@cortexkit/anthropic-auth-core 1.22.0 → 1.23.0

package/dist/auth.js

@@ -37,6 +37,9 @@ export class ClaudeOAuthRefreshError extends Error {
 }
 export async function refreshClaudeOAuthToken(input) {
     assertNotCustodyTombstone(input.refreshToken, 'anthropic');
+    if (typeof input.refreshToken !== 'string' || !input.refreshToken.trim()) {
+        throw new Error('Local OAuth refresh credential is unavailable');
+    }
     const fetchImpl = input.fetchImpl ?? fetch;
     const maxRetries = input.maxRetries ?? 2;
     const baseDelayMs = input.baseDelayMs ?? 500;

package/dist/cachekeep.d.ts

@@ -76,8 +76,15 @@ export type CacheKeepTarget = {
     consecutiveFailures: number;
     dayKey: string;
     oauthAccountId?: string;
+    oauthAccountIdentity?: string;
+    accountStoragePath?: string;
     isSubagent: boolean;
 };
+export type CacheKeepPrewarmAttempt = {
+    id: number;
+    /** One deadline covers credential authorization and the HTTP attempt. */
+    signal?: AbortSignal;
+};
 export type CacheKeepPrewarmResult = {
     ok: true;
     usage?: {
@@ -96,6 +103,7 @@ export declare class CacheKeepManager {
     private readonly targets;
     private timer;
     private tickPromise;
+    private nextPrewarmAttemptId;
     constructor(options: {
         loadStorage: () => Promise<AccountStorage | null>;
         fetchImpl?: typeof fetch;
@@ -103,7 +111,7 @@ export declare class CacheKeepManager {
         prewarmTimeoutMs?: number;
         setIntervalImpl?: typeof globalThis.setInterval;
         clearIntervalImpl?: typeof globalThis.clearInterval;
-        prepareHeaders?: (headers: Headers, target: CacheKeepTarget) => Promise<Headers> | Headers;
+        prepareHeaders?: (headers: Headers, target: CacheKeepTarget, attempt: CacheKeepPrewarmAttempt) => Promise<Headers | undefined> | Headers | undefined;
         onTrackedSessionsChanged?: (sessions: readonly CacheKeepTrackedSession[]) => Promise<void> | void;
         prepareBody?: (bodyText: string, target: CacheKeepTarget) => string | Promise<string>;
         onResponse?: (input: {
@@ -112,6 +120,11 @@ export declare class CacheKeepManager {
             status: number;
             data: unknown;
             receivedAt: number;
+            attempt: CacheKeepPrewarmAttempt;
+        }) => void | Promise<void>;
+        onComplete?: (input: {
+            target: CacheKeepTarget;
+            attempt: CacheKeepPrewarmAttempt;
         }) => void | Promise<void>;
     });
     start(): void;
@@ -137,6 +150,8 @@ export declare class CacheKeepManager {
         storage: AccountStorage | null;
         cacheMode: string;
         oauthAccountId?: string;
+        oauthAccountIdentity?: string;
+        accountStoragePath?: string;
         isSubagent?: boolean;
     }): {
         tracked: boolean;
@@ -151,6 +166,8 @@ export declare class CacheKeepManager {
         headers: Headers;
         bodyText: string;
         oauthAccountId?: string;
+        oauthAccountIdentity?: string;
+        accountStoragePath?: string;
         isSubagent?: boolean;
     }): Promise<CacheKeepPrewarmResult>;
     tick(): Promise<void>;

