@cortexkit/antigravity-auth-core 3.0.38 → 3.0.39

package/dist/common-auth-embedded/claustrum/availability.d.ts

@@ -85,6 +85,12 @@ export declare const VAULT_FAILURE_CLASSES: Readonly<{
  * kind stays `unavailable` for callers handling ClaustrumConsumerError.
  */
 export declare class ClaustrumUnreachableError extends ClaustrumConsumerError {
-    constructor();
+    /**
+     * Non-secret host connection diagnostic. A missing accessor can recover
+     * once the host bridge installs; a failed accessor could not provide a client.
+     * Other unreachable failures leave this unset. Never use adapter error text.
+     */
+    readonly reason?: 'host-accessor-missing' | 'host-accessor-failed';
+    constructor(reason?: ClaustrumUnreachableError['reason']);
 }
 export declare function classifyVaultFailure(error: unknown): VaultFailureClass;

package/dist/common-auth-embedded/claustrum/availability.js

@@ -87,9 +87,17 @@ export const VAULT_FAILURE_CLASSES = Object.freeze({
  * kind stays `unavailable` for callers handling ClaustrumConsumerError.
  */
 export class ClaustrumUnreachableError extends ClaustrumConsumerError {
-    constructor() {
+    /**
+     * Non-secret host connection diagnostic. A missing accessor can recover
+     * once the host bridge installs; a failed accessor could not provide a client.
+     * Other unreachable failures leave this unset. Never use adapter error text.
+     */
+    reason;
+    constructor(reason) {
         super('unavailable', 'Claustrum scoped operation unavailable');
         this.name = 'ClaustrumUnreachableError';
+        if (reason === 'host-accessor-missing' || reason === 'host-accessor-failed')
+            this.reason = reason;
     }
 }
 export function classifyVaultFailure(error) {

package/dist/common-auth-embedded/claustrum/custody.d.ts

@@ -279,6 +279,15 @@ export declare class ClaustrumScopedCustody {
         setTimeoutImpl?: typeof setTimeout;
         clearTimeoutImpl?: typeof clearTimeout;
     });
+    /**
+     * Replace the connection to the same vault without discarding receipts or
+     * their enrollment tokens. Open roster watches restart on the new client;
+     * their existing handles remain usable. Passing the current client does nothing.
+     * Neither client is closed here: the caller closes the old one, and custody's
+     * close()/dispose() still closes the client it holds at shutdown.
+     * While hosted, next must come from connectVaultHost, as in the constructor.
+     */
+    replaceClient(next: ClaustrumScopedClient): void;
     /** A watch losing its transport is the same outage as an unreachable read. */
     transportLost(error?: unknown): void;
     /** Any vault answer ends transport fallback, even when it refuses access. */
@@ -312,8 +321,8 @@ export declare class ClaustrumScopedCustody {
      * Report that a send this consumer actually made was rejected. Only a 401
      * is reported (the vault refuses 429, 402 and 5xx reports), addressed by
      * credential id with the exact record version that send was served, and
-     * sent through the client and enrollment token that authorized it. A receipt
-     * this custody did not issue is refused rather than reported.
+     * sent through the current client with the enrollment token that authorized
+     * it. A receipt this custody did not issue is refused rather than reported.
      */
     reportFailure(attempt: ClaustrumScopedAttempt, status: number, reporterSource: ClaustrumReporterSource): Promise<void>;
     /**

