@cortexkit/anthropic-auth-core 1.23.0 → 2.0.1

package/README.md

@@ -1,8 +1,25 @@
 # @cortexkit/anthropic-auth-core
 
-Shared Anthropic OAuth, stable account identity, optional Claustrum fallback-custody primitives, model metadata, quota, host-local quota feed, routing, cache, cache-keepalive, fast mode, relay, dump, request-signing, thinking-binding, and Fable 5.1 mid-conversation effort helpers used by CortexKit's OpenCode and Pi integrations.
+Internal implementation package for CortexKit's OpenCode and Pi integrations. Apart from the named public surface below, exports are internal host-support APIs with **no stability promise**.
+
+## Public, stable surface
+
+These root exports are public and stable for external callers, including Synapse's Anthropic request client:
+
+- `resolveClaudeCodeIdentity`
+- `buildBillingHeaderValue`
+- `CLAUDE_CODE_ENTRYPOINT`
+- `CLAUDE_CODE_IDENTITY`
+- `applyClaudeCodeMetadata`
+- `applyClaudeCodeHeaders`
+- `signRequestBody`
+- `orderClaudeCodeBody`
+
+The export-manifest test pins these names to the actual root barrel. Legacy sidecar writers and pre-native scoped runtime APIs are removed; host credentials and settings use native storage. Upgrade migration and one-time vault seeding still read the old sidecar format.
 
 User-facing packages:
 
 - `@cortexkit/opencode-anthropic-auth` for OpenCode
 - `@cortexkit/pi-anthropic-auth` for Pi
+
+Claude Haiku 5.5 (`claude-haiku-5-5`) has a 1M-token context window and 128K max output. Standard input/output rates are $0.10/$0.50 per million tokens; all rates increase fivefold above 100K total input, including cached tokens. Optional quota priming continues to send a minimal Haiku 4.5 request to start a new quota window.

