@cortexkit/anthropic-auth-core 2.0.2 → 2.1.0

package/dist/accounts.d.ts

@@ -61,6 +61,7 @@ export type ClaustrumConfig = {
         credentialId: string;
         accountId: ProviderAccountUuid;
         state: string;
+        enabled?: boolean;
     };
     /** Preserve explicit exclusions when a vaulted account disappears and returns. */
     disabledAccountIdentities?: string[];
@@ -251,7 +252,13 @@ export type AccountStorage = {
         enabled?: boolean;
         url?: string;
         token?: string;
+        /**
+         * Whether a private relay token is stored. Native account snapshots set
+         * this instead of `token`, which they never include.
+         */
+        tokenConfigured?: boolean;
         fallbackToDirect?: boolean;
+        /** When missing, inferred from `url`; see `effectiveRelayTransport`. */
         transport?: 'http' | 'websocket';
     };
     claustrum?: ClaustrumConfig;
@@ -310,7 +317,6 @@ export declare function acquireRefreshFileLock(options: {
     name: string;
     ttlMs: number;
     path?: string;
-    now?: () => number;
     renew?: boolean;
     renewIntervalMs?: number;
     onStep?: (step: 'stale-marker-stat' | 'stale-marker-claimed' | 'stale-lock-confirmed' | 'eviction-marker-acquired') => void | Promise<void>;

package/dist/cache1h.d.ts

@@ -25,9 +25,11 @@ export declare function parseCache1hCommandAction(argumentsText: string): Cache1
 export declare function buildCache1hStatusSummary(input?: {
     enabled?: boolean;
     mode?: Cache1hMode;
+    settingsPath?: string;
 }): string;
 export declare function executeCache1hCommand(input: {
     argumentsText: string;
     enabled?: boolean;
     mode?: Cache1hMode;
+    settingsPath?: string;
 }): string;

package/dist/cachekeep-registry.d.ts

@@ -9,6 +9,7 @@ export declare class CacheKeepSessionRegistry {
     private readonly options;
     private readonly filePath;
     private writeChain;
+    private lastSweepAt?;
     constructor(options: {
         directory: string;
         now?: () => number;
@@ -18,4 +19,6 @@ export declare class CacheKeepSessionRegistry {
     publish(sessions: readonly CacheKeepTrackedSession[]): Promise<void>;
     list(localSessions?: readonly CacheKeepTrackedSession[]): Promise<CacheKeepTrackedSession[]>;
     dispose(): Promise<void>;
+    private sweepExpiredRecords;
+    private restoreSweptRecord;
 }

package/dist/cachekeep.d.ts

@@ -1,5 +1,6 @@
 import type { AccountStorage } from './accounts.ts';
 import type { CacheKeepTrackedSession } from './cachekeep-registry.ts';
+import { type ProviderErrorSummary } from './provider-error.ts';
 export declare const CLAUDE_CACHE_KEEP_COMMAND_NAME = "claude-cachekeep";
 export declare const CACHE_KEEP_TTL_MS: number;
 export declare const CACHE_KEEP_PREWARM_LEAD_MS: number;
@@ -97,6 +98,7 @@ export type CacheKeepPrewarmResult = {
     reason: string;
     status?: number;
     transient?: true;
+    provider_error?: ProviderErrorSummary['provider_error'];
 };
 export declare class CacheKeepManager {
     private readonly options;

package/dist/cch.d.ts

@@ -1,6 +1,13 @@
 export interface BillingLineageFields {
     previousRequestId?: string;
     promptId?: string;
+    /**
+     * 1-based position of the current user prompt in the conversation. Claude
+     * Code sends it as `cc_prompt_index` and `cc_turn_index` (equal for a turn a
+     * person started) after `cc_turn_origin=human`, and keeps it for every
+     * request that serves the same prompt, tool-result follow-ups included.
+     */
+    promptIndex?: number;
 }
 export declare function isValidAnthropicRequestId(value: string): boolean;
 export declare function isValidBillingPromptId(value: string): boolean;
@@ -40,11 +47,23 @@ export declare function signRequestBody(bodyString: string): Promise<string>;
  * Compute Claude Code's 3-character suffix for cc_version.
  */
 export declare function computeCcVersionSuffix(firstUserText: string, version?: string): string;
+/**
+ * Number of user prompts in a Messages API history: user messages that carry
+ * anything besides tool results. A tool-result message continues the prompt
+ * before it, so the request that answers a tool call keeps that prompt's
+ * position, as Claude Code's `cc_prompt_index` does.
+ */
+export declare function countUserPrompts(messages: unknown): number;
 /**
  * Build the billing header with a cch placeholder.
  * signRequestBody() must run after final request serialization to replace it.
  */
 export declare function buildBillingHeaderValue(messages: Message[], version: string | undefined, entrypoint: string, pinnedFirstUserText?: string, lineage?: BillingLineageFields): string;
+/**
+ * The `cc_prompt_id` in a signed body's billing block, or undefined. Claude
+ * Code also sends this id as the `x-claude-code-prompt-id` header.
+ */
+export declare function extractBillingPromptId(body: Record<string, unknown> | null | undefined): string | undefined;
 /** Remove request-scoped Claude Code lineage from a billing header string. */
 export declare function stripBillingLineageFields(value: string): string;
 /** Remove request-scoped Claude Code lineage before reusing a request body. */

