instar 1.3.522 → 1.3.524

package/dist/core/CredentialLocationLedger.js

@@ -0,0 +1,351 @@
+/**
+ * CredentialLocationLedger — the bookkeeping core of live credential re-pointing.
+ *
+ * Spec: docs/specs/live-credential-repointing-rebalancer.md §2.2.
+ *
+ * A machine-local durable ledger (`<stateDir>/credential-locations.json`) that records,
+ * for each config-home SLOT, which pool account's credential currently lives there. It is
+ * the single source of truth for "which account is in which home" once live re-pointing is
+ * enabled — every consumer that today treats a pool account's enrollment `configHome` as its
+ * live location instead resolves through `slotOf(accountId)` / `tenantOf(slot)` here.
+ *
+ * This module is Step 2 of Increment A: the bookkeeping + durability + seeding/recovery core.
+ * It performs NO keychain writes itself — the staged swap executor (§2.3, Step 5) and the
+ * write funnel (§2.2, Step 4) are separate. The identity oracle it seeds/recovers from is the
+ * `IdentityOracle` interface (Step 3 implements it against the Anthropic OAuth profile endpoint,
+ * `/api/oauth/profile`, routed through the existing intelligence-provider chokepoint).
+ *
+ * Durability posture (the §2.2 contract — NOT SubscriptionPool's posture):
+ *   - missing file        → NEVER-SEEDED (mode 'ok', empty assignments). Reads return null →
+ *                           consumers fall back to today's enrollment-home behavior. This is
+ *                           normal, not a degradation.
+ *   - corrupt/unparseable → UNKNOWN MODE (fail-closed for moves: every mutation refuses;
+ *                           fail-open-LOUD for reads: reads return null AND one HIGH attention
+ *                           item names the degradation). Recovery is a fresh `seedFromOracle()`.
+ *                           This is deliberately NOT a silent fresh-start (No Silent Degradation):
+ *                           a quiet reset here could place a session onto the wrong account.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+/** The on-disk schema version this module writes. Bumped only on a breaking shape change. */
+export const CREDENTIAL_LEDGER_SCHEMA_VERSION = 1;
+/** Thrown when a mutation is attempted while the ledger is in UNKNOWN mode (fail-closed). */
+export class CredentialLedgerUnknownModeError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CredentialLedgerUnknownModeError';
+    }
+}
+const MAX_COMPLETED_JOURNAL = 50;
+const NON_CLAUDE_FRAMEWORKS = new Set(['codex-cli', 'gemini-cli', 'pi-cli']);
+/** A claude-code account is the implicit default (framework undefined or 'claude-code'). */
+function isClaudeCodeAccount(a) {
+    return !a.framework || a.framework === 'claude-code';
+}
+export class CredentialLocationLedger {
+    storePath;
+    pool;
+    oracle;
+    emitAttention;
+    now;
+    store;
+    /** UNKNOWN mode — set when the on-disk ledger was present but corrupt. Fail-closed for moves. */
+    unknownMode = false;
+    /** Dedupe the UNKNOWN-mode attention item so a re-read storm raises it once. */
+    unknownAttentionRaised = false;
+    /** In-memory index: accountId → slot (rebuilt on every mutation/load). */
+    slotByAccount = new Map();
+    /** In-memory index: slot → accountId. */
+    accountBySlot = new Map();
+    constructor(deps) {
+        this.storePath = path.join(deps.stateDir, 'credential-locations.json');
+        this.pool = deps.pool;
+        this.oracle = deps.oracle;
+        this.emitAttention = deps.emitAttention;
+        this.now = deps.now ?? (() => new Date().toISOString());
+        this.store = this.load();
+        this.reindex();
+        if (this.unknownMode)
+            void this.raiseUnknownModeAttention();
+    }
+    // ─── Load / save (atomic tmp+rename — the SubscriptionPool.save pattern) ──────────
+    load() {
+        if (!fs.existsSync(this.storePath)) {
+            // NEVER-SEEDED — not corrupt. Empty ledger; reads fall back to enrollment homes.
+            return { version: 0, assignments: [], journal: [] };
+        }
+        try {
+            const data = JSON.parse(fs.readFileSync(this.storePath, 'utf-8'));
+            if (data &&
+                typeof data.version === 'number' &&
+                Array.isArray(data.assignments) &&
+                Array.isArray(data.journal)) {
+                return data;
+            }
+            // Present but wrong shape → corrupt.
+            this.unknownMode = true;
+        }
+        catch {
+            // Present but unparseable → corrupt. NOT a silent fresh-start: UNKNOWN mode is entered
+            // and a HIGH attention item is raised by the constructor. (No Silent Degradation.)
+            this.unknownMode = true;
+        }
+        return { version: 0, assignments: [], journal: [] };
+    }
+    save() {
+        try {
+            const dir = path.dirname(this.storePath);
+            fs.mkdirSync(dir, { recursive: true });
+            const tmpPath = `${this.storePath}.${process.pid}.tmp`;
+            fs.writeFileSync(tmpPath, JSON.stringify(this.store, null, 2) + '\n');
+            fs.renameSync(tmpPath, this.storePath);
+        }
+        catch {
+            // @silent-fallback-ok — a persistence failure leaves the in-memory store authoritative
+            // for this process; the next mutation retries the write. The ledger is bookkeeping, not
+            // a credential, so an unwritten entry never strands a login — at worst a recovery probe
+            // re-derives it. Surfacing every transient fs hiccup would be noise, not signal.
+        }
+    }
+    reindex() {
+        this.slotByAccount.clear();
+        this.accountBySlot.clear();
+        for (const a of this.store.assignments) {
+            // Tenant-less quarantine markers (accountId === '') carry no resolvable tenant — a
+            // seed refusal / unavailable probe records the slot as quarantined-unknown, and a read
+            // of it must be null (caller falls back), never the empty string.
