@cortexkit/anthropic-auth-core 2.0.0 → 2.0.2

package/dist/internal-types/fs/refresh-file-lock.d.ts

@@ -29,5 +29,5 @@ export declare function acquireRefreshFileLock(options: {
     onContended?: () => void;
     /** Synchronous, never awaited; throws and returned promise/thenable rejections are isolated. */
     onRenewalTimer?: (event: 'scheduled' | 'cancelled') => void;
-    onStep?: (step: 'stale-marker-stat' | 'stale-marker-claimed' | 'stale-lock-observed' | 'stale-lock-confirmed' | 'stale-lock-removed' | 'stale-lock-recreated' | 'eviction-marker-acquired' | 'renewal-owner-confirmed' | 'renewal-marker-unavailable' | 'renewal-write-fenced' | 'renewal-write-ready' | 'relinquish-read' | 'renewal-finished' | 'release-owner-confirmed') => void | Promise<void>;
+    onStep?: (step: 'stale-marker-stat' | 'stale-marker-claimed' | 'stale-lock-observed' | 'lock-read-ready' | 'lock-missing' | 'stale-lock-confirmed' | 'stale-lock-removed' | 'stale-lock-recreated' | 'eviction-marker-acquired' | 'renewal-owner-confirmed' | 'renewal-marker-unavailable' | 'renewal-write-fenced' | 'renewal-write-ready' | 'renewal-write-finished' | 'relinquish-read' | 'renewal-finished' | 'release-owner-confirmed') => void | Promise<void>;
 }): Promise<RefreshFileLock | null>;

package/dist/internal-types/logger/engine.d.ts

@@ -62,11 +62,10 @@ export interface LoggerInstance {
     /** Operator override of the level floor; undefined removes it. */
     setLogLevel(level: Level | undefined): void;
     /**
-     * Write whatever is buffered. Safe to call synchronously from a
-     * process-exit handler, which is how each host drains the buffer on
-     * shutdown.
+     * On Windows this returns a promise and must be awaited before shutdown;
+     * synchronous process-exit flushing remains available on POSIX only.
      */
-    flushLogs(): void;
+    flushLogs(): void | Promise<void>;
 }
 /**
  * A logger instance of its own, configured with `options`. A plugin whose
@@ -84,11 +83,10 @@ export declare function createLoggerInstance(options: LoggerOptions): LoggerInst
 export declare function initLogger(options: LoggerOptions): LoggerInstance;
 export declare function setLogLevel(l: Level | undefined): void;
 /**
- * Write whatever the default logger has buffered. Safe to call synchronously
- * from a process-exit handler, which is how each host drains the buffer on
- * shutdown.
+ * Write whatever the default logger has buffered. On Windows await the
+ * promise before shutdown; POSIX keeps synchronous process-exit flushing.
  */
-export declare function flushLogs(): void;
+export declare function flushLogs(): void | Promise<void>;
 export declare function createLogger(channel: string): ChannelLogger;
 export declare function flushForTest(): Promise<void>;
 /**

package/dist/internal-types/pi-slot/slot.d.ts

@@ -5,6 +5,8 @@ export declare class PiSlotError extends Error {
     constructor(code: PiSlotErrorCode);
 }
 export interface PiSlotOptions {
+    /** Windows checks safe ancestry and creates missing parents owner-only, regardless of this option. POSIX keeps its existing directory policy. */
+    privateParents?: boolean;
     authPath: string;
     provider: string;
     /**

package/dist/internal-types/quota/codec.d.ts

@@ -1,5 +1,7 @@
 export interface QuotaCodec {
     readonly validate: (value: unknown) => boolean;
+    /** Normalize persisted data before validation; older codecs may omit this. */
+    readonly decode?: (value: unknown) => unknown;
     readonly merge: (stored: unknown, observation: unknown) => unknown;
 }
 /**

