@cortexkit/opencode-openai-auth 1.4.0 → 1.5.0

package/src/tui-compiled/raw/shared/754d6017f8e419cf-builtins.js

@@ -4,7 +4,7 @@
 // the same locks as any other writer of those files.
 import { formatQuota, isQuotaMap, projectQuota, quotaWindowName, } from "./d5a8f1061ee2f114-index.js";
 import { DEFAULT_FORMER_MAIN_ID, orderForPlacement, resolveRoutingMode, } from "./3e7d45a77c6ad4d5-index.js";
-import { projectFailure, } from "./94820e324f2b4c09-seam.js";
+import { CommandError, projectFailure, } from "./94820e324f2b4c09-seam.js";
 /** `disabledReason` recorded when the user disables an account from the menu. */
 export const MENU_DISABLED_REASON = 'disabled from the command menu';
 function isRecord(value) {
@@ -65,13 +65,16 @@ function addedText(name, result) {
 function failureMessage(error) {
     return projectFailure(error).text;
 }
-async function snapshot(store) {
+async function snapshot(options) {
+    const { store } = options;
     const load = await store.read();
     const read = await store.readSettings();
+    const vault = await options.routing?.vaultOrder?.();
     return {
         load,
         rows: distinctRows(load),
         settings: read.status === 'error' ? {} : read.settings,
+        ...(vault ? { vault } : {}),
     };
 }
 function accountView(row, options) {
@@ -323,6 +326,73 @@ function quotaSection(options, snap) {
         },
     };
 }
+/**
+ * Sets the vault order. The roster's own refusal of the list (`invalid-order`:
+ * an account left out, which it counts without naming) is shown with its own
+ * message; any other failure is projected as usual. The kind is read from
+ * the error object so the menu does not import the vault client.
+ */
+async function reorderVault(vault, order) {
+    try {
+        return await vault.reorder(order);
+    }
+    catch (error) {
+        if (error instanceof Error &&
+            error.name === 'ClaustrumConsumerError' &&
+            error.kind === 'invalid-order')
+            throw new CommandError('vault-invalid-order', error.message, {
+                cause: error,
+            });
+        throw error;
+    }
+}
+function invalidVaultOrder(message) {
+    return new CommandError('vault-invalid-order', message);
+}
+/**
+ * How the Routing section names vault accounts: by label, since route ids
+ * are long and opaque. A typed entry may be a label or a route id, and must
+ * name exactly one account. Refusals quote only the entry the user typed.
+ */
+function vaultNames(vault) {
+    const rows = vault.rows.map((row) => ({
+        id: row.id,
+        label: row.label.trim() || row.id,
+    }));
+    const matches = (entry) => rows.filter((row) => row.id === entry || row.label === entry);
+    return {
+        ids: rows.map((row) => row.id),
+        nameOf: (id) => rows.find((row) => row.id === id)?.label ?? id,
+        /**
+         * What the order input starts with for an account: its label when
+         * typing that label back names this account alone, else its route id
+         * (two accounts sharing a label, or a label with a comma or line break
+         * in it, either of which would split it into two entries).
+         */
+        entryOf: (id) => {
+            const row = rows.find((entry) => entry.id === id);
+            return row && !/[,\n]/.test(row.label) && matches(row.label).length === 1
+                ? row.label
+                : id;
+        },
+        /** The route ids the typed entries name, in order; refuses before any write. */
+        resolve: (entries) => {
+            const ids = [];
+            for (const entry of entries) {
+                const found = matches(entry);
+                if (found.length === 0)
+                    throw invalidVaultOrder(`"${entry}" is not a vault account.`);
+                if (found.length > 1)
+                    throw invalidVaultOrder(`"${entry}" matches more than one vault account; enter those accounts by route id.`);
+                const id = found[0].id;
+                if (ids.includes(id))
+                    throw invalidVaultOrder(`"${entry}" names an account already in the order.`);
+                ids.push(id);
+            }
+            return ids;
+        },
+    };
+}
 function routingSection(options, snap) {
     const { store, extraLocks } = options;
     const locks = extraLocks ? { extraLocks } : {};
@@ -336,14 +406,18 @@ function routingSection(options, snap) {
         ? raw
         : 'ordered';
     const resolved = resolveRoutingMode(current);
-    const ids = snap.rows.map((row) => row.id);
+    // In vault mode routing tries the vault accounts, so their order is the
+    // one shown and set here; the pool roster's order is not used.
+    const vault = snap.vault ? vaultNames(snap.vault) : undefined;
+    const ids = vault ? vault.ids : snap.rows.map((row) => row.id);
+    const nameOf = (id) => (vault ? vault.nameOf(id) : id);
     const tried = orderForPlacement(ids, resolved.placement, options.routing?.formerMainId ?? DEFAULT_FORMER_MAIN_ID);
     const label = choices.find((choice) => choice.value === current)?.label ?? current;
     const lines = [`Mode: ${label}`];
     if (ids.length > 0)
-        lines.push(`Roster order: ${ids.join(', ')}`);
+        lines.push(`${vault ? 'Vault account order' : 'Roster order'}: ${ids.map(nameOf).join(', ')}`);
     if (resolved.mode === 'ordered' && tried.join() !== ids.join())
-        lines.push(`Tried in order: ${tried.join(', ')}`);
+        lines.push(`Tried in order: ${tried.map(nameOf).join(', ')}`);
     const actions = [
         {
             id: 'mode',
@@ -371,19 +445,27 @@ function routingSection(options, snap) {
                 {
                     kind: 'text',
                     id: 'order',
-                    label: 'Account ids, first to last',
-                    value: ids.join(', '),
+                    label: vault
+                        ? 'Vault accounts, first to last, separated by commas'
+                        : 'Account ids, first to last',
+                    value: vault ? ids.map(vault.entryOf).join(', ') : ids.join(', '),
                     required: true,
                 },
             ],
             run: async ({ values }) => {
-                const order = String(values.order)
-                    .split(/[\s,]+/)
-                    .filter((id) => id.length > 0);
-                const result = await store.reorder(order, locks);
+                const text = String(values.order);
+                // A vault label may contain spaces, so vault entries are separated by
+                // commas or line breaks, not spaces; pool ids never contain spaces.
+                const entries = text
+                    .split(vault ? /[,\n]+/ : /[\s,]+/)
+                    .map((entry) => entry.trim())
+                    .filter((entry) => entry.length > 0);
+                const result = snap.vault && vault
+                    ? await reorderVault(snap.vault, vault.resolve(entries))
+                    : await store.reorder(entries, locks);
                 return result.outcome === 'unchanged'
                     ? 'The order is unchanged.'
-                    : `Order set to ${result.ids.join(', ')}.`;
+                    : `Order set to ${result.ids.map(nameOf).join(', ')}.`;
             },
         });
     return {
@@ -524,7 +606,7 @@ function limitsSection(options, snap) {
 }
 /** The four built-in sections, in their fixed order, from one read of the store. */
 export async function builtinSections(options) {
-    const snap = await snapshot(options.store);
+    const snap = await snapshot(options);
     return [
         accountsSection(options, snap),
         quotaSection(options, snap),