package/dist/accounts.d.ts

@@ -1,7 +1,6 @@
 import type { ProviderAccountUuid } from './claude-code.ts';
-import { type CustodyHandleResolution } from './claustrum.ts';
 import { type Cache1hMode } from './constants.ts';
-import { type LogLevel } from './logger.ts';
+import type { LogLevel } from './logger.ts';
 export type { ProviderAccountUuid } from './claude-code.ts';
 export declare const ACCOUNT_FILE_NAME = "anthropic-auth.json";
 export declare const ACCOUNT_STATE_FILE_NAME = "anthropic-auth-state.json";
@@ -22,7 +21,6 @@ export type OAuthAccount = AccountBase & {
     type: 'oauth';
     authLineageId?: string;
     anthropicAccountUuid?: ProviderAccountUuid;
-    claustrumHandle?: string;
     /** Non-secret scoped identity; never a capability handle or bearer token. */
     claustrumScopedCredentialId?: string;
     claustrumScopedState?: string;
@@ -51,15 +49,13 @@ export type ApiKeyAccount = AccountBase & {
     authHeader?: 'authorization-bearer' | 'x-api-key';
 };
 export type FallbackAccount = OAuthAccount | ApiKeyAccount;
-export type ClaustrumAccountGate = {
-    enabled?: boolean;
-};
 export type ClaustrumMode = 'local' | 'claustrum';
 export type ClaustrumConfig = {
     mode?: ClaustrumMode;
-    handlesFile?: string;
     /** Set by authoritative scoped discovery, not an authentication toggle. */
     scopedRoster?: true;
+    /** Producer inventory cursor committed with the roster; never a bearer. */
+    rosterView?: string;
     /** Authoritative, non-secret primary identity from scoped discovery. */
     primaryAccount?: {
         credentialId: string;
@@ -68,7 +64,6 @@ export type ClaustrumConfig = {
     };
     /** Preserve explicit exclusions when a vaulted account disappears and returns. */
     disabledAccountIdentities?: string[];
-    accounts?: Record<string, ClaustrumAccountGate>;
 };
 export declare function isOAuthAccount(account: FallbackAccount): account is OAuthAccount;
 export declare function isApiKeyAccount(account: FallbackAccount): account is ApiKeyAccount;
@@ -269,7 +264,7 @@ export type AccountStorage = {
  * (to display the provider's real model costs).
  */
 export declare function isCostZeroingEnabled(storage: Pick<AccountStorage, 'costZeroing'>): boolean;
-export type AccountRuntimeEntry = Partial<Pick<OAuthAccount, 'access' | 'authLineageId' | 'anthropicAccountUuid' | 'claustrumScopedCredentialId' | 'claustrumScopedState' | 'claustrumHandle' | 'refresh' | 'expires' | 'lastUsed' | 'lastRefreshedAt' | 'lastRefreshError' | 'lastQuotaRefreshError' | 'quota' | 'profile' | 'prime'> & Pick<ApiKeyAccount, 'apiKey' | 'lastUsed'>>;
+export type AccountRuntimeEntry = Partial<Pick<OAuthAccount, 'access' | 'authLineageId' | 'anthropicAccountUuid' | 'claustrumScopedCredentialId' | 'claustrumScopedState' | 'refresh' | 'expires' | 'lastUsed' | 'lastRefreshedAt' | 'lastRefreshError' | 'lastQuotaRefreshError' | 'quota' | 'profile' | 'prime'> & Pick<ApiKeyAccount, 'apiKey' | 'lastUsed'>>;
 export type AccountRuntimeState = {
     version: 1;
     main?: {
@@ -299,27 +294,6 @@ export type AccountStateSaveScope = {
     mainRefresh?: boolean;
     mainPrime?: boolean;
     accounts?: true | string[];
-    setClaustrumHandleAccountIds?: readonly string[];
-};
-export type AccountManagerOptions = {
-    now?: () => number;
-    fetchImpl?: typeof fetch;
-    configPath?: string;
-    quotaManager?: import('./quota-manager.ts').QuotaManager;
-    isFallbackAccountVaultServed?: (accountId: string, storage: AccountStorage) => boolean;
-    isFallbackAccountVaultEnabled?: (accountId: string, storage: AccountStorage) => boolean;
-    resolveFallbackAccessToken?: (account: OAuthAccount, storage: AccountStorage) => {
-        token: string;
-        source: 'vault' | 'sidecar';
-    } | undefined;
-    onBackgroundRefresh?: (initial?: boolean) => Promise<void> | void;
-    onFallbackStorageChanged?: () => void;
-    setIntervalImpl?: typeof globalThis.setInterval;
-    clearIntervalImpl?: typeof globalThis.clearInterval;
-};
-export type AccountRefreshError = {
-    accountId: string;
-    message: string;
 };
 export declare const FALLBACK_BACKGROUND_TICK_MS = 60000;
 export declare function getAccountStoragePath(): string;
@@ -327,47 +301,11 @@ export declare function getAccountStatePath(configPath?: string): string;
 export declare function createEmptyStorage(): AccountStorage;
 export declare function mergeMainQuotaErrorClearedAt(existing: number | undefined, incoming: number | undefined): number | undefined;
 export declare function mergeMainRefreshErrorClearedAt(existing: number | undefined, incoming: number | undefined): number | undefined;
-export declare function loadAccounts(path?: string): Promise<AccountStorage | null>;
 /** Returns the latest timestamp carried by any quota snapshot window. */
 export declare function quotaSnapshotCheckedAt(quota: OAuthQuotaSnapshot | undefined): number;
 export declare function quotaFieldSource(snapshot: OAuthQuotaSnapshot | undefined, field: QuotaFieldName): QuotaFieldSource | undefined;
