@cortexkit/pi-anthropic-auth 2.2.8 → 2.4.0

package/dist/native.d.ts

@@ -28,6 +28,7 @@ export interface PiVaultPollOptions {
 }
 export declare class PiNativeRuntime {
     private readonly paths;
+    private readonly holderRegistration;
     private readonly initialization;
     private readonly env;
     private vaultWatch;

package/dist/native.js

@@ -1,5 +1,5 @@
 import { resolve } from 'node:path';
-import { acquireNativeAccountRuntime, createNativeUsagePublisher, getAccountStatePath, getHostClaustrumEnrollmentPaths, isKillswitchEnabled, killswitchPassesPolicy, logger, nativeAccountCanServe, nativeMigrationAuthorityPhase, nativeRuntimeOptionIdentity, quotaSnapshotHasStandardWindows, quotaSnapshotPassesModelScope, quotaSnapshotPassesPolicy, readNativeAccountsForRequest, readNativeMigrationJournal, resolveClaustrumConnectionPath, resolveLocalRoutingDestination, resolveNativePoolPaths, } from '@cortexkit/anthropic-auth-core';
+import { acquireNativeAccountRuntime, createNativeUsagePublisher, getAccountStatePath, getHostClaustrumEnrollmentPaths, isKillswitchEnabled, killswitchPassesPolicy, logger, nativeAccountCanServe, nativeMigrationAuthorityPhase, nativeRuntimeOptionIdentity, quotaSnapshotHasStandardWindows, quotaSnapshotPassesModelScope, quotaSnapshotPassesPolicy, readNativeAccountsForRequest, readNativeMigrationJournal, registerNativePoolHolder, resolveClaustrumConnectionPath, resolveLocalRoutingDestination, resolveNativePoolPaths, } from '@cortexkit/anthropic-auth-core';
 import { getPiAccountStoragePath, getPiClaustrumConnectionOptions, getPiConfigDir, requirePiNativeHostAuth, } from './paths.js';
 export function piAttemptAccessToken(attempt) {
     return attempt.source === 'vault'
@@ -30,6 +30,18 @@ function requestPolicy(routeId, modelId) {
 }
 const runtimes = new Map();
 const RUNTIME_LIMIT = 16;
+const closingRuntimes = new Map();
+function closeRuntime(entry) {
+    const closing = entry.runtime.close();
+    const pending = closingRuntimes.get(entry.storagePath) ?? new Set();
+    closingRuntimes.set(entry.storagePath, pending);
+    pending.add(closing);
+    void closing.then(() => {
+        pending.delete(closing);
+        if (!pending.size)
+            closingRuntimes.delete(entry.storagePath);
+    }, () => { });
+}
 function runtimeCacheKey(storagePath) {
     const enrollment = getHostClaustrumEnrollmentPaths('pi');
     return JSON.stringify([
@@ -60,6 +72,7 @@ export function isNativeMigrationRequired(error) {
 export const PI_VAULT_POLL_INTERVAL_MS = 2000;
 export class PiNativeRuntime {
     paths;
+    holderRegistration;
     initialization;
     env;
     vaultWatch;
@@ -82,7 +95,19 @@ export class PiNativeRuntime {
         const poll = options.vaultPoll ?? { intervalMs: PI_VAULT_POLL_INTERVAL_MS };
         const identity = getPiClaustrumConnectionOptions(storagePath).identity;
         this.paths = resolveNativePoolPaths(storagePath);
-        this.initialization = this.paths.then((paths) => {
+        // Record that this process uses these files before any pool I/O, so a
+        // later version never moves them while it runs. A refusal (the files
+        // were moved, or an override points into a managed folder) fails
+        // initialization, which every request then reports.
+        this.holderRegistration = this.paths.then((paths) => registerNativePoolHolder({
+            paths,
+            role: 'pi',
+            kind: 'pi',
+            onLockEvent: options.local?.onLockEvent,
+        }));
+        void this.holderRegistration.catch(() => { });
+        this.initialization = this.holderRegistration.then(async () => {
+            const paths = await this.paths;
             const runtime = acquireNativeAccountRuntime({
                 paths,
                 host: 'pi',
@@ -278,6 +303,7 @@ export class PiNativeRuntime {
     close() {
         this.closed = true;
         this.vaultWatch?.close();
+        void this.holderRegistration.then((registration) => registration.close(), () => { });
         this.closing ??= (async () => {
             await this.usagePublications.drain();
             await this.drainRoutingPublications();
@@ -316,19 +342,22 @@ export function getPiNativeRuntime(storagePath = getPiAccountStoragePath(), opti
         const oldest = runtimes.keys().next().value;
         if (oldest === undefined)
             break;
-        void runtimes.get(oldest)?.runtime.close();
+        const evicted = runtimes.get(oldest);
+        if (evicted)
+            closeRuntime(evicted);
         runtimes.delete(oldest);
     }
     runtimes.set(key, { contextKey, storagePath: resolve(storagePath), runtime });
     return runtime;
 }
 export function closePiNativeRuntime(storagePath = getPiAccountStoragePath()) {
-    const closing = [];
     for (const [key, entry] of runtimes) {
         if (entry.storagePath !== resolve(storagePath))
             continue;
         runtimes.delete(key);
-        closing.push(entry.runtime.close());
+        closeRuntime(entry);
     }
-    return Promise.all(closing).then(() => { });
+    // Eviction removes cache entries before their quota drain finishes. Shutdown
+    // must also join those closes, not only the runtimes still in the cache.
+    return Promise.all(closingRuntimes.get(resolve(storagePath)) ?? []).then(() => { });
 }

package/dist/stream.js

@@ -114,6 +114,7 @@ async function getPiStickyRouter(storagePath) {
             path,
             vaultSeed,
             onLockEvent: runtime.onLockEvent,
+            relocationGuard: runtime.relocationGuard,
         });
         setBoundedService(stickyRouters, path, router);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/pi-anthropic-auth",
-  "version": "2.2.8",
+  "version": "2.4.0",
   "type": "module",
   "repository": {
     "type": "git",
@@ -36,7 +36,7 @@
     "prepublishOnly": "bun run build"
   },
   "dependencies": {
-    "@cortexkit/anthropic-auth-core": "2.2.8"
+    "@cortexkit/anthropic-auth-core": "2.4.0"
   },
   "peerDependencies": {
     "@earendil-works/pi-ai": ">=0.86.1 <2",