package/src/tui-compiled/raw/shared/b9588ad4725c1d10-enrollment.js

@@ -10,12 +10,22 @@ const ENROLLMENT_SCHEMA = 1;
 const ENROLLMENT_FILE_MAX_BYTES = 16 * 1024;
 const ENROLLMENT_LOCK_TTL_MS = 30_000;
 const TOKEN_RE = /^[0-9a-f]{64}$/;
+/**
+ * The code a vault without the enrollment ceremony answers a proposal with.
+ * Setup reports it as "this vault cannot connect plugins" instead of waiting.
+ */
+export const UNSUPPORTED_ENROLLMENT_CODE = 'unknown_method';
 /**
  * Codes the vault's closed enrollment-refusal vocabulary marks permanent. The
  * client labels some module error frames transient/retry regardless, so the
  * producer's code takes precedence over the client's action for these.
  */
 export const TERMINAL_ENROLLMENT_CODES = new Set([
+    // The daemon's answer to an operation it does not implement: a vault built
+    // before the enrollment ceremony. It arrives as a transport Error frame with
+    // no class, which claustrum-client before 0.13.0 labels transient/retry, but
+    // asking again can never succeed.
+    UNSUPPORTED_ENROLLMENT_CODE,
     'invalid_params',
     'pending_exists',
     'not_found',
@@ -638,6 +648,23 @@ export class ClaustrumEnrollmentManager {
                             retryCode: refusal.code,
                         };
                     }
+                    // A vault without the ceremony cannot hold a request for this
+                    // proposal, now or from an earlier run (the state has no request
+                    // id). So nothing is blocked and nothing is in progress: remove the
+                    // pending state, still under the ceremony lock, so status reads as
+                    // "not enrolled" and a reset or a later run starts afresh.
+                    if (refusal.code === UNSUPPORTED_ENROLLMENT_CODE) {
+                        await lock.assertOwned();
+                        await unlink(this.#paths.statePath).catch((cause) => {
+                            if (cause.code !== 'ENOENT')
+                                throw cause;
+                        });
+                        return {
+                            state: 'unavailable',
+                            proposedName: state.proposedName,
+                            code: refusal.code,
+                        };
+                    }
                     return this.#block(state, refusal.code);
                 }
             }

