@cortexkit/anthropic-auth-core 1.22.0 → 1.23.0

package/dist/models.js

@@ -9,6 +9,10 @@ export const CLAUDE_MYTHOS_5_1_MODEL_ID = 'claude-mythos-5-1';
  * above so per-million-token cost estimation does not conflate families.
  */
 export const CLAUDE_HAIKU_4_5_MODEL_ID = 'claude-haiku-4-5';
+/** Remove OpenCode's context-window qualifier before model-family checks. */
+export function normalizeAnthropicModelId(model) {
+    return model.endsWith('[1m]') ? model.slice(0, -4) : model;
+}
 /**
  * Per-million-token USD pricing for Haiku 4.5. Used to project the cumulative
  * cost of prime requests from persisted usage counters — never persisted on
@@ -74,18 +78,23 @@ export const CLAUDE_FABLE_MYTHOS_5_1_MODEL_SPECS = {
     [CLAUDE_MYTHOS_5_1_MODEL_ID]: CLAUDE_FABLE_MYTHOS_5_MODEL_SPECS[CLAUDE_MYTHOS_5_1_MODEL_ID],
 };
 export function isClaudeFableOrMythos5Model(model) {
-    return (typeof model === 'string' &&
-        CLAUDE_FABLE_MYTHOS_5_MODEL_IDS.some((id) => model === id || model.startsWith(`${id}-`)));
+    if (typeof model !== 'string')
+        return false;
+    const normalized = normalizeAnthropicModelId(model);
+    return CLAUDE_FABLE_MYTHOS_5_MODEL_IDS.some((id) => normalized === id || normalized.startsWith(`${id}-`));
 }
 export function isClaudeFableOrMythos51Model(model) {
-    return (typeof model === 'string' &&
-        CLAUDE_FABLE_MYTHOS_5_1_MODEL_IDS.some((id) => model === id || model.startsWith(`${id}-`)));
+    if (typeof model !== 'string')
+        return false;
+    const normalized = normalizeAnthropicModelId(model);
+    return CLAUDE_FABLE_MYTHOS_5_1_MODEL_IDS.some((id) => normalized === id || normalized.startsWith(`${id}-`));
 }
 export function isClaudeFable51Model(model) {
     if (typeof model !== 'string')
         return false;
-    return (model === CLAUDE_FABLE_5_1_MODEL_ID ||
-        model.startsWith(`${CLAUDE_FABLE_5_1_MODEL_ID}-`));
+    const normalized = normalizeAnthropicModelId(model);
+    return (normalized === CLAUDE_FABLE_5_1_MODEL_ID ||
+        normalized.startsWith(`${CLAUDE_FABLE_5_1_MODEL_ID}-`));
 }
 export function getClaudeFableMythos5ReleaseDate(model) {
     return isClaudeFableOrMythos51Model(model)
@@ -101,9 +110,11 @@ export const CLAUDE_SONNET_5_MODEL_ID = 'claude-sonnet-5';
  */
 export const CLAUDE_SONNET_5_ADAPTIVE_THINKING = CLAUDE_FABLE_MYTHOS_5_SUMMARIZED_THINKING;
 export function isClaudeSonnet5Model(model) {
-    return (typeof model === 'string' &&
-        (model === CLAUDE_SONNET_5_MODEL_ID ||
-            model.startsWith(`${CLAUDE_SONNET_5_MODEL_ID}-`)));
+    if (typeof model !== 'string')
+        return false;
+    const normalized = normalizeAnthropicModelId(model);
+    return (normalized === CLAUDE_SONNET_5_MODEL_ID ||
+        normalized.startsWith(`${CLAUDE_SONNET_5_MODEL_ID}-`));
 }
 export const CLAUDE_OPUS_5_MODEL_ID = 'claude-opus-5';
 /**
@@ -116,9 +127,34 @@ export const CLAUDE_OPUS_5_MODEL_ID = 'claude-opus-5';
  */
 export const CLAUDE_OPUS_5_ADAPTIVE_THINKING = CLAUDE_FABLE_MYTHOS_5_SUMMARIZED_THINKING;
 export function isClaudeOpus5Model(model) {
-    return (typeof model === 'string' &&
-        (model === CLAUDE_OPUS_5_MODEL_ID ||
-            model.startsWith(`${CLAUDE_OPUS_5_MODEL_ID}-`)));
+    if (typeof model !== 'string')
+        return false;
+    const normalized = normalizeAnthropicModelId(model);
+    return (!isClaudeOpus55Model(normalized) &&
+        (normalized === CLAUDE_OPUS_5_MODEL_ID ||
+            normalized.startsWith(`${CLAUDE_OPUS_5_MODEL_ID}-`)));
+}
+export const CLAUDE_OPUS_5_5_MODEL_ID = 'claude-opus-5-5';
+export const CLAUDE_OPUS_5_5_RELEASE_DATE = '2026-09-18';
+export const CLAUDE_OPUS_5_5_CONTEXT_WINDOW = 1_000_000;
+export const CLAUDE_OPUS_5_5_MAX_OUTPUT_TOKENS = 128_000;
+export const CLAUDE_OPUS_5_5_PRICING = {
+    input: 4,
+    output: 20,
+    cacheRead: 0.2,
+    cacheWrite5m: 5,
+    cacheWrite1h: 8,
+};
+export const CLAUDE_OPUS_5_5_ADAPTIVE_THINKING = CLAUDE_FABLE_MYTHOS_5_SUMMARIZED_THINKING;
+export function isClaudeOpus55Model(model) {
+    if (typeof model !== 'string')
+        return false;
+    const normalized = normalizeAnthropicModelId(model);
+    return (normalized === CLAUDE_OPUS_5_5_MODEL_ID ||
+        normalized.startsWith(`${CLAUDE_OPUS_5_5_MODEL_ID}-`));
+}
+export function isClaudeOpus5FamilyModel(model) {
+    return isClaudeOpus5Model(model) || isClaudeOpus55Model(model);
 }
 export function isOpenAIReasoningSignature(value) {
     if (typeof value !== 'string')