+            if (!a.accountId)
+                continue;
+            this.slotByAccount.set(a.accountId, a.slot);
+            this.accountBySlot.set(a.slot, a.accountId);
+        }
+    }
+    // ─── Sync in-memory reads (never disk/parse per spawn; never throw) ───────────────
+    /** Current slot holding `accountId`'s credential, or null (UNKNOWN mode / never-seeded). */
+    slotOf(accountId) {
+        if (this.unknownMode)
+            return null;
+        return this.slotByAccount.get(accountId) ?? null;
+    }
+    /** Account currently tenanting `slot`, or null (UNKNOWN mode / never-seeded). */
+    tenantOf(slot) {
+        if (this.unknownMode)
+            return null;
+        return this.accountBySlot.get(slot) ?? null;
+    }
+    isUnknownMode() {
+        return this.unknownMode;
+    }
+    /** True when the ledger has at least one assignment (has been seeded). */
+    isSeeded() {
+        return !this.unknownMode && this.store.assignments.length > 0;
+    }
+    getAssignments() {
+        return this.store.assignments.slice();
+    }
+    getAssignment(slot) {
+        return this.store.assignments.find((a) => a.slot === slot) ?? null;
+    }
+    getJournal() {
+        return this.store.journal.slice();
+    }
+    get version() {
+        return this.store.version;
+    }
+    // ─── Mutations (single-writer; refuse in UNKNOWN mode — fail-closed for moves) ─────
+    assertMutable(op) {
+        if (this.unknownMode) {
+            throw new CredentialLedgerUnknownModeError(`ledger is in UNKNOWN mode (corrupt on-disk state) — ${op} refused; recover via seedFromOracle()`);
+        }
+    }
+    /** Record (or re-point) `slot`'s tenant to `accountId`. Single-writer; bumps version. */
+    recordAssignment(slot, accountId, opts) {
+        this.assertMutable('recordAssignment');
+        const at = this.now();
+        const existing = this.store.assignments.find((a) => a.slot === slot);
+        // A slot's tenant changing means the previous tenant is no longer here — drop any stale
+        // assignment that claimed the SAME accountId in a different slot (one home per credential).
+        this.store.assignments = this.store.assignments.filter((a) => a.slot !== slot && a.accountId !== accountId);
+        const assignment = {
+            slot,
+            accountId,
+            since: existing && existing.accountId === accountId ? existing.since : at,
+            lastVerifiedAt: opts?.verifiedAt !== undefined ? opts.verifiedAt : (existing?.lastVerifiedAt ?? null),
+            quarantined: false,
+        };
+        this.store.assignments.push(assignment);
+        this.bumpAndJournal({ op: opts?.op ?? 'swap', phase: 'done', slots: [slot], detail: `tenant=${accountId}` });
+        this.reindex();
+        this.save();
+        return assignment;
+    }
+    /** Mark a slot quarantined (excluded from balancing) — oracle unavailable / divergence. */
+    quarantineSlot(slot, reason) {
+        this.assertMutable('quarantineSlot');
+        const a = this.store.assignments.find((x) => x.slot === slot);
+        if (a) {
+            a.quarantined = true;
+        }
+        else {
+            // Quarantine a slot we have no confirmed tenant for: record a tenant-less quarantine
+            // marker so the slot is durably excluded until a clean probe clears it.
+            this.store.assignments.push({ slot, accountId: '', since: this.now(), lastVerifiedAt: null, quarantined: true });
+        }
+        this.bumpAndJournal({ op: 'quarantine', phase: 'done', slots: [slot], detail: reason });
+        this.reindex();
+        this.save();
+    }
+    /** Lift a quarantine after a clean re-probe. */
+    unquarantineSlot(slot) {
+        this.assertMutable('unquarantineSlot');
+        const a = this.store.assignments.find((x) => x.slot === slot);
+        if (a) {
+            a.quarantined = false;
+            this.bumpAndJournal({ op: 'unquarantine', phase: 'done', slots: [slot] });
+            this.reindex();
+            this.save();
+        }
+    }
+    /** Stamp a slot's lastVerifiedAt after an identity-oracle confirmation. */
+    markVerified(slot, at) {
+        this.assertMutable('markVerified');
+        const a = this.store.assignments.find((x) => x.slot === slot);
+        if (a) {
+            a.lastVerifiedAt = at ?? this.now();
+            this.save();
+        }
+    }
+    /** Append a journal entry for an in-flight swap phase (used by the executor in Step 5). */
+    appendJournal(entry) {
+        this.assertMutable('appendJournal');
+        return this.bumpAndJournal(entry);
+    }
+    bumpAndJournal(entry) {
+        this.store.version += 1;
+        const full = {
+            seq: this.store.version,
+            op: entry.op,
+            phase: entry.phase,
+            slots: entry.slots ?? [],
+            ...(entry.detail !== undefined ? { detail: entry.detail } : {}),
+            at: entry.at ?? this.now(),
+        };
+        this.store.journal.push(full);
+        this.pruneJournal();
+        return full;
+    }
+    /** Keep all non-terminal (in-flight) entries + the last MAX_COMPLETED_JOURNAL terminal ones. */
+    pruneJournal() {
+        const terminal = (p) => p === 'done' || p === 'aborted';
+        const inFlight = this.store.journal.filter((e) => !terminal(e.phase));
+        const completed = this.store.journal.filter((e) => terminal(e.phase));
+        const keptCompleted = completed.slice(-MAX_COMPLETED_JOURNAL);
+        this.store.journal = [...inFlight, ...keptCompleted].sort((a, b) => a.seq - b.seq);
+    }
+    // ─── Seeding / recovery via the identity oracle (§2.2) ────────────────────────────
+    /**
+     * Derive each slot's tenant by probing its CURRENT credential via the oracle, then mapping
+     * email → accountId through the pool. Clears UNKNOWN mode on a clean pass. Per §2.2:
+     *   - oracle unavailable for a slot → quarantine that slot (never guess), continue.