 export declare function mergeHeaderQuotaForPersistence(existing: OAuthQuotaSnapshot | undefined, incoming: OAuthQuotaSnapshot): OAuthQuotaSnapshot;
 export declare function getClaustrumMode(storage: AccountStorage | null): ClaustrumMode;
-export declare function isOAuthAccountVaultOwned(storage: AccountStorage | null, account: FallbackAccount, binding?: CustodyHandleResolution | undefined): boolean;
-export declare function setClaustrumModePersistent(mode: ClaustrumMode, path?: string): Promise<'changed' | 'unchanged'>;
-export declare function clearClaustrumHandlePersistent(input: {
-    id: string;
-    path?: string;
-}): Promise<'updated' | 'missing' | 'ineligible'>;
-export interface SaveAccountsOptions {
-    /** Account ids intentionally removed by this mutation. */
-    removedAccountIds?: readonly string[];
-    /** Preserve disk order when a stale snapshot is missing newer accounts. */
-    preserveExistingAccountOrder?: boolean;
-    setClaustrumHandleAccountIds?: readonly string[];
-}
-export declare function saveAccounts(storage: AccountStorage, path?: string, options?: SaveAccountsOptions): Promise<void>;
-/** Read-modify-write account configuration under the existing config/state lock order.
- * The callback is synchronous: network discovery must happen under its own outer
- * lease, never while holding the config lock. Do not call another persistence API
- * from the callback.
- */
-export declare function mutateAccountsPersistent<T>(path: string, mutate: (storage: AccountStorage) => {
-    storage: AccountStorage;
-    result: T;
-    options?: SaveAccountsOptions;
-    save?: boolean;
-}, options?: {
-    assertAuthority?: () => Promise<void>;
-}): Promise<T>;
-export declare function getOrCreateMainAccountId(path?: string, createId?: () => string): Promise<string>;
-export declare function saveAccountState(storage: AccountStorage, path?: string, scope?: AccountStateSaveScope): Promise<void>;
-export declare function saveOAuthProfileState(input: {
-    accountId: 'main' | string;
-    profile: OAuthAccountProfile | undefined;
-    accountIdentity?: string;
-}, path?: string): Promise<boolean>;
-export declare function clearClaustrumRefreshErrorPersistent(accountId: string, handle: string, path?: string): Promise<boolean>;
 export declare function acquireRefreshFileLock(options: {
     name: string;
     ttlMs: number;
@@ -382,30 +320,10 @@ export declare function acquireRefreshFileLock(options: {
 } | null>;
 export declare function isCache1hPersistentlyEnabled(storage: AccountStorage | null): boolean;
 export declare function getCache1hPersistentMode(storage: AccountStorage | null): Cache1hMode;
-export declare function setCache1hPersistentEnabled(enabled: boolean, mode?: Cache1hMode, path?: string): Promise<AccountStorage>;
-export declare function setCache1hPersistentMode(mode: Cache1hMode, path?: string): Promise<AccountStorage>;
 export declare function isDumpPersistentlyEnabled(storage: AccountStorage | null): boolean;
-export declare function setDumpPersistentEnabled(enabled: boolean, path?: string): Promise<AccountStorage>;
 export declare function isFastModePersistentlyEnabled(storage: AccountStorage | null): boolean;
-export declare function setFastModePersistentEnabled(enabled: boolean, path?: string): Promise<AccountStorage>;
-export declare function setCacheKeepPersistentWindow(startHour: number, endHour: number, path?: string): Promise<AccountStorage>;
-export declare function setCacheKeepPersistentAlways(path?: string): Promise<AccountStorage>;
-export declare function setCacheKeepPersistentEnabled(enabled: boolean, path?: string): Promise<AccountStorage>;
 export declare function isCacheKeepSubagentsEnabled(storage: AccountStorage | null): boolean;
-export declare function setCacheKeepSubagentsEnabled(enabled: boolean, path?: string): Promise<AccountStorage>;
 export declare function isPrimePersistentlyEnabled(storage: AccountStorage | null): boolean;
-export declare function setPrimePersistentEnabled(enabled: boolean, path?: string): Promise<AccountStorage>;
-/** Return the stable prime marker identity for an OAuth account. */
-export declare function getOrCreatePrimeAuthLineageId(accountId: 'main' | string, path?: string): Promise<string | undefined>;
-/**
- * Atomically increment an account's cumulative prime counters and persist via
- * the scoped runtime-state path. The `main` account lives at state.main.prime;
- * every other account lives at state.accounts[id].prime. Config-side writes
- * are intentionally NOT triggered so prime counters cannot leak into
- * `anthropic-auth.json`. Callers should not depend on this function to mutate
- * the caller's storage object.
- */
-export declare function incrementPrimeUsagePersistent(accountId: 'main' | string, usage: PrimeUsageDelta, path?: string, now?: number): Promise<PrimeUsageCounters>;
 export declare function shouldFallbackStatus(status: number, storage: AccountStorage | null): boolean;
 export declare function getQuotaMinimumRemainingThresholds(storage: AccountStorage | null): {
     five_hour: number;
@@ -451,7 +369,6 @@ export declare function quotaBackoffActive(error: AccountOperationError | undefi
