@cortexkit/anthropic-auth-core 1.23.0 → 2.0.0

package/README.md

@@ -6,3 +6,5 @@ User-facing packages:
 
 - `@cortexkit/opencode-anthropic-auth` for OpenCode
 - `@cortexkit/pi-anthropic-auth` for Pi
+
+Claude Haiku 5.5 (`claude-haiku-5-5`) has a 1M-token context window and 128K max output. Standard input/output rates are $0.10/$0.50 per million tokens; all rates increase fivefold above 100K total input, including cached tokens. Optional quota priming continues to send a minimal Haiku 4.5 request to start a new quota window.

package/dist/accounts.d.ts

@@ -1,5 +1,4 @@
 import type { ProviderAccountUuid } from './claude-code.ts';
-import { type CustodyHandleResolution } from './claustrum.ts';
 import { type Cache1hMode } from './constants.ts';
 import { type LogLevel } from './logger.ts';
 export type { ProviderAccountUuid } from './claude-code.ts';
@@ -22,7 +21,6 @@ export type OAuthAccount = AccountBase & {
     type: 'oauth';
     authLineageId?: string;
     anthropicAccountUuid?: ProviderAccountUuid;
-    claustrumHandle?: string;
     /** Non-secret scoped identity; never a capability handle or bearer token. */
     claustrumScopedCredentialId?: string;
     claustrumScopedState?: string;
@@ -51,15 +49,13 @@ export type ApiKeyAccount = AccountBase & {
     authHeader?: 'authorization-bearer' | 'x-api-key';
 };
 export type FallbackAccount = OAuthAccount | ApiKeyAccount;
-export type ClaustrumAccountGate = {
-    enabled?: boolean;
-};
 export type ClaustrumMode = 'local' | 'claustrum';
 export type ClaustrumConfig = {
     mode?: ClaustrumMode;
-    handlesFile?: string;
     /** Set by authoritative scoped discovery, not an authentication toggle. */
     scopedRoster?: true;
+    /** Producer inventory cursor committed with the roster; never a bearer. */
+    rosterView?: string;
     /** Authoritative, non-secret primary identity from scoped discovery. */
     primaryAccount?: {
         credentialId: string;
@@ -68,7 +64,6 @@ export type ClaustrumConfig = {
     };
     /** Preserve explicit exclusions when a vaulted account disappears and returns. */
     disabledAccountIdentities?: string[];
-    accounts?: Record<string, ClaustrumAccountGate>;
 };
 export declare function isOAuthAccount(account: FallbackAccount): account is OAuthAccount;
 export declare function isApiKeyAccount(account: FallbackAccount): account is ApiKeyAccount;
@@ -269,7 +264,7 @@ export type AccountStorage = {
  * (to display the provider's real model costs).
  */
 export declare function isCostZeroingEnabled(storage: Pick<AccountStorage, 'costZeroing'>): boolean;
-export type AccountRuntimeEntry = Partial<Pick<OAuthAccount, 'access' | 'authLineageId' | 'anthropicAccountUuid' | 'claustrumScopedCredentialId' | 'claustrumScopedState' | 'claustrumHandle' | 'refresh' | 'expires' | 'lastUsed' | 'lastRefreshedAt' | 'lastRefreshError' | 'lastQuotaRefreshError' | 'quota' | 'profile' | 'prime'> & Pick<ApiKeyAccount, 'apiKey' | 'lastUsed'>>;
+export type AccountRuntimeEntry = Partial<Pick<OAuthAccount, 'access' | 'authLineageId' | 'anthropicAccountUuid' | 'claustrumScopedCredentialId' | 'claustrumScopedState' | 'refresh' | 'expires' | 'lastUsed' | 'lastRefreshedAt' | 'lastRefreshError' | 'lastQuotaRefreshError' | 'quota' | 'profile' | 'prime'> & Pick<ApiKeyAccount, 'apiKey' | 'lastUsed'>>;
 export type AccountRuntimeState = {
     version: 1;
     main?: {
@@ -299,7 +294,6 @@ export type AccountStateSaveScope = {
     mainRefresh?: boolean;
     mainPrime?: boolean;
     accounts?: true | string[];
-    setClaustrumHandleAccountIds?: readonly string[];
 };
 export type AccountManagerOptions = {
     now?: () => number;
@@ -333,18 +327,12 @@ export declare function quotaSnapshotCheckedAt(quota: OAuthQuotaSnapshot | undef
 export declare function quotaFieldSource(snapshot: OAuthQuotaSnapshot | undefined, field: QuotaFieldName): QuotaFieldSource | undefined;
 export declare function mergeHeaderQuotaForPersistence(existing: OAuthQuotaSnapshot | undefined, incoming: OAuthQuotaSnapshot): OAuthQuotaSnapshot;
 export declare function getClaustrumMode(storage: AccountStorage | null): ClaustrumMode;
-export declare function isOAuthAccountVaultOwned(storage: AccountStorage | null, account: FallbackAccount, binding?: CustodyHandleResolution | undefined): boolean;
 export declare function setClaustrumModePersistent(mode: ClaustrumMode, path?: string): Promise<'changed' | 'unchanged'>;
-export declare function clearClaustrumHandlePersistent(input: {
-    id: string;
-    path?: string;
-}): Promise<'updated' | 'missing' | 'ineligible'>;
 export interface SaveAccountsOptions {
     /** Account ids intentionally removed by this mutation. */
     removedAccountIds?: readonly string[];
     /** Preserve disk order when a stale snapshot is missing newer accounts. */
     preserveExistingAccountOrder?: boolean;
-    setClaustrumHandleAccountIds?: readonly string[];
 }
 export declare function saveAccounts(storage: AccountStorage, path?: string, options?: SaveAccountsOptions): Promise<void>;
 /** Read-modify-write account configuration under the existing config/state lock order.
@@ -367,7 +355,6 @@ export declare function saveOAuthProfileState(input: {
     profile: OAuthAccountProfile | undefined;
     accountIdentity?: string;
 }, path?: string): Promise<boolean>;
-export declare function clearClaustrumRefreshErrorPersistent(accountId: string, handle: string, path?: string): Promise<boolean>;
 export declare function acquireRefreshFileLock(options: {
     name: string;
     ttlMs: number;

