@cortexkit/anthropic-auth-core 1.22.0 → 1.23.0

package/dist/accounts.d.ts

@@ -1,5 +1,8 @@
+import type { ProviderAccountUuid } from './claude-code.ts';
+import { type CustodyHandleResolution } from './claustrum.ts';
 import { type Cache1hMode } from './constants.ts';
 import { type LogLevel } from './logger.ts';
+export type { ProviderAccountUuid } from './claude-code.ts';
 export declare const ACCOUNT_FILE_NAME = "anthropic-auth.json";
 export declare const ACCOUNT_STATE_FILE_NAME = "anthropic-auth-state.json";
 export declare const QUOTA_URL = "https://api.anthropic.com/api/oauth/usage";
@@ -18,7 +21,11 @@ export type AccountBase = {
 export type OAuthAccount = AccountBase & {
     type: 'oauth';
     authLineageId?: string;
+    anthropicAccountUuid?: ProviderAccountUuid;
     claustrumHandle?: string;
+    /** Non-secret scoped identity; never a capability handle or bearer token. */
+    claustrumScopedCredentialId?: string;
+    claustrumScopedState?: string;
     access?: string;
     refresh: string;
     expires?: number;
@@ -33,6 +40,10 @@ export type OAuthAccount = AccountBase & {
      */
     prime?: PrimeUsageCounters;
 };
+export declare function hasNoLocalCredential(account: {
+    access?: unknown;
+    refresh?: unknown;
+}): boolean;
 export type ApiKeyAccount = AccountBase & {
     type: 'api';
     apiKey?: string;
@@ -43,7 +54,20 @@ export type FallbackAccount = OAuthAccount | ApiKeyAccount;
 export type ClaustrumAccountGate = {
     enabled?: boolean;
 };
+export type ClaustrumMode = 'local' | 'claustrum';
 export type ClaustrumConfig = {
+    mode?: ClaustrumMode;
+    handlesFile?: string;
+    /** Set by authoritative scoped discovery, not an authentication toggle. */
+    scopedRoster?: true;
+    /** Authoritative, non-secret primary identity from scoped discovery. */
+    primaryAccount?: {
+        credentialId: string;
+        accountId: ProviderAccountUuid;
+        state: string;
+    };
+    /** Preserve explicit exclusions when a vaulted account disappears and returns. */
+    disabledAccountIdentities?: string[];
     accounts?: Record<string, ClaustrumAccountGate>;
 };
 export declare function isOAuthAccount(account: FallbackAccount): account is OAuthAccount;
@@ -105,6 +129,7 @@ export type OAuthAccountProfile = {
     checkedAt: number;
     /** Stable account identity; tokenFingerprint remains loadable for legacy state. */
     accountIdentity?: string;
+    providerAccountUuid?: ProviderAccountUuid;
     tokenFingerprint?: string;
 };
 export type OAuthQuotaSnapshot = Partial<Record<QuotaWindowName, AccountQuotaWindow>> & {
@@ -244,10 +269,11 @@ export type AccountStorage = {
  * (to display the provider's real model costs).
  */
 export declare function isCostZeroingEnabled(storage: Pick<AccountStorage, 'costZeroing'>): boolean;
-export type AccountRuntimeEntry = Partial<Pick<OAuthAccount, 'access' | 'authLineageId' | 'claustrumHandle' | 'refresh' | 'expires' | 'lastUsed' | 'lastRefreshedAt' | 'lastRefreshError' | 'lastQuotaRefreshError' | 'quota' | 'profile' | 'prime'> & Pick<ApiKeyAccount, 'apiKey' | 'lastUsed'>>;
+export type AccountRuntimeEntry = Partial<Pick<OAuthAccount, 'access' | 'authLineageId' | 'anthropicAccountUuid' | 'claustrumScopedCredentialId' | 'claustrumScopedState' | 'claustrumHandle' | 'refresh' | 'expires' | 'lastUsed' | 'lastRefreshedAt' | 'lastRefreshError' | 'lastQuotaRefreshError' | 'quota' | 'profile' | 'prime'> & Pick<ApiKeyAccount, 'apiKey' | 'lastUsed'>>;
 export type AccountRuntimeState = {
     version: 1;
     main?: {
+        scopedAccountIdentity?: string;
         profile?: OAuthAccountProfile;
         profileToken?: string;
         quota?: OAuthQuotaSnapshot;
@@ -273,6 +299,7 @@ export type AccountStateSaveScope = {
     mainRefresh?: boolean;
     mainPrime?: boolean;
     accounts?: true | string[];
+    setClaustrumHandleAccountIds?: readonly string[];
 };
 export type AccountManagerOptions = {
     now?: () => number;
@@ -305,14 +332,34 @@ export declare function loadAccounts(path?: string): Promise<AccountStorage | nu
 export declare function quotaSnapshotCheckedAt(quota: OAuthQuotaSnapshot | undefined): number;
 export declare function quotaFieldSource(snapshot: OAuthQuotaSnapshot | undefined, field: QuotaFieldName): QuotaFieldSource | undefined;
