@cortexkit/common-auth 0.11.1 → 0.11.3

package/dist/claustrum/custody.d.ts

@@ -87,6 +87,12 @@ export interface ClaustrumScopedAttempt {
      * in from the roster or from a token parse.
      */
     readonly assertedAccountIdentity?: string;
+    /**
+     * The non-secret Google Cloud project id the vault served in get_scoped for
+     * this attempt, if any. Never filled in from list_scoped, the roster or a
+     * token parse. A project change in the vault takes effect on the next send.
+     */
+    readonly projectId?: string;
     /**
      * Kept in memory only and hidden from JSON.stringify and object spreads, so
      * logging a receipt never leaks it. Authorize again for every dispatch and retry.

package/dist/claustrum/custody.js

@@ -298,6 +298,9 @@ export class ClaustrumScopedCustody {
             ...(assertedIdentity !== undefined && {
                 assertedAccountIdentity: assertedIdentity,
             }),
+            ...(served.projectId !== undefined && {
+                projectId: served.projectId,
+            }),
             recordVersion: served.recordVersion,
             expiresAtMs,
         }, 'accessToken', { value: accessToken, enumerable: false }));

package/dist/opencode2/errors.d.ts

@@ -2,7 +2,9 @@
  * Why an OpenCode 2 auth hook refused a request.
  *
  * - `no-account`: the adapter had no account to offer for this request, so
- *   the request is stopped before the host picks a transport.
+ *   the request is stopped before the host picks a transport. Also used when
+ *   session forgetting or installation disposal revokes an in-flight auth
+ *   selection: that selection no longer has an account it may send under.
  * - `host-credential-on-wire`: after every rewrite, a header still carried
  *   one of the host's placeholder credentials. Sending it would leak a
  *   non-routable value to the provider and fail with a confusing error.

