@cortexkit/common-auth 0.3.0 → 0.4.1

package/dist/cachekeep/manager.d.ts

@@ -151,12 +151,18 @@ export interface CacheKeepStatus {
  * Keeps idle prompt caches warm: one target per session holding the latest
  * request body, replayed just before the provider's cache would expire.
  *
- * Bounds, in the order they act: the clock window gates capture and warming
- * (targets captured earlier survive outside it); idle caps prune a target its
- * session stopped using (`sustain` lifts only the main-session cap); the
- * target-count and byte caps evict the least recently touched target; a
- * per-target warm cap retires short-lived sessions; and a failed warm backs
- * that target off without touching the others.
+ * Bounds, in the order they act: a target retires once its last confirmed
+ * cache lifetime ends (`cacheExpiresAt`, set by its capture or its last
+ * successful warm), whatever else holds, because replaying a history whose
+ * cache has expired rebuilds a cold cache instead of keeping a warm one
+ * alive; the clock window gates capture and warming (targets captured earlier
+ * survive outside it until their lifetime ends); idle caps prune a target its
+ * session stopped using (`sustain` lifts only the main-session idle cap, not
+ * the lifetime); the target-count and byte caps evict the least recently
+ * touched target; a per-target warm cap retires short-lived sessions; and a
+ * failed warm backs that target off without touching the others. A retry
+ * after a failure is sent only while the lifetime lasts, so a backoff that
+ * runs past it retires the target instead.
  */
 export declare class CacheKeepManager<M = undefined> {
     private readonly targets;
@@ -203,6 +209,12 @@ export declare class CacheKeepManager<M = undefined> {
      */
     tick(): Promise<void>;
     private runTick;
+    /**
+     * Retires `target` when its last confirmed cache lifetime has ended; true
+     * when it did. Called before every send, since earlier warms in the same
+     * tick, the adapter's account lookup and body build all take time.
+     */
+    private retireIfExpired;
     private isCurrent;
     private view;
     private fail;

package/dist/cachekeep/manager.js

@@ -19,12 +19,18 @@ function errorMessage(error) {
  * Keeps idle prompt caches warm: one target per session holding the latest
  * request body, replayed just before the provider's cache would expire.
  *
- * Bounds, in the order they act: the clock window gates capture and warming
- * (targets captured earlier survive outside it); idle caps prune a target its
- * session stopped using (`sustain` lifts only the main-session cap); the
- * target-count and byte caps evict the least recently touched target; a
- * per-target warm cap retires short-lived sessions; and a failed warm backs
- * that target off without touching the others.
+ * Bounds, in the order they act: a target retires once its last confirmed
+ * cache lifetime ends (`cacheExpiresAt`, set by its capture or its last
+ * successful warm), whatever else holds, because replaying a history whose
+ * cache has expired rebuilds a cold cache instead of keeping a warm one
+ * alive; the clock window gates capture and warming (targets captured earlier
+ * survive outside it until their lifetime ends); idle caps prune a target its
+ * session stopped using (`sustain` lifts only the main-session idle cap, not
+ * the lifetime); the target-count and byte caps evict the least recently
+ * touched target; a per-target warm cap retires short-lived sessions; and a
+ * failed warm backs that target off without touching the others. A retry
+ * after a failure is sent only while the lifetime lasts, so a backoff that
+ * runs past it retires the target instead.
  */
 export class CacheKeepManager {
     targets = new Map();
@@ -233,8 +239,9 @@ export class CacheKeepManager {
     }
     async runTick() {
         this.pruneStale();
-        // Outside the window nothing fires, but captured targets stay so they
-        // warm again when it reopens.
+        // Outside the window nothing fires, but captured targets stay until
+        // their cache lifetime ends, so one still alive when the window reopens
+        // is warmed again.
         const window = this.getWindow?.();
         if (window && !isWithinCacheKeepWindow(window, new Date(this.now()))) {
             return;
@@ -254,6 +261,23 @@ export class CacheKeepManager {
             await this.warm(sessionKey, target);
         }
     }
+    /**
+     * Retires `target` when its last confirmed cache lifetime has ended; true
+     * when it did. Called before every send, since earlier warms in the same
+     * tick, the adapter's account lookup and body build all take time.
+     */
+    retireIfExpired(sessionKey, target) {
+        if (this.now() < target.cacheExpiresAt)
+            return false;
+        this.log?.debug('cachekeep retired target (cache lifetime ended)', {
+            sessionKey,
+            accountId: target.accountId,
+            cacheExpiresAt: target.cacheExpiresAt,
+            failures: target.failures,
+        });
+        this.drop(sessionKey);
+        return true;
+    }
     isCurrent(sessionKey, target) {
         return !this.disposed && this.targets.get(sessionKey) === target;
     }
@@ -286,6 +310,8 @@ export class CacheKeepManager {
         });
     }
     async warm(sessionKey, target) {
+        if (this.retireIfExpired(sessionKey, target))
+            return;
         const view = this.view(sessionKey, target);
         if (this.adapter.activeAccount) {
             let active;
@@ -322,6 +348,8 @@ export class CacheKeepManager {
         }
         if (!this.isCurrent(sessionKey, target))
             return;
+        if (this.retireIfExpired(sessionKey, target))
+            return;
         const signal = AbortSignal.any([
             AbortSignal.timeout(this.warmTimeoutMs),
             this.abortController.signal,
@@ -383,8 +411,10 @@ export class CacheKeepManager {
         const now = this.now();
         const sustain = this.getSustain?.() === true;
         for (const [sessionKey, target] of [...this.targets]) {
-            // Sustain exempts main sessions from the idle cap only; the window,
-            // count, byte and warm caps still apply to them.
+            if (this.retireIfExpired(sessionKey, target))
+                continue;
+            // Sustain exempts main sessions from the idle cap only; the lifetime,
+            // window, count, byte and warm caps still apply to them.
             if (sustain && !target.isSubagent)
                 continue;
             const maxIdleMs = target.maxIdleMs ?? this.idleDefault(target.isSubagent);

