@cortexkit/common-auth 0.2.2 → 0.2.4

package/dist/auth-menu/index.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/auth-menu/index.js

@@ -0,0 +1,2 @@
+// Placeholder so the export resolves until this subpath is built.
+export {};

package/dist/cachekeep/index.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cachekeep/index.js

@@ -0,0 +1,2 @@
+// Placeholder so the export resolves until this subpath is built.
+export {};

package/dist/claustrum/index.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/claustrum/index.js

@@ -0,0 +1,2 @@
+// Placeholder so the export resolves until this subpath is built.
+export {};

package/dist/commands/index.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/index.js

@@ -0,0 +1,2 @@
+// Placeholder so the export resolves until this subpath is built.
+export {};

package/dist/dump/index.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/dump/index.js

@@ -0,0 +1,2 @@
+// Placeholder so the export resolves until this subpath is built.
+export {};

package/dist/opencode2/index.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/opencode2/index.js

@@ -0,0 +1,2 @@
+// Placeholder so the export resolves until this subpath is built.
+export {};

package/dist/routing/sticky.d.ts

@@ -1,5 +1,5 @@
 import { type ProjectedQuota } from '../quota/projection.js';
-import { type AdmissionInput, type AdmissionRefusal, type AdmissionResult, type WindowRef } from './admission.js';
+import { type AdmissionInput, type AdmissionRefusal, type AdmissionResult, type RoutingRow, type WindowRef } from './admission.js';
 import { type StickyPin } from './pins.js';
 export declare const QUOTA_STALENESS_MS: number;
 export declare const MIN_RESET_HOURS: number;
@@ -63,14 +63,40 @@ export interface StickySelection {
  * configured order, preferring one with an applicable reset credit.
  */
 export declare function selectStickyCandidate(input: StickySelectionInput): StickySelection | undefined;
+/** Reserve percent per window label; a missing label reserves nothing. */
+export type ReservePercent = Readonly<Record<string, number>>;
+/**
+ * Reserve percentages per row: a map keyed by row id, or a function of the
+ * row. A row the map lacks, or for which the function returns undefined,
+ * takes the shared `reservePercent`.
+ */
+export type RowReservePercent = ReadonlyMap<string, ReservePercent> | ((row: RoutingRow) => ReservePercent | undefined);
+/**
+ * What a valid pin does when its row is not dispatched.
+ *
+ * `keep`: the pin is retained whatever kept its row from this request.
+ *
+ * `move-on-confirmed-exhaustion`: the pin moves to the row this request is
+ * dispatched to when its own row was refused as confirmed exhausted (a spent
+ * window with a future reset, or a spent credit budget) or killed by the
+ * killswitch. A refusal for unknown quota (no reading yet, a missing window,
+ * an exhausted reading without a usable reset) and an exclusion (rate-limit
+ * mark, refresh backoff) keep the pin while this request is served elsewhere.
+ * With no admissible row the pin is retained either way.
+ */
+export type RefusedPinPolicy = 'keep' | 'move-on-confirmed-exhaustion';
 export interface StickyRouteInput extends AdmissionInput {
     requestBytes: number;
     /** Bytes already committed per row, for example from other sessions' pins. */
     pendingBytes?: ReadonlyMap<string, number>;
     /** Killswitch verdict per row; a missing row passes. */
     killswitch?: ReadonlyMap<string, boolean>;
-    /** Reserve percent per window label, applied to every row. */
-    reservePercent?: Readonly<Record<string, number>>;
+    /** Reserve percent per window label, for every row without its own. */
+    reservePercent?: ReservePercent;
+    /** Per-row reserves, which replace `reservePercent` for the rows they cover. */
+    rowReservePercent?: RowReservePercent;
+    /** Defaults to `keep`. */
+    refusedPinPolicy?: RefusedPinPolicy;
     resetCreditsApplicable?: ReadonlyMap<string, number>;
     /** The session's current pin, if it has one. */
     pin?: StickyPin;
@@ -80,8 +106,9 @@ export interface StickyRouteInput extends AdmissionInput {
 }
 /**
  * What the caller does with the session's pin: keep it, replace it with
- * `pin`, or drop it. A valid pin is always kept, even when this request was
- * routed elsewhere because its row was refused or excluded.
+ * `pin`, or drop it. Under the default `keep` policy a valid pin is always
+ * kept, even when this request was routed elsewhere because its row was
+ * refused, excluded or killed; `refusedPinPolicy` can move it instead.
  */
 export type PinAction = {
     action: 'retain';

