@cortexkit/common-auth 0.1.2 → 0.2.0

package/dist/routing/sticky.js

@@ -0,0 +1,310 @@
+// `sticky-balanced` routing: openai-auth's quota-weighted session placement
+// and pin-break classification, judged over the quota projection rather than
+// openai-auth's fixed primary/secondary snapshot.
+import { budgetExhaustedResetAt, projectQuota, } from '../quota/projection.js';
+import { admit, } from './admission.js';
+import { isPinValid } from './pins.js';
+export const QUOTA_STALENESS_MS = 15 * 60_000;
+export const MIN_RESET_HOURS = 1 / 60;
+export const MIN_WEIGHT = 1e-6;
+/**
+ * How many window readings the selection primitives judge, as openai-auth's
+ * primary and secondary slots did. The projection's first readings in its
+ * order fill the slots; any further window is judged by admission only.
+ */
+export const STICKY_WINDOW_SLOTS = 2;
+/** The projection's time, else the caller's cache-entry time. */
+export function snapshotCheckedAt(quota, entryCheckedAt) {
+    for (const checkedAt of [quota?.checkedAt, entryCheckedAt]) {
+        if (typeof checkedAt === 'number' && Number.isFinite(checkedAt)) {
+            return checkedAt;
+        }
+    }
+    return undefined;
+}
+function slotReadings(quota) {
+    // Longest known window first, unknown lengths last, as openai-auth sorts.
+    // Tombstones and absence records carry no capacity figure, so they occupy
+    // no slot.
+    return quota.limits
+        .filter((limit) => limit.kind === 'reading')
+        .sort((left, right) => {
+        const leftKnown = left.windowMinutes !== undefined;
+        const rightKnown = right.windowMinutes !== undefined;
+        if (leftKnown !== rightKnown)
+            return leftKnown ? -1 : 1;
+        if (leftKnown && rightKnown) {
+            return (right.windowMinutes ?? 0) - (left.windowMinutes ?? 0);
+        }
+        return 0;
+    })
+        .slice(0, STICKY_WINDOW_SLOTS);
+}
+/** Classifies whether a pinned session should leave its row after a failure. */
+export function decideStickyBreak(input) {
+    if (input.status === 401 || input.status === 403) {
+        return { action: 'migrate', reason: 'permanent' };
+    }
+    if (!input.quota)
+        return { action: 'retain', reason: 'unknown' };
+    const checkedAt = snapshotCheckedAt(input.quota, input.quotaCheckedAt);
+    if (checkedAt === undefined ||
+        !Number.isFinite(checkedAt) ||
+        input.now - checkedAt > QUOTA_STALENESS_MS) {
+        return { action: 'retain', reason: 'stale' };
+    }
+    // After the stale check, so a stale snapshot never judges the account on a
+    // reading the killswitch would consider below its floor.
+    if (input.killswitchPasses === false) {
+        return { action: 'migrate', reason: 'killswitch' };
+    }
+    for (const limit of slotReadings(input.quota)) {
+        const remaining = limit.remainingPercent;
+        if (typeof remaining === 'number' &&
+            Number.isFinite(remaining) &&
+            remaining <= 0) {
+            return {
+                action: 'migrate',
+                reason: 'exhausted',
+                window: { scope: limit.scope, label: limit.label },
+                ...(typeof limit.resetsAt === 'string'
+                    ? { resetsAt: limit.resetsAt }
+                    : {}),
+            };
+        }
+    }
+    // A reached credit budget is exhaustion on its own axis, judged by the same
+    // signal admission uses so the two never disagree on what "spent" means.
+    const budgetReset = budgetExhaustedResetAt(input.quota, input.now);
+    if (budgetReset) {
+        return {
+            action: 'migrate',
+            reason: 'exhausted',
+            resetsAt: budgetReset.resetsAt,
+        };
+    }
+    if (input.status === undefined ||
+        input.status === 0 ||
+        !Number.isFinite(input.status) ||
+        (input.status >= 500 && input.status <= 599) ||
+        input.status === 429) {
+        return { action: 'retain', reason: 'transient' };
+    }
+    return { action: 'retain', reason: 'healthy' };
+}
+export function sustainableWindowWeight(window, reservePercent, now) {
+    const spendable = Math.max(0, window.remainingPercent - reservePercent);
+    if (spendable <= 0)
+        return 0;
+    if (!window.resetsAt)
+        return spendable;
+    const resetMs = Date.parse(window.resetsAt);
+    // A lapsed reset cannot yield a spend rate: the divisor would clamp to
+    // MIN_RESET_HOURS and inflate the weight about sixty-fold on stale