package/dist/cachekeep.d.ts

@@ -112,6 +112,15 @@ export declare class CacheKeepManager {
         setIntervalImpl?: typeof globalThis.setInterval;
         clearIntervalImpl?: typeof globalThis.clearInterval;
         prepareHeaders?: (headers: Headers, target: CacheKeepTarget, attempt: CacheKeepPrewarmAttempt) => Promise<Headers | undefined> | Headers | undefined;
+        /** Optionally reauthorize a replayable prewarm after a genuine 401.
+         * Return headers only for a verified newer version of the same account;
+         * onResponse observes only the final physical attempt. */
+        retryOnUnauthorized?: (input: {
+            target: CacheKeepTarget;
+            headers: Headers;
+            bodyText: string;
+            attempt: CacheKeepPrewarmAttempt;
+        }) => Promise<Headers | undefined> | Headers | undefined;
         onTrackedSessionsChanged?: (sessions: readonly CacheKeepTrackedSession[]) => Promise<void> | void;
         prepareBody?: (bodyText: string, target: CacheKeepTarget) => string | Promise<string>;
         onResponse?: (input: {

package/dist/claude-code.d.ts

@@ -14,6 +14,22 @@ export declare function resetClaudeCodeIdentityCachesForTest(): void;
  * additional bootstrap request carrying a previously authorized token. */
 export declare function getClaudeCodeIdentityForVerifiedAccount(accountIdentity: string, accountUuid: ProviderAccountUuid): ClaudeCodeIdentity;
 export declare function resolveClaudeCodeIdentity(accessToken: string, model: string | undefined, accountIdentity: string | undefined): Promise<ClaudeCodeIdentity>;
+/**
+ * The access value is not a Claude OAuth access token, so Claude cannot
+ * identify its account. Asking again will not help; only a new sign-in
+ * replaces it. The message never includes the rejected value.
+ */
+export declare class ClaudeUnsupportedAccessError extends Error {
+    readonly code = "unsupported-access";
+    constructor();
+}
+/**
+ * Account lookup for credentials that must belong to a Claude account.
+ * Unlike resolveClaudeCodeIdentity, which returns an identity without an
+ * account UUID for any other access value, this rejects such a value with
+ * ClaudeUnsupportedAccessError before any network request.
+ */
+export declare function resolveClaudeCodeAccountIdentity(accessToken: string, model: string | undefined, accountIdentity: string | undefined): Promise<ClaudeCodeIdentity>;
 export declare function buildClaudeCodeMetadataUserId(identity: ClaudeCodeIdentity): string | null;
 export declare function applyClaudeCodeMetadata(body: Record<string, unknown>, identity: ClaudeCodeIdentity): boolean;
 export declare const CLAUDE_CODE_FULL_AGENT_BETAS: readonly ['oauth-2025-04-20', 'interleaved-thinking-2025-05-14', 'thinking-token-count-2026-05-13', 'context-management-2025-06-27', 'prompt-caching-scope-2026-01-05', 'claude-code-20250219', 'advisor-tool-2026-03-01', 'advanced-tool-use-2025-11-20', 'mid-conversation-system-2026-04-07', 'effort-2025-11-24', 'fallback-credit-2026-06-01', 'extended-cache-ttl-2025-04-11', 'cache-diagnosis-2026-04-07'];