package/dist/claustrum/consumer.d.ts

@@ -3,7 +3,7 @@ import type { QuotaObservation } from '../quota/index.js';
 import type { RoutingRow } from '../routing/index.js';
 import { type ClaustrumFamily, type ClaustrumScopedAttempt, type ClaustrumScopedClient, type IdentityParser } from './custody.js';
 import { type ClaustrumLogger } from './errors.js';
-import { type AccountMapper, type VaultRosterFile } from './roster.js';
+import { type AccountMapper, type QuotaReceipt, type VaultRosterFile } from './roster.js';
 export interface ClaustrumConsumerOptions {
     /**
      * The roster file: one row per vault account (route id, credential id,
@@ -26,6 +26,13 @@ export interface ClaustrumConsumerOptions {
     routePrefix?: string;
     mapAccount?: AccountMapper;
     parseIdentity?: IdentityParser;
+    /**
+     * Issue a receipt only when the vault's served reply itself names the
+     * credential id and the roster's account identity (see
+     * `ClaustrumScopedCustody`). Set it for providers whose tokens do not reveal
+     * their account; leave it unset to accept a reply that asserts no identity.
+     */
+    requireAssertion?: boolean;
     /**
      * Fired once per change of the vault's view cursor, including the first
      * roster. A poll that sees the same view does not fire, and neither does a
@@ -85,9 +92,11 @@ export declare class ClaustrumConsumer {
     decline(routeId: string): Promise<void>;
     accept(routeId: string): Promise<void>;
     /**
-     * Store a quota observation for a vault route. Pass the receipt the reading
-     * was taken with, so an observation for a replaced account is dropped.
+     * Store a quota or profile observation for a vault route. The receipt the
+     * reading was taken with is required: the observation lands only while the
+     * route still holds the credential and account that receipt was served for
+     * (see `recordVaultQuota`), so a reading for a replaced account is dropped.
      */
-    recordQuota(routeId: string, observation: QuotaObservation, attempt?: Pick<ClaustrumScopedAttempt, 'accountIdentity'>): Promise<boolean>;
+    recordQuota(routeId: string, observation: QuotaObservation, attempt: QuotaReceipt): Promise<boolean>;
     close(): void;
 }