package/dist/oauth-profile.d.ts

@@ -1,8 +1,9 @@
-import type { OAuthAccountProfile } from './accounts.ts';
+import type { OAuthAccountProfile, ProviderAccountUuid } from './accounts.ts';
 export declare const PROFILE_TTL_MS: number;
 export declare function fetchOAuthAccountProfile(input: {
     accessToken: string;
     accountIdentity?: string;
+    providerAccountUuid?: ProviderAccountUuid;
     fetchImpl?: typeof fetch;
     now?: () => number;
     signal?: AbortSignal;

package/dist/oauth-profile.js

@@ -1,6 +1,9 @@
+import { assertNotCustodyTombstone } from './claustrum.js';
 const PROFILE_URL = 'https://api.anthropic.com/api/oauth/profile';
 export const PROFILE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 export async function fetchOAuthAccountProfile(input) {
+    // The bearer value is guarded where it becomes a header, like every other builder.
+    assertNotCustodyTombstone(input.accessToken, 'anthropic');
     const response = await (input.fetchImpl ?? fetch)(PROFILE_URL, {
         method: 'GET',
         signal: input.signal,
@@ -29,6 +32,9 @@ export async function fetchOAuthAccountProfile(input) {
         ...(input.accountIdentity !== undefined && {
             accountIdentity: input.accountIdentity,
         }),
+        ...(input.providerAccountUuid !== undefined && {
+            providerAccountUuid: input.providerAccountUuid,
+        }),
     };
 }
 export function oauthProfileMatchesIdentity(profile, accountIdentity) {

