@cortexkit/common-auth 0.8.0 → 0.9.0

package/dist/logger/redact.js

@@ -1,6 +1,18 @@
 const SECRET_KEY_EXACT = /^(authorization|x-api-key|cookie|set-cookie|refresh|access|token)$/i;
 const TOKEN_VALUE = /\b(Bearer\s+[\w.-]+|sk-[\w-]+|eyJ[\w.-]+)\b|ckh_[A-Za-z0-9_-]{20,}/g;
 const MASK = '***REDACTED***';
+// How many errors deep a cause chain is followed. A chain this long is
+// already unreadable in a log line, and an unbounded one (each cause a fresh
+// object, so the cycle check never trips) must not grow the line forever.
+const MAX_ERROR_DEPTH = 8;
+// Error's own fields are non-enumerable, so a plain entry walk renders an
+// Error as `{}` and the name, message and stack a plugin logged are lost.
+// The tag check also recognises an Error from another realm (a worker or a
+// vm context), whose prototype is not this realm's Error.
+function isError(value) {
+    return (value instanceof Error ||
+        Object.prototype.toString.call(value) === '[object Error]');
+}
 export function createRedactor(options = {}) {
     const patterns = [TOKEN_VALUE, ...(options.extraValuePatterns ?? [])].map((pattern) => new RegExp(pattern.source, pattern.flags.includes('g') ? pattern.flags : `${pattern.flags}g`));
     function isSecretKey(key) {
@@ -12,7 +24,27 @@ export function createRedactor(options = {}) {
             (normalized.endsWith('token') && !normalized.endsWith('tokens')) ||
             !!options.extraSecretKeys?.(normalized));
     }
-    function walk(value, keys, seen) {
+    // The fields every log reader wants first, then whatever else the error
+    // carries as its own enumerable properties (which is all an Error rendered
+    // as before). Every entry goes through the same key and string scrubbing as
+    // any other object, so a token in a message or stack is still masked.
+    function errorEntries(error) {
+        const fields = error;
+        const entries = [
+            ['name', error.name],
+            ['message', error.message],
+            ['stack', error.stack],
+        ];
+        for (const key of ['code', 'status', 'cause'])
+            if (fields[key] !== undefined)
+                entries.push([key, fields[key]]);
+        const listed = new Set(entries.map(([key]) => key));
+        for (const entry of Object.entries(error))
+            if (!listed.has(entry[0]))
+                entries.push(entry);
+        return entries;
+    }
+    function walk(value, keys, seen, errorDepth = 0) {
         if (typeof value === 'string') {
             return patterns.reduce((text, pattern) => text.replace(pattern, MASK), value);
         }
@@ -23,11 +55,17 @@ export function createRedactor(options = {}) {
         seen.add(value);
         try {
             if (Array.isArray(value))
-                return value.map((item) => walk(item, keys, seen));
+                return value.map((item) => walk(item, keys, seen, errorDepth));
+            const error = isError(value);
+            if (error && errorDepth >= MAX_ERROR_DEPTH)
+                return '[Truncated]';
+            const childDepth = error ? errorDepth + 1 : errorDepth;
             // Define own properties so a diagnostic __proto__ key cannot change the output prototype.
-            return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+            return Object.fromEntries((error ? errorEntries(value) : Object.entries(value)).map(([key, item]) => [
                 key,
-                keys && isSecretKey(key) ? MASK : walk(item, keys, seen),
+                keys && isSecretKey(key)
+                    ? MASK
+                    : walk(item, keys, seen, childDepth),
             ]));
         }
         finally {

package/dist/rpc/rpc-client.d.ts

@@ -1,7 +1,7 @@
 import type { ApplyRequest, ApplyResult, RpcNotification } from './notifications.js';
 import { type DiscoverPortFileOptions, type PortFileEntry } from './port-file.js';
 export interface RpcClient {
-    pending: (lastReceivedId: number, sessionId?: string) => Promise<RpcNotification[]>;
+    pending: (lastReceivedId: number, sessionId?: string, timeoutMs?: number) => Promise<RpcNotification[]>;
     apply: (request: ApplyRequest, timeoutMs?: number) => Promise<ApplyResult>;
 }
 export declare const DEFAULT_RPC_TIMEOUT_MS = 2000;

