@cortexkit/anthropic-auth-core 1.23.0 → 2.0.1

package/dist/claustrum-scoped-roster.js

@@ -1,194 +0,0 @@
-import { createHash } from 'node:crypto';
-import { acquireRefreshFileLock, getClaustrumMode, isOAuthAccount, loadAccounts, mutateAccountsPersistent, } from './accounts.js';
-function preferredLabel(credentialId) {
-    const parts = credentialId.split(':');
-    return parts.length >= 3 && parts[2]?.trim()
-        ? parts.slice(2).join(':').trim()
-        : undefined;
-}
-function routeId(account) {
-    const label = preferredLabel(account.credentialId);
-    if (label)
-        return label;
-    return `scoped-${createHash('sha256').update(account.accountId).digest('hex')}`;
-}
-function representativeRows(storage, rows) {
-    const credentials = new Set();
-    const byIdentity = new Map();
-    for (const row of rows) {
-        if (!row.credentialId.trim() ||
-            !row.accountId.trim() ||
-            credentials.has(row.credentialId)) {
-            throw new Error('Claustrum returned an ambiguous account inventory');
-        }
-        credentials.add(row.credentialId);
-        const group = byIdentity.get(row.accountId) ?? [];
-        group.push(row);
-        byIdentity.set(row.accountId, group);
-    }
-    return [...byIdentity.values()]
-        .map((group) => {
-        const existing = storage.accounts.find((account) => isOAuthAccount(account) &&
-            account.anthropicAccountUuid === group[0]?.accountId);
-        // Multiple login records for one provider account are not extra quota.
-        // Keep its established binding where possible, except that the conventional
-        // default owns the primary slot rather than appearing a second time below.
-        const ordered = group.toSorted((left, right) => left.credentialId.localeCompare(right.credentialId));
-        const active = ordered.filter((entry) => entry.state === 'active');
-        const choices = active.length ? active : ordered;
-        const row = choices.find((entry) => entry.credentialId === 'oauth:anthropic') ??
-            choices.find((entry) => entry.credentialId === existing?.claustrumScopedCredentialId) ??
-            choices[0];
-        if (!row)
-            throw new Error('Claustrum returned an empty account identity group');
-        return row;
-    })
-        .sort((left, right) => left.credentialId.localeCompare(right.credentialId));
-}
-/** Pure identity projection; callers must serialize discovery before persisting it. */
-export function projectClaustrumScopedRoster(storage, rows, view, now = Date.now()) {
-    if (new Set(storage.accounts.map((account) => account.id)).size !==
-        storage.accounts.length) {
-        throw new Error('Account configuration contains duplicate route identities');
-    }
-    const selected = representativeRows(storage, rows);
-    const primaryIdentity = rows.find((row) => row.credentialId === 'oauth:anthropic')?.accountId;
-    const primary = selected.find((row) => row.accountId === primaryIdentity);
-    const disabled = new Set(storage.claustrum?.disabledAccountIdentities ?? []);
-    for (const account of storage.accounts) {
-        if (!isOAuthAccount(account) || !account.anthropicAccountUuid)
-            continue;
-        if (account.enabled === false)
-            disabled.add(account.anthropicAccountUuid);
-        else
-            disabled.delete(account.anthropicAccountUuid);
-    }
-    const unused = new Set(storage.accounts.filter(isOAuthAccount).map((account) => account.id));
-    const reserved = new Set(storage.accounts.map((account) => account.id));
-    const next = selected
-        .filter((row) => row !== primary)
-        .map((row) => {
-        const existing = storage.accounts.find((account) => isOAuthAccount(account) &&
-            unused.has(account.id) &&
-            account.anthropicAccountUuid === row.accountId);
-        let id = existing?.id ?? routeId(row);
-        // Existing API routes are unrelated and cannot be replaced by discovery.
-        while ((id !== existing?.id && reserved.has(id)) || id === 'main')
-            id = `scoped-${id}`;
-        reserved.add(id);
-        if (existing)
-            unused.delete(existing.id);
-        return {
-            id,
-            label: existing?.label ??
