@cortexkit/anthropic-auth-core 2.0.0 → 2.0.1

package/README.md

@@ -1,6 +1,21 @@
 # @cortexkit/anthropic-auth-core
 
-Shared Anthropic OAuth, stable account identity, optional Claustrum fallback-custody primitives, model metadata, quota, host-local quota feed, routing, cache, cache-keepalive, fast mode, relay, dump, request-signing, thinking-binding, and Fable 5.1 mid-conversation effort helpers used by CortexKit's OpenCode and Pi integrations.
+Internal implementation package for CortexKit's OpenCode and Pi integrations. Apart from the named public surface below, exports are internal host-support APIs with **no stability promise**.
+
+## Public, stable surface
+
+These root exports are public and stable for external callers, including Synapse's Anthropic request client:
+
+- `resolveClaudeCodeIdentity`
+- `buildBillingHeaderValue`
+- `CLAUDE_CODE_ENTRYPOINT`
+- `CLAUDE_CODE_IDENTITY`
+- `applyClaudeCodeMetadata`
+- `applyClaudeCodeHeaders`
+- `signRequestBody`
+- `orderClaudeCodeBody`
+
+The export-manifest test pins these names to the actual root barrel. Legacy sidecar writers and pre-native scoped runtime APIs are removed; host credentials and settings use native storage. Upgrade migration and one-time vault seeding still read the old sidecar format.
 
 User-facing packages:
 

