@cortexkit/antigravity-auth-core 3.0.7 → 3.0.9

package/dist/common-auth-embedded/auth-menu/login.d.ts

@@ -26,28 +26,24 @@ export interface MenuLogin {
         signal?: AbortSignal;
     }): Promise<LoginFlow>;
     /**
-     * Opens the URL in a browser; false or a throw means no browser could be
-     * opened. Defaults to `openBrowserForMenu`.
+     * Opens the URL in a browser; false or a throw means its opener could not be
+     * started. Defaults to `openBrowserForMenu`.
      */
     openBrowser?(url: string): boolean | undefined | Promise<boolean | undefined>;
 }
-type BrowserExec = (file: string, args: string[], options: {
-    stdio: 'ignore';
-    timeout: number;
-}) => unknown;
 type BrowserSpawn = (file: string, args: string[], options: {
     stdio: 'ignore';
-    windowsHide: true;
+    windowsHide?: true;
 }) => {
     pid?: number;
     unref(): void;
     on(event: 'error', listener: () => void): unknown;
 };
-/** Opens a URL with the platform's opener; false when that fails. */
-export declare function openBrowserForMenu(url: string, platform?: NodeJS.Platform, execFileSync?: BrowserExec, spawn?: BrowserSpawn): boolean;
+/** Opens a URL with the platform's opener; false when it could not start. */
+export declare function openBrowserForMenu(url: string, platform?: NodeJS.Platform, spawn?: BrowserSpawn): boolean;
 /**
  * Runs a login for the menu: a browser login first and, when no browser can
- * be opened, a device-code login instead, so a headless machine can still
+ * be started, a device-code login instead, so a headless machine can still
  * add an account. The URL is always printed, so an operator can open it by
  * hand when the opener reports success but nothing appears.
  */

package/dist/common-auth-embedded/auth-menu/login.js

@@ -1,6 +1,6 @@
-import { execFileSync as defaultExecFileSync, spawn as defaultSpawn, } from 'node:child_process';
-/** Opens a URL with the platform's opener; false when that fails. */
-export function openBrowserForMenu(url, platform = process.platform, execFileSync = defaultExecFileSync, spawn = defaultSpawn) {
+import { spawn as defaultSpawn } from 'node:child_process';
+/** Opens a URL with the platform's opener; false when it could not start. */
+export function openBrowserForMenu(url, platform = process.platform, spawn = defaultSpawn) {
     try {
         if (platform === 'win32') {
             // Start-Process opens the URL with its associated app. Base64 UTF-16LE
@@ -28,15 +28,18 @@ export function openBrowserForMenu(url, platform = process.platform, execFileSyn
             // Node leaves pid undefined when the process could not be started.
             return child.pid !== undefined;
         }
-        else {
-            execFileSync(platform === 'darwin' ? 'open' : 'xdg-open', [url], {
-                stdio: 'ignore',
-                timeout: 3000,
-            });
-        }
-        return true;
+        const child = spawn(platform === 'darwin' ? 'open' : 'xdg-open', [url], {
+            stdio: 'ignore',
+        });
+        // A failed launch reports asynchronously; without a listener it would
+        // become an uncaught exception after this function has returned.
+        child.on('error', () => { });
+        child.unref();
+        // The URL handler's process may outlive the caller; a pid means launch began.
+        return child.pid !== undefined;
     }
     catch {
+        // Browser launch is best effort; the printed URL remains the fallback.
         return false;
     }
 }
@@ -53,7 +56,7 @@ function printFlow(context, flow) {
 }
 /**
  * Runs a login for the menu: a browser login first and, when no browser can
- * be opened, a device-code login instead, so a headless machine can still
+ * be started, a device-code login instead, so a headless machine can still
  * add an account. The URL is always printed, so an operator can open it by
  * hand when the opener reports success but nothing appears.
  */

package/dist/common-auth-embedded/claustrum/availability.d.ts

@@ -0,0 +1,89 @@
+import { ClaustrumConsumerError } from './errors.js';
+export type VaultFailureClass = 'unreachable' | 'answered';
+/**
+ * Codes from claustrum-client's decoder and its subc transport. A retry action
+ * alone is not evidence of an outage: even transient vault refusals must win
+ * over a previously served credential. New codes fail closed until reviewed.