-                preferredLabel(row.credentialId) ??
-                row.email ??
-                row.credentialId,
-            type: 'oauth',
-            enabled: existing
-                ? existing.enabled !== false
-                : !disabled.has(row.accountId),
-            addedAt: existing?.addedAt ?? now,
-            anthropicAccountUuid: row.accountId,
-            claustrumScopedCredentialId: row.credentialId,
-            claustrumScopedState: row.state,
-            authLineageId: `scoped:${createHash('sha256').update(row.accountId).digest('hex')}`,
-            refresh: '',
-            // Provider identity, not rotating bearer material, owns these observations.
-            quota: existing?.quota,
-            profile: existing?.profile,
-            prime: existing?.prime,
-            lastUsed: existing?.lastUsed,
-            lastQuotaRefreshError: existing?.lastQuotaRefreshError,
-        };
-    });
-    const byId = new Map(next.map((account) => [account.id, account]));
-    const ordered = storage.accounts.flatMap((account) => {
-        if (!isOAuthAccount(account))
-            return [account];
-        const replacement = byId.get(account.id);
-        if (!replacement)
-            return [];
-        byId.delete(account.id);
-        return [replacement];
-    });
-    ordered.push(...byId.values());
-    const projected = {
-        ...storage,
-        claustrum: {
-            ...storage.claustrum,
-            scopedRoster: true,
-            primaryAccount: primary
-                ? {
-                    credentialId: primary.credentialId,
-                    accountId: primary.accountId,
-                    state: primary.state,
-                }
-                : undefined,
-            disabledAccountIdentities: [...disabled].sort(),
-        },
-        accounts: ordered,
-    };
-    return { primary, accounts: next, storage: projected, view };
-}
-/**
- * The lease covers LIST and commit, not just the file write: opaque view hashes
- * cannot tell a delayed old response from a newer one. A lost lease is checked
- * while holding the config lock, before any authoritative membership write.
- * Neither local mode nor a failed list can publish an empty inventory.
- */
-export async function refreshClaustrumScopedRoster(options) {
-    options.signal?.throwIfAborted();
-    if (getClaustrumMode(await loadAccounts(options.path)) !== 'claustrum')
-        return undefined;
-    const lease = await acquireRefreshFileLock({
-        name: 'scoped-roster',
-        path: options.path,
-        ttlMs: 30_000,
-        renew: true,
-    });
-    if (!lease)
-        throw new Error('Claustrum account discovery is already in progress');
-    try {
-        if (getClaustrumMode(await loadAccounts(options.path)) !== 'claustrum')
-            return undefined;
-        const inventory = await options.custody.discover(options.signal);
-        options.signal?.throwIfAborted();
-        const result = await mutateAccountsPersistent(options.path, (current) => {
-            if (getClaustrumMode(current) !== 'claustrum')
-                return { storage: current, result: undefined, save: false };
-            const roster = projectClaustrumScopedRoster(current, inventory.accounts, inventory.view, options.now?.());
-            const retained = new Set(roster.storage.accounts.map((account) => account.id));
-            const removedAccountIds = current.accounts
-                .filter((account) => isOAuthAccount(account) && !retained.has(account.id))
-                .map((account) => account.id);
-            return {
-                storage: roster.storage,
-                result: roster,
-                options: { removedAccountIds, preserveExistingAccountOrder: false },
-                save: JSON.stringify(current) !== JSON.stringify(roster.storage),
-            };
-        }, {
-            assertAuthority: async () => {
-                options.signal?.throwIfAborted();
-                await lease.assertOwned();
-            },
-        });
-        if (!result)
-            return undefined;
