@cortexkit/common-auth 0.7.0 → 0.9.0

package/dist/store/schema.js

@@ -5,6 +5,15 @@ export const POOL_KEY = 'commonAuthPool';
 export const POOL_SCHEMA_VERSION = 1;
 /** Property of `commonAuthPool` holding the per-row entries, keyed by local id. */
 export const POOL_ROWS_KEY = 'rows';
+/**
+ * Property of `commonAuthPool` (since 0.8.0) holding, per id, the highest
+ * credential epoch a row with that id held when the store last dropped it
+ * from the pool. A row added later under the same id starts past it (see
+ * `nextAddEpochIn`), so an attribution taken for the dropped row never
+ * matches the new one. Older readers ignore it, and older writers keep it
+ * as they keep every pool key they do not know.
+ */
+export const POOL_RETIRED_EPOCHS_KEY = 'retiredEpochs';
 /** The `version` older readers of the same files expect at the top level. */
 export const LEGACY_STORE_VERSION = 1;
 /**
@@ -410,11 +419,15 @@ function credentialFor(raw, stateEntry) {
 export function rosterRowIn(config, id) {
     return rosterOf(config).find((raw) => isRecord(raw) && raw.id === id);
 }
-/** The per-row entries of a config, created (empty) when absent. */
-export function ensureEntries(config) {
+/** The pool object of a config, created (empty) when absent. */
+function ensurePool(config) {
     if (!isRecord(config[POOL_KEY]))
         config[POOL_KEY] = {};
-    const pool = config[POOL_KEY];
+    return config[POOL_KEY];
+}
+/** The per-row entries of a config, created (empty) when absent. */
+export function ensureEntries(config) {
+    const pool = ensurePool(config);
     if (!isRecord(pool[POOL_ROWS_KEY]))
         pool[POOL_ROWS_KEY] = {};
     return pool[POOL_ROWS_KEY];
@@ -433,6 +446,77 @@ export function setEntryIn(config, id, entry) {
         configurable: true,
     });
 }
+/**
+ * The credential epoch recorded for a dropped id (see
+ * `POOL_RETIRED_EPOCHS_KEY`), or undefined when none is. A value that is not
+ * a credential epoch counts as none.
+ */
+export function retiredEpochIn(config, id) {
+    const pool = config[POOL_KEY];
+    if (!isRecord(pool))
+        return undefined;
+    const retired = pool[POOL_RETIRED_EPOCHS_KEY];
+    if (!isRecord(retired) || !Object.hasOwn(retired, id))
+        return undefined;
+    const epoch = retired[id];
+    return isCredentialEpoch(epoch) ? epoch : undefined;
+}
+/**
+ * The epoch a per-row entry claims, read without validating the rest of the
+ * entry, or undefined when it names none a reader would accept.
+ */
+function entryEpochIn(config, id) {
+    const epoch = entryIn(config, id)?.credentialEpoch;
+    return isCredentialEpoch(epoch) ? epoch : undefined;
+}
+/**
+ * The credential epoch `add` gives a new row with this id: one past the
+ * highest epoch the id is known to have held, which is the epoch recorded
+ * when the store dropped it, or the epoch of an entry left behind by a writer
+ * that removed only its roster row; 1 for an id the pool never held.
+ *
+ * An attribution names a row by id and credential epoch (and identity), and
+ * an id is chosen by the plugin, so it is often the same one again (`main`).
+ * Were a re-added row to start at epoch 1 again, an attribution taken for the
+ * removed row's credential would match the new credential exactly, in this
+ * process or any other. Starting past every earlier epoch makes such an
+ * attribution fail as it does after a `replace`. The result may lie past the
+ * safe integers (an id whose last row was at `Number.MAX_SAFE_INTEGER`);
+ * `add` refuses such an id.
+ */
+export function nextAddEpochIn(config, id) {
+    return (Math.max(retiredEpochIn(config, id) ?? 0, entryEpochIn(config, id) ?? 0) + 1);
+}
+/**
+ * Records, in a config being written, the epochs of the ids it drops: for
+ * each, the epoch its entry claims (1 for a row without one, the epoch such a
+ * row is at), kept only when above what is already recorded, so the record
+ * for an id never goes down. Valid recorded values of other ids are kept; a
+ * record that is not an object, or a value in it that is not an epoch, says
+ * nothing and is replaced. An entry whose epoch cannot be read records 1.
+ */
+export function retireEpochsIn(config, dropped) {
+    const ids = [...dropped];
+    if (ids.length === 0)
+        return;
+    const pool = ensurePool(config);
+    const previous = isRecord(pool[POOL_RETIRED_EPOCHS_KEY])
+        ? pool[POOL_RETIRED_EPOCHS_KEY]
+        : {};
+    const next = {};
+    const define = (id, epoch) => Object.defineProperty(next, id, {
+        value: epoch,
+        enumerable: true,
+        writable: true,
+        configurable: true,
+    });
+    for (const [id, epoch] of Object.entries(previous))
+        if (isCredentialEpoch(epoch))
+            define(id, epoch);
+    for (const id of ids)
+        define(id, Math.max(retiredEpochIn(config, id) ?? 0, entryEpochIn(config, id) ?? 1));
+    pool[POOL_RETIRED_EPOCHS_KEY] = next;
+}
 /**
  * Builds the rows of a ready pool from the files exactly as they are, without
  * looking at credential stamps (see `loadRows` for the rows every reader