+    // information, so the un-rate-adjusted spendable capacity is used instead.
+    if (!Number.isFinite(resetMs) || resetMs <= now)
+        return spendable;
+    const hours = Math.max((resetMs - now) / 3_600_000, MIN_RESET_HOURS);
+    return spendable / hours;
+}
+function compareAccountIds(left, right) {
+    if (left < right)
+        return -1;
+    if (left > right)
+        return 1;
+    return 0;
+}
+function candidateWeight(candidate, now) {
+    if (!candidate.quota)
+        return undefined;
+    const quotaCheckedAt = snapshotCheckedAt(candidate.quota, candidate.quotaCheckedAt);
+    if (quotaCheckedAt === undefined ||
+        now - quotaCheckedAt > QUOTA_STALENESS_MS) {
+        return undefined;
+    }
+    // Missing reserve data must leave a window usable rather than silently
+    // excluding its account.
+    const weights = slotReadings(candidate.quota).map((limit) => sustainableWindowWeight({
+        remainingPercent: limit.remainingPercent ?? Number.NaN,
+        ...(limit.resetsAt === undefined ? {} : { resetsAt: limit.resetsAt }),
+    }, candidate.reservePercent[limit.label] ?? 0, now));
+    // The credit budget is a third pressure axis on its own reset clock. It has
+    // no configured reserve, and a malformed reading is ignored rather than
+    // allowed to zero the account's weight.
+    const budget = candidate.quota.budget;
+    if (budget &&
+        typeof budget.remainingPercent === 'number' &&
+        Number.isFinite(budget.remainingPercent)) {
+        weights.push(sustainableWindowWeight({
+            remainingPercent: budget.remainingPercent,
+            ...(budget.resetsAt === undefined
+                ? {}
+                : { resetsAt: budget.resetsAt }),
+        }, 0, now));
+    }
+    const weight = weights.length > 0 ? Math.min(...weights) : 0;
+    return weight > 0 ? { candidate, quotaCheckedAt, weight } : undefined;
+}
+/**
+ * Places a session: the lowest projected pressure among candidates with a
+ * fresh positive weight, else (`mode-fallback`) the first candidate in
+ * configured order, preferring one with an applicable reset credit.
+ */
+export function selectStickyCandidate(input) {
+    // A candidate killed by the killswitch is excluded from BOTH weighted
+    // placement and the fallback branch, which must never become a way to
+    // spend on a killed account.
+    const eligibleCandidates = input.candidates.filter((candidate) => candidate.killswitchPasses !== false);
+    if (input.candidates.length === 0) {
+        throw new Error('Cannot select a sticky candidate: input.candidates is empty');
+    }
+    if (eligibleCandidates.length === 0)
+        return undefined;
+    const weighted = eligibleCandidates
+        .map((candidate) => candidateWeight(candidate, input.now))
+        .filter((candidate) => candidate !== undefined);
+    if (weighted.length > 0) {
+        weighted.sort((left, right) => {
+            // MIN_WEIGHT only guards the division; every weight here is positive.
+            const leftScore = ((input.pendingBytes.get(left.candidate.accountId) ?? 0) +
+                input.requestBytes) /
+                Math.max(left.weight, MIN_WEIGHT);
+            const rightScore = ((input.pendingBytes.get(right.candidate.accountId) ?? 0) +
+                input.requestBytes) /
+                Math.max(right.weight, MIN_WEIGHT);
+            return (leftScore - rightScore ||
+                left.candidate.configuredOrder - right.candidate.configuredOrder ||
+                compareAccountIds(left.candidate.accountId, right.candidate.accountId));
+        });
+        const selected = weighted[0];
+        if (selected) {
+            return {
+                accountId: selected.candidate.accountId,
+                quotaCheckedAt: selected.quotaCheckedAt,
+                source: 'weighted',
+            };
+        }
+    }
+    input.onEmptyWeightedSet?.();
+    const fallback = [...eligibleCandidates].sort((left, right) => {
+        const leftHasCredits = (left.resetCreditsApplicable ?? 0) > 0 ? 1 : 0;
+        const rightHasCredits = (right.resetCreditsApplicable ?? 0) > 0 ? 1 : 0;
+        return (rightHasCredits - leftHasCredits ||
+            left.configuredOrder - right.configuredOrder ||
+            compareAccountIds(left.accountId, right.accountId));
+    })[0];
+    if (!fallback) {
+        throw new Error('Cannot select a sticky candidate: input.candidates is empty');
+    }
+    return {
+        accountId: fallback.accountId,