-        const persisted = await loadAccounts(options.path);
-        options.signal?.throwIfAborted();
-        await lease.assertOwned();
-        if (!persisted || getClaustrumMode(persisted) !== 'claustrum')
-            return undefined;
-        return {
-            ...result,
-            storage: persisted,
-            accounts: persisted.accounts.filter((account) => isOAuthAccount(account) &&
-                Boolean(account.claustrumScopedCredentialId)),
-        };
-    }
-    finally {
-        await lease.release();
-    }
-}

package/dist/claustrum-scoped-runtime.d.ts

@@ -1,28 +0,0 @@
-import { type ClaustrumClientOptions } from '@cortexkit/claustrum-client';
-import { type ClaustrumScopedAttempt, type ClaustrumScopedClient } from './claustrum-scoped.js';
-import { type ClaustrumScopedRoster } from './claustrum-scoped-roster.js';
-export { ClaustrumCredentialError as ClaustrumScopedCredentialError } from '@cortexkit/claustrum-client';
-export declare function connectClaustrumScopedClient(options?: ClaustrumClientOptions): Promise<ClaustrumScopedClient>;
-/** Host-owned lifecycle for metadata discovery. Bearer material is never cached. */
-export interface ClaustrumScopedRuntimeOptions {
-    storagePath: string;
-    tokenPath: string;
-    connect: () => Promise<ClaustrumScopedClient>;
-    onRoster?: (roster: ClaustrumScopedRoster) => void;
-    onError?: () => void;
-    setTimeoutImpl?: typeof setTimeout;
-    clearTimeoutImpl?: typeof clearTimeout;
-    pollIntervalMs?: number;
-}
-export declare class ClaustrumScopedRuntime {
-    #private;
-    constructor(options: ClaustrumScopedRuntimeOptions);
-    snapshot(): ClaustrumScopedRoster | undefined;
-    refresh(): Promise<ClaustrumScopedRoster | undefined>;
-    start(): void;
-    authorize(routeId: string, signal?: AbortSignal): Promise<ClaustrumScopedAttempt>;
-    reportFailure(attempt: ClaustrumScopedAttempt, status: number, source: 'direct' | 'relay_status_field' | 'relay_message_parse'): Promise<void>;
-    fetchQuota(routeId: string, fetchImpl?: typeof fetch): Promise<import("./accounts.js").OAuthQuotaSnapshot>;
-    fetchProfile(routeId: string, fetchImpl?: typeof fetch, signal?: AbortSignal): Promise<import("./accounts.js").OAuthAccountProfile>;
-    close(): void;
-}

package/dist/claustrum-scoped-runtime.js

@@ -1,230 +0,0 @@
-import { ClaustrumClient, } from '@cortexkit/claustrum-client';
-import { fetchOAuthQuotaSnapshot, getClaustrumMode, isOAuthAccount, loadAccounts, } from './accounts.js';
-import { resolveClaustrumConnectionPath } from './claustrum.js';
-import { ClaustrumScopedCustody, } from './claustrum-scoped.js';
-import { refreshClaustrumScopedRoster, } from './claustrum-scoped-roster.js';
-import { fetchOAuthAccountProfile } from './oauth-profile.js';
-export { ClaustrumCredentialError as ClaustrumScopedCredentialError } from '@cortexkit/claustrum-client';
-export function connectClaustrumScopedClient(options = {}) {
-    return ClaustrumClient.connect({
-        ...options,
-        connectionFile: options.connectionFile ?? resolveClaustrumConnectionPath(),
-    });
-}
-export class ClaustrumScopedRuntime {
-    #options;
-    #shutdown = new AbortController();
-    #custody;
-    #connecting;
-    #refreshing;
-    #roster;
-    #timer;
-    #started = false;
-    constructor(options) {
-        this.#options = options;
-    }
-    #assertOpen(signal) {
-        this.#shutdown.signal.throwIfAborted();
-        signal?.throwIfAborted();
-    }
-    #wait(pending, signal) {
-        const combined = AbortSignal.any([
-            this.#shutdown.signal,
-            ...(signal ? [signal] : []),
-        ]);
-        return new Promise((resolve, reject) => {
-            const cleanup = () => combined.removeEventListener('abort', abort);
-            const abort = () => {
-                cleanup();
-                reject(combined.reason);
-            };
-            combined.addEventListener('abort', abort, { once: true });
-            // Observe the operation even after cancellation: shared metadata work may
-            // finish for other callers, and a late connector must still be closed.
