@cortexkit/anthropic-auth-core 1.23.0 → 2.0.0

package/dist/native-ui.d.ts

@@ -0,0 +1,45 @@
+import { type CommandInvocation, type CommandMenu } from "./internal-types/commands/index.js";
+export type { CommandApplyRequest, CommandApplyResult, CommandDialogPayload, CommandInvocation, CommandMenu, CommandMenuModel, KnobValue, KnobValues, MenuAction, MenuItem, MenuKnob, MenuSection, NotifyKind, SectionSlot, } from "./internal-types/commands/index.js";
+export { parseApplyRequest, runPiCommandMenu, } from "./internal-types/commands/index.js";
+import { type NativeMenuDispatch, type NativeVaultDisconnect } from './native-menu-executor.ts';
+import { type NativeMenuCommandId, type NativeMenuCustodyMode, type NativeMenuHost } from './native-menu-model.ts';
+export interface NativeUiOptions {
+    readonly host: NativeMenuHost;
+    /** Execute account/settings changes and host actions; this adapter never writes their storage. */
+    readonly dispatch: NativeMenuDispatch;
+    /** Read-only account, quota and settings status. Exclude OAuth tokens, API keys and other secrets. */
+    readonly readStatus: (command: Exclude<NativeMenuCommandId, 'start'>, invocation: CommandInvocation) => Promise<string>;
+    /**
+     * Reads the host's current credential custody from its enrollment record,
+     * never from status text. It is called each time the menu opens or applies
+     * an action, so connecting or disconnecting the vault takes effect without
+     * rebuilding the menu. Under 'claustrum' the menu leaves out and refuses
+     * actions offered only under local custody: host-local account and
+     * credential writes, and enrollment reset. A rejection or any other value
+     * is treated as unknown custody, which also withholds them.
+     */
+    readonly readMode: () => Promise<NativeMenuCustodyMode>;
+    /** Token-free account names, credential IDs and states used to show which vault account needs re-login and its replacement command. */
+    readonly readAccounts?: () => Promise<import('./native-account-view.ts').NativeAccountSnapshot>;
+    /**
+     * Disconnects this host from the vault; while enrolled, this is the host's
+     * only enrollment action. Before ending the enrollment, the callback
+     * restores any host sign-in set aside when the host joined the vault. If
+     * that restore would overwrite a sign-in the host already has, the callback
+     * reports `conflict` and leaves the enrollment in place. Every host must
+     * supply it: a host enrolled in the vault, or with an unreadable
+     * enrollment, always needs a way back to local accounts.
+     */
+    readonly disconnectVault: NativeVaultDisconnect;
+    /** The host sets this flag; RPC callers cannot declare themselves interactive. */
+    readonly interactive: boolean;
+}
+/**
+ * Builds the Claude menu from the supported commands for OpenCode or Pi.
+ * Shared renderers display it, but each submitted action still goes through
+ * input validation, required confirmation and host capability checks.
+ * Credential fields never contain saved values. Current host input controls
+ * display typed text even when the field requests masking; do not promise
+ * hidden entry until those controls support it.
+ */
+export declare function createNativeUi(options: NativeUiOptions): CommandMenu;

package/dist/native-usage-publication.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Custody, ownership and integrity refusals need an ERROR diagnostic; ordinary
+ * storage failures need a WARN. Neither may revoke an already-served reply.
+ * The error classes are not public runtime exports, so match name and code.
+ */
+export declare function usagePublicationRefusalIsFatal(error: unknown): boolean;
+/** Own advisory writes for one host instance and join them before runtime close. */
+export declare function createNativeUsagePublisher(channel: string): {
+    publish(write: () => Promise<unknown>): void;
+    drain(): Promise<void>;
+};

package/dist/native-vault-admission.d.ts

@@ -0,0 +1,8 @@
+import type { NativeAccountRuntime } from './native-account-runtime.ts';
+import type { NativeAccountSnapshot } from './native-account-view.ts';
+export declare const NATIVE_VAULT_NO_ACCOUNT_MESSAGE = "No vault account can serve this request. Open /claude to see which account needs signing in again.";
+export declare class NativeVaultNoAccountError extends Error {
+    constructor();
+}
+/** A missing roster may be discovery still in progress, not an empty pool. */
+export declare function readNativeAccountsForRequest(runtime: NativeAccountRuntime, signal?: AbortSignal): Promise<NativeAccountSnapshot>;