+ */
+export declare const VAULT_FAILURE_CLASSES: Readonly<{
+    ECONNREFUSED: "unreachable";
+    ENOENT: "unreachable";
+    ECONNRESET: "unreachable";
+    EPIPE: "unreachable";
+    ETIMEDOUT: "unreachable";
+    transport_error: "unreachable";
+    unavailable: "unreachable";
+    timeout: "unreachable";
+    route_closed: "unreachable";
+    daemon_draining: "unreachable";
+    connection_closed: "unreachable";
+    connection_dropped: "unreachable";
+    request_deadline: "unreachable";
+    deadline_exceeded_no_drop_observed: "unreachable";
+    module_reloading: "unreachable";
+    module_warming: "unreachable";
+    target_unavailable: "unreachable";
+    module_timeout: "unreachable";
+    invalid_response: "answered";
+    invalid_record_version: "answered";
+    invalid_expiry: "answered";
+    invalid_status: "answered";
+    invalid_params: "answered";
+    ttl_unsatisfiable: "answered";
+    not_found: "answered";
+    enrollment_revoked: "answered";
+    enrollment_invalid: "answered";
+    grant_denied: "answered";
+    credential_unavailable: "answered";
+    needs_reauth: "answered";
+    declined: "answered";
+    disabled: "answered";
+    identity_changed: "answered";
+    closed: "answered";
+    client_closed: "answered";
+    pending_exists: "answered";
+    pending_queue_full: "answered";
+    already_consumed: "answered";
+    superseded: "answered";
+    stale_generation: "answered";
+    missing_identity: "answered";
+    invalid_control_body: "answered";
+    unknown_module: "answered";
+    module_removed: "answered";
+    capability_denied: "answered";
+    unknown_channel: "unreachable";
+    stale_route_epoch: "unreachable";
+    capability_forbidden: "answered";
+    capability_unprovided: "answered";
+    capability_ambiguous: "answered";
+    invalid_capability_identifier: "answered";
+    binary_body_required: "answered";
+    binary_call_requires_call_binary: "answered";
+    corr_exhausted: "answered";
+    late_route_cleanup_failed: "answered";
+    reverse_request_capability_not_declared: "answered";
+    stale_route_handle: "answered";
+    reverse_request_unhandled: "answered";
+    handler_error: "answered";
+    health_error: "answered";
+    duplicate_module_id: "answered";
+    route_rejected: "answered";
+    lock_busy: "answered";
+    owner_invalid: "answered";
+    renewal_failed: "answered";
+    unsupported_platform: "answered";
+    EACCES: "answered";
+    EPERM: "answered";
+    ERR_PRIVATE_FILES_SECURITY: "answered";
+}>;
+/**
+ * An injected adapter may throw this ONLY when its connection/transport is
+ * unreachable, including a failed connect before getScoped. Do not wrap an
+ * adapter shutdown, cancellation, validation error or vault refusal in it.
+ * Its fixed message cannot echo enrollment or credential material, and its
+ * kind stays `unavailable` for callers handling ClaustrumConsumerError.
+ */
+export declare class ClaustrumUnreachableError extends ClaustrumConsumerError {
+    constructor();
+}
+export declare function classifyVaultFailure(error: unknown): VaultFailureClass;

package/dist/common-auth-embedded/claustrum/availability.js

@@ -0,0 +1,106 @@
+import { ClaustrumCredentialError } from '@cortexkit/claustrum-client';
+import { SocketClosedError, SocketTimeoutError, SubcCallError, } from '@cortexkit/subc-client';
+import { ClaustrumConsumerError } from './errors.js';
+/**
+ * Codes from claustrum-client's decoder and its subc transport. A retry action
+ * alone is not evidence of an outage: even transient vault refusals must win
+ * over a previously served credential. New codes fail closed until reviewed.
