@cortexkit/opencode-openai-auth 0.11.0 → 1.0.0

package/src/tui-compiled/raw/shared/97484d9bb98c705b-provider-state.js

@@ -0,0 +1,226 @@
+import { assertNotInsideHook, runInsideHook } from "./9deae3c4da4fd63b-hooks.js";
+import { runOperation, withTransaction } from "./458b934e92490331-mutate.js";
+import { readRow, refusal, requireBound, rowLockSpec, unknownRow, } from "./83bc3ba9d0fe2761-runtime.js";
+import { boundProviderStateDigest, CREDENTIAL_STAMP_KEY, credentialDigest, isCredentialEpoch, isRecord, PROVIDER_STATE_KEY, parseStamp, providerStateDigest, rowLockKey, } from "./cd94316a888b0a8e-schema.js";
+/**
+ * A provider state as the store will store it: a JSON round trip of it (so
+ * its digest is the same once read back from disk), accepted by the codec.
+ * Refused before anything is written when the store has no codec, the value
+ * is not JSON, or the codec rejects it.
+ */
+export function acceptProviderState(codec, operation, id, value, what = 'the provider state') {
+    if (!codec)
+        throw refusal(operation, id, 'invalid-input', 'the store was opened without a provider-state codec');
+    let normalized;
+    try {
+        const text = JSON.stringify(value);
+        normalized = text === undefined ? undefined : JSON.parse(text);
+    }
+    catch {
+        normalized = undefined;
+    }
+    if (normalized === undefined)
+        throw refusal(operation, id, 'invalid-provider-state', `${what} cannot be stored as JSON`);
+    if (!codec.validate(normalized))
+        throw refusal(operation, id, 'invalid-provider-state', `the provider-state codec rejected ${what}`);
+    return normalized;
+}
+/**
+ * The write for a value a credential write brings (`add` of a secret the
+ * pool holds, `rotate`, a refresh): merged with the row's value on disk by
+ * the codec's `merge` when both exist, else the incoming value as is.
+ */
+export function mergedProviderState(codec, operation, id, onDisk, incoming) {
+    if (onDisk === undefined || !codec?.merge)
+        return { kind: 'set', value: incoming };
+    return {
+        kind: 'set',
+        value: acceptProviderState(codec, operation, id, codec.merge(structuredClone(onDisk), structuredClone(incoming)), 'the merged provider state'),
+    };
+}
+/**
+ * The provider state a replace leaves on the row, decided before anything is
+ * written: whatever the codec's `onReplace` returns (undefined clears it), or
+ * without that hook the value handed to `replace`, else nothing. The old
+ * credential's value is never kept by default: it describes the account the
+ * replaced credential belonged to.
+ */
+export function replacementProviderState(codec, row, credentialEpoch, identity, incoming) {
+    const hook = codec?.onReplace;
+    const next = hook
+        ? hook(row.providerState === undefined
+            ? undefined
+            : structuredClone(row.providerState), {
+            id: row.id,
+            credentialEpoch,
+            ...(row.identity !== undefined
+                ? { previousIdentity: row.identity }
+                : {}),
+            ...(identity !== undefined ? { identity } : {}),
+            ...(incoming !== undefined
+                ? { incoming: structuredClone(incoming) }
+                : {}),
+        })
+        : incoming;
+    if (next === undefined)
+        return { kind: 'clear' };
+    if (!hook)
+        return { kind: 'set', value: next };
+    return {
+        kind: 'set',
+        value: acceptProviderState(codec, 'replace', row.id, next, 'the provider state onReplace returned'),
+    };
+}
+/**
+ * The provider-state digest the stamp of a credential write carries, and the
+ * state-file fields it changes. `set` binds the new value; `keep` carries the
+ * old stamp's digest forward only when that stamp bound it to this row as it
+ * stood before the write (same credential lineage, the epoch being written,
+ * the identity recorded before the write); `clear` binds nothing.
+ */
