@cortexkit/anthropic-auth-core 2.0.3 → 2.1.0

package/dist/quota-manager.d.ts

@@ -17,6 +17,13 @@ export type QuotaRefreshResult = {
     /** False when backoff or a cross-process lock served the existing cache. */
     fetched: boolean;
 };
+/**
+ * Why a quota reading is wanted, passed to fetchQuotaSnapshot unchanged.
+ * Vault custody uses it to decide whether insula's background quota cache
+ * may answer instead of a usage GET (see NativeVaultQuotaPurpose); omitted
+ * means poll the provider directly.
+ */
+export type QuotaReadingPurpose = 'background' | 'admission';
 /** Pace a physical usage GET and verify the selected credential is still eligible before sending. */
 export type QuotaRequestDispatch = (send: () => Promise<Response>, revalidate: () => Promise<void>) => Promise<Response>;
 export type QuotaManagerOptions = {
@@ -34,8 +41,17 @@ export type QuotaManagerOptions = {
         kind: 'main' | 'fallback';
         accountId: string | undefined;
         accessToken: string;
+        purpose?: QuotaReadingPurpose;
     }, dispatch: QuotaRequestDispatch) => Promise<OAuthQuotaSnapshot>;
     now?: () => number;
+    /**
+     * Waits before a physical usage GET until the minimum gap since the previous
+     * one has passed. It receives the milliseconds still to wait, measured with
+     * `now`, and is called only when that remainder is positive. Defaults to a
+     * real timer that does not keep the process alive. Tests pass one that
+     * records the requested wait and resolves at once.
+     */
+    pauseBetweenQuotaCalls?: (ms: number) => Promise<void>;
     onMainQuotaFetched?: (quota: OAuthQuotaSnapshot, checkedAt: number, tokenFingerprint: string, fetchStartedAt: number, quotaErrorGeneration: number, quotaErrorClearedAt: number | undefined) => void;
     onApiError?: (error: AccountOperationError, quotaErrorGeneration: number) => void;
     onFallbackQuotaFetched?: (accountId: string, quota: OAuthQuotaSnapshot, checkedAt: number, fetchStartedAt: number) => void;
@@ -66,6 +82,7 @@ export declare class QuotaManager {
     private readonly fetchImpl;
     private readonly fetchQuotaSnapshot;
     private readonly now;
+    private readonly pauseBetweenQuotaCalls;
     private readonly onMainQuotaFetched;
     private readonly onApiError;
     private readonly onFallbackQuotaFetched;
@@ -91,10 +108,10 @@ export declare class QuotaManager {
     clearFallback(accountId: string): void;
     pushMainFromHeaders(mainAccountId: string | undefined, incoming: OAuthQuotaSnapshot): QuotaEntry;
     pushFallbackFromHeaders(accountId: string, incoming: OAuthQuotaSnapshot, account: Pick<OAuthAccount, 'authLineageId'> | undefined): QuotaEntry | null;
-    refreshMain(mainAccountIdOrAccessToken: string | undefined, accessToken?: string, expectedIdentityGeneration?: number): Promise<OAuthQuotaSnapshot>;
-    refreshMainWithMetadata(mainAccountIdOrAccessToken: string | undefined, accessToken?: string, expectedIdentityGeneration?: number): Promise<QuotaRefreshResult>;
-    refreshFallback(accountId: string, accessToken: string, account: Pick<OAuthAccount, 'authLineageId'> | undefined): Promise<OAuthQuotaSnapshot>;
-    refreshFallbackWithMetadata(accountId: string, accessToken: string, account: Pick<OAuthAccount, 'authLineageId'> | undefined): Promise<QuotaRefreshResult>;
+    refreshMain(mainAccountIdOrAccessToken: string | undefined, accessToken?: string, expectedIdentityGeneration?: number, purpose?: QuotaReadingPurpose): Promise<OAuthQuotaSnapshot>;
+    refreshMainWithMetadata(mainAccountIdOrAccessToken: string | undefined, accessToken?: string, expectedIdentityGeneration?: number, purpose?: QuotaReadingPurpose): Promise<QuotaRefreshResult>;
+    refreshFallback(accountId: string, accessToken: string, account: Pick<OAuthAccount, 'authLineageId'> | undefined, purpose?: QuotaReadingPurpose): Promise<OAuthQuotaSnapshot>;
+    refreshFallbackWithMetadata(accountId: string, accessToken: string, account: Pick<OAuthAccount, 'authLineageId'> | undefined, purpose?: QuotaReadingPurpose): Promise<QuotaRefreshResult>;
     refreshAllFallbacks(accounts: OAuthAccount[], resolveAccessToken?: (account: OAuthAccount) => string | undefined): Promise<void>;
     /**
      * Fire-and-forget refresh. Does not await, swallows errors.