package/dist/rpc/rpc-client.js

@@ -1,3 +1,4 @@
+import { connect } from 'node:net';
 import { discoverPortFile, } from './port-file.js';
 export const DEFAULT_RPC_TIMEOUT_MS = 2_000;
 async function call(dir, expectedPid, discoverOptions, onSelected, method, params, timeoutMs = DEFAULT_RPC_TIMEOUT_MS) {
@@ -5,28 +6,114 @@ async function call(dir, expectedPid, discoverOptions, onSelected, method, param
     onSelected?.(entry);
     if (!entry)
         return null;
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), timeoutMs);
-    try {
-        const res = await fetch(`http://127.0.0.1:${entry.port}/rpc/${method}`, {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                authorization: `Bearer ${entry.token}`,
-            },
-            body: JSON.stringify(params),
-            signal: controller.signal,
-        });
-        if (!res.ok)
-            return null;
-        return (await res.json());
-    }
-    catch {
-        return null;
-    }
-    finally {
-        clearTimeout(timer);
-    }
+    // A raw loopback socket never consults runtime HTTP proxy settings, which
+    // otherwise can expose the bearer token to a configured proxy. timeoutMs is
+    // a total deadline for connect, request and the full response, not idle time.
+    return new Promise((resolve) => {
+        let socket;
+        let settled = false;
+        const done = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            socket?.destroy();
+            resolve(value);
+        };
+        const timer = setTimeout(() => done(null), timeoutMs);
+        try {
+            const body = JSON.stringify(params);
+            socket = connect({ host: '127.0.0.1', port: entry.port });
+            socket.on('connect', () => {
+                // HTTP/1.0 avoids chunked responses; explicitly request connection close
+                // because older Bun servers can keep delayed HTTP/1.0 replies open.
+                socket?.write(`POST /rpc/${method} HTTP/1.0\r\n` +
+                    `Host: 127.0.0.1:${entry.port}\r\n` +
+                    'Connection: close\r\n' +
+                    'Content-Type: application/json\r\n' +
+                    `Content-Length: ${Buffer.byteLength(body)}\r\n` +
+                    `Authorization: Bearer ${entry.token}\r\n\r\n` +
+                    body);
+            });
+            const chunks = [];
+            let bytes = 0;
+            let headerBytes;
+            let contentLength;
+            let prefix = Buffer.alloc(0);
+            const finishBody = () => {
+                if (headerBytes === undefined)
+                    return done(null);
+                try {
+                    const payload = Buffer.concat(chunks).subarray(headerBytes);
+                    done(JSON.parse(payload.toString('utf8')));
+                }
+                catch {
+                    done(null);
+                }
+            };
+            socket.on('data', (chunk) => {
+                if (settled)
+                    return;
+                bytes += chunk.length;
+                chunks.push(chunk);
+                if (headerBytes === undefined) {
+                    prefix = Buffer.concat([prefix, chunk]);
+                    const separator = prefix.indexOf('\r\n\r\n');
+                    if (separator >= 0)
+                        headerBytes = separator + 4;
+                    if ((headerBytes ?? prefix.length) > 16 * 1024)
+                        return done(null);
+                    if (headerBytes !== undefined) {
+                        const headers = prefix
+                            .subarray(0, separator)
+                            .toString('latin1')
+                            .split('\r\n');
+                        const status = /^HTTP\/1\.[01] (\d{3})(?: |$)/.exec(headers[0] ?? '');
+                        if (!status || Number(status[1]) < 200 || Number(status[1]) >= 300)
+                            return done(null);
+                        for (const header of headers.slice(1)) {
+                            const colon = header.indexOf(':');
+                            const name = header.slice(0, colon).toLowerCase();
+                            const value = header.slice(colon + 1).trim();
+                            if (name === 'transfer-encoding')
+                                return done(null);
+                            if (name === 'content-length') {
+                                if (contentLength !== undefined || !/^\d+$/.test(value))
+                                    return done(null);
+                                contentLength = Number(value);
+                                if (!Number.isSafeInteger(contentLength) ||
+                                    contentLength > 8 * 1024 * 1024)
+                                    return done(null);
+                            }
+                        }
+                        prefix = Buffer.alloc(0);
+                    }
+                }
+                const bodyBytes = bytes - (headerBytes ?? bytes);
+                if (bodyBytes > 8 * 1024 * 1024)
+                    return done(null);
+                if (contentLength !== undefined) {
+                    if (bodyBytes > contentLength)
+                        return done(null);
+                    // Bun 1.3.14 can keep an async HTTP/1.0 reply open after sending
+                    // its complete Content-Length body; don't wait for EOF in that case.
+                    if (bodyBytes === contentLength)
+                        finishBody();
+                }
+            });
+            socket.on('end', () => {
+                if (contentLength !== undefined &&
+                    bytes - (headerBytes ?? 0) !== contentLength)
+                    return done(null);
+                finishBody();
+            });
+            socket.on('error', () => done(null));
+            socket.on('close', () => done(null));
+        }
+        catch {
+            done(null);
+        }
+    });
 }
 /**
  * A client for the server in `dir`, preferring `expectedPid`'s.
@@ -52,8 +139,8 @@ export function createRpcClient(dir, expectedPid, onSelected, options = {}) {
         reportedSelection = true;
     };
     return {
-        async pending(lastReceivedId, sessionId) {
-            const out = await call(dir, expectedPid, discoverOptions, reportSelected, 'pending-notifications', { lastReceivedId, sessionId });
+        async pending(lastReceivedId, sessionId, timeoutMs) {
+            const out = await call(dir, expectedPid, discoverOptions, reportSelected, 'pending-notifications', { lastReceivedId, sessionId }, timeoutMs);
             return out?.messages ?? [];
         },
         async apply(request, timeoutMs) {