+     *   - email maps to exactly one claude-code account → record the assignment (verified now).
+     *   - ambiguous (≥2 accounts share the email) or unknown email → REFUSE auto-assign for that
+     *     slot + raise an attention item; never guess.
+     * Slots = the distinct enrollment `configHome`s of claude-code pool accounts.
+     */
+    async seedFromOracle() {
+        const claudeAccounts = this.pool.list().filter(isClaudeCodeAccount);
+        const slots = Array.from(new Set(claudeAccounts.map((a) => a.configHome))).filter(Boolean);
+        const outcomes = [];
+        // A clean slate for the rebuild; UNKNOWN mode is cleared as soon as we begin a real probe
+        // pass (the rebuild is the recovery path the spec names).
+        this.store = { version: this.store.version, assignments: [], journal: this.store.journal };
+        this.unknownMode = false;
+        this.unknownAttentionRaised = false;
+        this.bumpAndJournal({ op: 'seed', phase: 'begin', slots, detail: `${slots.length} slot(s)` });
+        for (const slot of slots) {
+            let result;
+            try {
+                result = await this.oracle.resolveSlotTenant(slot);
+            }
+            catch (err) {
+                // An oracle that THROWS is treated identically to unavailable (§2.11 — never a guess,
+                // never a mismatch). This is loud at the slot level (quarantine), not a silent swallow.
+                result = { unavailable: true, reason: `oracle threw: ${err?.message ?? 'unknown'}` };
+            }
+            if (result.unavailable || !result.email) {
+                this.store.assignments.push({ slot, accountId: '', since: this.now(), lastVerifiedAt: null, quarantined: true });
+                outcomes.push({ slot, result: 'unavailable', reason: result.reason ?? 'oracle unavailable' });
+                continue;
+            }
+            const matches = claudeAccounts.filter((a) => a.email && a.email === result.email);
+            if (matches.length === 1) {
+                this.store.assignments.push({
+                    slot,
+                    accountId: matches[0].id,
+                    since: this.now(),
+                    lastVerifiedAt: this.now(),
+                    quarantined: false,
+                });
+                outcomes.push({ slot, result: 'assigned', accountId: matches[0].id, email: result.email });
+            }
+            else if (matches.length > 1) {
+                // Ambiguous — two pool records, one email (legal under multi-grant). Never guess.
+                this.store.assignments.push({ slot, accountId: '', since: this.now(), lastVerifiedAt: null, quarantined: true });
+                outcomes.push({ slot, result: 'ambiguous', email: result.email, reason: `${matches.length} pool accounts share ${result.email}` });
+                await this.raiseSeedRefusalAttention(slot, 'ambiguous', `${matches.length} accounts share ${result.email}`);
+            }
+            else {
+                // Probed email matches no pool account.
+                this.store.assignments.push({ slot, accountId: '', since: this.now(), lastVerifiedAt: null, quarantined: true });
+                outcomes.push({ slot, result: 'unknown-email', email: result.email, reason: `no pool account for ${result.email}` });
+                await this.raiseSeedRefusalAttention(slot, 'unknown-email', `no pool account for ${result.email}`);
+            }
+        }
+        this.bumpAndJournal({ op: 'seed', phase: 'done', slots, detail: `${outcomes.filter((o) => o.result === 'assigned').length} assigned` });
+        this.reindex();
+        this.save();
+        return outcomes;
+    }
+    // ─── Attention (LOUD degradation surfaces) ───────────────────────────────────────
+    async raiseUnknownModeAttention() {
+        if (this.unknownAttentionRaised || !this.emitAttention)
+            return;
+        this.unknownAttentionRaised = true;
+        try {
+            await this.emitAttention({
+                id: 'credential-ledger-unknown-mode',
+                title: 'Credential location ledger is in UNKNOWN mode',
+                summary: 'The credential-locations ledger on disk was unreadable. Credential swaps are refused (fail-closed) and credential reads fall back to enrollment homes until a fresh identity-oracle probe rebuilds it.',
+                description: 'Recovery: re-seed via the identity oracle (POST /credentials/locations re-probe, or seedFromOracle()). No credential was moved while in this state.',
+                category: 'credential-repointing',
+                priority: 'HIGH',
+                sourceContext: 'credential-location-ledger',
+            });
+        }
+        catch {
+            // @silent-fallback-ok — the attention emitter is best-effort; a delivery failure must
+            // not throw out of the ledger constructor and crash boot. The UNKNOWN-mode posture
+            // (reads-null + mutations-refuse) is still in force regardless of whether the notice
+            // was delivered, so the safety behavior does not depend on this emit.
+        }
+    }
+    async raiseSeedRefusalAttention(slot, kind, detail) {
+        if (!this.emitAttention)
+            return;
+        try {
+            await this.emitAttention({
+                id: `credential-ledger-seed-refusal:${kind}:${slot}`,
+                title: `Credential ledger could not auto-assign a slot (${kind})`,
+                summary: `Seeding refused to guess the tenant of ${slot}: ${detail}. The slot is quarantined (excluded from balancing) until resolved.`,
+                category: 'credential-repointing',
+                priority: 'HIGH',
+                sourceContext: 'credential-location-ledger',
+            });
+        }
+        catch {
+            // @silent-fallback-ok — best-effort notice; the quarantine (the actual safety action) is
+            // already durably recorded in the ledger whether or not the notice is delivered.