+ */
+export const VAULT_FAILURE_CLASSES = Object.freeze({
+    ECONNREFUSED: 'unreachable',
+    ENOENT: 'unreachable',
+    ECONNRESET: 'unreachable',
+    EPIPE: 'unreachable',
+    ETIMEDOUT: 'unreachable',
+    transport_error: 'unreachable',
+    unavailable: 'unreachable',
+    timeout: 'unreachable',
+    route_closed: 'unreachable',
+    daemon_draining: 'unreachable',
+    connection_closed: 'unreachable',
+    connection_dropped: 'unreachable',
+    request_deadline: 'unreachable',
+    deadline_exceeded_no_drop_observed: 'unreachable',
+    module_reloading: 'unreachable',
+    module_warming: 'unreachable',
+    target_unavailable: 'unreachable',
+    module_timeout: 'unreachable',
+    invalid_response: 'answered',
+    invalid_record_version: 'answered',
+    invalid_expiry: 'answered',
+    invalid_status: 'answered',
+    invalid_params: 'answered',
+    ttl_unsatisfiable: 'answered',
+    not_found: 'answered',
+    enrollment_revoked: 'answered',
+    enrollment_invalid: 'answered',
+    grant_denied: 'answered',
+    credential_unavailable: 'answered',
+    needs_reauth: 'answered',
+    declined: 'answered',
+    disabled: 'answered',
+    identity_changed: 'answered',
+    closed: 'answered',
+    client_closed: 'answered',
+    pending_exists: 'answered',
+    pending_queue_full: 'answered',
+    already_consumed: 'answered',
+    superseded: 'answered',
+    stale_generation: 'answered',
+    missing_identity: 'answered',
+    invalid_control_body: 'answered',
+    unknown_module: 'answered',
+    module_removed: 'answered',
+    capability_denied: 'answered',
+    unknown_channel: 'unreachable',
+    stale_route_epoch: 'unreachable',
+    capability_forbidden: 'answered',
+    capability_unprovided: 'answered',
+    capability_ambiguous: 'answered',
+    invalid_capability_identifier: 'answered',
+    binary_body_required: 'answered',
+    binary_call_requires_call_binary: 'answered',
+    corr_exhausted: 'answered',
+    late_route_cleanup_failed: 'answered',
+    reverse_request_capability_not_declared: 'answered',
+    stale_route_handle: 'answered',
+    reverse_request_unhandled: 'answered',
+    handler_error: 'answered',
+    health_error: 'answered',
+    duplicate_module_id: 'answered',
+    route_rejected: 'answered',
+    lock_busy: 'answered',
+    owner_invalid: 'answered',
+    renewal_failed: 'answered',
+    unsupported_platform: 'answered',
+    EACCES: 'answered',
+    EPERM: 'answered',
+    ERR_PRIVATE_FILES_SECURITY: 'answered',
+});
+/**
+ * An injected adapter may throw this ONLY when its connection/transport is
+ * unreachable, including a failed connect before getScoped. Do not wrap an
+ * adapter shutdown, cancellation, validation error or vault refusal in it.
+ * Its fixed message cannot echo enrollment or credential material, and its
+ * kind stays `unavailable` for callers handling ClaustrumConsumerError.