 export declare function mergeHeaderQuotaForPersistence(existing: OAuthQuotaSnapshot | undefined, incoming: OAuthQuotaSnapshot): OAuthQuotaSnapshot;
-export declare function isClaustrumEnabledForAccount(storage: AccountStorage, accountId: string): boolean;
+export declare function getClaustrumMode(storage: AccountStorage | null): ClaustrumMode;
+export declare function isOAuthAccountVaultOwned(storage: AccountStorage | null, account: FallbackAccount, binding?: CustodyHandleResolution | undefined): boolean;
+export declare function setClaustrumModePersistent(mode: ClaustrumMode, path?: string): Promise<'changed' | 'unchanged'>;
+export declare function clearClaustrumHandlePersistent(input: {
+    id: string;
+    path?: string;
+}): Promise<'updated' | 'missing' | 'ineligible'>;
 export interface SaveAccountsOptions {
     /** Account ids intentionally removed by this mutation. */
     removedAccountIds?: readonly string[];
     /** Preserve disk order when a stale snapshot is missing newer accounts. */
     preserveExistingAccountOrder?: boolean;
+    setClaustrumHandleAccountIds?: readonly string[];
 }
 export declare function saveAccounts(storage: AccountStorage, path?: string, options?: SaveAccountsOptions): Promise<void>;
+/** Read-modify-write account configuration under the existing config/state lock order.
+ * The callback is synchronous: network discovery must happen under its own outer
+ * lease, never while holding the config lock. Do not call another persistence API
+ * from the callback.
+ */
+export declare function mutateAccountsPersistent<T>(path: string, mutate: (storage: AccountStorage) => {
+    storage: AccountStorage;
+    result: T;
+    options?: SaveAccountsOptions;
+    save?: boolean;
+}, options?: {
+    assertAuthority?: () => Promise<void>;
+}): Promise<T>;
 export declare function getOrCreateMainAccountId(path?: string, createId?: () => string): Promise<string>;
 export declare function saveAccountState(storage: AccountStorage, path?: string, scope?: AccountStateSaveScope): Promise<void>;
 export declare function saveOAuthProfileState(input: {
@@ -331,6 +378,7 @@ export declare function acquireRefreshFileLock(options: {
     onStep?: (step: 'stale-marker-stat' | 'stale-marker-claimed' | 'stale-lock-confirmed' | 'eviction-marker-acquired') => void | Promise<void>;
 }): Promise<{
     release: () => Promise<void>;
+    assertOwned: () => Promise<void>;
 } | null>;
 export declare function isCache1hPersistentlyEnabled(storage: AccountStorage | null): boolean;
 export declare function getCache1hPersistentMode(storage: AccountStorage | null): Cache1hMode;
@@ -459,6 +507,13 @@ export declare function fetchOAuthQuotaSnapshot(input: {
     now?: () => number;
 }): Promise<OAuthQuotaSnapshot>;
 export declare function upsertAccount(storage: AccountStorage, account: FallbackAccount): void;
+export declare function persistFallbackQuotaHeaderPersistent(input: {
+    accountId: string;
+    authLineageId?: string;
+    quota: OAuthQuotaSnapshot;
+    anthropicAccountUuid?: ProviderAccountUuid;
+}, path?: string): Promise<boolean>;
+export declare function fallbackAccountUuidForLineage(account: OAuthAccount | undefined, authLineageId?: string): string | null;
 export declare function removeAccount(storage: AccountStorage, id: string): boolean;
 export declare function reorderAccounts(storage: AccountStorage, orderedIds: string[]): void;
 export declare function setAccountEnabled(storage: AccountStorage, id: string, enabled: boolean): boolean;
@@ -467,6 +522,7 @@ export declare class FallbackAccountManager {
     private readonly fetchImpl;
     private readonly configPath;
     private readonly refreshPromises;
+    private readonly custodyVerificationAccounts;
     private refreshTimer;
     private quotaTimer;
     readonly quotaManager: import('./quota-manager.ts').QuotaManager | null;
@@ -487,6 +543,7 @@ export declare class FallbackAccountManager {
     save(storage: AccountStorage, accountIds?: string[]): Promise<void>;
     startBackgroundRefresh(): Promise<void>;
     stopBackgroundRefresh(): void;
+    withAccountRefreshLock<T>(accountId: string, fn: () => Promise<T>): Promise<T>;
     getUsableFallbackAccounts(existingStorage?: AccountStorage | null, options?: {
         modelId?: string;
     }): Promise<OAuthAccount[]>;