package/dist/common-auth-embedded/claustrum/custody.js

@@ -238,8 +238,15 @@ export class ClaustrumScopedCustody {
         this.#warnShutdown = shutdownWarning(this.#logger);
         this.#setTimeout = options.setTimeoutImpl ?? setTimeout;
         this.#clearTimeout = options.clearTimeoutImpl ?? clearTimeout;
+        const currentClient = () => this.#client;
         this.#usage = new ScopedUsageReporter({
-            client: this.#client,
+            client: {
+                // Queued readings follow a replacement without losing client capability checks.
+                get reportUsageScoped() {
+                    const client = currentClient();
+                    return client.reportUsageScoped?.bind(client);
+                },
+            },
             owns: (id) => this.#usageServed.has(id),
             token: async () => hasVaultHost() ? '' : checkedEnrollmentToken(await this.#readToken()),
             logger: this.#logger,
@@ -247,6 +254,24 @@ export class ClaustrumScopedCustody {
             clearTimeout: this.#clearTimeout,
         });
     }
+    /**
+     * Replace the connection to the same vault without discarding receipts or
+     * their enrollment tokens. Open roster watches restart on the new client;
+     * their existing handles remain usable. Passing the current client does nothing.
+     * Neither client is closed here: the caller closes the old one, and custody's
+     * close()/dispose() still closes the client it holds at shutdown.
+     * While hosted, next must come from connectVaultHost, as in the constructor.
+     */
+    replaceClient(next) {
+        this.#check();
+        if (next === this.#client)
+            return;
+        if (hasVaultHost() && !isVaultHostClient(next))
+            throw new ClaustrumUnreachableError();
+        this.#client = next;
+        for (const watch of this.#watches)
+            watch.restart();
+    }
     /** A watch losing its transport is the same outage as an unreachable read. */
     transportLost(error) {
         if (this.#closed || this.#outage)
@@ -255,7 +280,9 @@ export class ClaustrumScopedCustody {
         this.#outageError =
             error instanceof ClaustrumCredentialError
                 ? error
-                : new ClaustrumUnreachableError();
+                : new ClaustrumUnreachableError(error instanceof ClaustrumUnreachableError
+                    ? error.reason
+                    : undefined);
         this.#logger.warn('serving kept vault receipt', { reason: 'unreachable' });
         this.#scheduleProbe();
     }
@@ -367,7 +394,7 @@ export class ClaustrumScopedCustody {
             if (error instanceof ClaustrumCredentialError)
                 throw error;
             if (classifyVaultFailure(error) === 'unreachable')
-                throw new ClaustrumUnreachableError();
+                throw new ClaustrumUnreachableError(error instanceof ClaustrumUnreachableError ? error.reason : undefined);
             throw new ClaustrumConsumerError('unavailable', 'Claustrum scoped operation unavailable');
         }
         finally {
@@ -603,7 +630,7 @@ export class ClaustrumScopedCustody {
         if (kept.since === null)
             kept.since = this.#now();
         const attempt = Object.freeze(Object.defineProperty({ ...kept.attempt, fromKeptReceipt: true }, 'accessToken', { value: kept.attempt.accessToken, enumerable: false }));
-        this.#provenance.set(attempt, this.#provenance.get(kept.attempt) ?? { token, client: this.#client });
+        this.#provenance.set(attempt, this.#provenance.get(kept.attempt) ?? { token });
         this.#keptAttempts.set(attempt, routeId);
         return attempt;
     }
@@ -684,15 +711,15 @@ export class ClaustrumScopedCustody {
             recordVersion: served.recordVersion,
             expiresAtMs,
         }, 'accessToken', { value: accessToken, enumerable: false }));
-        this.#provenance.set(attempt, { token, client: this.#client });
+        this.#provenance.set(attempt, { token });
         return attempt;
     }
     /**
      * Report that a send this consumer actually made was rejected. Only a 401
      * is reported (the vault refuses 429, 402 and 5xx reports), addressed by
      * credential id with the exact record version that send was served, and
-     * sent through the client and enrollment token that authorized it. A receipt
-     * this custody did not issue is refused rather than reported.