+ */
+export class ClaustrumUnreachableError extends ClaustrumConsumerError {
+    constructor() {
+        super('unavailable', 'Claustrum scoped operation unavailable');
+        this.name = 'ClaustrumUnreachableError';
+    }
+}
+export function classifyVaultFailure(error) {
+    if (error instanceof ClaustrumUnreachableError ||
+        error instanceof SocketClosedError ||
+        error instanceof SocketTimeoutError)
+        return 'unreachable';
+    const code = error instanceof ClaustrumCredentialError || error instanceof SubcCallError
+        ? error.code
+        : error instanceof Error && 'code' in error
+            ? error.code
+            : undefined;
+    if (typeof code !== 'string' || !Object.hasOwn(VAULT_FAILURE_CLASSES, code))
+        return 'answered';
+    return VAULT_FAILURE_CLASSES[code];
+}

package/dist/common-auth-embedded/claustrum/consumer.d.ts

@@ -1,10 +1,11 @@
 import type { ClaustrumReporterSource } from '@cortexkit/claustrum-client';
 import type { QuotaObservation } from '../quota/index.js';
 import type { RoutingRow } from '../routing/index.js';
-import { type ClaustrumFamily, type ClaustrumScopedAttempt, type ClaustrumScopedClient, type IdentityParser, type VaultGrantReach } from './custody.js';
+import { type ClaustrumFamily, type ClaustrumScopedAttempt, type ClaustrumScopedClient, type IdentityParser, type KeptReceiptState, type VaultGrantReach } from './custody.js';
 import { type ClaustrumLogger } from './errors.js';
-import { type InsulaQuotaOptions } from './insula.js';
+import { type InsulaQuotaOptions, type InsulaQuotaResult } from './insula.js';
 import { type AccountMapper, type QuotaReceipt, type VaultRosterFile } from './roster.js';
+import { type WatchMode } from './watch.js';
 export interface ClaustrumConsumerOptions<Q = QuotaObservation> {
     /**
      * The roster file: one row per vault account (route id, credential id,
@@ -41,6 +42,12 @@ export interface ClaustrumConsumerOptions<Q = QuotaObservation> {
      */
     onRoster?: (roster: VaultRosterFile) => void;
     onError?: (error: unknown) => void;
+    /**
+     * How often `start()` ticks. A tick lists the vault when no vault watch is
+     * open (before it is accepted, or when the vault or the client cannot
+     * watch), and otherwise only every five minutes, as a safety net. A tick
+     * polls insula (at most once a minute) only while its watch is not open.
+     */
     pollIntervalMs?: number;
     setTimeoutImpl?: typeof setTimeout;
     clearTimeoutImpl?: typeof clearTimeout;
@@ -49,6 +56,15 @@ export interface ClaustrumConsumerOptions<Q = QuotaObservation> {
     /** Optional background quota source. In-band readings still use recordQuota. */
     insula?: InsulaQuotaOptions<Q>;
 }
+/**
+ * How a started consumer learns about changes, for logs and status displays.
+ * `insula` is present when the consumer was given an insula source. Never
+ * carries secrets.
+ */
+export interface ClaustrumWatchState {
+    readonly vault: WatchMode;
+    readonly insula?: WatchMode;
+}
 export interface SendOptions {
     /**
      * What kind of request this is (for example `model`, `quota`, `profile`),
@@ -81,9 +97,23 @@ export declare class ClaustrumConsumer<Q = QuotaObservation> {
      * held the discovery lease and its newer roster was served instead).
      */
     grantReach(): VaultGrantReach | undefined;
+    /** How this consumer currently learns about changes, without I/O. */
+    watchState(): ClaustrumWatchState;
+    /** Whether any account is using an in-memory outage receipt, without I/O. */
+    keptReceiptState(): KeptReceiptState;
     /** Rows for `/routing`, from the last committed roster. */
     routingRows(): RoutingRow[];
     refresh(): Promise<VaultRosterFile | undefined>;
+    /**
+     * Poll in the background and open the vault and insula watches. Until the
+     * vault watch is accepted, and whenever it is unavailable, every tick lists
+     * the vault exactly as before watches existed. While it is open a tick
+     * lists only when five minutes have passed since the last discovery, since
+     * the watch keeps no history; it still checks `isCustodyActive`, so a switch
+     * to local mode closes the connection as quickly as before. Insula is
+     * polled on the tick only while its own watch is not open. A host not in
+     * vault mode makes no request.
+     */
     start(): void;
     /**
      * Fetch on a background tick, at most once per minute across projects with
@@ -104,6 +134,10 @@ export declare class ClaustrumConsumer<Q = QuotaObservation> {
      * A route without a known provider account cannot join an insula entry.