package/dist/store/torn.js

@@ -1,4 +1,4 @@
-import { disableIdentityDuplicates, disableIn, enableIn, recordIdentityIn, } from './identity.js';
+import { disableIdentityDuplicates, disableIn, enableIn, IDENTITY_CONTRADICTED_REASON_PREFIX, recordIdentityIn, } from './identity.js';
 import { buildRawRows, CREDENTIAL_STAMP_KEY, credentialDigest, dispatchDigest, entryIn, isRecord, parseStamp, rosterRowIn, setEntryIn, } from './schema.js';
 /*
  * A replace changes both files: the state file gets the new credential and
@@ -209,6 +209,13 @@ export function bindReplacement(editor, id, credentialEpoch, binding) {
         needsFirstReading: true,
     };
     delete next.quota;
+    // An explicit identity supplied with a replacement is the adapter's validated
+    // account binding. Clear its quarantine on completion, including crash recovery,
+    // but leave the row disabled until a separate enable.
+    if (binding.identity !== undefined &&
+        typeof next.disabledReason === 'string' &&
+        next.disabledReason.startsWith(IDENTITY_CONTRADICTED_REASON_PREFIX))
+        delete next.disabledReason;
     editor.setEntry(id, next);
     const raw = editor.rosterRow(id);
     if (!raw)