package/dist/native-vault-connection.d.ts

@@ -0,0 +1,33 @@
+import { type PiSlot } from "./internal-types/pi-slot/index.js";
+export type { PiSlot as NativePiAuthSlot, PiSlotErrorCode as NativePiAuthSlotErrorCode, PiSlotInspection as NativePiAuthSlotInspection, } from "./internal-types/pi-slot/index.js";
+export { PiSlotError as NativePiAuthSlotError } from "./internal-types/pi-slot/index.js";
+export interface NativePiAuthSlotOptions {
+    /** The Pi adapter supplies its SDK-owned auth path; enrollment paths do not identify that file. */
+    authPath: string;
+    env?: NodeJS.ProcessEnv;
+}
+/** Setup and disconnect must use the same host auth file, private stash and inert API-key marker. */
+export declare function nativePiAuthSlotPaths(options: NativePiAuthSlotOptions): {
+    authPath: string;
+    stashPath: string;
+    provider: string;
+    placeholderKey: string;
+};
+/** Delegate private Pi-auth preservation to the shared locked writer; never create a second host-slot writer. */
+export declare function openNativePiAuthSlot(options: NativePiAuthSlotOptions): PiSlot;
+export type NativeVaultDisconnectOptions = {
+    host: 'opencode';
+    env?: NodeJS.ProcessEnv;
+} | {
+    host: 'pi';
+    env?: NodeJS.ProcessEnv;
+    slot: Pick<PiSlot, 'exitVault'>;
+};
+export type NativeVaultDisconnectResult = 'disconnected' | 'idle' | 'busy' | 'conflict';
+/**
+ * Restore Pi's stored authentication before removing this host's enrollment.
+ * A conflicting replacement belongs to the user: leave both it and enrollment
+ * intact rather than selecting local custody with unresolved recovery data.
+ * OpenCode authentication is never changed by this operation.
+ */
+export declare function disconnectNativeVaultForHost(options: NativeVaultDisconnectOptions): Promise<NativeVaultDisconnectResult>;

package/dist/native-vault-paths.d.ts

@@ -0,0 +1,13 @@
+import type { NativePoolPaths } from './pool-paths.ts';
+/** Vault files have no migration journal: enrollment alone authorizes their use. */
+export interface NativeVaultPaths {
+    config: string;
+    state: string;
+    runtime: string;
+    roster: string;
+    routing: string;
+    storageId: string;
+    legacySeedConfig: string;
+}
+/** Keep vault settings, metadata and affinity outside every local recovery file. */
+export declare function nativeVaultPaths(local: NativePoolPaths): NativeVaultPaths;