+export function providerStateCoverage(codec, write, prior, priorRow, credentialEpoch) {
+    if (write.kind === 'set')
+        return providerStateDigest(codec, write.value);
+    if (write.kind === 'clear')
+        return undefined;
+    return boundProviderStateDigest(prior, priorRow?.credential, credentialEpoch, priorRow?.identity);
+}
+/**
+ * Changes a row's provider state without touching its credential, in one
+ * state-file write under the row lock, the caller's extra locks and the
+ * store locks. `fence` is what the caller read the row at: the write is
+ * refused (`attribution`, retryable) when the row has since moved to another
+ * credential epoch or recorded identity, and (`unknown-row`) once it is
+ * removed, so a writer that read the row before a replace or a removal never
+ * lands its value on the new credential or brings a removed row's state back.
+ *
+ * The value is bound by the stamp already beside the credential. When its
+ * credential-bound part is unchanged the stamp is left byte for byte as it
+ * is; otherwise only the stamp's provider-state digest changes, so the
+ * credential's stamp status never moves. With `requireCredentialStamps`, an
+ * unbound row refuses (`unbound-credential`) as every other strict path
+ * does. Without it, a row whose stamp was not written by this store with this
+ * credential at the row's epoch and identity refuses the same way: no stamp
+ * could bind the value, so no reader would ever show it. A `rotate` or
+ * `replace` stamps such a row.
+ */
+export async function updateProviderStateRow(rt, id, fence, mutator, options = {}) {
+    assertNotInsideHook('updateProviderState');
+    const { ctx } = rt;
+    const operation = 'updateProviderState';
+    return runOperation(ctx, operation, id, options.onFailure, async (locks, progress) => {
+        const codec = ctx.providerState;
+        if (!codec)
+            throw refusal(operation, id, 'invalid-input', 'the store was opened without a provider-state codec');
+        if (typeof mutator !== 'function')
+            throw refusal(operation, id, 'invalid-input', 'a mutator is required');
+        const captured = isRecord(fence) ? fence.credentialEpoch : undefined;
+        if (!isCredentialEpoch(captured))
+            throw refusal(operation, id, 'invalid-input', 'the credential epoch the provider state was read at is required');
+        const { row: seen } = await readRow(rt, operation, id);
+        await locks.acquire(rowLockSpec(rt, seen));
+        for (const extra of options.extraLocks ?? [])
+            await locks.acquire(extra);
+        return withTransaction(ctx, locks, progress, { operation, rowId: id }, async (tx) => {
+            const row = tx.row(id);
+            if (!row)
+                throw unknownRow(operation, id);
+            if (rowLockKey(row) !== rowLockKey(seen))
+                throw refusal(operation, id, 'row-key-changed', `row ${id}'s wire identity changed while its lock was being taken`, true);
+            if (row.invalid)
+                throw refusal(operation, id, 'invalid-row', `row ${id} failed validation`);
+            if (!row.credential)
+                throw refusal(operation, id, 'no-credential', `row ${id} holds no credential`);
+            requireBound(operation, row);
+            const epoch = row.credentialEpoch ?? 1;
+            if (epoch !== captured || row.identity !== fence.identity)
+                throw refusal(operation, id, 'attribution', `the provider state for ${id} was read for a credential or account the row no longer holds`, true);
+            const plan = await planProviderStateIn(tx, codec, operation, row, mutator);
+            if (plan.kind !== 'changed')
+                return {
+                    id,
+                    outcome: 'unchanged',
+                    ...(plan.kind === 'unchanged' && plan.value !== undefined
+                        ? { providerState: plan.value }
+                        : {}),
+                };