+        }
+    }
+}
+//# sourceMappingURL=CredentialLocationLedger.js.map

package/dist/core/CredentialLocationLedger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialLocationLedger.js","sourceRoot":"","sources":["../../src/core/CredentialLocationLedger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,6FAA6F;AAC7F,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AA6FlD,6FAA6F;AAC7F,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IACzD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;IACjD,CAAC;CACF;AAWD,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE7E,4FAA4F;AAC5F,SAAS,mBAAmB,CAAC,CAAoB;IAC/C,OAAO,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,aAAa,CAAC;AACvD,CAAC;AAED,MAAM,OAAO,wBAAwB;IAClB,SAAS,CAAS;IAClB,IAAI,CAAiB;IACrB,MAAM,CAAiB;IACvB,aAAa,CAAkE;IAC/E,GAAG,CAAe;IAE3B,KAAK,CAAgC;IAC7C,iGAAiG;IACzF,WAAW,GAAG,KAAK,CAAC;IAC5B,gFAAgF;IACxE,sBAAsB,GAAG,KAAK,CAAC;IACvC,0EAA0E;IAClE,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClD,yCAAyC;IACjC,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAElD,YAAY,IAAkC;QAC5C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;QACvE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,IAAI,IAAI,CAAC,WAAW;YAAE,KAAK,IAAI,CAAC,yBAAyB,EAAE,CAAC;IAC9D,CAAC;IAED,qFAAqF;IAE7E,IAAI;QACV,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,iFAAiF;YACjF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACtD,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;YAClE,IACE,IAAI;gBACJ,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;gBAChC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;gBAC/B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAC3B,CAAC;gBACD,OAAO,IAAqC,CAAC;YAC/C,CAAC;YACD,qCAAqC;YACrC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,uFAAuF;YACvF,mFAAmF;YACnF,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAC1B,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACtD,CAAC;IAEO,IAAI;QACV,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;YACvD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACtE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,uFAAuF;YACvF,wFAAwF;YACxF,wFAAwF;YACxF,iFAAiF;QACnF,CAAC;IACH,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACvC,mFAAmF;YACnF,uFAAuF;YACvF,kEAAkE;YAClE,IAAI,CAAC,CAAC,CAAC,SAAS;gBAAE,SAAS;YAC3B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,qFAAqF;IAErF,4FAA4F;IAC5F,MAAM,CAAC,SAAiB;QACtB,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAClC,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;IACnD,CAAC;IAED,iFAAiF;IACjF,QAAQ,CAAC,IAAY;QACnB,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAClC,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IAC9C,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,0EAA0E;IAC1E,QAAQ;QACN,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;IAChE,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IACxC,CAAC;IAED,aAAa,CAAC,IAAY;QACxB,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;IACrE,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACpC,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;IAC5B,CAAC;IAED,sFAAsF;IAE9E,aAAa,CAAC,EAAU;QAC9B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,IAAI,gCAAgC,CACxC,uDAAuD,EAAE,wCAAwC,CAClG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,yFAAyF;IACzF,gBAAgB,CAAC,IAAY,EAAE,SAAiB,EAAE,IAA8E;QAC9H,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAC;QACvC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACrE,wFAAwF;QACxF,4FAA4F;QAC5F,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CACpD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,CACpD,CAAC;QACF,MAAM,UAAU,GAAyB;YACvC,IAAI;YACJ,SAAS;YACT,KAAK,EAAE,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YACzE,cAAc,EAAE,IAAI,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,cAAc,IAAI,IAAI,CAAC;YACrG,WAAW,EAAE,KAAK;SACnB,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,SAAS,EAAE,EAAE,CAAC,CAAC;QAC7G,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,2FAA2F;IAC3F,cAAc,CAAC,IAAY,EAAE,MAAc;QACzC,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,EAAE,CAAC;YACN,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,qFAAqF;YACrF,wEAAwE;YACxE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACnH,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED,gDAAgD;IAChD,gBAAgB,CAAC,IAAY;QAC3B,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,EAAE,CAAC;YACN,CAAC,CAAC,WAAW,GAAG,KAAK,CAAC;YACtB,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,YAAY,CAAC,IAAY,EAAE,EAAW;QACpC,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,EAAE,CAAC;YACN,CAAC,CAAC,cAAc,GAAG,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,CAAC;IACH,CAAC;IAED,2FAA2F;IAC3F,aAAa,CAAC,KAAyE;QACrF,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAEO,cAAc,CAAC,KAAyE;QAC9F,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QACxB,MAAM,IAAI,GAAiC;YACzC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO;YACvB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;YACxB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;SAC3B,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gGAAgG;IACxF,YAAY;QAClB,MAAM,QAAQ,GAAG,CAAC,CAAwC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,SAAS,CAAC;QAC/F,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC,CAAC;QAC9D,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IACrF,CAAC;IAED,qFAAqF;IAErF;;;;;;;;OAQG;IACH,KAAK,CAAC,cAAc;QAClB,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3F,MAAM,QAAQ,GAAsB,EAAE,CAAC;QAEvC,0FAA0F;QAC1F,0DAA0D;QAC1D,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC3F,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC,sBAAsB,GAAG,KAAK,CAAC;QACpC,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,UAAU,EAAE,CAAC,CAAC;QAE9F,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,MAA4B,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,sFAAsF;gBACtF,wFAAwF;gBACxF,MAAM,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAkB,GAAa,EAAE,OAAO,IAAI,SAAS,EAAE,EAAE,CAAC;YAClG,CAAC;YAED,IAAI,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACxC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjH,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,oBAAoB,EAAE,CAAC,CAAC;gBAC9F,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC;YAClF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;oBAC1B,IAAI;oBACJ,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;oBACxB,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE;oBACjB,cAAc,EAAE,IAAI,CAAC,GAAG,EAAE;oBAC1B,WAAW,EAAE,KAAK;iBACnB,CAAC,CAAC;gBACH,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YAC7F,CAAC;iBAAM,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,kFAAkF;gBAClF,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjH,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,wBAAwB,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACnI,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,MAAM,mBAAmB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YAC9G,CAAC;iBAAM,CAAC;gBACN,wCAAwC;gBACxC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjH,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,uBAAuB,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrH,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,eAAe,EAAE,uBAAuB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YACrG,CAAC;QACH,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC;QACxI,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,oFAAoF;IAE5E,KAAK,CAAC,yBAAyB;QACrC,IAAI,IAAI,CAAC,sBAAsB,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO;QAC/D,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC;gBACvB,EAAE,EAAE,gCAAgC;gBACpC,KAAK,EAAE,+CAA+C;gBACtD,OAAO,EACL,wMAAwM;gBAC1M,WAAW,EACT,qJAAqJ;gBACvJ,QAAQ,EAAE,uBAAuB;gBACjC,QAAQ,EAAE,MAAM;gBAChB,aAAa,EAAE,4BAA4B;aAC5C,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,sFAAsF;YACtF,mFAAmF;YACnF,qFAAqF;YACrF,sEAAsE;QACxE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,yBAAyB,CAAC,IAAY,EAAE,IAAmC,EAAE,MAAc;QACvG,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC;gBACvB,EAAE,EAAE,kCAAkC,IAAI,IAAI,IAAI,EAAE;gBACpD,KAAK,EAAE,mDAAmD,IAAI,GAAG;gBACjE,OAAO,EAAE,0CAA0C,IAAI,KAAK,MAAM,qEAAqE;gBACvI,QAAQ,EAAE,uBAAuB;gBACjC,QAAQ,EAAE,MAAM;gBAChB,aAAa,EAAE,4BAA4B;aAC5C,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,yFAAyF;YACzF,iFAAiF;QACnF,CAAC;IACH,CAAC;CACF"}

package/dist/core/CredentialWriteFunnel.d.ts

@@ -0,0 +1,77 @@
+/**
+ * CredentialWriteFunnel — Step 4 (primitive) of live credential re-pointing (spec §2.2).
+ *
+ * The SOLE in-process serialization point for credential writes to a config-home slot. Every
+ * in-process keychain credential write (the swap executor, the QuotaPoller 401-refresh closure,
+ * OAuthRefresher / EnrollmentWizard writes, KeychainCredentialProvider.writeCredentials) is meant
+ * to go through `withSlotLock(slot, fn)` so a write can never interleave with another write — or
+ * with a swap — on the SAME slot. A companion lint (Step 4b) forbids those write primitives
+ * outside this funnel, mirroring the SafeGitExecutor / SafeFsExecutor single-funnel precedent.
+ *
+ * This file is the PRIMITIVE only: the lock machinery + its tests. Routing the existing writers
+ * through it and adding the forbidding lint is the next commit (the lint can't land until every
+ * existing writer is routed, or it would break the build).
+ *
+ * Concurrency model (spec §2.2 "Concurrency model"):
+ *   - The server process is the only writer; these locks serialize WITHIN that process.
+ *   - One per-slot lock serializes every write to a given slot.
+ *   - One machine-local single-mover mutex serializes whole SWAPS against each other (a swap
+ *     touches two slots; two concurrent swaps could deadlock on cross-ordered slot locks, so a
+ *     swap takes the single-mover first, then the slot locks in a canonical order).
+ *   - Lock order: single-mover (swaps only) → per-slot locks ordered by slot path → ledger write.
+ *   - Crash-stale lock state is cleared by process restart (all state is in-memory).
+ *
+ * Bounded, never wedged (spec §2.2 "Bounded under the lock"): lock acquisition is a
+ * try-lock-WITH-TIMEOUT. On timeout the caller is told it was SKIPPED with a named reason rather
+ * than blocking forever — a slow holder degrades to a skipped action, never a wedged slot. (The
+ * caller is responsible for bounding any `await` it does INSIDE `fn` — e.g. a refresh fetch must
+ * carry its own `AbortSignal.timeout`; the funnel bounds acquisition, not the work.)
+ */
+/** Outcome of a funnel-guarded operation. `ran:false` = the lock could not be acquired in time. */
+export interface FunnelResult<T> {
+    ran: boolean;
+    /** Present when `ran` is true. */
+    value?: T;
+    /** Present when `ran` is false — a human-readable, credential-free reason. */
+    skippedReason?: string;
+}
+export interface CredentialWriteFunnelOptions {
+    /** Default try-lock timeout for a single slot acquisition (ms). */
+    slotLockTimeoutMs?: number;
+}
+export declare class CredentialWriteFunnel {
+    /** Per-slot serialization: slot → the tail promise of that slot's lock queue. */
+    private readonly slotTails;
+    /** Machine-local single-mover mutex (swaps). In-memory ⇒ a restart clears any crash-stale hold. */
+    private singleMoverHeld;
+    private readonly slotLockTimeoutMs;
+    constructor(opts?: CredentialWriteFunnelOptions);
+    /**
+     * Run `fn` while holding the per-slot lock for `slot`. Serializes against every other
+     * `withSlotLock` on the same slot. Acquisition is bounded: if the lock is not free within
+     * `timeoutMs`, `fn` does NOT run and the result is `{ ran: false, skippedReason }`.
+     */
+    withSlotLock<T>(slot: string, fn: () => Promise<T> | T, opts?: {
+        timeoutMs?: number;
+    }): Promise<FunnelResult<T>>;
+    /**
+     * Run `fn` while holding the per-slot locks for ALL `slots`, acquired in a CANONICAL order
+     * (sorted by path) so two concurrent multi-slot operations can't deadlock on opposite orders.
+     * If ANY slot lock cannot be acquired in time, NO `fn` runs and the result is skipped (the
+     * already-held inner locks are released by unwinding). Used by the swap executor (Step 5).
