@cortexkit/pi-openai-auth 1.0.5 → 1.2.0

package/dist/index.d.ts

@@ -2,7 +2,7 @@ import { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import "@cortexkit/private-files";
 import { ClaustrumClient, EnrollmentPollOutcome } from "@cortexkit/claustrum-client";
 import { Api, AssistantMessageEventStream, Context, Model, SimpleStreamOptions } from "@earendil-works/pi-ai";
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/pi-slot/slot.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/pi-slot/slot.d.ts
 interface PiSlotInspection {
   slot: 'original' | 'placeholder' | 'foreign' | 'empty';
   stash: 'valid' | 'missing';
@@ -13,7 +13,7 @@ interface PiSlot {
   exitVault(): Promise<'restored' | 'conflict' | 'nothing-to-do'>;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/schema.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/schema.d.ts
 type OAuthCredential = {
   type: 'oauth';
   access?: string;
@@ -202,7 +202,7 @@ interface PoolRow {
   unbound?: true;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/errors.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/errors.d.ts
 /** Every library operation that can fail, as named in the failure value. */
 type PoolOperation = 'initialize' | 'add' | 'replace' | 'rotate' | 'disable' | 'enable' | 'remove' | 'reorder' | 'updateSettings' | 'recordIdentity' | 'updateProviderState' | 'refresh' | 'pull' | 'publishRoster';
 /**
@@ -249,12 +249,12 @@ declare class PoolOperationError extends Error {
   });
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/hooks.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/hooks.d.ts
 interface PoolLogger {
   warn(message: string, data?: unknown): void;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/fs/refresh-file-lock.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/fs/refresh-file-lock.d.ts
 interface LockLoss {
   readonly reason: 'taken-over' | 'expired' | 'unreadable' | 'renewal-failed' | 'marker-lost';
   readonly expectedOwnerId: string;
@@ -269,7 +269,7 @@ interface RefreshFileLock {
   whenLost(): Promise<LockLoss>;
   hasLost(): boolean;
 }
-declare function acquireRefreshFileLock(options: {
+type RefreshFileLockOptions = {
   name: string;
   ttlMs: number;
   /**
@@ -278,7 +278,6 @@ declare function acquireRefreshFileLock(options: {
    * be one host's path.
    */
   path: string;
-  now?: () => number;
   renew?: boolean;
   renewIntervalMs?: number;
   /** Notifies a live-owner refusal without awaiting; observer failures are ignored. */
@@ -286,9 +285,11 @@ declare function acquireRefreshFileLock(options: {
   /** Synchronous, never awaited; throws and returned promise/thenable rejections are isolated. */
   onRenewalTimer?: (event: 'scheduled' | 'cancelled') => void;
   onStep?: (step: 'stale-marker-stat' | 'stale-marker-claimed' | 'stale-lock-observed' | 'lock-read-ready' | 'lock-missing' | 'stale-lock-confirmed' | 'stale-lock-removed' | 'stale-lock-recreated' | 'eviction-marker-acquired' | 'renewal-owner-confirmed' | 'renewal-marker-unavailable' | 'renewal-write-fenced' | 'renewal-write-ready' | 'renewal-write-finished' | 'relinquish-read' | 'renewal-finished' | 'release-owner-confirmed') => void | Promise<void>;
-}): Promise<RefreshFileLock | null>;
+};
+/** Filesystem leases share wall time across all callers and processes. */
+declare function acquireRefreshFileLock(options: RefreshFileLockOptions): Promise<RefreshFileLock | null>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/refresh-lock.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/refresh-lock.d.ts
 type LockStep = NonNullable<Parameters<typeof acquireRefreshFileLock>[0]['onStep']> extends ((step: infer S) => unknown) ? S : never;
 /** Tuning shared by every lock the store takes; each field is overridable. */
 interface PoolLockOptions {
@@ -309,7 +310,6 @@ type LockEvent = {
   path: string;
 };
 interface LockEnvironment {
-  now: () => number;
   onLockEvent?: (event: LockEvent) => void;
   onLockStep?: (lock: {
     name: string;
@@ -321,7 +321,7 @@ interface LockEnvironment {
   }, event: 'scheduled' | 'cancelled') => void;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/mutate.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/mutate.d.ts
 /** Named points on the write path, for crash and ownership injection. */
 type WriteStep = 'before-config-write' | 'after-config-write' | 'before-state-write' | 'after-state-write';
 /** Awaitable pause points on the pull and refresh paths. */
@@ -356,11 +356,11 @@ interface StoreContext {
 /** What `initializePool` did. */
 type InitializeOutcome = 'initialized' | 'already-ready';
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/runtime.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/runtime.d.ts
