@cortexkit/anthropic-auth-core 1.20.0 → 1.22.0

package/dist/auth.js

@@ -1,4 +1,6 @@
+import { assertNotCustodyTombstone } from './claustrum.js';
 import { AUTHORIZE_URLS, AXIOS_USER_AGENT, CLIENT_ID, CODE_CALLBACK_URL, OAUTH_SCOPES, REFRESH_SCOPE, TOKEN_URL, } from './constants.js';
+import { isTransientNetworkError } from './network-errors.js';
 import { generatePKCE } from './pkce.js';
 export function parseRetryAfterHeader(value) {
     if (!value)
@@ -33,17 +35,8 @@ export class ClaudeOAuthRefreshError extends Error {
         this.retryAfter = parseRetryAfterHeader(retryAfterHeader ?? undefined);
     }
 }
-function isTransientNetworkError(error) {
-    if (!(error instanceof Error))
-        return false;
-    const code = error.code;
-    return (error.message.includes('fetch failed') ||
-        code === 'ECONNRESET' ||
-        code === 'ECONNREFUSED' ||
-        code === 'ETIMEDOUT' ||
-        code === 'UND_ERR_CONNECT_TIMEOUT');
-}
 export async function refreshClaudeOAuthToken(input) {
+    assertNotCustodyTombstone(input.refreshToken, 'anthropic');
     const fetchImpl = input.fetchImpl ?? fetch;
     const maxRetries = input.maxRetries ?? 2;
     const baseDelayMs = input.baseDelayMs ?? 500;

package/dist/cch.d.ts

@@ -7,10 +7,18 @@ type Message = {
 };
 export declare const CCH_PATTERN: RegExp;
 /**
- * Extract text from the first user message's first text block.
- * Kept for diagnostics/backward-compatible tests; CCH signing no longer uses it.
+ * Extract the visible prompt from the first user message. Claude Code prepends
+ * reminder blocks and derives its version suffix from the final text block.
  */
 export declare function extractFirstUserMessageText(messages: Message[]): string;
+export declare class ClaudeCodeFirstUserTextTracker {
+    #private;
+    readonly limit: number;
+    constructor(limit?: number);
+    resolve(sessionId: string, messages: Message[], pin?: boolean): string;
+    has(sessionId: string): boolean;
+    clear(): void;
+}
 /**
  * Compute Claude Code's cch token over the final serialized request body.
  *
@@ -23,16 +31,12 @@ export declare function resetBillingHeaderCCH(bodyString: string): string;
 export declare function extractBillingHeaderCCH(bodyString: string): string | null;
 export declare function signRequestBody(bodyString: string): Promise<string>;
 /**
- * Compute a stable 3-character suffix for cc_version.
- *
- * The captured Claude Code version uses its observed build hash. Custom/future
- * versions get a deterministic version-only suffix so date changes never rotate
- * the billing header and bust prompt-cache prefixes.
+ * Compute Claude Code's 3-character suffix for cc_version.
  */
-export declare function computeVersionSuffix(version?: string, _date?: Date): string;
+export declare function computeCcVersionSuffix(firstUserText: string, version?: string): string;
 /**
  * Build the billing header with a cch placeholder.
  * signRequestBody() must run after final request serialization to replace it.
  */
-export declare function buildBillingHeaderValue(_messages: Message[], version: string | undefined, entrypoint: string, date?: Date): string;
+export declare function buildBillingHeaderValue(messages: Message[], version: string | undefined, entrypoint: string, pinnedFirstUserText?: string): string;
 export {};

package/dist/cch.js

@@ -1,7 +1,7 @@
 import { createHash } from 'node:crypto';
 import xxhashInit from 'xxhash-wasm';
-import { CLAUDE_CODE_BUILD_HASH, CLAUDE_CODE_VERSION } from './constants.js';
-const CCH_SEED = 0x6e52736ac806831en;
+import { CCH_POSITIONS, CCH_SALT, CLAUDE_CODE_VERSION } from './constants.js';
+const CCH_SEED = 0x4d659218e32a3268n;
 const CCH_PLACEHOLDER = 'cch=00000;';
 export const CCH_PATTERN = /\bcch=([0-9a-f]{5});/;
 const BILLING_HEADER_CCH_PATTERN = /("system":\[\{"type":"text","text":"x-anthropic-billing-header: cc_version=[^;"]+; cc_entrypoint=[^;"]+; )cch=([0-9a-f]{5});/;
@@ -18,8 +18,8 @@ async function ensureXxhash() {
     await xxhashPromise;
 }
 /**
- * Extract text from the first user message's first text block.