package/dist/claustrum/consumer.js

@@ -76,6 +76,7 @@ export class ClaustrumConsumer {
                     family: this.#options.family,
                     tokenPath: this.#options.tokenPath,
                     parseIdentity: this.#options.parseIdentity,
+                    requireAssertion: this.#options.requireAssertion,
                     now: this.#options.now,
                     logger: this.#logger,
                 });
@@ -247,17 +248,24 @@ export class ClaustrumConsumer {
         this.#roster = await readVaultRoster(this.#options.rosterPath);
     }
     /**
-     * Store a quota observation for a vault route. Pass the receipt the reading
-     * was taken with, so an observation for a replaced account is dropped.
+     * Store a quota or profile observation for a vault route. The receipt the
+     * reading was taken with is required: the observation lands only while the
+     * route still holds the credential and account that receipt was served for
+     * (see `recordVaultQuota`), so a reading for a replaced account is dropped.
      */
     async recordQuota(routeId, observation, attempt) {
         this.#assertOpen();
         const kept = await recordVaultQuota(this.#options.rosterPath, {
             routeId,
             observation,
-            ...(attempt?.accountIdentity !== undefined && {
+            credentialId: attempt.credentialId,
+            accountIdentitySource: attempt.accountIdentitySource,
+            ...(attempt.accountIdentity !== undefined && {
                 accountIdentity: attempt.accountIdentity,
             }),
+            ...(attempt.expectedAccountIdentity !== undefined && {
+                expectedAccountIdentity: attempt.expectedAccountIdentity,
+            }),
         });
         if (kept)
             this.#roster = await readVaultRoster(this.#options.rosterPath);

package/dist/claustrum/custody.d.ts

@@ -27,10 +27,19 @@ export interface VaultCredential {
     readonly email?: string;
     readonly orgName?: string;
 }
-/** A vault record this consumer could not use, kept for the warning it raises. */
+/**
+ * Why a listed vault record could not be used. A closed set of fixed codes, so
+ * a log line or a roster file that carries one never echoes vault data.
+ */
+export type SkippedVaultReason = 'empty credential id' | 'duplicate credential id' | 'blank account identity' | 'empty state';
+/**
+ * A vault record this consumer could not use. `credentialId` is absent when
+ * the record's id itself was unusable, so nothing can say which account the
+ * record was.
+ */
 export interface SkippedVaultRecord {
     readonly credentialId?: string;
-    readonly reason: string;
+    readonly reason: SkippedVaultReason;
 }
 export interface VaultInventory {
     /**
@@ -47,6 +56,13 @@ export interface ClaustrumScopedIdentity {
     readonly credentialType: VaultCredentialType;
     readonly accountIdentity?: string;
 }
+/**
+ * Where a receipt's `accountIdentity` came from: the vault asserted it in the
+ * served reply, the plugin's `parseIdentity` read it from the served token, or
+ * neither did and it is only the roster's expectation (`none`: no identity at
+ * all).
+ */
+export type AccountIdentitySource = 'asserted' | 'parsed' | 'expected' | 'none';
 /**
  * A receipt: what the vault served for one physical send. Each attempt gets
  * its own. It records the exact record version served, because a 401 for
@@ -55,7 +71,22 @@ export interface ClaustrumScopedIdentity {
 export interface ClaustrumScopedAttempt {
     readonly credentialId: string;
     readonly credentialType: VaultCredentialType;
+    /**
+     * The account this receipt is bound to: the vault's assertion, else the
+     * plugin's parse of the token, else the roster's expectation. Check
+     * `accountIdentitySource` before treating it as proof.
+     */
     readonly accountIdentity?: string;
+    readonly accountIdentitySource: AccountIdentitySource;
+    /** The account the roster row named when this receipt was requested. */
+    readonly expectedAccountIdentity?: string;
+    /** The credential id the vault itself put in the served reply, if any. */
+    readonly assertedCredentialId?: string;
+    /**
+     * The account the vault itself put in the served reply, if any. Never filled
+     * in from the roster or from a token parse.
+     */
+    readonly assertedAccountIdentity?: string;
     /**
      * Kept in memory only and hidden from JSON.stringify and object spreads, so
      * logging a receipt never leaks it. Authorize again for every dispatch and retry.
@@ -98,6 +129,14 @@ export declare class ClaustrumScopedCustody {
         tokenPath?: string;
         readToken?: () => Promise<EnrollmentTokenFile>;
         parseIdentity?: IdentityParser;
+        /**
+         * Issue a receipt only when the vault's served reply itself names the
+         * requested credential id and the roster's (known) account identity. For
+         * providers whose tokens are opaque, where nothing else can prove which
+         * account a token belongs to. Off by default: then an absent assertion is
+         * no claim, and the receipt says where its identity came from.
+         */
+        requireAssertion?: boolean;
         now?: () => number;
         logger?: ClaustrumLogger;
     });
@@ -110,10 +149,12 @@ export declare class ClaustrumScopedCustody {
     discover(signal?: AbortSignal): Promise<VaultInventory>;
     /**
      * Fetch the credential for one physical send and wrap it in a fresh receipt.
-     * Identity is checked only where both sides assert one: the vault's served
-     * identity (or, without one, the plugin's parse of the token) must equal the
-     * roster's when both are present; absence on either side proves nothing and
-     * does not refuse.
+     * The vault's served identity (or, without one, the plugin's parse of the
+     * token) must equal the roster's when both are present. Without
+     * `requireAssertion`, absence on either side proves nothing and does not
+     * refuse; the receipt records what the vault asserted separately from what
+     * the roster expected. With it, a reply that does not itself name the
+     * credential id and the expected account is refused.
      */
     authorize(identity: ClaustrumScopedIdentity, signal?: AbortSignal): Promise<ClaustrumScopedAttempt>;
     /**