+     */
+    withSlotLocks<T>(slots: string[], fn: () => Promise<T> | T, opts?: {
+        timeoutMs?: number;
+    }): Promise<FunnelResult<T>>;
+    /**
+     * Run `fn` holding the machine-local single-mover mutex. A swap takes this BEFORE its slot
+     * locks so two swaps never run at once. Try-acquire: if a move is already in flight, `fn`
+     * does NOT run and the result is skipped (never blocks).
+     */
+    withSingleMover<T>(fn: () => Promise<T> | T): Promise<FunnelResult<T>>;
+    /** Test/observability: is the single-mover mutex currently held? */
+    isSingleMoverHeld(): boolean;
+    /** Test/observability: how many slots currently have a live lock queue tail. */
+    get trackedSlotCount(): number;
+}
+//# sourceMappingURL=CredentialWriteFunnel.d.ts.map

package/dist/core/CredentialWriteFunnel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialWriteFunnel.d.ts","sourceRoot":"","sources":["../../src/core/CredentialWriteFunnel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,mGAAmG;AACnG,MAAM,WAAW,YAAY,CAAC,CAAC;IAC7B,GAAG,EAAE,OAAO,CAAC;IACb,kCAAkC;IAClC,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,4BAA4B;IAC3C,mEAAmE;IACnE,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAID,qBAAa,qBAAqB;IAChC,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAC9D,mGAAmG;IACnG,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAE/B,IAAI,GAAE,4BAAiC;IAInD;;;;OAIG;IACG,YAAY,CAAC,CAAC,EAClB,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EACxB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5B,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAuC3B;;;;;OAKG;IACG,aAAa,CAAC,CAAC,EACnB,KAAK,EAAE,MAAM,EAAE,EACf,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EACxB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5B,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAe3B;;;;OAIG;IACG,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAa5E,oEAAoE;IACpE,iBAAiB,IAAI,OAAO;IAI5B,gFAAgF;IAChF,IAAI,gBAAgB,IAAI,MAAM,CAE7B;CACF"}

package/dist/core/CredentialWriteFunnel.js

@@ -0,0 +1,128 @@
+/**
+ * CredentialWriteFunnel — Step 4 (primitive) of live credential re-pointing (spec §2.2).
+ *
+ * The SOLE in-process serialization point for credential writes to a config-home slot. Every
+ * in-process keychain credential write (the swap executor, the QuotaPoller 401-refresh closure,
+ * OAuthRefresher / EnrollmentWizard writes, KeychainCredentialProvider.writeCredentials) is meant
+ * to go through `withSlotLock(slot, fn)` so a write can never interleave with another write — or
+ * with a swap — on the SAME slot. A companion lint (Step 4b) forbids those write primitives
+ * outside this funnel, mirroring the SafeGitExecutor / SafeFsExecutor single-funnel precedent.
+ *
+ * This file is the PRIMITIVE only: the lock machinery + its tests. Routing the existing writers
+ * through it and adding the forbidding lint is the next commit (the lint can't land until every
+ * existing writer is routed, or it would break the build).
+ *
+ * Concurrency model (spec §2.2 "Concurrency model"):
+ *   - The server process is the only writer; these locks serialize WITHIN that process.
+ *   - One per-slot lock serializes every write to a given slot.
+ *   - One machine-local single-mover mutex serializes whole SWAPS against each other (a swap
+ *     touches two slots; two concurrent swaps could deadlock on cross-ordered slot locks, so a
+ *     swap takes the single-mover first, then the slot locks in a canonical order).
+ *   - Lock order: single-mover (swaps only) → per-slot locks ordered by slot path → ledger write.
+ *   - Crash-stale lock state is cleared by process restart (all state is in-memory).
+ *
+ * Bounded, never wedged (spec §2.2 "Bounded under the lock"): lock acquisition is a
+ * try-lock-WITH-TIMEOUT. On timeout the caller is told it was SKIPPED with a named reason rather
+ * than blocking forever — a slow holder degrades to a skipped action, never a wedged slot. (The
+ * caller is responsible for bounding any `await` it does INSIDE `fn` — e.g. a refresh fetch must
+ * carry its own `AbortSignal.timeout`; the funnel bounds acquisition, not the work.)
+ */
+const DEFAULT_SLOT_LOCK_TIMEOUT_MS = 15_000;
+export class CredentialWriteFunnel {
+    /** Per-slot serialization: slot → the tail promise of that slot's lock queue. */
+    slotTails = new Map();
+    /** Machine-local single-mover mutex (swaps). In-memory ⇒ a restart clears any crash-stale hold. */
+    singleMoverHeld = false;
+    slotLockTimeoutMs;
+    constructor(opts = {}) {
+        this.slotLockTimeoutMs = opts.slotLockTimeoutMs ?? DEFAULT_SLOT_LOCK_TIMEOUT_MS;
+    }
+    /**
+     * Run `fn` while holding the per-slot lock for `slot`. Serializes against every other
+     * `withSlotLock` on the same slot. Acquisition is bounded: if the lock is not free within
+     * `timeoutMs`, `fn` does NOT run and the result is `{ ran: false, skippedReason }`.
+     */
+    async withSlotLock(slot, fn, opts) {
+        const timeoutMs = opts?.timeoutMs ?? this.slotLockTimeoutMs;
+        const prev = this.slotTails.get(slot) ?? Promise.resolve();
+        let releaseMine;
+        const mine = new Promise((resolve) => {
+            releaseMine = resolve;
+        });
+        // I become the new tail immediately — later waiters queue behind `mine`.
+        this.slotTails.set(slot, mine);
+        // Wait for the previous holder to finish, bounded by the timeout.