- * Kept for diagnostics/backward-compatible tests; CCH signing no longer uses it.
+ * Extract the visible prompt from the first user message. Claude Code prepends
+ * reminder blocks and derives its version suffix from the final text block.
  */
 export function extractFirstUserMessageText(messages) {
     const userMsg = messages.find((message) => message.role === 'user');
@@ -29,12 +29,48 @@ export function extractFirstUserMessageText(messages) {
     if (typeof content === 'string')
         return content;
     if (Array.isArray(content)) {
-        const textBlock = content.find((block) => block.type === 'text');
-        if (textBlock?.text)
-            return textBlock.text;
+        const textBlocks = content.filter((block) => block.type === 'text');
+        const commandBlock = textBlocks.find((block) => block.text?.includes('<command-name>'));
+        if (commandBlock?.text) {
+            return commandBlock.text.slice(commandBlock.text.indexOf('<command-name>'));
+        }
+        const visibleBlock = textBlocks.findLast((block) => typeof block.text === 'string' && block.text.length > 0);
+        if (visibleBlock?.text)
+            return visibleBlock.text;
     }
     return '';
 }
+export class ClaudeCodeFirstUserTextTracker {
+    limit;
+    #values = new Map();
+    constructor(limit = 1_000) {
+        this.limit = limit;
+    }
+    resolve(sessionId, messages, pin = true) {
+        const existing = this.#values.get(sessionId);
+        if (existing !== undefined) {
+            this.#values.delete(sessionId);
+            this.#values.set(sessionId, existing);
+            return existing;
+        }
+        const value = extractFirstUserMessageText(messages);
+        if (pin) {
+            if (!this.#values.has(sessionId) && this.#values.size >= this.limit) {
+                const oldest = this.#values.keys().next().value;
+                if (oldest !== undefined)
+                    this.#values.delete(oldest);
+            }
+            this.#values.set(sessionId, value);
+        }
+        return value;
+    }
+    has(sessionId) {
+        return this.#values.has(sessionId);
+    }
+    clear() {
+        this.#values.clear();
+    }
+}
 /**
  * Compute Claude Code's cch token over the final serialized request body.
  *
@@ -61,27 +97,29 @@ export async function signRequestBody(bodyString) {
     if (!BILLING_HEADER_CCH_PATTERN.test(bodyString))
         return bodyString;
     const unsignedBodyString = resetBillingHeaderCCH(bodyString);
-    const token = await computeCCH(new TextEncoder().encode(unsignedBodyString));
+    const canonicalBody = JSON.parse(unsignedBodyString);
+    if ('model' in canonicalBody)
+        canonicalBody.model = '';
+    delete canonicalBody.max_tokens;
+    const token = await computeCCH(new TextEncoder().encode(JSON.stringify(canonicalBody)));
     return unsignedBodyString.replace(BILLING_HEADER_CCH_PLACEHOLDER_PATTERN, `$1cch=${token};`);
 }
 /**
- * Compute a stable 3-character suffix for cc_version.
- *
- * The captured Claude Code version uses its observed build hash. Custom/future
- * versions get a deterministic version-only suffix so date changes never rotate
- * the billing header and bust prompt-cache prefixes.
+ * Compute Claude Code's 3-character suffix for cc_version.
  */
-export function computeVersionSuffix(version = CLAUDE_CODE_VERSION, _date = new Date()) {
-    if (version === CLAUDE_CODE_VERSION)
-        return CLAUDE_CODE_BUILD_HASH;
-    return createHash('sha256').update(version).digest('hex').slice(0, 3);
+export function computeCcVersionSuffix(firstUserText, version = CLAUDE_CODE_VERSION) {
+    const sampledText = CCH_POSITIONS.map((position) => firstUserText[position] ?? '0').join('');
+    return createHash('sha256')
+        .update(`${CCH_SALT}${sampledText}${version}`)
+        .digest('hex')
+        .slice(0, 3);
 }
 /**
  * Build the billing header with a cch placeholder.