package/src/tui-compiled/raw/shared/e8d3c8da776ef9cd-index.js

@@ -15,7 +15,7 @@ export { assertHostSlotMatchesMode, assertNotCustodyPlaceholder, CUSTODY_PLACEHO
 export { acquireInsulaQuotaSource, } from "./d0f0b6be200311af-insula.js";
 export { acceptAccount, declineAccount, isDeclined, } from "./7c140680fc81be92-interlock.js";
 export { drainVaultQuota } from "./81dddd203f1b92a3-quota-writer.js";
-export { acceptVaultRoute, DEFAULT_ROUTE_PREFIX, declineVaultRoute, mutateVaultRoster, projectVaultRoster, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, resolveVaultPrimary, vaultRoutingRows, } from "./30f5bc480f31f51c-roster.js";
+export { acceptVaultRoute, DEFAULT_ROUTE_PREFIX, declineVaultRoute, mutateVaultRoster, projectVaultRoster, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, reorderVaultRoster, resolveVaultPrimary, vaultRoutingRows, } from "./30f5bc480f31f51c-roster.js";
 export { ChangeNoticeReader, RESUBSCRIBE_BACKOFF_MS, SAFETY_POLL_MS, ScopedRosterWatch, WATCH_RETRY_MS, } from "./dc9290c2a7552ba6-watch.js";
 /**
  * Connect the client that lists and fetches this consumer's vault credentials

package/src/tui-compiled/runtime/shared/169b2b4bf30909bc-consumer.js

@@ -5,7 +5,7 @@ import { readClaustrumEnrollmentToken } from "./b9588ad4725c1d10-enrollment.js";
 import { ClaustrumConsumerError } from "./ca0fccaba1d87af4-errors.js";
 import { acquireInsulaQuotaSource, } from "./d0f0b6be200311af-insula.js";
 import { pendingVaultQuota, retainVaultQuotaWriter } from "./81dddd203f1b92a3-quota-writer.js";
-import { acceptVaultRoute, applyVaultQuota, declineVaultRoute, forgetPendingVaultDiscovery, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, vaultRoutingRows, } from "./30f5bc480f31f51c-roster.js";
+import { acceptVaultRoute, applyVaultQuota, declineVaultRoute, forgetPendingVaultDiscovery, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, reorderVaultRoster, vaultRoutingRows, } from "./30f5bc480f31f51c-roster.js";
 import { SAFETY_POLL_MS } from "./dc9290c2a7552ba6-watch.js";
 /**
  * One plugin host's view of its vault accounts. It turns vault credentials
@@ -485,8 +485,12 @@ export class ClaustrumConsumer {
             let current;
             try {
                 current = await this.authorize(routeId, signal);
+                // Cancellation can land after authorize settles, before this continuation.
+                signal?.throwIfAborted();
             }
-            catch {
+            catch (error) {
+                if (signal?.aborted)
+                    throw error;
                 // Re-authorization failed: keep this 401 and report it against the
                 // receipt (served record version) this request was sent with.
             }
@@ -522,6 +526,17 @@ export class ClaustrumConsumer {
         await acceptVaultRoute(this.#options.rosterPath, routeId);
         this.#roster = pendingVaultQuota(this.#options.rosterPath, await readVaultRoster(this.#options.rosterPath));
     }
+    /**
+     * Set the order vault accounts are tried in (`reorderVaultRoster`), then
+     * re-read the roster, so the next routing decision in this process uses
+     * the new order without waiting for a discovery. Never contacts the vault.
+     */
+    async reorder(routeIds) {
+        this.#assertOpen();
+        const result = await reorderVaultRoster(this.#options.rosterPath, routeIds);
+        this.#roster = pendingVaultQuota(this.#options.rosterPath, await readVaultRoster(this.#options.rosterPath));
+        return result;
+    }
     /**
      * Store a quota or profile observation for a vault route. The receipt the
      * reading was taken with is required: the observation lands only while the