 export declare function formatQuotaBackoffMessage(error: AccountOperationError, now: number): string;
 export declare function getQuotaCheckIntervalMs(storage: AccountStorage | null): number;
 export declare function getPersistedLogLevel(storage: AccountStorage | null): LogLevel | undefined;
-export declare function setLogLevelPersistent(level: LogLevel, path?: string): Promise<void>;
 export declare function getPersistedMainQuota(storage: AccountStorage | null): {
     quota: OAuthQuotaSnapshot;
     checkedAt: number;
@@ -495,86 +412,10 @@ export declare function killswitchRetryAfterSeconds(mainQuota: OAuthQuotaSnapsho
     quota?: OAuthQuotaSnapshot;
 }>, now: number, scopedModelId?: string): number;
 export declare function getKillswitchConfig(storage: AccountStorage | null): KillswitchConfig;
-export declare function setKillswitchPersistent(config: KillswitchConfig, path?: string): Promise<AccountStorage>;
-export declare function removeAccountPersistent(id: string, path?: string): Promise<boolean>;
-export declare function reorderAccountsPersistent(orderedIds: string[], path?: string): Promise<void>;
-export declare function setAccountEnabledPersistent(id: string, enabled: boolean, path?: string): Promise<boolean>;
-export declare function addAccountPersistent(account: FallbackAccount, path?: string): Promise<void>;
 export declare function getQuotaNextRefreshAt(quota: OAuthQuotaSnapshot | undefined, storage: AccountStorage | null, now: number): number;
 export declare function fetchOAuthQuotaSnapshot(input: {
     accessToken: string;
     fetchImpl?: typeof fetch;
     now?: () => number;
 }): Promise<OAuthQuotaSnapshot>;
-export declare function upsertAccount(storage: AccountStorage, account: FallbackAccount): void;
-export declare function persistFallbackQuotaHeaderPersistent(input: {
-    accountId: string;
-    authLineageId?: string;
-    quota: OAuthQuotaSnapshot;
-    anthropicAccountUuid?: ProviderAccountUuid;
-}, path?: string): Promise<boolean>;
 export declare function fallbackAccountUuidForLineage(account: OAuthAccount | undefined, authLineageId?: string): string | null;
-export declare function removeAccount(storage: AccountStorage, id: string): boolean;
-export declare function reorderAccounts(storage: AccountStorage, orderedIds: string[]): void;
-export declare function setAccountEnabled(storage: AccountStorage, id: string, enabled: boolean): boolean;
-export declare class FallbackAccountManager {
-    private readonly now;
-    private readonly fetchImpl;
-    private readonly configPath;
-    private readonly refreshPromises;
-    private readonly custodyVerificationAccounts;
-    private refreshTimer;
-    private quotaTimer;
-    readonly quotaManager: import('./quota-manager.ts').QuotaManager | null;
-    private readonly isFallbackAccountVaultServed;
-    private readonly isFallbackAccountVaultEnabled;
-    private readonly resolveFallbackAccessToken;
-    private readonly onBackgroundRefresh;
-    private readonly onFallbackStorageChanged;
-    private readonly setIntervalImpl;
-    private readonly clearIntervalImpl;
-    constructor(options?: AccountManagerOptions);
-    /**
-     * Seed QuotaManager from persisted account.quota if no cache entry exists
-     * yet. Prevents unnecessary API calls when the on-disk snapshot is fresh.
-     */
-    private seedFallbackQuota;
-    load(): Promise<AccountStorage | null>;
-    save(storage: AccountStorage, accountIds?: string[]): Promise<void>;
-    startBackgroundRefresh(): Promise<void>;
-    stopBackgroundRefresh(): void;
-    withAccountRefreshLock<T>(accountId: string, fn: () => Promise<T>): Promise<T>;
-    getUsableFallbackAccounts(existingStorage?: AccountStorage | null, options?: {
-        modelId?: string;
-    }): Promise<OAuthAccount[]>;
-    markUsed(account: FallbackAccount): Promise<void>;
-    accountPassesQuotaPolicy(account: OAuthAccount, storage: AccountStorage | null, options?: {
-        modelId?: string;
-    }): boolean;
-    /**
-     * Return the account with its quota overlaid from the unified QuotaManager
-     * cache (token-bound) when available, so quota-policy decisions use the same
-     * source of truth as the staleness check. Falls back to the stored
-     * account.quota when no manager is wired or the cache has no entry.
-     */
-    private quotaPolicyAccount;
-    refreshDueAccounts(): Promise<void>;
-    refreshQuotaForDueAccounts(): Promise<void>;
-    refreshQuotaForAllAccounts(options?: {
-        force?: boolean;
-    }): Promise<{
-        storage: AccountStorage | null;
-        errors: AccountRefreshError[];
-    }>;
-    refreshAccount(account: OAuthAccount, storage: AccountStorage, options?: {
-        force?: boolean;
-        persistError?: boolean;
-    }): Promise<OAuthAccount>;
-    private waitForConcurrentFallbackRefresh;
-    private refreshAccountNow;
-    refreshAccountQuota(account: OAuthAccount, storage: AccountStorage): Promise<{
-        account: OAuthAccount;
-        fetched: boolean;
-        changed: boolean;
-    }>;
-}