package/dist/routing/sticky.js

@@ -233,6 +233,24 @@ export function routeSticky(input) {
             };
         }
     }
+    // A spent window with a future reset, a spent credit budget and a killswitch
+    // verdict all say the pinned row will not serve until some known later time,
+    // so the pin may move. A row refused for want of a usable reading, or
+    // excluded by a short rate-limit mark or refresh backoff, may serve again on
+    // the next reading, so its pin stays.
+    const pinRefusal = input.pin ? refusals.get(input.pin.accountId) : undefined;
+    const pinMoves = pinValid &&
+        input.pin !== undefined &&
+        input.refusedPinPolicy === 'move-on-confirmed-exhaustion' &&
+        (input.killswitch?.get(input.pin.accountId) === false ||
+            pinRefusal?.reason === 'exhausted' ||
+            pinRefusal?.reason === 'budget-spent');
+    const reserveFor = (row) => {
+        const perRow = typeof input.rowReservePercent === 'function'
+            ? input.rowReservePercent(row)
+            : input.rowReservePercent?.get(row.id);
+        return perRow ?? input.reservePercent ?? {};
+    };
     const scope = input.scope;
     let candidates = input.rows
         .map((row, configuredOrder) => ({ row, configuredOrder }))
@@ -246,7 +264,7 @@ export function routeSticky(input) {
                 ? undefined
                 : (admitted.get(row.id)?.projection ??
                     projectQuota(row.quota, scope)),
-            reservePercent: input.reservePercent ?? {},
+            reservePercent: reserveFor(row),
             configuredOrder,
             ...(credits === undefined ? {} : { resetCreditsApplicable: credits }),
             ...(killswitchPasses === undefined ? {} : { killswitchPasses }),
@@ -284,7 +302,7 @@ export function routeSticky(input) {
             ...(selection.quotaCheckedAt === undefined
                 ? {}
                 : { quotaCheckedAt: selection.quotaCheckedAt }),
-            pin: pinValid
+            pin: pinValid && !pinMoves
                 ? { action: 'retain' }
                 : {
                     action: 'assign',

package/dist/store/errors.d.ts

@@ -1,6 +1,6 @@
 import type { StoredCredential } from './schema.js';
 /** Every library operation that can fail, as named in the failure value. */
-export type PoolOperation = 'initialize' | 'add' | 'replace' | 'rotate' | 'disable' | 'recordIdentity' | 'refresh' | 'pull';
+export type PoolOperation = 'initialize' | 'add' | 'replace' | 'rotate' | 'disable' | 'enable' | 'remove' | 'reorder' | 'recordIdentity' | 'refresh' | 'pull';
 /**
  * How far an operation got before it failed.
  *
@@ -16,7 +16,7 @@ export type PoolFailurePhase = 'before-first-write' | 'after-first-write' | 'pul
  * lock outcomes (a wait that ran out, and a lease found lost); the rest are
  * refusals and failures of the operation itself.
  */
-export type PoolFailureKind = 'lock-contention' | 'lock-ownership' | 'pending-migration' | 'load-error' | 'unknown-row' | 'invalid-row' | 'invalid-input' | 'id-exists' | 'id-removed' | 'type-mismatch' | 'no-credential' | 'row-disabled' | 'row-key-changed' | 'refresh-stamp-ahead' | 'attribution' | 'provider' | 'pull' | 'invalid-quota' | 'after-persist-hook' | 'unexpected';
+export type PoolFailureKind = 'lock-contention' | 'lock-ownership' | 'pending-migration' | 'load-error' | 'unknown-row' | 'invalid-row' | 'invalid-input' | 'id-exists' | 'id-removed' | 'type-mismatch' | 'no-credential' | 'row-disabled' | 'row-protected' | 'duplicate-identity' | 'row-key-changed' | 'invalid-order' | 'refresh-stamp-ahead' | 'attribution' | 'provider' | 'pull' | 'invalid-quota' | 'after-persist-hook' | 'unexpected';
 /**
  * The single failure value of every store operation. `committed` is present
  * only when the operation had already written a credential to the state file

package/dist/store/hooks.d.ts

@@ -9,4 +9,4 @@ export interface PoolLogger {
  * Runs a failure hook. A hook that throws never replaces the failure it was
  * handed: its exception is logged and discarded.
  */
-export declare function callFailureHook<E>(operation: PoolOperation, hook: ((rowId: string, error: E) => void | Promise<void>) | undefined, rowId: string, error: E, logger: PoolLogger | undefined): Promise<void>;
+export declare function callFailureHook<E, R extends string | undefined>(operation: PoolOperation, hook: ((rowId: R, error: E) => void | Promise<void>) | undefined, rowId: R, error: E, logger: PoolLogger | undefined): Promise<void>;