+            tx.setStateAccount(id, plan.account);
+            await tx.commitState();
+            return plan.value === undefined
+                ? { id, outcome: 'cleared' }
+                : { id, outcome: 'updated', providerState: plan.value };
+        });
+    });
+}
+/**
+ * Returned by the provider-state mutator of an attributed `disable` or
+ * `enable` to decline the whole transition: nothing is written, neither the
+ * provider state nor the row's enabled flag, and the call resolves with
+ * `declined: true`. A mutator declines when the state it is shown is newer
+ * than what its caller saw, such as an eligibility recorded after the
+ * request whose refusal is being acted on. It is a value of its own because
+ * `undefined` already means "clear the provider state". `Symbol.for` keeps it
+ * equal across two copies of this module loaded in one process.
+ */
+export const DECLINE_TRANSITION = Symbol.for('@cortexkit/common-auth/store/decline-transition');
+/**
+ * Runs a provider-state mutator for a row loaded under every lock and
+ * already checked by the caller (present, valid, inside its attribution
+ * fence), and plans the write. Refuses (`no-credential`) a row holding no
+ * credential, and (`unbound-credential`) one whose credential carries no
+ * stamp of this store at the row's epoch and identity: no stamp could bind
+ * the value, so no reader would ever show it. `DECLINE_TRANSITION` is
+ * honoured only when `declinable` is set; elsewhere it is not JSON and is
+ * refused as such.
+ */
+export async function planProviderStateIn(tx, codec, operation, row, mutator, declinable = false) {
+    const id = row.id;
+    const credential = row.credential;
+    if (!credential)
+        throw refusal(operation, id, 'no-credential', `row ${id} holds no credential`);
+    const epoch = row.credentialEpoch ?? 1;
+    const account = tx.stateAccount(id);
+    const rawStamp = account?.[CREDENTIAL_STAMP_KEY];
+    const stamp = parseStamp(rawStamp);
+    if (!isRecord(rawStamp) ||
+        !stamp?.binding ||
+        stamp.digest !== credentialDigest(credential) ||
+        stamp.credentialEpoch !== epoch ||
+        stamp.binding.identity !== row.identity)
+        throw refusal(operation, id, 'unbound-credential', `row ${id}'s credential carries no stamp of this store to bind a provider state to (stamp ${row.stamp}); rotate or replace it first`);
+    const current = row.providerState === undefined
+        ? undefined
+        : structuredClone(row.providerState);
+    const returned = await runInsideHook(operation, () => mutator(current, row));
+    if (declinable && returned === DECLINE_TRANSITION)
+        return { kind: 'declined' };
+    const next = returned === undefined
+        ? undefined
+        : acceptProviderState(codec, operation, id, returned, 'the provider state the mutator returned');
+    const held = account !== undefined && Object.hasOwn(account, PROVIDER_STATE_KEY);
+    if (next === undefined
+        ? !held
+        : row.providerState !== undefined &&
+            JSON.stringify(row.providerState) === JSON.stringify(next))
+        return { kind: 'unchanged', ...(next !== undefined ? { value: next } : {}) };
+    const nextAccount = { ...account };
+    if (next === undefined) {
+        delete nextAccount[PROVIDER_STATE_KEY];
+        const nextStamp = { ...rawStamp };
+        delete nextStamp.providerState;
+        nextAccount[CREDENTIAL_STAMP_KEY] = nextStamp;
+    }
+    else {
+        nextAccount[PROVIDER_STATE_KEY] = next;
+        const digest = providerStateDigest(codec, next);
+        // A change confined to the part the codec does not bind to the
+        // credential leaves the stamp exactly as it was.
+        if (stamp.providerState !== digest)
+            nextAccount[CREDENTIAL_STAMP_KEY] = { ...rawStamp, providerState: digest };
+    }
+    return {
+        kind: 'changed',
+        ...(next !== undefined ? { value: next } : {}),
+        account: nextAccount,
+    };
+}