package/dist/accounts.d.ts

@@ -1,6 +1,6 @@
 import type { ProviderAccountUuid } from './claude-code.ts';
 import { type Cache1hMode } from './constants.ts';
-import { type LogLevel } from './logger.ts';
+import type { LogLevel } from './logger.ts';
 export type { ProviderAccountUuid } from './claude-code.ts';
 export declare const ACCOUNT_FILE_NAME = "anthropic-auth.json";
 export declare const ACCOUNT_STATE_FILE_NAME = "anthropic-auth-state.json";
@@ -295,66 +295,17 @@ export type AccountStateSaveScope = {
     mainPrime?: boolean;
     accounts?: true | string[];
 };
-export type AccountManagerOptions = {
-    now?: () => number;
-    fetchImpl?: typeof fetch;
-    configPath?: string;
-    quotaManager?: import('./quota-manager.ts').QuotaManager;
-    isFallbackAccountVaultServed?: (accountId: string, storage: AccountStorage) => boolean;
-    isFallbackAccountVaultEnabled?: (accountId: string, storage: AccountStorage) => boolean;
-    resolveFallbackAccessToken?: (account: OAuthAccount, storage: AccountStorage) => {
-        token: string;
-        source: 'vault' | 'sidecar';
-    } | undefined;
-    onBackgroundRefresh?: (initial?: boolean) => Promise<void> | void;
-    onFallbackStorageChanged?: () => void;
-    setIntervalImpl?: typeof globalThis.setInterval;
-    clearIntervalImpl?: typeof globalThis.clearInterval;
-};
-export type AccountRefreshError = {
-    accountId: string;
-    message: string;
-};
 export declare const FALLBACK_BACKGROUND_TICK_MS = 60000;
 export declare function getAccountStoragePath(): string;
 export declare function getAccountStatePath(configPath?: string): string;
 export declare function createEmptyStorage(): AccountStorage;
 export declare function mergeMainQuotaErrorClearedAt(existing: number | undefined, incoming: number | undefined): number | undefined;
 export declare function mergeMainRefreshErrorClearedAt(existing: number | undefined, incoming: number | undefined): number | undefined;
-export declare function loadAccounts(path?: string): Promise<AccountStorage | null>;
 /** Returns the latest timestamp carried by any quota snapshot window. */
 export declare function quotaSnapshotCheckedAt(quota: OAuthQuotaSnapshot | undefined): number;
 export declare function quotaFieldSource(snapshot: OAuthQuotaSnapshot | undefined, field: QuotaFieldName): QuotaFieldSource | undefined;
 export declare function mergeHeaderQuotaForPersistence(existing: OAuthQuotaSnapshot | undefined, incoming: OAuthQuotaSnapshot): OAuthQuotaSnapshot;
 export declare function getClaustrumMode(storage: AccountStorage | null): ClaustrumMode;
-export declare function setClaustrumModePersistent(mode: ClaustrumMode, path?: string): Promise<'changed' | 'unchanged'>;
-export interface SaveAccountsOptions {
-    /** Account ids intentionally removed by this mutation. */
-    removedAccountIds?: readonly string[];
-    /** Preserve disk order when a stale snapshot is missing newer accounts. */
-    preserveExistingAccountOrder?: boolean;
-}
-export declare function saveAccounts(storage: AccountStorage, path?: string, options?: SaveAccountsOptions): Promise<void>;
-/** Read-modify-write account configuration under the existing config/state lock order.
- * The callback is synchronous: network discovery must happen under its own outer
- * lease, never while holding the config lock. Do not call another persistence API
- * from the callback.
- */
-export declare function mutateAccountsPersistent<T>(path: string, mutate: (storage: AccountStorage) => {
-    storage: AccountStorage;
-    result: T;
-    options?: SaveAccountsOptions;
-    save?: boolean;
-}, options?: {
-    assertAuthority?: () => Promise<void>;
-}): Promise<T>;
-export declare function getOrCreateMainAccountId(path?: string, createId?: () => string): Promise<string>;
-export declare function saveAccountState(storage: AccountStorage, path?: string, scope?: AccountStateSaveScope): Promise<void>;
-export declare function saveOAuthProfileState(input: {
-    accountId: 'main' | string;
-    profile: OAuthAccountProfile | undefined;
-    accountIdentity?: string;
-}, path?: string): Promise<boolean>;
 export declare function acquireRefreshFileLock(options: {
     name: string;
     ttlMs: number;
@@ -369,30 +320,10 @@ export declare function acquireRefreshFileLock(options: {
 } | null>;
 export declare function isCache1hPersistentlyEnabled(storage: AccountStorage | null): boolean;
 export declare function getCache1hPersistentMode(storage: AccountStorage | null): Cache1hMode;
-export declare function setCache1hPersistentEnabled(enabled: boolean, mode?: Cache1hMode, path?: string): Promise<AccountStorage>;
-export declare function setCache1hPersistentMode(mode: Cache1hMode, path?: string): Promise<AccountStorage>;
 export declare function isDumpPersistentlyEnabled(storage: AccountStorage | null): boolean;
-export declare function setDumpPersistentEnabled(enabled: boolean, path?: string): Promise<AccountStorage>;
 export declare function isFastModePersistentlyEnabled(storage: AccountStorage | null): boolean;
-export declare function setFastModePersistentEnabled(enabled: boolean, path?: string): Promise<AccountStorage>;
-export declare function setCacheKeepPersistentWindow(startHour: number, endHour: number, path?: string): Promise<AccountStorage>;
-export declare function setCacheKeepPersistentAlways(path?: string): Promise<AccountStorage>;
-export declare function setCacheKeepPersistentEnabled(enabled: boolean, path?: string): Promise<AccountStorage>;
 export declare function isCacheKeepSubagentsEnabled(storage: AccountStorage | null): boolean;
-export declare function setCacheKeepSubagentsEnabled(enabled: boolean, path?: string): Promise<AccountStorage>;
 export declare function isPrimePersistentlyEnabled(storage: AccountStorage | null): boolean;
-export declare function setPrimePersistentEnabled(enabled: boolean, path?: string): Promise<AccountStorage>;
-/** Return the stable prime marker identity for an OAuth account. */