package/dist/native-vault-runtime.d.ts

@@ -0,0 +1,102 @@
+import { type ClaustrumClientOptions } from '@cortexkit/claustrum-client';
+import { type OAuthAccountProfile, type OAuthQuotaSnapshot, type PrimeUsageDelta } from './accounts.ts';
+import { type NativeAccountMetadataPatch } from './native-account-view.ts';
+import { type NativeCustodyClient, type NativeCustodyInventory, type NativeCustodyReceipt, type NativeCustodyReporterSource, type NativeCustodyRetry } from './native-custody.ts';
+import { type NativeRosterSeedInput, type NativeVaultRosterDocument, type NativeVaultRosterSeed } from './native-roster-seed.ts';
+import { type NativeRuntimeState } from './native-runtime.ts';
+import type { NativeVaultPaths } from './native-vault-paths.ts';
+import type { NativePoolPaths } from './pool-paths.ts';
+import type { QuotaRequestDispatch } from './quota-manager.ts';
+export interface NativeVaultRuntimeOptions {
+    paths: NativePoolPaths;
+    host: 'opencode' | 'pi';
+    identity?: ClaustrumClientOptions['identity'];
+    connect?: () => Promise<NativeCustodyClient>;
+    /** Reuse the inventory verifier supplied by offline setup without changing per-send scoped authorization. */
+    discover?: () => Promise<NativeCustodyInventory>;
+    readToken?: () => Promise<{
+        token: string;
+        token_generation: number;
+    }>;
+    env?: NodeJS.ProcessEnv;
+    now?: () => number;
+}
+export interface NativeVaultWatchOptions {
+    intervalMs: number;
+    onRefresh?: () => void | Promise<void>;
+    shouldRefresh?: () => boolean | Promise<boolean>;
+    setInterval?: typeof globalThis.setInterval;
+    clearInterval?: typeof globalThis.clearInterval;
+}
+export interface NativeVaultWatch {
+    readonly ready: Promise<void>;
+    close(): void;
+}
+/** Send classes that may replay once after a vault credential's 401, named in diagnostics. */
+export type NativeScoped401Site = 'model' | 'model-relay' | 'cachekeep' | 'prime' | 'quota-profile';
+export type NativeProfilePersistence = 'saved' | 'refused' | 'failed';
+/** The profile fields a display may receive; never the legacy token fingerprint. */
+export type NativeDisplayProfileMetadata = Pick<OAuthAccountProfile, 'tier' | 'orgType' | 'checkedAt' | 'accountIdentity' | 'providerAccountUuid'>;
+/**
+ * A fetched account tier for immediate display. `profile` contains metadata
+ * only, never tokens or authorization receipts. `persisted` reports whether
+ * the write succeeded, was refused because credentials or lock ownership
+ * changed, or failed because storage was unavailable. It never rejects.
+ * Call isCurrent before displaying the tier, including after a storage failure.
+ */
+export interface NativeDisplayProfile {
+    profile: NativeDisplayProfileMetadata;
+    persisted: Promise<NativeProfilePersistence>;
+    /** Check the same account and token or vault record version, without fetching credentials. */
+    isCurrent(): Promise<boolean>;
+}
+/** Build a NativeDisplayProfile from a validated profile and its publication. */
+export declare function nativeDisplayProfile(profile: OAuthAccountProfile, publish: () => Promise<boolean>, isCurrent: () => Promise<boolean>): NativeDisplayProfile;
+export interface NativeVaultRuntime {
+    /** Subscribe to one discovery loop; notifications contain no credential material. */
+    watch(options: NativeVaultWatchOptions): NativeVaultWatch;
+    initializeSettings(): Promise<void>;
+    read(): Promise<NativeVaultRosterDocument | undefined>;
+    refresh(signal?: AbortSignal): Promise<NativeVaultRosterDocument | undefined>;
+    authorize(routeId: string, signal?: AbortSignal): Promise<NativeCustodyReceipt>;
+    reportFailure(receipt: NativeCustodyReceipt, status: number, source: NativeCustodyReporterSource): Promise<void>;
+    /**
+     * After a 401, acquire a fresh receipt for the same credential and account.
+     * Permit one replay only if its recordVersion exceeds the rejected receipt's
+     * version. The optional site is a diagnostic call-site label: model requests,
+     * quota, profile or cache warming. Logs contain versions, never credentials.
+     * The caller reports only the receipt rejected by its final HTTP attempt.
+     */
+    prepareRetry(receipt: NativeCustodyReceipt, signal?: AbortSignal, site?: NativeScoped401Site): Promise<NativeCustodyRetry>;
+    publish(receipt: NativeCustodyReceipt, patch: NativeAccountMetadataPatch): Promise<boolean>;
+    fetchQuota(routeId: string, fetchImpl?: typeof fetch, signal?: AbortSignal, dispatch?: QuotaRequestDispatch): Promise<OAuthQuotaSnapshot>;
+    fetchProfile(routeId: string, fetchImpl?: typeof fetch, signal?: AbortSignal): Promise<OAuthAccountProfile>;
+    /** Return the fetched account profile without waiting for its metadata write. NativeDisplayProfile.persisted reports whether that asynchronous write succeeded, failed or was refused. */
+    fetchProfileForDisplay(routeId: string, fetchImpl?: typeof fetch, signal?: AbortSignal): Promise<NativeDisplayProfile>;
+    /**
+     * Accept or decline a vault route for the user. Resolves to whether the
+     * route's enabled flag changed, judged on the roster under its write lock.
+     */
+    setEnabled(routeId: string, enabled: boolean): Promise<boolean>;
+    resetBackoff(receipt: NativeCustodyReceipt, kind?: 'refresh' | 'quota' | 'all'): Promise<boolean>;
+    getOrCreateAuthLineage(receipt: NativeCustodyReceipt): Promise<string | undefined>;
+    incrementPrimeUsage(receipt: NativeCustodyReceipt, delta?: PrimeUsageDelta): Promise<boolean>;
+    close(): void;
+}
+/** Publish the initial roster from validated account inventory. A caller importing captured state must fence that state through assertOwned, which runs again at the roster's actual publication. */
+export declare function publishNativeVaultRosterSeed(paths: Pick<NativeVaultPaths, 'roster'>, input: NativeRosterSeedInput, options?: {
+    assertOwned?: () => Promise<void>;
+}): Promise<NativeVaultRosterSeed>;
+/** Match imported metadata to the held vault roster before publishing it. The caller's assertOwned fences its captured input; the roster lease separately prevents account replacement during the metadata write. */
+export declare function publishNativeVaultRuntimeSeed(paths: Pick<NativeVaultPaths, 'roster' | 'runtime' | 'storageId'>, state: NativeRuntimeState, options?: {
+    assertOwned?: () => Promise<void>;
+}): Promise<void>;
+/** List accounts readable by this host's enrollment for offline setup. An inventory grants no bearer authority; every outbound request still needs a fresh scoped receipt. */
+export declare function discoverNativeVaultInventory(options: NativeVaultRuntimeOptions, signal?: AbortSignal): Promise<NativeCustodyInventory>;
+/** Retain the vault client's original per-attempt receipts and version provenance; access tokens never persist in roster or runtime metadata. */
+export declare function createNativeVaultRuntime(options: NativeVaultRuntimeOptions): NativeVaultRuntime;
+export declare function nativeVaultRuntimeKey(options: NativeVaultRuntimeOptions): string;
+/** Each handle owns one reference; disposing it cannot close another host session. */
+export declare function acquireNativeVaultRuntime(options: NativeVaultRuntimeOptions): NativeVaultRuntime;
+/** Each account lease wraps the shared vault runtime and tracks its own subscriptions, so releasing the lease removes those subscriptions. */
+export declare function leaseNativeVaultRuntime(use: () => NativeVaultRuntime, close: () => void): NativeVaultRuntime;