package/src/tui-compiled/raw/shared/9968e3cade6969a1-index.js

@@ -0,0 +1,2 @@
+export { createTuiPreferenceWriter, readTuiPreferences, readTuiPreferencesFile, } from "./a09b6a533c11858f-tui-preferences.js";
+export { watchTuiPreferences, } from "./0766d78c6f481f18-watcher.js";

package/src/tui-compiled/raw/shared/9b4da614c45f9cd0-lock-constants.js

@@ -0,0 +1,14 @@
+export const WRITER_LOCK_CONSTANTS = Object.freeze({
+    sidebar: Object.freeze({
+        name: 'sidebar-write',
+        ttlMs: 10_000,
+        timeoutMs: 15_000,
+        renew: true,
+    }),
+    preferences: Object.freeze({
+        name: 'preferences',
+        ttlMs: 10_000,
+        timeoutMs: 2_000,
+        renew: true,
+    }),
+});

package/src/tui-compiled/raw/shared/9d3fc9e37456504e-refresh.js

@@ -0,0 +1,225 @@
+import { randomUUID } from "node:crypto";
+import { PoolOperationError } from "./04a6357627de5ed0-errors.js";
+import { assertNotInsideHook, runInsideHook } from "./9deae3c4da4fd63b-hooks.js";
+import { IDENTITY_CONTRADICTED_REASON_PREFIX, recordIdentityIn, } from "./75bd8c3bd63b315f-identity.js";
+import { runOperation, withTransaction } from "./458b934e92490331-mutate.js";
+import { acceptProviderState, mergedProviderState } from "./97484d9bb98c705b-provider-state.js";
+import { assertNotReserved } from "./08eef45626a94992-reserved.js";
+import { rotateIn } from "./fe02abeadc535f77-rows.js";
+import { readRow, refusal, requireBound, rowLockSpec, } from "./83bc3ba9d0fe2761-runtime.js";
+import { rotationStamp, rotationStampUntrusted, rowLockKey, } from "./cd94316a888b0a8e-schema.js";
+import { applyTransition } from "./fd45e82f2f9c0a0d-torn.js";
+function requireRefreshable(id, row) {
+    assertNotReserved('refresh', id, row?.staged);
+    if (!row)
+        throw refusal('refresh', id, 'unknown-row', `no row ${id} in the pool`);
+    if (row.invalid)
+        throw refusal('refresh', id, 'invalid-row', `row ${id} is invalid`);
+    if (row.type !== 'oauth' || row.credential?.type !== 'oauth')
+        throw refusal('refresh', id, 'no-credential', `row ${id} holds no OAuth credential`);
+    if (!row.enabled)
+        throw refusal('refresh', id, 'row-disabled', `row ${id} is disabled`);
+    return row;
+}
+function stampAhead(id) {
+    return refusal('refresh', id, 'refresh-stamp-ahead', `row ${id}'s stored refresh stamp is ahead of the clock; a rotation now could not be stamped newer within the trust bound`, true);
+}
+/**
+ * Refreshes one OAuth row. Locks are taken in the fixed order row lock,
+ * provider-wide lock, extra locks, and the store locks only around the
+ * capture and the commit; ownership of every held lease is asserted after
+ * each wait, immediately before the provider call and before each write.
+ */
+export async function refreshRow(rt, id, provider, options = {}) {
+    assertNotInsideHook('refresh');
+    const { ctx } = rt;
+    return runOperation(ctx, 'refresh', id, options.onFailure, async (locks, progress) => {
+        const { row: seen } = await readRow(rt, 'refresh', id);
+        requireRefreshable(id, seen);
+        const early = await options.refuse?.(seen);
+        if (early !== undefined)
+            return { status: 'refused', rowId: id, reason: early };
+        let key = rowLockKey(seen);
+        let captured;
+        for (let attempt = 0;; attempt++) {
+            await locks.acquire(rowLockSpec(rt, { id, identity: key === id ? undefined : key }));
+            await locks.acquire(options.providerLock ?? rt.providerLock);
+            for (const extra of options.extraLocks ?? [])
+                await locks.acquire(extra);
+            // The capture may write the config once, to give a row its per-row
+            // entry. That write is setup, not the rotation, so it is counted apart
+            // and never makes a later failure report `after-first-write`.
+            const captureProgress = { writes: 0 };
+            const read = await withTransaction(ctx, locks, captureProgress, { operation: 'refresh', rowId: id }, async (tx) => {
+                let row = requireRefreshable(id, tx.row(id));
+                requireBound('refresh', row);
+                if (!row.hasEntry) {
+                    tx.setEntry(id, { credentialEpoch: 1, needsFirstReading: true });
+                    await tx.commitConfig();
+                    row = requireRefreshable(id, tx.row(id));
+                }
+                if (rowLockKey(row) !== key)
+                    return { keyNow: rowLockKey(row) };
+                const reason = await options.refuse?.(row);
+                if (reason !== undefined)
+                    return { refused: reason };
+                return {
+                    row,
+                    credential: row.credential,
+                    credentialEpoch: row.credentialEpoch,
+                    identity: row.identity,
+                };
+            });
+            if ('refused' in read)
+                return { status: 'refused', rowId: id, reason: read.refused };
+            if ('keyNow' in read) {
+                await locks.releaseAll();
+                if (attempt >= 1)
+                    throw refusal('refresh', id, 'row-key-changed', `row ${id}'s wire identity changed twice while its lock was held`, true);
+                key = read.keyNow;
+                continue;
+            }
+            captured = read;
+            break;
+        }
+        if (rotationStampUntrusted(captured.credential.lastRefreshedAt, ctx.now()))
+            throw stampAhead(id);
+        await ctx.hold?.('refresh-before-provider', id);
+        await locks.assertAll();
+        let result;
+        try {
+            result = await provider(captured.credential, captured.row);
+        }
+        catch (cause) {
+            throw new PoolOperationError({
+                operation: 'refresh',
+                rowId: id,
+                phase: 'before-first-write',