package/dist/opencode2/install.js

@@ -129,6 +129,9 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
     let warnedUnmarkedSend = false;
     const listeners = new Map();
     let seq = 0;
+    let disposed = false;
+    /** Only active hook calls are held; forgetting never leaves a session tombstone. */
+    const inFlight = new Map();
     const warn = (message, data) => {
         try {
             logger?.warn(message, data);
@@ -200,12 +203,47 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
     const accountOf = (rec) => rec.accountId === undefined
         ? undefined
         : { ...rec.scope, accountId: rec.accountId };
-    const noAccount = (scope) => new OpenCode2AuthError({
+    const noAccount = (scope, message) => new OpenCode2AuthError({
         kind: 'no-account',
         providerID,
         sessionID: scope.sessionID,
         requestKind: scope.kind,
+        ...(message === undefined ? {} : { message }),
     });
+    const revokeSelections = (sessionID) => {
+        inFlight.get(sessionID)?.clear();
+        inFlight.delete(sessionID);
+    };
+    /**
+     * Owns selection through its transport handoff, not just the adapter calls.
+     * Deleting a session's set revokes its old calls without poisoning reuse of
+     * that id. Each await must recheck before calling the adapter or publishing.
+     */
+    const withSelection = async (scope, run) => {
+        const revoked = () => noAccount(scope, `${providerID} ${scope.kind} request has no account: its auth selection was revoked by session forgetting or installation disposal`);
+        if (disposed)
+            throw revoked();
+        let selections = inFlight.get(scope.sessionID);
+        if (!selections) {
+            selections = new Set();
+            inFlight.set(scope.sessionID, selections);
+        }
+        const token = {};
+        selections.add(token);
+        const assertActive = () => {
+            if (!selections.has(token))
+                throw revoked();
+        };
+        try {
+            return await run(assertActive);
+        }
+        finally {
+            selections.delete(token);
+            // An old call may settle after a new call has reused the session id.
+            if (selections.size === 0 && inFlight.get(scope.sessionID) === selections)
+                inFlight.delete(scope.sessionID);
+        }
+    };
     const guard = (scope, headers) => {
         for (const [name, value] of headers) {
             if (forbidden.some((secret) => value.includes(secret))) {
@@ -240,7 +278,7 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
             }
         }
     };
-    const select = async (scope, hook, transport) => {
+    const select = async (scope, hook, assertActive, transport) => {
         const key = keyOf(scope.sessionID, scope.kind);
         const retried = pendingRetries.get(key);
         pendingRetries.delete(key);
@@ -254,10 +292,12 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
                 : { rerouteFrom: retried.rerouteFrom }),
         };
         const accountId = await adapter.chooseAccount(input);
+        assertActive();
         let headers = {};
         let data;
         if (accountId !== undefined) {
             const result = await adapter.accountHeaders({ ...scope, accountId });
+            assertActive();
             if (isHeadersResult(result)) {
                 headers = result.headers;
                 data = result.attempt;
@@ -306,7 +346,7 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
     // of the attempt it started. Choosing here too keeps a request that skipped
     // it from going out under the host credential, and a second send of the
     // same attempt from reusing the first send's attempt.
-    const bind = async (scope, hook, transport, mark) => {
+    const bind = async (scope, hook, transport, mark, assertActive) => {
         const key = keyOf(scope.sessionID, scope.kind);
         let rec = mark === undefined ? undefined : attempts.get(mark);
         if (rec?.key !== key)
@@ -322,7 +362,7 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
             }
         }
         if (!rec || rec.transport !== undefined || rec.ended)
-            rec = await select(scope, hook, transport);
+            rec = await select(scope, hook, assertActive, transport);
         else {
             rec.transport = transport;
             if (rec.attempt)
@@ -443,18 +483,20 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
     };
     const scoped = { providerID };
     const registrations = [];
-    registrations.push(await ctx.session.hook('model.request', async (draft) => {
-        const rec = await select(scopeOf(draft), 'model.request');
+    registrations.push(await ctx.session.hook('model.request', (draft) => withSelection(scopeOf(draft), async (assertActive) => {
+        const rec = await select(scopeOf(draft), 'model.request', assertActive);
+        assertActive();
         if (rec.accountId === undefined)
             throw noAccount(rec.scope);
         applyHeaderEdits(draft.headers, {
             ...rec.headers,
             [ATTEMPT_HEADER]: rec.id,
         });
-    }, scoped));
-    registrations.push(await ctx.session.hook('http.request', async (draft) => {
+    }), scoped));
+    registrations.push(await ctx.session.hook('http.request', (draft) => withSelection(scopeOf(draft), async (assertActive) => {
         const mark = draft.request.headers.get(ATTEMPT_HEADER) ?? undefined;
-        const rec = await bind(scopeOf(draft), 'http.request', 'http', mark);
+        const rec = await bind(scopeOf(draft), 'http.request', 'http', mark, assertActive);
+        assertActive();
         const account = accountOf(rec);
         const attempt = rec.attempt;
         if (!account || !attempt)
@@ -475,6 +517,7 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
                         request,
                         attempt,
                     })) ?? request;
+                assertActive();
             }
             const headers = new Headers(request.headers);
             headers.delete(ATTEMPT_HEADER);
@@ -484,7 +527,7 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
             byRequest.set(final, rec);
             draft.request = final;
         });
-    }, scoped));
+    }), scoped));
     registrations.push(await ctx.session.hook('http.response', async (draft) => {
         const rec = byRequest.get(draft.request);
         if (!rec) {
@@ -554,7 +597,7 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
         if (response !== original)
             draft.response = response;
     }, scoped));
-    registrations.push(await ctx.session.hook('experimental.ws.handshake', async (draft) => {
+    registrations.push(await ctx.session.hook('experimental.ws.handshake', (draft) => withSelection(scopeOf(draft), async (assertActive) => {
         let mark;
         for (const name of Object.keys(draft.headers)) {
             if (name.toLowerCase() !== ATTEMPT_HEADER)
@@ -562,7 +605,8 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
             mark ??= draft.headers[name];