+        quotaCheckedAt: snapshotCheckedAt(fallback.quota, fallback.quotaCheckedAt),
+        source: 'mode-fallback',
+    };
+}
+/**
+ * Routes one request in `sticky-balanced` mode. A valid pin whose row is
+ * admitted, not excluded and not killed is dispatched as is. Otherwise
+ * selection runs over the non-excluded rows; each selected row admission
+ * refused is removed and selection re-runs, so the loop ends either on an
+ * admitted row or with no admissible account.
+ */
+export function routeSticky(input) {
+    const admission = admit(input);
+    const admitted = new Map(admission.admitted.map((row) => [row.id, row]));
+    const refusals = new Map(admission.refused.map((r) => [r.id, r]));
+    const excluded = new Set(admission.excluded.map((row) => row.id));
+    const validIds = new Set(input.rows.map((row) => row.id));
+    const pinValid = input.pin !== undefined &&
+        isPinValid(input.pin, validIds, input.identities?.get(input.pin.accountId));
+    if (pinValid && input.pin) {
+        const pinned = admitted.get(input.pin.accountId);
+        if (pinned && input.killswitch?.get(pinned.id) !== false) {
+            return {
+                outcome: 'dispatch',
+                accountId: pinned.id,
+                source: 'pin',
+                ...(pinned.projection?.checkedAt === undefined
+                    ? {}
+                    : { quotaCheckedAt: pinned.projection.checkedAt }),
+                pin: { action: 'retain' },
+                refusedSelections: [],
+                admission,
+            };
+        }
+    }
+    const scope = input.scope;
+    let candidates = input.rows
+        .map((row, configuredOrder) => ({ row, configuredOrder }))
+        .filter(({ row }) => !excluded.has(row.id))
+        .map(({ row, configuredOrder }) => {
+        const killswitchPasses = input.killswitch?.get(row.id);
+        const credits = input.resetCreditsApplicable?.get(row.id);
+        return {
+            accountId: row.id,
+            quota: row.kind === 'api-key'
+                ? undefined
+                : (admitted.get(row.id)?.projection ??
+                    projectQuota(row.quota, scope)),
+            reservePercent: input.reservePercent ?? {},
+            configuredOrder,
+            ...(credits === undefined ? {} : { resetCreditsApplicable: credits }),
+            ...(killswitchPasses === undefined ? {} : { killswitchPasses }),
+        };
+    });
+    const refusedSelections = [];
+    const unplaced = pinValid
+        ? { action: 'retain' }
+        : input.pin
+            ? { action: 'clear' }
+            : { action: 'none' };
+    while (candidates.length > 0) {
+        const selection = selectStickyCandidate({
+            candidates,
+            pendingBytes: input.pendingBytes ?? new Map(),
+            requestBytes: input.requestBytes,
+            now: input.now,
+            ...(input.onEmptyWeightedSet
+                ? { onEmptyWeightedSet: input.onEmptyWeightedSet }
+                : {}),
+        });
+        if (!selection)
+            break;
+        const refusal = refusals.get(selection.accountId);
+        if (refusal) {
+            refusedSelections.push(refusal);
+            candidates = candidates.filter((candidate) => candidate.accountId !== selection.accountId);
+            continue;
+        }
+        const identity = input.identities?.get(selection.accountId);
+        return {
+            outcome: 'dispatch',
+            accountId: selection.accountId,
+            source: selection.source,
+            ...(selection.quotaCheckedAt === undefined
+                ? {}
+                : { quotaCheckedAt: selection.quotaCheckedAt }),
+            pin: pinValid
+                ? { action: 'retain' }
+                : {
+                    action: 'assign',
+                    pin: {
+                        accountId: selection.accountId,
+                        inputBytes: input.requestBytes,
+                        ...(identity === undefined ? {} : { wireIdentity: identity }),
+                        ...(selection.quotaCheckedAt === undefined
+                            ? {}
+                            : { quotaCheckedAt: selection.quotaCheckedAt }),
+                    },
+                },
+            refusedSelections,
+            admission,
+        };
+    }
+    return {
+        outcome: 'no-admissible-account',
+        pin: unplaced,
+        refusedSelections,
+        admission,
+    };
+}