package/src/tui-compiled/runtime/shared/30f5bc480f31f51c-roster.js

@@ -378,6 +378,78 @@ export function acceptVaultRoute(path, routeId) {
         };
     });
 }
+function invalidOrder(message) {
+    return new ClaustrumConsumerError('invalid-order', message);
+}
+/**
+ * Why `routeIds` is not an order of these rows: it must name every distinct
+ * route id exactly once and nothing else. The message quotes only ids the
+ * caller supplied; route ids it left out are counted, not named.
+ */
+function vaultOrderProblem(rows, routeIds) {
+    if (!Array.isArray(routeIds))
+        return 'route ids must be an array of route ids';
+    const rosterIds = new Set(rows.map((row) => row.routeId));
+    const given = new Set();
+    for (const id of routeIds) {
+        if (typeof id !== 'string')
+            return 'route ids must be an array of route ids';
+        if (given.has(id))
+            return `route id ${id} appears more than once`;
+        if (!rosterIds.has(id))
+            return `route id ${id} is not in the roster`;
+        given.add(id);
+    }
+    const missing = [...rosterIds].filter((id) => !given.has(id)).length;
+    if (missing > 0)
+        return `the order leaves out ${missing} roster route id${missing === 1 ? '' : 's'}`;
+    return undefined;
+}
+/**
+ * Set the order vault accounts are tried in. Routing reads that order from
+ * the roster's row order (`vaultRoutingRows`), and a later discovery keeps
+ * each account at its position, so the order lasts until the next reorder.
+ * The order is this host's routing preference: the vault has no order of its
+ * own, and this never contacts it.
+ *
+ * `routeIds` must name every roster route id exactly once; anything else
+ * (an unknown, missing or repeated id) refuses with `invalid-order` and
+ * writes nothing. It runs under the roster's write lock, like every other
+ * roster write, so a quota reading or decline committed meanwhile is kept.
+ * Each row is kept as the same object, so only the positions change: every
+ * row's fields and the rest of the file stay as they were. An order equal to
+ * the current one writes nothing. A host with no roster file yet has no
+ * routes, so only the empty order is accepted.
+ *
+ * A `ClaustrumConsumer` in the same process does not see the new order until
+ * it re-reads the file: call `consumer.reorder` instead to update both.
+ */
+export function reorderVaultRoster(path, routeIds, options = {}) {
+    return mutateVaultRoster(path, (current) => {
+        const rows = current?.rows ?? [];
+        const problem = vaultOrderProblem(rows, routeIds);
+        if (problem)
+            throw invalidOrder(problem);
+        // Group by route id so a hand-edited file that repeats one keeps every
+        // copy: the later copies travel right after the first.
+        const byId = new Map();
+        for (const row of rows) {
+            const group = byId.get(row.routeId);
+            if (group)
+                group.push(row);
+            else
+                byId.set(row.routeId, [row]);
+        }
+        const ids = [...routeIds];
+        const next = ids.flatMap((id) => byId.get(id) ?? []);
+        if (!current || next.every((row, index) => row === rows[index]))
+            return { result: { ids, outcome: 'unchanged' } };
+        return {
+            next: { ...current, rows: next },
+            result: { ids, outcome: 'reordered' },
+        };
+    }, { ...(options.signal && { signal: options.signal }) });
+}
 /**
  * What a receipt may do to a row's quota: `hold` (the row holds the receipt's
  * credential and account), `bind` (the row has never had a known account and

package/src/tui-compiled/runtime/shared/375d9cca2def037d-private-files.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { lstat, readFile, rename, unlink } from "node:fs/promises";
-import { dirname, resolve } from "node:path";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