package/dist/quotas.d.ts

@@ -1,8 +1,8 @@
-import { formatQuota, type ProjectedQuota, quotaTextParts, quotaWindowParts } from "./internal-types/quota/index.js";
-import type { AccountQuotaWindow, AccountScopedQuotaWindow, AccountStorage, OAuthQuotaSnapshot } from './accounts.ts';
+import { formatQuota, isQuotaStale, type ProjectedQuota, quotaTextParts, quotaWindowParts } from "./internal-types/quota/index.js";
+import type { AccountQuotaWindow, AccountScopedQuotaWindow, AccountStorage, OAuthExtraUsageSnapshot, OAuthQuotaSnapshot, QuotaMoney } from './accounts.ts';
 export declare const CLAUDE_QUOTAS_COMMAND_NAME = "claude-quota";
 export type { QuotaWindowPart } from "./internal-types/quota/index.js";
-export { formatQuota, quotaTextParts, quotaWindowParts };
+export { formatQuota, isQuotaStale, quotaTextParts, quotaWindowParts };
 type DisplayWindow = Omit<AccountQuotaWindow, 'checkedAt'> & {
     checkedAt?: number;
 };
@@ -14,6 +14,22 @@ export type QuotaDisplaySnapshot = Pick<OAuthQuotaSnapshot, 'checkedAt' | 'extra
 };
 /** Adapt every reported window without projecting away other model families. */
 export declare function quotaDisplayProjection(snapshot: QuotaDisplaySnapshot | null | undefined, now: number): ProjectedQuota | undefined;
+export type QuotaMoneyFormat = {
+    /** Leave out the fractional digits, cutting the amount down to whole units. */
+    wholeUnits?: boolean;
+};
+/**
+ * A stored money amount in its own currency, such as `$25.00` or `€1,250.00`.
+ * An amount whose currency the runtime cannot format reads as its raw minor
+ * units and currency code.
+ */
+export declare function formatQuotaMoney(money: QuotaMoney, options?: QuotaMoneyFormat): string;
+/**
+ * The credit amounts shown after the shared credit figure: `$25.00/$100.00`
+ * (spent / monthly limit). Undefined when the limit is zero or either amount
+ * is missing or malformed, so the figure is then shown on its own.
+ */
+export declare function formatCreditAmounts(extraUsage: Partial<OAuthExtraUsageSnapshot> | null | undefined, options?: QuotaMoneyFormat): string | undefined;
 export type QuotaAccountSummary = {
     name: string;
     role: 'main' | 'fallback';