package/dist/cachekeep.js

@@ -1,4 +1,4 @@
-import { signRequestBody } from './cch.js';
+import { signRequestBody, stripBillingLineageFromBody } from './cch.js';
 import { orderClaudeCodeBody } from './claude-code.js';
 import { dumpDirectRequest, dumpResponseArtifact } from './dump.js';
 import { logger } from './logger.js';
@@ -216,6 +216,7 @@ export async function buildCacheKeepPrewarmBody(bodyText) {
         return { ok: false, reason: 'body has no explicit cache breakpoints' };
     }
     const warm = structuredClone(body);
+    stripBillingLineageFromBody(warm);
     warm.max_tokens = 0;
     delete warm.stream;
     const thinking = warm.thinking;
@@ -247,6 +248,7 @@ export class CacheKeepManager {
     targets = new Map();
     timer = null;
     tickPromise = null;
+    nextPrewarmAttemptId = 0;
     constructor(options) {
         this.options = options;
     }
@@ -374,6 +376,8 @@ export class CacheKeepManager {
             consecutiveFailures: 0,
             dayKey: today,
             oauthAccountId: input.oauthAccountId,
+            oauthAccountIdentity: input.oauthAccountIdentity,
+            accountStoragePath: input.accountStoragePath,
             isSubagent: input.isSubagent ?? false,
         });
         this.pruneTargets(now, today);
@@ -396,6 +400,8 @@ export class CacheKeepManager {
             consecutiveFailures: 0,
             dayKey: '',
             oauthAccountId: input.oauthAccountId,
+            oauthAccountIdentity: input.oauthAccountIdentity,
+            accountStoragePath: input.accountStoragePath,
             isSubagent: input.isSubagent ?? false,
         };
         return this.sendPrewarm(target);
@@ -454,96 +460,116 @@ export class CacheKeepManager {
         this.publishTrackedSessions();
     }
     async sendPrewarm(target) {
-        let bodyText = target.bodyText;
-        if (this.options.prepareBody) {
+        const attempt = {
+            id: ++this.nextPrewarmAttemptId,
+            signal: AbortSignal.timeout(this.options.prewarmTimeoutMs ?? CACHE_KEEP_PREWARM_TIMEOUT_MS),
+        };
+        try {
+            let bodyText = target.bodyText;
+            if (this.options.prepareBody) {
+                try {
+                    bodyText = await this.options.prepareBody(bodyText, target);
+                }
+                catch (error) {
+                    logger.warn('cachekeep', 'prepare body failed', {
+                        session: target.id,
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                }
+            }
+            const preparedTarget = { ...target, bodyText };
+            const prewarm = await buildCacheKeepPrewarmBody(bodyText);
+            if (!prewarm.ok)
+                return prewarm;
+            const fetchImpl = this.options.fetchImpl ?? fetch;
+            const prewarmTarget = { ...preparedTarget, bodyText: prewarm.bodyText };
+            const headers = this.options.prepareHeaders
+                ? await this.options.prepareHeaders(new Headers(target.headers), prewarmTarget, attempt)
+                : new Headers(target.headers);
+            if (!headers) {
+                return {
+                    ok: false,
+                    reason: 'OAuth cache prewarm credential is unavailable',
+                    transient: true,
+                };
+            }
+            headers.delete('content-length');
+            headers.delete('transfer-encoding');
+            let response;
             try {
-                bodyText = await this.options.prepareBody(bodyText, target);
+                response = await fetchImpl(target.url, {
+                    method: 'POST',
+                    headers,
+                    body: prewarm.bodyText,
+                    signal: attempt.signal,
+                });
             }
             catch (error) {
-                logger.warn('cachekeep', 'prepare body failed', {
+                return {
+                    ok: false,
+                    reason: error instanceof Error ? error.message : String(error),
+                    transient: true,
+                };
+            }
+            const receivedAt = this.options.now?.() ?? Date.now();
+            const raw = await response.text().catch(() => '');
+            let data = null;
+            try {
+                data = raw ? JSON.parse(raw) : null;
+            }
+            catch { }
+            try {
+                await this.options.onResponse?.({
+                    target,
+                    bodyText: prewarm.bodyText,
+                    status: response.status,