-export declare function getOrCreatePrimeAuthLineageId(accountId: 'main' | string, path?: string): Promise<string | undefined>;
-/**
- * Atomically increment an account's cumulative prime counters and persist via
- * the scoped runtime-state path. The `main` account lives at state.main.prime;
- * every other account lives at state.accounts[id].prime. Config-side writes
- * are intentionally NOT triggered so prime counters cannot leak into
- * `anthropic-auth.json`. Callers should not depend on this function to mutate
- * the caller's storage object.
- */
-export declare function incrementPrimeUsagePersistent(accountId: 'main' | string, usage: PrimeUsageDelta, path?: string, now?: number): Promise<PrimeUsageCounters>;
 export declare function shouldFallbackStatus(status: number, storage: AccountStorage | null): boolean;
 export declare function getQuotaMinimumRemainingThresholds(storage: AccountStorage | null): {
     five_hour: number;
@@ -438,7 +369,6 @@ export declare function quotaBackoffActive(error: AccountOperationError | undefi
 export declare function formatQuotaBackoffMessage(error: AccountOperationError, now: number): string;
 export declare function getQuotaCheckIntervalMs(storage: AccountStorage | null): number;
 export declare function getPersistedLogLevel(storage: AccountStorage | null): LogLevel | undefined;
-export declare function setLogLevelPersistent(level: LogLevel, path?: string): Promise<void>;
 export declare function getPersistedMainQuota(storage: AccountStorage | null): {
     quota: OAuthQuotaSnapshot;
     checkedAt: number;
@@ -482,86 +412,10 @@ export declare function killswitchRetryAfterSeconds(mainQuota: OAuthQuotaSnapsho
     quota?: OAuthQuotaSnapshot;
 }>, now: number, scopedModelId?: string): number;
 export declare function getKillswitchConfig(storage: AccountStorage | null): KillswitchConfig;
-export declare function setKillswitchPersistent(config: KillswitchConfig, path?: string): Promise<AccountStorage>;
-export declare function removeAccountPersistent(id: string, path?: string): Promise<boolean>;
-export declare function reorderAccountsPersistent(orderedIds: string[], path?: string): Promise<void>;
-export declare function setAccountEnabledPersistent(id: string, enabled: boolean, path?: string): Promise<boolean>;
-export declare function addAccountPersistent(account: FallbackAccount, path?: string): Promise<void>;
 export declare function getQuotaNextRefreshAt(quota: OAuthQuotaSnapshot | undefined, storage: AccountStorage | null, now: number): number;
 export declare function fetchOAuthQuotaSnapshot(input: {
     accessToken: string;
     fetchImpl?: typeof fetch;
     now?: () => number;
 }): Promise<OAuthQuotaSnapshot>;
-export declare function upsertAccount(storage: AccountStorage, account: FallbackAccount): void;
-export declare function persistFallbackQuotaHeaderPersistent(input: {
-    accountId: string;
-    authLineageId?: string;
-    quota: OAuthQuotaSnapshot;
-    anthropicAccountUuid?: ProviderAccountUuid;
-}, path?: string): Promise<boolean>;
 export declare function fallbackAccountUuidForLineage(account: OAuthAccount | undefined, authLineageId?: string): string | null;
-export declare function removeAccount(storage: AccountStorage, id: string): boolean;
-export declare function reorderAccounts(storage: AccountStorage, orderedIds: string[]): void;
-export declare function setAccountEnabled(storage: AccountStorage, id: string, enabled: boolean): boolean;
-export declare class FallbackAccountManager {
-    private readonly now;
-    private readonly fetchImpl;
-    private readonly configPath;
-    private readonly refreshPromises;
-    private readonly custodyVerificationAccounts;
-    private refreshTimer;
-    private quotaTimer;
-    readonly quotaManager: import('./quota-manager.ts').QuotaManager | null;
-    private readonly isFallbackAccountVaultServed;
-    private readonly isFallbackAccountVaultEnabled;
-    private readonly resolveFallbackAccessToken;
-    private readonly onBackgroundRefresh;
-    private readonly onFallbackStorageChanged;
-    private readonly setIntervalImpl;
-    private readonly clearIntervalImpl;
-    constructor(options?: AccountManagerOptions);
-    /**
-     * Seed QuotaManager from persisted account.quota if no cache entry exists
-     * yet. Prevents unnecessary API calls when the on-disk snapshot is fresh.
-     */
-    private seedFallbackQuota;
-    load(): Promise<AccountStorage | null>;
-    save(storage: AccountStorage, accountIds?: string[]): Promise<void>;
-    startBackgroundRefresh(): Promise<void>;
-    stopBackgroundRefresh(): void;
-    withAccountRefreshLock<T>(accountId: string, fn: () => Promise<T>): Promise<T>;
-    getUsableFallbackAccounts(existingStorage?: AccountStorage | null, options?: {
-        modelId?: string;
-    }): Promise<OAuthAccount[]>;
-    markUsed(account: FallbackAccount): Promise<void>;
-    accountPassesQuotaPolicy(account: OAuthAccount, storage: AccountStorage | null, options?: {
-        modelId?: string;
-    }): boolean;
-    /**
-     * Return the account with its quota overlaid from the unified QuotaManager
-     * cache (token-bound) when available, so quota-policy decisions use the same
-     * source of truth as the staleness check. Falls back to the stored
-     * account.quota when no manager is wired or the cache has no entry.
-     */
-    private quotaPolicyAccount;
-    refreshDueAccounts(): Promise<void>;
-    refreshQuotaForDueAccounts(): Promise<void>;
-    refreshQuotaForAllAccounts(options?: {
-        force?: boolean;
-    }): Promise<{
-        storage: AccountStorage | null;
-        errors: AccountRefreshError[];
-    }>;
-    refreshAccount(account: OAuthAccount, storage: AccountStorage, options?: {
-        force?: boolean;
-        persistError?: boolean;
-    }): Promise<OAuthAccount>;
-    private waitForConcurrentFallbackRefresh;
-    private refreshAccountNow;
-    refreshAccountQuota(account: OAuthAccount, storage: AccountStorage): Promise<{
-        account: OAuthAccount;
-        fetched: boolean;
-        changed: boolean;
-    }>;
-}