package/dist/store/index.d.ts

@@ -10,7 +10,7 @@ export type { PullHook, PullRequest } from './pull.js';
 export type { ProviderRefresh, ProviderRefreshResult, RefreshOptions, RefreshOutcome, } from './refresh.js';
 export type { LockEvent, PoolLockOptions, PoolLockSpec, } from './refresh-lock.js';
 export { POOL_LOCK_DEFAULTS } from './refresh-lock.js';
-export type { AddInput, AddResult, FailureHook, RowOperationOptions, } from './rows.js';
+export type { AddInput, AddResult, FailureHook, RemoveOptions, RemoveResult, RemoveView, ReorderOptions, ReorderResult, RowOperationOptions, RowToggleOptions, } from './rows.js';
 export type { PullReason } from './runtime.js';
 export type { ApiKeyCredential, OAuthCredential, PoolCredential, PoolRow, QuotaCodec, StoredCredential, } from './schema.js';
 export { fingerprintOf, LEGACY_STORE_VERSION, POOL_KEY, POOL_ROWS_KEY, POOL_SCHEMA_VERSION, REFRESH_STAMP_TOLERANCE_MS, rowLockKey, } from './schema.js';

package/dist/store/mutate.d.ts

@@ -76,10 +76,18 @@ export declare class Transaction {
     roster(): unknown[];
     /** The first roster row with this id (the one the pool loads). */
     rosterRow(id: string): Record<string, unknown> | undefined;
+    /**
+     * Drops every roster row carrying this id. The row's per-row entry goes with
+     * it on the next `commitConfig`, which drops entries for ids no longer in
+     * the roster. Returns how many roster rows were dropped.
+     */
+    dropRosterRows(id: string): number;
     entries(): Record<string, unknown>;
     entry(id: string): Record<string, unknown> | undefined;
     setEntry(id: string, entry: Record<string, unknown>): void;
     stateAccount(id: string): Record<string, unknown> | undefined;
+    /** Drops the row's credential and runtime fields from the state file's accounts. */
+    dropStateAccount(id: string): void;
     setStateAccount(id: string, fields: Record<string, unknown>): void;
     /**
      * Writes the config: legacy `version: 1` and the legacy roster beside
@@ -119,6 +127,7 @@ export declare function toFailure(error: unknown, operation: PoolOperation, rowI
  * The frame every lock-holding operation runs in: failures are mapped onto
  * the failure value, handed to the failure hook while the outer locks are
  * still held (the store locks are already released), and rethrown; every
- * lock is released afterwards.
+ * lock is released afterwards. `rowId` is undefined for an operation that
+ * names no row (`reorder`).
  */
-export declare function runOperation<T>(ctx: StoreContext, operation: PoolOperation, rowId: string, onFailure: ((rowId: string, error: PoolOperationError) => void | Promise<void>) | undefined, body: (locks: LockStack, progress: Progress) => Promise<T>): Promise<T>;
+export declare function runOperation<T, R extends string | undefined = string>(ctx: StoreContext, operation: PoolOperation, rowId: R, onFailure: ((rowId: R, error: PoolOperationError) => void | Promise<void>) | undefined, body: (locks: LockStack, progress: Progress) => Promise<T>): Promise<T>;

package/dist/store/mutate.js

@@ -94,6 +94,17 @@ export class Transaction {
     rosterRow(id) {
         return this.roster().find((raw) => isRecord(raw) && raw.id === id);
     }
+    /**
+     * Drops every roster row carrying this id. The row's per-row entry goes with
+     * it on the next `commitConfig`, which drops entries for ids no longer in
+     * the roster. Returns how many roster rows were dropped.
+     */
+    dropRosterRows(id) {
+        const roster = this.roster();
+        const kept = roster.filter((raw) => !(isRecord(raw) && raw.id === id));
+        this.config.accounts = kept;
+        return roster.length - kept.length;
+    }
     entries() {
         if (!isRecord(this.config[POOL_KEY]))
             this.config[POOL_KEY] = {};
@@ -120,6 +131,11 @@ export class Transaction {
         const entry = Object.hasOwn(accounts, id) ? accounts[id] : undefined;
         return isRecord(entry) ? entry : undefined;
     }
+    /** Drops the row's credential and runtime fields from the state file's accounts. */
+    dropStateAccount(id) {
+        if (isRecord(this.state.accounts) && Object.hasOwn(this.state.accounts, id))
+            delete this.state.accounts[id];
+    }
     setStateAccount(id, fields) {
         if (!isRecord(this.state.accounts))
             this.state.accounts = {};
@@ -319,7 +335,8 @@ export function toFailure(error, operation, rowId, progress) {
  * The frame every lock-holding operation runs in: failures are mapped onto
  * the failure value, handed to the failure hook while the outer locks are
  * still held (the store locks are already released), and rethrown; every
- * lock is released afterwards.
+ * lock is released afterwards. `rowId` is undefined for an operation that
+ * names no row (`reorder`).
  */
 export async function runOperation(ctx, operation, rowId, onFailure, body) {
     const locks = new LockStack(ctx.lockDefaults, ctx.lockEnv);