+     * sent through the current client with the enrollment token that authorized
+     * it. A receipt this custody did not issue is refused rather than reported.
      */
     async reportFailure(attempt, status, reporterSource) {
         if (status !== 401)
@@ -719,7 +746,7 @@ export class ClaustrumScopedCustody {
         const pending = this.#reports.get(attempt);
         if (pending)
             return pending;
-        const report = this.#call(() => provenance.client.reportAuthFailureScoped({
+        const report = this.#call(() => this.#client.reportAuthFailureScoped({
             credentialId: attempt.credentialId,
             enrollmentToken: provenance.token,
             providerStatus: 401,
@@ -761,36 +788,67 @@ export class ClaustrumScopedCustody {
      */
     watchRoster(options) {
         this.#check();
-        const watch = new ScopedRosterWatch({
-            client: this.#client,
-            enrollmentToken: () => this.#token(),
-            view: options.view ?? (() => this.#discoveredView),
-            discover: async (view) => {
-                await options.onView(view);
-            },
-            onRefused: (error) => {
-                // Apply a refused watch as discover() applies a refused account
-                // listing: every kept receipt is dropped.
-                this.listFailed(error);
-                options.onRefused?.(error);
+        const currentView = options.view ?? (() => this.#discoveredView);
+        let discovering;
+        let watch;
+        const create = (resubscribed = false) => {
+            const opened = new ScopedRosterWatch({
+                client: this.#client,
+                enrollmentToken: () => this.#token(),
+                // Nothing observed the gap between clients, even if the view is unchanged.
+                view: () => (resubscribed ? undefined : currentView()),
+                discover: async (view) => {
+                    // An old watch's discovery may still be committing the host's roster.
+                    while (discovering)
+                        await discovering.catch(() => { });
+                    if (watch !== opened)
+                        return;
+                    resubscribed = false;
+                    discovering = Promise.resolve().then(() => options.onView(view));
+                    try {
+                        await discovering;
+                    }
+                    finally {
+                        discovering = undefined;
+                    }
+                },
+                onRefused: (error) => {
+                    // Apply a refused watch as discover() applies a refused account
+                    // listing: every kept receipt is dropped.
+                    this.listFailed(error);
+                    options.onRefused?.(error);
+                },
+                onTransportLost: () => this.transportLost(),
+                onReachable: () => this.reachable(),
+                onError: options.onError,
+                onMode: options.onMode,
+                logger: this.#logger,
+                now: this.#now,
+                setTimeoutImpl: this.#setTimeout,
+                clearTimeoutImpl: this.#clearTimeout,
+            });
+            return opened;
+        };
+        watch = create();
+        const tracked = {
+            restart: () => {
+                const previousMode = watch.mode;
+                watch.stop();
+                watch = create(true);
+                if (previousMode !== watch.mode)
+                    options.onMode?.(watch.mode);
+                watch.start();
             },
-            onTransportLost: () => this.transportLost(),
-            onReachable: () => this.reachable(),
-            onError: options.onError,
-            onMode: options.onMode,
-            logger: this.#logger,
-            now: this.#now,
-            setTimeoutImpl: this.#setTimeout,
-            clearTimeoutImpl: this.#clearTimeout,
-        });
-        this.#watches.add(watch);
+            stop: () => watch.stop(),
+        };
+        this.#watches.add(tracked);
         watch.start();
         return {
             get mode() {
                 return watch.mode;
             },
             close: () => {
-                this.#watches.delete(watch);
+                this.#watches.delete(tracked);
                 watch.stop();
             },
         };