      */
     cachedInsulaQuotaForRoute(routeId: string): Promise<Q | undefined>;
+    /** Cache-only background lookup, preserving the reason a route has no reading. */
+    lookupInsulaQuotaForRoute(routeId: string): Promise<InsulaQuotaResult<Q>>;
+    /** Skip the fallback poll while insula is cold or its upstream fetch failed. */
+    pollInsulaQuotaForRoute(routeId: string, fallback: () => Promise<Q | undefined>): Promise<Q | undefined>;
     /**
      * Authorize one physical send on a vault route. The roster file is re-read
      * first, so a decline committed by another process applies before the next

package/dist/common-auth-embedded/claustrum/consumer.js

@@ -3,8 +3,9 @@ import { combineAbortSignals } from '../util/any-signal.js';
 import { ClaustrumScopedCustody, decideScopedRetryAfter401, } from './custody.js';
 import { readClaustrumEnrollmentToken } from './enrollment.js';
 import { ClaustrumConsumerError } from './errors.js';
-import { acquireInsulaQuotaSource } from './insula.js';
+import { acquireInsulaQuotaSource, } from './insula.js';
 import { acceptVaultRoute, declineVaultRoute, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, vaultRoutingRows, } from './roster.js';
+import { SAFETY_POLL_MS } from './watch.js';
 /**
  * One plugin host's view of its vault accounts. It turns vault credentials
  * into rows for `/routing`, authorizes each physical send with the vault, and
@@ -29,6 +30,11 @@ export class ClaustrumConsumer {
     #timer;
     #started = false;
     #insula;
+    #vaultWatch;
+    #releaseInsulaWatch;
+    #insulaSkips = new Map();
+    /** When this instance last completed a discovery, by `now`. */
+    #discoveredAt;
     constructor(options) {
         this.#options = options;
         this.#logger = options.logger ?? createLogger('claustrum');
@@ -91,6 +97,8 @@ export class ClaustrumConsumer {
                     requireAssertion: this.#options.requireAssertion,
                     now: this.#options.now,
                     logger: this.#logger,
+                    setTimeoutImpl: this.#options.setTimeoutImpl,
+                    clearTimeoutImpl: this.#options.clearTimeoutImpl,
                 });
                 if (this.#options.insula && client.insula) {
                     this.#insula = acquireInsulaQuotaSource(client.insula, this.#options.tokenPath);
@@ -122,6 +130,27 @@ export class ClaustrumConsumer {
             ? latest.reach
             : undefined;
     }
+    /** How this consumer currently learns about changes, without I/O. */
+    watchState() {
+        return Object.freeze({
+            vault: this.#vaultWatch?.mode ?? 'polling',
+            ...(this.#options.insula && {
+                insula: this.#insula?.source.watchMode() ?? 'polling',
+            }),
+        });
+    }
+    /** Close the watches with the connection they belong to. */
+    #stopWatch() {
+        this.#vaultWatch?.close();
+        this.#vaultWatch = undefined;
+        this.#releaseInsulaWatch?.();
+        this.#releaseInsulaWatch = undefined;
+    }
+    /** Whether any account is using an in-memory outage receipt, without I/O. */
+    keptReceiptState() {
+        return (this.#custody?.keptReceiptState() ??
+            Object.freeze({ active: false, since: null }));
+    }
     /** Rows for `/routing`, from the last committed roster. */
     routingRows() {
         return vaultRoutingRows(this.#roster);
@@ -134,6 +163,7 @@ export class ClaustrumConsumer {
             if (!(await this.#active())) {
                 this.#roster = undefined;
                 this.#grantReach = undefined;
+                this.#stopWatch();
                 this.#custody?.close();
                 this.#custody = undefined;
                 this.#insula?.release();
@@ -164,6 +194,7 @@ export class ClaustrumConsumer {
             this.#assertOpen();
             const changed = roster?.view !== this.#roster?.view;
             this.#roster = roster;
+            custody.retain(roster?.rows ?? []);
             // Each discovery replaces the previous value, including with unknown. A
             // refresh that served a peer's roster discovered nothing and leaves it;
             // grantReach() hides it once the roster's view no longer matches.
@@ -175,12 +206,23 @@ export class ClaustrumConsumer {
             // notification, and the poll runs every few seconds.
             if (roster && changed)
                 this.#options.onRoster?.(roster);
+            this.#discoveredAt = (this.#options.now ?? Date.now)();
             return roster;
         })().finally(() => {
             this.#refreshing = undefined;
         });
         return this.#refreshing;
     }
+    /**
+     * Poll in the background and open the vault and insula watches. Until the
+     * vault watch is accepted, and whenever it is unavailable, every tick lists
+     * the vault exactly as before watches existed. While it is open a tick
+     * lists only when five minutes have passed since the last discovery, since
+     * the watch keeps no history; it still checks `isCustodyActive`, so a switch
+     * to local mode closes the connection as quickly as before. Insula is
+     * polled on the tick only while its own watch is not open. A host not in
+     * vault mode makes no request.