package/dist/claustrum/custody.js

@@ -97,6 +97,7 @@ export class ClaustrumScopedCustody {
     #now;
     #family;
     #parseIdentity;
+    #requireAssertion;
     #logger;
     #provenance = new WeakMap();
     #reports = new WeakMap();
@@ -115,6 +116,7 @@ export class ClaustrumScopedCustody {
         this.#client = options.client;
         this.#family = options.family;
         this.#parseIdentity = options.parseIdentity;
+        this.#requireAssertion = options.requireAssertion ?? false;
         this.#now = options.now ?? Date.now;
         this.#logger = options.logger ?? defaultLogger;
     }
@@ -223,16 +225,20 @@ export class ClaustrumScopedCustody {
     }
     /**
      * Fetch the credential for one physical send and wrap it in a fresh receipt.
-     * Identity is checked only where both sides assert one: the vault's served
-     * identity (or, without one, the plugin's parse of the token) must equal the
-     * roster's when both are present; absence on either side proves nothing and
-     * does not refuse.
+     * The vault's served identity (or, without one, the plugin's parse of the
+     * token) must equal the roster's when both are present. Without
+     * `requireAssertion`, absence on either side proves nothing and does not
+     * refuse; the receipt records what the vault asserted separately from what
+     * the roster expected. With it, a reply that does not itself name the
+     * credential id and the expected account is refused.
      */
     async authorize(identity, signal) {
         if (!identity.credentialId)
             throw new ClaustrumConsumerError('route-unavailable', 'Claustrum dispatch requires a credential id');
         // Capture the caller's fields before yielding so a later mutation cannot move the fence.
         const { credentialId, credentialType, accountIdentity } = identity;
+        if (this.#requireAssertion && accountIdentity === undefined)
+            throw new ClaustrumConsumerError('identity-unasserted', 'Claustrum dispatch requires a known account identity');
         const token = await this.#token(signal);
         const served = await this.#call(() => this.#client.getScoped({
             credentialId,
@@ -253,21 +259,45 @@ export class ClaustrumScopedCustody {
             throw new ClaustrumConsumerError('insufficient-validity', 'Claustrum served credential has insufficient validity');
         }
         const accessToken = accessTokenFromMaterial(served.material);
-        const servedIdentity = served.accountId?.trim()
+        const assertedIdentity = served.accountId?.trim()
             ? served.accountId
-            : this.#parseIdentity?.(accessToken);
+            : undefined;
+        if (this.#requireAssertion &&
+            (served.credentialId === undefined || assertedIdentity === undefined))
+            throw new ClaustrumConsumerError('identity-unasserted', 'Claustrum served credential did not assert its identity');
+        const parsedIdentity = assertedIdentity === undefined
+            ? this.#parseIdentity?.(accessToken)
+            : undefined;
+        const servedIdentity = assertedIdentity ?? parsedIdentity;
         if (accountIdentity !== undefined &&
             servedIdentity !== undefined &&
             servedIdentity !== accountIdentity) {
             throw new ClaustrumConsumerError('identity-changed', 'Claustrum served credential identity changed');
         }
-        const resolvedIdentity = accountIdentity ?? servedIdentity;
+        const resolvedIdentity = servedIdentity ?? accountIdentity;
+        const source = assertedIdentity !== undefined
+            ? 'asserted'
+            : parsedIdentity !== undefined
+                ? 'parsed'
+                : accountIdentity !== undefined
+                    ? 'expected'
+                    : 'none';
         const attempt = Object.freeze(Object.defineProperty({
             credentialId,
             credentialType,
             ...(resolvedIdentity !== undefined && {
                 accountIdentity: resolvedIdentity,
             }),
+            accountIdentitySource: source,
+            ...(accountIdentity !== undefined && {
+                expectedAccountIdentity: accountIdentity,
+            }),
+            ...(served.credentialId !== undefined && {
+                assertedCredentialId: served.credentialId,
+            }),
+            ...(assertedIdentity !== undefined && {
+                assertedAccountIdentity: assertedIdentity,
+            }),
             recordVersion: served.recordVersion,
             expiresAtMs,
         }, 'accessToken', { value: accessToken, enumerable: false }));