package/dist/store/pool.d.ts

@@ -5,7 +5,7 @@ import { type HoldPoint, type InitializeOutcome, type StoreContext } from './mut
 import { type PullHook } from './pull.js';
 import { type ProviderRefresh, type RefreshOptions, type RefreshOutcome } from './refresh.js';
 import { type LockEnvironment, type PoolLockOptions, type PoolLockSpec } from './refresh-lock.js';
-import { type AddInput, type AddResult, type RowOperationOptions } from './rows.js';
+import { type AddInput, type AddResult, type RemoveOptions, type RemoveResult, type ReorderOptions, type ReorderResult, type RowOperationOptions, type RowToggleOptions } from './rows.js';
 import { type PoolCredential, type PoolRow, type QuotaCodec, type StoredCredential } from './schema.js';
 export interface OpenPoolStoreOptions {
     /** The provider every row of this pool belongs to; keys the provider-wide lock. */
@@ -80,9 +80,34 @@ export interface PoolStore {
         id: string;
         credential: StoredCredential;
     }>;
-    disable(id: string, reason: string, options?: Pick<RowOperationOptions, 'onFailure'>): Promise<{
+    /**
+     * Sets `enabled: false` and the entry's `disabledReason`. Takes the row
+     * lock, then `extraLocks`, then the store locks (the row lock and
+     * `extraLocks` since 0.2.3).
+     */
+    disable(id: string, reason: string, options?: RowToggleOptions): Promise<{
+        id: string;
+    }>;
+    /**
+     * Clears `enabled: false` and `disabledReason` (since 0.2.3); refuses with
+     * `duplicate-identity` when another enabled OAuth row holds the row's
+     * identity. Locks as `disable`.
+     */
+    enable(id: string, options?: RowToggleOptions): Promise<{
         id: string;
     }>;
+    /**
+     * Deletes the roster row, its per-row entry and its state-file credential
+     * (since 0.2.3). Locks as `disable`; `protect` can refuse the id.
+     */
+    remove(id: string, options?: RemoveOptions): Promise<RemoveResult>;
+    /**
+     * Sets the roster order (since 0.2.4) in one config write. `ids` must name
+     * every roster id exactly once; anything else refuses with `invalid-order`
+     * and writes nothing. Takes `extraLocks`, then the store locks; no row or
+     * provider-wide lock. Roster rows and their entries are left unchanged.
+     */
+    reorder(ids: readonly string[], options?: ReorderOptions): Promise<ReorderResult>;
     recordIdentity(id: string, identity: string, options?: RowOperationOptions): Promise<{
         id: string;
         disabled: string[];

package/dist/store/pool.js

@@ -3,7 +3,7 @@ import { initializePool, readPool, } from './mutate.js';
 import { PullScheduler } from './pull.js';
 import { refreshRow, } from './refresh.js';
 import { POOL_LOCK_DEFAULTS, } from './refresh-lock.js';
-import { addRow, disableRow, recordRowIdentity, replaceRow, rotateRow, } from './rows.js';
+import { addRow, disableRow, enableRow, recordRowIdentity, removeRow, reorderRows, replaceRow, rotateRow, } from './rows.js';
 import { POOL_SCHEMA_VERSION, } from './schema.js';
 /**
  * Process-wide memory per config file: ids whose per-row entry a library
@@ -92,6 +92,9 @@ export function openPoolStore(options) {
         replace: (id, credential, input, callOptions) => replaceRow(rt, id, credential, input, callOptions),
         rotate: (id, credential, input, callOptions) => rotateRow(rt, id, credential, input, callOptions),
         disable: (id, reason, callOptions) => disableRow(rt, id, reason, callOptions),
+        enable: (id, callOptions) => enableRow(rt, id, callOptions),
+        remove: (id, callOptions) => removeRow(rt, id, callOptions),
+        reorder: (ids, callOptions) => reorderRows(rt, ids, callOptions),
         recordIdentity: (id, identity, callOptions) => recordRowIdentity(rt, id, identity, callOptions),
         refresh: (id, provider, callOptions) => refreshRow(rt, id, provider, callOptions),
         recordQuota: (id, attribution, observation) => recordQuota(rt, id, attribution, observation),