 export const windowsPrivateFiles = process.platform === 'win32';
 const migrationNotices = new Set();
 function ioCode(detail) {
@@ -20,8 +21,51 @@ let backend;
 export function setPrivateFilesBackendForTest(api) {
     backend = api ? Promise.resolve(api) : undefined;
 }
+/** The fixed `reason` of a refusal because the Windows native addon did not load. */
+export const PRIVATE_FILES_UNAVAILABLE_REASON = 'native-addon-unavailable';
+function privateFilesUnavailable(cause) {
+    return Object.assign(new Error('Windows private-files native addon is unavailable', { cause }), {
+        code: 'ERR_PRIVATE_FILES_UNAVAILABLE',
+        reason: PRIVATE_FILES_UNAVAILABLE_REASON,
+    });
+}
+function isUnavailable(api, error) {
+    return (error instanceof api.PrivateFilesUnavailableError ||
+        error?.code ===
+            'ERR_PRIVATE_FILES_UNAVAILABLE');
+}
+/**
+ * Importing @cortexkit/private-files succeeds even when its Windows addon
+ * cannot load: the package loads the addon on first use, and some of its
+ * checks then report the failure as an ordinary refusal such as
+ * `unsupported-filesystem`. So prove the addon loads before handing the
+ * package out. Verifying a path that does not exist loads the addon first and
+ * then fails harmlessly; only the package's own "unavailable" error means the
+ * addon is missing.
+ */
+async function assertNativeAddonLoads(api) {
+    try {
+        await api.verifyPrivatePath(join(tmpdir(), `.common-auth-private-files-probe-${randomUUID()}`), 'file');
+    }
+    catch (error) {
+        if (isUnavailable(api, error))
+            throw privateFilesUnavailable(error);
+    }
+}
+/**
+ * Load the package once per process. On Windows a failed import or addon load
+ * is kept, so every later private-file operation refuses at once with
+ * ERR_PRIVATE_FILES_UNAVAILABLE. There is no fallback to permission bits:
+ * they do not protect files on Windows.
+ */
 function loadBackend() {
-    backend ??= import("@cortexkit/private-files");
+    backend ??= import("@cortexkit/private-files").then(async (api) => {
+        if (windowsPrivateFiles)
+            await assertNativeAddonLoads(api);
+        return api;
+    }, (cause) => {
+        throw windowsPrivateFiles ? privateFilesUnavailable(cause) : cause;
+    });
     return backend;
 }
 export class PrivateFileError extends Error {
@@ -38,7 +82,9 @@ export class PrivateFileError extends Error {
     orphanPath;
     constructor(path, stage, cause) {
         const detail = cause;
-        super(`Private file refused at ${stage}: ${path} (${detail?.reason ?? detail?.code ?? 'io-error'}). Use a safe parent directory. Repair only a named secret file in safe ancestry whose owner the published policy trusts, without changing its owner or any existing directory. Previously exposed credentials may need rotation. Windows requires the private-files native prebuild and an ACL-persisting local filesystem such as NTFS.`, { cause });
+        super(detail?.code === 'ERR_PRIVATE_FILES_UNAVAILABLE'
+            ? `Private file refused at ${stage}: ${path} (${PRIVATE_FILES_UNAVAILABLE_REASON}). The Windows native addon of @cortexkit/private-files could not be loaded, so owner-only access cannot be enforced and nothing was read or written. Reinstall the plugin so the private-files Windows prebuild for this architecture is present; Windows has no safe fallback to permission bits.`
+            : `Private file refused at ${stage}: ${path} (${detail?.reason ?? detail?.code ?? 'io-error'}). Keep this file in a folder that only you, the system or administrators can change, such as a folder in your home directory. If other users could read the file before, sign in again to replace the credentials it held. On Windows the file must also be on a local drive that keeps Windows file permissions, such as NTFS.`, { cause });
         this.path = path;
         this.stage = stage;
         this.name = 'PrivateFileError';