package/dist/native-vault-seed.d.ts

@@ -0,0 +1,16 @@
+import type { NativeVaultRosterDocument } from './native-roster-seed.ts';
+export interface NativeVaultRoutingSeed {
+    legacyConfig: string;
+    roster: string;
+    mainRouteId?: string;
+}
+/** Missing or invalid legacy JSON skips the import rather than blocking vault requests. */
+export declare function readNativeVaultLegacyJson(path: string): Promise<unknown>;
+export declare function nativeVaultFileAbsent(path: string): Promise<boolean>;
+/** Validate only preference fields, excluding credentials, account rows and stored account observations. */
+export declare function readNativeVaultLegacySettings(path: string): Promise<Record<string, unknown>>;
+/** Match public legacy IDs to verified vault UUIDs, never to labels, credential handles or row order. */
+export declare function nativeVaultLegacyRoutes(source: unknown, roster: NativeVaultRosterDocument): Map<string, {
+    routeId: string;
+    accountIdentity: string;
+}>;

package/dist/pool-authority.d.ts

@@ -0,0 +1,159 @@
+import { type NativeMigrationPreparedProof } from './native-migration-proof.ts';
+import type { NativePoolPaths } from './pool-paths.ts';
+declare const PHASES: readonly ['building', 'verified', 'activation-installed', 'committed', 'retired'];
+export type NativeMigrationPhase = (typeof PHASES)[number];
+export interface NativeMigrationSources {
+    config: string | null;
+    state: string | null;
+    /** SHA-256 of the host's anthropic entry with sorted JSON object keys; other providers are excluded. */
+    hostAuth: string;
+    routing: string | null;
+}
+export interface NativeMigrationRoutingPaths {
+    source: string;
+    destination: string;
+}
+export interface NativeMigrationInput {
+    host: 'opencode' | 'pi';
+    sources: NativeMigrationSources;
+    routingPaths: NativeMigrationRoutingPaths;
+    hostAuthPath: string;
+    /**
+     * Request vault custody during the first credential migration. The journal
+     * keeps native serving blocked until the separate vault activation commits.
+     */
+    activation?: 'requested';
+}
+export interface NativeMigrationExpectations {
+    expectedHostAuth: string;
+    expectedRouting: string | null;
+    preparedProof: NativeMigrationPreparedProof;
+}
+/** Public account metadata recorded for the planned switch to vault custody. */
+export interface NativeCustodyActivationRosterRow {
+    routeId: string;
+    credentialId: string;
+    credentialType: 'oauth';
+    accountIdentity: string;
+    state: string;
+    label: string;
+    enabled: boolean;
+    addedAt: number;
+}
+/** The validated vault account list that activation publishes or reuses unchanged. */
+export interface NativeCustodyActivationRoster {
+    version: 1;
+    view: string;
+    complete: true;
+    rows: NativeCustodyActivationRosterRow[];
+    declined: {
+        credentialId: string;
+        accountIdentity?: string;
+    }[];
+}
+export type NativeCustodyActivationPhase = 'prepared' | 'published' | 'committed';
+/**
+ * The offline switch of a migrated pool from local to vault custody. Every
+ * field is fixed when the activation is prepared, so a resumed run checks the
+ * files against these values and never against what it finds on disk later.
+ * Holds no credential: only public descriptor digests and vault ids.
+ */
+export interface NativeCustodyActivationPlan {
+    kind: 'activation';
+    phase: NativeCustodyActivationPhase;
+    /** The vault's designated primary login, bound to the pool's main route. */
+    primary: {
+        routeId: string;
+        credentialId: string;
+        accountIdentity: string;
+    };
+    roster: NativeCustodyActivationRoster;
+    /**
+     * Every credential row captured before this custody switch, including local
+     * OAuth and API-key accounts, with a digest of the imported runtime state.
+     */
+    localProof: NativeMigrationPreparedProof;
+    /**
+     * IDs of local OAuth credential rows to remove. Keep every other row
+     * recorded in localProof.
+     */
+    removeIds: string[];
+    /** Digests of the canonical pool settings before and after the mode switch. */
+    settings: {
+        source: string;
+        target: string;