package/dist/tui-build/build-tui.js

@@ -2,7 +2,7 @@ import { createHash } from 'node:crypto';
 import { existsSync, realpathSync } from 'node:fs';
 import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
 import { createRequire } from 'node:module';
-import { basename, dirname, extname, join, relative, resolve } from 'node:path';
+import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep, } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { isBareSpecifier, parseImports } from './walker.js';
 export const runtimeModules = [
@@ -109,6 +109,35 @@ export async function buildTui(entryFile, variant, destinationDir, options = {})
         selector: 'selector.js',
         externals: new Set(),
     };
+    // Every name below is computed from the entry's real directory: an entry
+    // reached through a symlink (macOS's /var -> /private/var temp directory,
+    // a linked checkout) must not make its own siblings look like outside files.
+    const entryDirectory = dirname(realpathSync(entry));
+    const portable = (path) => path.split(sep).join('/');
+    // A shared copy's name must be the same wherever the checkout lives, so it
+    // is derived from a key that holds no absolute path. A file inside an
+    // inlined package is keyed by that package's name and its path within the
+    // package; any other file by its path relative to the entry's directory.
+    // Both are one-to-one: one root per package name (the innermost root wins
+    // when roots nest, so a file always picks the same one), a fixed base for
+    // relative paths, and distinct prefixes for the two kinds. The guard in
+    // `visit` turns the remaining risk, two keys sharing a truncated hash, into
+    // an error instead of one copy silently overwriting another.
+    const namingRoots = [...roots]
+        .map(([name, root]) => ({
+        name,
+        root: existsSync(root) ? realpathSync(root) : root,
+    }))
+        .sort((a, b) => b.root.length - a.root.length);
+    const sharedKey = (source) => {
+        for (const { name, root } of namingRoots) {
+            const path = relative(root, source);
+            if (path && !path.startsWith(`..${sep}`) && !isAbsolute(path))
+                return `package:${name}/${portable(path)}`;
+        }
+        return `path:${portable(relative(entryDirectory, source))}`;
+    };
+    const sharedOwners = new Map();
     const copied = new Map();
     const relativeImport = (from, to) => {
         const path = relative(dirname(from), to).split('\\').join('/');
@@ -116,17 +145,23 @@ export async function buildTui(entryFile, variant, destinationDir, options = {})
     };
     const visit = async (source, shared) => {
         source = realpathSync(source);
-        if (relative(dirname(entry), source).startsWith('../'))
+        if (relative(entryDirectory, source).startsWith(`..${sep}`))
             shared = true;
         const previous = copied.get(source);
         if (previous)
             return previous;
         const extension = variant === 'raw' && extname(source) === '.tsx' ? '.tsx' : '.js';
         const name = shared
-            ? `shared/${createHash('sha256').update(source).digest('hex').slice(0, 16)}-${basename(source).replace(/\.[^.]+$/, '')}${extension}`
-            : relative(dirname(entry), source).replace(/\.[^.]+$/, extension);
+            ? `shared/${createHash('sha256').update(sharedKey(source)).digest('hex').slice(0, 16)}-${basename(source).replace(/\.[^.]+$/, '')}${extension}`
+            : portable(relative(entryDirectory, source)).replace(/\.[^.]+$/, extension);
         if (name.startsWith('../'))
             throw new Error(`Entry dependency escapes source directory: ${source}`);
+        if (shared) {
+            const owner = sharedOwners.get(name);
+            if (owner !== undefined)
+                throw new Error(`Shared module name ${name} is claimed by both ${owner} and ${source}`);
+            sharedOwners.set(name, source);
+        }
         copied.set(source, name);
         let code = await readFile(source, 'utf8');
         if (transform && /\.[jt]sx$/.test(source))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/common-auth",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Shared code for the CortexKit auth plugins: account pool, quota and routing, commands and auth menu, OpenCode 2 hooks, Claustrum custody, and plumbing (loopback RPC, file locks, logger, sidebar state, TUI preferences and build).",
   "license": "MIT",
   "repository": {
@@ -89,16 +89,18 @@
     "format:check": "biome format .",
     "lint": "biome check .",
     "prepublishOnly": "bun run build",
-    "check:ranges": "bun scripts/check-installed-ranges.mjs"
+    "check:ranges": "bun scripts/check-installed-ranges.mjs",
+    "check:claustrum-040": "bun scripts/check-claustrum-040.mjs",
+    "check:opentui-0511": "bun scripts/check-opentui-0511.mjs"
   },
   "dependencies": {
     "jsonc-parser": "^3.3.1"
   },
   "peerDependencies": {
-    "@opentui/core": ">=0.5.12",
-    "@opentui/solid": ">=0.5.12",
+    "@opentui/core": ">=0.5.11",
+    "@opentui/solid": ">=0.5.11",
     "solid-js": "1.9.12",
-    "@cortexkit/claustrum-client": ">=0.5.0",
+    "@cortexkit/claustrum-client": ">=0.4.0",
     "@opencode/plugin": ">=2.0.21"
   },
   "peerDependenciesMeta": {