package/dist/store/rows.d.ts

@@ -1,8 +1,8 @@
-import type { PoolOperationError } from './errors.js';
+import { PoolOperationError } from './errors.js';
 import { type Transaction } from './mutate.js';
 import type { PoolLockSpec } from './refresh-lock.js';
 import { type StoreRuntime } from './runtime.js';
-import { type PoolCredential, type StoredCredential } from './schema.js';
+import { type PoolCredential, type PoolRow, type StoredCredential } from './schema.js';
 export type FailureHook = (rowId: string, error: PoolOperationError) => void | Promise<void>;
 export interface RowOperationOptions {
     /** Called once, awaited, on every non-success path, before locks release. */
@@ -17,6 +17,63 @@ export interface RowOperationOptions {
      */
     extraLocks?: readonly PoolLockSpec[];
 }
+/**
+ * Options of `disable`, `enable` and `remove`. The provider-wide lock guards
+ * changes to the recorded identity a row lock is named by; none of these
+ * three records an identity, so none takes it. The extra locks are taken
+ * where every other row write takes them, after the row lock and before the
+ * store locks.
+ */
+export type RowToggleOptions = Pick<RowOperationOptions, 'onFailure' | 'extraLocks'>;
+/** What a `remove` protect predicate is shown, read under every lock. */
+export interface RemoveView {
+    /**
+     * The row as loaded; undefined when the roster no longer holds the id and
+     * only its state-file entry is left (a removal interrupted between writes).
+     */
+    row: PoolRow | undefined;
+    /** The config file as read under the store locks. */
+    config: Readonly<Record<string, unknown>>;
+    /** The state file as read under the store locks. */
+    state: Readonly<Record<string, unknown>>;
+}
+export interface RemoveOptions extends RowToggleOptions {
+    /**
+     * Awaited under every lock before anything is written; a reason refuses
+     * the removal (kind `row-protected`) with both files unchanged. The store
+     * keeps no record of a plugin's in-flight work, so this is where a plugin
+     * refuses an id it reserves or one its own pending-operation record (kept
+     * in the config or state file) still names: reading that record from the
+     * locked files here cannot race a writer that holds the store locks.
+     */
+    protect?: (id: string, view: RemoveView) => string | undefined | Promise<string | undefined>;
+}
+export type RemoveResult = {
+    id: string;
+    /**
+     * `removed`: the roster row was dropped (and its state entry, if any).
+     * `completed`: only a state-file entry was left, by a removal interrupted
+     * between its config and state writes, and it is now dropped.
+     */
+    outcome: 'removed' | 'completed';
+};
+/**
+ * Options of `reorder`. It names no row, so its failure hook is handed only
+ * the failure; it takes no row lock and no provider-wide lock, so the extra
+ * locks are taken first, then the store locks.
+ */
+export interface ReorderOptions {
+    /** Called once, awaited, on every non-success path, before the extra locks release. */
+    onFailure?: (error: PoolOperationError) => void | Promise<void>;
+    /** Locks taken, in this order, before the store locks. */
+    extraLocks?: readonly PoolLockSpec[];
+}
+export type ReorderResult = {
+    /** The roster order now on disk. */
+    ids: string[];
+    /** `unchanged` when the roster was already in this order; nothing was written. */
+    outcome: 'reordered' | 'unchanged';
+};
 export interface AddInput {
     id: string;
     credential: PoolCredential;
@@ -51,9 +108,44 @@ export declare function rotateRow(rt: StoreRuntime, id: string, credential: Pool
     id: string;
     credential: StoredCredential;
 }>;
-export declare function disableRow(rt: StoreRuntime, id: string, reason: string, options?: Pick<RowOperationOptions, 'onFailure'>): Promise<{
+/**
+ * Marks a row disabled. Since 0.2.3 it takes the row lock and the caller's
+ * extra locks before the store locks, as the other row writes do, so it waits
+ * for a refresh of the row instead of landing during its provider call.
+ */
+export declare function disableRow(rt: StoreRuntime, id: string, reason: string, options?: RowToggleOptions): Promise<{
     id: string;
 }>;
+/**
+ * Clears a row's `enabled: false` and its `disabledReason` in one config
+ * write. An OAuth row whose recorded identity another enabled OAuth row holds
+ * stays disabled and the call refuses (`duplicate-identity`): the same rule
+ * that makes `add` store such a row disabled. Enabling a row that is already
+ * enabled writes nothing.
+ */
+export declare function enableRow(rt: StoreRuntime, id: string, options?: RowToggleOptions): Promise<{
+    id: string;
+}>;
+/**
+ * Deletes a row: its roster row and per-row entry (quota, epoch; the identity
+ * lives in the roster row) in one config write, then its credential and
+ * runtime fields in one state write. The config goes first, so a crash
+ * between the two leaves a row every reader already sees as removed, with
+ * only an orphaned state entry that no reader loads; calling `remove` again
+ * drops that entry (`completed`). As with every id the store drops, the id is
+ * not reused by `add` in this process.
+ */
+export declare function removeRow(rt: StoreRuntime, id: string, options?: RemoveOptions): Promise<RemoveResult>;
+/**
+ * Sets the roster order in one config write. `ids` must name every roster id
+ * exactly once; anything else refuses (`invalid-order`) before writing. The
+ * roster rows, the per-row entries and the state file are left as they are:
+ * only the order of the legacy `accounts` array changes, which older readers
+ * load as is. It takes the extra locks, then the store locks, and no row or
+ * provider-wide lock, since no row's credential, identity or quota changes.
+ * An order equal to the current one writes nothing.
+ */
+export declare function reorderRows(rt: StoreRuntime, ids: readonly string[], options?: ReorderOptions): Promise<ReorderResult>;
 export declare function recordRowIdentity(rt: StoreRuntime, id: string, identity: string, options?: RowOperationOptions): Promise<{
     id: string;
     disabled: string[];