package/dist/claustrum/errors.d.ts

@@ -4,7 +4,7 @@
  * `code`, a `class` and an `action`), so callers can tell the vault's verdict
  * apart from a check made on this side.
  */
-export type ClaustrumConsumerFailureKind = 'closed' | 'not-enrolled' | 'invalid-token' | 'unavailable' | 'identity-changed' | 'insufficient-validity' | 'invalid-material' | 'not-active' | 'route-unavailable' | 'route-declined' | 'no-receipt' | 'unsafe-file' | 'invalid-state' | 'wrong-consumer' | 'roster-busy' | 'host-slot-login' | 'host-slot-placeholder' | 'placeholder-refresh';
+export type ClaustrumConsumerFailureKind = 'closed' | 'not-enrolled' | 'invalid-token' | 'unavailable' | 'identity-changed' | 'identity-unasserted' | 'insufficient-validity' | 'invalid-material' | 'not-active' | 'route-unavailable' | 'route-declined' | 'no-receipt' | 'unsafe-file' | 'invalid-state' | 'wrong-consumer' | 'roster-busy' | 'host-slot-login' | 'host-slot-placeholder' | 'placeholder-refresh';
 export declare class ClaustrumConsumerError extends Error {
     readonly kind: ClaustrumConsumerFailureKind;
     constructor(kind: ClaustrumConsumerFailureKind, message: string);