package/dist/sidebar-file/sidebar-file.d.ts

@@ -10,9 +10,10 @@ export interface SidebarFileOptions<T> {
     normalize: (parsed: unknown) => T;
     timeoutMs?: number;
     /**
-     * Create the parent directory private and tighten it to 0o700 before each
-     * write. Defaults to true. Pass false for a directory the user chose (an
-     * override path), whose permissions are theirs to set.
+     * Tighten an existing parent directory to 0o700 before each write. Defaults
+     * to true. Pass false for a directory the user chose (an override path),
+     * whose permissions are theirs to set. A parent this library has to create
+     * is always created private, either way.
      */
     secureDir?: boolean;
     logger?: {

package/dist/sidebar-file/sidebar-file.js

@@ -42,10 +42,7 @@ export function createSidebarFile(options) {
     const persist = async (merge, hooks) => {
         const parent = dirname(path);
         const secureDir = options.secureDir ?? true;
-        await mkdir(parent, {
-            recursive: true,
-            mode: secureDir ? 0o700 : undefined,
-        });
+        await mkdir(parent, { recursive: true, mode: 0o700 });
         if (secureDir) {
             await chmod(parent, 0o700).catch((error) => {
                 options.logger?.warn('sidebar directory permission remediation failed', { error: error instanceof Error ? error.message : String(error) });

package/dist/store/attribution.d.ts

@@ -0,0 +1,17 @@
+import { type StoreRuntime } from './runtime.js';
+/**
+ * What a pull or refresh captured about its row (named by id alongside) when
+ * it was issued. A result applies only while the row with that id still has
+ * this credential epoch and this recorded identity; a replaced credential bumps the epoch, so work issued
+ * for the old one is discarded.
+ */
+export interface Attribution {
+    credentialEpoch: number;
+    identity?: string;
+}
+/**
+ * Merges a quota observation into a row's stored map under the store locks,
+ * after attribution passes. Needs no row lock, so it is permitted from
+ * inside hooks. Clears needs-first-reading on success.
+ */
+export declare function recordQuota(rt: StoreRuntime, id: string, attribution: Attribution, observation: unknown): Promise<void>;

package/dist/store/attribution.js

@@ -0,0 +1,46 @@
+import { PoolOperationError } from './errors.js';
+import { toFailure, withTransaction } from './mutate.js';
+import { LockStack } from './refresh-lock.js';
+import { refusal, unknownRow } from './runtime.js';
+/**
+ * Merges a quota observation into a row's stored map under the store locks,
+ * after attribution passes. Needs no row lock, so it is permitted from
+ * inside hooks. Clears needs-first-reading on success.
+ */
+export async function recordQuota(rt, id, attribution, observation) {
+    const { ctx } = rt;
+    const locks = new LockStack(ctx.lockDefaults, ctx.lockEnv);
+    const progress = { writes: 0 };
+    try {
+        await withTransaction(ctx, locks, progress, { operation: 'pull', rowId: id }, async (tx) => {
+            const row = tx.row(id);
+            if (!row)
+                throw unknownRow('pull', id);
+            if (row.invalid)
+                throw refusal('pull', id, 'invalid-row', `row ${id} is invalid`);
+            const entry = tx.entry(id);
+            if (!entry ||
+                entry.credentialEpoch !== attribution.credentialEpoch ||
+                row.identity !== attribution.identity)
+                throw new PoolOperationError({
+                    operation: 'pull',
+                    rowId: id,
+                    phase: 'pull',
+                    retryable: true,
+                    kind: 'attribution',
+                    message: `quota for ${id} was issued for a credential the row no longer holds`,
+                });
+            const merged = ctx.codec.merge(entry.quota, observation);
+            if (!ctx.codec.validate(merged))
+                throw refusal('pull', id, 'invalid-quota', 'the quota codec rejected the merged map');
+            tx.setEntry(id, { ...entry, quota: merged, needsFirstReading: false });
+            await tx.commitConfig();
+        });
+    }
+    catch (error) {
+        throw toFailure(error, 'pull', id, progress);
+    }
+    finally {
+        await locks.releaseAll();
+    }
+}