package/dist/common-auth-embedded/claustrum/enrollment.d.ts

@@ -29,10 +29,13 @@ export declare function classifyEnrollmentError(error: unknown): {
  * Each host enrolls separately so the operator can revoke one without the other.
  */
 export declare function enrollmentName(plugin: string, host: string): string;
+/** Match the vault's plain-text, code-point limit before proposing a display name. */
+export declare function validEnrollmentDisplayName(displayName: string): boolean;
 export interface ClaustrumEnrollmentClient {
     enrollPropose(input: {
         name: string;
         requestSecretHash: string;
+        displayName?: string;
     }): Promise<{
         requestId: string;
     }>;
@@ -142,6 +145,7 @@ export declare class ClaustrumEnrollmentManager {
         client: ClaustrumEnrollmentClient;
         paths: ClaustrumEnrollmentPaths;
         proposedName: string;
+        displayName?: string;
         now?: () => number;
         mintSecret?: () => string;
         writeTokenFile?: typeof writeEnrollmentTokenFile;

package/dist/common-auth-embedded/claustrum/enrollment.js

@@ -68,6 +68,13 @@ export function enrollmentName(plugin, host) {
         throw new ClaustrumConsumerError('invalid-state', 'Claustrum enrollment names use lowercase letters, digits and dashes');
     return `${plugin}-${host}`;
 }
+/** Match the vault's plain-text, code-point limit before proposing a display name. */
+export function validEnrollmentDisplayName(displayName) {
+    const length = Array.from(displayName).length;
+    return (length >= 1 &&
+        length <= 40 &&
+        !/[\p{Cc}\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069\u200b-\u200d\u2060\ufeff]/u.test(displayName));
+}
 /**
  * Connect the enrollment ceremony. Setup calls this; the request path never
  * does. `connectionFile` is required because this library reads no
@@ -559,15 +566,20 @@ export class ClaustrumEnrollmentManager {
     #client;
     #paths;
     #proposedName;
+    #displayName;
     #now;
     #mintSecret;
     #writeTokenFile;
     #ancestorOptions;
     constructor(options) {
+        if (options.displayName !== undefined &&
+            !validEnrollmentDisplayName(options.displayName))
+            throw new ClaustrumConsumerError('invalid-state', 'invalid Claustrum enrollment display name');
         this.#ancestorOptions = options.ancestorOptions ?? {};
         this.#client = options.client;
         this.#paths = options.paths;
         this.#proposedName = options.proposedName;
+        this.#displayName = options.displayName;
         this.#now = options.now ?? Date.now;
         this.#mintSecret =
             options.mintSecret ?? (() => randomBytes(32).toString('hex'));
@@ -665,10 +677,29 @@ export class ClaustrumEnrollmentManager {
                     const requestSecretHash = createHash('sha256')
                         .update(Buffer.from(state.requestSecret, 'hex'))
                         .digest('hex');
-                    const proposed = await this.#client.enrollPropose({
+                    const proposal = {
                         name: state.proposedName,
                         requestSecretHash,
-                    });
+                    };
+                    let proposed;
+                    try {
+                        proposed = await this.#client.enrollPropose({
+                            ...proposal,
+                            ...(this.#displayName !== undefined && {
+                                displayName: this.#displayName,
+                            }),
+                        });
+                    }
+                    catch (error) {
+                        if (this.#displayName === undefined ||
+                            !(error instanceof ClaustrumCredentialError) ||
+                            error.code !== 'invalid_params')
+                            throw error;
+                        // Locally validated names can only be refused by vaults that do
+                        // not support displayName. A refused proposal stores nothing, so
+                        // retry once with the same hash and let normal handling decide.
+                        proposed = await this.#client.enrollPropose(proposal);
+                    }
                     state = {
                         ...state,
                         requestId: proposed.requestId,

package/dist/common-auth-embedded/claustrum/host.js

@@ -29,7 +29,10 @@ function hostError(error) {
         (typeof value.code === 'string' &&
             classifyVaultFailure(Object.assign(new Error(), { code: value.code })) ===
                 'unreachable'))
-        return new ClaustrumUnreachableError();
+        return new ClaustrumUnreachableError(value.reason === 'host-accessor-missing' ||
+            value.reason === 'host-accessor-failed'
+            ? value.reason
+            : undefined);
     return error;
 }
 function call(operation) {
@@ -101,13 +104,14 @@ export function connectVaultHost(pluginId) {
         throw new ClaustrumUnreachableError();
     try {
         const accessor = globalThis[Symbol.for('cortexkit.vault')];
-        if (typeof accessor !== 'function')
-            throw new ClaustrumUnreachableError();
-        const client = wrapHostClient(accessor(pluginId));
-        hostClients.add(client);
-        return client;
+        if (typeof accessor === 'function') {
+            const client = wrapHostClient(accessor(pluginId));
+            hostClients.add(client);
+            return client;
+        }
     }
     catch {
-        throw new ClaustrumUnreachableError();
+        throw new ClaustrumUnreachableError('host-accessor-failed');
     }
+    throw new ClaustrumUnreachableError('host-accessor-missing');
 }