package/dist/claustrum/index.d.ts

@@ -2,12 +2,12 @@ import { type ClaustrumClientOptions } from '@cortexkit/claustrum-client';
 import type { ClaustrumScopedClient } from './custody.js';
 export { ClaustrumCredentialError, type ClaustrumReporterSource, type EnrollmentTokenFile, } from '@cortexkit/claustrum-client';
 export { ClaustrumConsumer, type ClaustrumConsumerOptions, type SendOptions, } from './consumer.js';
-export { type ClaustrumFamily, type ClaustrumScopedAttempt, type ClaustrumScopedClient, ClaustrumScopedCustody, type ClaustrumScopedIdentity, decideScopedRetryAfter401, type IdentityParser, isScopedCredentialRotation, type ScopedRetryReason, SERVING_MARGIN_MS, type SkippedVaultRecord, type VaultCredential, type VaultCredentialType, type VaultInventory, } from './custody.js';
+export { type AccountIdentitySource, type ClaustrumFamily, type ClaustrumScopedAttempt, type ClaustrumScopedClient, ClaustrumScopedCustody, type ClaustrumScopedIdentity, decideScopedRetryAfter401, type IdentityParser, isScopedCredentialRotation, type ScopedRetryReason, SERVING_MARGIN_MS, type SkippedVaultReason, type SkippedVaultRecord, type VaultCredential, type VaultCredentialType, type VaultInventory, } from './custody.js';
 export { type ClaustrumEnrollmentClient, type ClaustrumEnrollmentConnection, ClaustrumEnrollmentManager, type ClaustrumEnrollmentPaths, type ClaustrumEnrollmentResetResult, type ClaustrumEnrollmentStatus, classifyEnrollmentError, connectClaustrumEnrollmentClient, type EnrollmentDisposition, enrollmentName, getClaustrumEnrollmentPaths, hostEnrollmentPaths, RETRYABLE_ENROLLMENT_CODES, readClaustrumEnrollmentStatus, readClaustrumEnrollmentToken, resetClaustrumEnrollmentState, TERMINAL_ENROLLMENT_CODES, } from './enrollment.js';
 export { ClaustrumConsumerError, type ClaustrumConsumerFailureKind, type ClaustrumLogger, } from './errors.js';
 export { assertHostSlotMatchesMode, assertNotCustodyPlaceholder, CUSTODY_PLACEHOLDER_PREFIX, classifyHostSlot, custodyPlaceholder, custodyPlaceholderKey, type HostSlotContent, isCustodyPlaceholder, isCustodyPlaceholderValue, } from './host-slot.js';
-export { acceptAccount, type DeclinedAccount, declineAccount, isDeclined, pruneDeclined, } from './interlock.js';
-export { type AccountMapper, acceptVaultRoute, DEFAULT_ROUTE_PREFIX, declineVaultRoute, mutateVaultRoster, type ProjectionOptions, projectVaultRoster, readVaultRoster, recordVaultQuota, refreshVaultRoster, type VaultRosterFile, type VaultRosterRow, vaultRoutingRows, } from './roster.js';
+export { acceptAccount, type DeclinedAccount, declineAccount, isDeclined, } from './interlock.js';
+export { type AccountMapper, acceptVaultRoute, DEFAULT_ROUTE_PREFIX, declineVaultRoute, mutateVaultRoster, type ProjectionOptions, projectVaultRoster, type QuotaReceipt, readVaultRoster, recordVaultQuota, refreshVaultRoster, resolveVaultPrimary, type VaultPrimary, type VaultPrimaryBinding, type VaultPrimaryUnavailableReason, type VaultRosterFile, type VaultRosterRow, vaultRoutingRows, } from './roster.js';
 /**
  * Connect the client that lists and fetches this consumer's vault credentials
  * on the request path. `connectionFile` is required: this library

package/dist/claustrum/index.js

@@ -10,8 +10,8 @@ export { ClaustrumScopedCustody, decideScopedRetryAfter401, isScopedCredentialRo
 export { ClaustrumEnrollmentManager, classifyEnrollmentError, connectClaustrumEnrollmentClient, enrollmentName, getClaustrumEnrollmentPaths, hostEnrollmentPaths, RETRYABLE_ENROLLMENT_CODES, readClaustrumEnrollmentStatus, readClaustrumEnrollmentToken, resetClaustrumEnrollmentState, TERMINAL_ENROLLMENT_CODES, } from './enrollment.js';
 export { ClaustrumConsumerError, } from './errors.js';
 export { assertHostSlotMatchesMode, assertNotCustodyPlaceholder, CUSTODY_PLACEHOLDER_PREFIX, classifyHostSlot, custodyPlaceholder, custodyPlaceholderKey, isCustodyPlaceholder, isCustodyPlaceholderValue, } from './host-slot.js';
-export { acceptAccount, declineAccount, isDeclined, pruneDeclined, } from './interlock.js';
-export { acceptVaultRoute, DEFAULT_ROUTE_PREFIX, declineVaultRoute, mutateVaultRoster, projectVaultRoster, readVaultRoster, recordVaultQuota, refreshVaultRoster, vaultRoutingRows, } from './roster.js';
+export { acceptAccount, declineAccount, isDeclined, } from './interlock.js';
+export { acceptVaultRoute, DEFAULT_ROUTE_PREFIX, declineVaultRoute, mutateVaultRoster, projectVaultRoster, readVaultRoster, recordVaultQuota, refreshVaultRoster, resolveVaultPrimary, vaultRoutingRows, } from './roster.js';
 /**
  * Connect the client that lists and fetches this consumer's vault credentials
  * on the request path. `connectionFile` is required: this library