package/dist/store/errors.d.ts

@@ -19,7 +19,7 @@ export type PoolFailurePhase = 'before-first-write' | 'after-first-write' | 'pul
  * lock outcomes (a wait that ran out, and a lease found lost); the rest are
  * refusals and failures of the operation itself.
  */
-export type PoolFailureKind = 'lock-contention' | 'lock-ownership' | 'pending-migration' | 'load-error' | 'unknown-row' | 'invalid-row' | 'invalid-input' | 'id-exists' | 'id-removed' | 'type-mismatch' | 'no-credential' | 'row-disabled' | 'row-protected' | 'duplicate-identity' | 'identity-mismatch' | 'endpoint-mismatch' | 'row-key-changed' | 'invalid-order' | 'refresh-stamp-ahead' | 'unbound-credential' | 'attribution' | 'provider' | 'pull' | 'invalid-quota' | 'invalid-provider-state' | 'after-persist-hook' | 'unexpected';
+export type PoolFailureKind = 'lock-contention' | 'lock-ownership' | 'pending-migration' | 'load-error' | 'unknown-row' | 'invalid-row' | 'invalid-input' | 'id-exists' | 'id-removed' | 'type-mismatch' | 'no-credential' | 'row-disabled' | 'row-protected' | 'duplicate-identity' | 'identity-mismatch' | 'identity-contradicted' | 'endpoint-mismatch' | 'row-key-changed' | 'invalid-order' | 'refresh-stamp-ahead' | 'unbound-credential' | 'attribution' | 'provider' | 'pull' | 'invalid-quota' | 'invalid-provider-state' | 'after-persist-hook' | 'unexpected';
 /**
  * The single failure value of every store operation. `committed` is present
  * only when the operation had already written a credential to the state file

package/dist/store/identity.d.ts

@@ -9,6 +9,8 @@ export interface RowEditor {
     entry(id: string): Record<string, unknown> | undefined;
     setEntry(id: string, entry: Record<string, unknown>): void;
 }
+/** Prefix of a refresh quarantine reason, followed by JSON of the expected and returned identities. */
+export declare const IDENTITY_CONTRADICTED_REASON_PREFIX = "identity-contradicted: ";
 /** The reason recorded on a row disabled because an earlier row is the same account. */
 export declare const DUPLICATE_IDENTITY_REASON = "duplicate-identity";
 /**