  * signRequestBody() must run after final request serialization to replace it.
  */
-export function buildBillingHeaderValue(_messages, version = CLAUDE_CODE_VERSION, entrypoint, date = new Date()) {
-    const suffix = computeVersionSuffix(version, date);
+export function buildBillingHeaderValue(messages, version = CLAUDE_CODE_VERSION, entrypoint, pinnedFirstUserText) {
+    const suffix = computeCcVersionSuffix(pinnedFirstUserText ?? extractFirstUserMessageText(messages), version);
     return ('x-anthropic-billing-header: ' +
         `cc_version=${version}.${suffix}; ` +
         `cc_entrypoint=${entrypoint}; ` +

package/dist/claude-code.d.ts

@@ -1,14 +1,16 @@
 export type ClaudeCodeIdentity = {
     deviceId: string;
+    accountIdentity?: string;
     accountUuid?: string;
     sessionId: string;
 };
 export declare function setBounded<K, V>(map: Map<K, V>, key: K, value: V, limit?: number): void;
 export declare function getClaudeCodeIdentity(seed: string): ClaudeCodeIdentity;
-export declare function resolveClaudeCodeIdentity(accessToken: string, model?: string): Promise<ClaudeCodeIdentity>;
+export declare function resetClaudeCodeIdentityCachesForTest(): void;
+export declare function resolveClaudeCodeIdentity(accessToken: string, model: string | undefined, accountIdentity: string | undefined): Promise<ClaudeCodeIdentity>;
 export declare function buildClaudeCodeMetadataUserId(identity: ClaudeCodeIdentity): string | null;
 export declare function applyClaudeCodeMetadata(body: Record<string, unknown>, identity: ClaudeCodeIdentity): boolean;
-export declare const CLAUDE_CODE_FULL_AGENT_BETAS: readonly ['oauth-2025-04-20', 'interleaved-thinking-2025-05-14', 'thinking-token-count-2026-05-13', 'context-management-2025-06-27', 'prompt-caching-scope-2026-01-05', 'claude-code-20250219', 'advisor-tool-2026-03-01', 'advanced-tool-use-2025-11-20', 'extended-cache-ttl-2025-04-11', 'cache-diagnosis-2026-04-07'];
+export declare const CLAUDE_CODE_FULL_AGENT_BETAS: readonly ['oauth-2025-04-20', 'interleaved-thinking-2025-05-14', 'thinking-token-count-2026-05-13', 'context-management-2025-06-27', 'prompt-caching-scope-2026-01-05', 'claude-code-20250219', 'advisor-tool-2026-03-01', 'advanced-tool-use-2025-11-20', 'mid-conversation-system-2026-04-07', 'effort-2025-11-24', 'fallback-credit-2026-06-01', 'extended-cache-ttl-2025-04-11', 'cache-diagnosis-2026-04-07'];
 export declare function selectClaudeCodeBetas(body?: Record<string, unknown> | null, extraBetas?: string[]): string;
 export declare function applyClaudeCodeHeaders(headers: Headers, accessToken: string, options?: {
     body?: Record<string, unknown> | null;
@@ -16,5 +18,4 @@ export declare function applyClaudeCodeHeaders(headers: Headers, accessToken: st
     extraBetas?: string[];
 }): Headers;
 export declare function orderClaudeCodeBody<T extends Record<string, unknown>>(body: T): T;
-export declare function claudeCodeBuildHash(): string;
 export declare function claudeCodeEntrypoint(): string;

package/dist/claude-code.js

@@ -1,5 +1,5 @@
 import { randomBytes, randomUUID } from 'node:crypto';
-import { CLAUDE_CODE_BUILD_HASH, CLAUDE_CODE_ENTRYPOINT, CLAUDE_CODE_STAINLESS_PACKAGE_VERSION, CLAUDE_CODE_STAINLESS_RUNTIME_VERSION, CLAUDE_CODE_VERSION, FAST_MODE_BETA, USER_AGENT, } from './constants.js';
+import { CLAUDE_CODE_ENTRYPOINT, CLAUDE_CODE_STAINLESS_PACKAGE_VERSION, CLAUDE_CODE_STAINLESS_RUNTIME_VERSION, CLAUDE_CODE_VERSION, FAST_MODE_BETA, USER_AGENT, } from './constants.js';
 const IDENTITY_CACHE_LIMIT = 1_000;