package/dist/claude-code.d.ts

@@ -32,12 +32,18 @@ export declare class ClaudeUnsupportedAccessError extends Error {
 export declare function resolveClaudeCodeAccountIdentity(accessToken: string, model: string | undefined, accountIdentity: string | undefined): Promise<ClaudeCodeIdentity>;
 export declare function buildClaudeCodeMetadataUserId(identity: ClaudeCodeIdentity): string | null;
 export declare function applyClaudeCodeMetadata(body: Record<string, unknown>, identity: ClaudeCodeIdentity): boolean;
-export declare const CLAUDE_CODE_FULL_AGENT_BETAS: readonly ['oauth-2025-04-20', 'interleaved-thinking-2025-05-14', 'thinking-token-count-2026-05-13', 'context-management-2025-06-27', 'prompt-caching-scope-2026-01-05', 'claude-code-20250219', 'advisor-tool-2026-03-01', 'advanced-tool-use-2025-11-20', 'mid-conversation-system-2026-04-07', 'effort-2025-11-24', 'fallback-credit-2026-06-01', 'extended-cache-ttl-2025-04-11', 'cache-diagnosis-2026-04-07'];
-export declare function selectClaudeCodeBetas(body?: Record<string, unknown> | null, extraBetas?: string[]): string;
+export declare const CLAUDE_CODE_FULL_AGENT_BETAS: readonly ['claude-code-20250219', 'oauth-2025-04-20', 'interleaved-thinking-2025-05-14', 'thinking-token-count-2026-05-13', 'context-management-2025-06-27', 'prompt-caching-scope-2026-01-05', 'mid-conversation-tool-changes-2026-07-01', 'advanced-tool-use-2025-11-20', 'mid-conversation-system-clear-at-2026-08-21', 'effort-2025-11-24', 'thinking-binding-controls-2026-08-01', 'thinking-display-updates-2026-08-18', 'extended-cache-ttl-2025-04-11', 'cache-diagnosis-2026-04-07'];
+export declare function selectClaudeCodeBetas(body?: Record<string, unknown> | null, extraBetas?: string[], requestClass?: ClaudeCodeRequestClass): string;
+export type ClaudeCodeRequestClass = 'main' | 'auxiliary';
 export declare function applyClaudeCodeHeaders(headers: Headers, accessToken: string, options?: {
     body?: Record<string, unknown> | null;
     identity?: ClaudeCodeIdentity;
     extraBetas?: string[];
+    /**
+     * Claude Code's `x-claude-code-request-class`: `main` for a conversation
+     * turn, `auxiliary` for background requests such as title generation.
+     */
+    requestClass?: ClaudeCodeRequestClass;
 }): Headers;
 export declare function orderClaudeCodeBody<T extends Record<string, unknown>>(body: T): T;
 export declare function claudeCodeEntrypoint(): string;