             delete draft.headers[name];
         }
-        const rec = await bind(scopeOf(draft), 'experimental.ws.handshake', 'ws', mark);
+        const rec = await bind(scopeOf(draft), 'experimental.ws.handshake', 'ws', mark, assertActive);
+        assertActive();
         const account = accountOf(rec);
         const attempt = rec.attempt;
         if (!account || !attempt)
@@ -578,7 +622,7 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
                 draft.url = url;
             guard(rec.scope, Object.entries(draft.headers));
         });
-    }, scoped));
+    }), scoped));
     const rewriteFrame = adapter.rewriteWebSocketFrame?.bind(adapter);
     if (rewriteFrame) {
         registrations.push(await ctx.session.hook('experimental.ws.send', async (draft) => {
@@ -624,68 +668,79 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
             return;
         }
         const rec = picked;
-        rec.judged = true;
-        let decision = hostDecision;
-        let reason;
-        let rerouteFrom;
-        const attempt = rec.attempt;
-        if (rec.accountId === undefined || !attempt) {
-            decision = { retry: false };
-            reason = 'no-account';
-        }
-        else if (rec.outputStarted) {
-            // The user has already seen part of this answer; a retry would
-            // send it again.
-            decision = { retry: false };
-            reason = 'output-started';
-        }
-        else {
-            if (!rec.limit) {
-                const signal = adapter.limitFromError?.(draft.error, attempt);
-                if (signal)
-                    noteLimit(rec, signal, 'error');
+        await withSelection(rec.scope, async (assertActive) => {
+            rec.judged = true;
+            let decision = hostDecision;
+            let reason;
+            let rerouteFrom;
+            const attempt = rec.attempt;
+            if (rec.accountId === undefined || !attempt) {
+                decision = { retry: false };
+                reason = 'no-account';
             }
-            // The next `chooseAccount` should see whatever the plugin learnt
-            // from how this attempt ended.
-            if (rec.ended)
-                await rec.ended;
-            if (rec.limit) {
-                await rec.limit.delivered;
-                rec.rerouted = true;
-                rerouteFrom = { accountId: rec.accountId, limit: rec.limit.signal };
-                // No delay: the next attempt goes to another account, and the
-                // host would otherwise wait out the refused account's backoff,
-                // or not retry at all for errors it deems final.
-                decision = { retry: true, delay: 0 };
-                reason = 'reroute';
+            else if (rec.outputStarted) {
+                // The user has already seen part of this answer; a retry would
+                // send it again.
+                decision = { retry: false };
+                reason = 'output-started';
             }
             else {
-                reason = 'host-decides';
+                if (!rec.limit) {
+                    const signal = adapter.limitFromError?.(draft.error, attempt);
+                    if (signal)
+                        noteLimit(rec, signal, 'error');
+                }
+                // The next `chooseAccount` should see whatever the plugin learnt
+                // from how this attempt ended.
+                if (rec.ended) {
+                    await rec.ended;
+                    assertActive();
+                }
+                if (rec.limit) {
+                    await rec.limit.delivered;
+                    assertActive();
+                    rec.rerouted = true;
+                    rerouteFrom = {
+                        accountId: rec.accountId,
+                        limit: rec.limit.signal,
+                    };
+                    // No delay: the next attempt goes to another account, and the
+                    // host would otherwise wait out the refused account's backoff,
+                    // or not retry at all for errors it deems final.
+                    decision = { retry: true, delay: 0 };
+                    reason = 'reroute';
+                }
+                else {
+                    reason = 'host-decides';
+                }
             }
-        }
-        draft.decision = decision;
-        // The host's retry runs `model.request` again for this attempt's
-        // session and kind; that next attempt, and no other attempt of the
-        // session, is told what this one ended with.
-        if (decision.retry && rec.accountId !== undefined) {
-            pendingRetries.set(rec.key, {
-                sessionID: rec.scope.sessionID,
-                accountId: rec.accountId,
-                ...(rerouteFrom === undefined ? {} : { rerouteFrom }),
+            draft.decision = decision;
+            // The host's retry runs `model.request` again for this attempt's
+            // session and kind; that next attempt, and no other attempt of the
+            // session, is told what this one ended with.
+            if (decision.retry && rec.accountId !== undefined) {
+                pendingRetries.set(rec.key, {
+                    sessionID: rec.scope.sessionID,
+                    accountId: rec.accountId,
+                    ...(rerouteFrom === undefined ? {} : { rerouteFrom }),
+                });
+            }
+            await emit('retry', {
+                sessionID: draft.sessionID,
+                ...(rec.accountId === undefined
+                    ? {}
+                    : { accountId: rec.accountId }),
+                kind: rec.scope.kind,
+                attempt: draft.attempt,
+                reason,
+                hostDecision,
+                decision,
+                ...(attempt === undefined ? {} : { handle: attempt }),
             });
-        }
-        await emit('retry', {
-            sessionID: draft.sessionID,
-            ...(rec.accountId === undefined ? {} : { accountId: rec.accountId }),
-            kind: rec.scope.kind,
-            attempt: draft.attempt,
-            reason,
-            hostDecision,
-            decision,
-            ...(attempt === undefined ? {} : { handle: attempt }),
         });
     }, scoped));
     const forgetSession = (sessionID) => {
+        revokeSelections(sessionID);
         for (const rec of [...attempts.values()]) {
             if (rec.scope.sessionID !== sessionID)
                 continue;
@@ -716,7 +771,6 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
             }
         })();
     }
-    let disposed = false;
     return {
         on(event, listener) {
             let set = listeners.get(event);
@@ -741,6 +795,8 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
             if (disposed)
                 return;
             disposed = true;
+            for (const sessionID of inFlight.keys())
+                revokeSelections(sessionID);
             abort.abort();
             for (const rec of attempts.values())
                 abandon(rec, 'the installation was disposed');