 const identityCache = new Map();
 export function setBounded(map, key, value, limit = IDENTITY_CACHE_LIMIT) {
@@ -10,6 +10,16 @@ export function setBounded(map, key, value, limit = IDENTITY_CACHE_LIMIT) {
     }
     map.set(key, value);
 }
+function clearCachedAccountUuid(key, identity) {
+    if (!identity.accountUuid)
+        return identity;
+    if (identityCache.get(key) !== identity) {
+        return { ...identity, accountUuid: undefined };
+    }
+    const cleared = { ...identity, accountUuid: undefined };
+    setBounded(identityCache, key, cleared);
+    return cleared;
+}
 export function getClaudeCodeIdentity(seed) {
     const cacheKey = seed || 'anonymous';
     const cached = identityCache.get(cacheKey);
@@ -26,6 +36,46 @@ const BOOTSTRAP_IDENTITY_CACHE_TTL_MS = 24 * 60 * 60_000;
 const BOOTSTRAP_IDENTITY_NEGATIVE_TTL_MS = 5 * 60_000;
 const bootstrapFetches = new Map();
 const bootstrapResults = new Map();
+export function resetClaudeCodeIdentityCachesForTest() {
+    identityCache.clear();
+    bootstrapFetches.clear();
+    bootstrapResults.clear();
+}
+function compatibilityCacheKey(accessToken) {
+    return `compat:${accessToken || 'anonymous'}`;
+}
+function explicitCacheKey(accountIdentity) {
+    return `identity:${accountIdentity}`;
+}
+function accountCacheKey(accountUuid, accountIdentity) {
+    return `account:${accountUuid}:${accountIdentity}`;
+}
+function adoptCachedIdentity(cached, accountIdentity, accountUuid) {
+    if (!cached)
+        return undefined;
+    if (cached.accountIdentity !== undefined &&
+        cached.accountIdentity !== accountIdentity) {
+        return undefined;
+    }
+    if (accountUuid !== undefined &&
+        cached.accountUuid !== undefined &&
+        cached.accountUuid !== accountUuid) {
+        return undefined;
+    }
+    if (cached.accountIdentity === accountIdentity &&
+        (accountUuid === undefined || cached.accountUuid === accountUuid)) {
+        return cached;
+    }
+    return {
+        ...cached,
+        accountIdentity,
+        ...(accountUuid !== undefined && { accountUuid }),
+    };
+}
+function cacheAccountIdentity(identity, accountIdentity, accountUuid) {
+    setBounded(identityCache, explicitCacheKey(accountIdentity), identity);
+    setBounded(identityCache, accountCacheKey(accountUuid, accountIdentity), identity);
+}
 async function fetchClaudeCodeAccountUuid(accessToken, model) {
     if (!accessToken.startsWith('sk-ant-oat'))
         return null;
@@ -60,47 +110,100 @@ async function fetchClaudeCodeAccountUuid(accessToken, model) {
         clearTimeout(timeout);
     }
 }
-export async function resolveClaudeCodeIdentity(accessToken, model) {
-    const identity = getClaudeCodeIdentity(accessToken);
+export async function resolveClaudeCodeIdentity(accessToken, model, accountIdentity) {
+    const stableAccountIdentity = accountIdentity?.trim() || undefined;
+    const cacheKey = stableAccountIdentity
+        ? explicitCacheKey(stableAccountIdentity)
+        : compatibilityCacheKey(accessToken);
+    let identity;
+    if (stableAccountIdentity) {
+        const cachedIdentity = adoptCachedIdentity(identityCache.get(cacheKey) ?? identityCache.get(accessToken), stableAccountIdentity);
+        identity = cachedIdentity ?? getClaudeCodeIdentity(cacheKey);
+        identity = adoptCachedIdentity(identity, stableAccountIdentity) ?? identity;
+        setBounded(identityCache, cacheKey, identity);
+    }
+    else {
+        identity =
+            identityCache.get(cacheKey) ??