package/dist/store/rows.js

@@ -1,6 +1,7 @@
-import { assertNotInsideHook } from './hooks.js';
+import { PoolOperationError } from './errors.js';
+import { assertNotInsideHook, runInsideHook } from './hooks.js';
 import { DUPLICATE_IDENTITY_REASON, disableIdentityDuplicates, disableIn, recordIdentityIn, } from './identity.js';
-import { runOperation, withTransaction } from './mutate.js';
+import { notReadyError, readPool, runOperation, withTransaction, } from './mutate.js';
 import { readRow, refusal, rowLockSpec, unknownRow, } from './runtime.js';
 import { credentialProblem, fingerprintOf, idProblem, isRecord, rosterRowFor, rotationStamp, rowLockKey, stateFieldsFor, storedCredential, } from './schema.js';
 /** Fields of a state entry that belong to the credential it replaces. */
@@ -226,15 +227,226 @@ export async function rotateRow(rt, id, credential, input = {}, options = {}) {
         });
     });
 }
+/**
+ * Marks a row disabled. Since 0.2.3 it takes the row lock and the caller's
+ * extra locks before the store locks, as the other row writes do, so it waits
+ * for a refresh of the row instead of landing during its provider call.
+ */
 export async function disableRow(rt, id, reason, options = {}) {
     assertNotInsideHook('disable');
-    return runOperation(rt.ctx, 'disable', id, options.onFailure, async (locks, progress) => withTransaction(rt.ctx, locks, progress, { operation: 'disable', rowId: id }, async (tx) => {
-        if (!tx.rosterRow(id))
-            throw unknownRow('disable', id);
-        disableIn(tx, id, reason);
-        await tx.commitConfig();
-        return { id };
-    }));
+    return runOperation(rt.ctx, 'disable', id, options.onFailure, async (locks, progress) => {
+        const { row: seen } = await readRow(rt, 'disable', id);
+        await locks.acquire(rowLockSpec(rt, seen));
+        for (const extra of options.extraLocks ?? [])
+            await locks.acquire(extra);
+        return withTransaction(rt.ctx, locks, progress, { operation: 'disable', rowId: id }, async (tx) => {
+            const row = tx.row(id);
+            if (!row || !tx.rosterRow(id))
+                throw unknownRow('disable', id);
+            if (rowLockKey(row) !== rowLockKey(seen))
+                throw keyChanged('disable', id);
+            disableIn(tx, id, reason);
+            await tx.commitConfig();
+            return { id };
+        });
+    });
+}
+/**
+ * Clears a row's `enabled: false` and its `disabledReason` in one config
+ * write. An OAuth row whose recorded identity another enabled OAuth row holds
+ * stays disabled and the call refuses (`duplicate-identity`): the same rule
+ * that makes `add` store such a row disabled. Enabling a row that is already
+ * enabled writes nothing.
+ */
+export async function enableRow(rt, id, options = {}) {
+    assertNotInsideHook('enable');
+    return runOperation(rt.ctx, 'enable', id, options.onFailure, async (locks, progress) => {
+        const { row: seen } = await readRow(rt, 'enable', id);
+        await locks.acquire(rowLockSpec(rt, seen));
+        for (const extra of options.extraLocks ?? [])
+            await locks.acquire(extra);
+        return withTransaction(rt.ctx, locks, progress, { operation: 'enable', rowId: id }, async (tx) => {
+            const row = requireUsableRow('enable', id, tx.row(id));
+            if (rowLockKey(row) !== rowLockKey(seen))
+                throw keyChanged('enable', id);
+            if (row.enabled && row.disabledReason === undefined)
+                return { id };
+            if (row.type === 'oauth' && row.identity !== undefined) {
+                const holder = tx
+                    .rows()
+                    .find((other) => other.id !== id &&
+                    other.invalid === undefined &&
+                    other.type === 'oauth' &&
+                    other.enabled &&
+                    other.identity === row.identity);
+                if (holder)
+                    throw refusal('enable', id, 'duplicate-identity', `row ${holder.id} is enabled with the same identity as row ${id}`);
+            }
+            const raw = tx.rosterRow(id);
+            raw.enabled = true;
+            const entry = tx.entry(id);
+            if (entry && 'disabledReason' in entry) {
+                const next = { ...entry };
+                delete next.disabledReason;
+                tx.setEntry(id, next);
+            }
+            await tx.commitConfig();
+            return { id };
+        });
+    });
+}
+/**
+ * Deletes a row: its roster row and per-row entry (quota, epoch; the identity
+ * lives in the roster row) in one config write, then its credential and
+ * runtime fields in one state write. The config goes first, so a crash
+ * between the two leaves a row every reader already sees as removed, with
+ * only an orphaned state entry that no reader loads; calling `remove` again
+ * drops that entry (`completed`). As with every id the store drops, the id is
+ * not reused by `add` in this process.
+ */
+export async function removeRow(rt, id, options = {}) {
+    assertNotInsideHook('remove');
+    const { ctx } = rt;
+    return runOperation(ctx, 'remove', id, options.onFailure, async (locks, progress) => {
+        // Only a non-string or empty id is refused: a roster row whose id the
+        // older readers would trim is invalid, and removing it is a repair.
+        if (typeof id !== 'string' || id.length === 0)
+            throw refusal('remove', id, 'invalid-input', 'id must be non-empty');
+        const result = await readPool(ctx);
+        if (result.status !== 'ready')
+            throw notReadyError(result, 'remove', id);