package/dist/claustrum-enrollment.d.ts

@@ -1,4 +1,5 @@
 import { type ClaustrumClientOptions as ClaustrumEnrollmentClientOptions, type EnrollmentPollOutcome, type EnrollmentTokenFile, writeEnrollmentTokenFile } from '@cortexkit/claustrum-client';
+import { type OwnerOnlyOptions } from './owner-only.ts';
 export declare const CLAUSTRUM_OPENCODE_ENROLLMENT_NAME = "anthropic-auth-opencode";
 export declare const CLAUSTRUM_PI_ENROLLMENT_NAME = "anthropic-auth-pi";
 export interface ClaustrumEnrollmentClient {
@@ -50,7 +51,10 @@ export interface ClaustrumEnrollmentPaths {
 export declare function getClaustrumEnrollmentPaths(tokenPath: string): ClaustrumEnrollmentPaths;
 /** Resolve the independently enrolled host's owner-only token and state paths. */
 export declare function getHostClaustrumEnrollmentPaths(host: 'opencode' | 'pi', env?: NodeJS.ProcessEnv, cwd?: string): ClaustrumEnrollmentPaths;
-export declare function readClaustrumEnrollmentStatus(paths: ClaustrumEnrollmentPaths, proposedName?: string): Promise<ClaustrumEnrollmentStatus>;
+export declare function refuseWritableAncestor(parent: string, ownership?: OwnerOnlyOptions, metadataAt?: (path: string) => Promise<{
+    mode: number;
+} | undefined>): Promise<void>;
+export declare function readClaustrumEnrollmentStatus(paths: ClaustrumEnrollmentPaths, proposedName?: string, ownership?: OwnerOnlyOptions): Promise<ClaustrumEnrollmentStatus>;
 /** Read fresh bearer material for a scoped operation; never publish this value. */
 export declare function readClaustrumEnrollmentToken(tokenPath: string): Promise<EnrollmentTokenFile>;
 export declare class ClaustrumEnrollmentManager {

package/dist/constants.d.ts

@@ -19,11 +19,23 @@ export declare const CLAUDE_CODE_IDENTITY = "You are Claude Code, Anthropic's of
 export declare const PARALLEL_TOOL_CALLS_SYSTEM_PROMPT: string;
 export declare const CCH_SALT = "59cf53e54c78";
 export declare const CCH_POSITIONS: number[];
-export declare const CLAUDE_CODE_VERSION = "2.1.280";
+export declare const CLAUDE_CODE_VERSION = "2.1.302";
 export declare const CLAUDE_CODE_ENTRYPOINT = "cli";
-export declare const CLAUDE_CODE_STAINLESS_PACKAGE_VERSION = "0.112.1";
+export declare const CLAUDE_CODE_STAINLESS_PACKAGE_VERSION = "0.128.0";
 export declare const CLAUDE_CODE_STAINLESS_RUNTIME_VERSION = "v26.3.0";
-export declare const USER_AGENT = "claude-cli/2.1.280 (external, cli)";
+/**
+ * Whether the emulated Claude Code version gzips request bodies. Claude Code
+ * 2.1.302 compresses every request body of at least
+ * `CLAUDE_CODE_GZIP_MIN_BODY_CHARS` characters that goes straight to
+ * api.anthropic.com, and leaves it uncompressed behind a proxy, a custom CA
+ * or client certificates. A gzipped body carries `cch=00000` and trailing
+ * whitespace padding, which only a gzipping version sends, so this switch
+ * belongs to the version above and must change with it.
+ */
+export declare const CLAUDE_CODE_GZIPS_REQUEST_BODIES = true;
+/** Smallest body, in UTF-16 characters (`string.length`), Claude Code gzips. */
+export declare const CLAUDE_CODE_GZIP_MIN_BODY_CHARS = 4096;
+export declare const USER_AGENT = "claude-cli/2.1.302 (external, cli)";
 export declare const CACHE_1H_MODES: readonly ['explicit', 'automatic', 'hybrid'];
 export type Cache1hMode = (typeof CACHE_1H_MODES)[number];
 export declare const DEFAULT_CACHE_1H_MODE: Cache1hMode;

package/dist/dump.d.ts

@@ -1,3 +1,4 @@
+import type { ProviderErrorSummary } from './provider-error.ts';
 type DumpHeaders = ConstructorParameters<typeof Headers>[0];
 export declare const CLAUDE_DUMP_COMMAND_NAME = "claude-dump";
 export type DumpCommandAction = {
@@ -40,10 +41,12 @@ export declare function sweepDumpDirectory(options: {
 export declare function parseDumpCommandAction(argumentsText: string): DumpCommandAction;
 export declare function buildDumpStatusSummary(input?: {
     enabled?: boolean;
+    settingsPath?: string;
 }): string;
 export declare function executeDumpCommand(input: {
     argumentsText: string;
     enabled?: boolean;
+    settingsPath?: string;
 }): string;
 export declare function dumpDirectRequest(input: {
     affinity?: string | null;
@@ -72,5 +75,6 @@ export declare function dumpResponseArtifact(handle: DumpHandle | null, input: {
     status: number;
     message: unknown;
     complete?: boolean;
+    provider_error?: ProviderErrorSummary['provider_error'];
 }): Promise<void>;
 export {};

