry;
+                this.#queue.delete(credentialId);
+                try {
+                    const enrollmentToken = await this.options.token();
+                    if (this.#stopped || !this.options.owns(credentialId)) {
+                        if (!this.#stopped)
+                            this.#dropped++;
+                        continue;
+                    }
+                    await this.options.client.reportUsageScoped?.({
+                        credentialId,
+                        reading,
+                        enrollmentToken,
+                    });
+                }
+                catch (error) {
+                    if (!this.#stopped)
+                        this.#dropped++;
+                    this.#log(error);
+                }
+            }
+        });
+        this.#running = running;
+        void running.finally(() => {
+            this.#running = undefined;
+        });
+        return running;
+    }
+    #log(error) {
+        // Only codes from credential refusals are exposed. Transport messages,
+        // arbitrary thrown objects and reply contents can contain secrets.
+        let code = 'transport_error';
+        try {
+            if (error instanceof ClaustrumCredentialError)
+                code = /^[a-z][a-z0-9_]{0,63}$/.test(error.code) ? error.code : code;
+            if (this.#errors.has(code))
+                return;
+            this.#errors.add(code);
+            this.options.logger.debug('claustrum usage report dropped', { code });
+        }
+        catch {
+            // A caller's logger must not turn best-effort reporting into a rejection.
+        }
+    }
+    /** Start the final flush; the custody's existing shutdown drain bounds it. */
+    close() {
+        this.#closing = true;
+        if (this.#timer)
+            this.options.clearTimeout(this.#timer);
+        this.#timer = undefined;
+        return this.#flush();
+    }
+    drop() {
+        this.#stopped = true;
+        this.#dropped += this.#queue.size + (this.#running ? 1 : 0);
+        this.#running = undefined;
+        this.#queue.clear();
+        this.#latest.clear();
+    }
+}

package/dist/common-auth-embedded/commands/builtins.d.ts

@@ -41,6 +41,11 @@ export interface QuotaSectionOptions {
     check?(ids: readonly string[], invocation: CommandInvocation): Promise<void>;
 }
 export interface RoutingSectionOptions {
+    /**
+     * Show how long the plugin may wait for the current account's limit to
+     * reset before switching. Opt in only when the plugin supports that policy.
+     */
+    sameAccountWait?: boolean;
     /**
      * Further `routing.mode` values the plugin routes as `ordered` with the
      * former main row moved (`main-first`, `fallback-first`), offered between

package/dist/common-auth-embedded/commands/builtins.js

@@ -468,6 +468,44 @@ function routingSection(options, snap) {
                     : `Order set to ${result.ids.map(nameOf).join(', ')}.`;
             },
         });
+    if (options.routing?.sameAccountWait) {
+        const waitLabel = 'Longest wait on the same account';
+        const waitChoices = [
+            { value: '0', label: "Don't wait" },
+            { value: '15', label: '15 minutes' },
+            { value: 'max', label: 'Until the cache expires' },
+        ];
+        const rawWait = record(snap.settings.routing).maxSameAccountWait;
+        const wait = String(rawWait === 0 || rawWait === 'max' ? rawWait : 15);
+        const waitName = (value) => waitChoices.find((choice) => choice.value === value)?.label ?? value;
+        lines.push(`${waitLabel}: ${waitName(wait)}`);
+        actions.push({
+            id: 'maxSameAccountWait',
+            label: waitLabel,
+            group: ACTIONS_GROUP,
+            knobs: [
+                {
+                    kind: 'choice',
+                    id: 'maxSameAccountWait',
+                    label: waitLabel,
+                    choices: waitChoices,
+                    value: wait,
+                },
+            ],
+            run: async ({ values }) => {
+                const value = String(values.maxSameAccountWait);
+                const maxSameAccountWait = value === 'max' ? 'max' : Number(value);
+                await store.updateSettings((settings) => {
+                    settings.routing = {
+                        ...record(settings.routing),
+                        maxSameAccountWait,
+                    };
+                    return undefined;
+                }, locks);
+                return `${waitLabel} set to ${waitName(value)}.`;
+            },
+        });
+    }
     return {
         id: 'routing',
         slot: 'routing',

package/dist/common-auth-embedded/fs/private-files.d.ts

@@ -21,6 +21,11 @@ export declare class PrivateFileError extends Error {
     orphanPath?: string;
     constructor(path: string, stage: string, cause: unknown);
 }
+/** Native sharing and delete-pending errors reveal neither ownership nor expiry. */
+export declare function isWindowsSharingViolation(error: unknown): error is PrivateFileError & {
+    reason: 'io-error';
+    win32Code: 32 | 303;
+};
 export declare function privateOperation<T>(path: string, stage: string, operation: () => Promise<T>): Promise<T>;
 /** Tests only: policy options used by safe-parent checks that pass none. */
 export declare function setSafeParentOptionsForTest(options?: PosixOwnerOnlyPathAsyncOptions): void;

package/dist/common-auth-embedded/fs/private-files.js

@@ -93,6 +93,13 @@ export class PrivateFileError extends Error {
         this.reason = detail?.reason;
     }
 }
+/** Native sharing and delete-pending errors reveal neither ownership nor expiry. */
+export function isWindowsSharingViolation(error) {
+    return (windowsPrivateFiles &&
+        error instanceof PrivateFileError &&
+        error.reason === 'io-error' &&
+        (error.win32Code === 32 || error.win32Code === 303));
+}
 export async function privateOperation(path, stage, operation) {
     try {
         return await operation();