+                identityCache.get(accessToken) ??
+                getClaudeCodeIdentity(cacheKey);
+        setBounded(identityCache, cacheKey, identity);
+        setBounded(identityCache, accessToken, identity);
+    }
     if (!accessToken.startsWith('sk-ant-oat'))
         return identity;
     const now = Date.now();
-    const cachedResult = bootstrapResults.get(accessToken);
+    // A slot-stable identity survives account replacement; bootstrap is the
+    // account lookup that must be repeated for each credential presented to it.
+    const bootstrapKey = `${cacheKey}:${accessToken}`;
+    const cachedResult = bootstrapResults.get(bootstrapKey);
     if (cachedResult && cachedResult.expiresAt > now) {
-        if (!cachedResult.accountUuid)
+        if (!cachedResult.accountUuid) {
+            identity = clearCachedAccountUuid(cacheKey, identity);
+            return identity;
+        }
+        if (!stableAccountIdentity) {
+            if (identity.accountUuid === cachedResult.accountUuid)
+                return identity;
+            identity = { ...identity, accountUuid: cachedResult.accountUuid };
+            setBounded(identityCache, bootstrapKey, identity);
+            return identity;
+        }
+        const cachedAccountIdentity = adoptCachedIdentity(identityCache.get(accountCacheKey(cachedResult.accountUuid, stableAccountIdentity)) ?? identityCache.get(`account:${cachedResult.accountUuid}`), stableAccountIdentity, cachedResult.accountUuid);
+        if (cachedAccountIdentity) {
+            identity = cachedAccountIdentity;
+            cacheAccountIdentity(identity, stableAccountIdentity, cachedResult.accountUuid);
             return identity;
-        const accountCacheKey = `account:${cachedResult.accountUuid}`;
-        const accountIdentity = identityCache.get(accountCacheKey);
-        if (accountIdentity) {
-            setBounded(identityCache, accessToken, accountIdentity);
-            return accountIdentity;
         }
+        if (identity.accountUuid === cachedResult.accountUuid)
+            return identity;
+        identity = {
+            ...identity,
+            accountIdentity: stableAccountIdentity,
+            accountUuid: cachedResult.accountUuid,
+        };
+        cacheAccountIdentity(identity, stableAccountIdentity, cachedResult.accountUuid);
+        return identity;
     }
-    let fetchPromise = bootstrapFetches.get(accessToken);
+    let fetchPromise = bootstrapFetches.get(bootstrapKey);
     if (!fetchPromise) {
         fetchPromise = fetchClaudeCodeAccountUuid(accessToken, model);
-        bootstrapFetches.set(accessToken, fetchPromise);
+        setBounded(bootstrapFetches, bootstrapKey, fetchPromise);
     }
     const accountUuid = await fetchPromise.finally(() => {
-        bootstrapFetches.delete(accessToken);
+        if (bootstrapFetches.get(bootstrapKey) === fetchPromise) {
+            bootstrapFetches.delete(bootstrapKey);
+        }
     });
-    setBounded(bootstrapResults, accessToken, {
+    setBounded(bootstrapResults, bootstrapKey, {
         accountUuid,
         expiresAt: now +
             (accountUuid
                 ? BOOTSTRAP_IDENTITY_CACHE_TTL_MS
                 : BOOTSTRAP_IDENTITY_NEGATIVE_TTL_MS),
     });
-    if (!accountUuid)
+    if (!accountUuid) {
+        identity = clearCachedAccountUuid(cacheKey, identity);
         return identity;
-    const accountCacheKey = `account:${accountUuid}`;
-    const accountIdentity = identityCache.get(accountCacheKey);
-    if (accountIdentity) {
-        setBounded(identityCache, accessToken, accountIdentity);
-        return accountIdentity;
     }
-    identity.accountUuid = accountUuid;
-    setBounded(identityCache, accountCacheKey, identity);
+    if (!stableAccountIdentity) {
+        identity = { ...identity, accountUuid };
+        setBounded(identityCache, bootstrapKey, identity);
+        return identity;
+    }
+    const cachedAccountIdentity = adoptCachedIdentity(identityCache.get(accountCacheKey(accountUuid, stableAccountIdentity)) ??