package/dist/cachekeep.d.ts

@@ -112,6 +112,15 @@ export declare class CacheKeepManager {
         setIntervalImpl?: typeof globalThis.setInterval;
         clearIntervalImpl?: typeof globalThis.clearInterval;
         prepareHeaders?: (headers: Headers, target: CacheKeepTarget, attempt: CacheKeepPrewarmAttempt) => Promise<Headers | undefined> | Headers | undefined;
+        /** Optionally reauthorize a replayable prewarm after a genuine 401.
+         * Return headers only for a verified newer version of the same account;
+         * onResponse observes only the final physical attempt. */
+        retryOnUnauthorized?: (input: {
+            target: CacheKeepTarget;
+            headers: Headers;
+            bodyText: string;
+            attempt: CacheKeepPrewarmAttempt;
+        }) => Promise<Headers | undefined> | Headers | undefined;
         onTrackedSessionsChanged?: (sessions: readonly CacheKeepTrackedSession[]) => Promise<void> | void;
         prepareBody?: (bodyText: string, target: CacheKeepTarget) => string | Promise<string>;
         onResponse?: (input: {

package/dist/claude-code.d.ts

@@ -14,6 +14,22 @@ export declare function resetClaudeCodeIdentityCachesForTest(): void;
  * additional bootstrap request carrying a previously authorized token. */
 export declare function getClaudeCodeIdentityForVerifiedAccount(accountIdentity: string, accountUuid: ProviderAccountUuid): ClaudeCodeIdentity;
 export declare function resolveClaudeCodeIdentity(accessToken: string, model: string | undefined, accountIdentity: string | undefined): Promise<ClaudeCodeIdentity>;
+/**
+ * The access value is not a Claude OAuth access token, so Claude cannot
+ * identify its account. Asking again will not help; only a new sign-in
+ * replaces it. The message never includes the rejected value.
+ */
+export declare class ClaudeUnsupportedAccessError extends Error {
+    readonly code = "unsupported-access";
+    constructor();
+}
+/**
+ * Account lookup for credentials that must belong to a Claude account.
+ * Unlike resolveClaudeCodeIdentity, which returns an identity without an
+ * account UUID for any other access value, this rejects such a value with
+ * ClaudeUnsupportedAccessError before any network request.
+ */
+export declare function resolveClaudeCodeAccountIdentity(accessToken: string, model: string | undefined, accountIdentity: string | undefined): Promise<ClaudeCodeIdentity>;
 export declare function buildClaudeCodeMetadataUserId(identity: ClaudeCodeIdentity): string | null;
 export declare function applyClaudeCodeMetadata(body: Record<string, unknown>, identity: ClaudeCodeIdentity): boolean;
 export declare const CLAUDE_CODE_FULL_AGENT_BETAS: readonly ['oauth-2025-04-20', 'interleaved-thinking-2025-05-14', 'thinking-token-count-2026-05-13', 'context-management-2025-06-27', 'prompt-caching-scope-2026-01-05', 'claude-code-20250219', 'advisor-tool-2026-03-01', 'advanced-tool-use-2025-11-20', 'mid-conversation-system-2026-04-07', 'effort-2025-11-24', 'fallback-credit-2026-06-01', 'extended-cache-ttl-2025-04-11', 'cache-diagnosis-2026-04-07'];

package/dist/claustrum-enrollment.d.ts

@@ -48,6 +48,8 @@ export interface ClaustrumEnrollmentPaths {
     tokenPath: string;
 }
 export declare function getClaustrumEnrollmentPaths(tokenPath: string): ClaustrumEnrollmentPaths;
+/** Resolve the independently enrolled host's owner-only token and state paths. */
+export declare function getHostClaustrumEnrollmentPaths(host: 'opencode' | 'pi', env?: NodeJS.ProcessEnv, cwd?: string): ClaustrumEnrollmentPaths;
 export declare function readClaustrumEnrollmentStatus(paths: ClaustrumEnrollmentPaths, proposedName?: string): Promise<ClaustrumEnrollmentStatus>;
 /** Read fresh bearer material for a scoped operation; never publish this value. */
 export declare function readClaustrumEnrollmentToken(tokenPath: string): Promise<EnrollmentTokenFile>;