package/src/tui-compiled/runtime/shared/754d6017f8e419cf-builtins.js

@@ -4,7 +4,7 @@
 // the same locks as any other writer of those files.
 import { formatQuota, isQuotaMap, projectQuota, quotaWindowName, } from "./d5a8f1061ee2f114-index.js";
 import { DEFAULT_FORMER_MAIN_ID, orderForPlacement, resolveRoutingMode, } from "./3e7d45a77c6ad4d5-index.js";
-import { projectFailure, } from "./94820e324f2b4c09-seam.js";
+import { CommandError, projectFailure, } from "./94820e324f2b4c09-seam.js";
 /** `disabledReason` recorded when the user disables an account from the menu. */
 export const MENU_DISABLED_REASON = 'disabled from the command menu';
 function isRecord(value) {
@@ -65,13 +65,16 @@ function addedText(name, result) {
 function failureMessage(error) {
     return projectFailure(error).text;
 }
-async function snapshot(store) {
+async function snapshot(options) {
+    const { store } = options;
     const load = await store.read();
     const read = await store.readSettings();
+    const vault = await options.routing?.vaultOrder?.();
     return {
         load,
         rows: distinctRows(load),
         settings: read.status === 'error' ? {} : read.settings,
+        ...(vault ? { vault } : {}),
     };
 }
 function accountView(row, options) {
@@ -323,6 +326,73 @@ function quotaSection(options, snap) {
         },
     };
 }
+/**
+ * Sets the vault order. The roster's own refusal of the list (`invalid-order`:
+ * an account left out, which it counts without naming) is shown with its own
+ * message; any other failure is projected as usual. The kind is read from
+ * the error object so the menu does not import the vault client.
+ */
+async function reorderVault(vault, order) {
+    try {
+        return await vault.reorder(order);
+    }
+    catch (error) {
+        if (error instanceof Error &&
+            error.name === 'ClaustrumConsumerError' &&
+            error.kind === 'invalid-order')
+            throw new CommandError('vault-invalid-order', error.message, {
+                cause: error,
+            });
+        throw error;
+    }
+}
+function invalidVaultOrder(message) {
+    return new CommandError('vault-invalid-order', message);
+}
+/**
+ * How the Routing section names vault accounts: by label, since route ids
+ * are long and opaque. A typed entry may be a label or a route id, and must
+ * name exactly one account. Refusals quote only the entry the user typed.
+ */
+function vaultNames(vault) {
+    const rows = vault.rows.map((row) => ({
+        id: row.id,
+        label: row.label.trim() || row.id,
+    }));
+    const matches = (entry) => rows.filter((row) => row.id === entry || row.label === entry);
+    return {
+        ids: rows.map((row) => row.id),
+        nameOf: (id) => rows.find((row) => row.id === id)?.label ?? id,
+        /**
+         * What the order input starts with for an account: its label when
+         * typing that label back names this account alone, else its route id
+         * (two accounts sharing a label, or a label with a comma or line break
+         * in it, either of which would split it into two entries).
+         */
+        entryOf: (id) => {
+            const row = rows.find((entry) => entry.id === id);
+            return row && !/[,\n]/.test(row.label) && matches(row.label).length === 1
+                ? row.label
+                : id;
+        },
+        /** The route ids the typed entries name, in order; refuses before any write. */
+        resolve: (entries) => {
+            const ids = [];
+            for (const entry of entries) {
+                const found = matches(entry);
+                if (found.length === 0)
+                    throw invalidVaultOrder(`"${entry}" is not a vault account.`);
+                if (found.length > 1)
+                    throw invalidVaultOrder(`"${entry}" matches more than one vault account; enter those accounts by route id.`);
+                const id = found[0].id;
+                if (ids.includes(id))
+                    throw invalidVaultOrder(`"${entry}" names an account already in the order.`);
+                ids.push(id);
+            }
+            return ids;
+        },
+    };
+}
 function routingSection(options, snap) {
     const { store, extraLocks } = options;
     const locks = extraLocks ? { extraLocks } : {};
@@ -336,14 +406,18 @@ function routingSection(options, snap) {
         ? raw
         : 'ordered';
     const resolved = resolveRoutingMode(current);
-    const ids = snap.rows.map((row) => row.id);
+    // In vault mode routing tries the vault accounts, so their order is the
+    // one shown and set here; the pool roster's order is not used.
+    const vault = snap.vault ? vaultNames(snap.vault) : undefined;
+    const ids = vault ? vault.ids : snap.rows.map((row) => row.id);
+    const nameOf = (id) => (vault ? vault.nameOf(id) : id);
     const tried = orderForPlacement(ids, resolved.placement, options.routing?.formerMainId ?? DEFAULT_FORMER_MAIN_ID);
     const label = choices.find((choice) => choice.value === current)?.label ?? current;
     const lines = [`Mode: ${label}`];
     if (ids.length > 0)
-        lines.push(`Roster order: ${ids.join(', ')}`);
+        lines.push(`${vault ? 'Vault account order' : 'Roster order'}: ${ids.map(nameOf).join(', ')}`);
     if (resolved.mode === 'ordered' && tried.join() !== ids.join())
-        lines.push(`Tried in order: ${tried.join(', ')}`);
+        lines.push(`Tried in order: ${tried.map(nameOf).join(', ')}`);
     const actions = [
         {
             id: 'mode',
@@ -371,19 +445,27 @@ function routingSection(options, snap) {
                 {
                     kind: 'text',
                     id: 'order',
-                    label: 'Account ids, first to last',
-                    value: ids.join(', '),
+                    label: vault
+                        ? 'Vault accounts, first to last, separated by commas'
+                        : 'Account ids, first to last',
+                    value: vault ? ids.map(vault.entryOf).join(', ') : ids.join(', '),
                     required: true,
                 },
             ],
             run: async ({ values }) => {
-                const order = String(values.order)
-                    .split(/[\s,]+/)
-                    .filter((id) => id.length > 0);
-                const result = await store.reorder(order, locks);
+                const text = String(values.order);
+                // A vault label may contain spaces, so vault entries are separated by
+                // commas or line breaks, not spaces; pool ids never contain spaces.
+                const entries = text
+                    .split(vault ? /[,\n]+/ : /[\s,]+/)
+                    .map((entry) => entry.trim())
+                    .filter((entry) => entry.length > 0);
+                const result = snap.vault && vault
+                    ? await reorderVault(snap.vault, vault.resolve(entries))
+                    : await store.reorder(entries, locks);
                 return result.outcome === 'unchanged'
                     ? 'The order is unchanged.'
-                    : `Order set to ${result.ids.join(', ')}.`;
+                    : `Order set to ${result.ids.map(nameOf).join(', ')}.`;
             },
         });
     return {
@@ -524,7 +606,7 @@ function limitsSection(options, snap) {
 }
 /** The four built-in sections, in their fixed order, from one read of the store. */
 export async function builtinSections(options) {
-    const snap = await snapshot(options.store);
+    const snap = await snapshot(options);
     return [
         accountsSection(options, snap),
         quotaSection(options, snap),