+        identityCache.get(`account:${accountUuid}`), stableAccountIdentity, accountUuid);
+    if (cachedAccountIdentity) {
+        identity = cachedAccountIdentity;
+        cacheAccountIdentity(identity, stableAccountIdentity, accountUuid);
+        return identity;
+    }
+    identity = {
+        ...identity,
+        accountIdentity: stableAccountIdentity,
+        accountUuid,
+    };
+    cacheAccountIdentity(identity, stableAccountIdentity, accountUuid);
     return identity;
 }
 function isRecord(value) {
@@ -129,6 +232,8 @@ export function applyClaudeCodeMetadata(body, identity) {
         metadata.user_id = userId;
     return true;
 }
+// Claude Code 2.1.258 sends redact-thinking-2026-02-12, but it suppresses
+// thinking-block content that OpenCode displays; deliberately omitted after A/B proof on 2026-09-01.
 export const CLAUDE_CODE_FULL_AGENT_BETAS = [
     'oauth-2025-04-20',
     'interleaved-thinking-2025-05-14',
@@ -138,6 +243,9 @@ export const CLAUDE_CODE_FULL_AGENT_BETAS = [
     'claude-code-20250219',
     'advisor-tool-2026-03-01',
     'advanced-tool-use-2025-11-20',
+    'mid-conversation-system-2026-04-07',
+    'effort-2025-11-24',
+    'fallback-credit-2026-06-01',
     'extended-cache-ttl-2025-04-11',
     'cache-diagnosis-2026-04-07',
 ];
@@ -275,9 +383,6 @@ export function orderClaudeCodeBody(body) {
     }
     return ordered;
 }
-export function claudeCodeBuildHash() {
-    return CLAUDE_CODE_BUILD_HASH;
-}
 export function claudeCodeEntrypoint() {
     return CLAUDE_CODE_ENTRYPOINT;
 }

package/dist/claustrum.d.ts

@@ -0,0 +1,109 @@
+import { type BindIdentity, type CatalogEntry, type CloseRouteOptions, type ManagedCallOptions, type ManagedCloseRouteOptions, type RequestOptions, type RouteHandle, type RouteOpenOptions, type RouteTarget, SubcClient, type SubscribeOptions, type Subscription } from '@cortexkit/subc-client';
+export type ClaustrumEndpoint = {
+    host: string;
+    port: number;
+};
+export type ClaustrumDetection = {
+    status: 'available';
+    schema: number;
+    wireVersion: number;
+    endpoints: ClaustrumEndpoint[];
+} | {
+    status: 'absent';
+    path: string;
+} | {
+    status: 'malformed';
+    path: string;
+    reason: string;
+};
+export declare function getDefaultClaustrumConnectionPath(): string;
+export declare function detectClaustrumConnection(path?: string): Promise<ClaustrumDetection>;
+export declare const CUSTODY_TOMBSTONE_PREFIX = "claustrum-tombstone:v1:";
+export declare function custodyTombstoneKey(provider: string): string;
+export declare function isCustodyTombstoneValue(value: unknown): value is string;
+export declare function isCustodyTombstoneOAuth(auth: unknown, provider: string): boolean;
+export declare class CustodyTombstoneRefreshError extends Error {
+    readonly provider: string;
+    readonly code = "custody_tombstone_refresh";
+    constructor(provider: string);
+}
+export declare function assertNotCustodyTombstone(refreshToken: unknown, provider: string): void;
+export type CustodyHandleAccount = {
+    label: string;
+    handle: string;
+    credentialId: string;
+};
+export type CustodyHandleManifest = {
+    provider: string;
+    serve: string;
+    shape: string;
+    accounts: CustodyHandleAccount[];
+};
+export declare function isValidCustodyHandle(value: unknown): value is string;
+export declare function readCustodyHandles(json: unknown, provider: string): CustodyHandleManifest;
+export type ClaustrumClientOptions = {
+    connectionFile?: string;
+    handshakeTimeoutMs?: number;
+    connector?: ClaustrumConnector;
+};
+export type ClaustrumConnector = (options: {