package/dist/claustrum-enrollment.d.ts

@@ -48,6 +48,8 @@ export interface ClaustrumEnrollmentPaths {
     tokenPath: string;
 }
 export declare function getClaustrumEnrollmentPaths(tokenPath: string): ClaustrumEnrollmentPaths;
+/** Resolve the independently enrolled host's owner-only token and state paths. */
+export declare function getHostClaustrumEnrollmentPaths(host: 'opencode' | 'pi', env?: NodeJS.ProcessEnv, cwd?: string): ClaustrumEnrollmentPaths;
 export declare function readClaustrumEnrollmentStatus(paths: ClaustrumEnrollmentPaths, proposedName?: string): Promise<ClaustrumEnrollmentStatus>;
 /** Read fresh bearer material for a scoped operation; never publish this value. */
 export declare function readClaustrumEnrollmentToken(tokenPath: string): Promise<EnrollmentTokenFile>;

package/dist/claustrum-scoped-roster.d.ts

@@ -1,5 +1,9 @@
 import { type AccountStorage, type OAuthAccount } from './accounts.js';
 import type { ClaustrumScopedAccount, ClaustrumScopedCustody } from './claustrum-scoped.js';
+export declare class ClaustrumRosterBusyError extends Error {
+    readonly code = "claustrum_roster_busy";
+    constructor();
+}
 export interface ClaustrumScopedRoster {
     /** The vault's conventional default record; absent when only labeled accounts exist. */
     primary?: ClaustrumScopedAccount;

package/dist/claustrum-scoped-runtime.d.ts

@@ -8,6 +8,9 @@ export interface ClaustrumScopedRuntimeOptions {
     storagePath: string;
     tokenPath: string;
     connect: () => Promise<ClaustrumScopedClient>;
+    /** Fired once per discovery change (including the initial snapshot),
+     * keyed by the inventory view digest. Repeat polls with an identical
+     * view do not notify. */
     onRoster?: (roster: ClaustrumScopedRoster) => void;
     onError?: () => void;
     setTimeoutImpl?: typeof setTimeout;

package/dist/claustrum-scoped.d.ts

@@ -15,6 +15,20 @@ export interface ClaustrumScopedAttempt extends ClaustrumScopedIdentity {
     readonly recordVersion: number;
     readonly expiresAtMs: number;
 }
+/** Only a new version of the same account may replace an in-flight 401. */
+export declare function isScopedCredentialRotation(served: ClaustrumScopedAttempt, current: ClaustrumScopedAttempt | undefined): current is ClaustrumScopedAttempt;
+/** Send classes that retry once after a scoped 401, for diagnostics. */
+export type ScopedRetrySite = 'model' | 'model-relay' | 'cachekeep' | 'prime' | 'quota-profile' | 'pi-model' | 'pi-model-relay' | 'pi-cachekeep';
+/** Why a scoped 401 did or did not retry. Never carries credential material. */
+export type ScopedRetryReason = 'rotated' | 'reauthorize-failed' | 'credential-changed' | 'account-changed' | 'version-unchanged';
+/**
+ * Decide whether a request that got a 401 should retry with the freshly
+ * re-authorized receipt, and record the decision. The vault can refresh a
+ * credential between dispatch and the 401; this line is the consumer-side
+ * half of that timeline, pairing with the vault's refresh commit instant when
+ * a stale report has to be explained. Never logs credential material.
+ */
+export declare function decideScopedRetryAfter401(site: ScopedRetrySite, served: ClaustrumScopedAttempt, current: ClaustrumScopedAttempt | undefined): current is ClaustrumScopedAttempt;
 /**
  * Shared OpenCode/Pi scoped read plane. There is intentionally no credential cache,
  * handle fallback, or get single-flight: each outgoing attempt must be authorized