package/dist/prime.d.ts

@@ -30,7 +30,7 @@ export type PrimeAccountStatus = {
     label: string;
     nextDueAt?: number;
     lastPrimedAt?: number | null;
-    lastResult?: 'ok' | 'error';
+    lastResult?: 'ok' | 'error' | 'skipped';
     usage?: import('./accounts.ts').PrimeUsageCounters;
     estimatedCostUsd?: number;
 };
@@ -47,7 +47,7 @@ export type PrimeSendResult = {
     status?: number;
     ms?: number;
     error: string;
-    reason?: 'token-refresh' | 'send';
+    reason?: 'token-refresh' | 'vault-cold' | 'send';
 };
 /**
  * Pure command parser — accepts `''` / `on` / `off` and treats anything else
@@ -72,7 +72,7 @@ export declare function buildPrimeAccountStatuses(storage: AccountStorage | null
     now?: number;
     transient?: ReadonlyMap<string, {
         lastPrimedAt?: number;
-        lastResult?: 'ok' | 'error';
+        lastResult?: 'ok' | 'error' | 'skipped';
     }>;
 }): PrimeAccountStatus[];
 /**
@@ -182,9 +182,17 @@ export type PrimeManagerOptions = {
     now?: () => number;
     markerDir?: string;
     storagePath: string;
+    setIntervalImpl?: typeof globalThis.setInterval;
+    clearIntervalImpl?: typeof globalThis.clearInterval;
+    setTimeoutImpl?: typeof globalThis.setTimeout;
+    clearTimeoutImpl?: typeof globalThis.clearTimeout;
 };
 export declare class PrimeManager {
     private timer;
+    private readonly setIntervalImpl;
+    private readonly clearIntervalImpl;
+    private readonly setTimeoutImpl;
+    private readonly clearTimeoutImpl;
     private postFireRefreshTimers;
     private lastForcedCheck;
     private stopped;

package/dist/prime.js

@@ -155,6 +155,8 @@ function formatPrimed(lastPrimedAt, lastResult) {
     });
     if (lastResult === 'error')
         return `primed ${time} err`;
+    if (lastResult === 'skipped')
+        return `primed ${time} skipped`;
     return `primed ${time} \u2713`;
 }
 function formatUsd(value) {
@@ -346,6 +348,10 @@ function storedResetMs(window) {
 }
 export class PrimeManager {
     timer = null;
+    setIntervalImpl;
+    clearIntervalImpl;
+    setTimeoutImpl;
+    clearTimeoutImpl;
     postFireRefreshTimers = new Set();
     lastForcedCheck = new Map();
     // Set true by `stop()` so a tick already in flight can short-circuit
@@ -373,6 +379,11 @@ export class PrimeManager {
     windowActive = new Map();
     constructor(options) {
         this.options = options;
+        this.setIntervalImpl = options.setIntervalImpl ?? globalThis.setInterval;
+        this.clearIntervalImpl =
+            options.clearIntervalImpl ?? globalThis.clearInterval;
+        this.setTimeoutImpl = options.setTimeoutImpl ?? globalThis.setTimeout;
+        this.clearTimeoutImpl = options.clearTimeoutImpl ?? globalThis.clearTimeout;
     }
     updateOptions(options) {
         this.options = options;
@@ -382,7 +393,7 @@ export class PrimeManager {
             return;
         this.stopped = false;
         logger.trace('prime', 'manager started');
-        this.timer = setInterval(() => {
+        this.timer = this.setIntervalImpl(() => {
             void this.tick().catch((error) => {
                 logger.warn('prime', 'tick failed', {
                     error: error instanceof Error ? error.message : String(error),
@@ -399,11 +410,12 @@ export class PrimeManager {
         const hadPostFireRefresh = this.postFireRefreshTimers.size > 0;
         this.stopped = true;
         if (this.timer) {
-            clearInterval(this.timer);
+            this.clearIntervalImpl(this.timer);
             this.timer = null;
         }
-        for (const timer of this.postFireRefreshTimers)
-            clearTimeout(timer);
+        for (const timer of this.postFireRefreshTimers) {
+            this.clearTimeoutImpl(timer);
+        }
         this.postFireRefreshTimers.clear();
         this.lastForcedCheck.clear();
         if (!hadTimer && !hadPostFireRefresh)
@@ -687,7 +699,7 @@ export class PrimeManager {
         if (this.stopped)
             return;
         if (!result.ok) {
-            // Spec Logging table: two distinct warn events.
+            // `vault-cold` is a cache-warm skip; it is not a provider failure.
             // - `prime token refresh failed` — token-refresh failure
             //   before the request fires (reason: 'token-refresh').
             // - `prime fire failed` — HTTP error / fetch throw /
@@ -698,6 +710,12 @@ export class PrimeManager {
                     error: result.error,
                 });
             }
+            else if (result.reason === 'vault-cold') {
+                logger.debug('prime', 'prime vault credential cold', {
+                    account: evaluation.label,
+                    reason: result.reason,
+                });
+            }
             else {
                 logger.warn('prime', 'prime fire failed', {
                     account: evaluation.label,
@@ -707,7 +725,7 @@ export class PrimeManager {
             }
             this.transient.set(evaluation.id, {
                 lastPrimedAt: now,
-                lastResult: 'error',
+                lastResult: result.reason === 'vault-cold' ? 'skipped' : 'error',
             });
             return;
         }
@@ -757,7 +775,7 @@ export class PrimeManager {
         // Unified fire-response headers can arm the window instantly on newer
         // trees. This branch predates header harvesting, so a delayed poll captures
         // the reset after the usage API's observed propagation lag.
-        const timer = setTimeout(() => {
+        const timer = this.setTimeoutImpl(() => {
             this.postFireRefreshTimers.delete(timer);
             if (this.stopped)
                 return;