package/dist/index.d.ts

@@ -7,9 +7,6 @@ export * from './cch.ts';
 export * from './claude-code.ts';
 export * from './claustrum.ts';
 export * from './claustrum-enrollment.ts';
-export * from './claustrum-scoped.ts';
-export * from './claustrum-scoped-roster.ts';
-export * from './claustrum-scoped-runtime.ts';
 export * from './commands/account.ts';
 export * from './constants.ts';
 export * from './custom-headers.ts';
@@ -46,6 +43,7 @@ export { NativeMigrationError, prepareNativeMigration, releaseNativeMigrationPre
 export type { NativeCommittedMaterial, NativeIdentityBootstrap, NativeRefreshContext, NativeRefreshDispatchVersion, NativeRefreshFailure, NativeRefreshHandoff, NativeRefreshObservation, NativeRefreshRequest, NativeRefreshRestriction, NativeRefreshResult, NativeRefreshSubject, NativeServingAdmission, } from './native-refresh-coordinator.ts';
 export type { NativeLocalFailureAttribution, NativeLocalFailurePolicy, NativeLocalFailureSkipReason, } from './native-runtime.ts';
 export { nativeRuntimeOptionIdentity } from './native-runtime-registry.ts';
+export * from './native-settings.ts';
 export { isNativeTransientAccountError, NativeTransientAccountError, } from './native-transient-account.ts';
 export type { CommandApplyRequest, CommandApplyResult, CommandDialogPayload, CommandInvocation, CommandMenu, CommandMenuModel, KnobValue, KnobValues, MenuAction, MenuItem, MenuKnob, MenuSection, NativeUiOptions, NotifyKind, SectionSlot, } from './native-ui.ts';
 export { createNativeUi, parseApplyRequest, runPiCommandMenu, } from './native-ui.ts';