package/dist/internal-types/quota/index.d.ts

@@ -2,8 +2,8 @@ export type { QuotaCodec } from './codec.js';
 export { quotaCodec } from './codec.js';
 export type { QuotaTextForm, QuotaTextOptions } from './format.js';
 export { formatQuota, NO_LIMITS_REPORTED, NO_QUOTA_READING, QUOTA_STALE_AFTER_MS, quotaTextParts, quotaWindowName, } from './format.js';
-export type { CreditBudgetCleared, CreditBudgetEntry, CreditBudgetReading, QuotaAbsentEntry, QuotaEntry, QuotaMap, QuotaReadingEntry, QuotaRetiredEntry, } from './map.js';
-export { ALL_SCOPE, DEFAULT_REQUIRED_LABELS, emptyQuotaMap, isQuotaMap, } from './map.js';
+export type { CreditBudgetCleared, CreditBudgetEntry, CreditBudgetReading, QuotaAbsentEntry, QuotaCounter, QuotaEntry, QuotaMap, QuotaReadingEntry, QuotaRetiredEntry, } from './map.js';
+export { ALL_SCOPE, DEFAULT_REQUIRED_LABELS, decodeQuotaMap, emptyQuotaMap, isQuotaMap, } from './map.js';
 export type { ObservedBudget, ObservedPair, ObservedReading, QuotaObservation, } from './merge.js';
 export { isQuotaObservation, mergeQuotaObservation, QuotaCodecError, } from './merge.js';
 export type { ExhaustionReset, ProjectedBudget, ProjectedLimit, ProjectedQuota, } from './projection.js';

package/dist/internal-types/quota/map.d.ts

@@ -44,16 +44,27 @@ export interface CreditBudgetCleared {
     checkedAt: number;
 }
 export type CreditBudgetEntry = CreditBudgetReading | CreditBudgetCleared;
+export interface QuotaCounter {
+    value: number;
+    checkedAt: number;
+}
 export interface QuotaMap {
     limits: QuotaEntry[];
     /** Absent means no observation has reported on the budget yet. */
     budget?: CreditBudgetEntry;
+    /** Provider-named counts, each with its own observation time. */
+    counters?: Record<string, QuotaCounter>;
 }
 export declare function emptyQuotaMap(): QuotaMap;
 /** The time an entry speaks for: its reading, retirement or absence time. */
 export declare function entryTime(entry: QuotaEntry): number;
 export declare function limitKey(scope: string, label: string): string;
 export declare function isCreditBudgetEntry(value: unknown): value is CreditBudgetEntry;
+export declare function isQuotaCounters(value: unknown): value is Record<string, QuotaCounter>;
+/** Keep usable counters without letting one malformed count hide a quota map. */
+export declare function readQuotaCounters(value: unknown): Record<string, QuotaCounter> | undefined;
+/** Decode persisted quota, dropping malformed counters but not limit evidence. */
+export declare function decodeQuotaMap(value: unknown): QuotaMap | undefined;
 /**
  * True when `value` is a well-formed quota map. Unrecognised top-level keys
  * are tolerated (and preserved by merge) so a newer writer's additions

package/dist/internal-types/quota/merge.d.ts

@@ -1,4 +1,4 @@
-import { type QuotaMap } from './map.js';
+import { type QuotaCounter, type QuotaMap } from './map.js';
 export interface ObservedReading {
     /** Defaults to `all`. */
     scope?: string;
@@ -32,6 +32,8 @@ export interface QuotaObservation {
     coverage?: ObservedPair[];
     /** Absent means the observation says nothing about the budget. */
     budget?: ObservedBudget;
+    /** Each named count uses its own time, independently of limits and budget. */
+    counters?: Record<string, QuotaCounter>;
 }
 /** Thrown by `mergeQuotaObservation` when either argument is malformed. */
 export declare class QuotaCodecError extends TypeError {

package/dist/internal-types/quota/projection.d.ts

@@ -1,4 +1,4 @@
-import { type QuotaMap } from './map.js';
+import { type QuotaCounter, type QuotaMap } from './map.js';
 export interface ProjectedLimit {
     scope: string;
     label: string;
@@ -30,6 +30,7 @@ export interface ProjectedQuota {
     checkedAt?: number;
     /** Present only when the stored budget is a reading, not cleared. */
     budget?: ProjectedBudget;
+    counters?: Record<string, QuotaCounter>;
 }
 /**
  * Resolves `map` for a request in `scope` (`all` or a model family). A family

package/dist/internal-types/store/pool.d.ts

@@ -66,6 +66,7 @@ export interface OpenPoolStoreOptions {
     hold?: (point: HoldPoint, rowId: string) => void | Promise<void>;
     onLockEvent?: LockEnvironment['onLockEvent'];
     onLockStep?: LockEnvironment['onLockStep'];
+    onRenewalTimer?: LockEnvironment['onRenewalTimer'];
 }
 export type PoolLoad = {
     status: 'ready';