 /** Where a pull was fired from; `load` fires at most once per process per row. */
 type PullReason = 'load' | 'add' | 'replace' | 'admission';
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/attribution.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/attribution.d.ts
 /**
  * What a pull or refresh captured about its row (named by id alongside) when
  * it was issued. A result applies only while the row with that id still has
@@ -383,7 +383,7 @@ interface Attribution {
   identity?: string;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/rows.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/rows.d.ts
 type FailureHook = (rowId: string, error: PoolOperationError) => void | Promise<void>;
 interface RowOperationOptions {
   /** Called once, awaited, on every non-success path, before locks release. */
@@ -599,7 +599,7 @@ interface RowTransitionResult {
   providerState?: unknown;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/provider-state.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/provider-state.d.ts
 /**
  * Receives a private copy of the row's provider state (undefined when the row
  * shows none) and the row as loaded under the locks, and returns the next
@@ -635,7 +635,7 @@ declare const DECLINE_TRANSITION: unique symbol;
  */
 type RowTransitionMutator = (current: unknown | undefined, row: PoolRow) => unknown | typeof DECLINE_TRANSITION | Promise<unknown | typeof DECLINE_TRANSITION>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/publication.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/publication.d.ts
 interface PublishPlan {
   operationId: string;
   remove: Array<{
@@ -678,7 +678,7 @@ interface PublishResult {
   receipt: PublicationReceipt;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/pull.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/pull.d.ts
 /** What a pull is issued with: the credential and its attribution tuple. */
 interface PullRequest {
   id: string;
@@ -689,7 +689,7 @@ interface PullRequest {
 }
 type PullHook = (request: PullRequest) => Promise<unknown>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/refresh.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/refresh.d.ts
 /** What the injected provider refresh function returns. */
 interface ProviderRefreshResult {
   access: string;
@@ -752,7 +752,7 @@ type RefreshOutcome = {
   reason: string;
 };
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/settings.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/settings.d.ts
 /** The plugin's settings: every top-level config key except the pool-owned ones. */
 type PoolSettings = Record<string, unknown>;
 type SettingsRead = {
@@ -796,7 +796,7 @@ type UpdateSettingsResult = {
   outcome: 'updated' | 'unchanged';
 };
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/store/pool.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/store/pool.d.ts
 interface OpenPoolStoreOptions {
   /** The provider every row of this pool belongs to; keys the provider-wide lock. */
   provider: string;
@@ -829,7 +829,7 @@ interface OpenPoolStoreOptions {
   requireCredentialStamps?: boolean;
   /** Require an exact secret fingerprint for every roster-publication removal. */
   requireRemovedFingerprint?: boolean;
-  /** Injected clock for leases, refresh stamps and `addedAt`. */
+  /** Logical clock for refresh stamps and `addedAt`; filesystem leases always use wall time. */
   now?: () => number;
   /**
    * Ordered store-lock list held across every read-modify-write. Defaults to
@@ -1202,14 +1202,14 @@ interface RefreshAllQuotaResult {
   permanent?: boolean;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/claustrum/insula.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/claustrum/insula.d.ts
 /** Optional transport for custom scoped clients; getUsage must not retry refusals. */
 interface InsulaUsageTransport {
   connectionFile: string;
   getUsage(): Promise<unknown>;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/claustrum/custody.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/claustrum/custody.d.ts
 type ClaustrumScopedClient = Pick<ClaustrumClient, 'listScoped' | 'getScoped' | 'reportAuthFailureScoped' | 'close'> & {
   insula?: InsulaUsageTransport;
 };
@@ -1229,6 +1229,30 @@ interface SkippedVaultRecord {
   readonly credentialId?: string;
   readonly reason: SkippedVaultReason;
 }
+/**
+ * One grant this consumer's enrollment holds, as the vault's list reply names
+ * it: for example `{ selectorKind: 'category', selector: 'openai-native',
+ * operation: 'read' }`. `selectorKind` is `exact` (the selector is a credential
+ * id) or `category` (a bare category name); both open strings.