+     */
     start() {
         if (this.#started)
             return;
@@ -188,8 +230,10 @@ export class ClaustrumConsumer {
         this.#started = true;
         const tick = async () => {
             try {
-                await this.refresh();
+                if (await this.#listDue())
+                    await this.refresh();
                 await this.refreshInsulaQuota();
+                this.#openWatch();
             }
             catch (error) {
                 if (!this.#shutdown.signal.aborted)
@@ -208,6 +252,53 @@ export class ClaustrumConsumer {
         };
         void tick();
     }
+    /** Whether a background tick must list the vault now. */
+    async #listDue() {
+        if (this.#vaultWatch?.mode !== 'watching')
+            return true;
+        const now = (this.#options.now ?? Date.now)();
+        if (this.#discoveredAt === undefined ||
+            now - this.#discoveredAt >= SAFETY_POLL_MS)
+            return true;
+        // refresh() is what closes the connection when the host left vault mode.
+        return !(await this.#active());
+    }
+    /**
+     * Open the vault and insula watches once a vault connection exists. Only
+     * reached in vault mode: a host in local mode never connects.
+     */
+    #openWatch() {
+        const custody = this.#custody;
+        if (this.#shutdown.signal.aborted || !custody)
+            return;
+        // The same entry point a host without a consumer uses, so both apply
+        // notices, refusals and outages alike.
+        this.#vaultWatch ??= custody.watchRoster({
+            view: () => this.#roster?.view,
+            // The existing discovery, so a watched change commits the roster and
+            // re-applies it to kept receipts exactly as a poll does. A refresh
+            // already in flight may have listed before the change was announced,
+            // so wait for it and list again.
+            onView: async () => {
+                while (this.#refreshing)
+                    await this.#refreshing.catch(() => { });
+                await this.refresh();
+            },
+            // Custody has dropped kept receipts, as a poll meeting the same
+            // refusal from list_scoped would.
+            onRefused: (error) => this.#options.onError?.(error),
+            onError: (error) => {
+                if (!this.#shutdown.signal.aborted)
+                    this.#options.onError?.(error);
+            },
+        });
+        if (this.#options.insula && this.#insula && !this.#releaseInsulaWatch)
+            this.#releaseInsulaWatch = this.#insula.source.watch({
+                provider: this.#options.insula.provider,
+                setTimeoutImpl: this.#options.setTimeoutImpl,
+                clearTimeoutImpl: this.#options.clearTimeoutImpl,
+            });
+    }
     /**
      * Fetch on a background tick, at most once per minute across projects with
      * the same daemon and enrollment token path. Admission must use the cache
@@ -266,6 +357,44 @@ export class ClaustrumConsumer {
             return undefined;
         }
     }
+    /** Cache-only background lookup, preserving the reason a route has no reading. */
+    async lookupInsulaQuotaForRoute(routeId) {
+        const options = this.#options.insula;
+        if (!options || this.#shutdown.signal.aborted || !(await this.#active()))
+            return { miss: 'unreachable' };
+        try {
+            await readClaustrumEnrollmentToken(this.#options.tokenPath);
+            const roster = await readVaultRoster(this.#options.rosterPath);
+            const account = roster?.rows.find((row) => row.routeId === routeId)?.accountIdentity;
+            if (!account || !this.#insula)
+                return { miss: 'unreachable' };
+            const result = this.#insula.source.lookup(options.provider, account, (this.#options.now ?? Date.now)());
+            const reading = result.reading &&
+                options.normalize(result.reading.entry, result.reading.context);
+            if (result.miss)
+                return { miss: result.miss, ...(reading !== undefined && { reading }) };
+            // Refusing an echo or unsupported window leaves the plugin's poll in charge.