+    };
+    /** Digests of the canonical native runtime state before and after rebinding. */
+    runtime: {
+        source: string;
+        target: string;
+    };
+    /** Anthropic host-auth entry digests (or 'absent') before and after activation. */
+    hostAuth: {
+        source: string;
+        expected: string;
+    };
+}
+export type NativeCustodyActivation = {
+    kind: 'requested';
+} | NativeCustodyActivationPlan;
+export interface NativeMigrationJournal {
+    version: 4;
+    storageId: string;
+    host: 'opencode' | 'pi';
+    phase: NativeMigrationPhase;
+    sources: NativeMigrationSources;
+    routingPaths: NativeMigrationRoutingPaths;
+    hostAuthPath: string;
+    expectedHostAuth: string;
+    expectedRouting: string | null;
+    preparedProof: NativeMigrationPreparedProof | null;
+    /**
+     * Null unless the offline setup command requested or began switching
+     * credential authority to Claustrum.
+     */
+    activation: NativeCustodyActivation | null;
+}
+export declare class NativeAuthorityError extends Error {
+    readonly code: 'migration-required' | 'migration-incomplete' | 'invalid-journal' | 'journal-conflict';
+    constructor(code: 'migration-required' | 'migration-incomplete' | 'invalid-journal' | 'journal-conflict');
+}
+export declare function readNativeMigrationJournal(paths: NativePoolPaths): Promise<NativeMigrationJournal | undefined>;
+/**
+ * The migration phase that authorizes serving, or undefined while the
+ * migration or a requested switch to vault custody is unfinished. Every reader
+ * that admits requests from the journal uses this one predicate.
+ */
+export declare function nativeMigrationAuthorityPhase(journal: NativeMigrationJournal | undefined): 'committed' | 'retired' | undefined;
+/** An empty or readable store is not proof that the offline authority flip completed. */
+export declare function requireNativePoolAuthority(paths: NativePoolPaths): Promise<void>;
+interface JournalHooks {
+    /** Outer controller and pool leases remain held through the atomic journal rename. */
+    assertOwned?: () => Promise<void>;
+    lockOptions?: {
+        ttlMs: number;
+        timeoutMs: number;
+    };
+    onWriteStep?: (step: 'before-write' | 'after-write', journal: NativeMigrationJournal) => Promise<void>;
+}
+/** Migration resume retains the original digests and resolved paths so a retry cannot adopt changed inputs or redirect writes. */
+export declare function beginNativeMigration(paths: NativePoolPaths, input: NativeMigrationInput, hooks?: JournalHooks): Promise<NativeMigrationJournal>;
+/** Save the expected host-auth entry and routing digests together before changing files, so recovery can recognize completed writes. */
+export declare function recordNativeMigrationExpectations(paths: NativePoolPaths, expectations: NativeMigrationExpectations, hooks?: JournalHooks): Promise<NativeMigrationJournal>;
+/**
+ * Advance one phase at a time. A retry of the same transition returns the journal.
+ * Before recording activation, the caller must compare the host's Anthropic auth
+ * entry and routing file with the saved expected values. This journal records the
+ * migration stage; it does not read or verify those files.
+ */
+export declare function advanceNativeMigration(paths: NativePoolPaths, expected: NativeMigrationPhase, next: NativeMigrationPhase, hooks?: JournalHooks): Promise<NativeMigrationJournal>;
+/**
+ * Record the prepared switch to vault custody on a retired migration. From
+ * this write until the activation commits, the pool authorizes no serving.
+ * Retrying with the identical plan returns the journal; any other plan is a
+ * conflict, so a resumed setup can never replace what it recorded.
+ */
+export declare function recordNativeCustodyActivation(paths: NativePoolPaths, plan: NativeCustodyActivationPlan, hooks?: JournalHooks): Promise<NativeMigrationJournal>;
+/** Advance a recorded activation one phase; never backwards or across a phase. */
+export declare function advanceNativeCustodyActivation(paths: NativePoolPaths, expected: NativeCustodyActivationPhase, next: NativeCustodyActivationPhase, hooks?: JournalHooks): Promise<NativeMigrationJournal>;
+export {};