+        const seen = result.rows.find((row) => row.id === id);
+        if (!seen && !hasStateAccount(result.state, id))
+            throw unknownRow('remove', id);
+        const seenKey = rowLockKey(seen ?? { id });
+        await locks.acquire(rowLockSpec(rt, seen ?? { id }));
+        for (const extra of options.extraLocks ?? [])
+            await locks.acquire(extra);
+        return withTransaction(ctx, locks, progress, { operation: 'remove', rowId: id }, async (tx) => {
+            const row = tx.row(id);
+            const orphan = hasStateAccount(tx.state, id);
+            if (!row && !orphan)
+                throw unknownRow('remove', id);
+            if (rowLockKey(row ?? { id }) !== seenKey)
+                throw keyChanged('remove', id);
+            const protect = options.protect;
+            if (protect) {
+                const view = {
+                    row,
+                    config: tx.snapshot.config,
+                    state: tx.snapshot.state,
+                };
+                const reason = await runInsideHook('remove', () => protect(id, view));
+                if (reason !== undefined)
+                    throw refusal('remove', id, 'row-protected', reason);
+            }
+            if (row) {
+                tx.dropRosterRows(id);
+                await tx.commitConfig();
+            }
+            if (orphan) {
+                tx.dropStateAccount(id);
+                await tx.commitState();
+            }
+            return { id, outcome: row ? 'removed' : 'completed' };
+        });
+    });
+}
+function hasStateAccount(state, id) {
+    const accounts = state.accounts;
+    return isRecord(accounts) && Object.hasOwn(accounts, id);
+}
+/** The id a roster row carries, or undefined for a row that names none. */
+function rosterIdOf(raw) {
+    return isRecord(raw) && typeof raw.id === 'string' ? raw.id : undefined;
+}
+/**
+ * Why `ids` is not an order of this roster: it must name every distinct
+ * roster id exactly once and nothing else.
+ */
+function orderProblem(roster, ids) {
+    if (!Array.isArray(ids))
+        return 'ids must be an array of roster ids';
+    const rosterIds = new Set();
+    for (const raw of roster) {
+        const id = rosterIdOf(raw);
+        if (id !== undefined)
+            rosterIds.add(id);
+    }
+    const given = new Set();
+    for (const id of ids) {
+        if (typeof id !== 'string')
+            return 'ids must be an array of roster ids';
+        if (given.has(id))
+            return `id ${id} appears more than once`;
+        if (!rosterIds.has(id))
+            return `id ${id} is not in the roster`;
+        given.add(id);
+    }
+    const missing = [...rosterIds].filter((id) => !given.has(id));
+    if (missing.length > 0)
+        return `the order leaves out roster id(s) ${missing.join(', ')}`;
+    return undefined;
+}
+/**
+ * The roster in the new order. Every roster row is kept as the same object,
+ * so its serialized bytes are unchanged. Rows that carry an id fill the
+ * positions such rows held before, in the order of `ids`; a second row with
+ * an already-seen id (invalid, but preserved) travels right after the first.
+ * A row that names no id cannot be ordered by id, so it keeps its position.
+ */
+function reorderedRoster(roster, ids) {
+    const byId = new Map();
+    for (const raw of roster) {
+        const id = rosterIdOf(raw);
+        if (id === undefined)
+            continue;
+        const group = byId.get(id);
+        if (group)
+            group.push(raw);
+        else
+            byId.set(id, [raw]);
+    }
+    const sequence = ids.flatMap((id) => byId.get(id) ?? []);
+    let next = 0;
+    return roster.map((raw) => rosterIdOf(raw) === undefined ? raw : sequence[next++]);
+}
+/**
+ * Sets the roster order in one config write. `ids` must name every roster id
+ * exactly once; anything else refuses (`invalid-order`) before writing. The
+ * roster rows, the per-row entries and the state file are left as they are:
+ * only the order of the legacy `accounts` array changes, which older readers
+ * load as is. It takes the extra locks, then the store locks, and no row or
+ * provider-wide lock, since no row's credential, identity or quota changes.
+ * An order equal to the current one writes nothing.
+ */
+export async function reorderRows(rt, ids, options = {}) {
+    assertNotInsideHook('reorder');
+    const { ctx } = rt;
+    const onFailure = options.onFailure;
+    return runOperation(ctx, 'reorder', undefined, onFailure && ((_rowId, error) => onFailure(error)), async (locks, progress) => {
+        for (const extra of options.extraLocks ?? [])
+            await locks.acquire(extra);
+        return withTransaction(ctx, locks, progress, { operation: 'reorder', rowId: undefined }, async (tx) => {
+            const roster = tx.roster();
+            const problem = orderProblem(roster, ids);
+            if (problem)
+                throw new PoolOperationError({
+                    operation: 'reorder',
+                    phase: 'before-first-write',
+                    retryable: false,
+                    kind: 'invalid-order',
+                    message: problem,
+                });
+            const order = [...ids];
+            const next = reorderedRoster(roster, order);
+            if (next.every((raw, index) => raw === roster[index]))
+                return { ids: order, outcome: 'unchanged' };
+            tx.config.accounts = next;
+            await tx.commitConfig();
+            return { ids: order, outcome: 'reordered' };
+        });
+    });
 }
 export async function recordRowIdentity(rt, id, identity, options = {}) {
     assertNotInsideHook('recordIdentity');