package/dist/common-auth-embedded/claustrum/index.d.ts

@@ -4,7 +4,7 @@ export { ClaustrumCredentialError, type ClaustrumReporterSource, type Enrollment
 export { ClaustrumUnreachableError, classifyVaultFailure, VAULT_FAILURE_CLASSES, type VaultFailureClass, } from './availability.js';
 export { ClaustrumConsumer, type ClaustrumConsumerOptions, type ClaustrumWatchState, DEFAULT_CONNECT_TIMEOUT_MS, type SendOptions, } from './consumer.js';
 export { type AccountIdentitySource, type ClassifyingClaustrumFamily, type ClaustrumFamily, type ClaustrumFamilyInput, type ClaustrumRosterWatch, type ClaustrumRosterWatchOptions, type ClaustrumScopedAttempt, type ClaustrumScopedClient, ClaustrumScopedCustody, type ClaustrumScopedIdentity, decideScopedRetryAfter401, type IdentityParser, isScopedCredentialRotation, KEPT_RECEIPT_MARGIN_MS, type KeptReceiptState, type ScopedRetryReason, SERVING_MARGIN_MS, type SkippedVaultReason, type SkippedVaultRecord, type VaultCredential, type VaultCredentialType, type VaultGrantReach, type VaultGrantTuple, type VaultInventory, type VaultRowFacts, } from './custody.js';
-export { type ClaustrumEnrollmentClient, type ClaustrumEnrollmentConnection, type ClaustrumEnrollmentDisconnectResult, ClaustrumEnrollmentManager, type ClaustrumEnrollmentPaths, type ClaustrumEnrollmentResetResult, type ClaustrumEnrollmentStatus, classifyEnrollmentError, connectClaustrumEnrollmentClient, disconnectClaustrumEnrollment, type EnrollmentDisposition, enrollmentAuthority, enrollmentName, getClaustrumEnrollmentPaths, hostEnrollmentPaths, RETRYABLE_ENROLLMENT_CODES, readClaustrumEnrollmentStatus, readClaustrumEnrollmentToken, resetClaustrumEnrollmentState, TERMINAL_ENROLLMENT_CODES, vaultAuthority, } from './enrollment.js';
+export { type ClaustrumEnrollmentClient, type ClaustrumEnrollmentConnection, type ClaustrumEnrollmentDisconnectResult, ClaustrumEnrollmentManager, type ClaustrumEnrollmentPaths, type ClaustrumEnrollmentResetResult, type ClaustrumEnrollmentStatus, classifyEnrollmentError, connectClaustrumEnrollmentClient, disconnectClaustrumEnrollment, type EnrollmentDisposition, enrollmentAuthority, enrollmentName, getClaustrumEnrollmentPaths, hostEnrollmentPaths, RETRYABLE_ENROLLMENT_CODES, readClaustrumEnrollmentStatus, readClaustrumEnrollmentToken, resetClaustrumEnrollmentState, TERMINAL_ENROLLMENT_CODES, validEnrollmentDisplayName, vaultAuthority, } from './enrollment.js';
 export { ClaustrumConsumerError, type ClaustrumConsumerFailureKind, type ClaustrumLogger, } from './errors.js';
 export { connectVaultHost, hasVaultHost, VAULT_HOST_CONNECT_REFUSAL, VAULT_HOST_STATUS, } from './host.js';
 export { assertHostSlotMatchesMode, assertNotCustodyPlaceholder, CUSTODY_PLACEHOLDER_PREFIX, classifyHostSlot, custodyPlaceholder, custodyPlaceholderKey, type HostSlotContent, isCustodyPlaceholder, isCustodyPlaceholderValue, } from './host-slot.js';