package/dist/claustrum.d.ts

@@ -1,5 +1,3 @@
-import { type BindIdentity, type CatalogEntry, type CloseRouteOptions, type ManagedCallOptions, type ManagedCloseRouteOptions, type RequestOptions, type RouteHandle, type RouteOpenOptions, type RouteTarget, SubcClient, type SubscribeOptions, type Subscription } from '@cortexkit/subc-client';
-import type { ClaustrumConfig, OAuthAccount } from './accounts.ts';
 export type ClaustrumEndpoint = {
     host: string;
     port: number;
@@ -21,9 +19,6 @@ export declare const PRODUCTION_CLAUSTRUM_CONNECTION_FILE_NAME = "subc-connectio
 export declare function findExistingClaustrumConnectionPath(env?: NodeJS.ProcessEnv): string | undefined;
 export declare function getDefaultClaustrumConnectionPath(env?: NodeJS.ProcessEnv): string;
 export declare function resolveClaustrumConnectionPath(explicit?: string, env?: NodeJS.ProcessEnv): string;
-type CustodyHandlesEnvironment = Readonly<Record<string, string | undefined>>;
-export declare function resolveCustodyHandlesPath(config: Pick<ClaustrumConfig, 'handlesFile'> | undefined, env: CustodyHandlesEnvironment): string;
-export declare function getDefaultClaustrumHandlesPath(): string;
 export declare function detectClaustrumConnection(explicitPath?: string): Promise<ClaustrumDetection>;
 export declare const CUSTODY_TOMBSTONE_PREFIX = "claustrum-tombstone:v1:";
 export declare function custodyTombstoneKey(provider: string): string;
@@ -46,207 +41,3 @@ export declare class CustodyTombstoneLoginError extends Error {
     constructor(provider: string);
 }
 export declare function assertNotCustodyTombstone(refreshToken: unknown, provider: string): void;
-export type CustodyHandleAccount = {
-    label: string;
-    handle: string;
-    credentialId: string;
-};
-export type CustodyHandleManifest = {
-    version: 1;
-    provider: 'anthropic';
-    serve: 'anthropic-auth';
-    accounts: ReadonlyArray<CustodyHandleAccount>;
-    superseded: ReadonlySet<string>;
-    corruptLabels?: ReadonlySet<string>;
-};
-export type CustodyHandleResolution = {
-    status: 'resolved';
-    source: 'manifest';
-    handle: string;
-    credentialId: string;
-} | {
-    status: 'resolved';
-    source: 'legacy';
-    handle: string;
-} | {
-    status: 'unresolved';
-    reason: 'missing-label' | 'invalid-label' | 'duplicate-label' | 'missing-entry' | 'foreign-serve' | 'superseded' | 'corrupt-binding' | 'unknown-identity';
-};
-type ParsedCustodyHandleManifest = {
-    version: 1;
-    provider: string;
-    serve: string;
-    accounts: ReadonlyArray<CustodyHandleAccount>;
-    superseded: ReadonlySet<string>;
-    corruptLabels: ReadonlySet<string>;
-};
-export declare function isValidCustodyLabel(value: unknown): value is string;
-export declare function isValidCustodyHandle(value: unknown): value is string;
-export declare function custodyCredentialId(label: string): string;
-export declare function custodyCredentialIdFromResolution(resolution: CustodyHandleResolution, label: string): string;
-/**
- * | manifest state | legacy handle | result |
- * | --- | --- | --- |
- * | matching ready entry | any | manifest handle |
- * | absent or invalid | present | legacy handle |
- * | no matching ready entry | present | legacy handle |
- * | foreign serve | any | unresolved |
- * | superseded matching entry | any | unresolved |
- */
-export declare function resolveCustodyHandle(input: {
-    account: OAuthAccount;
-    manifest: CustodyHandleManifest | undefined;
-    duplicateOAuthLabels?: ReadonlySet<string>;
-}): CustodyHandleResolution;
-export declare function readCustodyHandles(json: unknown, provider: string, serve: string): ParsedCustodyHandleManifest;
-type CustodyHandleManifestReadResult = {
-    status: 'ready';
-    manifest: CustodyHandleManifest;
-} | {
-    status: 'absent';
-} | {
-    status: 'ignored';
-    reason: 'foreign-serve' | 'missing-provider';
-} | {
-    status: 'invalid';
-    reason: string;
-};
-export declare const CUSTODY_MANIFEST_SELECTION_ERROR_CODES: readonly ['foreign-serve', 'invalid-label', 'missing-provider'];
-type CustodyManifestSelectionErrorCode = (typeof CUSTODY_MANIFEST_SELECTION_ERROR_CODES)[number];
-export declare class CustodyManifestSelectionError extends Error {
-    readonly code: CustodyManifestSelectionErrorCode;
-    constructor(code: CustodyManifestSelectionErrorCode);
-}
-export declare class CustodyHandleManifestReader {
-    #private;
-    constructor(options: {
-        path: string;
-        provider: 'anthropic';
-        serve: 'anthropic-auth';
-        expectedUid?: number;
-    });
-    read(): Promise<CustodyHandleManifestReadResult>;
-}
-export type CustodyHandleManifestWriteResult = {
-    status: 'written' | 'unchanged';
-} | {
-    status: 'refused';
-    reason: string;
-    code?: CustodyManifestLockErrorCode;
-};
-export type CustodyHandleManifestRemovalResult = 'removed' | 'missing' | {
-    status: 'refused';
-    code?: CustodyManifestLockErrorCode;
-};
-export declare const CUSTODY_MANIFEST_LOCK_TTL_MS = 30000;
-export declare const CUSTODY_MANIFEST_LOCK_RENEW_MS = 10000;
-export declare const CUSTODY_MANIFEST_LOCK_RETRY_MIN_MS = 50;
-export declare const CUSTODY_MANIFEST_LOCK_RETRY_MAX_MS = 150;
-export type CustodyManifestLockTestOptions = Partial<{
-    ttlMs: number;
-    retryMinMs: number;
-    retryMaxMs: number;
-    renewalIntervalMs: number;
-    now: () => number;
-    setIntervalImpl: typeof globalThis.setInterval;
-    clearIntervalImpl: typeof globalThis.clearInterval;
-    afterStaleOwnerRead: () => void | Promise<void>;
-    beforeRename: () => void | Promise<void>;
-}>;