+ */
+interface VaultGrantTuple {
+  readonly selectorKind: string;
+  readonly selector: string;
+  readonly operation: string;
+}
+/**
+ * What this consumer is granted, independent of what those grants currently
+ * reach. It is what tells two empty listings apart: no rows with `grants === 0`
+ * means no grant at all (the fix is `ck auth grant`), while no rows with
+ * `grants > 0` means a grant that reaches no credential, usually logins that
+ * lack the category (`ck auth reclassify --from-registry`); `tuples` names the
+ * selector that matched nothing. Never written to the roster file.
+ */
+interface VaultGrantReach {
+  /** How many grants the consumer holds, deposit grants excluded. */
+  readonly grants: number;
+  readonly tuples: readonly VaultGrantTuple[];
+}
 /**
  * Where a receipt's `accountIdentity` came from: the vault asserted it in the
  * served reply, the plugin's `parseIdentity` read it from the served token, or
@@ -1275,7 +1299,7 @@ interface ClaustrumScopedAttempt {
   readonly expiresAtMs: number | null;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/quota/map.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/quota/map.d.ts
 interface QuotaReadingEntry {
   scope: string;
   label: string;
@@ -1330,7 +1354,7 @@ interface QuotaMap {
   counters?: Record<string, QuotaCounter>;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/quota/merge.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/quota/merge.d.ts
 interface ObservedReading {
   /** Defaults to `all`. */
   scope?: string;
@@ -1368,7 +1392,7 @@ interface QuotaObservation {
   counters?: Record<string, QuotaCounter>;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/claustrum/interlock.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/claustrum/interlock.d.ts
 /**
  * The declined-account interlock: the user's "do not use this vault account",
  * kept on the consumer side because the vault has no notion of it.
@@ -1387,7 +1411,7 @@ interface DeclinedAccount {
   readonly accountIdentity?: string;
 }
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/claustrum/roster.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/claustrum/roster.d.ts
 /**
  * One vault account as the pool sees it. It carries no bearer material: the
  * access token is fetched from the vault for every send. Several vault
@@ -1442,7 +1466,7 @@ interface VaultRosterFile {
  */
 type QuotaReceipt = Pick<ClaustrumScopedAttempt, 'credentialId' | 'accountIdentity' | 'accountIdentitySource' | 'expectedAccountIdentity'>;
 //#endregion
-//#region ../../node_modules/.bun/@cortexkit+common-auth@0.17.1+0d2d5e37d881ac14/node_modules/@cortexkit/common-auth/dist/claustrum/enrollment.d.ts
+//#region ../../node_modules/.bun/@cortexkit+common-auth@0.19.0+eac60b769bf9196b/node_modules/@cortexkit/common-auth/dist/claustrum/enrollment.d.ts
 interface ClaustrumEnrollmentClient {
   enrollPropose(input: {
     name: string;
@@ -1502,6 +1526,8 @@ interface VaultPaths extends ClaustrumEnrollmentPaths {
 /** One vault account as routing sees it. */
 interface VaultRoute {
   id: string;
+  /** The vault credential name, distinct from its stable routing id. */
+  credentialId?: string;
   kind: 'oauth' | 'api-key';
   /** The ChatGPT account it signs in as, when the vault knows it. */
   identity?: string;
@@ -1586,6 +1612,12 @@ declare class OpenAiVault {
    */
   refresh(): Promise<VaultRosterFile | undefined>;
   snapshot(): VaultRosterFile | undefined;
+  /**
+   * What the vault says this host is granted, from the latest list, without
+   * any I/O. Undefined is unknown (a vault that does not report grants, or
+   * nothing listed yet), never zero grants.
+   */
+  grantReach(): VaultGrantReach | undefined;
   /** Whether the vault serves this host any account (whatever its state). */
   serves(): boolean;
   /**