+        let timer;
+        const timeout = new Promise((resolve) => {
+            timer = setTimeout(() => resolve('timeout'), timeoutMs);
+        });
+        const winner = await Promise.race([prev.then(() => 'acquired'), timeout]);
+        if (timer)
+            clearTimeout(timer);
+        if (winner === 'timeout') {
+            // We never acquired the slot. We ARE the registered tail, so release `mine` ONLY after the
+            // real prior holder finishes — otherwise the next waiter (queued behind `mine`) could run
+            // concurrently with the holder we were waiting on. We never run `fn`.
+            void prev.then(() => releaseMine(), () => releaseMine());
+            return { ran: false, skippedReason: `slot-lock acquire on '${slot}' timed out after ${timeoutMs}ms` };
+        }
+        try {
+            const value = await fn();
+            return { ran: true, value };
+        }
+        finally {
+            releaseMine();
+            // GC the tail entry if no later waiter replaced us.
+            if (this.slotTails.get(slot) === mine)
+                this.slotTails.delete(slot);
+        }
+    }
+    /**
+     * Run `fn` while holding the per-slot locks for ALL `slots`, acquired in a CANONICAL order
+     * (sorted by path) so two concurrent multi-slot operations can't deadlock on opposite orders.
+     * If ANY slot lock cannot be acquired in time, NO `fn` runs and the result is skipped (the
+     * already-held inner locks are released by unwinding). Used by the swap executor (Step 5).
+     */
+    async withSlotLocks(slots, fn, opts) {
+        const ordered = Array.from(new Set(slots)).sort();
+        const acquire = async (i) => {
+            if (i >= ordered.length) {
+                const value = await fn();
+                return { ran: true, value };
+            }
+            const inner = await this.withSlotLock(ordered[i], () => acquire(i + 1), opts);
+            // If the inner acquire was skipped (timeout deeper in the chain), propagate the skip.
+            if (!inner.ran)
+                return { ran: false, skippedReason: inner.skippedReason };
+            return inner.value;
+        };
+        return acquire(0);
+    }
+    /**
+     * Run `fn` holding the machine-local single-mover mutex. A swap takes this BEFORE its slot
+     * locks so two swaps never run at once. Try-acquire: if a move is already in flight, `fn`
+     * does NOT run and the result is skipped (never blocks).
+     */
+    async withSingleMover(fn) {
+        if (this.singleMoverHeld) {
+            return { ran: false, skippedReason: 'another credential move is already in flight (single-mover mutex held)' };
+        }
+        this.singleMoverHeld = true;
+        try {
+            const value = await fn();
+            return { ran: true, value };
+        }
+        finally {
+            this.singleMoverHeld = false;
+        }
+    }
+    /** Test/observability: is the single-mover mutex currently held? */
+    isSingleMoverHeld() {
+        return this.singleMoverHeld;
+    }
+    /** Test/observability: how many slots currently have a live lock queue tail. */
+    get trackedSlotCount() {
+        return this.slotTails.size;
+    }
+}
+//# sourceMappingURL=CredentialWriteFunnel.js.map

package/dist/core/CredentialWriteFunnel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialWriteFunnel.js","sourceRoot":"","sources":["../../src/core/CredentialWriteFunnel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAgBH,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAE5C,MAAM,OAAO,qBAAqB;IAChC,iFAAiF;IAChE,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC9D,mGAAmG;IAC3F,eAAe,GAAG,KAAK,CAAC;IACf,iBAAiB,CAAS;IAE3C,YAAY,OAAqC,EAAE;QACjD,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,IAAI,4BAA4B,CAAC;IAClF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAChB,IAAY,EACZ,EAAwB,EACxB,IAA6B;QAE7B,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,IAAI,CAAC,iBAAiB,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3D,IAAI,WAAwB,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACzC,WAAW,GAAG,OAAO,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,yEAAyE;QACzE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAE/B,kEAAkE;QAClE,IAAI,KAAgD,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,EAAE;YACjD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,UAAmB,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACnF,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAE/B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,2FAA2F;YAC3F,0FAA0F;YAC1F,sEAAsE;YACtE,KAAK,IAAI,CAAC,IAAI,CACZ,GAAG,EAAE,CAAC,WAAW,EAAE,EACnB,GAAG,EAAE,CAAC,WAAW,EAAE,CACpB,CAAC;YACF,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,yBAAyB,IAAI,qBAAqB,SAAS,IAAI,EAAE,CAAC;QACxG,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,EAAE,EAAE,CAAC;YACzB,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC9B,CAAC;gBAAS,CAAC;YACT,WAAW,EAAE,CAAC;YACd,oDAAoD;YACpD,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI;gBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CACjB,KAAe,EACf,EAAwB,EACxB,IAA6B;QAE7B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,KAAK,EAAE,CAAS,EAA4B,EAAE;YAC5D,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACxB,MAAM,KAAK,GAAG,MAAM,EAAE,EAAE,CAAC;gBACzB,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YAC9B,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAC9E,sFAAsF;YACtF,IAAI,CAAC,KAAK,CAAC,GAAG;gBAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;YAC1E,OAAO,KAAK,CAAC,KAAwB,CAAC;QACxC,CAAC,CAAC;QACF,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAI,EAAwB;QAC/C,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,wEAAwE,EAAE,CAAC;QACjH,CAAC;QACD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,EAAE,EAAE,CAAC;YACzB,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC9B,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,iBAAiB;QACf,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED,gFAAgF;IAChF,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC7B,CAAC;CACF"}

package/dist/core/MeshRpc.d.ts

@@ -86,6 +86,11 @@ export type MeshCommand = {
         sinceSeq: number;
         incarnation?: string;
     };
+} | {
+    type: 'state-snapshot';
+    request: {
+        store: string;
+    };
 } | {
     type: 'preferences-sync';
     request: {