-export declare function __setCustodyManifestLockTestOptions(options?: CustodyManifestLockTestOptions): void;
-export declare const CUSTODY_MANIFEST_LOCK_ERROR_CODES: readonly ['lock_busy', 'owner_invalid', 'renewal_failed'];
-export type CustodyManifestLockErrorCode = (typeof CUSTODY_MANIFEST_LOCK_ERROR_CODES)[number];
-export declare class CustodyManifestLockError extends Error {
-    readonly code: CustodyManifestLockErrorCode;
-    constructor(message: string, code: CustodyManifestLockErrorCode);
-}
-export declare class CustodyManifestLockBusyError extends CustodyManifestLockError {
-    constructor(message: string);
-}
-export declare class CustodyManifestLockOwnerInvalidError extends CustodyManifestLockError {
-    constructor(message: string);
-}
-export declare class CustodyManifestLockLeaseLostError extends CustodyManifestLockError {
-    constructor(message: string);
-}
-export declare function __deriveCustodyManifestStaleLockPrefix(lockPath: string, pathBasename: (path: string) => string): string;
-export declare function withCustodyManifestLock<T>(path: string, fn: (assertLease: () => Promise<void>, nonce: string) => Promise<T>): Promise<T>;
-type CustodyHandleManifestWriteInput = {
-    path: string;
-    entry: CustodyHandleAccount;
-    expectedUid?: number;
-};
-export declare function writeCustodyHandleManifestEntry(input: CustodyHandleManifestWriteInput): Promise<CustodyHandleManifestWriteResult>;
-export declare function removeCustodyHandleManifestEntry(input: CustodyHandleManifestWriteInput): Promise<CustodyHandleManifestRemovalResult>;
-export declare function writeCustodyHandleManifestEntryLocked(input: CustodyHandleManifestWriteInput, assertLease: () => Promise<void>, lockNonce: string): Promise<CustodyHandleManifestWriteResult>;
-export type ClaustrumClientOptions = {
-    connectionFile?: string;
-    handshakeTimeoutMs?: number;
-    connector?: ClaustrumConnector;
-};
-export type ClaustrumConnector = (options: {
-    connectionFile: string;
-    handshakeTimeoutMs?: number;
-}) => Promise<SubcClient>;
-export declare class ClaustrumClient {
-    #private;
-    private constructor();
-    static connect(options?: ClaustrumClientOptions): Promise<ClaustrumClient>;
-    catalogList(moduleId?: string): Promise<CatalogEntry[]>;
-    routeOpen(target: RouteTarget, identity: BindIdentity, options?: Omit<RouteOpenOptions, 'consumerIdentity'>): Promise<RouteHandle>;
-    request(handle: RouteHandle, body: unknown, options?: RequestOptions): Promise<unknown>;
-    call<Response = unknown>(moduleId: string, method: string, params?: unknown, options?: Omit<ManagedCallOptions, 'consumerIdentity'>): Promise<Response>;
-    subscribe(handle: RouteHandle, body: unknown, onEvent: (event: Uint8Array) => void, options?: SubscribeOptions): Subscription;
-    closeRoute(handle: RouteHandle, options?: CloseRouteOptions): Promise<void>;
-    closeManagedRoute(target: Extract<RouteTarget, {
-        kind: 'management_surface' | 'tool_provider';
-    }>, identity: BindIdentity, options?: Omit<ManagedCloseRouteOptions, 'consumerIdentity'>): Promise<void>;
-    close(): void;
-}
-export declare function connectClaustrumClient(options?: ClaustrumClientOptions): Promise<ClaustrumClient>;
-export declare const CLAUSTRUM_MODULE_ID = "claustrum";
-export declare const DEFAULT_CLAUSTRUM_CREDENTIAL_MIN_TTL_MS = 120000;
-export declare const ERROR_CLASS_WIRE_SET: readonly ['transient', 'permanent', 'auth_required', 'context_overflow'];
-export type ClaustrumCredentialErrorClass = (typeof ERROR_CLASS_WIRE_SET)[number];
-export type ClaustrumCredentialErrorAction = 'gone' | 'reauth' | 'retry' | 'reduce_and_retry';
-export type ClaustrumCredential = {
-    payload: string;
-    expiresAtMs: number | null;
-    recordVersion: number;
-    projectId?: string;
-    accountId?: string;
-    credentialId?: string;
-};
-export type ClaustrumServedCredential = Pick<ClaustrumCredential, 'recordVersion'>;
-export type ClaustrumReporterSource = 'direct' | 'relay_status_field' | 'relay_message_parse';
-export declare class ClaustrumCredentialError extends Error {
-    readonly code: string;
-    readonly action: ClaustrumCredentialErrorAction;
-    readonly errorClass: ClaustrumCredentialErrorClass;
-    constructor(message: string, code: string, errorClass: ClaustrumCredentialErrorClass, action: ClaustrumCredentialErrorAction);
-}
-export type ClaustrumCredentialCacheOptions = {
-    identity?: BindIdentity;
-    now?: () => number;
-    minTtlMs?: number;
-};
-export declare class ClaustrumCredentialCache {
-    #private;
-    constructor(client: ClaustrumClient, options?: ClaustrumCredentialCacheOptions);
-    get(handle: string, minTtlMs?: number, options?: {
-        cacheIf?: () => boolean;
-    }): Promise<ClaustrumCredential>;
-    peek(handle: string): ClaustrumCredential | undefined;
-    abandonPending(handle: string): void;
-    seedForTest(handle: string, credential: ClaustrumCredential): void;
-    reduceMinTtlMs(): number;
-    reportAuthFailure(handle: string, providerStatus: number, servedCredential: ClaustrumServedCredential, reporterSource?: ClaustrumReporterSource): Promise<void>;
-    reportAuthFailure(handle: string, servedCredential: ClaustrumServedCredential, providerStatus?: number, reporterSource?: ClaustrumReporterSource): Promise<void>;
-    invalidate(handle: string, recordVersion?: number): void;
-    close(): void;
-}
-export type ConnectClaustrumCredentialCacheOptions = ClaustrumClientOptions & ClaustrumCredentialCacheOptions & {
-    enabled?: boolean;
-};
-export declare function connectClaustrumCredentialCache(options?: ConnectClaustrumCredentialCacheOptions): Promise<ClaustrumCredentialCache | null>;
-export {};