package/dist/quota-header-feed.d.ts

@@ -1,6 +1,13 @@
 import { type AccountStorage, type OAuthQuotaSnapshot, type QuotaFieldName, type QuotaFieldSource, type QuotaFieldSources } from './accounts.ts';
 export declare const QUOTA_HEADER_FEED_SCHEMA_VERSION = 3;
 export declare const QUOTA_HEADER_FEED_LEASE_MS = 180000;
+/**
+ * Lease files are per process; each carries only the accounts whose response
+ * headers THAT process harvested. Consumers MUST union entries across all files
+ * inside `lease_horizon_ms`, deduplicating by account; "newest file wins" is wrong.
+ * `anthropic_account_uuid` is always present: null is unresolvable, while absence
+ * identifies an old producer. A fallback `account_ref` is store-local.
+ */
 export type QuotaHeaderFeedIdentity = {
     identity_source: 'credential_id';
     credential_id: string;
@@ -22,9 +29,12 @@ type QuotaHeaderFeedMetadata = {
     observed_at_ms: number;
 };
 export type QuotaHeaderFeedEntry = QuotaHeaderFeedIdentity & QuotaHeaderFeedMetadata & {
+    /** Always present: null means UUID resolution failed; absence denotes an old producer. */
+    anthropic_account_uuid: string | null;
     quota: QuotaHeaderFeedQuota;
 };
 export type QuotaHeaderFeedPublishEntry = QuotaHeaderFeedIdentity & QuotaHeaderFeedMetadata & {
+    anthropic_account_uuid: string | null;
     quota: Omit<QuotaHeaderFeedQuota, 'provenance'> & {
         fieldSources?: QuotaFieldSources;
     };
@@ -44,8 +54,11 @@ export declare class QuotaHeaderFeedRegistry {
         now?: () => number;
         leaseMs?: number;
         instanceId?: string;
+        removeFile?: (path: string) => Promise<void>;
+        beforeRemoveFile?: (path: string) => Promise<void>;
     });
     publish(entry: QuotaHeaderFeedPublishEntry): Promise<void>;
+    private reapStaleSiblingLeases;
     list(): Promise<QuotaHeaderFeedEntry[]>;
     dispose(): Promise<void>;
 }