-            pending.then((value) => {
-                cleanup();
-                if (combined.aborted)
-                    reject(combined.reason);
-                else
-                    resolve(value);
-            }, (error) => {
-                cleanup();
-                reject(error);
-            });
-            if (combined.aborted)
-                abort();
-        });
-    }
-    async #getCustody() {
-        this.#assertOpen();
-        if (this.#custody)
-            return this.#custody;
-        if (!this.#connecting) {
-            this.#connecting = this.#options
-                .connect()
-                .then((client) => {
-                if (this.#shutdown.signal.aborted) {
-                    client.close();
-                    this.#assertOpen();
-                }
-                this.#custody = new ClaustrumScopedCustody({
-                    client,
-                    tokenPath: this.#options.tokenPath,
-                });
-                return this.#custody;
-            })
-                .finally(() => {
-                this.#connecting = undefined;
-            });
-        }
-        return this.#wait(this.#connecting);
-    }
-    snapshot() {
-        return this.#roster;
-    }
-    refresh() {
-        this.#assertOpen();
-        if (this.#refreshing)
-            return this.#refreshing;
-        this.#refreshing = (async () => {
-            if (getClaustrumMode(await loadAccounts(this.#options.storagePath)) !==
-                'claustrum') {
-                this.#roster = undefined;
-                this.#custody?.close();
-                this.#custody = undefined;
-                return undefined;
-            }
-            const custody = await this.#getCustody();
-            const roster = await refreshClaustrumScopedRoster({
-                path: this.#options.storagePath,
-                custody,
-                signal: this.#shutdown.signal,
-            });
-            this.#assertOpen();
-            this.#roster = roster;
-            if (roster)
-                this.#options.onRoster?.(roster);
-            return roster;
-        })().finally(() => {
-            this.#refreshing = undefined;
-        });
-        return this.#refreshing;
-    }
-    start() {
-        if (this.#started)
-            return;
-        this.#assertOpen();
-        this.#started = true;
-        const tick = async () => {
-            try {
-                await this.refresh();
-            }
-            catch {
-                if (!this.#shutdown.signal.aborted)
-                    this.#options.onError?.();
-            }
-            if (this.#shutdown.signal.aborted)
-                return;
-            const delay = this.#options.pollIntervalMs ?? 5_000;
-            if (delay <= 0)
-                return;
-            this.#timer = (this.#options.setTimeoutImpl ?? setTimeout)(() => {
-                this.#timer = undefined;
-                void tick();
-            }, delay);
-            this.#timer.unref?.();
-        };
-        void tick();
-    }
-    async authorize(routeId, signal) {
-        this.#assertOpen(signal);
-        const roster = this.#roster ?? (await this.#wait(this.refresh(), signal));
-        const current = await loadAccounts(this.#options.storagePath);
-        this.#assertOpen(signal);
-        if (!roster || getClaustrumMode(current) !== 'claustrum')
-            throw new Error('Claustrum scoped custody is not active');
-        let credentialId;
-        let accountId;
-        if (routeId === 'main') {
-            const primary = current?.claustrum?.primaryAccount;
-            if (roster.primary?.state !== 'active' ||
-                primary?.state !== 'active' ||
-                primary.accountId !== roster.primary.accountId ||
-                primary.credentialId !== roster.primary.credentialId)
-                throw new Error('Claustrum primary account is unavailable or changed');
-            credentialId = roster.primary.credentialId;
-            accountId = roster.primary.accountId;
-            if (current?.claustrum?.disabledAccountIdentities?.includes(accountId)) {
-                throw new Error('Claustrum primary account is disabled');
-            }
-        }
-        else {