package/dist/fast.d.ts

@@ -14,8 +14,10 @@ export declare function resetFastModeState(): void;
 export declare function parseFastModeCommandAction(argumentsText: string): FastModeCommandAction;
 export declare function buildFastModeStatusSummary(input?: {
     enabled?: boolean;
+    settingsPath?: string;
 }): string;
 export declare function executeFastModeCommand(input: {
     argumentsText: string;
     enabled?: boolean;
+    settingsPath?: string;
 }): string;

package/dist/index.d.ts

@@ -1,3 +1,5 @@
+export type { CommandResult, CommandRunner, HostDetection, OpenCodeGeneration, ProcessFence, SetupCallbackContext, SetupDetection, SetupEnvironment, SetupFileSystem, SetupHost, SetupIO, SetupPlugin, SetupResult, } from "./internal-types/setup/index.js";
+export { assertHostsStopped, createProcessFence, runSetup, setupEnrollment, } from "./internal-types/setup/index.js";
 export * from './accounts.ts';
 export * from './auth.ts';
 export * from './cache1h.ts';
@@ -22,15 +24,17 @@ export * from './models.ts';
 export type { NativeAccountRuntime, NativeAccountRuntimeOptions, NativeAccountWriteInput, NativeApiSubject, NativeLocalAuthorizeOptions, NativeRelayUpdate, } from './native-account-runtime.ts';
 export { acquireNativeAccountRuntime, createNativeAccountRuntime, nativeAccountPolicy, } from './native-account-runtime.ts';
 export type { NativeAccountMetadataPatch, NativeAccountSnapshot, NativeAccountView, } from './native-account-view.ts';
-export { formatNativeAccountState } from './native-account-view.ts';
+export { formatNativeAccountState, nativeAccountCanServe, } from './native-account-view.ts';
 export * from './native-credential-validation.ts';
-export type { NativeCustody, NativeCustodyClient, NativeCustodyErrorCode, NativeCustodyIdentity, NativeCustodyInventory, NativeCustodyLogger, NativeCustodyOptions, NativeCustodyReceipt, NativeCustodyReporterSource, NativeCustodyRetry, } from './native-custody.ts';
+export type { NativeCustody, NativeCustodyClient, NativeCustodyErrorCode, NativeCustodyIdentity, NativeCustodyInventory, NativeCustodyLogger, NativeCustodyOptions, NativeCustodyReceipt, NativeCustodyReporterSource, NativeCustodyRetry, NativeRosterWatch, NativeRosterWatchMode, NativeRosterWatchOptions, NativeScopedWatchEnd, NativeScopedWatchHandle, NativeScopedWatchNotice, } from './native-custody.ts';
 export { createNativeCustody, NativeCustodyError } from './native-custody.ts';
 export type { NativeCustodyActivationErrorCode, NativeCustodyActivationHooks, NativeCustodyActivationOptions, NativeCustodyActivationResult, } from './native-custody-activation.ts';
 export { NativeCustodyActivationError, runNativeCustodyActivation, } from './native-custody-activation.ts';
 export { readNativeEnrollmentMode } from './native-enrollment-authority.ts';
 export { inspectNativeHostAuthEntry, NativeHostAuthError, requireNoSupervisedAuthContentSnapshot, } from './native-host-auth.ts';
 export { readNativeHostAuthKind } from './native-host-auth-read.ts';
+export type { NativeHostAuthWriteHooks, NativeHostAuthWriteInput, NativeHostAuthWriteOutcome, } from './native-host-auth-write.ts';
+export { writeNativeHostAuth } from './native-host-auth-write.ts';
 export type { NativeLocalAttributedFailure, NativeLocalCredentialService, NativeLocalCredentialServiceOptions, NativeLocalFailurePolicyInput, } from './native-local-credential-service.ts';
 export { createNativeLocalCredentialService } from './native-local-credential-service.ts';
 export type { NativeLocalExternalPolicy } from './native-local-runtime-readers.ts';
@@ -38,8 +42,9 @@ export type { NativeMenuActionValues, NativeMenuCapabilityOutcome, NativeMenuDis
 export { createNativeMenuExecutor } from './native-menu-executor.ts';
 export type { NativeMenuAction, NativeMenuActionId, NativeMenuCacheMode, NativeMenuChoiceParameter, NativeMenuCommandId, NativeMenuCustodyMode, NativeMenuGroup, NativeMenuGroupId, NativeMenuHost, NativeMenuLogLevel, NativeMenuModel, NativeMenuParameter, NativeMenuParameterId, NativeMenuRefusalCode, NativeMenuRoutingMode, NativeMenuStatus, } from './native-menu-model.ts';