package/dist/store/errors.d.ts

@@ -0,0 +1,52 @@
+import type { StoredCredential } from './schema.js';
+/** Every library operation that can fail, as named in the failure value. */
+export type PoolOperation = 'add' | 'replace' | 'rotate' | 'disable' | 'recordIdentity' | 'refresh' | 'pull';
+/**
+ * How far an operation got before it failed.
+ *
+ * `before-first-write`: nothing was written; both files are as they were.
+ * `after-first-write`: the operation's first file write landed and a later one
+ * did not; what that first write left is on disk and is never rolled back
+ * (add: a row with no credential; replace: the bumped epoch beside the prior
+ * credential; rotate: the rotated credential beside the old per-row entry). `pull`: a quota pull, or the recording of its result, failed.
+ */
+export type PoolFailurePhase = 'before-first-write' | 'after-first-write' | 'pull';
+/**
+ * Why an operation failed. `lock-contention` and `lock-ownership` are the two
+ * lock outcomes (a wait that ran out, and a lease found lost); the rest are
+ * refusals and failures of the operation itself.
+ */
+export type PoolFailureKind = 'lock-contention' | 'lock-ownership' | 'pending-migration' | 'load-error' | 'unknown-row' | 'invalid-row' | 'invalid-input' | 'id-exists' | 'id-removed' | 'type-mismatch' | 'no-credential' | 'row-disabled' | 'row-key-changed' | 'refresh-stamp-ahead' | 'attribution' | 'provider' | 'pull' | 'invalid-quota' | 'after-persist-hook' | 'unexpected';
+/**
+ * The single failure value of every store operation. `committed` is present
+ * only when the operation had already written a credential to the state file
+ * before it failed (a partial rotation or refresh): it is the credential now
+ * on disk, so a caller never has to re-read the files to learn it.
+ */
+export declare class PoolOperationError extends Error {
+    readonly operation: PoolOperation;
+    readonly rowId: string | undefined;
+    readonly phase: PoolFailurePhase;
+    readonly retryable: boolean;
+    readonly kind: PoolFailureKind;
+    readonly committed: StoredCredential | undefined;
+    constructor(details: {
+        operation: PoolOperation;
+        rowId?: string;
+        phase: PoolFailurePhase;
+        retryable: boolean;
+        kind: PoolFailureKind;
+        committed?: StoredCredential;
+        message?: string;
+        cause?: unknown;
+    });
+}
+/**
+ * Thrown when a row operation or a refresh is called from inside a hook of a
+ * lock-holding operation (or from any continuation created inside one). It is
+ * thrown before any lock is taken or waited for.
+ */
+export declare class PoolReentryError extends Error {
+    readonly operation: PoolOperation;
+    constructor(operation: PoolOperation);
+}

package/dist/store/errors.js

@@ -0,0 +1,38 @@
+/**
+ * The single failure value of every store operation. `committed` is present
+ * only when the operation had already written a credential to the state file
+ * before it failed (a partial rotation or refresh): it is the credential now
+ * on disk, so a caller never has to re-read the files to learn it.
+ */
+export class PoolOperationError extends Error {
+    operation;
+    rowId;
+    phase;
+    retryable;
+    kind;
+    committed;
+    constructor(details) {
+        super(details.message ??
+            `${details.operation} failed (${details.kind}, ${details.phase})`, details.cause === undefined ? undefined : { cause: details.cause });
+        this.name = 'PoolOperationError';
+        this.operation = details.operation;
+        this.rowId = details.rowId;
+        this.phase = details.phase;
+        this.retryable = details.retryable;
+        this.kind = details.kind;
+        this.committed = details.committed;
+    }
+}
+/**
+ * Thrown when a row operation or a refresh is called from inside a hook of a
+ * lock-holding operation (or from any continuation created inside one). It is
+ * thrown before any lock is taken or waited for.
+ */
+export class PoolReentryError extends Error {
+    operation;
+    constructor(operation) {
+        super(`${operation} was called from inside a store hook; hand it to the caller's continuation instead`);
+        this.name = 'PoolReentryError';
+        this.operation = operation;
+    }
+}