-            const observed = roster.accounts.find((account) => account.id === routeId);
-            const configured = current?.accounts.find((account) => account.id === routeId);
-            if (!observed ||
-                !configured ||
-                !isOAuthAccount(configured) ||
-                configured.enabled === false ||
-                configured.claustrumScopedState !== 'active' ||
-                configured.claustrumScopedCredentialId !==
-                    observed.claustrumScopedCredentialId ||
-                configured.anthropicAccountUuid !== observed.anthropicAccountUuid) {
-                throw new Error('Claustrum route is disabled, removed or changed');
-            }
-            credentialId = observed.claustrumScopedCredentialId;
-            accountId = observed.anthropicAccountUuid;
-        }
-        if (!credentialId || !accountId)
-            throw new Error('Claustrum route has no verified identity');
-        return (await this.#wait(this.#getCustody(), signal)).authorize({ credentialId, accountId }, AbortSignal.any([this.#shutdown.signal, ...(signal ? [signal] : [])]));
-    }
-    async reportFailure(attempt, status, source) {
-        this.#assertOpen();
-        if (!this.#custody)
-            throw new Error('Claustrum dispatch receipt has no active owner');
-        await this.#custody.reportFailure(attempt, status, source);
-    }
-    async fetchQuota(routeId, fetchImpl = fetch) {
-        const attempt = await this.authorize(routeId);
-        return fetchOAuthQuotaSnapshot({
-            accessToken: attempt.accessToken,
-            fetchImpl: this.#fetchForAttempt(attempt, fetchImpl),
-        });
-    }
-    async fetchProfile(routeId, fetchImpl = fetch, signal) {
-        const attempt = await this.authorize(routeId, signal);
-        return fetchOAuthAccountProfile({
-            accessToken: attempt.accessToken,
-            accountIdentity: attempt.accountId,
-            providerAccountUuid: attempt.accountId,
-            signal,
-            fetchImpl: this.#fetchForAttempt(attempt, fetchImpl),
-        });
-    }
-    #fetchForAttempt(attempt, fetchImpl) {
-        return Object.assign(async (input, init) => {
-            this.#assertOpen();
-            const response = await fetchImpl(input, {
-                ...init,
-                signal: AbortSignal.any([
-                    this.#shutdown.signal,
-                    ...(init?.signal ? [init.signal] : []),
-                ]),
-            });
-            if (response.status === 401) {
-                await this.reportFailure(attempt, response.status, 'direct').catch(() => this.#options.onError?.());
-            }
-            return response;
-        }, { preconnect: fetchImpl.preconnect });
-    }
-    close() {
-        if (this.#shutdown.signal.aborted)
-            return;
-        this.#shutdown.abort(new Error('Claustrum scoped runtime is closed'));
-        if (this.#timer)
-            (this.#options.clearTimeoutImpl ?? clearTimeout)(this.#timer);
-        this.#timer = undefined;
-        this.#custody?.close();
-        this.#roster = undefined;
-    }
-}

package/dist/claustrum-scoped.d.ts

@@ -1,39 +0,0 @@
-import { type ClaustrumClient, type ClaustrumReporterSource, type EnrollmentTokenFile } from '@cortexkit/claustrum-client';
-export type ClaustrumScopedClient = Pick<ClaustrumClient, 'listScoped' | 'getScoped' | 'reportAuthFailureScoped' | 'close'>;
-export interface ClaustrumScopedIdentity {
-    readonly credentialId: string;
-    readonly accountId: string;
-}
-export interface ClaustrumScopedAccount extends ClaustrumScopedIdentity {
-    readonly state: string;
-    readonly email?: string;
-    readonly orgName?: string;
-}
-export interface ClaustrumScopedAttempt extends ClaustrumScopedIdentity {
-    /** Non-enumerable, memory-only bearer. Authorize again for every dispatch/retry. */
-    readonly accessToken: string;
-    readonly recordVersion: number;
-    readonly expiresAtMs: number;
-}
-/**
- * Shared OpenCode/Pi scoped read plane. There is intentionally no credential cache,
- * handle fallback, or get single-flight: each outgoing attempt must be authorized
- * by the daemon, including attempts made after a successful earlier request.