package/dist/core/MeshRpc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MeshRpc.d.ts","sourceRoot":"","sources":["../../src/core/MeshRpc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC;AAE/B,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GACvE;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GACxG;IAWE,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,SAAS,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB,GACD;IAAE,IAAI,EAAE,iBAAiB,CAAA;CAAE,GAC3B;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAM3C;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/C;IAOE,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAClF,OAAO,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,EAAE,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACjG,GACD;IAOE,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD,GACD;IAOE,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD,GACD;IAQE,IAAI,EAAE,mBAAmB,CAAC;IAC1B,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAC;QACf,EAAE,EAAE,MAAM,CAAC;QACX,EAAE,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,cAAc,CAAC;QACvD,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/B,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH,GACD;IAUE,IAAI,EAAE,oBAAoB,CAAC;IAC3B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,GACD;IAOE,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC9C,GACD;IAkBE,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAEN,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,EAAE,WAAW,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oFAAoF;AACpF,wBAAgB,oBAAoB,CAClC,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,CAAC,GAC1F,MAAM,CAER;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAC1B,KAAK,EAAE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EACzH,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAClC,YAAY,CAEd;AAED,MAAM,MAAM,YAAY,GACpB,IAAI,GACJ,iBAAiB,GACjB,mBAAmB,GACnB,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,CAAC;AAEtB,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,aAAa,EAAE,SAAS,CAAC;IACzB,uFAAuF;IACvF,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC;IAC7E,2DAA2D;IAC3D,gBAAgB,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC;IACjD,+EAA+E;IAC/E,SAAS,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IACzD,+BAA+B;IAC/B,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,iDAAiD;IACjD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,kBAAkB,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CAajH;AAED,MAAM,MAAM,UAAU,GAClB,IAAI,GACJ,YAAY,GACZ,oBAAoB,GACpB,sBAAsB,GACtB,oBAAoB,CAAC;AAEzB,MAAM,WAAW,QAAQ;IACvB,qFAAqF;IACrF,YAAY,EAAE,MAAM,SAAS,GAAG,IAAI,CAAC;IACrC,uDAAuD;IACvD,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,GAAG,IAAI,CAAC;IAC/C,wFAAwF;IACxF,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,GAAG,IAAI,CAAC;CAC1D;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,CAqE7H;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,YAAY,EACjB,UAAU,EAAE,kBAAkB,EAC9B,QAAQ,EAAE,QAAQ,GACjB;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,YAAY,GAAG,UAAU,CAAA;CAAE,CAIpD;AAID;;mDAEmD;AACnD,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;AAE5H,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,IAAI,EAAE,QAAQ,CAAC;IACf,+EAA+E;IAC/E,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACxD,mIAAmI;IACnI,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACnE,yDAAyD;IACzD,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACvD,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,YAAY,GAAG,UAAU,GAAG,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAwBpF;;;;;;GAMG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAwB;gBAC9B,IAAI,EAAE,qBAAqB;IAIjC,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC;CAgB3D"}
+{"version":3,"file":"MeshRpc.d.ts","sourceRoot":"","sources":["../../src/core/MeshRpc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC;AAE/B,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GACvE;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GACxG;IAWE,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,SAAS,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB,GACD;IAAE,IAAI,EAAE,iBAAiB,CAAA;CAAE,GAC3B;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAM3C;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/C;IAOE,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAClF,OAAO,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,EAAE,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACjG,GACD;IAOE,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD,GACD;IAcE,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5B,GACD;IAOE,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD,GACD;IAQE,IAAI,EAAE,mBAAmB,CAAC;IAC1B,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAC;QACf,EAAE,EAAE,MAAM,CAAC;QACX,EAAE,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,cAAc,CAAC;QACvD,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/B,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH,GACD;IAUE,IAAI,EAAE,oBAAoB,CAAC;IAC3B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,GACD;IAOE,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC9C,GACD;IAkBE,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAEN,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,EAAE,WAAW,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oFAAoF;AACpF,wBAAgB,oBAAoB,CAClC,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,CAAC,GAC1F,MAAM,CAER;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAC1B,KAAK,EAAE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EACzH,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAClC,YAAY,CAEd;AAED,MAAM,MAAM,YAAY,GACpB,IAAI,GACJ,iBAAiB,GACjB,mBAAmB,GACnB,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,CAAC;AAEtB,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,aAAa,EAAE,SAAS,CAAC;IACzB,uFAAuF;IACvF,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC;IAC7E,2DAA2D;IAC3D,gBAAgB,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC;IACjD,+EAA+E;IAC/E,SAAS,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IACzD,+BAA+B;IAC/B,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,iDAAiD;IACjD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,kBAAkB,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CAajH;AAED,MAAM,MAAM,UAAU,GAClB,IAAI,GACJ,YAAY,GACZ,oBAAoB,GACpB,sBAAsB,GACtB,oBAAoB,CAAC;AAEzB,MAAM,WAAW,QAAQ;IACvB,qFAAqF;IACrF,YAAY,EAAE,MAAM,SAAS,GAAG,IAAI,CAAC;IACrC,uDAAuD;IACvD,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,GAAG,IAAI,CAAC;IAC/C,wFAAwF;IACxF,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,GAAG,IAAI,CAAC;CAC1D;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,CA6E7H;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,YAAY,EACjB,UAAU,EAAE,kBAAkB,EAC9B,QAAQ,EAAE,QAAQ,GACjB;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,YAAY,GAAG,UAAU,CAAA;CAAE,CAIpD;AAID;;mDAEmD;AACnD,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;AAE5H,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,IAAI,EAAE,QAAQ,CAAC;IACf,+EAA+E;IAC/E,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACxD,mIAAmI;IACnI,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACnE,yDAAyD;IACzD,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACvD,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,YAAY,GAAG,UAAU,GAAG,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAwBpF;;;;;;GAMG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAwB;gBAC9B,IAAI,EAAE,qBAAqB;IAIjC,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC;CAgB3D"}