package/dist/claustrum.d.ts

@@ -1,5 +1,3 @@
-import { type BindIdentity, type CatalogEntry, type CloseRouteOptions, type ManagedCallOptions, type ManagedCloseRouteOptions, type RequestOptions, type RouteHandle, type RouteOpenOptions, type RouteTarget, SubcClient, type SubscribeOptions, type Subscription } from '@cortexkit/subc-client';
-import type { ClaustrumConfig, OAuthAccount } from './accounts.ts';
 export type ClaustrumEndpoint = {
     host: string;
     port: number;
@@ -21,9 +19,6 @@ export declare const PRODUCTION_CLAUSTRUM_CONNECTION_FILE_NAME = "subc-connectio
 export declare function findExistingClaustrumConnectionPath(env?: NodeJS.ProcessEnv): string | undefined;
 export declare function getDefaultClaustrumConnectionPath(env?: NodeJS.ProcessEnv): string;
 export declare function resolveClaustrumConnectionPath(explicit?: string, env?: NodeJS.ProcessEnv): string;
-type CustodyHandlesEnvironment = Readonly<Record<string, string | undefined>>;
-export declare function resolveCustodyHandlesPath(config: Pick<ClaustrumConfig, 'handlesFile'> | undefined, env: CustodyHandlesEnvironment): string;
-export declare function getDefaultClaustrumHandlesPath(): string;
 export declare function detectClaustrumConnection(explicitPath?: string): Promise<ClaustrumDetection>;
 export declare const CUSTODY_TOMBSTONE_PREFIX = "claustrum-tombstone:v1:";
 export declare function custodyTombstoneKey(provider: string): string;
@@ -46,207 +41,3 @@ export declare class CustodyTombstoneLoginError extends Error {
     constructor(provider: string);
 }
 export declare function assertNotCustodyTombstone(refreshToken: unknown, provider: string): void;
-export type CustodyHandleAccount = {
-    label: string;
-    handle: string;
-    credentialId: string;
-};
-export type CustodyHandleManifest = {
-    version: 1;
-    provider: 'anthropic';
-    serve: 'anthropic-auth';
-    accounts: ReadonlyArray<CustodyHandleAccount>;
-    superseded: ReadonlySet<string>;
-    corruptLabels?: ReadonlySet<string>;
-};
-export type CustodyHandleResolution = {
-    status: 'resolved';
-    source: 'manifest';
-    handle: string;
-    credentialId: string;
-} | {
-    status: 'resolved';
-    source: 'legacy';
-    handle: string;
-} | {
-    status: 'unresolved';
-    reason: 'missing-label' | 'invalid-label' | 'duplicate-label' | 'missing-entry' | 'foreign-serve' | 'superseded' | 'corrupt-binding' | 'unknown-identity';
-};
-type ParsedCustodyHandleManifest = {
-    version: 1;
-    provider: string;
-    serve: string;
-    accounts: ReadonlyArray<CustodyHandleAccount>;
-    superseded: ReadonlySet<string>;
-    corruptLabels: ReadonlySet<string>;
-};
-export declare function isValidCustodyLabel(value: unknown): value is string;
-export declare function isValidCustodyHandle(value: unknown): value is string;
-export declare function custodyCredentialId(label: string): string;
-export declare function custodyCredentialIdFromResolution(resolution: CustodyHandleResolution, label: string): string;
-/**
- * | manifest state | legacy handle | result |
- * | --- | --- | --- |
- * | matching ready entry | any | manifest handle |
- * | absent or invalid | present | legacy handle |
- * | no matching ready entry | present | legacy handle |
- * | foreign serve | any | unresolved |
- * | superseded matching entry | any | unresolved |
- */
-export declare function resolveCustodyHandle(input: {
-    account: OAuthAccount;
-    manifest: CustodyHandleManifest | undefined;
-    duplicateOAuthLabels?: ReadonlySet<string>;
-}): CustodyHandleResolution;
-export declare function readCustodyHandles(json: unknown, provider: string, serve: string): ParsedCustodyHandleManifest;
-type CustodyHandleManifestReadResult = {
-    status: 'ready';
-    manifest: CustodyHandleManifest;