- * Enrollment tokens are re-read per operation so operator reissue works on disk.
- */
-export declare class ClaustrumScopedCustody {
-    #private;
-    constructor(options: {
-        client: ClaustrumScopedClient;
-        tokenPath?: string;
-        readToken?: () => Promise<EnrollmentTokenFile>;
-        now?: () => number;
-    });
-    discover(signal?: AbortSignal): Promise<{
-        view: string;
-        accounts: readonly ClaustrumScopedAccount[];
-    }>;
-    authorize(identity: ClaustrumScopedIdentity, signal?: AbortSignal): Promise<ClaustrumScopedAttempt>;
-    reportFailure(attempt: ClaustrumScopedAttempt, status: number, reporterSource: ClaustrumReporterSource): Promise<void>;
-    close(): void;
-}

package/dist/claustrum-scoped.js

@@ -1,193 +0,0 @@
-import { ClaustrumCredentialError, } from '@cortexkit/claustrum-client';
-import { CUSTODY_TOMBSTONE_PREFIX } from './claustrum.js';
-import { readClaustrumEnrollmentToken } from './claustrum-enrollment.js';
-import { parseJsonRedacted } from './json.js';
-const SERVING_MARGIN_MS = 300_000;
-function accessTokenFromMaterial(material) {
-    let access = material.trim();
-    if (access.startsWith('{')) {
-        let parsed;
-        try {
-            parsed = parseJsonRedacted(access);
-        }
-        catch {
-            throw new Error('Claustrum returned invalid OAuth material');
-        }
-        if (!parsed || typeof parsed !== 'object') {
-            throw new Error('Claustrum returned invalid OAuth material');
-        }
-        const record = parsed;
-        const value = record.access_token ?? record.access;
-        access = typeof value === 'string' ? value : '';
-    }
-    if (!/^[\x21-\x7e]+$/.test(access) ||
-        access.startsWith(CUSTODY_TOMBSTONE_PREFIX)) {
-        throw new Error('Claustrum returned invalid OAuth material');
-    }
-    return access;
-}
-/**
- * Shared OpenCode/Pi scoped read plane. There is intentionally no credential cache,
- * handle fallback, or get single-flight: each outgoing attempt must be authorized
- * by the daemon, including attempts made after a successful earlier request.
- * Enrollment tokens are re-read per operation so operator reissue works on disk.
- */
-export class ClaustrumScopedCustody {
-    #client;
-    #readToken;
-    #now;
-    #provenance = new WeakMap();
-    #reports = new WeakMap();
-    #closed = false;
-    constructor(options) {
-        const tokenPath = options.tokenPath;
-        if (options.readToken) {
-            this.#readToken = options.readToken;
-        }
-        else if (tokenPath) {
-            this.#readToken = () => readClaustrumEnrollmentToken(tokenPath);
-        }
-        else {
-            throw new Error('Claustrum enrollment token path is required');
-        }
-        this.#client = options.client;
-        this.#now = options.now ?? Date.now;
-    }
-    #check(signal) {
-        if (this.#closed)
-            throw new Error('Claustrum scoped custody is closed');
-        signal?.throwIfAborted();
-    }
-    async #token(signal) {
-        this.#check(signal);
-        const value = await this.#readToken();
-        this.#check(signal);
-        if (!/^[0-9a-f]{64}$/.test(value.token) ||
-            !Number.isSafeInteger(value.token_generation) ||
-            value.token_generation < 1) {
-            throw new Error('Invalid Claustrum enrollment token');
-        }
-        return value.token;
-    }
-    async #call(operation, signal) {
-        this.#check(signal);
-        let result;
-        let removeAbortListener;
-        try {
-            const pending = operation();
-            result = signal
-                ? await Promise.race([
-                    pending,
-                    new Promise((_resolve, reject) => {
-                        const abort = () => reject(signal.reason);
-                        signal.addEventListener('abort', abort, { once: true });
-                        removeAbortListener = () => signal.removeEventListener('abort', abort);
-                        if (signal.aborted)
-                            abort();
-                    }),
-                ])
-                : await pending;
-        }
-        catch (error) {
-            this.#check(signal);
-            // Preserve producer-owned classifications, never arbitrary transport text
-            // which may echo request params containing the enrollment bearer.