+                    data,
+                    receivedAt,
+                    attempt,
+                });
+            }
+            catch { }
+            try {
+                const dumpHandle = await dumpDirectRequest({
+                    affinity: target.id,
+                    route: 'cachekeep',
+                    status: response.status,
+                    bodyText: prewarm.bodyText,
+                    url: target.url,
+                    method: 'POST',
+                    headers,
+                    tag: 'cachekeep',
+                });
+                await dumpResponseArtifact(dumpHandle, {
+                    status: response.status,
+                    message: data,
+                });
+            }
+            catch (error) {
+                logger.debug('cachekeep', 'dump failed', {
                     session: target.id,
                     error: error instanceof Error ? error.message : String(error),
                 });
             }
+            if (!response.ok) {
+                return {
+                    ok: false,
+                    reason: raw || `HTTP ${response.status}`,
+                    status: response.status,
+                };
+            }
+            const objectData = data && typeof data === 'object' && !Array.isArray(data)
+                ? data
+                : null;
+            const usage = objectData?.usage;
+            return { ok: true, ...(usage && { usage }) };
         }
-        const preparedTarget = { ...target, bodyText };
-        const prewarm = await buildCacheKeepPrewarmBody(bodyText);
-        if (!prewarm.ok)
-            return prewarm;
-        const fetchImpl = this.options.fetchImpl ?? fetch;
-        const prewarmTarget = { ...preparedTarget, bodyText: prewarm.bodyText };
-        const headers = this.options.prepareHeaders
-            ? await this.options.prepareHeaders(new Headers(target.headers), prewarmTarget)
-            : new Headers(target.headers);
-        headers.delete('content-length');
-        headers.delete('transfer-encoding');
-        let response;
-        try {
-            response = await fetchImpl(target.url, {
-                method: 'POST',
-                headers,
-                body: prewarm.bodyText,
-                signal: AbortSignal.timeout(this.options.prewarmTimeoutMs ?? CACHE_KEEP_PREWARM_TIMEOUT_MS),
-            });
-        }
-        catch (error) {
-            return {
-                ok: false,
-                reason: error instanceof Error ? error.message : String(error),
-                transient: true,
-            };
-        }
-        const receivedAt = this.options.now?.() ?? Date.now();
-        const raw = await response.text().catch(() => '');
-        let data = null;
-        try {
-            data = raw ? JSON.parse(raw) : null;
-        }
-        catch { }
-        try {
-            await this.options.onResponse?.({
-                target,
-                bodyText: prewarm.bodyText,
-                status: response.status,
-                data,
-                receivedAt,
-            });
-        }
-        catch { }
-        try {
-            const dumpHandle = await dumpDirectRequest({
-                affinity: target.id,
-                route: 'cachekeep',
-                status: response.status,
-                bodyText: prewarm.bodyText,
-                url: target.url,
-                method: 'POST',
-                headers,
-                tag: 'cachekeep',
-            });
-            await dumpResponseArtifact(dumpHandle, {
-                status: response.status,
-                message: data,
-            });
-        }
-        catch (error) {
-            logger.debug('cachekeep', 'dump failed', {
-                session: target.id,
-                error: error instanceof Error ? error.message : String(error),
-            });
-        }
-        if (!response.ok) {
-            return {
-                ok: false,
-                reason: raw || `HTTP ${response.status}`,
-                status: response.status,
-            };
+        finally {
+            try {
+                await this.options.onComplete?.({ target, attempt });
+            }
+            catch { }
         }
-        const objectData = data && typeof data === 'object' && !Array.isArray(data)
-            ? data
-            : null;
-        const usage = objectData?.usage;
-        return { ok: true, ...(usage && { usage }) };
     }
     async prewarm(target, now) {
         const result = await this.sendPrewarm(target);