-} | {
-    status: 'absent';
-} | {
-    status: 'ignored';
-    reason: 'foreign-serve' | 'missing-provider';
-} | {
-    status: 'invalid';
-    reason: string;
-};
-export declare const CUSTODY_MANIFEST_SELECTION_ERROR_CODES: readonly ['foreign-serve', 'invalid-label', 'missing-provider'];
-type CustodyManifestSelectionErrorCode = (typeof CUSTODY_MANIFEST_SELECTION_ERROR_CODES)[number];
-export declare class CustodyManifestSelectionError extends Error {
-    readonly code: CustodyManifestSelectionErrorCode;
-    constructor(code: CustodyManifestSelectionErrorCode);
-}
-export declare class CustodyHandleManifestReader {
-    #private;
-    constructor(options: {
-        path: string;
-        provider: 'anthropic';
-        serve: 'anthropic-auth';
-        expectedUid?: number;
-    });
-    read(): Promise<CustodyHandleManifestReadResult>;
-}
-export type CustodyHandleManifestWriteResult = {
-    status: 'written' | 'unchanged';
-} | {
-    status: 'refused';
-    reason: string;
-    code?: CustodyManifestLockErrorCode;
-};
-export type CustodyHandleManifestRemovalResult = 'removed' | 'missing' | {
-    status: 'refused';
-    code?: CustodyManifestLockErrorCode;
-};
-export declare const CUSTODY_MANIFEST_LOCK_TTL_MS = 30000;
-export declare const CUSTODY_MANIFEST_LOCK_RENEW_MS = 10000;
-export declare const CUSTODY_MANIFEST_LOCK_RETRY_MIN_MS = 50;
-export declare const CUSTODY_MANIFEST_LOCK_RETRY_MAX_MS = 150;
-export type CustodyManifestLockTestOptions = Partial<{
-    ttlMs: number;
-    retryMinMs: number;
-    retryMaxMs: number;
-    renewalIntervalMs: number;
-    now: () => number;
-    setIntervalImpl: typeof globalThis.setInterval;
-    clearIntervalImpl: typeof globalThis.clearInterval;
-    afterStaleOwnerRead: () => void | Promise<void>;
-    beforeRename: () => void | Promise<void>;
-}>;
-export declare function __setCustodyManifestLockTestOptions(options?: CustodyManifestLockTestOptions): void;
-export declare const CUSTODY_MANIFEST_LOCK_ERROR_CODES: readonly ['lock_busy', 'owner_invalid', 'renewal_failed'];
-export type CustodyManifestLockErrorCode = (typeof CUSTODY_MANIFEST_LOCK_ERROR_CODES)[number];
-export declare class CustodyManifestLockError extends Error {
-    readonly code: CustodyManifestLockErrorCode;
-    constructor(message: string, code: CustodyManifestLockErrorCode);
-}
-export declare class CustodyManifestLockBusyError extends CustodyManifestLockError {
-    constructor(message: string);
-}
-export declare class CustodyManifestLockOwnerInvalidError extends CustodyManifestLockError {
-    constructor(message: string);
-}
-export declare class CustodyManifestLockLeaseLostError extends CustodyManifestLockError {
-    constructor(message: string);
-}
-export declare function __deriveCustodyManifestStaleLockPrefix(lockPath: string, pathBasename: (path: string) => string): string;
-export declare function withCustodyManifestLock<T>(path: string, fn: (assertLease: () => Promise<void>, nonce: string) => Promise<T>): Promise<T>;
-type CustodyHandleManifestWriteInput = {
-    path: string;
-    entry: CustodyHandleAccount;
-    expectedUid?: number;
-};
-export declare function writeCustodyHandleManifestEntry(input: CustodyHandleManifestWriteInput): Promise<CustodyHandleManifestWriteResult>;
-export declare function removeCustodyHandleManifestEntry(input: CustodyHandleManifestWriteInput): Promise<CustodyHandleManifestRemovalResult>;
-export declare function writeCustodyHandleManifestEntryLocked(input: CustodyHandleManifestWriteInput, assertLease: () => Promise<void>, lockNonce: string): Promise<CustodyHandleManifestWriteResult>;
-export type ClaustrumClientOptions = {
-    connectionFile?: string;
-    handshakeTimeoutMs?: number;
-    connector?: ClaustrumConnector;
-};