package/dist/pool-binding.d.ts

@@ -0,0 +1,32 @@
+import type { NativePoolPaths } from './pool-paths.ts';
+export interface NativeLocalPoolBinding {
+    readonly kind: 'local';
+    readonly storageId: string;
+    readonly rowId: string;
+    readonly credentialEpoch: number;
+    readonly identity?: string;
+}
+interface BindingSourceRow {
+    id: string;
+    identity?: string;
+    credentialEpoch?: number;
+    candidate: boolean;
+    stamp?: string;
+    invalid?: string;
+    torn?: boolean;
+    unbound?: boolean;
+}
+export declare class NativePoolBindingError extends Error {
+    constructor();
+}
+export declare function isNativeLocalPoolBinding(value: unknown): value is NativeLocalPoolBinding;
+/** Capture the selected row before asynchronous work, never the newest primary afterward. */
+export declare function captureNativeLocalPoolBinding(paths: NativePoolPaths, row: BindingSourceRow): NativeLocalPoolBinding;
+/**
+ * A response still belongs to an account disabled after dispatch. Matching
+ * this snapshot does not make that account eligible for a new request.
+ */
+export declare function nativeLocalPoolBindingMatches(binding: NativeLocalPoolBinding, paths: NativePoolPaths, row: BindingSourceRow): boolean;
+/** Unknown row ids and proven account identities occupy different refresh namespaces. */
+export declare function nativeLocalRefreshJobKey(binding: NativeLocalPoolBinding): string;
+export {};

package/dist/pool-paths.d.ts

@@ -0,0 +1,21 @@
+export interface NativePoolPaths {
+    legacyConfig: string;
+    legacyState: string;
+    config: string;
+    state: string;
+    runtime: string;
+    journal: string;
+    roster: string;
+    storageId: string;
+}
+/**
+ * Resolve existing parent aliases and nonexistent leaves without creating files.
+ * This can follow a leaf symlink, so it does not establish configured-leaf safety.
+ * Source capture and recheck must retain the configured path for the lstat guard.
+ */
+export declare function canonicalPath(path: string): Promise<string>;
+/**
+ * Separate runtime authority from import inputs so a stale legacy writer cannot
+ * rewrite a stamped credential. Both independently configured paths matter.
+ */
+export declare function resolveNativePoolPaths(legacyConfig?: string, legacyState?: string): Promise<NativePoolPaths>;