package/dist/quota-header-feed.js

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { chmod, mkdir, readdir, readFile, rename, rm, writeFile, } from 'node:fs/promises';
+import { chmod, lstat, mkdir, readdir, readFile, rename, rm, stat, writeFile, } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { isOAuthAccount, QUOTA_FIELD_NAMES, } from './accounts.js';
@@ -22,6 +22,10 @@ function validIdentity(entry) {
         return false;
     if (!entry.quota || typeof entry.quota !== 'object')
         return false;
+    if (!Object.hasOwn(entry, 'anthropic_account_uuid') ||
+        (entry.anthropic_account_uuid !== null &&
+            typeof entry.anthropic_account_uuid !== 'string'))
+        return false;
     if (entry.identity_source === 'none') {
         return !('credential_id' in entry) && !('account_ref' in entry);
     }
@@ -192,17 +196,33 @@ export class QuotaHeaderFeedRegistry {
         this.filePath = join(options.directory ?? getDefaultQuotaHeaderFeedDirectory(), `${instanceId}.json`);
     }
     publish(entry) {
-        const { accountKey, quota, ...entryWithoutQuota } = entry;
-        const cleanEntry = {
-            ...entryWithoutQuota,
-            quota: projectQuota(quota),
-        };
+        const { accountKey, quota } = entry;
         try {
-            validatePublishEntry(cleanEntry);
+            validatePublishEntry(entry);
         }
         catch (error) {
             return Promise.reject(error);
         }
+        const identity = entry.identity_source === 'credential_id'
+            ? {
+                identity_source: 'credential_id',
+                credential_id: entry.credential_id,
+            }
+            : entry.identity_source === 'account_ref'
+                ? {
+                    identity_source: 'account_ref',
+                    account_ref: entry.account_ref,
+                }
+                : { identity_source: 'none' };
+        const cleanEntry = {
+            ...identity,
+            schema_version: entry.schema_version,
+            provider: entry.provider,
+            configured_account_count: entry.configured_account_count,
+            observed_at_ms: entry.observed_at_ms,
+            anthropic_account_uuid: entry.anthropic_account_uuid,
+            quota: projectQuota(quota),
+        };
         if (!accountKey)
             return Promise.reject(new Error('Invalid quota header feed account key'));
         this.writeChain = this.writeChain
@@ -211,6 +231,7 @@ export class QuotaHeaderFeedRegistry {
             const directory = this.options.directory ?? getDefaultQuotaHeaderFeedDirectory();
             await mkdir(directory, { recursive: true, mode: 0o700 });
             await chmod(directory, 0o700);
+            await this.reapStaleSiblingLeases(directory);
             let entries = {};
             try {
                 const record = JSON.parse(await readFile(this.filePath, 'utf8'));
@@ -223,7 +244,7 @@ export class QuotaHeaderFeedRegistry {
             entries[accountKey] = cleanEntry;
             const tempPath = `${this.filePath}.${randomUUID()}.tmp`;
             try {
-                await writeFile(tempPath, `${JSON.stringify({ version: QUOTA_HEADER_FEED_SCHEMA_VERSION, entries })}\n`, { mode: 0o600 });
+                await writeFile(tempPath, `${JSON.stringify({ version: QUOTA_HEADER_FEED_SCHEMA_VERSION, lease_horizon_ms: this.options.leaseMs ?? QUOTA_HEADER_FEED_LEASE_MS, entries })}\n`, { mode: 0o600 });
                 await chmod(tempPath, 0o600);
                 await rename(tempPath, this.filePath);
             }
@@ -233,6 +254,37 @@ export class QuotaHeaderFeedRegistry {
         });
         return this.writeChain;
     }
+    async reapStaleSiblingLeases(directory) {
+        const now = this.options.now?.() ?? Date.now();
+        const leaseMs = this.options.leaseMs ?? QUOTA_HEADER_FEED_LEASE_MS;
+        let names;
+        try {
+            names = await readdir(directory);
+        }
+        catch {
+            return;
+        }
+        await Promise.all(names
+            .filter((name) => /^\d+-[0-9a-f-]+\.json$/i.test(name))
+            .map(async (name) => {
+            const path = join(directory, name);
+            if (path === this.filePath)
+                return;
+            try {
+                const file = await stat(path);
+                if (file.mtimeMs > now || now - file.mtimeMs < leaseMs)
+                    return;
+                await this.options.beforeRemoveFile?.(path);
+                const current = await lstat(path);
+                if (current.ino !== file.ino || current.mtimeMs !== file.mtimeMs)
+                    return;
+                await (this.options.removeFile ?? ((target) => rm(target)))(path);
+            }
+            catch {
+                // A missed cleanup must not prevent this process from refreshing its lease.
+            }
+        }));
+    }
     async list() {
         await this.writeChain.catch(() => { });
         const directory = this.options.directory ?? getDefaultQuotaHeaderFeedDirectory();