-export type ClaustrumConnector = (options: {
-    connectionFile: string;
-    handshakeTimeoutMs?: number;
-}) => Promise<SubcClient>;
-export declare class ClaustrumClient {
-    #private;
-    private constructor();
-    static connect(options?: ClaustrumClientOptions): Promise<ClaustrumClient>;
-    catalogList(moduleId?: string): Promise<CatalogEntry[]>;
-    routeOpen(target: RouteTarget, identity: BindIdentity, options?: Omit<RouteOpenOptions, 'consumerIdentity'>): Promise<RouteHandle>;
-    request(handle: RouteHandle, body: unknown, options?: RequestOptions): Promise<unknown>;
-    call<Response = unknown>(moduleId: string, method: string, params?: unknown, options?: Omit<ManagedCallOptions, 'consumerIdentity'>): Promise<Response>;
-    subscribe(handle: RouteHandle, body: unknown, onEvent: (event: Uint8Array) => void, options?: SubscribeOptions): Subscription;
-    closeRoute(handle: RouteHandle, options?: CloseRouteOptions): Promise<void>;
-    closeManagedRoute(target: Extract<RouteTarget, {
-        kind: 'management_surface' | 'tool_provider';
-    }>, identity: BindIdentity, options?: Omit<ManagedCloseRouteOptions, 'consumerIdentity'>): Promise<void>;
-    close(): void;
-}
-export declare function connectClaustrumClient(options?: ClaustrumClientOptions): Promise<ClaustrumClient>;
-export declare const CLAUSTRUM_MODULE_ID = "claustrum";
-export declare const DEFAULT_CLAUSTRUM_CREDENTIAL_MIN_TTL_MS = 120000;
-export declare const ERROR_CLASS_WIRE_SET: readonly ['transient', 'permanent', 'auth_required', 'context_overflow'];
-export type ClaustrumCredentialErrorClass = (typeof ERROR_CLASS_WIRE_SET)[number];
-export type ClaustrumCredentialErrorAction = 'gone' | 'reauth' | 'retry' | 'reduce_and_retry';
-export type ClaustrumCredential = {
-    payload: string;
-    expiresAtMs: number | null;
-    recordVersion: number;
-    projectId?: string;
-    accountId?: string;
-    credentialId?: string;
-};
-export type ClaustrumServedCredential = Pick<ClaustrumCredential, 'recordVersion'>;
-export type ClaustrumReporterSource = 'direct' | 'relay_status_field' | 'relay_message_parse';
-export declare class ClaustrumCredentialError extends Error {
-    readonly code: string;
-    readonly action: ClaustrumCredentialErrorAction;
-    readonly errorClass: ClaustrumCredentialErrorClass;
-    constructor(message: string, code: string, errorClass: ClaustrumCredentialErrorClass, action: ClaustrumCredentialErrorAction);
-}
-export type ClaustrumCredentialCacheOptions = {
-    identity?: BindIdentity;
-    now?: () => number;
-    minTtlMs?: number;
-};
-export declare class ClaustrumCredentialCache {
-    #private;
-    constructor(client: ClaustrumClient, options?: ClaustrumCredentialCacheOptions);
-    get(handle: string, minTtlMs?: number, options?: {
-        cacheIf?: () => boolean;
-    }): Promise<ClaustrumCredential>;
-    peek(handle: string): ClaustrumCredential | undefined;
-    abandonPending(handle: string): void;
-    seedForTest(handle: string, credential: ClaustrumCredential): void;
-    reduceMinTtlMs(): number;
-    reportAuthFailure(handle: string, providerStatus: number, servedCredential: ClaustrumServedCredential, reporterSource?: ClaustrumReporterSource): Promise<void>;
-    reportAuthFailure(handle: string, servedCredential: ClaustrumServedCredential, providerStatus?: number, reporterSource?: ClaustrumReporterSource): Promise<void>;
-    invalidate(handle: string, recordVersion?: number): void;
-    close(): void;
-}
-export type ConnectClaustrumCredentialCacheOptions = ClaustrumClientOptions & ClaustrumCredentialCacheOptions & {
-    enabled?: boolean;
-};
-export declare function connectClaustrumCredentialCache(options?: ConnectClaustrumCredentialCacheOptions): Promise<ClaustrumCredentialCache | null>;
-export {};