package/dist/internal-types/store/refresh-lock.d.ts

@@ -30,6 +30,10 @@ export interface LockEnvironment {
         name: string;
         path: string;
     }, step: LockStep) => void | Promise<void>;
+    onRenewalTimer?: (lock: {
+        name: string;
+        path: string;
+    }, event: 'scheduled' | 'cancelled') => void;
 }
 export interface HeldLock {
     readonly name: string;

package/dist/internal-types/store/schema.d.ts

@@ -49,6 +49,8 @@ export type StoredCredential = (OAuthCredential & {
 /** Quota codec supplied by `/quota`: the store never interprets the map itself. */
 export interface QuotaCodec {
     validate(value: unknown): boolean;
+    /** Normalize persisted quota before validation, when the codec supports it. */
+    decode?(value: unknown): unknown;
     merge(stored: unknown | undefined, observation: unknown): unknown;
 }
 /**

package/dist/native-account-view.d.ts

@@ -42,8 +42,10 @@ export interface NativeAccountSnapshot {
     mode: 'local' | 'claustrum';
     settings: Record<string, unknown>;
     accounts: NativeAccountView[];
-    /** Vault session-to-account assignments use this separate file. Local mode keeps the assignment file at the destination recorded by migration. */
+    /** Vault storage, or the local destination recorded by the authorized migration journal. */
     routingPath?: string;
+    /** Distinct pre-migration routing file that OpenCode local serving may have recreated. */
+    routingRecoveryPath?: string;
     routingSeed?: NativeVaultRoutingSeed;
     /** AccountStorage-shaped input for pure policy predicates, never a credential or persistence authority. */
     policyStorage: AccountStorage;

package/dist/native-settings.d.ts

@@ -0,0 +1,6 @@
+/** Treat malformed or absent settings sections as empty, without accepting arrays. */
+export declare function nativeSettingsRecord(value: unknown): Record<string, unknown>;
+/** Patch one section without replacing unrelated native settings or section fields. */
+export declare function mergeNativeSettingsSection(settings: Readonly<Record<string, unknown>>, section: string, patch: Readonly<Record<string, unknown>>): Record<string, unknown>;
+/** When keep-warm runs continuously, remove any previous start/end hour restriction. */
+export declare function nativeCacheKeepAlways(settings: Readonly<Record<string, unknown>>): Record<string, unknown>;

package/dist/native-usage-publication.d.ts

@@ -6,6 +6,7 @@
 export declare function usagePublicationRefusalIsFatal(error: unknown): boolean;
 /** Own advisory writes for one host instance and join them before runtime close. */
 export declare function createNativeUsagePublisher(channel: string): {
+    observe: (write: Promise<unknown>) => Promise<void>;
     publish(write: () => Promise<unknown>): void;
     drain(): Promise<void>;
 };

package/dist/pool-authority.d.ts

@@ -126,7 +126,7 @@ export declare function readNativeMigrationJournal(paths: NativePoolPaths): Prom
  */
 export declare function nativeMigrationAuthorityPhase(journal: NativeMigrationJournal | undefined): 'committed' | 'retired' | undefined;
 /** An empty or readable store is not proof that the offline authority flip completed. */
-export declare function requireNativePoolAuthority(paths: NativePoolPaths): Promise<void>;
+export declare function requireNativePoolAuthority(paths: NativePoolPaths): Promise<NativeMigrationJournal>;
 interface JournalHooks {
     /** Outer controller and pool leases remain held through the atomic journal rename. */
     assertOwned?: () => Promise<void>;

package/dist/routing.d.ts

@@ -1,4 +1,4 @@
-import { type AccountStorage, type RoutingMode } from './accounts.ts';
+import type { AccountStorage, RoutingMode } from './accounts.ts';
 export declare const CLAUDE_ROUTING_COMMAND_NAME = "claude-routing";
 export declare const ROUTING_MODES: readonly ['main-first', 'fallback-first', 'sticky-balanced'];
 export declare const DEFAULT_ROUTING_MODE: RoutingMode;
@@ -13,7 +13,6 @@ type RoutingCommandAction = {
     type: 'usage';
 };
 export declare function getRoutingMode(storage: AccountStorage | null): RoutingMode;
-export declare function setRoutingMode(mode: RoutingMode, path?: string): Promise<AccountStorage>;
 export declare function parseRoutingCommandAction(argumentsText: string): RoutingCommandAction;
 export declare function buildRoutingStatusSummary(input?: {
     mode?: RoutingMode;