package/dist/cch.d.ts

@@ -1,3 +1,9 @@
+export interface BillingLineageFields {
+    previousRequestId?: string;
+    promptId?: string;
+}
+export declare function isValidAnthropicRequestId(value: string): boolean;
+export declare function isValidBillingPromptId(value: string): boolean;
 type Message = {
     role?: string;
     content?: string | Array<{
@@ -38,5 +44,9 @@ export declare function computeCcVersionSuffix(firstUserText: string, version?:
  * Build the billing header with a cch placeholder.
  * signRequestBody() must run after final request serialization to replace it.
  */
-export declare function buildBillingHeaderValue(messages: Message[], version: string | undefined, entrypoint: string, pinnedFirstUserText?: string): string;
+export declare function buildBillingHeaderValue(messages: Message[], version: string | undefined, entrypoint: string, pinnedFirstUserText?: string, lineage?: BillingLineageFields): string;
+/** Remove request-scoped Claude Code lineage from a billing header string. */
+export declare function stripBillingLineageFields(value: string): string;
+/** Remove request-scoped Claude Code lineage before reusing a request body. */
+export declare function stripBillingLineageFromBody(body: unknown): number;
 export {};

package/dist/cch.js

@@ -1,6 +1,15 @@
 import { createHash } from 'node:crypto';
 import xxhashInit from 'xxhash-wasm';
 import { CCH_POSITIONS, CCH_SALT, CLAUDE_CODE_VERSION } from './constants.js';
+const ANTHROPIC_REQUEST_ID_PATTERN = /^req_[A-Za-z0-9_-]{8,128}$/;
+const PROMPT_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const BILLING_LINEAGE_FIELD_PATTERN = / cc_(?:prev_req|prompt_id)=[^;\r\n]*;/g;
+export function isValidAnthropicRequestId(value) {
+    return ANTHROPIC_REQUEST_ID_PATTERN.test(value);
+}
+export function isValidBillingPromptId(value) {
+    return PROMPT_ID_PATTERN.test(value);
+}
 const CCH_SEED = 0x4d659218e32a3268n;
 const CCH_PLACEHOLDER = 'cch=00000;';
 export const CCH_PATTERN = /\bcch=([0-9a-f]{5});/;
@@ -118,10 +127,46 @@ export function computeCcVersionSuffix(firstUserText, version = CLAUDE_CODE_VERS
  * Build the billing header with a cch placeholder.
  * signRequestBody() must run after final request serialization to replace it.
  */
-export function buildBillingHeaderValue(messages, version = CLAUDE_CODE_VERSION, entrypoint, pinnedFirstUserText) {
+export function buildBillingHeaderValue(messages, version = CLAUDE_CODE_VERSION, entrypoint, pinnedFirstUserText, lineage) {
     const suffix = computeCcVersionSuffix(pinnedFirstUserText ?? extractFirstUserMessageText(messages), version);
-    return ('x-anthropic-billing-header: ' +
+    let value = 'x-anthropic-billing-header: ' +
         `cc_version=${version}.${suffix}; ` +
         `cc_entrypoint=${entrypoint}; ` +
-        'cch=00000;');
+        'cch=00000;';
+    if (lineage?.previousRequestId &&
+        isValidAnthropicRequestId(lineage.previousRequestId)) {
+        value += ` cc_prev_req=${lineage.previousRequestId};`;
+    }
+    if (lineage?.promptId && isValidBillingPromptId(lineage.promptId)) {
+        value += ` cc_prompt_id=${lineage.promptId};`;
+    }
+    return value;
+}
+/** Remove request-scoped Claude Code lineage from a billing header string. */
+export function stripBillingLineageFields(value) {
+    return value.replace(BILLING_LINEAGE_FIELD_PATTERN, '');
+}
+/** Remove request-scoped Claude Code lineage before reusing a request body. */
+export function stripBillingLineageFromBody(body) {
+    if (!body || typeof body !== 'object')
+        return 0;
+    const system = body.system;
+    if (!Array.isArray(system))
+        return 0;
+    let stripped = 0;
+    for (const block of system) {
+        if (!block || typeof block !== 'object')
+            continue;
+        const text = block.text;
+        if (typeof text !== 'string' ||
+            !text.startsWith('x-anthropic-billing-header:')) {
+            continue;
+        }
+        const clean = stripBillingLineageFields(text);
+        if (clean === text)
+            continue;
+        block.text = clean;
+        stripped += 1;
+    }
+    return stripped;
 }