package/dist/commands/account.d.ts

@@ -1,5 +1,5 @@
-import type { AccountStorage, ClaustrumMode, FallbackAccount } from '../accounts.ts';
-import type { ClaustrumDetection, CustodyHandleResolution } from '../claustrum.ts';
+import type { AccountStorage, ClaustrumMode } from '../accounts.ts';
+import type { ClaustrumDetection } from '../claustrum.ts';
 import type { ClaustrumEnrollmentStatus } from '../claustrum-enrollment.ts';
 export declare const CLAUDE_ACCOUNT_COMMAND_NAME = "claude-account";
 export type AccountCommandAction = {
@@ -82,7 +82,6 @@ export declare function executeAccountCommand(input: {
     storage: AccountStorage;
     claustrum?: ClaustrumDetection;
     statusProjection?: AccountCommandStatusProjection;
-    resolveCustodyBinding?: (account: FallbackAccount) => CustodyHandleResolution;
     path?: string;
     transition?: ClaustrumModeTransition;
     resetEnrollment?: () => Promise<AccountCommandResult>;

package/dist/index.d.ts

@@ -7,7 +7,6 @@ export * from './cch.ts';
 export * from './claude-code.ts';
 export * from './claustrum.ts';
 export * from './claustrum-enrollment.ts';
-export * from './claustrum-enrollment-registry.ts';
 export * from './claustrum-scoped.ts';
 export * from './claustrum-scoped-roster.ts';
 export * from './claustrum-scoped-runtime.ts';
@@ -23,16 +22,60 @@ export * from './logging.ts';
 export * from './mid-conversation-output-config.ts';
 export * from './model-remap.ts';
 export * from './models.ts';
+export type { NativeAccountRuntime, NativeAccountRuntimeOptions, NativeAccountWriteInput, NativeApiSubject, NativeLocalAuthorizeOptions, NativeRelayUpdate, } from './native-account-runtime.ts';
+export { acquireNativeAccountRuntime, createNativeAccountRuntime, nativeAccountPolicy, } from './native-account-runtime.ts';
+export type { NativeAccountMetadataPatch, NativeAccountSnapshot, NativeAccountView, } from './native-account-view.ts';
+export { formatNativeAccountState } from './native-account-view.ts';
+export * from './native-credential-validation.ts';
+export type { NativeCustody, NativeCustodyClient, NativeCustodyErrorCode, NativeCustodyIdentity, NativeCustodyInventory, NativeCustodyLogger, NativeCustodyOptions, NativeCustodyReceipt, NativeCustodyReporterSource, NativeCustodyRetry, } from './native-custody.ts';
+export { createNativeCustody, NativeCustodyError } from './native-custody.ts';
+export type { NativeCustodyActivationErrorCode, NativeCustodyActivationHooks, NativeCustodyActivationOptions, NativeCustodyActivationResult, } from './native-custody-activation.ts';
+export { NativeCustodyActivationError, runNativeCustodyActivation, } from './native-custody-activation.ts';
+export { readNativeEnrollmentMode } from './native-enrollment-authority.ts';
+export { inspectNativeHostAuthEntry, NativeHostAuthError, requireNoSupervisedAuthContentSnapshot, } from './native-host-auth.ts';
+export { readNativeHostAuthKind } from './native-host-auth-read.ts';
+export type { NativeLocalAttributedFailure, NativeLocalCredentialService, NativeLocalCredentialServiceOptions, NativeLocalFailurePolicyInput, } from './native-local-credential-service.ts';
+export { createNativeLocalCredentialService } from './native-local-credential-service.ts';
+export type { NativeLocalExternalPolicy } from './native-local-runtime-readers.ts';
+export type { NativeMenuActionValues, NativeMenuCapabilityOutcome, NativeMenuDispatch, NativeMenuDispatchActionId, NativeMenuDispatchOptions, NativeMenuDispatchRequest, NativeMenuDispatchValues, NativeMenuExecutionContext, NativeMenuExecutionResult, NativeMenuExecutor, NativeMenuExecutorOptions, NativeMenuExecutorRefusalCode, NativeMenuKillswitchEntry, NativeMenuNoValues, NativeMenuRequest, NativeMenuSessionActionId, } from './native-menu-executor.ts';
+export { createNativeMenuExecutor } from './native-menu-executor.ts';