+                retryable: true,
+                kind: 'provider',
+                message: 'the provider refresh failed',
+                cause,
+            });
+        }
+        if (typeof result?.refresh !== 'string' || !result.refresh.trim())
+            throw refusal('refresh', id, 'provider', 'the provider returned no refresh token', true);
+        const incoming = result.providerState === undefined
+            ? undefined
+            : acceptProviderState(ctx.providerState, 'refresh', id, result.providerState, 'the provider state the provider returned');
+        const commit = await withTransaction(ctx, locks, progress, { operation: 'refresh', rowId: id }, async (tx) => {
+            const current = tx.row(id);
+            const entry = tx.entry(id);
+            if (!current ||
+                current.invalid ||
+                !entry ||
+                entry.credentialEpoch !== captured.credentialEpoch ||
+                current.identity !== captured.identity)
+                throw new PoolOperationError({
+                    operation: 'refresh',
+                    rowId: id,
+                    phase: 'before-first-write',
+                    retryable: true,
+                    kind: 'attribution',
+                    message: `row ${id} changed credential while its refresh was in flight; the rotation is discarded`,
+                });
+            // The epoch fence above does not see a credential another writer
+            // swapped in under the same epoch; the stamp does, and committing
+            // the rotation would stamp the swapped row as bound.
+            requireBound('refresh', current);
+            const reason = await options.refuse?.(current);
+            if (reason !== undefined)
+                return { refused: reason };
+            const now = ctx.now();
+            const prior = current.credential?.type === 'oauth'
+                ? current.credential.lastRefreshedAt
+                : undefined;
+            if (rotationStampUntrusted(prior, now))
+                throw stampAhead(id);
+            const credential = {
+                type: 'oauth',
+                access: result.access,
+                refresh: result.refresh,
+                expires: result.expires,
+            };
+            const contradiction = current.identity !== undefined &&
+                result.identity !== undefined &&
+                current.identity !== result.identity
+                ? {
+                    expectedIdentity: current.identity,
+                    returnedIdentity: result.identity,
+                }
+                : undefined;
+            const transition = contradiction
+                ? {
+                    mark: randomUUID(),
+                    enabled: false,
+                    reason: `${IDENTITY_CONTRADICTED_REASON_PREFIX}${JSON.stringify(contradiction)}`,
+                }
+                : undefined;
+            const learnt = current.identity === undefined && result.identity
+                ? result.identity
+                : undefined;
+            // The rotated credential's stamp names a learnt identity before the
+            // config records it, so a crash between the two writes is completed
+            // forward rather than leaving an identity no stamp proves.
+            const stored = await rotateIn(rt, tx, id, credential, {
+                stamp: rotationStamp(prior, now),
+                // Write state first with the disable marker, then config below.
+                // Once the successor is durable, recovery projects the disable even
+                // if config has not landed. A crash before the first rename still
+                // loses an in-memory provider reply, as in any ordinary refresh.
+                transition,
+                identity: learnt,
+                ...(incoming !== undefined
+                    ? {
+                        providerState: mergedProviderState(ctx.providerState, 'refresh', id, current.providerState, incoming),
+                    }
+                    : {}),
+            });
+            if (transition !== undefined) {
+                applyTransition(tx, id, transition);
+                await tx.commitConfig();
+            }
+            let identity = current.identity;
+            if (learnt !== undefined) {
+                recordIdentityIn(tx, id, learnt);
+                identity = learnt;
+                await tx.commitConfig();
+            }
+            return { stored, identity, contradiction, refused: undefined };
+        });
+        if (commit.refused !== undefined)
+            return { status: 'refused', rowId: id, reason: commit.refused };
+        if (commit.contradiction !== undefined)
+            return {
+                status: 'identity-contradicted',
+                rowId: id,
+                ...commit.contradiction,
+                credential: commit.stored,
+            };
+        if (options.onPersisted) {
+            try {
+                const persisted = options.onPersisted;
+                await runInsideHook('refresh', () => persisted(id, commit.stored));
+            }
+            catch (cause) {
+                throw new PoolOperationError({
+                    operation: 'refresh',
+                    rowId: id,
+                    phase: 'after-first-write',
+                    retryable: false,
+                    kind: 'after-persist-hook',
+                    committed: commit.stored,
+                    message: 'the after-persist hook threw; the rotation stays committed',
+                    cause,
+                });
+            }
+        }
+        return {
+            status: 'rotated',
+            rowId: id,
+            credential: commit.stored,
+            ...(commit.identity !== undefined ? { identity: commit.identity } : {}),
+        };
+    });
+}