package/dist/claude-code.d.ts

@@ -1,12 +1,18 @@
+export type ProviderAccountUuid = string & {
+    readonly __providerAccountUuid: unique symbol;
+};
 export type ClaudeCodeIdentity = {
     deviceId: string;
     accountIdentity?: string;
-    accountUuid?: string;
+    accountUuid?: ProviderAccountUuid;
     sessionId: string;
 };
 export declare function setBounded<K, V>(map: Map<K, V>, key: K, value: V, limit?: number): void;
 export declare function getClaudeCodeIdentity(seed: string): ClaudeCodeIdentity;
 export declare function resetClaudeCodeIdentityCachesForTest(): void;
+/** Use the identity already verified by the credential custodian, without an
+ * additional bootstrap request carrying a previously authorized token. */
+export declare function getClaudeCodeIdentityForVerifiedAccount(accountIdentity: string, accountUuid: ProviderAccountUuid): ClaudeCodeIdentity;
 export declare function resolveClaudeCodeIdentity(accessToken: string, model: string | undefined, accountIdentity: string | undefined): Promise<ClaudeCodeIdentity>;
 export declare function buildClaudeCodeMetadataUserId(identity: ClaudeCodeIdentity): string | null;
 export declare function applyClaudeCodeMetadata(body: Record<string, unknown>, identity: ClaudeCodeIdentity): boolean;

package/dist/claude-code.js

@@ -101,7 +101,9 @@ async function fetchClaudeCodeAccountUuid(accessToken, model) {
             return null;
         const data = (await response.json().catch(() => null));
         const accountUuid = data?.oauth_account?.account_uuid;
-        return typeof accountUuid === 'string' && accountUuid ? accountUuid : null;
+        return typeof accountUuid === 'string' && accountUuid
+            ? accountUuid
+            : null;
     }
     catch {
         return null;
@@ -110,6 +112,18 @@ async function fetchClaudeCodeAccountUuid(accessToken, model) {
         clearTimeout(timeout);
     }
 }
+/** Use the identity already verified by the credential custodian, without an
+ * additional bootstrap request carrying a previously authorized token. */
+export function getClaudeCodeIdentityForVerifiedAccount(accountIdentity, accountUuid) {
+    if (!accountIdentity.trim() || !accountUuid.trim()) {
+        throw new Error('A verified provider account identity is required');
+    }
+    const base = identityCache.get(accountCacheKey(accountUuid, accountIdentity)) ??
+        getClaudeCodeIdentity(explicitCacheKey(accountIdentity));
+    const identity = { ...base, accountIdentity, accountUuid };
+    cacheAccountIdentity(identity, accountIdentity, accountUuid);
+    return identity;
+}
 export async function resolveClaudeCodeIdentity(accessToken, model, accountIdentity) {
     const stableAccountIdentity = accountIdentity?.trim() || undefined;
     const cacheKey = stableAccountIdentity
@@ -130,8 +144,9 @@ export async function resolveClaudeCodeIdentity(accessToken, model, accountIdent
         setBounded(identityCache, cacheKey, identity);
         setBounded(identityCache, accessToken, identity);
     }
-    if (!accessToken.startsWith('sk-ant-oat'))
-        return identity;
+    if (!accessToken.startsWith('sk-ant-oat')) {
+        return clearCachedAccountUuid(cacheKey, identity);
+    }
     const now = Date.now();
     // A slot-stable identity survives account replacement; bootstrap is the
     // account lookup that must be repeated for each credential presented to it.