package/dist/pool-store.d.ts

@@ -0,0 +1,32 @@
+import { type OpenPoolStoreOptions } from "./internal-types/store/index.js";
+import { type NativeLockEvent } from './native-lock-observer.ts';
+import type { NativePoolPaths } from './pool-paths.ts';
+export type { NativeLockEvent } from './native-lock-observer.ts';
+interface NativeQuotaCodec {
+    validate(value: unknown): boolean;
+    merge(stored: unknown | undefined, observation: unknown): unknown;
+}
+export type NativePoolStorePaths = Pick<NativePoolPaths, 'config' | 'state'> & {
+    legacySeedConfig?: string;
+};
+export interface NativePoolStoreOptions extends Pick<OpenPoolStoreOptions, 'now' | 'onStep' | 'hold' | 'logger' | 'onLockStep'> {
+    paths: NativePoolStorePaths;
+    quota: NativeQuotaCodec;
+    onLockEvent?: (event: NativeLockEvent) => void;
+}
+/**
+ * These config/state locks also fence local account metadata against concurrent
+ * credential changes. Legacy sidecar writers use different files and locks.
+ */
+export declare function nativePoolStoreLocks(paths: NativePoolStorePaths): readonly [{
+    readonly path: string;
+    readonly name: 'pool-config';
+}, {
+    readonly path: string;
+    readonly name: 'pool-state';
+}];
+/**
+ * Storage machinery only. Callers must separately establish local migration
+ * authority or vault enrollment authority before using these files.
+ */
+export declare function createNativePoolStore(options: NativePoolStoreOptions): import("./internal-types/store/index.js").PoolStore;