package/src/tui-compiled/raw/shared/9deae3c4da4fd63b-hooks.js

@@ -0,0 +1,34 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { PoolReentryError } from "./04a6357627de5ed0-errors.js";
+/**
+ * Set while a hook of a lock-holding operation runs. Async context is
+ * inherited by every timer, promise and continuation created inside the hook,
+ * so work a hook schedules is inside the guarded region too.
+ */
+const insideHook = new AsyncLocalStorage();
+/** Refuses a row operation or refresh called from inside a hook. */
+export function assertNotInsideHook(operation) {
+    if (insideHook.getStore() !== undefined)
+        throw new PoolReentryError(operation);
+}
+export function runInsideHook(operation, fn) {
+    return insideHook.run(operation, async () => await fn());
+}
+/**
+ * Runs a failure hook. A hook that throws never replaces the failure it was
+ * handed: its exception is logged and discarded.
+ */
+export async function callFailureHook(operation, hook, rowId, error, logger) {
+    if (!hook)
+        return;
+    try {
+        await runInsideHook(operation, () => hook(rowId, error));
+    }
+    catch (hookError) {
+        logger?.warn('store failure hook threw; the original failure stands', {
+            operation,
+            rowId,
+            error: hookError instanceof Error ? hookError.message : String(hookError),
+        });
+    }
+}

package/src/tui-compiled/raw/shared/a09b6a533c11858f-tui-preferences.js

@@ -0,0 +1,77 @@
+import { readFile } from "node:fs/promises";
+import { applyEdits, modify, parse } from "jsonc-parser";
+import { writeJsonAtomic } from "./7211cfec06a298bc-atomic-write.js";
+import { WRITER_LOCK_CONSTANTS } from "./9b4da614c45f9cd0-lock-constants.js";
+import { withLock } from "./4825e03209d6ae3e-with-lock.js";
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+/** Malformed or missing user-edited files are treated as an empty root. */
+export async function readTuiPreferencesFile(file) {
+    try {
+        const errors = [];
+        const root = parse(await readFile(file, 'utf8'), errors, {
+            allowTrailingComma: true,
+        });
+        return errors.length === 0 && isRecord(root) ? root : {};
+    }
+    catch {
+        return {};
+    }
+}
+export async function readTuiPreferences(options) {
+    const root = await readTuiPreferencesFile(options.file);
+    const entry = Object.hasOwn(root, options.pluginKey)
+        ? root[options.pluginKey]
+        : undefined;
+    return options.schema(entry, options.defaults);
+}
+const TEMPLATE = `// Shared preferences for TUI plugins.
+// Plugins update individual keys in place and preserve comments.
+{}
+`;
+/** Each instance serializes updates; the file lock also excludes other processes. */
+export function createTuiPreferenceWriter(options) {
+    const { file, pluginKey, beforeCommit } = options;
+    const lockOptions = {
+        ...WRITER_LOCK_CONSTANTS.preferences,
+        timeoutMs: options.timeoutMs ?? WRITER_LOCK_CONSTANTS.preferences.timeoutMs,
+    };
+    let chain = Promise.resolve();
+    async function writePreference(path, value) {
+        await withLock(file, lockOptions, async (lock) => {
+            let text;
+            try {
+                text = await readFile(file, 'utf8');
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+                text = '';
+            }
+            if (text.trim() === '')
+                text = TEMPLATE;
+            const next = applyEdits(text, modify(text, [pluginKey, ...path], value, {
+                formattingOptions: { insertSpaces: true, tabSize: 2 },
+            }));
+            await writeJsonAtomic(file, next, {
+                serialize: (value) => String(value),
+                beforeRename: async () => {
+                    await beforeCommit?.();
+                    await lock.assertOwned();
+                },
+            });
+        });
+    }
+    return {
+        queueTuiPreferenceUpdate(path, value) {
+            // Snapshot inputs so queued callers cannot change an update before it runs.
+            const savedPath = [...path];
+            const savedValue = structuredClone(value);
+            const update = chain.then(() => writePreference(savedPath, savedValue));
+            // Recover only the stored tail; the caller still sees the original rejection.
+            chain = update.catch(() => { });
+            return update;
+        },
+    };
+}