 export { getNativeMenuModel } from './native-menu-model.ts';
-export type { NativeMigrationCustody, NativeMigrationHooks, NativeMigrationOptions, NativeMigrationPreflight, } from './native-migration.ts';
-export { NativeMigrationError, prepareNativeMigration, releaseNativeMigrationPreflight, runNativeMigration, } from './native-migration.ts';
+export type { NativeEmptyInitHooks, NativeEmptyInitOptions, NativeMigrationCustody, NativeMigrationHooks, NativeMigrationOptions, NativeMigrationPreflight, } from './native-migration.ts';
+export { NativeMigrationError, nativePoolHoldsAccountData, prepareNativeMigration, publishNativeEmptyInit, releaseNativeMigrationPreflight, runNativeMigration, snapshotHasServableLocalOAuth, } from './native-migration.ts';
+export * from './native-quota-observations.ts';
 export type { NativeCommittedMaterial, NativeIdentityBootstrap, NativeRefreshContext, NativeRefreshDispatchVersion, NativeRefreshFailure, NativeRefreshHandoff, NativeRefreshObservation, NativeRefreshRequest, NativeRefreshRestriction, NativeRefreshResult, NativeRefreshSubject, NativeServingAdmission, } from './native-refresh-coordinator.ts';
 export type { NativeLocalFailureAttribution, NativeLocalFailurePolicy, NativeLocalFailureSkipReason, } from './native-runtime.ts';
 export { nativeRuntimeOptionIdentity } from './native-runtime-registry.ts';
@@ -51,11 +56,12 @@ export * from './native-usage-publication.ts';
 export { NATIVE_VAULT_NO_ACCOUNT_MESSAGE, NativeVaultNoAccountError, readNativeAccountsForRequest, } from './native-vault-admission.ts';
 export type { NativePiAuthSlot, NativePiAuthSlotErrorCode, NativePiAuthSlotInspection, NativePiAuthSlotOptions, NativeVaultDisconnectOptions, NativeVaultDisconnectResult, } from './native-vault-connection.ts';
 export { disconnectNativeVaultForHost, NativePiAuthSlotError, nativePiAuthSlotPaths, openNativePiAuthSlot, } from './native-vault-connection.ts';
-export type { NativeVaultRuntime, NativeVaultRuntimeOptions, NativeVaultWatch, NativeVaultWatchOptions, } from './native-vault-runtime.ts';
+export type { NativeVaultQuotaPurpose, NativeVaultRuntime, NativeVaultRuntimeOptions, NativeVaultWatch, NativeVaultWatchOptions, } from './native-vault-runtime.ts';
 export { acquireNativeVaultRuntime, createNativeVaultRuntime, discoverNativeVaultInventory, publishNativeVaultRosterSeed, publishNativeVaultRuntimeSeed, } from './native-vault-runtime.ts';
 export * from './oauth-profile.ts';
+export { createWindowsOwnerOnly, ensureWindowsOwnerOnlyDirectory, isOwnerOnly, type OwnerOnlyOptions, } from './owner-only.ts';
 export * from './pkce.ts';
-export type { NativeMigrationJournal } from './pool-authority.ts';
+export type { NativeEmptyInitJournal, NativeLegacyMigrationJournal, NativeMigrationJournal, } from './pool-authority.ts';
 export { nativeMigrationAuthorityPhase, readNativeMigrationJournal, } from './pool-authority.ts';
 export type { NativeLocalPoolBinding } from './pool-binding.ts';
 export { captureNativeLocalPoolBinding } from './pool-binding.ts';
@@ -63,13 +69,14 @@ export * from './pool-paths.ts';
 export * from './pool-store.ts';
 export * from './prime.ts';
 export * from './provider.ts';
-export type { ProviderErrorRedactor, ProviderErrorResponseScope, ProviderResponseMode, ProviderResponseSettlement, } from './provider-error.ts';
-export { createProviderErrorRedactor, createProviderErrorResponseScope, } from './provider-error.ts';
+export type { ProviderErrorRedactor, ProviderErrorResponseScope, ProviderErrorSummary, ProviderResponseMode, ProviderResponseSettlement, } from './provider-error.ts';
+export { createProviderErrorRedactor, createProviderErrorResponseScope, summarizePrewarmProviderError, } from './provider-error.ts';
 export * from './quota-header-feed.ts';
 export * from './quota-headers.ts';
 export * from './quota-manager.ts';
 export * from './quotas.ts';
 export * from './relay.ts';
+export * from './request-gzip.ts';
 export * from './request-history.ts';
 export * from './routing.ts';
 export type { SseEvent, SseFramer, SseFramerOptions } from './sse.ts';