package/dist/opencode2/types.d.ts

@@ -381,10 +381,13 @@ export interface OpenCode2AuthInstallation<Q, A = unknown> {
      * handle.
      */
     accountFor(sessionID: string, kind: RequestKind): string | undefined;
-    /** Drops every attempt of a session. Session deletion does this itself. */
+    /**
+     * Drops every attempt and revokes in-flight auth selections of a session.
+     * Session deletion does this itself. Later requests may reuse the session id.
+     */
     forgetSession(sessionID: string): void;
     /** Number of attempts held. */
     readonly size: number;
-    /** Removes every hook and stops listening for session deletion. */
+    /** Removes every hook, revokes in-flight auth and stops listening for session deletion. */
     dispose(): Promise<void>;
 }

package/dist/rpc/rpc-server.js

@@ -293,10 +293,10 @@ export async function startRpcServer(options) {
         token,
         async stop() {
             await new Promise((resolve) => {
-                server.close(() => resolve());
-                // Stop accepting connections before ending requests that may never finish.
+                // Bun's close() disables closeAllConnections(), and a peer sending
+                // incomplete headers may not have reached the tracked connection set.
                 server.closeAllConnections?.();
-                // Bun exposes closeAllConnections but leaves partial requests open.
+                server.close(() => resolve());
                 for (const socket of connections)
                     socket.destroy();
             });

package/dist/store/pool.d.ts

@@ -33,6 +33,10 @@ export interface OpenPoolStoreOptions {
      * provider call or write, checked again under the locks and at commit.
      * Nothing makes such a row bound except `replace`, which starts a new
      * credential epoch and drops what was observed about the old one.
+     * An interrupted add's state-only orphan is recovered only when its stamp
+     * binds the stored and incoming material, including a supplied identity and
+     * an API key's endpoint/header. Otherwise add refuses `unbound-credential`
+     * without writing; `remove(id)` explicitly discards the orphan.
      */
     requireCredentialStamps?: boolean;
     /** Injected clock for leases, refresh stamps and `addedAt`. */

package/dist/store/rows.d.ts

@@ -46,7 +46,7 @@ export type RowToggleOptions = Pick<RowOperationOptions, 'onFailure' | 'extraLoc
 export interface RemoveView {
     /**
      * The row as loaded; undefined when the roster no longer holds the id and
-     * only its state-file entry is left (a removal interrupted between writes).
+     * only its state-file entry is left (an add or removal interrupted between writes).
      */
     row: PoolRow | undefined;
     /** The config file as read under the store locks. */
@@ -70,7 +70,8 @@ export type RemoveResult = {
     /**
      * `removed`: the roster row was dropped (and its state entry, if any).
      * `completed`: only a state-file entry was left, by a removal interrupted
-     * between its config and state writes, and it is now dropped.
+     * between its config and state writes or an add interrupted before its
+     * config write, and it is now dropped.
      */
     outcome: 'removed' | 'completed';
 };