package/dist/common-auth-embedded/claustrum/index.js

@@ -10,7 +10,7 @@ export { ClaustrumCredentialError, } from '@cortexkit/claustrum-client';
 export { ClaustrumUnreachableError, classifyVaultFailure, VAULT_FAILURE_CLASSES, } from './availability.js';
 export { ClaustrumConsumer, DEFAULT_CONNECT_TIMEOUT_MS, } from './consumer.js';
 export { ClaustrumScopedCustody, decideScopedRetryAfter401, isScopedCredentialRotation, KEPT_RECEIPT_MARGIN_MS, SERVING_MARGIN_MS, } from './custody.js';
-export { ClaustrumEnrollmentManager, classifyEnrollmentError, connectClaustrumEnrollmentClient, disconnectClaustrumEnrollment, enrollmentAuthority, enrollmentName, getClaustrumEnrollmentPaths, hostEnrollmentPaths, RETRYABLE_ENROLLMENT_CODES, readClaustrumEnrollmentStatus, readClaustrumEnrollmentToken, resetClaustrumEnrollmentState, TERMINAL_ENROLLMENT_CODES, vaultAuthority, } from './enrollment.js';
+export { ClaustrumEnrollmentManager, classifyEnrollmentError, connectClaustrumEnrollmentClient, disconnectClaustrumEnrollment, enrollmentAuthority, enrollmentName, getClaustrumEnrollmentPaths, hostEnrollmentPaths, RETRYABLE_ENROLLMENT_CODES, readClaustrumEnrollmentStatus, readClaustrumEnrollmentToken, resetClaustrumEnrollmentState, TERMINAL_ENROLLMENT_CODES, validEnrollmentDisplayName, vaultAuthority, } from './enrollment.js';
 export { ClaustrumConsumerError, } from './errors.js';
 export { connectVaultHost, hasVaultHost, VAULT_HOST_CONNECT_REFUSAL, VAULT_HOST_STATUS, } from './host.js';
 export { assertHostSlotMatchesMode, assertNotCustodyPlaceholder, CUSTODY_PLACEHOLDER_PREFIX, classifyHostSlot, custodyPlaceholder, custodyPlaceholderKey, isCustodyPlaceholder, isCustodyPlaceholderValue, } from './host-slot.js';

package/dist/common-auth-embedded/fs/lock-record.js

@@ -0,0 +1,55 @@
+import { resolve } from 'node:path';
+import { PrivateFileError } from './private-files.js';
+/** A failed open is not evidence of deletion until the same path disappears. */
+export class DisappearedLockRecordError extends Error {
+    path;
+    code = 'ENOENT';
+    constructor(path, cause) {
+        super(`Lock record disappeared: ${path}`, { cause });
+        this.path = path;
+    }
+}
+export function isWindowsAccessDeniedRead(error, paths) {
+    return (error instanceof PrivateFileError &&
+        error.reason === 'io-error' &&
+        error.win32Code === 5 &&
+        (error.stage === 'read' || error.stage === 'verify') &&
+        paths.some((path) => resolve(path) === error.path));
+}
+/**
+ * An exclusive create at the lock or eviction-directory name can fail with
+ * ACCESS_DENIED (5) while a holder's delete of that name is still pending. No
+ * reread settles a create refusal, so callers retry only under their existing
+ * bound and never infer staleness from it. owner.json is deliberately not a
+ * candidate: a marker directory created exclusively a moment ago cannot hold a
+ * delete-pending old owner.json, so a 5 there is a real refusal and the caller
+ * removes the directory it just created.
+ */
+export function isWindowsAccessDeniedCreate(error, paths, stage) {
+    return (error instanceof PrivateFileError &&
+        error.reason === 'io-error' &&
+        error.win32Code === 5 &&
+        error.stage === stage &&
+        paths.some((path) => resolve(path) === error.path));
+}
+export async function readLockRecord(path, read) {
+    try {
+        return await read();
+    }
+    catch (error) {
+        if (!isWindowsAccessDeniedRead(error, [path]))
+            throw error;
+        // Windows commonly maps STATUS_DELETE_PENDING to ACCESS_DENIED (5),
+        // which can also mean a permission refusal, not a sharing violation.
+        // Only a successful fresh read or ENOENT resolves that ambiguity. A
+        // persistent refusal escapes to the caller's existing deadline/backoff.
+        try {
+            return await read();
+        }
+        catch (recheckError) {
+            if (recheckError.code === 'ENOENT')
+                throw new DisappearedLockRecordError(path, error);
+            throw error;
+        }
+    }
+}