+            return reading === undefined ? { miss: 'unreachable' } : { reading };
+        }
+        catch {
+            return { miss: 'unreachable' };
+        }
+    }
+    /** Skip the fallback poll while insula is cold or its upstream fetch failed. */
+    async pollInsulaQuotaForRoute(routeId, fallback) {
+        const result = await this.lookupInsulaQuotaForRoute(routeId);
+        if (result.miss === 'cold' || result.miss === 'upstream-failed') {
+            if (this.#insulaSkips.get(routeId) !== result.miss) {
+                this.#insulaSkips.set(routeId, result.miss);
+                this.#logger.warn('skipped insula provider poll', {
+                    reason: result.miss,
+                });
+            }
+            return undefined;
+        }
+        this.#insulaSkips.delete(routeId);
+        return result.miss ? fallback() : result.reading;
+    }
     #normalizeInsulaQuota(accountIdentity) {
         if (!this.#options.insula || !accountIdentity)
             return undefined;
@@ -282,20 +411,33 @@ export class ClaustrumConsumer {
     async authorize(routeId, signal) {
         this.#assertOpen(signal);
         const roster = this.#roster ?? (await this.#wait(this.refresh(), signal));
-        if (!roster || !(await this.#active()))
+        if (!roster || !(await this.#active())) {
+            this.#custody?.close();
+            this.#custody = undefined;
+            this.#stopWatch();
+            this.#insula?.release();
+            this.#insula = undefined;
             throw new ClaustrumConsumerError('not-active', 'Claustrum scoped custody is not active');
+        }
         const current = await readVaultRoster(this.#options.rosterPath);
         this.#assertOpen(signal);
         const observed = roster.rows.find((row) => row.routeId === routeId);
         const configured = current?.rows.find((row) => row.routeId === routeId);
-        if (configured && !configured.enabled)
+        if (configured && !configured.enabled) {
+            if (observed)
+                this.#custody?.forget(observed.credentialId);
             throw new ClaustrumConsumerError('route-declined', 'Claustrum route is disabled');
+        }
         if (!observed ||
             !configured ||
             configured.state !== 'active' ||
             configured.credentialId !== observed.credentialId ||
-            configured.accountIdentity !== observed.accountIdentity)
+            configured.accountIdentity !== observed.accountIdentity ||
+            configured.credentialType !== observed.credentialType) {
+            if (observed)
+                this.#custody?.forget(observed.credentialId);
             throw new ClaustrumConsumerError('route-unavailable', 'Claustrum route is disabled, removed or changed');
+        }
         const custody = await this.#wait(this.#getCustody(), signal);
         const combined = combineAbortSignals([
             this.#shutdown.signal,
@@ -308,7 +450,7 @@ export class ClaustrumConsumer {
                 ...(configured.accountIdentity !== undefined && {
                     accountIdentity: configured.accountIdentity,
                 }),
-            }, combined.signal);
+            }, combined.signal, routeId);
         }
         finally {
             combined.dispose();
@@ -332,6 +474,10 @@ export class ClaustrumConsumer {
         const signal = options.signal;
         let served = await this.authorize(routeId, signal);
         let response = await dispatch(served, signal);
+        if (response.status === 401 && served.fromKeptReceipt) {
+            await this.reportFailure(served, 401, options.reporterSource ?? 'direct');
+            return response;
+        }
         if (response.status === 401 && !signal?.aborted) {
             let current;
             try {
@@ -366,6 +512,7 @@ export class ClaustrumConsumer {
         this.#assertOpen();
         await declineVaultRoute(this.#options.rosterPath, routeId);
         this.#roster = await readVaultRoster(this.#options.rosterPath);
+        this.#custody?.retain(this.#roster?.rows ?? []);
     }
     async accept(routeId) {
         this.#assertOpen();
@@ -421,6 +568,7 @@ export class ClaustrumConsumer {
         if (this.#timer)
             (this.#options.clearTimeoutImpl ?? clearTimeout)(this.#timer);
         this.#timer = undefined;
+        this.#stopWatch();
         this.#custody?.close();
         this.#insula?.release();
         this.#insula = undefined;