package/dist/commands/account.d.ts

@@ -1,5 +1,5 @@
-import type { AccountStorage, ClaustrumMode, FallbackAccount } from '../accounts.ts';
-import type { ClaustrumDetection, CustodyHandleResolution } from '../claustrum.ts';
+import type { AccountStorage, ClaustrumMode } from '../accounts.ts';
+import type { ClaustrumDetection } from '../claustrum.ts';
 import type { ClaustrumEnrollmentStatus } from '../claustrum-enrollment.ts';
 export declare const CLAUDE_ACCOUNT_COMMAND_NAME = "claude-account";
 export type AccountCommandAction = {
@@ -82,7 +82,6 @@ export declare function executeAccountCommand(input: {
     storage: AccountStorage;
     claustrum?: ClaustrumDetection;
     statusProjection?: AccountCommandStatusProjection;
-    resolveCustodyBinding?: (account: FallbackAccount) => CustodyHandleResolution;
     path?: string;
     transition?: ClaustrumModeTransition;
     resetEnrollment?: () => Promise<AccountCommandResult>;

package/dist/index.d.ts

@@ -7,10 +7,6 @@ export * from './cch.ts';
 export * from './claude-code.ts';
 export * from './claustrum.ts';
 export * from './claustrum-enrollment.ts';
-export * from './claustrum-enrollment-registry.ts';
-export * from './claustrum-scoped.ts';
-export * from './claustrum-scoped-roster.ts';
-export * from './claustrum-scoped-runtime.ts';
 export * from './commands/account.ts';
 export * from './constants.ts';
 export * from './custom-headers.ts';
@@ -23,16 +19,61 @@ export * from './logging.ts';
 export * from './mid-conversation-output-config.ts';
 export * from './model-remap.ts';
 export * from './models.ts';
+export type { NativeAccountRuntime, NativeAccountRuntimeOptions, NativeAccountWriteInput, NativeApiSubject, NativeLocalAuthorizeOptions, NativeRelayUpdate, } from './native-account-runtime.ts';
+export { acquireNativeAccountRuntime, createNativeAccountRuntime, nativeAccountPolicy, } from './native-account-runtime.ts';
+export type { NativeAccountMetadataPatch, NativeAccountSnapshot, NativeAccountView, } from './native-account-view.ts';
+export { formatNativeAccountState } from './native-account-view.ts';
+export * from './native-credential-validation.ts';
+export type { NativeCustody, NativeCustodyClient, NativeCustodyErrorCode, NativeCustodyIdentity, NativeCustodyInventory, NativeCustodyLogger, NativeCustodyOptions, NativeCustodyReceipt, NativeCustodyReporterSource, NativeCustodyRetry, } from './native-custody.ts';
+export { createNativeCustody, NativeCustodyError } from './native-custody.ts';
+export type { NativeCustodyActivationErrorCode, NativeCustodyActivationHooks, NativeCustodyActivationOptions, NativeCustodyActivationResult, } from './native-custody-activation.ts';
+export { NativeCustodyActivationError, runNativeCustodyActivation, } from './native-custody-activation.ts';
+export { readNativeEnrollmentMode } from './native-enrollment-authority.ts';
+export { inspectNativeHostAuthEntry, NativeHostAuthError, requireNoSupervisedAuthContentSnapshot, } from './native-host-auth.ts';
+export { readNativeHostAuthKind } from './native-host-auth-read.ts';
+export type { NativeLocalAttributedFailure, NativeLocalCredentialService, NativeLocalCredentialServiceOptions, NativeLocalFailurePolicyInput, } from './native-local-credential-service.ts';
+export { createNativeLocalCredentialService } from './native-local-credential-service.ts';
+export type { NativeLocalExternalPolicy } from './native-local-runtime-readers.ts';
+export type { NativeMenuActionValues, NativeMenuCapabilityOutcome, NativeMenuDispatch, NativeMenuDispatchActionId, NativeMenuDispatchOptions, NativeMenuDispatchRequest, NativeMenuDispatchValues, NativeMenuExecutionContext, NativeMenuExecutionResult, NativeMenuExecutor, NativeMenuExecutorOptions, NativeMenuExecutorRefusalCode, NativeMenuKillswitchEntry, NativeMenuNoValues, NativeMenuRequest, NativeMenuSessionActionId, } from './native-menu-executor.ts';
+export { createNativeMenuExecutor } from './native-menu-executor.ts';
+export type { NativeMenuAction, NativeMenuActionId, NativeMenuCacheMode, NativeMenuChoiceParameter, NativeMenuCommandId, NativeMenuCustodyMode, NativeMenuGroup, NativeMenuGroupId, NativeMenuHost, NativeMenuLogLevel, NativeMenuModel, NativeMenuParameter, NativeMenuParameterId, NativeMenuRefusalCode, NativeMenuRoutingMode, NativeMenuStatus, } from './native-menu-model.ts';
+export { getNativeMenuModel } from './native-menu-model.ts';
+export type { NativeMigrationCustody, NativeMigrationHooks, NativeMigrationOptions, NativeMigrationPreflight, } from './native-migration.ts';
+export { NativeMigrationError, prepareNativeMigration, releaseNativeMigrationPreflight, runNativeMigration, } from './native-migration.ts';
+export type { NativeCommittedMaterial, NativeIdentityBootstrap, NativeRefreshContext, NativeRefreshDispatchVersion, NativeRefreshFailure, NativeRefreshHandoff, NativeRefreshObservation, NativeRefreshRequest, NativeRefreshRestriction, NativeRefreshResult, NativeRefreshSubject, NativeServingAdmission, } from './native-refresh-coordinator.ts';
+export type { NativeLocalFailureAttribution, NativeLocalFailurePolicy, NativeLocalFailureSkipReason, } from './native-runtime.ts';
+export { nativeRuntimeOptionIdentity } from './native-runtime-registry.ts';
+export * from './native-settings.ts';
+export { isNativeTransientAccountError, NativeTransientAccountError, } from './native-transient-account.ts';
+export type { CommandApplyRequest, CommandApplyResult, CommandDialogPayload, CommandInvocation, CommandMenu, CommandMenuModel, KnobValue, KnobValues, MenuAction, MenuItem, MenuKnob, MenuSection, NativeUiOptions, NotifyKind, SectionSlot, } from './native-ui.ts';
+export { createNativeUi, parseApplyRequest, runPiCommandMenu, } from './native-ui.ts';
+export * from './native-usage-publication.ts';
+export { NATIVE_VAULT_NO_ACCOUNT_MESSAGE, NativeVaultNoAccountError, readNativeAccountsForRequest, } from './native-vault-admission.ts';
+export type { NativePiAuthSlot, NativePiAuthSlotErrorCode, NativePiAuthSlotInspection, NativePiAuthSlotOptions, NativeVaultDisconnectOptions, NativeVaultDisconnectResult, } from './native-vault-connection.ts';
+export { disconnectNativeVaultForHost, NativePiAuthSlotError, nativePiAuthSlotPaths, openNativePiAuthSlot, } from './native-vault-connection.ts';
+export type { NativeVaultRuntime, NativeVaultRuntimeOptions, NativeVaultWatch, NativeVaultWatchOptions, } from './native-vault-runtime.ts';
+export { acquireNativeVaultRuntime, createNativeVaultRuntime, discoverNativeVaultInventory, publishNativeVaultRosterSeed, publishNativeVaultRuntimeSeed, } from './native-vault-runtime.ts';
 export * from './oauth-profile.ts';
 export * from './pkce.ts';
+export type { NativeMigrationJournal } from './pool-authority.ts';
+export { nativeMigrationAuthorityPhase, readNativeMigrationJournal, } from './pool-authority.ts';
+export type { NativeLocalPoolBinding } from './pool-binding.ts';
+export { captureNativeLocalPoolBinding } from './pool-binding.ts';
+export * from './pool-paths.ts';
+export * from './pool-store.ts';
 export * from './prime.ts';
 export * from './provider.ts';
+export type { ProviderErrorRedactor, ProviderErrorResponseScope, ProviderResponseMode, ProviderResponseSettlement, } from './provider-error.ts';
+export { createProviderErrorRedactor, createProviderErrorResponseScope, } from './provider-error.ts';
 export * from './quota-header-feed.ts';
 export * from './quota-headers.ts';
 export * from './quota-manager.ts';
 export * from './quotas.ts';
 export * from './relay.ts';
+export * from './request-history.ts';
 export * from './routing.ts';
+export type { SseEvent, SseFramer, SseFramerOptions } from './sse.ts';
+export { createSseFramer, DEFAULT_SSE_MAX_FRAME_BYTES, decodeSseFrame, isSseCandidateFrame, isTerminatedSseFrame, parseSseFrame, SseFrameTooLargeError, } from './sse.ts';
 export * from './start.ts';
 export * from './sticky-routing.ts';
 export * from './thinking-binding.ts';