package/dist/store/rows.js

@@ -5,7 +5,7 @@ import { DUPLICATE_IDENTITY_REASON, disableIdentityDuplicates, disableIn, enable
 import { notReadyError, readPool, runOperation, withTransaction, } from './mutate.js';
 import { acceptProviderState, mergedProviderState, planProviderStateIn, providerStateCoverage, replacementProviderState, } from './provider-state.js';
 import { readRow, refusal, requireBound, rowLockSpec, unknownRow, } from './runtime.js';
-import { boundProviderStateDigest, CREDENTIAL_STAMP_KEY, credentialProblem, fingerprintOf, idProblem, isCredentialEpoch, isRecord, nextAddEpochIn, PROVIDER_STATE_KEY, rosterRowFor, rotationStamp, rowLockKey, stampFor, stateFieldsFor, storedCredential, } from './schema.js';
+import { boundProviderStateDigest, buildRawRows, CREDENTIAL_STAMP_KEY, credentialDigest, credentialProblem, dispatchDigest, fingerprintOf, idProblem, isCredentialEpoch, isRecord, nextAddEpochIn, POOL_KEY, PROVIDER_STATE_KEY, parseStamp, providerStateDigest, rosterRowFor, rotationStamp, rowLockKey, stampFor, stateFieldsFor, storedCredential, } from './schema.js';
 import { applyTransition, bindReplacement, TRANSITION_STAMP_KEY, } from './torn.js';
 /** Fields of a state entry that belong to the credential it replaces. */
 const CREDENTIAL_STATE_FIELDS = [
@@ -203,6 +203,74 @@ function identityMismatch(operation, id) {
 function keyChanged(operation, id) {
     return refusal(operation, id, 'row-key-changed', `row ${id}'s wire identity changed while its lock was being taken`, true);
 }
+/**
+ * A strict replay may finish a state-first add, but must not replace what the
+ * interrupted write stamped. Load the orphan against its stamped descriptor
+ * using the ordinary row/stamp machinery, then compare the caller's material.
+ * The roster has no endpoint or identity yet, so neither can be inferred from
+ * the incoming add. Refusal happens before even repairing other torn rows.
+ */
+function matchingInterruptedAdd(rt, tx, input, incoming) {
+    const { id, credential, identity } = input;
+    if (!rt.ctx.requireCredentialStamps ||
+        tx.rosterRow(id) ||
+        !hasStateAccount(tx.state, id))
+        return undefined;
+    const refuse = () => {
+        throw refusal('add', id, 'unbound-credential', `orphan ${id} cannot be bound to this add's material; remove it explicitly before adding different material`);
+    };
+    const account = tx.stateAccount(id);
+    const stamp = parseStamp(account?.[CREDENTIAL_STAMP_KEY]);
+    if (!stamp?.binding || stamp.dispatch === undefined || stamp.replace)
+        return refuse();
+    if (credential.type === 'api' &&
+        (stamp.binding.baseURL === undefined ||
+            stamp.binding.authHeader === undefined))
+        return refuse();
+    const descriptor = credential.type === 'api'
+        ? {
+            ...credential,
+            baseURL: stamp.binding.baseURL,
+            authHeader: stamp.binding.authHeader,
+        }
+        : credential;
+    const [orphan] = buildRawRows({
+        accounts: [
+            rosterRowFor({
+                id,
+                credential: descriptor,
+                identity: stamp.binding.identity,
+                addedAt: 0,
+            }),
+        ],
+        [POOL_KEY]: {
+            rows: { [id]: { credentialEpoch: nextAddEpochIn(tx.config, id) } },
+        },
+    }, tx.state, rt.ctx.codec, rt.ctx.providerState);
+    if (!orphan?.credential || orphan.invalid || orphan.stamp !== 'bound')
+        return refuse();
+    if (identity !== undefined && identity !== orphan.identity)
+        return refuse();
+    if (credentialDigest(credential) !== stamp.digest)
+        return refuse();
+    if (credential.type === 'api') {
+        if (credential.baseURL.trim() !== stamp.binding.baseURL)
+            return refuse();
+        if ((credential.authHeader ?? 'authorization-bearer') !==
+            stamp.binding.authHeader)
+            return refuse();
+    }
+    else if (dispatchDigest(credential) !== stamp.dispatch)
+        return refuse();
+    // Provider-state coverage is separate from credential stamp status. Keep
+    // the interrupted write's value, but never complete a changed bound value.
+    if (stamp.providerState !== undefined && orphan.providerState === undefined)
+        return refuse();
+    if (incoming !== undefined &&
+        providerStateDigest(rt.ctx.providerState, incoming) !== stamp.providerState)
+        return refuse();
+    return orphan;
+}
 export async function addRow(rt, input, options = {}) {
     assertNotInsideHook('add');
     const { ctx } = rt;
@@ -220,9 +288,13 @@ export async function addRow(rt, input, options = {}) {
         for (const extra of options.extraLocks ?? [])