package/dist/sticky-routing.d.ts

@@ -106,15 +106,19 @@ export declare class StickySessionRouter {
         now?: () => number;
         assignmentTtlMs?: number;
         vaultSeed?: NativeVaultRoutingSeed;
+        localRecoveryPath?: string;
     });
     private now;
     private readState;
     private readStateMtimeNs;
     private refreshStateIfChanged;
     private acquireLock;
+    private recoverLocalPins;
+    private fillLocalPins;
     private assignmentIsActive;
     private prune;
     private writeState;
+    private writeResolutionState;
     /** Import legacy session pins only after vault account discovery produces a complete verified roster. No empty routing file is published while that roster is incomplete. */
     prepareLegacySeed(knownRoster?: NativeVaultRosterDocument | null): Promise<void>;
     private logicalAccountId;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/anthropic-auth-core",
-  "version": "2.0.0",
+  "version": "2.0.2",
   "type": "module",
   "repository": {
     "type": "git",
@@ -30,10 +30,12 @@
     "prepublishOnly": "bun run build"
   },
   "devDependencies": {
-    "@cortexkit/common-auth": "0.14.2"
+    "@cortexkit/common-auth": "0.17.0"
   },
   "dependencies": {
-    "@cortexkit/claustrum-client": "0.6.2",
+    "@cortexkit/claustrum-client": "0.9.0",
+    "@cortexkit/private-files": "0.2.1",
+    "@cortexkit/subc-client": "^0.16.0",
     "jsonc-parser": "^3.3.1",
     "xxhash-wasm": "^1.1.0"
   }

package/dist/claustrum-scoped-roster.d.ts

@@ -1,27 +0,0 @@
-import { type AccountStorage, type OAuthAccount } from './accounts.js';
-import type { ClaustrumScopedAccount, ClaustrumScopedCustody } from './claustrum-scoped.js';
-export declare class ClaustrumRosterBusyError extends Error {
-    readonly code = "claustrum_roster_busy";
-    constructor();
-}
-export interface ClaustrumScopedRoster {
-    /** The vault's conventional default record; absent when only labeled accounts exist. */
-    primary?: ClaustrumScopedAccount;
-    accounts: readonly OAuthAccount[];
-    storage: AccountStorage;
-    view: string;
-}
-/** Pure identity projection; callers must serialize discovery before persisting it. */
-export declare function projectClaustrumScopedRoster(storage: AccountStorage, rows: readonly ClaustrumScopedAccount[], view: string, now?: number): ClaustrumScopedRoster;
-/**
- * The lease covers LIST and commit, not just the file write: opaque view hashes
- * cannot tell a delayed old response from a newer one. A lost lease is checked
- * while holding the config lock, before any authoritative membership write.
- * Neither local mode nor a failed list can publish an empty inventory.
- */
-export declare function refreshClaustrumScopedRoster(options: {
-    path: string;
-    custody: Pick<ClaustrumScopedCustody, 'discover'>;
-    signal?: AbortSignal;
-    now?: () => number;
-}): Promise<ClaustrumScopedRoster | undefined>;