package/src/tui-compiled/raw/shared/a62a27a204266acd-attribution.js

@@ -0,0 +1,60 @@
+import { PoolOperationError } from "./04a6357627de5ed0-errors.js";
+import { toFailure, withTransaction } from "./458b934e92490331-mutate.js";
+import { LockStack } from "./43fc9e6b994519c7-refresh-lock.js";
+import { refusal, requireBound, unknownRow, } from "./83bc3ba9d0fe2761-runtime.js";
+import { isCredentialEpoch } from "./cd94316a888b0a8e-schema.js";
+/**
+ * Merges a quota observation into a row's stored map under the store locks,
+ * after attribution passes. Needs no row lock, so it is permitted from
+ * inside hooks. Clears needs-first-reading on success.
+ */
+export async function recordQuota(rt, id, attribution, observation) {
+    const { ctx } = rt;
+    const locks = new LockStack(ctx.lockDefaults, ctx.lockEnv);
+    const progress = { writes: 0 };
+    try {
+        if (!isCredentialEpoch(attribution?.credentialEpoch))
+            throw refusal('pull', id, 'invalid-input', 'the credential epoch the reading was issued for must be a positive safe integer');
+        await withTransaction(ctx, locks, progress, { operation: 'pull', rowId: id }, async (tx) => {
+            tx.assertNotStaged(id);
+            const row = tx.row(id);
+            if (!row)
+                throw unknownRow('pull', id);
+            if (row.invalid)
+                throw refusal('pull', id, 'invalid-row', `row ${id} is invalid`);
+            // A reading belongs to one (epoch, identity, credential). A row
+            // holding no credential, or torn between the writes of a replace,
+            // has no such triple on disk, so no reading is recorded for it.
+            if (!row.credential)
+                throw refusal('pull', id, 'no-credential', `row ${id} holds no credential`);
+            requireBound('pull', row);
+            const entry = tx.entry(id);
+            if (row.torn ||
+                !entry ||
+                entry.credentialEpoch !== attribution.credentialEpoch ||
+                row.identity !== attribution.identity)
+                throw new PoolOperationError({
+                    operation: 'pull',
+                    rowId: id,
+                    phase: 'pull',
+                    retryable: true,
+                    kind: 'attribution',
+                    message: `quota for ${id} was issued for a credential the row no longer holds`,
+                });
+            const merged = ctx.codec.merge(entry.quota, observation);
+            if (!ctx.codec.validate(merged))
+                throw refusal('pull', id, 'invalid-quota', 'the quota codec rejected the merged map');
+            tx.setEntry(id, { ...entry, quota: merged, needsFirstReading: false });
+            await tx.commitConfig();
+        }, 
+        // Recording a reading never completes a torn row: the fence above
+        // refuses it, and the row's own next write completes it.
+        { completeTorn: false });
+    }
+    catch (error) {
+        throw toFailure(error, 'pull', id, progress);
+    }
+    finally {
+        await locks.releaseAll();
+    }
+}