package/dist/provider-error.d.ts

@@ -0,0 +1,139 @@
+export interface ProviderErrorRedactor {
+    /** Scrub credentials from error text. */
+    redactText(text: string): string;
+    /**
+     * Scrub credentials from any thrown value without running caller code.
+     * Strings come back scrubbed and other primitives unchanged. Objects come
+     * back as a fresh projection that keeps only the fields hosts classify on
+     * (name, message, status, code, type, retry hints, headers, the nested
+     * `error` envelope, `cause` and aggregate `errors`), each read as own data
+     * and scrubbed. The original object, its prototype, getters, private state
+     * and any response body, stream or URL are never returned. Never throws.
+     */
+    redactError(error: unknown): unknown;
+    /**
+     * Scrub a provider response. Successful non-stream responses are returned
+     * as-is. Successful event streams keep every successful frame byte-for-byte
+     * and rewrite only error envelopes. Non-2xx responses get scrubbed status
+     * text, headers, URL and body; the body is read lazily when the caller
+     * reads it. After disposal a non-2xx response keeps only its status and
+     * verifiable retry/rate-limit headers.
+     */
+    redactResponse(response: Response): Response;
+    /** Forget the credentials. Later error reads fail closed to a generic message. */
+    dispose(): void;
+}
+/** Replacement for every scrubbed credential. */
+export declare const PROVIDER_ERROR_REDACTION = "[REDACTED]";
+/** Message used when error material is read after the redactor was disposed. */
+export declare const PROVIDER_ERROR_WITHHELD_MESSAGE = "Provider error details were withheld because the request attempt has ended";
+/** Message used when a non-2xx body is too large to scrub safely. */
+export declare const PROVIDER_ERROR_OVERSIZED_MESSAGE = "Provider error body exceeded the redaction size limit and was withheld";
+/** Largest non-2xx body read into memory for scrubbing. */
+export declare const PROVIDER_ERROR_MAX_BODY_BYTES: number;
+/** Largest SSE frame carried while looking for its end. */
+export declare const PROVIDER_ERROR_MAX_FRAME_BYTES: number;
+/**
+ * For producers of a non-2xx body, such as the relay, that stop buffering it
+ * at PROVIDER_ERROR_MAX_BODY_BYTES: error the raw body stream with a new
+ * instance, and the body handed out by `redactResponse` ends with the fixed
+ * PROVIDER_ERROR_OVERSIZED_MESSAGE JSON instead of an error, also when the
+ * redactor or scope was already disposed. Bytes the source had queued are
+ * dropped. Only objects this constructor created count: membership is
+ * looked up by identity in a private set, so nothing on the value (its
+ * message, code, prototype or any getter) is read, and a look-alike, a
+ * proxy around an instance or an object with the same prototype is treated
+ * as an ordinary failure. Not exported from the Core package entry point.
+ */
+export declare class ProviderErrorSourceOversizedError extends Error {
+    constructor();
+}
+/** Message of the error thrown when a closed stream scope is fed again. */
+export declare const PROVIDER_ERROR_SCOPE_CLOSED_MESSAGE = "Provider error stream scope is closed";
+/**
+ * Internal scope for a producer that already holds the raw event-stream
+ * bytes of one physical attempt (the relay): it feeds them through the same
+ * pipeline as `redactResponse` without wrapping a Response.
+ */
+export interface ProviderErrorStreamScope {
+    /**
+     * Bytes to forward for this chunk. Unchanged frames come back as the same
+     * bytes; only error envelopes are rewritten; an incomplete frame is held
+     * until its blank line. A frame over the bound throws
+     * `SseFrameTooLargeError`, and any failure disposes the scope.
+     */
+    push(chunk: Uint8Array): Uint8Array[];
+    /** End of input: bytes for the unterminated tail, then the scope disposes. */
+    finish(): Uint8Array[];
+    /** Scrub a thrown error; generic once the scope is disposed. */
+    redactError(error: unknown): unknown;
+    /** Drop the credentials and any held partial frame. Idempotent. */
+    dispose(): void;
+}
+/**
+ * Create a stream scope for one physical attempt or reconnect, holding the
+ * exact credentials that attempt sent. Create a fresh scope after every
+ * fresh authorization. After `finish()` or `dispose()`, `push` and `finish`
+ * throw an error carrying no content and `redactError` fails closed.
+ */
+export declare function createProviderErrorStreamScope(secrets: readonly string[]): ProviderErrorStreamScope;
+/**
+ * Create a redactor for one request attempt. `secrets` are the exact
+ * credentials that attempt sent; pass a new redactor for every attempt so a
+ * rotated or fallback credential is scrubbed by the attempt that used it, and
+ * call `dispose()` when the attempt ends.
+ */
+export declare function createProviderErrorRedactor(secrets: readonly string[]): ProviderErrorRedactor;
+/**
+ * What the request asked for, which decides how a successful body is
+ * treated: `event-stream` for streaming model requests (the body always goes
+ * through the error-only SSE rewrite, whatever content type the response
+ * claims), `http` for every other request (successful bodies are returned
+ * untouched and never read).
+ */
+export type ProviderResponseMode = 'event-stream' | 'http';
+/** How a response scope retired its credentials. */
+export type ProviderResponseSettlement = 'eof' | 'cancel' | 'error' | 'untouched' | 'disposed';
+/**
+ * Lifetime of one direct provider response. The credentials are retired at
+ * the response's terminal point rather than when the host remembers to
+ * dispose.
+ */
+export interface ProviderErrorResponseScope {
+    /**
+     * Scrub exactly one response. In `http` mode a successful response is
+     * returned as-is without reading its body; in `event-stream` mode a
+     * successful body is wrapped so only error envelopes are rewritten,
+     * whatever its content type. In both modes a non-2xx response gets
+     * scrubbed status text, headers, URL and a lazily scrubbed body. A second
+     * call, or any call after the scope has settled, throws a TypeError.
+     */
+    redactResponse(response: Response): Response;
+    /** Scrub a thrown error while live; generic once the scope has settled. */
+    redactError(error: unknown): unknown;
+    /** Retire the credentials now. Idempotent. */
+    dispose(): void;
+    /**
+     * Resolves once, at the first terminal point, and never rejects:
+     * - `eof`, `cancel` or `error` when a wrapped body (a successful event
+     *   stream or a non-2xx body) ends, is cancelled by its consumer, or fails;
+     * - `untouched` when `redactResponse` returned without wrapping a body,
+     *   such as a successful non-event-stream response, whose body is never
+     *   read;
+     * - `disposed` when `dispose()` came first.
+     * It marks the credentials' retirement, not completed I/O cleanup: a
+     * source cancellation may still be pending.
+     */
+    readonly settled: Promise<ProviderResponseSettlement>;
+}
+/** Message of the TypeError thrown when a response scope is reused. */
+export declare const PROVIDER_ERROR_RESPONSE_SCOPE_USED_MESSAGE = "Provider error response scope accepts one response while live";
+/**
+ * Create a response scope for one physical attempt, holding the exact
+ * credentials that attempt sent, and the mode of the request that attempt
+ * made. Host code that classifies the outcome after
+ * the scope settles (retry, rerouting or quota decisions) must use the
+ * status, headers and already-scrubbed frames it read during the attempt:
+ * once settled, `redactError` only returns a generic error.
+ */
+export declare function createProviderErrorResponseScope(secrets: readonly string[], mode: ProviderResponseMode): ProviderErrorResponseScope;