package/dist/claustrum-enrollment-registry.d.ts

@@ -0,0 +1,17 @@
+import { type ClaustrumEnrollmentConnection, type ClaustrumEnrollmentPaths, type ClaustrumEnrollmentStatus } from './claustrum-enrollment.js';
+export declare function getHostClaustrumEnrollmentPaths(host: 'opencode' | 'pi', env?: NodeJS.ProcessEnv, cwd?: string): ClaustrumEnrollmentPaths;
+export interface ClaustrumEnrollmentAdoption {
+    status(): ClaustrumEnrollmentStatus;
+    reconcileNow(): Promise<void>;
+    resetTerminal(): Promise<'reset' | 'idle' | 'refused-pending' | 'refused-approved' | 'busy'>;
+    release(): void;
+}
+export declare function adoptClaustrumEnrollment(options: {
+    proposedName: string;
+    paths: ClaustrumEnrollmentPaths;
+    connect: () => Promise<ClaustrumEnrollmentConnection>;
+    onStatus?: (status: ClaustrumEnrollmentStatus) => void;
+    setTimeoutImpl?: typeof setTimeout;
+    clearTimeoutImpl?: typeof clearTimeout;
+    pollIntervalMs?: number;
+}): ClaustrumEnrollmentAdoption;

package/dist/claustrum-enrollment-registry.js

@@ -0,0 +1,194 @@
+import { homedir } from 'node:os';
+import { isAbsolute, join, resolve } from 'node:path';
+import { ClaustrumEnrollmentManager, getClaustrumEnrollmentPaths, } from './claustrum-enrollment.js';
+const REGISTRY_SYMBOL = Symbol.for('cortexkit.anthropic-auth.claustrum-enrollments.v2');
+const PENDING_POLL_MS = 5_000;
+const RETRY_POLL_MS = 60_000;
+const UNAVAILABLE_RETRY_MS = 5_000;
+export function getHostClaustrumEnrollmentPaths(host, env = process.env, cwd = process.cwd()) {
+    const configured = env[`${host.toUpperCase()}_ANTHROPIC_AUTH_CLAUSTRUM_ENROLLMENT_FILE`]?.trim();
+    const tokenPath = configured
+        ? isAbsolute(configured)
+            ? configured
+            : resolve(cwd, configured)
+        : join(env.XDG_STATE_HOME || join(homedir(), '.local', 'state'), 'cortexkit', 'anthropic-auth', `${host}-enrollment.json`);
+    return getClaustrumEnrollmentPaths(tokenPath);
+}
+function registry() {
+    const global = globalThis;
+    if (!global[REGISTRY_SYMBOL])
+        global[REGISTRY_SYMBOL] = new Map();
+    return global[REGISTRY_SYMBOL];
+}
+function notify(entry, status) {
+    entry.status = status;
+    for (const listener of entry.leases.values())
+        listener(status);
+}
+function schedule(entry, delayMs) {
+    if (entry.closed || entry.timer)
+        return;
+    entry.timer = entry.setTimeoutImpl(() => {
+        entry.timer = undefined;
+        void run(entry);
+    }, delayMs);
+    if (typeof entry.timer === 'object' &&
+        entry.timer &&
+        'unref' in entry.timer) {
+        entry.timer.unref();
+    }
+}
+function nextDelay(status, pollIntervalMs) {
+    if (pollIntervalMs === 0 ||
+        status.state === 'approved' ||
+        status.state === 'denied' ||
+        status.state === 'blocked') {
+        return undefined;
+    }
+    if (status.state === 'pending') {
+        return status.retryCode ? RETRY_POLL_MS : pollIntervalMs;
+    }
+    return UNAVAILABLE_RETRY_MS;
+}
+async function getClient(entry) {
+    if (entry.closed)
+        throw new Error('Claustrum enrollment registry is closed');
+    if (entry.client)
+        return entry.client;
+    if (!entry.clientPromise) {
+        entry.clientPromise = entry
+            .connect()
+            .then((client) => {
+            if (entry.closed) {
+                client.close();
+                throw new Error('Claustrum enrollment registry is closed');
+            }
+            entry.client = client;
+            return client;
+        })
+            .finally(() => {
+            entry.clientPromise = undefined;
+        });
+    }
+    return entry.clientPromise;
+}
+async function run(entry) {
+    if (entry.closed)
+        return;
+    if (entry.run)
+        return entry.run;
+    entry.run = (async () => {
+        let status;
+        try {
+            status = await entry.manager.reconcile();
+        }
+        catch {
+            status = {
+                state: 'unavailable',
+                proposedName: entry.proposedName,