package/dist/store/hooks.d.ts

@@ -0,0 +1,12 @@
+import { type PoolOperation } from './errors.js';
+/** Refuses a row operation or refresh called from inside a hook. */
+export declare function assertNotInsideHook(operation: PoolOperation): void;
+export declare function runInsideHook<T>(operation: PoolOperation, fn: () => Promise<T> | T): Promise<T>;
+export interface PoolLogger {
+    warn(message: string, data?: unknown): void;
+}
+/**
+ * Runs a failure hook. A hook that throws never replaces the failure it was
+ * handed: its exception is logged and discarded.
+ */
+export declare function callFailureHook<E>(operation: PoolOperation, hook: ((rowId: string, error: E) => void | Promise<void>) | undefined, rowId: string, error: E, logger: PoolLogger | undefined): Promise<void>;

package/dist/store/hooks.js

@@ -0,0 +1,34 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { PoolReentryError } from './errors.js';
+/**
+ * Set while a hook of a lock-holding operation runs. Async context is
+ * inherited by every timer, promise and continuation created inside the hook,
+ * so work a hook schedules is inside the guarded region too.
+ */
+const insideHook = new AsyncLocalStorage();
+/** Refuses a row operation or refresh called from inside a hook. */
+export function assertNotInsideHook(operation) {
+    if (insideHook.getStore() !== undefined)
+        throw new PoolReentryError(operation);
+}
+export function runInsideHook(operation, fn) {
+    return insideHook.run(operation, async () => await fn());
+}
+/**
+ * Runs a failure hook. A hook that throws never replaces the failure it was
+ * handed: its exception is logged and discarded.
+ */
+export async function callFailureHook(operation, hook, rowId, error, logger) {
+    if (!hook)
+        return;
+    try {
+        await runInsideHook(operation, () => hook(rowId, error));
+    }
+    catch (hookError) {
+        logger?.warn('store failure hook threw; the original failure stands', {
+            operation,
+            rowId,
+            error: hookError instanceof Error ? hookError.message : String(hookError),
+        });
+    }
+}

package/dist/store/identity.d.ts

@@ -0,0 +1,23 @@
+import type { Transaction } from './mutate.js';
+import type { PoolRow } from './schema.js';
+/** The reason recorded on a row disabled because an earlier row is the same account. */
+export declare const DUPLICATE_IDENTITY_REASON = "duplicate-identity";
+/**
+ * Enabled OAuth rows holding a credential whose wire identity is not yet
+ * known. API-key rows and disabled rows never count.
+ */
+export declare function countUnknownIdentityRows(rows: readonly PoolRow[]): number;
+/**
+ * Marks a row disabled with a reason: `enabled: false` in the roster row,
+ * which older readers honour, and the reason in the per-row entry. A row
+ * without an entry gets one at epoch 1. Nothing is ever deleted.
+ */
+export declare function disableIn(tx: Transaction, id: string, reason: string): void;
+/**
+ * Two enabled OAuth rows with one wire identity are the same account: the
+ * earlier row in roster order stays enabled and every later one is disabled
+ * with a reason. Returns the ids it disabled.
+ */
+export declare function disableIdentityDuplicates(tx: Transaction, identity: string): string[];
+/** Records a row's wire identity in its roster row, then applies dedupe. */
+export declare function recordIdentityIn(tx: Transaction, id: string, identity: string): string[];