+    connectionFile: string;
+    handshakeTimeoutMs?: number;
+}) => Promise<SubcClient>;
+export declare class ClaustrumClient {
+    #private;
+    private constructor();
+    static connect(options?: ClaustrumClientOptions): Promise<ClaustrumClient>;
+    catalogList(moduleId?: string): Promise<CatalogEntry[]>;
+    routeOpen(target: RouteTarget, identity: BindIdentity, options?: Omit<RouteOpenOptions, 'consumerIdentity'>): Promise<RouteHandle>;
+    request(handle: RouteHandle, body: unknown, options?: RequestOptions): Promise<unknown>;
+    call<Response = unknown>(moduleId: string, method: string, params?: unknown, options?: Omit<ManagedCallOptions, 'consumerIdentity'>): Promise<Response>;
+    subscribe(handle: RouteHandle, body: unknown, onEvent: (event: Uint8Array) => void, options?: SubscribeOptions): Subscription;
+    closeRoute(handle: RouteHandle, options?: CloseRouteOptions): Promise<void>;
+    closeManagedRoute(target: Extract<RouteTarget, {
+        kind: 'management_surface' | 'tool_provider';
+    }>, identity: BindIdentity, options?: Omit<ManagedCloseRouteOptions, 'consumerIdentity'>): Promise<void>;
+    close(): void;
+}
+export declare function connectClaustrumClient(options?: ClaustrumClientOptions): Promise<ClaustrumClient>;
+export declare const CLAUSTRUM_MODULE_ID = "claustrum";
+export declare const DEFAULT_CLAUSTRUM_CREDENTIAL_MIN_TTL_MS = 120000;
+export declare const ERROR_CLASS_WIRE_SET: readonly ['transient', 'permanent', 'auth_required', 'context_overflow'];
+export type ClaustrumCredentialErrorClass = (typeof ERROR_CLASS_WIRE_SET)[number];
+export type ClaustrumCredentialErrorAction = 'gone' | 'reauth' | 'retry' | 'reduce_and_retry';
+export type ClaustrumCredential = {
+    payload: string;
+    expiresAtMs: number | null;
+    recordVersion: number;
+    projectId?: string;
+    accountId?: string;
+};
+export type ClaustrumServedCredential = Pick<ClaustrumCredential, 'recordVersion'>;
+export type ClaustrumReporterSource = 'direct' | 'relay_status_field' | 'relay_message_parse';
+export declare class ClaustrumCredentialError extends Error {
+    readonly code: string;
+    readonly action: ClaustrumCredentialErrorAction;
+    readonly errorClass: ClaustrumCredentialErrorClass;
+    constructor(message: string, code: string, errorClass: ClaustrumCredentialErrorClass, action: ClaustrumCredentialErrorAction);
+}
+export type ClaustrumCredentialCacheOptions = {
+    identity?: BindIdentity;
+    now?: () => number;
+    minTtlMs?: number;
+};
+export declare class ClaustrumCredentialCache {
+    #private;
+    constructor(client: ClaustrumClient, options?: ClaustrumCredentialCacheOptions);
+    get(handle: string, minTtlMs?: number): Promise<ClaustrumCredential>;
+    peek(handle: string): ClaustrumCredential | undefined;
+    seedForTest(handle: string, credential: ClaustrumCredential): void;
+    reduceMinTtlMs(): number;
+    reportAuthFailure(handle: string, providerStatus: number, servedCredential: ClaustrumServedCredential, reporterSource?: ClaustrumReporterSource): Promise<void>;
+    reportAuthFailure(handle: string, servedCredential: ClaustrumServedCredential, providerStatus?: number, reporterSource?: ClaustrumReporterSource): Promise<void>;
+    invalidate(handle: string, recordVersion?: number): void;
+    close(): void;
+}
+export type ConnectClaustrumCredentialCacheOptions = ClaustrumClientOptions & ClaustrumCredentialCacheOptions & {
+    enabled?: boolean;
+};
+export declare function connectClaustrumCredentialCache(options?: ConnectClaustrumCredentialCacheOptions): Promise<ClaustrumCredentialCache | null>;