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cortexkit/common-auth",
-  "version": "0.2.2",
-  "description": "Shared plumbing for the CortexKit auth plugins: loopback RPC, file locks and atomic writes, logger, sidebar state file, TUI preferences and TUI build.",
+  "version": "0.2.4",
+  "description": "Shared code for the CortexKit auth plugins: account pool, quota and routing, commands and auth menu, OpenCode 2 hooks, Claustrum custody, and plumbing (loopback RPC, file locks, logger, sidebar state, TUI preferences and build).",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -51,6 +51,30 @@
     "./routing": {
       "types": "./dist/routing/index.d.ts",
       "import": "./dist/routing/index.js"
+    },
+    "./commands": {
+      "types": "./dist/commands/index.d.ts",
+      "import": "./dist/commands/index.js"
+    },
+    "./auth-menu": {
+      "types": "./dist/auth-menu/index.d.ts",
+      "import": "./dist/auth-menu/index.js"
+    },
+    "./opencode2": {
+      "types": "./dist/opencode2/index.d.ts",
+      "import": "./dist/opencode2/index.js"
+    },
+    "./claustrum": {
+      "types": "./dist/claustrum/index.d.ts",
+      "import": "./dist/claustrum/index.js"
+    },
+    "./cachekeep": {
+      "types": "./dist/cachekeep/index.d.ts",
+      "import": "./dist/cachekeep/index.js"
+    },
+    "./dump": {
+      "types": "./dist/dump/index.d.ts",
+      "import": "./dist/dump/index.js"
     }
   },
   "files": [
@@ -73,7 +97,9 @@
   "peerDependencies": {
     "@opentui/core": ">=0.5.12",
     "@opentui/solid": ">=0.5.12",
-    "solid-js": "1.9.12"
+    "solid-js": "1.9.12",
+    "@cortexkit/claustrum-client": ">=0.5.0",
+    "@opencode/plugin": ">=2.0.21"
   },
   "peerDependenciesMeta": {
     "@opentui/core": {
@@ -84,10 +110,18 @@
     },
     "solid-js": {
       "optional": true
+    },
+    "@cortexkit/claustrum-client": {
+      "optional": true
+    },
+    "@opencode/plugin": {
+      "optional": true
     }
   },
   "devDependencies": {
     "@biomejs/biome": "2.5.14",
+    "@cortexkit/claustrum-client": "0.5.0",
+    "@opencode/plugin": "2.0.21",
     "@opentui/core": ">=0.5.12",
     "@opentui/solid": ">=0.5.12",
     "@tsconfig/bun": "1.0.11",