package/src/tui-compiled/runtime/shared/b9588ad4725c1d10-enrollment.js

@@ -10,12 +10,22 @@ const ENROLLMENT_SCHEMA = 1;
 const ENROLLMENT_FILE_MAX_BYTES = 16 * 1024;
 const ENROLLMENT_LOCK_TTL_MS = 30_000;
 const TOKEN_RE = /^[0-9a-f]{64}$/;
+/**
+ * The code a vault without the enrollment ceremony answers a proposal with.
+ * Setup reports it as "this vault cannot connect plugins" instead of waiting.
+ */
+export const UNSUPPORTED_ENROLLMENT_CODE = 'unknown_method';
 /**
  * Codes the vault's closed enrollment-refusal vocabulary marks permanent. The
  * client labels some module error frames transient/retry regardless, so the
  * producer's code takes precedence over the client's action for these.
  */
 export const TERMINAL_ENROLLMENT_CODES = new Set([
+    // The daemon's answer to an operation it does not implement: a vault built
+    // before the enrollment ceremony. It arrives as a transport Error frame with
+    // no class, which claustrum-client before 0.13.0 labels transient/retry, but
+    // asking again can never succeed.
+    UNSUPPORTED_ENROLLMENT_CODE,
     'invalid_params',
     'pending_exists',
     'not_found',
@@ -638,6 +648,23 @@ export class ClaustrumEnrollmentManager {
                             retryCode: refusal.code,
                         };
                     }
+                    // A vault without the ceremony cannot hold a request for this
+                    // proposal, now or from an earlier run (the state has no request
+                    // id). So nothing is blocked and nothing is in progress: remove the
+                    // pending state, still under the ceremony lock, so status reads as
+                    // "not enrolled" and a reset or a later run starts afresh.
+                    if (refusal.code === UNSUPPORTED_ENROLLMENT_CODE) {
+                        await lock.assertOwned();
+                        await unlink(this.#paths.statePath).catch((cause) => {
+                            if (cause.code !== 'ENOENT')
+                                throw cause;
+                        });
+                        return {
+                            state: 'unavailable',
+                            proposedName: state.proposedName,
+                            code: refusal.code,
+                        };
+                    }
                     return this.#block(state, refusal.code);
                 }
             }

package/src/tui-compiled/runtime/shared/e8d3c8da776ef9cd-index.js

@@ -15,7 +15,7 @@ export { assertHostSlotMatchesMode, assertNotCustodyPlaceholder, CUSTODY_PLACEHO
 export { acquireInsulaQuotaSource, } from "./d0f0b6be200311af-insula.js";
 export { acceptAccount, declineAccount, isDeclined, } from "./7c140680fc81be92-interlock.js";
 export { drainVaultQuota } from "./81dddd203f1b92a3-quota-writer.js";
-export { acceptVaultRoute, DEFAULT_ROUTE_PREFIX, declineVaultRoute, mutateVaultRoster, projectVaultRoster, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, resolveVaultPrimary, vaultRoutingRows, } from "./30f5bc480f31f51c-roster.js";
+export { acceptVaultRoute, DEFAULT_ROUTE_PREFIX, declineVaultRoute, mutateVaultRoster, projectVaultRoster, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, reorderVaultRoster, resolveVaultPrimary, vaultRoutingRows, } from "./30f5bc480f31f51c-roster.js";
 export { ChangeNoticeReader, RESUBSCRIBE_BACKOFF_MS, SAFETY_POLL_MS, ScopedRosterWatch, WATCH_RETRY_MS, } from "./dc9290c2a7552ba6-watch.js";
 /**
  * Connect the client that lists and fetches this consumer's vault credentials