package/dist/store/identity.js

@@ -1,3 +1,5 @@
+/** Prefix of a refresh quarantine reason, followed by JSON of the expected and returned identities. */
+export const IDENTITY_CONTRADICTED_REASON_PREFIX = 'identity-contradicted: ';
 /** The reason recorded on a row disabled because an earlier row is the same account. */
 export const DUPLICATE_IDENTITY_REASON = 'duplicate-identity';
 /**
@@ -22,7 +24,13 @@ export function disableIn(tx, id, reason) {
         return;
     raw.enabled = false;
     const entry = tx.entry(id) ?? { credentialEpoch: 1, needsFirstReading: true };
-    tx.setEntry(id, { ...entry, disabledReason: reason });
+    // A routine disable must not erase the evidence needed to refuse enable.
+    const quarantined = typeof entry.disabledReason === 'string' &&
+        entry.disabledReason.startsWith(IDENTITY_CONTRADICTED_REASON_PREFIX);
+    tx.setEntry(id, {
+        ...entry,
+        disabledReason: quarantined ? entry.disabledReason : reason,
+    });
 }
 /**
  * Marks a row enabled: `enabled: true` in the roster row and no

package/dist/store/refresh.d.ts

@@ -27,7 +27,11 @@ export interface RefreshOptions {
     providerLock?: PoolLockSpec;
     /** Taken after the provider-wide lock in this order, released in reverse. */
     extraLocks?: readonly PoolLockSpec[];
-    /** Awaited once the rotation is persisted and the store locks released. */
+    /**
+     * Awaited once an ordinary rotation is persisted and the store locks released.
+     * Never called for `identity-contradicted`: its credential must not propagate
+     * as the row's recorded account.
+     */
     onPersisted?: (rowId: string, credential: StoredCredential) => void | Promise<void>;
     onFailure?: FailureHook;
     /**
@@ -42,6 +46,18 @@ export type RefreshOutcome = {
     rowId: string;
     credential: StoredCredential;
     identity?: string;
+}
+/**
+ * The provider's successor credential is stored bound to expectedIdentity,
+ * not returnedIdentity. The row stays disabled until the adapter supplies
+ * an identity-validated replacement credential through replace.
+ */
+ | {
+    status: 'identity-contradicted';
+    rowId: string;
+    expectedIdentity: string;
+    returnedIdentity: string;
+    credential: StoredCredential;
 } | {
     status: 'refused';
     rowId: string;

package/dist/store/refresh.js

@@ -1,11 +1,13 @@
+import { randomUUID } from 'node:crypto';
 import { PoolOperationError } from './errors.js';
 import { assertNotInsideHook, runInsideHook } from './hooks.js';
-import { recordIdentityIn } from './identity.js';
+import { IDENTITY_CONTRADICTED_REASON_PREFIX, recordIdentityIn, } from './identity.js';
 import { runOperation, withTransaction } from './mutate.js';
 import { acceptProviderState, mergedProviderState } from './provider-state.js';
 import { rotateIn } from './rows.js';
 import { readRow, refusal, requireBound, rowLockSpec, } from './runtime.js';
 import { rotationStamp, rotationStampUntrusted, rowLockKey, } from './schema.js';
+import { applyTransition } from './torn.js';
 function requireRefreshable(id, row) {
     if (!row)
         throw refusal('refresh', id, 'unknown-row', `no row ${id} in the pool`);
@@ -137,6 +139,21 @@ export async function refreshRow(rt, id, provider, options = {}) {
                 refresh: result.refresh,
                 expires: result.expires,
             };
+            const contradiction = current.identity !== undefined &&
+                result.identity !== undefined &&
+                current.identity !== result.identity
+                ? {
+                    expectedIdentity: current.identity,
+                    returnedIdentity: result.identity,
+                }
+                : undefined;
+            const transition = contradiction
+                ? {
+                    mark: randomUUID(),
+                    enabled: false,
+                    reason: `${IDENTITY_CONTRADICTED_REASON_PREFIX}${JSON.stringify(contradiction)}`,
+                }
+                : undefined;
             const learnt = current.identity === undefined && result.identity
                 ? result.identity
                 : undefined;
@@ -145,6 +162,11 @@ export async function refreshRow(rt, id, provider, options = {}) {
             // forward rather than leaving an identity no stamp proves.
             const stored = await rotateIn(rt, tx, id, credential, {
                 stamp: rotationStamp(prior, now),
+                // Write state first with the disable marker, then config below.
+                // Once the successor is durable, recovery projects the disable even
+                // if config has not landed. A crash before the first rename still
+                // loses an in-memory provider reply, as in any ordinary refresh.
+                transition,
                 identity: learnt,
                 ...(incoming !== undefined
                     ? {
@@ -152,16 +174,27 @@ export async function refreshRow(rt, id, provider, options = {}) {
                     }
                     : {}),
             });
+            if (transition !== undefined) {
+                applyTransition(tx, id, transition);
+                await tx.commitConfig();
+            }
             let identity = current.identity;
             if (learnt !== undefined) {
                 recordIdentityIn(tx, id, learnt);
                 identity = learnt;
                 await tx.commitConfig();
             }
-            return { stored, identity, refused: undefined };
+            return { stored, identity, contradiction, refused: undefined };
         });
         if (commit.refused !== undefined)
             return { status: 'refused', rowId: id, reason: commit.refused };
+        if (commit.contradiction !== undefined)
+            return {
+                status: 'identity-contradicted',
+                rowId: id,
+                ...commit.contradiction,
+                credential: commit.stored,
+            };
         if (options.onPersisted) {
             try {
                 const persisted = options.onPersisted;