package/dist/claustrum/interlock.d.ts

@@ -2,28 +2,26 @@
  * The declined-account interlock: the user's "do not use this vault account",
  * kept on the consumer side because the vault has no notion of it.
  *
- * An entry is keyed on the credential id plus the provider identity the
- * credential logged into, never on the record version, so a token refresh
- * cannot lift it. It is sticky whenever either side's identity is unknown: an
- * adapter that makes no identity claim cannot prove the account changed. It
- * lifts on its own only when both identities are known and differ, which
- * means the credential now logs into a different account than the one the
- * user declined.
+ * A decline follows the provider account, not the vault record: an entry made
+ * while the account was known matches any credential id or alias that logs
+ * into that same account, so relabelling, adding an alias or removing and
+ * re-adding the account never lifts it. A credential id that now logs into a
+ * different known account does not match, because that account has its own
+ * policy. While either side's account is unknown the entry falls back to the
+ * credential id, so an adapter that makes no identity claim cannot slip past
+ * it. Never keyed on the record version, so a token refresh cannot lift it.
  */
 export interface DeclinedAccount {
     readonly credentialId: string;
     readonly accountIdentity?: string;
 }
 export declare function isDeclined(entries: readonly DeclinedAccount[], credentialId: string, accountIdentity?: string): boolean;
+export declare function declineAccount(entries: readonly DeclinedAccount[], credentialId: string, accountIdentity?: string): DeclinedAccount[];
 /**
- * Drop entries the vault has proven stale: the same credential id now listed
- * with a known identity that differs from the declined one. Entries for
- * credentials that are not listed stay, so an account that leaves and comes
- * back is still declined.
+ * Lift every entry that declines a row: the row's credential ids (the
+ * representative and its aliases) under the row's account. An entry for a
+ * different known account is left alone even when it names one of these
+ * credential ids, so accepting a replacement never re-enables the account the
+ * user declined.
  */
-export declare function pruneDeclined(entries: readonly DeclinedAccount[], listed: readonly {
-    credentialId: string;
-    accountIdentity?: string;
-}[]): DeclinedAccount[];
-export declare function declineAccount(entries: readonly DeclinedAccount[], credentialId: string, accountIdentity?: string): DeclinedAccount[];
-export declare function acceptAccount(entries: readonly DeclinedAccount[], credentialIds: readonly string[]): DeclinedAccount[];
+export declare function acceptAccount(entries: readonly DeclinedAccount[], credentialIds: readonly string[], accountIdentity?: string): DeclinedAccount[];

package/dist/claustrum/interlock.js

@@ -1,36 +1,29 @@
 function matches(entry, credentialId, accountIdentity) {
-    return (entry.credentialId === credentialId &&
-        (entry.accountIdentity === undefined ||
-            accountIdentity === undefined ||
-            entry.accountIdentity === accountIdentity));
+    if (entry.accountIdentity !== undefined && accountIdentity !== undefined)
+        return entry.accountIdentity === accountIdentity;
+    return entry.credentialId === credentialId;
 }
 export function isDeclined(entries, credentialId, accountIdentity) {
     return entries.some((entry) => matches(entry, credentialId, accountIdentity));
 }
-/**
- * Drop entries the vault has proven stale: the same credential id now listed
- * with a known identity that differs from the declined one. Entries for
- * credentials that are not listed stay, so an account that leaves and comes
- * back is still declined.
- */
-export function pruneDeclined(entries, listed) {
-    return entries.filter((entry) => {
-        const current = listed.find((credential) => credential.credentialId === entry.credentialId);
-        return !(current &&
-            entry.accountIdentity !== undefined &&
-            current.accountIdentity !== undefined &&
-            current.accountIdentity !== entry.accountIdentity);
-    });
-}
 export function declineAccount(entries, credentialId, accountIdentity) {
+    const entry = {
+        credentialId,
+        ...(accountIdentity !== undefined && { accountIdentity }),
+    };
     return [
-        ...entries.filter((entry) => entry.credentialId !== credentialId),
-        {
-            credentialId,
-            ...(accountIdentity !== undefined && { accountIdentity }),
-        },
+        ...entries.filter((existing) => existing.credentialId !== credentialId ||
+            existing.accountIdentity !== accountIdentity),
+        entry,
     ];
 }
-export function acceptAccount(entries, credentialIds) {
-    return entries.filter((entry) => !credentialIds.includes(entry.credentialId));
+/**
+ * Lift every entry that declines a row: the row's credential ids (the
+ * representative and its aliases) under the row's account. An entry for a
+ * different known account is left alone even when it names one of these
+ * credential ids, so accepting a replacement never re-enables the account the
+ * user declined.
+ */
+export function acceptAccount(entries, credentialIds, accountIdentity) {
+    return entries.filter((entry) => !credentialIds.some((id) => matches(entry, id, accountIdentity)));
 }