package/dist/request-gzip.d.ts

@@ -0,0 +1,99 @@
+/** Claude Code's own opt-out: `0`/`false` turns gzip off, `1`/`true` forces it. */
+export declare const GZIP_REQUEST_BODIES_ENV = "CLAUDE_CODE_GZIP_REQUEST_BODIES";
+/** How long a persisted latch keeps gzip off. */
+export declare const GZIP_LATCH_TTL_MS: number;
+export type RequestGzipSkipReason = 'version' | 'host' | 'env_off' | 'below_min_size' | 'proxy' | 'mtls' | 'custom_ca' | 'latched_off';
+export type RequestGzipDecision = {
+    gzip: true;
+    forced: boolean;
+} | {
+    gzip: false;
+    reason: RequestGzipSkipReason;
+};
+export type GzipRejectionKind = 'non_anthropic_rejection' | 'invalid_json_at_origin';
+/**
+ * What the caller's transport adds beyond the environment: a proxy, a custom
+ * certificate authority or a client certificate the caller passes to fetch
+ * itself. Claude Code sends uncompressed bodies through any of these.
+ */
+export interface RequestGzipTransport {
+    proxy?: boolean;
+    customCa?: boolean;
+    mtls?: boolean;
+}
+type Env = Record<string, string | undefined>;
+/**
+ * Remembers that a gzipped body was rejected. Any rejection turns gzip off
+ * for this process; a proxy rejection followed by an accepted uncompressed
+ * resend also writes `{latchedAt, status}` to `path`, which keeps gzip off
+ * for seven days in later processes. The file belongs to this plugin, not to
+ * the user's settings. An expired, future-dated or unreadable record is
+ * removed when read.
+ */
+export declare class RequestGzipLatch {
+    #private;
+    readonly path?: string | undefined;
+    readonly now: () => number;
+    constructor(path?: string | undefined, now?: () => number);
+    get latchedThisProcess(): boolean;
+    latchProcess(): void;
+    /** Whether the latch file holds a record younger than seven days (read once). */
+    persistedInEffect(): Promise<boolean>;
+    persist(status: number): Promise<void>;
+}
+/** One latch per storage path, shared by every send path in this process. */
+export declare function getRequestGzipLatch(path?: string): RequestGzipLatch;
+/** The latch file path: `<stem>-request-gzip.json` beside the account storage file. */
+export declare function getRequestGzipLatchPath(accountStoragePath: string): string;
+/** Decide, in Claude Code's order, whether this request body goes out gzipped. */
+export declare function decideRequestGzip(options: {
+    url: string | URL;
+    body: unknown;
+    latch: RequestGzipLatch;
+    env?: Env;
+    transport?: RequestGzipTransport;
+}): Promise<RequestGzipDecision>;
+/** A newline and 0 to 256 random spaces and tabs, as Claude Code appends. */
+export declare function requestGzipPadding(random?: () => number): string;
+/**
+ * The gzipped wire bytes for a signed identity body: `cch` reset to `00000`,
+ * padding appended, one gzip member at level 6. Never sign the result.
+ */
+export declare function encodeGzipRequestBody(identityBody: string, random?: () => number): Promise<Uint8Array>;
+/**
+ * Claude Code's test for a rejected gzipped body: a 400, 403 or 415 that
+ * either did not come from Anthropic (no `req_` request id and no `cf-ray`)
+ * or, for a 400, says the JSON could not be parsed. Any other response,
+ * including an ordinary API 400, is not a gzip problem. Reads at most 8 KiB
+ * from a clone, so the response itself stays unread.
+ */
+export declare function classifyGzipRejection(response: Response): Promise<GzipRejectionKind | null>;
+export interface RequestGzipEvent {
+    decision: RequestGzipDecision;
+    rejection?: {
+        kind: GzipRejectionKind;
+        status: number;
+    };
+    resendStatus?: number;
+    persisted?: boolean;
+}
+/**
+ * Send a signed identity body, gzipped when Claude Code would gzip it.
+ *
+ * `send` performs one physical request with the given body and headers; it is
+ * called once, or twice when the gzipped body is rejected: the second call
+ * gets the identity body and the same headers (same `x-client-request-id`,
+ * same retry count) minus `content-encoding`. That resend is not a retry.
+ */
+export declare function sendWithRequestGzip(options: {
+    url: string | URL;
+    body: string;
+    headers: Headers;
+    send: (body: string | Uint8Array, headers: Headers) => Promise<Response>;
+    latch: RequestGzipLatch;
+    env?: Env;
+    transport?: RequestGzipTransport;
+    random?: () => number;
+    onEvent?: (event: RequestGzipEvent) => void;
+}): Promise<Response>;
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/anthropic-auth-core",
-  "version": "2.0.3",
+  "version": "2.1.0",
   "type": "module",
   "repository": {
     "type": "git",
@@ -30,12 +30,12 @@
     "prepublishOnly": "bun run build"
   },
   "devDependencies": {
-    "@cortexkit/common-auth": "0.18.0"
+    "@cortexkit/common-auth": "0.21.1"
   },
   "dependencies": {
-    "@cortexkit/claustrum-client": "0.9.0",
+    "@cortexkit/claustrum-client": "0.12.0",
     "@cortexkit/private-files": "0.2.1",
-    "@cortexkit/subc-client": "^0.16.0",
+    "@cortexkit/subc-client": "^0.22.0",
     "jsonc-parser": "^3.3.1",
     "xxhash-wasm": "^1.1.0"
   }