             await locks.acquire(extra);
         return withTransaction(ctx, locks, progress, { operation: 'add', rowId: id }, async (tx) => {
+            const orphan = matchingInterruptedAdd(rt, tx, input, incoming);
+            if (!orphan)
+                await tx.completeTorn();
             const rows = tx.rows();
             const fingerprint = fingerprintOf(credential);
-            const same = rows.find((row) => row.invalid === undefined && row.fingerprint === fingerprint);
+            const same = !orphan &&
+                rows.find((row) => row.invalid === undefined && row.fingerprint === fingerprint);
             if (same) {
                 // Re-adding a secret whose stamp is not proved would rotate it in
                 // and keep the identity and quota recorded beside it, making that
@@ -286,10 +358,13 @@ export async function addRow(rt, input, options = {}) {
             const credentialEpoch = nextAddEpochIn(tx.config, id);
             if (!isCredentialEpoch(credentialEpoch))
                 throw refusal('add', id, 'id-removed', `id ${id} has held every credential epoch and is not reused; add the credential under another id`);
+            const addedIdentity = orphan?.identity ?? identity;
             tx.roster().push(rosterRowFor({
                 id,
                 credential,
-                ...(identity !== undefined ? { identity } : {}),
+                ...(addedIdentity !== undefined
+                    ? { identity: addedIdentity }
+                    : {}),
                 ...(label !== undefined ? { label } : {}),
                 addedAt: ctx.now(),
             }));
@@ -298,17 +373,24 @@ export async function addRow(rt, input, options = {}) {
                 needsFirstReading: credential.type === 'oauth',
             });
             let outcome = 'added';
-            if (identity !== undefined && credential.type === 'oauth') {
+            if (addedIdentity !== undefined && credential.type === 'oauth') {
                 // Same account, different credential: kept on disk, disabled.
                 const holder = rows.find((row) => row.invalid === undefined &&
                     row.type === 'oauth' &&
                     row.enabled &&
-                    row.identity === identity);
+                    row.identity === addedIdentity);
                 if (holder) {
                     disableIn(tx, id, DUPLICATE_IDENTITY_REASON);
                     outcome = 'added-disabled';
                 }
             }
+            if (orphan?.credential) {
+                // The state half is already durable and proved. A config-only
+                // completion preserves the credential, stamp and provider state
+                // byte for byte; a crash leaves either this orphan or a whole row.
+                await tx.commitConfig();
+                return { id, outcome, credential: orphan.credential };
+            }
             // The credential is written first. A crash before the config write
             // then leaves a state entry no roster row names, which no reader
             // loads and `remove` drops; written the other way round, the new
@@ -322,7 +404,7 @@ export async function addRow(rt, input, options = {}) {
             });
             await tx.commitConfig();
             return { id, outcome, credential: stored };
-        });
+        }, { completeTorn: false });
     });
     if (credential.type === 'oauth' &&
         (result.outcome === 'added' || result.outcome === 'completed'))

package/dist/store/torn.js

@@ -186,6 +186,12 @@ export function tornStamps(config, state, codec, options = {}) {
         }
         else if (stamp.credentialEpoch === epoch &&
             stamp.binding.identity === row.identity) {
+            // The lineage digest alone misses an access-token or expiry edit. A
+            // strict store must not repair the config from a transition whose stamp
+            // no longer describes the credential; the row stays unbound instead.
+            if (options.requireCredentialStamps &&
+                stamp.dispatch !== dispatchDigest(row.credential))
+                continue;
             const transition = stampedTransition(account[CREDENTIAL_STAMP_KEY]);
             if (transition &&
                 entryIn(config, row.id)?.[TRANSITION_MARK_KEY] !== transition.mark)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/common-auth",
-  "version": "0.11.1",
+  "version": "0.11.3",
   "description": "Shared code for the CortexKit auth plugins: account pool, quota and routing, commands and auth menu, OpenCode 2 hooks, Claustrum custody, and plumbing (loopback RPC, file locks, logger, sidebar state, TUI preferences and build).",
   "license": "MIT",
   "repository": {