package/dist/index-5230x6s8.js

@@ -1,2 +0,0 @@
-import{jf as E}from"./index-d98f1xdp.js";import{randomUUID as k}from"node:crypto";import{lstat as S,readFile as O,rename as F,unlink as C}from"node:fs/promises";import{dirname as V,resolve as M}from"node:path";var b=process.platform==="win32",N=new Set;function T(j){if(j?.reason==="io-error"){if(j.win32Code===2||j.win32Code===3)return"ENOENT";if(j.win32Code===80||j.win32Code===183)return"EEXIST"}return j?.code??"ERR_PRIVATE_FILE"}var B;function $(){return B??=import("@cortexkit/private-files"),B}class R extends Error{path;stage;code;win32Code;reason;published=!1;durabilityConfirmed=!1;fileDurable=!1;attempts=0;elapsedMs=0;orphanPath;constructor(j,G,A){let z=A;super(`Private file refused at ${G}: ${j} (${z?.reason??z?.code??"io-error"}). Use a safe parent directory. Repair only a named secret file in safe ancestry whose owner the published policy trusts, without changing its owner or any existing directory. Previously exposed credentials may need rotation. Windows requires the private-files native prebuild and an ACL-persisting local filesystem such as NTFS.`,{cause:A});this.path=j,this.stage=G,this.name="PrivateFileError",this.code=T(z),this.win32Code=z?.win32Code,this.reason=z?.reason}}async function q(j,G,A){try{return await A()}catch(z){if(z instanceof R)throw z;throw new R(j,G,z)}}var g;async function Z(j,G){j=M(j),G??=g,await q(j,"safe-parent",async()=>{let A=await(await $()).verifySafeParent(j,G);if(A.ok===!1){if(A.reason==="io-error"||A.reason==="wrong-kind")await S(j);throw new R(A.level??A.path,"safe-parent",{...A,code:"ERR_PRIVATE_FILES_SECURITY"})}})}async function U(j,G,A=!1){if(j=M(j),G==="directory")return Z(j);await q(j,"verify",async()=>{let z=await $(),K=await z.verifyOwnerOnly(j),H=!1;if(!K.ok){let{reason:L}=K.refusal;if(L==="io-error")await z.verifyPrivatePath(j,G);if(A&&[z.EXTRA_ACE,z.NOT_PROTECTED,z.NULL_DACL,z.EMPTY_DACL].includes(L))await Z(V(j)),await z.securePrivatePath(j,G),H=!0;else throw Object.assign(Error("Owner-only verification refused"),{reason:L,code:"ERR_PRIVATE_FILES_SECURITY"})}if(await z.verifyPrivatePath(j,G),H&&!N.has(j))N.add(j),process.emitWarning(`Private permissions tightened: ${j}. This object may have been readable before; rotate credentials if needed.`,"PrivateFileMigration")})}async function w(j,G=!1,A){j=M(j),await q(j,"directory",async()=>{let z=await $();try{return await S(j),await Z(j,A)}catch(H){if(T(H)!=="ENOENT")throw H}let K=V(j);if(K===j)throw Object.assign(Error("Missing root"),{code:"ENOENT"});await w(K,!1,A);try{await z.createOwnerOnly(j,{kind:"dir"})}catch(H){if(T(H)!=="EEXIST")throw H}await Z(j,A)})}async function d(j,G=!1){if(!b)return O(j,"utf8");return(await P(j,G)).toString("utf8")}async function P(j,G=!1){if(!b)return O(j);if(j=M(j),G)await Z(V(j)),await U(j,"file",!0);return q(j,"read",async()=>(await $()).readOwnerOnly(j))}async function f(j,G){await Z(V(M(j))),await q(j,"create",async()=>{await(await $()).createPrivateFile(M(j),G)})}async function l(j){await Z(V(M(j))),await q(j,"directory-create",async()=>{await(await $()).createOwnerOnly(M(j),{kind:"dir"})})}async function y(j,G,A={}){j=M(j),G=M(G);let z=A.now??(()=>performance.now()),K=z(),H=A.deadline??1/0,L,_=[0,10,20,40,80,100],x,J=0;for(let W of _){let I=Math.min(L??1/0,H);if(z()>=I)break;if(W)await(A.sleep??((X)=>new Promise((Y)=>setTimeout(Y,X))))(Math.min(W,Math.max(0,I-z())));if(z()>=I)break;let D=z();if(await A.beforeRename?.(),L!==void 0)L+=z()-D;if(z()>=H)break;J++;try{return await(A.rename??F)(j,G),{attempts:J,elapsedMs:z()-K}}catch(X){x??=X;let Y=X;if(!(Y.win32Code!==void 0?Y.win32Code===32||Y.win32Code===33:["EBUSY","EPERM","EACCES"].includes(Y.code??"")&&!Y.reason))break;L??=z()+500}}let Q=new R(G,"rename",x??Object.assign(Error("Publication deadline expired"),{code:"ETIMEDOUT"}));throw Q.attempts=J,Q.elapsedMs=z()-K,Q}async function n(j,G,A={}){j=M(j),await w(V(j));try{await U(j,"file",!0)}catch(J){if(J.code!=="ENOENT")throw J}let z=M(A.stagePath??`${j}.${k()}.tmp`);if(V(z)!==V(j))throw new R(j,"stage-directory",{code:"EXDEV"});let K=!1,H=!1,L={attempts:0,elapsedMs:0},_="stage-create",x=(J)=>{try{A.onOutcome?.({path:j,stage:J?.stage??"published",published:H,fileDurable:H,durabilityConfirmed:!1,attempts:J?.attempts??L.attempts,elapsedMs:J?.elapsedMs??L.elapsedMs,...J&&{code:J.code,win32Code:J.win32Code}})}catch{}};try{if(await f(z,G),K=!0,_="before-rename",L=await y(z,j,A),K=!1,H=!0,_="published-callback",A.onRenamed?.(),_="published-verify",await U(j,"file"),A.durable&&A.durability!=="file-only-on-windows")throw new R(j,"directory-sync-unsupported",{code:"ENOTSUP"});x()}catch(J){let Q=J instanceof R?J:new R(j,_,J);if(Q.published=H,Q.fileDurable=H,H)Object.assign(Q,L);if(K){try{await C(z)}catch{Q.orphanPath=z}K=!1}throw x(Q),Q}finally{if(K)await C(z).catch(()=>{})}}
-export{b as Ue,R as Ve,q as We,Z as Xe,U as Ye,w as Ze,d as _e,f as $e,l as af,y as bf,n as cf};