package/dist/store/rows.d.ts

@@ -5,6 +5,7 @@ import { type ProviderStateWrite, type RowTransitionMutator, type UpdateProvider
 import type { PoolLockSpec } from './refresh-lock.js';
 import { type StoreRuntime } from './runtime.js';
 import { type CredentialBinding, type PoolCredential, type PoolRow, type RotateCredential, type StoredCredential } from './schema.js';
+import { type StampedTransition } from './torn.js';
 export type FailureHook = (rowId: string, error: PoolOperationError) => void | Promise<void>;
 export interface RowOperationOptions {
     /** Called once, awaited, on every non-success path, before locks release. */
@@ -122,6 +123,8 @@ export declare function rotateIn(rt: StoreRuntime, tx: Transaction, id: string,
     binding?: CredentialBinding;
     identity?: string;
     providerState?: ProviderStateWrite;
+    /** Config transition persisted with the successor credential for crash recovery. */
+    transition?: StampedTransition;
 }): Promise<StoredCredential>;
 export declare function addRow(rt: StoreRuntime, input: AddInput, options?: RowOperationOptions): Promise<AddResult>;
 export declare function replaceRow(rt: StoreRuntime, id: string, credential: PoolCredential, input?: CredentialWriteInput, options?: RowOperationOptions): Promise<{
@@ -178,7 +181,9 @@ export interface RowTransitionResult {
 export declare function disableRow(rt: StoreRuntime, id: string, reason: string, options?: RowTransitionOptions): Promise<RowTransitionResult>;
 /**
  * Clears a row's `enabled: false` and its `disabledReason` in one config
- * write. An OAuth row whose recorded identity another enabled OAuth row holds
+ * write. An identity-contradicted row refuses with `identity-contradicted`
+ * until the caller validates a replacement's identity and supplies it to replace.
+ * An OAuth row whose recorded identity another enabled OAuth row holds
  * stays disabled and the call refuses (`duplicate-identity`): the same rule
  * that makes `add` store such a row disabled. Enabling a row that is already
  * enabled writes nothing. See `RowTransitionOptions` for the attributed

