@cortexkit/claustrum-client 0.9.0 → 0.11.0

package/README.md

@@ -28,10 +28,25 @@ credential caching, refresh, account scheduling, and retry policy.
   no provider ids are set. Since 0.6.2 a daemon too old to send the field decodes the
   same way, so a newer client still lists against an older daemon. `authMethod` stays
   optional.
+• Since 0.10.0 `listScoped` also returns `grants` (how many grants the caller holds)
+  and `grantTuples` (`{ selectorKind, selector, operation }` per grant). They tell two
+  empty listings apart: `rows: []` with `grants === 0` means the caller has no grant;
+  `rows: []` with `grants > 0` means it holds a grant that currently reaches no
+  credential, usually a category no credential carries yet (the operator's fix is
+  `ck auth set-category`, or `ck auth reclassify --from-registry` for credentials created
+  before categories existed). Both are `undefined` against a vault too old to send
+  them; treat that as unknown, not as zero. A present but malformed value refuses the
+  reply like any other malformed field.
 
 The client sends `consumerIdentity: null` for every managed request so inherited
 `SUBC_MODULE_ID` and `SUBC_LAUNCH_NONCE` cannot impersonate a supervising host.
 
+**Changed in 0.11.0:** the client depends on `@cortexkit/subc-client` ^0.22.0 (was
+^0.16.0). A host that also uses subc-client must move to the 0.22 line, so both share one
+copy. One behaviour reaches callers: while the vault is restarting or refusing route
+opens as retryable, a call now keeps retrying for up to 90 s (paced, with jitter) instead
+of 30 s. Give every vault call on a latency-sensitive path its own timeout.
+
 ## OpenCode handle-file exports
 
 `defaultHandleFilePath`, `readHandleFile`, `handleFileRevision`, and `parseHandleFile`

package/dist/index.d.ts

@@ -3,5 +3,5 @@ export { storeIdentity, storageFingerprint } from './identity.js';
 export { writeEnrollmentTokenFile, type EnrollmentTokenFile, } from './enrollment.js';
 export { MANIFEST_LOCK, manifestLockQuarantinePrefix, withManifestLock, writeHandleFileLocked, type ManifestHandleAccount, type ManifestHandleFile, type ManifestHandleProvider, type ManifestLockError, type ManifestLockErrorCode, } from './manifest-lock.js';
 export { ClaustrumCredentialError, credentialErrorAction, ERROR_CLASS_WIRE_SET, type ClaustrumCredentialErrorAction, type ClaustrumCredentialErrorClass, } from './errors.js';
-export { ClaustrumClient, type ClaustrumClientOptions, type ClaustrumConnector, type ClaustrumReporterSource, type CredentialStatus, type EnrollmentPollOutcome, type ScopedInventory, type ScopedInventoryRow, type ServedCredential, } from './wire.js';
+export { ClaustrumClient, type ClaustrumClientOptions, type ClaustrumConnector, type ClaustrumReporterSource, type CredentialStatus, type EnrollmentPollOutcome, type ScopedGrantTuple, type ScopedInventory, type ScopedInventoryRow, type ServedCredential, } from './wire.js';
 export { HANDLE_FILE_CONTRACT, HandleFileValidationError, credentialIdMatchesProvider, defaultHandleFilePath, handleFileRevision, identifierIsValid, parseHandleFile, readHandleFile, type HandleAccount, type HandleFileIo, type HandleProvider, type OpenCodeHandleFileV1, } from './handles.js';