+export type { NativeMenuAction, NativeMenuActionId, NativeMenuCacheMode, NativeMenuChoiceParameter, NativeMenuCommandId, NativeMenuCustodyMode, NativeMenuGroup, NativeMenuGroupId, NativeMenuHost, NativeMenuLogLevel, NativeMenuModel, NativeMenuParameter, NativeMenuParameterId, NativeMenuRefusalCode, NativeMenuRoutingMode, NativeMenuStatus, } from './native-menu-model.ts';
+export { getNativeMenuModel } from './native-menu-model.ts';
+export type { NativeMigrationCustody, NativeMigrationHooks, NativeMigrationOptions, NativeMigrationPreflight, } from './native-migration.ts';
+export { NativeMigrationError, prepareNativeMigration, releaseNativeMigrationPreflight, runNativeMigration, } from './native-migration.ts';
+export type { NativeCommittedMaterial, NativeIdentityBootstrap, NativeRefreshContext, NativeRefreshDispatchVersion, NativeRefreshFailure, NativeRefreshHandoff, NativeRefreshObservation, NativeRefreshRequest, NativeRefreshRestriction, NativeRefreshResult, NativeRefreshSubject, NativeServingAdmission, } from './native-refresh-coordinator.ts';
+export type { NativeLocalFailureAttribution, NativeLocalFailurePolicy, NativeLocalFailureSkipReason, } from './native-runtime.ts';
+export { nativeRuntimeOptionIdentity } from './native-runtime-registry.ts';
+export { isNativeTransientAccountError, NativeTransientAccountError, } from './native-transient-account.ts';
+export type { CommandApplyRequest, CommandApplyResult, CommandDialogPayload, CommandInvocation, CommandMenu, CommandMenuModel, KnobValue, KnobValues, MenuAction, MenuItem, MenuKnob, MenuSection, NativeUiOptions, NotifyKind, SectionSlot, } from './native-ui.ts';
+export { createNativeUi, parseApplyRequest, runPiCommandMenu, } from './native-ui.ts';
+export * from './native-usage-publication.ts';
+export { NATIVE_VAULT_NO_ACCOUNT_MESSAGE, NativeVaultNoAccountError, readNativeAccountsForRequest, } from './native-vault-admission.ts';
+export type { NativePiAuthSlot, NativePiAuthSlotErrorCode, NativePiAuthSlotInspection, NativePiAuthSlotOptions, NativeVaultDisconnectOptions, NativeVaultDisconnectResult, } from './native-vault-connection.ts';
+export { disconnectNativeVaultForHost, NativePiAuthSlotError, nativePiAuthSlotPaths, openNativePiAuthSlot, } from './native-vault-connection.ts';
+export type { NativeVaultRuntime, NativeVaultRuntimeOptions, NativeVaultWatch, NativeVaultWatchOptions, } from './native-vault-runtime.ts';
+export { acquireNativeVaultRuntime, createNativeVaultRuntime, discoverNativeVaultInventory, publishNativeVaultRosterSeed, publishNativeVaultRuntimeSeed, } from './native-vault-runtime.ts';
 export * from './oauth-profile.ts';
 export * from './pkce.ts';
+export type { NativeMigrationJournal } from './pool-authority.ts';
+export { nativeMigrationAuthorityPhase, readNativeMigrationJournal, } from './pool-authority.ts';
+export type { NativeLocalPoolBinding } from './pool-binding.ts';
+export { captureNativeLocalPoolBinding } from './pool-binding.ts';
+export * from './pool-paths.ts';
+export * from './pool-store.ts';
 export * from './prime.ts';
 export * from './provider.ts';
+export type { ProviderErrorRedactor, ProviderErrorResponseScope, ProviderResponseMode, ProviderResponseSettlement, } from './provider-error.ts';
+export { createProviderErrorRedactor, createProviderErrorResponseScope, } from './provider-error.ts';
 export * from './quota-header-feed.ts';
 export * from './quota-headers.ts';
 export * from './quota-manager.ts';
 export * from './quotas.ts';
 export * from './relay.ts';
+export * from './request-history.ts';
 export * from './routing.ts';
+export type { SseEvent, SseFramer, SseFramerOptions } from './sse.ts';
+export { createSseFramer, DEFAULT_SSE_MAX_FRAME_BYTES, decodeSseFrame, isSseCandidateFrame, isTerminatedSseFrame, parseSseFrame, SseFrameTooLargeError, } from './sse.ts';
 export * from './start.ts';
 export * from './sticky-routing.ts';
 export * from './thinking-binding.ts';