-            if (error instanceof ClaustrumCredentialError)
-                throw error;
-            throw new Error('Claustrum scoped operation unavailable');
-        }
-        finally {
-            removeAbortListener?.();
-        }
-        this.#check(signal);
-        return result;
-    }
-    async discover(signal) {
-        const token = await this.#token(signal);
-        const inventory = await this.#call(() => this.#client.listScoped(token), signal);
-        const seen = new Set();
-        const accounts = [];
-        for (const row of inventory.rows) {
-            if (row.refreshAdapter !== 'anthropic' ||
-                row.credentialType !== 'oauth' ||
-                !row.operations.includes('read'))
-                continue;
-            if (!row.id || !row.accountId?.trim() || seen.has(row.id)) {
-                throw new Error('Claustrum inventory has missing or ambiguous account identity');
-            }
-            seen.add(row.id);
-            accounts.push(Object.freeze({
-                credentialId: row.id,
-                accountId: row.accountId,
-                state: row.state,
-                ...(row.email !== undefined && { email: row.email }),
-                ...(row.orgName !== undefined && { orgName: row.orgName }),
-            }));
-        }
-        return { view: inventory.view, accounts: Object.freeze(accounts) };
-    }
-    async authorize(identity, signal) {
-        if (!identity.credentialId || !identity.accountId)
-            throw new Error('Claustrum dispatch requires account identity');
-        // Capture caller fields before yielding so mutation cannot change the fence.
-        const { credentialId, accountId } = identity;
-        const token = await this.#token(signal);
-        const served = await this.#call(() => this.#client.getScoped({
-            credentialId,
-            enrollmentToken: token,
-            minTtlMs: SERVING_MARGIN_MS,
-        }), signal);
-        if (served.credentialId !== credentialId ||
-            served.accountId !== accountId) {
-            throw new Error('Claustrum served credential identity changed');
-        }
-        if (!Number.isSafeInteger(served.recordVersion) ||
-            served.recordVersion < 0 ||
-            served.expiresAtMs === null ||
-            !Number.isFinite(served.expiresAtMs) ||
-            served.expiresAtMs - this.#now() < SERVING_MARGIN_MS) {
-            throw new Error('Claustrum served credential has insufficient validity');
-        }
-        const accessToken = accessTokenFromMaterial(served.material);
-        const attempt = Object.freeze(Object.defineProperty({
-            credentialId,
-            accountId,
-            recordVersion: served.recordVersion,
-            expiresAtMs: served.expiresAtMs,
-        }, 'accessToken', { value: accessToken, enumerable: false }));
-        this.#provenance.set(attempt, token);
-        return attempt;
-    }
-    async reportFailure(attempt, status, reporterSource) {
-        if (status !== 401)
-            return;
-        this.#check();
-        const token = this.#provenance.get(attempt);
-        if (!token)
-            throw new Error('Claustrum failure report requires an original dispatch receipt');
-        const pending = this.#reports.get(attempt);
-        if (pending)
-            return pending;
-        const report = this.#call(() => this.#client.reportAuthFailureScoped({
-            credentialId: attempt.credentialId,
-            enrollmentToken: token,
-            providerStatus: 401,
-            recordVersion: attempt.recordVersion,
-            reporterSource,
-        }));
-        this.#reports.set(attempt, report);
-        try {
-            await report;
-        }
-        catch (error) {
-            this.#reports.delete(attempt);
-            throw error;
-        }
-    }
-    close() {
-        if (this.#closed)
-            return;
-        this.#closed = true;
-        this.#client.close();
-    }
-}