package/dist/store/identity.js

@@ -0,0 +1,53 @@
+/** The reason recorded on a row disabled because an earlier row is the same account. */
+export const DUPLICATE_IDENTITY_REASON = 'duplicate-identity';
+/**
+ * Enabled OAuth rows holding a credential whose wire identity is not yet
+ * known. API-key rows and disabled rows never count.
+ */
+export function countUnknownIdentityRows(rows) {
+    return rows.filter((row) => row.invalid === undefined &&
+        row.type === 'oauth' &&
+        row.enabled &&
+        row.credential !== undefined &&
+        row.identity === undefined).length;
+}
+/**
+ * Marks a row disabled with a reason: `enabled: false` in the roster row,
+ * which older readers honour, and the reason in the per-row entry. A row
+ * without an entry gets one at epoch 1. Nothing is ever deleted.
+ */
+export function disableIn(tx, id, reason) {
+    const raw = tx.rosterRow(id);
+    if (!raw)
+        return;
+    raw.enabled = false;
+    const entry = tx.entry(id) ?? { credentialEpoch: 1, needsFirstReading: true };
+    tx.setEntry(id, { ...entry, disabledReason: reason });
+}
+/**
+ * Two enabled OAuth rows with one wire identity are the same account: the
+ * earlier row in roster order stays enabled and every later one is disabled
+ * with a reason. Returns the ids it disabled.
+ */
+export function disableIdentityDuplicates(tx, identity) {
+    const holders = tx
+        .rows()
+        .filter((row) => row.invalid === undefined &&
+        row.type === 'oauth' &&
+        row.enabled &&
+        row.identity === identity);
+    const disabled = [];
+    for (const row of holders.slice(1)) {
+        disableIn(tx, row.id, DUPLICATE_IDENTITY_REASON);
+        disabled.push(row.id);
+    }
+    return disabled;
+}
+/** Records a row's wire identity in its roster row, then applies dedupe. */
+export function recordIdentityIn(tx, id, identity) {
+    const raw = tx.rosterRow(id);
+    if (!raw)
+        return [];
+    raw.accountId = identity;
+    return disableIdentityDuplicates(tx, identity);
+}

package/dist/store/index.d.ts

@@ -0,0 +1,16 @@
+export type { Attribution } from './attribution.js';
+export type { PoolFailureKind, PoolFailurePhase, PoolOperation, } from './errors.js';
+export { PoolOperationError, PoolReentryError } from './errors.js';
+export type { PoolLogger } from './hooks.js';
+export { countUnknownIdentityRows, DUPLICATE_IDENTITY_REASON, } from './identity.js';
+export type { HoldPoint, WriteStep } from './mutate.js';
+export type { OpenPoolStoreOptions, PoolLoad, PoolStore, } from './pool.js';
+export { openPoolStore } from './pool.js';
+export type { PullHook, PullRequest } from './pull.js';
+export type { ProviderRefresh, ProviderRefreshResult, RefreshOptions, RefreshOutcome, } from './refresh.js';
+export type { LockEvent, PoolLockOptions, PoolLockSpec, } from './refresh-lock.js';
+export { POOL_LOCK_DEFAULTS } from './refresh-lock.js';
+export type { AddInput, AddResult, FailureHook, RowOperationOptions, } from './rows.js';
+export type { PullReason } from './runtime.js';
+export type { ApiKeyCredential, OAuthCredential, PoolCredential, PoolRow, QuotaCodec, StoredCredential, } from './schema.js';
+export { fingerprintOf, LEGACY_STORE_VERSION, POOL_KEY, POOL_ROWS_KEY, POOL_SCHEMA_VERSION, REFRESH_STAMP_TOLERANCE_MS, rowLockKey, } from './schema.js';

package/dist/store/index.js

@@ -0,0 +1,5 @@
+export { PoolOperationError, PoolReentryError } from './errors.js';
+export { countUnknownIdentityRows, DUPLICATE_IDENTITY_REASON, } from './identity.js';
+export { openPoolStore } from './pool.js';
+export { POOL_LOCK_DEFAULTS } from './refresh-lock.js';
+export { fingerprintOf, LEGACY_STORE_VERSION, POOL_KEY, POOL_ROWS_KEY, POOL_SCHEMA_VERSION, REFRESH_STAMP_TOLERANCE_MS, rowLockKey, } from './schema.js';