package/dist/quota-manager.d.ts

@@ -20,6 +20,12 @@ export type QuotaRefreshResult = {
 export type QuotaManagerOptions = {
     storage: AccountStorage | null;
     fetchImpl?: typeof fetch;
+    /** Resolve custody credentials at the actual HTTP boundary, after quota gates. */
+    fetchQuotaSnapshot?: (request: {
+        kind: 'main' | 'fallback';
+        accountId: string | undefined;
+        accessToken: string;
+    }) => Promise<OAuthQuotaSnapshot>;
     now?: () => number;
     onMainQuotaFetched?: (quota: OAuthQuotaSnapshot, checkedAt: number, tokenFingerprint: string, fetchStartedAt: number, quotaErrorGeneration: number, quotaErrorClearedAt: number | undefined) => void;
     onApiError?: (error: AccountOperationError, quotaErrorGeneration: number) => void;
@@ -39,6 +45,8 @@ export declare class QuotaManager {
     private fallbackGenerations;
     private inflightMain;
     private inflightMainAccountId;
+    private inflightMainAccessToken;
+    private inflightMainToken;
     private inflightFallbacks;
     private mainLastApiError;
     private fallbackApiErrors;
@@ -46,6 +54,7 @@ export declare class QuotaManager {
     private lastApiCallAt;
     private storage;
     private readonly fetchImpl;
+    private readonly fetchQuotaSnapshot;
     private readonly now;
     private readonly onMainQuotaFetched;
     private readonly onApiError;
@@ -61,10 +70,13 @@ export declare class QuotaManager {
      * Cached fallback quota entry, scoped to the configured account id.
      */
     getFallback(accountId: string, account?: Pick<OAuthAccount, 'authLineageId'>): QuotaEntry | null;
+    /** A host transport resolves scoped credentials at dispatch time. */
+    canFetchWithoutAccessToken(): boolean;
     getAllFallbacks(): Map<string, QuotaEntry>;
     setMain(mainAccountId: string | undefined, entry: QuotaEntry): void;
+    clearMain(): void;
     /** Bind quota state to the account behind the current main credential. */
-    setMainQuotaAccountIdentity(accountIdentity: string | undefined, strict?: boolean): number | undefined;
+    setMainQuotaAccountIdentity(accountIdentity: string | undefined, strict?: boolean, force?: boolean): number | undefined;
     setFallback(accountId: string, entry: QuotaEntry, account: Pick<OAuthAccount, 'authLineageId'> | undefined): void;
     clearFallback(accountId: string): void;
     pushMainFromHeaders(mainAccountId: string | undefined, incoming: OAuthQuotaSnapshot): QuotaEntry;
@@ -122,6 +134,8 @@ export declare class QuotaManager {
     private static quotaLockName;
     private bindFallbackLineage;
     private acceptFallbackQuotaObservation;
+    private isClosed;
+    close(): void;
     /**
      * Serialize API calls through a shared gate so only one
      * quota API request runs at a time, with a minimum gap