package/dist/claustrum-scoped-runtime.d.ts

@@ -1,31 +0,0 @@
-import { type ClaustrumClientOptions } from '@cortexkit/claustrum-client';
-import { type ClaustrumScopedAttempt, type ClaustrumScopedClient } from './claustrum-scoped.js';
-import { type ClaustrumScopedRoster } from './claustrum-scoped-roster.js';
-export { ClaustrumCredentialError as ClaustrumScopedCredentialError } from '@cortexkit/claustrum-client';
-export declare function connectClaustrumScopedClient(options?: ClaustrumClientOptions): Promise<ClaustrumScopedClient>;
-/** Host-owned lifecycle for metadata discovery. Bearer material is never cached. */
-export interface ClaustrumScopedRuntimeOptions {
-    storagePath: string;
-    tokenPath: string;
-    connect: () => Promise<ClaustrumScopedClient>;
-    /** Fired once per discovery change (including the initial snapshot),
-     * keyed by the inventory view digest. Repeat polls with an identical
-     * view do not notify. */
-    onRoster?: (roster: ClaustrumScopedRoster) => void;
-    onError?: () => void;
-    setTimeoutImpl?: typeof setTimeout;
-    clearTimeoutImpl?: typeof clearTimeout;
-    pollIntervalMs?: number;
-}
-export declare class ClaustrumScopedRuntime {
-    #private;
-    constructor(options: ClaustrumScopedRuntimeOptions);
-    snapshot(): ClaustrumScopedRoster | undefined;
-    refresh(): Promise<ClaustrumScopedRoster | undefined>;
-    start(): void;
-    authorize(routeId: string, signal?: AbortSignal): Promise<ClaustrumScopedAttempt>;
-    reportFailure(attempt: ClaustrumScopedAttempt, status: number, source: 'direct' | 'relay_status_field' | 'relay_message_parse'): Promise<void>;
-    fetchQuota(routeId: string, fetchImpl?: typeof fetch): Promise<import("./accounts.js").OAuthQuotaSnapshot>;
-    fetchProfile(routeId: string, fetchImpl?: typeof fetch, signal?: AbortSignal): Promise<import("./accounts.js").OAuthAccountProfile>;
-    close(): void;
-}

package/dist/claustrum-scoped.d.ts

@@ -1,53 +0,0 @@
-import { type ClaustrumClient, type ClaustrumReporterSource, type EnrollmentTokenFile } from '@cortexkit/claustrum-client';
-export type ClaustrumScopedClient = Pick<ClaustrumClient, 'listScoped' | 'getScoped' | 'reportAuthFailureScoped' | 'close'>;
-export interface ClaustrumScopedIdentity {
-    readonly credentialId: string;
-    readonly accountId: string;
-}
-export interface ClaustrumScopedAccount extends ClaustrumScopedIdentity {
-    readonly state: string;
-    readonly email?: string;
-    readonly orgName?: string;
-}
-export interface ClaustrumScopedAttempt extends ClaustrumScopedIdentity {
-    /** Non-enumerable, memory-only bearer. Authorize again for every dispatch/retry. */
-    readonly accessToken: string;
-    readonly recordVersion: number;
-    readonly expiresAtMs: number;
-}
-/** Only a new version of the same account may replace an in-flight 401. */
-export declare function isScopedCredentialRotation(served: ClaustrumScopedAttempt, current: ClaustrumScopedAttempt | undefined): current is ClaustrumScopedAttempt;
-/** Send classes that retry once after a scoped 401, for diagnostics. */
-export type ScopedRetrySite = 'model' | 'model-relay' | 'cachekeep' | 'prime' | 'quota-profile' | 'pi-model' | 'pi-model-relay' | 'pi-cachekeep';
-/** Why a scoped 401 did or did not retry. Never carries credential material. */
-export type ScopedRetryReason = 'rotated' | 'reauthorize-failed' | 'credential-changed' | 'account-changed' | 'version-unchanged';
-/**
- * Decide whether a request that got a 401 should retry with the freshly
- * re-authorized receipt, and record the decision. The vault can refresh a
- * credential between dispatch and the 401; this line is the consumer-side
- * half of that timeline, pairing with the vault's refresh commit instant when
- * a stale report has to be explained. Never logs credential material.
- */
-export declare function decideScopedRetryAfter401(site: ScopedRetrySite, served: ClaustrumScopedAttempt, current: ClaustrumScopedAttempt | undefined): current is ClaustrumScopedAttempt;
-/**
- * Shared OpenCode/Pi scoped read plane. There is intentionally no credential cache,
- * handle fallback, or get single-flight: each outgoing attempt must be authorized
- * by the daemon, including attempts made after a successful earlier request.
- * Enrollment tokens are re-read per operation so operator reissue works on disk.
- */
-export declare class ClaustrumScopedCustody {
-    #private;
-    constructor(options: {
-        client: ClaustrumScopedClient;
-        tokenPath?: string;
-        readToken?: () => Promise<EnrollmentTokenFile>;
-        now?: () => number;
-    });
-    discover(signal?: AbortSignal): Promise<{
-        view: string;
-        accounts: readonly ClaustrumScopedAccount[];
-    }>;
-    authorize(identity: ClaustrumScopedIdentity, signal?: AbortSignal): Promise<ClaustrumScopedAttempt>;
-    reportFailure(attempt: ClaustrumScopedAttempt, status: number, reporterSource: ClaustrumReporterSource): Promise<void>;
-    close(): void;
-}