+                // Unknown transport/storage errors may echo one-shot bearer material.
+                code: 'unavailable',
+            };
+            // A transport or filesystem failure is not a durable ceremony verdict. Keep
+            // retrying while the process is alive; only the manager persists protocol-terminal
+            // outcomes such as denied, superseded, or already_consumed.
+            if (entry.closed)
+                return;
+            notify(entry, status);
+            if (entry.pollIntervalMs !== 0)
+                schedule(entry, UNAVAILABLE_RETRY_MS);
+            return;
+        }
+        if (entry.closed)
+            return;
+        notify(entry, status);
+        const delay = nextDelay(status, entry.pollIntervalMs);
+        if (delay !== undefined)
+            schedule(entry, delay);
+    })().finally(() => {
+        entry.run = undefined;
+    });
+    return entry.run;
+}
+export function adoptClaustrumEnrollment(options) {
+    const key = resolve(options.paths.tokenPath);
+    const entries = registry();
+    let entry = entries.get(key);
+    if (entry && entry.proposedName !== options.proposedName) {
+        throw new Error('Claustrum enrollment path is already owned by a different consumer');
+    }
+    if (!entry) {
+        const connect = options.connect;
+        const setTimeoutImpl = options.setTimeoutImpl ?? setTimeout;
+        const clearTimeoutImpl = options.clearTimeoutImpl ?? clearTimeout;
+        const lazyClient = {
+            enrollPropose: async (input) => {
+                const current = entry;
+                const client = await getClient(current);
+                if (current.closed)
+                    throw new Error('Claustrum enrollment registry is closed');
+                return client.enrollPropose(input);
+            },
+            enrollPoll: async (input) => {
+                const current = entry;
+                const client = await getClient(current);
+                if (current.closed)
+                    throw new Error('Claustrum enrollment registry is closed');
+                // Once a poll has been sent, let the manager durably collect its one-shot
+                // approval even if release wins meanwhile. Only later calls are fenced.
+                return client.enrollPoll(input);
+            },
+        };
+        entry = {
+            key,
+            proposedName: options.proposedName,
+            leases: new Map(),
+            manager: new ClaustrumEnrollmentManager({
+                client: lazyClient,
+                paths: options.paths,
+                proposedName: options.proposedName,
+            }),
+            connect,
+            setTimeoutImpl,
+            clearTimeoutImpl,
+            pollIntervalMs: options.pollIntervalMs ?? PENDING_POLL_MS,
+            status: { state: 'idle' },
+            closed: false,
+        };
+        entries.set(key, entry);
+    }
+    const lease = Symbol(key);
+    entry.leases.set(lease, options.onStatus ?? (() => { }));
+    options.onStatus?.(entry.status);
+    void run(entry);
+    let released = false;
+    return {
+        status: () => entry?.status ?? { state: 'idle' },
+        reconcileNow: () => (entry ? run(entry) : Promise.resolve()),
+        resetTerminal: async () => {
+            if (!entry)
+                return 'idle';
+            const result = await entry.manager.resetTerminal();
+            if (result === 'reset') {
+                notify(entry, { state: 'idle' });
+                await run(entry);
+            }
+            return result;
+        },
+        release: () => {
+            if (released || !entry)
+                return;
+            released = true;
+            entry.leases.delete(lease);
+            if (entry.leases.size > 0)
+                return;
+            entry.closed = true;
+            if (entry.timer) {
+                entry.clearTimeoutImpl(entry.timer);
+                entry.timer = undefined;
+            }
+            entry.client?.close();
+            entries.delete(key);
+        },
+    };
+}