package/dist/store/rows.js

@@ -1,7 +1,7 @@
 import { randomUUID } from 'node:crypto';
 import { PoolOperationError } from './errors.js';
 import { assertNotInsideHook, runInsideHook } from './hooks.js';
-import { DUPLICATE_IDENTITY_REASON, disableIdentityDuplicates, disableIn, enableIn, recordIdentityIn, } from './identity.js';
+import { DUPLICATE_IDENTITY_REASON, disableIdentityDuplicates, disableIn, enableIn, IDENTITY_CONTRADICTED_REASON_PREFIX, recordIdentityIn, } from './identity.js';
 import { notReadyError, readPool, runOperation, withTransaction, } from './mutate.js';
 import { acceptProviderState, mergedProviderState, planProviderStateIn, providerStateCoverage, replacementProviderState, } from './provider-state.js';
 import { readRow, refusal, requireBound, rowLockSpec, unknownRow, } from './runtime.js';
@@ -122,12 +122,17 @@ export async function rotateIn(rt, tx, id, given, extra = {}) {
     tx.setStateAccount(id, {
         ...kept,
         ...stateFieldsFor(credential, stamp),
-        [CREDENTIAL_STAMP_KEY]: stampFor(stored, credentialEpoch, extra.binding ?? bindingInTx(tx, id, stored, extra.identity), {
-            replace: extra.binding !== undefined,
-            ...(providerStateBinding !== undefined
-                ? { providerState: providerStateBinding }
+        [CREDENTIAL_STAMP_KEY]: {
+            ...(extra.transition !== undefined
+                ? { [TRANSITION_STAMP_KEY]: extra.transition }
                 : {}),
-        }),
+            ...stampFor(stored, credentialEpoch, extra.binding ?? bindingInTx(tx, id, stored, extra.identity), {
+                replace: extra.binding !== undefined,
+                ...(providerStateBinding !== undefined
+                    ? { providerState: providerStateBinding }
+                    : {}),
+            }),
+        },
     });
     await tx.commitState(stored);
     return stored;
@@ -480,6 +485,9 @@ async function transitionRow(rt, operation, id, flag, options) {
                     row.identity !== fence.identity)
                     throw refusal(operation, id, 'attribution', `the ${operation} of ${id} was issued for a credential or account the row no longer holds`, true);
             }
+            if (flag.enabled &&
+                row.disabledReason?.startsWith(IDENTITY_CONTRADICTED_REASON_PREFIX))
+                throw refusal('enable', id, 'identity-contradicted', `row ${id} needs an identity-validated credential replacement before it can be enabled`);
             // An enable of a row that is already enabled has nothing to write
             // to the config; a disable always rewrites it, as it always has.
             const writesConfig = !flag.enabled || !row.enabled || row.disabledReason !== undefined;
@@ -567,7 +575,9 @@ export function disableRow(rt, id, reason, options = {}) {
 }
 /**
  * Clears a row's `enabled: false` and its `disabledReason` in one config
- * write. An OAuth row whose recorded identity another enabled OAuth row holds
+ * write. An identity-contradicted row refuses with `identity-contradicted`
+ * until the caller validates a replacement's identity and supplies it to replace.
+ * An OAuth row whose recorded identity another enabled OAuth row holds
  * stays disabled and the call refuses (`duplicate-identity`): the same rule
  * that makes `add` store such a row disabled. Enabling a row that is already
  * enabled writes nothing. See `RowTransitionOptions` for the attributed

package/dist/store/torn.js

@@ -1,4 +1,4 @@
-import { disableIdentityDuplicates, disableIn, enableIn, recordIdentityIn, } from './identity.js';
+import { disableIdentityDuplicates, disableIn, enableIn, IDENTITY_CONTRADICTED_REASON_PREFIX, recordIdentityIn, } from './identity.js';
 import { buildRawRows, CREDENTIAL_STAMP_KEY, credentialDigest, dispatchDigest, entryIn, isRecord, parseStamp, rosterRowIn, setEntryIn, } from './schema.js';
 /*
  * A replace changes both files: the state file gets the new credential and
@@ -209,6 +209,13 @@ export function bindReplacement(editor, id, credentialEpoch, binding) {
         needsFirstReading: true,
     };
     delete next.quota;
+    // An explicit identity supplied with a replacement is the adapter's validated
+    // account binding. Clear its quarantine on completion, including crash recovery,
+    // but leave the row disabled until a separate enable.
+    if (binding.identity !== undefined &&
+        typeof next.disabledReason === 'string' &&
+        next.disabledReason.startsWith(IDENTITY_CONTRADICTED_REASON_PREFIX))
+        delete next.disabledReason;
     editor.setEntry(id, next);
     const raw = editor.rosterRow(id);
     if (!raw)