package/dist/wire.d.ts

@@ -250,10 +250,38 @@ export interface ScopedInventoryRow {
  * and deliberately NOT over `record_version`, so a routine token refresh does not move it.
  * Compare it against the previous call's to decide whether to reconcile at all; it is an
  * opaque string and nothing but equality is defined on it.
+ *
+ * `grants` and `grantTuples` say what this caller is GRANTED, independent of what those
+ * grants currently reach. They are the only way to tell two empty listings apart:
+ *
+ * - `rows: []` with `grants === 0`: the caller holds no grant at all. The remedy is a
+ *   grant (`ck auth grant`).
+ * - `rows: []` with `grants > 0`: the caller holds a grant that currently reaches no
+ *   credential, typically a category no credential carries yet. The remedy is on the
+ *   credential side (`ck auth set-category`, or `ck auth reclassify --from-registry` for
+ *   credentials created before categories existed), not another grant.
+ *
+ * `grantTuples` lists each grant as `{ selectorKind, selector, operation }` (for example
+ * `{ selectorKind: 'category', selector: 'openai-native', operation: 'read' }`), so a
+ * consumer can name the selector that matched nothing. `grants` is its length.
+ *
+ * Both are `undefined` when the vault is too old to send them. That means "unknown",
+ * not "no grant": do not read an absent count as zero.
  */
 export interface ScopedInventory {
     readonly rows: readonly ScopedInventoryRow[];
     readonly view: string;
+    readonly grants: number | undefined;
+    readonly grantTuples: readonly ScopedGrantTuple[] | undefined;
+}
+/** One grant the caller holds, as the vault's `list_scoped` reply names it. */
+export interface ScopedGrantTuple {
+    /** `exact` or `category`; decoded as an open string. */
+    readonly selectorKind: string;
+    /** A credential id for `exact`, a bare category name for `category`. */
+    readonly selector: string;
+    /** The granted operation, e.g. `read` or `list`; decoded as an open string. */
+    readonly operation: string;
 }
 /**
  * Exported for the golden-reply test only; `index.ts` re-exports by name, so this does not

package/dist/wire.js

@@ -346,6 +346,7 @@ export class ClaustrumClient {
         await this.#reconnecting;
     }
 }
+const GRANT_TUPLE_KEYS = ['operation', 'selector', 'selector_kind'];
 /**
  * Exported for the golden-reply test only; `index.ts` re-exports by name, so this does not
  * widen the published surface. The test drives THIS function rather than asserting keys,
@@ -445,7 +446,38 @@ export function decodeScopedInventory(response, logUnknownClass) {
             orgName: row.org_name,
         };
     });
-    return { rows: decoded, view };
+    // ABSENT IS UNKNOWN, PRESENT MUST BE WELL-FORMED. A vault from before these fields
+    // omits both, and refusing that would fail every listing against a still-supported
+    // vault. A present but malformed value is a broken reply, and decoding it leniently
+    // would hand the caller a grant count it cannot trust to tell "no grant" from "a grant
+    // that reaches nothing".
+    const rawGrants = result?.grants;
+    let grants;
+    if (rawGrants !== undefined) {
+        if (typeof rawGrants !== 'number' || !Number.isSafeInteger(rawGrants) || rawGrants < 0) {
+            throw asCredentialError(response, 'invalid_response', logUnknownClass);
+        }
+        grants = rawGrants;
+    }
+    const rawTuples = result?.grant_tuples;
+    let grantTuples;
+    if (rawTuples !== undefined) {
+        if (!Array.isArray(rawTuples))
+            throw asCredentialError(response, 'invalid_response', logUnknownClass);
+        grantTuples = rawTuples.map((tuple) => {
+            if (!isRecord(tuple) ||
+                Object.keys(tuple).length !== GRANT_TUPLE_KEYS.length ||
+                !GRANT_TUPLE_KEYS.every((key) => typeof tuple[key] === 'string')) {
+                throw asCredentialError(response, 'invalid_response', logUnknownClass);
+            }
+            return {
+                selectorKind: tuple.selector_kind,
+                selector: tuple.selector,
+                operation: tuple.operation,
+            };
+        });
+    }
+    return { rows: decoded, view, grants, grantTuples };
 }
 function decodeEnrollmentResult(response, logUnknownClass) {
     if (hasCredentialError(response))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/claustrum-client",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -28,6 +28,6 @@
   },
   "dependencies": {
     "@cortexkit/store": "^0.2.1",
-    "@cortexkit/subc-client": "^0.16.0"
+    "@cortexkit/subc-client": "^0.22.0"
   }
 }