package/dist/tui-build/build-tui.js

@@ -2,7 +2,7 @@ import { createHash } from 'node:crypto';
 import { existsSync, realpathSync } from 'node:fs';
 import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
 import { createRequire } from 'node:module';
-import { basename, dirname, extname, join, relative, resolve } from 'node:path';
+import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep, } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { isBareSpecifier, parseImports } from './walker.js';
 export const runtimeModules = [
@@ -109,6 +109,35 @@ export async function buildTui(entryFile, variant, destinationDir, options = {})
         selector: 'selector.js',
         externals: new Set(),
     };
+    // Every name below is computed from the entry's real directory: an entry
+    // reached through a symlink (macOS's /var -> /private/var temp directory,
+    // a linked checkout) must not make its own siblings look like outside files.
+    const entryDirectory = dirname(realpathSync(entry));
+    const portable = (path) => path.split(sep).join('/');
+    // A shared copy's name must be the same wherever the checkout lives, so it
+    // is derived from a key that holds no absolute path. A file inside an
+    // inlined package is keyed by that package's name and its path within the
+    // package; any other file by its path relative to the entry's directory.
+    // Both are one-to-one: one root per package name (the innermost root wins
+    // when roots nest, so a file always picks the same one), a fixed base for
+    // relative paths, and distinct prefixes for the two kinds. The guard in
+    // `visit` turns the remaining risk, two keys sharing a truncated hash, into
+    // an error instead of one copy silently overwriting another.
+    const namingRoots = [...roots]
+        .map(([name, root]) => ({
+        name,
+        root: existsSync(root) ? realpathSync(root) : root,
+    }))
+        .sort((a, b) => b.root.length - a.root.length);
+    const sharedKey = (source) => {
+        for (const { name, root } of namingRoots) {
+            const path = relative(root, source);
+            if (path && !path.startsWith(`..${sep}`) && !isAbsolute(path))
+                return `package:${name}/${portable(path)}`;
+        }
+        return `path:${portable(relative(entryDirectory, source))}`;
+    };
+    const sharedOwners = new Map();
     const copied = new Map();
     const relativeImport = (from, to) => {
         const path = relative(dirname(from), to).split('\\').join('/');
@@ -116,17 +145,23 @@ export async function buildTui(entryFile, variant, destinationDir, options = {})
     };
     const visit = async (source, shared) => {
         source = realpathSync(source);
-        if (relative(dirname(entry), source).startsWith('../'))
+        if (relative(entryDirectory, source).startsWith(`..${sep}`))
             shared = true;
         const previous = copied.get(source);
         if (previous)
             return previous;
         const extension = variant === 'raw' && extname(source) === '.tsx' ? '.tsx' : '.js';
         const name = shared
-            ? `shared/${createHash('sha256').update(source).digest('hex').slice(0, 16)}-${basename(source).replace(/\.[^.]+$/, '')}${extension}`
-            : relative(dirname(entry), source).replace(/\.[^.]+$/, extension);
+            ? `shared/${createHash('sha256').update(sharedKey(source)).digest('hex').slice(0, 16)}-${basename(source).replace(/\.[^.]+$/, '')}${extension}`
+            : portable(relative(entryDirectory, source)).replace(/\.[^.]+$/, extension);
         if (name.startsWith('../'))
             throw new Error(`Entry dependency escapes source directory: ${source}`);
+        if (shared) {
+            const owner = sharedOwners.get(name);
+            if (owner !== undefined)
+                throw new Error(`Shared module name ${name} is claimed by both ${owner} and ${source}`);
+            sharedOwners.set(name, source);
+        }
         copied.set(source, name);
         let code = await readFile(source, 'utf8');
         if (transform && /\.[jt]sx$/.test(source))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/common-auth",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Shared code for the CortexKit auth plugins: account pool, quota and routing, commands and auth menu, OpenCode 2 hooks, Claustrum custody, and plumbing (loopback RPC, file locks, logger, sidebar state, TUI preferences and build).",
   "license": "MIT",
   "repository": {
@@ -89,16 +89,18 @@
     "format:check": "biome format .",
     "lint": "biome check .",
     "prepublishOnly": "bun run build",
-    "check:ranges": "bun scripts/check-installed-ranges.mjs"
+    "check:ranges": "bun scripts/check-installed-ranges.mjs",
+    "check:claustrum-040": "bun scripts/check-claustrum-040.mjs",
+    "check:opentui-0511": "bun scripts/check-opentui-0511.mjs"
   },
   "dependencies": {
     "jsonc-parser": "^3.3.1"
   },
   "peerDependencies": {
-    "@opentui/core": ">=0.5.12",
-    "@opentui/solid": ">=0.5.12",
+    "@opentui/core": ">=0.5.11",
+    "@opentui/solid": ">=0.5.11",
     "solid-js": "1.9.12",
-    "@cortexkit/claustrum-client": ">=0.5.0",
+    "@cortexkit/claustrum-client": ">=0.4.0",
     "@opencode/plugin": ">=2.0.21"
   },
   "peerDependenciesMeta": {